@nanobpm/nano-workforce 0.166.0 → 0.167.1

package/app/pullRequestReadModel.ts

@@ -0,0 +1,76 @@
+// The `pull_requests_read_model` derived read model — DECLARED ONCE and compiled to BOTH backends via
+// Urban's ADR-0065 reconciling-read-model primitive (`defineReadModel`, `@nanobpm/urban`). The
+// exemplars are app/featureReadModel.ts / app/deliveryGraphReadModel.ts; this is the Convergence-PR
+// twin (issue #641).
+//
+// WHY IT EXISTS. Before #641 the Convergence (PRs) surfaces — Overview's "Active PR convergences" and
+// home's "Pull requests" — filtered the RAW `pull_requests` table on a hand-synced base-`status`
+// allowlist (the 7 in-flight convergence states), so a PR dropped out of Active the instant its
+// `status` reached a terminal state, with NO operator dismiss. That is the last-but-one base-`status`
+// allowlist #637 set out to retire. This model gives PRs the SAME acknowledge-to-dismiss behaviour as
+// Features/Epics/Delivery-Graphs: a terminal PR STAYS in Active until an operator dismisses it
+// (`acknowledgePr` stamps `acknowledged_at`), then drops to History — the derived `list_bucket`
+// (app/listBucket.ts, the ONE shared oracle) is the single activeness predicate every "Active …" grid
+// now filters.
+//
+// BASE TABLE. Reads the auto-provisioned `pull_requests__tracking` derived VIEW (ADR-0065), NOT the raw
+// `pull_requests` table: it re-exports `pull_requests.*` plus a terminal-folded `derived_status` (the
+// `instanceTracking` reconciler's `onTerminated → abandoned` edge, recomputed on read), so a
+// terminated PR classifies on ENGINE TRUTH — exactly as `feature_read_model` reads
+// `feature_runs__tracking`.
+
+import { defineReadModel, type Expr, type ReadModel } from "@nanobpm/urban";
+import { deriveAckOpenExpr, deriveListBucketExpr } from "./listBucket.ts";
+
+/** The base table the read model reads: the auto-provisioned `pull_requests__tracking` derived VIEW
+ * (ADR-0065), NOT the raw `pull_requests` table — so the status-classifying derivations read the
+ * terminal-folded `derived_status` and a terminated PR drops to History with no worker write. */
+export const PULL_REQUEST_READ_MODEL_BASE_TABLE = "pull_requests__tracking";
+
+/** The base alias the managed VIEW gives `pull_requests__tracking` — pinned so the emitted derived-
+ * column SQL (`pr."col"`) matches the migration exactly (the drift guard compares against this alias). */
+export const PULL_REQUEST_READ_MODEL_BASE_ALIAS = "pr";
+
+/** The effective (terminal-folded) status column the bucket/ack derivations classify on — the tracking
+ * VIEW's `derived_status`. Single source of truth for the name so the derivations can't drift from it. */
+export const EFFECTIVE_STATUS_COLUMN = "derived_status";
+
+/** The PR statuses that are TERMINAL for the Active/History partition (issue #641). A PR in any of
+ * these has finished its convergence/merge lifecycle: `merged` (landed), `converged` (review-only
+ * consensus, no auto-merge), `abandoned` (cancelled / out-of-band terminated — the reconciler's
+ * `onTerminated` edge), `closed` (the PR was closed on GitHub without merging), `failed` (a terminal
+ * merge/convergence failure). Distinct from `deliveryStatuses.ts`'s `TERMINAL_STATUSES` (the epic-
+ * delivery in-flight fold, which counts `converged`/`merged`/`abandoned` only): this is the FULL PR
+ * terminal tier the acknowledge-to-dismiss rule folds to History. */
+export const PR_TERMINAL_STATUSES: readonly string[] = ["merged", "converged", "abandoned", "closed", "failed"];
+
+/** The Active/History partition — `history` IFF the PR is terminal AND acknowledged, else `active`
+ * (live PRs + terminal-but-UNACKNOWLEDGED PRs that stay actionable until dismissed). The ONE shared
+ * oracle (app/listBucket.ts) parameterised by {@link PR_TERMINAL_STATUSES}. */
+const listBucket: Expr = deriveListBucketExpr(EFFECTIVE_STATUS_COLUMN, PR_TERMINAL_STATUSES);
+
+/** The operator "Dismiss" affordance flag — `1` IFF the PR is terminal AND not yet acknowledged (so the
+ * page's `showWhenField` Dismiss button renders only for a terminal-but-unacknowledged PR), else `0`. */
+const ackOpen: Expr = deriveAckOpenExpr(EFFECTIVE_STATUS_COLUMN, PR_TERMINAL_STATUSES);
+
+/** The keys of {@link pullRequestReadModel}'s DERIVED columns, in the order the migration emits them.
+ * Base columns are identity pass-throughs (not derivations) and are listed in the migration directly. */
+export const PULL_REQUEST_READ_MODEL_DERIVED = ["list_bucket", "ack_open"] as const;
+export type PullRequestReadModelDerivedColumn = (typeof PULL_REQUEST_READ_MODEL_DERIVED)[number];
+
+/**
+ * The declare-once `pull_requests_read_model` derived columns. `selectBaseColumns: false` because the
+ * base columns are plain identity pass-throughs enumerated in the migration (so the static
+ * pages↔schema contract guard, which reads a VIEW's columns off an aliased select-list, sees them).
+ * Both the migration VIEW (`sqlSelectFor`, drift-guarded) and the runtime TS oracle (`fnFor`) are
+ * generated from THIS single declaration.
+ */
+export const pullRequestReadModel: ReadModel = defineReadModel({
+  name: "pull_requests_read_model",
+  baseTable: PULL_REQUEST_READ_MODEL_BASE_TABLE,
+  selectBaseColumns: false,
+  derive: {
+    list_bucket: listBucket,
+    ack_open: ackOpen,
+  },
+});

package/app/service.ts

@@ -198,6 +198,15 @@ export const MERGEABLE_WAIT_TIMEOUT = mergeableWaitTimeout(
  * to one attempt per window. Set via `NANO_PR_REVIEW_NUDGE_MINUTES` (minutes). */
 export const REVIEW_NUDGE_MS = clampNudgeMinutes(process.env.NANO_PR_REVIEW_NUDGE_MINUTES) * 60_000;
 
