@nanobpm/nano-workforce 0.188.1 → 0.189.1

package/operations/enrolAgenticWorker.ts

@@ -13,6 +13,12 @@
 import type { Capability } from "@nanobpm/agentic/protocol";
 import { resolveEnrolment } from "../app/agentic/vocab/enrol.ts";
 import { DurableResumeRegistry } from "../app/durableResume.ts";
+import {
+  HarnessProtocolRegistry,
+  isStaleProtocol,
+  minHarnessProtocol,
+  staleHarnessPolicy,
+} from "../app/harnessProtocol.ts";
 import { envVar } from "../app/version.ts";
 import type { EnrolResult } from "../nano-generated/api-io.d.ts";
 import { defineOperation } from "../nano-generated/operations.ts";
@@ -73,6 +79,22 @@ export default defineOperation("enrolAgenticWorker", async ({ req, body }, app)
     app.log.warn("enrolAgenticWorker rejected: non-boolean durableResume");
     return { status: 400, body: { error: "`durableResume` must be a boolean when provided" } };
   }
+  // The harness-protocol enrolment attribute (issue #802) — a non-negative integer the harness
+  // advertises declaring which machine-readable artifacts it emits (AgentInstance, transcript flush,
+  // result envelope). A directly-invoked delegate bypasses the OpenAPI runtime validation, so guard the
+  // type here: a non-integer / negative value would corrupt the persisted staleness gate.
+  if (
+    body.harnessProtocol !== undefined &&
+    (typeof body.harnessProtocol !== "number" ||
+      !Number.isInteger(body.harnessProtocol) ||
+      body.harnessProtocol < 0)
+  ) {
+    app.log.warn("enrolAgenticWorker rejected: non-integer harnessProtocol");
+    return {
+      status: 400,
+      body: { error: "`harnessProtocol` must be a non-negative integer when provided" },
+    };
+  }
 
   // Fold a top-level `host` into the capability when the capability didn't carry its own — a worker
   // may declare its host either on the capability or beside it (ADR 0059 `{ capability, host }`).
@@ -102,19 +124,57 @@ export default defineOperation("enrolAgenticWorker", async ({ req, body }, app)
     }
   }
 
+  // Harness-protocol enrolment gate (issue #802): record the advertised protocol per instance so the
+  // app can expose it in getAgenticSupply / the registry and gate on it. Recorded even on a downgrade
+  // (a re-enrol WITHOUT a version clears a stale-healthy value to absent → stale). Like durable-resume
+  // it needs a non-blank `instance` and is best-effort — a registry write hiccup must not fail enrol.
+  if (app.data && instanceKey) {
+    try {
+      await new HarnessProtocolRegistry(app.data).recordEnrolment(instanceKey, body.harnessProtocol);
+    } catch (err) {
+      app.log.warn("enrolAgenticWorker: harness-protocol record failed", { instance: instanceKey, err: String(err) });
+    }
+  }
+
+  // Derive staleness from the just-advertised protocol against the configured minimum (absent version =
+  // stale, the #802 signature). Under the `refuse` policy a stale harness is handed an EMPTY SERVE set
+  // so it wins no job leases — a REGISTER→SERVE gate, never an engine/job-protocol change. Under the
+  // default `flag` policy the SERVE set is unchanged (no routing regression); the worker is only
+  // flagged so the cockpit can surface it for drain.
+  const harnessStale = isStaleProtocol(body.harnessProtocol, minHarnessProtocol());
+  const refuseRouting = harnessStale && staleHarnessPolicy() === "refuse";
+  if (refuseRouting) {
+    app.log.warn("enrolAgenticWorker: refusing routing for a stale harness", {
+      instance: body.instance,
+      harnessProtocol: body.harnessProtocol,
+      minHarnessProtocol: minHarnessProtocol(),
+    });
+  }
+
   const result: EnrolResult = {
-    serve: [...resolved.serve],
-    roles: resolved.roles.map((role) => {
-      const out: EnrolResult["roles"][number] = { token: role.token, seatsDistinctFamily: role.seatsDistinctFamily };
-      if (role.weight !== undefined) out.weight = role.weight;
-      return out;
-    }),
+    serve: refuseRouting ? [] : [...resolved.serve],
+    roles: refuseRouting
+      ? []
+      : resolved.roles.map((role) => {
+          const out: EnrolResult["roles"][number] = { token: role.token, seatsDistinctFamily: role.seatsDistinctFamily };
+          if (role.weight !== undefined) out.weight = role.weight;
+          return out;
+        }),
     demandVersion: resolved.demandVersion,
     leaseTtl: resolved.leaseTtl,
+    // Always surface the staleness verdict so the caller (and the cockpit) can see a stale harness even
+    // when it advertised no version at all.
+    harnessStale,
   };
   if (body.instance !== undefined) result.instance = body.instance;
   if (body.durableResume !== undefined) result.durableResume = body.durableResume;
+  if (body.harnessProtocol !== undefined) result.harnessProtocol = body.harnessProtocol;
 
