@nanobpm/nano-workforce 0.188.1 → 0.189.1

package/app/convergenceAdjudicationResume.test.ts

@@ -0,0 +1,274 @@
+// Red/green regression for issue #806 — the convergence loop must not re-escalate an already-answered
+// `wait-answer` question. When a durable adjudication exists for (this PR, this question fingerprint),
+// the poller (`pollUserTasks`) auto-resumes the parked `wait-answer` with the recorded answer through
+// the SAME `completeEscalationAsHuman` door a human uses — attributed to the prior adjudicator —
+// instead of re-parking a human (PR #800 / proc 46310: the same design question escalated at round 2
+// and again at round 13, both answered identically).
+//
+// A materially different question (no matching adjudication) still escalates normally.
+import { test } from "node:test";
+import { assertEquals } from "#test-assert";
+import type { DataLayer, EngineClient } from "@nanobpm/urban";
+import { questionFingerprint } from "./github.ts";
+import { pollUserTasks } from "./service.ts";
+
+// biome-ignore lint/suspicious/noExplicitAny: in-memory table double, mirrors pollUserTasks.test.ts
+function memData(seed: Record<string, any[]> = {}): { data: DataLayer; stores: Record<string, any[]> } {
+  // biome-ignore lint/suspicious/noExplicitAny: see above
+  const stores: Record<string, any[]> = {};
+  for (const [k, v] of Object.entries(seed)) stores[k] = v.map((r) => ({ ...r }));
+  function tbl(name: string, pk = "id") {
+    // biome-ignore lint/suspicious/noExplicitAny: see above
+    const rows = (stores[name] ??= [] as any[]);
+    // biome-ignore lint/suspicious/noExplicitAny: see above
+    const match = (r: any, where: any) => Object.entries(where).every(([k, v]) => r[k] === v);
+    return {
+      async all() {
+        return rows.slice();
+      },
+      // biome-ignore lint/suspicious/noExplicitAny: see above
+      async get(id: any) {
+        return rows.find((r) => r[pk] === id);
+      },
+      // biome-ignore lint/suspicious/noExplicitAny: see above
+      async find(where: any = {}) {
+        return rows.filter((r) => match(r, where));
+      },
+      // biome-ignore lint/suspicious/noExplicitAny: see above
+      async insert(r: any) {
+        rows.push({ ...r });
+        return r[pk];
+      },
+      // biome-ignore lint/suspicious/noExplicitAny: see above
+      async update(id: any, patch: any) {
+        const r = rows.find((row) => row[pk] === id);
+        if (r) Object.assign(r, patch);
+      },
+      // biome-ignore lint/suspicious/noExplicitAny: see above
+      async delete(id: any) {
+        const i = rows.findIndex((r) => r[pk] === id);
+        if (i >= 0) rows.splice(i, 1);
+      },
+    };
+  }
+  const data = { table: (n: string, pk?: string) => tbl(n, pk) } as unknown as DataLayer;
+  return { data, stores };
+}
+
+type FakeTask = { userTaskKey: string; elementId: string; processInstanceKey: string };
+
+/** A fake engine backing BOTH the poller's per-instance `openUserTasks({processInstanceKey})` scan AND
+ *  the `completeEscalationAsHuman` door's unfiltered `openUserTasks()` resolve. `completeUserTask`
+ *  removes the task (a resumed task is no longer open) and records the completion for assertions. */
+function fakeEngine(tasks: FakeTask[]) {
+  const open = tasks.slice();
+  const completions: { userTaskKey: string; variables: Record<string, unknown> }[] = [];
+  // Every `openUserTasks` filter seen this run, so a test can assert the auto-apply resolve scans a
+  // single instance (`{processInstanceKey}`) rather than an engine-wide unfiltered scan (issue #806).
