@nanobpm/nano-workforce 0.99.1 → 0.101.0

package/app/service.ts

@@ -22,7 +22,7 @@ import {
   UnresolvableCapabilityRefError,
 } from "./capabilityNeed.ts";
 import { deriveDelivery, TERMINAL_STATUSES } from "./delivery.ts";
-import { backfillFeatureStages, deriveFeatureBlockedPatch, deriveFeatureDelivery, deriveFeatureEscalationPatch, FEATURE_BLOCKED_ELEMENT, FEATURE_ESCALATION_ELEMENT, FEATURE_RUN_STATUSES, type FeatureRun, type FeatureRunStatus, featureEscalations, featureRuns } from "./feature.ts";
+import { backfillFeatureStages, deriveFeatureDelivery, FEATURE_BLOCKED_ELEMENT, FEATURE_ESCALATION_ELEMENT, FEATURE_RUN_STATUSES, type FeatureRunStatus, featureEscalations, featureRuns } from "./feature.ts";
 import {
   classifyMergeability,
   coalesceTitle,
@@ -81,6 +81,7 @@ import {
 } from "./userTasks.ts";
 import { deriveWaitGate } from "./waitGate.ts";
 import { waveMergeTargets } from "./waves.ts";
+import { isCommitSha, WorldStore } from "./world/index.ts";
 
 /** The BPMN process that drives review convergence (`resources/processes/convergence-loop.bpmn`). */
 export const PROCESS_ID = "convergence-loop";
@@ -373,8 +374,20 @@ const AGENT_TASK_NS = "io.nanobpm.agentTask";
  * fetching file blobs lazily — small upfront, correct diffs. `--depth 1` is deliberately NOT used:
  * it would drop the merge-base and break `git diff origin/<base>...HEAD`. When the PR base branch
  * is known we also emit `baseRef` so the harness fetches the base tip alongside the head, keeping
- * that base reachable for the diff. */
-export function repoEnvelopeVars(repo: string, ref: string | null, baseRef: string | null = null): Record<string, unknown> {
+ * that base reachable for the diff.
+ *
+ * World-restore (issue #324, ADR 0062 Slice 4/5): when a PR already has a durable push-checkpoint,
+ * `commitSha` is emitted so a REPLACEMENT activation (a fresh worktree after a lease loss)
+ * reconstructs the working tree to the EXACT pushed SHA — the inversion of the round's outbound
+ * `git push` into an inbound `git fetch && git checkout <sha>` — rather than to a branch tip that may
+ * have moved. Omitted (no key) when the PR has no checkpoint yet, so a first activation clones the
+ * head branch normally. */
+export function repoEnvelopeVars(
+  repo: string,
+  ref: string | null,
+  baseRef: string | null = null,
+  commitSha: string | null = null,
+): Record<string, unknown> {
   if (!ref) return {};
   // Defence in depth: every current caller derives `repo` from parsePr/parseIssue (regex-bounded to
   // `owner/repo`), but this is an exported helper the fan-out epic gives many new callers. A repo
@@ -399,11 +412,33 @@ export function repoEnvelopeVars(repo: string, ref: string | null, baseRef: stri
         // The base branch this PR targets — emitted so the harness fetches its tip alongside the
         // single-branch head, keeping `origin/<base>` reachable for the diff. Omitted when unknown.
         ...(baseRef ? { baseRef } : {}),
+        // World-restore (issue #324): the last pushed SHA a replacement activation reconstructs the
+        // working tree to (inverting the round's push into a fetch+checkout). Only emitted when it is
+        // a well-formed 40-hex commit SHA: `commitSha` is forwarded to the harness as an EXACT
+        // checkout target, so a non-SHA ref or a whitespace-tainted value could reconstruct to an
+        // unintended ref (a moved branch tip) or fail provisioning. A malformed value degrades to
+        // omission — the harness then clones the head branch tip, the pre-#324 behaviour. Omitted too
+        // when the PR has no durable push-checkpoint yet.
+        ...(isCommitSha(commitSha) ? { commitSha } : {}),
       },
     },
   };
 }
 
