@nanobpm/nano-workforce 0.121.0 → 0.123.0

package/app/service.ts

@@ -31,7 +31,7 @@ import { deriveDelivery, TERMINAL_STATUSES } from "./delivery.ts";
 import { deliveryGraphRuns, deriveDeliveryPhase, parseHumanLabels } from "./deliveryGraphRun.ts";
 import { isDeliveryHumanElement } from "./deliveryHuman.ts";
 import { fleetSupportsDurableResume } from "./durableResume.ts";
-import { backfillFeatureStages, deriveFeatureDelivery, FEATURE_BLOCKED_ELEMENT, FEATURE_ESCALATION_ELEMENT, FEATURE_RUN_STATUSES, type FeatureRunStatus, featureEscalations, featureRuns } from "./feature.ts";
+import { deriveFeatureDelivery, FEATURE_BLOCKED_ELEMENT, FEATURE_ESCALATION_ELEMENT, FEATURE_RUN_STATUSES, type FeatureRunStatus, featureEscalations, featureRuns } from "./feature.ts";
 import {
   classifyMergeability,
   classifyPrLiveness,
@@ -52,19 +52,18 @@ import {
 import { pollLineage } from "./lineage.ts";
 import { mergeLanes, readExclusions } from "./mergeExclusion.ts";
 import { freshHeadRunAction, headRunPresenceCount, loadMergeProtocol } from "./mergeProtocol.ts";
-import { pollMergesPerDay } from "./mergesPerDay.ts";
 import { type PrLaneDecision, planPrLane, taskDependencyDepths } from "./mergeTrain.ts";
 import {
-  backfillPlanBuckets,
   capabilityGates,
   inboundPlanDeps,
+  type Plan,
   planReviews,
   plans,
   planTaskDeps,
   planTaskNeeds,
   planTasks,
 } from "./plan.ts";
-import { derivePromotionState, isPromotable, promotionPrBody, promotionPrTitle } from "./promotion.ts";
+import { derivePromotionState, isEpicIntegrationBranch, isPromotable, promotionPrBody, promotionPrTitle } from "./promotion.ts";
 import {
   defaultProbeExec,
   type ProbeExec,
@@ -1862,56 +1861,37 @@ export async function pollCapabilityGatesImpl(
   }
 }
 
-/** Idempotent read-model pass: recompute each plan's derived `delivery` signal (issue #171) by
- * joining its slice tasks' `pr_key` → `pull_requests.status`, and denormalise it onto the `plans`
- * row so the epics overview / detail views can read it as a flat column (Urban's datasource can't
- * read a SQL VIEW). Never touches `plan.status` — additive/derived only. Writes only when the
- * projection actually changes, so a steady-state pass is a no-op. */
 /** Sentinel status fed to `deriveDelivery` for a `plan_tasks.pr_key` whose `pull_requests` row is
  * missing (DB desync). It is deliberately non-terminal and not `merged`, so a dangling PR counts as
  * in-flight — never a false-positive `landed` from a silently-dropped slice. */
 const MISSING_PR_STATUS = "missing";
 
-export async function pollDelivery(data: DataLayer) {
-  // Preload every PR status once per pass into a pr_key→status map (avoids the prior N+1
-  // `prs(data).get` per task; mirrors how `activePrs` reads `prs(data).all()` once).
-  const statusByPrKey = new Map<string, string>();
-  for (const pr of await prs(data).all()) statusByPrKey.set(pr.pr_key, pr.status);
-  for (const plan of await plans(data).all()) {
-    try {
-      // `deriveDelivery` always yields `{null, null}` for a non-`done` plan, so skip the per-plan
-      // task join for those — but still clear any stale projection defensively (e.g. a plan that
-      // regressed out of `done`) so the read model never keeps a phantom `converging`/`landed`.
-      if (plan.status !== "done") {
-        if (plan.delivery !== null || plan.delivery_label !== null) {
-          await plans(data).update(plan.plan_key, {
-            delivery: null,
-            delivery_label: null,
-            updated_at: now(),
-          });
-        }
-        continue;
-      }
-      const tasks = await planTasks(data).find({ plan_key: plan.plan_key });
-      const prStatuses: string[] = [];
-      for (const t of tasks) {
-        if (!t.pr_key) continue;
-        // A dangling pr_key (row missing) is treated as in-flight, not dropped, so a DB desync
-        // can never wrongly promote an epic to `landed`.
-        prStatuses.push(statusByPrKey.get(t.pr_key) ?? MISSING_PR_STATUS);
-      }
-      const { delivery, label } = deriveDelivery(plan.status, prStatuses);
-      if (plan.delivery !== delivery || plan.delivery_label !== label) {
-        await plans(data).update(plan.plan_key, {
-          delivery,
-          delivery_label: label,
-          updated_at: now(),
-        });
-      }
-    } catch (err) {
-      console.error(`[poller] delivery ${plan.plan_key}: ${err}`);
+/** Recompute an epic's derived `delivery` signal at READ TIME (epic #412) from the SAME pure
+ * `deriveDelivery` the `plan_delivery` VIEW encodes — by joining each slice `plan_tasks.pr_key` →
+ * `pull_requests.status` (a dangling `pr_key` counts as in-flight, never false-`landed`). The
+ * `plans.delivery` column was RETIRED, so the pollers that still need the signal derive it here
+ * rather than reading a denormalised column. Non-`done` plans short-circuit to `null` (the view's
+ * behaviour) without the per-plan task join. `statusByPrKey` is an optional once-per-pass PR-status
+ * map (the pollers preload it to avoid an N+1); when omitted (a one-off caller like the
+ * acknowledge-epic op) it loads only THIS plan's slice PRs on demand — never the whole table. */
+export async function derivePlanDelivery(
+  data: DataLayer,
+  plan: Plan,
+  statusByPrKey?: Map<string, string>,
+): Promise<string | null> {
+  if (plan.status !== "done") return null;
+  const tasks = await planTasks(data).find({ plan_key: plan.plan_key });
+  const prStatuses: string[] = [];
+  for (const t of tasks) {
+    if (!t.pr_key) continue;
+    let status = statusByPrKey?.get(t.pr_key);
+    if (status === undefined && !statusByPrKey) {
+      // On-demand caller: fetch just this slice's PR row rather than loading the whole table.
+      status = (await prs(data).get(t.pr_key))?.status;
     }
+    prStatuses.push(status ?? MISSING_PR_STATUS);
   }
+  return deriveDelivery(plan.status, prStatuses).delivery;
 }
 