+  const scans: (undefined | { processInstanceKey?: string; rootProcessInstanceKey?: string })[] = [];
+  const engine = {
+    openUserTasks: (filter?: { processInstanceKey?: string; rootProcessInstanceKey?: string }) => {
+      scans.push(filter);
+      return Promise.resolve(
+        open.filter((t) => {
+          if (filter?.processInstanceKey) return t.processInstanceKey === filter.processInstanceKey;
+          if (filter?.rootProcessInstanceKey) return t.processInstanceKey === filter.rootProcessInstanceKey;
+          return true;
+        }),
+      );
+    },
+    completeUserTask: (userTaskKey: string, variables: Record<string, unknown>) => {
+      const i = open.findIndex((t) => t.userTaskKey === userTaskKey);
+      if (i < 0) return Promise.reject(new Error("no such open task"));
+      open.splice(i, 1);
+      completions.push({ userTaskKey, variables });
+      return Promise.resolve();
+    },
+  } as unknown as EngineClient;
+  return { engine, completions, scans };
+}
+
+test("pollUserTasks: auto-resumes an already-answered wait-answer instead of re-parking a human (#806)", async () => {
+  const question = "Should the timeout be a boundary event or a poller sentinel?";
+  const { data, stores } = memData({
+    pull_requests: [{ pr_key: "o/r#800", status: "escalated", process_key: "rp-800", url: "https://github.com/o/r/pull/800", title: "Converge" }],
+    escalations: [{ id: 1, pr_key: "o/r#800", status: "open", question }],
+    pr_adjudications: [
+      {
+        id: 1,
+        pr_key: "o/r#800",
+        // Whitespace/case variant — the canonical fingerprint normalises it to the same key.
+        question_fingerprint: questionFingerprint(`  ${question.toUpperCase()}  `),
+        answer: "Option A: a bounded boundary event.",
+        adjudicated_by: "alice",
+        adjudicated_at: "2025-01-01T00:00:00.000Z",
+      },
+    ],
+  });
+  const { engine, completions } = fakeEngine([{ userTaskKey: "ut-800", elementId: "wait-answer", processInstanceKey: "rp-800" }]);
+
+  await pollUserTasks(data, engine);
+
+  assertEquals(completions.length, 1, "the parked wait-answer is auto-resumed");
+  assertEquals(completions[0].userTaskKey, "ut-800");
+  assertEquals(completions[0].variables.answer, "Option A: a bounded boundary event.", "resumed with the recorded answer");
+  assertEquals((stores.user_tasks ?? []).length, 0, "no wait-answer row is projected — the human is NOT re-parked");
+  const ledger = stores.task_completions ?? [];
+  assertEquals(ledger.length, 1, "the auto-resume is recorded in the completion ledger");
+  assertEquals(ledger[0].actor_id, "alice", "attributed to the prior adjudicator");
+  assertEquals(ledger[0].actor_kind, "human", "the prior adjudicator's kind is preserved (a human-settled decision)");
+  assertEquals(ledger[0].auto_applied, 1, "the replay is marked auto_applied — distinguishable from a first-hand submission");
+  assertEquals(ledger[0].reversible, 1, "an auto-applied replay is human-overridable");
+});
+
+test("pollUserTasks: auto-resume PRESERVES an agent adjudicator's kind and stays reversible (#806 review)", async () => {
+  // A prior AGENT-settled adjudication (ADR 0046) must replay as an agent completion, never laundered
+  // into an irreversible human authority — the whole point of recording `adjudicated_kind`.
