@nanobpm/nano-workforce 0.175.0 → 0.175.1

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## [0.175.1](https://github.com/nanobpm/nano-workforce/compare/v0.175.0...v0.175.1) (2026-09-02)
+
+### Bug Fixes
+
+* **intake:** route feature-run admission idempotency through derived_status ([#707](https://github.com/nanobpm/nano-workforce/issues/707)) ([eab2c9c](https://github.com/nanobpm/nano-workforce/commit/eab2c9ce3d4b22bad38da62170f13fda647eb21f)), closes [#503](https://github.com/nanobpm/nano-workforce/issues/503) [#503](https://github.com/nanobpm/nano-workforce/issues/503) [#503](https://github.com/nanobpm/nano-workforce/issues/503) [#704](https://github.com/nanobpm/nano-workforce/issues/704)
+
 ## [0.175.0](https://github.com/nanobpm/nano-workforce/compare/v0.174.1...v0.175.0) (2026-09-02)
 
 ### Features

package/app/feature.test.ts

@@ -7,6 +7,7 @@
 // process variables (the single `task` slice + the base-branch brief).
 import { after, test } from "node:test";
 import { assertEquals } from "#test-assert";
+import { withTrackingViews } from "../test/trackingViews.ts";
 import { FEATURE_PROCESS_ID, FEATURE_TERMINAL_STATUSES, featureTaskId, startFeature } from "./feature.ts";
 
 // `startFeature` now fetches the issue title (issue #248) via the GitHub transport. Force the token
@@ -49,7 +50,11 @@ function memTable(rows: any[], key: string) {
 
 function memData(stores: Record<string, { rows: any[]; key: string }>) {
   return {
-    table: (name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key),
+    // Serve the ADR-0065 derived tracking VIEW (`feature_runs__tracking`) off the base store so the
+    // intake idempotency reader (which reads `derived_status`, issue #704) resolves against the same
+    // rows — a base row with no explicitly-seeded `derived_status` folds `derived_status := status`.
+    table: withTrackingViews((name: string, key: string) =>
+      memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
   } as any;
 }
 
@@ -74,6 +79,8 @@ test("startFeature: inserts a running feature_runs row and persists the process
 
   assertEquals(result.featureKey, "owner/repo#42");
   assertEquals(result.processKey, "PI-9");
+  assertEquals(result.outcome, "started");
+  assertEquals(result.alreadyRunning, false);
   const row = stores.feature_runs.rows[0];
   assertEquals(row.feature_key, "owner/repo#42");
   assertEquals(row.repo, "owner/repo");
@@ -214,6 +221,7 @@ test("startFeature: an already-running run short-circuits (no new instance)", as
   const result = await startFeature(memData(stores), engine, PARSED, "main", false, false);
   assertEquals(created, 0);
   assertEquals("alreadyRunning" in result && (result as any).alreadyRunning, true);
+  assertEquals(result.outcome, "already-active");
   assertEquals(result.processKey, "PI-OLD");
 });
 
@@ -293,7 +301,138 @@ test("startFeature: an in-place restart clears a stale acknowledged_at (re-earn
   assertEquals(row.acknowledged_at, null);
 });
 
