@nanobpm/nano-workforce 0.99.0 → 0.100.0

package/app/service.ts

@@ -22,7 +22,7 @@ import {
   UnresolvableCapabilityRefError,
 } from "./capabilityNeed.ts";
 import { deriveDelivery, TERMINAL_STATUSES } from "./delivery.ts";
-import { backfillFeatureStages, deriveFeatureBlockedPatch, deriveFeatureDelivery, deriveFeatureEscalationPatch, FEATURE_BLOCKED_ELEMENT, FEATURE_ESCALATION_ELEMENT, FEATURE_RUN_STATUSES, type FeatureRun, type FeatureRunStatus, featureEscalations, featureRuns } from "./feature.ts";
+import { backfillFeatureStages, deriveFeatureDelivery, FEATURE_BLOCKED_ELEMENT, FEATURE_ESCALATION_ELEMENT, FEATURE_RUN_STATUSES, type FeatureRunStatus, featureEscalations, featureRuns } from "./feature.ts";
 import {
   classifyMergeability,
   coalesceTitle,
@@ -1779,83 +1779,6 @@ export async function pollFeatureDelivery(data: DataLayer) {
   }
 }
 
-/** Reconcile each in-flight FEATURE run against its native `feature-escalation` user task (issue
- * #210 — feature-run escalations were invisible in the nwf UI). When a feature run escalates it parks
- * on the `feature-escalation` operator user task (an engine wait); no worker runs, so `feature_runs`
- * — which the schema-driven pages read — stayed `running` with nothing to show. This is the
- * `feature_runs` twin of `pollFeatureDelivery`: for each run that can be parked at (or resuming from)
- * the escalation, read its open user tasks and project the parked task onto the row via the pure
- * `deriveFeatureEscalationPatch` — flipping `status` to `escalated` and denormalising the escalation's
- * completable `userTaskKey` so the pages can drive an answer, and flipping back to `running` (clearing
- * the pointer) once it un-parks. It never writes `escalation_question` — that is persisted by the
- * `record-feature-escalation` worker at escalation entry and cleared on the exit paths, so the poller
- * can never clobber the source of truth for the question.
- *
- * Candidates are only the runs that could be parked here — `running` (may have just escalated) and
- * `escalated` (may have just resumed) — queried via the `feature_runs(status)` index, so the pass
- * stays O(in-flight), not O(total runs). Terminal-ward transitions THROUGH `record-feature` (answer
- * → abandon, SLA auto-abandon, done) clear the pointer in that worker, so a run that has already left
- * `escalated` never needs sweeping here. Best-effort + idempotent — per-run failures are isolated. */
-export async function pollFeatureEscalations(data: DataLayer, engine: EngineClient) {
-  const seen = new Set<string>();
-  const candidates: FeatureRun[] = [];
-  for (const status of ["running", "escalated"] as const) {
-    for (const run of await featureRuns(data).find({ status })) {
-      if (seen.has(run.feature_key)) continue;
-      seen.add(run.feature_key);
-      candidates.push(run);
-    }
-  }
-  for (const run of candidates) {
-    if (!run.process_key) continue;
-    try {
-      const tasks = await engine.openUserTasks({ processInstanceKey: run.process_key });
-      const task = tasks.find((t) => t.elementId === FEATURE_ESCALATION_ELEMENT);
-      const parked = task ? { userTaskKey: task.userTaskKey } : null;
-      const patch = deriveFeatureEscalationPatch(run, parked);
-      if (patch) {
-        await featureRuns(data).update(run.feature_key, { ...patch, updated_at: now() });
-      }
-    } catch (err) {
-      console.error(`[poller] feature escalation ${run.feature_key}: ${err}`);
-    }
-  }
-}
-
-/** Reconcile each BLOCKED FEATURE run against its native `feature-blocked` user task (issue #220 —
- * a blocked run parked at `feature-blocked` had no completion affordance in nwf). When a feature run
- * reaches a `blocked` outcome `record-feature` holds the row at the NON-terminal `awaiting_operator`
- * status and it parks on the `feature-blocked` operator user task (an engine wait); no worker runs, so
- * the schema-driven pages — which read `feature_runs` — had a status to show but NO pointer to drive a
- * completion action, so the run sat parked forever unless completed out-of-band. This is the blocked
- * twin of `pollFeatureEscalations`: for each run parked at (or resuming from) the blocked wait, read its
- * open user tasks and project the parked task's completable `userTaskKey` onto the row via the pure
- * `deriveFeatureBlockedPatch`, so the pages can drive an "Acknowledge blocked" action, and clear the
- * pointer once it un-parks. It never touches `status` — `record-feature` owns the `awaiting_operator`
- * flip and `record-blocked-ack` owns the terminal `blocked`, so the poller can never clobber either.
- *
- * Candidates are only the runs that could be parked here — `awaiting_operator` (parked at, or just
- * un-parked from, the blocked wait) — queried via the `feature_runs(status)` index, so the pass stays
- * O(in-flight), not O(total runs). The terminal-ward transition THROUGH `record-blocked-ack` (and the
- * acknowledge operation) clears the pointer, so a run that has already settled to `blocked` never needs
- * sweeping here. Best-effort + idempotent — per-run failures are isolated. */
-export async function pollFeatureBlocked(data: DataLayer, engine: EngineClient) {
-  for (const run of await featureRuns(data).find({ status: "awaiting_operator" })) {
-    if (!run.process_key) continue;
-    try {
-      const tasks = await engine.openUserTasks({ processInstanceKey: run.process_key });
-      const task = tasks.find((t) => t.elementId === FEATURE_BLOCKED_ELEMENT);
-      const parked = task ? { userTaskKey: task.userTaskKey } : null;
-      const patch = deriveFeatureBlockedPatch(run, parked);
-      if (patch) {
-        await featureRuns(data).update(run.feature_key, { ...patch, updated_at: now() });
-      }
-    } catch (err) {
-      console.error(`[poller] feature blocked ${run.feature_key}: ${err}`);
-    }
-  }
-}
-
 /** The app manifest, read and parsed exactly ONCE at module load. `activeStatusesFor` is invoked
  * three times during module initialization (the PR/plan/feature constants below); parsing here keeps
  * that to a single synchronous `readFileSync` + `JSON.parse` instead of one per lookup. */
@@ -1904,16 +1827,14 @@ export const FEATURE_ACTIVE_STATUSES: readonly FeatureRunStatus[] =
 
