@nanobpm/nano-workforce 0.166.0 → 0.167.1

package/openapi.yaml

@@ -5436,6 +5436,104 @@ paths:
             application/json:
               schema:
                 $ref: "#/components/schemas/MessageResult"
+  /actions/acknowledge-pr:
+    post:
+      operationId: acknowledgePr
+      summary: "Dismiss a TERMINAL pull request (issue #641). Stamps `acknowledged_at` on the
+        `pull_requests` row so the `pull_requests_read_model` VIEW recomputes its `list_bucket` to
+        'history' (and `ack_open` to 0), dropping the finished PR out of the Active convergence list
+        into History. The PR twin of acknowledge-done/acknowledge-epic: a PR is not parked at a user
+        task, so this completes no user task and touches no engine/ledger — it only stamps the row.
+        Keyed on the PR's `pr_key`. Rejects (409) a PR that is not yet terminal (still converging), so a
+        live PR stays visible in Active. Idempotent-safe (re-acknowledging keeps it in History)."
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: false
+              required:
+                - pr_key
+              properties:
+                pr_key:
+                  type: string
+                  minLength: 1
+                  description: The pull request's key (pull_requests.pr_key).
+      responses:
+        "200":
+          description: The terminal PR was acknowledged and moved to History.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/MessageResult"
+        "400":
+          description: A required field (pr_key) was missing or invalid.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/MessageResult"
+        "404":
+          description: No pull request matches the pr_key.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/MessageResult"
+        "409":
+          description: The pull request is not terminal, so it cannot be dismissed yet.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/MessageResult"
+  /actions/acknowledge-delivery-graph:
+    post:
+      operationId: acknowledgeDeliveryGraph
+      summary: "Dismiss a TERMINAL delivery-graph run (issue #641). Stamps `acknowledged_at` on the
+        `delivery_graph_runs` row so the `delivery_graph_read_model` VIEW recomputes its `list_bucket`
+        to 'history' (and `ack_open` to 0), dropping the finished run out of the Active delivery-graph
+        list into History. The delivery-graph twin of acknowledge-done/acknowledge-epic/acknowledge-pr:
+        it completes no user task and touches no engine/ledger — it only stamps the row. Keyed on the
+        run's `run_key`. Rejects (409) a run that is not yet terminal (still awaiting-approval/running),
+        so a live run stays visible in Active. Idempotent-safe (re-acknowledging keeps it in History)."
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: false
+              required:
+                - run_key
+              properties:
+                run_key:
+                  type: string
+                  minLength: 1
+                  description: The delivery-graph run's key (delivery_graph_runs.run_key).
+      responses:
+        "200":
+          description: The terminal delivery-graph run was acknowledged and moved to History.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/MessageResult"
+        "400":
+          description: A required field (run_key) was missing or invalid.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/MessageResult"
+        "404":
+          description: No delivery-graph run matches the run_key.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/MessageResult"
+        "409":
+          description: The delivery-graph run is not terminal, so it cannot be dismissed yet.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/MessageResult"
   /hooks/agent-complete:
     post:
       operationId: agentCompleteEscalation