+  const question = "Which retry cap should the husk loop use?";
+  const { data, stores } = memData({
+    pull_requests: [{ pr_key: "o/r#801", status: "escalated", process_key: "rp-801", url: "https://github.com/o/r/pull/801", title: "Converge" }],
+    escalations: [{ id: 1, pr_key: "o/r#801", status: "open", question }],
+    pr_adjudications: [
+      {
+        id: 1,
+        pr_key: "o/r#801",
+        question_fingerprint: questionFingerprint(question),
+        answer: "Cap at 3.",
+        adjudicated_by: "senior-agent",
+        adjudicated_kind: "agent",
+        adjudicated_at: "2025-01-01T00:00:00.000Z",
+      },
+    ],
+  });
+  const { engine, completions } = fakeEngine([{ userTaskKey: "ut-801", elementId: "wait-answer", processInstanceKey: "rp-801" }]);
+
+  await pollUserTasks(data, engine);
+
+  assertEquals(completions.length, 1, "the parked wait-answer is auto-resumed");
+  const ledger = stores.task_completions ?? [];
+  assertEquals(ledger[0].actor_kind, "agent", "the agent adjudicator's kind is preserved — not laundered into a human");
+  assertEquals(ledger[0].actor_id, "senior-agent");
+  assertEquals(ledger[0].auto_applied, 1, "still marked auto_applied");
+  assertEquals(ledger[0].reversible, 1, "still reversible — a human may override the replayed agent answer");
+});
+
+test("pollUserTasks: a DIFFERENT question with no adjudication still escalates to a human (#806)", async () => {
+  const { data, stores } = memData({
+    pull_requests: [{ pr_key: "o/r#800", status: "escalated", process_key: "rp-800", url: "https://github.com/o/r/pull/800", title: "Converge" }],
+    escalations: [{ id: 1, pr_key: "o/r#800", status: "open", question: "A brand-new question nobody has answered." }],
+    pr_adjudications: [
+      {
+        id: 1,
+        pr_key: "o/r#800",
+        question_fingerprint: questionFingerprint("Some other, already-settled question."),
+        answer: "Prior answer.",
+        adjudicated_by: "alice",
+        adjudicated_at: "2025-01-01T00:00:00.000Z",
+      },
+    ],
+  });
+  const { engine, completions } = fakeEngine([{ userTaskKey: "ut-800", elementId: "wait-answer", processInstanceKey: "rp-800" }]);
+
+  await pollUserTasks(data, engine);
+
+  assertEquals(completions.length, 0, "no auto-resume — the question is materially different");
+  const rows = stores.user_tasks ?? [];
+  assertEquals(rows.length, 1, "the new question is projected for a human to answer");
+  assertEquals(rows[0].user_task_key, "ut-800");
+  assertEquals(rows[0].question, "A brand-new question nobody has answered.");
+});
+
+test("pollUserTasks: an adjudication with UNKNOWN provenance fails open to a human, not a synthetic actor (#806 review)", async () => {
+  // A settled row whose `adjudicated_by` is blank (completed out of band, so `latestAdjudicator`
+  // returned no actor) must NOT be auto-replayed as a manufactured `human` actor — that would audit an
+  // unknown-provenance replay as a first-hand human decision. It fails open to a fresh human task.
+  const question = "Should the cache be write-through or write-back?";
+  const { data, stores } = memData({
+    pull_requests: [{ pr_key: "o/r#802", status: "escalated", process_key: "rp-802", url: "https://github.com/o/r/pull/802", title: "Converge" }],
+    escalations: [{ id: 1, pr_key: "o/r#802", status: "open", question }],
+    pr_adjudications: [
+      {
+        id: 1,
+        pr_key: "o/r#802",
+        question_fingerprint: questionFingerprint(question),
+        answer: "Write-through.",
+        adjudicated_by: null,
+        adjudicated_kind: null,
+        adjudicated_at: "2025-01-01T00:00:00.000Z",
+      },
+    ],
+  });
+  const { engine, completions } = fakeEngine([{ userTaskKey: "ut-802", elementId: "wait-answer", processInstanceKey: "rp-802" }]);
+
+  await pollUserTasks(data, engine);
+
+  assertEquals(completions.length, 0, "no auto-resume — a synthetic human actor is never manufactured");
+  const rows = stores.user_tasks ?? [];
+  assertEquals(rows.length, 1, "the question projects for a human to answer (fail-open)");
+  assertEquals(rows[0].user_task_key, "ut-802");
+});
+
+test("pollUserTasks: a transient adjudication-lookup error fails open and never aborts the pass (#806 review)", async () => {
+  // The adjudication LOOKUP is inside the fail-open try, so a transient `pr_adjudications.find` error
+  // must NOT reject `project`/abort `pollUserTasks` — the task still projects and reaches a human.