-// Issue #248: the human-readable identity for the feature grids. Every start persists a non-blank
+// Issue #704 (RED first): the feature-side twin of the #503 `submitPr`/epic re-admission wedges. Under
+// urban 0.81.0 the `instanceTracking` reconciler is a SOURCE, not a writer: on cancel/terminate it no
+// longer stamps the terminal `abandoned` onto base `feature_runs.status` — the terminal is recomputed
+// on read as `feature_runs__tracking.derived_status`. A terminated run therefore keeps its base
+// `status` frozen at its last worker transient (`running`/`escalated`/`awaiting_operator`) while
+// `derived_status` reads `abandoned`. The intake idempotency reader MUST classify on `derived_status`,
+// or a terminated run wedges `already-active` forever — a green success that dispatches NO instance.
+//
+// (a) present + TERMINATED: base row present, `status` frozen, `derived_status: "abandoned"` → the
+// resubmit dispatches a FRESH instance and reports `started` with a new processKey.
+test("startFeature: resubmits a derive-only-terminated run (base 'running', derived 'abandoned') — started, not already-active", async () => {
+  const stores = {
+    feature_runs: {
+      rows: [{
+        feature_key: "owner/repo#42",
+        repo: "owner/repo",
+        issue_number: 42,
+        status: "running", // base transient FROZEN — the reconciler no longer writes the terminal
+        derived_status: "abandoned", // ADR-0065 derive-only terminal
+        process_key: "PI-DEAD",
+        pr_key: null,
+        converge: 0,
+        auto_merge: 0,
+      }],
+      key: "feature_key",
+    },
+  };
+  let created = 0;
+  const engine = {
+    createInstance: () => {
+      created += 1;
+      return Promise.resolve({ processInstanceKey: "PI-FRESH" });
+    },
+  } as any;
+  const result = await startFeature(memData(stores), engine, PARSED, "main", false, false);
+  assertEquals(created, 1); // NOT wedged — a fresh incarnation was dispatched
+  assertEquals(result.outcome, "started");
+  assertEquals(result.alreadyRunning, false);
+  assertEquals(result.processKey, "PI-FRESH"); // a NEW instance key, not the dead PI-DEAD
+  const row = stores.feature_runs.rows[0];
+  assertEquals(row.status, "running"); // restarted in place
+  assertEquals(row.process_key, "PI-FRESH");
+});
+
+// (b) vanished instance (feature_runs row absent — a clean reset dropped it): the intake sees no prior
+// run at all and inserts a fresh one. Resubmit dispatches a fresh instance and reports `started`.
+// (The present-but-instance-state-vanished shape — where derived_status cannot fold — is #630's edge;
+// this asserts the row-absent boundary is resubmittable here.)
+test("startFeature: resubmits when the prior run row has vanished (row absent) — started", async () => {
+  const stores = { feature_runs: { rows: [] as any[], key: "feature_key" } };
+  let created = 0;
+  const engine = {
+    createInstance: () => {
+      created += 1;
+      return Promise.resolve({ processInstanceKey: "PI-REBORN" });
+    },
+  } as any;
+  const result = await startFeature(memData(stores), engine, PARSED, "main", false, false);
+  assertEquals(created, 1);
+  assertEquals(result.outcome, "started");
+  assertEquals(result.processKey, "PI-REBORN");
+  assertEquals(stores.feature_runs.rows[0].process_key, "PI-REBORN");
+});
+
+// A genuinely-live prior run (non-terminal derived edge) still short-circuits `already-active` — a
+// live run cannot be double-started.
+test("startFeature: a non-terminal derived run still short-circuits (already-active, no new instance)", async () => {
+  const stores = {
+    feature_runs: {
+      rows: [{
+        feature_key: "owner/repo#42",
+        status: "running",
+        derived_status: "running", // still live
+        process_key: "PI-LIVE",
+      }],
+      key: "feature_key",
+    },
+  };
+  let created = 0;
+  const engine = {
+    createInstance: () => {
+      created += 1;
+      return Promise.resolve({ processInstanceKey: "PI-NEW" });
+    },
+  } as any;
+  const result = await startFeature(memData(stores), engine, PARSED, "main", false, false);
+  assertEquals(created, 0);
+  assertEquals(result.outcome, "already-active");
+  assertEquals(result.alreadyRunning, true);
+  assertEquals(result.processKey, "PI-LIVE");
+});
+
+// The silent-success contract (#704 fix #3): when the engine returns NO instance key the intake
+// dispatched nothing — it must report `noop-terminal` (a distinct non-success), never a green
+// `started`. The operation maps this to a 502 so the page renders "nothing started" distinctly.
+test("startFeature: a start that dispatches no instance reports noop-terminal (not a green success)", async () => {
+  const stores = { feature_runs: { rows: [] as any[], key: "feature_key" } };
+  const engine = { createInstance: () => Promise.resolve({ processInstanceKey: null }) } as any;
+  const result = await startFeature(memData(stores), engine, PARSED, "main", false, false);
+  assertEquals(result.outcome, "noop-terminal");
+  assertEquals(result.processKey, null);
+  assertEquals(result.alreadyRunning, false);
+});
+
+// #704 follow-up (review): a `noop-terminal` start leaves a `feature_runs` row at base `running` with
+// `process_key: null` — NO engine instance was ever dispatched. That phantom row's `derived_status`
+// folds to the non-terminal base `running` (there is no terminated instance to fold to `abandoned`),
+// so without the null-`process_key` admission guard a retry would short-circuit `already-active` and
+// wedge resubmission forever. Assert the retry stays RESUBMITTABLE and re-dispatches.
+test("startFeature: retry after a noop-terminal re-dispatches (a null process_key row is not already-active)", async () => {
+  const stores = { feature_runs: { rows: [] as any[], key: "feature_key" } };
+  // Round 1: the engine dispatches nothing → noop-terminal, leaving a running/process_key:null row.
+  const noopEngine = { createInstance: () => Promise.resolve({ processInstanceKey: null }) } as any;
+  const first = await startFeature(memData(stores), noopEngine, PARSED, "main", false, false);
+  assertEquals(first.outcome, "noop-terminal");
+  assertEquals(stores.feature_runs.rows[0].status, "running");
+  assertEquals(stores.feature_runs.rows[0].process_key, null);
+  // Round 2: a healthy engine now dispatches — the retry must NOT wedge as already-active.
+  let created = 0;
+  const engine = {
+    createInstance: () => {
+      created += 1;
+      return Promise.resolve({ processInstanceKey: "PI-RETRY" });
+    },
+  } as any;
+  const second = await startFeature(memData(stores), engine, PARSED, "main", false, false);
+  assertEquals(created, 1);
+  assertEquals(second.outcome, "started");
+  assertEquals(second.alreadyRunning, false);
+  assertEquals(second.processKey, "PI-RETRY");
+});
+
 // `title` — the fetched issue title when available, else the `owner/repo#N` key — on BOTH the insert
 // (new run) and update (in-place restart) paths, so the title-led grid never renders a blank cell.
 test("startFeature: coalesces title to the key when the fetch yields nothing (insert path)", async () => {

