@nanobpm/nano-workforce 0.167.0 → 0.167.1

package/.github/workflows/mirror-install-dispatch.yml

@@ -0,0 +1,54 @@
+# Refresh the mirrored install script on nanobpm.io the moment install.sh changes.
+#
+# https://nanobpm.io/install.sh is served as the ACTUAL bytes of THIS repo's
+# install.sh (GitHub Pages can't 301-redirect a `curl … | sh` URL). The site is
+# built in a DIFFERENT repo (Magikcraft/nano-bpm) whose Pages workflow re-fetches
+# install.sh on every deploy — but that deploy only triggers on changes to files
+# in that repo, so an edit here would otherwise not reach the published mirror
+# until the nightly backstop cron. This job pokes that repo's Pages deploy via a
+# `repository_dispatch` (event type `install-sh-updated`) so the mirror refreshes
+# within minutes of merging an install.sh change.
+#
+# Requires a token that can write to Magikcraft/nano-bpm — the default
+# GITHUB_TOKEN is scoped to THIS repo only. Store a fine-grained PAT (or GitHub
+# App token) with `Contents: read and write` on Magikcraft/nano-bpm as the repo
+# secret PAGES_DISPATCH_TOKEN. Absent the secret, the job no-ops (the nightly
+# cron on the site keeps the mirror eventually-consistent).
+name: Refresh nanobpm.io install mirror
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'install.sh'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  dispatch:
+    name: dispatch install-sh-updated
+    runs-on: ubuntu-latest
+    steps:
+      - name: Notify the nanobpm.io Pages deploy
+        env:
+          DISPATCH_TOKEN: ${{ secrets.PAGES_DISPATCH_TOKEN }}
+        run: |
+          set -eu
+          if [ -z "${DISPATCH_TOKEN:-}" ]; then
+            echo "::warning::PAGES_DISPATCH_TOKEN is not set — skipping. nanobpm.io/install.sh will refresh on its nightly cron instead."
+            exit 0
+          fi
+          code=$(curl -sS -o /dev/null -w '%{http_code}' \
+            -X POST \
+            -H 'Accept: application/vnd.github+json' \
+            -H "Authorization: Bearer ${DISPATCH_TOKEN}" \
+            -H 'X-GitHub-Api-Version: 2022-11-28' \
+            https://api.github.com/repos/Magikcraft/nano-bpm/dispatches \
+            -d '{"event_type":"install-sh-updated"}')
+          if [ "$code" != "204" ]; then
+            echo "::error::repository_dispatch to Magikcraft/nano-bpm returned HTTP ${code} (expected 204). Check PAGES_DISPATCH_TOKEN scope (fine-grained PAT: Contents: read & write)."
+            exit 1
+          fi
+          echo "dispatched install-sh-updated to Magikcraft/nano-bpm (HTTP 204)"

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+## [0.167.1](https://github.com/nanobpm/nano-workforce/compare/v0.167.0...v0.167.1) (2026-08-31)
+
+### Bug Fixes
+
+* **delivery-graphs:** honest Preview & Reuse toasts (drop optimistic ✓, ack-or-timeout, bump @nanobpm/urban) ([#645](https://github.com/nanobpm/nano-workforce/issues/645)) ([#650](https://github.com/nanobpm/nano-workforce/issues/650)) ([b9cd357](https://github.com/nanobpm/nano-workforce/commit/b9cd357335fc555224bb35c5043b5d5df9cc273d)), closes [#518](https://github.com/nanobpm/nano-workforce/issues/518) [#518](https://github.com/nanobpm/nano-workforce/issues/518)
+* **feature:** reset status to running on answer re-entry to implement-task ([#642](https://github.com/nanobpm/nano-workforce/issues/642)) ([#647](https://github.com/nanobpm/nano-workforce/issues/647)) ([fd636ba](https://github.com/nanobpm/nano-workforce/commit/fd636ba482562269ab64a242c5f29d5c4b1e2020)), closes [#632](https://github.com/nanobpm/nano-workforce/issues/632)
+
 ## [0.167.0](https://github.com/nanobpm/nano-workforce/compare/v0.166.0...v0.167.0) (2026-08-31)
 