-  app.log.info("agentic enrol resolved", { instance: body.instance, serve: result.serve, family: capability.family });
+  app.log.info("agentic enrol resolved", {
+    instance: body.instance,
+    serve: result.serve,
+    family: capability.family,
+    harnessStale,
+  });
   return { status: 200, body: result };
 });

package/operations/getAgenticRegistry.ts

@@ -20,6 +20,6 @@ export default defineOperation("getAgenticRegistry", async ({ req }, app) => {
     app.log.warn("getAgenticRegistry rejected: missing/invalid shared secret");
     return { status: 401, body: { error: "unauthorized" } };
   }
-  const report = await computeRegistryReport(app.log);
+  const report = await computeRegistryReport(app.log, app.data);
   return { status: 200, body: toWireReport(report) };
 });

package/operations/getAgenticSupply.test.ts

@@ -5,6 +5,7 @@
 // by instance, family/host/jobKeys/liveness) — driven through a REAL AgenticHub + in-memory transport
 // exactly as the presence family is exercised, so the singleton the operation reads is the live one.
 import { DatabaseSync } from "node:sqlite";
+import { readFileSync } from "node:fs";
 import { test } from "node:test";
 import { AgenticHub } from "@nanobpm/agentic/channel";
 import type { Authenticator, ChannelConnection, ChannelTransport } from "@nanobpm/agentic/channel";
@@ -39,6 +40,19 @@ function memData(db: SqliteDb): DataLayer {
   return { source: () => ({ db }) } as unknown as DataLayer;
 }
 
+/** Wrap an existing DatabaseSync as a SqliteDb (so the presence store and a raw insert share one db). */
+function memSqliteOver(db: DatabaseSync): SqliteDb {
+  return {
+    exec: (sql) => db.exec(sql),
+    run: (sql, params = []) => {
+      const r = db.prepare(sql).run(...(params as never[]));
+      return { changes: Number(r.changes), lastInsertRowid: Number(r.lastInsertRowid) };
+    },
+    all: <T = Record<string, unknown>>(sql: string, params: unknown[] = []) =>
+      db.prepare(sql).all(...(params as never[])) as T[],
+  };
+}
+
 function memTransport(): { transport: ChannelTransport; connect(conn: ChannelConnection): void } {
   let onConnection: ((conn: ChannelConnection) => void) | undefined;
   const transport: ChannelTransport = {
@@ -259,3 +273,69 @@ test("#738 drift: the supply advertises the producer's instance-scoped stream id
     await hub.close();
   }
 });
+
+// Harness staleness (issue #802): the supply report flags a worker whose harness protocol is below the
+// minimum / absent, joined by instance from the app's harness-protocol registry.
+test("#802: flags harnessStale per worker, joining the harness-protocol registry by instance", async () => {
+  const raw = new DatabaseSync(":memory:");
+  raw.exec("PRAGMA foreign_keys = ON;");
+  raw.exec(readFileSync(new URL("../db/migrations/107_worker_harness_protocol.sql", import.meta.url), "utf8"));
+  const now = new Date().toISOString();
+  // wk-a advertised a healthy protocol (>= min 1); wk-a's presence row is minted below.
+  raw.prepare("INSERT INTO worker_harness_protocol (instance, harness_protocol, updated_at) VALUES (?, ?, ?)").run("wk-a", 2, now);
+
+  // A data layer providing BOTH the presence `source().db` handle and the RAD `table()` surface over
+  // the SAME db, so the presence family and the harness registry read one store.
+  const sqlite = memSqliteOver(raw);
+  const quote = (id: string) => `"${id.replace(/"/g, '""')}"`;
+  const table = (name: string, pk = "id") => ({
+    // biome-ignore lint/suspicious/noExplicitAny: test-only gateway.
+    async find(where: any = {}): Promise<any[]> {
+      const keys = Object.keys(where);
+      const clause = keys.length ? `WHERE ${keys.map((k) => `${quote(k)} = ?`).join(" AND ")}` : "";
+      return raw.prepare(`SELECT * FROM ${quote(name)} ${clause}`).all(...keys.map((k) => where[k])) as any[];
+    },
+    // biome-ignore lint/suspicious/noExplicitAny: test-only gateway.
+    async findOne(where: any = {}): Promise<any> {
+      return (await this.find(where))[0];
+    },
+    _pk: pk,
+  });
+  const data = {
+    source: () => ({ db: sqlite }),
+    table,
+    // The raw-SQL surface the harness registry's bounded `WHERE instance IN (…)` read binds to, over
+    // the SAME db as `table`/presence.
+    // biome-ignore lint/suspicious/noExplicitAny: test-only gateway.
+    open: () => ({ query: async (sql: string, params: any[] = []) => raw.prepare(sql).all(...params) as any[] }),
+  } as unknown as DataLayer;
+
+  const transport = memTransport();
+  const hub = new AgenticHub({ transport: transport.transport, authenticator, sweepIntervalMs: 0 });
+  await family.mount({ hub, registry: hub.registry, transport: transport.transport as never, data, log: noopLog() });
+  const healthyConn = fakeConn("c1", "leafA");
+  transport.connect(healthyConn.conn);
+  await flush();
+  healthyConn.feed({ lane: "control", family: "register", seq: 1, payload: { instance: "wk-a", capability: {} } });
+  const staleConn = fakeConn("c2", "leafA");
+  transport.connect(staleConn.conn);
+  await flush();
+  // wk-b registers but has NO harness-protocol row → absent = stale.
+  staleConn.feed({ lane: "control", family: "register", seq: 1, payload: { instance: "wk-b", capability: {} } });
+  await flush();
+
+  const withData = { log: noopLog(), data } as unknown as AppApi;
+  try {
+    const res = (await handler(input(), withData)) as { status: number; body: { workers: Array<Record<string, unknown>> } };
+    assertEquals(res.status, 200);
+    const byInstance = new Map(res.body.workers.map((w) => [w.instance, w]));
+    assertEquals(byInstance.get("wk-a")?.harnessStale, false, "healthy protocol is not stale");
+    assertEquals(byInstance.get("wk-a")?.harnessProtocol, 2);
+    assertEquals(byInstance.get("wk-b")?.harnessStale, true, "no recorded protocol = stale");
+    assertEquals("harnessProtocol" in (byInstance.get("wk-b") ?? {}), false, "no protocol echoed for a stale worker");
+  } finally {
+    family.teardown?.();
+    await hub.close();
+    raw.close();
+  }
+});

