@nanobpm/nano-workforce 0.32.1 → 0.33.0

package/CHANGELOG.md

@@ -1,3 +1,23 @@
+# [0.33.0](https://github.com/nanobpm/nano-workforce/compare/v0.32.2...v0.33.0) (2026-08-09)
+
+
+### Bug Fixes
+
+* **pages:** move the epic submission form to the Epic tab ([#97](https://github.com/nanobpm/nano-workforce/issues/97)) ([da6db32](https://github.com/nanobpm/nano-workforce/commit/da6db32438d8b9fd9c04fea08ffe1f981728f314))
+
+
+### Features
+
+* **ops:** add GET /app/version endpoint for runtime identity ([#98](https://github.com/nanobpm/nano-workforce/issues/98)) ([538cf61](https://github.com/nanobpm/nano-workforce/commit/538cf615cf0f9b34cdb6417346e045fc6131423e))
+* **pages:** link status column to the process explorer ([#99](https://github.com/nanobpm/nano-workforce/issues/99)) ([7f19a29](https://github.com/nanobpm/nano-workforce/commit/7f19a298b4c8c427c593a9d71181192bcac4a896))
+
+## [0.32.2](https://github.com/nanobpm/nano-workforce/compare/v0.32.1...v0.32.2) (2026-08-09)
+
+
+### Bug Fixes
+
+* heal missing pull_requests FK parent before child writes ([#93](https://github.com/nanobpm/nano-workforce/issues/93)) ([896c1f7](https://github.com/nanobpm/nano-workforce/commit/896c1f7a71098463c581816ffc2821af196f779e)), closes [owner/repo#N](https://github.com/owner/repo/issues/N)
+
 ## [0.32.1](https://github.com/nanobpm/nano-workforce/compare/v0.32.0...v0.32.1) (2026-08-09)
 
 

package/actions/version.test.ts

@@ -0,0 +1,85 @@
+// Tests for GET /app/version (version/identity endpoint).
+import { assert, assertEquals } from "jsr:@std/assert@1";
+import type { AppApi } from "@nanobpm/urban";
+import handler from "./version.ts";
+import { buildVersionInfo } from "../app/version.ts";
+
+// deno-lint-ignore no-explicit-any
+const app = {} as any as AppApi;
+
+function req(method: string, headers: Record<string, string> = {}) {
+  return {
+    method,
+    path: "/app/version",
+    query: new URLSearchParams(),
+    headers: new Headers(headers),
+    text: async () => "",
+  };
+}
+
+async function call(method: string, headers: Record<string, string> = {}) {
+  // deno-lint-ignore no-explicit-any
+  const res = await handler({ req: req(method, headers) as any, body: undefined }, app);
+  // deno-lint-ignore no-explicit-any
+  return res as any;
+}
+
+Deno.test("GET returns 200 with the app identity", async () => {
+  const res = await call("GET");
+  assertEquals(res.status, 200);
+  assertEquals(res.body.name, "nano-workforce");
+  // These are always present; their values are environment-dependent so we only assert shape.
+  assert("version" in res.body);
+  assert("urbanVersion" in res.body);
+  assert("gitSha" in res.body);
+  assert("gitBranch" in res.body);
+  assert(typeof res.body.runtime === "string" && res.body.runtime.length > 0);
+  assert(typeof res.body.startedAt === "string");
+  assert(typeof res.body.uptimeSeconds === "number");
+});
+
+Deno.test("non-GET is rejected with 405", async () => {
+  const res = await call("POST");
+  assertEquals(res.status, 405);
+});
+
+Deno.test("shared-secret guard rejects a missing/wrong secret when configured", async () => {
+  const prev = Deno.env.get("NANO_PR_WEBHOOK_SECRET");
+  Deno.env.set("NANO_PR_WEBHOOK_SECRET", "s3cr3t");
+  try {
+    // The handler binds SECRET at import time, so a freshly-imported module is needed to observe
+    // the guard. Import a cache-busted copy so this test is independent of import order.
+    const mod = await import(`./version.ts?guard=${Date.now()}`);
+    const guarded = mod.default as typeof handler;
+    // deno-lint-ignore no-explicit-any
+    const bad = (await guarded({ req: req("GET") as any, body: undefined }, app)) as any;
+    assertEquals(bad.status, 401);
+    // deno-lint-ignore no-explicit-any
+    const ok = (await guarded(
+      // deno-lint-ignore no-explicit-any
+      { req: req("GET", { "x-hook-secret": "s3cr3t" }) as any, body: undefined },
+      app,
+    )) as any;
+    assertEquals(ok.status, 200);
+  } finally {
+    if (prev === undefined) Deno.env.delete("NANO_PR_WEBHOOK_SECRET");
+    else Deno.env.set("NANO_PR_WEBHOOK_SECRET", prev);
+  }
+});
+
+Deno.test("buildVersionInfo is side-effect free and stable in shape", () => {
+  const a = buildVersionInfo();
+  const b = buildVersionInfo();
+  assertEquals(a.name, b.name);
+  assertEquals(Object.keys(a).sort(), [
+    "gitBranch",
+    "gitSha",
+    "name",
+    "pid",
+    "runtime",
+    "startedAt",
+    "uptimeSeconds",
+    "urbanVersion",
+    "version",
+  ]);
+});

package/actions/version.ts

@@ -0,0 +1,25 @@
+// GET /app/version — the running app's identity (ADR: version endpoint for debugging).
+//
+// Answers "which code is this process actually running?" — the app version, the resolved
+// `@nanobpm/urban` runtime version, the git commit/branch of the working tree, the JS runtime,
+// pid, and how long it has been up. Because the app runs its `.ts` sources directly from a
+// checkout with no build step, restarts alone don't tell you whether the fix you shipped is live;
+// this endpoint does.
+//
+// Read-only and unauthenticated by design (no secrets in the payload); it mirrors the open
+// posture of the pages surface. Optional shared-secret guard when NANO_PR_WEBHOOK_SECRET is set,
+// mirroring /app/status.
+import type { ActionHandler } from "@nanobpm/urban";
+import { buildVersionInfo } from "../app/version.ts";
+
+const SECRET = process.env.NANO_PR_WEBHOOK_SECRET ?? "";
+
+const handler: ActionHandler = ({ req }) => {
+  if (req.method !== "GET") return { status: 405, body: { error: "method not allowed (use GET)" } };
+  if (SECRET && req.headers.get("x-hook-secret") !== SECRET) {
+    return { status: 401, body: { error: "unauthorized" } };
+  }
+  return { status: 200, body: buildVersionInfo() };
+};
+
+export default handler;

package/app/abandon.test.ts

@@ -3,6 +3,7 @@ import { assertEquals, assertNotEquals } from "jsr:@std/assert@1";
 import type { DataLayer } from "@nanobpm/urban";
 import {
   abandonStatusForToken,
+  abandonTokenFromUrl,
   abandonUrl,
   isAbandoned,
   mintAbandonToken,
@@ -61,6 +62,21 @@ Deno.test("abandonUrl carries the token on the query string (url-encoded)", () =
   );
 });
 