 ### Features

package/app/contracts.ts

@@ -420,7 +420,23 @@ export const WIRE_CONTRACTS = {
     owner: "pages/delivery-graphs/mount.js",
     semantics:
       "The INBOUND reuse-fill host-bridge message that loads a saved `DeliveryGraph` JSON into the Delivery Graphs COMPOSE App-View textarea (`#dg-json`) — issue #523, epic #519 S4. The compose mount (consumer) registers a same-origin `window` `message` listener for this shape and routes it through its single `fillComposer()` seam; the producer is the Library App-View **Reuse** action (#523), which posts it across the App-View iframe boundary (the INBOUND twin of the existing OUTBOUND `nano-navigate` DI-preview bridge). The filesystem **Import** control (#524) is NOT a producer of this message — it lives in the same compose mount and fills directly through `fillComposer()`, no cross-frame hop. The `type` string is exported ONCE as `DG_COMPOSE_FILL_MESSAGE` from pages/delivery-graphs/mount.js — the Reuse producer imports it, never re-declares a synonym.",
-    shape: '{ type: "nano-delivery-graph-compose-fill", graphJson: string }',
+    shape: '{ type: "nano-delivery-graph-compose-fill", graphJson: string, token?: string }',
+  },
+  "deliveryGraph.compose.fill.ack": {
+    category: "wire",
+    name: "deliveryGraph.compose.fill.ack",
+    owner: "pages/delivery-graphs/mount.js",
+    semantics:
+      "The ACK half of the reuse-fill host-bridge message (issue #645). The compose App-View posts it back UP to the host — relayed across to the Library sibling App-View by the Urban App-View relay (nano-ide #518) — the moment it has actually filled `#dg-json` from a `deliveryGraph.compose.fill`. It exists to make the Library's success toast EARNED, not optimistic: the Library shows \"✓ Loaded…\" ONLY on this ack (matching its correlation `token`) and a clear \"Couldn't reach the composer\" on a short timeout, closing the #645 false-positive-toast defect. Its `token` echoes the producer's fill `token` so a stale ack from a prior Reuse can't complete a newer one. The `type` string is exported ONCE as `DG_COMPOSE_FILL_ACK_MESSAGE` from pages/delivery-graphs/mount.js — the Library consumer imports it, never re-declares a synonym.",
+    shape: '{ type: "nano-delivery-graph-compose-fill-ack", token: string | null }',
+  },
+  "nano.navigate.ack": {
+    category: "wire",
+    name: "nano.navigate.ack",
+    owner: "pages/delivery-graphs/mount.js",
+    semantics:
+      "The host's acknowledgment of a `nano-navigate` (issue #645). \"Preview generated DI\" posts `nano-navigate` UP to the console (forwarded to the host explorer by the Urban App-View relay, nano-ide #518), but the host does not synchronously confirm it navigated — so the old \"✓ Opening…\" toast printed right after the post claimed success even when the message was dropped (standalone, no relay, a console that never navigated). The compose view now treats Preview as fire-to-host with a bounded budget: a NEUTRAL in-progress status, resolved to \"✓ Opened…\" ONLY on this same-origin ack from the parent for the matching `target`, or to \"Couldn't reach the console explorer\" on a short timeout. Consumed same-origin from `window.parent`; the `type` string is `NANO_NAVIGATE_ACK_MESSAGE` in pages/delivery-graphs/mount.js.",
+    shape: '{ type: "nano-navigate-ack", target: string }',
   },
   "deliveryGraph.library.import.submit": {
     category: "wire",

