@nanobpm/nano-workforce 0.128.0 → 0.129.1

package/.github/workflows/pr-title-lint.yml

@@ -1,9 +1,11 @@
 name: PR title lint
 
 # Squash-merge uses the PR title as the commit subject on `main`, and
-# semantic-release (Angular preset) only cuts a release for `feat:`/`fix:`/`perf:`.
-# A non-conventional title therefore lands on `main` and is silently skipped by
-# the release job — so gate the title against the Conventional Commits grammar.
+# semantic-release (conventionalcommits preset) cuts a release for
+# `feat:`/`fix:`/`perf:`/`refactor:`/`build:`/`revert:`/`docs:` (see
+# `.releaserc.json` releaseRules). A non-conventional title therefore lands on
+# `main` and is silently skipped by the release job — so gate the title against
+# the Conventional Commits grammar.
 on:
   pull_request:
     types: [opened, edited, synchronize, reopened]

package/.releaserc.json

@@ -1,8 +1,42 @@
 {
   "branches": ["main"],
   "plugins": [
-    "@semantic-release/commit-analyzer",
-    "@semantic-release/release-notes-generator",
+    [
+      "@semantic-release/commit-analyzer",
+      {
+        "preset": "conventionalcommits",
+        "releaseRules": [
+          { "type": "feat", "release": "minor" },
+          { "type": "fix", "release": "patch" },
+          { "type": "perf", "release": "patch" },
+          { "type": "refactor", "release": "patch" },
+          { "type": "build", "release": "patch" },
+          { "type": "revert", "release": "patch" },
+          { "type": "docs", "release": "patch" }
+        ]
+      }
+    ],
+    [
+      "@semantic-release/release-notes-generator",
+      {
+        "preset": "conventionalcommits",
+        "presetConfig": {
+          "types": [
+            { "type": "feat", "section": "Features" },
+            { "type": "fix", "section": "Bug Fixes" },
+            { "type": "perf", "section": "Performance Improvements" },
+            { "type": "refactor", "section": "Code Refactoring" },
+            { "type": "build", "section": "Build System" },
+            { "type": "revert", "section": "Reverts" },
+            { "type": "docs", "section": "Documentation" },
+            { "type": "test", "hidden": true },
+            { "type": "ci", "hidden": true },
+            { "type": "chore", "hidden": true },
+            { "type": "style", "hidden": true }
+          ]
+        }
+      }
+    ],
     "@semantic-release/changelog",
     "@semantic-release/npm",
     "@semantic-release/github",

package/AGENTS.md

@@ -353,16 +353,20 @@ agents:
 - **DCO sign-off is enforced.** Every commit needs a `Signed-off-by` trailer —
   use `git commit -s` (or `git rebase --signoff`). A missing sign-off fails the
   DCO check.
-- **Conventional Commits.** `feat:`, `fix:`, `chore:`, `docs:`, `refactor:`,
-  `test:`, imperative mood. Review-comment fix-ups are `chore:`, not `fix:`.
+- **Conventional Commits.** `feat:`, `fix:`, `perf:`, `refactor:`, `build:`,
+  `revert:`, `docs:`, `chore:`, `ci:`, `test:`, `style:`, imperative mood — see the
+  next bullet for which of these trigger a release. Review-comment fix-ups are
+  `chore:`, not `fix:`.
 - **PR titles must be Conventional too — they become the release trigger.** PRs
   land on `main` via **squash merge**, so the **PR title is the commit subject**
-  semantic-release analyses. Only `feat:` (minor) and `fix:`/`perf:` (patch) cut a
-  release; any other type — or a non-conventional title like `Redesign …` or
-  `Foundation: …` — lands on `main` and is **silently skipped** by the release job
+  semantic-release analyses. `feat:` cuts a **minor**; `fix:`, `perf:`,
+  `refactor:`, `build:`, `revert:`, and `docs:` cut a **patch** (see
+  `.releaserc.json` `releaseRules`); a `BREAKING CHANGE:` footer cuts a **major**.
+  Only `chore:`, `ci:`, `test:`, and `style:` are **no-release** — a PR titled
+  with one of those lands on `main` and is **silently skipped** by the release job
   (no version, no changelog, no deploy). A user-facing feature **must** be titled
   `feat:`. The `PR title lint` workflow (`.github/workflows/pr-title-lint.yml`)
-  enforces this; if a non-conventional title ever slips through, push one empty
+  enforces this; if a non-releasing title ever slips through, push one empty
   releasable commit (`git commit --allow-empty -s -m "feat(scope): …"`) to release
   the accumulated changes.
 - **Feature work in a worktree** off `origin/main`, one branch per change; open a