+Deno.test("abandonTokenFromUrl round-trips the token minted into an abandonUrl", () => {
+  const tok = mintAbandonToken();
+  assertEquals(abandonTokenFromUrl(abandonUrl(tok, "https://host")), tok);
+  // url-special tokens survive the encode/decode round-trip too.
+  assertEquals(abandonTokenFromUrl(abandonUrl("tok+/=", "https://host")), "tok+/=");
+});
+
+Deno.test("abandonTokenFromUrl returns undefined for absent/tokenless/garbage input", () => {
+  assertEquals(abandonTokenFromUrl(undefined), undefined);
+  assertEquals(abandonTokenFromUrl(null), undefined);
+  assertEquals(abandonTokenFromUrl(""), undefined);
+  assertEquals(abandonTokenFromUrl("https://host/hooks/abandon"), undefined, "no token param");
+  assertEquals(abandonTokenFromUrl("not a url"), undefined, "unparseable input never throws");
+});
+
 Deno.test("renderAbandonBrief embeds the concrete URL and the stop contract", () => {
   const brief = renderAbandonBrief("https://host/hooks/abandon?token=tok");
   assertEquals(brief.includes("https://host/hooks/abandon?token=tok"), true);

package/app/abandon.ts

@@ -44,6 +44,21 @@ export function abandonUrl(token: string, base: string = publicBaseUrl()): strin
   return `${base}/hooks/abandon?token=${encodeURIComponent(token)}`;
 }
 
+/** Recover the capability token from an abandon URL — the inverse of `abandonUrl`. Returns
+ * undefined when the input is absent or carries no `token` query param. A desync-heal uses this to
+ * reconstruct a missing `pull_requests` row with the SAME token the running agent was already
+ * handed (via the `abandonUrl` process variable), so its `curl -f "…/hooks/abandon?token=…"` abort
+ * check keeps resolving instead of 404-ing on a freshly-minted token and aborting a live run. */
+export function abandonTokenFromUrl(url: string | null | undefined): string | undefined {
+  if (!url) return undefined;
+  try {
+    const t = new URL(url).searchParams.get("token");
+    return t || undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 /** Resolve an abandon token back to its PR key, or undefined when the token is unknown. */
 export async function prKeyForAbandonToken(
   data: DataLayer,

package/app/ensure-pr.test.ts

@@ -0,0 +1,117 @@
+// Tests for ensurePr — the idempotent, race-safe heal that reconstructs a missing
+// `pull_requests` FK parent before a child (`rounds`/`escalations`/`merges`) insert, so an
+// engine/app.db store desync never parks an opaque `FOREIGN KEY constraint failed` incident
+// (observed on convergence-loop instance 94).
+import { assert, assertEquals } from "jsr:@std/assert@1";
+import type { DataLayer } from "@nanobpm/urban";
+import { canonicalPrUrl, ensurePr } from "./service.ts";
+
+// A tiny in-memory DataLayer backing only the `.get`/`.insert` surface ensurePr uses. `insert`
+// can be made to throw to exercise the race guard, optionally after seeding the row so the
+// post-throw `.get` sees it.
+function memData(opts: { throwOnInsert?: boolean; seedOnThrow?: boolean } = {}): {
+  data: DataLayer;
+  rows: Map<string, Record<string, unknown>>;
+  insertCalls: number;
+} {
+  const rows = new Map<string, Record<string, unknown>>();
+  let insertCalls = 0;
+  function tbl(name: string, key: string) {
+    return {
+      // deno-lint-ignore require-await
+      async get(id: string) {
+        return rows.get(id);
+      },
+      // deno-lint-ignore no-explicit-any require-await
+      async insert(row: any) {
+        insertCalls++;
+        if (opts.throwOnInsert) {
+          if (opts.seedOnThrow) rows.set(row[key], { ...row });
+          throw new Error("FOREIGN KEY constraint failed");
+        }
+        rows.set(row[key], { ...row });
+        return row[key];
+      },
+    };
+  }
+  // deno-lint-ignore no-explicit-any
+  const data = { table: (n: string, k: string) => tbl(n, k) } as any as DataLayer;
+  return { data, rows, get insertCalls() {
+    return insertCalls;
+  } };
+}
+
+Deno.test("ensurePr is a no-op when the parent already exists", async () => {
+  const mem = memData();
+  const { data, rows } = mem;
+  rows.set("o/r#1", { pr_key: "o/r#1", status: "converging" });
+  const before = { ...rows.get("o/r#1") };
+  await ensurePr(data, { prKey: "o/r#1", repo: "o/r", number: 1 });
+  assertEquals(rows.size, 1, "no new row is written");
+  assertEquals(rows.get("o/r#1"), before, "the existing row is untouched");
+  assertEquals(mem.insertCalls, 0, "insert is never attempted — the no-write guarantee holds");
+});
+
+Deno.test("ensurePr reconstructs a minimal converging row when the parent is absent", async () => {
+  const { data, rows } = memData();
+  await ensurePr(data, { prKey: "o/r#2", repo: "o/r", number: 2, round: 3 });
+  const row = rows.get("o/r#2")!;
+  assertEquals(row.pr_key, "o/r#2");
+  assertEquals(row.repo, "o/r");
+  assertEquals(row.number, 2);
+  assertEquals(row.status, "converging");
+  assertEquals(row.current_round, 3, "the round is carried through so the aggregate isn't behind");
+  assertEquals(row.url, canonicalPrUrl("o/r", 2), "URL is derived canonically when none is passed");
+  assert(typeof row.abandon_token === "string" && (row.abandon_token as string).length > 0);
+});
+
+Deno.test("ensurePr defaults current_round to 1 (rounds are 1-based) when none is passed", async () => {
+  const { data, rows } = memData();
+  await ensurePr(data, { prKey: "o/r#5", repo: "o/r", number: 5 });
+  assertEquals(
+    rows.get("o/r#5")!.current_round,
+    1,
+    "an unknown round heals to 1, not 0, matching submitPr's 1-based invariant",
+  );
+});
+
+Deno.test("ensurePr reuses a supplied abandon token instead of minting a new one", async () => {
+  const { data, rows } = memData();
+  await ensurePr(data, { prKey: "o/r#7", repo: "o/r", number: 7, abandonToken: "TOK-en_123" });
+  assertEquals(
+    rows.get("o/r#7")!.abandon_token,
+    "TOK-en_123",
+    "the running agent's existing token is preserved so its abort check keeps resolving",
+  );
+});
+
+Deno.test("ensurePr mints a token when none is supplied", async () => {
+  const { data, rows } = memData();
+  await ensurePr(data, { prKey: "o/r#8", repo: "o/r", number: 8 });
+  const tok = rows.get("o/r#8")!.abandon_token;
+  assert(typeof tok === "string" && (tok as string).length > 0, "a fresh token is minted as a fallback");
+});
+
+Deno.test("ensurePr prefers an explicit url over the canonical one", async () => {
+  const { data, rows } = memData();
+  const url = "https://github.com/o/r/pull/9";
+  await ensurePr(data, { prKey: "o/r#9", repo: "o/r", number: 9, url });
+  assertEquals(rows.get("o/r#9")!.url, url);
+});
+
+Deno.test("ensurePr swallows an insert race when the row appears anyway", async () => {
+  // insert throws (unique-violation / concurrent writer) but the row is now present → healed.
+  const { data } = memData({ throwOnInsert: true, seedOnThrow: true });
+  await ensurePr(data, { prKey: "o/r#3", repo: "o/r", number: 3 });
+});
+
+Deno.test("ensurePr rethrows when the insert fails and the row is still absent", async () => {
+  const { data } = memData({ throwOnInsert: true, seedOnThrow: false });
+  let threw = false;
+  try {
+    await ensurePr(data, { prKey: "o/r#4", repo: "o/r", number: 4 });
+  } catch (_e) {
+    threw = true;
+  }
+  assert(threw, "a genuine insert failure must surface, not be silently swallowed");
+});

