@nanobpm/nano-workforce 0.122.0 → 0.123.0

package/app/plan.ts

@@ -12,7 +12,6 @@
 import type { DataLayer, EngineClient } from "@nanobpm/urban";
 import { blackboardUrl, mintBlackboardToken, renderCoordinationBrief } from "./blackboard.ts";
 import { capsWaitTimeout, DEFAULT_CAPS_WAIT_TIMEOUT } from "./capsWait.ts";
-import { deriveEpicBucket, epicIsAcknowledgeable } from "./delivery.ts";
 import { EPIC_PHASE } from "./epicPhase.ts";
 import { DEFAULT_ESCALATION_SLA_TIMEOUT, escalationSlaTimeout } from "./escalationSla.ts";
 import {
@@ -93,8 +92,9 @@ export interface Plan {
   // #412): `delivery` / `delivery_label` are now a DERIVED SQL VIEW (`plan_delivery` /
   // `plan_read_model`, 061), computed from the SAME pure `deriveDelivery`/`TERMINAL_STATUSES`
   // (app/delivery.ts). The pages read them off the view; the pollers that still need the signal
-  // (`pollPlanBucket` for list_bucket/ack_open, `pollPromotion` for `isPromotable`) recompute it at
-  // read time via `deriveDelivery`. There is no stored column and no write-path any more.
+  // (`pollPromotion` for `isPromotable`) recompute it at
+  // read time via `deriveDelivery`, as does the `plan_read_model` VIEW's bucket derivation (074).
+  // There is no stored column and no write-path any more.
   // Derived epic domain phase (038_plan_epic_phase.sql, #261): the epic's own lifecycle phase —
   // Planning / Reviewing / Implementing (wave n/t) / Trial merging / Finalizing / Dispatched —
   // projected at write time from plan-fanout.bpmn's named activities (app/epicPhase.ts), so the epic
@@ -112,16 +112,18 @@ export interface Plan {
   //                       which has nothing to promote). Display-only; projected by the poller.
   promotion_pr: string | null;
   promotion_state: string | null;
-  // Active/History partition + operator tick-off (044_plan_list_bucket.sql, #298). Derived,
-  // write-time-projected by the `plans` gateway (below) from the pure `deriveEpicBucket` /
-  // `epicIsAcknowledgeable` helpers (app/delivery.ts) — never written by the plan lifecycle or a
-  // poller directly. Bucket epics on the derived `delivery` rollup, not raw `status`, so a `done`
-  // epic still converging — or landed-but-unpromoted — does not vanish from Active.
+  // Active/History partition + operator tick-off (044_plan_list_bucket.sql, #298). RETIRED as a
+  // write-time projection (issue #439): `list_bucket`/`ack_open` are now DERIVED by the
+  // `plan_read_model` VIEW (074) from `status`, `acknowledged_at`, and the derived `plan_delivery`
+  // signal — mirroring the pure `deriveEpicBucket` / `epicIsAcknowledgeable` (app/delivery.ts). The
+  // Epics pages bind the VIEW, never these base columns, so a raw-datasource `status` write (the
+  // `instanceTracking` reconciler) can no longer leave them stale, and the delivery-aware
+  // `pollPlanBucket` correction is retired (the VIEW sees the live signal). The base columns survive
+  // (expand/contract — a later migration drops them) but are no longer written or read.
   //   • acknowledged_at — NULL until an operator dismisses a resolved `done` epic (acknowledge-epic).
-  //   • list_bucket     — 'active' | 'history': the page tabs filter on this flat column.
-  //   • ack_open        — 1 | 0: 1 iff a resolved (`done`, not converging) but unacknowledged epic,
-  //                       gating the Dismiss button's `showWhenField`. NULL only on pre-#298 rows
-  //                       until `backfillPlanBuckets`.
+  //                       Still written; the sole live input the derivation reads off the row.
+  //   • list_bucket     — 'active' | 'history': VESTIGIAL base column; the pages filter the VIEW's.
+  //   • ack_open        — 1 | 0: VESTIGIAL base column; the pages gate Dismiss on the VIEW's.
   acknowledged_at: string | null;
   list_bucket: string | null;
   ack_open: number | null;
@@ -182,91 +184,19 @@ export const PLAN_TASK_STATUSES = [
 ] as const;
 export type PlanTaskStatus = typeof PLAN_TASK_STATUSES[number];
 
