@nanobpm/nano-workforce 0.128.0 → 0.129.0

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+# [0.129.0](https://github.com/nanobpm/nano-workforce/compare/v0.128.0...v0.129.0) (2026-08-23)
+
+
+### Features
+
+* adopt ADR-0065 derived instanceTracking read-models (urban 0.81.0) ([#489](https://github.com/nanobpm/nano-workforce/issues/489)) ([ce25501](https://github.com/nanobpm/nano-workforce/commit/ce255013b383eb4d593526c5f34e74aaab535d25)), closes [#318](https://github.com/nanobpm/nano-workforce/issues/318) [nano-workforce#422](https://github.com/nano-workforce/issues/422) [#76](https://github.com/nanobpm/nano-workforce/issues/76)
+
 # [0.128.0](https://github.com/nanobpm/nano-workforce/compare/v0.127.0...v0.128.0) (2026-08-23)
 
 

package/app/abandon.test.ts

@@ -1,7 +1,8 @@
 // Tests for the cooperative abandon-check helpers (issue #76).
 import { test } from "node:test";
-import { assertEquals, assertNotEquals } from "#test-assert";
+import { assertEquals, assertNotEquals, assertRejects } from "#test-assert";
 import type { DataLayer } from "@nanobpm/urban";
+import { withTrackingViews } from "../test/trackingViews.ts";
 import {
   abandonStatusForToken,
   abandonTokenFromUrl,
@@ -26,7 +27,7 @@ function memData(): DataLayer {
       },
     };
   }
-  return { table: (n: string) => tbl(n) } as any as DataLayer;
+  return { table: withTrackingViews((n: string) => tbl(n)) } as any as DataLayer;
 }
 
 async function seedPr(data: DataLayer, pr_key: string, abandon_token: string, status: string) {
@@ -106,3 +107,16 @@ test("abandonStatusForToken derives abandoned from the row status", async () =>
   });
   assertEquals(await abandonStatusForToken(data, "nope"), undefined);
 });
+
+test("abandonStatusForToken fails CLOSED on a non-string derived status", async () => {
+  // A malformed/missing derived_status must never be reported as `abandoned:false`
+  // (that would let a cancelled run proceed with irreversible side effects). It throws
+  // instead, which the operation dispatcher maps to a 500 so the agent's `curl -f` aborts.
+  const data = memData();
+  await data.table("pull_requests", "pr_key").insert({
+    pr_key: "o/r#3",
+    abandon_token: "weird",
+    status: 123,
+  });
+  await assertRejects(() => abandonStatusForToken(data, "weird"), Error, "is not a string");
+});

package/app/abandon.ts

@@ -10,23 +10,28 @@
 // Design invariants (mirroring the blackboard, app/blackboard.ts):
 //   - CAPABILITY URL. The per-PR token IS the credential; the agent curls the exact URL it was
 //     handed in its prompt. An unknown token is a 404 (never leaks which PRs exist).
-//   - DERIVED, not a separate marker. `abandoned` is read straight off `pull_requests.status`,
-//     which Urban's cancel primitive sets to 'abandoned' on cancel (via the `instanceTracking`
-//     `onTerminated.set` patch, applied the instant the instance terminates). No new state to
-//     keep in sync.
+//   - DERIVED, not a separate marker. `abandoned` is read off the PR's ADR-0065 derived tracking
+//     VIEW (`pull_requests__tracking.derived_status`). Since urban 0.81.0 the `instanceTracking`
+//     reconciler no longer WRITES 'abandoned' onto the base row on cancel; it feeds urban's instance
+//     projection and the `onTerminated.set` edge is recomputed on every read as `derived_status`. So
+//     an out-of-band cancel leaves the base `status` at its transient (e.g. `converging`) but the
+//     derived view reports 'abandoned' immediately — reading the view keeps the abort-check correct
+//     with no new state to sync. (`abandonClosedPr`, #352, still writes 'abandoned' onto the base
+//     row directly; the view passes that worker-written terminal through unchanged.)
 //   - ADVISORY. Like the blackboard, this never hard-locks; it narrows an unavoidable
 //     check-then-push (TOCTOU) window to near-zero. Job fencing in the harness (issue #76 layer 2)
 //     is what makes it airtight.
 import type { DataLayer } from "@nanobpm/urban";
 import { publicBaseUrl } from "./blackboard.ts";
+import { trackingTargetFor } from "./instanceTracking.ts";
 
-/** The one app-row status meaning a PR is terminally abandoned — the run must not be worked on
- * further. Two disjoint producers flip a row here, and both are non-completion terminals that must
+/** The one derived-status value meaning a PR is terminally abandoned — the run must not be worked on
+ * further. Two disjoint producers surface a row here, and both are non-completion terminals that must
  * stop a servicing agent:
- *   1. an explicit **cancel** of a live convergence/merge run (Urban's cancel primitive, via the
- *      `instanceTracking` `onTerminated.set` patch), and
+ *   1. an explicit **cancel** of a live convergence/merge run (Urban's cancel primitive terminates
+ *      the instance; the `instanceTracking` `onTerminated.set` edge derives `abandoned` on read), and
  *   2. **`abandonClosedPr`** reconciling a wave-member PR that was **closed on GitHub without
- *      merging** (#352) — for both `pull_requests` and its `plan_tasks`.
+ *      merging** (#352) — for both `pull_requests` and its `plan_tasks` — by writing the base row.
  * Convergence/merge terminal states `converged`/`merged` are NOT abandonment. In either abandoned
  * case a servicing agent should stop, so the abandon-check endpoint treating both as `abandoned:
  * true` is correct. */
@@ -69,32 +74,49 @@ export function abandonTokenFromUrl(url: string | null | undefined): string | un
   }
 }
 