 /** Reconcile the unified Tasks-inbox read-model (`user_tasks`) against the engine's currently-open
  * native user-task escalations (issue #236). The Tasks page lists EVERY open escalation awaiting a
- * human decision — the feature kinds (already denormalised onto `feature_runs` by the two feature
- * pollers, which run earlier in this pass) plus the epic/PR kinds (`plan-review-decision`,
- * `trial-merge-decision`, `wait-answer`) that had no app-side pointer at all, so the pages could not
- * drive their completion. This is the generalisation of `pollFeatureEscalations`/`pollFeatureBlocked`
- * across all subjects: for each in-flight plan / PR it reads the instance's open user tasks and
- * projects one `user_tasks` row per escalation, enriching the display `question` from the audit
- * tables each kind already records. `reconcileUserTasks` then diffs the desired open set against the
- * persisted rows so a completed task's row is deleted (answered here, via the task inbox, or
- * out-of-band) and `showCount` reflects live pending work. Best-effort + idempotent — per-instance
- * failures are isolated so one bad instance never stalls the pass. */
+ * human decision — the feature kinds (`feature-escalation` / `feature-blocked`) plus the epic/PR kinds
+ * (`plan-review-decision`, `trial-merge-decision`, `wait-answer`) — that otherwise had no app-side
+ * pointer, so the pages could not drive their completion. For each in-flight feature / plan / PR it
+ * reads the instance's open user tasks and projects one `user_tasks` row per escalation, enriching the
+ * display `question` from the audit tables each kind already records. `reconcileUserTasks` then diffs
+ * the desired open set against the persisted rows so a completed task's row is deleted (answered here,
+ * via the task inbox, or out-of-band) and `showCount` reflects live pending work. Best-effort +
+ * idempotent — per-instance failures are isolated so one bad instance never stalls the pass. */
 export async function pollUserTasks(data: DataLayer, engine: EngineClient) {
   const at = now();
   const desired: UserTaskRow[] = [];
@@ -1921,54 +1842,63 @@ export async function pollUserTasks(data: DataLayer, engine: EngineClient) {
     if (row) desired.push(row);
   };
 
