@nanobpm/nano-workforce 0.103.0 → 0.105.0

package/app/durableResume.ts

@@ -0,0 +1,141 @@
+// nano-workforce — the `durable-resume` ENROLMENT GATE (issue #325, ADR 0062 Slice 5/5).
+//
+// Durable agent-session resume splits into two halves already landed by the earlier slices: the MIND
+// (the harness conversation — Slices 1–3, restored harness-side via `session/load` / native
+// `--resume`) and the WORLD (the git working tree + irreversible effect ledger — Slice 4,
+// `app/world`, restored by inverting the round's `git push` into `git fetch && git checkout <sha>`).
+// This slice is the INTEGRATION that wires both halves into the running orchestration, behind an
+// enrolment gate, so a re-leased `senior:pr-review` round (ADR 0002 lease-expiry redrive) RESUMES at
+// the last push-checkpoint on a participating harness and gracefully DEGRADES — redriven from scratch,
+// exactly as today — on a harness that does not advertise durable-resume.
+//
+// THE GATE (ADR 0056 §7). `durable-resume` is a WORKER ATTRIBUTE declared at ENROLMENT — never a
+// routing token. The routing token `network.role#seat` is unchanged; there is no BPMN change and no
+// job-type change. A worker's harness advertises durable-resume at enrol (the probe result from Slice
+// 2/3); this registry records that per instance so the app can ask, before it emits the world-restore
+// marker, "does the fleet serving this role include a participant?".
+//
+// WHY FLEET-LEVEL. At the moment the app emits the repo-provisioning envelope it does not yet know
+// WHICH worker will lease the `senior:pr-review` job — any worker enrolled for that role may. So the
+// gate is a fleet-level existence probe ({@link DurableResumeRegistry.anyParticipant}). This is
+// well-defined for a MIXED fleet: emitting the world-restore `commitSha` when at least one participant
+// is enrolled lets a participant RESUME, while a non-participant harness simply ignores the marker
+// (the envelope validators are structurally forward-compatible) and clones the head branch tip —
+// redriving from scratch. When NO participant is enrolled the marker is omitted entirely, so nothing
+// regresses: resume is purely additive.
+//
+// Advisory, app-tier only (ADR 0056): this registry NEVER hard-locks or gates a BPMN sequence flow —
+// it only decides whether an OPTIMISATION (world-restore) is offered inside an activation.
+import type { DataLayer } from "@nanobpm/urban";
+
+/**
+ * The canonical name of the durable-resume enrolment attribute. A worker advertises it at enrol; the
+ * registry records it here. It is an ENROLMENT gate (ADR 0056 §7), never a routing token — do not put
+ * it in `network.role#seat`.
+ */
+export const DURABLE_RESUME_ATTR = "durable-resume";
+
+/** A persisted enrolment row (`worker_durable_resume`): one worker instance's durable-resume flag. */
+interface WorkerDurableResumeRow {
+  instance: string;
+  durable_resume: number;
+  updated_at: string;
+}
+
+/** True when `err` is the durable PRIMARY KEY fence firing — a SQLite `UNIQUE constraint failed`
+ * raised because a concurrent/duplicate enrol inserted the SAME instance BETWEEN our `findOne` and our
+ * `insert`. `recordEnrolment` is an upsert, so a collision means "the row now exists" — the same
+ * intended outcome as the update branch, not a surfaced error. Matched on the message substring the
+ * RAD `Table` surface propagates verbatim (mirrors `WorldStore`), because that surface hides the
+ * concrete driver error type. */
+function isFenceCollision(err: unknown): boolean {
+  return err instanceof Error && /UNIQUE constraint failed/i.test(err.message);
+}
+
+/**
+ * The durable registry of per-worker durable-resume participation, over the `worker_durable_resume`
+ * table (`db/migrations/052_worker_durable_resume.sql`). Backed by the app's SQLite DataLayer through
+ * the RAD `Table<T>` surface (`data.table(...)`) — NOT hand-written SQL — mirroring `WorldStore`.
+ */
+export class DurableResumeRegistry {