 /** Idempotent read-model pass (issue #292 slice S4): project each DEPENDENT epic's inter-epic gate
@@ -1926,12 +1906,30 @@ export async function pollDelivery(data: DataLayer) {
  * a prior edge (e.g. an edge later removed) is cleared defensively so the read model never keeps a
  * phantom gate. */
 export async function pollWaitGate(data: DataLayer) {
+  // Preload every plan_tasks row once per pass and group by plan_key, so deriving each plan's
+  // fanned-out signal below is a map lookup rather than a per-plan `planTasks(data).find` (avoids
+  // an N+1 that would double this pass's DB work alongside the per-plan `inboundPlanDeps` lookup).
+  const wavesByPlanKey = new Map<string, number[]>();
+  for (const t of await planTasks(data).all()) {
+    if (t.wave == null) continue;
+    const list = wavesByPlanKey.get(t.plan_key) ?? [];
+    list.push(t.wave);
+    wavesByPlanKey.set(t.plan_key, list);
+  }
   for (const plan of await plans(data).all()) {
     try {
       const edges = await inboundPlanDeps(data, plan.plan_key);
+      // `plans.current_wave` was retired (epic #412); `deriveWaitGate` only consumes its
+      // NULL-ness (proof the epic's fan-out began). Derive that at read time: an epic has fanned out
+      // iff it has ≥1 levelized `plan_tasks` row (a wave assigned). The value's magnitude is never
+      // surfaced here — the epic index/detail read the display `current_wave` off the
+      // `plan_wave_label`/`plan_read_model` VIEWs — so any non-null (the frontier's min wave) is
+      // faithful for the gate's "has this epic ever fanned out?" test.
+      const assignedWaves = wavesByPlanKey.get(plan.plan_key) ?? [];
+      const current_wave = assignedWaves.length > 0 ? Math.min(...assignedWaves) : null;
       const { wait_gate, wait_gate_label } = deriveWaitGate(edges, {
         status: plan.status,
-        current_wave: plan.current_wave,
+        current_wave,
         bound_artifacts: plan.bound_artifacts,
         created_at: plan.created_at,
       });
@@ -1951,8 +1949,8 @@ export async function pollWaitGate(data: DataLayer) {
 /** Idempotent promotion pass (issue #299): open — and then track — the `epic/* → <default>`
  * promotion PR for every epic that has LANDED on a custom integration branch. This is the missing
  * counterpart to `ensureBaseBranch`: that creates the `epic/*` branch slices merge into; this
- * delivers the fully-landed branch to the default branch. Runs AFTER `pollDelivery` so it reads the
- * freshly-projected `delivery = landed` signal.
+ * delivers the fully-landed branch to the default branch. Derives each epic's `delivery` signal at
+ * read time (epic #412 — the `plans.delivery` column was retired) via the same pure `deriveDelivery`.
  *
  * Per promotable plan (`isPromotable`: `delivery = landed` AND base is `epic/*`):
  *   • No promotion PR yet → open ONE `epic/* → <default>` PR (idempotent against a remote head-branch
@@ -1972,10 +1970,15 @@ export async function pollPromotion(data: DataLayer, engine: EngineClient, token
   const statusByPrKey = new Map<string, string>();
   for (const pr of await prs(data).all()) statusByPrKey.set(pr.pr_key, pr.status);
   for (const plan of await plans(data).all()) {
-    if (!isPromotable(plan)) continue;
     const base = plan.base_branch;
-    if (!base) continue; // narrowed by isPromotable, but keep the type-checker honest
