@nanobpm/nano-workforce 0.206.3 → 0.207.0

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## [0.207.0](https://github.com/nanobpm/nano-workforce/compare/v0.206.4...v0.207.0) (2026-11-09)
+
+### Features
+
+* **status:** surface engine incidents on loop and delivery rows with a retry action ([#938](https://github.com/nanobpm/nano-workforce/issues/938)) ([e3955c8](https://github.com/nanobpm/nano-workforce/commit/e3955c8145a966a29806400872b7a9c362d1d992)), closes [#931](https://github.com/nanobpm/nano-workforce/issues/931) [#931](https://github.com/nanobpm/nano-workforce/issues/931)
+
+## [0.206.4](https://github.com/nanobpm/nano-workforce/compare/v0.206.3...v0.206.4) (2026-11-09)
+
+### Bug Fixes
+
+* **delivery:** accept affirmative-completion aliases as producer terminal-success statuses ([#934](https://github.com/nanobpm/nano-workforce/issues/934)) ([b8c5e4e](https://github.com/nanobpm/nano-workforce/commit/b8c5e4e5cb59ce42bb2d6573e107d1865393fa27)), closes [731/#760](https://github.com/731/nano-workforce/issues/760) [nano-bpm#1337](https://github.com/nanobpm/nano-bpm/issues/1337) [#1464](https://github.com/nanobpm/nano-workforce/issues/1464) [nano-bpm#1463](https://github.com/nanobpm/nano-bpm/issues/1463) [#1476](https://github.com/nanobpm/nano-workforce/issues/1476) [#731](https://github.com/nanobpm/nano-workforce/issues/731) [#760](https://github.com/nanobpm/nano-workforce/issues/760) [#761](https://github.com/nanobpm/nano-workforce/issues/761)
+
 ## [0.206.3](https://github.com/nanobpm/nano-workforce/compare/v0.206.2...v0.206.3) (2026-11-09)
 
 ### Bug Fixes

package/SPEC.md

@@ -1289,7 +1289,9 @@ reserved — with **one exception**: an agent emitting `pr` (the canonical
 result field holds, and the retry reset correctly clears both — reserving them would
 forbid that flagship pattern. The exception is the agent completion-control **`status`**:
 the producer status gate reads that same node-local field as the node's completion status
-and accepts only `done`/`opened`/`skipped`, so an agent emit named `status` carrying any
+and accepts only the terminal-success vocabulary (`AGENT_TERMINAL_SUCCESS_STATUSES` — the
+canonical `done`/`opened`/`skipped` plus the issue-#932 affirmative-completion aliases
+`completed`/`succeeded`/`success`), so an agent emit named `status` carrying any
 other routing value (`approved`, …) always escalates, and `status="done"` can never take an
 `approved` branch — the emit contract and the gate conflict. `status` is therefore reserved
 for an **`agent`** (a connector has no producer status gate, so a connector `status` emit

package/app/deliveryGraph.test.ts

@@ -538,7 +538,7 @@ test("invalid-fact-name: an AGENT emit named `status` is reserved — the produc
   // Regression guard (PR #863 Copilot Medium "Previously missed", deliveryGraph.ts:418): the result-set
   // exemption was too broad for an agent emit named `status`. The producer status gate
   // (`agentContractProceedCondition`) interprets that same node-local field as the completion status and
-  // accepts only `done`/`opened`/`skipped`, while the emit contract may require a different routing
+  // accepts only the terminal-success vocabulary (`AGENT_TERMINAL_SUCCESS_STATUSES`), while the emit contract may require a different routing
   // value — `status="approved"` always escalates, and `status="done"` can never take an `approved`
   // branch. Unlike an aligned result fact such as `pr` (whose emit value and result field agree),
   // `status` is CONSTRAINED by the gate, so the two uses conflict. Reserve the agent completion-control

package/app/deliveryGraph.ts

@@ -458,7 +458,9 @@ export const DELIVERY_SCAFFOLDING_VARS = ["boundFacts", "nodeInputs", "nodeInput
  * correctly clears both. Reserving the whole set would forbid the flagship
  * `agent → connector[converge] → wait[pr]` pattern. The exception is the agent completion-control
  * `status`: the producer status gate reads that SAME node-local field as the node's completion status
- * and accepts only `done`/`opened`/`skipped`, so an agent emit named `status` whose routing value is
+ * and accepts only the terminal-success vocabulary (`AGENT_TERMINAL_SUCCESS_STATUSES` — the canonical
+ * `done`/`opened`/`skipped` plus the #932 affirmative-completion aliases), so an agent emit named
+ * `status` whose routing value is
  * anything else (`approved`, …) ALWAYS escalates, and `status="done"` can never take an `approved`
  * branch — the emit contract and the gate conflict. `status` is therefore reserved for an `agent`
  * (a connector has no producer status gate, so its `status` emit collides with nothing and stays

