@nanobpm/nano-workforce 0.174.1 → 0.175.1

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## [0.175.1](https://github.com/nanobpm/nano-workforce/compare/v0.175.0...v0.175.1) (2026-09-02)
+
+### Bug Fixes
+
+* **intake:** route feature-run admission idempotency through derived_status ([#707](https://github.com/nanobpm/nano-workforce/issues/707)) ([eab2c9c](https://github.com/nanobpm/nano-workforce/commit/eab2c9ce3d4b22bad38da62170f13fda647eb21f)), closes [#503](https://github.com/nanobpm/nano-workforce/issues/503) [#503](https://github.com/nanobpm/nano-workforce/issues/503) [#503](https://github.com/nanobpm/nano-workforce/issues/503) [#704](https://github.com/nanobpm/nano-workforce/issues/704)
+
+## [0.175.0](https://github.com/nanobpm/nano-workforce/compare/v0.174.1...v0.175.0) (2026-09-02)
+
+### Features
+
+* **agentic:** engine/poller-owned relay transcript completion (retire the presence heuristic) ([#708](https://github.com/nanobpm/nano-workforce/issues/708)) ([74f42f6](https://github.com/nanobpm/nano-workforce/commit/74f42f6fa3f1b07a6608ccf50979693eecb8ead4)), closes [689/#690](https://github.com/689/nano-workforce/issues/690) [#661](https://github.com/nanobpm/nano-workforce/issues/661) [#691](https://github.com/nanobpm/nano-workforce/issues/691) [#691](https://github.com/nanobpm/nano-workforce/issues/691) [#691](https://github.com/nanobpm/nano-workforce/issues/691) [#unlink](https://github.com/nanobpm/nano-workforce/issues/unlink)
+
 ## [0.174.1](https://github.com/nanobpm/nano-workforce/compare/v0.174.0...v0.174.1) (2026-09-02)
 
 ### Bug Fixes

package/app/agentic/families/relay.family.test.ts

@@ -956,6 +956,198 @@ test("#689 mid-job reconnect: with no isInstanceLive wired, a producer disconnec
   service.teardown();
 });
 
