@nanobpm/nano-workforce 0.166.0 → 0.167.1

package/scripts/pages-contract.test.ts

@@ -319,27 +319,21 @@ test("issue #205: overview is the landing page and first nav item", async () =>
 
   // Four collapsible active-work sections, one per dispatch surface, each with a
   // live count in its header (showCount) and a persisted collapse toggle (collapsible). Each filters
-  // its Active list on a `{field, in:[...]}` predicate. The FEATURE and EPIC surfaces bucket on the
-  // DERIVED `list_bucket` — NOT raw `status` — over their read-model VIEW (features: issue #637 —
-  // fixing a drift where the grid read the vestigial base `feature_runs.status` with an allowlist that
-  // hid every converging feature; epics: issue #298), so a `done`-but-unacknowledged item still
-  // converging does not vanish from its in-flight section the instant `status` reads terminal. Guarding
-  // the field here is the regression guard for that defect class. The feature surface binds the derived
-  // `feature_read_model` VIEW (the single source of truth for the `list_bucket` activeness predicate,
-  // shared byte-for-byte with the Feature tab); the epic surface binds `plan_read_model` (epic #412),
-  // not the raw `plans` table. PRs / delivery graphs still bucket on `status` (see #637 follow-up).
+  // its Active list on a `{field, in:[...]}` predicate. ALL FOUR surfaces now bucket on the DERIVED
+  // `list_bucket` — NOT raw `status` — over their read-model VIEW (features: issue #637; epics: #298;
+  // PRs + delivery graphs: issue #641 — retiring the last two base-`status` allowlists), so a terminal-
+  // but-unacknowledged item stays in its in-flight section until an operator dismisses it, instead of
+  // vanishing the instant `status` reads terminal. Guarding the field here is the regression guard for
+  // that defect class. Each surface binds its declare-once read-model VIEW (the single source of truth
+  // for the `list_bucket` activeness predicate), never a raw base table.
   const expected: Record<string, { field: string; in: string[] }> = {
-    pull_requests: {
-      field: "status",
-      in: ["converging", "waiting_review", "escalated", "waiting_deps", "waiting_merge", "queued", "merging"],
-    },
+    pull_requests_read_model: { field: "list_bucket", in: ["active"] },
     plan_read_model: { field: "list_bucket", in: ["active"] },
     feature_read_model: { field: "list_bucket", in: ["active"] },
-    // The 4th dispatch surface (issue #386) — active delivery graphs. Both in-flight statuses
-    // (`awaiting-approval` parked at the gate, `running` dispatched) show here. Binds the derived
-    // `delivery_graph_read_model` VIEW (S7 / #541 — the single source of truth for the pipeline
-    // projection it also renders), which re-exports every run column plus the effective `status`.
-    delivery_graph_read_model: { field: "status", in: ["awaiting-approval", "running"] },
+    // The 4th dispatch surface (issue #386) — active delivery graphs. Binds the derived
+    // `delivery_graph_read_model` VIEW (S7 / #541), now filtered on `list_bucket` (issue #641) so a
+    // terminal run stays Active until dismissed rather than dropping on its base `status`.
+    delivery_graph_read_model: { field: "list_bucket", in: ["active"] },
   };
   const grids = (overview.nodes ?? []).filter((n: Json) => n.type === "dataGrid");
   for (const [table, { field, in: values }] of Object.entries(expected)) {
@@ -357,6 +351,74 @@ test("issue #205: overview is the landing page and first nav item", async () =>
 });
 