package/app/pollUserTasks.test.ts

@@ -675,3 +675,168 @@ test("pollUserTasks (typed-seam fallback): denormalises the engine form_key from
   const byKey = Object.fromEntries((stores.user_tasks ?? []).map((r) => [r.user_task_key, r]));
   assertEquals(byKey["ut-plan"].form_key, "form-77");
 });
+
+test("pollUserTasks (engine-first): self-heals an escalated run stranded off its parked task, sparing a genuinely parked one (issue #642)", async () => {
+  // `status="escalated"` must hold ONLY while a `feature-escalation` task is open (parity with the PR
+  // contract). A run whose instance the engine no longer reports parked (its escalation was answered,
+  // or it predates the write-side reset — the #632 tear) is reconciled to `running`; a run whose task
+  // IS still open is left escalated. The engine's open set is the authority, not the raw status column.
+  const { data, stores } = memData({
+    feature_runs: [
+      { feature_key: "o/r#632", status: "escalated", process_key: "fp-632", issue_url: null, title: "stranded", delivery_label: null },
+      { feature_key: "o/r#77", status: "escalated", process_key: "fp-77", issue_url: null, title: "still parked", delivery_label: null },
+    ],
+  });
+  const restore = stubUserTaskSearch([
+    // Only fp-77 is genuinely parked; the engine reports NO open task on fp-632.
+    { userTaskKey: "ut-parked", elementId: "feature-escalation", processInstanceKey: "fp-77", state: "CREATED" },
+  ]);
+  try {
+    await pollUserTasks(data, fakeEngine({ "fp-77": [{ userTaskKey: "ut-parked", elementId: "feature-escalation" }] }), REST);
+  } finally {
+    restore();
+  }
+
+  const byKey = Object.fromEntries((stores.feature_runs ?? []).map((r) => [r.feature_key, r]));
+  assertEquals(byKey["o/r#632"].status, "running", "the stranded escalated run is healed to running");
+  assertEquals(byKey["o/r#77"].status, "escalated", "the genuinely parked run stays escalated");
+});
+
+test("pollUserTasks (engine-first): skips the per-instance open-task RPC for an escalated run already seen parked in this pass's sweep (issue #642)", async () => {
+  // Presence in THIS pass's swept `desired` set is POSITIVE evidence the run is genuinely parked — the
+  // best-effort sweep may truncate (drop tasks) but never invents one. Re-confirming such a run with a
+  // per-instance `openUserTasks` RPC is a redundant N+1 query on every poll tick; the self-heal must skip
+  // it. Only a run NOT confirmed parked by the sweep still needs the per-instance check (unchanged).
+  const { data, stores } = memData({
+    feature_runs: [
+      { feature_key: "o/r#parked", status: "escalated", process_key: "fp-parked", issue_url: null, title: "parked", delivery_label: null },
+      { feature_key: "o/r#stranded", status: "escalated", process_key: "fp-stranded", issue_url: null, title: "stranded", delivery_label: null },
+    ],
+  });
+  const restore = stubUserTaskSearch([
+    { userTaskKey: "ut-parked", elementId: "feature-escalation", processInstanceKey: "fp-parked", state: "CREATED" },
+  ]);
+  const openUserTasksCalls: string[] = [];
+  const engine = {
+    searchUserTasks: () => Promise.resolve([]),
+    openUserTasks: (filter?: { processInstanceKey?: string }) => {
+      if (filter?.processInstanceKey) openUserTasksCalls.push(filter.processInstanceKey);
+      return Promise.resolve([]); // no instance reports an open escalation via the per-instance seam
+    },
+  } as unknown as EngineClient;
+  try {
+    await pollUserTasks(data, engine, REST);
+  } finally {
+    restore();
+  }
+  const byKey = Object.fromEntries((stores.feature_runs ?? []).map((r) => [r.feature_key, r]));
+  assertEquals(byKey["o/r#parked"].status, "escalated", "the swept-parked run stays escalated without a per-instance query");
+  assertEquals(byKey["o/r#stranded"].status, "running", "the run absent from the sweep is still confirmed per-instance and healed");
+  assertEquals(openUserTasksCalls.includes("fp-parked"), false, "no redundant per-instance RPC for the already-parked run");
+  assertEquals(openUserTasksCalls.includes("fp-stranded"), true, "the unconfirmed run still needs the per-instance RPC");
+});
+
+test("pollUserTasks (engine-first): a TRUNCATED best-effort sweep never heals a genuinely-parked escalated run (issue #642)", async () => {
+  // `sweepOpenEscalationTasks` is explicitly best-effort — it BREAKS early on a paging/transport error
+  // and projects only what it had gathered. Healing `escalated -> running` on ABSENCE from that partial
+  // set is mutating durable state on negative evidence: a genuinely-parked human escalation whose task
+  // lived on an unreached page would be silently stolen. The self-heal must confirm per-instance against
+  // the engine's authoritative open set, NOT the (possibly truncated) global sweep.
+  const { data, stores } = memData({
+    feature_runs: [
+      { feature_key: "o/r#parked", status: "escalated", process_key: "fp-parked", issue_url: null, title: "genuinely parked", delivery_label: null },
+      { feature_key: "o/r#stranded", status: "escalated", process_key: "fp-stranded", issue_url: null, title: "stranded", delivery_label: null },
+    ],
+  });
+  // Page 1 fills the limit (forcing a second page) with unrelated open escalations; page 2 — which WOULD
+  // carry fp-parked's escalation — errors, so the sweep truncates and `desired` never sees fp-parked.
+  const page1: RawTask[] = Array.from({ length: 100 }, (_, i) => ({
