@nanobpm/nano-workforce 0.122.0 → 0.123.1

package/e2e/readiness-gate.e2e.ts

@@ -23,6 +23,34 @@ import { dirname, join, resolve } from "node:path";
 import { after, before, describe, test } from "node:test";
 import { fileURLToPath } from "node:url";
 import { bootTestApp, type TestApp } from "@nanobpm/urban-testkit";
+import type { CommandResult, ProbeExec } from "../app/readiness.ts";
+import { __setProbeExecForTest } from "../workers/readiness-probe/worker.ts";
+
+// A synchronous, in-memory ProbeExec so the probe resolves WITHIN the testkit's virtual-clock drain
+// fixpoint instead of spawning a REAL subprocess (real-time work `settle()` cannot deterministically
+// await — issue #450). It maps the hermetic shell builtins these scenarios use to a deterministic
+// `CommandResult` — `true` → exit 0 (green), `false` → exit 1 (never green) — mirroring the real
+// commands' semantics exactly, but with zero real time. Any OTHER command, or any HTTP call, is an
+// unintended probe escape: because `probeSingleShot` catches a thrown/rejected probe error and folds
+// it into a silent "not ready", an escape would otherwise be INVISIBLE and could let a bounded
+// not-ready scenario still pass, masking a regression (reviewer note). So we record every escape and
+// assert none occurred in teardown, failing the suite loudly instead of swallowing it.
+const unexpectedProbeIO: string[] = [];
+const deterministicExec: ProbeExec = {
+  run(command: string): Promise<CommandResult> {
+    const cmd = command.trim();
+    if (cmd !== "true" && cmd !== "false") {
+      unexpectedProbeIO.push(`command: ${cmd}`);
+      return Promise.resolve({ code: 127, stdout: "", stderr: "" });
+    }
+    const code = cmd === "true" ? 0 : 1;
+    return Promise.resolve({ code, stdout: "", stderr: "" });
+  },
+  httpGet(url: string): Promise<never> {
+    unexpectedProbeIO.push(`http: ${url}`);
+    return Promise.reject(new Error(`readiness-gate e2e: unexpected real HTTP probe (command probes only)`));
+  },
+};
 
 const APP_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 let dbSeq = 0;
@@ -32,6 +60,7 @@ const GITHUB_ENV_OVERRIDES: Record<string, string> = {
   GITHUB_TOKEN: "",
 };
 const savedEnv = new Map<string, string | undefined>();
+let savedProbeExec: ProbeExec | undefined;
 
 interface TakenFlow {
   from: string;
@@ -61,6 +90,11 @@ describe("nano-workforce artifact-readiness wait-gate (readiness-gate.bpmn)", ()
       savedEnv.set(k, process.env[k]);
       process.env[k] = v;
     }
+    // Inject the deterministic exec so the probe never spawns a real subprocess under the virtual
+    // clock (issue #450). Scenario-agnostic: it maps each scenario's command by string. Capture the
+    // prior override and restore exactly that in teardown, so the seam is restored to its real prior
+    // state rather than assuming production.
+    savedProbeExec = __setProbeExecForTest(deterministicExec);
   });
 
   after(() => {
@@ -68,6 +102,13 @@ describe("nano-workforce artifact-readiness wait-gate (readiness-gate.bpmn)", ()
       if (v === undefined) delete process.env[k];
       else process.env[k] = v;
     }
+    // Restore the prior exec — the seam must never outlive this suite.
+    __setProbeExecForTest(savedProbeExec);
+    // Fail loudly if the probe ever escaped the hermetic `true`/`false` builtins (an unexpected
+    // command or any HTTP call). `probeSingleShot` folds a probe error into a silent "not ready", so
+    // without this assertion an escape would be invisible and could let a bounded not-ready scenario
+    // still pass, masking a regression.
+    assert.deepEqual(unexpectedProbeIO, [], `readiness-gate e2e saw unexpected probe I/O: ${unexpectedProbeIO.join(", ")}`);
   });
 
   test("READY: a green probe publishes readiness-ready and the gate releases through wait-ready → gate-ready", async () => {