package/CHANGELOG.md

@@ -1,3 +1,16 @@
+## [0.129.1](https://github.com/nanobpm/nano-workforce/compare/v0.129.0...v0.129.1) (2026-08-23)
+
+### Code Refactoring
+
+* **merge-loop:** sub-process topology + behavioural guards ([#466](https://github.com/nanobpm/nano-workforce/issues/466)) ([#490](https://github.com/nanobpm/nano-workforce/issues/490)) ([ac6f130](https://github.com/nanobpm/nano-workforce/commit/ac6f130d19e545c4d3da23d738c30c1cb6f2b981)), closes [Magikcraft/nano-bpm#971](https://github.com/Magikcraft/nano-bpm/issues/971)
+
+# [0.129.0](https://github.com/nanobpm/nano-workforce/compare/v0.128.0...v0.129.0) (2026-08-23)
+
+
+### Features
+
+* adopt ADR-0065 derived instanceTracking read-models (urban 0.81.0) ([#489](https://github.com/nanobpm/nano-workforce/issues/489)) ([ce25501](https://github.com/nanobpm/nano-workforce/commit/ce255013b383eb4d593526c5f34e74aaab535d25)), closes [#318](https://github.com/nanobpm/nano-workforce/issues/318) [nano-workforce#422](https://github.com/nano-workforce/issues/422) [#76](https://github.com/nanobpm/nano-workforce/issues/76)
+
 # [0.128.0](https://github.com/nanobpm/nano-workforce/compare/v0.127.0...v0.128.0) (2026-08-23)
 
 

package/app/abandon.test.ts

@@ -1,7 +1,8 @@
 // Tests for the cooperative abandon-check helpers (issue #76).
 import { test } from "node:test";
-import { assertEquals, assertNotEquals } from "#test-assert";
+import { assertEquals, assertNotEquals, assertRejects } from "#test-assert";
 import type { DataLayer } from "@nanobpm/urban";
+import { withTrackingViews } from "../test/trackingViews.ts";
 import {
   abandonStatusForToken,
   abandonTokenFromUrl,
@@ -26,7 +27,7 @@ function memData(): DataLayer {
       },
     };
   }
-  return { table: (n: string) => tbl(n) } as any as DataLayer;
+  return { table: withTrackingViews((n: string) => tbl(n)) } as any as DataLayer;
 }
 
 async function seedPr(data: DataLayer, pr_key: string, abandon_token: string, status: string) {
@@ -106,3 +107,16 @@ test("abandonStatusForToken derives abandoned from the row status", async () =>
   });
   assertEquals(await abandonStatusForToken(data, "nope"), undefined);
 });
+
+test("abandonStatusForToken fails CLOSED on a non-string derived status", async () => {
+  // A malformed/missing derived_status must never be reported as `abandoned:false`
+  // (that would let a cancelled run proceed with irreversible side effects). It throws
+  // instead, which the operation dispatcher maps to a 500 so the agent's `curl -f` aborts.
+  const data = memData();
+  await data.table("pull_requests", "pr_key").insert({
+    pr_key: "o/r#3",
+    abandon_token: "weird",
+    status: 123,
+  });
+  await assertRejects(() => abandonStatusForToken(data, "weird"), Error, "is not a string");
+});