+  readonly #data: DataLayer;
+
+  constructor(data: DataLayer) {
+    this.#data = data;
+  }
+
+  #table() {
+    return this.#data.table<WorkerDurableResumeRow>("worker_durable_resume", "instance");
+  }
+
+  /** Canonicalise an instance key: trim surrounding whitespace and reject a blank one. The instance is
+   * the table PRIMARY KEY and drives the fleet-wide gate via {@link anyParticipant}, so a whitespace or
+   * differently-trimmed key would create an unreachable row — or, worse, open the gate on a blank key.
+   * Normalising here makes every registry entry point safe by default rather than relying on each call
+   * site to pre-trim. Returns the trimmed key, or `undefined` when it is empty/whitespace. */
+  static #normaliseInstance(instance: string): string | undefined {
+    const trimmed = instance.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+  }
+
+  /**
+   * Record a worker's durable-resume participation at enrolment (an idempotent UPSERT keyed by
+   * `instance`). A re-enrol overwrites the flag so a harness that gains — or loses — durable-resume
+   * support across a redeploy is reflected. The `findOne`-then-insert is racy under a concurrent
+   * duplicate enrol, so a PRIMARY KEY fence collision folds into the update path rather than surfacing
+   * as an error (the same end-state either way). A blank/whitespace `instance` is ignored (no-op) — it
+   * cannot key a reachable row and a blank key would let unrelated workers collide on one registry row.
+   */
+  async recordEnrolment(instance: string, durableResume: boolean): Promise<void> {
+    const key = DurableResumeRegistry.#normaliseInstance(instance);
+    if (key === undefined) return;
+    const table = this.#table();
+    const now = new Date().toISOString();
+    const flag = durableResume ? 1 : 0;
+    const existing = await table.findOne({ instance: key });
+    if (existing) {
+      await table.update(key, { durable_resume: flag, updated_at: now });
+      return;
+    }
+    try {
+      await table.insert({ instance: key, durable_resume: flag, updated_at: now });
+    } catch (err) {
+      if (!isFenceCollision(err)) throw err;
+      await table.update(key, { durable_resume: flag, updated_at: now });
+    }
+  }
+
+  /** Whether a specific worker instance is a durable-resume participant. `false` for an unknown
+   * instance (never enrolled) or a blank/whitespace key — the safe default (graceful degradation). */
+  async isParticipant(instance: string): Promise<boolean> {
+    const key = DurableResumeRegistry.#normaliseInstance(instance);
+    if (key === undefined) return false;
+    const row = await this.#table().findOne({ instance: key });
+    return row?.durable_resume === 1;
+  }
+
+  /** Whether the enrolled fleet includes AT LEAST ONE durable-resume participant — the fleet-level
+   * gate the world-restore emission consults. `false` when none is enrolled (nobody advertises
+   * durable-resume), so the resume marker is omitted and the round redrives from scratch. */
+  async anyParticipant(): Promise<boolean> {
+    const row = await this.#table().findOne({ durable_resume: 1 });
+    return row != null;
+  }
+}
+
+/**
+ * Whether the fleet supports durable resume — the app-tier gate for emitting the world-restore
+ * `commitSha` (see `app/service.ts`). Best-effort: any read failure (a legacy DB predating migration
+ * 052, an in-flight desync) degrades to `false`, so the round redrives from scratch rather than
+ * blocking a submit/merge on the enrolment registry. When no data layer is mounted it is likewise
+ * `false` — resume is purely additive, so its absence is always the safe direction.
+ */
+export async function fleetSupportsDurableResume(data: DataLayer | undefined): Promise<boolean> {
+  if (!data) return false;
+  try {
+    return await new DurableResumeRegistry(data).anyParticipant();
+  } catch (err) {
+    console.warn(`[durable-resume] fleet participation read: ${err}`);
+    return false;
+  }
+}