+/** Grace window (ms) before the `escalated`→`running` self-heal (below) may act on a row. The sole
+ * writer of `status="escalated"` — `record-feature-escalation` — runs on the `escalated` arm and stamps
+ * `updated_at` IMMEDIATELY BEFORE the engine creates the `feature-escalation` user task. A poll landing
+ * in that window would see `openUserTasks` report none and wrongly heal the just-raised escalation back
+ * to `running`, hiding it until a future write. Only heal rows whose escalation is older than this
+ * window, by when the user task must already be observable — sparing the in-flight transition while
+ * still reconciling genuinely-stranded rows. */
+export const FEATURE_ESCALATION_HEAL_GRACE_MS = 60_000;
+
 /** Whether a converged PR is automatically driven to merge (the merge-loop). Default on; set
  * `NANO_PR_AUTO_MERGE=0` to stop at `converged` (review-only mode). */
 export const AUTO_MERGE = !["0", "false", "off", "no"].includes(
@@ -2677,6 +2686,49 @@ export async function pollUserTasks(
     await userTasks(data).update(user_task_key, { ...patch, updated_at: at });
   }
   for (const key of deletes) await userTasks(data).delete(key);
+
+  // ── Self-heal: `escalated` holds ONLY while parked (issue #642) ──────────────────────────────────
+  // `record-feature-escalation` is the sole writer of `status="escalated"`, but the answer loop-back
+  // now stamps `running` (via `record-feature-implementing`). This read-side sweep heals any row that
+  // is ALREADY stranded at `escalated` — e.g. runs that escalated before the write-side twin shipped
+  // (#632), or any future missed transition — by reconciling against the ENGINE's authoritative
+  // open-escalation set. But it must NOT decide on absence from THIS pass's `desired` set:
+  // `sweepOpenEscalationTasks` is best-effort and breaks early on a paging/transport error, so a
+  // truncated `desired` would wrongly flip a genuinely-parked run whose task lived on an unreached page.
+  // Confirm each escalated run POSITIVELY, per-instance, against `openUserTasks` (which pins
+  // `state:"CREATED"`), and skip healing when that query errors — durable state is mutated only on
+  // positive evidence that no `feature-escalation` task is open for the instance (parity with the PR
+  // `status="escalated"` contract). Confined to rows with a known `process_key` so an untracked instance
+  // is never guessed at.
+  //
+  // Presence in THIS pass's `desired` set is itself POSITIVE evidence of parking (truncation only ever
+  // DROPS tasks, never invents one), so a run whose `feature-escalation` task was already swept is
+  // genuinely parked — skip its per-instance `openUserTasks` RPC entirely (an avoidable N+1 on every
+  // tick). Only a run NOT confirmed parked by the sweep falls through to the per-instance check below.
+  const sweptParkedEscalations = new Set(
+    desired.filter((r) => r.element_id === FEATURE_ESCALATION_ELEMENT && r.process_key).map((r) => r.process_key),
+  );
+  for (const run of await featureRuns(data).find({ status: "escalated" })) {
+    if (!run.process_key) continue;
+    if (sweptParkedEscalations.has(run.process_key)) continue; // already seen parked this pass — no RPC, no heal
+    // A just-written escalation may not have its `feature-escalation` user task yet: the sole writer,
+    // `record-feature-escalation`, stamps `updated_at` immediately BEFORE the engine creates the task.
+    // Skip healing inside the grace window so this pass never races that transition and steals a fresh
+    // escalation; a genuinely-stranded (old, or timestamp-less) row is past the window and still healed.
+    const escalatedAt = Date.parse(run.updated_at ?? "");
+    if (Number.isFinite(escalatedAt) && Date.now() - escalatedAt < FEATURE_ESCALATION_HEAL_GRACE_MS) continue;
+    let openTasks: { elementId?: string }[];
+    try {
+      openTasks = await engine.openUserTasks({ processInstanceKey: run.process_key });
+    } catch (err) {
+      // Negative evidence from a failed query is not proof the run is unparked — leave it for a later pass.
+      console.error(`[poller] escalated-run self-heal (${run.feature_key} @ ${run.process_key}): ${err}`);
+      continue;
+    }
+    if (!openTasks.some((t) => t.elementId === FEATURE_ESCALATION_ELEMENT)) {
+      await featureRuns(data).update(run.feature_key, { status: "running", updated_at: at });
+    }
+  }
 }
 
 /** One full poll pass: advance the review stage, the merge stage, the wave-merge barrier, and