package/app/abandon.ts

@@ -10,23 +10,28 @@
 // Design invariants (mirroring the blackboard, app/blackboard.ts):
 //   - CAPABILITY URL. The per-PR token IS the credential; the agent curls the exact URL it was
 //     handed in its prompt. An unknown token is a 404 (never leaks which PRs exist).
-//   - DERIVED, not a separate marker. `abandoned` is read straight off `pull_requests.status`,
-//     which Urban's cancel primitive sets to 'abandoned' on cancel (via the `instanceTracking`
-//     `onTerminated.set` patch, applied the instant the instance terminates). No new state to
-//     keep in sync.
+//   - DERIVED, not a separate marker. `abandoned` is read off the PR's ADR-0065 derived tracking
+//     VIEW (`pull_requests__tracking.derived_status`). Since urban 0.81.0 the `instanceTracking`
+//     reconciler no longer WRITES 'abandoned' onto the base row on cancel; it feeds urban's instance
+//     projection and the `onTerminated.set` edge is recomputed on every read as `derived_status`. So
+//     an out-of-band cancel leaves the base `status` at its transient (e.g. `converging`) but the
+//     derived view reports 'abandoned' immediately — reading the view keeps the abort-check correct
+//     with no new state to sync. (`abandonClosedPr`, #352, still writes 'abandoned' onto the base
+//     row directly; the view passes that worker-written terminal through unchanged.)
 //   - ADVISORY. Like the blackboard, this never hard-locks; it narrows an unavoidable
 //     check-then-push (TOCTOU) window to near-zero. Job fencing in the harness (issue #76 layer 2)
 //     is what makes it airtight.
 import type { DataLayer } from "@nanobpm/urban";
 import { publicBaseUrl } from "./blackboard.ts";
+import { trackingTargetFor } from "./instanceTracking.ts";
 
-/** The one app-row status meaning a PR is terminally abandoned — the run must not be worked on
- * further. Two disjoint producers flip a row here, and both are non-completion terminals that must
+/** The one derived-status value meaning a PR is terminally abandoned — the run must not be worked on
+ * further. Two disjoint producers surface a row here, and both are non-completion terminals that must
  * stop a servicing agent:
- *   1. an explicit **cancel** of a live convergence/merge run (Urban's cancel primitive, via the
- *      `instanceTracking` `onTerminated.set` patch), and
+ *   1. an explicit **cancel** of a live convergence/merge run (Urban's cancel primitive terminates
+ *      the instance; the `instanceTracking` `onTerminated.set` edge derives `abandoned` on read), and
  *   2. **`abandonClosedPr`** reconciling a wave-member PR that was **closed on GitHub without
- *      merging** (#352) — for both `pull_requests` and its `plan_tasks`.
+ *      merging** (#352) — for both `pull_requests` and its `plan_tasks` — by writing the base row.
  * Convergence/merge terminal states `converged`/`merged` are NOT abandonment. In either abandoned
  * case a servicing agent should stop, so the abandon-check endpoint treating both as `abandoned:
  * true` is correct. */
@@ -69,32 +74,49 @@ export function abandonTokenFromUrl(url: string | null | undefined): string | un
   }
 }
 
-/** Resolve an abandon token back to its PR key, or undefined when the token is unknown. */
+/** Resolve an abandon token back to its PR key, or undefined when the token is unknown. Reads the
+ * derived tracking VIEW (a strict superset of the base row) so this stays valid post-ADR-0065. */
 export async function prKeyForAbandonToken(
   data: DataLayer,
   token: string,
 ): Promise<string | undefined> {
   if (!token) return undefined;
   const row = await data
-    .table<{ pr_key: string; abandon_token: string | null }>("pull_requests", "pr_key")
+    .table<{ pr_key: string; abandon_token: string | null }>(
+      trackingTargetFor("pull_requests").view,
+      "pr_key",
+    )
     .findOne({ abandon_token: token });
   return row?.pr_key;
 }
 