+    // A non-`epic/*` base is never promotable — short-circuit before the per-plan delivery join.
+    if (!isEpicIntegrationBranch(base)) continue;
     try {
+      // `plans.delivery` was retired (epic #412) — derive the landed signal at READ TIME from the
+      // slice PRs (same pure `deriveDelivery` the `plan_delivery` VIEW encodes) instead of reading a
+      // denormalised column, then apply the pure `isPromotable` predicate.
+      const delivery = await derivePlanDelivery(data, plan, statusByPrKey);
+      if (!isPromotable({ delivery, base_branch: base })) continue;
       // Already opened → project state from the promotion PR's live status, and re-enroll it if its
       // convergence row went missing (a prior submit failed, or the app/engine store desynced).
       if (plan.promotion_pr) {
@@ -2398,47 +2401,18 @@ export async function pollUserTasks(
  * The wave-merge barrier is now level-triggered and probes the engine's message-subscription state
  * over the same raw-REST search surface, so it runs only when `engineRest` is supplied (as in
  * production — `main.ts` always passes it). */
-/** One-shot guard so the feature-stage backfill (`backfillFeatureStages`) runs at most once per
- * process, on the first `pollOnce`. Idempotent regardless, but there is no need to re-scan every row
- * on every poll. */
-let featureStagesBackfilled = false;
-
-/** One-shot guard so the epic-bucket backfill (`backfillPlanBuckets`, #298) runs at most once per
- * process, on the first `pollOnce` — re-projecting pre-migration-042 `plans` rows whose
- * `list_bucket` is still NULL. The gateway keeps every future write fresh; idempotent regardless. */
-let planBucketsBackfilled = false;
-
 export async function pollOnce(
   data: DataLayer,
   engine: EngineClient,
   token: string,
   engineRest?: { restAddress: string; token?: string },
 ) {
-  // One-shot: re-project any pre-#254 feature_runs rows whose pipeline columns are still NULL. The
-  // gateway keeps every future write fresh, so this only needs to run once per process and is safe to
-  // re-run (it re-derives from each row's own stored fields).
-  if (!featureStagesBackfilled) {
-    // Only arm the one-shot guard AFTER a successful backfill: setting it first would swallow a
-    // transient failure (e.g. a DB blip) and leave legacy rows unprojected forever, since every later
-    // pass would skip. On a throw the guard stays false and the next `pollOnce` retries.
-    await backfillFeatureStages(data);
-    featureStagesBackfilled = true;
-  }
-  // One-shot: re-project any pre-#298 `plans` rows whose `list_bucket` is still NULL, so a legacy
-  // epic buckets correctly into Active/History from the first pass. Guard armed only after success so
-  // a transient failure retries next pass (mirrors the feature-stage backfill above).
-  if (!planBucketsBackfilled) {
-    await backfillPlanBuckets(data);
-    planBucketsBackfilled = true;
-  }
   await pollReviews(data, engine, token);
   await pollMerges(data, engine, token);
-  await pollDelivery(data);
   await pollWaitGate(data);
   await pollPromotion(data, engine, token);
   await pollFeatureDelivery(data);
   await pollLineage(data);
-  await pollMergesPerDay(data);
   await pollUserTasks(data, engine, engineRest);
   await pollDeliveryGraphPhase(data, engine);
   if (engineRest) {