package/db/migrations/093_pull_requests_acknowledged_at.sql

@@ -0,0 +1,30 @@
+-- Convergence (PRs): add the `acknowledged_at` dismissal stamp + backfill currently-terminal rows
+-- (issue #641). This is the PR half of making all four "Active …" grids behave uniformly — a row STAYS
+-- in Active until an operator dismisses it (acknowledge-to-dismiss), then drops to History — completing
+-- the direction set in #637 by retiring the last two base-`status` allowlists (Convergence + Delivery
+-- Graphs). The twin stamp already exists on `feature_runs` (073) and `plans` (074).
+--
+-- BACKFILL IS MANDATORY (the highest-risk item). Merlin carries hundreds of already-terminal PRs (~411
+-- merged + 35 abandoned + 5 converged at authoring). Without the backfill, repointing the Active grids
+-- at the derived `list_bucket` (094) — which folds an UNACKNOWLEDGED terminal PR into `active` — would
+-- dump every one of those historical PRs into Active on the next boot. So we stamp `acknowledged_at` on
+-- every CURRENTLY-terminal row here: they load in History from day one, and only PRs that reach a
+-- terminal state AFTER this migration require an operator dismiss (their `acknowledged_at` stays NULL
+-- until `acknowledgePr`). Stamp = COALESCE(merged_at, converged_at, updated_at): the best available
+-- "when it settled" timestamp, and `updated_at` is NOT NULL so the stamp is never NULL for a matched
+-- row.
+--
+-- Terminal set = the PR terminal tier {merged, converged, abandoned, closed, failed}
+-- (app/pullRequestReadModel.ts `PR_TERMINAL_STATUSES`). Classified on the base `status` (the stored
+-- ground truth at migration time; the reconciler's `derived_status` is a read-time projection). The
+-- `acknowledged_at IS NULL` guard keeps the backfill idempotent — re-running never re-stamps a row an
+-- operator later dismissed with a different timestamp.
+--
+-- The runner wraps each file in its own transaction — no BEGIN/COMMIT here. Numbered after 092.
+
+ALTER TABLE pull_requests ADD COLUMN acknowledged_at TEXT;
+
+UPDATE pull_requests
+   SET acknowledged_at = COALESCE(merged_at, converged_at, updated_at)
+ WHERE acknowledged_at IS NULL
+   AND status IN ('merged', 'converged', 'abandoned', 'closed', 'failed');

package/db/migrations/094_pull_requests_read_model.sql

@@ -0,0 +1,65 @@
+-- Convergence (PRs) read model: DECLARE ONCE, compile to BOTH backends (ADR-0065, nano-ide#452) — the
+-- `pull_requests_read_model` VIEW that gives the Convergence surfaces the SAME acknowledge-to-dismiss
+-- Active/History partition Features/Epics/Delivery-Graphs already have (issue #641).
+--
+-- Before #641 the Overview "Active PR convergences" and home "Pull requests" grids filtered the RAW
+-- `pull_requests` table on a hand-synced base-`status` allowlist (the 7 in-flight convergence states),
+-- so a PR dropped out of Active the instant its `status` reached terminal, with NO operator dismiss —
+-- the last-but-one base-`status` allowlist #637 set out to retire. This VIEW introduces a declared
+-- `list_bucket` (active/history) + `ack_open` (the Dismiss affordance flag) derived from the ONE shared
+-- oracle (app/listBucket.ts): a terminal PR STAYS in `active` until `acknowledged_at` is stamped
+-- (`acknowledgePr`), then folds to `history`.
+--
+-- Every DERIVED column below is emitted VERBATIM from the ONE declaration in
+-- app/pullRequestReadModel.ts (`pullRequestReadModel.sqlSelectFor(col, { baseAlias: "pr" })`), which
+-- ALSO drives the runtime TS via `fnFor` — the two lowerings fall out of the same closed-DSL AST and
+-- cannot diverge. A drift guard (app/pullRequestReadModel.test.ts) fails if this file stops matching the
+-- declaration, and `assertReadModelParity` proves the SQL and TS lowerings agree.
+--
+-- SEMANTICS. The status-classifying `list_bucket`/`ack_open` read the terminal-folded `derived_status`
+-- off the auto-provisioned `pull_requests__tracking` derived VIEW (ADR-0065), so an out-of-band-
+-- terminated PR classifies on ENGINE TRUTH (`abandoned`) rather than a frozen base `status`. Base
+-- columns stay aliased identity pass-throughs (so the static pages↔schema contract guard sees the
+-- VIEW's columns), sourced off `pull_requests__tracking`'s re-export of the base `pull_requests.*`;
+-- `status` is exposed as the effective `COALESCE(derived_status, status)` so the pages' Status cell and
+-- any status reader track a terminated PR. `acknowledged_at` (093) passes through so the read model can
+-- classify on it.
+--
+-- Forward-only VIEW definition (DROP then CREATE). `pull_requests__tracking` is the managed VIEW urban
+-- provisions at mount; SQLite does not validate a view body at CREATE time, so this migration (which
+-- runs before that mount) is created fine and resolves once the managed VIEW exists. The runner wraps
+-- each file in its own transaction, so this file must NOT contain BEGIN/COMMIT. Numbered after 093.
+
+DROP VIEW IF EXISTS pull_requests_read_model;
+
+CREATE VIEW pull_requests_read_model AS
+SELECT
+  pr.pr_key AS pr_key,
+  pr.repo AS repo,
+  pr.number AS number,
+  pr.url AS url,
+  pr.title AS title,
+  COALESCE(pr.derived_status, pr.status) AS status,
+  pr.current_round AS current_round,
+  pr.process_key AS process_key,
+  pr.waiting_since AS waiting_since,
+  pr.last_review_id AS last_review_id,
+  pr.outcome AS outcome,
+  pr.created_at AS created_at,
+  pr.updated_at AS updated_at,
+  pr.converged_at AS converged_at,
+  pr.merged_at AS merged_at,
+  pr.active_worker AS active_worker,
+  pr.lease_until AS lease_until,
+  pr.last_nudge_at AS last_nudge_at,
+  pr.fresh_head_run_head AS fresh_head_run_head,
+  pr.abandon_token AS abandon_token,
+  pr.incident_key AS incident_key,
+  pr.incident_message AS incident_message,
+  pr.last_round_head AS last_round_head,
+  pr.root_request_key AS root_request_key,
+  pr.epic_phase_label AS epic_phase_label,
+  pr.acknowledged_at AS acknowledged_at,
+  CASE WHEN COALESCE((COALESCE((COALESCE(("pr"."derived_status" = 'merged'), 0) OR COALESCE(("pr"."derived_status" = 'converged'), 0) OR COALESCE(("pr"."derived_status" = 'abandoned'), 0) OR COALESCE(("pr"."derived_status" = 'closed'), 0) OR COALESCE(("pr"."derived_status" = 'failed'), 0)), 0) AND COALESCE(("pr"."acknowledged_at" = "pr"."acknowledged_at"), 0)), 0) THEN 'history' ELSE 'active' END AS list_bucket,
+  CASE WHEN COALESCE((COALESCE((COALESCE(("pr"."derived_status" = 'merged'), 0) OR COALESCE(("pr"."derived_status" = 'converged'), 0) OR COALESCE(("pr"."derived_status" = 'abandoned'), 0) OR COALESCE(("pr"."derived_status" = 'closed'), 0) OR COALESCE(("pr"."derived_status" = 'failed'), 0)), 0) AND (NOT COALESCE(COALESCE(("pr"."acknowledged_at" = "pr"."acknowledged_at"), 0), 0))), 0) THEN 1 ELSE 0 END AS ack_open
+FROM pull_requests__tracking pr;