package/app/deliveryGraphCompiler.test.ts

@@ -15,7 +15,7 @@ import { test } from "node:test";
 import { assert, assertEquals } from "#test-assert";
 import type { DeliveryGraph } from "../nano-generated/api-io.d.ts";
 import { missingExternalMarkerAgentTaskTypes } from "./agentic/vocab/job-types.ts";
-import { compileDeliveryGraph, digestInvisibleRawValues, graphCarriesRedactedSecrets, nodeDisplay, redactFreeText, resumeValidVar } from "./deliveryGraphCompiler.ts";
+import { AGENT_TERMINAL_SUCCESS_STATUSES, compileDeliveryGraph, digestInvisibleRawValues, graphCarriesRedactedSecrets, nodeDisplay, redactFreeText, resumeValidVar } from "./deliveryGraphCompiler.ts";
 import { isDeliveryEscalationTwin } from "./deliveryHuman.ts";
 
 /** Compile and assert success, returning the narrowed ok-result. */
@@ -2131,7 +2131,11 @@ test("#731 producer status gate: an agent node inserts a post-completion contrac
   assert(g0, "the contract-met success flow exists");
   assert(g0![1].includes(`=${el}_contractMet = true`), "the success flow reads the node-unique contract decision");
   const cond = contractMetExpr(r.bpmn, el);
-  assert(cond.includes('list contains(["done", "opened", "skipped"], status)'), "the success flow gates on the terminal-success status allowlist");
+  // The gate's FEEL allowlist is DERIVED from the single source of truth (AGENT_TERMINAL_SUCCESS_STATUSES)
+  // — assert against the derived rendering, not a hand-copied literal, so this test can never drift from
+  // the vocabulary it guards (issue #932).
+  const derivedList = `[${AGENT_TERMINAL_SUCCESS_STATUSES.map((s) => `"${s}"`).join(", ")}]`;
+  assert(cond.includes(`list contains(${derivedList}, status)`), `the success flow gates on the derived terminal-success status allowlist, got: ${cond}`);
   assert(cond.includes("not(is defined(status)) or status = null"), "an absent/null status is not itself the failure mode — it still proceeds");
   // The contract escalation's read-only context names the node and its reported status (#731).
   const esc = escBlockForNodeSuffix(r.bpmn, "open", "contract");
@@ -2139,6 +2143,49 @@ test("#731 producer status gate: an agent node inserts a post-completion contrac
   assert(esc.includes("Reported status="), "the context surfaces the actual reported status");
 });
 
+test("#932 producer status gate: the affirmative-completion synonyms agents actually report are allowlisted terminal-success statuses, derived from one source", () => {
+  // Issue #932: agents keep self-reporting `status: "completed"` (and other unambiguous success
+  // synonyms) after FULLY delivering — every required emit present — yet the #731 gate accepted only
+  // `done`/`opened`/`skipped`, so a fully-delivered node parked on a human "Continue" escalation as a
+  // contract violation (nano-bpm#1337 → PR #1464 escalation 584376; nano-bpm#1463 → PR #1476
+  // escalation 599960). The fix is the CLASS fix: the affirmative-completion aliases are
+  // terminal-success statuses in the ONE canonical vocabulary (AGENT_TERMINAL_SUCCESS_STATUSES), which
+  // the gate's FEEL AND the #760 prompt contract both derive from. Pin the vocabulary content so a
+  // future "tidy-up" cannot silently re-narrow it (a removed synonym re-introduces the escalation).
+  for (const synonym of ["completed", "success", "succeeded"]) {
+    assert(
+      AGENT_TERMINAL_SUCCESS_STATUSES.includes(synonym),
+      `"${synonym}" — an unambiguous affirmative-completion alias agents report — must be a terminal-success status (issue #932)`,
+    );
+  }
+  // The canonical statuses stay.
+  for (const canonical of ["done", "opened", "skipped"]) {
+    assert(AGENT_TERMINAL_SUCCESS_STATUSES.includes(canonical), `the canonical "${canonical}" status stays allowlisted`);
+  }
+  // And the vocabulary remains CLOSED to ambiguous non-success reports: a failure/give-up/in-progress
+  // self-report must NEVER be normalised to success (the gate stays fail-closed for those).
+  for (const nonSuccess of ["in_progress", "blocked", "failed", "escalated", "needs_input"]) {
+    assert(
+      !AGENT_TERMINAL_SUCCESS_STATUSES.includes(nonSuccess),
+      `"${nonSuccess}" is not a success claim — it must stay OFF the terminal-success allowlist`,
+    );
+  }
+});
+
+test("#932 producer status gate: the compiled contract gate accepts a `completed` report (the observed failure) as terminal-success", async () => {
+  // The compile-level half of the #932 regression guard: the gate's FEEL allowlist (derived from
+  // AGENT_TERMINAL_SUCCESS_STATUSES) must literally contain `completed`, so a fully-delivered node
+  // reporting it passes the producer gate instead of escalating (the e2e half, in
+  // e2e/delivery-graph.e2e.ts, proves the routing end-to-end).
+  const r = await compileOk(PRODUCER_GATE);
+  const el = elementForNode(r.bpmn, "open");
+  const cond = contractMetExpr(r.bpmn, el);
+  assert(cond.includes('"completed"'), `the gate's status allowlist contains "completed", got: ${cond}`);
+  // The escalation context line names the SAME derived vocabulary (never a stale hand-typed list).
+  const esc = escBlockForNodeSuffix(r.bpmn, "open", "contract");
+  assert(esc.includes("completed"), "the escalation context names the widened vocabulary");
+});
+
 test("#731 required-emit gate: a producer's declared emit consumed as a required data dependency adds a non-null gate clause and a resumable escalation NAMING the fact", async () => {
   const r = await compileOk(PRODUCER_GATE);
   const el = elementForNode(r.bpmn, "open");