-export const plans = (data: DataLayer) => {
-  const table = data.table<Plan>("plans", "plan_key");
-  return new Proxy(table, {
-    get(target, prop) {
-      if (prop === "insert") {
-        return (row: Partial<Plan>) => target.insert({ ...row, ...projectPlanBucket(row) });
-      }
-      if (prop === "update") {
-        return async (id: unknown, patch: Partial<Plan>) => {
-          // Only re-read + reproject when the patch changes a projection input (status /
-          // acknowledged_at) or writes a derived column directly. A projection-irrelevant patch (e.g.
-          // an `updated_at`-only write — including the direct `data.table` writes in
-          // e.g. `app/retro.ts` that stamp `retro_started_at`) leaves the stored projection correct, so
-          // skip the extra `get` roundtrip and delegate straight. Any bucket-relevant write
-          // (status/acknowledged_at or a derived column) MUST go through this gateway to stay
-          // reprojected.
-          if (!patchAffectsPlanProjection(patch)) return target.update(id, patch);
-          const existing = await target.get(id);
-          const merged: Partial<Plan> = { ...existing, ...patch };
-          return target.update(id, { ...patch, ...projectPlanBucket(merged) });
-        };
-      }
-      // Delegate every other method straight through. Bind functions to the real target so the
-      // gateway's private class fields resolve — a Proxy `this` would not carry them.
-      const value = Reflect.get(target, prop, target);
-      return typeof value === "function" ? value.bind(target) : value;
-    },
-  });
-};
-
-/** The `plans` fields the bucket projection READS: a patch touching none of these (and none it
- * writes) cannot change `list_bucket`/`ack_open`, so the gateway skips the read-back+reproject. Kept
- * adjacent to {@link projectPlanBucket} so the two stay in lockstep. */
-const PLAN_PROJECTION_INPUT_KEYS: readonly (keyof Plan)[] = ["status", "acknowledged_at"];
-
-/** The `plans` fields the bucket projection WRITES. Included in the reproject trigger so a caller who
- * writes a derived column directly (e.g. `list_bucket`/`ack_open`) can never bypass derivation: the
- * gateway re-reads, recomputes, and OVERRIDES the raw value with the canonical derived one. */
-const PLAN_PROJECTION_OUTPUT_KEYS: readonly (keyof Plan)[] = ["list_bucket", "ack_open"];
-
-/** True when a patch changes at least one field the bucket projection derives from OR one it writes —
- * i.e. the projection must be recomputed (mirrors feature.ts `patchAffectsProjection`). */
-function patchAffectsPlanProjection(patch: Partial<Plan>): boolean {
-  return (
-    PLAN_PROJECTION_INPUT_KEYS.some((k) => k in patch) ||
-    PLAN_PROJECTION_OUTPUT_KEYS.some((k) => k in patch)
-  );
-}
-
-/** Compute the write-time bucket projection columns for a merged `plans` row. Centralised so the
- * gateway is the ONE place `deriveEpicBucket` / `epicIsAcknowledgeable` are applied — the page, SQL,
- * pollers and workers never re-derive the mapping (AGENTS.md "derivation over duplication").
+/** The `plans` record gateway (keyed on `plan_key`) — a plain record table.
  *
- * The `delivery` signal was retired as a stored column (epic #412), so the write-time projection can
- * no longer read it — it derives the bucket with `delivery` treated as UNKNOWN (null). This is
- * provably safe for `list_bucket`: `deriveEpicBucket` returns the same bucket with `delivery=null` as
- * with the real signal for every reachable `(status, acknowledged_at)` state. `ack_open` is only a
- * *candidate* here (any unacknowledged `done` epic); the delivery-aware correction — clearing it
- * while an epic is still `converging` — is applied at read time by `pollPlanBucket` (app/service.ts),
- * which recomputes `delivery` via `deriveDelivery`. */
-function projectPlanBucket(row: Partial<Plan>): Partial<Plan> {
-  if (!row.status) return {};
-  return {
-    list_bucket: deriveEpicBucket(row.status, null, row.acknowledged_at ?? null),
-    ack_open:
-      epicIsAcknowledgeable(row.status, null) && (row.acknowledged_at ?? null) === null ? 1 : 0,
-  };
-}
-
-/** Re-project every `plans` row through the gateway so rows written before migration 042 (whose
- * `list_bucket`/`ack_open` are NULL) get a correct Active/History bucket. Idempotent and safe to
- * re-run: it re-derives from each row's own stored fields, so a second pass is a no-op. Runs once at
- * boot (pollOnce) — the gateway keeps every future write fresh, so this only needs to catch legacy
- * rows. Returns the count actually stamped. Mirrors `backfillFeatureStages` (app/feature.ts). */
-export async function backfillPlanBuckets(data: DataLayer): Promise<number> {
-  const table = plans(data);
-  let stamped = 0;
-  for (const row of await table.all()) {
-    // Only touch rows the projection has never reached — a legacy row whose `list_bucket` is NULL.
-    if (row.list_bucket != null) continue;
-    await table.update(row.plan_key, projectPlanBucket(row));
-    stamped++;
-  }
-  return stamped;
-}
+ * The epic-bucket projection (`list_bucket`/`ack_open`) is NO LONGER a write-time projection here
+ * (issue #439): it is DERIVED by the `plan_read_model` VIEW (074) from each row's own `status` /
+ * `acknowledged_at` and the derived `plan_delivery` signal, mirroring `deriveEpicBucket` /
+ * `epicIsAcknowledgeable` (app/delivery.ts). The Epics pages bind the VIEW, never this table's stored
+ * derived columns. Removing the write-time projection closes the drift the framework
+ * `instanceTracking` reconciler opened (a raw-datasource `{status:"abandoned"}` write on a terminated
+ * instance bypassed the projecting gateway and froze the bucket) AND retires the read-time
+ * `pollPlanBucket` correction: the VIEW sees the live delivery signal, so a still-converging epic never
+ * offers Dismiss without a poller pass. The pure helpers stay the acknowledge-epic guard and the VIEW's
+ * test oracle (app/plansReadModel.test.ts). */
+export const plans = (data: DataLayer) => data.table<Plan>("plans", "plan_key");
 export const planTasks = (data: DataLayer) => data.table<PlanTask>("plan_tasks", "id");
 