package/operations/acknowledgeDeliveryGraph.test.ts

@@ -0,0 +1,93 @@
+// Tests for the POST /app/api/actions/acknowledge-delivery-graph operation `acknowledgeDeliveryGraph`
+// (issue #641). The nwf UI's "Dismiss" (Done ✓) affordance for a TERMINAL delivery-graph run. It stamps
+// `acknowledged_at`, which the `delivery_graph_read_model` VIEW (096) derives into `list_bucket` =
+// 'history' and `ack_open` = 0, dropping the finished run from the Active list into History. The
+// delivery-graph twin of acknowledge-done / acknowledge-epic / acknowledge-pr.
+//
+// The op's only write is the `acknowledged_at` (+ `updated_at`) stamp, gated on the base `status`
+// belonging to the terminal tier (`DELIVERY_GRAPH_TERMINAL_STATUSES`). These tests seed an in-memory
+// `delivery_graph_runs` store and assert the 400/404/409/200 gate + the stamp; the bucket derivation
+// itself is proven in app/deliveryGraphReadModel.test.ts.
+import { test } from "node:test";
+import { assertEquals } from "#test-assert";
+import type { AppApi } from "@nanobpm/urban";
+import { noopLog } from "../test/log.ts";
+import { DELIVERY_GRAPH_TERMINAL_STATUSES } from "../app/deliveryGraphRun.ts";
+import handler from "./acknowledgeDeliveryGraph.ts";
+
+// biome-ignore lint/suspicious/noExplicitAny: test-only fake data layer over dynamic row shapes.
+function memApp(seed: any[]): { app: AppApi; rows: any[] } {
+  // biome-ignore lint/suspicious/noExplicitAny: test-only store.
+  const stores: Record<string, any[]> = { delivery_graph_runs: seed };
+  function tbl(name: string, pk = "id") {
+    // biome-ignore lint/suspicious/noExplicitAny: test-only.
+    const rows = (stores[name] ??= [] as any[]);
+    return {
+      // biome-ignore lint/suspicious/noExplicitAny: test-only.
+      async get(id: any) {
+        return rows.find((r) => r[pk] === id);
+      },
+      // biome-ignore lint/suspicious/noExplicitAny: test-only.
+      async update(id: any, patch: any) {
+        const r = rows.find((row) => row[pk] === id);
+        if (r) Object.assign(r, patch);
+        return r ? 1 : 0;
+      },
+    };
+  }
+  const app = {
+    data: { table: (n: string, pk?: string) => tbl(n, pk) },
+    log: noopLog(),
+  } as unknown as AppApi;
+  return { app, rows: stores.delivery_graph_runs };
+}
+
+async function call(app: AppApi, body: unknown) {
+  // biome-ignore lint/suspicious/noExplicitAny: test-only op invocation.
+  return (await handler({ req: {} as any, params: {}, query: {}, body } as any, app)) as any;
+}
+
+test("acknowledge-delivery-graph: stamps acknowledged_at on a terminal run and returns 200", async () => {
+  const { app, rows } = memApp([{ run_key: "run-1", status: "done", acknowledged_at: null }]);
+  const res = await call(app, { run_key: "run-1" });
+  assertEquals(res.status, 200);
+  assertEquals(res.body.ok, true);
+  assertEquals(typeof rows[0].acknowledged_at, "string");
+  assertEquals(typeof rows[0].updated_at, "string");
+});
+
+test("acknowledge-delivery-graph: every terminal status is dismissable", async () => {
+  for (const status of DELIVERY_GRAPH_TERMINAL_STATUSES) {
+    const { app, rows } = memApp([{ run_key: "run-1", status, acknowledged_at: null }]);
+    const res = await call(app, { run_key: "run-1" });
+    assertEquals(res.status, 200, `status ${status} must be dismissable`);
+    assertEquals(typeof rows[0].acknowledged_at, "string");
+  }
+});
+
+test("acknowledge-delivery-graph: a live (running) run is rejected (409) and stays unstamped", async () => {
+  const { app, rows } = memApp([{ run_key: "run-2", status: "running", acknowledged_at: null }]);
+  const res = await call(app, { run_key: "run-2" });
+  assertEquals(res.status, 409);
+  assertEquals(res.body.ok, false);
+  assertEquals(rows[0].acknowledged_at, null);
+});
+
+test("acknowledge-delivery-graph: a missing run_key → 400", async () => {
+  const { app } = memApp([]);
+  assertEquals((await call(app, {})).status, 400);
+  assertEquals((await call(app, { run_key: "  " })).status, 400);
+});
+
+test("acknowledge-delivery-graph: no matching run → 404", async () => {
+  const { app } = memApp([]);
+  assertEquals((await call(app, { run_key: "run-404" })).status, 404);
+});
+
+test("acknowledge-delivery-graph: idempotent — re-acknowledging a terminal run re-stamps and returns 200", async () => {
+  const { app, rows } = memApp([{ run_key: "run-5", status: "failed", acknowledged_at: null }]);
+  assertEquals((await call(app, { run_key: "run-5" })).status, 200);
+  assertEquals(typeof rows[0].acknowledged_at, "string");
+  assertEquals((await call(app, { run_key: "run-5" })).status, 200);
+  assertEquals(typeof rows[0].acknowledged_at, "string");
+});

