@nanobpm/nano-workforce 0.133.0 → 0.134.0

package/db/migrations/081_feature_read_model_derive_terminal.sql

@@ -0,0 +1,65 @@
+-- Feature-run read model: fold the ADR-0065 DERIVED terminal edge into the projection (issue #503 —
+-- the feature_runs row of the "migrate remaining terminal-edge readers to derived_status" class).
+--
+-- Since ADR-0065 (`@nanobpm/urban@0.81.0`) the `instanceTracking` reconciler is a SOURCE, not a writer:
+-- on cancel/terminate it feeds urban's instance projection and the terminal edge (`onTerminated →
+-- abandoned`) is RECOMPUTED ON READ as `feature_runs__tracking.derived_status` — it NO LONGER writes
+-- `abandoned` onto the base `feature_runs.status` column. `feature_runs` had NO derived reader, so a
+-- terminated feature run's base row stayed frozen at `running`/`escalated`/`awaiting_operator` and
+-- 076's `feature_read_model` rendered it "Implementing" (never "failed") on the Feature history grid
+-- forever.
+--
+-- 076_feature_read_model_declare_once.sql authored the projection ONCE (`defineReadModel`,
+-- app/featureReadModel.ts) and emitted each derived column VERBATIM from that declaration; it read the
+-- base `feature_runs.status`. This migration SUPERSEDES 076's VIEW body: the declaration's `baseTable`
+-- is now the auto-provisioned `feature_runs__tracking` derived VIEW (which re-exports `feature_runs.*`
+-- plus a terminal-folded `derived_status`), and every status-classifying derived column below reads
+-- `fr."derived_status"` instead of `fr."status"`. So a cancelled/terminated run renders `Done`/`failed`
+-- with no worker write. 076 is a MERGED, IMMUTABLE migration — never edited; this is a NEW migration
+-- superseding its VIEW body (the same pattern by which 076 superseded 073/075).
+--
+-- Every DERIVED column body is emitted VERBATIM from the ONE declaration
+-- (`featureReadModel.sqlSelectFor(col, { baseAlias: "fr" })`), which ALSO drives the runtime TS via
+-- `fnFor` — the two lowerings fall out of the same closed-DSL AST and cannot diverge. The drift guard
+-- (app/featureReadModel.test.ts) fails if this file stops matching the declaration, and
+-- `assertReadModelParity` proves the SQL and TS lowerings agree. SEMANTICS are unchanged from 076 EXCEPT
+-- the status source (base transient → terminal-folded `derived_status`): `attention` still derives from
+-- ENGINE TRUTH (an OPEN `user_tasks` row, issue #422); `stage_skipped` is still a pure function of
+-- `converge`/`auto_merge`.
+--
+-- `feature_runs__tracking` is the managed VIEW urban provisions at mount (`<table>__tracking`); SQLite
+-- does not validate a view body at CREATE time, so this migration (which runs before the runtime mount
+-- that provisions the managed VIEW) is created fine and resolves once the managed VIEW exists. Base
+-- columns stay aliased pass-throughs (so the static pages↔schema contract guard still sees the VIEW
+-- columns), now sourced off `feature_runs__tracking`'s re-export of `base.*`; `feature_runs__tracking fr`
+-- is the sole top-level FROM (the user_tasks lookups are nested EXISTS subqueries at paren depth >= 1).
+--
+-- Forward-only VIEW redefinition (DROP then CREATE). The runner wraps each file in its own transaction,