+    userTaskKey: `other-${i}`,
+    elementId: "feature-escalation",
+    processInstanceKey: `other-${i}`,
+    state: "CREATED",
+  }));
+  const orig = globalThis.fetch;
+  // biome-ignore lint/suspicious/noExplicitAny: minimal fetch double for the raw-REST search surface
+  globalThis.fetch = (async (url: string | URL, init?: any) => {
+    if (!String(url).endsWith("/user-tasks/search")) return new Response("not found", { status: 404 });
+    const from: number = JSON.parse(init?.body ?? "{}")?.page?.from ?? 0;
+    if (from === 0) {
+      return new Response(JSON.stringify({ items: page1 }), { status: 200, headers: { "content-type": "application/json" } });
+    }
+    return new Response("boom", { status: 500 }); // page 2 transport error -> sweep truncates here
+  }) as typeof fetch;
+  // The engine's authoritative per-instance open set: fp-parked IS parked; fp-stranded is not.
+  const engine = fakeEngine({ "fp-parked": [{ userTaskKey: "ut-parked", elementId: "feature-escalation" }] });
+  try {
+    await pollUserTasks(data, engine, REST);
+  } finally {
+    globalThis.fetch = orig;
+  }
+  const byKey = Object.fromEntries((stores.feature_runs ?? []).map((r) => [r.feature_key, r]));
+  assertEquals(byKey["o/r#parked"].status, "escalated", "a genuinely-parked run survives a truncated sweep");
+  assertEquals(byKey["o/r#stranded"].status, "running", "a truly stranded run is still healed");
+});
+
+test("pollUserTasks (engine-first): does NOT heal an escalated run when the per-instance open-task query errors (issue #642)", async () => {
+  // A per-instance query error is not proof the run is unparked — mutating on that negative evidence would
+  // again steal a parked escalation. On query error the run must be left `escalated` for a later pass.
+  const { data, stores } = memData({
+    feature_runs: [{ feature_key: "o/r#err", status: "escalated", process_key: "fp-err", issue_url: null, title: "query errors", delivery_label: null }],
+  });
+  const restore = stubUserTaskSearch([]); // empty sweep -> old code would heal on absence
+  const engine = {
+    searchUserTasks: () => Promise.resolve([]),
+    openUserTasks: (filter?: { processInstanceKey?: string }) =>
+      filter?.processInstanceKey === "fp-err" ? Promise.reject(new Error("engine down")) : Promise.resolve([]),
+  } as unknown as EngineClient;
+  try {
+    await pollUserTasks(data, engine, REST);
+  } finally {
+    restore();
+  }
+  const byKey = Object.fromEntries((stores.feature_runs ?? []).map((r) => [r.feature_key, r]));
+  assertEquals(byKey["o/r#err"].status, "escalated", "a failed per-instance query leaves the run escalated");
+});
+
+test("pollUserTasks (engine-first): does NOT heal a JUST-escalated run inside the grace window before its user task exists (issue #642)", async () => {
+  // `record-feature-escalation` writes `status="escalated"` (stamping `updated_at`) on the `escalated`
+  // arm IMMEDIATELY BEFORE the engine creates the `feature-escalation` user task. A poll landing in that
+  // window sees `openUserTasks` return none and would wrongly flip the fresh escalation back to `running`,
+  // making the just-raised escalation invisible. A short grace window on `updated_at` spares a just-written
+  // escalation while still healing genuinely-stranded (old) rows.
+  const fresh = new Date().toISOString();
+  const stale = new Date(Date.now() - 60 * 60_000).toISOString(); // an hour ago — comfortably past grace
+  const { data, stores } = memData({
+    feature_runs: [
+      { feature_key: "o/r#fresh", status: "escalated", process_key: "fp-fresh", updated_at: fresh, issue_url: null, title: "just escalated", delivery_label: null },
+      { feature_key: "o/r#old", status: "escalated", process_key: "fp-old", updated_at: stale, issue_url: null, title: "genuinely stranded", delivery_label: null },
+    ],
+  });
+  const restore = stubUserTaskSearch([]); // engine reports no open escalation task for either instance
+  const engine = fakeEngine({}); // openUserTasks returns [] for every instance (task not yet created / gone)
+  try {
+    await pollUserTasks(data, engine, REST);
+  } finally {
+    restore();
+  }
+  const byKey = Object.fromEntries((stores.feature_runs ?? []).map((r) => [r.feature_key, r]));
+  assertEquals(byKey["o/r#fresh"].status, "escalated", "a just-escalated run inside the grace window is spared the heal");
+  assertEquals(byKey["o/r#old"].status, "running", "a genuinely-stranded (old) run is still healed");
+});
+
+test("pollUserTasks (typed-seam fallback): self-heals an escalated run with no open feature-escalation task (issue #642)", async () => {
+  // The reduced-capability path scans FEATURE_ACTIVE_STATUSES instances (incl. `escalated`) directly,
+  // so the per-instance open-task read is just as authoritative for the self-heal.
+  const { data, stores } = memData({
+    feature_runs: [
+      { feature_key: "o/r#632", status: "escalated", process_key: "fp-632", issue_url: null, title: "stranded", delivery_label: null },
+    ],
+  });
+  const engine = fakeEngine({ "fp-632": [] }); // instance active at implement-task, no open user task
+
+  await pollUserTasks(data, engine); // no engineRest → typed-seam fallback
+
+  const byKey = Object.fromEntries((stores.feature_runs ?? []).map((r) => [r.feature_key, r]));
+  assertEquals(byKey["o/r#632"].status, "running", "the stranded escalated run is healed to running");
+});

