@nanobpm/nano-workforce 0.99.1 → 0.101.0

package/pages/tasks.page.json

@@ -119,22 +119,6 @@
           }
         ],
         "rowKey": "user_task_key",
-        "rowActions": [
-          {
-            "label": "Abandon",
-            "confirm": "Abandon this escalated task? The run gives up on it (no PR).",
-            "showWhenField": "user_task_key",
-            "action": {
-              "path": "/app/api/actions/complete-user-task",
-              "body": {
-                "userTaskKey": "{{row.user_task_key}}",
-                "variables": {
-                  "resolution": "abandon"
-                }
-              }
-            }
-          }
-        ],
         "detail": {
           "linkField": "subject_url",
           "fields": [
@@ -147,18 +131,32 @@
             "showWhenField": "user_task_key",
             "title": "Answer escalation",
             "promptField": "question",
-            "inputKey": "answer",
-            "inputLabel": "Guidance for the implementation agent",
-            "submitLabel": "Answer & re-dispatch",
+            "submitLabel": "Submit decision",
+            "fields": [
+              {
+                "inputKey": "resolution",
+                "type": "select",
+                "inputLabel": "Resolution",
+                "options": [
+                  { "value": "answer", "label": "Answer — re-dispatch the task with this guidance" },
+                  { "value": "abandon", "label": "Abandon — give up on this task" }
+                ]
+              },
+              {
+                "inputKey": "answer",
+                "type": "textarea",
+                "inputLabel": "Answer / guidance for the implementation agent",
+                "conditional": {
+                  "hide": "=resolution != \"answer\""
+                }
+              }
+            ],
             "action": {
               "path": "/app/api/actions/complete-user-task",
-              "successLabel": "Answered — the agent will resume",
+              "successLabel": "Decision submitted — the process will continue",
               "body": {
                 "userTaskKey": "{{row.user_task_key}}",
-                "variables": {
-                  "resolution": "answer",
-                  "answer": "{{form.answer}}"
-                }
+                "variables": "{{form}}"
               }
             }
           }
@@ -220,22 +218,6 @@
           }
         ],
         "rowKey": "user_task_key",
-        "rowActions": [
-          {
-            "label": "Proceed",
-            "confirm": "Proceed with the current plan as-is? It is dispatched unchanged.",
-            "showWhenField": "user_task_key",
-            "action": {
-              "path": "/app/api/actions/complete-user-task",
-              "body": {
-                "userTaskKey": "{{row.user_task_key}}",
-                "variables": {
-                  "directive": "proceed"
-                }
-              }
-            }
-          }
-        ],
         "detail": {
           "linkField": "subject_url",
           "fields": [
@@ -246,20 +228,34 @@
           ],
           "form": {
             "showWhenField": "user_task_key",
-            "title": "Revise — send the plan back to the planner",
+            "title": "Review the plan",
             "promptField": "question",
-            "inputKey": "notes",
-            "inputLabel": "Revision guidance for the planner",
-            "submitLabel": "Revise & re-plan",
+            "submitLabel": "Submit decision",
+            "fields": [
+              {
+                "inputKey": "directive",
+                "type": "select",
+                "inputLabel": "Directive",
+                "options": [
+                  { "value": "proceed", "label": "Proceed — dispatch the current plan as-is" },
+                  { "value": "revise", "label": "Revise — send the plan back to the planner" }
+                ]
+              },
+              {
+                "inputKey": "notes",
+                "type": "textarea",
+                "inputLabel": "Revision guidance for the planner",
