@nanobpm/nano-workforce 0.167.0 → 0.167.2

package/.github/workflows/mirror-install-dispatch.yml

@@ -0,0 +1,54 @@
+# Refresh the mirrored install script on nanobpm.io the moment install.sh changes.
+#
+# https://nanobpm.io/install.sh is served as the ACTUAL bytes of THIS repo's
+# install.sh (GitHub Pages can't 301-redirect a `curl … | sh` URL). The site is
+# built in a DIFFERENT repo (Magikcraft/nano-bpm) whose Pages workflow re-fetches
+# install.sh on every deploy — but that deploy only triggers on changes to files
+# in that repo, so an edit here would otherwise not reach the published mirror
+# until the nightly backstop cron. This job pokes that repo's Pages deploy via a
+# `repository_dispatch` (event type `install-sh-updated`) so the mirror refreshes
+# within minutes of merging an install.sh change.
+#
+# Requires a token that can write to Magikcraft/nano-bpm — the default
+# GITHUB_TOKEN is scoped to THIS repo only. Store a fine-grained PAT (or GitHub
+# App token) with `Contents: read and write` on Magikcraft/nano-bpm as the repo
+# secret PAGES_DISPATCH_TOKEN. Absent the secret, the job no-ops (the nightly
+# cron on the site keeps the mirror eventually-consistent).
+name: Refresh nanobpm.io install mirror
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'install.sh'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  dispatch:
+    name: dispatch install-sh-updated
+    runs-on: ubuntu-latest
+    steps:
+      - name: Notify the nanobpm.io Pages deploy
+        env:
+          DISPATCH_TOKEN: ${{ secrets.PAGES_DISPATCH_TOKEN }}
+        run: |
+          set -eu
+          if [ -z "${DISPATCH_TOKEN:-}" ]; then
+            echo "::warning::PAGES_DISPATCH_TOKEN is not set — skipping. nanobpm.io/install.sh will refresh on its nightly cron instead."
+            exit 0
+          fi
+          code=$(curl -sS -o /dev/null -w '%{http_code}' \
+            -X POST \
+            -H 'Accept: application/vnd.github+json' \
+            -H "Authorization: Bearer ${DISPATCH_TOKEN}" \
+            -H 'X-GitHub-Api-Version: 2022-11-28' \
+            https://api.github.com/repos/Magikcraft/nano-bpm/dispatches \
+            -d '{"event_type":"install-sh-updated"}')
+          if [ "$code" != "204" ]; then
+            echo "::error::repository_dispatch to Magikcraft/nano-bpm returned HTTP ${code} (expected 204). Check PAGES_DISPATCH_TOKEN scope (fine-grained PAT: Contents: read & write)."
+            exit 1
+          fi
+          echo "dispatched install-sh-updated to Magikcraft/nano-bpm (HTTP 204)"

package/CHANGELOG.md

@@ -1,3 +1,16 @@
+## [0.167.2](https://github.com/nanobpm/nano-workforce/compare/v0.167.1...v0.167.2) (2026-08-31)
+
+### Bug Fixes
+
+* gate acknowledgePr on the read model's folded status, not the base column ([#653](https://github.com/nanobpm/nano-workforce/issues/653)) ([80446e2](https://github.com/nanobpm/nano-workforce/commit/80446e24af3c62570c041a109eef85eb34f8bb23)), closes [#652](https://github.com/nanobpm/nano-workforce/issues/652)
+
+## [0.167.1](https://github.com/nanobpm/nano-workforce/compare/v0.167.0...v0.167.1) (2026-08-31)
+
+### Bug Fixes
+
+* **delivery-graphs:** honest Preview & Reuse toasts (drop optimistic ✓, ack-or-timeout, bump @nanobpm/urban) ([#645](https://github.com/nanobpm/nano-workforce/issues/645)) ([#650](https://github.com/nanobpm/nano-workforce/issues/650)) ([b9cd357](https://github.com/nanobpm/nano-workforce/commit/b9cd357335fc555224bb35c5043b5d5df9cc273d)), closes [#518](https://github.com/nanobpm/nano-workforce/issues/518) [#518](https://github.com/nanobpm/nano-workforce/issues/518)
+* **feature:** reset status to running on answer re-entry to implement-task ([#642](https://github.com/nanobpm/nano-workforce/issues/642)) ([#647](https://github.com/nanobpm/nano-workforce/issues/647)) ([fd636ba](https://github.com/nanobpm/nano-workforce/commit/fd636ba482562269ab64a242c5f29d5c4b1e2020)), closes [#632](https://github.com/nanobpm/nano-workforce/issues/632)
+
 ## [0.167.0](https://github.com/nanobpm/nano-workforce/compare/v0.166.0...v0.167.0) (2026-08-31)
 