package/db/migrations/070_drop_plan_projection_columns.sql

@@ -0,0 +1,31 @@
+-- Contract phase for the worker-maintained `plans` projection columns (epic #412: retire
+-- worker-maintained denormalised projections in favour of SQL VIEWs).
+--
+-- Wave-0 of this epic re-expressed every one of these denormalised `plans` columns as a DERIVED SQL
+-- VIEW computed from the SAME pure helpers that used to feed the write-path, and repointed every
+-- operator page onto those views:
+--   • `wave_count` / `current_wave` / `wave_label` (022_plan_wave_progress.sql) → `plan_wave_progress`
+--     / `plan_wave_label` / `plan_read_model` (060/061), derived from the levelized `plan_tasks`.
+--   • `delivery` / `delivery_label` (029_plan_delivery.sql) → `plan_delivery` / `plan_read_model`
+--     (061), derived via the pure `deriveDelivery`/`TERMINAL_STATUSES` (app/delivery.ts) by joining
+--     each slice `plan_tasks.pr_key` → `pull_requests.status`.
+--
+-- This wave-1 cleanup deletes the now-dead write-paths (the `record-plan`/`record-wave`/`select-wave`
+-- worker writes and the `pollDelivery` poller) and repoints the last internal readers onto read-time
+-- derivation (`pollPlanBucket`/`pollPromotion` recompute `delivery` via `deriveDelivery`;
+-- `pollWaitGate` derives "has the epic fanned out?" from `plan_tasks`). With no remaining writer or
+-- reader, these five columns are dead schema — a drift surface with no source of truth behind them —
+-- so drop them. The `plan_read_model` / `plan_wave_label` / `plan_delivery` VIEWs DERIVE their
+-- wave/delivery columns from the join surfaces, never from these `plans` columns, so the pages the
+-- views back are unaffected.
+--
+-- Forward-only contract migration numbered in this task's disjoint 070-079 block (029/022 are
+-- forward-only and immutable, so this is the standard expand→contract follow-up, not an edit to
+-- them). All five columns were nullable with no default and have no remaining writer or reader, and
+-- no index references them, so a plain `ALTER TABLE … DROP COLUMN` suffices. The runner wraps each
+-- file in its own transaction, so this file must NOT contain BEGIN/COMMIT.
+ALTER TABLE plans DROP COLUMN wave_count;
+ALTER TABLE plans DROP COLUMN current_wave;
+ALTER TABLE plans DROP COLUMN wave_label;
+ALTER TABLE plans DROP COLUMN delivery;
+ALTER TABLE plans DROP COLUMN delivery_label;

package/db/migrations/071_drop_merges_per_day_table.sql

@@ -0,0 +1,21 @@
+-- Contract phase for the worker-maintained `merges_per_day` read table (epic #412: retire
+-- worker-maintained denormalised projections in favour of SQL VIEWs).
+--
+-- 051_merges_per_day.sql created the flat `merges_per_day` read table the Velocity page bound, kept
+-- fresh each poll pass by `pollMergesPerDay` (app/mergesPerDay.ts) projecting the pure
+-- `deriveMergesPerDay` over the `merges` audit trail. Wave-0 re-expressed that aggregate as the
+-- DERIVED `merges_per_day_view` VIEW (062) — computed directly from `merges` with the same
+-- `COUNT(DISTINCT pr_key)` / local-day bucketing — and repointed `pages/velocity.page.json` onto it.
+--
+-- This wave-1 cleanup deletes the `pollMergesPerDay` write-path and its base-table accessors. With no
+-- remaining writer or reader, the `merges_per_day` table is dead schema, so drop it. The pure
+-- `deriveMergesPerDay`/`barFor` helpers (app/mergesPerDay.ts) stay — they are the single source of
+-- truth the view's SQL mirrors and are still exercised by the view's read-model guard. The
+-- `merges_per_day_view` reads the `merges` audit table, NOT this dropped table, so the Velocity page
+-- is unaffected.
+--
+-- Forward-only contract migration numbered in this task's disjoint 070-079 block. The table has no
+-- remaining writer or reader and nothing references it by foreign key, so a plain `DROP TABLE`
+-- suffices. The runner wraps each file in its own transaction, so this file must NOT contain
+-- BEGIN/COMMIT.
+DROP TABLE merges_per_day;

package/db/migrations/072_drop_lineage_view_backed_columns.sql

@@ -0,0 +1,23 @@
+-- Contract phase for the view-migrated `lineage_threads` identity columns (epic #412: retire
+-- worker-maintained denormalised projections in favour of SQL VIEWs).
+--
+-- 064_lineage_thread_view.sql introduced the `lineage_thread_view` VIEW the Lineage page now binds.
+-- The lineage audit (lineage-views-audit) split `lineage_threads`' columns into two groups:
+--   • VIEW-BACKED (fully derivable from the `plans`/`feature_runs` origin joins): `kind` and
+--     `issue_url`. The view DERIVES both — `kind` from which origin table the root matches, `issue_url`
+--     from that origin's `issue_url` (NULL for a self-rooted PR) — and NEVER reads `lt.kind` /
+--     `lt.issue_url`. `pollLineage` (app/lineage.ts) no longer writes them (this wave-1 cleanup).
+--   • PROCEDURAL (kept, still poller-written, still read by the view): `title` (a self-rooted PR's
+--     representative-PR pick), `stage`, `stage_label`, `process_key`, `pr_keys`, `pr_count`, `active`,
+--     `created_at`, `updated_at`. These are NOT dropped — the view passes them through from
+--     `lineage_threads`, and `pollLineage` remains their single writer.
+--
+-- So drop ONLY the two fully view-backed columns; the procedural remainder stays. Both dropped
+-- columns were nullable with no default and now have no writer or reader, and no index references
+-- them, so a plain `ALTER TABLE … DROP COLUMN` suffices. Because a procedural remainder survives, the
+-- `lineage_threads` table itself is NOT dropped.
+--
+-- Forward-only contract migration numbered in this task's disjoint 070-079 block. The runner wraps
+-- each file in its own transaction, so this file must NOT contain BEGIN/COMMIT.
+ALTER TABLE lineage_threads DROP COLUMN kind;
+ALTER TABLE lineage_threads DROP COLUMN issue_url;