+test("#691 engine-owned disconnect: a mid-job reconnect whose engine job is still parked keeps the correlation live", async () => {
+  const registry = new ConnectionRegistry();
+  const correlation = new CorrelationRegistry();
+  const byConnection = new Map([["conn-old", "worker-E"]]);
+  // The engine is the completion authority (#691): while the harness holds the lease the job stays
+  // parked (resolver returns an element-instance key), so a producer disconnect must NOT complete it.
+  let parked = true;
+  const resolveElementInstance = (jobKey: string) =>
+    Promise.resolve(parked && jobKey === "9001" ? "ei-9001" : undefined);
+  // isInstanceLive is deliberately NOT wired (static () => false): the engine job-state — not the
+  // presence heuristic — must be what spares the reconnect, proving presence is no longer the authority.
+  const { service, hub } = mkCorrelatedService(registry, memoryDb(), correlation, byConnection, {
+    resolveElementInstance,
+  });
+  const p = connect("conn-old", registry);
+  hub.handler?.(produce(jobStream("9001"), 1, "booting agent"), p.conn);
+  assertEquals(correlation.jobKeysFor("worker-E"), ["9001"], "the job links on first produce");
+
+  // The producer WS blips: the old connection drops (no new one yet — presence would report the
+  // instance NOT live). A frame drives #reconcile → drops the dead producer + kicks the engine reconcile.
+  registry.remove("conn-old");
+  const other = connect("cons", registry);
+  hub.handler?.(grant(0), other.conn);
+  await tick(); // let the fire-and-forget engine reconcile settle
+  assertEquals(correlation.jobKeysFor("worker-E"), ["9001"], "a still-parked job survives the disconnect");
+  assertEquals(service.transcriptOf(jobStream("9001")), undefined, "the still-active stream is NOT archived");
+  assertEquals(service.liveFallback(jobStream("9001"))?.ring !== undefined, true, "the transcript is still live");
+
+  // The worker resumes producing on a NEW connection over the same job → re-attributed, still one job.
+  byConnection.set("conn-new", "worker-E");
+  const p2 = connect("conn-new", registry);
+  hub.handler?.(produce(jobStream("9001"), 1, "resumed output"), p2.conn);
+  assertEquals(correlation.jobKeysFor("worker-E"), ["9001"], "the resumed producer stays linked to the same job");
+
+  // The job genuinely ends: the engine park vanishes. The periodic backstop pass completes + archives it.
+  parked = false;
+  await service.reconcileEngineCorrelations();
+  assertEquals(correlation.jobKeysFor("worker-E"), [], "the ended job is released");
+  assertEquals(service.transcriptOf(jobStream("9001"))?.status, "completed", "and its transcript is archived");
+  service.teardown();
+});
+
+test("#691 engine-owned disconnect: a true exit whose engine job is gone completes + archives the stream", async () => {
+  const registry = new ConnectionRegistry();
+  const correlation = new CorrelationRegistry();
+  const byConnection = new Map([["prod", "worker-X"]]);
+  // The engine reports the job GONE at disconnect time (a clean completion whose terminal lifecycle
+  // event was missed, or an unclean exit): the disconnect-driven engine reconcile completes it.
+  const resolveElementInstance = () => Promise.resolve(undefined);
+  const { service, hub } = mkCorrelatedService(registry, memoryDb(), correlation, byConnection, {
+    resolveElementInstance,
+  });
+  const p = connect("prod", registry);
+  hub.handler?.(produce(jobStream("kX"), 1, "x"), p.conn);
+  assertEquals(correlation.jobKeysFor("worker-X"), ["kX"]);
+
+  registry.remove("prod");
+  const other = connect("cons", registry);
+  hub.handler?.(grant(0), other.conn);
+  await tick(); // the fire-and-forget engine reconcile resolves "gone" → completes
+  assertEquals(correlation.jobKeysFor("worker-X"), [], "a truly-ended job is released on disconnect");
+  assertEquals(service.transcriptOf(jobStream("kX"))?.status, "completed", "and its transcript is archived");
+  service.teardown();
+});
+
+test("#691 engine-owned disconnect: an UNLINKED job stream (register/produce race) whose engine job is still parked is NOT archived on disconnect", async () => {
+  const registry = new ConnectionRegistry();
+  const correlation = new CorrelationRegistry();
+  // The connection→instance map is deliberately EMPTY at first produce: the producer's presence
+  // instance is not yet resolvable (the documented register/produce race), so #link leaves the job
+  // stream UNLINKED (`state.linked` stays false) even though it IS a job stream and a resolver is
+  // wired. The engine — not `state.linked` — must own the disconnect completion decision, otherwise
+  // a mid-job reconnect that raced the link would wrongly fall through to the presence fallback and
+  // archive a still-parked job.
+  const byConnection = new Map<string, string>();
+  let parked = true;
+  const resolveElementInstance = (jobKey: string) =>
+    Promise.resolve(parked && jobKey === "7742" ? "ei-7742" : undefined);
+  const { service, hub } = mkCorrelatedService(registry, memoryDb(), correlation, byConnection, {
+    resolveElementInstance,
+  });
+  const p = connect("conn-old", registry);
+  hub.handler?.(produce(jobStream("7742"), 1, "booting agent"), p.conn);
+  assertEquals(correlation.count(), 0, "the stream did NOT link — the instance was not resolvable at produce time");
+
+  // The old producer connection blips before a later produce could retry the link. A frame drives
+  // #reconcile → it must defer to the engine (job still parked) rather than archive on presence.
+  registry.remove("conn-old");
+  const other = connect("cons", registry);
+  hub.handler?.(grant(0), other.conn);
+  await tick(); // let the fire-and-forget engine reconcile settle
+  assertEquals(
+    service.transcriptOf(jobStream("7742")),
+    undefined,
+    "an unlinked-but-still-parked job is NOT archived on disconnect",
+  );
+  assertEquals(service.liveFallback(jobStream("7742"))?.ring !== undefined, true, "its transcript is still live");
+
+  // The worker resumes on a NEW connection; the instance now resolves → the late link finally lands.
+  byConnection.set("conn-new", "worker-R");
+  const p2 = connect("conn-new", registry);
+  hub.handler?.(produce(jobStream("7742"), 1, "resumed output"), p2.conn);
+  assertEquals(correlation.jobKeysFor("worker-R"), ["7742"], "the late link succeeds on reconnect once the instance resolves");
+
+  // The job genuinely ends: the engine park vanishes → the backstop pass completes + archives it.
+  parked = false;
+  await service.reconcileEngineCorrelations();
+  assertEquals(correlation.jobKeysFor("worker-R"), [], "the ended job is released");
+  assertEquals(service.transcriptOf(jobStream("7742"))?.status, "completed", "and its transcript is archived");
+  service.teardown();
+});
+
+test("#708 periodic backstop covers an UNLINKED job stream: an unlinked-but-parked disconnect that never reconnects is completed once the engine park ends", async () => {
+  const registry = new ConnectionRegistry();
+  const correlation = new CorrelationRegistry();
+  // Same register/produce race as #691: the connection→instance map is empty, so #link leaves the
+  // job stream UNLINKED. The producer then drops while the engine job is still parked, so the
+  // disconnect path keeps the stream live and clears `state.producer` (so #reconcile does not
+  // re-trigger). Critically the worker NEVER reconnects — no later `produce` ever links it. The
+  // periodic backstop is now the ONLY actor that can retire it, so it must include unlinked job
+  // streams in its reconcile snapshot; otherwise the stream leaks live forever once the engine job
+  // becomes terminal.
+  const byConnection = new Map<string, string>();
+  let parked = true;
+  const resolveElementInstance = (jobKey: string) =>
+    Promise.resolve(parked && jobKey === "7708" ? "ei-7708" : undefined);
+  const { service, hub } = mkCorrelatedService(registry, memoryDb(), correlation, byConnection, {
+    resolveElementInstance,
+  });
+  const p = connect("conn-old", registry);
+  hub.handler?.(produce(jobStream("7708"), 1, "booting agent"), p.conn);
+  assertEquals(correlation.count(), 0, "the stream did NOT link — the instance was not resolvable at produce time");
+
+  // Producer blips; the disconnect engine-reconcile keeps the still-parked stream live and clears
+  // the producer so #reconcile will not revisit it on later frames.
+  registry.remove("conn-old");
+  const other = connect("cons", registry);
+  hub.handler?.(grant(0), other.conn);
+  await tick();
+  assertEquals(
+    service.transcriptOf(jobStream("7708")),
+    undefined,
+    "an unlinked-but-still-parked job is NOT archived on disconnect",
+  );
+
+  // The engine job genuinely ends. With NO reconnect to link it, only the periodic backstop can
+  // retire it — and it must, even though the stream is unlinked.
+  parked = false;
+  await service.reconcileEngineCorrelations();
+  assertEquals(
+    service.transcriptOf(jobStream("7708"))?.status,
+    "completed",
+    "the periodic backstop completes an unlinked job stream once the engine park disappears",
+  );
+  assertEquals(service.liveFallback(jobStream("7708")), undefined, "and its live ring is retired");
+  service.teardown();
+});
+
+test("#691 engine-owned disconnect: a transient engine read at disconnect never falsely completes; the backstop retries", async () => {
+  const registry = new ConnectionRegistry();
+  const correlation = new CorrelationRegistry();
+  const byConnection = new Map([["prod", "worker-T"]]);
+  // The disconnect-time engine read throws (unavailable). A transient fault must be treated as
+  // "unknown — keep it linked", NEVER as "job gone": the stream stays live until a later pass resolves.
+  let failing = true;
+  let gone = false;
+  const resolveElementInstance = () => {
+    if (failing) return Promise.reject(new Error("engine unavailable"));
+    return Promise.resolve(gone ? undefined : "ei-T");
+  };
+  const { service, hub } = mkCorrelatedService(registry, memoryDb(), correlation, byConnection, {
+    resolveElementInstance,
+  });
+  const p = connect("prod", registry);
+  hub.handler?.(produce(jobStream("kT"), 1, "x"), p.conn);
+
+  registry.remove("prod");
+  const other = connect("cons", registry);
+  hub.handler?.(grant(0), other.conn);
+  await tick(); // the engine read rejects → the stream must stay linked, not complete
+  assertEquals(correlation.jobKeysFor("worker-T"), ["kT"], "a transient engine failure leaves the job linked");
+  assertEquals(service.transcriptOf(jobStream("kT")), undefined, "and its transcript is NOT archived");
+
+  // The engine recovers and now reports the job gone: the periodic backstop pass completes it.
+  failing = false;
+  gone = true;
+  await service.reconcileEngineCorrelations();
+  assertEquals(correlation.jobKeysFor("worker-T"), [], "the backstop pass releases the ended job");
+  assertEquals(service.transcriptOf(jobStream("kT"))?.status, "completed", "and archives its transcript");
+  service.teardown();
+});
+
 test("H6 correlation write-side: non-job streams are never linked; a link retries until the instance resolves", () => {
   const registry = new ConnectionRegistry();
   const correlation = new CorrelationRegistry();

package/app/agentic/families/relay.family.ts

@@ -254,15 +254,18 @@ export interface RelayTranscriptServiceOptions {
   readonly instanceForConnection?: (connectionId: string) => string | undefined;
   /**
    * Whether a worker instance is still live on any hub connection (#689). Wired to the presence
-   * registry's {@link PresenceRegistry.isInstanceLive}. The disconnect-driven reconcile uses it to
-   * spare a still-active job's stream when its worker merely RECONNECTED mid-job (old producer
-   * connection dropped, a new one re-registered under the same instance): completing then would
-   * archive a live job's transcript and release its correlation, wedging the cockpit (the reconnected
-   * worker's produce frames hit a terminal `completed` stream and are ignored) while the harness
-   * keeps the engine lease. When wired to presence, a true worker-exit still completes: presence
-   * has dropped the instance, so this returns false. Omitted (`() => false`, the static default) →
-   * the prior always-complete-on-disconnect behaviour — every disconnect completes, reconnect
-   * included (the seam never consults presence, so its value does not vary).
+   * registry's {@link PresenceRegistry.isInstanceLive}. Since #691 the disconnect-driven reconcile
+   * defers to the engine job-state (the poller-owned completion authority) whenever an engine view
+   * ({@link resolveElementInstance}) is wired, so this presence signal is consulted ONLY as the
+   * engine-less fallback: on a host with no engine read-model (or a non-job stream — no jobKey, so
+   * nothing for the engine to reconcile against; an unlinked *job* stream still has a jobKey and DOES
+   * reconcile against the engine since #691) it spares a still-active job's stream when its worker merely
+   * RECONNECTED mid-job (old producer connection dropped, a new one re-registered under the same
+   * instance) — completing then would archive a live job's transcript and release its correlation,
+   * wedging the cockpit (the reconnected worker's produce frames hit a terminal `completed` stream and
+   * are ignored). A true worker-exit still completes (presence has dropped the instance → false).
+   * Omitted (`() => false`, the static default) → the prior always-complete-on-disconnect behaviour in
+   * that fallback path.
    */
   readonly isInstanceLive?: (instance: string) => boolean;
   /**
@@ -725,27 +728,56 @@ export class RelayTranscriptService {
   }
 