-/** The abandon status of a PR, or undefined when the token is unknown. */
+/** The abandon status of a PR, or undefined when the token is unknown. Reads the ADR-0065 derived
+ * tracking VIEW's `derived_status`, so an out-of-band-cancelled run (whose base row is still
+ * `converging`) is correctly reported `abandoned: true` the instant the instance terminates. */
 export async function abandonStatusForToken(
   data: DataLayer,
   token: string,
 ): Promise<{ prKey: string; status: string; abandoned: boolean } | undefined> {
   if (!token) return undefined;
+  const target = trackingTargetFor("pull_requests");
   const row = await data
-    .table<{ pr_key: string; abandon_token: string | null; status: string }>(
-      "pull_requests",
-      "pr_key",
-    )
+    .table<
+      { pr_key: string; abandon_token: string | null } & Record<string, unknown>
+    >(target.view, "pr_key")
     .findOne({ abandon_token: token });
   if (!row) return undefined;
-  return { prKey: row.pr_key, status: row.status, abandoned: isAbandoned(row.status) };
+  const rawStatus = row[target.statusColumn];
+  if (typeof rawStatus !== "string") {
+    // Fail CLOSED: a missing/non-string derived_status must never be reported as
+    // `abandoned:false`. The abort brief tells agents to proceed on a 200 with
+    // `abandoned:false`, so surfacing this as a thrown error (→ 500, which trips the
+    // agent's `curl -f` and aborts) is the safe direction for a cancelled run.
+    throw new Error(
+      `abandonStatusForToken: ${target.view}.${target.statusColumn} is not a string`,
+    );
+  }
+  const status = rawStatus;
+  return { prKey: row.pr_key, status, abandoned: isAbandoned(status) };
 }
 
 /** The instruction block appended (verbatim, via `appendPrompt`) to each side-effecting agent's

package/app/conformance.test.ts

@@ -3,6 +3,7 @@ import { test } from "node:test";
 import { assert, assertEquals, assertRejects, assertStringIncludes } from "#test-assert";
 import type { DataLayer } from "@nanobpm/urban";
 import { memBlackboardSource } from "../test/blackboardDb.ts";
+import { withTrackingViews } from "../test/trackingViews.ts";
 import { appendEntry } from "./blackboard.ts";
 import {
   acknowledgeConformance,
@@ -45,7 +46,7 @@ function memData(): { data: DataLayer; stores: Record<string, any[]> } {
       },
     };
   }
-  const data = { table: (n: string, pk?: string) => tbl(n, pk), source: memBlackboardSource().source } as any as DataLayer;
+  const data = { table: withTrackingViews((n: string, pk?: string) => tbl(n, pk)), source: memBlackboardSource().source } as any as DataLayer;
   return { data, stores };
 }
 

package/app/conformance.ts

@@ -17,6 +17,7 @@
 import type { DataLayer } from "@nanobpm/urban";
 import { type BlackboardEntry, isUniqueViolation, readBlackboard } from "./blackboard.ts";
 import { TERMINAL_STATUSES } from "./delivery.ts";
+import { derivedTrackingTable } from "./instanceTracking.ts";
 import { planTasks } from "./plan.ts";
 
 const now = () => new Date().toISOString();
@@ -45,15 +46,20 @@ interface PlanRow extends Record<string, unknown> {
 
 const plansTbl = (data: DataLayer) => data.table<PlanRow>("plans", "plan_key");
 const prsTbl = (data: DataLayer) =>
-  data.table<{ pr_key: string; status: string }>("pull_requests", "pr_key");
+  derivedTrackingTable<{ pr_key: string; derived_status: string }>(
+    data,
+    "pull_requests",
+    "pr_key",
+  );
 
 /** A slice's PR "landed" iff it exists and reached a non-abandoned terminal status. The single
  * predicate both {@link gatherConformance} and {@link hasDeliveredImplementationForPlan} apply, so
- * the full digest and the cheap trigger check can't disagree about what counts as landed. */
+ * the full digest and the cheap trigger check can't disagree about what counts as landed. Reads the
+ * ADR-0065 derived edge so an out-of-band-terminated PR is correctly excluded from "landed". */
 async function isLanded(data: DataLayer, prKey: string | null | undefined): Promise<boolean> {
   if (!prKey) return false;
   const pr = await prsTbl(data).get(prKey);
-  return !!pr && LANDED_PR_STATUSES.has(pr.status);
+  return !!pr && LANDED_PR_STATUSES.has(pr.derived_status);
 }
 const conformanceTbl = (data: DataLayer) =>
   data.table<{ plan_key: string } & Record<string, unknown>>("plan_conformance", "plan_key");

package/app/featureDelivery.test.ts

@@ -6,6 +6,7 @@
 import { test } from "node:test";
 import { assertEquals } from "#test-assert";
 import type { DataLayer } from "@nanobpm/urban";
+import { withTrackingViews } from "../test/trackingViews.ts";
 import { deriveFeatureDelivery } from "./feature.ts";
 import { pollFeatureDelivery } from "./service.ts";
 