package/operations/getAgenticSupply.ts

@@ -23,6 +23,7 @@
 import { type ClaimRegistry, currentClaimRegistry } from "../app/agentic/claim-registry.ts";
 import { currentCorrelation, type JobCorrelation } from "../app/agentic/correlation.ts";
 import { currentPresenceRegistry, type SupplyWorker } from "../app/agentic/families/presence.family.ts";
+import { assessWorkers, type HarnessAssessment } from "../app/harnessProtocol.ts";
 import { envVar } from "../app/version.ts";
 import type { AgenticJobCorrelation, AgenticSupplyReport, AgenticSupplyWorker } from "../nano-generated/api-io.d.ts";
 import { defineOperation } from "../nano-generated/operations.ts";
@@ -36,7 +37,7 @@ const SECRET = envVar("NANO_PR_WEBHOOK_SECRET") ?? "";
 // (`composeStreamId(instance, jobKey)`, issue #738) when the claim registry knows a current claim for
 // it (#713) — keyed by the CLAIM, not by the connection — so drilling in opens the LIVE job's terminal
 // (the exact stream the producer writes) even before any transcript lands.
-function toWorker(w: SupplyWorker, claims: ClaimRegistry | undefined): AgenticSupplyWorker {
+function toWorker(w: SupplyWorker, claims: ClaimRegistry | undefined, harness: HarnessAssessment | undefined): AgenticSupplyWorker {
   const out: AgenticSupplyWorker = {
     instance: w.instance,
     identity: w.identity,
@@ -44,9 +45,13 @@ function toWorker(w: SupplyWorker, claims: ClaimRegistry | undefined): AgenticSu
     jobKeys: [...w.jobKeys],
     live: w.live,
     staleMs: w.staleMs,
+    // Harness staleness (issue #802) — an absent registry entry / unmounted data layer reads as stale
+    // (fail loud). Distinct from the liveness `staleMs` heartbeat grade above.
+    harnessStale: harness?.stale ?? true,
   };
   if (w.family !== undefined) out.family = w.family;
   if (w.host !== undefined) out.host = w.host;
+  if (harness?.harnessProtocol !== undefined) out.harnessProtocol = harness.harnessProtocol;
   return out;
 }
 