package/app/deliveryGraphCompiler.ts

@@ -254,11 +254,22 @@ export function resumeValidVar(esc: string): string {
  * and escalates AT the node instead of threading an incomplete result into a downstream consumer. An
  * ABSENT/null status passes the gate (a status-less completion — an older fleet worker or a bare test
  * stub — is not itself the failure mode; the required-emit gate still catches a missing data fact).
+ *
+ * The list deliberately includes the unambiguous AFFIRMATIVE-COMPLETION aliases agents actually report
+ * — `completed`/`success`/`succeeded` (issue #932: agents kept reporting `status: "completed"` after
+ * FULLY delivering — every required emit present — and the narrow list parked that good work on a
+ * human "Continue" escalation as a contract violation; nano-bpm#1337 → PR #1464 escalation 584376,
+ * nano-bpm#1463 → PR #1476 escalation 599960). An affirmative alias is normalised to terminal-success
+ * AT THE GATE: it routes onward exactly like `done` — the required-emit clauses still gate it, so a
+ * `completed` WITHOUT its required emits still escalates. Only UNAMBIGUOUS success claims belong here:
+ * a failure / input-required / in-progress report (`failed`, `needs_input`, `in_progress`, …) is NOT a
+ * completion claim and must NEVER be added — the gate stays fail-closed for those.
+ *
  * Sorted for the compiler's byte-identical-output determinism. Exported as the SINGLE SOURCE OF TRUTH:
  * the compiler's contract gate reads it here, and the runner's `renderProducerContract` (#760) derives
  * the agent-facing status vocabulary from the SAME list — changing it changes both the gate and the
  * prompt at once, so the two representations of the producer contract can never drift. */
-export const AGENT_TERMINAL_SUCCESS_STATUSES: readonly string[] = ["done", "opened", "skipped"];
+export const AGENT_TERMINAL_SUCCESS_STATUSES: readonly string[] = ["completed", "done", "opened", "skipped", "succeeded", "success"];
 
 /** A never-reached exhaustiveness guard: `compileNode`'s `switch` covers every allowlisted kind, so
  * the closed union narrows to `never` here. If a future kind is added to the vocabulary without a

package/app/deliveryGraphReadModel.test.ts

@@ -39,7 +39,7 @@ import { applyMigrationSet, readMigrationSetFromDisk } from "../test/migrations.
 const MIG = (name: string) => readFileSync(fileURLToPath(new URL(`../db/migrations/${name}`, import.meta.url)), "utf8");
 const PAGE = (name: string) => JSON.parse(readFileSync(fileURLToPath(new URL(`../pages/${name}`, import.meta.url)), "utf8"));
 
-const READ_MODEL_MIGRATION = "121_delivery_graph_read_model_auto_resolve.sql";
+const READ_MODEL_MIGRATION = "129_delivery_graph_read_model_incidents.sql";
 
 // A minimal in-memory DB carrying the base `delivery_graph_runs` / `pull_requests` shapes the VIEW
 // reads, plus stand-ins for the managed `<table>__tracking` derived VIEWs urban provisions at mount
@@ -53,7 +53,9 @@ function viewDb(): DatabaseSync {
        run_key TEXT PRIMARY KEY, process_key TEXT, process_definition_id TEXT, digest TEXT,
        status TEXT, side_effecting INTEGER, node_count INTEGER, human_node_count INTEGER,
        side_effect_count INTEGER, title TEXT, phase TEXT, phase_node_id TEXT, human_labels TEXT,
-       created_at TEXT, updated_at TEXT, acknowledged_at TEXT, auto_resolve_escalations INTEGER, derived_status_override TEXT);
+       created_at TEXT, updated_at TEXT, acknowledged_at TEXT, auto_resolve_escalations INTEGER,
+       incident_key TEXT, incident_type TEXT, incident_message TEXT, incident_since TEXT,
+       derived_status_override TEXT);
      CREATE TABLE pull_requests (pr_key TEXT PRIMARY KEY, root_request_key TEXT, status TEXT,
        derived_status_override TEXT);`,
   );