package/main.ts

@@ -109,10 +109,11 @@ async function pollLoop(): Promise<void> {
   }
   if (!shuttingDown) pollTimer = setTimeout(() => void pollLoop(), POLL_MS);
 }
-// Run the first pass immediately at boot (not after POLL_MS) so the one-shot feature-stage backfill
-// runs before the UI is relied upon — the Feature Runs grid/tabs filter on the stored `list_bucket`
-// projection, which is NULL on legacy rows until `backfillFeatureStages()` runs inside `pollOnce()`.
-// Deferring the first pass would leave those rows missing from Active/History for up to POLL_MS.
+// Run the first pass immediately at boot (not after POLL_MS) so the read-model pollers (delivery,
+// wait-gate, promotion, lineage) reconcile before the UI is relied upon rather than after up to
+// POLL_MS. The Feature Runs grid/tabs now filter the `feature_read_model` VIEW's derived `stage`/
+// `list_bucket` (issue #439), computed from each row's own `status`, so no boot-time backfill of a
+// stored projection is required.
 if (app.data) void pollLoop();
 
 async function drainAndExit(): Promise<void> {

package/operations/acknowledgeDone.test.ts

@@ -1,17 +1,19 @@
 // Tests for the POST /app/api/actions/acknowledge-done operation `acknowledgeDone` (issue #254 §5).
-// The nwf UI's "tick off" affordance for a TERMINAL feature run: it stamps `acknowledged_at` via the
-// feature_runs gateway, which recomputes `list_bucket` to 'history', dropping the run from Active into
-// History. Unlike acknowledgeBlocked it completes NO user task (a terminal run is not parked). Mirrors
-// the acknowledge-blocked twin's shape.
+// The nwf UI's "tick off" affordance for a TERMINAL feature run: it stamps `acknowledged_at`, which
+// the `feature_read_model` VIEW (073, issue #439) derives into `list_bucket` = 'history', dropping the
+// run from Active into History. Unlike acknowledgeBlocked it completes NO user task (a terminal run is
+// not parked). Since `list_bucket` is now a VIEW over `status`/`acknowledged_at` (no stored column),
+// these tests assert the operation's real write — the `acknowledged_at` stamp — and cross-check the
+// resulting bucket through the pure `deriveListBucket` oracle the VIEW mirrors.
 import { test } from "node:test";
 import { assertEquals } from "#test-assert";
 import type { AppApi } from "@nanobpm/urban";
-import { featureRuns } from "../app/feature.ts";
+import { deriveListBucket } from "../app/stage.ts";
 import { noopLog } from "../test/log.ts";
 import handler from "./acknowledgeDone.ts";
 
-// An in-memory data layer wired through the REAL featureRuns gateway proxy, so the test exercises the
-// gateway's list_bucket projection exactly as production does.
+// An in-memory data layer wired through the `featureRuns` gateway (now a plain record table), so the
+// test exercises the operation's write path exactly as production does.
 function memApp(seed: any[]): { app: AppApi; rows: any[] } {
   const stores: Record<string, any[]> = { feature_runs: seed };
   function tbl(name: string, pk = "id") {
@@ -49,30 +51,30 @@ async function call(app: AppApi, body: unknown) {
   return (await handler({ req: {} as any, params: {}, query: {}, body } as any, app)) as any;
 }
 
-test("acknowledge-done: stamps acknowledged_at and flips list_bucket to 'history' on a terminal row", async () => {
+test("acknowledge-done: stamps acknowledged_at and (via the VIEW) buckets a terminal row into History", async () => {
   const { app, rows } = memApp([{ feature_key: "o/r#1", status: "merged", converge: 1, auto_merge: 1, acknowledged_at: null }]);
-  // Seed the projection as the gateway would have on the last write (terminal, unacknowledged → active).
-  await featureRuns(app.data).update("o/r#1", { status: "merged" });
-  assertEquals(rows[0].list_bucket, "active");
+  // Before dismissal a terminal-but-unacknowledged run reads as Active through the VIEW.
+  assertEquals(deriveListBucket(rows[0].status, rows[0].acknowledged_at), "active");
 