@@ -82,11 +87,18 @@ export default defineOperation("getAgenticSupply", async ({ req }, app) => {
   // process-instance / plan context surfaced in `correlations`, but no longer feeds visibility.
   const correlation = currentCorrelation();
   const snapshot = registry.snapshot(claims ? { jobKeysFor: (instance) => claims.jobKeysFor(instance) } : {});
+  // Harness-staleness (issue #802): assess every visible worker's advertised protocol against the
+  // configured minimum — the ONE canonical staleness derivation (no second heuristic). Best-effort:
+  // an unmounted data layer / read failure reads as stale (fail loud).
+  const harness = await assessWorkers(app.data, snapshot.workers.map((w) => w.instance));
   const report: AgenticSupplyReport = {
     count: snapshot.count,
     generatedAt: new Date().toISOString(),
-    workers: snapshot.workers.map((w) => toWorker(w, claims)),
-    leaves: snapshot.leaves.map((leaf) => ({ token: leaf.token, workers: leaf.workers.map((w) => toWorker(w, claims)) })),
+    workers: snapshot.workers.map((w) => toWorker(w, claims, harness.get(w.instance))),
+    leaves: snapshot.leaves.map((leaf) => ({
+      token: leaf.token,
+      workers: leaf.workers.map((w) => toWorker(w, claims, harness.get(w.instance))),
+    })),
     correlations: correlation ? correlation.snapshot().correlations.map(toCorrelation) : [],
   };
   return { status: 200, body: report };

package/operations/listEscalations.test.ts

@@ -126,7 +126,7 @@ test("listEscalations: round-trip — the listed userTaskKey is exactly what com
   assertEquals(done.status, 200);
   assertEquals(done.body.ok, true);
   assertEquals(done.body.elementId, "wait-answer");
-  assertEquals(completed, [{ userTaskKey: "ut-answer", variables: { answer: "v2" } }]);
+  assertEquals(completed, [{ userTaskKey: "ut-answer", variables: { answer: "v2", completedUserTaskKey: "ut-answer", completedCompletionId: 1 } }]);
   // The answered task's read-model row is dropped, so a re-list no longer shows it.
   assertEquals(stores.user_tasks, []);
   const reListed = await callList(app);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.188.1",
+  "version": "0.189.1",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",

package/pages/cockpit/mount.js

@@ -84,6 +84,10 @@ function workerView(worker, staleAfterMs, byJobKey) {
     correlations,
     liveness: liveness(worker, staleAfterMs),
     staleMs: worker.staleMs,
+    // Fail loud: default a missing harness verdict to STALE (mirrors the typed cockpit view and the
+    // server's fail-loud assessment) so an older/cached response can't hide a stale/unknown worker.
+    harnessStale: worker.harnessStale ?? true,
+    ...(worker.harnessProtocol !== undefined ? { harnessProtocol: worker.harnessProtocol } : {}),
   };
 }
 
@@ -141,6 +145,7 @@ function workerRow(doc, worker, onDrill, onOpenWorker) {
   row.setAttribute("data-worker", worker.instance);
   row.setAttribute("data-liveness", worker.liveness);
   row.setAttribute("data-stream", worker.stream);
+  row.setAttribute("data-harness-stale", String(worker.harnessStale));
 
   const nameCell = el(doc, "td", "cockpit-td cockpit-supply-name");
   nameCell.appendChild(dot(doc, worker.liveness));
@@ -162,6 +167,19 @@ function workerRow(doc, worker, onDrill, onOpenWorker) {
     if (onDrill) drill.addEventListener("click", () => onDrill(worker.stream));
     nameCell.appendChild(drill);
   }
+  // A stale harness silently swallows machine-readable artifacts (issue #802) — surface it as a
+  // distinct badge (mirrors app/agentic/cockpit/supply-render.ts).
+  if (worker.harnessStale) {
+    const badge = el(
+      doc,
+      "span",
+      "cockpit-supply-harness-stale",
+      worker.harnessProtocol === undefined ? "stale harness" : `stale harness (v${worker.harnessProtocol})`,
+    );
+    badge.setAttribute("data-harness-stale", "true");
+    badge.setAttribute("title", "Harness protocol below the configured minimum (or none advertised); jobs may dead-end.");
+    nameCell.appendChild(badge);
+  }
   row.appendChild(nameCell);
 
   row.appendChild(el(doc, "td", "cockpit-td cockpit-supply-family", worker.family));