package/app/deliveryGraphRun.ts

@@ -56,6 +56,14 @@ export interface DeliveryGraphRun {
   /** Opt-in escalation steward (120_escalation_auto_resolutions.sql, issue #889): 1 ⇒ this run's
    * escalations are eligible for steward auto-resolution. Default 0. */
   auto_resolve_escalations: number;
+  /** Technical-incident mirror (127_delivery_graph_run_incidents.sql, issue #931), written by the
+   *  poller's `pollIncidents` pass — the delivery-side twin of the PR incident columns (017/126).
+   *  All NULL when the run's instance has no active incident; `/status` derives the `incident`
+   *  overlay from these columns (see `activeDeliveries` in app/service.ts). */
+  incident_key: string | null;
+  incident_type: string | null;
+  incident_message: string | null;
+  incident_since: string | null;
 }
 
 /** The run lifecycle. `awaiting-approval` is RESERVED but no longer produced (issue #460 moved dispatch
@@ -530,5 +538,9 @@ export function buildDeliveryGraphRunRow(input: {
     created_at: input.createdAt ?? at,
     updated_at: at,
     acknowledged_at: null,
+    incident_key: null,
+    incident_type: null,
+    incident_message: null,
+    incident_since: null,
   };
 }

package/app/deliveryRunner.test.ts

@@ -279,6 +279,25 @@ test("producer contract semantics coverage (#761 follow-up): renderProducerContr
 });
 
 
+test("#932 producer contract prompt: the affirmative-completion synonyms agents actually report are listed AND documented, so the prompt and the gate accept the same vocabulary", () => {
+  // Issue #932: agents kept reporting `status: "completed"` (and synonyms) after fully delivering and
+  // were parked on a human escalation, because the #731 gate accepted only `done`/`opened`/`skipped`
+  // and the #760 prompt told agents the same narrow list. The class fix puts the synonyms in the ONE
+  // canonical vocabulary (AGENT_TERMINAL_SUCCESS_STATUSES); the prompt contract is DERIVED from it, so
+  // the agent is now TOLD these are valid — pin that the observed aliases surface with semantics.
+  const rendered = renderProducerContract([]);
+  for (const synonym of ["completed", "success", "succeeded"]) {
+    assert(
+      rendered.includes(`- \`${synonym}\` — `),
+      `the prompt documents the "${synonym}" alias with its semantics (issue #932), got: ${rendered}`,
+    );
+  }
+  // The "do not invent a status" warning must name the widened list too (derived, never hand-typed).
+  const list = AGENT_TERMINAL_SUCCESS_STATUSES.map((s) => `\`${s}\``).join(", ");
+  assert(rendered.includes(`Any \`status\` OUTSIDE ${list}`), `the fail-closed warning names the derived allowlist, got: ${rendered}`);
+});
+
+
 test("agent node idempotency preflight (#551): every agent prompt leads with adopt-and-report guidance; non-agent nodes are untouched", async () => {
   // #551: a delivery agent node dispatches a raw retry-carrying `senior:feature` job with no
   // PR-existence guard, so a re-dispatch opened a DUPLICATE PR (instance 43077 n0 → #979/#980). The
@@ -754,3 +773,15 @@ test("the canonical `agent → converge-merge → wait[pr merged]` graph DISPATC
   assert(r.ok, `expected the canonical fact-bound wait[pr] graph to launch, got ${JSON.stringify(r)}`);
   assertEquals(r.handle.processInstanceKey, "555");
 });
+test("PR #934 producer contract prompt: no accepted status is ever cited as a forbidden example", () => {
+  // Class: the rejection sentence named `success` as invalid after it became an accepted alias, so every
+  // agent got contradictory instructions. Every accepted status must be absent from that sentence.
+  const rendered = renderProducerContract([]);
+  const rejectLine = rendered.split("\n").find((l) => l.includes("including a free-form"));
+  assert(rejectLine !== undefined, `the fail-closed warning carries rejection examples, got: ${rendered}`);
+  const examples = rejectLine.split("including a free-form")[1] ?? "";
+  for (const s of AGENT_TERMINAL_SUCCESS_STATUSES) {
+    assert(!examples.includes(`\`${s}\``), `accepted status "${s}" must not be cited as a rejected example: ${rejectLine}`);
+  }
+  assert(examples.includes("`in_progress`"), `a genuine out-of-vocabulary example remains: ${rejectLine}`);
+});

package/app/deliveryRunner.ts

@@ -495,6 +495,13 @@ const PRODUCER_STATUS_SEMANTICS: Readonly<Record<string, string>> = {
   opened: "you opened OR adopted a PR (return it in your `pr` emit if this node declares one)",
   done: "the work completed with no PR to open",
   skipped: "there was genuinely nothing to do",
+  // Issue #932: the unambiguous AFFIRMATIVE-COMPLETION aliases agents actually self-report. They are
+  // full terminal-success statuses (normalised at the gate), documented here so the prompt and the
+  // gate accept the SAME vocabulary — an agent told only `done`/`opened`/`skipped` keeps inventing
+  // `completed` and parking good work on a human escalation.
+  completed: "an alias of `done`/`opened` — the work fully completed (with its required emits populated)",
+  succeeded: "an alias of `done`/`opened` — the work fully succeeded (with its required emits populated)",
+  success: "an alias of `done`/`opened` — the work fully succeeded (with its required emits populated)",
 };
 