package/operations/acknowledgeDeliveryGraph.ts

@@ -0,0 +1,58 @@
+// POST /app/api/actions/acknowledge-delivery-graph → operationId `acknowledgeDeliveryGraph` (issue #641).
+// The nwf UI's "Dismiss" (Done ✓) affordance for a TERMINAL delivery-graph run: an operator dismisses a
+// finished run (done / failed / abandoned) directly from the Overview "Active Delivery Graphs" or
+// delivery-graphs "In-flight delivery graphs" grid so it drops out of the Active list into History. It
+// is the delivery-graph twin of `acknowledgeDone` / `acknowledgeEpic` / `acknowledgePr` — a terminal
+// run is NOT parked at a user task, so this op completes no user task and touches no engine/ledger: it
+// simply stamps `acknowledged_at` on the `delivery_graph_runs` row.
+//
+// `list_bucket`/`ack_open` are DERIVED by the `delivery_graph_read_model` VIEW (096, issue #641) from
+// the terminal-folded `derived_status` + `acknowledged_at` — a terminal, now-acknowledged run reads
+// `list_bucket` = 'history' and `ack_open` = 0 — so this op NEVER writes a derived projection. Keyed on
+// the row's `run_key`. Idempotent-safe: re-acknowledging re-stamps the timestamp and keeps it in
+// History.
+//
+// It rejects (409) a run that is NOT terminal (still awaiting-approval/running), so it can never pre-
+// seed the tick-off on a live run. The terminal check reads the base `status`: the delivery-graph
+// poller (app/deliveryGraphRun.ts) persists the terminal outcome to base `status` (done/failed/
+// abandoned), and the reconciler's `onTerminated` edge covers an out-of-band terminate.
+
+import { DELIVERY_GRAPH_TERMINAL_STATUSES, deliveryGraphRuns } from "../app/deliveryGraphRun.ts";
+import { defineOperation } from "../nano-generated/operations.ts";
+
+const str = (v: unknown): string => (typeof v === "string" ? v.trim() : "");
+
+export default defineOperation("acknowledgeDeliveryGraph", async ({ body }, app) => {
+  if (!body || typeof body !== "object") {
+    app.log.warn("acknowledge-delivery-graph rejected: missing request body");
+    return { status: 400, body: { ok: false, error: "run_key is required" } };
+  }
+
+  const runKey = str(body.run_key);
+  if (!runKey) return { status: 400, body: { ok: false, error: "run_key is required" } };
+
+  const table = deliveryGraphRuns(app.data);
+  const run = await table.get(runKey);
+  if (!run) {
+    app.log.warn("acknowledge-delivery-graph: no such run", { runKey });
+    return { status: 404, body: { ok: false, error: "no such delivery-graph run" } };
+  }
+
+  // Guard: only a TERMINAL run (a `DELIVERY_GRAPH_TERMINAL_STATUSES` status — the same set the read
+  // model's `list_bucket` folds to History) carries the Dismiss affordance. Acknowledging a live run
+  // would pre-seed `acknowledged_at`, so the moment it later settled the VIEW would drop it straight
+  // into History, skipping the operator tick-off this op exists to require.
+  if (!DELIVERY_GRAPH_TERMINAL_STATUSES.includes(run.status)) {
+    app.log.warn("acknowledge-delivery-graph rejected: run is not terminal", { runKey, status: run.status });
+    return { status: 409, body: { ok: false, error: "delivery-graph run is not terminal" } };
+  }
+
+  // Stamp the dismissal. `list_bucket` (→ 'history') and `ack_open` (→ 0) are derived by the
+  // `delivery_graph_read_model` VIEW from the terminal, now-acknowledged row, so we never hand-set them
+  // here. Idempotent: re-acknowledging re-stamps and stays in History.
+  const now = new Date().toISOString();
+  await table.update(runKey, { acknowledged_at: now, updated_at: now });
+
+  app.log.info("operator dismissed terminal delivery-graph run", { runKey });
+  return { status: 200, body: { ok: true, message: "acknowledged" } };
+});