package/app/migration052.test.ts

@@ -0,0 +1,66 @@
+// Regression guard for migration 052 (issue #325, ADR 0062 Slice 5/5): the durable `durable-resume`
+// enrolment registry. The table is FK-free (enrolment is per-worker and connection-agnostic, with no
+// `pull_requests`/`plans` parent), the `instance` PRIMARY KEY makes `recordEnrolment` an idempotent
+// upsert, and `CHECK(durable_resume IN (0,1))` pins the gate's boolean domain.
+import { readFileSync } from "node:fs";
+import { DatabaseSync } from "node:sqlite";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+import { assertEquals, assertThrows } from "#test-assert";
+
+function migratedDb(): DatabaseSync {
+  const db = new DatabaseSync(":memory:");
+  db.exec("PRAGMA foreign_keys = ON;");
+  // Deliberately NO parent tables — the enrolment table must apply and accept rows on a bare db.
+  const sql = readFileSync(fileURLToPath(new URL("../db/migrations/052_worker_durable_resume.sql", import.meta.url)), "utf8");
+  db.exec(sql);
+  return db;
+}
+
+const upsert = (db: DatabaseSync, instance: string, flag: number) =>
+  db
+    .prepare(
+      `INSERT INTO worker_durable_resume (instance, durable_resume, updated_at) VALUES (?, ?, 't')
+       ON CONFLICT(instance) DO UPDATE SET durable_resume = excluded.durable_resume`,
+    )
+    .run(instance, flag);
+
+test("migration 052 applies cleanly with NO parent tables (FK-free) and records an enrolment", () => {
+  const db = migratedDb();
+  upsert(db, "w1", 1);
+  const row = db.prepare("SELECT instance, durable_resume FROM worker_durable_resume WHERE instance = ?").get("w1") as {
+    instance: string;
+    durable_resume: number;
+  };
+  assertEquals(row.instance, "w1");
+  assertEquals(row.durable_resume, 1);
+});
+
+test("instance PRIMARY KEY makes a re-enrol an upsert (one row per worker, latest flag wins)", () => {
+  const db = migratedDb();
+  upsert(db, "w1", 1);
+  upsert(db, "w1", 0);
+  const count = Number((db.prepare("SELECT COUNT(*) c FROM worker_durable_resume").get() as { c: number }).c);
+  assertEquals(count, 1, "no duplicate row for one instance");
+  const row = db.prepare("SELECT durable_resume FROM worker_durable_resume WHERE instance = 'w1'").get() as { durable_resume: number };
+  assertEquals(row.durable_resume, 0, "the latest enrolment flag wins");
+});
+
+test("durable_resume defaults to 0 (a non-participant) when unset", () => {
+  const db = migratedDb();
+  db.prepare("INSERT INTO worker_durable_resume (instance, updated_at) VALUES ('w1', 't')").run();
+  const row = db.prepare("SELECT durable_resume FROM worker_durable_resume WHERE instance = 'w1'").get() as { durable_resume: number };
+  assertEquals(row.durable_resume, 0);
+});
+
+test("CHECK(durable_resume IN (0,1)): the gate's boolean domain is pinned at the schema", () => {
+  const db = migratedDb();
+  assertThrows(
+    () => db.prepare("INSERT INTO worker_durable_resume (instance, durable_resume, updated_at) VALUES ('w1', 2, 't')").run(),
+    undefined,
+    "CHECK constraint failed",
+  );
+  upsert(db, "yes", 1);
+  upsert(db, "no", 0);
+  assertEquals(Number((db.prepare("SELECT COUNT(*) c FROM worker_durable_resume").get() as { c: number }).c), 2);
+});