@@ -34,7 +35,7 @@ function memData(): { data: DataLayer; stores: Record<string, any[]> } {
       },
     };
   }
-  const data = { table: (n: string, pk?: string) => tbl(n, pk) } as any as DataLayer;
+  const data = { table: withTrackingViews((n: string, pk?: string) => tbl(n, pk)) } as any as DataLayer;
   return { data, stores };
 }
 

package/app/instanceTracking.ts

@@ -0,0 +1,97 @@
+// nano-workforce — the app's single accessor for the `instanceTracking` derived read models
+// (ADR 0065, the writer→source inversion adopted with `@nanobpm/urban@0.81.0`).
+//
+// Since ADR 0065 the `instanceTracking` reconciler is a SOURCE, not a writer: on each poll it feeds
+// engine truth into urban's canonical projections (`urban_instance_state`, `urban_open_user_tasks`)
+// and NO LONGER writes the terminal (`onTerminated.set`) / wait-on-human (`onWaitingHuman.set`)
+// edges onto the app's base row. Those edges are now DERIVED — recomputed on every read — by an
+// auto-provisioned managed VIEW `<table>__tracking` whose `derived_status` column is
+// `CASE WHEN terminated THEN <onTerminated value> WHEN waiting-human THEN <onWaitingHuman value>
+// ELSE base.<statusField> END`. So the base `statusField` keeps only the worker-owned transient
+// status, and any reader that used to rely on the reconciler having written the terminal status
+// onto the base row must read `derived_status` off the VIEW instead.
+//
+// This module is the ONE place that:
+//   - parses the `instanceTracking` bindings from `nano.app.json` (the single source of truth), and
+//   - resolves each binding's derived VIEW name + `derived_status` column via urban's OWN target
+//     resolver (`instanceTrackingReadModelTarget`), so the app can never drift from the framework's
+//     view naming.
+//
+// Writers are unchanged: a service-task worker that owns a terminal outcome (`converged`, `merged`,
+// `done`, …) still writes it to the base `data.table(<table>)`. Only readers that classify on the
+// RECONCILER-derived edge (terminated → abandoned/failed/reviewed, or waiting-human →
+// awaiting_operator) route through the derived VIEW here.
+
+import { readFileSync } from "node:fs";
+import {
+  type AppManifest,
+  type DataLayer,
+  type InstanceTracking,
+  instanceTrackingReadModelTarget,
+  type Table,
+} from "@nanobpm/urban";
+
+/** The app manifest, parsed exactly ONCE at module load, typed by urban's own `AppManifest` so the
+ *  binding shape can never drift from the framework's schema. */
+const APP_MANIFEST: AppManifest = JSON.parse(
+  readFileSync(new URL("../nano.app.json", import.meta.url), "utf8"),
+);
+
+/** The app manifest's `instanceTracking` bindings — the single source of truth for the derived
+ *  read-model registry. */
+const INSTANCE_TRACKING_BINDINGS: readonly InstanceTracking[] = APP_MANIFEST.instanceTracking ?? [];
+
+/** The single `instanceTracking` binding for a base table, or throw if the manifest has none. */
+export function trackingBindingFor(table: string): InstanceTracking {
+  const binding = INSTANCE_TRACKING_BINDINGS.find((b) => b.table === table);
+  if (!binding) {
+    throw new Error(`nano.app.json: no instanceTracking binding for table "${table}"`);
+  }
+  return binding;
+}
+
+/** A tracked table's parked-and-active statuses, from the single source of truth
+ *  (`instanceTracking.<table>.activeStatuses` in nano.app.json), so an app-side scan can never drift
+ *  from the reconciler's notion of "in-flight". Throws if the binding is missing/empty. */
+export function activeStatusesFor(table: string): readonly string[] {
+  const binding = trackingBindingFor(table);
+  if (!binding.activeStatuses?.length) {
+    throw new Error(
+      `nano.app.json: instanceTracking[table="${table}"].activeStatuses is missing or empty`,
+    );
+  }
+  return binding.activeStatuses;
+}
+
+/** The managed derived read-model VIEW name + effective-status column for a base table, resolved by
+ *  urban's OWN target resolver so the app never drifts from the framework's `<table>__tracking` /
+ *  `derived_status` naming (ADR 0065). */
+export function trackingTargetFor(table: string): { view: string; statusColumn: string } {
+  return instanceTrackingReadModelTarget(trackingBindingFor(table));
+}
+
+/** The base table a derived tracking VIEW projects, or undefined when `view` is not a tracking view.
+ * The inverse of {@link trackingTargetFor}, resolved off the same binding registry so it can't drift
+ * from the framework's view naming. */
+export function baseTableForTrackingView(view: string): string | undefined {
+  return INSTANCE_TRACKING_BINDINGS.find((b) => trackingTargetFor(b.table).view === view)?.table;
+}
+
+/** The base `statusField` a binding's derived edge falls through to when no terminal/wait edge
+ * applies (the VIEW's `ELSE base.<statusField>` branch). Defaults to `"status"`, mirroring urban. */
+export function baseStatusFieldFor(table: string): string {
+  return trackingBindingFor(table).statusField ?? "status";
+}
+
+/** A read-only typed gateway over a tracked table's derived VIEW (`<table>__tracking`). The VIEW
+ *  re-exports `base.*` plus the derived `derived_status` column, so a row carries BOTH the base
+ *  transient `<statusField>` and the effective (ADR-0065-derived) `derived_status`. Read
+ *  `derived_status` to classify on the terminal / wait-on-human edge; urban forbids writing a VIEW,
+ *  so use `data.table(<table>)` for writes. `T` should include `derived_status: string`. */
+export function derivedTrackingTable<T extends object>(
+  data: DataLayer,
+  table: string,
+  pk: string,
+): Table<T> {
+  return data.table<T>(trackingTargetFor(table).view, pk);
+}