   const res = await call(app, { feature_key: "o/r#1" });
 
   assertEquals(res.status, 200);
   assertEquals(res.body.ok, true);
   assertEquals(typeof rows[0].acknowledged_at, "string");
-  assertEquals(rows[0].list_bucket, "history");
+  // The op's only write is the stamp; the VIEW derives 'history' from (terminal status + acknowledged).
+  assertEquals(deriveListBucket(rows[0].status, rows[0].acknowledged_at), "history");
 });
 
 test("acknowledge-done: idempotent-safe — re-acknowledging keeps the row in History", async () => {
   const { app, rows } = memApp([{ feature_key: "o/r#2", status: "failed", converge: 1, auto_merge: 1, acknowledged_at: null }]);
   const first = await call(app, { feature_key: "o/r#2" });
   assertEquals(first.status, 200);
-  assertEquals(rows[0].list_bucket, "history");
+  assertEquals(deriveListBucket(rows[0].status, rows[0].acknowledged_at), "history");
   const firstStamp = rows[0].acknowledged_at;
   // Re-acknowledge — still 200, still history.
   const second = await call(app, { feature_key: "o/r#2" });
   assertEquals(second.status, 200);
-  assertEquals(rows[0].list_bucket, "history");
+  assertEquals(deriveListBucket(rows[0].status, rows[0].acknowledged_at), "history");
   assertEquals(typeof firstStamp, "string");
 });
 
@@ -92,12 +94,12 @@ test("acknowledge-done: no such feature run → 404", async () => {
 
 test("acknowledge-done: a non-terminal run → 409, no acknowledged_at stamped", async () => {
   const { app, rows } = memApp([{ feature_key: "o/r#live", status: "running", converge: 1, auto_merge: 1, acknowledged_at: null }]);
-  await featureRuns(app.data).update("o/r#live", { status: "running" });
   const res = await call(app, { feature_key: "o/r#live" });
   assertEquals(res.status, 409);
   assertEquals(res.body.ok, false);
   assertEquals(rows[0].acknowledged_at, null);
-  assertEquals(rows[0].list_bucket, "active");
+  // A live run stays Active through the VIEW (no stamp → not History).
+  assertEquals(deriveListBucket(rows[0].status, rows[0].acknowledged_at), "active");
 });
 
 test("acknowledge-done: a converging (redispatch-terminal but live) run → 409", async () => {

package/operations/acknowledgeDone.ts

@@ -3,13 +3,15 @@
 // run (Done ✓ / Done ✕) directly from the Feature / Overview pages so it drops out of the primary
 // Active list into History. It is the DONE twin of `acknowledgeBlocked` — but a terminal run is NOT
 // parked at a user task, so this op does NOT complete a user task and touches no engine/ledger: it
-// simply stamps `acknowledged_at` on the row via the feature_runs gateway. It rejects (409) a run that
+// simply stamps `acknowledged_at` on the row via the plain `feature_runs` record table (the projecting
+// gateway this PR retired). It rejects (409) a run that
 // is not yet truly terminal, so it can never pre-seed the tick-off on a still-live run.
 //
-// The gateway (app/feature.ts) recomputes `list_bucket` on that write — a terminal row with
-// `acknowledged_at` set flips to 'history' — so this op NEVER hand-sets `list_bucket` (or any other
-// projection). Keyed on the row's `feature_key`. Idempotent-safe: re-acknowledging simply re-stamps
-// the timestamp and keeps the row in History.
+// The `list_bucket` partition is DERIVED by the `feature_read_model` VIEW (073, issue #439) from
+// `status` + `acknowledged_at` — a terminal row with `acknowledged_at` set reads as 'history' — so
+// this op NEVER writes `list_bucket` (or any projection): stamping `acknowledged_at` is the whole
+// contract. Keyed on the row's `feature_key`. Idempotent-safe: re-acknowledging simply re-stamps the
+// timestamp and keeps the row in History.
 
