fix(review): evict a manual-review-held sibling from the merge-train gate

[JSONbored]

Summary

• The merge-train FIFO gate (src/review/merge-train.ts, shouldWaitForOlderSiblings) already has
  overlap-scoping (a sibling only blocks when it shares a linked issue or a meaningful changed file)
  and a 24h staleness cap. Neither is the actual gap the confirmed incident (fix(test): add required default field to queue-3 pause commandAuthorization fixture #8735: 57 denials, 5 PRs
  blocked, 4 hours) exposed — overlap-scoping worked exactly as designed (those 5 PRs genuinely
  overlapped fix(test): add required default field to queue-3 pause commandAuthorization fixture #8735), and fix(test): add required default field to queue-3 pause commandAuthorization fixture #8735 was created only ~4h before a human intervened, nowhere near the 24h
  cap. The real gap: the gate has no concept of "this sibling is held for a reason that will never
  self-resolve without a human" — it only ever asked "is this sibling older, overlapping, and not git-
  conflicted," and a PR wearing the manual-review label passed all three, so the gate waited for it
  exactly like an ordinary in-review PR that's still making forward progress.
• Fix: MergeTrainSibling gained a heldForManualReview field, resolved by the caller
  (agent-action-executor.ts) the SAME way the existing live approve/merge guard already resolves
  "does this PR carry the manual-review label" (ctx.manualReviewLabel — null disables it,
  absent/undefined falls back to AGENT_LABEL_NEEDS_REVIEW). A manual-review-held sibling is now
  evicted from the train exactly like a git-conflicted (dirty) one, instead of counting as "still
  viable to eventually clear on its own."
• Wait-bound question: no separate/shorter cap added. Once a manual-review hold is evicted outright,
  the only siblings left for the 24h cap to bound are ones genuinely still in CI/AI-review/human-review
  — i.e. actively making progress toward a natural resolution, not administratively frozen. That's the
  same case the 24h cap was already designed for. A shorter cap on top would mostly just race an
  actively-progressing review, trading a hypothetical extra-fast escape hatch for spurious out-of-order
  merges on PRs that were about to clear on their own. Happy to add one if you disagree, but I don't see
  a concrete failure mode it would close that the eviction fix + existing cap don't already cover.
• Wedge alert: wired a best-effort, flag-gated PagerDuty page when N (5) consecutive merge-train
  denials land against the SAME blocking sibling within an hour — keyed to the blocking PR number
  (owner/repo#merge-train-blocked-by-<N>), not the waiting PR, since the incident denied 5 different
  PR numbers behind the one stuck sibling. Reuses the existing isPagerDutyEnabled /
  triggerPagerDutyIncident helpers verbatim (same min-severity floor + cooldown-via-dedup_key
  ops-wire.ts already relies on for its own "count recent audit rows, page past a threshold" alerting),
  rather than inventing a second alerting mechanism. No-op unless LOOPOVER_ENABLE_PAGERDUTY is set.

Judgment calls (flagging explicitly, not asking mid-task)

• Scoped the eviction to the manual-review label only (the confirmed, concrete incident) and did not
  extend it to mergeBlockedSha/pending-closure (orb(disposition): merge_blocked_sha never clears and mergeAttemptCount never resets — one token blip permanently strands green approved PRs, invisibly #9012/orb(sweep): a PR that goes green during a pause is never re-evaluated after unpause #9018/orb(gate): pending-closure flag can strand a PR when the delayed verify job is lost #9031). Both label checks
  (manual-review, pending-closure) are equally cheap on MergeTrainSibling.labels, but I kept this PR
  to the one confirmed incident to keep the diff, and the coverage surface, tight; a pending-closure
  eviction (also just a label check) looks like a clean, low-risk follow-up if wanted.
  mergeBlockedSha needs real new plumbing (the sibling's live head SHA, not currently fetched/passed)
  and interacts with mergeBlockedUntil's infra-scoped-expiry logic (merge-failure.ts), so it's a
  bigger, separate change.
• Wedge-alert threshold (5 denials / 1h window): chosen well below the confirmed incident's scale (57
  denials / 4h) so a real wedge pages inside its first hour, but above 1 so a single denial that clears
  in seconds (the other observed train-wait episode, behind fix(miner): reject a portfolio-queue identifier containing the '::' composite-id separator (#8857) #8925, cleared in 20s) never pages.
• Committed as a single commit rather than two, since the eviction fix and the wedge alert share the
  same call site (agent-action-executor.ts's step 8b) and splitting them after the fact risked an
  inconsistent intermediate state; both are fully tested together.