   /**
-   * Flush + complete every ephemeral stream whose producer connection is no longer live (the S1
-   * registry dropped it on close or liveness timeout), and release its job correlation (H6, #149).
-   * Lazy, like the relay hub's own dead-subscriber prune: it runs on each inbound frame, and shutdown
-   * covers the quiescent tail via {@link teardown}. The correlation release is store-independent (it
-   * runs even for an unpersisted relay), so a dropped worker's `jobKeys` always clear.
+   * Reconcile every ephemeral stream whose producer connection is no longer live (the S1 registry
+   * dropped it on close or liveness timeout). For a job stream with an engine view wired this
+   * defers the completion decision to the engine job-state (#691) — the poller-owned authority —
+   * regardless of whether the stream is linked yet (an unlinked job stream can still be mid-reconnect
+   * on the register/produce race), so a mid-job reconnect never archives a still-active job; for an
+   * engine-less host (or a non-job stream with no engine job to reconcile against) it flushes +
+   * completes the ephemeral stream and releases its correlation (H6, #149), with
+   * presence liveness (#689/#690) sparing a still-live instance as the only fallback signal. Lazy, like
+   * the relay hub's own dead-subscriber prune: it runs on each inbound frame, and shutdown covers the
+   * quiescent tail via {@link teardown}. The correlation release is store-independent (it runs even for
+   * an unpersisted relay), so a dropped worker's `jobKeys` always clear.
    */
   #reconcile(): void {
     for (const [stream, state] of this.#streams) {
       if (state.producer !== undefined && !this.#registry.has(state.producer)) {
-        // Producer connection gone. Normally that means the job it was relaying ended — release the
-        // correlation and flush+complete its ephemeral transcript. BUT a worker that merely
-        // RECONNECTED mid-job (#689) also loses its old producer connection while its job keeps
-        // running (the harness holds the engine lease and extends it). Presence re-registers the SAME
-        // instance under the new connection, so the instance stays live even though this specific
-        // producer connection is gone. Completing then would archive a still-active job's transcript
-        // to `historical` and drop its correlation — and because a completed stream is terminal
-        // (`#observe` ignores later frames), the reconnected worker could NEVER re-correlate: the
-        // cockpit shows the worker idle with a frozen transcript while the job is genuinely running.
-        // So spare the stream while its instance is still live; the next `produce` re-attributes the
-        // live connection (via `#observe`), a NEW job supersedes it (via `#link`), or — once the
-        // worker truly exits — presence drops the instance and a later reconcile completes it.
+        // Producer connection gone. Normally that means the job it was relaying ended — but a worker
+        // that merely RECONNECTED mid-job (#689) also loses its old producer connection while its job
+        // keeps running (the harness holds the engine lease and extends it). Inferring job-end from the
+        // relay-connection layer (the old presence heuristic, #690) conflates two independent liveness
+        // signals (engine lease vs. WS connection); the authoritative one is the engine job-state the
+        // poller already reconciles (#691).
+        if (this.#resolveElementInstance !== undefined && jobKeyOfStream(stream) !== undefined) {
+          // Engine/poller-owned completion (#691): drop the dead producer so `#reconcile` does not
+          // re-trigger on every subsequent frame, then reconcile THIS stream against the engine's view
+          // of its job (fire-and-forget — the sync frame handler must not await an engine read). A
+          // reconnected worker's job is still parked → kept live (the reconnect's next `produce`
+          // re-attributes the live connection via `#observe`); a genuine exit's job is gone →
+          // completed + archived. The periodic {@link reconcileEngineCorrelations} pass is the backstop
+          // if this read faults transiently. Presence liveness is no longer consulted here — the
+          // engine job-state is the sole completion authority whenever an engine view is wired.
+          //
+          // NB: this deliberately does NOT require `state.linked`. A job stream can still be UNLINKED
+          // during the documented register/produce race (the producer's presence instance was not yet
+          // resolvable at `produce` time, so `#link` deferred). Gating the engine path on `linked`
+          // would fall an unlinked-but-engine-wired job through to the presence fallback below and
+          // archive a still-parked job mid-reconnect — the very heuristic #691 removes. The engine is
+          // resolvable by jobKey alone (as at link time), so defer to it regardless of `linked`;
+          // `#unlink` inside `completeStream` stays a no-op for a stream that never linked.
+          state.producer = undefined;
+          void this.#reconcileStreamAgainstEngine(stream).catch((err: unknown) => {
+            this.#log.warn("agentic relay disconnect engine-reconcile failed", { stream, err: String(err) });
+          });
+          continue;
+        }
+        // Engine-less fallback (no engine view wired — e.g. an engine-less host, or a non-job stream
+        // with no engine job to reconcile against): presence-liveness spares a still-live
+        // instance's stream (#689/#690) and a truly-gone instance completes. Presence remains a
+        // completion signal ONLY in this degraded path where there is no engine job-state to consult —
+        // never the sole authority on the engine-wired path above. (A job stream with an engine view
+        // wired always took the engine path above, linked or not — it never reaches here.)
         if (state.instance !== undefined && this.#isInstanceLive(state.instance)) continue;
         // Producer connection gone → the job it was relaying ended: release its correlation.
         this.#unlink(stream, state);
@@ -756,58 +788,98 @@ export class RelayTranscriptService {
   }
 