-  // Feature-run escalations — the completable keys are denormalised onto `feature_runs` by
-  // pollFeatureEscalations/pollFeatureBlocked (earlier in this pass), so no per-instance engine read
-  // is needed here.
+  // Feature-run escalations / blocked runs — read each in-flight feature run's open user tasks directly
+  // from the engine (issue #332: the denormalised `feature_runs.escalation_user_task_key` /
+  // `blocked_user_task_key` pointers were dropped in the contract phase, so this now reads the live
+  // task exactly as the plan/PR scans below do — one canonical read, no denormalised mirror). Dedupe by
+  // `feature_key` across the status queries so a run whose status transitions mid-pass is not processed
+  // twice.
   const featureSeen = new Set<string>();
   for (const status of FEATURE_ACTIVE_STATUSES) {
     for (const run of await featureRuns(data).find({ status })) {
+      if (!run.process_key) continue;
       if (featureSeen.has(run.feature_key)) continue;
       featureSeen.add(run.feature_key);
-      if (run.escalation_user_task_key) {
-        // Source the question from the canonical append-only `feature_escalations` audit log (issue
-        // #305) — the surviving table `record-feature-escalation` writes — falling back to the legacy
-        // denormalised `feature_runs.escalation_question` while both coexist (expand phase). This is the
-        // feature analogue of the plan-review/trial-merge/PR-loop question enrichment below, and lets the
-        // denormalised column be dropped in the contract phase without the Tasks grid losing the text.
-        const question = latestFeatureEscalationQuestion(await featureEscalations(data).find({ feature_key: run.feature_key })) ??
-          run.escalation_question;
-        push(
-          buildUserTaskRow(
-            {
-              userTaskKey: run.escalation_user_task_key,
-              elementId: FEATURE_ESCALATION_ELEMENT,
-              subjectType: "feature",
-              subjectKey: run.feature_key,
-              subjectTitle: run.title,
-              subjectUrl: run.issue_url,
-              question,
-              processKey: run.process_key,
-            },
-            at,
-          ),
-        );
+      let tasks: { userTaskKey: string; elementId?: string }[];
+      try {
+        tasks = await engine.openUserTasks({ processInstanceKey: run.process_key });
+      } catch (err) {
+        console.error(`[poller] user tasks (feature ${run.feature_key}): ${err}`);
+        continue;
       }
-      if (run.blocked_user_task_key) {
-        push(
-          buildUserTaskRow(
-            {
-              userTaskKey: run.blocked_user_task_key,
-              elementId: FEATURE_BLOCKED_ELEMENT,
-              subjectType: "feature",
-              subjectKey: run.feature_key,
-              subjectTitle: run.title,
-              subjectUrl: run.issue_url,
-              question: run.delivery_label,
-              processKey: run.process_key,
-            },
-            at,
-          ),
-        );
+      for (const t of tasks) {
+        if (t.elementId === FEATURE_ESCALATION_ELEMENT) {
+          // Source the question from the canonical append-only `feature_escalations` audit log (issue
+          // #305) — the surviving table `record-feature-escalation` writes — the feature analogue of the
+          // plan-review/trial-merge/PR-loop question enrichment below.
+          const question = latestFeatureEscalationQuestion(await featureEscalations(data).find({ feature_key: run.feature_key }));
+          push(
+            buildUserTaskRow(
+              {
+                userTaskKey: t.userTaskKey,
+                elementId: FEATURE_ESCALATION_ELEMENT,
+                subjectType: "feature",
+                subjectKey: run.feature_key,
+                subjectTitle: run.title,
+                subjectUrl: run.issue_url,
+                question,
+                processKey: run.process_key,
+              },
+              at,
+            ),
+          );
+        } else if (t.elementId === FEATURE_BLOCKED_ELEMENT) {
+          push(
+            buildUserTaskRow(
+              {
+                userTaskKey: t.userTaskKey,
+                elementId: FEATURE_BLOCKED_ELEMENT,
+                subjectType: "feature",
+                subjectKey: run.feature_key,
+                subjectTitle: run.title,
+                subjectUrl: run.issue_url,
+                question: run.delivery_label,
+                processKey: run.process_key,
+              },
+              at,
+            ),
+          );
+        }
       }
     }
   }
@@ -2126,8 +2056,6 @@ export async function pollOnce(
   await pollPromotion(data, engine, token);
   await pollFeatureDelivery(data);
   await pollLineage(data);
-  await pollFeatureEscalations(data, engine);
-  await pollFeatureBlocked(data, engine);
   await pollUserTasks(data, engine);
   if (engineRest) {
     const base = engineRest.restAddress.replace(/\/+$/, "");

package/app/stage.test.ts

@@ -5,15 +5,12 @@
 import { test } from "node:test";
 import { assert, assertEquals } from "#test-assert";
 import { FEATURE_RUN_STATUSES } from "./feature.ts";
-import { deriveEscalationOpen, deriveListBucket, deriveStage, type StageInput } from "./stage.ts";
+import { deriveListBucket, deriveStage, type StageInput } from "./stage.ts";
 
 const base = (over: Partial<StageInput> & { status: string }): StageInput => ({
   pr_key: null,
   converge: 1,
   auto_merge: 1,
-  escalation_question: null,
-  escalation_user_task_key: null,
-  blocked_user_task_key: null,
   ...over,
 });
 