+/** The last durable push-checkpoint SHA for a PR (issue #324, ADR 0062 Slice 4/5), or `null` when it
+ * has none yet. Threaded into `repoEnvelopeVars` so a replacement activation reconstructs the exact
+ * pushed tree. Best-effort: any store read failure (a legacy DB predating migration 049, an in-flight
+ * desync) degrades to `null` — the harness then clones the head branch tip, the pre-#324 behaviour —
+ * rather than blocking a submit/merge on the world store. */
+async function lastPushedSha(data: DataLayer, prKey: string): Promise<string | null> {
+  try {
+    return (await new WorldStore(data).lastCheckpoint(prKey))?.commitSha ?? null;
+  } catch (err) {
+    console.warn(`[world] ${prKey} last-checkpoint read: ${err}`);
+    return null;
+  }
+}
+
 /** Register a PR row (if new) and start the convergence process. Idempotent on prKey. Optional
  * `dependsOn` (explicit refs) is unioned with any `Depends-on:` line parsed from the PR body and
  * recorded as the PR's merge-stage dependency set. */
@@ -508,6 +543,11 @@ export async function submitPr(
     });
   }
   const abUrl = abandonUrl(abandonToken);
+  // World-restore (issue #324, ADR 0062 Slice 4/5): a re-run of convergence for a PR that already
+  // pushed is a resume — carry its last durable push-checkpoint so a replacement activation on a
+  // fresh worktree reconstructs the tree to the EXACT pushed SHA. Absent (null) on a first submit,
+  // which leaves the envelope unchanged.
+  const worldSha = await lastPushedSha(data, parsed.prKey);
   const { processInstanceKey } = await engine.createInstance({
     processDefinitionId: PROCESS_ID,
     variables: {
@@ -533,7 +573,7 @@ export async function submitPr(
       // Host-git provisioning (c8ctl): deliver the repository envelope so the `senior:pr-review`
       // harness clones an isolated workspace checked out on the PR head branch. Spread last so an
       // unresolved head (`{}`) leaves the other vars untouched.
-      ...repoEnvelopeVars(parsed.repo, headRef, baseRef),
+      ...repoEnvelopeVars(parsed.repo, headRef, baseRef, worldSha),
     },
   });
   const processKey = processInstanceKey == null ? null : String(processInstanceKey);
@@ -580,6 +620,9 @@ export async function startMerge(
   if (!headRef) {
     console.warn(`[startMerge] ${pr.prKey} head branch unresolved — merge-agent workspace won't be provisioned`);
   }
+  // World-restore (issue #324): the merge stage runs on the same durable working tree; carry the
+  // last push-checkpoint so a replacement fix-ci/rebase activation reconstructs the exact SHA.
+  const worldSha = await lastPushedSha(data, pr.prKey);
   const { processInstanceKey } = await engine.createInstance({
     processDefinitionId: MERGE_PROCESS_ID,
     variables: {
@@ -601,7 +644,7 @@ export async function startMerge(
       abandonBrief: renderAbandonBrief(abUrl),
       // Host-git provisioning (c8ctl): same repository envelope as the convergence loop, so the
       // fix-ci/rebase agents operate on an isolated checkout of the PR head branch.
-      ...repoEnvelopeVars(pr.repo, headRef, baseRef),
+      ...repoEnvelopeVars(pr.repo, headRef, baseRef, worldSha),
     },
   });
   if (processInstanceKey != null) {
@@ -1779,83 +1822,6 @@ export async function pollFeatureDelivery(data: DataLayer) {
   }
 }
 