   /**
-   * Defensive engine-reconcile safety net (#661): release any linked jobKey whose engine JOB park is
-   * no longer live. The precise, fast release is the terminal `lifecycle` event
+   * Defensive engine-reconcile safety net (#661): release any job stream — linked OR unlinked (#708) —
+   * whose engine JOB park is no longer live. The precise, fast release is the terminal `lifecycle` event
    * ({@link #observeTerminalLifecycle}), but an UNCLEAN worker exit (crash/kill) can skip that event —
    * and because the worker's relay connection is persistent across jobs, the disconnect release never
    * fires either, so the finished job would linger as a phantom active job on the worker's supply row.
    * This periodic pass asks the engine read model (the same {@link ElementInstanceResolver} the link
-   * path uses at #544) whether each linked job is still parked; a job the engine no longer parks
+   * path uses at #544) whether each job is still parked; a job the engine no longer parks
    * (resolver returns `undefined`) is released and its transcript completed. Bounds staleness regardless
    * of whether the worker emitted a clean terminal event — and also covers a worker that emitted nothing
-   * and merely went quiet.
+   * and merely went quiet. It covers UNLINKED job streams too (#708): the disconnect path (#691)
+   * can leave a job stream unlinked-but-still-parked with no producer, and jobKey alone resolves
+   * terminality, so this backstop is the only actor that can retire one whose worker never reconnects.
    *
    * Advisory and best-effort: a no-op with no resolver wired, and a resolver THROW / REJECTION for a
-   * given job is treated as "unknown — keep it linked" (never a false release of a genuinely active
-   * job). The linked set is snapshotted before any await so a concurrent completion (a terminal
+   * given job is treated as "unknown — keep it" (never a false release of a genuinely active
+   * job). The job-stream set is snapshotted before any await so a concurrent completion (a terminal
    * lifecycle event landing mid-pass) cannot corrupt iteration, and each release re-checks the current
    * stream state so a job already released between snapshot and resolution is not double-completed.
    */
   async reconcileEngineCorrelations(): Promise<void> {
-    const resolve = this.#resolveElementInstance;
-    if (resolve === undefined) return;
-    const linked: { stream: string; jobKey: string; processInstanceKey?: string }[] = [];
+    if (this.#resolveElementInstance === undefined) return;
+    // Snapshot the job-stream ids BEFORE any await so a concurrent completion (a terminal lifecycle
+    // event, a supersede, or a disconnect-triggered engine reconcile landing mid-pass) cannot corrupt
+    // iteration; the per-stream helper re-reads live state, so a job released between snapshot and
+    // resolution is not double-completed.
+    const streams: string[] = [];
     for (const [stream, state] of this.#streams) {
-      if (!state.linked || state.completed) continue;
-      const jobKey = jobKeyOfStream(stream);
-      if (jobKey === undefined) continue;
-      const processInstanceKey = this.#correlation()?.resolve?.(jobKey)?.processInstanceKey;
-      linked.push({ stream, jobKey, processInstanceKey });
+      if (state.completed) continue;
+      if (jobKeyOfStream(stream) === undefined) continue;
+      // Include UNLINKED job streams too (#708). The disconnect path (#691) routes an unlinked
+      // job stream through the engine reconcile and clears `state.producer`, so if the engine
+      // reports "still parked" at disconnect (or the read faults transiently) and the worker never
+      // reconnects to `produce` a link, this periodic pass is the ONLY actor left that can retire
+      // it. jobKey alone resolves terminality (as at link time), so gating this snapshot on
+      // `state.linked` would leak such a stream live forever once its engine job becomes terminal.
+      streams.push(stream);
     }
-    for (const { stream, jobKey, processInstanceKey } of linked) {
-      let activeKey: string | undefined;
-      try {
-        activeKey = await resolve(jobKey, processInstanceKey);
-      } catch (err) {
-        // A transient engine read failure must NOT be read as "job gone" — leave the job linked; a
-        // later pass (or the terminal lifecycle event) releases it. Advisory, never a false release.
-        this.#log.warn("agentic relay engine-reconcile read failed — leaving correlation linked", {
-          stream,
-          jobKey,
-          err: String(err),
-        });
-        continue;
-      }
-      // A live JOB park (a resolved element-instance key) means the job is genuinely active — keep it.
-      if (activeKey !== undefined) continue;
-      // The engine no longer parks this job → it ended (possibly via an unclean exit that skipped the
-      // terminal lifecycle event). Re-check the current state — a concurrent completion may already
-      // have released it — then release its correlation and flush its transcript.
-      const current = this.#streams.get(stream);
-      if (current === undefined || current.completed || !current.linked) continue;
-      this.#log.info("agentic relay engine-reconcile released a stale correlation", { stream, jobKey });
-      this.completeStream(stream);
+    for (const stream of streams) await this.#reconcileStreamAgainstEngine(stream);
+  }
+
+  /**
+   * Reconcile ONE `job:<jobKey>` stream against the engine's view of its job (the poller-owned
+   * completion authority, #691). Asks the engine read model (the {@link ElementInstanceResolver} the
+   * #544 link path uses) whether the job is still parked: still parked → genuinely active, kept live;
+   * gone → ended (a clean completion whose terminal lifecycle event was missed, or an unclean exit) →
+   * released + its transcript flushed/archived. This is the single canonical engine-reconcile step,
+   * shared by BOTH the periodic safety-net pass ({@link reconcileEngineCorrelations}) and the
+   * disconnect-driven `#reconcile` — so a producer disconnect no longer completes a stream by inferring
+   * job-end from relay-connection/presence liveness (#689/#690), but by the authoritative engine
+   * job-state. A no-op with no resolver wired, and a resolver THROW / REJECTION is treated as
+   * "unknown — keep it" so a transient engine read never falsely releases a genuinely active
+   * job (a later pass, or the terminal lifecycle event, releases it). Re-reads live state before
+   * completing so a job released between the read and the completion is not double-completed.
+   *
+   * Does NOT require `state.linked`: the disconnect path (#691) also routes an UNLINKED job stream
+   * here (a job stream whose link deferred on the register/produce race), so the engine — not the
+   * link flag — owns its completion. The engine resolves by jobKey alone (as at link time); an
+   * unlinked stream the engine says is gone is still flushed/archived, and `#unlink` inside
+   * `completeStream` stays a no-op for it.
+   */
+  async #reconcileStreamAgainstEngine(stream: string): Promise<void> {
+    const resolve = this.#resolveElementInstance;
+    if (resolve === undefined) return;
+    const before = this.#streams.get(stream);
+    if (before === undefined || before.completed) return;
+    const jobKey = jobKeyOfStream(stream);
+    if (jobKey === undefined) return;
+    const processInstanceKey = this.#correlation()?.resolve?.(jobKey)?.processInstanceKey;
+    let activeKey: string | undefined;
+    try {
+      activeKey = await resolve(jobKey, processInstanceKey);
+    } catch (err) {
+      // A transient engine read failure must NOT be read as "job gone" — keep the stream live; a
+      // later pass (or the terminal lifecycle event) releases it. Advisory, never a false release.
+      this.#log.warn("agentic relay engine-reconcile read failed — keeping stream live", {
+        stream,
+        jobKey,
+        err: String(err),
+      });
+      return;
     }
+    // A live JOB park (a resolved element-instance key) means the job is genuinely active — keep it.
+    // This is what spares a mid-job RECONNECT: the harness still holds the engine lease, so the job is
+    // still parked even though the old producer connection dropped.
+    if (activeKey !== undefined) return;
+    // The engine no longer parks this job → it ended (possibly via an unclean exit that skipped the
+    // terminal lifecycle event). Re-check the current state — a concurrent completion may already
+    // have released it — then release its correlation and flush its transcript.
+    const current = this.#streams.get(stream);
+    if (current === undefined || current.completed) return;
+    this.#log.info("agentic relay engine-reconcile released a stale correlation", { stream, jobKey });
+    this.completeStream(stream);
   }
 
   /**
@@ -886,10 +958,11 @@ export function createRelayFamily(options: {
         // are read per call, so this works regardless of family mount order (relay may mount before
         // presence/correlation). Absent registries → no linking, still advisory-correct.
         instanceForConnection: (connectionId) => currentPresenceRegistry()?.instanceForConnection(connectionId),
-        // #689: is the producing worker instance still live on ANY connection? Gates the
-        // disconnect-driven reconcile so a mid-job RECONNECT (old producer connection dropped, the
-        // same instance re-registered) does not archive a still-active job's stream and wedge its
-        // correlation. Read per call for the same mount-order independence as the resolvers above.
+        // #689/#691: is the producing worker instance still live on ANY connection? Since #691 the
+        // disconnect-driven reconcile decides completion by the engine job-state (below) whenever the
+        // element-instance resolver is wired; this presence signal is the engine-LESS fallback that
+        // spares a mid-job RECONNECT's still-active stream where no engine view is available. Read per
+        // call for the same mount-order independence as the resolvers around it.
         isInstanceLive: (instance) => currentPresenceRegistry()?.isInstanceLive(instance) ?? false,
         // #485: resolve a completed job's worker attribution (presence identity/host) from the live
         // presence registry, read per call for the same mount-order independence. Absent → attribution

package/app/feature.test.ts

@@ -7,6 +7,7 @@
 // process variables (the single `task` slice + the base-branch brief).
 import { after, test } from "node:test";
 import { assertEquals } from "#test-assert";
+import { withTrackingViews } from "../test/trackingViews.ts";
 import { FEATURE_PROCESS_ID, FEATURE_TERMINAL_STATUSES, featureTaskId, startFeature } from "./feature.ts";
 