 
+test("issue #641: no Active/History grid filters a base-`status` allowlist — every dispatch Active list buckets on a derived read-model VIEW", async () => {
+  // The drift class this closes (the last mile of #637): an "Active …" dispatch list that re-encodes
+  // activeness as a hardcoded base-`status` allowlist (`{ field: "status", in: [...] }`) instead of the
+  // declare-once derived `list_bucket` over its read-model VIEW. Such an allowlist silently drops a row
+  // out of Active the instant its `status` leaves the set — with NO operator dismiss — and must be kept
+  // hand-synced with every status rename. #641 retired the last two (PRs + delivery graphs); this guard
+  // makes the whole class a BUILD FAILURE so it can never creep back in on a new/edited grid.
+  //
+  // SCOPE — an "Active/History surface" is a top-level grid that partitions rows into active vs.
+  // finished: either its title starts with "Active " (the Overview sections) OR it carries a `History`
+  // tab (the Feature/Epic/PR/Delivery-Graph/lineage grids). This deliberately EXCLUDES the param-scoped
+  // per-epic slice grids (epic-detail's "Wave state" Active/Skipped/All, "Trial-merge results"
+  // Needs-attention/Clean/All), which legitimately filter a domain `status`/`result` within one epic —
+  // they have no `History` tab and no "Active " title, so they are not activeness partitions.
+  const BASE_TABLES = new Set(["pull_requests", "plans", "feature_runs", "delivery_graph_runs"]);
+  const grids: Json[] = [];
+  const walk = (n: Json): void => {
+    if (Array.isArray(n)) return n.forEach(walk);
+    if (n && typeof n === "object") {
+      if (n.type === "dataGrid") grids.push(n);
+      for (const v of Object.values(n)) walk(v);
+    }
+  };
+  for (const e of readdirSync(`${ROOT}pages`, { withFileTypes: true })) {
+    if (!e.isFile() || !e.name.endsWith(".page.json")) continue;
+    const page = JSON.parse(readFileSync(`${ROOT}pages/${e.name}`, "utf8"));
+    walk(page.nodes ?? page);
+    // Tag each grid with its page for messages.
+    for (const g of grids) if (g.__page === undefined) g.__page = e.name;
+  }
+
+  let surfaces = 0;
+  for (const g of grids) {
+    const props = g.props ?? {};
+    const title: string = typeof props.title === "string" ? props.title : "";
+    const tabs: Json[] = Array.isArray(props.tabs) ? props.tabs : [];
+    const hasHistoryTab = tabs.some((t) => typeof t?.label === "string" && /history/i.test(t.label));
+    const activeTitle = /^active\s/i.test(title);
+    if (!hasHistoryTab && !activeTitle) continue; // not an activeness partition — skip
+    surfaces++;
+
+    const table: string = g.props?.data?.table ?? "";
+    // 1) It must bind a DERIVED read-model relation, never a raw base table (whose only activeness
+    //    signal is the base `status` this guard forbids filtering on).
+    assert(
+      !BASE_TABLES.has(table),
+      `${g.__page}: Active/History grid "${title || tabs.map((t) => t.label).join("/")}" binds the raw base table "${table}" — bind its derived read-model VIEW (…_read_model) so it can filter the declared list_bucket`,
+    );
+
+    // 2) No filter — the grid's main filter OR any tab filter — may re-encode activeness as a
+    //    base-`status` allowlist. (A domain filter on another column is fine; only `status IN […]` is
+    //    the banned drift surface.)
+    const allFilters: Json[] = [g.props?.data?.filter, ...tabs.map((t) => t?.filter)];
+    for (const filter of allFilters) {
+      if (!Array.isArray(filter)) continue;
+      for (const pred of filter) {
+        assert(
+          !(pred?.field === "status" && (Array.isArray(pred.in) || pred.eq !== undefined)),
+          `${g.__page}: Active/History grid "${title || tabs.map((t) => t.label).join("/")}" filters a base-\`status\` allowlist ` +
+            `(${JSON.stringify(pred)}) — bucket on the derived \`list_bucket\` over the read-model VIEW instead (issue #641).`,
+        );
+      }
+    }
+  }
+  assert(surfaces >= 6, `expected to find the dispatch Active/History surfaces, found only ${surfaces}`);
+});
+
+
 test("issue #386: the human-facing Delivery Graphs surface is wired (nav tab, page, detail, overview)", async () => {
   // 1) A `Delivery Graphs` nav tab in the single-source nav, pointing at the delivery-graphs page.
   const nav = JSON.parse(readFileSync(`${ROOT}pages/_nav.json`, "utf8"));