package/db/migrations/095_delivery_graph_acknowledged_at.sql

@@ -0,0 +1,24 @@
+-- Delivery Graphs: add the `acknowledged_at` dismissal stamp + backfill currently-terminal runs (issue
+-- #641). The Delivery-Graph half of the uniform acknowledge-to-dismiss behaviour (see 093 for the PR
+-- half and the rationale): a terminal run STAYS in Active until an operator dismisses it, then drops to
+-- History — retiring the `status IN ('awaiting-approval','running')` allowlist the pages filtered.
+--
+-- BACKFILL (mandatory, same risk as 093). Repointing the Active grids at the derived `list_bucket`
+-- (096) folds an UNACKNOWLEDGED terminal run into `active`, so without a backfill every historical
+-- terminal run would flood Active on boot. Stamp `acknowledged_at = updated_at` (a delivery-graph run
+-- has no merged/converged timestamp; `updated_at` is its last-touch and is NOT NULL) on every currently-
+-- terminal run so they load in History, and only runs that reach terminal AFTER this migration require
+-- an operator dismiss.
+--
+-- Terminal set = {done, failed, abandoned} (app/deliveryGraphRun.ts `DELIVERY_GRAPH_TERMINAL_STATUSES`).
+-- Classified on the base `status` (the stored ground truth at migration time). The `acknowledged_at IS
+-- NULL` guard keeps the backfill idempotent.
+--
+-- The runner wraps each file in its own transaction — no BEGIN/COMMIT here. Numbered after 094.
+
+ALTER TABLE delivery_graph_runs ADD COLUMN acknowledged_at TEXT;
+
+UPDATE delivery_graph_runs
+   SET acknowledged_at = updated_at
+ WHERE acknowledged_at IS NULL
+   AND status IN ('done', 'failed', 'abandoned');