@@ -71,10 +68,11 @@ test("skipped: the three converge/auto_merge cases", () => {
   assertEquals(deriveStage(base({ status: "running", converge: 1, auto_merge: 1 })).skipped, "");
 });
 
-test("attention: blocked, escalation, none", () => {
-  assertEquals(deriveStage(base({ status: "awaiting_operator", blocked_user_task_key: "ut-1" })).attention, "blocked");
-  assertEquals(deriveStage(base({ status: "escalated", escalation_user_task_key: "ut-2" })).attention, "⚠");
-  assertEquals(deriveStage(base({ status: "escalated", escalation_question: "which base?" })).attention, "⚠");
+test("attention: derives from status alone (blocked, escalation, none)", () => {
+  // Issue #332 dropped the denormalised escalation pointer/question columns; `attention` is now a pure
+  // function of `status` — `awaiting_operator` (a parked blocked run) → "blocked", `escalated` → "⚠".
+  assertEquals(deriveStage(base({ status: "awaiting_operator" })).attention, "blocked");
+  assertEquals(deriveStage(base({ status: "escalated" })).attention, "⚠");
   assertEquals(deriveStage(base({ status: "running" })).attention, null);
 });
 
@@ -92,7 +90,7 @@ test("escalated WITHOUT pr_key → Implementing / null", () => {
 });
 
 test("awaiting_operator WITHOUT pr_key → Implementing / null, attention 'blocked' when parked", () => {
-  const d = deriveStage(base({ status: "awaiting_operator", pr_key: null, blocked_user_task_key: "ut-3" }));
+  const d = deriveStage(base({ status: "awaiting_operator", pr_key: null }));
   assertEquals(d.stage, "Implementing");
   assertEquals(d.state, null);
   assertEquals(d.attention, "blocked");
@@ -105,47 +103,3 @@ test("deriveListBucket: history iff terminal AND acknowledged, else active", ()
   assertEquals(deriveListBucket("running", "2024-01-01T00:00:00Z"), "active");
   assertEquals(deriveListBucket("blocked", "2024-01-01T00:00:00Z"), "history");
 });
-
-// deriveEscalationOpen (issue #272): the single fail-closed "open escalation" display signal. TRUE iff
-// all three independently-written escalation columns AGREE the run is parked at an answerable
-// escalation; any single missing/torn field yields FALSE so the pages render not-escalated.
-test("deriveEscalationOpen: true only when status, pointer AND question all present", () => {
-  assertEquals(
-    deriveEscalationOpen({ status: "escalated", escalation_user_task_key: "ut-7", escalation_question: "which base?" }),
-    true,
-  );
-});
-
-test("deriveEscalationOpen: torn tuple (pointer set, question blank) renders as NOT escalated", () => {
-  // The mirror tear observed on nwf#270: status=escalated + live pointer + blank question.
-  assertEquals(
-    deriveEscalationOpen({ status: "escalated", escalation_user_task_key: "ut-7", escalation_question: null }),
-    false,
-  );
-  assertEquals(
-    deriveEscalationOpen({ status: "escalated", escalation_user_task_key: "ut-7", escalation_question: "" }),
-    false,
-  );
-});
-
-test("deriveEscalationOpen: torn tuple (question set, pointer null) renders as NOT escalated", () => {
-  // The entry-window tear: record-feature-escalation persisted the question but the poller has not yet
-  // denormalised the pointer.
-  assertEquals(
-    deriveEscalationOpen({ status: "escalated", escalation_user_task_key: null, escalation_question: "which base?" }),
-    false,
-  );
-});
-
-test("deriveEscalationOpen: a resumed run whose status lags behind a cleared tuple is NOT escalated", () => {
-  // status still 'escalated' but the answer op already cleared pointer + question → fail closed.
-  assertEquals(
-    deriveEscalationOpen({ status: "escalated", escalation_user_task_key: null, escalation_question: null }),
-    false,
-  );
-  // A non-escalated status can never be open regardless of stray column values.
-  assertEquals(
-    deriveEscalationOpen({ status: "running", escalation_user_task_key: "ut-7", escalation_question: "which base?" }),
-    false,
-  );
-});

package/app/stage.ts

@@ -43,9 +43,6 @@ export interface StageInput {
   pr_key?: string | null;
   converge?: number | boolean | null;
   auto_merge?: number | boolean | null;
-  escalation_question?: string | null;
-  escalation_user_task_key?: string | null;
-  blocked_user_task_key?: string | null;
 }
 