package/test/delivery-graphs-ack-or-timeout.test.ts

@@ -0,0 +1,280 @@
+// Red/green behavioural guard for the delivery-graph Preview & Reuse "honest toast" fix (issue #645).
+//
+// The DEFECT: both cross-frame producers printed an UNCONDITIONAL "✓ …" success toast synchronously
+// right after `postMessage`, even though the message can be dropped by the host relay boundary — so the
+// UI claimed success while nothing happened. The FIX makes the success EARNED, not assumed:
+//   • Library "Reuse" (library.mount.js `doReuse`) posts the compose-fill UP to the host (relayed across
+//     to the compose sibling App-View by nano-ide #518), shows a NEUTRAL in-progress status, and only
+//     renders "✓ Loaded…" when the compose mount acks the fill (matching a correlation token) — a clear
+//     "Couldn't reach the composer" on a short timeout.
+//   • Compose "Preview generated DI" (mount.js `doPreviewDi`) posts `nano-navigate` UP to the console,
+//     shows a NEUTRAL in-progress status, and only renders "✓ Opened…" on a host `nano-navigate-ack` —
+//     "Couldn't reach the console explorer" on a short timeout.
+//
+// These tests drive the REAL mounts over a linkedom DOM inside a fake EMBEDDED App-View window whose
+// `parent.postMessage` is recorded and whose `message` listeners can be fed synthetic acks. They fail
+// against the pre-fix mounts (which render "✓" synchronously with no ack) and pass after.
+import { test } from "node:test";
+import { assert, assertEquals } from "#test-assert";
+import { parseHTML } from "linkedom";
+import { mountDeliveryGraphs, DG_COMPOSE_FILL_ACK_MESSAGE, NANO_NAVIGATE_ACK_MESSAGE } from "../pages/delivery-graphs/mount.js";
+import { mountDeliveryGraphLibrary } from "../pages/delivery-graphs/library.mount.js";
+
+const ORIGIN = "https://app.test";
+const CHECK = "\u2713"; // the "✓" a success toast must EARN, never assume
+
+interface PostedMessage {
+  data: { type?: string; graphJson?: string; token?: string | null; target?: string; params?: unknown };
+  targetOrigin: string;
+}
+
+/** Boot a mount inside a fake EMBEDDED App-View window (parent !== window) with a recording
+ *  parent.postMessage and a capturable `message` listener set, over a linkedom DOM. */
+function harness(
+  mountFn: (host: unknown, config: Record<string, unknown>) => () => void,
+  config: Record<string, unknown>,
+  fetchImpl?: (input: unknown, init?: unknown) => Promise<Response>,
+) {
+  const { window: domWindow, document } = parseHTML("<!doctype html><html><body><div id='host'></div></body></html>");
+  const host = document.getElementById("host");
+  assert(host, "harness host element must exist");
+
+  const posted: PostedMessage[] = [];
+  const messageListeners: Array<(ev: unknown) => void> = [];
+  const parentWindow = {
+    postMessage: (data: PostedMessage["data"], targetOrigin: string) => {
+      posted.push({ data, targetOrigin });
+    },
+  };
+  const fakeWindow = {
+    location: { origin: ORIGIN, href: `${ORIGIN}/delivery-graphs/` },
+    parent: parentWindow, // parent !== fakeWindow ⇒ embedded
+    addEventListener: (type: string, fn: (ev: unknown) => void) => {
+      if (type === "message") messageListeners.push(fn);
+    },
+    removeEventListener: (type: string, fn: (ev: unknown) => void) => {
+      if (type !== "message") return;
+      const i = messageListeners.indexOf(fn);
+      if (i >= 0) messageListeners.splice(i, 1);
+    },
+  };
+
+  const origFetch = globalThis.fetch;
+  if (fetchImpl) globalThis.fetch = fetchImpl as typeof fetch;
+  const origWindow = Reflect.get(globalThis, "window");
+  Reflect.set(globalThis, "window", fakeWindow);
+