-/** Reconcile each in-flight FEATURE run against its native `feature-escalation` user task (issue
- * #210 — feature-run escalations were invisible in the nwf UI). When a feature run escalates it parks
- * on the `feature-escalation` operator user task (an engine wait); no worker runs, so `feature_runs`
- * — which the schema-driven pages read — stayed `running` with nothing to show. This is the
- * `feature_runs` twin of `pollFeatureDelivery`: for each run that can be parked at (or resuming from)
- * the escalation, read its open user tasks and project the parked task onto the row via the pure
- * `deriveFeatureEscalationPatch` — flipping `status` to `escalated` and denormalising the escalation's
- * completable `userTaskKey` so the pages can drive an answer, and flipping back to `running` (clearing
- * the pointer) once it un-parks. It never writes `escalation_question` — that is persisted by the
- * `record-feature-escalation` worker at escalation entry and cleared on the exit paths, so the poller
- * can never clobber the source of truth for the question.
- *
- * Candidates are only the runs that could be parked here — `running` (may have just escalated) and
- * `escalated` (may have just resumed) — queried via the `feature_runs(status)` index, so the pass
- * stays O(in-flight), not O(total runs). Terminal-ward transitions THROUGH `record-feature` (answer
- * → abandon, SLA auto-abandon, done) clear the pointer in that worker, so a run that has already left
- * `escalated` never needs sweeping here. Best-effort + idempotent — per-run failures are isolated. */
-export async function pollFeatureEscalations(data: DataLayer, engine: EngineClient) {
-  const seen = new Set<string>();
-  const candidates: FeatureRun[] = [];
-  for (const status of ["running", "escalated"] as const) {
-    for (const run of await featureRuns(data).find({ status })) {
-      if (seen.has(run.feature_key)) continue;
-      seen.add(run.feature_key);
-      candidates.push(run);
-    }
-  }
-  for (const run of candidates) {
-    if (!run.process_key) continue;
-    try {
-      const tasks = await engine.openUserTasks({ processInstanceKey: run.process_key });
-      const task = tasks.find((t) => t.elementId === FEATURE_ESCALATION_ELEMENT);
-      const parked = task ? { userTaskKey: task.userTaskKey } : null;
-      const patch = deriveFeatureEscalationPatch(run, parked);
-      if (patch) {
-        await featureRuns(data).update(run.feature_key, { ...patch, updated_at: now() });
-      }
-    } catch (err) {
-      console.error(`[poller] feature escalation ${run.feature_key}: ${err}`);
-    }
-  }
-}
-
-/** Reconcile each BLOCKED FEATURE run against its native `feature-blocked` user task (issue #220 —
- * a blocked run parked at `feature-blocked` had no completion affordance in nwf). When a feature run
- * reaches a `blocked` outcome `record-feature` holds the row at the NON-terminal `awaiting_operator`
- * status and it parks on the `feature-blocked` operator user task (an engine wait); no worker runs, so
- * the schema-driven pages — which read `feature_runs` — had a status to show but NO pointer to drive a
- * completion action, so the run sat parked forever unless completed out-of-band. This is the blocked
- * twin of `pollFeatureEscalations`: for each run parked at (or resuming from) the blocked wait, read its
- * open user tasks and project the parked task's completable `userTaskKey` onto the row via the pure
- * `deriveFeatureBlockedPatch`, so the pages can drive an "Acknowledge blocked" action, and clear the
- * pointer once it un-parks. It never touches `status` — `record-feature` owns the `awaiting_operator`
- * flip and `record-blocked-ack` owns the terminal `blocked`, so the poller can never clobber either.
- *
- * Candidates are only the runs that could be parked here — `awaiting_operator` (parked at, or just
- * un-parked from, the blocked wait) — queried via the `feature_runs(status)` index, so the pass stays
- * O(in-flight), not O(total runs). The terminal-ward transition THROUGH `record-blocked-ack` (and the
- * acknowledge operation) clears the pointer, so a run that has already settled to `blocked` never needs
- * sweeping here. Best-effort + idempotent — per-run failures are isolated. */
-export async function pollFeatureBlocked(data: DataLayer, engine: EngineClient) {
-  for (const run of await featureRuns(data).find({ status: "awaiting_operator" })) {
-    if (!run.process_key) continue;
-    try {
-      const tasks = await engine.openUserTasks({ processInstanceKey: run.process_key });
-      const task = tasks.find((t) => t.elementId === FEATURE_BLOCKED_ELEMENT);
-      const parked = task ? { userTaskKey: task.userTaskKey } : null;
-      const patch = deriveFeatureBlockedPatch(run, parked);
-      if (patch) {
-        await featureRuns(data).update(run.feature_key, { ...patch, updated_at: now() });
-      }
-    } catch (err) {
-      console.error(`[poller] feature blocked ${run.feature_key}: ${err}`);
-    }
-  }
-}
-
 /** The app manifest, read and parsed exactly ONCE at module load. `activeStatusesFor` is invoked
  * three times during module initialization (the PR/plan/feature constants below); parsing here keeps
  * that to a single synchronous `readFileSync` + `JSON.parse` instead of one per lookup. */
@@ -1904,16 +1870,14 @@ export const FEATURE_ACTIVE_STATUSES: readonly FeatureRunStatus[] =
 