package/resources/processes/convergence-loop.bpmn

@@ -88,6 +88,10 @@
         <nano:shape id="PrAnswerEscalationIn" name="Answer escalation — input">
           <nano:extend name="prKey" type="string" />
           <nano:extend name="answer" type="string" optional="true" />
+          <nano:extend name="answerContext" type="string" optional="true" />
+          <nano:extend name="completedUserTaskKey" type="string" optional="true" />
+          <nano:extend name="completedCompletionId" type="integer" optional="true" />
+          <nano:extend name="escalationId" type="integer" optional="true" />
         </nano:shape>
         <nano:shape id="PrFinalizeIn" name="Mark converged — input">
           <nano:extend name="prKey" type="string" />
@@ -308,9 +312,14 @@
         <zeebe:ioMapping>
           <zeebe:input source="=prKey" target="prKey" />
           <zeebe:input source="=answer" target="answer" />
+          <zeebe:input source="=&#34;convergence&#34;" target="answerContext" />
+          <zeebe:input source="=completedUserTaskKey" target="completedUserTaskKey" />
+          <zeebe:input source="=completedCompletionId" target="completedCompletionId" />
           <zeebe:output source="=(if scopePending = true then answer else scopeAnswer)" target="scopeAnswer" />
           <zeebe:output source="=0" target="huskRetries" />
           <zeebe:output source="=false" target="reviewStale" />
+          <zeebe:output source="=null" target="completedUserTaskKey" />
+          <zeebe:output source="=null" target="completedCompletionId" />
         </zeebe:ioMapping>
       </bpmn:extensionElements>
       <bpmn:incoming>f_answerRecord</bpmn:incoming>

package/resources/processes/merge-loop.bpmn

@@ -329,6 +329,7 @@
         <zeebe:ioMapping>
           <zeebe:input source="=prKey" target="prKey" />
           <zeebe:input source="=answer" target="answer" />
+          <zeebe:input source="=&#34;merge&#34;" target="answerContext" />
         </zeebe:ioMapping>
       </bpmn:extensionElements>
       <bpmn:incoming>f_m_answerRecord</bpmn:incoming>

package/test/worldDb.ts

@@ -69,12 +69,18 @@ function gateway(db: DatabaseSync, name: string, pk: string) {
  * that decorates `table` on the returned source sees its decoration inside the transaction too. */
 type MemDataSource = {
   table: (name: string, pk?: string) => ReturnType<typeof gateway>;
+  query<T = unknown>(sql: string, params?: unknown[]): Promise<T[]>;
   tx<T>(fn: (t: MemDataSource) => Promise<T>): Promise<T>;
 };
 
 function openDataSource(db: DatabaseSync): MemDataSource {
   const ds: MemDataSource = {
     table: (name, pk = "id") => gateway(db, name, pk),
+    // The row-returning raw-SQL surface (mirrors the runtime `DataSource.query`) so tests exercise a
+    // handler's bounded `WHERE … IN (…)` reads against genuine SQLite rather than a mock.
+    async query<T = unknown>(sql: string, params: unknown[] = []): Promise<T[]> {
+      return db.prepare(sql).all(...params.map(coerce)) as T[];
+    },
     async tx(fn) {
       db.exec("BEGIN");
       try {

package/workers/answer-escalation/worker.ts

@@ -17,21 +17,26 @@
 // durable rows; it returns no variables, leaving the submitted `answer` untouched so it flows on to
 // the next review round.
 import type { AppJobHandler } from "@nanobpm/urban";
+import { generationGuard, recordAdjudication } from "../../app/adjudications.ts";
+import { taskCompletions } from "../../app/agentCompletion.ts";
 import type { WorkerInputs } from "../../nano-generated/worker-io.d.ts";
 
 interface Escalation extends Record<string, unknown> {
   id: number;
   pr_key: string;
   status: string;
+  question: string;
   answer: string | null;
   answered_at: string | null;
 }
 
 // The PR-row fields this worker reconciles when an escalation is answered. Only `status`/`updated_at`
-// are written; the rest of the row is untouched.
+// are written; the rest of the row is untouched. `process_key` is READ (never written here) to reject a
+// delayed/redelivered job from a superseded process instance (Copilot review of #806).
 interface PullRequest extends Record<string, unknown> {
   pr_key: string;
   status: string;
+  process_key: string | null;
   updated_at: string;
 }
 
@@ -42,10 +47,62 @@ type In = WorkerInputs["pr.answer-escalation"];
 function nonBlank(v: unknown): string | undefined {
   return typeof v === "string" && v.trim() !== "" ? v.trim() : undefined;
 }
+// A finite integer variable, or undefined when absent/blank/non-numeric. The `completedCompletionId`
+// envelope field is typed `integer`, so it arrives as a number; tolerate a numeric string defensively.
+function nonBlankInt(v: unknown): number | undefined {
+  if (typeof v === "number") return Number.isFinite(v) ? v : undefined;
+  if (typeof v === "string" && v.trim() !== "") {
+    const n = Number(v);
+    return Number.isFinite(n) ? n : undefined;
+  }
+  return undefined;
+}
 