 /** One dependency edge in the plan DAG (issue #20): `task_id` waits for `depends_on_task_id`.

package/app/plansReadModel.test.ts

@@ -19,7 +19,7 @@ import { DatabaseSync } from "node:sqlite";
 import { test } from "node:test";
 import { fileURLToPath } from "node:url";
 import { assert, assertEquals } from "#test-assert";
-import { deriveDelivery } from "./delivery.ts";
+import { deriveDelivery, deriveEpicBucket, epicIsAcknowledgeable } from "./delivery.ts";
 
 const MIG = (name: string) => readFileSync(fileURLToPath(new URL(`../db/migrations/${name}`, import.meta.url)), "utf8");
 const PAGE = (name: string) => JSON.parse(readFileSync(fileURLToPath(new URL(`../pages/${name}`, import.meta.url)), "utf8"));
@@ -34,7 +34,7 @@ function viewDb(): DatabaseSync {
        plan_key TEXT PRIMARY KEY, repo TEXT, issue_number INTEGER, issue_url TEXT, title TEXT,
        status TEXT, task_count INTEGER, process_key TEXT, outcome TEXT, created_at TEXT,
        updated_at TEXT, epic_phase TEXT, base_branch TEXT, wait_gate_label TEXT, bound_artifacts TEXT,
-       promotion_pr TEXT, promotion_state TEXT, list_bucket TEXT, ack_open INTEGER);
+       promotion_pr TEXT, promotion_state TEXT, acknowledged_at TEXT, list_bucket TEXT, ack_open INTEGER);
      CREATE TABLE plan_tasks (
        id INTEGER PRIMARY KEY, plan_key TEXT, task_index INTEGER, task_id TEXT, title TEXT,
        prompt TEXT, status TEXT, pr_key TEXT, summary TEXT, created_at TEXT, updated_at TEXT,
@@ -44,6 +44,9 @@ function viewDb(): DatabaseSync {
   db.exec(MIG("059_plan_wave_summary.sql"));
   db.exec(MIG("060_plan_wave_rollup.sql"));
   db.exec(MIG("061_plan_delivery_rollup.sql"));
+  // 074 redefines plan_read_model to DERIVE list_bucket/ack_open from status + acknowledged_at + the
+  // derived plan_delivery signal (issue #439), instead of reading the denormalised base columns.
+  db.exec(MIG("074_plan_read_model_derive_bucket.sql"));
   return db;
 }
 
@@ -66,10 +69,16 @@ const MISSING_PR_STATUS = "missing";
 // Insert a plan plus its tasks (and each task's PR, if any). PR keys are derived so the test rows
 // stay terse. Returns the flat `pull_requests.status` list `deriveDelivery` consumes (only tasks
 // that opened a PR), so the delivery assertions can cross-check the view against it.
-function addPlan(db: DatabaseSync, plan_key: string, status: string, tasks: SampleTask[]): string[] {
+function addPlan(
+  db: DatabaseSync,
+  plan_key: string,
+  status: string,
+  tasks: SampleTask[],
+  opts: { acknowledged_at?: string | null } = {},
+): string[] {
   db.prepare(
-    "INSERT INTO plans (plan_key, repo, issue_number, issue_url, status, task_count, updated_at, list_bucket) VALUES (?, ?, ?, ?, ?, ?, ?, ?)",
-  ).run(plan_key, "o/r", 1, `https://gh/${plan_key}`, status, tasks.length, "2026-01-01T00:00:00Z", "active");
+    "INSERT INTO plans (plan_key, repo, issue_number, issue_url, status, task_count, updated_at, acknowledged_at, list_bucket) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",
+  ).run(plan_key, "o/r", 1, `https://gh/${plan_key}`, status, tasks.length, "2026-01-01T00:00:00Z", opts.acknowledged_at ?? null, "active");
   const prStatuses: string[] = [];
   tasks.forEach((t, i) => {
     const prKey = t.pr || t.danglingPr ? `${plan_key}::pr${i}` : null;
@@ -107,6 +116,16 @@ function counts(db: DatabaseSync, plan_key: string): { prs_opened: number; prs_m
   return { ...r };
 }
 