 import { featureRuns } from "../app/feature.ts";
 import { STAGE_DONE_STATUSES } from "../app/stage.ts";
@@ -42,9 +44,9 @@ export default defineOperation("acknowledgeDone", async ({ body }, app) => {
     return { status: 409, body: { ok: false, error: "feature run is not terminal" } };
   }
 
-  // Stamp the dismissal. The gateway recomputes `list_bucket` from the merged row (→ 'history' for a
-  // terminal run), so we never hand-set it here. Idempotent: re-acknowledging re-stamps and stays in
-  // History.
+  // Stamp the dismissal. `list_bucket` is derived by the `feature_read_model` VIEW (→ 'history' for a
+  // terminal, acknowledged row), so we never hand-set it here. Idempotent: re-acknowledging re-stamps
+  // and stays in History.
   const now = new Date().toISOString();
   await runs.update(featureKey, { acknowledged_at: now, updated_at: now });
 

package/operations/acknowledgeEpic.test.ts

@@ -1,24 +1,27 @@
 // Tests for the POST /app/api/actions/acknowledge-epic operation `acknowledgeEpic` (issue #298).
 // The nwf UI's "Dismiss" affordance for a RESOLVED epic — landed (delivery=landed) or
 // resolved-not-landed (delivery=null); only still-`converging` epics are rejected. It stamps
-// `acknowledged_at` via the plans gateway, which recomputes `list_bucket` to 'history' (and
-// `ack_open` to 0), dropping the resolved epic from Active into History. Unlike acknowledge-blocked
-// it completes NO user task (a resolved epic is not parked). The epic twin of acknowledge-done.
+// `acknowledged_at`, which the `plan_read_model` VIEW (074, issue #439) derives into `list_bucket` =
+// 'history' and `ack_open` = 0, dropping the resolved epic from Active into History. Unlike
+// acknowledge-blocked it completes NO user task (a resolved epic is not parked). The epic twin of
+// acknowledge-done.
 //
 // Since epic #412 retired the stored `plans.delivery` column, the op derives the delivery signal at
 // READ TIME (`derivePlanDelivery` → the pure `deriveDelivery`) by joining the epic's slice
 // `plan_tasks.pr_key` → `pull_requests.status`. So these tests seed `plan_tasks` + `pull_requests`
-// (not a `plans.delivery` column) to model a landed / converging / resolved-not-landed epic.
+// (not a `plans.delivery` column) to model a landed / converging / resolved-not-landed epic. Because
+// `list_bucket`/`ack_open` are now a VIEW (no stored column), the tests assert the operation's real
+// write — the `acknowledged_at` stamp and the 200/409 gate — and cross-check the resulting bucket
+// through the pure `deriveEpicBucket` / `epicIsAcknowledgeable` oracles the VIEW mirrors.
 import { test } from "node:test";
 import { assertEquals } from "#test-assert";
 import type { AppApi } from "@nanobpm/urban";
-import { plans } from "../app/plan.ts";
+import { deriveEpicBucket, epicIsAcknowledgeable } from "../app/delivery.ts";
 import { noopLog } from "../test/log.ts";
 import handler from "./acknowledgeEpic.ts";
 
-// An in-memory data layer wired through the REAL plans gateway proxy, so the test exercises the
-// gateway's list_bucket/ack_open projection exactly as production does. `extra` seeds the join
-// surfaces (`plan_tasks` / `pull_requests`) the read-time delivery derivation reads.
+// An in-memory data layer wired through the `plans` gateway (now a plain record table). `extra` seeds
+// the join surfaces (`plan_tasks` / `pull_requests`) the read-time delivery derivation reads.
 function memApp(
   seed: any[],
   extra: Record<string, any[]> = {},
@@ -59,13 +62,7 @@ async function call(app: AppApi, body: unknown) {
   return (await handler({ req: {} as any, params: {}, query: {}, body } as any, app)) as any;
 }
 