package/app/lineage.test.ts

@@ -6,6 +6,7 @@
 import { test } from "node:test";
 import { assert, assertEquals } from "#test-assert";
 import type { DataLayer } from "@nanobpm/urban";
+import { withTrackingViews } from "../test/trackingViews.ts";
 import {
   deriveLineage,
   type LineagePr,
@@ -176,7 +177,7 @@ function memData(): { data: DataLayer; stores: Record<string, any[]> } {
       },
     };
   }
-  const data = { table: (n: string, pk?: string) => tbl(n, pk) } as any as DataLayer;
+  const data = { table: withTrackingViews((n: string, pk?: string) => tbl(n, pk)) } as any as DataLayer;
   return { data, stores };
 }
 

package/app/lineage.ts

@@ -21,6 +21,7 @@
 import type { DataLayer } from "@nanobpm/urban";
 import { deriveDelivery, TERMINAL_STATUSES } from "./delivery.ts";
 import { type FeatureRun, featureRuns } from "./feature.ts";
+import { derivedTrackingTable } from "./instanceTracking.ts";
 import { type Plan, type PlanTask, plans, planTasks } from "./plan.ts";
 
 const now = () => new Date().toISOString();
@@ -307,9 +308,19 @@ interface PrRow {
   // Epic-phase projection this module maintains (issue #304, migration 043): the parent epic's phase
   // label for an epic slice PR, NULL otherwise. Read here only to keep the write idempotent.
   epic_phase_label: string | null;
+  // The ADR-0065 derived tracking edge (`pull_requests__tracking.derived_status`). Present ONLY on
+  // rows read through the derived VIEW (`prRowsRead`); undefined on base-table reads/writes. The
+  // frontier stage is derived from THIS, not the base transient `status`, so an out-of-band-
+  // terminated slice reads `abandoned` rather than a stale `converging`.
+  derived_status?: string;
 }
 
 const prRows = (data: DataLayer) => data.table<PrRow>("pull_requests", "pr_key");
+/** Read-only accessor over the PR derived tracking VIEW (`pull_requests__tracking`). The lineage
+ * frontier classifies on the reconciler-derived edge, so `collectThreads` reads through this and
+ * `toLineagePr` folds `derived_status` onto `LineagePr.status`. Writes stay on `prRows`. */
+const prRowsRead = (data: DataLayer) =>
+  derivedTrackingTable<PrRow & { derived_status: string }>(data, "pull_requests", "pr_key");
 