-/** Resolve an abandon token back to its PR key, or undefined when the token is unknown. */
+/** Resolve an abandon token back to its PR key, or undefined when the token is unknown. Reads the
+ * derived tracking VIEW (a strict superset of the base row) so this stays valid post-ADR-0065. */
 export async function prKeyForAbandonToken(
   data: DataLayer,
   token: string,
 ): Promise<string | undefined> {
   if (!token) return undefined;
   const row = await data
-    .table<{ pr_key: string; abandon_token: string | null }>("pull_requests", "pr_key")
+    .table<{ pr_key: string; abandon_token: string | null }>(
+      trackingTargetFor("pull_requests").view,
+      "pr_key",
+    )
     .findOne({ abandon_token: token });
   return row?.pr_key;
 }
 
-/** The abandon status of a PR, or undefined when the token is unknown. */
+/** The abandon status of a PR, or undefined when the token is unknown. Reads the ADR-0065 derived
+ * tracking VIEW's `derived_status`, so an out-of-band-cancelled run (whose base row is still
+ * `converging`) is correctly reported `abandoned: true` the instant the instance terminates. */
 export async function abandonStatusForToken(
   data: DataLayer,
   token: string,
 ): Promise<{ prKey: string; status: string; abandoned: boolean } | undefined> {
   if (!token) return undefined;
+  const target = trackingTargetFor("pull_requests");
   const row = await data
-    .table<{ pr_key: string; abandon_token: string | null; status: string }>(
-      "pull_requests",
-      "pr_key",
-    )
+    .table<
+      { pr_key: string; abandon_token: string | null } & Record<string, unknown>
+    >(target.view, "pr_key")
     .findOne({ abandon_token: token });
   if (!row) return undefined;
-  return { prKey: row.pr_key, status: row.status, abandoned: isAbandoned(row.status) };
+  const rawStatus = row[target.statusColumn];
+  if (typeof rawStatus !== "string") {
+    // Fail CLOSED: a missing/non-string derived_status must never be reported as
+    // `abandoned:false`. The abort brief tells agents to proceed on a 200 with
+    // `abandoned:false`, so surfacing this as a thrown error (→ 500, which trips the
+    // agent's `curl -f` and aborts) is the safe direction for a cancelled run.
+    throw new Error(
+      `abandonStatusForToken: ${target.view}.${target.statusColumn} is not a string`,
+    );
+  }
+  const status = rawStatus;
+  return { prKey: row.pr_key, status, abandoned: isAbandoned(status) };
 }
 
 /** The instruction block appended (verbatim, via `appendPrompt`) to each side-effecting agent's

package/app/conformance.test.ts

@@ -3,6 +3,7 @@ import { test } from "node:test";
 import { assert, assertEquals, assertRejects, assertStringIncludes } from "#test-assert";
 import type { DataLayer } from "@nanobpm/urban";
 import { memBlackboardSource } from "../test/blackboardDb.ts";
+import { withTrackingViews } from "../test/trackingViews.ts";
 import { appendEntry } from "./blackboard.ts";
 import {
   acknowledgeConformance,
@@ -45,7 +46,7 @@ function memData(): { data: DataLayer; stores: Record<string, any[]> } {
       },
     };
   }
-  const data = { table: (n: string, pk?: string) => tbl(n, pk), source: memBlackboardSource().source } as any as DataLayer;
+  const data = { table: withTrackingViews((n: string, pk?: string) => tbl(n, pk)), source: memBlackboardSource().source } as any as DataLayer;
   return { data, stores };
 }
 

package/app/conformance.ts

@@ -17,6 +17,7 @@
 import type { DataLayer } from "@nanobpm/urban";
 import { type BlackboardEntry, isUniqueViolation, readBlackboard } from "./blackboard.ts";
 import { TERMINAL_STATUSES } from "./delivery.ts";
+import { derivedTrackingTable } from "./instanceTracking.ts";
 import { planTasks } from "./plan.ts";
 
 const now = () => new Date().toISOString();
@@ -45,15 +46,20 @@ interface PlanRow extends Record<string, unknown> {
 
 const plansTbl = (data: DataLayer) => data.table<PlanRow>("plans", "plan_key");
 const prsTbl = (data: DataLayer) =>
-  data.table<{ pr_key: string; status: string }>("pull_requests", "pr_key");
+  derivedTrackingTable<{ pr_key: string; derived_status: string }>(
+    data,
+    "pull_requests",
+    "pr_key",
+  );
 
 /** A slice's PR "landed" iff it exists and reached a non-abandoned terminal status. The single
  * predicate both {@link gatherConformance} and {@link hasDeliveredImplementationForPlan} apply, so
- * the full digest and the cheap trigger check can't disagree about what counts as landed. */
+ * the full digest and the cheap trigger check can't disagree about what counts as landed. Reads the
+ * ADR-0065 derived edge so an out-of-band-terminated PR is correctly excluded from "landed". */
 async function isLanded(data: DataLayer, prKey: string | null | undefined): Promise<boolean> {
   if (!prKey) return false;
   const pr = await prsTbl(data).get(prKey);
-  return !!pr && LANDED_PR_STATUSES.has(pr.status);
+  return !!pr && LANDED_PR_STATUSES.has(pr.derived_status);
 }
 const conformanceTbl = (data: DataLayer) =>
   data.table<{ plan_key: string } & Record<string, unknown>>("plan_conformance", "plan_key");

package/app/featureDelivery.test.ts

@@ -6,6 +6,7 @@
 import { test } from "node:test";
 import { assertEquals } from "#test-assert";
 import type { DataLayer } from "@nanobpm/urban";
+import { withTrackingViews } from "../test/trackingViews.ts";
 import { deriveFeatureDelivery } from "./feature.ts";
 import { pollFeatureDelivery } from "./service.ts";
 