package/operations/acknowledgePr.test.ts

@@ -0,0 +1,94 @@
+// Tests for the POST /app/api/actions/acknowledge-pr operation `acknowledgePr` (issue #641).
+// The nwf UI's "Dismiss" (Done ✓) affordance for a TERMINAL pull request. It stamps `acknowledged_at`,
+// which the `pull_requests_read_model` VIEW (094) derives into `list_bucket` = 'history' and `ack_open`
+// = 0, dropping the finished PR from the Active convergence list into History. Unlike acknowledge-
+// blocked it completes NO user task (a terminal PR is not parked). The PR twin of acknowledge-done /
+// acknowledge-epic.
+//
+// The op's only write is the `acknowledged_at` (+ `updated_at`) stamp, gated on the base `status`
+// belonging to the terminal tier (`PR_TERMINAL_STATUSES`). These tests seed an in-memory `pull_requests`
+// store and assert the 400/404/409/200 gate + the stamp; the bucket derivation itself is proven in
+// app/pullRequestReadModel.test.ts.
+import { test } from "node:test";
+import { assertEquals } from "#test-assert";
+import type { AppApi } from "@nanobpm/urban";
+import { noopLog } from "../test/log.ts";
+import { PR_TERMINAL_STATUSES } from "../app/pullRequestReadModel.ts";
+import handler from "./acknowledgePr.ts";
+
+// biome-ignore lint/suspicious/noExplicitAny: test-only fake data layer over dynamic row shapes.
+function memApp(seed: any[]): { app: AppApi; rows: any[] } {
+  // biome-ignore lint/suspicious/noExplicitAny: test-only store.
+  const stores: Record<string, any[]> = { pull_requests: seed };
+  function tbl(name: string, pk = "id") {
+    // biome-ignore lint/suspicious/noExplicitAny: test-only.
+    const rows = (stores[name] ??= [] as any[]);
+    return {
+      // biome-ignore lint/suspicious/noExplicitAny: test-only.
+      async get(id: any) {
+        return rows.find((r) => r[pk] === id);
+      },
+      // biome-ignore lint/suspicious/noExplicitAny: test-only.
+      async update(id: any, patch: any) {
+        const r = rows.find((row) => row[pk] === id);
+        if (r) Object.assign(r, patch);
+        return r ? 1 : 0;
+      },
+    };
+  }
+  const app = {
+    data: { table: (n: string, pk?: string) => tbl(n, pk) },
+    log: noopLog(),
+  } as unknown as AppApi;
+  return { app, rows: stores.pull_requests };
+}
+
+async function call(app: AppApi, body: unknown) {
+  // biome-ignore lint/suspicious/noExplicitAny: test-only op invocation.
+  return (await handler({ req: {} as any, params: {}, query: {}, body } as any, app)) as any;
+}
+
+test("acknowledge-pr: stamps acknowledged_at on a terminal PR and returns 200", async () => {
+  const { app, rows } = memApp([{ pr_key: "o/r#1", status: "merged", acknowledged_at: null }]);
+  const res = await call(app, { pr_key: "o/r#1" });
+  assertEquals(res.status, 200);
+  assertEquals(res.body.ok, true);
+  assertEquals(typeof rows[0].acknowledged_at, "string");
+  assertEquals(typeof rows[0].updated_at, "string");
+});
+
+test("acknowledge-pr: every terminal status is dismissable", async () => {
+  for (const status of PR_TERMINAL_STATUSES) {
+    const { app, rows } = memApp([{ pr_key: "o/r#1", status, acknowledged_at: null }]);
+    const res = await call(app, { pr_key: "o/r#1" });
+    assertEquals(res.status, 200, `status ${status} must be dismissable`);
+    assertEquals(typeof rows[0].acknowledged_at, "string");
+  }
+});
+
+test("acknowledge-pr: a live (still-converging) PR is rejected (409) and stays unstamped", async () => {
+  const { app, rows } = memApp([{ pr_key: "o/r#2", status: "converging", acknowledged_at: null }]);
+  const res = await call(app, { pr_key: "o/r#2" });
+  assertEquals(res.status, 409);
+  assertEquals(res.body.ok, false);
+  assertEquals(rows[0].acknowledged_at, null);
+});
+
+test("acknowledge-pr: a missing pr_key → 400", async () => {
+  const { app } = memApp([]);
+  assertEquals((await call(app, {})).status, 400);
+  assertEquals((await call(app, { pr_key: "  " })).status, 400);
+});
+
+test("acknowledge-pr: no matching PR → 404", async () => {
+  const { app } = memApp([]);
+  assertEquals((await call(app, { pr_key: "o/r#404" })).status, 404);
+});
+
+test("acknowledge-pr: idempotent — re-acknowledging a terminal PR re-stamps and returns 200", async () => {
+  const { app, rows } = memApp([{ pr_key: "o/r#5", status: "converged", acknowledged_at: null }]);
+  assertEquals((await call(app, { pr_key: "o/r#5" })).status, 200);
+  assertEquals(typeof rows[0].acknowledged_at, "string");
+  assertEquals((await call(app, { pr_key: "o/r#5" })).status, 200);
+  assertEquals(typeof rows[0].acknowledged_at, "string");
+});