package/app/feature.ts

@@ -17,6 +17,7 @@
 import type { DataLayer, EngineClient } from "@nanobpm/urban";
 import { TRANSCRIPT_URL_BASE_VAR, transcriptUrlBaseFor } from "./agentic/transcript-url.ts";
 import { coalesceTitle, fetchIssueTitle } from "./github.ts";
+import { derivedTrackingTable } from "./instanceTracking.ts";
 import { ESCALATION_SLA_TIMEOUT, normalizeBaseBranch, type ParsedIssue, renderBaseBranchBrief } from "./plan.ts";
 import type { ReadinessProbe } from "./readiness.ts";
 import { repoEnvelopeVars } from "./repoEnvelope.ts";
@@ -235,6 +236,50 @@ export const FEATURE_BLOCKED_ELEMENT = "feature-blocked";
  * that reproduces the reconciler bypass). */
 export const featureRuns = (data: DataLayer) => data.table<FeatureRun>("feature_runs", "feature_key");
 
+/** A `feature_runs` row as seen through its derived tracking VIEW (`feature_runs__tracking`): the base
+ * columns plus urban's ADR-0065 `derived_status`, which FOLDS the reconciler's terminal edge
+ * (out-of-band terminate / in-app cancel → `abandoned`) over the worker-owned transient. Since urban
+ * 0.81.0 the `instanceTracking` reconciler is a SOURCE, not a writer: it no longer stamps the terminal
+ * onto base `status` on cancel/terminate — the terminal is recomputed on read as `derived_status`. */
+export type TrackedFeatureRun = FeatureRun & { derived_status: string };
+
+/** Read-only accessor over the feature-run derived tracking VIEW (`feature_runs__tracking`). Use this —
+ * and read `derived_status`, NOT the base `status` — for the intake/admission idempotency
+ * classification (issue #704), so a run whose engine instance was terminated out-of-band (base row
+ * frozen at its last transient `running`/`escalated`/`awaiting_operator`) is correctly seen as
+ * `abandoned` and RESUBMITTABLE. The view name + `derived_status` column resolve through
+ * `derivedTrackingTable` (app/instanceTracking.ts), never a hard-coded name — mirroring `prsTracking`
+ * (app/service.ts) and `plansTracking` (app/plan.ts). Writes stay on `featureRuns`. */
+export const featureRunsTracking = (data: DataLayer) =>
+  derivedTrackingTable<TrackedFeatureRun>(data, "feature_runs", "feature_key");
+
+/** The discriminated outcome of a feature-run intake (issue #704). It distinguishes a genuine dispatch
+ * from a short-circuit and from a no-op, so a submit that started NOTHING can never render as a bare
+ * green success:
+ *  - `started` — a fresh engine instance was dispatched (`processKey` set).
+ *  - `already-active` — a non-terminal prior run for the same issue is still live, so the start
+ *    short-circuited; no new instance was created and `processKey` is the live run's.
+ *  - `noop-terminal` — the intake attempted a start but the engine returned NO instance key, so
+ *    nothing was dispatched. Surfaced by the operation as a distinct non-success (a submit that
+ *    dispatches no instance is not "Done"). */
+export type FeatureStartOutcome = "started" | "already-active" | "noop-terminal";
+
+/** The result of {@link startFeature} — a discriminated intake outcome (issue #704). `alreadyRunning`
+ * is retained as a back-compat flag for existing callers/telemetry (true iff `outcome` is
+ * `already-active`). A `type` alias (not an `interface`) because an object-literal type alias — with a
+ * fully-known, final set of properties — is assignable to the generated OpenAPI response shape's index
+ * signature, whereas an `interface` (open to declaration-merging) is not; this mirrors the inferred
+ * sibling results. */
+export type StartFeatureResult = {
+  featureKey: string;
+  outcome: FeatureStartOutcome;
+  /** The dispatched instance key (`started`), the live run's key (`already-active`), or null
+   * (`noop-terminal`). */
+  processKey: string | null;
+  /** True iff a non-terminal prior run short-circuited the start (`outcome === "already-active"`). */
+  alreadyRunning: boolean;
+};
+
 /** The deterministic task id for a single-issue run — the implementation agent branches
  * `feat/<task.id>` (see resources/prompts/feature.md), so it MUST be derivable from the issue alone
  * and stable across a resume. The PR is opened on the target repo, so the issue number
@@ -257,7 +302,7 @@ export async function startFeature(
   autoMerge: boolean,