package/app/service.ts

@@ -198,6 +198,15 @@ export const MERGEABLE_WAIT_TIMEOUT = mergeableWaitTimeout(
  * to one attempt per window. Set via `NANO_PR_REVIEW_NUDGE_MINUTES` (minutes). */
 export const REVIEW_NUDGE_MS = clampNudgeMinutes(process.env.NANO_PR_REVIEW_NUDGE_MINUTES) * 60_000;
 
+/** Grace window (ms) before the `escalated`→`running` self-heal (below) may act on a row. The sole
+ * writer of `status="escalated"` — `record-feature-escalation` — runs on the `escalated` arm and stamps
+ * `updated_at` IMMEDIATELY BEFORE the engine creates the `feature-escalation` user task. A poll landing
+ * in that window would see `openUserTasks` report none and wrongly heal the just-raised escalation back
+ * to `running`, hiding it until a future write. Only heal rows whose escalation is older than this
+ * window, by when the user task must already be observable — sparing the in-flight transition while
+ * still reconciling genuinely-stranded rows. */
+export const FEATURE_ESCALATION_HEAL_GRACE_MS = 60_000;
+
 /** Whether a converged PR is automatically driven to merge (the merge-loop). Default on; set
  * `NANO_PR_AUTO_MERGE=0` to stop at `converged` (review-only mode). */
 export const AUTO_MERGE = !["0", "false", "off", "no"].includes(
@@ -2677,6 +2686,49 @@ export async function pollUserTasks(
     await userTasks(data).update(user_task_key, { ...patch, updated_at: at });
   }
   for (const key of deletes) await userTasks(data).delete(key);
+
+  // ── Self-heal: `escalated` holds ONLY while parked (issue #642) ──────────────────────────────────
+  // `record-feature-escalation` is the sole writer of `status="escalated"`, but the answer loop-back
+  // now stamps `running` (via `record-feature-implementing`). This read-side sweep heals any row that
+  // is ALREADY stranded at `escalated` — e.g. runs that escalated before the write-side twin shipped
+  // (#632), or any future missed transition — by reconciling against the ENGINE's authoritative
+  // open-escalation set. But it must NOT decide on absence from THIS pass's `desired` set:
+  // `sweepOpenEscalationTasks` is best-effort and breaks early on a paging/transport error, so a
+  // truncated `desired` would wrongly flip a genuinely-parked run whose task lived on an unreached page.
+  // Confirm each escalated run POSITIVELY, per-instance, against `openUserTasks` (which pins
+  // `state:"CREATED"`), and skip healing when that query errors — durable state is mutated only on
+  // positive evidence that no `feature-escalation` task is open for the instance (parity with the PR
+  // `status="escalated"` contract). Confined to rows with a known `process_key` so an untracked instance
+  // is never guessed at.
+  //
+  // Presence in THIS pass's `desired` set is itself POSITIVE evidence of parking (truncation only ever
+  // DROPS tasks, never invents one), so a run whose `feature-escalation` task was already swept is
+  // genuinely parked — skip its per-instance `openUserTasks` RPC entirely (an avoidable N+1 on every
+  // tick). Only a run NOT confirmed parked by the sweep falls through to the per-instance check below.
+  const sweptParkedEscalations = new Set(
+    desired.filter((r) => r.element_id === FEATURE_ESCALATION_ELEMENT && r.process_key).map((r) => r.process_key),
+  );
+  for (const run of await featureRuns(data).find({ status: "escalated" })) {
+    if (!run.process_key) continue;
+    if (sweptParkedEscalations.has(run.process_key)) continue; // already seen parked this pass — no RPC, no heal
+    // A just-written escalation may not have its `feature-escalation` user task yet: the sole writer,
+    // `record-feature-escalation`, stamps `updated_at` immediately BEFORE the engine creates the task.
+    // Skip healing inside the grace window so this pass never races that transition and steals a fresh
+    // escalation; a genuinely-stranded (old, or timestamp-less) row is past the window and still healed.
+    const escalatedAt = Date.parse(run.updated_at ?? "");
+    if (Number.isFinite(escalatedAt) && Date.now() - escalatedAt < FEATURE_ESCALATION_HEAL_GRACE_MS) continue;
+    let openTasks: { elementId?: string }[];
+    try {
+      openTasks = await engine.openUserTasks({ processInstanceKey: run.process_key });
+    } catch (err) {
+      // Negative evidence from a failed query is not proof the run is unparked — leave it for a later pass.
+      console.error(`[poller] escalated-run self-heal (${run.feature_key} @ ${run.process_key}): ${err}`);
+      continue;
+    }
+    if (!openTasks.some((t) => t.elementId === FEATURE_ESCALATION_ELEMENT)) {
+      await featureRuns(data).update(run.feature_key, { status: "running", updated_at: at });
+    }
+  }
 }
 