 /** The `lineage_thread_view` VIEW row (migration 064) — the read shape the Lineage page binds. The
  *  view PASSES THROUGH the procedural frontier columns from `lineage_threads` and DERIVES the
@@ -382,7 +393,9 @@ function toLineagePr(row: PrRow): LineagePr {
     prKey: row.pr_key,
     title: row.title,
     url: row.url,
-    status: row.status,
+    // Classify the frontier on the ADR-0065 derived edge when the row came through the tracking VIEW
+    // (`prRowsRead`); fall back to the base transient for any base-table row.
+    status: row.derived_status ?? row.status,
     round: row.current_round,
     processKey: row.process_key,
     outcome: row.outcome,
@@ -394,7 +407,7 @@ function toLineagePr(row: PrRow): LineagePr {
 async function collectThreads(
   data: DataLayer,
 ): Promise<{ threads: Map<string, LineageThread>; allPrs: PrRow[] }> {
-  const allPrs = await prRows(data).all();
+  const allPrs = await prRowsRead(data).all();
   const prByKey = new Map<string, PrRow>();
   for (const pr of allPrs) prByKey.set(pr.pr_key, pr);
 

package/app/mergeEscalationUserTask.test.ts

@@ -1,71 +1,37 @@
-// Structural + cross-layer regression guard for converging the merge-loop escalation onto the ONE
-// native user-task answer pathway (#256).
+// Cross-layer drift guard: the merge-loop escalation user task the model parks on must be one the
+// canonical completer (`agentCompletion.ts`) actually accepts and validates (#256, #466).
 //
-// Before #256 the merge loop parked on a durable `escalation-answered` message catch answered by a
-// bespoke `answerEscalation()` publish — a SECOND answer pathway invisible to the Tasks inbox, so a
-// merge escalation could not be answered from the nwf UI at all. It now parks on a native
-// `wait-merge-answer` userTask (backed by `pr-escalation.form`) followed by the SAME
-// `pr.answer-escalation` reconcile step the review loop's `wait-answer` runs, so both loops answer
-// through the one canonical `completeUserTask` door and surface in the one Tasks inbox.
-//
-// These are pure text assertions over the committed BPMN (no engine), matching the repo's
-// lightweight model-guard style (see mergeRebaseArm.test.ts), plus a drift guard tying the model's
-// user-task element id to the completer's accepted escalation set so the two can't silently diverge.
+// The merge escalation converges on ONE native `wait-merge-answer` userTask (backed by the shared
+// `pr-escalation` form) so it is answerable from the one Tasks inbox. The *behavioural* invariants —
+// that the loop parks on that task, that answering it reconciles the escalations row and re-arms the
+// poller — are exercised end-to-end by the WASM engine in `mergeLoopBehaviour.test.ts`. But that
+// engine harness completes the task through the engine, NOT through nwf's application-level
+// completer, so it cannot catch the specific silent-drift failure this guard closes: the model
+// deploys and parks on `wait-merge-answer`, yet `agentCompletion.ts` refuses to drive it because the
+// id fell out of `ESCALATION_TASK_ELEMENTS` (or its form contract drifted) — a task no worker will
+// ever answer. This guard ties the model's user-task id to the completer's accepted set + form
+// contract so the two layers cannot diverge unnoticed.
 
 import { test } from "node:test";
-import { assert, assertStringIncludes } from "#test-assert";
+import { assert } from "#test-assert";
 import { readFileSync } from "node:fs";
 import { ESCALATION_TASK_ELEMENTS, validateEscalationVariables } from "./agentCompletion.ts";
 