 const handler: AppJobHandler<In> = async (job, app) => {
   const { prKey } = job.variables;
   const answer = nonBlank(job.variables.answer);
+  // The exact identity of the `wait-*` completion that resumed THIS token (Copilot review of #806),
+  // stamped by `completeUserTaskAttributed` on the resumed token. Used to correlate the durable
+  // adjudication to the completion the engine actually accepted; absent for an out-of-band resume.
+  const completedUserTaskKey = nonBlank(job.variables.completedUserTaskKey);
+  // The exact ledger id of the winning completion (Copilot review of #806), stamped by
+  // `completeUserTaskAttributed`. When present it uniquely identifies the winner — even against a
+  // same-answer losing racer on the same `user_task_key` — so record-answer selects that exact row
+  // rather than correlating by answer. Absent for an out-of-band resume.
+  const completedCompletionId = nonBlankInt(job.variables.completedCompletionId);
+  // The durable id of the escalation THIS completion answers (Copilot review of #806). The originating
+  // `pr.persist-escalation` returns its inserted `escalations.id` as a process variable (`EscalationOut`),
+  // which the `wait-*` completion carries through here. Answering by this exact id — rather than the
+  // newest open row — is what makes a REDELIVERED older answer safe: if the process has since opened a
+  // NEWER escalation (a different question), a stale Q1 `record-answer` whose `escalationId` no longer
+  // matches any open row is a no-op instead of misfiling Q1's answer under Q2's fingerprint and retiring
+  // Q2 unanswered. Absent for a pre-#806 / out-of-band resume — we then fall back to the newest open row.
+  const escalationId = nonBlankInt(job.variables.escalationId);
+  const prs = app.data.table<PullRequest>("pull_requests", "pr_key");
+  // Reject a delayed/redelivered job from a SUPERSEDED process instance (Copilot review of #806).
+  // `pull_requests.process_key` always tracks the CURRENT loop instance for this PR — the convergence
+  // instance at submit, reassigned to the merge instance at merge-start (app/service.ts). A job whose
+  // `processInstanceKey` no longer matches is from an old run that a re-submit (or the merge hand-off)
+  // replaced; accepting it would let a stale process reinsert its adjudication after the fresh run's
+  // reset, or even answer the new run's open escalation, so a re-submit would not be a reliable
+  // fresh-decision boundary. No-op such jobs BEFORE any adjudication/escalation/PR write. When the
+  // current process is unknown (no row / null `process_key`) we cannot classify the job as stale, so
+  // we proceed rather than silently drop a legitimate operator answer.
+  //
+  // The `process_key` is read AS LATE AS POSSIBLE — immediately before the writes below, not at handler
+  // entry — so a concurrent re-submit that advances `process_key` and resets the adjudication memory is
+  // observed here (Copilot review of #806). Paired with submitPr advancing `process_key` BEFORE it
+  // clears the memory, this shrinks the reset window to a single check-then-write step: a straggler is
+  // rejected once the new identity is installed, and any pre-advance insert is cleared by the
+  // post-advance reset.
+  const jobProcessKey = job.processInstanceKey != null ? String(job.processInstanceKey) : undefined;
+  // This one worker services BOTH loops' answer steps (`record-answer` in the convergence loop AND
+  // `record-merge-answer` in the merge loop, #256). Only a CONVERGENCE answer may feed the durable
+  // adjudication memory the convergence poller replays — a merge-loop decision recorded here would let
+  // a later convergence `wait-answer` with the same text replay a merge-context answer that was never a
+  // convergence adjudication (Copilot review of #806). The originating step stamps `answerContext` via a
+  // literal ioMapping so this reconcile can tell them apart.
+  const isConvergence = nonBlank(job.variables.answerContext) === "convergence";
   const escs = app.data.table<Escalation>("escalations", "id");
   // Retire EVERY still-open escalation for this PR. `pr.persist-escalation` always INSERTs a new
   // open row, so a retry/duplicate activation can leave more than one open — answering only the
@@ -53,24 +110,147 @@ const handler: AppJobHandler<In> = async (job, app) => {
   // is still `escalated`. Answer the newest (it carries the operator's reply) and mark any remaining
   // open rows `stale`, mirroring `submitPr`'s resubmit cleanup.
   const open = (await escs.find({ pr_key: prKey, status: "open" })).sort((a, b) => b.id - a.id);
-  if (open.length > 0) {
+  const currentProcessKey = nonBlank((await prs.find({ pr_key: prKey }))[0]?.process_key);
+  if (currentProcessKey !== undefined && jobProcessKey !== undefined && jobProcessKey !== currentProcessKey) {
+    return {};
+  }
+  // The escalation this completion actually answers. Prefer the exact `escalationId` the winning