package/app/migration053.test.ts

@@ -0,0 +1,84 @@
+// Regression guard for migration 053 (#352, PR #354 review — suppressed advisory on app/service.ts:867):
+// the DB-level fence that makes `abandonClosedPr`'s terminal audit write TRULY idempotent under a
+// concurrent race, not merely best-effort. The partial `UNIQUE INDEX ux_merges_abandon_pr_closed ON
+// merges(pr_key) WHERE outcome='abandoned' AND method='pr-closed'` IS the fence: the merge worker and
+// the wave-gate self-heal path can both observe "no row" between the guard's `find` and its `insert`
+// and both attempt the write, and this index is what turns the loser's insert into a catchable
+// `UNIQUE constraint failed` instead of a duplicate audit row.
+import { readFileSync } from "node:fs";
+import { DatabaseSync } from "node:sqlite";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+import { assert, assertEquals, assertThrows } from "#test-assert";
+
+// The `merges` audit table as created by 004_merge.sql, minus the `pull_requests` FK parent (this
+// test proves the index behaviour in isolation, exactly as migration049.test.ts hosts the world
+// tables FK-free). Then apply 053 on top.
+function migratedDb(): DatabaseSync {
+  const db = new DatabaseSync(":memory:");
+  db.exec(`CREATE TABLE merges (
+    id       INTEGER PRIMARY KEY AUTOINCREMENT,
+    pr_key   TEXT NOT NULL,
+    outcome  TEXT NOT NULL,
+    method   TEXT,
+    detail   TEXT,
+    at       TEXT NOT NULL
+  );`);
+  const sql = readFileSync(fileURLToPath(new URL("../db/migrations/053_merges_abandon_dedupe.sql", import.meta.url)), "utf8");
+  db.exec(sql);
+  return db;
+}
+
+const insertAbandon = (db: DatabaseSync, prKey: string) =>
+  db
+    .prepare("INSERT INTO merges (pr_key, outcome, method, detail, at) VALUES (?, 'abandoned', 'pr-closed', 'd', 't')")
+    .run(prKey);
+
+test("migration 053 applies cleanly and enforces one abandoned/pr-closed row per pr_key", () => {
+  const db = migratedDb();
+  insertAbandon(db, "o/r#1");
+  // The race: a second observer inserting the SAME abandoned/pr-closed row now hits the fence.
+  assertThrows(() => insertAbandon(db, "o/r#1"), undefined, "UNIQUE constraint failed");
+  assertEquals(
+    Number((db.prepare("SELECT COUNT(*) c FROM merges WHERE pr_key='o/r#1'").get() as { c: number }).c),
+    1,
+    "the loser's duplicate was rejected — one terminal audit row survives",
+  );
+  // A DIFFERENT PR's abandon is independent — the index is per pr_key, not global.
+  insertAbandon(db, "o/r#2");
+  assertEquals(Number((db.prepare("SELECT COUNT(*) c FROM merges").get() as { c: number }).c), 2);
+});
+
+test("migration 053 only fences abandoned/pr-closed rows — merged/queued/blocked still repeat freely", () => {
+  const db = migratedDb();
+  const insertMerged = () =>
+    db.prepare("INSERT INTO merges (pr_key, outcome, method, detail, at) VALUES ('o/r#3','merged','squash','d','t')").run();
+  // A PR can carry several `merged` audit rows (retry / already-merged short-circuit) — the partial
+  // index must NOT constrain them (mergesPerDay dedupes with COUNT(DISTINCT pr_key)).
+  insertMerged();
+  insertMerged();
+  assertEquals(Number((db.prepare("SELECT COUNT(*) c FROM merges WHERE outcome='merged'").get() as { c: number }).c), 2);
+  // An abandoned row with a DIFFERENT method is also outside the partial predicate.
+  db.prepare("INSERT INTO merges (pr_key, outcome, method, detail, at) VALUES ('o/r#3','abandoned','other','d','t')").run();
+  db.prepare("INSERT INTO merges (pr_key, outcome, method, detail, at) VALUES ('o/r#3','abandoned','other','d','t')").run();
+  assertEquals(Number((db.prepare("SELECT COUNT(*) c FROM merges WHERE method='other'").get() as { c: number }).c), 2);
+});
+
+test("migration 053 collapses pre-existing duplicate abandoned/pr-closed rows, keeping the earliest", () => {
+  // Simulate a database where the pre-fence race already wrote duplicates, then apply the migration.
+  const db = new DatabaseSync(":memory:");
+  db.exec(`CREATE TABLE merges (
+    id INTEGER PRIMARY KEY AUTOINCREMENT, pr_key TEXT NOT NULL, outcome TEXT NOT NULL,
+    method TEXT, detail TEXT, at TEXT NOT NULL);`);
+  db.prepare("INSERT INTO merges (pr_key,outcome,method,detail,at) VALUES ('o/r#9','abandoned','pr-closed','first','t')").run();
+  db.prepare("INSERT INTO merges (pr_key,outcome,method,detail,at) VALUES ('o/r#9','abandoned','pr-closed','dup','t')").run();
+  db.prepare("INSERT INTO merges (pr_key,outcome,method,detail,at) VALUES ('o/r#8','abandoned','pr-closed','solo','t')").run();
+  const sql = readFileSync(fileURLToPath(new URL("../db/migrations/053_merges_abandon_dedupe.sql", import.meta.url)), "utf8");
+  db.exec(sql); // dedupe + create index; must not throw despite the pre-existing duplicate
+  const rows = db.prepare("SELECT pr_key, detail FROM merges ORDER BY pr_key").all() as { pr_key: string; detail: string }[];
+  assertEquals(rows.length, 2, "the duplicate for o/r#9 was collapsed");
+  assert(
+    rows.some((r) => r.pr_key === "o/r#9" && r.detail === "first"),
+    "the EARLIEST (MIN(id)) row survived the collapse",
+  );
+});