 /** Render the producer-completion contract auto-injected into EVERY `agent` node's `appendPrompt`
@@ -518,6 +525,11 @@ const PRODUCER_STATUS_SEMANTICS: Readonly<Record<string, string>> = {
  * contract already tells the agent to omit an undecidable routing fact. Listing every DECLARED emit
  * here instead would contradict that guidance and push agents to guess values that should stay
  * optional (#761). */
+/** Illustrative out-of-vocabulary statuses named in the producer contract's rejection sentence. Always
+ * filtered against `AGENT_TERMINAL_SUCCESS_STATUSES` at render time, so an example that later becomes an
+ * accepted alias silently drops out instead of contradicting the accepted list. */
+const PRODUCER_REJECTED_STATUS_EXAMPLES: readonly string[] = ["in_progress", "failed", "partial", "success"];
+
 export function renderProducerContract(requiredEmits: readonly DeliveryFact[]): string {
   const list = AGENT_TERMINAL_SUCCESS_STATUSES.map((s) => `\`${s}\``).join(", ");
   const semantics = AGENT_TERMINAL_SUCCESS_STATUSES.map((s) => {
@@ -530,6 +542,11 @@ export function renderProducerContract(requiredEmits: readonly DeliveryFact[]):
     }
     return `- \`${s}\` — ${doc}.`;
   });
+  // Rejection examples are FILTERED against the allowlist so the prompt can never present one status as
+  // both accepted and forbidden (PR #934 review: `success` became an alias but stayed an example).
+  const rejected = PRODUCER_REJECTED_STATUS_EXAMPLES.filter((s) => !AGENT_TERMINAL_SUCCESS_STATUSES.includes(s))
+    .map((s) => `\`${s}\``)
+    .join("/");
   const lines = [
     "",
     "",
@@ -543,7 +560,7 @@ export function renderProducerContract(requiredEmits: readonly DeliveryFact[]):
     "",
     ...semantics,
     "",
-    `Any \`status\` OUTSIDE ${list} — including a free-form \`success\`/\`in_progress\`/\`failed\` — parks the`,
+    `Any \`status\` OUTSIDE ${list} — including a free-form ${rejected} — parks the`,
     "run on a human escalation (the gate is fail-closed), EVEN when your underlying work was correct. So",
     "do not invent a status: report exactly one of the allowlisted values above.",
   ];