 /** The derived pipeline projection for one run. `skipped` is a space-separated set of stage keys not
@@ -94,44 +91,15 @@ export function deriveStage(run: StageInput): DerivedStage {
 
   // `attention`: a short badge for the active stage (the renderer colours it from `state`). This is how
   // a parked `awaiting_operator`/`escalated` run surfaces as attention WITHOUT altering its stage.
-  const attention = run.blocked_user_task_key
-    ? "blocked"
-    : run.escalation_user_task_key || run.escalation_question
-      ? "⚠"
-      : null;
+  // Derived from `status` alone (issue #332): the parked-task pointers that used to source it were
+  // dropped with the denormalised escalation surface, and the authoritative "who is waiting on a human"
+  // list now lives on the `user_tasks` Tasks inbox. `awaiting_operator` (parked at `feature-blocked`)
+  // shows the blocked glyph; `escalated` (parked at `feature-escalation`) shows the ⚠ badge.
+  const attention = status === "awaiting_operator" ? "blocked" : status === "escalated" ? "⚠" : null;
 
   return { stage, state, skipped: skippedKeys.join(" "), attention };
 }
 
-/** Derive the single fail-closed "open escalation" display signal for one feature run (issue #272).
- *
- * The open-escalation condition is jointly encoded by THREE independently-written columns —
- * `status='escalated'`, `escalation_user_task_key` (the completable pointer), and `escalation_question`
- * — owned by different writers on different schedules (the `record-feature-escalation` service task
- * sets the question; `pollFeatureEscalations`/`deriveFeatureEscalationPatch` sets status + pointer; the
- * answer operation clears the tuple). Because they are not written as one atomic tuple, a reader can
- * observe a TORN interim state (e.g. `status=escalated` + pointer set + `question=null`) and render a
- * self-contradictory escalation — an "answer me" affordance with nothing to answer.
- *
- * Collapse that class at the consumer: the pages gate the escalation affordances (Abandon / answer
- * form) on this ONE derived conjunction rather than on any single column, so a torn tuple renders as
- * NOT escalated (fail closed) instead of escalated-but-blank. `true` iff ALL THREE fields agree the run
- * is parked at an answerable escalation; any missing field yields `false`. Maintained as a write-time
- * projection by the feature_runs gateway (like `stage`/`list_bucket`), so it stays fresh on every write
- * — including the answer operation's eager tuple-clear, which makes the affordance disappear WITHOUT
- * waiting a poll pass. Pure and read-only. */
-export function deriveEscalationOpen(run: {
-  status: string;
-  escalation_question?: string | null;
-  escalation_user_task_key?: string | null;
-}): boolean {
-  return (
-    run.status === "escalated" &&
-    (run.escalation_user_task_key ?? "") !== "" &&
-    (run.escalation_question ?? "") !== ""
-  );
-}
-
 /** The Active/History partition label (§5), maintained at write time so the flat-DSL page tabs filter
  * on a stored `list_bucket` column with only `in` clauses. `history` iff the row is in a truly-terminal
  * status AND acknowledged; otherwise `active` (live runs + terminal-but-UNACKNOWLEDGED runs). */

package/app/userTasks.test.ts

@@ -2,7 +2,7 @@
 // one resolved open escalation user task into its desired `user_tasks` row (or null for a
 // non-escalation / blank key), and `reconcileUserTasks` diffs the desired open set against the
 // persisted rows into the minimal insert/update/delete plan the `pollUserTasks` reconcile applies.
-// These are the pure source of truth the poller projects, mirroring `deriveFeatureEscalationPatch`.
+// These are the pure source of truth the poller projects.
 import { test } from "node:test";
 import { assert, assertEquals } from "#test-assert";
 import type { PlanReview } from "./plan.ts";

package/app/userTasks.ts

@@ -10,11 +10,11 @@
 // (app/service.ts) projects: `buildUserTaskRow` (one open task → a desired row) and
 // `reconcileUserTasks` (the desired set vs the persisted set → the minimal upserts + deletes). The
 // engine iteration + writes live in the poller; the decisions live here so they are unit-testable
-// without a host, mirroring `deriveFeatureEscalationPatch`.
+// without a host.
 //
 // Completion is NOT owned here — the page posts the typed form variables to the ONE canonical human
-// completer (`completeEscalationAsHuman`, app/agentCompletion.ts) / the existing feature answer &
-// acknowledge operations, the exact resume path the task inbox uses. This module only makes the open
+// completer (`completeEscalationAsHuman`, app/agentCompletion.ts) via the `complete-user-task` door,
+// the exact resume path the task inbox uses. This module only makes the open
 // tasks visible; a completed task's row is removed on the next pass when the engine no longer reports
 // it open.
 import type { DataLayer } from "@nanobpm/urban";