+                "conditional": {
+                  "hide": "=directive != \"revise\""
+                }
+              }
+            ],
             "action": {
               "path": "/app/api/actions/complete-user-task",
-              "successLabel": "Sent back — the planner will revise",
+              "successLabel": "Decision recorded",
               "body": {
                 "userTaskKey": "{{row.user_task_key}}",
-                "variables": {
-                  "directive": "revise",
-                  "notes": "{{form.notes}}"
-                }
+                "variables": "{{form}}"
               }
             }
           }
@@ -321,58 +317,45 @@
           }
         ],
         "rowKey": "user_task_key",
-        "rowActions": [
-          {
-            "label": "Proceed",
-            "confirm": "Accept the red trial merge and continue?",
-            "showWhenField": "user_task_key",
-            "action": {
-              "path": "/app/api/actions/complete-user-task",
-              "body": {
-                "userTaskKey": "{{row.user_task_key}}",
-                "variables": {
-                  "action": "proceed"
-                }
-              }
+        "detail": {
+          "linkField": "subject_url",
+          "fields": [
+            {
+              "field": "question",
+              "label": "Trial merge"
             }
-          },
-          {
-            "label": "Rebase",
-            "confirm": "Re-run the trial merge?",
+          ],
+          "form": {
             "showWhenField": "user_task_key",
-            "action": {
-              "path": "/app/api/actions/complete-user-task",
-              "body": {
-                "userTaskKey": "{{row.user_task_key}}",
-                "variables": {
-                  "action": "rebase"
-                }
+            "title": "Trial-merge decision",
+            "promptField": "question",
+            "submitLabel": "Submit decision",
+            "fields": [
+              {
+                "inputKey": "action",
+                "type": "select",
+                "inputLabel": "Action",
+                "options": [
+                  { "value": "proceed", "label": "Proceed — accept the red trial merge and continue" },
+                  { "value": "rebase", "label": "Rebase — re-run the trial merge" },
+                  { "value": "abandon", "label": "Abandon — stop and finalize the plan" }
+                ]
+              },
+              {
+                "inputKey": "notes",
+                "type": "textarea",
+                "inputLabel": "Notes"
               }
-            }
-          },
-          {
-            "label": "Abandon",
-            "confirm": "Stop and finalize the plan?",
-            "showWhenField": "user_task_key",
+            ],
             "action": {
               "path": "/app/api/actions/complete-user-task",
+              "successLabel": "Decision recorded",
               "body": {
                 "userTaskKey": "{{row.user_task_key}}",
-                "variables": {
-                  "action": "abandon"
-                }
+                "variables": "{{form}}"
               }
             }
           }
-        ],
-        "detail": {
-          "linkField": "subject_url",
-          "fields": [
-            {
-              "field": "question",
-              "label": "Trial merge"
-            }
-          ]
         },
         "refreshMs": 5000
       }
@@ -532,11 +515,13 @@
             "inputLabel": "Disposition note (what you did / why)",
             "submitLabel": "Acknowledge & close",
             "action": {
-              "path": "/app/api/actions/acknowledge-blocked",
+              "path": "/app/api/actions/complete-user-task",
               "successLabel": "Acknowledged — the run will close",
               "body": {
                 "userTaskKey": "{{row.user_task_key}}",
-                "note": "{{form.note}}"
+                "variables": {
+                  "note": "{{form.note}}"
+                }
               }
             }
           }