package/app/persist-escalation.test.ts

@@ -12,13 +12,22 @@ import handler from "../workers/persist-escalation/worker.ts";
 function fakeApp() {
   const inserts: Record<string, unknown[]> = { rounds: [], escalations: [] };
   const updates: Record<string, unknown[]> = { pull_requests: [] };
+  const rows: Record<string, Map<string, unknown>> = {};
   const app = {
     data: {
       table(name: string, _key: string) {
+        const store = (rows[name] ??= new Map());
         return {
+          // deno-lint-ignore require-await
+          async get(key: string) {
+            return store.get(key);
+          },
           // deno-lint-ignore require-await
           async insert(row: unknown) {
             (inserts[name] ??= []).push(row);
+            const pk = name === "escalations" ? "id" : name === "rounds" ? "id" : "pr_key";
+            // deno-lint-ignore no-explicit-any
+            store.set((row as any)[pk], row);
             return name === "escalations" ? 42 : 1;
           },
           // deno-lint-ignore require-await
@@ -29,7 +38,7 @@ function fakeApp() {
       },
     },
   };
-  return { app, inserts, updates };
+  return { app, inserts, updates, rows };
 }
 
 Deno.test("stalled arm (recordRound=false) does not insert a duplicate rounds row", async () => {
@@ -55,8 +64,39 @@ Deno.test("escalation arm without the flag still records the round", async () =>
   assertEquals((inserts.rounds[0] as any).round_no, 3);
 });
 
-// A blank question would have to be trimmed away, so a padded-but-non-blank question is stored
-// trimmed (matching the sibling `persist-task-escalation`) — no whitespace drift into the UI/DB.
+// When the convergence-loop passes repo/prNumber and the FK parent is missing (engine/app.db
+// desync), persist-escalation reconstructs the `pull_requests` row before the rounds/escalations
+// inserts so opening an escalation never dies with an opaque FOREIGN KEY constraint failure.
+Deno.test("persist-escalation heals a missing pull_requests parent before recording", async () => {
+  const { app, inserts, updates } = fakeApp();
+  const job = {
+    variables: {
+      prKey: "o/r#8",
+      round: 4,
+      status: "blocked",
+      question: "max rounds",
+      repo: "o/r",
+      prNumber: 8,
+    },
+  };
+  // deno-lint-ignore no-explicit-any
+  await handler(job as any, app as any);
+  assertEquals(inserts.pull_requests?.length, 1, "the missing parent is reconstructed");
+  // Assert against the reconstruction insert payload (ensurePr) rather than the stored row: the
+  // fake update() doesn't apply patches, so the row would otherwise still read the insert's
+  // "converging" status and mask the worker's real final state.
+  // deno-lint-ignore no-explicit-any
+  const healed = inserts.pull_requests![0] as any;
+  assertEquals(healed.status, "converging", "the healed parent starts in the converging aggregate");
+  assertEquals(inserts.rounds.length, 1, "the round is still recorded");
+  assertEquals(inserts.escalations.length, 1, "the escalation is still opened");
+  // And the worker still moves the (now-present) PR to escalated as its final state.
+  assertEquals(updates.pull_requests!.length, 1, "the PR is updated once after the heal");
+  // deno-lint-ignore no-explicit-any
+  assertEquals((updates.pull_requests![0] as any).patch.status, "escalated");
+});
+
+
 Deno.test("a padded question is persisted trimmed (no whitespace drift)", async () => {
   const { app, inserts, updates } = fakeApp();
   const job = { variables: { prKey: "o/r#1", round: 4, status: "needs_input", question: "  needs a decision  " } };
@@ -117,3 +157,31 @@ Deno.test("unclassified status without a question names the status in the fabric
   assert(esc.question.includes("in_progress"), "fabricated question references the raw status");
   assertEquals(esc.kind, "blocker", "a non needs_input status is a blocker escalation");
 });
+
+// When repo/prNumber process variables are absent the heal still runs by parsing the canonical
+// `owner/repo#N` prKey, so the escalation's FK parent is never left unguarded.
+Deno.test("persist-escalation heals from the prKey when repo/prNumber are absent", async () => {
+  const { app, inserts } = fakeApp();
+  const job = {
+    variables: {
+      prKey: "o/r#12",
+      round: 2,
+      status: "needs_input",
+      question: "decide",
+      abandonUrl: "https://host/hooks/abandon?token=TOK-en_123",
+    },
+  };
+  // deno-lint-ignore no-explicit-any
+  await handler(job as any, app as any);
+  assertEquals(inserts.pull_requests?.length, 1, "the parent is reconstructed from the prKey");
+  // deno-lint-ignore no-explicit-any
+  const healed = inserts.pull_requests![0] as any;
+  assertEquals(healed.repo, "o/r");
+  assertEquals(healed.number, 12);
+  assertEquals(healed.url, "https://github.com/o/r/pull/12", "URL is derived from the parsed prKey");
+  assertEquals(
+    healed.abandon_token,
+    "TOK-en_123",
+    "the running agent's abandon token is preserved from abandonUrl, not re-minted",
+  );
+});