package/db/migrations/049_drop_feature_escalation_surface.sql

@@ -0,0 +1,25 @@
+-- 049_drop_feature_escalation_surface.sql — issue #332: the destructive CONTRACT phase of #305,
+-- whose EXPAND half landed in #310 (the append-only `feature_escalations` audit table + dual-write +
+-- the native `user_tasks` read). Now that escalation/blocked state is projected onto `user_tasks`
+-- from the engine's open user tasks (`pollUserTasks` reads the engine directly, like the plan/PR
+-- kinds), and the question text survives on `feature_escalations`, the denormalised
+-- `feature_runs.escalation_*` / `blocked_user_task_key` surface is dead — nothing reads or writes it.
+-- Drop it.
+--
+-- These four columns were the interim mirror the retired `pollFeatureEscalations` / `pollFeatureBlocked`
+-- pollers and the bespoke `answer-escalation` / `acknowledge-blocked` doors used to drive the Feature /
+-- Overview pages before the Tasks inbox owned every human decision:
+--   • escalation_question       (031) — now sourced from the `feature_escalations` audit log.
+--   • escalation_user_task_key  (031) — now read live from the engine's open `feature-escalation` task.
+--   • blocked_user_task_key     (032) — now read live from the engine's open `feature-blocked` task.
+--   • escalation_open           (040) — the fail-closed torn-tuple display signal, moot once the tuple
+--                                       is gone; the Feature page no longer gates any affordance on it.
+--
+-- Forward-only and numbered after the current highest prefix on origin/main (048); migrations apply in
+-- order and are auto-applied on boot. The runner wraps each file in its own transaction, so this file
+-- must NOT contain BEGIN/COMMIT. No index references these columns (none was ever created), so a plain
+-- `ALTER TABLE … DROP COLUMN` suffices (mirrors 027's `pull_requests`/`plans` pointer drops).
+ALTER TABLE feature_runs DROP COLUMN escalation_question;
+ALTER TABLE feature_runs DROP COLUMN escalation_user_task_key;
+ALTER TABLE feature_runs DROP COLUMN blocked_user_task_key;
+ALTER TABLE feature_runs DROP COLUMN escalation_open;

package/e2e/feature-run.e2e.ts

@@ -23,7 +23,7 @@ import type { EngineJob } from "@nanobpm/urban/runtime";
 import { bootTestApp, type TestApp } from "@nanobpm/urban-testkit";
 import { admitGithubState, installAdmitGithub } from "./support/github-admit.ts";
 import { asEngineClient } from "./support/engine-client.ts";
-import { pollFeatureBlocked, pollFeatureEscalations } from "../app/service.ts";
+import { pollUserTasks } from "../app/service.ts";
 
 const APP_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 
@@ -58,9 +58,6 @@ interface FeatureRow {
   status: string;
   pr_key: string | null;
   delivery_label: string | null;
-  escalation_question: string | null;
-  escalation_user_task_key: string | null;
-  blocked_user_task_key: string | null;
 }
 interface PrRow {
   pr_key: string;
@@ -191,18 +188,23 @@ describe("single-issue feature run (#172 — feature.bpmn)", () => {
         const prs = await app.db.table<PrRow>("pull_requests", "pr_key").find({});
         assert.equal(prs.length, 0, "a blocked run never enrolled a PR into the convergence loop");
 