+// The derived Active/History bucket flags the epics pages bind — read straight off `plan_read_model`
+// (074), plus the delivery signal the derivation folds in, so the assertions can cross-check the
+// VIEW against the pure `deriveEpicBucket` / `epicIsAcknowledgeable` oracles.
+function bucket(db: DatabaseSync, plan_key: string): { list_bucket: unknown; ack_open: unknown; delivery: string | null } {
+  const r = db
+    .prepare("SELECT list_bucket, ack_open, delivery FROM plan_read_model WHERE plan_key = ?")
+    .get(plan_key) as { list_bucket: unknown; ack_open: unknown; delivery: string | null };
+  return { ...r };
+}
+
 function waveLabel(db: DatabaseSync, plan_key: string): Record<string, unknown> | undefined {
   const r = db.prepare("SELECT wave_count, current_wave, wave_label FROM plan_wave_label WHERE plan_key = ?").get(plan_key) as
     | Record<string, unknown>
@@ -259,4 +278,92 @@ test("the operator pages read the derived plan_read_model VIEW for the wave/deli
   assertEquals(byId("epic-plan").props.data.table, "plan_read_model");
   assert(/\{\{\s*wave_label\s*\}\}/.test(byId("wave-banner").props.header), "the banner surfaces wave_label");
   assertEquals(byId("wave-banner").props.body, "delivery_label", "the banner body is the delivery_label");
+
+  // Epic INDEX page (epic.page.json) — the standalone Epics grid must also read the derived VIEW, not
+  // the raw `plans` table. `plans` stays a valid schema table, so a regression here (reverting the
+  // binding) would leave every OTHER test green while the index silently resumed reading stale
+  // list_bucket/ack_open; this pins it (suppressed advisory epic.page.json — issue #439).
+  const epicIndex = PAGE("epic.page.json");
+  const epicPlans = (epicIndex.nodes ?? []).find((n: { id: string }) => n.id === "epic-plans");
+  assert(epicPlans, "epic index must keep the Epics grid");
+  assertEquals(epicPlans.props.data.table, "plan_read_model");
+});
+
+test("plan_read_model DERIVES list_bucket / ack_open from status + delivery + acknowledged_at, matching deriveEpicBucket / epicIsAcknowledgeable (issue #439)", () => {
+  const db = viewDb();
+  // done, still converging (a slice in flight): Active, Dismiss suppressed — never ticked off mid-flight.
+  const converging = addPlan(db, "o/r#conv", "done", [
+    { status: "opened", wave: 0, pr: { status: "merged" } },
+    { status: "opened", wave: 1, pr: { status: "converging" } },
+  ]);
+  // done, fully landed, unacknowledged: Active with Dismiss OPEN (ack_open=1).
+  const landed = addPlan(db, "o/r#land", "done", [
+    { status: "opened", wave: 0, pr: { status: "merged" } },
+    { status: "opened", wave: 0, pr: { status: "merged" } },
+  ]);
+  // done, landed AND acknowledged: History, Dismiss closed.
+  const acked = addPlan(
+    db,
+    "o/r#ack",
+    "done",
+    [{ status: "opened", wave: 0, pr: { status: "merged" } }],
+    { acknowledged_at: "2026-02-02T00:00:00Z" },
+  );
+  // resolved-not-landed (one abandoned), unacknowledged: delivery null → acknowledgeable, Active + Dismiss.
+  const resolved = addPlan(db, "o/r#res", "done", [
+    { status: "opened", wave: 0, pr: { status: "merged" } },
+    { status: "opened", wave: 0, pr: { status: "abandoned" } },
+  ]);
+  // live (dispatched) epic: Active, not acknowledgeable.
+  const live = addPlan(db, "o/r#live", "dispatched", [{ status: "opened", wave: 0, pr: { status: "converging" } }]);
+
+  for (const [plan_key, status, prStatuses, ackAt] of [
+    ["o/r#conv", "done", converging, null],
+    ["o/r#land", "done", landed, null],
+    ["o/r#ack", "done", acked, "2026-02-02T00:00:00Z"],
+    ["o/r#res", "done", resolved, null],
+    ["o/r#live", "dispatched", live, null],
+  ] as const) {
+    const b = bucket(db, plan_key);
+    const expectedDelivery = deriveDelivery(status, prStatuses).delivery;
+    assertEquals(b.delivery, expectedDelivery, `${plan_key}: delivery`);
+    // Cross-check the VIEW against the pure helpers — the SAME oracle the acknowledge-epic op guards on.
+    assertEquals(
+      b.list_bucket,
+      deriveEpicBucket(status, expectedDelivery, ackAt),
+      `${plan_key}: list_bucket must equal deriveEpicBucket`,
+    );
+    const expectedAckOpen = epicIsAcknowledgeable(status, expectedDelivery) && ackAt === null ? 1 : 0;
+    assertEquals(b.ack_open, expectedAckOpen, `${plan_key}: ack_open must equal epicIsAcknowledgeable`);
+  }
+
+  // Pin the human-visible outcomes so a derivation drift can't hide behind the cross-check.
+  assertEquals(bucket(db, "o/r#conv"), { list_bucket: "active", ack_open: 0, delivery: "converging" });
+  assertEquals(bucket(db, "o/r#land"), { list_bucket: "active", ack_open: 1, delivery: "landed" });
+  assertEquals(bucket(db, "o/r#ack"), { list_bucket: "history", ack_open: 0, delivery: "landed" });
+  assertEquals(bucket(db, "o/r#res"), { list_bucket: "active", ack_open: 1, delivery: null });
+  assertEquals(bucket(db, "o/r#live"), { list_bucket: "active", ack_open: 0, delivery: null });
+});
+
+test("RED/GREEN GUARD: a RAW-datasource plans.status write (the instanceTracking reconciler bypass) leaves plan_read_model's bucket CONSISTENT", () => {
+  // Reproduce the framework `instanceTracking` reconciler class of bug: on a terminated process
+  // instance it writes `{status:"abandoned"}` to `plans` through the RAW datasource — bypassing the
+  // (now retired) projecting `plans` gateway. Under the OLD write-time projection the stored
+  // `list_bucket`/`ack_open` would freeze at their pre-terminal values; because they are now a VIEW
+  // over `status`, the read model stays correct with no write-path for any writer to leave stale.
+  const db = viewDb();
+  // A live epic mid-flight — Active, its (stale) stored projection says active/converging.
+  addPlan(db, "o/r#kill", "dispatched", [{ status: "opened", wave: 0, pr: { status: "converging" } }]);
+  assertEquals(bucket(db, "o/r#kill").list_bucket, "active");
+
+  // The reconciler flips status terminal via the RAW table — NOT the gateway. (Simulated with a raw
+  // UPDATE, exactly what the raw datasource emits.) It touches neither list_bucket nor ack_open.
+  db.prepare("UPDATE plans SET status = 'abandoned' WHERE plan_key = ?").run("o/r#kill");
+
+  // `abandoned` is a terminal non-`done` status: History, never acknowledgeable — matches the oracle.
+  const b = bucket(db, "o/r#kill");
+  assertEquals(b.list_bucket, deriveEpicBucket("abandoned", b.delivery, null), "list_bucket tracks status via the VIEW");
+  assertEquals(b.list_bucket, "history", "an abandoned epic is filed under History, not wedged in Active");
+  assertEquals(b.ack_open, epicIsAcknowledgeable("abandoned", b.delivery) ? 1 : 0);
+  assertEquals(b.ack_open, 0, "no phantom Dismiss on a reconciler-cancelled epic");
 });