 /** Reconcile the unified Tasks-inbox read-model (`user_tasks`) against the engine's currently-open
  * native user-task escalations (issue #236). The Tasks page lists EVERY open escalation awaiting a
- * human decision — the feature kinds (already denormalised onto `feature_runs` by the two feature
- * pollers, which run earlier in this pass) plus the epic/PR kinds (`plan-review-decision`,
- * `trial-merge-decision`, `wait-answer`) that had no app-side pointer at all, so the pages could not
- * drive their completion. This is the generalisation of `pollFeatureEscalations`/`pollFeatureBlocked`
- * across all subjects: for each in-flight plan / PR it reads the instance's open user tasks and
- * projects one `user_tasks` row per escalation, enriching the display `question` from the audit
- * tables each kind already records. `reconcileUserTasks` then diffs the desired open set against the
- * persisted rows so a completed task's row is deleted (answered here, via the task inbox, or
- * out-of-band) and `showCount` reflects live pending work. Best-effort + idempotent — per-instance
- * failures are isolated so one bad instance never stalls the pass. */
+ * human decision — the feature kinds (`feature-escalation` / `feature-blocked`) plus the epic/PR kinds
+ * (`plan-review-decision`, `trial-merge-decision`, `wait-answer`) — that otherwise had no app-side
+ * pointer, so the pages could not drive their completion. For each in-flight feature / plan / PR it
+ * reads the instance's open user tasks and projects one `user_tasks` row per escalation, enriching the
+ * display `question` from the audit tables each kind already records. `reconcileUserTasks` then diffs
+ * the desired open set against the persisted rows so a completed task's row is deleted (answered here,
+ * via the task inbox, or out-of-band) and `showCount` reflects live pending work. Best-effort +
+ * idempotent — per-instance failures are isolated so one bad instance never stalls the pass. */
 export async function pollUserTasks(data: DataLayer, engine: EngineClient) {
   const at = now();
   const desired: UserTaskRow[] = [];
@@ -1921,54 +1885,63 @@ export async function pollUserTasks(data: DataLayer, engine: EngineClient) {
     if (row) desired.push(row);
   };
 