-/** Fire a projecting gateway write (re-writing `status`) so `list_bucket`/`ack_open` reflect the
- *  delivery-free gateway projection, mirroring the last real write before the op runs. */
-async function project(app: AppApi, key: string, status: string) {
-  await plans(app.data).update(key, { status });
-}
-
-test("acknowledge-epic: stamps acknowledged_at and flips list_bucket to 'history' on a landed epic", async () => {
+test("acknowledge-epic: stamps acknowledged_at and (via the VIEW) buckets a landed epic into History", async () => {
   const { app, rows } = memApp(
     [{ plan_key: "o/r#1", status: "done", acknowledged_at: null }],
     {
@@ -73,17 +70,17 @@ test("acknowledge-epic: stamps acknowledged_at and flips list_bucket to 'history
       pull_requests: [{ pr_key: "o/r#100", status: "merged" }], // landed
     },
   );
-  await project(app, "o/r#1", "done");
-  assertEquals(rows[0].list_bucket, "active");
-  assertEquals(rows[0].ack_open, 1);
+  // Before dismissal a landed-but-unacknowledged epic reads as Active with Dismiss open through the VIEW.
+  assertEquals(deriveEpicBucket("done", "landed", rows[0].acknowledged_at), "active");
+  assertEquals(epicIsAcknowledgeable("done", "landed"), true);
 
   const res = await call(app, { plan_key: "o/r#1" });
 
   assertEquals(res.status, 200);
   assertEquals(res.body.ok, true);
   assertEquals(typeof rows[0].acknowledged_at, "string");
-  assertEquals(rows[0].list_bucket, "history");
-  assertEquals(rows[0].ack_open, 0);
+  // The op's only write is the stamp; the VIEW derives 'history' + ack_open 0 from the acknowledged row.
+  assertEquals(deriveEpicBucket("done", "landed", rows[0].acknowledged_at), "history");
 });
 
 test("acknowledge-epic: a still-converging epic is rejected (409) and stays Active", async () => {
@@ -100,15 +97,14 @@ test("acknowledge-epic: a still-converging epic is rejected (409) and stays Acti
       ],
     },
   );
-  await project(app, "o/r#2", "done");
 
   const res = await call(app, { plan_key: "o/r#2" });
 
   assertEquals(res.status, 409);
   assertEquals(res.body.ok, false);
-  // Untouched: no premature acknowledged_at, still Active.
+  // Untouched: no premature acknowledged_at; still Active through the VIEW (converging → active).
   assertEquals(rows[0].acknowledged_at, null);
-  assertEquals(rows[0].list_bucket, "active");
+  assertEquals(deriveEpicBucket("done", "converging", rows[0].acknowledged_at), "active");
 });
 
 test("acknowledge-epic: a resolved-not-landed epic (delivery=null) is accepted (200) and flips to History", async () => {
@@ -125,17 +121,15 @@ test("acknowledge-epic: a resolved-not-landed epic (delivery=null) is accepted (
       ],
     },
   );
-  await project(app, "o/r#2b", "done");
-  assertEquals(rows[0].list_bucket, "active");
-  assertEquals(rows[0].ack_open, 1);
+  assertEquals(deriveEpicBucket("done", null, rows[0].acknowledged_at), "active");
+  assertEquals(epicIsAcknowledgeable("done", null), true);
 
   const res = await call(app, { plan_key: "o/r#2b" });
 
   assertEquals(res.status, 200);
   assertEquals(res.body.ok, true);
   assertEquals(typeof rows[0].acknowledged_at, "string");
-  assertEquals(rows[0].list_bucket, "history");
-  assertEquals(rows[0].ack_open, 0);
+  assertEquals(deriveEpicBucket("done", null, rows[0].acknowledged_at), "history");
 });
 
 test("acknowledge-epic: a live (dispatched) epic is rejected (409)", async () => {
@@ -164,15 +158,14 @@ test("acknowledge-epic: idempotent — re-acknowledging a landed epic keeps it i
       pull_requests: [{ pr_key: "o/r#500", status: "merged" }], // landed
     },
   );
-  await project(app, "o/r#5", "done");
 
   assertEquals((await call(app, { plan_key: "o/r#5" })).status, 200);
   const firstStamp = rows[0].acknowledged_at;
-  assertEquals(rows[0].list_bucket, "history");
+  assertEquals(deriveEpicBucket("done", "landed", rows[0].acknowledged_at), "history");
 