package/db/migrations/096_delivery_graph_read_model_list_bucket.sql

@@ -0,0 +1,63 @@
+-- Delivery-Graph read model: fold the acknowledge-to-dismiss `list_bucket`/`ack_open` derivations into
+-- the `delivery_graph_read_model` VIEW (issue #641). SUPERSEDES 087's VIEW body — every DERIVED column
+-- is emitted VERBATIM from the ONE declaration in app/deliveryGraphReadModel.ts, now extended with the
+-- shared Active/History oracle (app/listBucket.ts). 087 is a MERGED, IMMUTABLE migration — never edited;
+-- this is a NEW migration superseding its VIEW body (the same pattern by which 081 superseded 076).
+--
+-- WHY. Before #641 the Overview "Active Delivery Graphs" and delivery-graphs "In-flight" grids filtered
+-- the derived VIEW's effective `status` on a base allowlist (`status IN ('awaiting-approval','running')`)
+-- — so a terminal run dropped out of Active the instant it settled, with NO operator dismiss (the last
+-- base-`status` allowlist #637 set out to retire). This VIEW adds a declared `list_bucket`
+-- (active/history) + `ack_open` (Dismiss affordance) so a terminal run STAYS in `active` until
+-- `acknowledged_at` is stamped (`acknowledgeDeliveryGraph`), then folds to `history`, uniformly with the
+-- other three surfaces.
+--
+-- Every DERIVED column below is emitted VERBATIM from `deliveryGraphReadModel.sqlSelectFor(col,
+-- { baseAlias: "dg" })` (which ALSO drives the runtime TS via `fnFor`); the member-PR rollup DDL is
+-- unchanged from 087 and re-emitted from `deliveryGraphPrCounts.viewDdl()`. The drift guard
+-- (app/deliveryGraphReadModel.test.ts) fails if this file stops matching the declaration, and
+-- `assertRollupParity`/`assertReadModelParity` prove the SQL and TS lowerings agree.
+--
+-- SEMANTICS unchanged from 087 EXCEPT the two new derived columns: `stage`/`stage_state` still read the
+-- terminal-folded `derived_status`; `park_label` is the same hand-authored display column; base columns
+-- stay aliased identity pass-throughs; `status` is the effective `COALESCE(derived_status, status)`.
+-- `acknowledged_at` (095) now passes through so the read model can classify on it.
+--
+-- Forward-only VIEW redefinition (DROP then CREATE). The runner wraps each file in its own transaction,
+-- so this file must NOT contain BEGIN/COMMIT. Numbered after 095.
+
+DROP VIEW IF EXISTS delivery_graph_read_model;
+DROP VIEW IF EXISTS delivery_graph_pr_counts;
+
+CREATE VIEW IF NOT EXISTS "delivery_graph_pr_counts" AS
+SELECT
+  "__urban_rollup_src"."root_request_key" AS "root_request_key",
+  SUM(CASE WHEN COALESCE(((NOT COALESCE(("__urban_rollup_src"."root_request_key" IS NULL), 0)) AND (NOT COALESCE(COALESCE((COALESCE(("__urban_rollup_src"."derived_status" = 'converged'), 0) OR COALESCE(("__urban_rollup_src"."derived_status" = 'merged'), 0) OR COALESCE(("__urban_rollup_src"."derived_status" = 'abandoned'), 0)), 0), 0))), 0) THEN 1 ELSE 0 END) AS "prs_in_flight"
+FROM "pull_requests__tracking" "__urban_rollup_src"
+GROUP BY "__urban_rollup_src"."root_request_key";
+
+CREATE VIEW delivery_graph_read_model AS
+SELECT
+  dg.run_key AS run_key,
+  COALESCE(dg.derived_status, dg.status) AS status,
+  dg.process_key AS process_key,
+  dg.process_definition_id AS process_definition_id,
+  dg.digest AS digest,
+  dg.side_effecting AS side_effecting,
+  dg.node_count AS node_count,
+  dg.human_node_count AS human_node_count,
+  dg.side_effect_count AS side_effect_count,
+  dg.title AS title,
+  dg.phase AS phase,
+  dg.phase_node_id AS phase_node_id,
+  dg.human_labels AS human_labels,
+  dg.created_at AS created_at,
+  dg.updated_at AS updated_at,
+  dg.acknowledged_at AS acknowledged_at,
+  CASE WHEN COALESCE(("dg"."derived_status" = 'done'), 0) THEN 'Done' WHEN COALESCE((COALESCE(("dg"."derived_status" = 'failed'), 0) OR COALESCE(("dg"."derived_status" = 'abandoned'), 0)), 0) THEN 'Done' WHEN COALESCE(("dg"."derived_status" = 'awaiting-approval'), 0) THEN 'Requested' WHEN COALESCE((COALESCE("pc"."prs_in_flight", 0) > 0), 0) THEN 'Converging' ELSE 'Implementing' END AS stage,
+  CASE WHEN COALESCE(("dg"."derived_status" = 'done'), 0) THEN 'ok' WHEN COALESCE((COALESCE(("dg"."derived_status" = 'failed'), 0) OR COALESCE(("dg"."derived_status" = 'abandoned'), 0)), 0) THEN 'failed' ELSE NULL END AS stage_state,
+  CASE WHEN COALESCE((COALESCE((COALESCE(("dg"."derived_status" = 'done'), 0) OR COALESCE(("dg"."derived_status" = 'failed'), 0) OR COALESCE(("dg"."derived_status" = 'abandoned'), 0)), 0) AND COALESCE(("dg"."acknowledged_at" = "dg"."acknowledged_at"), 0)), 0) THEN 'history' ELSE 'active' END AS list_bucket,
+  CASE WHEN COALESCE((COALESCE((COALESCE(("dg"."derived_status" = 'done'), 0) OR COALESCE(("dg"."derived_status" = 'failed'), 0) OR COALESCE(("dg"."derived_status" = 'abandoned'), 0)), 0) AND (NOT COALESCE(COALESCE(("dg"."acknowledged_at" = "dg"."acknowledged_at"), 0), 0))), 0) THEN 1 ELSE 0 END AS ack_open,
+  CASE WHEN dg.phase_node_id IS NOT NULL THEN dg.phase ELSE NULL END AS park_label
+FROM delivery_graph_runs__tracking dg
+LEFT JOIN delivery_graph_pr_counts pc ON dg.run_key = pc.root_request_key;