@@ -34,7 +35,7 @@ function memData(): { data: DataLayer; stores: Record<string, any[]> } {
       },
     };
   }
-  const data = { table: (n: string, pk?: string) => tbl(n, pk) } as any as DataLayer;
+  const data = { table: withTrackingViews((n: string, pk?: string) => tbl(n, pk)) } as any as DataLayer;
   return { data, stores };
 }
 

package/app/instanceTracking.ts

@@ -0,0 +1,97 @@
+// nano-workforce — the app's single accessor for the `instanceTracking` derived read models
+// (ADR 0065, the writer→source inversion adopted with `@nanobpm/urban@0.81.0`).
+//
+// Since ADR 0065 the `instanceTracking` reconciler is a SOURCE, not a writer: on each poll it feeds
+// engine truth into urban's canonical projections (`urban_instance_state`, `urban_open_user_tasks`)
+// and NO LONGER writes the terminal (`onTerminated.set`) / wait-on-human (`onWaitingHuman.set`)
+// edges onto the app's base row. Those edges are now DERIVED — recomputed on every read — by an
+// auto-provisioned managed VIEW `<table>__tracking` whose `derived_status` column is
+// `CASE WHEN terminated THEN <onTerminated value> WHEN waiting-human THEN <onWaitingHuman value>
+// ELSE base.<statusField> END`. So the base `statusField` keeps only the worker-owned transient
+// status, and any reader that used to rely on the reconciler having written the terminal status
+// onto the base row must read `derived_status` off the VIEW instead.
+//
+// This module is the ONE place that:
+//   - parses the `instanceTracking` bindings from `nano.app.json` (the single source of truth), and
+//   - resolves each binding's derived VIEW name + `derived_status` column via urban's OWN target
+//     resolver (`instanceTrackingReadModelTarget`), so the app can never drift from the framework's
+//     view naming.
+//
+// Writers are unchanged: a service-task worker that owns a terminal outcome (`converged`, `merged`,
+// `done`, …) still writes it to the base `data.table(<table>)`. Only readers that classify on the
+// RECONCILER-derived edge (terminated → abandoned/failed/reviewed, or waiting-human →
+// awaiting_operator) route through the derived VIEW here.
+
+import { readFileSync } from "node:fs";
+import {
+  type AppManifest,
+  type DataLayer,
+  type InstanceTracking,
+  instanceTrackingReadModelTarget,
+  type Table,
+} from "@nanobpm/urban";
+
+/** The app manifest, parsed exactly ONCE at module load, typed by urban's own `AppManifest` so the
+ *  binding shape can never drift from the framework's schema. */
+const APP_MANIFEST: AppManifest = JSON.parse(
+  readFileSync(new URL("../nano.app.json", import.meta.url), "utf8"),
+);
+
+/** The app manifest's `instanceTracking` bindings — the single source of truth for the derived
+ *  read-model registry. */
+const INSTANCE_TRACKING_BINDINGS: readonly InstanceTracking[] = APP_MANIFEST.instanceTracking ?? [];
+
+/** The single `instanceTracking` binding for a base table, or throw if the manifest has none. */
+export function trackingBindingFor(table: string): InstanceTracking {
+  const binding = INSTANCE_TRACKING_BINDINGS.find((b) => b.table === table);
+  if (!binding) {
+    throw new Error(`nano.app.json: no instanceTracking binding for table "${table}"`);
+  }
+  return binding;
+}
+
+/** A tracked table's parked-and-active statuses, from the single source of truth
+ *  (`instanceTracking.<table>.activeStatuses` in nano.app.json), so an app-side scan can never drift
+ *  from the reconciler's notion of "in-flight". Throws if the binding is missing/empty. */
+export function activeStatusesFor(table: string): readonly string[] {
+  const binding = trackingBindingFor(table);
+  if (!binding.activeStatuses?.length) {
+    throw new Error(
+      `nano.app.json: instanceTracking[table="${table}"].activeStatuses is missing or empty`,
+    );
+  }
+  return binding.activeStatuses;
+}
+
+/** The managed derived read-model VIEW name + effective-status column for a base table, resolved by
+ *  urban's OWN target resolver so the app never drifts from the framework's `<table>__tracking` /
+ *  `derived_status` naming (ADR 0065). */
+export function trackingTargetFor(table: string): { view: string; statusColumn: string } {
+  return instanceTrackingReadModelTarget(trackingBindingFor(table));
+}
+
+/** The base table a derived tracking VIEW projects, or undefined when `view` is not a tracking view.
+ * The inverse of {@link trackingTargetFor}, resolved off the same binding registry so it can't drift
+ * from the framework's view naming. */
+export function baseTableForTrackingView(view: string): string | undefined {
+  return INSTANCE_TRACKING_BINDINGS.find((b) => trackingTargetFor(b.table).view === view)?.table;
+}
+
+/** The base `statusField` a binding's derived edge falls through to when no terminal/wait edge
+ * applies (the VIEW's `ELSE base.<statusField>` branch). Defaults to `"status"`, mirroring urban. */
+export function baseStatusFieldFor(table: string): string {
+  return trackingBindingFor(table).statusField ?? "status";
+}
+
+/** A read-only typed gateway over a tracked table's derived VIEW (`<table>__tracking`). The VIEW
+ *  re-exports `base.*` plus the derived `derived_status` column, so a row carries BOTH the base
+ *  transient `<statusField>` and the effective (ADR-0065-derived) `derived_status`. Read
+ *  `derived_status` to classify on the terminal / wait-on-human edge; urban forbids writing a VIEW,
+ *  so use `data.table(<table>)` for writes. `T` should include `derived_status: string`. */
+export function derivedTrackingTable<T extends object>(
+  data: DataLayer,
+  table: string,
+  pk: string,
+): Table<T> {
+  return data.table<T>(trackingTargetFor(table).view, pk);
+}

package/app/lineage.test.ts

@@ -6,6 +6,7 @@
 import { test } from "node:test";
 import { assert, assertEquals } from "#test-assert";
 import type { DataLayer } from "@nanobpm/urban";
+import { withTrackingViews } from "../test/trackingViews.ts";
 import {
   deriveLineage,
   type LineagePr,
@@ -176,7 +177,7 @@ function memData(): { data: DataLayer; stores: Record<string, any[]> } {
       },
     };
   }
-  const data = { table: (n: string, pk?: string) => tbl(n, pk) } as any as DataLayer;
+  const data = { table: withTrackingViews((n: string, pk?: string) => tbl(n, pk)) } as any as DataLayer;
   return { data, stores };
 }
 