   customInstructions: string | null = null,
   readiness: FeatureReadinessOptions = {},
-) {
+): Promise<StartFeatureResult> {
   // Intake-time readiness gate (issue #295): the probes the run must satisfy before it implements,
   // and the bound its preflight escalation timers fire off. Both are load-bearing together —
   // `pr.readiness-probe` rejects a blank `probeTimeout` and the preflight timers read `=probeTimeout`
@@ -286,9 +331,38 @@ export async function startFeature(
     ? customInstructions.trim()
     : null;
   const table = featureRuns(data);
-  const existing = await table.get(parsed.planKey);
-  if (existing && !FEATURE_TERMINAL_STATUSES.includes(existing.status)) {
-    return { featureKey: parsed.planKey, alreadyRunning: true, processKey: existing.process_key };
+  // ADR-0065: classify "already running" on the DERIVED terminal edge, not the base transient. A
+  // feature run whose engine instance was terminated out-of-band (or by an ordinary in-app cancel —
+  // derive-only under urban 0.81.0) has a base row frozen at its last worker transient
+  // (`running`/`escalated`/`awaiting_operator`) but a `feature_runs__tracking.derived_status` of
+  // `abandoned`. Reading the base `status` here wedged a terminated run `alreadyRunning` forever —
+  // returning a green success while dispatching NO instance (issue #704, the feature-side twin of the
+  // `submitPr` / epic re-admission wedges #503 fixed; this intake reader was the one #503 omitted).
+  // Route the idempotency gate through the derived view so a terminated run is correctly seen terminal
+  // and RESUBMITTABLE; a non-terminal derived edge still short-circuits (a genuinely-live run cannot
+  // be double-started). ONE read through the tracking VIEW serves both this classification and the
+  // insert-vs-update decision below: it re-exports every base column (so it doubles as the "exists?"
+  // check and the `process_key` source) plus `derived_status`, so a second base-table round trip is
+  // redundant.
+  const trackedExisting = await featureRunsTracking(data).get(parsed.planKey);
+  // A row with a null `process_key` never had an engine instance dispatched, so it is NEVER a live
+  // run — treat it as non-active for admission. This is load-bearing for the `noop-terminal` path
+  // (issue #704): a start the engine accepted without returning an instance key leaves a base row at
+  // `running`/`process_key: null` whose `derived_status` folds to the non-terminal base `running`
+  // (there is no terminated instance to fold to `abandoned`). Without this guard that phantom row
+  // would short-circuit every retry as `already-active`, wedging resubmission forever even though
+  // nothing was ever dispatched.
+  if (
+    trackedExisting &&
+    trackedExisting.process_key != null &&
+    !FEATURE_TERMINAL_STATUSES.some((s) => s === trackedExisting.derived_status)
+  ) {
+    return {
+      featureKey: parsed.planKey,
+      outcome: "already-active",
+      processKey: trackedExisting.process_key,
+      alreadyRunning: true,
+    };
   }
   const base = normalizeBaseBranch(baseBranch);
   const ts = now();
@@ -300,7 +374,7 @@ export async function startFeature(
     await fetchIssueTitle(parsed.repo, parsed.number, process.env.GITHUB_TOKEN ?? ""),
     parsed.planKey,
   );
-  if (existing) {
+  if (trackedExisting) {
     await table.update(parsed.planKey, {
       status: "running",
       base_branch: base,
@@ -425,6 +499,10 @@ export async function startFeature(
   const processKey = processInstanceKey == null ? null : String(processInstanceKey);
   if (processKey != null) {
     await table.update(parsed.planKey, { process_key: processKey, updated_at: now() });
+    return { featureKey: parsed.planKey, outcome: "started", processKey, alreadyRunning: false };
   }
-  return { featureKey: parsed.planKey, processKey };
+  // The engine accepted the start but returned NO instance key — nothing was actually dispatched.
+  // Report a discriminated no-op (issue #704) so the caller can surface it as a distinct non-success
+  // instead of a bare green "Done": a submit that dispatches no instance is not "started".
+  return { featureKey: parsed.planKey, outcome: "noop-terminal", processKey: null, alreadyRunning: false };
 }