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• Closes orb(merge-train): a blocked head-of-line PR stalls every PR behind it — 5 PRs blocked 4h behind one manual-review label #9039 (see below).

Validation

• git diff --check
• npm run actionlint (not run — no workflow files touched)
• npm run typecheck (npx tsc --noEmit -p tsconfig.json --incremental false, clean)
• npm run test:coverage locally, scoped: test/unit/merge-train.test.ts (31/31) +
  test/unit/agent-action-executor.test.ts (211/211) = 242/242 passing; v8 coverage on the two
  touched src/** files is 100% branch/line on merge-train.ts and every new line/branch in
  agent-action-executor.ts is covered (the file's only uncovered lines are pre-existing, in an
  unrelated function this PR does not touch).
• npm run test:workers (not run — no Worker-specific surface touched)
• npm run build:mcp / npm run test:mcp-pack (not run — no MCP surface touched)
• npm run ui:openapi:check (not run — no route/schema change)
• npm run ui:lint / npm run ui:typecheck / npm run ui:build (not run — no UI change)
• npm audit --audit-level=moderate was not re-run in this pass (no dependency changes)
• New behavior has unit/integration tests for new branches, fallback paths (see below)

If any required check was skipped, explain why:

• Full local gate (npm run test:ci) intentionally not run per this task's own instructions — scoped
  to typecheck + the touched test files instead. This PR is backend-only (src/review, src/services,
  test/unit), so the UI/MCP/worker/OpenAPI checks above are not applicable to this diff.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private
  rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or
  optimization tactics.
• No auth/cookie/CORS/GitHub App/Cloudflare/session changes.
• No API/OpenAPI/MCP behavior changed.
• No UI changes.
• No public docs/changelog changes (correctly not touching CHANGELOG.md).

UI Evidence

N/A — backend-only change, no visible UI/frontend/docs surface.

Notes

• Regression test reproducing the confirmed incident's exact shape lives in
  test/unit/agent-action-executor.test.ts, describe block "manual-review eviction (orb(merge-train): a blocked head-of-line PR stalls every PR behind it — 5 PRs blocked 4h behind one manual-review label #9039 — confirmed
  fix(test): add required default field to queue-3 pause commandAuthorization fixture #8735 incident: 57 denials, 5 PRs blocked 4h)": an older, overlapping, manual-review-labeled sibling
  no longer blocks — the newer PR merges normally in enforce mode.
• Also fixed the module header comment in merge-train.ts, which explicitly documented the OLD (now
  incorrect) behavior — "An overlapping older sibling DOES still count as a blocker even while held for
  manual review" — so a future reader isn't misled by a stale rationale.

Closes #9039

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

❌ 4 Tests Failed:

Tests completed	Failed	Passed	Skipped
22159	4	22155	21

View the top 3 failed test(s) by shortest run time

test/integration/orb-relay.test.ts > POST /v1/orb/relay/pull > REGRESSION (#4995): a DB error inside validateOrbRelayEnrollment's own lookup ALSO returns a clean 503 broker_error, not a framework 500 (the earlier of the two DB-touching calls in this handler)

Stack Traces | 0.0122s run time

AssertionError: expected 500 to be 503 // Object.is equality

- Expected
+ Received

- 503
+ 500

 ❯ test/integration/orb-relay.test.ts:1160:24

test/integration/orb-onboarding.test.ts > Central Orb installation registry routes (/v1/internal/orb/installations) > tolerates a list query that omits results (rows.results ?? [])

Stack Traces | 0.0238s run time

SyntaxError: Unexpected token 'I', "Internal S"... is not valid JSON
 ❯ test/integration/orb-onboarding.test.ts:57:14

test/integration/orb-ingest.test.ts > Orb instance registry routes (/v1/internal/orb/instances) > tolerates a list query that omits results (rows.results ?? [])

Stack Traces | 0.0263s run time

SyntaxError: Unexpected token 'I', "Internal S"... is not valid JSON
 ❯ test/integration/orb-ingest.test.ts:427:14

test/integration/orb-relay.test.ts > POST /v1/orb/relay/register > REGRESSION (#4995): a DB error inside validateOrbRelayEnrollment's own lookup ALSO returns a clean 503 broker_error, not a framework 500 (the earlier of the two DB-touching calls in this handler)

Stack Traces | 0.092s run time

AssertionError: expected 500 to be 503 // Object.is equality

- Expected
+ Received

- 503
+ 500

 ❯ test/integration/orb-relay.test.ts:155:24

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}