package/app/service.ts

@@ -27,11 +27,11 @@ import {
   conformanceEscalationQuestion,
 } from "./conformance.ts";
 import { isUniqueConstraintFence } from "./dbFence.ts";
-import { deriveDelivery, deriveEpicBucket, epicIsAcknowledgeable, TERMINAL_STATUSES } from "./delivery.ts";
+import { deriveDelivery, TERMINAL_STATUSES } from "./delivery.ts";
 import { deliveryGraphRuns, deriveDeliveryPhase, parseHumanLabels } from "./deliveryGraphRun.ts";
 import { isDeliveryHumanElement } from "./deliveryHuman.ts";
 import { fleetSupportsDurableResume } from "./durableResume.ts";
-import { backfillFeatureStages, deriveFeatureDelivery, FEATURE_BLOCKED_ELEMENT, FEATURE_ESCALATION_ELEMENT, FEATURE_RUN_STATUSES, type FeatureRunStatus, featureEscalations, featureRuns } from "./feature.ts";
+import { deriveFeatureDelivery, FEATURE_BLOCKED_ELEMENT, FEATURE_ESCALATION_ELEMENT, FEATURE_RUN_STATUSES, type FeatureRunStatus, featureEscalations, featureRuns } from "./feature.ts";
 import {
   classifyMergeability,
   classifyPrLiveness,
@@ -54,7 +54,6 @@ import { mergeLanes, readExclusions } from "./mergeExclusion.ts";
 import { freshHeadRunAction, headRunPresenceCount, loadMergeProtocol } from "./mergeProtocol.ts";
 import { type PrLaneDecision, planPrLane, taskDependencyDepths } from "./mergeTrain.ts";
 import {
-  backfillPlanBuckets,
   capabilityGates,
   inboundPlanDeps,
   type Plan,
@@ -1895,46 +1894,6 @@ export async function derivePlanDelivery(
   return deriveDelivery(plan.status, prStatuses).delivery;
 }
 