package/resources/forms/feature-escalation.form

@@ -21,6 +21,9 @@
       "label": "Answer / guidance for the implementation agent",
       "conditional": {
         "hide": "=resolution != \"answer\""
+      },
+      "validate": {
+        "required": true
       }
     }
   ]

package/test/worldDb.ts

@@ -0,0 +1,103 @@
+// A test-only DataLayer over a real in-memory `node:sqlite` db with the world-restore schema
+// (`db/migrations/049_world_checkpoint.sql`) applied, for exercising `app/world/store.ts` and the
+// `app/world/checkpoint.ts` orchestration against a REAL SQLite engine — so the durable fence (the
+// `UNIQUE(pr_key, idempotency_key)` constraint) and the monotonic offset are proven, not mocked.
+import { readFileSync } from "node:fs";
+import { DatabaseSync, type SQLInputValue } from "node:sqlite";
+import { afterEach } from "node:test";
+import { fileURLToPath } from "node:url";
+import type { DataLayer } from "@nanobpm/urban";
+
+const openDbs = new Set<DatabaseSync>();
+afterEach(() => {
+  for (const raw of openDbs) {
+    if (openDbs.delete(raw)) raw.close();
+  }
+});
+
+function coerce(p: unknown): SQLInputValue {
+  if (p === null || p === undefined) return null;
+  if (typeof p === "boolean") return p ? 1 : 0;
+  return p as SQLInputValue;
+}
+
+const quote = (id: string) => `"${id.replace(/"/g, '""')}"`;
+
+/** A minimal async `Table<T>`-shaped gateway over one real SQLite table — the insert/find/findOne/
+ * update/get subset the world store uses. Mirrors the runtime `Table<T>` semantics: `insert` omits
+ * `undefined` keys (schema default governs), `update` skips `undefined` keys and clears on `null`. */
+function gateway(db: DatabaseSync, name: string, pk: string) {
+  return {
+    // biome-ignore lint/suspicious/noExplicitAny: test-only gateway over dynamic row shapes.
+    async insert(row: any): Promise<number | bigint> {
+      const keys = Object.keys(row).filter((k) => row[k] !== undefined);
+      const cols = keys.map(quote).join(", ");
+      const placeholders = keys.map(() => "?").join(", ");
+      const r = db.prepare(`INSERT INTO ${quote(name)} (${cols}) VALUES (${placeholders})`).run(...keys.map((k) => coerce(row[k])));
+      return pk === "id" ? r.lastInsertRowid : (row[pk] as number);
+    },
+    // biome-ignore lint/suspicious/noExplicitAny: test-only gateway over dynamic row shapes.
+    async find(where: any = {}): Promise<any[]> {
+      const keys = Object.keys(where);
+      const clause = keys.length ? `WHERE ${keys.map((k) => `${quote(k)} = ?`).join(" AND ")}` : "";
+      return db.prepare(`SELECT * FROM ${quote(name)} ${clause}`).all(...keys.map((k) => coerce(where[k])));
+    },
+    // biome-ignore lint/suspicious/noExplicitAny: test-only gateway over dynamic row shapes.
+    async findOne(where: any = {}): Promise<any> {
+      return (await this.find(where))[0];
+    },
+    // biome-ignore lint/suspicious/noExplicitAny: test-only gateway over dynamic row shapes.
+    async get(id: any): Promise<any> {
+      return db.prepare(`SELECT * FROM ${quote(name)} WHERE ${quote(pk)} = ?`).get(coerce(id));
+    },
+    // biome-ignore lint/suspicious/noExplicitAny: test-only gateway over dynamic row shapes.
+    async update(id: any, patch: any): Promise<number> {
+      const keys = Object.keys(patch).filter((k) => patch[k] !== undefined);
+      if (keys.length === 0) return 0;
+      const set = keys.map((k) => `${quote(k)} = ?`).join(", ");
+      const r = db.prepare(`UPDATE ${quote(name)} SET ${set} WHERE ${quote(pk)} = ?`).run(...keys.map((k) => coerce(patch[k])), coerce(id));
+      return Number(r.changes);
+    },
+  };
+}
+
+/** A minimal self-referential `DataSource`-shaped gateway over the real db: the `table` surface plus
+ * a real `tx()` that BEGIN/COMMIT/ROLLBACKs on the underlying SQLite connection, so the world store's
+ * atomic `recordCheckpoint` (checkpoint + effects in one transaction) is exercised against genuine
+ * transaction semantics rather than mocked. `tx(fn)` passes the SAME source object to `fn`, so a test
+ * that decorates `table` on the returned source sees its decoration inside the transaction too. */
+type MemDataSource = {
+  table: (name: string, pk?: string) => ReturnType<typeof gateway>;
+  tx<T>(fn: (t: MemDataSource) => Promise<T>): Promise<T>;
+};
+
+function openDataSource(db: DatabaseSync): MemDataSource {
+  const ds: MemDataSource = {
+    table: (name, pk = "id") => gateway(db, name, pk),
+    async tx(fn) {
+      db.exec("BEGIN");
+      try {
+        const r = await fn(ds);
+        db.exec("COMMIT");
+        return r;
+      } catch (e) {
+        db.exec("ROLLBACK");
+        throw e;
+      }
+    },
+  };
+  return ds;
+}
+
+/** A `DataLayer` stub over a fresh in-memory db with the world schema applied. */
+export function memWorldData(): { data: DataLayer; db: DatabaseSync } {
+  const db = new DatabaseSync(":memory:");
+  openDbs.add(db);
+  const sql = readFileSync(fileURLToPath(new URL("../db/migrations/049_world_checkpoint.sql", import.meta.url)), "utf8");
+  db.exec(sql);
+  const data = {
+    table: (name: string, pk = "id") => gateway(db, name, pk),
+    open: () => openDataSource(db),
+  } as unknown as DataLayer;
+  return { data, db };
+}

package/workers/persist-round/worker.ts

@@ -7,6 +7,7 @@
 import type { AppJobHandler } from "@nanobpm/urban";
 import { abandonTokenFromUrl } from "../../app/abandon.ts";
 import { ensurePr, parsePr } from "../../app/service.ts";
+import { type Effect, isCommitSha, isEffectKind, recordWorldCheckpoint, WorldStore } from "../../app/world/index.ts";
 import type { WorkerInputs } from "../../nano-generated/worker-io.d.ts";
 