+  const question = "Should retries be capped?";
+  const { data, stores } = memData({
+    pull_requests: [{ pr_key: "o/r#803", status: "escalated", process_key: "rp-803", url: "https://github.com/o/r/pull/803", title: "Converge" }],
+    escalations: [{ id: 1, pr_key: "o/r#803", status: "open", question }],
+  });
+  const base = data.table.bind(data);
+  const failing = {
+    table(name: string, pk?: string) {
+      const t = base(name, pk);
+      if (name === "pr_adjudications") {
+        return { ...t, find: () => Promise.reject(new Error("transient db error")) };
+      }
+      return t;
+    },
+  } as unknown as DataLayer;
+  const { engine, completions } = fakeEngine([{ userTaskKey: "ut-803", elementId: "wait-answer", processInstanceKey: "rp-803" }]);
+
+  await pollUserTasks(failing, engine);
+
+  assertEquals(completions.length, 0, "no auto-resume on a lookup error");
+  const rows = stores.user_tasks ?? [];
+  assertEquals(rows.length, 1, "the task still projects — the poller did not abort (fail-open)");
+  assertEquals(rows[0].user_task_key, "ut-803");
+});
+
+test("pollUserTasks: auto-resume resolves the task per-instance, never an engine-wide scan (#806 review)", async () => {
+  // Copilot review of #806: `completeEscalationAutoApplied` -> `resolveEscalationTask` used an
+  // UNFILTERED `openUserTasks()` scan, run once per already-adjudicated PR in a single poll pass — so
+  // N parked-and-answered PRs cost N full engine scans (O(N²) work/REST). The poller already knows each
+  // task's owning instance, so the resolve must scan THAT instance (`{processInstanceKey}`) only. Seed
+  // several answered PRs and assert the pass issues ZERO unfiltered scans.
+  const q = "Boundary event or poller sentinel?";
+  const prKeys = ["o/r#810", "o/r#811", "o/r#812"];
+  const { data } = memData({
+    pull_requests: prKeys.map((pr_key, i) => ({
+      pr_key,
+      status: "escalated",
+      process_key: `rp-81${i}`,
+      url: `https://github.com/o/r/pull/81${i}`,
+      title: "Converge",
+    })),
+    escalations: prKeys.map((pr_key, i) => ({ id: i + 1, pr_key, status: "open", question: q })),
+    pr_adjudications: prKeys.map((pr_key, i) => ({
+      id: i + 1,
+      pr_key,
+      question_fingerprint: questionFingerprint(q),
+      answer: "Option A: a bounded boundary event.",
+      adjudicated_by: "alice",
+      adjudicated_at: "2025-01-01T00:00:00.000Z",
+    })),
+  });
+  const { engine, completions, scans } = fakeEngine(
+    prKeys.map((_, i) => ({ userTaskKey: `ut-81${i}`, elementId: "wait-answer", processInstanceKey: `rp-81${i}` })),
+  );
+
+  await pollUserTasks(data, engine);
+
+  assertEquals(completions.length, 3, "all three answered wait-answers auto-resume");
+  const unfiltered = scans.filter((f) => !f?.processInstanceKey && !f?.rootProcessInstanceKey);
+  assertEquals(unfiltered.length, 0, "no engine-wide (unfiltered) openUserTasks scan — the resolve is per-instance");
+});

package/app/github.ts

@@ -240,6 +240,16 @@ export function advisoryStableKey(path: string, text: string): string {
   return `${path.trim()}#${fingerprint(normalizeAdvisoryText(text))}`;
 }
 
+/** The line-stable fingerprint of a convergence escalation QUESTION (issue #806): the SAME canonical
+ * `normalizeAdvisoryText` + `fingerprint` digest advisory acks key on, applied to the escalation's
+ * question text. Reuses the ONE normaliser/fingerprint pair (no second implementation) so a durable
+ * wait-answer adjudication keyed by `(prKey, questionFingerprint)` is byte/semantic-stable the exact
+ * disciplined way an advisory ack is — only a semantically-identical, already-answered question is
+ * suppressed; a materially different question keys differently and still escalates. */
+export function questionFingerprint(text: string): string {
+  return fingerprint(normalizeAdvisoryText(text));
+}
+
 /** Parse Copilot's suppressed / low-confidence advisories out of a review body. Copilot renders them
  * under a `<summary>Suppressed comments (N)</summary>` block, each as a bold `**path:line**` header
  * followed by the advisory prose. Returns de-duplicated advisories (empty when there is no block). */

package/app/harnessProtocol.test.ts

@@ -0,0 +1,170 @@
+// Tests for the harness-protocol enrolment gate (issue #802) — the env knobs, the staleness
+// derivation, and the durable registry over `worker_harness_protocol` (migration 107).