-/** Idempotent read-model pass (epic #412 — successor to the retired `pollDelivery`): keep each
- * epic's Active/History `list_bucket` + `ack_open` tick-off flags fresh now that the `plans.delivery`
- * column is gone. The `plans` gateway projects both at write time, but with `delivery` treated as
- * UNKNOWN (null) — provably correct for `list_bucket`, but it cannot clear `ack_open` while a `done`
- * epic is still CONVERGING (its slices not all merged). This pass supplies the delivery-aware
- * correction: it recomputes `delivery` at read time via {@link derivePlanDelivery} and re-derives
- * `list_bucket`/`ack_open` from the pure `deriveEpicBucket`/`epicIsAcknowledgeable` helpers, writing
- * the result via the RAW `plans` table so the gateway's delivery-free reprojection can't clobber the
- * corrected value. Writes only when the projection actually changes, so a steady-state pass is a
- * no-op. Never touches `plan.status` — additive/derived only. */
-export async function pollPlanBucket(data: DataLayer) {
-  // Preload every PR status once per pass into a pr_key→status map (avoids an N+1 `prs(data).get`).
-  const statusByPrKey = new Map<string, string>();
-  for (const pr of await prs(data).all()) statusByPrKey.set(pr.pr_key, pr.status);
-  // Write through the RAW table, NOT the `plans` gateway: the gateway reprojects `list_bucket`/
-  // `ack_open` with `delivery=null` (it can't see the read-time signal), which would undo the
-  // delivery-aware `ack_open` correction below. This pass is the authoritative writer of the
-  // delivery-aware bucket flags.
-  const plansTable = data.table<Plan>("plans", "plan_key");
-  for (const plan of await plans(data).all()) {
-    try {
-      const delivery = await derivePlanDelivery(data, plan, statusByPrKey);
-      const listBucket = deriveEpicBucket(plan.status, delivery, plan.acknowledged_at ?? null);
-      const ackOpen =
-        epicIsAcknowledgeable(plan.status, delivery) && (plan.acknowledged_at ?? null) === null
-          ? 1
-          : 0;
-      if (plan.list_bucket !== listBucket || plan.ack_open !== ackOpen) {
-        await plansTable.update(plan.plan_key, {
-          list_bucket: listBucket,
-          ack_open: ackOpen,
-          updated_at: now(),
-        });
-      }
-    } catch (err) {
-      console.error(`[poller] plan-bucket ${plan.plan_key}: ${err}`);
-    }
-  }
-}
-
 /** Idempotent read-model pass (issue #292 slice S4): project each DEPENDENT epic's inter-epic gate
  * state onto its `plans` row so the epic index/detail views can show — as flat columns — which
  * producer/package a parked dependent is blocked on, its poll cadence + escalation deadline, and the
@@ -2442,42 +2401,14 @@ export async function pollUserTasks(
  * The wave-merge barrier is now level-triggered and probes the engine's message-subscription state
  * over the same raw-REST search surface, so it runs only when `engineRest` is supplied (as in
  * production — `main.ts` always passes it). */
-/** One-shot guard so the feature-stage backfill (`backfillFeatureStages`) runs at most once per
- * process, on the first `pollOnce`. Idempotent regardless, but there is no need to re-scan every row
- * on every poll. */
-let featureStagesBackfilled = false;
-
-/** One-shot guard so the epic-bucket backfill (`backfillPlanBuckets`, #298) runs at most once per
- * process, on the first `pollOnce` — re-projecting pre-migration-042 `plans` rows whose
- * `list_bucket` is still NULL. The gateway keeps every future write fresh; idempotent regardless. */
-let planBucketsBackfilled = false;
-
 export async function pollOnce(
   data: DataLayer,
   engine: EngineClient,
   token: string,
   engineRest?: { restAddress: string; token?: string },
 ) {
-  // One-shot: re-project any pre-#254 feature_runs rows whose pipeline columns are still NULL. The
-  // gateway keeps every future write fresh, so this only needs to run once per process and is safe to
-  // re-run (it re-derives from each row's own stored fields).
-  if (!featureStagesBackfilled) {
-    // Only arm the one-shot guard AFTER a successful backfill: setting it first would swallow a
-    // transient failure (e.g. a DB blip) and leave legacy rows unprojected forever, since every later
-    // pass would skip. On a throw the guard stays false and the next `pollOnce` retries.
-    await backfillFeatureStages(data);
-    featureStagesBackfilled = true;
-  }
-  // One-shot: re-project any pre-#298 `plans` rows whose `list_bucket` is still NULL, so a legacy
-  // epic buckets correctly into Active/History from the first pass. Guard armed only after success so
-  // a transient failure retries next pass (mirrors the feature-stage backfill above).
-  if (!planBucketsBackfilled) {
-    await backfillPlanBuckets(data);
-    planBucketsBackfilled = true;
-  }
   await pollReviews(data, engine, token);
   await pollMerges(data, engine, token);
-  await pollPlanBucket(data);
   await pollWaitGate(data);
   await pollPromotion(data, engine, token);
   await pollFeatureDelivery(data);