-        // The poller fills in the completable user-task key (which no service task can know — the task
-        // doesn't exist yet when record-feature runs) so the pages can drive an attributed acknowledge.
-        await pollFeatureBlocked(app.db, asEngineClient(app.engine));
-        const denorm = await featureRow(app, featureKey);
-        assert.ok(denorm.blocked_user_task_key, "the poller denormalised the completable blocked user-task key");
-        assert.equal(denorm.status, "awaiting_operator", "the run stays awaiting_operator while parked");
-
-        // Acknowledge through the app's OWN operation (the nwf UI's affordance) — the attributed
-        // completer resumes the SAME record-blocked-ack path a human would from the task inbox, with NO
-        // out-of-band /v2/user-tasks/{key}/completion call.
-        const acked = await app.api?.call("acknowledgeBlocked", {
-          body: { userTaskKey: denorm.blocked_user_task_key, note: "reassigned to a human" },
+        // The escalation state now lives on the native user task + the Tasks inbox `user_tasks`
+        // read-model (issue #332 dropped the denormalised `feature_runs.blocked_user_task_key` pointer),
+        // so `pollUserTasks` projects the parked `feature-blocked` task onto `user_tasks` by reading the
+        // engine directly — no per-run column write.
+        await pollUserTasks(app.db, asEngineClient(app.engine));
+        const inboxRow = await app.db
+          .table<{ user_task_key: string; element_id: string }>("user_tasks", "user_task_key")
+          .findOne({ user_task_key: task!.userTaskKey });
+        assert.ok(inboxRow, "the poller projected the blocked task onto the Tasks inbox read-model");
+        assert.equal(inboxRow!.element_id, "feature-blocked", "the projected row is a feature-blocked task");
+        assert.equal(parked.status, "awaiting_operator", "the run stays awaiting_operator while parked");
+
+        // Acknowledge through the ONE canonical `complete-user-task` door (issue #332 retired the bespoke
+        // `acknowledge-blocked` operation) — the attributed human completer resumes the SAME
+        // record-blocked-ack path from the task inbox, with NO out-of-band completion call.
+        const acked = await app.api?.call("completeUserTask", {
+          body: { userTaskKey: task!.userTaskKey, variables: { note: "reassigned to a human" } },
         });
         assert.equal(acked?.status, 200, "the operator acknowledgement completed the blocked task");
         await app.settle();
@@ -212,10 +214,10 @@ describe("single-issue feature run (#172 — feature.bpmn)", () => {
         const settled = await featureRow(app, featureKey);
         assert.equal(settled.status, "blocked", "the acknowledged run settles at terminal blocked");
         assert.equal(settled.delivery_label, "operator: reassigned to a human", "the operator note is recorded");
-        assert.equal(settled.blocked_user_task_key, null, "the completable-task pointer was cleared on ack");
 
-        // A further poll pass is an idempotent no-op — a terminal run is not a candidate.
-        await pollFeatureBlocked(app.db, asEngineClient(app.engine));
+        // A further poll pass is an idempotent no-op — the task is completed, so the read-model row is
+        // reconciled away and a terminal run is not a candidate.
+        await pollUserTasks(app.db, asEngineClient(app.engine));
         assert.equal((await featureRow(app, featureKey)).status, "blocked");
       },
     );
@@ -276,7 +278,7 @@ describe("single-issue feature run (#172 — feature.bpmn)", () => {
     );
   });
 
-  test("escalate → the poller surfaces it on the read model, and the operator answer resolves it (issue #210)", async () => {
+  test("escalate → the poller surfaces it on the Tasks inbox, and the operator answer resolves it (issue #210/#332)", async () => {
     let calls = 0;
     await withApp(
       {
@@ -288,25 +290,32 @@ describe("single-issue feature run (#172 — feature.bpmn)", () => {
         },
       },
       { baseBranch: "epic/e2e" },
-      async ({ app, featureKey }) => {
+      async ({ app, featureKey, processKey }) => {
         // The `record-feature-escalation` service task runs on the escalated arm (before the user task),
-        // so the row already carries the flipped status + the agent's question when the run parks — the
-        // read model the pages read is no longer blind to the native user-task wait (the #210 bug).
+        // so the row already carries the flipped status when the run parks, and the agent's question is
+        // recorded in the `feature_escalations` audit log the poller reads (issue #332 dropped the
+        // denormalised `feature_runs.escalation_question` column).
         const parked = await featureRow(app, featureKey);
         assert.equal(parked.status, "escalated", "the escalated status is surfaced on the read model");
-        assert.equal(parked.escalation_question, "Which API should I use?", "the agent's question is surfaced");
-
-        // The poller fills in the completable user-task key (which the service task can't know — the
-        // task doesn't exist yet when it runs) so the UI can drive an attributed answer.
-        await pollFeatureEscalations(app.db, asEngineClient(app.engine));
-        const escalated = await featureRow(app, featureKey);
-        assert.ok(escalated.escalation_user_task_key, "the poller denormalised the completable user-task key");
-        assert.equal(escalated.status, "escalated", "the run stays escalated while parked");
-
-        // Answer through the app's OWN operation (the nwf UI's answer affordance) — the attributed
-        // completer resumes the SAME implement task a human would from the task inbox.
-        const answered = await app.api?.call("answerFeatureEscalation", {
-          body: { userTaskKey: escalated.escalation_user_task_key, resolution: "answer", answer: "use v2" },
+
+        const tasks = await app.engine.searchUserTasks({ processInstanceKey: processKey });
+        const task = tasks.find((t) => t.elementId === "feature-escalation") as InboxTask | undefined;
+        assert.ok(task?.userTaskKey, "the feature escalation parked a completable native user task");
+
+        // The poller projects the parked task onto the Tasks inbox `user_tasks` read-model by reading
+        // the engine directly, sourcing the question from the `feature_escalations` audit log.
+        await pollUserTasks(app.db, asEngineClient(app.engine));
+        const inboxRow = await app.db
+          .table<{ user_task_key: string; element_id: string; question: string | null }>("user_tasks", "user_task_key")
+          .findOne({ user_task_key: task!.userTaskKey });
+        assert.ok(inboxRow, "the poller projected the escalation onto the Tasks inbox read-model");
+        assert.equal(inboxRow!.question, "Which API should I use?", "the agent's question is surfaced from the audit log");
+
+        // Answer through the ONE canonical `complete-user-task` door (issue #332 retired the bespoke
+        // `answer-escalation` operation) — the attributed human completer resumes the SAME implement task
+        // a human would from the task inbox.
+        const answered = await app.api?.call("completeUserTask", {
+          body: { userTaskKey: task!.userTaskKey, variables: { resolution: "answer", answer: "use v2" } },
         });
         assert.equal(answered?.status, 200, "the operator answer completed the escalation task");
         await app.settle();
@@ -318,14 +327,16 @@ describe("single-issue feature run (#172 — feature.bpmn)", () => {
         );
         assert.equal(calls, 2, "the implementation agent was re-dispatched exactly once after the answer");
 