-  // Feature-run escalations — the completable keys are denormalised onto `feature_runs` by
-  // pollFeatureEscalations/pollFeatureBlocked (earlier in this pass), so no per-instance engine read
-  // is needed here.
+  // Feature-run escalations / blocked runs — read each in-flight feature run's open user tasks directly
+  // from the engine (issue #332: the denormalised `feature_runs.escalation_user_task_key` /
+  // `blocked_user_task_key` pointers were dropped in the contract phase, so this now reads the live
+  // task exactly as the plan/PR scans below do — one canonical read, no denormalised mirror). Dedupe by
+  // `feature_key` across the status queries so a run whose status transitions mid-pass is not processed
+  // twice.
   const featureSeen = new Set<string>();
   for (const status of FEATURE_ACTIVE_STATUSES) {
     for (const run of await featureRuns(data).find({ status })) {
+      if (!run.process_key) continue;
       if (featureSeen.has(run.feature_key)) continue;
       featureSeen.add(run.feature_key);
-      if (run.escalation_user_task_key) {
-        // Source the question from the canonical append-only `feature_escalations` audit log (issue
-        // #305) — the surviving table `record-feature-escalation` writes — falling back to the legacy
-        // denormalised `feature_runs.escalation_question` while both coexist (expand phase). This is the
-        // feature analogue of the plan-review/trial-merge/PR-loop question enrichment below, and lets the
-        // denormalised column be dropped in the contract phase without the Tasks grid losing the text.
-        const question = latestFeatureEscalationQuestion(await featureEscalations(data).find({ feature_key: run.feature_key })) ??
-          run.escalation_question;
-        push(
-          buildUserTaskRow(
-            {
-              userTaskKey: run.escalation_user_task_key,
-              elementId: FEATURE_ESCALATION_ELEMENT,
-              subjectType: "feature",
-              subjectKey: run.feature_key,
-              subjectTitle: run.title,
-              subjectUrl: run.issue_url,
-              question,
-              processKey: run.process_key,
-            },
-            at,
-          ),
-        );
+      let tasks: { userTaskKey: string; elementId?: string }[];
+      try {
+        tasks = await engine.openUserTasks({ processInstanceKey: run.process_key });
+      } catch (err) {
+        console.error(`[poller] user tasks (feature ${run.feature_key}): ${err}`);
+        continue;
       }
-      if (run.blocked_user_task_key) {
-        push(
-          buildUserTaskRow(
-            {
-              userTaskKey: run.blocked_user_task_key,
-              elementId: FEATURE_BLOCKED_ELEMENT,
-              subjectType: "feature",
-              subjectKey: run.feature_key,
-              subjectTitle: run.title,
-              subjectUrl: run.issue_url,
-              question: run.delivery_label,
-              processKey: run.process_key,
-            },
-            at,
-          ),
-        );
+      for (const t of tasks) {
+        if (t.elementId === FEATURE_ESCALATION_ELEMENT) {
+          // Source the question from the canonical append-only `feature_escalations` audit log (issue
+          // #305) — the surviving table `record-feature-escalation` writes — the feature analogue of the
+          // plan-review/trial-merge/PR-loop question enrichment below.
+          const question = latestFeatureEscalationQuestion(await featureEscalations(data).find({ feature_key: run.feature_key }));
+          push(
+            buildUserTaskRow(
+              {
+                userTaskKey: t.userTaskKey,
+                elementId: FEATURE_ESCALATION_ELEMENT,
+                subjectType: "feature",
+                subjectKey: run.feature_key,
+                subjectTitle: run.title,
+                subjectUrl: run.issue_url,
+                question,
+                processKey: run.process_key,
+              },
+              at,
+            ),
+          );
+        } else if (t.elementId === FEATURE_BLOCKED_ELEMENT) {
+          push(
+            buildUserTaskRow(
+              {
+                userTaskKey: t.userTaskKey,
+                elementId: FEATURE_BLOCKED_ELEMENT,
+                subjectType: "feature",
+                subjectKey: run.feature_key,
+                subjectTitle: run.title,
+                subjectUrl: run.issue_url,
+                question: run.delivery_label,
+                processKey: run.process_key,
+              },
+              at,
+            ),
+          );
+        }
       }
     }
   }
@@ -2126,8 +2099,6 @@ export async function pollOnce(
   await pollPromotion(data, engine, token);
   await pollFeatureDelivery(data);
   await pollLineage(data);
-  await pollFeatureEscalations(data, engine);
-  await pollFeatureBlocked(data, engine);
   await pollUserTasks(data, engine);
   if (engineRest) {
     const base = engineRest.restAddress.replace(/\/+$/, "");

package/app/stage.test.ts

@@ -5,15 +5,12 @@
 import { test } from "node:test";
 import { assert, assertEquals } from "#test-assert";
 import { FEATURE_RUN_STATUSES } from "./feature.ts";
-import { deriveEscalationOpen, deriveListBucket, deriveStage, type StageInput } from "./stage.ts";
+import { deriveListBucket, deriveStage, type StageInput } from "./stage.ts";
 
 const base = (over: Partial<StageInput> & { status: string }): StageInput => ({
   pr_key: null,
   converge: 1,
   auto_merge: 1,
-  escalation_question: null,
-  escalation_user_task_key: null,
-  blocked_user_task_key: null,
   ...over,
 });
 
@@ -71,10 +68,11 @@ test("skipped: the three converge/auto_merge cases", () => {
   assertEquals(deriveStage(base({ status: "running", converge: 1, auto_merge: 1 })).skipped, "");
 });
 
-test("attention: blocked, escalation, none", () => {
-  assertEquals(deriveStage(base({ status: "awaiting_operator", blocked_user_task_key: "ut-1" })).attention, "blocked");
-  assertEquals(deriveStage(base({ status: "escalated", escalation_user_task_key: "ut-2" })).attention, "⚠");
-  assertEquals(deriveStage(base({ status: "escalated", escalation_question: "which base?" })).attention, "⚠");
+test("attention: derives from status alone (blocked, escalation, none)", () => {
+  // Issue #332 dropped the denormalised escalation pointer/question columns; `attention` is now a pure
+  // function of `status` — `awaiting_operator` (a parked blocked run) → "blocked", `escalated` → "⚠".
+  assertEquals(deriveStage(base({ status: "awaiting_operator" })).attention, "blocked");
+  assertEquals(deriveStage(base({ status: "escalated" })).attention, "⚠");
   assertEquals(deriveStage(base({ status: "running" })).attention, null);
 });
 