 // `startFeature` now fetches the issue title (issue #248) via the GitHub transport. Force the token
@@ -49,7 +50,11 @@ function memTable(rows: any[], key: string) {
 
 function memData(stores: Record<string, { rows: any[]; key: string }>) {
   return {
-    table: (name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key),
+    // Serve the ADR-0065 derived tracking VIEW (`feature_runs__tracking`) off the base store so the
+    // intake idempotency reader (which reads `derived_status`, issue #704) resolves against the same
+    // rows — a base row with no explicitly-seeded `derived_status` folds `derived_status := status`.
+    table: withTrackingViews((name: string, key: string) =>
+      memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
   } as any;
 }
 
@@ -74,6 +79,8 @@ test("startFeature: inserts a running feature_runs row and persists the process
 
   assertEquals(result.featureKey, "owner/repo#42");
   assertEquals(result.processKey, "PI-9");
+  assertEquals(result.outcome, "started");
+  assertEquals(result.alreadyRunning, false);
   const row = stores.feature_runs.rows[0];
   assertEquals(row.feature_key, "owner/repo#42");
   assertEquals(row.repo, "owner/repo");
@@ -214,6 +221,7 @@ test("startFeature: an already-running run short-circuits (no new instance)", as
   const result = await startFeature(memData(stores), engine, PARSED, "main", false, false);
   assertEquals(created, 0);
   assertEquals("alreadyRunning" in result && (result as any).alreadyRunning, true);
+  assertEquals(result.outcome, "already-active");
   assertEquals(result.processKey, "PI-OLD");
 });
 
@@ -293,7 +301,138 @@ test("startFeature: an in-place restart clears a stale acknowledged_at (re-earn
   assertEquals(row.acknowledged_at, null);
 });
 
-// Issue #248: the human-readable identity for the feature grids. Every start persists a non-blank
+// Issue #704 (RED first): the feature-side twin of the #503 `submitPr`/epic re-admission wedges. Under
+// urban 0.81.0 the `instanceTracking` reconciler is a SOURCE, not a writer: on cancel/terminate it no
+// longer stamps the terminal `abandoned` onto base `feature_runs.status` — the terminal is recomputed
+// on read as `feature_runs__tracking.derived_status`. A terminated run therefore keeps its base
+// `status` frozen at its last worker transient (`running`/`escalated`/`awaiting_operator`) while
+// `derived_status` reads `abandoned`. The intake idempotency reader MUST classify on `derived_status`,
+// or a terminated run wedges `already-active` forever — a green success that dispatches NO instance.
+//
+// (a) present + TERMINATED: base row present, `status` frozen, `derived_status: "abandoned"` → the
+// resubmit dispatches a FRESH instance and reports `started` with a new processKey.
+test("startFeature: resubmits a derive-only-terminated run (base 'running', derived 'abandoned') — started, not already-active", async () => {
+  const stores = {
+    feature_runs: {
+      rows: [{
+        feature_key: "owner/repo#42",
+        repo: "owner/repo",
+        issue_number: 42,
+        status: "running", // base transient FROZEN — the reconciler no longer writes the terminal
+        derived_status: "abandoned", // ADR-0065 derive-only terminal
+        process_key: "PI-DEAD",
+        pr_key: null,
+        converge: 0,
+        auto_merge: 0,
+      }],
+      key: "feature_key",
+    },
+  };
+  let created = 0;
+  const engine = {
+    createInstance: () => {
+      created += 1;
+      return Promise.resolve({ processInstanceKey: "PI-FRESH" });
+    },
+  } as any;
+  const result = await startFeature(memData(stores), engine, PARSED, "main", false, false);
+  assertEquals(created, 1); // NOT wedged — a fresh incarnation was dispatched
+  assertEquals(result.outcome, "started");
+  assertEquals(result.alreadyRunning, false);
+  assertEquals(result.processKey, "PI-FRESH"); // a NEW instance key, not the dead PI-DEAD
+  const row = stores.feature_runs.rows[0];
+  assertEquals(row.status, "running"); // restarted in place
+  assertEquals(row.process_key, "PI-FRESH");
+});
+
+// (b) vanished instance (feature_runs row absent — a clean reset dropped it): the intake sees no prior
+// run at all and inserts a fresh one. Resubmit dispatches a fresh instance and reports `started`.
+// (The present-but-instance-state-vanished shape — where derived_status cannot fold — is #630's edge;
+// this asserts the row-absent boundary is resubmittable here.)
+test("startFeature: resubmits when the prior run row has vanished (row absent) — started", async () => {
+  const stores = { feature_runs: { rows: [] as any[], key: "feature_key" } };
+  let created = 0;
+  const engine = {
+    createInstance: () => {
+      created += 1;
+      return Promise.resolve({ processInstanceKey: "PI-REBORN" });
+    },
+  } as any;
+  const result = await startFeature(memData(stores), engine, PARSED, "main", false, false);
+  assertEquals(created, 1);
+  assertEquals(result.outcome, "started");
+  assertEquals(result.processKey, "PI-REBORN");
+  assertEquals(stores.feature_runs.rows[0].process_key, "PI-REBORN");
+});
+
+// A genuinely-live prior run (non-terminal derived edge) still short-circuits `already-active` — a
+// live run cannot be double-started.
+test("startFeature: a non-terminal derived run still short-circuits (already-active, no new instance)", async () => {
+  const stores = {
+    feature_runs: {
+      rows: [{
+        feature_key: "owner/repo#42",
+        status: "running",
+        derived_status: "running", // still live
+        process_key: "PI-LIVE",
+      }],
+      key: "feature_key",
+    },
+  };
+  let created = 0;
+  const engine = {
+    createInstance: () => {
+      created += 1;
+      return Promise.resolve({ processInstanceKey: "PI-NEW" });
+    },
+  } as any;
+  const result = await startFeature(memData(stores), engine, PARSED, "main", false, false);
+  assertEquals(created, 0);
+  assertEquals(result.outcome, "already-active");
+  assertEquals(result.alreadyRunning, true);
+  assertEquals(result.processKey, "PI-LIVE");
+});
+
+// The silent-success contract (#704 fix #3): when the engine returns NO instance key the intake
+// dispatched nothing — it must report `noop-terminal` (a distinct non-success), never a green
+// `started`. The operation maps this to a 502 so the page renders "nothing started" distinctly.
+test("startFeature: a start that dispatches no instance reports noop-terminal (not a green success)", async () => {
+  const stores = { feature_runs: { rows: [] as any[], key: "feature_key" } };
+  const engine = { createInstance: () => Promise.resolve({ processInstanceKey: null }) } as any;
+  const result = await startFeature(memData(stores), engine, PARSED, "main", false, false);
+  assertEquals(result.outcome, "noop-terminal");
+  assertEquals(result.processKey, null);
+  assertEquals(result.alreadyRunning, false);
+});
+
+// #704 follow-up (review): a `noop-terminal` start leaves a `feature_runs` row at base `running` with
+// `process_key: null` — NO engine instance was ever dispatched. That phantom row's `derived_status`
+// folds to the non-terminal base `running` (there is no terminated instance to fold to `abandoned`),
+// so without the null-`process_key` admission guard a retry would short-circuit `already-active` and
+// wedge resubmission forever. Assert the retry stays RESUBMITTABLE and re-dispatches.
+test("startFeature: retry after a noop-terminal re-dispatches (a null process_key row is not already-active)", async () => {
+  const stores = { feature_runs: { rows: [] as any[], key: "feature_key" } };
+  // Round 1: the engine dispatches nothing → noop-terminal, leaving a running/process_key:null row.
+  const noopEngine = { createInstance: () => Promise.resolve({ processInstanceKey: null }) } as any;
+  const first = await startFeature(memData(stores), noopEngine, PARSED, "main", false, false);
+  assertEquals(first.outcome, "noop-terminal");
+  assertEquals(stores.feature_runs.rows[0].status, "running");
+  assertEquals(stores.feature_runs.rows[0].process_key, null);
+  // Round 2: a healthy engine now dispatches — the retry must NOT wedge as already-active.
+  let created = 0;
+  const engine = {
+    createInstance: () => {
+      created += 1;
+      return Promise.resolve({ processInstanceKey: "PI-RETRY" });
+    },
+  } as any;
+  const second = await startFeature(memData(stores), engine, PARSED, "main", false, false);
+  assertEquals(created, 1);
+  assertEquals(second.outcome, "started");
+  assertEquals(second.alreadyRunning, false);
+  assertEquals(second.processKey, "PI-RETRY");
+});
+
 // `title` — the fetched issue title when available, else the `owner/repo#N` key — on BOTH the insert
 // (new run) and update (in-place restart) paths, so the title-led grid never renders a blank cell.
 test("startFeature: coalesces title to the key when the fetch yields nothing (insert path)", async () => {

