@nanobpm/urban 0.80.0 → 0.81.0

package/src/runtime/core/modules/open-user-tasks-store.test.ts

@@ -154,3 +154,14 @@ test("syncInstance is atomic — it composes inside an existing transaction and
 test("the DSL projection name is stable and unprefixed (usable in `exists(...)`)", () => {
   assert.equal(OPEN_USER_TASKS_PROJECTION, "urban_open_user_tasks");
 });
+
+test("instanceKeys returns each distinct instance with ≥1 open task (and drops one when cleared)", async () => {
+  await withStore((store) => {
+    assert.deepEqual(store.instanceKeys(), []); // empty projection
+    store.syncInstance("pi-1", [task("ut-1"), task("ut-2")]); // two tasks, one instance
+    store.syncInstance("pi-2", [task("ut-3")]);
+    assert.deepEqual(store.instanceKeys().sort(), ["pi-1", "pi-2"]); // distinct, not per-task
+    store.clearInstance("pi-1"); // answered/terminated
+    assert.deepEqual(store.instanceKeys(), ["pi-2"]); // retired key no longer listed
+  });
+});

package/src/runtime/core/modules/open-user-tasks-store.ts

@@ -144,6 +144,17 @@ export class OpenUserTasksStore {
     this.#db.run(`DELETE FROM ${OPEN_USER_TASKS_TABLE} WHERE process_instance_key = ?`, [processInstanceKey]);
   }
 
+  /** Every distinct instance key currently projected as having ≥1 open user task. Used by the
+   *  reconciler to re-probe (and, when answered, RETIRE) keys that have dropped out of a binding's
+   *  `activeStatuses` allow-list — a projected row must be retired independently of the base-row
+   *  selector, or an answered escalation's row would linger and the derived edge tear (ADR 0065). */
+  instanceKeys(): string[] {
+    const rows = this.#db.all<{ process_instance_key: string }>(
+      `SELECT DISTINCT process_instance_key FROM ${OPEN_USER_TASKS_TABLE}`,
+    );
+    return rows.map((r) => r.process_instance_key);
+  }
+
   /** True iff the instance currently has any open user task — the "parked on a human" predicate. */
   hasOpenTask(processInstanceKey: string): boolean {
     if (!processInstanceKey) return false;

package/src/runtime/core/modules/pages.ts

@@ -35,6 +35,7 @@ import { FORMJS_JS } from "./formjs.gen.ts";
 import { completeUserTaskResponse, resolveFormResponse } from "./forms.ts";
 import { quoteIdent } from "./gateway.ts";
 import { RENDERER_JS } from "./runtime.gen.ts";
+import { isSqlIdentifier } from "../read-model.ts";
 
 /** The subset of the datasource gateway the page runtime needs. */
 export interface PagesDataSource {
@@ -183,10 +184,10 @@ async function serveAsset(
   }
 }
 
-/** A SQL identifier guard — a table name must be a bare identifier *and* a known table
- * (checked against `schema()`), so `/app/data/:table` can never inject SQL. */
-const IDENT = /^[A-Za-z_][A-Za-z0-9_]*$/;
-
+/** A table name must be a bare SQL identifier ({@link isSqlIdentifier}, the runtime-wide single source
+ * of truth) *and* a known table (checked against `schema()`), so `/app/data/:table` can never inject
+ * SQL. Reusing the shared guard (rather than a private regex) keeps this surface from drifting from
+ * manifest / read-model / data-source identifier validation. */
 // A query flag (e.g. ?count=1) is "on" when present and not one of the falsy
 // spellings. A bare `?count` (empty string) still counts as on, so a caller can
 // opt in without inventing a value.
@@ -369,7 +370,7 @@ export function createPagesRoutes(opts: PagesOptions, deps: PagesDeps): Route[]
       // v1 exposes only the injected default datasource; a request naming any other
       // source is rejected rather than silently served off the default.
       if (source !== sourceName) return json({ error: `unknown datasource "${source}"` }, 404);
-      if (!IDENT.test(table)) return json({ error: "invalid table name" }, 400);
+      if (!isSqlIdentifier(table)) return json({ error: "invalid table name" }, 400);
       let tables: Set<string>;
       try {
         tables = await knownTables();

package/src/runtime/core/read-model.test.ts

@@ -25,6 +25,8 @@ import {
   ProjectionRegistry,
   projectionRegistry,
   ReadModelRegistry,
+  isReservedObjectName,
+  RESERVED_OBJECT_PREFIXES,
   when,
 } from "./read-model.ts";
 import type { ReadModel } from "./read-model.ts";
@@ -82,6 +84,19 @@ const EXPECTED: Record<string, { display_status: string; is_high_priority: numbe
   t3: { display_status: "active", is_high_priority: 1 },
 };
 