+import { test } from "node:test";
+import { assert, assertEquals } from "#test-assert";
+import {
+  assessWorkers,
+  assessWorkersWithAvailability,
+  HarnessProtocolRegistry,
+  isStaleProtocol,
+  minHarnessProtocol,
+  staleHarnessPolicy,
+} from "./harnessProtocol.ts";
+import { memDataFor } from "../test/worldDb.ts";
+
+const MIGRATIONS = ["107_worker_harness_protocol.sql"];
+
+test("minHarnessProtocol defaults to 1 and reads the declared env knob", () => {
+  assertEquals(minHarnessProtocol({}), 1);
+  assertEquals(minHarnessProtocol({ NANO_AGENTIC_MIN_HARNESS_PROTOCOL: "3" }), 3);
+  // A malformed/blank value degrades to the default rather than NaN-poisoning the gate.
+  assertEquals(minHarnessProtocol({ NANO_AGENTIC_MIN_HARNESS_PROTOCOL: "nonsense" }), 1);
+});
+
+test("minHarnessProtocol rejects parseInt-lenient values (Copilot #802): '3junk'/'1.9'/blank → default", () => {
+  // `Number.parseInt` would accept "3junk" (→ 3) and truncate "1.9" (→ 1); a strict integer parse
+  // degrades all of these to the registered default so a malformed knob never silently shifts the gate.
+  assertEquals(minHarnessProtocol({ NANO_AGENTIC_MIN_HARNESS_PROTOCOL: "3junk" }), 1);
+  assertEquals(minHarnessProtocol({ NANO_AGENTIC_MIN_HARNESS_PROTOCOL: "1.9" }), 1);
+  assertEquals(minHarnessProtocol({ NANO_AGENTIC_MIN_HARNESS_PROTOCOL: "" }), 1);
+  assertEquals(minHarnessProtocol({ NANO_AGENTIC_MIN_HARNESS_PROTOCOL: "  " }), 1);
+  assertEquals(minHarnessProtocol({ NANO_AGENTIC_MIN_HARNESS_PROTOCOL: "-2" }), 1);
+  // A clean integer (with surrounding whitespace) still parses.