package/app/feature.ts

@@ -17,6 +17,7 @@
 import type { DataLayer, EngineClient } from "@nanobpm/urban";
 import { TRANSCRIPT_URL_BASE_VAR, transcriptUrlBaseFor } from "./agentic/transcript-url.ts";
 import { coalesceTitle, fetchIssueTitle } from "./github.ts";
+import { derivedTrackingTable } from "./instanceTracking.ts";
 import { ESCALATION_SLA_TIMEOUT, normalizeBaseBranch, type ParsedIssue, renderBaseBranchBrief } from "./plan.ts";
 import type { ReadinessProbe } from "./readiness.ts";
 import { repoEnvelopeVars } from "./repoEnvelope.ts";
@@ -235,6 +236,50 @@ export const FEATURE_BLOCKED_ELEMENT = "feature-blocked";
  * that reproduces the reconciler bypass). */
 export const featureRuns = (data: DataLayer) => data.table<FeatureRun>("feature_runs", "feature_key");
 
+/** A `feature_runs` row as seen through its derived tracking VIEW (`feature_runs__tracking`): the base
+ * columns plus urban's ADR-0065 `derived_status`, which FOLDS the reconciler's terminal edge
+ * (out-of-band terminate / in-app cancel → `abandoned`) over the worker-owned transient. Since urban
+ * 0.81.0 the `instanceTracking` reconciler is a SOURCE, not a writer: it no longer stamps the terminal
+ * onto base `status` on cancel/terminate — the terminal is recomputed on read as `derived_status`. */
+export type TrackedFeatureRun = FeatureRun & { derived_status: string };
+
+/** Read-only accessor over the feature-run derived tracking VIEW (`feature_runs__tracking`). Use this —
+ * and read `derived_status`, NOT the base `status` — for the intake/admission idempotency
+ * classification (issue #704), so a run whose engine instance was terminated out-of-band (base row
+ * frozen at its last transient `running`/`escalated`/`awaiting_operator`) is correctly seen as
+ * `abandoned` and RESUBMITTABLE. The view name + `derived_status` column resolve through
+ * `derivedTrackingTable` (app/instanceTracking.ts), never a hard-coded name — mirroring `prsTracking`
+ * (app/service.ts) and `plansTracking` (app/plan.ts). Writes stay on `featureRuns`. */
+export const featureRunsTracking = (data: DataLayer) =>
+  derivedTrackingTable<TrackedFeatureRun>(data, "feature_runs", "feature_key");
+
+/** The discriminated outcome of a feature-run intake (issue #704). It distinguishes a genuine dispatch
+ * from a short-circuit and from a no-op, so a submit that started NOTHING can never render as a bare
+ * green success:
+ *  - `started` — a fresh engine instance was dispatched (`processKey` set).
+ *  - `already-active` — a non-terminal prior run for the same issue is still live, so the start
+ *    short-circuited; no new instance was created and `processKey` is the live run's.
+ *  - `noop-terminal` — the intake attempted a start but the engine returned NO instance key, so
+ *    nothing was dispatched. Surfaced by the operation as a distinct non-success (a submit that
+ *    dispatches no instance is not "Done"). */
+export type FeatureStartOutcome = "started" | "already-active" | "noop-terminal";
+
+/** The result of {@link startFeature} — a discriminated intake outcome (issue #704). `alreadyRunning`
+ * is retained as a back-compat flag for existing callers/telemetry (true iff `outcome` is
+ * `already-active`). A `type` alias (not an `interface`) because an object-literal type alias — with a
+ * fully-known, final set of properties — is assignable to the generated OpenAPI response shape's index
+ * signature, whereas an `interface` (open to declaration-merging) is not; this mirrors the inferred
+ * sibling results. */
+export type StartFeatureResult = {
+  featureKey: string;
+  outcome: FeatureStartOutcome;
+  /** The dispatched instance key (`started`), the live run's key (`already-active`), or null
+   * (`noop-terminal`). */
+  processKey: string | null;
+  /** True iff a non-terminal prior run short-circuited the start (`outcome === "already-active"`). */
+  alreadyRunning: boolean;
+};
+
 /** The deterministic task id for a single-issue run — the implementation agent branches
  * `feat/<task.id>` (see resources/prompts/feature.md), so it MUST be derivable from the issue alone
  * and stable across a resume. The PR is opened on the target repo, so the issue number
@@ -257,7 +302,7 @@ export async function startFeature(
   autoMerge: boolean,
   customInstructions: string | null = null,
   readiness: FeatureReadinessOptions = {},
-) {
+): Promise<StartFeatureResult> {
   // Intake-time readiness gate (issue #295): the probes the run must satisfy before it implements,
   // and the bound its preflight escalation timers fire off. Both are load-bearing together —
   // `pr.readiness-probe` rejects a blank `probeTimeout` and the preflight timers read `=probeTimeout`
@@ -286,9 +331,38 @@ export async function startFeature(
     ? customInstructions.trim()
     : null;
   const table = featureRuns(data);
-  const existing = await table.get(parsed.planKey);
-  if (existing && !FEATURE_TERMINAL_STATUSES.includes(existing.status)) {
-    return { featureKey: parsed.planKey, alreadyRunning: true, processKey: existing.process_key };
+  // ADR-0065: classify "already running" on the DERIVED terminal edge, not the base transient. A
+  // feature run whose engine instance was terminated out-of-band (or by an ordinary in-app cancel —
+  // derive-only under urban 0.81.0) has a base row frozen at its last worker transient
+  // (`running`/`escalated`/`awaiting_operator`) but a `feature_runs__tracking.derived_status` of
+  // `abandoned`. Reading the base `status` here wedged a terminated run `alreadyRunning` forever —
+  // returning a green success while dispatching NO instance (issue #704, the feature-side twin of the
+  // `submitPr` / epic re-admission wedges #503 fixed; this intake reader was the one #503 omitted).
+  // Route the idempotency gate through the derived view so a terminated run is correctly seen terminal
+  // and RESUBMITTABLE; a non-terminal derived edge still short-circuits (a genuinely-live run cannot
+  // be double-started). ONE read through the tracking VIEW serves both this classification and the
+  // insert-vs-update decision below: it re-exports every base column (so it doubles as the "exists?"
+  // check and the `process_key` source) plus `derived_status`, so a second base-table round trip is
+  // redundant.
+  const trackedExisting = await featureRunsTracking(data).get(parsed.planKey);
+  // A row with a null `process_key` never had an engine instance dispatched, so it is NEVER a live
+  // run — treat it as non-active for admission. This is load-bearing for the `noop-terminal` path
+  // (issue #704): a start the engine accepted without returning an instance key leaves a base row at
+  // `running`/`process_key: null` whose `derived_status` folds to the non-terminal base `running`
+  // (there is no terminated instance to fold to `abandoned`). Without this guard that phantom row
+  // would short-circuit every retry as `already-active`, wedging resubmission forever even though
+  // nothing was ever dispatched.
+  if (
+    trackedExisting &&
+    trackedExisting.process_key != null &&
+    !FEATURE_TERMINAL_STATUSES.some((s) => s === trackedExisting.derived_status)
+  ) {
+    return {
+      featureKey: parsed.planKey,
+      outcome: "already-active",
+      processKey: trackedExisting.process_key,
+      alreadyRunning: true,
+    };
   }
   const base = normalizeBaseBranch(baseBranch);
   const ts = now();
@@ -300,7 +374,7 @@ export async function startFeature(
     await fetchIssueTitle(parsed.repo, parsed.number, process.env.GITHUB_TOKEN ?? ""),
     parsed.planKey,
   );
-  if (existing) {
+  if (trackedExisting) {
     await table.update(parsed.planKey, {
       status: "running",
       base_branch: base,
@@ -425,6 +499,10 @@ export async function startFeature(
   const processKey = processInstanceKey == null ? null : String(processInstanceKey);
   if (processKey != null) {
     await table.update(parsed.planKey, { process_key: processKey, updated_at: now() });
+    return { featureKey: parsed.planKey, outcome: "started", processKey, alreadyRunning: false };
   }
-  return { featureKey: parsed.planKey, processKey };
+  // The engine accepted the start but returned NO instance key — nothing was actually dispatched.
+  // Report a discriminated no-op (issue #704) so the caller can surface it as a distinct non-success
+  // instead of a bare green "Done": a submit that dispatches no instance is not "started".
+  return { featureKey: parsed.planKey, outcome: "noop-terminal", processKey: null, alreadyRunning: false };
 }