package/app/plan.ts

@@ -181,6 +181,12 @@ export const PLAN_TASK_STATUSES = [
   "skipped",
   "escalated",
   "waiting-for-lane",
+  // Terminal: the task's PR was closed on GitHub without merging (abandoned / superseded /
+  // perpetually conflicting). Set by the canonical abandon writer (`abandonClosedPr`, app/service.ts)
+  // reached from BOTH the merge stage and the wave-merge gate. An `abandoned` task drops out of
+  // `waveMergeTargets` (so a dead member never wedges the wave barrier — #352) and stops
+  // `isPlanComplete`/the Epics table counting a phantom open task.
+  "abandoned",
 ] as const;
 export type PlanTaskStatus = typeof PLAN_TASK_STATUSES[number];
 

package/app/retro.test.ts

@@ -166,6 +166,17 @@ test("gatherRetro: separates learnings from notes and folds in deltas", async ()
   assertEquals(d.repo, "acme/widgets");
 });
 
+test("gatherRetro: uses pre-fetched blackboard entries instead of re-scanning", async () => {
+  const { data, stores } = memData();
+  seedPlan(stores);
+  // A learning lives in the store, but the caller passes an EMPTY pre-fetched snapshot — gatherRetro
+  // must honour what it was handed and not re-read the store.
+  await appendEntry(data, PLAN, { author_task: "t1", kind: "learning", body: "should be ignored" });
+  const d = await gatherRetro(data, PLAN, []);
+  assertEquals(d.counts.learnings, 0);
+  assertEquals(d.notes.length, 0);
+});
+
 test("gatherRetro: folds in the plan-review trace and task-outcome shape", async () => {
   const { data, stores } = memData();
   seedPlan(stores);
@@ -382,11 +393,13 @@ test("maybeStartRetro: bails while the plan is incomplete", async () => {
   assertEquals(stores["plans"][0].retro_started_at, null, "must not stamp an incomplete plan");
 });
 
-test("maybeStartRetro: complete but empty → records a skipped retro, does not start the process", async () => {
+test("maybeStartRetro: complete but nothing landed (PR abandoned) → records a skipped retro, does not start", async () => {
   const { data, stores } = memData();
   seedPlan(stores);
+  // The only task's PR was abandoned: the plan is complete (abandoned is terminal) but shipped no
+  // code, so there is neither reflection material nor an implementation to audit.
   seedTask(stores, { id: "t1", status: "opened", pr_key: "acme/widgets#10" });
-  seedPr(stores, "acme/widgets#10", "merged");
+  seedPr(stores, "acme/widgets#10", "abandoned");
   const { engine, started } = fakeEngine();
 
   const r = await maybeStartRetro(data, engine, "acme/widgets#10");
@@ -397,6 +410,23 @@ test("maybeStartRetro: complete but empty → records a skipped retro, does not
   assertEquals(stores["plan_retros"][0].status, "skipped");
 });
 
+test("maybeStartRetro: complete with landed code but no learnings → still starts (conformance has something to verify)", async () => {
+  const { data, stores } = memData();
+  seedPlan(stores);
+  // A merged PR but zero learnings/deltas/notes: the retro digest is empty, but there IS delivered
+  // implementation to audit for conformance — so the process must still start.
+  seedTask(stores, { id: "t1", status: "opened", pr_key: "acme/widgets#10" });
+  seedPr(stores, "acme/widgets#10", "merged");
+  const { engine, started } = fakeEngine();
+
+  const r = await maybeStartRetro(data, engine, "acme/widgets#10");
+  assertEquals(r.started, true);
+  assertEquals(r.planKey, PLAN);
+  assertEquals(started.length, 1);
+  assertEquals(started[0].processDefinitionId, "retro");
+  assert(stores["plans"][0].retro_started_at, "retro_started_at must be stamped");
+});
+
 test("maybeStartRetro: a rejected review round alone is enough to fire the retro", async () => {
   const { data, stores } = memData();
   seedPlan(stores);