+  // Restore the mutated globals if the mount itself throws, so a failing mount can't
+  // leak `fetch`/`window` into later tests and make them fail in confusing ways.
+  let dispose: () => void;
+  try {
+    dispose = mountFn(host, config);
+  } catch (err) {
+    if (fetchImpl) globalThis.fetch = origFetch;
+    Reflect.set(globalThis, "window", origWindow);
+    throw err;
+  }
+
+  const teardown = () => {
+    dispose();
+    if (fetchImpl) globalThis.fetch = origFetch;
+    Reflect.set(globalThis, "window", origWindow);
+  };
+  const flush = async () => {
+    for (let i = 0; i < 4; i++) await new Promise((r) => setTimeout(r, 0));
+  };
+  const click = (el: { dispatchEvent: (ev: unknown) => boolean } | null) => {
+    assert(el, "click target must exist");
+    el!.dispatchEvent(new domWindow.Event("click", { bubbles: true, cancelable: true }));
+  };
+  // Deliver a synthetic same-origin message from the parent (the console relay) to the mount's listeners.
+  const emitFromParent = (data: unknown) => {
+    for (const fn of [...messageListeners]) fn({ origin: ORIGIN, source: parentWindow, data });
+  };
+  const status = () => host!.querySelector(".status") as { textContent: string | null; className: string } | null;
+
+  return { host, posted, teardown, flush, click, emitFromParent, status };
+}
+
+const wait = (ms: number) => new Promise((r) => setTimeout(r, ms));
+
+// ── Library "Reuse" ────────────────────────────────────────────────────────────────────────────────
+const LIBRARY_URL = `${ORIGIN}/app/api/delivery-graph/library`;
+const ENTRY = { id: "lib-1", name: "Onboarding", graph: '{"nodes":[],"edges":[]}' };
+const libraryFetch = async (input: unknown) => {
+  if (String(input).startsWith(LIBRARY_URL)) return new Response(JSON.stringify({ entries: [ENTRY] }), { status: 200 });
+  return new Response(JSON.stringify({}), { status: 404 });
+};
+
+function libraryHarness() {
+  return harness(
+    mountDeliveryGraphLibrary as never,
+    { libraryUrl: LIBRARY_URL, refreshMs: 1_000_000_000, ackTimeoutMs: 40 },
+    libraryFetch,
+  );
+}
+
+test("#645: Reuse shows NO optimistic ✓ toast — a neutral in-progress status until the compose acks", async () => {
+  const h = libraryHarness();
+  try {
+    await h.flush();
+    h.click(h.host!.querySelector("[data-reuse]"));
+    // Synchronously after the post: the fill message went UP to the host, but there is NO success yet.
+    const fill = h.posted.find((p) => p.data.type === "nano-delivery-graph-compose-fill");
+    assert(fill, "Reuse must post the compose-fill message up to the host");
+    assertEquals(fill!.data.graphJson, ENTRY.graph, "the fill carries the saved graph JSON");
+    assert(typeof fill!.data.token === "string" && fill!.data.token, "the fill carries a correlation token for the ack");
+    const s = h.status();
+    assert(s && !s.textContent!.includes(CHECK), "Reuse must NOT render a ✓ success toast synchronously (the #645 defect)");
+    assert(s && !/status-ok/.test(s.className), "the pre-ack Reuse status must not carry the success (ok) tone");
+  } finally {
+    h.teardown();
+  }
+});
+
+test("#645: Reuse renders ✓ Loaded only once the compose acks the matching fill token", async () => {
+  const h = libraryHarness();
+  try {
+    await h.flush();
+    h.click(h.host!.querySelector("[data-reuse]"));
+    const fill = h.posted.find((p) => p.data.type === "nano-delivery-graph-compose-fill");
+    assert(fill, "Reuse must post the compose-fill message");
+    // A stale/mismatched-token ack must NOT complete this Reuse.
+    h.emitFromParent({ type: DG_COMPOSE_FILL_ACK_MESSAGE, token: "some-other-token" });