package/app/lineage.ts

@@ -21,6 +21,7 @@
 import type { DataLayer } from "@nanobpm/urban";
 import { deriveDelivery, TERMINAL_STATUSES } from "./delivery.ts";
 import { type FeatureRun, featureRuns } from "./feature.ts";
+import { derivedTrackingTable } from "./instanceTracking.ts";
 import { type Plan, type PlanTask, plans, planTasks } from "./plan.ts";
 
 const now = () => new Date().toISOString();
@@ -307,9 +308,19 @@ interface PrRow {
   // Epic-phase projection this module maintains (issue #304, migration 043): the parent epic's phase
   // label for an epic slice PR, NULL otherwise. Read here only to keep the write idempotent.
   epic_phase_label: string | null;
+  // The ADR-0065 derived tracking edge (`pull_requests__tracking.derived_status`). Present ONLY on
+  // rows read through the derived VIEW (`prRowsRead`); undefined on base-table reads/writes. The
+  // frontier stage is derived from THIS, not the base transient `status`, so an out-of-band-
+  // terminated slice reads `abandoned` rather than a stale `converging`.
+  derived_status?: string;
 }
 
 const prRows = (data: DataLayer) => data.table<PrRow>("pull_requests", "pr_key");
+/** Read-only accessor over the PR derived tracking VIEW (`pull_requests__tracking`). The lineage
+ * frontier classifies on the reconciler-derived edge, so `collectThreads` reads through this and
+ * `toLineagePr` folds `derived_status` onto `LineagePr.status`. Writes stay on `prRows`. */
+const prRowsRead = (data: DataLayer) =>
+  derivedTrackingTable<PrRow & { derived_status: string }>(data, "pull_requests", "pr_key");
 
 /** The `lineage_thread_view` VIEW row (migration 064) — the read shape the Lineage page binds. The
  *  view PASSES THROUGH the procedural frontier columns from `lineage_threads` and DERIVES the
@@ -382,7 +393,9 @@ function toLineagePr(row: PrRow): LineagePr {
     prKey: row.pr_key,
     title: row.title,
     url: row.url,
-    status: row.status,
+    // Classify the frontier on the ADR-0065 derived edge when the row came through the tracking VIEW
+    // (`prRowsRead`); fall back to the base transient for any base-table row.
+    status: row.derived_status ?? row.status,
     round: row.current_round,
     processKey: row.process_key,
     outcome: row.outcome,
@@ -394,7 +407,7 @@ function toLineagePr(row: PrRow): LineagePr {
 async function collectThreads(
   data: DataLayer,
 ): Promise<{ threads: Map<string, LineageThread>; allPrs: PrRow[] }> {
-  const allPrs = await prRows(data).all();
+  const allPrs = await prRowsRead(data).all();
   const prByKey = new Map<string, PrRow>();
   for (const pr of allPrs) prByKey.set(pr.pr_key, pr);
 

package/app/promotionPoll.test.ts

@@ -6,6 +6,7 @@
 // recording engine: open exactly one PR, never a duplicate on re-run, never for a converging epic,
 // and never for a `main`-based epic.
 import { test } from "node:test";
+import { withTrackingViews } from "../test/trackingViews.ts";
 import { assert, assertEquals } from "#test-assert";
 import type { DataLayer, EngineClient } from "@nanobpm/urban";
 import { resetDefaultBranchCache } from "./github.ts";
@@ -41,7 +42,7 @@ function memData(): { data: DataLayer; stores: Record<string, any[]> } {
       },
     };
   }
-  const data = { table: (n: string, pk?: string) => tbl(n, pk) } as any as DataLayer;
+  const data = { table: withTrackingViews((n: string, pk?: string) => tbl(n, pk)) } as any as DataLayer;
   return { data, stores };
 }
 

package/app/retro.test.ts

@@ -3,6 +3,7 @@ import { test } from "node:test";
 import { assert, assertEquals, assertStringIncludes } from "#test-assert";
 import type { DataLayer, EngineClient } from "@nanobpm/urban";
 import { memBlackboardSource } from "../test/blackboardDb.ts";
+import { withTrackingViews } from "../test/trackingViews.ts";
 import { appendEntry } from "./blackboard.ts";
 import { recordTaskDelta } from "./taskDelta.ts";
 import {
@@ -47,7 +48,7 @@ function memData(): { data: DataLayer; stores: Record<string, any[]> } {
       },
     };
   }
-  const data = { table: (n: string, pk?: string) => tbl(n, pk), source: memBlackboardSource().source } as any as DataLayer;
+  const data = { table: withTrackingViews((n: string, pk?: string) => tbl(n, pk)), source: memBlackboardSource().source } as any as DataLayer;
   return { data, stores };
 }
 

package/app/retro.ts

@@ -17,6 +17,7 @@ import type { DataLayer, EngineClient, Logger } from "@nanobpm/urban";
 import { type BlackboardEntry, isUniqueViolation, readBlackboard } from "./blackboard.ts";
 import { hasDeliveredImplementationForPlan } from "./conformance.ts";
 import { TERMINAL_STATUSES } from "./delivery.ts";
+import { derivedTrackingTable } from "./instanceTracking.ts";
 import { planReviews, planTasks } from "./plan.ts";
 import { aggregateEpicDeltas } from "./taskDelta.ts";
 
@@ -55,7 +56,11 @@ interface PlanRow extends Record<string, unknown> {
 
 const plansTbl = (data: DataLayer) => data.table<PlanRow>("plans", "plan_key");
 const prsTbl = (data: DataLayer) =>
-  data.table<{ pr_key: string; status: string }>("pull_requests", "pr_key");
+  derivedTrackingTable<{ pr_key: string; derived_status: string }>(
+    data,
+    "pull_requests",
+    "pr_key",
+  );
 const retroStartsTbl = (data: DataLayer) =>
   data.table<{ plan_key: string; started_at: string }>("plan_retro_starts", "plan_key");
 