package/app/persist-round.test.ts

@@ -12,13 +12,22 @@ import handler from "../workers/persist-round/worker.ts";
 function fakeApp() {
   const inserts: Record<string, unknown[]> = { rounds: [] };
   const updates: Record<string, unknown[]> = { pull_requests: [] };
+  const rows: Record<string, Map<string, unknown>> = {};
   const app = {
     data: {
       table(name: string, _key: string) {
+        const store = (rows[name] ??= new Map());
         return {
+          // deno-lint-ignore require-await
+          async get(key: string) {
+            return store.get(key);
+          },
           // deno-lint-ignore require-await
           async insert(row: unknown) {
             (inserts[name] ??= []).push(row);
+            const pk = name === "rounds" ? "id" : "pr_key";
+            // deno-lint-ignore no-explicit-any
+            store.set((row as any)[pk], row);
             return 1;
           },
           // deno-lint-ignore require-await
@@ -29,7 +38,7 @@ function fakeApp() {
       },
     },
   };
-  return { app, inserts, updates };
+  return { app, inserts, updates, rows };
 }
 
 for (const status of ["addressed", "waiting"]) {
@@ -53,7 +62,38 @@ for (const status of ["addressed", "waiting"]) {
   });
 }
 
-// When the agent omits `status` (e.g. a fallback), persist-round defaults it to `addressed`
+// When the convergence-loop passes repo/prNumber and the FK parent is missing (engine/app.db
+// desync), persist-round reconstructs the `pull_requests` row before recording the round so the
+// insert never dies with an opaque FOREIGN KEY constraint failure.
+Deno.test("persist-round heals a missing pull_requests parent before recording the round", async () => {
+  const { app, inserts, updates } = fakeApp();
+  const job = {
+    variables: {
+      prKey: "o/r#7",
+      round: 3,
+      status: "addressed",
+      repo: "o/r",
+      prNumber: 7,
+    },
+  };
+  // deno-lint-ignore no-explicit-any
+  await handler(job as any, app as any);
+
+  assertEquals(inserts.pull_requests?.length, 1, "the missing parent is reconstructed");
+  // Assert against the reconstruction insert payload (ensurePr) rather than the stored row: the
+  // fake update() doesn't apply patches, so the row would otherwise still read the insert's
+  // "converging" status and mask the worker's real final state.
+  // deno-lint-ignore no-explicit-any
+  const healed = inserts.pull_requests![0] as any;
+  assertEquals(healed.status, "converging", "the healed parent starts in the converging aggregate");
+  assertEquals(healed.url, "https://github.com/o/r/pull/7", "URL is derived canonically");
+  assertEquals(inserts.rounds.length, 1, "the round is still recorded after the heal");
+  // And the worker still parks the (now-present) PR in waiting_review as its final state.
+  assertEquals(updates.pull_requests!.length, 1, "the PR is updated once after the heal");
+  // deno-lint-ignore no-explicit-any
+  assertEquals((updates.pull_requests![0] as any).patch.status, "waiting_review");
+});
+
 // rather than writing a NULL status — the round history stays readable.
 Deno.test("persist-round defaults a missing status to 'addressed'", async () => {
   const { app, inserts } = fakeApp();
@@ -63,3 +103,31 @@ Deno.test("persist-round defaults a missing status to 'addressed'", async () =>
   // deno-lint-ignore no-explicit-any
   assertEquals((inserts.rounds[0] as any).status, "addressed");
 });
+
+// When repo/prNumber process variables are absent (an older in-flight instance, or a regression)
+// the heal still runs by parsing the canonical `owner/repo#N` prKey, so the FK-child insert is
+// never left unguarded.
+Deno.test("persist-round heals from the prKey when repo/prNumber are absent", async () => {
+  const { app, inserts } = fakeApp();
+  const job = {
+    variables: {
+      prKey: "o/r#12",
+      round: 2,
+      status: "addressed",
+      abandonUrl: "https://host/hooks/abandon?token=TOK-en_123",
+    },
+  };
+  // deno-lint-ignore no-explicit-any
+  await handler(job as any, app as any);
+  assertEquals(inserts.pull_requests?.length, 1, "the parent is reconstructed from the prKey");
+  // deno-lint-ignore no-explicit-any
+  const healed = inserts.pull_requests![0] as any;
+  assertEquals(healed.repo, "o/r");
+  assertEquals(healed.number, 12);
+  assertEquals(healed.url, "https://github.com/o/r/pull/12", "URL is derived from the parsed prKey");
+  assertEquals(
+    healed.abandon_token,
+    "TOK-en_123",
+    "the running agent's abandon token is preserved from abandonUrl, not re-minted",
+  );
+});