-const bpmn = readFileSync("resources/processes/merge-loop.bpmn", "utf8");
-const flat = bpmn.replace(/\s+/g, " ");
-
-function hasFlow(source: string, target: string): boolean {
-  const re = new RegExp(
-    `<bpmn:sequenceFlow\\b[^>]*\\bsourceRef="${source}"[^>]*\\btargetRef="${target}"|` +
-      `<bpmn:sequenceFlow\\b[^>]*\\btargetRef="${target}"[^>]*\\bsourceRef="${source}"`,
-  );
-  return re.test(flat);
-}
-
-test("the merge escalation parks on a native wait-merge-answer userTask backed by pr-escalation.form", () => {
-  const task = flat.match(/<bpmn:userTask\b[^>]*\bid="wait-merge-answer"[\s\S]*?<\/bpmn:userTask>/);
-  assert(task, "wait-merge-answer must be a <bpmn:userTask>");
-  assertStringIncludes(task![0], 'formId="pr-escalation"', "it must render the shared pr-escalation form");
-  assertStringIncludes(task![0], "<zeebe:userTask", "it must be a native (Zeebe) user task");
-});
+const flat = readFileSync("resources/processes/merge-loop.bpmn", "utf8").replace(/\s+/g, " ");
 
-test("the answered task reconciles the escalations row, then re-arms the merge poller", () => {
-  // wait-merge-answer → record-merge-answer (pr.answer-escalation) → arm-merge, mirroring the review
-  // loop's wait-answer → record-answer. Without the reconcile step the escalations row would stay
-  // `open` forever after the task completes (a phantom on /status).
-  const record = flat.match(/<bpmn:serviceTask\b[^>]*\bid="record-merge-answer"[\s\S]*?<\/bpmn:serviceTask>/);
-  assert(record, "record-merge-answer service task must exist");
-  assertStringIncludes(record![0], 'type="pr.answer-escalation"', "it must run the shared reconcile worker");
-  assert(hasFlow("wait-merge-answer", "record-merge-answer"), "wait-merge-answer → record-merge-answer missing");
-  assert(hasFlow("record-merge-answer", "arm-merge"), "record-merge-answer → arm-merge (re-arm) missing");
-});
-
-test("the legacy escalation-answered message pathway is gone", () => {
-  assert(!flat.includes("escalation-answered"), "the escalation-answered message must be removed");
-  assert(!flat.includes("Message_mergeEscAnswered"), "the merge escalation message declaration must be removed");
-  // The answer wait must no longer be a message catch — it is now a user task.
+test("drift guard: the model's merge user-task element is one the canonical completer accepts", () => {
+  // (1) The model actually parks on `wait-merge-answer` as a native user task...
   assert(
-    !/<bpmn:intermediateCatchEvent\b[^>]*\bid="wait-merge-answer"/.test(flat),
-    "wait-merge-answer must no longer be an intermediateCatchEvent",
+    /<bpmn:userTask\b[^>]*\bid="wait-merge-answer"/.test(flat),
+    "the model must park the merge escalation on a userTask id='wait-merge-answer'",
   );
-});
-
-test("drift guard: the model's merge user-task element is one the canonical completer accepts", () => {
-  // The completer refuses any user task outside ESCALATION_TASK_ELEMENTS, so a model that parks on
-  // `wait-merge-answer` while the code doesn't accept it would deploy but never be answerable — the
-  // exact silent-drift failure mode this guard closes.
+  // (2) ...and the completer accepts that exact id (else it deploys but is never answerable)...
   assert(
     ESCALATION_TASK_ELEMENTS.has("wait-merge-answer"),
     "ESCALATION_TASK_ELEMENTS must accept wait-merge-answer",
   );
-  // And it must map to the pr-escalation form contract (answer required) — a missing answer is
-  // rejected, proving the element resolves to the same form the model renders.
+  // (3) ...resolving to the pr-escalation form contract (a missing answer is rejected; a present
+  // one accepted), proving the element maps to the same form the model renders.
   assert(
     validateEscalationVariables("wait-merge-answer", {}) !== null,
     "wait-merge-answer must enforce the pr-escalation form contract (answer required)",