 // Input is typed off the model data envelope (`PrPersistRoundIn` in convergence-loop.bpmn),
@@ -32,6 +33,54 @@ function workerOf(vars: Record<string, unknown>): string | undefined {
   return typeof v === "string" && v.trim() !== "" ? v.trim() : undefined;
 }
 
+/** The world-restore marker (issue #324, ADR 0062 Slice 4/5, the WORLD half). When a round pushed
+ * changes, the c8ctl harness reports `{commitSha, effects?}` under this reserved key so the app
+ * records a durable push-checkpoint: the pushed SHA a replacement activation reconstructs the working
+ * tree to (inverting `git push` → `git fetch && git checkout <sha>`), plus the round's irreversible
+ * effect ledger (each fence-keyed) so a resume skips an already-applied effect. Absent (a `waiting`
+ * round, or a harness predating #324) → no checkpoint is recorded (nothing was pushed). */
+const WORLD_MARKER_KEY = "worldMarker";
+
+interface WorldMarker {
+  readonly commitSha: string;
+  readonly effects?: readonly Effect[];
+}
+
+/** Normalize one externally-supplied effect from the harness `worldMarker`, or `null` when it is not
+ * a usable effect. This is a CONTRACT BOUNDARY: the marker arrives from out-of-process, so both the
+ * fence key AND the effect kind are untrusted. We (a) TRIM `idempotencyKey` so whitespace variants of
+ * one real effect collapse to a single fence key rather than manufacturing distinct ledger rows that
+ * defeat the fence, and (b) validate `kind` against the canonical {@link EFFECT_KINDS} so an unknown
+ * kind can never enter the durable ledger. `description` is trimmed to a non-empty note or dropped. */
+function normalizeEffect(raw: unknown): Effect | null {
+  // biome-ignore lint/plugin: runtime/framework contract boundary for external data shape
+  const e = raw as { kind?: unknown; idempotencyKey?: unknown; description?: unknown } | null | undefined;
+  if (!e || !isEffectKind(e.kind)) return null;
+  if (typeof e.idempotencyKey !== "string") return null;
+  const idempotencyKey = e.idempotencyKey.trim();
+  if (idempotencyKey === "") return null;
+  const description = typeof e.description === "string" ? e.description.trim() : "";
+  return { kind: e.kind, idempotencyKey, ...(description !== "" ? { description } : {}) };
+}
+
+export function worldMarkerOf(vars: Record<string, unknown>): WorldMarker | null {
+  // biome-ignore lint/plugin: runtime/framework contract boundary for external data shape
+  const m = vars[WORLD_MARKER_KEY] as { commitSha?: unknown; effects?: unknown } | undefined;
+  if (!m || typeof m.commitSha !== "string") return null;
+  // `commitSha` is used as an EXACT checkout target on restore (`git fetch && git checkout <sha>`),
+  // so validate it is a well-formed 40-hex SHA — the SAME guard the emit boundary `repoEnvelopeVars`
+  // applies (via `isCommitSha`) so the two boundaries can't drift. An arbitrary ref (e.g. `main`) or
+  // an abbreviated SHA would reconstruct to a moved branch tip or fail restore, undermining the
+  // "reconstruct the exact tree at <sha>" contract. Trim first so a whitespace-tainted valid SHA
+  // still passes; a value that isn't a full object name degrades to no checkpoint (a `waiting` round).
+  const commitSha = m.commitSha.trim();
+  if (!isCommitSha(commitSha)) return null;
+  const effects = Array.isArray(m.effects)
+    ? m.effects.map(normalizeEffect).filter((e): e is Effect => e !== null)
+    : undefined;
+  return { commitSha, ...(effects && effects.length > 0 ? { effects } : {}) };
+}
+
 const handler: AppJobHandler<In> = async (job, app) => {
   // This worker is the "addressed"/"waiting" path, so `status` resolves to one of those
   // domain values. `summary` is left undefined when absent: the write boundary omits it so the
@@ -75,6 +124,25 @@ const handler: AppJobHandler<In> = async (job, app) => {
     updated_at: now,
   });
 