package/app/terminalReaderGuard.test.ts

@@ -1,4 +1,4 @@
-// Class guard for the ADR-0065 terminal-edge reader migration (issue #503).
+// Class guard for the ADR-0065 terminal-edge reader migration (issues #503, #704).
 //
 // Since ADR-0065 (`@nanobpm/urban@0.81.0`) the `instanceTracking` reconciler is a SOURCE, not a
 // writer: on cancel/terminate it feeds urban's instance projection and the terminal edge
@@ -6,14 +6,20 @@
 // the terminal (`abandoned`/`failed`/`reviewed`) onto the base `status` column. A classifying reader
 // that inspects the BASE `status` column of a DERIVE-ONLY tracked table therefore sees a row frozen at
 // its last worker-owned transient after the instance ends → phantom-active / wedged-idempotency bugs
-// (the #497 / #503 class).
+// (the #497 / #503 / #704 class).
 //
-// This is a SOURCE-SCAN guard over the defect CLASS, not a single instance: it asserts that every
-// terminal/active classification (`TERMINAL_STATUSES.includes` / `=== ABANDONED_STATUS` /
-// `PLAN_TERMINAL_STATUSES` / the feature read model's status DSL) for the three derive-only tracked
-// tables (`pull_requests`, `plans`, `feature_runs`) reads the DERIVED effective status
-// (`.derived_status`), never the frozen base `.status`. A future reader that silently re-drifts onto
-// the base column fails here.
+// This is a SOURCE-SCAN guard over the defect CLASS, not a single instance. It is PARAMETRIZED over
+// the three derive-only tracked tables and their admission/idempotency/classifier readers
+// (derivation-over-duplication in the test itself, so the whole class is unrepresentable):
+//   - `pull_requests` → service.ts, `TERMINAL_STATUSES` (submitPr idempotency, activePrs, incidents,
+//     merge lanes, wave gates)
+//   - `plans`         → plan.ts,    `PLAN_TERMINAL_STATUSES` (startPlan re-admission, active-by-base)
+//   - `feature_runs`  → feature.ts, `FEATURE_TERMINAL_STATUSES` (startFeature INTAKE idempotency — the
+//     reader #503 omitted, closed by #704)
+// Every terminal-set classification (both the `.includes(x)` and `.some((s) => s === x)` forms) MUST
+// read the DERIVED effective status (`.derived_status`), never the frozen base `.status`. A future
+// reader — on ANY of the three tables — that silently re-drifts onto the base column fails here; the
+// pre-#704 feature intake (`FEATURE_TERMINAL_STATUSES.includes(existing.status)`) would have been red.
 //
 // Worker-owned terminals that PASS THROUGH the derive edge unchanged (`merged`) are exempt: a base
 // `=== "merged"` read is legitimate (see `isDepMerged` / `classifyWaveTarget` / `mergeLaneDecisionForPr`
@@ -36,23 +42,61 @@ function stripComments(src: string): string {
   return src.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/.*$/gm, "$1");
 }
 
-test("class guard: every TERMINAL_STATUSES classification in service.ts reads derived_status, not base status", () => {
-  const code = stripComments(SRC("service.ts"));
-  const calls = [...code.matchAll(/TERMINAL_STATUSES\.includes\(([^)]*)\)/g)];
-  assert(calls.length > 0, "expected TERMINAL_STATUSES.includes classifications in service.ts");
-  for (const m of calls) {
-    const arg = m[1];
-    assert(
-      /\.derived_status\b/.test(arg),
-      `TERMINAL_STATUSES.includes(${arg}) classifies on the BASE status of a derive-only tracked table — ` +