+  // completion carried; fall back to the newest open row only when it is absent (a pre-#806 / out-of-band
+  // resume). If an `escalationId` was carried but no OPEN row bears it, this is a redelivered answer for
+  // an escalation that has already been retired (or superseded by a newer question) — no-op rather than
+  // misfile the answer under a different escalation's question (Copilot review of #806).
+  const target = escalationId != null ? open.find((e) => e.id === escalationId) : open[0];
+  if (target !== undefined) {
     const ts = new Date().toISOString();
-    await escs.update(open[0].id, {
-      answer: answer ?? null,
-      status: "answered",
-      answered_at: ts,
-    });
-    for (const dup of open.slice(1)) {
-      await escs.update(dup.id, { status: "stale" });
+    // Persist the DURABLE adjudication FIRST, BEFORE the escalation/PR rows transition off `open`
+    // (issue #806, Copilot review — crash safety). `recordAdjudication` is INSERT-if-absent idempotent,
+    // so if the worker crashes after this write but before the row transitions, a retry re-finds the
+    // still-open row and re-records a no-op; whereas recording it LAST would mean a crash in the window
+    // after the rows flip loses the adjudication entirely (the retry finds no open row and returns), so
+    // the answered question could re-escalate after restart. Scoped to convergence answers only.
+    if (isConvergence) {
+      const adjudicator = await latestAdjudicator(app, job.processInstanceKey, answer, completedUserTaskKey, completedCompletionId);
+      await recordAdjudication(app.data, {
+        prKey,
+        question: target.question,
+        answer,
+        adjudicatedBy: adjudicator?.id,
+        adjudicatedKind: adjudicator?.kind,
+        // Link the decision to the winning completion (issue #806 review) so a later revert of that
+        // completion can tombstone it even when it is a FIRST-HAND agent answer with no
+        // `source_adjudication_id`. INSERT-if-absent, so it pins to the original first-hand winner.
+        sourceCompletionId: completedCompletionId,
+        // Run generation this answer belongs to: every adjudication write is fenced on the PR's current
+        // `process_key` still matching it, so a pre-reset straggler (one that passed the check above,
+        // then paused across a re-submit that advanced `process_key` and cleared the memory) cannot
+        // resurrect a stale adjudication after the reset (issue #806, Copilot review). Undefined when the
+        // job carries no instance key — the fence then fails open, exactly like the staleness gate above.
+        expectedProcessKey: jobProcessKey,
+      });
+    }
+    // Fence the escalation/PR transitions on the run generation too (Copilot review of #806). The
+    // ownership check above is READ-TIME — not atomic with these writes — so in the window between it
+    // and here a concurrent re-submit could advance `process_key` and open a FRESH escalation; a naive
+    // `escs.update`/`prs.update` would then answer the new run's snapshot and flip its PR to
+    // `converging`. Each write is now a guarded conditional statement carrying the SAME `generationGuard`
+    // predicate as the adjudication writes (one guard, no second implementation): it applies only while
+    // the PR's current `process_key` still matches this job's generation, so a superseded worker touches
+    // nothing. Fails open when `jobProcessKey` is undefined, exactly like the gate above.
+    const db = app.data.open();
+    const guard = generationGuard(prKey, jobProcessKey);
+    await db.exec(
+      `UPDATE "escalations" SET "answer" = ?, "status" = 'answered', "answered_at" = ? WHERE "id" = ? AND ${guard.sql}`,
+      [answer ?? null, ts, target.id, ...guard.params],
+    );
+    // Mark any OTHER still-open row `stale` (a `pr.persist-escalation` retry can leave more than one
+    // open for the same question). We retire every open row except the one we just answered so a phantom
+    // `activePrs` never keeps deriving while the PR is `escalated`.
+    for (const dup of open) {
+      if (dup.id === target.id) continue;
+      await db.exec(
+        `UPDATE "escalations" SET "status" = 'stale' WHERE "id" = ? AND ${guard.sql}`,
+        [dup.id, ...guard.params],
+      );
     }
     // Move the PR off `status="escalated"` back to
     // `"converging"` now that the question is answered. Without this the row stays `escalated` (with
     // a now-null derived `openEscalation`) until the re-entered round's `persist-round` runs — a
     // `/status` inconsistency and a divergence from the merge path both loops are meant to share.
-    const prs = app.data.table<PullRequest>("pull_requests", "pr_key");
-    await prs.update(prKey, { status: "converging", updated_at: ts });
+    await db.exec(
+      `UPDATE "pull_requests" SET "status" = 'converging', "updated_at" = ? WHERE "pr_key" = ? AND ${guard.sql}`,
+      [ts, prKey, ...guard.params],
+    );
   }
   return {};
 };
 