+-- so this file must NOT contain BEGIN/COMMIT. Numbered after 079.
+
+DROP VIEW IF EXISTS feature_read_model;
+
+CREATE VIEW feature_read_model AS
+SELECT
+  fr.feature_key AS feature_key,
+  fr.repo AS repo,
+  fr.issue_number AS issue_number,
+  fr.issue_url AS issue_url,
+  fr.title AS title,
+  fr.base_branch AS base_branch,
+  fr.status AS status,
+  fr.process_key AS process_key,
+  fr.pr_key AS pr_key,
+  fr.converge AS converge,
+  fr.auto_merge AS auto_merge,
+  fr.outcome AS outcome,
+  fr.delivery_label AS delivery_label,
+  fr.acknowledged_at AS acknowledged_at,
+  fr.created_at AS created_at,
+  fr.updated_at AS updated_at,
+  CASE WHEN COALESCE((COALESCE(("fr"."derived_status" = 'merged'), 0) OR COALESCE(("fr"."derived_status" = 'converged'), 0) OR COALESCE(("fr"."derived_status" = 'blocked'), 0) OR COALESCE(("fr"."derived_status" = 'failed'), 0) OR COALESCE(("fr"."derived_status" = 'skipped'), 0) OR COALESCE(("fr"."derived_status" = 'abandoned'), 0)), 0) THEN 'Done' WHEN COALESCE(("fr"."derived_status" = 'converging'), 0) THEN 'Converging' WHEN COALESCE((COALESCE(("fr"."pr_key" <> ''), 0) OR COALESCE(("fr"."derived_status" = 'opened'), 0)), 0) THEN 'PR open' WHEN COALESCE((COALESCE(("fr"."derived_status" = 'running'), 0) OR COALESCE(("fr"."derived_status" = 'escalated'), 0) OR COALESCE(("fr"."derived_status" = 'awaiting_operator'), 0)), 0) THEN 'Implementing' ELSE 'Requested' END AS stage,
+  CASE WHEN COALESCE((COALESCE(("fr"."derived_status" = 'merged'), 0) OR COALESCE(("fr"."derived_status" = 'converged'), 0)), 0) THEN 'ok' WHEN COALESCE(("fr"."derived_status" = 'blocked'), 0) THEN 'blocked' WHEN COALESCE((COALESCE(("fr"."derived_status" = 'failed'), 0) OR COALESCE(("fr"."derived_status" = 'skipped'), 0) OR COALESCE(("fr"."derived_status" = 'abandoned'), 0)), 0) THEN 'failed' ELSE NULL END AS stage_state,
+  CASE WHEN (NOT COALESCE("fr"."converge", 0)) THEN 'Converging Merging' WHEN (NOT COALESCE("fr"."auto_merge", 0)) THEN 'Merging' ELSE '' END AS stage_skipped,
+  CASE WHEN EXISTS (SELECT 1 FROM "user_tasks" AS "__urban_proj_0" WHERE COALESCE((COALESCE(("__urban_proj_0"."subject_type" = 'feature'), 0) AND COALESCE(("__urban_proj_0"."subject_key" = "fr"."feature_key"), 0) AND COALESCE(("__urban_proj_0"."element_id" = 'feature-blocked'), 0)), 0)) THEN 'blocked' WHEN EXISTS (SELECT 1 FROM "user_tasks" AS "__urban_proj_0" WHERE COALESCE((COALESCE(("__urban_proj_0"."subject_type" = 'feature'), 0) AND COALESCE(("__urban_proj_0"."subject_key" = "fr"."feature_key"), 0) AND COALESCE(("__urban_proj_0"."element_id" = 'feature-escalation'), 0)), 0)) THEN '⚠' ELSE NULL END AS attention,
+  CASE WHEN COALESCE((COALESCE((COALESCE(("fr"."derived_status" = 'merged'), 0) OR COALESCE(("fr"."derived_status" = 'converged'), 0) OR COALESCE(("fr"."derived_status" = 'blocked'), 0) OR COALESCE(("fr"."derived_status" = 'failed'), 0) OR COALESCE(("fr"."derived_status" = 'skipped'), 0) OR COALESCE(("fr"."derived_status" = 'abandoned'), 0)), 0) AND COALESCE(("fr"."acknowledged_at" = "fr"."acknowledged_at"), 0)), 0) THEN 'history' ELSE 'active' END AS list_bucket
+FROM feature_runs__tracking fr;