package/app/incidentStatus.test.ts

@@ -0,0 +1,175 @@
+// Red/green for issue #931 — an engine incident parked on a convergence loop's job must be VISIBLE
+// on the `/status` row, not hide behind a healthy-looking `status: "converging"`.
+//
+// The defect (observed on merlin, 2026-11-09): a loop whose `senior:pr-review` job exhausted its
+// retries (`JOB_NO_RETRIES`, the agent idle-timeout) sat dead for hours while `/status` reported
+// `status: "converging"`, `openEscalation: null`, `activeWorker: null` — indistinguishable from a
+// healthy queued run. `pollIncidents` mirrored the incident onto `incident_key`/`incident_message`
+// (issue #94), but the `/status` projection never READ those columns, so the only discovery path
+// was a hand-run `POST /v2/incidents/search`.
+//
+// The fix surfaces the mirrored incident on every ActivePr/ActiveDelivery row:
+//   status   — overlaid to "incident" while the row carries an ACTIVE incident (the base
+//              `pull_requests.status` workflow transient is untouched; the overlay is derived at
+//              read time so it can never wedge the status machine), and
+//   incident — { key, type, message, since }: the engine incidentKey, errorType, errorMessage and
+//              creationTime the poller mirrored, so an operator sees WHAT broke and WHEN without
+//              opening the engine.
+import { test } from "node:test";
+import { assertEquals } from "#test-assert";
+import { withTrackingViews } from "../test/trackingViews.ts";
+import { activeDeliveries, activePrs } from "./service.ts";
+
+function memTable(rows: any[], key: string) {
+  return {
+    get: (k: any) => Promise.resolve(rows.find((r) => r[key] === k) ?? null),
+    all: () => Promise.resolve([...rows]),
+    find: (q: any) =>
+      Promise.resolve(rows.filter((r) => Object.entries(q).every(([f, v]) => r[f] === v))),
+    findOne: (q: any) =>
+      Promise.resolve(rows.find((r) => Object.entries(q).every(([f, v]) => r[f] === v)) ?? null),
+    insert: (r: any) => {
+      rows.push(r);
+      return Promise.resolve(r);
+    },
+    update: (k: any, patch: any) => {
+      const r = rows.find((x) => x[key] === k);
+      if (r) Object.assign(r, patch);
+      return Promise.resolve(r);
+    },
+    delete: (k: any) => {
+      for (let i = rows.length - 1; i >= 0; i--) if (rows[i][key] === k) rows.splice(i, 1);
+      return Promise.resolve();
+    },
+  };
+}
+
+type Stores = Record<string, { rows: any[]; key: string }>;
+
+function memData(stores: Stores) {
+  return {
+    table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
+  } as any;
+}
+
+/** A fake engine whose `searchVariables` serves the given per-instance variables (none here — the
+ *  merge policy degrades to its historical default, which these tests do not exercise). */
+function fakeEngine() {
+  return {
+    searchVariables: () => Promise.resolve([]),
+  } as any;
+}
+
+function prRow(over: Record<string, unknown>) {
+  return {
+    pr_key: "owner/repo#1",
+    repo: "owner/repo",
+    number: 1,
+    url: "https://github.com/owner/repo/pull/1",
+    title: "t",
+    status: "converging",
+    current_round: 1,
+    process_key: "PI-1",
+    updated_at: "2024-01-01",
+    ...over,
+  };
+}
+
+async function statusOf(rowOver: Record<string, unknown> = {}) {
+  const stores: Stores = {
+    pull_requests: { rows: [prRow(rowOver)], key: "pr_key" },
+    user_tasks: { rows: [], key: "id" },
+  };
+  const [pr] = await activePrs(memData(stores), fakeEngine());
+  return pr;
+}
+
+test("incident surfacing: a PR row carrying an ACTIVE incident reads status 'incident', not 'converging' (the #931 defect)", async () => {
+  const pr = await statusOf({
+    incident_key: "598235",
+    incident_type: "JOB_NO_RETRIES",
+    incident_message: 'agent "nano-coder" failed: no output and no subtree progress for >= 300000ms (idle)',
+    incident_since: "2026-11-09T01:00:00.000Z",
+  });
+  assertEquals(pr.status, "incident");
+  assertEquals(pr.incident, {
+    key: "598235",
+    type: "JOB_NO_RETRIES",
+    message: 'agent "nano-coder" failed: no output and no subtree progress for >= 300000ms (idle)',
+    since: "2026-11-09T01:00:00.000Z",
+  });
+});
+
+test("incident surfacing: a healthy PR row keeps its workflow status and a null incident", async () => {
+  const pr = await statusOf({
+    incident_key: null,
+    incident_type: null,
+    incident_message: null,
+    incident_since: null,
+  });
+  assertEquals(pr.status, "converging");
+  assertEquals(pr.incident, null);
+});
+
+test("incident surfacing: the overlay applies to any live workflow status (e.g. waiting_merge), never just converging", async () => {
+  const pr = await statusOf({
+    status: "waiting_merge",
+    incident_key: "INC-9",
+    incident_type: "EXTRACT_VALUE_ERROR",
+    incident_message: "failed to evaluate expression",
+    incident_since: "2026-11-09T02:00:00.000Z",
+  });
+  assertEquals(pr.status, "incident");
+  assertEquals(pr.incident?.key, "INC-9");
+});
+
+test("incident surfacing: a delivery run carrying an ACTIVE incident reads status 'incident' with the incident block", async () => {
+  const run = {
+    run_key: "dg-1",
+    title: "ship it",
+    status: "running",
+    phase: "Running",
+    process_key: "PI-DG-1",
+    updated_at: "2024-01-01",
+    auto_resolve_escalations: 0,
+    incident_key: "INC-DG-1",
+    incident_type: "JOB_NO_RETRIES",
+    incident_message: "delivery node job exhausted retries",
+    incident_since: "2026-11-09T03:00:00.000Z",
+  };
+  const stores: Stores = {
+    delivery_graph_runs: { rows: [run], key: "run_key" },
+    user_tasks: { rows: [], key: "id" },
+  };
+  const [delivery] = await activeDeliveries(memData(stores));
+  assertEquals(delivery.status, "incident");
+  assertEquals(delivery.incident, {
+    key: "INC-DG-1",
+    type: "JOB_NO_RETRIES",
+    message: "delivery node job exhausted retries",
+    since: "2026-11-09T03:00:00.000Z",
+  });
+});
+
+test("incident surfacing: a healthy delivery run keeps its status and a null incident", async () => {
+  const run = {
+    run_key: "dg-2",
+    title: "ship it",
+    status: "running",
+    phase: "Running",
+    process_key: "PI-DG-2",
+    updated_at: "2024-01-01",
+    auto_resolve_escalations: 0,
+    incident_key: null,
+    incident_type: null,
+    incident_message: null,
+    incident_since: null,
+  };
+  const stores: Stores = {
+    delivery_graph_runs: { rows: [run], key: "run_key" },
+    user_tasks: { rows: [], key: "id" },
+  };
+  const [delivery] = await activeDeliveries(memData(stores));
+  assertEquals(delivery.status, "running");
+  assertEquals(delivery.incident, null);
+});