-        `route it through prsTracking and read \`.derived_status\` (ADR-0065, #503)`,
-    );
-    assert(
-      !/[A-Za-z0-9_)\]]\.status\b/.test(arg),
-      `TERMINAL_STATUSES.includes(${arg}) still reads a base \`.status\` — the terminal edge is derive-only (#503)`,
-    );
+/** Every expression a `<SET>_TERMINAL_STATUSES` classifies, across BOTH idioms the app uses:
+ *  `SET.includes(<expr>)` and `SET.some((s) => s === <expr>)` (and the mirrored `<expr> === s`). One
+ *  extractor for both forms so a reader can't dodge the guard by switching idiom. For the `.some`
+ *  form we capture the CLASSIFIED OPERAND — the side of `===` that is NOT the arrow parameter — on
+ *  either orientation, and assert against that operand rather than the whole arrow body, so an
+ *  incidental `.derived_status` reference elsewhere in the body can't mask a base-`.status`
+ *  classification. */
+function classifiedExprs(code: string, setName: string): string[] {
+  const exprs: string[] = [];
+  for (const m of code.matchAll(new RegExp(`${setName}\\.includes\\(([^)]*)\\)`, "g"))) {
+    exprs.push(m[1]);
   }
-});
+  for (const m of code.matchAll(new RegExp(`${setName}\\.some\\(\\(\\s*(\\w+)\\s*\\)\\s*=>\\s*([^)]*)\\)`, "g"))) {
+    const param = m[1]; // the arrow parameter, e.g. `s`
+    const body = m[2]; // `s === <expr>` or the mirrored `<expr> === s`
+    const sides = body.split("===").map((x) => x.trim());
+    // Capture the operand compared against the loop parameter, on either side of `===`; fall back to
+    // the whole body for any shape we don't recognise so the guard errs toward stricter, not looser.
+    if (sides.length === 2 && (sides[0] === param || sides[1] === param)) {
+      exprs.push(sides[0] === param ? sides[1] : sides[0]);
+    } else {
+      exprs.push(body);
+    }
+  }
+  return exprs;
+}
+
+/** The derive-only tracked tables and the reader module + terminal-status set that classifies each.
+ * ONE registry drives the whole guard so adding a fourth derive-only admission reader is a one-line
+ * change, never a copy-pasted test. */
+const DERIVE_ONLY_READERS = [
+  { table: "pull_requests", file: "service.ts", set: "TERMINAL_STATUSES" },
+  { table: "plans", file: "plan.ts", set: "PLAN_TERMINAL_STATUSES" },
+  { table: "feature_runs", file: "feature.ts", set: "FEATURE_TERMINAL_STATUSES" },
+] as const;
+
+for (const { table, file, set } of DERIVE_ONLY_READERS) {
+  test(`class guard: every ${set} classification (${table} admission/idempotency) reads derived_status, not base status`, () => {
+    const code = stripComments(SRC(file));
+    const exprs = classifiedExprs(code, set);
+    assert(exprs.length > 0, `expected ${set} classifications in ${file}`);
+    for (const expr of exprs) {
+      assert(
+        /\.derived_status\b/.test(expr),
+        `${set} classifies on \`${expr}\` — the BASE status of the derive-only tracked table \`${table}\`. ` +
+          `Route it through the derived tracking view and read \`.derived_status\` (ADR-0065, #503/#704)`,
+      );
+      assert(
+        !/[A-Za-z0-9_)\]]\.status\b/.test(expr),
+        `${set} classifies on \`${expr}\` which still reads a base \`.status\` — the terminal edge is ` +
+          `derive-only for \`${table}\` (ADR-0065, #503/#704)`,
+      );
+    }
+  });
+}
 