 ### Features

package/app/contracts.ts

@@ -420,7 +420,23 @@ export const WIRE_CONTRACTS = {
     owner: "pages/delivery-graphs/mount.js",
     semantics:
       "The INBOUND reuse-fill host-bridge message that loads a saved `DeliveryGraph` JSON into the Delivery Graphs COMPOSE App-View textarea (`#dg-json`) — issue #523, epic #519 S4. The compose mount (consumer) registers a same-origin `window` `message` listener for this shape and routes it through its single `fillComposer()` seam; the producer is the Library App-View **Reuse** action (#523), which posts it across the App-View iframe boundary (the INBOUND twin of the existing OUTBOUND `nano-navigate` DI-preview bridge). The filesystem **Import** control (#524) is NOT a producer of this message — it lives in the same compose mount and fills directly through `fillComposer()`, no cross-frame hop. The `type` string is exported ONCE as `DG_COMPOSE_FILL_MESSAGE` from pages/delivery-graphs/mount.js — the Reuse producer imports it, never re-declares a synonym.",
-    shape: '{ type: "nano-delivery-graph-compose-fill", graphJson: string }',
+    shape: '{ type: "nano-delivery-graph-compose-fill", graphJson: string, token?: string }',
+  },
+  "deliveryGraph.compose.fill.ack": {
+    category: "wire",
+    name: "deliveryGraph.compose.fill.ack",
+    owner: "pages/delivery-graphs/mount.js",
+    semantics:
+      "The ACK half of the reuse-fill host-bridge message (issue #645). The compose App-View posts it back UP to the host — relayed across to the Library sibling App-View by the Urban App-View relay (nano-ide #518) — the moment it has actually filled `#dg-json` from a `deliveryGraph.compose.fill`. It exists to make the Library's success toast EARNED, not optimistic: the Library shows \"✓ Loaded…\" ONLY on this ack (matching its correlation `token`) and a clear \"Couldn't reach the composer\" on a short timeout, closing the #645 false-positive-toast defect. Its `token` echoes the producer's fill `token` so a stale ack from a prior Reuse can't complete a newer one. The `type` string is exported ONCE as `DG_COMPOSE_FILL_ACK_MESSAGE` from pages/delivery-graphs/mount.js — the Library consumer imports it, never re-declares a synonym.",
+    shape: '{ type: "nano-delivery-graph-compose-fill-ack", token: string | null }',
+  },
+  "nano.navigate.ack": {
+    category: "wire",
+    name: "nano.navigate.ack",
+    owner: "pages/delivery-graphs/mount.js",
+    semantics:
+      "The host's acknowledgment of a `nano-navigate` (issue #645). \"Preview generated DI\" posts `nano-navigate` UP to the console (forwarded to the host explorer by the Urban App-View relay, nano-ide #518), but the host does not synchronously confirm it navigated — so the old \"✓ Opening…\" toast printed right after the post claimed success even when the message was dropped (standalone, no relay, a console that never navigated). The compose view now treats Preview as fire-to-host with a bounded budget: a NEUTRAL in-progress status, resolved to \"✓ Opened…\" ONLY on this same-origin ack from the parent for the matching `target`, or to \"Couldn't reach the console explorer\" on a short timeout. Consumed same-origin from `window.parent`; the `type` string is `NANO_NAVIGATE_ACK_MESSAGE` in pages/delivery-graphs/mount.js.",
+    shape: '{ type: "nano-navigate-ack", target: string }',
   },
   "deliveryGraph.library.import.submit": {
     category: "wire",