+  // World checkpoint (issue #324, ADR 0062 Slice 4/5): when this round pushed, record the durable
+  // push-checkpoint — the pushed SHA a replacement activation reconstructs the tree to, plus the
+  // round's fence-keyed effect ledger. The JOIN to the mind's `session.checkpoint(...)` (Slice 1)
+  // happens harness-side (out of process); here we persist the WORLD marker so restore can invert
+  // the push. Best-effort: a checkpoint-store failure must not fail an already-recorded round.
+  const marker = worldMarkerOf(job.variables);
+  if (marker) {
+    try {
+      await recordWorldCheckpoint(new WorldStore(app.data), {
+        prKey,
+        roundNo: round,
+        commitSha: marker.commitSha,
+        ...(marker.effects ? { effects: marker.effects } : {}),
+      });
+    } catch (err) {
+      app.log.warn("world checkpoint record failed", { prKey, round, err: String(err) });
+    }
+  }
+
   return {};
 };
 

package/workers/record-blocked-ack/worker.test.ts

@@ -32,15 +32,12 @@ function fakeApp(rows: Record<string, unknown>[]) {
 }
 
 test("record-blocked-ack: settles the parked run at terminal blocked and records the operator note", async () => {
-  const rows = [{ feature_key: "owner/repo#7", status: "awaiting_operator", delivery_label: null, blocked_user_task_key: "ut-7" }];
+  const rows = [{ feature_key: "owner/repo#7", status: "awaiting_operator", delivery_label: null }];
   const app = fakeApp(rows);
   const out = await handler({ variables: { featureKey: "owner/repo#7", note: "reassigned to a human" } } as any, app);
   assertEquals(out, {});
   assertEquals(rows[0].status, "blocked");
   assertEquals(rows[0].delivery_label, "operator: reassigned to a human");
-  // The completable-task pointer is cleared on the terminal-ward transition so the pages stop offering
-  // the acknowledge affordance for a now-completed task (pollFeatureBlocked no longer sweeps this row).
-  assertEquals(rows[0].blocked_user_task_key, null);
 });
 
 test("record-blocked-ack: a blank note falls back to an 'acknowledged' label", async () => {

package/workers/record-blocked-ack/worker.ts

@@ -26,11 +26,6 @@ const handler: AppJobHandler<In, Record<string, never>> = async (job, app) => {
   await featureRuns(app.data).update(featureKey, {
     status: "blocked",
     delivery_label: note ? `operator: ${note}` : "acknowledged",
-    // The run has left the `feature-blocked` wait, so clear the denormalised completable-task pointer
-    // the pages gate the "Acknowledge blocked" affordance on. pollFeatureBlocked only sweeps
-    // `awaiting_operator` runs, so this terminal-ward transition must clear it itself or a stale pointer
-    // would linger on the now-terminal row.
-    blocked_user_task_key: null,
     updated_at: ts,
   });
   app.log.info("record-blocked-ack", { featureKey, note: note ?? null });

package/workers/record-feature/worker.ts

@@ -54,12 +54,6 @@ const handler: AppJobHandler<In, Out> = async (job, app) => {
     status: rowStatus,
     pr_key: prKey,
     outcome: summary ?? null,
-    // The run has left the `feature-escalation` wait (answered → abandon, SLA auto-abandon, or the
-    // agent finished without escalating), so clear the denormalised escalation pointer the pages gate
-    // on. pollFeatureEscalations only sweeps `running`/`escalated` runs, so a terminal-ward transition
-    // through here must clear it itself or the stale question would linger on the row.
-    escalation_question: null,
-    escalation_user_task_key: null,
     updated_at: ts,
   });
   app.log.info("record-feature", { featureKey, featureStatus, rowStatus, prKey });

package/workers/record-feature-escalation/worker.test.ts

@@ -1,9 +1,10 @@
 // Unit coverage for pr.record-feature-escalation — a feature run parked on the native
 // `feature-escalation` user task (issue #210). Runs on the `escalated` arm, before the user task
-// exists, and must flip the row to the non-terminal `escalated` status and persist the agent's
-// `question` so the nwf UI can surface it (the poller can't read task-local vars, so this is the
-// question's source of truth). It clears the completable-task pointer to NULL (the task does not
-// exist yet, so any non-null value is stale); the poller fills the real key once it is observable.
+// exists, and must flip the row to the non-terminal `escalated` status and append the agent's
+// `question` to the canonical `feature_escalations` audit log so the nwf UI can surface it (the poller
+// can't read task-local vars, so this is the question's source of truth). Issue #332 dropped the
+// denormalised `feature_runs.escalation_question` / `escalation_user_task_key` columns, so this worker
+// now only flips the status and appends the audit row.
 import { test } from "node:test";
 import { assertEquals } from "#test-assert";
 import { noopLog } from "../../test/log.ts";
@@ -43,8 +44,8 @@ function fakeApp(rows: Record<string, unknown>[]): any {
   };
 }
 