 test("class guard: no base `.status === ABANDONED_STATUS` / `.status === \"abandoned\"` read classification in service.ts", () => {
   const code = stripComments(SRC("service.ts"));
@@ -71,21 +115,6 @@ test("class guard: no base `.status === ABANDONED_STATUS` / `.status === \"aband
   );
 });
 
-test("class guard: every PLAN_TERMINAL_STATUSES classification in plan.ts reads derived_status, not base status", () => {
-  const code = stripComments(SRC("plan.ts"));
-  // Match the `.some((s) => s === <ref>)` classification form used at both admission sites.
-  const calls = [...code.matchAll(/PLAN_TERMINAL_STATUSES\.some\(\([^)]*\)\s*=>\s*[^)]*===\s*([A-Za-z0-9_.]+)\)/g)];
-  assert(calls.length > 0, "expected PLAN_TERMINAL_STATUSES classifications in plan.ts");
-  for (const m of calls) {
-    const ref = m[1];
-    assert(
-      /\.derived_status$/.test(ref),
-      `PLAN_TERMINAL_STATUSES classification reads \`${ref}\` — route it through plansTracking and read ` +
-        `\`.derived_status\` so a derive-only-terminated epic is seen terminal (ADR-0065, #503)`,
-    );
-  }
-});
-
 test("class guard: the feature read model classifies on derived_status, never the base status column", () => {
   // The feature history read model (app/featureReadModel.ts) buckets a run's pipeline `stage`/
   // `list_bucket` off its status. Under ADR-0065 that must be the terminal-folded `derived_status`