package/app/pollUserTasks.test.ts

@@ -675,3 +675,168 @@ test("pollUserTasks (typed-seam fallback): denormalises the engine form_key from
   const byKey = Object.fromEntries((stores.user_tasks ?? []).map((r) => [r.user_task_key, r]));
   assertEquals(byKey["ut-plan"].form_key, "form-77");
 });
+
+test("pollUserTasks (engine-first): self-heals an escalated run stranded off its parked task, sparing a genuinely parked one (issue #642)", async () => {
+  // `status="escalated"` must hold ONLY while a `feature-escalation` task is open (parity with the PR
+  // contract). A run whose instance the engine no longer reports parked (its escalation was answered,
+  // or it predates the write-side reset — the #632 tear) is reconciled to `running`; a run whose task
+  // IS still open is left escalated. The engine's open set is the authority, not the raw status column.
+  const { data, stores } = memData({
+    feature_runs: [
+      { feature_key: "o/r#632", status: "escalated", process_key: "fp-632", issue_url: null, title: "stranded", delivery_label: null },
+      { feature_key: "o/r#77", status: "escalated", process_key: "fp-77", issue_url: null, title: "still parked", delivery_label: null },
+    ],
+  });
+  const restore = stubUserTaskSearch([
+    // Only fp-77 is genuinely parked; the engine reports NO open task on fp-632.
+    { userTaskKey: "ut-parked", elementId: "feature-escalation", processInstanceKey: "fp-77", state: "CREATED" },
+  ]);
+  try {
+    await pollUserTasks(data, fakeEngine({ "fp-77": [{ userTaskKey: "ut-parked", elementId: "feature-escalation" }] }), REST);
+  } finally {
+    restore();
+  }
+
+  const byKey = Object.fromEntries((stores.feature_runs ?? []).map((r) => [r.feature_key, r]));
+  assertEquals(byKey["o/r#632"].status, "running", "the stranded escalated run is healed to running");
+  assertEquals(byKey["o/r#77"].status, "escalated", "the genuinely parked run stays escalated");
+});
+
+test("pollUserTasks (engine-first): skips the per-instance open-task RPC for an escalated run already seen parked in this pass's sweep (issue #642)", async () => {
+  // Presence in THIS pass's swept `desired` set is POSITIVE evidence the run is genuinely parked — the
+  // best-effort sweep may truncate (drop tasks) but never invents one. Re-confirming such a run with a
+  // per-instance `openUserTasks` RPC is a redundant N+1 query on every poll tick; the self-heal must skip
+  // it. Only a run NOT confirmed parked by the sweep still needs the per-instance check (unchanged).
+  const { data, stores } = memData({
+    feature_runs: [
+      { feature_key: "o/r#parked", status: "escalated", process_key: "fp-parked", issue_url: null, title: "parked", delivery_label: null },
+      { feature_key: "o/r#stranded", status: "escalated", process_key: "fp-stranded", issue_url: null, title: "stranded", delivery_label: null },
+    ],
+  });
+  const restore = stubUserTaskSearch([
+    { userTaskKey: "ut-parked", elementId: "feature-escalation", processInstanceKey: "fp-parked", state: "CREATED" },
+  ]);
+  const openUserTasksCalls: string[] = [];
+  const engine = {
+    searchUserTasks: () => Promise.resolve([]),
+    openUserTasks: (filter?: { processInstanceKey?: string }) => {
+      if (filter?.processInstanceKey) openUserTasksCalls.push(filter.processInstanceKey);
+      return Promise.resolve([]); // no instance reports an open escalation via the per-instance seam
+    },
+  } as unknown as EngineClient;
+  try {
+    await pollUserTasks(data, engine, REST);
+  } finally {
+    restore();
+  }
+  const byKey = Object.fromEntries((stores.feature_runs ?? []).map((r) => [r.feature_key, r]));
+  assertEquals(byKey["o/r#parked"].status, "escalated", "the swept-parked run stays escalated without a per-instance query");
+  assertEquals(byKey["o/r#stranded"].status, "running", "the run absent from the sweep is still confirmed per-instance and healed");
+  assertEquals(openUserTasksCalls.includes("fp-parked"), false, "no redundant per-instance RPC for the already-parked run");
+  assertEquals(openUserTasksCalls.includes("fp-stranded"), true, "the unconfirmed run still needs the per-instance RPC");
+});
+
+test("pollUserTasks (engine-first): a TRUNCATED best-effort sweep never heals a genuinely-parked escalated run (issue #642)", async () => {
+  // `sweepOpenEscalationTasks` is explicitly best-effort — it BREAKS early on a paging/transport error
+  // and projects only what it had gathered. Healing `escalated -> running` on ABSENCE from that partial
+  // set is mutating durable state on negative evidence: a genuinely-parked human escalation whose task
+  // lived on an unreached page would be silently stolen. The self-heal must confirm per-instance against
+  // the engine's authoritative open set, NOT the (possibly truncated) global sweep.
+  const { data, stores } = memData({
+    feature_runs: [
+      { feature_key: "o/r#parked", status: "escalated", process_key: "fp-parked", issue_url: null, title: "genuinely parked", delivery_label: null },
+      { feature_key: "o/r#stranded", status: "escalated", process_key: "fp-stranded", issue_url: null, title: "stranded", delivery_label: null },
+    ],
+  });
+  // Page 1 fills the limit (forcing a second page) with unrelated open escalations; page 2 — which WOULD
+  // carry fp-parked's escalation — errors, so the sweep truncates and `desired` never sees fp-parked.
+  const page1: RawTask[] = Array.from({ length: 100 }, (_, i) => ({
+    userTaskKey: `other-${i}`,
+    elementId: "feature-escalation",
+    processInstanceKey: `other-${i}`,
+    state: "CREATED",
+  }));
+  const orig = globalThis.fetch;
+  // biome-ignore lint/suspicious/noExplicitAny: minimal fetch double for the raw-REST search surface
+  globalThis.fetch = (async (url: string | URL, init?: any) => {
+    if (!String(url).endsWith("/user-tasks/search")) return new Response("not found", { status: 404 });
+    const from: number = JSON.parse(init?.body ?? "{}")?.page?.from ?? 0;
+    if (from === 0) {
+      return new Response(JSON.stringify({ items: page1 }), { status: 200, headers: { "content-type": "application/json" } });
+    }
+    return new Response("boom", { status: 500 }); // page 2 transport error -> sweep truncates here
+  }) as typeof fetch;
+  // The engine's authoritative per-instance open set: fp-parked IS parked; fp-stranded is not.
+  const engine = fakeEngine({ "fp-parked": [{ userTaskKey: "ut-parked", elementId: "feature-escalation" }] });
+  try {
+    await pollUserTasks(data, engine, REST);
+  } finally {
+    globalThis.fetch = orig;
+  }
+  const byKey = Object.fromEntries((stores.feature_runs ?? []).map((r) => [r.feature_key, r]));
+  assertEquals(byKey["o/r#parked"].status, "escalated", "a genuinely-parked run survives a truncated sweep");
+  assertEquals(byKey["o/r#stranded"].status, "running", "a truly stranded run is still healed");
+});
+
+test("pollUserTasks (engine-first): does NOT heal an escalated run when the per-instance open-task query errors (issue #642)", async () => {
+  // A per-instance query error is not proof the run is unparked — mutating on that negative evidence would
+  // again steal a parked escalation. On query error the run must be left `escalated` for a later pass.
+  const { data, stores } = memData({
+    feature_runs: [{ feature_key: "o/r#err", status: "escalated", process_key: "fp-err", issue_url: null, title: "query errors", delivery_label: null }],
+  });
+  const restore = stubUserTaskSearch([]); // empty sweep -> old code would heal on absence
+  const engine = {
+    searchUserTasks: () => Promise.resolve([]),
+    openUserTasks: (filter?: { processInstanceKey?: string }) =>
+      filter?.processInstanceKey === "fp-err" ? Promise.reject(new Error("engine down")) : Promise.resolve([]),
+  } as unknown as EngineClient;
+  try {
+    await pollUserTasks(data, engine, REST);
+  } finally {
+    restore();
+  }
+  const byKey = Object.fromEntries((stores.feature_runs ?? []).map((r) => [r.feature_key, r]));
+  assertEquals(byKey["o/r#err"].status, "escalated", "a failed per-instance query leaves the run escalated");
+});
+
+test("pollUserTasks (engine-first): does NOT heal a JUST-escalated run inside the grace window before its user task exists (issue #642)", async () => {
+  // `record-feature-escalation` writes `status="escalated"` (stamping `updated_at`) on the `escalated`
+  // arm IMMEDIATELY BEFORE the engine creates the `feature-escalation` user task. A poll landing in that
+  // window sees `openUserTasks` return none and would wrongly flip the fresh escalation back to `running`,
+  // making the just-raised escalation invisible. A short grace window on `updated_at` spares a just-written
+  // escalation while still healing genuinely-stranded (old) rows.
+  const fresh = new Date().toISOString();
+  const stale = new Date(Date.now() - 60 * 60_000).toISOString(); // an hour ago — comfortably past grace
+  const { data, stores } = memData({
+    feature_runs: [
+      { feature_key: "o/r#fresh", status: "escalated", process_key: "fp-fresh", updated_at: fresh, issue_url: null, title: "just escalated", delivery_label: null },
+      { feature_key: "o/r#old", status: "escalated", process_key: "fp-old", updated_at: stale, issue_url: null, title: "genuinely stranded", delivery_label: null },
+    ],
+  });
+  const restore = stubUserTaskSearch([]); // engine reports no open escalation task for either instance
+  const engine = fakeEngine({}); // openUserTasks returns [] for every instance (task not yet created / gone)
+  try {
+    await pollUserTasks(data, engine, REST);
+  } finally {
+    restore();
+  }
+  const byKey = Object.fromEntries((stores.feature_runs ?? []).map((r) => [r.feature_key, r]));
+  assertEquals(byKey["o/r#fresh"].status, "escalated", "a just-escalated run inside the grace window is spared the heal");
+  assertEquals(byKey["o/r#old"].status, "running", "a genuinely-stranded (old) run is still healed");
+});
+
+test("pollUserTasks (typed-seam fallback): self-heals an escalated run with no open feature-escalation task (issue #642)", async () => {
+  // The reduced-capability path scans FEATURE_ACTIVE_STATUSES instances (incl. `escalated`) directly,
+  // so the per-instance open-task read is just as authoritative for the self-heal.
+  const { data, stores } = memData({
+    feature_runs: [
+      { feature_key: "o/r#632", status: "escalated", process_key: "fp-632", issue_url: null, title: "stranded", delivery_label: null },
+    ],
+  });
+  const engine = fakeEngine({ "fp-632": [] }); // instance active at implement-task, no open user task
+
+  await pollUserTasks(data, engine); // no engineRest → typed-seam fallback
+
+  const byKey = Object.fromEntries((stores.feature_runs ?? []).map((r) => [r.feature_key, r]));
+  assertEquals(byKey["o/r#632"].status, "running", "the stranded escalated run is healed to running");
+});