@@ -77,8 +82,10 @@ export async function isPlanComplete(data: DataLayer, planKey: string): Promise<
     if (SETTLED_TASKLESS.has(t.status)) continue;
     // Any task that is meant to yield a PR must have a terminal PR to be settled.
     if (!t.pr_key) return false; // pending/escalated/etc. with no PR yet → still in flight
+    // Any task that is meant to yield a PR must have a terminal PR to be settled. Read the ADR-0065
+    // derived edge so an out-of-band-terminated (`abandoned`) PR is recognised as terminal here.
     const pr = await prsTbl(data).get(t.pr_key);
-    if (!pr || !TERMINAL_PR_STATUSES.has(pr.status)) return false;
+    if (!pr || !TERMINAL_PR_STATUSES.has(pr.derived_status)) return false;
   }
   return true;
 }

package/app/service.test.ts

@@ -8,6 +8,7 @@
 import { test } from "node:test";
 import { assertEquals, assertRejects, assertStringIncludes } from "#test-assert";
 import { memDataFor } from "../test/worldDb.ts";
+import { withTrackingViews } from "../test/trackingViews.ts";
 import { DurableResumeRegistry } from "./durableResume.ts";
 import { WorldStore } from "./world/index.ts";
 import { abandonClosedPr, parsePr, pollCapabilityGatesImpl, pollIncidentsImpl, pollWaveGatesImpl, repoEnvelopeVars, startMerge, submitPr, worldRestoreSha } from "./service.ts";
@@ -71,7 +72,7 @@ test("re-submit of a cancelled PR marks stale open escalations", async () => {
       pr_dependencies: { rows: [], key: "pr_key" },
     };
     const data = {
-      table: (name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key),
+      table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
     } as any;
     const engine = {
       createInstance: () => Promise.resolve({ processInstanceKey: "PI-9" }),
@@ -137,7 +138,7 @@ test("pollIncidents mirrors an ACTIVE incident onto the PR row, then clears it,
     pull_requests: { rows: [row], key: "pr_key" },
   };
   const data = {
-    table: (name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key),
+    table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
   } as any;
   const headers = { "content-type": "application/json" };
 
@@ -190,7 +191,7 @@ test("pollIncidents never queries a PR with no live instance and clears any stal
     pull_requests: { rows: [noKey, terminal], key: "pr_key" },
   };
   const data = {
-    table: (name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key),
+    table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
   } as any;
   const headers = { "content-type": "application/json" };
 
@@ -223,7 +224,7 @@ test("pollIncidents picks the oldest incident by creationTime, sorting a missing
     pull_requests: { rows: [row], key: "pr_key" },
   };
   const data = {
-    table: (name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key),
+    table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
   } as any;
   const headers = { "content-type": "application/json" };
 
@@ -262,7 +263,7 @@ test("submitPr stringifies a numeric processInstanceKey (contract: string | null
       pr_dependencies: { rows: [], key: "pr_key" },
     };
     const data = {
-      table: (name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key),
+      table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
     } as any;
     const engine = {
       // A large key delivered as a JS number — the exact case that breaks dev response validation
@@ -296,7 +297,7 @@ function captureConvergeOnly() {
     pr_dependencies: { rows: [], key: "pr_key" },
   };
   const data = {
-    table: (name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key),
+    table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
   } as any;
   let captured: unknown;
   const engine = {
@@ -347,7 +348,7 @@ function captureRoot() {
     pr_dependencies: { rows: [], key: "pr_key" },
   };
   const data = {
-    table: (name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key),
+    table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
   } as any;
   let captured: unknown;
   const engine = {
@@ -629,7 +630,7 @@ test("pollWaveGatesImpl is level-triggered: PRs merged before the token arrives
       },
     };
     const data = {
-      table: (name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key),
+      table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
     } as any;
 
     const published: { name: string; correlationKey?: string }[] = [];
@@ -718,7 +719,7 @@ test("pollWaveGatesImpl never releases the barrier on an unverifiable subscripti
       },
     };
     const data = {
-      table: (name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key),
+      table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
     } as any;
 
     const published: { name: string; correlationKey?: string }[] = [];
@@ -822,7 +823,7 @@ test("pollWaveGatesImpl releases the wave when a member PR is closed-unmerged an
       merges: { rows: [], key: "id" },
     };
     const data = {
-      table: (name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key),
+      table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
     } as any;
 
     const published: { name: string; correlationKey?: string }[] = [];
@@ -878,7 +879,7 @@ test("abandonClosedPr is idempotent — the terminal merges audit row is written
     merges: { rows: [], key: "id" },
   };
   const data = {
-    table: (name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key),
+    table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
   } as any;
 
   await abandonClosedPr(data, "owner/repo#70", "closed without merging");
@@ -906,7 +907,7 @@ test("abandonClosedPr self-heals a missing pull_requests parent row before the F
     merges: { rows: [], key: "id" },
   };
   const data = {
-    table: (name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key),
+    table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
   } as any;
 
   await abandonClosedPr(data, "owner/repo#71", "closed without merging");
@@ -932,7 +933,7 @@ test("abandonClosedPr rejects a malformed prKey with a clear error before any FK
     merges: { rows: [], key: "id" },
   };
   const data = {
-    table: (name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key),
+    table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
   } as any;
 
   const err = await assertRejects(() => abandonClosedPr(data, "not-a-valid-pr-key", "closed without merging"));
@@ -1004,7 +1005,7 @@ function capsProbeExec(ready: boolean) {
 
 function capsDataLayer(stores: Record<string, { rows: any[]; key: string }>) {
   return {
-    table: (name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key),
+    table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
   } as any;
 }
 