 /** One full poll pass: advance the review stage, the merge stage, the wave-merge barrier, and

package/e2e/feature-preflight.e2e.ts

@@ -157,7 +157,8 @@ describe("single-issue feature intake readiness gate (feature.bpmn, issue #295)"
         "the green gate leads into the fan-out head",
       );
       assert.ok(
-        flows.includes("ensure-base-branch->implement-task"),
+        flows.includes("ensure-base-branch->record-feature-implementing") &&
+          flows.includes("record-feature-implementing->implement-task"),
         `the run reaches the implement agent only after the gate (flows: ${flows.join(", ")})`,
       );
       // A green probe never escalates.
@@ -189,7 +190,7 @@ describe("single-issue feature intake readiness gate (feature.bpmn, issue #295)"
       );
       assert.ok(!flows.includes("gw-readiness->readiness-preflight"), "an ungated feature never enters the preflight");
       assert.ok(
-        flows.includes("ensure-base-branch->implement-task"),
+        flows.includes("record-feature-implementing->implement-task"),
         "an ungated feature reaches the implement agent",
       );
     } finally {

package/e2e/feature-run.e2e.ts

@@ -245,8 +245,12 @@ describe("single-issue feature run (#172 — feature.bpmn)", () => {
 
         const flows = takenFlows(app);
         assert.ok(
-          flows.includes("w_gw_answer->implement-task"),
-          `answer re-dispatched the same implement task (flows: ${flows.join(", ")})`,
+          flows.includes("w_gw_answer->record-feature-implementing"),
+          `answer re-dispatched through the implementing-reset task (flows: ${flows.join(", ")})`,
+        );
+        assert.ok(
+          flows.includes("record-feature-implementing->implement-task"),
+          `the reset task re-enters the same implement task (flows: ${flows.join(", ")})`,
         );
         assert.ok(!flows.includes("w_gw_answer->record-feature"), "the abandon (default) flow was NOT taken");
         assert.equal(calls, 2, "the implementation agent was re-dispatched exactly once after the answer");
@@ -254,6 +258,56 @@ describe("single-issue feature run (#172 — feature.bpmn)", () => {
     );
   });
 
+  test("escalate + answer: the run reads `running` (not a stale escalated) through the post-answer re-implementation (issue #642)", async () => {
+    // The write-side twin of `record-feature-escalation`: `record-feature-implementing` sits on the
+    // answer loop-back and stamps `running` BEFORE implement-task re-runs, so `feature_runs.status` no
+    // longer holds a stale `escalated` for the entire re-implementation (the #632 tear). Assert the
+    // agent observes `running` at the moment it is re-dispatched. Boots inline (not `withApp`) so the
+    // re-implementation stub can read the row through `app.db`.
+    const dbDir = mkdtempSync(join(tmpdir(), "nwf-f642-"));
+    const app = await bootTestApp(APP_ROOT, { env: { NANO_APP_DB_URL: `file:${join(dbDir, "app.db")}` } });
+    try {
+      let calls = 0;
+      let statusDuringReimpl: string | undefined;
+      await app.engine.registerWorker("senior:feature", async () => {
+        calls += 1;
+        if (calls === 1) {
+          return { status: "escalated", question: "Which API should I use?", summary: "parked for a human" };
+        }
+        const run = await app.db
+          .table<FeatureRow>("feature_runs", "feature_key")
+          .findOne({ feature_key: "owner/repo#7" });
+        statusDuringReimpl = run?.status;
+        return { status: "opened", pr: "owner/repo#642", summary: "resumed and opened" };
+      });
+      const featureKey = "owner/repo#7";
+      const started = await app.api?.call("startFeature", { body: { issue: featureKey, baseBranch: "epic/e2e" } });
+      assert.equal(started?.status, 202, "startFeature accepted the issue");
+      await app.settle();
+
+      const parked = await featureRow(app, featureKey);
+      assert.equal(parked.status, "escalated", "the run parks at escalated while awaiting the answer");
+      assert.ok(parked.process_key, "the parked run carries its engine process-instance key");
+
+      const tasks = await app.engine.searchUserTasks({ processInstanceKey: parked.process_key! });
+      const task = tasks.find((t) => t.elementId === "feature-escalation") as InboxTask | undefined;
+      assert.ok(task?.userTaskKey, "the feature escalation parked a completable native user task");
+
+      await app.engine.completeUserTask(task!.userTaskKey, { resolution: "answer", answer: "use v2" });
+      await app.settle();
+
+      assert.equal(
+        statusDuringReimpl,
+        "running",
+        "the reset task stamped `running` before implement-task re-ran — no stale escalated",
+      );
+      assert.equal(calls, 2, "the implementation agent was re-dispatched exactly once after the answer");
+    } finally {
+      await app.stop();
+      rmSync(dbDir, { recursive: true, force: true });
+    }
+  });
+
   test("escalate + abandon: abandoning routes to record-feature (default flow)", async () => {
     await withApp(
       {
@@ -273,7 +327,7 @@ describe("single-issue feature run (#172 — feature.bpmn)", () => {
           flows.includes("w_gw_answer->record-feature"),
           `abandon routed to record-feature (flows: ${flows.join(", ")})`,
         );
-        assert.ok(!flows.includes("w_gw_answer->implement-task"), "the answer loop was NOT taken");
+        assert.ok(!flows.includes("w_gw_answer->record-feature-implementing"), "the answer loop was NOT taken");
       },
     );
   });
@@ -322,8 +376,9 @@ describe("single-issue feature run (#172 — feature.bpmn)", () => {
 