package/app/pullRequestReadModel.ts

@@ -22,6 +22,11 @@
 import { defineReadModel, type Expr, type ReadModel } from "@nanobpm/urban";
 import { deriveAckOpenExpr, deriveListBucketExpr } from "./listBucket.ts";
 
+/** The read model's VIEW name — the single source of truth for the table an operation queries when it
+ * must gate on the folded/effective status (e.g. `acknowledgePr`, issue #652) rather than re-derive
+ * terminality off the frozen base `pull_requests.status` column. */
+export const PULL_REQUEST_READ_MODEL_NAME = "pull_requests_read_model";
+
 /** The base table the read model reads: the auto-provisioned `pull_requests__tracking` derived VIEW
  * (ADR-0065), NOT the raw `pull_requests` table — so the status-classifying derivations read the
  * terminal-folded `derived_status` and a terminated PR drops to History with no worker write. */
@@ -66,7 +71,7 @@ export type PullRequestReadModelDerivedColumn = (typeof PULL_REQUEST_READ_MODEL_
  * generated from THIS single declaration.
  */
 export const pullRequestReadModel: ReadModel = defineReadModel({
-  name: "pull_requests_read_model",
+  name: PULL_REQUEST_READ_MODEL_NAME,
   baseTable: PULL_REQUEST_READ_MODEL_BASE_TABLE,
   selectBaseColumns: false,
   derive: {

package/app/service.ts

@@ -198,6 +198,15 @@ export const MERGEABLE_WAIT_TIMEOUT = mergeableWaitTimeout(
  * to one attempt per window. Set via `NANO_PR_REVIEW_NUDGE_MINUTES` (minutes). */
 export const REVIEW_NUDGE_MS = clampNudgeMinutes(process.env.NANO_PR_REVIEW_NUDGE_MINUTES) * 60_000;
 