   const res2 = await call(app, { plan_key: "o/r#5" });
   assertEquals(res2.status, 200);
-  assertEquals(rows[0].list_bucket, "history");
+  assertEquals(deriveEpicBucket("done", "landed", rows[0].acknowledged_at), "history");
   // Re-stamped (a fresh timestamp) but still resolved.
   assertEquals(typeof rows[0].acknowledged_at, "string");
   void firstStamp;

package/operations/acknowledgeEpic.ts

@@ -4,12 +4,13 @@
 // resolved-not-landed) directly from the Epic / Overview pages so it drops out of the Active epic list
 // into History. It is the epic twin of `acknowledgeDone` (the feature-run tick-off) — a resolved epic
 // is NOT parked at a user task, so this op completes no user task and touches no engine/ledger: it
-// simply stamps `acknowledged_at` on the `plans` row via the plans gateway.
+// simply stamps `acknowledged_at` on the `plans` row.
 //
-// The gateway (app/plan.ts) recomputes `list_bucket`/`ack_open` on that write — a landed, now-
-// acknowledged epic flips `list_bucket` to 'history' and `ack_open` to 0 — so this op NEVER hand-sets
-// a derived projection. Keyed on the row's `plan_key`. Idempotent-safe: re-acknowledging re-stamps
-// the timestamp and keeps the row in History.
+// `list_bucket`/`ack_open` are DERIVED by the `plan_read_model` VIEW (074, issue #439) from
+// `status` + `acknowledged_at` + the derived `plan_delivery` signal — a landed, now-acknowledged epic
+// reads `list_bucket` = 'history' and `ack_open` = 0 — so this op NEVER writes a derived projection.
+// Keyed on the row's `plan_key`. Idempotent-safe: re-acknowledging re-stamps the timestamp and keeps
+// the row in History.
 //
 // It rejects (409) an epic that is NOT yet resolved — i.e. anything the `epicIsAcknowledgeable`
 // guard refuses: a non-`done` status (`planning`/`dispatched`), or `done` but still `converging`. A
@@ -56,9 +57,9 @@ export default defineOperation("acknowledgeEpic", async ({ body }, app) => {
     return { status: 409, body: { ok: false, error: "epic is not resolved" } };
   }
 
-  // Stamp the dismissal. The gateway recomputes `list_bucket` (→ 'history') and `ack_open` (→ 0) from
-  // the merged row, so we never hand-set them here. Idempotent: re-acknowledging re-stamps and stays
-  // in History.
+  // Stamp the dismissal. `list_bucket` (→ 'history') and `ack_open` (→ 0) are derived by the
+  // `plan_read_model` VIEW from the resolved, now-acknowledged row, so we never hand-set them here.
+  // Idempotent: re-acknowledging re-stamps and stays in History.
   const now = new Date().toISOString();
   await table.update(planKey, { acknowledged_at: now, updated_at: now });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.122.0",
+  "version": "0.123.1",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",

package/pages/epic.page.json

@@ -99,7 +99,7 @@
         "data": {
           "kind": "datasource",
           "source": "app",
-          "table": "plans",
+          "table": "plan_read_model",
           "orderBy": { "field": "updated_at", "dir": "desc" },
           "filter": [{ "field": "list_bucket", "in": ["active"] }]
         },

package/pages/feature.page.json

@@ -102,7 +102,7 @@
         "data": {
           "kind": "datasource",
           "source": "app",
-          "table": "feature_runs",
+          "table": "feature_read_model",
           "orderBy": { "field": "updated_at", "dir": "desc" },
           "filter": [{ "field": "list_bucket", "in": ["active"] }]
         },

package/workers/readiness-probe/worker.ts

@@ -103,10 +103,38 @@ export function readGateVars(vars: { gateKey?: unknown; probeTimeout?: unknown }
   return { gateKey, probeTimeout };
 }
 