package/db/migrations/073_feature_read_model.sql

@@ -0,0 +1,80 @@
+-- Feature-run display projection as a derived SQL VIEW (issue #439 — the status-driven follow-up to
+-- epic #412).
+--
+-- 039_feature_pipeline_stage.sql denormalised the pipeline projection
+-- (`stage`/`stage_state`/`stage_skipped`/`attention`/`list_bucket`) onto the `feature_runs` row,
+-- projected at WRITE TIME by the `featureRuns()` gateway (app/feature.ts) from the pure `deriveStage`
+-- / `deriveListBucket` (app/stage.ts). That "the gateway is the sole write path" invariant held for
+-- app-layer writes but NOT for the framework `instanceTracking` reconciler, which writes
+-- `feature_runs.status` through the RAW datasource (`{status:"abandoned"}` on a terminated instance,
+-- see nano.app.json → instanceTracking) — bypassing the gateway, so `status` flipped terminal while
+-- the display columns stayed frozen at their pre-terminal values (a cancelled run wedged in Active as
+-- a live-looking `Implementing ⚠`, its Dismiss gated shut on a null `stage_state`).
+--
+-- The fix is the same technique #412/#411 established (projection → VIEW, enabled by nano-ide#424):
+-- express the derived columns as a VIEW over `status` (+ `pr_key`/`converge`/`auto_merge`/
+-- `acknowledged_at`), removing the write-time projection entirely. There is then no stored column and
+-- no write-path for ANY writer (the reconciler or a future one) to leave stale — the projection is a
+-- pure function of the row's own base columns, recomputed on every read. `deriveStage` /
+-- `deriveListBucket` remain the canonical TS implementation (used by the acknowledge operations and
+-- as the test oracle); this VIEW's CASE expressions MIRROR them exactly, and
+-- app/featureReadModel.test.ts pins the two in lockstep over the full status matrix.
+--
+-- A single plain `CREATE VIEW <name> AS SELECT … FROM …` (no CTE / no select-list subquery), so its
+-- output columns stay parseable by the static pages↔schema contract guard (scripts/pages-contract.
+-- test.ts) — every projected column is aliased and the derived ones are wrapped so nothing but the
+-- real table reference reads as the top-level FROM. It projects the `feature_runs` columns the Feature
+-- page references PLUS the five derived columns (same shape as 061's plan_read_model): the base
+-- `stage`/`stage_state`/`stage_skipped`/`attention`/`list_bucket` columns are deliberately NOT
+-- selected — the derived CASE expressions take those names — so a stale stored value can never surface.
+--
+-- Forward-only, additive (a new read model, no schema change to feature_runs). The runner wraps each
+-- file in its own transaction, so this file must NOT contain BEGIN/COMMIT. Numbered after the current
+-- highest prefix (072 — the #412 wave-1 contract cleanup landed a disjoint 070-079 block).
+
+CREATE VIEW feature_read_model AS
+SELECT
+  fr.feature_key AS feature_key,
+  fr.repo AS repo,
+  fr.issue_number AS issue_number,
+  fr.issue_url AS issue_url,
+  fr.title AS title,
+  fr.base_branch AS base_branch,
+  fr.status AS status,
+  fr.process_key AS process_key,
+  fr.pr_key AS pr_key,
+  fr.converge AS converge,
+  fr.auto_merge AS auto_merge,
+  fr.outcome AS outcome,
+  fr.delivery_label AS delivery_label,
+  fr.acknowledged_at AS acknowledged_at,
+  fr.created_at AS created_at,
+  fr.updated_at AS updated_at,
+  (CASE
+    WHEN fr.status IN ('merged', 'converged', 'blocked', 'failed', 'skipped', 'abandoned') THEN 'Done'
+    WHEN fr.status = 'converging' THEN 'Converging'
+    WHEN (fr.pr_key IS NOT NULL AND fr.pr_key <> '') OR fr.status = 'opened' THEN 'PR open'
+    WHEN fr.status IN ('running', 'escalated', 'awaiting_operator') THEN 'Implementing'
+    ELSE 'Requested'
+  END) AS stage,
+  (CASE
+    WHEN fr.status IN ('merged', 'converged') THEN 'ok'
+    WHEN fr.status = 'blocked' THEN 'blocked'
+    WHEN fr.status IN ('failed', 'skipped', 'abandoned') THEN 'failed'
+    ELSE NULL
+  END) AS stage_state,
+  (CASE
+    WHEN NOT (fr.converge IS NOT NULL AND fr.converge <> 0) THEN 'Converging Merging'
+    WHEN NOT (fr.auto_merge IS NOT NULL AND fr.auto_merge <> 0) THEN 'Merging'
+    ELSE ''
+  END) AS stage_skipped,
+  (CASE
+    WHEN fr.status = 'awaiting_operator' THEN 'blocked'
+    WHEN fr.status = 'escalated' THEN '⚠'
+    ELSE NULL
+  END) AS attention,
+  (CASE
+    WHEN fr.status IN ('merged', 'converged', 'blocked', 'failed', 'skipped', 'abandoned') AND fr.acknowledged_at IS NOT NULL THEN 'history'
+    ELSE 'active'
+  END) AS list_bucket
+FROM feature_runs fr;