+/** Grace window (ms) before the `escalated`→`running` self-heal (below) may act on a row. The sole
+ * writer of `status="escalated"` — `record-feature-escalation` — runs on the `escalated` arm and stamps
+ * `updated_at` IMMEDIATELY BEFORE the engine creates the `feature-escalation` user task. A poll landing
+ * in that window would see `openUserTasks` report none and wrongly heal the just-raised escalation back
+ * to `running`, hiding it until a future write. Only heal rows whose escalation is older than this
+ * window, by when the user task must already be observable — sparing the in-flight transition while
+ * still reconciling genuinely-stranded rows. */
+export const FEATURE_ESCALATION_HEAL_GRACE_MS = 60_000;
+
 /** Whether a converged PR is automatically driven to merge (the merge-loop). Default on; set
  * `NANO_PR_AUTO_MERGE=0` to stop at `converged` (review-only mode). */
 export const AUTO_MERGE = !["0", "false", "off", "no"].includes(
@@ -2677,6 +2686,49 @@ export async function pollUserTasks(
     await userTasks(data).update(user_task_key, { ...patch, updated_at: at });
   }
   for (const key of deletes) await userTasks(data).delete(key);
+
+  // ── Self-heal: `escalated` holds ONLY while parked (issue #642) ──────────────────────────────────
+  // `record-feature-escalation` is the sole writer of `status="escalated"`, but the answer loop-back
+  // now stamps `running` (via `record-feature-implementing`). This read-side sweep heals any row that
+  // is ALREADY stranded at `escalated` — e.g. runs that escalated before the write-side twin shipped
+  // (#632), or any future missed transition — by reconciling against the ENGINE's authoritative
+  // open-escalation set. But it must NOT decide on absence from THIS pass's `desired` set:
+  // `sweepOpenEscalationTasks` is best-effort and breaks early on a paging/transport error, so a
+  // truncated `desired` would wrongly flip a genuinely-parked run whose task lived on an unreached page.
+  // Confirm each escalated run POSITIVELY, per-instance, against `openUserTasks` (which pins
+  // `state:"CREATED"`), and skip healing when that query errors — durable state is mutated only on
+  // positive evidence that no `feature-escalation` task is open for the instance (parity with the PR
+  // `status="escalated"` contract). Confined to rows with a known `process_key` so an untracked instance
+  // is never guessed at.
+  //
+  // Presence in THIS pass's `desired` set is itself POSITIVE evidence of parking (truncation only ever
+  // DROPS tasks, never invents one), so a run whose `feature-escalation` task was already swept is
+  // genuinely parked — skip its per-instance `openUserTasks` RPC entirely (an avoidable N+1 on every
+  // tick). Only a run NOT confirmed parked by the sweep falls through to the per-instance check below.
+  const sweptParkedEscalations = new Set(
+    desired.filter((r) => r.element_id === FEATURE_ESCALATION_ELEMENT && r.process_key).map((r) => r.process_key),
+  );
+  for (const run of await featureRuns(data).find({ status: "escalated" })) {
+    if (!run.process_key) continue;
+    if (sweptParkedEscalations.has(run.process_key)) continue; // already seen parked this pass — no RPC, no heal
+    // A just-written escalation may not have its `feature-escalation` user task yet: the sole writer,
+    // `record-feature-escalation`, stamps `updated_at` immediately BEFORE the engine creates the task.
+    // Skip healing inside the grace window so this pass never races that transition and steals a fresh
+    // escalation; a genuinely-stranded (old, or timestamp-less) row is past the window and still healed.
+    const escalatedAt = Date.parse(run.updated_at ?? "");
+    if (Number.isFinite(escalatedAt) && Date.now() - escalatedAt < FEATURE_ESCALATION_HEAL_GRACE_MS) continue;
+    let openTasks: { elementId?: string }[];
+    try {
+      openTasks = await engine.openUserTasks({ processInstanceKey: run.process_key });
+    } catch (err) {
+      // Negative evidence from a failed query is not proof the run is unparked — leave it for a later pass.
+      console.error(`[poller] escalated-run self-heal (${run.feature_key} @ ${run.process_key}): ${err}`);
+      continue;
+    }
+    if (!openTasks.some((t) => t.elementId === FEATURE_ESCALATION_ELEMENT)) {
+      await featureRuns(data).update(run.feature_key, { status: "running", updated_at: at });
+    }
+  }
 }
 