package/operations/acknowledgePr.ts

@@ -0,0 +1,62 @@
+// POST /app/api/actions/acknowledge-pr → operationId `acknowledgePr` (issue #641).
+// The nwf UI's "Dismiss" (Done ✓) affordance for a TERMINAL pull request: an operator dismisses a
+// finished PR (merged / converged / abandoned / closed / failed) directly from the Overview "Active PR
+// convergences" or home "Pull requests" grid so it drops out of the Active convergence list into
+// History. It is the PR twin of `acknowledgeDone` (the feature-run tick-off) and `acknowledgeEpic` — a
+// terminal PR is NOT parked at a user task, so this op completes no user task and touches no engine/
+// ledger: it simply stamps `acknowledged_at` on the `pull_requests` row.
+//
+// `list_bucket`/`ack_open` are DERIVED by the `pull_requests_read_model` VIEW (094, issue #641) from
+// the terminal-folded `derived_status` + `acknowledged_at` — a terminal, now-acknowledged PR reads
+// `list_bucket` = 'history' and `ack_open` = 0 — so this op NEVER writes a derived projection. Keyed on
+// the row's `pr_key`. Idempotent-safe: re-acknowledging re-stamps the timestamp and keeps it in
+// History.
+//
+// It rejects (409) a PR that is NOT terminal (still converging/waiting_review/…), so it can never
+// pre-seed the tick-off on a live PR: were `acknowledged_at` set early, the moment the PR later settled
+// the VIEW would drop it straight into History, skipping the operator dismiss this op exists to
+// require. The terminal check reads the base `status` — the reconciler's `onTerminated` edge persists
+// an out-of-band terminate to base `status` = 'abandoned', so a resolved PR is matched here too.
+
+import { PR_TERMINAL_STATUSES } from "../app/pullRequestReadModel.ts";
+import { defineOperation } from "../nano-generated/operations.ts";
+
+const str = (v: unknown): string => (typeof v === "string" ? v.trim() : "");
+
+export default defineOperation("acknowledgePr", async ({ body }, app) => {
+  if (!body || typeof body !== "object") {
+    app.log.warn("acknowledge-pr rejected: missing request body");
+    return { status: 400, body: { ok: false, error: "pr_key is required" } };
+  }
+
+  const prKey = str(body.pr_key);
+  if (!prKey) return { status: 400, body: { ok: false, error: "pr_key is required" } };
+
+  const table = app.data.table<{ pr_key: string; status: string; acknowledged_at: string | null; updated_at: string }>(
+    "pull_requests",
+    "pr_key",
+  );
+  const pr = await table.get(prKey);
+  if (!pr) {
+    app.log.warn("acknowledge-pr: no such pull request", { prKey });
+    return { status: 404, body: { ok: false, error: "no such pull request" } };
+  }
+
+  // Guard: only a TERMINAL PR (a `PR_TERMINAL_STATUSES` status — the same set the read model's
+  // `list_bucket` folds to History) carries the Dismiss affordance. Acknowledging a live PR would
+  // pre-seed `acknowledged_at`, so the moment it later settled the VIEW would drop it straight into
+  // History, skipping the operator tick-off this op exists to require.
+  if (!PR_TERMINAL_STATUSES.includes(pr.status)) {
+    app.log.warn("acknowledge-pr rejected: PR is not terminal", { prKey, status: pr.status });
+    return { status: 409, body: { ok: false, error: "pull request is not terminal" } };
+  }
+
+  // Stamp the dismissal. `list_bucket` (→ 'history') and `ack_open` (→ 0) are derived by the
+  // `pull_requests_read_model` VIEW from the terminal, now-acknowledged row, so we never hand-set them
+  // here. Idempotent: re-acknowledging re-stamps and stays in History.
+  const now = new Date().toISOString();
+  await table.update(prKey, { acknowledged_at: now, updated_at: now });
+
+  app.log.info("operator dismissed terminal pull request", { prKey });
+  return { status: 200, body: { ok: true, message: "acknowledged" } };
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.166.0",
+  "version": "0.167.1",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",
@@ -61,7 +61,7 @@
   },
   "dependencies": {
     "@nanobpm/agentic": "^0.4.0",
-    "@nanobpm/urban": "^0.87.0",
+    "@nanobpm/urban": "^0.88.1",
     "bpmn-auto-layout": "^2.0.0-alpha.2"
   },
   "devDependencies": {