-test("record-feature-escalation: flips the run to escalated and persists the question", async () => {
-  const rows = [{ feature_key: "owner/repo#7", status: "running", escalation_question: null, escalation_user_task_key: null }];
+test("record-feature-escalation: flips the run to escalated and appends the question to the audit log", async () => {
+  const rows = [{ feature_key: "owner/repo#7", status: "running" }];
   const app = fakeApp(rows);
   const out = await handler(
     { jobKey: "job-1", variables: { featureKey: "owner/repo#7", question: "Which API should I use?" } } as never,
@@ -52,11 +53,8 @@ test("record-feature-escalation: flips the run to escalated and persists the que
   );
   assertEquals(out, {});
   assertEquals(rows[0].status, "escalated");
-  assertEquals(rows[0].escalation_question, "Which API should I use?");
-  // The user task does not exist yet — the pointer is cleared to NULL here (poller fills the real key).
-  assertEquals(rows[0].escalation_user_task_key, null);
-  // Dual-write (issue #305): the question is ALSO appended to the canonical `feature_escalations`
-  // audit log so `pollUserTasks` can source it from a surviving table once the denormalised column drops.
+  // Issue #305/#332: the question is the sole responsibility of the canonical `feature_escalations`
+  // audit log so `pollUserTasks` can source it from a surviving table (the denormalised column is gone).
   assertEquals(app.stores.feature_escalations.length, 1);
   assertEquals(app.stores.feature_escalations[0].feature_key, "owner/repo#7");
   assertEquals(app.stores.feature_escalations[0].question, "Which API should I use?");
@@ -68,7 +66,7 @@ test("record-feature-escalation: a retried job (same jobKey) reuses its audit ro
   // before job completion re-runs with the SAME jobKey. The `job_key` idempotency guard must reuse the
   // existing `feature_escalations` row rather than append a duplicate (which would bloat the append-only
   // log and could skew "latest question" selection). Mirrors `record-plan-review`'s `plan_reviews` guard.
-  const rows = [{ feature_key: "owner/repo#7", status: "running", escalation_question: null, escalation_user_task_key: null }];
+  const rows = [{ feature_key: "owner/repo#7", status: "running" }];
   const app = fakeApp(rows);
   const job = { jobKey: "job-retry", variables: { featureKey: "owner/repo#7", question: "Which API?" } } as never;
   await handler(job, app);
@@ -77,22 +75,11 @@ test("record-feature-escalation: a retried job (same jobKey) reuses its audit ro
   assertEquals(app.stores.feature_escalations[0].job_key, "job-retry");
 });
 
-test("record-feature-escalation: clears a stale completable-task pointer at escalation entry", async () => {
-  // The task does not exist yet here, so a non-null key can only be stale (a prior escalation's key
-  // left behind, a manual DB repair, etc). Leaving it would bind the pages' answer/abandon affordance
-  // to the wrong task until the poller overwrites it; clear it so the row reads "key unknown here".
-  const rows = [{ feature_key: "owner/repo#9", status: "running", escalation_question: null, escalation_user_task_key: "stale-ut" }];
-  const app = fakeApp(rows);
-  await handler({ jobKey: "job-9", variables: { featureKey: "owner/repo#9", question: "Q?" } } as never, app);
-  assertEquals(rows[0].status, "escalated");
-  assertEquals(rows[0].escalation_question, "Q?");
-  assertEquals(rows[0].escalation_user_task_key, null);
-});
-
-test("record-feature-escalation: a blank/absent question is persisted as NULL (badge/affordance stay off)", async () => {
-  const rows = [{ feature_key: "owner/repo#8", status: "running", escalation_question: null }];
+test("record-feature-escalation: a blank/absent question is appended as NULL (badge/affordance stay off)", async () => {
+  const rows = [{ feature_key: "owner/repo#8", status: "running" }];
   const app = fakeApp(rows);
   await handler({ jobKey: "job-8", variables: { featureKey: "owner/repo#8", question: "   " } } as never, app);
   assertEquals(rows[0].status, "escalated");
-  assertEquals(rows[0].escalation_question, null);
+  assertEquals(app.stores.feature_escalations.length, 1);
+  assertEquals(app.stores.feature_escalations[0].question, null);
 });