 /** One full poll pass: advance the review stage, the merge stage, the wave-merge barrier, and

package/e2e/feature-preflight.e2e.ts

@@ -157,7 +157,8 @@ describe("single-issue feature intake readiness gate (feature.bpmn, issue #295)"
         "the green gate leads into the fan-out head",
       );
       assert.ok(
-        flows.includes("ensure-base-branch->implement-task"),
+        flows.includes("ensure-base-branch->record-feature-implementing") &&
+          flows.includes("record-feature-implementing->implement-task"),
         `the run reaches the implement agent only after the gate (flows: ${flows.join(", ")})`,
       );
       // A green probe never escalates.
@@ -189,7 +190,7 @@ describe("single-issue feature intake readiness gate (feature.bpmn, issue #295)"
       );
       assert.ok(!flows.includes("gw-readiness->readiness-preflight"), "an ungated feature never enters the preflight");
       assert.ok(
-        flows.includes("ensure-base-branch->implement-task"),
+        flows.includes("record-feature-implementing->implement-task"),
         "an ungated feature reaches the implement agent",
       );
     } finally {

package/e2e/feature-run.e2e.ts

@@ -245,8 +245,12 @@ describe("single-issue feature run (#172 — feature.bpmn)", () => {
 
         const flows = takenFlows(app);
         assert.ok(
-          flows.includes("w_gw_answer->implement-task"),
-          `answer re-dispatched the same implement task (flows: ${flows.join(", ")})`,
+          flows.includes("w_gw_answer->record-feature-implementing"),
+          `answer re-dispatched through the implementing-reset task (flows: ${flows.join(", ")})`,
+        );
+        assert.ok(
+          flows.includes("record-feature-implementing->implement-task"),
+          `the reset task re-enters the same implement task (flows: ${flows.join(", ")})`,
         );
         assert.ok(!flows.includes("w_gw_answer->record-feature"), "the abandon (default) flow was NOT taken");
         assert.equal(calls, 2, "the implementation agent was re-dispatched exactly once after the answer");
@@ -254,6 +258,56 @@ describe("single-issue feature run (#172 — feature.bpmn)", () => {
     );
   });
 
+  test("escalate + answer: the run reads `running` (not a stale escalated) through the post-answer re-implementation (issue #642)", async () => {
+    // The write-side twin of `record-feature-escalation`: `record-feature-implementing` sits on the
+    // answer loop-back and stamps `running` BEFORE implement-task re-runs, so `feature_runs.status` no
+    // longer holds a stale `escalated` for the entire re-implementation (the #632 tear). Assert the
+    // agent observes `running` at the moment it is re-dispatched. Boots inline (not `withApp`) so the
+    // re-implementation stub can read the row through `app.db`.
+    const dbDir = mkdtempSync(join(tmpdir(), "nwf-f642-"));
+    const app = await bootTestApp(APP_ROOT, { env: { NANO_APP_DB_URL: `file:${join(dbDir, "app.db")}` } });
+    try {
+      let calls = 0;
+      let statusDuringReimpl: string | undefined;
+      await app.engine.registerWorker("senior:feature", async () => {
+        calls += 1;
+        if (calls === 1) {
+          return { status: "escalated", question: "Which API should I use?", summary: "parked for a human" };
+        }
+        const run = await app.db
+          .table<FeatureRow>("feature_runs", "feature_key")
+          .findOne({ feature_key: "owner/repo#7" });
+        statusDuringReimpl = run?.status;
+        return { status: "opened", pr: "owner/repo#642", summary: "resumed and opened" };
+      });
+      const featureKey = "owner/repo#7";
+      const started = await app.api?.call("startFeature", { body: { issue: featureKey, baseBranch: "epic/e2e" } });
+      assert.equal(started?.status, 202, "startFeature accepted the issue");
+      await app.settle();
+
+      const parked = await featureRow(app, featureKey);
+      assert.equal(parked.status, "escalated", "the run parks at escalated while awaiting the answer");
+      assert.ok(parked.process_key, "the parked run carries its engine process-instance key");
+
+      const tasks = await app.engine.searchUserTasks({ processInstanceKey: parked.process_key! });
+      const task = tasks.find((t) => t.elementId === "feature-escalation") as InboxTask | undefined;
+      assert.ok(task?.userTaskKey, "the feature escalation parked a completable native user task");
+
+      await app.engine.completeUserTask(task!.userTaskKey, { resolution: "answer", answer: "use v2" });
+      await app.settle();
+
+      assert.equal(
+        statusDuringReimpl,
+        "running",
+        "the reset task stamped `running` before implement-task re-ran — no stale escalated",
+      );
+      assert.equal(calls, 2, "the implementation agent was re-dispatched exactly once after the answer");
+    } finally {
+      await app.stop();
+      rmSync(dbDir, { recursive: true, force: true });
+    }
+  });
+
   test("escalate + abandon: abandoning routes to record-feature (default flow)", async () => {
     await withApp(
       {
@@ -273,7 +327,7 @@ describe("single-issue feature run (#172 — feature.bpmn)", () => {
           flows.includes("w_gw_answer->record-feature"),
           `abandon routed to record-feature (flows: ${flows.join(", ")})`,
         );
-        assert.ok(!flows.includes("w_gw_answer->implement-task"), "the answer loop was NOT taken");
+        assert.ok(!flows.includes("w_gw_answer->record-feature-implementing"), "the answer loop was NOT taken");
       },
     );
   });
@@ -322,8 +376,9 @@ describe("single-issue feature run (#172 — feature.bpmn)", () => {
 