package/db/migrations/074_plan_read_model_derive_bucket.sql

@@ -0,0 +1,74 @@
+-- Derive the epic Active/History bucket in the read-model VIEW instead of at write time (issue #439 —
+-- the status-driven follow-up to epic #412).
+--
+-- 044_plan_list_bucket.sql denormalised `plans.list_bucket` / `plans.ack_open` onto the row, projected
+-- at WRITE TIME by the `plans()` gateway (app/plan.ts) from the pure `deriveEpicBucket` /
+-- `epicIsAcknowledgeable` (app/delivery.ts), with a read-time `pollPlanBucket` pass (app/service.ts)
+-- supplying the delivery-aware correction the delivery-free gateway could not. As with feature_runs
+-- (073), that write path is bypassed by the framework `instanceTracking` reconciler, which writes
+-- `plans.status` through the RAW datasource (`{status:"abandoned"}` on a terminated instance) —
+-- leaving `list_bucket`/`ack_open` frozen at their pre-terminal values, so a cancelled epic drifts the
+-- same way a cancelled feature run does.
+--
+-- 061_plan_delivery_rollup.sql already made `plan_read_model` the composite VIEW the operator pages
+-- bind, but it still READ `pl.list_bucket` / `pl.ack_open` straight off the denormalised columns. This
+-- migration redefines `plan_read_model` (same name, so no page repoint is needed) to DERIVE both from
+-- the base inputs — `status`, `acknowledged_at`, and the already-derived `plan_delivery.delivery`
+-- signal — removing the last read of the stored columns. The bucket is now a pure function with no
+-- write-path: there is nothing for the reconciler (or `pollPlanBucket`, which this retires) to leave
+-- stale. The CASE expressions MIRROR `deriveEpicBucket` / `epicIsAcknowledgeable` exactly, cross-checked
+-- against those pure functions in app/plansReadModel.test.ts.
+--
+-- Deriving from the REAL delivery signal is strictly MORE correct than the old write-time projection,
+-- which had to assume `delivery = null` (it could not see the read-time signal) and relied on
+-- `pollPlanBucket` to clear `ack_open` while a `done` epic was still converging. The view sees the live
+-- `plan_delivery.delivery`, so a still-converging epic never offers Dismiss (`ack_open = 0`) without a
+-- poller pass.
+--
+-- A merged view is not editable in place (that would edit a shipped migration), so this DROPs and
+-- re-CREATEs it. `plan_read_model` is a leaf — no other view builds on it — so the DROP is safe. Its
+-- output column set is UNCHANGED (list_bucket/ack_open are still projected, only their derivation
+-- changed), so the pages↔schema contract guard and every page binding stay valid.
+--
+-- Forward-only. NO BEGIN/COMMIT — the runner wraps each file in its own transaction. Numbered after
+-- 073.
+
+DROP VIEW plan_read_model;
+
+CREATE VIEW plan_read_model AS
+SELECT
+  pl.plan_key AS plan_key,
+  pl.repo AS repo,
+  pl.issue_number AS issue_number,
+  pl.issue_url AS issue_url,
+  pl.title AS title,
+  pl.status AS status,
+  pl.task_count AS task_count,
+  pl.process_key AS process_key,
+  pl.outcome AS outcome,
+  pl.updated_at AS updated_at,
+  pl.epic_phase AS epic_phase,
+  pl.base_branch AS base_branch,
+  pl.wait_gate_label AS wait_gate_label,
+  pl.bound_artifacts AS bound_artifacts,
+  pl.promotion_pr AS promotion_pr,
+  pl.promotion_state AS promotion_state,
+  (CASE
+    WHEN pl.status IN ('planning', 'dispatched') THEN 'active'
+    WHEN pl.status = 'done' AND d.delivery = 'converging' THEN 'active'
+    WHEN pl.status = 'done' AND pl.acknowledged_at IS NULL THEN 'active'
+    WHEN pl.status = 'done' THEN 'history'
+    ELSE 'history'
+  END) AS list_bucket,
+  (CASE
+    WHEN pl.status = 'done' AND d.delivery IS NOT 'converging' AND pl.acknowledged_at IS NULL THEN 1
+    ELSE 0
+  END) AS ack_open,
+  wl.wave_count AS wave_count,
+  wl.current_wave AS current_wave,
+  wl.wave_label AS wave_label,
+  d.delivery AS delivery,
+  d.delivery_label AS delivery_label
+FROM plans pl
+LEFT JOIN plan_wave_label wl ON wl.plan_key = pl.plan_key
+LEFT JOIN plan_delivery d ON d.plan_key = pl.plan_key;