package/app/retro.ts

@@ -14,7 +14,8 @@
 // Data access goes through the record gateway (`data.table`), never hand-written SQL — matching
 // app/plan.ts, app/blackboard.ts, and app/taskDelta.ts.
 import type { DataLayer, EngineClient, Logger } from "@nanobpm/urban";
-import { isUniqueViolation, readBlackboard } from "./blackboard.ts";
+import { type BlackboardEntry, isUniqueViolation, readBlackboard } from "./blackboard.ts";
+import { hasDeliveredImplementationForPlan } from "./conformance.ts";
 import { TERMINAL_STATUSES } from "./delivery.ts";
 import { planReviews, planTasks } from "./plan.ts";
 import { aggregateEpicDeltas } from "./taskDelta.ts";
@@ -110,14 +111,22 @@ export interface RetroDigest {
 /** Gather a plan's reflection material: the `learning` blackboard entries (the headline), plus the
  * task-delta rollup (contract changes, discovered constraints, cross-slice file touches), the
  * plan-review trace (rounds + rejection findings), the task-outcome shape, and any other
- * non-learning blackboard notes for colour. Reads only — no writes. */
-export async function gatherRetro(data: DataLayer, planKey: string): Promise<RetroDigest> {
+ * non-learning blackboard notes for colour. Reads only — no writes.
+ *
+ * `entries` lets a caller that has already scanned the blackboard for this plan (e.g.
+ * `pr.retro-gather`, which also runs {@link gatherConformance}) pass those entries in so the plan is
+ * scanned once, not once per gatherer — see workers/retro-gather. Omitted, it reads them itself. */
+export async function gatherRetro(
+  data: DataLayer,
+  planKey: string,
+  entries?: BlackboardEntry[],
+): Promise<RetroDigest> {
   const plan = await plansTbl(data).get(planKey);
-  const entries = await readBlackboard(data, planKey);
-  const learnings = entries
+  const bbEntries = entries ?? (await readBlackboard(data, planKey));
+  const learnings = bbEntries
     .filter((e) => e.kind === "learning")
     .map((e) => ({ author_task: e.author_task, body: e.body, created_at: e.created_at }));
-  const notes = entries
+  const notes = bbEntries
     .filter((e) => e.kind !== "learning")
     .map((e) => ({ author_task: e.author_task, kind: e.kind, body: e.body }));
   const deltas = await aggregateEpicDeltas(data, planKey);
@@ -310,12 +319,19 @@ export async function maybeStartRetro(
     if (!(await isPlanComplete(data, planKey))) return { started: false, planKey, reason: "incomplete" };
 
     const digest = await gatherRetro(data, planKey);
-    if (isDigestEmpty(digest)) {
+    // The retro digest can be empty (no learnings/deltas/notes, cleanly-approved plan) yet the epic
+    // still shipped real code — in which case conformance has something to verify even though the
+    // lessons agent has nothing to distil. So run whenever there is EITHER reflection material OR
+    // landed implementation to audit; only truly skip when there is neither. The landed-implementation
+    // probe is gathered lazily (only when the digest is empty) and via the lightweight
+    // hasDeliveredImplementationForPlan — which inspects only plan_tasks + PR status, with no
+    // blackboard scan — so we avoid discarded DB work on every terminal-PR event.
+    if (isDigestEmpty(digest) && !(await hasDeliveredImplementationForPlan(data, planKey))) {
       if (!(await claimRetroStart(data, planKey))) return { started: false, planKey, reason: "already-started" };
-      // Nothing to reflect on — stamp anyway so we don't re-check on every future terminal PR of a
-      // (now settled) plan, and record a skipped retro for visibility.
+      // Nothing to reflect on and nothing shipped to verify — stamp anyway so we don't re-check on
+      // every future terminal PR of a (now settled) plan, and record a skipped retro for visibility.
       await plansTbl(data).update(planKey, { retro_started_at: now(), updated_at: now() });
-      await recordRetro(data, planKey, { status: "skipped", summary: "No learnings, deltas, or notes to retrospect." });
+      await recordRetro(data, planKey, { status: "skipped", summary: "No learnings, deltas, notes, or landed implementation to retrospect." });
       return { started: false, planKey, reason: "nothing-to-retro" };
     }