package/db/migrations/097_plan_read_model_terminal_dismiss.sql

@@ -0,0 +1,65 @@
+-- Epic `plan_read_model`: fold the terminal-non-`done` dismissal arm into the Active/History partition
+-- (issue #641, Scope C). SUPERSEDES 083's VIEW body — every DERIVED column is emitted VERBATIM from the
+-- ONE `planReadModel` declaration (app/planReadModel.ts), now with `list_bucket`/`ack_open` classified
+-- over the SHARED acknowledge-to-dismiss oracle (app/listBucket.ts) parameterised by the epic terminal
+-- set {done, failed, abandoned}. 061/074/080/083 are MERGED, IMMUTABLE migrations — never edited; this
+-- is a NEW migration superseding 083's VIEW body (the pattern by which 083 superseded 080).
+--
+-- WHY. Epics already stayed active-until-dismissed on the SUCCESS path (a `done` epic). But a terminal-
+-- non-`done` epic (`failed`/`abandoned` — cancelled) fell STRAIGHT to History (the old bucket CASE's
+-- default), skipping the operator tick-off. For true uniformity with features/PRs/delivery-graphs, the
+-- new `list_bucket` keeps a terminal-but-UNACKNOWLEDGED epic of ANY terminal status in `active` until
+-- dismissed, and `ack_open` extends the Dismiss affordance from `done`-only to the full terminal set (a
+-- `failed`/`abandoned` epic's `delivery` is always non-`converging`, so it is immediately dismissable).
+--
+-- Every DERIVED column below is emitted VERBATIM from `planReadModel.sqlSelectFor(col, { baseAlias:
+-- "pl" })` (which ALSO drives the runtime TS via `fnFor`, behind the app/delivery.ts adapters). The
+-- drift guard (app/planReadModel.test.ts) fails if this file stops matching the declaration, and
+-- `assertReadModelParity` proves the SQL and TS lowerings agree.
+--
+-- SEMANTICS unchanged from 083 EXCEPT `list_bucket`/`ack_open`: `delivery` still reads the base
+-- `plans.status`; the status-classifying arms read the terminal-folded `derived_status`; the wave
+-- columns pass through the `plan_wave_progress` lookup; the display strings (`delivery_label`,
+-- `wave_label`) stay hand-authored. Base columns stay aliased pass-throughs; `status` is the effective
+-- `COALESCE(derived_status, status)`. The two rollup lookups are re-joined identically.
+--
+-- Forward-only VIEW redefinition (DROP then CREATE). `plans__tracking` is the managed VIEW urban
+-- provisions at mount; SQLite does not validate a view body at CREATE time, so this migration (which
+-- runs before that mount) is created fine and resolves once the managed VIEW exists. The runner wraps
+-- each file in its own transaction, so this file must NOT contain BEGIN/COMMIT. Numbered after 096.
+
+DROP VIEW IF EXISTS plan_read_model;
+
+CREATE VIEW plan_read_model AS
+SELECT
+  pl.plan_key AS plan_key,
+  pl.repo AS repo,
+  pl.issue_number AS issue_number,
+  pl.issue_url AS issue_url,
+  pl.title AS title,
+  COALESCE(pl.derived_status, pl.status) AS status,
+  pl.task_count AS task_count,
+  pl.process_key AS process_key,
+  pl.outcome AS outcome,
+  pl.updated_at AS updated_at,
+  pl.epic_phase AS epic_phase,
+  pl.base_branch AS base_branch,
+  pl.wait_gate_label AS wait_gate_label,
+  pl.bound_artifacts AS bound_artifacts,
+  pl.promotion_pr AS promotion_pr,
+  pl.promotion_state AS promotion_state,
+  CASE WHEN COALESCE(((NOT COALESCE(COALESCE(("pl"."status" = 'done'), 0), 0)) OR COALESCE((COALESCE("dc"."prs_opened", 0) = 0), 0)), 0) THEN NULL WHEN COALESCE((COALESCE("dc"."prs_in_flight", 0) > 0), 0) THEN 'converging' WHEN COALESCE((COALESCE("dc"."prs_merged", 0) = COALESCE("dc"."prs_opened", 0)), 0) THEN 'landed' ELSE NULL END AS delivery,
+  "wp"."wave_count" AS wave_count,
+  "wp"."current_wave" AS current_wave,
+  CASE WHEN COALESCE((COALESCE((COALESCE((COALESCE(("pl"."derived_status" = 'done'), 0) OR COALESCE(("pl"."derived_status" = 'failed'), 0) OR COALESCE(("pl"."derived_status" = 'abandoned'), 0)), 0) AND (NOT COALESCE(COALESCE((CASE WHEN COALESCE(((NOT COALESCE(COALESCE(("pl"."status" = 'done'), 0), 0)) OR COALESCE((COALESCE("dc"."prs_opened", 0) = 0), 0)), 0) THEN NULL WHEN COALESCE((COALESCE("dc"."prs_in_flight", 0) > 0), 0) THEN 'converging' WHEN COALESCE((COALESCE("dc"."prs_merged", 0) = COALESCE("dc"."prs_opened", 0)), 0) THEN 'landed' ELSE NULL END = 'converging'), 0), 0))), 0) AND COALESCE(("pl"."acknowledged_at" = "pl"."acknowledged_at"), 0)), 0) THEN 'history' ELSE 'active' END AS list_bucket,
+  CASE WHEN COALESCE((COALESCE((COALESCE((COALESCE(("pl"."derived_status" = 'done'), 0) OR COALESCE(("pl"."derived_status" = 'failed'), 0) OR COALESCE(("pl"."derived_status" = 'abandoned'), 0)), 0) AND (NOT COALESCE(COALESCE((CASE WHEN COALESCE(((NOT COALESCE(COALESCE(("pl"."status" = 'done'), 0), 0)) OR COALESCE((COALESCE("dc"."prs_opened", 0) = 0), 0)), 0) THEN NULL WHEN COALESCE((COALESCE("dc"."prs_in_flight", 0) > 0), 0) THEN 'converging' WHEN COALESCE((COALESCE("dc"."prs_merged", 0) = COALESCE("dc"."prs_opened", 0)), 0) THEN 'landed' ELSE NULL END = 'converging'), 0), 0))), 0) AND (NOT COALESCE(COALESCE(("pl"."acknowledged_at" = "pl"."acknowledged_at"), 0), 0))), 0) THEN 1 ELSE 0 END AS ack_open,
+  CASE
+    WHEN pl.status IS NOT 'done' OR COALESCE(dc.prs_opened, 0) = 0 THEN NULL
+    WHEN COALESCE(dc.prs_in_flight, 0) > 0 THEN dc.prs_merged || '/' || dc.prs_opened || ' slices merged, ' || dc.prs_in_flight || ' converging'
+    WHEN dc.prs_merged = dc.prs_opened THEN dc.prs_opened || '/' || dc.prs_opened || ' slices merged'
+    ELSE NULL
+  END AS delivery_label,
+  (wp.current_wave + 1) || '/' || wp.wave_count AS wave_label
+FROM plans__tracking pl
+LEFT JOIN plan_delivery_counts dc ON pl.plan_key = dc.plan_key
+LEFT JOIN plan_wave_progress wp ON pl.plan_key = wp.plan_key;