+// ── Deterministic-exec test seam (issue #450) ───────────────────────────────────────────────────
+// The probe's I/O runs through {@link defaultProbeExec} — a REAL `node:child_process` subprocess (for
+// `command` probes) / `fetch` (for `http`). A real subprocess is real-time async work that spans
+// multiple macrotasks, which the urban-testkit's *virtual-clock* `settle()`/`drain()` fixpoint cannot
+// deterministically await: it can return before the probe publishes `readiness-ready`, so a gate-flow
+// e2e races the subprocess (the same fire-and-forget-across-teardown hazard behind the testkit
+// use-after-free, nano-ide#446). An e2e under the virtual clock injects a synchronous, in-memory
+// `ProbeExec` here so the probe resolves *within* the drain fixpoint — no real spawn, no wall-clock
+// race — while production leaves the override unset and uses `defaultProbeExec()`. Deliberately a
+// process-scoped seam (not urban worker DI, which `bootTestApp` does not expose per-worker); the e2e
+// sets it before creating instances and clears it in teardown so it can never leak into production.
+let probeExecOverride: ProbeExec | undefined;
+
+/** Test-only seam: inject a deterministic {@link ProbeExec} for e2es driven by the virtual clock, or
+ *  pass `undefined` to restore the production {@link defaultProbeExec}. Never called in production.
+ *  Returns the PREVIOUS override so a caller can narrowly scope its change with `try/finally`
+ *  (restore the prior value rather than assuming production), keeping the seam safe even if the set
+ *  and clear are not lexically paired. */
+export function __setProbeExecForTest(exec: ProbeExec | undefined): ProbeExec | undefined {
+  const previous = probeExecOverride;
+  probeExecOverride = exec;
+  return previous;
+}
+
+function resolveProbeExec(): ProbeExec {
+  return probeExecOverride ?? defaultProbeExec();
+}
+
 const handler: AppJobHandler<In, Out> = async (job, app) => {
   const probe = parseProbe(job.variables.probe);
   const { gateKey } = readGateVars(job.variables);
-  const exec = defaultProbeExec();
+  const exec = resolveProbeExec();
   const result = await probeSingleShot({
     probe,
     exec,

package/workers/record-results/worker.test.ts

@@ -9,6 +9,7 @@
 import { test } from "node:test";
 import { assertEquals, assertRejects } from "#test-assert";
 import { BpmnError } from "@nanobpm/urban";
+import { deriveEpicBucket } from "../../app/delivery.ts";
 import { noopLog } from "../../test/log.ts";
 import handler from "./worker.ts";
 import type { PlanTaskStatus } from "../../app/plan.ts";
@@ -77,8 +78,9 @@ test("no opened PRs (empty plan) hard-fails with NO_WORK_DISPATCHED", async () =
   const plan = app._plans.at(-1) as Record<string, unknown>;
   assertEquals(plan.status, "failed");
   assertEquals(plan.outcome, "no work dispatched — the planner produced no tasks");
-  // The gateway projects the bucket: a failed epic settles to History (no tick-off needed).
-  assertEquals(plan.list_bucket, "history");
+  // `list_bucket` is derived by the `plan_read_model` VIEW (074): a failed epic reads as History
+  // (no tick-off needed). Cross-checked against the pure `deriveEpicBucket` oracle the VIEW mirrors.
+  assertEquals(deriveEpicBucket(plan.status as string, null, plan.acknowledged_at as string | null), "history");
 });
 
 test("tasks present but none opened (all skipped/blocked) hard-fails", async () => {
@@ -102,6 +104,7 @@ test("at least one opened PR finalizes cleanly (no throw)", async () => {
   const plan = app._plans.at(-1) as Record<string, unknown>;
   assertEquals(plan.status, "done");
   assertEquals(plan.outcome, "1 PR(s) dispatched to convergence");
-  // A just-`done` epic (delivery not yet projected) stays in Active — it must not vanish (#298).
-  assertEquals(plan.list_bucket, "active");
+  // A just-`done` epic (delivery not yet converging, unacknowledged) reads as Active through the VIEW —
+  // it must not vanish (#298). Cross-checked against the pure `deriveEpicBucket` oracle.
+  assertEquals(deriveEpicBucket(plan.status as string, null, plan.acknowledged_at as string | null), "active");
 });