         const flows = takenFlows(app);
         assert.ok(
-          flows.includes("w_gw_answer->implement-task"),
-          `the answer re-dispatched the same implement task (flows: ${flows.join(", ")})`,
+          flows.includes("w_gw_answer->record-feature-implementing") &&
+            flows.includes("record-feature-implementing->implement-task"),
+          `the answer re-dispatched the same implement task through the reset (flows: ${flows.join(", ")})`,
         );
         assert.equal(calls, 2, "the implementation agent was re-dispatched exactly once after the answer");
 

package/nano.app.json

@@ -235,6 +235,10 @@
     {
       "taskType": "pr.delivery-connector",
       "handler": "workers/delivery-connector/worker.ts"
+    },
+    {
+      "taskType": "pr.record-feature-implementing",
+      "handler": "workers/record-feature-implementing/worker.ts"
     }
   ],
   "externalTaskTypes": [

package/operations/acknowledgePr.test.ts

@@ -1,25 +1,45 @@
-// Tests for the POST /app/api/actions/acknowledge-pr operation `acknowledgePr` (issue #641).
+// Tests for the POST /app/api/actions/acknowledge-pr operation `acknowledgePr` (issue #641, #652).
 // The nwf UI's "Dismiss" (Done ✓) affordance for a TERMINAL pull request. It stamps `acknowledged_at`,
 // which the `pull_requests_read_model` VIEW (094) derives into `list_bucket` = 'history' and `ack_open`
 // = 0, dropping the finished PR from the Active convergence list into History. Unlike acknowledge-
 // blocked it completes NO user task (a terminal PR is not parked). The PR twin of acknowledge-done /
 // acknowledge-epic.
 //
-// The op's only write is the `acknowledged_at` (+ `updated_at`) stamp, gated on the base `status`
-// belonging to the terminal tier (`PR_TERMINAL_STATUSES`). These tests seed an in-memory `pull_requests`
-// store and assert the 400/404/409/200 gate + the stamp; the bucket derivation itself is proven in
-// app/pullRequestReadModel.test.ts.
+// The op's only write is the `acknowledged_at` (+ `updated_at`) stamp on the base `pull_requests` row,
+// gated on the TERMINAL tier (`PR_TERMINAL_STATUSES`) — but read off the `pull_requests_read_model`
+// VIEW's FOLDED/effective `status` (issue #652), the SAME source of truth the Dismiss affordance
+// (`ack_open`) derives from, NOT the frozen base column. These tests seed an in-memory read model +
+// base store and assert the 400/404/409/200 gate + the stamp; the bucket derivation itself is proven
+// in app/pullRequestReadModel.test.ts.
 import { test } from "node:test";
 import { assertEquals } from "#test-assert";
 import type { AppApi } from "@nanobpm/urban";
 import { noopLog } from "../test/log.ts";
-import { PR_TERMINAL_STATUSES } from "../app/pullRequestReadModel.ts";
+import { PR_TERMINAL_STATUSES, PULL_REQUEST_READ_MODEL_NAME } from "../app/pullRequestReadModel.ts";
 import handler from "./acknowledgePr.ts";
 
+// A read model row (folded/effective `status` the op gates on) and its base `pull_requests` row (the
+// stamp target). `derivedStatus` folds over `status` exactly as `COALESCE(pr.derived_status, pr.status)`
+// does in the 094 VIEW, so a seed can model an out-of-band-terminated PR (base `escalated`, folded
+// `abandoned`) — the #652 drift case.
+type Seed = { prKey: string; status: string; derivedStatus?: string; acknowledgedAt?: string | null };
+
 // biome-ignore lint/suspicious/noExplicitAny: test-only fake data layer over dynamic row shapes.
-function memApp(seed: any[]): { app: AppApi; rows: any[] } {
+function memApp(seeds: Seed[]): { app: AppApi; base: any[] } {
+  // biome-ignore lint/suspicious/noExplicitAny: test-only store.
+  const base: any[] = seeds.map((s) => ({
+    pr_key: s.prKey,
+    status: s.status,
+    acknowledged_at: s.acknowledgedAt ?? null,
+  }));
+  // The read model VIEW exposes the folded effective status as `status` (COALESCE(derived_status, status)).
+  // biome-ignore lint/suspicious/noExplicitAny: test-only store.
+  const readModel: any[] = seeds.map((s) => ({
+    pr_key: s.prKey,
+    status: s.derivedStatus ?? s.status,
+  }));
   // biome-ignore lint/suspicious/noExplicitAny: test-only store.
-  const stores: Record<string, any[]> = { pull_requests: seed };
+  const stores: Record<string, any[]> = { pull_requests: base, [PULL_REQUEST_READ_MODEL_NAME]: readModel };
   function tbl(name: string, pk = "id") {
     // biome-ignore lint/suspicious/noExplicitAny: test-only.
     const rows = (stores[name] ??= [] as any[]);
@@ -40,7 +60,7 @@ function memApp(seed: any[]): { app: AppApi; rows: any[] } {
     data: { table: (n: string, pk?: string) => tbl(n, pk) },
     log: noopLog(),
   } as unknown as AppApi;
-  return { app, rows: stores.pull_requests };
+  return { app, base };
 }
 