package/pages/delivery-graphs/library.mount.js

@@ -13,7 +13,13 @@
 // standalone — only the host element and injected endpoint config differ. The app has no browser build
 // step, so this consumes the library doors straight off the wire.
 
-import { DG_COMPOSE_FILL_MESSAGE } from "./mount.js";
+import { DG_COMPOSE_FILL_ACK_MESSAGE, DG_COMPOSE_FILL_MESSAGE } from "./mount.js";
+
+// The bounded budget within which the compose App-View must ACK a Reuse fill before we surface an honest
+// "Couldn't reach the composer" error (issue #645). Mirrors the compose mount's own ACK_TIMEOUT_MS: long
+// enough for the App-View relay round-trip (nano-ide #518), short enough that a dropped fill fails fast
+// instead of leaving a misleading "✓ Loaded…" up. Overridable via config for tests.
+const REUSE_ACK_TIMEOUT_MS = 2000;
 
 // The read behind the list: every saved library entry, newest first. Anchored to THIS MODULE's url
 // (import.meta.url), NOT the document base. The library App-View shell (library-embed.html /
@@ -149,6 +155,8 @@ export function mountDeliveryGraphLibrary(host, config = {}) {
 
   const libraryUrl = config.libraryUrl ?? DEFAULT_LIBRARY_URL;
   const refreshMs = typeof config.refreshMs === "number" && config.refreshMs > 0 ? config.refreshMs : DEFAULT_REFRESH_MS;
+  const ackTimeoutMs =
+    typeof config.ackTimeoutMs === "number" && config.ackTimeoutMs > 0 ? config.ackTimeoutMs : REUSE_ACK_TIMEOUT_MS;
   const headers = (url) => ({
     "content-type": "application/json",
     ...(config.hookSecret && isSameOrigin(url) ? { "x-hook-secret": config.hookSecret } : {}),
@@ -255,7 +263,22 @@ export function mountDeliveryGraphLibrary(host, config = {}) {
   // the host bridge, posting the shared `deliveryGraph.compose.fill` message UP to the console (the
   // INBOUND twin of the outbound `nano-navigate` DI-preview bridge). Standalone (not embedded) there is
   // no console to route it and no compose view to fill, so we say so instead of failing silently.
+  //
+  // The success toast is ACKNOWLEDGED, never optimistic (issue #645): a "✓ Loaded…" printed synchronously
+  // after the post lied whenever the fill was dropped (no relay, wrong origin, an unmounted compose view).
+  // Now we show a NEUTRAL in-progress status, tag the fill with a correlation `token`, and resolve it only
+  // when the compose mount echoes `DG_COMPOSE_FILL_ACK_MESSAGE` for that token — "✓ Loaded…" on the ack,
+  // "Couldn't reach the composer" on a short timeout. A fresh Reuse supersedes any pending one.
   const isEmbedded = typeof window !== "undefined" && window.parent && window.parent !== window;
+  let pendingReuse = null;
+  function clearPendingReuse() {
+    if (pendingReuse && pendingReuse.timer) clearTimeout(pendingReuse.timer);
+    pendingReuse = null;
+  }
+  function newReuseToken() {
+    if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") return crypto.randomUUID();
+    return `reuse-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+  }
   function doReuse(id) {