package/app/service.ts

@@ -168,6 +168,64 @@ export interface ParsedPr {
   prKey: string;
 }
 
+/** Canonical GitHub PR URL for a repo + number. Matches the `url` `parsePr` derives, so a
+ * reconstructed row is indistinguishable from one registered at submit time. */
+export function canonicalPrUrl(repo: string, number: number): string {
+  return `https://github.com/${repo}/pull/${number}`;
+}
+
+/**
+ * Guarantee the `pull_requests` parent row exists before a FK-child row (`rounds`, `escalations`,
+ * `merges`) is written. Idempotent and race-safe.
+ *
+ * The durable engine and the app's `app.db` are two INDEPENDENT stores. If they ever desync — the
+ * DB is rebuilt, restored from a stale copy, or simply lags a live process instance while running
+ * from a local checkout — a persist/finalize/merge job would otherwise insert a child row whose
+ * FK parent is absent and die with an opaque `FOREIGN KEY constraint failed` incident that a human
+ * has to hand-resolve (observed on convergence-loop instance 94). The PR's `repo`/`prNumber` are
+ * normally carried as process variables; where they may be absent (older in-flight instances) the
+ * call sites derive them from the canonical `owner/repo#N` prKey, so the parent can always be
+ * reconstructed deterministically: we heal the missing row (a minimal `converging` aggregate) and
+ * let the loop continue instead of parking a dead-end incident. Callers pass the instance's
+ * `abandonToken` (recovered from its `abandonUrl` var) so the healed row keeps the token the
+ * running agent was handed and its cooperative-abort check keeps resolving. When the row already
+ * exists this is a no-op, so the healthy path is unchanged.
+ */
+export async function ensurePr(
+  data: DataLayer,
+  pr: { prKey: string; repo: string; number: number; url?: string; round?: number; abandonToken?: string },
+): Promise<void> {
+  const table = prs(data);
+  if (await table.get(pr.prKey)) return;
+  const ts = now();
+  console.warn(
+    `[ensurePr] pull_requests row for ${pr.prKey} was missing — reconstructing it so the FK-child ` +
+      `write can proceed (engine/app.db desync heal)`,
+  );
+  try {
+    await table.insert({
+      pr_key: pr.prKey,
+      repo: pr.repo,
+      number: pr.number,
+      url: pr.url ?? canonicalPrUrl(pr.repo, pr.number),
+      status: "converging",
+      current_round: pr.round ?? 1,
+      // Reuse the token the running agent was already handed (recovered from the instance's
+      // `abandonUrl` var) so its abort check keeps resolving; only mint a fresh one when the caller
+      // has no token to preserve (e.g. an old instance predating the `abandonUrl` variable).
+      abandon_token: pr.abandonToken ?? mintAbandonToken(),
+      created_at: ts,
+      updated_at: ts,
+    });
+  } catch (err) {
+    // Lost a race with a concurrent writer (submitPr or another job created the row first): the
+    // parent now exists, which is exactly the goal, so swallow. Only a still-absent row is a real
+    // failure worth surfacing.
+    if (await table.get(pr.prKey)) return;
+    throw err;
+  }
+}
+
 /** Parse "owner/repo#123" or a canonical PR URL into its parts. */
 export function parsePr(input: string): ParsedPr | null {
   const s = input.trim();