@@ -92,7 +90,7 @@ test("escalated WITHOUT pr_key → Implementing / null", () => {
 });
 
 test("awaiting_operator WITHOUT pr_key → Implementing / null, attention 'blocked' when parked", () => {
-  const d = deriveStage(base({ status: "awaiting_operator", pr_key: null, blocked_user_task_key: "ut-3" }));
+  const d = deriveStage(base({ status: "awaiting_operator", pr_key: null }));
   assertEquals(d.stage, "Implementing");
   assertEquals(d.state, null);
   assertEquals(d.attention, "blocked");
@@ -105,47 +103,3 @@ test("deriveListBucket: history iff terminal AND acknowledged, else active", ()
   assertEquals(deriveListBucket("running", "2024-01-01T00:00:00Z"), "active");
   assertEquals(deriveListBucket("blocked", "2024-01-01T00:00:00Z"), "history");
 });
-
-// deriveEscalationOpen (issue #272): the single fail-closed "open escalation" display signal. TRUE iff
-// all three independently-written escalation columns AGREE the run is parked at an answerable
-// escalation; any single missing/torn field yields FALSE so the pages render not-escalated.
-test("deriveEscalationOpen: true only when status, pointer AND question all present", () => {
-  assertEquals(
-    deriveEscalationOpen({ status: "escalated", escalation_user_task_key: "ut-7", escalation_question: "which base?" }),
-    true,
-  );
-});
-
-test("deriveEscalationOpen: torn tuple (pointer set, question blank) renders as NOT escalated", () => {
-  // The mirror tear observed on nwf#270: status=escalated + live pointer + blank question.
-  assertEquals(
-    deriveEscalationOpen({ status: "escalated", escalation_user_task_key: "ut-7", escalation_question: null }),
-    false,
-  );
-  assertEquals(
-    deriveEscalationOpen({ status: "escalated", escalation_user_task_key: "ut-7", escalation_question: "" }),
-    false,
-  );
-});
-
-test("deriveEscalationOpen: torn tuple (question set, pointer null) renders as NOT escalated", () => {
-  // The entry-window tear: record-feature-escalation persisted the question but the poller has not yet
-  // denormalised the pointer.
-  assertEquals(
-    deriveEscalationOpen({ status: "escalated", escalation_user_task_key: null, escalation_question: "which base?" }),
-    false,
-  );
-});
-
-test("deriveEscalationOpen: a resumed run whose status lags behind a cleared tuple is NOT escalated", () => {
-  // status still 'escalated' but the answer op already cleared pointer + question → fail closed.
-  assertEquals(
-    deriveEscalationOpen({ status: "escalated", escalation_user_task_key: null, escalation_question: null }),
-    false,
-  );
-  // A non-escalated status can never be open regardless of stray column values.
-  assertEquals(
-    deriveEscalationOpen({ status: "running", escalation_user_task_key: "ut-7", escalation_question: "which base?" }),
-    false,
-  );
-});

package/app/stage.ts

@@ -43,9 +43,6 @@ export interface StageInput {
   pr_key?: string | null;
   converge?: number | boolean | null;
   auto_merge?: number | boolean | null;
-  escalation_question?: string | null;
-  escalation_user_task_key?: string | null;
-  blocked_user_task_key?: string | null;
 }
 
 /** The derived pipeline projection for one run. `skipped` is a space-separated set of stage keys not
@@ -94,44 +91,15 @@ export function deriveStage(run: StageInput): DerivedStage {
 