package/openapi.yaml

@@ -1407,6 +1407,15 @@ components:
                   type: string
                   maxLength: 20000
                   description: OPTIONAL steering prompt appended to the node's job brief.
+                timeout:
+                  type: string
+                  pattern: '^[Pp](?!$)(\d+[Yy])?(\d+[Mm])?(\d+[Ww])?(\d+[Dd])?([Tt](?=\d)(\d+[Hh])?(\d+[Mm])?(\d+[Ss])?)?$'
+                  maxLength: 64
+                  description: >-
+                    OPTIONAL per-node ISO-8601 SLA timeout (#505). Overrides the run-level `nodeTimeout`
+                    (and the `PT1H` default) for THIS node's bounded-timeout → escalate boundary timer, so
+                    a legitimately-long node (e.g. a full `senior:feature` implementation) can outlast a
+                    quick gate without a spurious escalation. Absent → the run/default value.
     DeliveryNodeWait:
       description: >-
         A `wait` node — a durable `ReadinessProbe` (ADR 0001 §2) watching an external fact. Reuses the
@@ -1496,6 +1505,14 @@ components:
                   type: object
                   additionalProperties: true
                   description: Minimal forward-declared payload stub — the concrete connector payload schema is deferred (ADR non-goal).
+                timeout:
+                  type: string
+                  pattern: '^[Pp](?!$)(\d+[Yy])?(\d+[Mm])?(\d+[Ww])?(\d+[Dd])?([Tt](?=\d)(\d+[Hh])?(\d+[Mm])?(\d+[Ss])?)?$'
+                  maxLength: 64
+                  description: >-
+                    OPTIONAL per-node ISO-8601 SLA timeout (#505). Overrides the run-level `nodeTimeout`
+                    (and the `PT1H` default) for THIS connector node's bounded-timeout → escalate boundary
+                    timer. Absent → the run/default value.
     DeliveryEdge:
       description: >-
         A dependency edge — "`to` proceeds once fact `from` is observable" (ADR 0005 Decision 3).
@@ -1596,6 +1613,28 @@ components:
           type: string
           maxLength: 255
           description: OPTIONAL idempotency key. A re-dispatch with the same key (or, when omitted, the same digest) does not double-launch. Blank/whitespace is treated as absent.
+        nodeTimeout:
+          type: string
+          pattern: '^[Pp](?!$)(\d+[Yy])?(\d+[Mm])?(\d+[Ww])?(\d+[Dd])?([Tt](?=\d)(\d+[Hh])?(\d+[Mm])?(\d+[Ss])?)?$'
+          maxLength: 64
+          description: >-
+            OPTIONAL run-level ISO-8601 SLA timeout for `agent`/`connector` nodes (#505) — the
+            bounded-timeout → escalate boundary bound every such node inherits unless it declares its own
+            per-node `timeout`. Absent → the `PT1H` default. An invalid duration is rejected at submit.
+        probeTimeout:
+          type: string
+          pattern: '^[Pp](?!$)(\d+[Yy])?(\d+[Mm])?(\d+[Ww])?(\d+[Dd])?([Tt](?=\d)(\d+[Hh])?(\d+[Mm])?(\d+[Ss])?)?$'
+          maxLength: 64
+          description: >-
+            OPTIONAL run-level ISO-8601 poll budget for `wait` gates (#505) before they escalate. Absent →
+            the `PT30M` default. An invalid duration is rejected at submit.
+        escalationSlaTimeout:
+          type: string
+          pattern: '^[Pp](?!$)(\d+[Yy])?(\d+[Mm])?(\d+[Ww])?(\d+[Dd])?([Tt](?=\d)(\d+[Hh])?(\d+[Mm])?(\d+[Ss])?)?$'
+          maxLength: 64
+          description: >-
+            OPTIONAL run-level ISO-8601 SLA for `human` nodes (#505) before they record an `escalated`
+            outcome. Absent → the `P1D` default. An invalid duration is rejected at submit.
     DeliveryGraphProposalBpmnRequest:
       description: >-
         Request the compiled BPMN of a staged delivery-graph proposal for read-only DI PREVIEW. Carries