package/app/terminalReaderGuard.test.ts

@@ -1,4 +1,4 @@
-// Class guard for the ADR-0065 terminal-edge reader migration (issue #503).
+// Class guard for the ADR-0065 terminal-edge reader migration (issues #503, #704).
 //
 // Since ADR-0065 (`@nanobpm/urban@0.81.0`) the `instanceTracking` reconciler is a SOURCE, not a
 // writer: on cancel/terminate it feeds urban's instance projection and the terminal edge
@@ -6,14 +6,20 @@
 // the terminal (`abandoned`/`failed`/`reviewed`) onto the base `status` column. A classifying reader
 // that inspects the BASE `status` column of a DERIVE-ONLY tracked table therefore sees a row frozen at
 // its last worker-owned transient after the instance ends → phantom-active / wedged-idempotency bugs
-// (the #497 / #503 class).
+// (the #497 / #503 / #704 class).
 //
-// This is a SOURCE-SCAN guard over the defect CLASS, not a single instance: it asserts that every
-// terminal/active classification (`TERMINAL_STATUSES.includes` / `=== ABANDONED_STATUS` /
-// `PLAN_TERMINAL_STATUSES` / the feature read model's status DSL) for the three derive-only tracked
-// tables (`pull_requests`, `plans`, `feature_runs`) reads the DERIVED effective status
-// (`.derived_status`), never the frozen base `.status`. A future reader that silently re-drifts onto
-// the base column fails here.
+// This is a SOURCE-SCAN guard over the defect CLASS, not a single instance. It is PARAMETRIZED over
+// the three derive-only tracked tables and their admission/idempotency/classifier readers
+// (derivation-over-duplication in the test itself, so the whole class is unrepresentable):
+//   - `pull_requests` → service.ts, `TERMINAL_STATUSES` (submitPr idempotency, activePrs, incidents,
+//     merge lanes, wave gates)
+//   - `plans`         → plan.ts,    `PLAN_TERMINAL_STATUSES` (startPlan re-admission, active-by-base)
+//   - `feature_runs`  → feature.ts, `FEATURE_TERMINAL_STATUSES` (startFeature INTAKE idempotency — the
+//     reader #503 omitted, closed by #704)
+// Every terminal-set classification (both the `.includes(x)` and `.some((s) => s === x)` forms) MUST
+// read the DERIVED effective status (`.derived_status`), never the frozen base `.status`. A future
+// reader — on ANY of the three tables — that silently re-drifts onto the base column fails here; the
+// pre-#704 feature intake (`FEATURE_TERMINAL_STATUSES.includes(existing.status)`) would have been red.
 //
 // Worker-owned terminals that PASS THROUGH the derive edge unchanged (`merged`) are exempt: a base
 // `=== "merged"` read is legitimate (see `isDepMerged` / `classifyWaveTarget` / `mergeLaneDecisionForPr`
@@ -36,23 +42,61 @@ function stripComments(src: string): string {
   return src.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/.*$/gm, "$1");
 }
 
-test("class guard: every TERMINAL_STATUSES classification in service.ts reads derived_status, not base status", () => {
-  const code = stripComments(SRC("service.ts"));
-  const calls = [...code.matchAll(/TERMINAL_STATUSES\.includes\(([^)]*)\)/g)];
-  assert(calls.length > 0, "expected TERMINAL_STATUSES.includes classifications in service.ts");
-  for (const m of calls) {
-    const arg = m[1];
-    assert(
-      /\.derived_status\b/.test(arg),
-      `TERMINAL_STATUSES.includes(${arg}) classifies on the BASE status of a derive-only tracked table — ` +
-        `route it through prsTracking and read \`.derived_status\` (ADR-0065, #503)`,
-    );
-    assert(
-      !/[A-Za-z0-9_)\]]\.status\b/.test(arg),
-      `TERMINAL_STATUSES.includes(${arg}) still reads a base \`.status\` — the terminal edge is derive-only (#503)`,
-    );
+/** Every expression a `<SET>_TERMINAL_STATUSES` classifies, across BOTH idioms the app uses:
+ *  `SET.includes(<expr>)` and `SET.some((s) => s === <expr>)` (and the mirrored `<expr> === s`). One
+ *  extractor for both forms so a reader can't dodge the guard by switching idiom. For the `.some`
+ *  form we capture the CLASSIFIED OPERAND — the side of `===` that is NOT the arrow parameter — on
+ *  either orientation, and assert against that operand rather than the whole arrow body, so an
+ *  incidental `.derived_status` reference elsewhere in the body can't mask a base-`.status`
+ *  classification. */
+function classifiedExprs(code: string, setName: string): string[] {
+  const exprs: string[] = [];
+  for (const m of code.matchAll(new RegExp(`${setName}\\.includes\\(([^)]*)\\)`, "g"))) {
+    exprs.push(m[1]);
   }
-});
+  for (const m of code.matchAll(new RegExp(`${setName}\\.some\\(\\(\\s*(\\w+)\\s*\\)\\s*=>\\s*([^)]*)\\)`, "g"))) {
+    const param = m[1]; // the arrow parameter, e.g. `s`
+    const body = m[2]; // `s === <expr>` or the mirrored `<expr> === s`
+    const sides = body.split("===").map((x) => x.trim());
+    // Capture the operand compared against the loop parameter, on either side of `===`; fall back to
+    // the whole body for any shape we don't recognise so the guard errs toward stricter, not looser.
+    if (sides.length === 2 && (sides[0] === param || sides[1] === param)) {
+      exprs.push(sides[0] === param ? sides[1] : sides[0]);
+    } else {
+      exprs.push(body);
+    }
+  }
+  return exprs;
+}
+
+/** The derive-only tracked tables and the reader module + terminal-status set that classifies each.
+ * ONE registry drives the whole guard so adding a fourth derive-only admission reader is a one-line
+ * change, never a copy-pasted test. */
+const DERIVE_ONLY_READERS = [
+  { table: "pull_requests", file: "service.ts", set: "TERMINAL_STATUSES" },
+  { table: "plans", file: "plan.ts", set: "PLAN_TERMINAL_STATUSES" },
+  { table: "feature_runs", file: "feature.ts", set: "FEATURE_TERMINAL_STATUSES" },
+] as const;
+
+for (const { table, file, set } of DERIVE_ONLY_READERS) {
+  test(`class guard: every ${set} classification (${table} admission/idempotency) reads derived_status, not base status`, () => {
+    const code = stripComments(SRC(file));
+    const exprs = classifiedExprs(code, set);
+    assert(exprs.length > 0, `expected ${set} classifications in ${file}`);
+    for (const expr of exprs) {
+      assert(
+        /\.derived_status\b/.test(expr),
+        `${set} classifies on \`${expr}\` — the BASE status of the derive-only tracked table \`${table}\`. ` +
+          `Route it through the derived tracking view and read \`.derived_status\` (ADR-0065, #503/#704)`,
+      );
+      assert(
+        !/[A-Za-z0-9_)\]]\.status\b/.test(expr),
+        `${set} classifies on \`${expr}\` which still reads a base \`.status\` — the terminal edge is ` +
+          `derive-only for \`${table}\` (ADR-0065, #503/#704)`,
+      );
+    }
+  });
+}
 