package/app/service.ts

@@ -7,7 +7,6 @@
 //
 // Data access goes through the record-oriented gateway (`data.table<T>(name, pk)` — the RAD
 // `Table<T>` surface), not hand-written SQL. Row shapes are declared inline here.
-import { readFileSync } from "node:fs";
 import type { DataLayer, EngineClient } from "@nanobpm/urban";
 import { ABANDONED_STATUS, abandonUrl, mintAbandonToken, renderAbandonBrief } from "./abandon.ts";
 import { escalationFormId } from "./agentCompletion.ts";
@@ -51,6 +50,7 @@ import {
   type PrState,
   requestCopilotReview,
 } from "./github.ts";
+import { activeStatusesFor, derivedTrackingTable } from "./instanceTracking.ts";
 import { pollLineage } from "./lineage.ts";
 import { mergeLanes, readExclusions } from "./mergeExclusion.ts";
 import {
@@ -253,6 +253,16 @@ interface Escalation {
 }
 
 const prs = (data: DataLayer) => data.table<PullRequest>("pull_requests", "pr_key");
+/** A PR row as seen through its derived tracking VIEW (`pull_requests__tracking`): the base columns
+ * plus urban's ADR-0065 `derived_status`, which folds the reconciler's terminal edge
+ * (out-of-band terminate → `abandoned`) over the worker-owned transient. */
+type TrackedPullRequest = PullRequest & { derived_status: string };
+/** Read-only accessor over the PR derived tracking VIEW. Use this — and read `derived_status`, not
+ * `status` — for any terminal-edge classification (delivery/promotion/feature reconciliation), so an
+ * out-of-band-terminated PR (whose base row is still `converging`) is correctly seen as `abandoned`.
+ * Worker-written terminals (`merged`/`converged`) pass through unchanged. Writes stay on `prs`. */
+const prsTracking = (data: DataLayer) =>
+  derivedTrackingTable<TrackedPullRequest>(data, "pull_requests", "pr_key");
 const escs = (data: DataLayer) => data.table<Escalation>("escalations", "id");
 const deps = (data: DataLayer) => data.table<PrDependency>("pr_dependencies", "pr_key");
 
@@ -1948,7 +1958,8 @@ export async function derivePlanDelivery(
     let status = statusByPrKey?.get(t.pr_key);
     if (status === undefined && !statusByPrKey) {
       // On-demand caller: fetch just this slice's PR row rather than loading the whole table.
-      status = (await prs(data).get(t.pr_key))?.status;
+      // Read the ADR-0065 derived edge so an out-of-band-terminated slice reads `abandoned`.
+      status = (await prsTracking(data).get(t.pr_key))?.derived_status;
     }
     prStatuses.push(status ?? MISSING_PR_STATUS);
   }
@@ -2028,8 +2039,9 @@ export async function pollWaitGate(data: DataLayer) {
  * default branch, so there is nothing to promote. Best-effort + per-plan isolated. */
 export async function pollPromotion(data: DataLayer, engine: EngineClient, token: string) {
   // Preload every PR status once per pass (mirrors pollDelivery — avoids an N+1 `prs(data).get`).
+  // Read the ADR-0065 derived edge (`derived_status`) so a terminated slice reads `abandoned`.
   const statusByPrKey = new Map<string, string>();
-  for (const pr of await prs(data).all()) statusByPrKey.set(pr.pr_key, pr.status);
+  for (const pr of await prsTracking(data).all()) statusByPrKey.set(pr.pr_key, pr.derived_status);
   for (const plan of await plans(data).all()) {
     const base = plan.base_branch;
     // A non-`epic/*` base is never promotable — short-circuit before the per-plan delivery join.
@@ -2107,8 +2119,9 @@ export async function pollPromotion(data: DataLayer, engine: EngineClient, token
  * Never touches a run that isn't `converging` — additive/derived only, idempotent, best-effort. */
 export async function pollFeatureDelivery(data: DataLayer) {
   // Preload every PR status once per pass (mirrors pollDelivery — avoids an N+1 `prs(data).get`).
+  // Read the ADR-0065 derived edge (`derived_status`) so a terminated run reads `abandoned`.
   const statusByPrKey = new Map<string, string>();
-  for (const pr of await prs(data).all()) statusByPrKey.set(pr.pr_key, pr.status);
+  for (const pr of await prsTracking(data).all()) statusByPrKey.set(pr.pr_key, pr.derived_status);
   // Only `converging` runs are ever reconciled — query them via the `feature_runs(status)` index
   // (db/migrations/028) instead of scanning all history, so this pass stays O(in-flight), not
   // O(total runs), as the table grows.
@@ -2130,26 +2143,6 @@ export async function pollFeatureDelivery(data: DataLayer) {
   }
 }
 
-/** The app manifest, read and parsed exactly ONCE at module load. `activeStatusesFor` is invoked
- * three times during module initialization (the PR/plan/feature constants below); parsing here keeps
- * that to a single synchronous `readFileSync` + `JSON.parse` instead of one per lookup. */
-const APP_MANIFEST: { instanceTracking?: { table: string; activeStatuses?: string[] }[] } = JSON.parse(
-  readFileSync(new URL("../nano.app.json", import.meta.url), "utf8"),
-);
-
-/** Read a tracked table's parked-and-active statuses from the single source of truth
- * (`instanceTracking.<table>.activeStatuses` in nano.app.json), so an app-side scan can never drift
- * from the reconciler's notion of "in-flight". Throws if the binding is missing/empty. */
-function activeStatusesFor(table: string): readonly string[] {
-  const binding = APP_MANIFEST.instanceTracking?.find((b) => b.table === table);
-  if (!binding?.activeStatuses?.length) {
-    throw new Error(
-      `nano.app.json: instanceTracking[table="${table}"].activeStatuses is missing or empty`,
-    );
-  }
-  return binding.activeStatuses;
-}
-
 /** The `pull_requests` statuses a PR instance can be parked-and-active on, DERIVED from the single
  * source of truth (`instanceTracking.pull_requests.activeStatuses` in nano.app.json) so the app-side
  * scan can never drift from the reconciler's notion of "in-flight". `pollUserTasks` scans only these

package/e2e/convergence-loop.e2e.ts

@@ -22,6 +22,7 @@ import { mkdtempSync, rmSync, readFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { after, before, describe, test } from "node:test";
 import { bootTestApp, type TestApp } from "@nanobpm/urban-testkit";
+import { trackingTargetFor } from "../app/instanceTracking.ts";
 