package/app/version.ts

@@ -0,0 +1,205 @@
+// Runtime version/identity of the running nano-workforce app.
+//
+// The app runs its TypeScript sources DIRECTLY from a checkout (`node --experimental-strip-types
+// main.ts`) with no build/bundle step, so "which code is running" can only be answered by
+// inspecting the working tree at runtime. This module gathers that identity — the app's package
+// version, the resolved `@nanobpm/urban` version, the git commit (read from `.git`, handling both
+// an ordinary `.git` directory and the `gitdir:` file pointer used by worktrees/submodules, with
+// an env override for detached deploys), plus the Node/Deno runtime, pid and start time — so an operator
+// debugging a stuck instance can confirm the process is on the code they think it is.
+//
+// Every probe is best-effort: a missing file or unavailable `.git` yields `null` for that field
+// rather than throwing, so `/app/version` never fails just because one source is absent.
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join, resolve, isAbsolute } from "node:path";
+
+// Captured once, at module load — i.e. when the running process booted this code.
+const STARTED_AT = new Date();
+
+const REPO_ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
+
+function readText(path: string): string | null {
+  try {
+    return readFileSync(path, "utf8");
+  } catch {
+    return null;
+  }
+}
+
+function readJson(path: string): Record<string, unknown> | null {
+  const text = readText(path);
+  if (text == null) return null;
+  try {
+    return JSON.parse(text) as Record<string, unknown>;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Read an env var across runtimes: Node exposes `process.env`; Deno may not populate it, so fall
+ * back to `Deno.env.get` (guarded — reading env can throw without `--allow-env`).
+ */
+function envVar(name: string): string | null {
+  const fromProcess = globalThis.process?.env?.[name];
+  if (typeof fromProcess === "string" && fromProcess.trim()) return fromProcess.trim();
+  const deno = (globalThis as { Deno?: { env?: { get?(k: string): string | undefined } } }).Deno;
+  try {
+    const fromDeno = deno?.env?.get?.(name);
+    if (typeof fromDeno === "string" && fromDeno.trim()) return fromDeno.trim();
+  } catch {
+    // Env access denied — treat as unset.
+  }
+  return null;
+}
+
+/**
+ * Locate the repo's git directories. `.git` is usually a directory, but in a `git worktree` (this
+ * app is often run from one) or a submodule it is a FILE containing `gitdir: <path>`, so a naive
+ * `${REPO_ROOT}/.git/HEAD` read returns null even on a live checkout. Resolve both the (possibly
+ * per-worktree) git dir that holds `HEAD` and the COMMON dir that holds loose refs / `packed-refs`.
+ */
+function resolveGitDirs(): { gitDir: string; commonDir: string } | null {
+  const dotGit = join(REPO_ROOT, ".git");
+  // Ordinary checkout: `.git` is a directory and `HEAD` sits directly inside.
+  if (readText(join(dotGit, "HEAD")) != null) {
+    return { gitDir: dotGit, commonDir: dotGit };
+  }
+  // Linked worktree / submodule: `.git` is a file pointing at the real git dir.
+  const pointer = readText(dotGit);
+  const match = pointer ? /^gitdir:\s*(.+?)\s*$/m.exec(pointer) : null;
+  if (!match) return null;
+  const target = match[1].trim();
+  const gitDir = isAbsolute(target) ? target : resolve(REPO_ROOT, target);
+  // A linked worktree keeps its own HEAD in `gitDir` but shares refs via the common dir, named by
+  // the `commondir` file (e.g. "../..").
+  const common = readText(join(gitDir, "commondir"));
+  const commonDir = common?.trim()
+    ? (isAbsolute(common.trim()) ? common.trim() : resolve(gitDir, common.trim()))
+    : gitDir;
+  return { gitDir, commonDir };
+}
+
+/** The app's own `package.json` (read once, reused by name + version). */
+function appPackage(): Record<string, unknown> | null {
+  return readJson(join(REPO_ROOT, "package.json"));
+}
+
+/** The app's name from `package.json`, scope-stripped (e.g. "@foo/bar" → "bar"). */
+function appName(pkg: Record<string, unknown> | null): string {
+  const raw = typeof pkg?.name === "string" ? pkg.name.trim() : "";
+  if (!raw) return "nano-workforce";
+  const unscoped = raw.startsWith("@") ? raw.slice(raw.indexOf("/") + 1) : raw;
+  return unscoped || "nano-workforce";
+}
+
+/** The app's own version from its `package.json`. */
+function appVersion(pkg: Record<string, unknown> | null): string | null {
+  return typeof pkg?.version === "string" ? pkg.version : null;
+}
+
+/** The installed `@nanobpm/urban` version (the runtime that materializes the whole app). */
+function urbanVersion(): string | null {
+  const pkg = readJson(join(REPO_ROOT, "node_modules", "@nanobpm", "urban", "package.json"));
+  return typeof pkg?.version === "string" ? pkg.version : null;
+}
+
+/**
+ * The git commit the working tree is on, read straight from `.git` so it reflects the ACTUAL
+ * checked-out code — not a value baked at some earlier build. Resolves a symbolic `HEAD`
+ * (`ref: refs/heads/…`) via the loose ref file (checking both the per-worktree and common dirs),
+ * falling back to `packed-refs`. An explicit `NANO_WORKFORCE_GIT_SHA` env var wins (for deploys
+ * that ship without a `.git` directory).
+ */
+function gitSha(): string | null {
+  const env = envVar("NANO_WORKFORCE_GIT_SHA");
+  if (env) return env;
+
+  const dirs = resolveGitDirs();
+  if (dirs == null) return null;
+  const head = readText(join(dirs.gitDir, "HEAD"));
+  if (head == null) return null;
+
+  const ref = head.trim();
+  if (!ref.startsWith("ref:")) {
+    // Detached HEAD — the file already holds the commit sha.
+    return ref || null;
+  }
+  const refPath = ref.slice(4).trim(); // e.g. "refs/heads/main"
+  // A loose ref may live in the per-worktree dir or the common dir; check both.
+  const loose = readText(join(dirs.gitDir, refPath)) ?? readText(join(dirs.commonDir, refPath));
+  if (loose != null && loose.trim()) return loose.trim();
+
+  // Packed refs fallback (always in the common dir): lines of "<sha> <refname>".
+  const packed = readText(join(dirs.commonDir, "packed-refs"));
+  if (packed != null) {
+    for (const line of packed.split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#") || trimmed.startsWith("^")) continue;
+      const [sha, name] = trimmed.split(/\s+/, 2);
+      if (name === refPath) return sha;
+    }
+  }
+  return null;
+}
+
+/** The current branch name from `HEAD`, or `null` when detached / unavailable. */
+function gitBranch(): string | null {
+  const dirs = resolveGitDirs();
+  if (dirs == null) return null;
+  const head = readText(join(dirs.gitDir, "HEAD"));
+  if (head == null) return null;
+  const ref = head.trim();
+  if (!ref.startsWith("ref:")) return null;
+  const refPath = ref.slice(4).trim();
+  return refPath.startsWith("refs/heads/") ? refPath.slice("refs/heads/".length) : refPath;
+}
+
+function runtime(): string {
+  const proc = globalThis.process;
+  // Deno exposes `Deno.version.deno`; Node exposes `process.version` (e.g. "v24.15.0").
+  const deno = (globalThis as { Deno?: { version?: { deno?: string } } }).Deno;
+  if (deno?.version?.deno) return `deno ${deno.version.deno}`;
+  if (proc?.version) return `node ${proc.version}`;
+  return "unknown";
+}
+
+export interface VersionInfo {
+  name: string;
+  version: string | null;
+  urbanVersion: string | null;
+  gitSha: string | null;
+  gitBranch: string | null;
+  runtime: string;
+  pid: number | null;
+  startedAt: string;
+  uptimeSeconds: number;
+}
+
+/**
+ * Everything except `uptimeSeconds` is fixed for the life of the process, so probe the working
+ * tree ONCE at module load rather than re-reading files (`.git`, package.jsons) on every request.
+ */
+const STATIC: Omit<VersionInfo, "uptimeSeconds"> = (() => {
+  const proc = globalThis.process;
+  const pkg = appPackage();
+  return Object.freeze({
+    name: appName(pkg),
+    version: appVersion(pkg),
+    urbanVersion: urbanVersion(),
+    gitSha: gitSha(),
+    gitBranch: gitBranch(),
+    runtime: runtime(),
+    pid: typeof proc?.pid === "number" ? proc.pid : null,
+    startedAt: STARTED_AT.toISOString(),
+  });
+})();
+
+/** Gather the running app's identity. Cheap and side-effect-free — safe to call per request. */
+export function buildVersionInfo(): VersionInfo {
+  return {
+    ...STATIC,
+    uptimeSeconds: Math.round((Date.now() - STARTED_AT.getTime()) / 1000),
+  };
+}

package/nano.app.json

@@ -154,6 +154,11 @@
       "module": "actions/status.ts",
       "method": "GET"
     },
+    {
+      "path": "/app/version",
+      "module": "actions/version.ts",
+      "method": "GET"
+    },
     {
       "path": "/app/actions/message",
       "module": "actions/message.ts"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.32.1",
+  "version": "0.33.0",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",