 async function call(app: AppApi, body: unknown) {
@@ -49,29 +69,54 @@ async function call(app: AppApi, body: unknown) {
 }
 
 test("acknowledge-pr: stamps acknowledged_at on a terminal PR and returns 200", async () => {
-  const { app, rows } = memApp([{ pr_key: "o/r#1", status: "merged", acknowledged_at: null }]);
+  const { app, base } = memApp([{ prKey: "o/r#1", status: "merged" }]);
   const res = await call(app, { pr_key: "o/r#1" });
   assertEquals(res.status, 200);
   assertEquals(res.body.ok, true);
-  assertEquals(typeof rows[0].acknowledged_at, "string");
-  assertEquals(typeof rows[0].updated_at, "string");
+  assertEquals(typeof base[0].acknowledged_at, "string");
+  assertEquals(typeof base[0].updated_at, "string");
 });
 
 test("acknowledge-pr: every terminal status is dismissable", async () => {
   for (const status of PR_TERMINAL_STATUSES) {
-    const { app, rows } = memApp([{ pr_key: "o/r#1", status, acknowledged_at: null }]);
+    const { app, base } = memApp([{ prKey: "o/r#1", status }]);
     const res = await call(app, { pr_key: "o/r#1" });
     assertEquals(res.status, 200, `status ${status} must be dismissable`);
-    assertEquals(typeof rows[0].acknowledged_at, "string");
+    assertEquals(typeof base[0].acknowledged_at, "string");
   }
 });
 
+// Issue #652 — the drift case. A PR terminated OUT OF BAND leaves base `status` frozen at its last
+// transient (`escalated`) while the tracking VIEW folds `derived_status` to `abandoned`, so the read
+// model reports the effective `status = abandoned` and lights `ack_open`. Gating on the base column
+// (the old bug) 409'd "pull request is not terminal" on exactly the row the UI shows Dismiss on;
+// gating on the folded read-model status accepts it.
+test("acknowledge-pr: an out-of-band-terminated PR (base escalated, folded abandoned) is dismissable (200)", async () => {
+  const { app, base } = memApp([{ prKey: "o/r#1716", status: "escalated", derivedStatus: "abandoned" }]);
+  const res = await call(app, { pr_key: "o/r#1716" });
+  assertEquals(res.status, 200);
+  assertEquals(res.body.ok, true);
+  assertEquals(typeof base[0].acknowledged_at, "string");
+  // The base row's frozen transient is NOT rewritten — only the acknowledgement is stamped; the VIEW
+  // folds it to History (list_bucket = 'history', ack_open = 0) off derived_status + acknowledged_at.
+  assertEquals(base[0].status, "escalated");
+});
+
 test("acknowledge-pr: a live (still-converging) PR is rejected (409) and stays unstamped", async () => {
-  const { app, rows } = memApp([{ pr_key: "o/r#2", status: "converging", acknowledged_at: null }]);
+  const { app, base } = memApp([{ prKey: "o/r#2", status: "converging" }]);
   const res = await call(app, { pr_key: "o/r#2" });
   assertEquals(res.status, 409);
   assertEquals(res.body.ok, false);
-  assertEquals(rows[0].acknowledged_at, null);
+  assertEquals(base[0].acknowledged_at, null);
+});
+
+// A genuinely live PR whose engine instance is still ACTIVE has `derived_status === status` (a live PR
+// has no terminal fold), so the read model reports the live transient — still not terminal → 409.
+test("acknowledge-pr: a live PR awaiting review (instance active, folded == base) is rejected (409)", async () => {
+  const { app, base } = memApp([{ prKey: "o/r#3", status: "waiting_review", derivedStatus: "waiting_review" }]);
+  const res = await call(app, { pr_key: "o/r#3" });
+  assertEquals(res.status, 409);
+  assertEquals(base[0].acknowledged_at, null);
 });
 
 test("acknowledge-pr: a missing pr_key → 400", async () => {
@@ -86,9 +131,9 @@ test("acknowledge-pr: no matching PR → 404", async () => {
 });
 
 test("acknowledge-pr: idempotent — re-acknowledging a terminal PR re-stamps and returns 200", async () => {
-  const { app, rows } = memApp([{ pr_key: "o/r#5", status: "converged", acknowledged_at: null }]);
+  const { app, base } = memApp([{ prKey: "o/r#5", status: "converged" }]);
   assertEquals((await call(app, { pr_key: "o/r#5" })).status, 200);
-  assertEquals(typeof rows[0].acknowledged_at, "string");
+  assertEquals(typeof base[0].acknowledged_at, "string");
   assertEquals((await call(app, { pr_key: "o/r#5" })).status, 200);
-  assertEquals(typeof rows[0].acknowledged_at, "string");
+  assertEquals(typeof base[0].acknowledged_at, "string");
 });