+test("isReservedObjectName flags every reserved prefix, case-insensitively, and clears domain names", () => {
+  // Single source of truth for the prefixes the datasource surface hides (gateway.schema()) and the
+  // provenance recorder skips (datasource.ts). SQLite folds ASCII object names, so a cased reserved
+  // name must not slip through.
+  assert.deepEqual([...RESERVED_OBJECT_PREFIXES], ["_urban_", "_nano_", "sqlite_"]);
+  for (const name of ["_urban_x", "_URBAN_x", "_nano_y", "sqlite_master", "SQLITE_stat1"]) {
+    assert.ok(isReservedObjectName(name), `expected "${name}" reserved`);
+  }
+  for (const name of ["orders", "plans__tracking", "urban_things", "nano", "sqlitely"]) {
+    assert.ok(!isReservedObjectName(name), `expected "${name}" NOT reserved`);
+  }
+});
+
 test("(i) the read model with CASE + EXISTS compiles to a SQLite VIEW returning the expected values", async () => {
   await withDb((db) => {
     seedFixtures(db);
@@ -219,6 +234,60 @@ test("both backends agree on NULL inputs: SQL NULL propagation is COALESCE'd to
   });
 });
 
+test("compileToFn resolves col/pcol identifiers case-insensitively (SQLite identifier folding)", () => {
+  // SQLite folds identifier case even for quoted identifiers, so `col("Status")` in the VIEW binds to a
+  // column DECLARED `status`. The TS backend must fold too — a case-sensitive `row["Status"]` returns
+  // null and silently diverges from the VIEW on the no-edge fallback and on keyField correlation.
+  assert.equal(compileToFn(col("Status"))({ status: "abandoned" }), "abandoned"); // folds to declared column
+  assert.equal(compileToFn(col("status"))({ status: "abandoned" }), "abandoned"); // exact match still works
+  assert.equal(compileToFn(col("Missing"))({ status: "x" }), null); // a truly-absent column → null (not a fold)
+  // pcol inside EXISTS folds too, so keyField correlation matches the VIEW's join.
+  const corr = compileToFn(exists("p", eq(pcol("Process_Instance_Key"), col("Key"))));
+  assert.equal(corr({ key: "pi-1" }, { p: [{ process_instance_key: "pi-1" }] }), true);
+  assert.equal(corr({ key: "pi-1" }, { p: [{ process_instance_key: "pi-2" }] }), false);
+});
+
+test("mixed-case col/pcol identifiers: the VIEW and TS backends agree (VIEW/TS parity on the no-edge fallback)", async () => {
+  // End-to-end guard for the case-fold fix: author a model with mixed-case identifiers over lowercase
+  // columns and confirm the SQLite VIEW and the TS backend derive the SAME value — including the
+  // parity-critical no-edge fallback that passes the stored status through.
+  const mixed: ReadModel = defineReadModel({
+    name: "mixed_case_display",
+    baseTable: "widgets",
+    derive: {
+      effective: caseWhen(
+        [
+          when(
+            exists("urban_open_user_tasks", eq(pcol("Process_Instance_Key"), col("Process_Key"))),
+            lit("awaiting_operator"),
+          ),
+        ],
+        col("Status"), // no-edge fallback → the stored status, read via a mixed-case identifier
+      ),
+    },
+  });
+  await withDb((db) => {
+    db.exec(`CREATE TABLE widgets (id TEXT, process_key TEXT, status TEXT);`);
+    db.exec(`CREATE TABLE urban_open_user_tasks (process_instance_key TEXT);`);
+    db.exec(mixed.viewDdl());
+    db.run(`INSERT INTO widgets VALUES (?, ?, ?)`, ["w1", "pi-1", "dispatched"]); // no open task → fallback
+    db.run(`INSERT INTO widgets VALUES (?, ?, ?)`, ["w2", "pi-2", "dispatched"]);
+    db.run(`INSERT INTO urban_open_user_tasks VALUES (?)`, ["pi-2"]); // w2 waiting on a human
+    // SQL backend: the VIEW resolves the mixed-case identifiers against the lowercase columns.
+    const sqlRows = db
+      .all<{ id: string; effective: string }>(`SELECT id, effective FROM mixed_case_display ORDER BY id`)
+      .map((r) => ({ ...r }));
+    assert.deepEqual(sqlRows, [
+      { id: "w1", effective: "dispatched" }, // no-edge fallback → stored status (the parity-critical path)
+      { id: "w2", effective: "awaiting_operator" },
+    ]);
+    // TS backend: base/projection rows arrive keyed as SQLite stored them (lowercase).
+    const projections = { urban_open_user_tasks: [{ process_instance_key: "pi-2" }] };
+    assert.equal(mixed.evaluate({ id: "w1", process_key: "pi-1", status: "dispatched" }, projections).effective, "dispatched");
+    assert.equal(mixed.evaluate({ id: "w2", process_key: "pi-2", status: "dispatched" }, projections).effective, "awaiting_operator");
+  });
+});
+
 test("EXISTS references a projection by name; the projection registry resolves the physical table", () => {
   const reg = new ProjectionRegistry();
   reg.register({ name: "urban_instance_state", sqlTable: "_urban_instance_state" });