   // `attention`: a short badge for the active stage (the renderer colours it from `state`). This is how
   // a parked `awaiting_operator`/`escalated` run surfaces as attention WITHOUT altering its stage.
-  const attention = run.blocked_user_task_key
-    ? "blocked"
-    : run.escalation_user_task_key || run.escalation_question
-      ? "⚠"
-      : null;
+  // Derived from `status` alone (issue #332): the parked-task pointers that used to source it were
+  // dropped with the denormalised escalation surface, and the authoritative "who is waiting on a human"
+  // list now lives on the `user_tasks` Tasks inbox. `awaiting_operator` (parked at `feature-blocked`)
+  // shows the blocked glyph; `escalated` (parked at `feature-escalation`) shows the ⚠ badge.
+  const attention = status === "awaiting_operator" ? "blocked" : status === "escalated" ? "⚠" : null;
 
   return { stage, state, skipped: skippedKeys.join(" "), attention };
 }
 
-/** Derive the single fail-closed "open escalation" display signal for one feature run (issue #272).
- *
- * The open-escalation condition is jointly encoded by THREE independently-written columns —
- * `status='escalated'`, `escalation_user_task_key` (the completable pointer), and `escalation_question`
- * — owned by different writers on different schedules (the `record-feature-escalation` service task
- * sets the question; `pollFeatureEscalations`/`deriveFeatureEscalationPatch` sets status + pointer; the
- * answer operation clears the tuple). Because they are not written as one atomic tuple, a reader can
- * observe a TORN interim state (e.g. `status=escalated` + pointer set + `question=null`) and render a
- * self-contradictory escalation — an "answer me" affordance with nothing to answer.
- *
- * Collapse that class at the consumer: the pages gate the escalation affordances (Abandon / answer
- * form) on this ONE derived conjunction rather than on any single column, so a torn tuple renders as
- * NOT escalated (fail closed) instead of escalated-but-blank. `true` iff ALL THREE fields agree the run
- * is parked at an answerable escalation; any missing field yields `false`. Maintained as a write-time
- * projection by the feature_runs gateway (like `stage`/`list_bucket`), so it stays fresh on every write
- * — including the answer operation's eager tuple-clear, which makes the affordance disappear WITHOUT
- * waiting a poll pass. Pure and read-only. */
-export function deriveEscalationOpen(run: {
-  status: string;
-  escalation_question?: string | null;
-  escalation_user_task_key?: string | null;
-}): boolean {
-  return (
-    run.status === "escalated" &&
-    (run.escalation_user_task_key ?? "") !== "" &&
-    (run.escalation_question ?? "") !== ""
-  );
-}
-
 /** The Active/History partition label (§5), maintained at write time so the flat-DSL page tabs filter
  * on a stored `list_bucket` column with only `in` clauses. `history` iff the row is in a truly-terminal
  * status AND acknowledged; otherwise `active` (live runs + terminal-but-UNACKNOWLEDGED runs). */

package/app/userTasks.test.ts

@@ -2,7 +2,7 @@
 // one resolved open escalation user task into its desired `user_tasks` row (or null for a
 // non-escalation / blank key), and `reconcileUserTasks` diffs the desired open set against the
 // persisted rows into the minimal insert/update/delete plan the `pollUserTasks` reconcile applies.
-// These are the pure source of truth the poller projects, mirroring `deriveFeatureEscalationPatch`.
+// These are the pure source of truth the poller projects.
 import { test } from "node:test";
 import { assert, assertEquals } from "#test-assert";
 import type { PlanReview } from "./plan.ts";

package/app/userTasks.ts

@@ -10,11 +10,11 @@
 // (app/service.ts) projects: `buildUserTaskRow` (one open task → a desired row) and
 // `reconcileUserTasks` (the desired set vs the persisted set → the minimal upserts + deletes). The
 // engine iteration + writes live in the poller; the decisions live here so they are unit-testable
-// without a host, mirroring `deriveFeatureEscalationPatch`.
+// without a host.
 //
 // Completion is NOT owned here — the page posts the typed form variables to the ONE canonical human
-// completer (`completeEscalationAsHuman`, app/agentCompletion.ts) / the existing feature answer &
-// acknowledge operations, the exact resume path the task inbox uses. This module only makes the open
+// completer (`completeEscalationAsHuman`, app/agentCompletion.ts) via the `complete-user-task` door,
+// the exact resume path the task inbox uses. This module only makes the open
 // tasks visible; a completed task's row is removed on the next pass when the engine no longer reports
 // it open.
 import type { DataLayer } from "@nanobpm/urban";