+    assert(!h.status()!.textContent!.includes(CHECK), "an ack for a different token must not satisfy this Reuse");
+    // The real ack (echoing our token) earns the success toast.
+    h.emitFromParent({ type: DG_COMPOSE_FILL_ACK_MESSAGE, token: fill!.data.token });
+    const s = h.status();
+    assert(s!.textContent!.includes(CHECK) && /Loaded/.test(s!.textContent!), "on ack Reuse renders the ✓ Loaded toast");
+    assert(/status-ok/.test(s!.className), "the acked Reuse status carries the success tone");
+  } finally {
+    h.teardown();
+  }
+});
+
+test("#645: Reuse ignores an ack with a null/absent token — it can't be correlated, so no ✓", async () => {
+  const h = libraryHarness();
+  try {
+    await h.flush();
+    h.click(h.host!.querySelector("[data-reuse]"));
+    const fill = h.posted.find((p) => p.data.type === "nano-delivery-graph-compose-fill");
+    assert(fill, "Reuse must post the compose-fill message");
+    // The compose mount emits `token: null` when a fill arrives without a token; such an ack can't be
+    // correlated to this Reuse and must NOT satisfy it (else the #645 false-positive toast returns).
+    h.emitFromParent({ type: DG_COMPOSE_FILL_ACK_MESSAGE, token: null });
+    assert(!h.status()!.textContent!.includes(CHECK), "a null-token ack must not satisfy this Reuse");
+    h.emitFromParent({ type: DG_COMPOSE_FILL_ACK_MESSAGE });
+    assert(!h.status()!.textContent!.includes(CHECK), "a token-less ack must not satisfy this Reuse");
+    // The real ack (echoing our token) still earns the success toast.
+    h.emitFromParent({ type: DG_COMPOSE_FILL_ACK_MESSAGE, token: fill!.data.token });
+    assert(h.status()!.textContent!.includes(CHECK), "the matching-token ack still resolves the Reuse");
+  } finally {
+    h.teardown();
+  }
+});
+
+test("#645: Reuse surfaces an honest error when the compose never acks (short timeout)", async () => {
+  const h = libraryHarness();
+  try {
+    await h.flush();
+    h.click(h.host!.querySelector("[data-reuse]"));
+    assert(!h.status()!.textContent!.includes(CHECK), "no success before the timeout");
+    await wait(80); // > ackTimeoutMs (40)
+    const s = h.status();
+    assert(s && /Couldn't reach the composer/.test(s.textContent!), "on timeout Reuse surfaces 'Couldn't reach the composer'");
+    assert(!s!.textContent!.includes(CHECK) && /status-err/.test(s!.className), "the timed-out Reuse is an error, never a ✓ success");
+  } finally {
+    h.teardown();
+  }
+});
+
+// ── Compose "Preview generated DI" ───────────────────────────────────────────────────────────────────
+const PREVIEW_URL = `${ORIGIN}/app/api/actions/delivery-graph/preview`;
+const STAGE_URL = `${ORIGIN}/app/api/actions/delivery-graph/stage`;
+const IMPORT_URL = `${ORIGIN}/app/api/actions/delivery-graph/library/import`;
+const composeFetch = async (input: unknown) => {
+  if (String(input) === PREVIEW_URL) {
+    return new Response(
+      JSON.stringify({ ok: true, title: "T", sideEffecting: false, nodeCount: 1, humanNodeCount: 0, sideEffectCount: 0, digest: "d1", sideEffects: [], mermaid: "graph TD", bpmn: "<xml/>" }),
+      { status: 200 },
+    );
+  }
+  return new Response(JSON.stringify({}), { status: 404 });
+};
+
+/** Boot the compose mount and drive Preview so a laid-out BPMN exists, then click "Preview generated DI". */
+async function composePreviewHarness() {
+  const h = harness(
+    mountDeliveryGraphs as never,
+    { previewUrl: PREVIEW_URL, stageUrl: STAGE_URL, importUrl: IMPORT_URL, ackTimeoutMs: 40 },
+    composeFetch,
+  );
+  const jsonEl = h.host!.querySelector("#dg-json") as { value: string } | null;