         const flows = takenFlows(app);
         assert.ok(
-          flows.includes("w_gw_answer->implement-task"),
-          `the answer re-dispatched the same implement task (flows: ${flows.join(", ")})`,
+          flows.includes("w_gw_answer->record-feature-implementing") &&
+            flows.includes("record-feature-implementing->implement-task"),
+          `the answer re-dispatched the same implement task through the reset (flows: ${flows.join(", ")})`,
         );
         assert.equal(calls, 2, "the implementation agent was re-dispatched exactly once after the answer");
 

package/nano.app.json

@@ -235,6 +235,10 @@
     {
       "taskType": "pr.delivery-connector",
       "handler": "workers/delivery-connector/worker.ts"
+    },
+    {
+      "taskType": "pr.record-feature-implementing",
+      "handler": "workers/record-feature-implementing/worker.ts"
     }
   ],
   "externalTaskTypes": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.167.0",
+  "version": "0.167.1",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",
@@ -61,7 +61,7 @@
   },
   "dependencies": {
     "@nanobpm/agentic": "^0.4.0",
-    "@nanobpm/urban": "^0.87.0",
+    "@nanobpm/urban": "^0.88.1",
     "bpmn-auto-layout": "^2.0.0-alpha.2"
   },
   "devDependencies": {

package/pages/delivery-graphs/library.mount.js

@@ -13,7 +13,13 @@
 // standalone — only the host element and injected endpoint config differ. The app has no browser build
 // step, so this consumes the library doors straight off the wire.
 
-import { DG_COMPOSE_FILL_MESSAGE } from "./mount.js";
+import { DG_COMPOSE_FILL_ACK_MESSAGE, DG_COMPOSE_FILL_MESSAGE } from "./mount.js";
+
+// The bounded budget within which the compose App-View must ACK a Reuse fill before we surface an honest
+// "Couldn't reach the composer" error (issue #645). Mirrors the compose mount's own ACK_TIMEOUT_MS: long
+// enough for the App-View relay round-trip (nano-ide #518), short enough that a dropped fill fails fast
+// instead of leaving a misleading "✓ Loaded…" up. Overridable via config for tests.
+const REUSE_ACK_TIMEOUT_MS = 2000;
 
 // The read behind the list: every saved library entry, newest first. Anchored to THIS MODULE's url
 // (import.meta.url), NOT the document base. The library App-View shell (library-embed.html /
@@ -149,6 +155,8 @@ export function mountDeliveryGraphLibrary(host, config = {}) {
 