package/db/migrations/098_delivery_graph_units_acknowledged_at.sql

@@ -0,0 +1,63 @@
+-- Delivery Graphs: carry the new `acknowledged_at` dismissal stamp (095) through the `delivery_units`
+-- aggregate (issue #641). Migration 095 added `acknowledged_at` to the base `delivery_graph_runs`
+-- table, but its projection onto the ADR "declare-once" `delivery_units` aggregate (088-091) predates
+-- the column: the delivery-graph sync triggers (089) never copied it and the `delivery_graph_runs__units`
+-- compat VIEW (091) never re-exported it. That broke the aggregate's compat-view parity invariant
+-- (`delivery_graph_runs__units` must be byte-identical to `delivery_graph_runs`), and — since the
+-- aggregate is the S9 unified store the feature/epic surfaces already read `acknowledged_at`/`list_bucket`
+-- from — left the delivery-graph unit rows without the dismissal stamp the other kinds carry.
+--
+-- This migration supersedes the two delivery-graph WRITE triggers (INSERT/UPDATE) to also project
+-- `NEW.acknowledged_at`, re-creates the `delivery_graph_runs__units` compat VIEW to re-export it, and
+-- backfills the stamp onto the existing aggregate rows (095's backfill fired the OLD trigger, which
+-- dropped `acknowledged_at`, so the aggregate must be re-synced from the base once here). The feature
+-- and epic triggers/views already project `acknowledged_at` (089/091) and are untouched; the DELETE
+-- trigger is column-agnostic and is left as-is.
+--
+-- Migrations are forward-only and immutable once merged, so 089/091 are NOT edited — the triggers/VIEW
+-- are DROPped and re-created here (numbered after 097). The runner wraps each file in its own
+-- transaction — no BEGIN/COMMIT.
+
+DROP TRIGGER IF EXISTS delivery_graph_runs__du_ai;
+CREATE TRIGGER delivery_graph_runs__du_ai AFTER INSERT ON delivery_graph_runs
+BEGIN
+  INSERT OR REPLACE INTO delivery_units (unit_id, kind, legacy_key, legacy_id, parent_unit_id, node_index, delivery_status, dispatch_status, process_key, process_definition_id, digest, status, side_effecting, node_count, human_node_count, side_effect_count, title, phase, phase_node_id, human_labels, acknowledged_at, created_at, updated_at)
+  VALUES ('delivery-graph:' || NEW.run_key, 'delivery-graph', NEW.run_key, NULL, NULL, NULL, CASE WHEN NEW.status = 'awaiting-approval' THEN 'requested' WHEN NEW.status = 'running' THEN 'running' WHEN NEW.status = 'done' THEN 'done' WHEN NEW.status = 'failed' THEN 'failed' WHEN NEW.status = 'abandoned' THEN 'abandoned' ELSE NULL END, CASE WHEN NEW.status IN ('awaiting-approval') THEN 'pending' WHEN NEW.status IN ('done', 'failed', 'abandoned') THEN 'settled' WHEN NEW.status IN ('running') THEN 'dispatched' ELSE NULL END, NEW.process_key, NEW.process_definition_id, NEW.digest, NEW.status, NEW.side_effecting, NEW.node_count, NEW.human_node_count, NEW.side_effect_count, NEW.title, NEW.phase, NEW.phase_node_id, NEW.human_labels, NEW.acknowledged_at, NEW.created_at, NEW.updated_at);
+END;
+
+DROP TRIGGER IF EXISTS delivery_graph_runs__du_au;
+CREATE TRIGGER delivery_graph_runs__du_au AFTER UPDATE ON delivery_graph_runs
+BEGIN
+  INSERT OR REPLACE INTO delivery_units (unit_id, kind, legacy_key, legacy_id, parent_unit_id, node_index, delivery_status, dispatch_status, process_key, process_definition_id, digest, status, side_effecting, node_count, human_node_count, side_effect_count, title, phase, phase_node_id, human_labels, acknowledged_at, created_at, updated_at)
+  VALUES ('delivery-graph:' || NEW.run_key, 'delivery-graph', NEW.run_key, NULL, NULL, NULL, CASE WHEN NEW.status = 'awaiting-approval' THEN 'requested' WHEN NEW.status = 'running' THEN 'running' WHEN NEW.status = 'done' THEN 'done' WHEN NEW.status = 'failed' THEN 'failed' WHEN NEW.status = 'abandoned' THEN 'abandoned' ELSE NULL END, CASE WHEN NEW.status IN ('awaiting-approval') THEN 'pending' WHEN NEW.status IN ('done', 'failed', 'abandoned') THEN 'settled' WHEN NEW.status IN ('running') THEN 'dispatched' ELSE NULL END, NEW.process_key, NEW.process_definition_id, NEW.digest, NEW.status, NEW.side_effecting, NEW.node_count, NEW.human_node_count, NEW.side_effect_count, NEW.title, NEW.phase, NEW.phase_node_id, NEW.human_labels, NEW.acknowledged_at, NEW.created_at, NEW.updated_at);
+END;
+
+DROP VIEW IF EXISTS delivery_graph_runs__units;
+CREATE VIEW delivery_graph_runs__units AS
+SELECT
+  du.legacy_key AS run_key,
+  du.process_key AS process_key,
+  du.process_definition_id AS process_definition_id,
+  du.digest AS digest,
+  du.status AS status,
+  du.side_effecting AS side_effecting,
+  du.node_count AS node_count,
+  du.human_node_count AS human_node_count,
+  du.side_effect_count AS side_effect_count,
+  du.title AS title,
+  du.phase AS phase,
+  du.phase_node_id AS phase_node_id,
+  du.human_labels AS human_labels,
+  du.acknowledged_at AS acknowledged_at,
+  du.created_at AS created_at,
+  du.updated_at AS updated_at
+FROM delivery_units du
+WHERE du.kind = 'delivery-graph';
+
+-- Re-sync the stamp onto the existing aggregate rows (095's backfill fired the OLD, column-dropping
+-- trigger). Keyed by the aggregate's `legacy_key` = the run's `run_key`.
+UPDATE delivery_units
+   SET acknowledged_at = (
+     SELECT d.acknowledged_at FROM delivery_graph_runs d WHERE d.run_key = delivery_units.legacy_key
+   )
+ WHERE kind = 'delivery-graph';

package/e2e/feature-preflight.e2e.ts

@@ -157,7 +157,8 @@ describe("single-issue feature intake readiness gate (feature.bpmn, issue #295)"
         "the green gate leads into the fan-out head",
       );
       assert.ok(
-        flows.includes("ensure-base-branch->implement-task"),
+        flows.includes("ensure-base-branch->record-feature-implementing") &&
+          flows.includes("record-feature-implementing->implement-task"),
         `the run reaches the implement agent only after the gate (flows: ${flows.join(", ")})`,
       );
       // A green probe never escalates.
@@ -189,7 +190,7 @@ describe("single-issue feature intake readiness gate (feature.bpmn, issue #295)"
       );
       assert.ok(!flows.includes("gw-readiness->readiness-preflight"), "an ungated feature never enters the preflight");
       assert.ok(
-        flows.includes("ensure-base-branch->implement-task"),
+        flows.includes("record-feature-implementing->implement-task"),
         "an ungated feature reaches the implement agent",
       );
     } finally {