package/app/mcpExclusions.test.ts

@@ -31,9 +31,10 @@ function projectedOperations() {
 }
 
 // The operator-only cockpit doors: the staged delivery-graph lifecycle (stage -> dispatch ->
-// dismiss) whose approval is a human click in the cockpit (ADR 0005 Decision 7). These — and ONLY
-// these — must be excluded from the projected MCP tool surface.
-const EXPECTED_EXCLUDED = ["stageDeliveryGraph", "dispatchDeliveryGraph", "dismissProposal"];
+// dismiss) whose approval is a human click in the cockpit (ADR 0005 Decision 7), plus the
+// incident-retry remediation door (issue #931) — the human unstick action on an incident-parked
+// run. These — and ONLY these — must be excluded from the projected MCP tool surface.
+const EXPECTED_EXCLUDED = ["stageDeliveryGraph", "dispatchDeliveryGraph", "dismissProposal", "retryIncident"];
 
 // A representative set of agent-facing operations that MUST stay exposed as tools — the drive doors
 // (submit PR / epic / delivery-graph set), the pure compile/preview doors, and the read/orientation

package/app/mcpToolSurface.ts

@@ -87,8 +87,12 @@ export const FRAMEWORK_TOOL_PREFIX = "urban_debug_";
  * regression guard, not the reduction itself: the reduction an agent actually experiences comes from
  * importing {@link CURATED_MCP_TOOLS} rather than `["*"]`, and the transport-level shrink of the
  * framework tool family is tracked upstream (nano-ide#488).
+ *
+ * RAISE PROVENANCE — 60 → 61 (#931): the read-only `listIncidents` door (sibling of
+ * `listEscalations`) stays on the surface per the `x-mcp` convention that read/orient doors are
+ * exposed; its operator-only remedy `retryIncident` is excluded. Deliberate, documented growth.
  */
-export const MCP_TOOL_COUNT_BUDGET = 60;
+export const MCP_TOOL_COUNT_BUDGET = 61;
 
 /**
  * Hard CEILING on the serialized byte size of the full `tools/list` payload (the schema bytes a
@@ -138,8 +142,13 @@ export const MCP_TOOL_COUNT_BUDGET = 60;
  * intended description text (a correctness fix, not new surface). Measured 90,420 bytes serialized
  * (over the old ceiling's 920-byte headroom). Deliberate, documented growth of restored description
  * text — not schema fat.
+ *
+ * RAISE PROVENANCE — 91_000 → 92_000 (#931): the read-only `listIncidents` tool (engine-incident
+ * liveness sibling of `listEscalations`) plus the `incident` field on the status row schemas.
+ * Measured 91,069 bytes serialized (over the old ceiling's headroom). Deliberate, documented growth
+ * of a real new read surface — not schema fat.
  */
-export const MCP_SURFACE_BYTES_BUDGET = 91_000;
+export const MCP_SURFACE_BYTES_BUDGET = 92_000;
 
 /**
  * The eagerly-loaded curated subset MUST stay materially smaller than the full surface — otherwise it

package/app/pullRequestReadModel.test.ts

@@ -33,7 +33,7 @@ import {
 const MIG = (name: string) => readFileSync(fileURLToPath(new URL(`../db/migrations/${name}`, import.meta.url)), "utf8");
 const PAGE = (name: string) => JSON.parse(readFileSync(fileURLToPath(new URL(`../pages/${name}`, import.meta.url)), "utf8"));
 
-const READ_MODEL_MIGRATION = "122_pull_requests_read_model_auto_resolve.sql";
+const READ_MODEL_MIGRATION = "128_pull_requests_read_model_incidents.sql";
 
 // The real base `pull_requests` columns, in schema order — DERIVED from the migration chain (not a
 // hand-kept list that could silently omit one), used by both the drift guard and the e2e stand-in.

package/app/service.test.ts

@@ -675,6 +675,123 @@ test("pollIncidents picks the oldest incident by creationTime, sorting a missing
   assertEquals(row.incident_message, "the first fault");
 });
 