package/db/migrations/073_feature_read_model.sql

@@ -0,0 +1,80 @@
+-- Feature-run display projection as a derived SQL VIEW (issue #439 — the status-driven follow-up to
+-- epic #412).
+--
+-- 039_feature_pipeline_stage.sql denormalised the pipeline projection
+-- (`stage`/`stage_state`/`stage_skipped`/`attention`/`list_bucket`) onto the `feature_runs` row,
+-- projected at WRITE TIME by the `featureRuns()` gateway (app/feature.ts) from the pure `deriveStage`
+-- / `deriveListBucket` (app/stage.ts). That "the gateway is the sole write path" invariant held for
+-- app-layer writes but NOT for the framework `instanceTracking` reconciler, which writes
+-- `feature_runs.status` through the RAW datasource (`{status:"abandoned"}` on a terminated instance,
+-- see nano.app.json → instanceTracking) — bypassing the gateway, so `status` flipped terminal while
+-- the display columns stayed frozen at their pre-terminal values (a cancelled run wedged in Active as
+-- a live-looking `Implementing ⚠`, its Dismiss gated shut on a null `stage_state`).
+--
+-- The fix is the same technique #412/#411 established (projection → VIEW, enabled by nano-ide#424):
+-- express the derived columns as a VIEW over `status` (+ `pr_key`/`converge`/`auto_merge`/
+-- `acknowledged_at`), removing the write-time projection entirely. There is then no stored column and
+-- no write-path for ANY writer (the reconciler or a future one) to leave stale — the projection is a
+-- pure function of the row's own base columns, recomputed on every read. `deriveStage` /
+-- `deriveListBucket` remain the canonical TS implementation (used by the acknowledge operations and
+-- as the test oracle); this VIEW's CASE expressions MIRROR them exactly, and
+-- app/featureReadModel.test.ts pins the two in lockstep over the full status matrix.
+--
+-- A single plain `CREATE VIEW <name> AS SELECT … FROM …` (no CTE / no select-list subquery), so its
+-- output columns stay parseable by the static pages↔schema contract guard (scripts/pages-contract.
+-- test.ts) — every projected column is aliased and the derived ones are wrapped so nothing but the
+-- real table reference reads as the top-level FROM. It projects the `feature_runs` columns the Feature
+-- page references PLUS the five derived columns (same shape as 061's plan_read_model): the base
+-- `stage`/`stage_state`/`stage_skipped`/`attention`/`list_bucket` columns are deliberately NOT
+-- selected — the derived CASE expressions take those names — so a stale stored value can never surface.
+--
+-- Forward-only, additive (a new read model, no schema change to feature_runs). The runner wraps each
+-- file in its own transaction, so this file must NOT contain BEGIN/COMMIT. Numbered after the current
+-- highest prefix (072 — the #412 wave-1 contract cleanup landed a disjoint 070-079 block).
+
+CREATE VIEW feature_read_model AS
+SELECT
+  fr.feature_key AS feature_key,
+  fr.repo AS repo,
+  fr.issue_number AS issue_number,
+  fr.issue_url AS issue_url,
+  fr.title AS title,
+  fr.base_branch AS base_branch,
+  fr.status AS status,
+  fr.process_key AS process_key,
+  fr.pr_key AS pr_key,
+  fr.converge AS converge,
+  fr.auto_merge AS auto_merge,
+  fr.outcome AS outcome,
+  fr.delivery_label AS delivery_label,
+  fr.acknowledged_at AS acknowledged_at,
+  fr.created_at AS created_at,
+  fr.updated_at AS updated_at,
+  (CASE
+    WHEN fr.status IN ('merged', 'converged', 'blocked', 'failed', 'skipped', 'abandoned') THEN 'Done'
+    WHEN fr.status = 'converging' THEN 'Converging'
+    WHEN (fr.pr_key IS NOT NULL AND fr.pr_key <> '') OR fr.status = 'opened' THEN 'PR open'
+    WHEN fr.status IN ('running', 'escalated', 'awaiting_operator') THEN 'Implementing'
+    ELSE 'Requested'
+  END) AS stage,
+  (CASE
+    WHEN fr.status IN ('merged', 'converged') THEN 'ok'
+    WHEN fr.status = 'blocked' THEN 'blocked'
+    WHEN fr.status IN ('failed', 'skipped', 'abandoned') THEN 'failed'
+    ELSE NULL
+  END) AS stage_state,
+  (CASE
+    WHEN NOT (fr.converge IS NOT NULL AND fr.converge <> 0) THEN 'Converging Merging'
+    WHEN NOT (fr.auto_merge IS NOT NULL AND fr.auto_merge <> 0) THEN 'Merging'
+    ELSE ''
+  END) AS stage_skipped,
+  (CASE
+    WHEN fr.status = 'awaiting_operator' THEN 'blocked'
+    WHEN fr.status = 'escalated' THEN '⚠'
+    ELSE NULL
+  END) AS attention,
+  (CASE
+    WHEN fr.status IN ('merged', 'converged', 'blocked', 'failed', 'skipped', 'abandoned') AND fr.acknowledged_at IS NOT NULL THEN 'history'
+    ELSE 'active'
+  END) AS list_bucket
+FROM feature_runs fr;