+  assertEquals(minHarnessProtocol({ NANO_AGENTIC_MIN_HARNESS_PROTOCOL: " 4 " }), 4);
+  assertEquals(minHarnessProtocol({ NANO_AGENTIC_MIN_HARNESS_PROTOCOL: "0" }), 0);
+});
+
+test("staleHarnessPolicy defaults to flag; only the exact 'refuse' token opts into refusal", () => {
+  assertEquals(staleHarnessPolicy({}), "flag");
+  assertEquals(staleHarnessPolicy({ NANO_AGENTIC_STALE_HARNESS_POLICY: "refuse" }), "refuse");
+  assertEquals(staleHarnessPolicy({ NANO_AGENTIC_STALE_HARNESS_POLICY: "  REFUSE " }), "refuse");
+  assertEquals(staleHarnessPolicy({ NANO_AGENTIC_STALE_HARNESS_POLICY: "flagg" }), "flag");
+});
+
+test("isStaleProtocol: absent version is stale; below-minimum is stale; at-or-above is healthy", () => {
+  assertEquals(isStaleProtocol(undefined, 1), true, "no version advertised = stale");
+  assertEquals(isStaleProtocol(null, 1), true, "null version = stale");
+  assertEquals(isStaleProtocol(0, 1), true, "below minimum = stale");
+  assertEquals(isStaleProtocol(1, 1), false, "at minimum = healthy");
+  assertEquals(isStaleProtocol(5, 1), false, "above minimum = healthy");
+});
+
+test("registry records the advertised protocol and reads it back (idempotent upsert)", async () => {
+  const { data } = memDataFor(MIGRATIONS);
+  const reg = new HarnessProtocolRegistry(data);
+  await reg.recordEnrolment("wk-1", 2);
+  assertEquals(await reg.protocolFor("wk-1"), 2);
+  // Re-enrol overwrites (upsert keyed by instance).
+  await reg.recordEnrolment("wk-1", 4);
+  assertEquals(await reg.protocolFor("wk-1"), 4);
+});
+
+test("a downgrade re-enrol WITHOUT a version clears a stale-healthy value to absent (stale)", async () => {
+  const { data } = memDataFor(MIGRATIONS);
+  const reg = new HarnessProtocolRegistry(data);
+  await reg.recordEnrolment("wk-1", 3);
+  assertEquals(await reg.protocolFor("wk-1"), 3);
+  await reg.recordEnrolment("wk-1", undefined);
+  assertEquals(await reg.protocolFor("wk-1"), undefined, "stale-healthy value cleared to NULL");
+});
+
+test("a blank/whitespace instance is a no-op (no unreachable/colliding row)", async () => {
+  const { data } = memDataFor(MIGRATIONS);
+  const reg = new HarnessProtocolRegistry(data);
+  await reg.recordEnrolment("   ", 2);
+  assertEquals((await reg.all()).size, 0);
+});
+
+test("assessWorkers: flags absent/below-min as stale, at-or-above as healthy (canonical derivation)", async () => {
+  const { data } = memDataFor(MIGRATIONS);
+  const reg = new HarnessProtocolRegistry(data);
+  await reg.recordEnrolment("healthy", 2);
+  await reg.recordEnrolment("old", 0);
+  await reg.recordEnrolment("versionless", undefined);
+  // "never-enrolled" has no row at all.
+  const out = await assessWorkers(data, ["healthy", "old", "versionless", "never-enrolled"], {
+    NANO_AGENTIC_MIN_HARNESS_PROTOCOL: "1",
+  });
+  assertEquals(out.get("healthy"), { instance: "healthy", harnessProtocol: 2, stale: false });
+  assertEquals(out.get("old"), { instance: "old", harnessProtocol: 0, stale: true });
+  assertEquals(out.get("versionless"), { instance: "versionless", stale: true });
+  assertEquals(out.get("never-enrolled"), { instance: "never-enrolled", stale: true });
+});
+
+test("protocolsFor: one bounded IN query maps each ORIGINAL key back, skips blanks, short-circuits empty", async () => {
+  // The hot-path read is a single bounded `WHERE instance IN (…)` over the live set (not a per-worker
+  // findOne / O(history) scan): assert it maps each key back correctly and handles the edge sets.
+  const { data } = memDataFor(MIGRATIONS);
+  const reg = new HarnessProtocolRegistry(data);
+  await reg.recordEnrolment("a", 3);
+  await reg.recordEnrolment("b", undefined); // NULL row → undefined
+  // "c" never enrolled.
+  const got = await reg.protocolsFor(["a", "b", "c", "   "]);
+  assertEquals(got.get("a"), 3);
+  assertEquals(got.get("b"), undefined);
+  assertEquals(got.get("c"), undefined);
+  assertEquals(got.has("   "), false, "a blank instance keys no row and is skipped");
+  // An empty (or all-blank) set short-circuits without issuing an `IN ()` query.