package/pages/epic.page.json

@@ -23,10 +23,22 @@
       "type": "text",
       "id": "subtitle",
       "props": {
-        "text": "Read-only observability over each plan's review trace, wave state, merge-exclusion graph, coordination notes, and trial-merge gate results.",
+        "text": "Hand an issue to the fleet to plan and implement it, then track each plan's review trace, wave state, merge-exclusion graph, coordination notes, and trial-merge gate results.",
         "variant": "sub"
       }
     },
+    {
+      "type": "actionForm",
+      "id": "plan-submit",
+      "props": {
+        "title": "Hand an issue to the fleet",
+        "submitLabel": "Plan & implement",
+        "action": { "kind": "startProcess", "process": "plan-fanout" },
+        "fields": [
+          { "key": "issue", "label": "owner/repo#123 or a GitHub issue URL", "type": "text" }
+        ]
+      }
+    },
     {
       "type": "dataGrid",
       "id": "epic-plans",
@@ -54,7 +66,7 @@
         ],
         "columns": [
           { "field": "plan_key", "header": "Issue", "linkField": "issue_url" },
-          { "field": "status", "header": "Status" },
+          { "field": "status", "header": "Status", "link": { "kind": "processExplorer", "keyField": "process_key" } },
           { "field": "task_count", "header": "Tasks" },
           { "field": "open_task_id", "header": "Open escalation" },
           { "field": "updated_at", "header": "Updated" }

package/pages/home.page.json

@@ -40,18 +40,6 @@
         ]
       }
     },
-    {
-      "type": "actionForm",
-      "id": "plan-submit",
-      "props": {
-        "title": "Hand an issue to the fleet",
-        "submitLabel": "Plan & implement",
-        "action": { "kind": "startProcess", "process": "plan-fanout" },
-        "fields": [
-          { "key": "issue", "label": "owner/repo#123 or a GitHub issue URL", "type": "text" }
-        ]
-      }
-    },
     {
       "type": "dataGrid",
       "id": "prs",
@@ -83,7 +71,7 @@
         ],
         "columns": [
           { "field": "pr_key", "header": "PR", "linkField": "url" },
-          { "field": "status", "header": "Status" },
+          { "field": "status", "header": "Status", "link": { "kind": "processExplorer", "keyField": "process_key" } },
           { "field": "incident_message", "header": "Incident" },
           { "field": "current_round", "header": "Round" },
           { "field": "active_worker", "header": "Agent" },
@@ -195,7 +183,7 @@
         ],
         "columns": [
           { "field": "plan_key", "header": "Issue" },
-          { "field": "status", "header": "Status" },
+          { "field": "status", "header": "Status", "link": { "kind": "processExplorer", "keyField": "process_key" } },
           { "field": "task_count", "header": "Tasks" },
           { "field": "updated_at", "header": "Updated" }
         ],

package/workers/finalize/worker.ts

@@ -2,7 +2,8 @@
 // merge stage (start the `merge-loop` process and park the PR in `waiting_deps`) when auto-merge
 // is on, or (b) close the PR out as `converged` (review-only mode).
 import type { AppJobHandler } from "@nanobpm/urban";
-import { AUTO_MERGE, startMerge } from "../../app/service.ts";
+import { AUTO_MERGE, ensurePr, startMerge } from "../../app/service.ts";
+import { abandonTokenFromUrl } from "../../app/abandon.ts";
 import { maybeStartRetro } from "../../app/retro.ts";
 
 // Extends Record so the declared fields are typed while the job may still carry
@@ -14,6 +15,9 @@ interface In extends Record<string, unknown> {
   prUrl: string;
   round: number;
   summary?: string;
+  // The per-PR abandon capability URL the agent was handed; its token is preserved on a heal so
+  // the agent's cooperative-abort check keeps resolving (see ensurePr).
+  abandonUrl?: string;
 }
 
 const AGENT_RESULT_KEY = "io.nanobpm.agentResult";
@@ -26,9 +30,19 @@ const handler: AppJobHandler<In> = async (job, app) => {
   // `summary` is left undefined when absent so the write boundary omits it: the
   // nullable `rounds.summary` stays NULL and `pull_requests.outcome` is untouched
   // rather than being coerced to "".
-  const { prKey, repo, prNumber, prUrl, round, summary } = job.variables;
+  const { prKey, repo, prNumber, prUrl, round, summary, abandonUrl } = job.variables;
   const now = new Date().toISOString();
 
+  // Heal a missing FK parent (engine/app.db desync) before the child `rounds` insert.
+  await ensurePr(app.data, {
+    prKey,
+    repo,
+    number: prNumber,
+    url: prUrl,
+    round,
+    abandonToken: abandonTokenFromUrl(abandonUrl),
+  });
+
   await app.data.table("rounds", "id").insert({
     pr_key: prKey,
     round_no: round,

package/workers/merge/worker.ts

@@ -10,7 +10,8 @@
 // shapes the escalation payload on a block.
 import type { AppJobHandler } from "@nanobpm/urban";
 import { enqueueViaComment, mergePr } from "../../app/github.ts";
-import { MERGE_ADMIN, MERGE_METHOD } from "../../app/service.ts";
+import { MERGE_ADMIN, MERGE_METHOD, ensurePr } from "../../app/service.ts";
+import { abandonTokenFromUrl } from "../../app/abandon.ts";
 import { loadMergeProtocol } from "../../app/mergeProtocol.ts";
 import { checkBaseTarget } from "../../app/baseGuard.ts";
 
@@ -18,6 +19,12 @@ interface In extends Record<string, unknown> {
   prKey: string;
   repo: string;
   prNumber: number;
+  // Carried by the merge-loop instance (startMerge sets it to the converged round); passed to
+  // the heal so a reconstructed row reflects the real round, not a 1-based default.
+  round?: number;
+  // The per-PR abandon capability URL the agent was handed; its token is preserved on a heal so
+  // the agent's cooperative-abort check keeps resolving (see ensurePr).
+  abandonUrl?: string;
 }
 
 interface Out extends Record<string, unknown> {
@@ -27,10 +34,23 @@ interface Out extends Record<string, unknown> {
 }
 
 const handler: AppJobHandler<In, Out> = async (job, app) => {
-  const { prKey, repo, prNumber } = job.variables;
+  const { prKey, repo, prNumber, round, abandonUrl } = job.variables;
   const token = process.env.GITHUB_TOKEN ?? "";
   const now = new Date().toISOString();
 