package/main.ts

@@ -109,10 +109,11 @@ async function pollLoop(): Promise<void> {
   }
   if (!shuttingDown) pollTimer = setTimeout(() => void pollLoop(), POLL_MS);
 }
-// Run the first pass immediately at boot (not after POLL_MS) so the one-shot feature-stage backfill
-// runs before the UI is relied upon — the Feature Runs grid/tabs filter on the stored `list_bucket`
-// projection, which is NULL on legacy rows until `backfillFeatureStages()` runs inside `pollOnce()`.
-// Deferring the first pass would leave those rows missing from Active/History for up to POLL_MS.
+// Run the first pass immediately at boot (not after POLL_MS) so the read-model pollers (delivery,
+// wait-gate, promotion, lineage) reconcile before the UI is relied upon rather than after up to
+// POLL_MS. The Feature Runs grid/tabs now filter the `feature_read_model` VIEW's derived `stage`/
+// `list_bucket` (issue #439), computed from each row's own `status`, so no boot-time backfill of a
+// stored projection is required.
 if (app.data) void pollLoop();
 
 async function drainAndExit(): Promise<void> {

package/operations/acknowledgeDone.test.ts

@@ -1,17 +1,19 @@
 // Tests for the POST /app/api/actions/acknowledge-done operation `acknowledgeDone` (issue #254 §5).
-// The nwf UI's "tick off" affordance for a TERMINAL feature run: it stamps `acknowledged_at` via the
-// feature_runs gateway, which recomputes `list_bucket` to 'history', dropping the run from Active into
-// History. Unlike acknowledgeBlocked it completes NO user task (a terminal run is not parked). Mirrors
-// the acknowledge-blocked twin's shape.
+// The nwf UI's "tick off" affordance for a TERMINAL feature run: it stamps `acknowledged_at`, which
+// the `feature_read_model` VIEW (073, issue #439) derives into `list_bucket` = 'history', dropping the
+// run from Active into History. Unlike acknowledgeBlocked it completes NO user task (a terminal run is
+// not parked). Since `list_bucket` is now a VIEW over `status`/`acknowledged_at` (no stored column),
+// these tests assert the operation's real write — the `acknowledged_at` stamp — and cross-check the
+// resulting bucket through the pure `deriveListBucket` oracle the VIEW mirrors.
 import { test } from "node:test";
 import { assertEquals } from "#test-assert";
 import type { AppApi } from "@nanobpm/urban";
-import { featureRuns } from "../app/feature.ts";
+import { deriveListBucket } from "../app/stage.ts";
 import { noopLog } from "../test/log.ts";
 import handler from "./acknowledgeDone.ts";
 
-// An in-memory data layer wired through the REAL featureRuns gateway proxy, so the test exercises the
-// gateway's list_bucket projection exactly as production does.
+// An in-memory data layer wired through the `featureRuns` gateway (now a plain record table), so the
+// test exercises the operation's write path exactly as production does.
 function memApp(seed: any[]): { app: AppApi; rows: any[] } {
   const stores: Record<string, any[]> = { feature_runs: seed };
   function tbl(name: string, pk = "id") {
@@ -49,30 +51,30 @@ async function call(app: AppApi, body: unknown) {
   return (await handler({ req: {} as any, params: {}, query: {}, body } as any, app)) as any;
 }
 
-test("acknowledge-done: stamps acknowledged_at and flips list_bucket to 'history' on a terminal row", async () => {
+test("acknowledge-done: stamps acknowledged_at and (via the VIEW) buckets a terminal row into History", async () => {
   const { app, rows } = memApp([{ feature_key: "o/r#1", status: "merged", converge: 1, auto_merge: 1, acknowledged_at: null }]);
-  // Seed the projection as the gateway would have on the last write (terminal, unacknowledged → active).
-  await featureRuns(app.data).update("o/r#1", { status: "merged" });
-  assertEquals(rows[0].list_bucket, "active");
+  // Before dismissal a terminal-but-unacknowledged run reads as Active through the VIEW.
+  assertEquals(deriveListBucket(rows[0].status, rows[0].acknowledged_at), "active");
 