+  assertEquals((await reg.protocolsFor([])).size, 0);
+  assertEquals((await reg.protocolsFor(["  "])).size, 0);
+});
+
+test("protocolsFor chunks past SQLite's host-parameter cap (a large fleet does not overflow one IN query)", async () => {
+  // A fleet larger than a single IN(…) batch must still resolve every key: the read is chunked under
+  // SQLite's ~999 host-parameter floor, so scale never throws (which the caller would mislabel as a
+  // fleet-wide outage marking everyone stale). Exercise > 900 (two batches) plus a boundary key.
+  const { data } = memDataFor(MIGRATIONS);
+  const reg = new HarnessProtocolRegistry(data);
+  const instances: string[] = [];
+  for (let i = 0; i < 1500; i++) {
+    const id = `wk-${i}`;
+    instances.push(id);
+    if (i % 2 === 0) await reg.recordEnrolment(id, 2); // even = enrolled@2, odd = never enrolled
+  }
+  const got = await reg.protocolsFor(instances);
+  assertEquals(got.size, 1500, "every requested key is mapped back across batches");
+  assertEquals(got.get("wk-0"), 2);
+  assertEquals(got.get("wk-900"), 2, "a key in the second batch still resolves");
+  assertEquals(got.get("wk-1"), undefined, "a never-enrolled key reads back undefined");
+  assertEquals(got.get("wk-1499"), undefined);
+});
+
+test("assessWorkers with no data layer treats every worker as stale (fail loud)", async () => {
+  const out = await assessWorkers(undefined, ["a", "b"]);
+  assertEquals(out.get("a")?.stale, true);
+  assertEquals(out.get("b")?.stale, true);
+  assert(!("harnessProtocol" in (out.get("a") ?? {})), "no protocol known without a registry");
+});
+
+test("assessWorkersWithAvailability: registryAvailable is true on a successful read, false without a data layer", async () => {
+  const { data } = memDataFor(MIGRATIONS);
+  await new HarnessProtocolRegistry(data).recordEnrolment("healthy", 2);
+  const ok = await assessWorkersWithAvailability(data, ["healthy"], { NANO_AGENTIC_MIN_HARNESS_PROTOCOL: "1" });
+  assertEquals(ok.registryAvailable, true);
+  assertEquals(ok.assessments.get("healthy")?.stale, false);
+
+  const noData = await assessWorkersWithAvailability(undefined, ["healthy"]);
+  assertEquals(noData.registryAvailable, false, "no data layer = registry could not be consulted");
+  assertEquals(noData.assessments.get("healthy")?.stale, true, "still fails loud per-worker");
+});
+
+test("assessWorkersWithAvailability: a registry read outage reports registryAvailable=false (not silent all-stale)", async () => {
+  // A legacy DB predating migration 107: the table is absent, so the bounded read throws and is caught.
+  const { data } = memDataFor([]);
+  const res = await assessWorkersWithAvailability(data, ["a", "b"]);
+  assertEquals(res.registryAvailable, false, "read failure surfaces as unavailable, distinct from all-healthy");
+  assertEquals(res.assessments.get("a")?.stale, true, "assessments still fail loud");
+});
+
+test("protocolsFor reads only the requested instances (bounded), not the whole history", async () => {
+  const { data } = memDataFor(MIGRATIONS);
+  const reg = new HarnessProtocolRegistry(data);
+  await reg.recordEnrolment("live-1", 2);
+  await reg.recordEnrolment("live-2", undefined);
+  await reg.recordEnrolment("disconnected-history", 3);
+  const scoped = await reg.protocolsFor(["live-1", "live-2", "never-enrolled"]);
+  assertEquals(scoped.get("live-1"), 2);
+  assertEquals(scoped.get("live-2"), undefined, "an enrolled-but-versionless row reads as undefined");
+  assertEquals(scoped.get("never-enrolled"), undefined, "an absent row reads as undefined");
+  assertEquals(scoped.has("disconnected-history"), false, "a historical instance outside the live set is never read");
+});