   const libraryUrl = config.libraryUrl ?? DEFAULT_LIBRARY_URL;
   const refreshMs = typeof config.refreshMs === "number" && config.refreshMs > 0 ? config.refreshMs : DEFAULT_REFRESH_MS;
+  const ackTimeoutMs =
+    typeof config.ackTimeoutMs === "number" && config.ackTimeoutMs > 0 ? config.ackTimeoutMs : REUSE_ACK_TIMEOUT_MS;
   const headers = (url) => ({
     "content-type": "application/json",
     ...(config.hookSecret && isSameOrigin(url) ? { "x-hook-secret": config.hookSecret } : {}),
@@ -255,7 +263,22 @@ export function mountDeliveryGraphLibrary(host, config = {}) {
   // the host bridge, posting the shared `deliveryGraph.compose.fill` message UP to the console (the
   // INBOUND twin of the outbound `nano-navigate` DI-preview bridge). Standalone (not embedded) there is
   // no console to route it and no compose view to fill, so we say so instead of failing silently.
+  //
+  // The success toast is ACKNOWLEDGED, never optimistic (issue #645): a "✓ Loaded…" printed synchronously
+  // after the post lied whenever the fill was dropped (no relay, wrong origin, an unmounted compose view).
+  // Now we show a NEUTRAL in-progress status, tag the fill with a correlation `token`, and resolve it only
+  // when the compose mount echoes `DG_COMPOSE_FILL_ACK_MESSAGE` for that token — "✓ Loaded…" on the ack,
+  // "Couldn't reach the composer" on a short timeout. A fresh Reuse supersedes any pending one.
   const isEmbedded = typeof window !== "undefined" && window.parent && window.parent !== window;
+  let pendingReuse = null;
+  function clearPendingReuse() {
+    if (pendingReuse && pendingReuse.timer) clearTimeout(pendingReuse.timer);
+    pendingReuse = null;
+  }
+  function newReuseToken() {
+    if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") return crypto.randomUUID();
+    return `reuse-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+  }
   function doReuse(id) {
     const entry = entries.find((e) => e && e.id === id);
     if (!entry) {
@@ -270,12 +293,42 @@ export function mountDeliveryGraphLibrary(host, config = {}) {
       setStatus("Open this page inside the console to reuse a saved graph in the composer.", "err");
       return;
     }
+    clearPendingReuse();
+    const token = newReuseToken();
     window.parent.postMessage(
-      { type: DG_COMPOSE_FILL_MESSAGE, graphJson: entry.graph },
+      { type: DG_COMPOSE_FILL_MESSAGE, graphJson: entry.graph, token },
       window.location.origin,
     );
+    // NEUTRAL in-progress status (no "✓") — success is only earned on the compose ack below (#645).
+    setStatus("Loading into the composer above\u2026", "");
+    const timer = setTimeout(() => {
+      if (!pendingReuse || pendingReuse.token !== token) return;
+      pendingReuse = null;
+      setStatus("Couldn't reach the composer \u2014 is the composer open above this list?", "err");
+    }, ackTimeoutMs);
+    pendingReuse = { token, timer };
+  }
+  // The compose App-View's acknowledgment that it filled (#645): a same-origin `DG_COMPOSE_FILL_ACK_MESSAGE`
+  // from the parent (the console, which relays it across from the compose sibling) whose `token` matches the
+  // pending Reuse resolves it to success. A foreign origin, a non-parent source, or a stale/mismatched token
+  // is ignored — an unrelated page (or a prior Reuse's late ack) can't forge or misattribute a success toast.
+  function onReuseAck(ev) {
+    if (!ev || typeof window === "undefined") return;
+    if (ev.origin !== window.location.origin) return;
+    if (ev.source !== window.parent) return;
+    const data = ev.data;
+    if (!data || data.type !== DG_COMPOSE_FILL_ACK_MESSAGE) return;
+    // Require a string `token` that exactly matches the pending Reuse. A null/undefined-token ack
+    // (the compose mount emits `token: null` when a fill arrives without a token) can't be correlated
+    // to this Reuse and must NOT resolve it — otherwise it reintroduces the false-positive "✓ Loaded…"
+    // toast (#645).
+    if (!pendingReuse || typeof data.token !== "string" || data.token !== pendingReuse.token) return;
+    clearPendingReuse();
     setStatus("\u2713 Loaded into the composer above \u2014 edit, Preview or Stage it.", "ok");
   }
+  if (isEmbedded && typeof window !== "undefined" && typeof window.addEventListener === "function") {
+    window.addEventListener("message", onReuseAck);
+  }
 
   // "Export": a purely client-side download of a saved entry's graph JSON as `<name>.deliverygraph.json`
   // (issue #525). No backend door — the list door already carries each entry's `graph` inline (the same
@@ -368,6 +421,10 @@ export function mountDeliveryGraphLibrary(host, config = {}) {
 
   return () => {
     disposed = true;
+    clearPendingReuse();
+    if (typeof window !== "undefined" && typeof window.removeEventListener === "function") {
+      window.removeEventListener("message", onReuseAck);
+    }
     clearInterval(timer);
     root.innerHTML = "";
   };