-        // The run opened its PR; the escalation pointer + question were cleared once resolved.
+        // The run opened its PR.
         const settled = await featureRow(app, featureKey);
         assert.equal(settled.status, "opened", "the resumed run opened its PR");
-        assert.equal(settled.escalation_user_task_key, null, "the escalation pointer was cleared once resolved");
-        assert.equal(settled.escalation_question, null, "the surfaced question was cleared once resolved");
 
-        // A further poll pass is an idempotent no-op — a terminal run is not a candidate.
-        await pollFeatureEscalations(app.db, asEngineClient(app.engine));
+        // A further poll pass reconciles the completed task's read-model row away.
+        await pollUserTasks(app.db, asEngineClient(app.engine));
+        const gone = await app.db
+          .table<{ user_task_key: string }>("user_tasks", "user_task_key")
+          .findOne({ user_task_key: task!.userTaskKey });
+        assert.equal(gone, undefined, "the completed escalation's inbox row was reconciled away");
         assert.equal((await featureRow(app, featureKey)).status, "opened");
       },
     );

package/e2e/retire-escalation-subsystem.e2e.ts

@@ -155,6 +155,32 @@ describe("retire escalation subsystem (U7 — destructive contract phase)", () =
     }
   });
 
+  test("issue #332 contract phase: feature_runs escalation columns + bespoke feature doors are gone", async () => {
+    // The destructive contract phase of #305 dropped the denormalised feature-run escalation surface now
+    // that escalation state lives on the native `user_tasks` inbox + the `feature_escalations` audit log.
+    const featureCols = await columnNames(app, "feature_runs");
+    assert.ok(featureCols.length > 0, "feature_runs table still exists");
+    for (const dropped of [
+      "escalation_question",
+      "escalation_user_task_key",
+      "blocked_user_task_key",
+      "escalation_open",
+    ]) {
+      assert.ok(!featureCols.includes(dropped), `feature_runs.${dropped} column dropped (#332)`);
+    }
+
+    // The bespoke feature-run answer doors are gone — the ONE canonical `/actions/complete-user-task`
+    // door now completes `feature-escalation` / `feature-blocked` alongside the epic/PR kinds.
+    for (const path of ["/app/api/actions/answer-escalation", "/app/api/actions/acknowledge-blocked"]) {
+      const res = await app.callRoute({
+        method: "POST",
+        path,
+        body: JSON.stringify({ userTaskKey: "x" }),
+      });
+      assert.equal(res.status, 404, `retired feature door ${path} is unmounted (404)`);
+    }
+  });
+
   test("an escalation still round-trips via userTask + inbox with no denormalised pointer or dead form", async () => {
     const api = app.api;
     assert.ok(api, "the OpenAPI driver is available");