package/operations/dispatchDeliveryGraph.test.ts

@@ -182,4 +182,69 @@ describe("dispatchDeliveryGraph — operator dispatch by staged-proposal digest"
     assert.equal((await deliveryGraphProposals(app.db).get(digest))?.status, "expired");
     assert.equal((await deliveryGraphRuns(app.db).all()).length, 0);
   });
+
+  test("an invalid run-level nodeTimeout duration is rejected at submit → 400, nothing launched (#505)", async () => {
+    const app = await boot();
+    assert.ok(app.api);
+    const api = app.api;
+    const staged = await api.call<{ digest: string }>("compileDeliveryGraph", { body: HUMAN_ONLY });
+    const res = await api.call<{ ok?: boolean; error?: string; issues?: Array<{ path: string }> }>("dispatchDeliveryGraph", {
+      body: { digest: staged.body.digest, nodeTimeout: "2 hours" },
+    });
+    // Rejected at submit — either by the edge shape-validator (openapi `pattern`) or the door's own
+    // ISO-8601 guard; both surface a 400. Nothing launches and the proposal stays staged (dispatchable).
+    assert.equal(res.status, 400);
+    assert.equal((await deliveryGraphRuns(app.db).all()).length, 0);
+    assert.equal((await deliveryGraphProposals(app.db).get(staged.body.digest))?.status, "staged");
+  });
+
+  test("an oversized invalid duration never bloats the 400 response — rejected with a bounded error, nothing launched (#505)", async () => {
+    const app = await boot();
+    assert.ok(app.api);
+    const api = app.api;
+    const staged = await api.call<{ digest: string }>("compileDeliveryGraph", { body: HUMAN_ONLY });
+    const huge = `PT${"9".repeat(5000)}X`;
+    const res = await api.call<{ ok?: boolean; error?: string }>("dispatchDeliveryGraph", {
+      body: { digest: staged.body.digest, nodeTimeout: huge },
+    });
+    assert.equal(res.status, 400);
+    // The 5000-char blob is never echoed back verbatim — the edge pattern rejects it, and the door's
+    // own guard (`truncateForEcho`) caps the echo when the edge is bypassed. Either way the response
+    // stays bounded, so a malformed input can't bloat logs/response bodies.
+    assert.ok((res.body.error ?? "").length < 300, `error body should be bounded, got ${(res.body.error ?? "").length} chars`);
+    assert.equal((await deliveryGraphRuns(app.db).all()).length, 0);
+  });
+
+  test("a syntactically-valid but oversized duration is rejected at the door → 400, nothing launched (#505)", async () => {
+    const app = await boot();
+    assert.ok(app.api);
+    const api = app.api;
+    const staged = await api.call<{ digest: string }>("compileDeliveryGraph", { body: HUMAN_ONLY });
+    // Matches the ISO-8601 grammar but exceeds the door's MAX_DURATION_LEN (64) — the door re-enforces the
+    // openapi `maxLength: 64` so an oversized value is refused even if the edge validator is bypassed.
+    const longValid = `PT${"9".repeat(70)}H`;
+    const res = await api.call<{ ok?: boolean; error?: string }>("dispatchDeliveryGraph", {
+      body: { digest: staged.body.digest, nodeTimeout: longValid },
+    });
+    assert.equal(res.status, 400);
+    assert.ok((res.body.error ?? "").length < 300, `error body should be bounded, got ${(res.body.error ?? "").length} chars`);
+    assert.equal((await deliveryGraphRuns(app.db).all()).length, 0);
+    assert.equal((await deliveryGraphProposals(app.db).get(staged.body.digest))?.status, "staged");
+  });
+
+  test("a valid run-level nodeTimeout override dispatches the run → 202 running (#505)", async () => {
+    const app = await boot();
+    assert.ok(app.api);
+    const api = app.api;
+    const staged = await api.call<{ digest: string }>("compileDeliveryGraph", { body: HUMAN_ONLY });
+    const res = await api.call<{ ok: boolean; status: string }>("dispatchDeliveryGraph", {
+      body: { digest: staged.body.digest, nodeTimeout: "PT2H" },
+    });
+    assert.equal(res.status, 202);
+    assert.equal(res.body.ok, true);
+    assert.equal(res.body.status, "running");
+    await app.settle();
+    assert.equal((await deliveryGraphRuns(app.db).all()).length, 1);
+    assert.equal((await deliveryGraphProposals(app.db).get(staged.body.digest))?.status, "dispatched");
+  });
 });

package/operations/dispatchDeliveryGraph.ts

@@ -12,9 +12,39 @@
 
 import { dispatchDeliveryGraphRun } from "../app/deliveryGraphDispatch.ts";
 import { getStagedProposal, markProposalDispatched, markProposalExpired } from "../app/deliveryGraphProposals.ts";
+import { isValidIsoDuration } from "../app/reviewWait.ts";
 import type { DeliveryGraphTextResult } from "../nano-generated/api-io.d.ts";
 import { defineOperation } from "../nano-generated/operations.ts";
 