package/db/migrations/074_plan_read_model_derive_bucket.sql

@@ -0,0 +1,74 @@
+-- Derive the epic Active/History bucket in the read-model VIEW instead of at write time (issue #439 —
+-- the status-driven follow-up to epic #412).
+--
+-- 044_plan_list_bucket.sql denormalised `plans.list_bucket` / `plans.ack_open` onto the row, projected
+-- at WRITE TIME by the `plans()` gateway (app/plan.ts) from the pure `deriveEpicBucket` /
+-- `epicIsAcknowledgeable` (app/delivery.ts), with a read-time `pollPlanBucket` pass (app/service.ts)
+-- supplying the delivery-aware correction the delivery-free gateway could not. As with feature_runs
+-- (073), that write path is bypassed by the framework `instanceTracking` reconciler, which writes
+-- `plans.status` through the RAW datasource (`{status:"abandoned"}` on a terminated instance) —
+-- leaving `list_bucket`/`ack_open` frozen at their pre-terminal values, so a cancelled epic drifts the
+-- same way a cancelled feature run does.
+--
+-- 061_plan_delivery_rollup.sql already made `plan_read_model` the composite VIEW the operator pages
+-- bind, but it still READ `pl.list_bucket` / `pl.ack_open` straight off the denormalised columns. This
+-- migration redefines `plan_read_model` (same name, so no page repoint is needed) to DERIVE both from
+-- the base inputs — `status`, `acknowledged_at`, and the already-derived `plan_delivery.delivery`
+-- signal — removing the last read of the stored columns. The bucket is now a pure function with no
+-- write-path: there is nothing for the reconciler (or `pollPlanBucket`, which this retires) to leave
+-- stale. The CASE expressions MIRROR `deriveEpicBucket` / `epicIsAcknowledgeable` exactly, cross-checked
+-- against those pure functions in app/plansReadModel.test.ts.
+--
+-- Deriving from the REAL delivery signal is strictly MORE correct than the old write-time projection,
+-- which had to assume `delivery = null` (it could not see the read-time signal) and relied on
+-- `pollPlanBucket` to clear `ack_open` while a `done` epic was still converging. The view sees the live
+-- `plan_delivery.delivery`, so a still-converging epic never offers Dismiss (`ack_open = 0`) without a
+-- poller pass.
+--
+-- A merged view is not editable in place (that would edit a shipped migration), so this DROPs and
+-- re-CREATEs it. `plan_read_model` is a leaf — no other view builds on it — so the DROP is safe. Its
+-- output column set is UNCHANGED (list_bucket/ack_open are still projected, only their derivation
+-- changed), so the pages↔schema contract guard and every page binding stay valid.
+--
+-- Forward-only. NO BEGIN/COMMIT — the runner wraps each file in its own transaction. Numbered after
+-- 073.
+
+DROP VIEW plan_read_model;
+
+CREATE VIEW plan_read_model AS
+SELECT
+  pl.plan_key AS plan_key,
+  pl.repo AS repo,
+  pl.issue_number AS issue_number,
+  pl.issue_url AS issue_url,
+  pl.title AS title,
+  pl.status AS status,
+  pl.task_count AS task_count,
+  pl.process_key AS process_key,
+  pl.outcome AS outcome,
+  pl.updated_at AS updated_at,
+  pl.epic_phase AS epic_phase,
+  pl.base_branch AS base_branch,
+  pl.wait_gate_label AS wait_gate_label,
+  pl.bound_artifacts AS bound_artifacts,
+  pl.promotion_pr AS promotion_pr,
+  pl.promotion_state AS promotion_state,
+  (CASE
+    WHEN pl.status IN ('planning', 'dispatched') THEN 'active'
+    WHEN pl.status = 'done' AND d.delivery = 'converging' THEN 'active'
+    WHEN pl.status = 'done' AND pl.acknowledged_at IS NULL THEN 'active'
+    WHEN pl.status = 'done' THEN 'history'
+    ELSE 'history'
+  END) AS list_bucket,
+  (CASE
+    WHEN pl.status = 'done' AND d.delivery IS NOT 'converging' AND pl.acknowledged_at IS NULL THEN 1
+    ELSE 0
+  END) AS ack_open,
+  wl.wave_count AS wave_count,
+  wl.current_wave AS current_wave,
+  wl.wave_label AS wave_label,
+  d.delivery AS delivery,
+  d.delivery_label AS delivery_label
+FROM plans pl
+LEFT JOIN plan_wave_label wl ON wl.plan_key = pl.plan_key
+LEFT JOIN plan_delivery d ON d.plan_key = pl.plan_key;

package/main.ts

@@ -109,10 +109,11 @@ async function pollLoop(): Promise<void> {
   }
   if (!shuttingDown) pollTimer = setTimeout(() => void pollLoop(), POLL_MS);
 }
-// Run the first pass immediately at boot (not after POLL_MS) so the one-shot feature-stage backfill
-// runs before the UI is relied upon — the Feature Runs grid/tabs filter on the stored `list_bucket`
-// projection, which is NULL on legacy rows until `backfillFeatureStages()` runs inside `pollOnce()`.
-// Deferring the first pass would leave those rows missing from Active/History for up to POLL_MS.
+// Run the first pass immediately at boot (not after POLL_MS) so the read-model pollers (delivery,
+// wait-gate, promotion, lineage) reconcile before the UI is relied upon rather than after up to
+// POLL_MS. The Feature Runs grid/tabs now filter the `feature_read_model` VIEW's derived `stage`/
+// `list_bucket` (issue #439), computed from each row's own `status`, so no boot-time backfill of a
+// stored projection is required.
 if (app.data) void pollLoop();
 
 async function drainAndExit(): Promise<void> {