 test("class guard: no base `.status === ABANDONED_STATUS` / `.status === \"abandoned\"` read classification in service.ts", () => {
   const code = stripComments(SRC("service.ts"));
@@ -71,21 +115,6 @@ test("class guard: no base `.status === ABANDONED_STATUS` / `.status === \"aband
   );
 });
 
-test("class guard: every PLAN_TERMINAL_STATUSES classification in plan.ts reads derived_status, not base status", () => {
-  const code = stripComments(SRC("plan.ts"));
-  // Match the `.some((s) => s === <ref>)` classification form used at both admission sites.
-  const calls = [...code.matchAll(/PLAN_TERMINAL_STATUSES\.some\(\([^)]*\)\s*=>\s*[^)]*===\s*([A-Za-z0-9_.]+)\)/g)];
-  assert(calls.length > 0, "expected PLAN_TERMINAL_STATUSES classifications in plan.ts");
-  for (const m of calls) {
-    const ref = m[1];
-    assert(
-      /\.derived_status$/.test(ref),
-      `PLAN_TERMINAL_STATUSES classification reads \`${ref}\` — route it through plansTracking and read ` +
-        `\`.derived_status\` so a derive-only-terminated epic is seen terminal (ADR-0065, #503)`,
-    );
-  }
-});
-
 test("class guard: the feature read model classifies on derived_status, never the base status column", () => {
   // The feature history read model (app/featureReadModel.ts) buckets a run's pipeline `stage`/
   // `list_bucket` off its status. Under ADR-0065 that must be the terminal-folded `derived_status`

package/openapi.yaml

@@ -1281,15 +1281,29 @@ components:
       type: object
       required:
         - featureKey
+        - outcome
       properties:
         featureKey:
           type: string
+        outcome:
+          type: string
+          enum:
+            - started
+            - already-active
+            - noop-terminal
+          description: >-
+            Discriminated intake outcome (issue #704). `started` — a fresh engine instance was
+            dispatched (`processKey` set). `already-active` — a non-terminal prior run for this issue is
+            still live, so the start short-circuited (no new instance; `processKey` is the live run's).
+            `noop-terminal` — the engine returned no instance key, so NOTHING was dispatched; the
+            operation surfaces this as a 502 (never on a 202 body), so a submit that dispatched no
+            instance is never reported as success.
         processKey:
           type: string
           nullable: true
         alreadyRunning:
           type: boolean
-          description: True when a non-terminal feature run for this issue already exists; no new instance was started.
+          description: True iff a non-terminal feature run for this issue already existed and short-circuited the start (outcome `already-active`); no new instance was started.
     EpicSetStart:
       description: >-
         The set/batch admission request body (issue #292, slice S2). Submits a SET of epics plus the
@@ -5618,6 +5632,15 @@ paths:
             application/json:
               schema:
                 $ref: "#/components/schemas/ErrorBody"
+        "502":
+          description: >-
+            The engine accepted the start but returned no instance key — nothing was dispatched (issue
+            #704). A submit that starts no instance is surfaced here as a distinct non-success, never a
+            green 202.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ErrorBody"
   /actions/message:
     post:
       operationId: postMessage

package/operations/startFeature.ts

@@ -177,14 +177,31 @@ export default defineOperation("startFeature", async ({ body }, app) => {
     customInstructions,
     { probes: readiness.probes, probeTimeout: readiness.probeTimeout, probePollEvery: readiness.probePollEvery },
   );
-  app.log.info("feature run started", {
+  app.log.info("feature run intake", {
     featureKey: parsed.planKey,
     requestedBaseBranch: normalizedBase,
     converge,
     autoMerge,
     hasCustomInstructions: typeof customInstructions === "string" && customInstructions.trim() !== "",
     readinessProbes: readiness.probes.length,
-    alreadyRunning: "alreadyRunning" in result && result.alreadyRunning === true,
+    outcome: result.outcome,
+    alreadyRunning: result.alreadyRunning,
   });
+  // Discriminated intake outcome (issue #704): a `noop-terminal` means the engine accepted the start
+  // but returned no instance key, so NOTHING was dispatched. That is not a success — surface it as a
+  // 502 so the feature page renders "nothing started" distinctly (a red error banner), never a bare
+  // green success for a submit that started no instance. `started` / `already-active` are both
+  // legitimate 202s (the latter short-circuited a genuinely-live run).
+  if (result.outcome === "noop-terminal") {
+    app.log.error("feature run intake dispatched no engine instance", { featureKey: parsed.planKey });
+    return {
+      status: 502,
+      body: {
+        error:
+          `feature run for ${parsed.planKey} started no engine instance — the engine returned no ` +
+          `instance key, so nothing was dispatched. Retry, or check the engine.`,
+      },
+    };
+  }
   return { status: 202, body: result };
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.174.1",
+  "version": "0.175.1",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",

package/pages/feature.page.json

@@ -84,7 +84,7 @@
       "props": {
         "title": "Implement one issue",
         "submitLabel": "Implement & raise PR",
-        "action": { "path": "/app/api/actions/start/feature", "body": "{{form}}" },
+        "action": { "path": "/app/api/actions/start/feature", "body": "{{form}}", "successLabel": "Feature run dispatched \u2014 track it in the runs below. (A run already live for this issue is re-used, not double-started; if nothing is dispatched you\u2019ll see an error here, never a silent success.)" },
         "fields": [
           { "key": "issue", "label": "owner/repo#123 or a GitHub issue URL", "type": "text", "required": true, "requiredMessage": "An issue reference is required (owner/repo#123 or an issue URL)" },
           { "key": "baseBranch", "label": "Base branch: the branch the PR targets, e.g. main. A missing epic/* branch is auto-created off default HEAD; a non-epic/* branch must already exist.", "type": "text", "required": true, "requiredMessage": "Name the branch the PR targets (e.g. main or epic/agent-protocol)" },