   const res = await call(app, { feature_key: "o/r#1" });
 
   assertEquals(res.status, 200);
   assertEquals(res.body.ok, true);
   assertEquals(typeof rows[0].acknowledged_at, "string");
-  assertEquals(rows[0].list_bucket, "history");
+  // The op's only write is the stamp; the VIEW derives 'history' from (terminal status + acknowledged).
+  assertEquals(deriveListBucket(rows[0].status, rows[0].acknowledged_at), "history");
 });
 
 test("acknowledge-done: idempotent-safe — re-acknowledging keeps the row in History", async () => {
   const { app, rows } = memApp([{ feature_key: "o/r#2", status: "failed", converge: 1, auto_merge: 1, acknowledged_at: null }]);
   const first = await call(app, { feature_key: "o/r#2" });
   assertEquals(first.status, 200);
-  assertEquals(rows[0].list_bucket, "history");
+  assertEquals(deriveListBucket(rows[0].status, rows[0].acknowledged_at), "history");
   const firstStamp = rows[0].acknowledged_at;
   // Re-acknowledge — still 200, still history.
   const second = await call(app, { feature_key: "o/r#2" });
   assertEquals(second.status, 200);
-  assertEquals(rows[0].list_bucket, "history");
+  assertEquals(deriveListBucket(rows[0].status, rows[0].acknowledged_at), "history");
   assertEquals(typeof firstStamp, "string");
 });
 
@@ -92,12 +94,12 @@ test("acknowledge-done: no such feature run → 404", async () => {
 
 test("acknowledge-done: a non-terminal run → 409, no acknowledged_at stamped", async () => {
   const { app, rows } = memApp([{ feature_key: "o/r#live", status: "running", converge: 1, auto_merge: 1, acknowledged_at: null }]);
-  await featureRuns(app.data).update("o/r#live", { status: "running" });
   const res = await call(app, { feature_key: "o/r#live" });
   assertEquals(res.status, 409);
   assertEquals(res.body.ok, false);
   assertEquals(rows[0].acknowledged_at, null);
-  assertEquals(rows[0].list_bucket, "active");
+  // A live run stays Active through the VIEW (no stamp → not History).
+  assertEquals(deriveListBucket(rows[0].status, rows[0].acknowledged_at), "active");
 });
 
 test("acknowledge-done: a converging (redispatch-terminal but live) run → 409", async () => {

package/operations/acknowledgeDone.ts

@@ -3,13 +3,15 @@
 // run (Done ✓ / Done ✕) directly from the Feature / Overview pages so it drops out of the primary
 // Active list into History. It is the DONE twin of `acknowledgeBlocked` — but a terminal run is NOT
 // parked at a user task, so this op does NOT complete a user task and touches no engine/ledger: it
-// simply stamps `acknowledged_at` on the row via the feature_runs gateway. It rejects (409) a run that
+// simply stamps `acknowledged_at` on the row via the plain `feature_runs` record table (the projecting
+// gateway this PR retired). It rejects (409) a run that
 // is not yet truly terminal, so it can never pre-seed the tick-off on a still-live run.
 //
-// The gateway (app/feature.ts) recomputes `list_bucket` on that write — a terminal row with
-// `acknowledged_at` set flips to 'history' — so this op NEVER hand-sets `list_bucket` (or any other
-// projection). Keyed on the row's `feature_key`. Idempotent-safe: re-acknowledging simply re-stamps
-// the timestamp and keeps the row in History.
+// The `list_bucket` partition is DERIVED by the `feature_read_model` VIEW (073, issue #439) from
+// `status` + `acknowledged_at` — a terminal row with `acknowledged_at` set reads as 'history' — so
+// this op NEVER writes `list_bucket` (or any projection): stamping `acknowledged_at` is the whole
+// contract. Keyed on the row's `feature_key`. Idempotent-safe: re-acknowledging simply re-stamps the
+// timestamp and keeps the row in History.
 
 import { featureRuns } from "../app/feature.ts";
 import { STAGE_DONE_STATUSES } from "../app/stage.ts";
@@ -42,9 +44,9 @@ export default defineOperation("acknowledgeDone", async ({ body }, app) => {
     return { status: 409, body: { ok: false, error: "feature run is not terminal" } };
   }
 
-  // Stamp the dismissal. The gateway recomputes `list_bucket` from the merged row (→ 'history' for a
-  // terminal run), so we never hand-set it here. Idempotent: re-acknowledging re-stamps and stays in
-  // History.
+  // Stamp the dismissal. `list_bucket` is derived by the `feature_read_model` VIEW (→ 'history' for a
+  // terminal, acknowledged row), so we never hand-set it here. Idempotent: re-acknowledging re-stamps
+  // and stays in History.
   const now = new Date().toISOString();
   await runs.update(featureKey, { acknowledged_at: now, updated_at: now });