     const entry = entries.find((e) => e && e.id === id);
     if (!entry) {
@@ -270,12 +293,42 @@ export function mountDeliveryGraphLibrary(host, config = {}) {
       setStatus("Open this page inside the console to reuse a saved graph in the composer.", "err");
       return;
     }
+    clearPendingReuse();
+    const token = newReuseToken();
     window.parent.postMessage(
-      { type: DG_COMPOSE_FILL_MESSAGE, graphJson: entry.graph },
+      { type: DG_COMPOSE_FILL_MESSAGE, graphJson: entry.graph, token },
       window.location.origin,
     );
+    // NEUTRAL in-progress status (no "✓") — success is only earned on the compose ack below (#645).
+    setStatus("Loading into the composer above\u2026", "");
+    const timer = setTimeout(() => {
+      if (!pendingReuse || pendingReuse.token !== token) return;
+      pendingReuse = null;
+      setStatus("Couldn't reach the composer \u2014 is the composer open above this list?", "err");
+    }, ackTimeoutMs);
+    pendingReuse = { token, timer };
+  }
+  // The compose App-View's acknowledgment that it filled (#645): a same-origin `DG_COMPOSE_FILL_ACK_MESSAGE`
+  // from the parent (the console, which relays it across from the compose sibling) whose `token` matches the
+  // pending Reuse resolves it to success. A foreign origin, a non-parent source, or a stale/mismatched token
+  // is ignored — an unrelated page (or a prior Reuse's late ack) can't forge or misattribute a success toast.
+  function onReuseAck(ev) {
+    if (!ev || typeof window === "undefined") return;
+    if (ev.origin !== window.location.origin) return;
+    if (ev.source !== window.parent) return;
+    const data = ev.data;
+    if (!data || data.type !== DG_COMPOSE_FILL_ACK_MESSAGE) return;
+    // Require a string `token` that exactly matches the pending Reuse. A null/undefined-token ack
+    // (the compose mount emits `token: null` when a fill arrives without a token) can't be correlated
+    // to this Reuse and must NOT resolve it — otherwise it reintroduces the false-positive "✓ Loaded…"
+    // toast (#645).
+    if (!pendingReuse || typeof data.token !== "string" || data.token !== pendingReuse.token) return;
+    clearPendingReuse();
     setStatus("\u2713 Loaded into the composer above \u2014 edit, Preview or Stage it.", "ok");
   }
+  if (isEmbedded && typeof window !== "undefined" && typeof window.addEventListener === "function") {
+    window.addEventListener("message", onReuseAck);
+  }
 
   // "Export": a purely client-side download of a saved entry's graph JSON as `<name>.deliverygraph.json`
   // (issue #525). No backend door — the list door already carries each entry's `graph` inline (the same
@@ -368,6 +421,10 @@ export function mountDeliveryGraphLibrary(host, config = {}) {
 
   return () => {
     disposed = true;
+    clearPendingReuse();
+    if (typeof window !== "undefined" && typeof window.removeEventListener === "function") {
+      window.removeEventListener("message", onReuseAck);
+    }
     clearInterval(timer);
     root.innerHTML = "";
   };