package/e2e/feature-run.e2e.ts

@@ -245,8 +245,12 @@ describe("single-issue feature run (#172 — feature.bpmn)", () => {
 
         const flows = takenFlows(app);
         assert.ok(
-          flows.includes("w_gw_answer->implement-task"),
-          `answer re-dispatched the same implement task (flows: ${flows.join(", ")})`,
+          flows.includes("w_gw_answer->record-feature-implementing"),
+          `answer re-dispatched through the implementing-reset task (flows: ${flows.join(", ")})`,
+        );
+        assert.ok(
+          flows.includes("record-feature-implementing->implement-task"),
+          `the reset task re-enters the same implement task (flows: ${flows.join(", ")})`,
         );
         assert.ok(!flows.includes("w_gw_answer->record-feature"), "the abandon (default) flow was NOT taken");
         assert.equal(calls, 2, "the implementation agent was re-dispatched exactly once after the answer");
@@ -254,6 +258,56 @@ describe("single-issue feature run (#172 — feature.bpmn)", () => {
     );
   });
 
+  test("escalate + answer: the run reads `running` (not a stale escalated) through the post-answer re-implementation (issue #642)", async () => {
+    // The write-side twin of `record-feature-escalation`: `record-feature-implementing` sits on the
+    // answer loop-back and stamps `running` BEFORE implement-task re-runs, so `feature_runs.status` no
+    // longer holds a stale `escalated` for the entire re-implementation (the #632 tear). Assert the
+    // agent observes `running` at the moment it is re-dispatched. Boots inline (not `withApp`) so the
+    // re-implementation stub can read the row through `app.db`.
+    const dbDir = mkdtempSync(join(tmpdir(), "nwf-f642-"));
+    const app = await bootTestApp(APP_ROOT, { env: { NANO_APP_DB_URL: `file:${join(dbDir, "app.db")}` } });
+    try {
+      let calls = 0;
+      let statusDuringReimpl: string | undefined;
+      await app.engine.registerWorker("senior:feature", async () => {
+        calls += 1;
+        if (calls === 1) {
+          return { status: "escalated", question: "Which API should I use?", summary: "parked for a human" };
+        }
+        const run = await app.db
+          .table<FeatureRow>("feature_runs", "feature_key")
+          .findOne({ feature_key: "owner/repo#7" });
+        statusDuringReimpl = run?.status;
+        return { status: "opened", pr: "owner/repo#642", summary: "resumed and opened" };
+      });
+      const featureKey = "owner/repo#7";
+      const started = await app.api?.call("startFeature", { body: { issue: featureKey, baseBranch: "epic/e2e" } });
+      assert.equal(started?.status, 202, "startFeature accepted the issue");
+      await app.settle();
+
+      const parked = await featureRow(app, featureKey);
+      assert.equal(parked.status, "escalated", "the run parks at escalated while awaiting the answer");
+      assert.ok(parked.process_key, "the parked run carries its engine process-instance key");
+
+      const tasks = await app.engine.searchUserTasks({ processInstanceKey: parked.process_key! });
+      const task = tasks.find((t) => t.elementId === "feature-escalation") as InboxTask | undefined;
+      assert.ok(task?.userTaskKey, "the feature escalation parked a completable native user task");
+
+      await app.engine.completeUserTask(task!.userTaskKey, { resolution: "answer", answer: "use v2" });
+      await app.settle();
+
+      assert.equal(
+        statusDuringReimpl,
+        "running",
+        "the reset task stamped `running` before implement-task re-ran — no stale escalated",
+      );
+      assert.equal(calls, 2, "the implementation agent was re-dispatched exactly once after the answer");
+    } finally {
+      await app.stop();
+      rmSync(dbDir, { recursive: true, force: true });
+    }
+  });
+
   test("escalate + abandon: abandoning routes to record-feature (default flow)", async () => {
     await withApp(
       {
@@ -273,7 +327,7 @@ describe("single-issue feature run (#172 — feature.bpmn)", () => {
           flows.includes("w_gw_answer->record-feature"),
           `abandon routed to record-feature (flows: ${flows.join(", ")})`,
         );
-        assert.ok(!flows.includes("w_gw_answer->implement-task"), "the answer loop was NOT taken");
+        assert.ok(!flows.includes("w_gw_answer->record-feature-implementing"), "the answer loop was NOT taken");
       },
     );
   });
@@ -322,8 +376,9 @@ describe("single-issue feature run (#172 — feature.bpmn)", () => {
 
         const flows = takenFlows(app);
         assert.ok(
-          flows.includes("w_gw_answer->implement-task"),
-          `the answer re-dispatched the same implement task (flows: ${flows.join(", ")})`,
+          flows.includes("w_gw_answer->record-feature-implementing") &&
+            flows.includes("record-feature-implementing->implement-task"),
+          `the answer re-dispatched the same implement task through the reset (flows: ${flows.join(", ")})`,
         );
         assert.equal(calls, 2, "the implementation agent was re-dispatched exactly once after the answer");
 

package/nano.app.json

@@ -235,6 +235,10 @@
     {
       "taskType": "pr.delivery-connector",
       "handler": "workers/delivery-connector/worker.ts"
+    },
+    {
+      "taskType": "pr.record-feature-implementing",
+      "handler": "workers/record-feature-implementing/worker.ts"
     }
   ],
   "externalTaskTypes": [