+/** Cap an untrusted, rejected duration string before it is echoed into logs/response bodies. `openapi.yaml`
+ * caps these dispatch duration fields at `maxLength: 64` at the edge, and the door re-enforces that bound
+ * (see `MAX_DURATION_LEN`); this truncation is defense-in-depth for when the edge validator is bypassed,
+ * so a very large malformed value can never bloat either the logs or the response. */
+const MAX_ECHO_LEN = 80;
+function truncateForEcho(value: string): string {
+  return value.length > MAX_ECHO_LEN ? `${value.slice(0, MAX_ECHO_LEN)}… (${value.length} chars)` : value;
+}
+
+/** Door-level cap on a duration override, mirroring the `maxLength: 64` on these fields in `openapi.yaml`.
+ * Re-enforced here so a syntactically-valid-but-oversized duration is still rejected when the edge
+ * validator is bypassed (internal calls/tests), keeping seeded process variables and error/log output bounded. */
+const MAX_DURATION_LEN = 64;
+
+/** Validate an OPTIONAL run-level ISO-8601 duration override off the dispatch body (#505). Blank/
+ * whitespace is treated as absent (→ the runner default). A present-but-malformed value returns
+ * `{ ok: false, invalid }` so the door can reject it at submit rather than silently deploy an
+ * uninterpretable timer. Reuses the canonical `reviewWait` grammar so accept/reject never drifts from
+ * the runner's normalise-or-default one, and enforces `MAX_DURATION_LEN` so an oversized value is
+ * rejected even if the OpenAPI `maxLength` edge check is bypassed. */
+function validateDurationOverride(raw: unknown): { ok: true; value: string | undefined } | { ok: false; invalid: string } {
+  if (raw === undefined || raw === null) return { ok: true, value: undefined };
+  if (typeof raw !== "string") return { ok: false, invalid: String(raw) };
+  const trimmed = raw.trim();
+  if (trimmed === "") return { ok: true, value: undefined };
+  if (trimmed.length > MAX_DURATION_LEN || !isValidIsoDuration(trimmed)) return { ok: false, invalid: trimmed };
+  return { ok: true, value: trimmed.toUpperCase() };
+}
+
 export default defineOperation("dispatchDeliveryGraph", async ({ body }, app) => {
   const digest = body && typeof body === "object" && "digest" in body && typeof body.digest === "string" ? body.digest.trim() : "";
   if (digest === "") {
@@ -24,6 +54,27 @@ export default defineOperation("dispatchDeliveryGraph", async ({ body }, app) =>
   const idemRaw = body && typeof body === "object" && "idempotencyKey" in body && typeof body.idempotencyKey === "string" ? body.idempotencyKey.trim() : "";
   const idempotencyKey = idemRaw !== "" ? idemRaw : undefined;
 
+  // Run-level timeout overrides (#505) — exposed at submission, validated as ISO-8601 durations here so
+  // an invalid value is a clean 400 (never a deployed, uninterpretable timer). Absent → runner defaults.
+  const rawTimeouts: Record<"nodeTimeout" | "probeTimeout" | "escalationSlaTimeout", unknown> =
+    body && typeof body === "object"
+      ? {
+          nodeTimeout: "nodeTimeout" in body ? body.nodeTimeout : undefined,
+          probeTimeout: "probeTimeout" in body ? body.probeTimeout : undefined,
+          escalationSlaTimeout: "escalationSlaTimeout" in body ? body.escalationSlaTimeout : undefined,
+        }
+      : { nodeTimeout: undefined, probeTimeout: undefined, escalationSlaTimeout: undefined };
+  const timeouts: { nodeTimeout?: string; probeTimeout?: string; escalationSlaTimeout?: string } = {};
+  for (const field of ["nodeTimeout", "probeTimeout", "escalationSlaTimeout"] as const) {
+    const parsed = validateDurationOverride(rawTimeouts[field]);
+    if (!parsed.ok) {
+      const shown = truncateForEcho(parsed.invalid);
+      app.log.warn("dispatch-delivery-graph rejected: invalid duration", { field, value: shown, invalidLength: parsed.invalid.length });
+      return { status: 400, body: { ok: false, error: `\`${field}\` must be an ISO-8601 duration (e.g. \`PT2H\`); got \`${shown}\`` } };
+    }
+    if (parsed.value !== undefined) timeouts[field] = parsed.value;
+  }
+
   // Load the live staged proposal for this digest — refuses an unknown/expired/superseded/already-
   // dispatched digest cleanly (no run is launched).
   const proposal = await getStagedProposal(app.data, digest);
@@ -47,7 +98,7 @@ export default defineOperation("dispatchDeliveryGraph", async ({ body }, app) =>
     return { status: 400, body: { ok: false, error: `staged proposal ${digest} is corrupt: ${err instanceof Error ? err.message : String(err)}` } };
   }
 