+  assert(jsonEl, "compose mount must render the #dg-json textarea");
+  jsonEl!.value = '{"nodes":[],"edges":[]}';
+  h.click(h.host!.querySelector("#dg-preview"));
+  await h.flush(); // resolves the preview door → lastBpmn set → renders the "Preview generated DI" button
+  return h;
+}
+
+test("#645: 'Preview generated DI' shows NO optimistic ✓ toast — a neutral status until the host acks", async () => {
+  const h = await composePreviewHarness();
+  try {
+    const before = h.posted.length;
+    h.click(h.host!.querySelector("[data-preview-di]"));
+    const nav = h.posted.slice(before).find((p) => p.data.type === "nano-navigate");
+    assert(nav, "Preview DI must post nano-navigate up to the console");
+    assertEquals(nav!.data.target, "definitionPreview", "the nano-navigate targets the definitionPreview view");
+    const s = h.status();
+    assert(s && !s.textContent!.includes(CHECK), "Preview DI must NOT render a ✓ 'Opening…' toast synchronously (the #645 defect)");
+    assert(s && !/status-ok/.test(s.className), "the pre-ack Preview status must not carry the success (ok) tone");
+  } finally {
+    h.teardown();
+  }
+});
+
+test("#645: 'Preview generated DI' renders ✓ Opened only once the host acks the nano-navigate", async () => {
+  const h = await composePreviewHarness();
+  try {
+    h.click(h.host!.querySelector("[data-preview-di]"));
+    assert(!h.status()!.textContent!.includes(CHECK), "no success before the host ack");
+    h.emitFromParent({ type: NANO_NAVIGATE_ACK_MESSAGE, target: "definitionPreview" });
+    const s = h.status();
+    assert(s!.textContent!.includes(CHECK) && /Opened/.test(s!.textContent!), "on host ack Preview DI renders the ✓ Opened toast");
+    assert(/status-ok/.test(s!.className), "the acked Preview status carries the success tone");
+  } finally {
+    h.teardown();
+  }
+});
+
+test("#645: 'Preview generated DI' ignores a target-less nav ack — no forged ✓ Opened", async () => {
+  const h = await composePreviewHarness();
+  try {
+    h.click(h.host!.querySelector("[data-preview-di]"));
+    // An ack that omits `target` (or names a different one) could be any unrelated same-origin parent
+    // ack — it must NOT resolve the pending Preview (else the #645 false-positive toast returns).
+    h.emitFromParent({ type: NANO_NAVIGATE_ACK_MESSAGE });
+    assert(!h.status()!.textContent!.includes(CHECK), "a target-less nav ack must not satisfy the Preview");
+    h.emitFromParent({ type: NANO_NAVIGATE_ACK_MESSAGE, target: "someOtherView" });
+    assert(!h.status()!.textContent!.includes(CHECK), "an ack for a different target must not satisfy the Preview");
+    // The real ack (matching target) still earns the success toast.
+    h.emitFromParent({ type: NANO_NAVIGATE_ACK_MESSAGE, target: "definitionPreview" });
+    assert(h.status()!.textContent!.includes(CHECK), "the matching-target ack still resolves the Preview");
+  } finally {
+    h.teardown();
+  }
+});
+
+test("#645: 'Preview generated DI' surfaces an honest error when the host never acks (short timeout)", async () => {
+  const h = await composePreviewHarness();
+  try {
+    h.click(h.host!.querySelector("[data-preview-di]"));
+    assert(!h.status()!.textContent!.includes(CHECK), "no success before the timeout");
+    await wait(80); // > ackTimeoutMs (40)
+    const s = h.status();
+    assert(s && /Couldn't reach the console explorer/.test(s.textContent!), "on timeout Preview DI surfaces 'Couldn't reach the console explorer'");
+    assert(!s!.textContent!.includes(CHECK) && /status-err/.test(s!.className), "the timed-out Preview is an error, never a ✓ success");
+  } finally {
+    h.teardown();
+  }
+});