 // The app root is this repo's root (one level up from `e2e/`) — where nano.app.json + openapi.yaml
 // + db/migrations + resources/processes live.
@@ -160,16 +161,20 @@ describe("nano-workforce e2e (urban-testkit pilot)", () => {
 
     // The operation registered the PR aggregate (instanceTracking table) and started a real engine
     // instance — synchronously, before any worker ran (we never settled).
-    const prs = app.db.table<{ pr_key: string; status: string; process_key: string | null }>(
-      "pull_requests",
-      "pr_key",
-    );
+    const prs = app.db.table<{
+      pr_key: string;
+      status: string;
+      process_key: string | null;
+      abandon_token: string | null;
+    }>("pull_requests", "pr_key");
     const row = await prs.findOne({ pr_key: prKey });
     assert.ok(row, "a pull_requests row was registered");
     assert.equal(row?.status, "converging", "the PR is tracked as actively converging");
     assert.ok(row?.process_key, "the row carries the engine process-instance key");
+    assert.ok(row?.abandon_token, "the row carries a #76 abandon-check capability token");
 
     const processInstanceKey = row!.process_key!;
+    const abandonToken = row!.abandon_token!;
     const before = await app.engine.searchProcessInstances({
       processInstanceKeys: [processInstanceKey],
     });
@@ -182,11 +187,39 @@ describe("nano-workforce e2e (urban-testkit pilot)", () => {
     assert.equal(stillActive?.status, "converging", "row not yet reconciled before any poll fires");
 
     // Advance past the instanceTracking pollMs (derived from nano.app.json above, plus a margin):
-    // the reconciler observes TERMINATED and applies the manifest `onTerminated.set` → status
-    // `abandoned`.
+    // the reconciler observes TERMINATED and feeds urban's instance projection. Under ADR-0065
+    // (urban 0.81.0, the writer→source inversion) it NO LONGER writes `abandoned` onto the base row;
+    // the terminal edge is DERIVED on read via the managed `pull_requests__tracking` VIEW.
     await app.advanceTime(PR_POLL_MS + 1000);
-    const reconciled = await prs.findOne({ pr_key: prKey });
-    assert.equal(reconciled?.status, "abandoned", "reconciler abandoned the terminated PR's row");
+
+    // (1) The base row keeps only the worker-owned transient — it stays `converging`, NOT rewritten.
+    const baseRow = await prs.findOne({ pr_key: prKey });
+    assert.equal(
+      baseRow?.status,
+      "converging",
+      "ADR-0065: the reconciler no longer writes the terminal edge onto the base row",
+    );
+
+    // (2) The derived tracking VIEW reports the terminal edge (`abandoned`) via `derived_status`. Its
+    // name/column are resolved by the app's SSOT helper, which defers to urban's own target resolver.
+    const target = trackingTargetFor("pull_requests");
+    const view = app.db.table<{ pr_key: string } & Record<string, unknown>>(target.view, "pr_key");
+    const derived = await view.findOne({ pr_key: prKey });
+    assert.equal(
+      derived?.[target.statusColumn],
+      "abandoned",
+      "the derived read-model reports the terminated PR as abandoned",
+    );
+
+    // (3) End-to-end, the #76 cooperative abandon-check endpoint (which a servicing agent curls
+    // before any irreversible action) now reports `abandoned: true` — the whole point of the edge.
+    const abandonCheck = await api.call<{ prKey: string; status: string; abandoned: boolean }>(
+      "checkAbandon",
+      { query: { token: abandonToken } },
+    );
+    assert.equal(abandonCheck.status, 200, "the abandon check resolves the known token");
+    assert.equal(abandonCheck.body.abandoned, true, "a servicing agent is told to abort the run");
+    assert.equal(abandonCheck.body.status, "abandoned", "the reported status is the derived edge");
   });
 
   test("coverage gate: every operation the pilot claims to own was exercised", () => {

package/operations/acknowledgeEpic.test.ts

@@ -18,6 +18,7 @@ import { assertEquals } from "#test-assert";
 import type { AppApi } from "@nanobpm/urban";
 import { deriveEpicBucket, epicIsAcknowledgeable } from "../app/delivery.ts";
 import { noopLog } from "../test/log.ts";
+import { withTrackingViews } from "../test/trackingViews.ts";
 import handler from "./acknowledgeEpic.ts";
 
 // An in-memory data layer wired through the `plans` gateway (now a plain record table). `extra` seeds
@@ -52,7 +53,7 @@ function memApp(
     };
   }
   const app = {
-    data: { table: (n: string, pk?: string) => tbl(n, pk) },
+    data: { table: withTrackingViews((n: string, pk?: string) => tbl(n, pk)) },
     log: noopLog(),
   } as any as AppApi;
   return { app, rows: stores.plans };

package/operations/checkAbandon.test.ts

@@ -3,6 +3,7 @@ import { test } from "node:test";
 import { assertEquals } from "#test-assert";
 import type { AppApi } from "@nanobpm/urban";
 import { noopLog } from "../test/log.ts";
+import { withTrackingViews } from "../test/trackingViews.ts";
 import handler from "./checkAbandon.ts";
 
 function memApp(): { app: AppApi } {
@@ -19,7 +20,7 @@ function memApp(): { app: AppApi } {
       },
     };
   }
-  const app = { data: { table: (n: string) => tbl(n) }, log: noopLog() } as any as AppApi;
+  const app = { data: { table: withTrackingViews((n: string) => tbl(n)) }, log: noopLog() } as any as AppApi;
   return { app };
 }
 

package/operations/getLineage.test.ts

@@ -6,6 +6,7 @@ import { test } from "node:test";
 import { assert, assertEquals } from "#test-assert";
 import type { AppApi } from "@nanobpm/urban";
 import { noopLog } from "../test/log.ts";
+import { withTrackingViews } from "../test/trackingViews.ts";
 import handler from "./getLineage.ts";
 