package/openapi.yaml

@@ -1281,15 +1281,29 @@ components:
       type: object
       required:
         - featureKey
+        - outcome
       properties:
         featureKey:
           type: string
+        outcome:
+          type: string
+          enum:
+            - started
+            - already-active
+            - noop-terminal
+          description: >-
+            Discriminated intake outcome (issue #704). `started` — a fresh engine instance was
+            dispatched (`processKey` set). `already-active` — a non-terminal prior run for this issue is
+            still live, so the start short-circuited (no new instance; `processKey` is the live run's).
+            `noop-terminal` — the engine returned no instance key, so NOTHING was dispatched; the
+            operation surfaces this as a 502 (never on a 202 body), so a submit that dispatched no
+            instance is never reported as success.
         processKey:
           type: string
           nullable: true
         alreadyRunning:
           type: boolean
-          description: True when a non-terminal feature run for this issue already exists; no new instance was started.
+          description: True iff a non-terminal feature run for this issue already existed and short-circuited the start (outcome `already-active`); no new instance was started.
     EpicSetStart:
       description: >-
         The set/batch admission request body (issue #292, slice S2). Submits a SET of epics plus the
@@ -5618,6 +5632,15 @@ paths:
             application/json:
               schema:
                 $ref: "#/components/schemas/ErrorBody"
+        "502":
+          description: >-
+            The engine accepted the start but returned no instance key — nothing was dispatched (issue
+            #704). A submit that starts no instance is surfaced here as a distinct non-success, never a
+            green 202.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ErrorBody"
   /actions/message:
     post:
       operationId: postMessage

package/operations/startFeature.ts

@@ -177,14 +177,31 @@ export default defineOperation("startFeature", async ({ body }, app) => {
     customInstructions,
     { probes: readiness.probes, probeTimeout: readiness.probeTimeout, probePollEvery: readiness.probePollEvery },
   );
-  app.log.info("feature run started", {
+  app.log.info("feature run intake", {
     featureKey: parsed.planKey,
     requestedBaseBranch: normalizedBase,
     converge,
     autoMerge,
     hasCustomInstructions: typeof customInstructions === "string" && customInstructions.trim() !== "",
     readinessProbes: readiness.probes.length,
-    alreadyRunning: "alreadyRunning" in result && result.alreadyRunning === true,
+    outcome: result.outcome,
+    alreadyRunning: result.alreadyRunning,
   });
+  // Discriminated intake outcome (issue #704): a `noop-terminal` means the engine accepted the start
+  // but returned no instance key, so NOTHING was dispatched. That is not a success — surface it as a
+  // 502 so the feature page renders "nothing started" distinctly (a red error banner), never a bare
+  // green success for a submit that started no instance. `started` / `already-active` are both
+  // legitimate 202s (the latter short-circuited a genuinely-live run).
+  if (result.outcome === "noop-terminal") {
+    app.log.error("feature run intake dispatched no engine instance", { featureKey: parsed.planKey });
+    return {
+      status: 502,
+      body: {
+        error:
+          `feature run for ${parsed.planKey} started no engine instance — the engine returned no ` +
+          `instance key, so nothing was dispatched. Retry, or check the engine.`,
+      },
+    };
+  }
   return { status: 202, body: result };
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.175.0",
+  "version": "0.175.1",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",

package/pages/feature.page.json

@@ -84,7 +84,7 @@
       "props": {
         "title": "Implement one issue",
         "submitLabel": "Implement & raise PR",
-        "action": { "path": "/app/api/actions/start/feature", "body": "{{form}}" },
+        "action": { "path": "/app/api/actions/start/feature", "body": "{{form}}", "successLabel": "Feature run dispatched \u2014 track it in the runs below. (A run already live for this issue is re-used, not double-started; if nothing is dispatched you\u2019ll see an error here, never a silent success.)" },
         "fields": [
           { "key": "issue", "label": "owner/repo#123 or a GitHub issue URL", "type": "text", "required": true, "requiredMessage": "An issue reference is required (owner/repo#123 or an issue URL)" },
           { "key": "baseBranch", "label": "Base branch: the branch the PR targets, e.g. main. A missing epic/* branch is auto-created off default HEAD; a non-epic/* branch must already exist.", "type": "text", "required": true, "requiredMessage": "Name the branch the PR targets (e.g. main or epic/agent-protocol)" },