package/test/delivery-graphs-library-embed.test.ts

@@ -71,7 +71,7 @@ test("#523: Reuse drives the compose fill seam over the shared host-bridge messa
   // Reuse loads the saved graph back into the SEPARATE compose App-View, so it posts the ONE shared
   // fill message (its type imported from ./mount.js, never re-declared) UP over the App-View boundary.
   assert(
-    /import \{ DG_COMPOSE_FILL_MESSAGE \} from "\.\/mount\.js"/.test(LIBRARY_JS),
+    /import \{[^}]*\bDG_COMPOSE_FILL_MESSAGE\b[^}]*\} from "\.\/mount\.js"/.test(LIBRARY_JS),
     "library.mount.js must import DG_COMPOSE_FILL_MESSAGE from ./mount.js (the ONE source of truth for the fill message type)",
   );
   assert(/data-reuse=/.test(LIBRARY_JS), "library.mount.js must render a per-row Reuse affordance carrying the entry id");

package/workers/record-feature-implementing/worker.test.ts

@@ -0,0 +1,57 @@
+// Unit coverage for pr.record-feature-implementing (issue #642) — the twin of
+// `record-feature-escalation`. It runs on BOTH edges into `implement-task` (first entry + answer
+// re-entry) and must flip the run to the non-terminal `running` status so `escalated` holds ONLY
+// while parked on the native `feature-escalation` user task. Without it, the answer loop-back left
+// `feature_runs.status` a stale `escalated` through the whole re-implementation (the #632 tear).
+import { test } from "node:test";
+import { assertEquals } from "#test-assert";
+import { noopLog } from "../../test/log.ts";
+import handler from "./worker.ts";
+
+// biome-ignore lint/suspicious/noExplicitAny: tiny in-memory app double, mirrors record-feature-escalation.worker.test
+function fakeApp(rows: Record<string, unknown>[]): any {
+  const stores: Record<string, Record<string, unknown>[]> = { feature_runs: rows };
+  return {
+    stores,
+    data: {
+      table(name: string, key: string) {
+        const store = (stores[name] ??= []);
+        return {
+          // biome-ignore lint/suspicious/noExplicitAny: test double
+          get: (k: any) => Promise.resolve(store.find((r) => r[key] === k)),
+          // biome-ignore lint/suspicious/noExplicitAny: test double
+          update: (k: any, patch: any) => {
+            const row = store.find((r) => r[key] === k);
+            if (row) Object.assign(row, patch);
+            return Promise.resolve(row);
+          },
+        };
+      },
+    },
+    log: noopLog(),
+  };
+}
+
+test("record-feature-implementing: resets an escalated run back to running on the answer re-entry", async () => {
+  // The answer loop-back routes through this task before re-dispatching implement-task; it must clear
+  // the stale `escalated` the run parked on so the Overview no longer reads it as escalated while it
+  // re-implements (issue #642 — the #632 tear).
+  const rows = [{ feature_key: "owner/repo#7", status: "escalated", updated_at: "2025-01-01T00:00:00.000Z" }];
+  const app = fakeApp(rows);
+  const out = await handler({ jobKey: "job-1", variables: { featureKey: "owner/repo#7" } } as never, app);
+  assertEquals(out, {});
+  assertEquals(rows[0].status, "running");
+  assertEquals(rows[0].updated_at !== "2025-01-01T00:00:00.000Z", true, "updated_at was refreshed");
+});
+
+test("record-feature-implementing: a confirming write on the first entry (already running) keeps status running and still refreshes updated_at", async () => {
+  // On `f_toImplement` (first entry) the row is already `running` from dispatch — re-stamping is a
+  // harmless idempotent confirming write for the STATUS (a retried at-least-once job never regresses it),
+  // but the worker still refreshes `updated_at` on every invocation, so assert that timestamp write too
+  // (a future refactor must not silently stop stamping it — the self-heal grace window keys on it).
+  const rows = [{ feature_key: "owner/repo#8", status: "running", updated_at: "2025-01-01T00:00:00.000Z" }];
+  const app = fakeApp(rows);
+  await handler({ jobKey: "job-8", variables: { featureKey: "owner/repo#8" } } as never, app);
+  assertEquals(rows[0].status, "running");
+  assertEquals(rows[0].updated_at !== "2025-01-01T00:00:00.000Z", true, "updated_at was refreshed on the confirming write");
+});