+  // Heal a missing FK parent (engine/app.db desync) before any child `merges` insert below so a
+  // land attempt never dies with an opaque `FOREIGN KEY constraint failed` incident. The merge-loop
+  // instance carries repo+prNumber (and the converged round) but not prUrl; ensurePr derives the
+  // canonical URL from them, keeps the healed round faithful, and preserves the agent's abandon
+  // token so its cooperative-abort check keeps resolving.
+  await ensurePr(app.data, {
+    prKey,
+    repo,
+    number: prNumber,
+    round,
+    abandonToken: abandonTokenFromUrl(abandonUrl),
+  });
+
   // Dead-end-base guard (#60): never land a PR into a base branch that has itself already merged
   // to the default branch — the merge would land into a dead branch and never reach `main`.
   // GitHub only auto-retargets a PR when its base is *deleted* on merge; a merged-but-undeleted

package/workers/persist-escalation/worker.ts

@@ -3,6 +3,8 @@
 // and the MAX_ROUNDS guard (status = blocked, question set by the process). Returns
 // `escalationId` for the UI.
 import type { AppJobHandler } from "@nanobpm/urban";
+import { ensurePr, parsePr } from "../../app/service.ts";
+import { abandonTokenFromUrl } from "../../app/abandon.ts";
 
 // Extends Record so the declared fields are typed while the job may still carry
 // other process variables (e.g. io.nanobpm.agentResult, read by transcriptOf).
@@ -12,6 +14,14 @@ interface In extends Record<string, unknown> {
   status?: string;
   summary?: string;
   question?: string;
+  // Carried by the convergence-loop instance so a missing `pull_requests` parent can be
+  // reconstructed before the FK-child `rounds`/`escalations` inserts.
+  repo?: string;
+  prNumber?: number;
+  prUrl?: string;
+  // The per-PR abandon capability URL the agent was handed; its token is preserved on a heal so
+  // the agent's cooperative-abort check keeps resolving (see ensurePr).
+  abandonUrl?: string;
   // False on the "review stalled" arm: `persist-round` already recorded this `round` as
   // `addressed`, so this escalation must not insert a second `rounds` row for the same
   // `pr_key`/`round_no` (which would record one round as both addressed and blocked). Absent
@@ -52,7 +62,7 @@ function fabricateQuestion(rawStatus: string | undefined, hasTranscript: boolean
 }
 
 const handler: AppJobHandler<In> = async (job, app) => {
-  const { prKey, round, summary } = job.variables;
+  const { prKey, round, summary, repo, prNumber, prUrl, abandonUrl } = job.variables;
   // `status` drives the escalation kind (control flow); a blank/absent status is an
   // unclassified escalation -> a question needing input. `question` is denormalised
   // onto pull_requests below and bound by the UI answer form, so it must be a
@@ -71,6 +81,25 @@ const handler: AppJobHandler<In> = async (job, app) => {
   const kind = status === "needs_input" ? "question" : "blocker";
   const now = new Date().toISOString();
 
+  // Heal a missing FK parent (engine/app.db desync) before the child `rounds`/`escalations`
+  // inserts so this never dies with an opaque `FOREIGN KEY constraint failed` incident. Prefer
+  // the carried repo/prNumber; if either is missing (an older in-flight instance, or a
+  // process-variable regression) fall back to parsing them out of the canonical `owner/repo#N`
+  // prKey so the heal still runs.
+  const parsed = parsePr(prKey);
+  const healRepo = repo ?? parsed?.repo;
+  const healNumber = typeof prNumber === "number" ? prNumber : parsed?.number;
+  if (healRepo && typeof healNumber === "number") {
+    await ensurePr(app.data, {
+      prKey,
+      repo: healRepo,
+      number: healNumber,
+      url: prUrl,
+      round,
+      abandonToken: abandonTokenFromUrl(abandonUrl),
+    });
+  }
+
   // Skip the round insert when the caller already recorded this round (the "review stalled"
   // arm runs after `persist-round`): re-inserting would duplicate the `pr_key`/`round_no` row.
   if (job.variables.recordRound !== false) {

package/workers/persist-round/worker.ts

@@ -5,6 +5,8 @@
 // Data access goes through the injected app datasource gateway (`app.data.table<T>`), the RAD
 // `Table<T>` surface — `rounds.insert(...)` / `pull_requests.update(...)`, not hand-written SQL.
 import type { AppJobHandler } from "@nanobpm/urban";
+import { ensurePr, parsePr } from "../../app/service.ts";
+import { abandonTokenFromUrl } from "../../app/abandon.ts";
 
 // Extends Record so the declared fields are typed while the job may still carry
 // other process variables (e.g. io.nanobpm.agentResult, read by transcriptOf).
@@ -13,6 +15,14 @@ interface In extends Record<string, unknown> {
   round: number;
   status?: string;
   summary?: string;
+  // Carried by the convergence-loop instance (set at createInstance) so a missing
+  // `pull_requests` parent can be reconstructed before the FK-child `rounds` insert.
+  repo?: string;
+  prNumber?: number;
+  prUrl?: string;
+  // The per-PR abandon capability URL the review agent was handed; its token is preserved on a
+  // heal so the agent's cooperative-abort check keeps resolving (see ensurePr).
+  abandonUrl?: string;
 }
 
 // The harness records the agent's full (byte-capped) stdout on the result envelope; keep it
@@ -27,9 +37,28 @@ const handler: AppJobHandler<In> = async (job, app) => {
   // This worker is the "addressed"/"waiting" path, so `status` resolves to one of those
   // domain values. `summary` is left undefined when absent: the write boundary omits it so the
   // nullable `rounds.summary` column stays NULL rather than being coerced to "".
-  const { prKey, round, status = "addressed", summary } = job.variables;
+  const { prKey, round, status = "addressed", summary, repo, prNumber, prUrl, abandonUrl } = job.variables;
   const now = new Date().toISOString();
 
+  // Heal a missing FK parent (engine/app.db desync) before the child `rounds` insert so this
+  // never dies with an opaque `FOREIGN KEY constraint failed` incident. Prefer the carried
+  // repo/prNumber; if either is missing (an older in-flight instance, or a process-variable
+  // regression) fall back to parsing them out of the canonical `owner/repo#N` prKey so the heal
+  // still runs.
+  const parsed = parsePr(prKey);
+  const healRepo = repo ?? parsed?.repo;
+  const healNumber = typeof prNumber === "number" ? prNumber : parsed?.number;
+  if (healRepo && typeof healNumber === "number") {
+    await ensurePr(app.data, {
+      prKey,
+      repo: healRepo,
+      number: healNumber,
+      url: prUrl,
+      round,
+      abandonToken: abandonTokenFromUrl(abandonUrl),
+    });
+  }
+
   await app.data.table("rounds", "id").insert({
     pr_key: prKey,
     round_no: round,