-  const dispatched = await dispatchDeliveryGraphRun(app, graph, { runKey: idempotencyKey, title: proposal.title });
+  const dispatched = await dispatchDeliveryGraphRun(app, graph, { runKey: idempotencyKey, title: proposal.title, ...timeouts });
   if (!dispatched.ok) {
     app.log.warn("dispatch-delivery-graph refused: compile", { digest, errors: dispatched.errors.length });
     const outBody: DeliveryGraphTextResult = {

package/operations/listActivePrs.test.ts

@@ -5,6 +5,7 @@ import { test } from "node:test";
 import { assert, assertEquals } from "#test-assert";
 import type { AppApi } from "@nanobpm/urban";
 import { noopLog } from "../test/log.ts";
+import { withTrackingViews } from "../test/trackingViews.ts";
 import handler from "./listActivePrs.ts";
 
 function memApp(rows: any[], escalations: any[] = []): AppApi {
@@ -24,7 +25,7 @@ function memApp(rows: any[], escalations: any[] = []): AppApi {
       },
     };
   };
-  return { data: { table }, log: noopLog() } as any as AppApi;
+  return { data: { table: withTrackingViews(table) }, log: noopLog() } as any as AppApi;
 }
 
 function input(headers: Record<string, string> = {}) {

package/operations/startEpicSet.admission.integration.test.ts

@@ -18,6 +18,7 @@ import { assertEquals } from "#test-assert";
 import type { AppApi } from "@nanobpm/urban";
 import { resetDefaultBranchCache } from "../app/github.ts";
 import { noopLog } from "../test/log.ts";
+import { withTrackingViews } from "../test/trackingViews.ts";
 import startEpicSet from "./startEpicSet.ts";
 
 // ── in-memory github model (mirrors startPlanFanout.admission.integration.test.ts) ───────────────
@@ -116,7 +117,7 @@ function makeApp(seedPlans: Record<string, unknown>[] = []) {
     };
   };
   const app = {
-    data: { table },
+    data: { table: withTrackingViews(table) },
     engine: {
       createInstance: (req: { processDefinitionId: string; variables?: Record<string, unknown> }) => {
         started.push(req);
@@ -526,7 +527,7 @@ function makeSqliteApp(
     delete: () => Promise.resolve(),
   });
   const app = {
-    data: { table },
+    data: { table: withTrackingViews(table) },
     engine: { createInstance: () => Promise.resolve({ processInstanceKey: "PI-1" }) },
     log: noopLog(),
   } as any as AppApi;

package/operations/startPlanFanout.admission.integration.test.ts

@@ -9,6 +9,7 @@ import { assertEquals } from "#test-assert";
 import type { AppApi } from "@nanobpm/urban";
 import { resetDefaultBranchCache } from "../app/github.ts";
 import { noopLog } from "../test/log.ts";
+import { withTrackingViews } from "../test/trackingViews.ts";
 import startPlanFanout from "./startPlanFanout.ts";
 
 // ── in-memory github model ───────────────────────────────────────────────────
@@ -112,7 +113,7 @@ function makeApp(seedPlans: Record<string, unknown>[] = []) {
     };
   };
   const app = {
-    data: { table },
+    data: { table: withTrackingViews(table) },
     engine: {
       createInstance: (req: { processDefinitionId: string; variables?: Record<string, unknown> }) => {
         started.push(req);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.133.0",
+  "version": "0.134.0",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",

package/test/trackingViews.ts

@@ -30,7 +30,17 @@ export function withTrackingViews<F extends TableFn>(base: F): F {
     const statusField = baseStatusFieldFor(baseName);
     // biome-ignore lint/suspicious/noExplicitAny: test-only projection over dynamic row shapes.
     const project = (row: any) =>
-      row == null ? row : { ...row, [derivedColumn]: row[statusField] };
+      row == null
+        ? row
+        : // Honor an explicitly-seeded `derived_status` so a test can model the ADR-0065 divergence a
+          // real terminated instance produces — the base `<statusField>` frozen at its last transient
+          // while the derive edge reports the terminal (`abandoned`/`failed`/`reviewed`). When a row
+          // seeds no derived column the VIEW's `ELSE base.<statusField>` fall-through applies, so it
+          // stays byte-for-byte the pass-through the previous behaviour modelled.
+          {
+            ...row,
+            [derivedColumn]: row[derivedColumn] ?? row[statusField],
+          };
     // biome-ignore lint/suspicious/noExplicitAny: test-only Proxy over a dynamic DataLayer table.
     return new Proxy(inner, {
       get(target: any, prop: string) {