package/workers/record-feature-implementing/worker.ts

@@ -0,0 +1,31 @@
+// pr.record-feature-implementing — the twin of `record-feature-escalation` (issue #642). This
+// service task sits on BOTH edges into `implement-task`: the first entry (`f_toImplement`, off
+// `ensure-base-branch`) AND the answer re-entry (`w_answerLoop`, off the `w_gw_answer` gateway).
+// It stamps `feature_runs.status="running"` so the run is `escalated` ONLY while a token is parked
+// on the native `feature-escalation` user task — honouring the invariant `record-feature-escalation`
+// (the sole `escalated` writer) would otherwise violate on the answer loop-back: it had no symmetric
+// reset, so `status` stayed a stale `escalated` through the ENTIRE post-answer re-implementation
+// (the #632 tear). Parity with the PR `status="escalated"` contract, which holds only while parked.
+//
+// Idempotent-safe: re-stamping `running` is a no-op FOR THE STATUS, so the at-least-once job can retry
+// freely; it does still refresh `updated_at` on every invocation (a confirming timestamp write), and
+// stamping `running` on the very first entry (when the row is already `running` from dispatch) is a
+// harmless confirming write.
+import type { AppJobHandler } from "@nanobpm/urban";
+import { featureRuns } from "../../app/feature.ts";
+import type { WorkerInputs } from "../../nano-generated/worker-io.d.ts";
+
+// Input typed off the model data envelope (`RecordFeatureImplementingIn` in feature.bpmn) — ADR 0040.
+type In = WorkerInputs["pr.record-feature-implementing"];
+
+const handler: AppJobHandler<In> = async (job, app) => {
+  const featureKey = job.variables.featureKey;
+  await featureRuns(app.data).update(featureKey, {
+    status: "running",
+    updated_at: new Date().toISOString(),
+  });
+  app.log.info("record-feature-implementing", { featureKey });
+  return {};
+};
+
+export default handler;

package/workers/record-results/worker.test.ts

@@ -78,9 +78,11 @@ test("no opened PRs (empty plan) hard-fails with NO_WORK_DISPATCHED", async () =
   const plan = app._plans.at(-1) as Record<string, unknown>;
   assertEquals(plan.status, "failed");
   assertEquals(plan.outcome, "no work dispatched — the planner produced no tasks");
-  // `list_bucket` is derived by the `plan_read_model` VIEW (074): a failed epic reads as History
-  // (no tick-off needed). Cross-checked against the pure `deriveEpicBucket` oracle the VIEW mirrors.
-  assertEquals(deriveEpicBucket(plan.status as string, null, plan.acknowledged_at as string | null), "history");
+  // `list_bucket` is derived by the `plan_read_model` VIEW: under the uniform acknowledge-to-dismiss
+  // rule (issue #641) a terminal-but-UNACKNOWLEDGED epic — including a `failed` one — STAYS in Active
+  // (offering the operator a Dismiss) until it is acknowledged, rather than vanishing straight to
+  // History. Cross-checked against the pure `deriveEpicBucket` oracle the VIEW mirrors.
+  assertEquals(deriveEpicBucket(plan.status as string, null, plan.acknowledged_at as string | null), "active");
 });
 
 test("tasks present but none opened (all skipped/blocked) hard-fails", async () => {