+/** Who just completed this `wait-answer`: the `{ id, kind }` of the `task_completions` row that
+ *  actually WON the user-task race, so the durable adjudication is attributed to the completion the
+ *  engine accepted — never a losing racer's transient row NOR an older round's completion. Both
+ *  canonical completers (`completeUserTaskAttributed`) insert their ledger row BEFORE calling
+ *  `completeUserTask` and the loser only removes its row AFTER the engine rejects it, so a bare
+ *  "newest row for this process instance" can transiently select a higher-id LOSER; and because a
+ *  convergence-loop instance is REUSED across rounds, an older round's completion (or a delayed
+ *  same-answer redelivery) with a higher id can also linger for the SAME process instance (Copilot
+ *  review of #806). Correlate on the EXACT completion identity: the resumed token carries the
+ *  `completedCompletionId` — the ledger id of the exact completion the engine accepted — so the winner
+ *  is the row with that id, unambiguous even when both racers submitted the IDENTICAL answer (answer
+ *  correlation alone cannot separate two same-answer rows on one `user_task_key`; the higher-id one may
+ *  be the loser). A pre-#806-fix out-of-band resume that carried no `completedCompletionId` falls back
+ *  to the exact `completedUserTaskKey` + winning-answer correlation, and attributes ONLY when that
+ *  leaves exactly one candidate — an ambiguous same-answer set fails open rather than guess a winner.
+ *  The KIND (`human`/`agent`, ADR
+ *  0046) is preserved so a later auto-resume replays with the ORIGINAL attribution and never launders
+ *  an agent decision into a human one. `undefined` (fails open to a fresh human task) when the identity
+ *  is unavailable or no ledger row exactly matches — rather than attribute a wrong one. */
+async function latestAdjudicator(app: Parameters<AppJobHandler<In>>[1], processInstanceKey: unknown, winningAnswer: string | undefined, completedUserTaskKey: string | undefined, completedCompletionId: number | undefined): Promise<{ id: string; kind: string } | undefined> {
+  // Exact ledger-id match by PRIMARY KEY. The engine resumed this token with exactly ONE completion's
+  // variables, and that completion stamped its own (globally unique) ledger id here — so look the
+  // winner up DIRECTLY by primary key, BEFORE the process-instance fallback below. It must NOT be found
+  // via a `process_instance_key`-scoped query: the canonical completers (`completeUserTaskAttributed`)
+  // resolve the task through the typed `openUserTasks` seam, which deliberately omits `processInstanceKey`
+  // (app/service.ts), so EVERY real ledger row is stored with `process_instance_key = null`. A
+  // `process_instance_key`-filtered lookup therefore never matched the winning row and always failed
+  // open — recording a null adjudicator and letting the convergence poller re-park an already-answered
+  // question (Copilot review). Selecting nothing still returns undefined and fails open (never attribute
+  // a wrong row).
+  if (completedCompletionId != null) {
+    const exact = await taskCompletions(app.data).get(completedCompletionId);
+    return exact ? { id: exact.actor_id, kind: exact.actor_kind } : undefined;
+  }
+  // Process-instance fallback for a resume that carried no completion id (a pre-fix / out-of-band
+  // token): require the carried user-task identity, then — when the winning answer is known — keep only
+  // rows whose recorded answer matches it, dropping the same-task losing racer whose recorded submission
+  // differs. Without a completion id there is no evidence WHICH row won, so attribute ONLY when the
+  // candidate set is exactly one (Copilot review of #806): more than one same-answer row on this
+  // `user_task_key` is the very ambiguity the completion id was added to resolve — picking the newest
+  // could attribute to the losing racer — so return undefined and fail open to a human rather than guess.
+  const key = processInstanceKey != null ? String(processInstanceKey) : "";
+  if (key === "") return undefined;
+  const rows = await taskCompletions(app.data).find({ process_instance_key: key });
+  if (completedUserTaskKey == null || completedUserTaskKey === "") return undefined;
+  let candidates = rows.filter((r) => String(r.user_task_key) === completedUserTaskKey);
+  if (winningAnswer != null && winningAnswer !== "") {
+    candidates = candidates.filter((r) => completionAnswer(r.variables_json) === winningAnswer);
+  }
+  if (candidates.length !== 1) return undefined;
+  const only = candidates[0];
+  return { id: only.actor_id, kind: only.actor_kind };
+}
+
+/** The trimmed `answer` field recorded in a completion's `variables_json`, or undefined when the JSON
+ *  is unparseable or carries no string answer. Used to correlate a ledger row with the submission the
+ *  engine actually accepted (see `latestAdjudicator`). */
+function completionAnswer(variablesJson: unknown): string | undefined {
+  if (typeof variablesJson !== "string") return undefined;
+  try {
+    const parsed: unknown = JSON.parse(variablesJson);
+    if (parsed === null || typeof parsed !== "object" || !("answer" in parsed)) return undefined;
+    const answer = parsed.answer;
+    return typeof answer === "string" && answer.trim() !== "" ? answer.trim() : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 export default handler;