 function memApp(stores: Record<string, any[]>): AppApi {
@@ -20,7 +21,7 @@ function memApp(stores: Record<string, any[]>): AppApi {
       },
     };
   };
-  return { data: { table }, log: noopLog() } as any as AppApi;
+  return { data: { table: withTrackingViews(table) }, log: noopLog() } as any as AppApi;
 }
 
 function input(query: Record<string, string> = {}, headers: Record<string, string> = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.128.0",
+  "version": "0.129.0",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",
@@ -59,12 +59,12 @@
   },
   "dependencies": {
     "@nanobpm/agentic": "^0.4.0",
-    "@nanobpm/urban": "^0.80.0",
+    "@nanobpm/urban": "^0.81.0",
     "bpmn-auto-layout": "^2.0.0-alpha.2"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.4.11",
-    "@nanobpm/urban-testkit": "^0.12.16",
+    "@nanobpm/urban-testkit": "^0.13.1",
     "@nanobpm/workflow": "^0.14.0",
     "@semantic-release/changelog": "^6.0.3",
     "@semantic-release/git": "^10.0.1",

package/test/trackingViews.ts

@@ -0,0 +1,50 @@
+// Test-only helper: make a hand-rolled fake `DataLayer.table(name)` also serve the ADR-0065 derived
+// tracking VIEWs (`<table>__tracking`) that the real `@nanobpm/urban` runtime auto-provisions.
+//
+// The app's terminal-edge readers (app/abandon.ts, app/lineage.ts, app/conformance.ts, app/retro.ts,
+// app/service.ts) route through `<table>__tracking` and read `derived_status`. The in-memory fakes in
+// the unit tests only model base tables keyed by name, so a read of `pull_requests__tracking` would
+// hit an empty store. Wrapping a fake's `table` resolver with `withTrackingViews` transparently
+// aliases any tracking VIEW onto its base store and projects the derived column.
+//
+// Fidelity: a fake has no engine instance-state, so it can only compute the VIEW's `ELSE
+// base.<statusField>` fall-through branch — which is exactly how these tests model an already-settled
+// PR (they seed the terminal directly onto the base row). So `derived_status := base.<statusField>`
+// reproduces the real view's pass-through semantics for the states unit tests exercise, with zero
+// duplicated view-naming logic (it defers to the app's SSOT resolvers in app/instanceTracking.ts).
+import { baseStatusFieldFor, baseTableForTrackingView, trackingTargetFor } from "../app/instanceTracking.ts";
+
+// biome-ignore lint/suspicious/noExplicitAny: test-only fake `table` resolver over dynamic row shapes.
+type TableFn = (name: string, pk?: string) => any;
+
+/** Decorate a fake `table(name, pk)` resolver so it also serves every `<table>__tracking` derived
+ * VIEW off the corresponding base store, projecting `derived_status := base.<statusField>` onto each
+ * row the read methods (`findOne`/`get`/`find`/`all`) return. A non-tracking name is passed through
+ * untouched, and the VIEW is read-only (writes are never wrapped). */
+export function withTrackingViews<F extends TableFn>(base: F): F {
+  return ((name: string, pk?: string) => {
+    const baseName = baseTableForTrackingView(name);
+    if (!baseName) return base(name, pk);
+    const inner = base(baseName, pk);
+    const derivedColumn = trackingTargetFor(baseName).statusColumn;
+    const statusField = baseStatusFieldFor(baseName);
+    // biome-ignore lint/suspicious/noExplicitAny: test-only projection over dynamic row shapes.
+    const project = (row: any) =>
+      row == null ? row : { ...row, [derivedColumn]: row[statusField] };
+    // biome-ignore lint/suspicious/noExplicitAny: test-only Proxy over a dynamic DataLayer table.
+    return new Proxy(inner, {
+      get(target: any, prop: string) {
+        const value = target[prop];
+        if (typeof value !== "function") return value;
+        const bound = value.bind(target);
+        if (prop === "findOne" || prop === "get") {
+          return async (...args: unknown[]) => project(await bound(...args));
+        }
+        if (prop === "find" || prop === "all") {
+          return async (...args: unknown[]) => (await bound(...args)).map(project);
+        }
+        return bound;
+      },
+    });
+  }) as F;
+}

package/test/worldDb.ts

@@ -7,6 +7,7 @@ import { DatabaseSync, type SQLInputValue } from "node:sqlite";
 import { afterEach } from "node:test";
 import { fileURLToPath } from "node:url";
 import type { DataLayer } from "@nanobpm/urban";
+import { withTrackingViews } from "./trackingViews.ts";
 
 const openDbs = new Set<DatabaseSync>();
 afterEach(() => {
@@ -103,7 +104,7 @@ export function memDataFor(migrationFiles: readonly string[]): { data: DataLayer
     db.exec(sql);
   }
   const data = {
-    table: (name: string, pk = "id") => gateway(db, name, pk),
+    table: withTrackingViews((name: string, pk = "id") => gateway(db, name, pk)),
     open: () => openDataSource(db),
   } as unknown as DataLayer;
   return { data, db };

package/workers/retro-gather/worker.test.ts

@@ -3,6 +3,7 @@ import { assert, assertEquals, assertStringIncludes } from "#test-assert";
 import type { DataLayer } from "@nanobpm/urban";
 import { noopLog } from "../../test/log.ts";
 import { memBlackboardSource } from "../../test/blackboardDb.ts";
+import { withTrackingViews } from "../../test/trackingViews.ts";
 import { appendEntry } from "../../app/blackboard.ts";
 import handler from "./worker.ts";
 
@@ -30,7 +31,7 @@ function memData(): { data: DataLayer; stores: Record<string, any[]> } {
       async update() {},
     };
   }
-  const data = { table: (n: string, pk?: string) => tbl(n, pk), source: memBlackboardSource().source } as any as DataLayer;
+  const data = { table: withTrackingViews((n: string, pk?: string) => tbl(n, pk)), source: memBlackboardSource().source } as any as DataLayer;
   return { data, stores };
 }