do not merge() new updates unless they are NEW or RESERVED (#20)

a request may only enter the state machine as NEW or RESERVED
this fixes a fundamental error that was causing all sorts of problems