package/workers/record-feature-escalation/worker.ts

@@ -1,17 +1,17 @@
 // pr.record-feature-escalation — a feature run has parked on the native `feature-escalation`
 // user task (the agent reported `status:"escalated"` with a non-blank `question`). This service
-// task runs on the `escalated` arm, immediately BEFORE the user task is created, and persists the
-// escalation onto the `feature_runs` row so the nwf UI can surface it (issue #210):
-//   • flips `status` to the non-terminal `escalated` so status-based views and counts flag it, and
-//   • denormalises the agent's `question` for the Escalation column + the answer affordance.
+// task runs on the `escalated` arm, immediately BEFORE the user task is created, and:
+//   • flips `feature_runs.status` to the non-terminal `escalated` so status-based views and counts
+//     flag it (and a re-dispatch of the same issue short-circuits while it is parked), and
+//   • appends the agent's `question` to the append-only `feature_escalations` audit log (issue #305),
+//     the canonical, poller-readable source for a parked run's question.
 //
-// It deliberately does NOT record a REAL completable `userTaskKey` — the task does not exist yet at
-// this point — and clears any stale pointer so the row reads "key unknown until observed".
-// `pollFeatureEscalations` (app/service.ts) fills that pointer in once the user task is
-// observable via `searchUserTasks`, which is also the reason the question is captured HERE rather
-// than by the poller: the WASM testkit engine does not surface a user task's ioMapping-mapped local
-// variables through `searchUserTasks`, so the process variable must be persisted while it is still
-// in scope on the job.
+// The completable `userTaskKey` is NOT recorded here — the task does not exist yet at this point.
+// `pollUserTasks` (app/service.ts) reads the engine's open `feature-escalation` task directly once it
+// is observable and projects it onto the `user_tasks` Tasks inbox, pairing it with the audit log's
+// question. Capturing the question HERE (not in the poller) is required because the WASM testkit
+// engine does not surface a user task's ioMapping-mapped local variables through the user-task query,
+// so the process variable must be persisted while it is still in scope on the job.
 import type { AppJobHandler } from "@nanobpm/urban";
 import { featureRuns, recordFeatureEscalation } from "../../app/feature.ts";
 import type { WorkerInputs } from "../../nano-generated/worker-io.d.ts";
@@ -27,19 +27,13 @@ const handler: AppJobHandler<In> = async (job, app) => {
   const question = nonBlank(job.variables.question);
   await featureRuns(app.data).update(featureKey, {
     status: "escalated",
-    escalation_question: question,
-    // The user task does not exist yet, so any non-null pointer here can only be stale (a prior
-    // escalation's key, a manual DB repair). Clear it so the row reads "key unknown until observed"
-    // and the pages don't bind the answer/abandon affordance to a dead task; the poller re-fills the
-    // real key (it can always re-derive it from `searchUserTasks`), so this clear is never lossy.
-    escalation_user_task_key: null,
     updated_at: new Date().toISOString(),
   });
-  // Append the question to the canonical `feature_escalations` audit log (issue #305) so the poller
-  // can source it from a SURVIVING table once the denormalised `feature_runs.escalation_question`
-  // column is dropped in the contract phase — the feature analogue of `record-plan-review` writing
-  // `plan_reviews`. Dual-write for now (the column above still feeds the legacy page reads); the log
-  // is authoritative for `pollUserTasks`.
+  // Append the question to the canonical `feature_escalations` audit log (issue #305) — the SURVIVING
+  // table `pollUserTasks` reads to enrich the parked `feature-escalation` task's question on the Tasks
+  // inbox (the feature analogue of `record-plan-review` writing `plan_reviews`). The denormalised
+  // `feature_runs.escalation_question` column it used to dual-write was dropped in the contract phase
+  // (issue #332), so this log is now the sole source of the question text.
   await recordFeatureEscalation(app.data, { featureKey, question, jobKey: job.jobKey });
   app.log.info("record-feature-escalation", { featureKey, hasQuestion: question !== null });
   return {};