+// Issue #931: the mirror must carry the incident's `errorType` and `creationTime` (not just key +
+// message) so `/status` can show WHAT broke and SINCE WHEN, and it must cover a delivery-graph
+// run's instance too — a delivery parked on an engine incident was just as invisible as a PR.
+test("pollIncidents mirrors errorType + creationTime alongside the key/message, and clears them with the incident", async () => {
+  const row = {
+    pr_key: "owner/repo#12",
+    status: "converging",
+    process_key: "PI-12",
+    incident_key: null as string | null,
+    incident_type: null as string | null,
+    incident_message: null as string | null,
+    incident_since: null as string | null,
+    updated_at: "t0",
+  };
+  const stores: Record<string, { rows: unknown[]; key: string }> = {
+    pull_requests: { rows: [row], key: "pr_key" },
+  };
+  const data = {
+    table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
+    open: () => memOpen(stores),
+  } as any;
+  const headers = { "content-type": "application/json" };
+
+  const prevFetch = globalThis.fetch;
+  globalThis.fetch = incidentFetch({
+    "PI-12": [{
+      incidentKey: "598235",
+      errorType: "JOB_NO_RETRIES",
+      errorMessage: 'agent "nano-coder" failed: no output and no subtree progress for >= 300000ms (idle)',
+      state: "ACTIVE",
+      creationTime: "2026-11-09T01:00:00.000Z",
+    }],
+  }) as typeof fetch;
+  try {
+    await pollIncidentsImpl(data, "http://engine/v2", headers);
+  } finally {
+    globalThis.fetch = prevFetch;
+  }
+  assertEquals(row.incident_key, "598235");
+  assertEquals(row.incident_type, "JOB_NO_RETRIES");
+  assertEquals(row.incident_message, 'agent "nano-coder" failed: no output and no subtree progress for >= 300000ms (idle)');
+  assertEquals(row.incident_since, "2026-11-09T01:00:00.000Z");
+  assertEquals(row.status, "converging"); // orthogonal: the workflow transient is never touched
+
+  // Once resolved, ALL FOUR columns clear idempotently — a stale `incident_since` must not linger.
+  globalThis.fetch = incidentFetch({ "PI-12": [] }) as typeof fetch;
+  try {
+    await pollIncidentsImpl(data, "http://engine/v2", headers);
+  } finally {
+    globalThis.fetch = prevFetch;
+  }
+  assertEquals(row.incident_key, null);
+  assertEquals(row.incident_type, null);
+  assertEquals(row.incident_message, null);
+  assertEquals(row.incident_since, null);
+});
+
+test("pollIncidents mirrors an ACTIVE incident onto a delivery-graph run row, and skips a terminal run", async () => {
+  const running = {
+    run_key: "dg-1",
+    status: "running",
+    process_key: "PI-DG-1",
+    incident_key: null as string | null,
+    incident_type: null as string | null,
+    incident_message: null as string | null,
+    incident_since: null as string | null,
+    updated_at: "t0",
+  };
+  const done = {
+    run_key: "dg-2",
+    status: "done",
+    process_key: "PI-DG-2",
+    incident_key: "STALE-DG",
+    incident_type: "JOB_NO_RETRIES",
+    incident_message: "left over",
+    incident_since: "2026-11-08T00:00:00.000Z",
+    updated_at: "t0",
+  };
+  const stores: Record<string, { rows: unknown[]; key: string }> = {
+    delivery_graph_runs: { rows: [running, done], key: "run_key" },
+  };
+  const data = {
+    table: withTrackingViews((name: string, key: string) => memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
+    open: () => memOpen(stores),
+  } as any;
+  const headers = { "content-type": "application/json" };
+
+  const prevFetch = globalThis.fetch;
+  globalThis.fetch = incidentFetch({
+    "PI-DG-1": [{
+      incidentKey: "INC-DG-1",
+      errorType: "JOB_NO_RETRIES",
+      errorMessage: "delivery node job exhausted retries",
+      state: "ACTIVE",
+      creationTime: "2026-11-09T03:00:00.000Z",
+    }],
+    // A terminal run's instance is gone — the pass must never query it (the stub would serve an
+    // incident, so a query would wrongly overwrite the clearing below).
+    "PI-DG-2": [{ incidentKey: "INC-DG-2", errorMessage: "ghost", state: "ACTIVE", creationTime: "2026-11-09T04:00:00.000Z" }],
+  }) as typeof fetch;
+  try {
+    await pollIncidentsImpl(data, "http://engine/v2", headers);
+  } finally {
+    globalThis.fetch = prevFetch;
+  }
+  assertEquals(running.incident_key, "INC-DG-1");
+  assertEquals(running.incident_type, "JOB_NO_RETRIES");
+  assertEquals(running.incident_message, "delivery node job exhausted retries");
+  assertEquals(running.incident_since, "2026-11-09T03:00:00.000Z");
+  assertEquals(running.status, "running"); // orthogonal: status untouched
+  // Terminal run: the stale incident is cleared without ever consulting the engine.
+  assertEquals(done.incident_key, null);
+  assertEquals(done.incident_type, null);
+  assertEquals(done.incident_message, null);
+  assertEquals(done.incident_since, null);
+});
+
 
 // Red/green regression (nano-workforce#845 Copilot review): the convergence loop runs TWO external
 // agent task types while the PR reads `converging` — `review-round` (`senior:pr-review`) and, since