package/src/runtime/core/read-model.ts

@@ -261,14 +261,37 @@ function resolveBaseAlias(alias: string | undefined): string {
   return assertSqlIdentifier("base alias", alias ?? DEFAULT_BASE_ALIAS);
 }
 
-/** A conservative SQL identifier guard — we interpolate names directly into DDL/SQL. */
-const SQL_IDENT = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** A conservative SQL identifier guard — we interpolate names directly into DDL/SQL. This is the
+ *  single source of truth for "is this a legal identifier"; the manifest validator imports it (rather
+ *  than re-declaring the regex) so a name accepted at author time is accepted at VIEW provisioning too
+ *  (No Drift Surfaces — a divergence would let a manifest validate but fail at boot). */
+export const SQL_IDENT = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** True iff `name` is a legal SQL identifier per {@link SQL_IDENT}. The boolean twin of
+ *  {@link assertSqlIdentifier}, for callers (e.g. the manifest validator) that collect issues rather
+ *  than throw. */
+export function isSqlIdentifier(name: string): boolean {
+  return SQL_IDENT.test(name);
+}
 export function assertSqlIdentifier(kind: string, name: string): string {
   if (!SQL_IDENT.test(name)) {
     throw new Error(`invalid ${kind} "${name}": must match ${SQL_IDENT.source}`);
   }
   return name;
 }
+/** Object-name prefixes reserved for engine/runtime internals. Tables and views whose names begin
+ *  with one of these are Nano bookkeeping (`_urban_*` / `_nano_*`) or SQLite internals (`sqlite_*`):
+ *  the provenance recorder skips them (`modules/datasource.ts`) and the datasource `schema()` surface
+ *  filters them out (`modules/gateway.ts`), so they are invisible to `/app/data`, DB Manager, and forms.
+ *  This is the single source of truth for that prefix set (No Drift Surfaces — a manifest that provisions
+ *  a `_urban_*` VIEW would otherwise validate yet be unreadable by the documented pages surface). */
+export const RESERVED_OBJECT_PREFIXES = ["_urban_", "_nano_", "sqlite_"] as const;
+/** True iff `name` begins with a {@link RESERVED_OBJECT_PREFIXES} prefix. Case-insensitive, matching
+ *  SQLite's ASCII identifier folding (a `_URBAN_x` table resolves to the same reserved object as
+ *  `_urban_x`), so a reserved name cannot slip through by casing. */
+export function isReservedObjectName(name: string): boolean {
+  const folded = name.toLowerCase();
+  return RESERVED_OBJECT_PREFIXES.some((p) => folded.startsWith(p));
+}
 function quoteIdent(name: string): string {
   return `"${name.replace(/"/g, '""')}"`;
 }
@@ -491,10 +514,10 @@ export function compileToFn(expr: Expr): DerivationFn {
       case "lit":
         return node.value;
       case "col":
-        return baseRow[node.name] ?? null;
+        return lookupColumn(baseRow, node.name);
       case "pcol":
         if (!projRow) throw new Error(`pcol("${node.name}") evaluated outside an EXISTS projection context`);
-        return projRow[node.name] ?? null;
+        return lookupColumn(projRow, node.name);
       case "compare":
         return compareValues(
           node.op,
@@ -524,6 +547,22 @@ export function compileToFn(expr: Expr): DerivationFn {
   return (baseRow, projections = {}) => evalNode(expr, baseRow, projections);
 }
 
+/** Resolve a column value the way SQLite resolves an identifier: an exact-key match first, then a
+ *  case-insensitive fallback. SQLite folds ASCII identifier case even for quoted identifiers, so the
+ *  VIEW's `col("Status")` binds to a table declared with column `status`; a plain case-sensitive JS
+ *  `row["Status"]` would miss it and return null, breaking VIEW/TS parity on the no-edge fallback and on
+ *  `keyField` correlation. Fold here so both backends read the same column. (A table cannot declare two
+ *  columns differing only in case, so the fallback is unambiguous.) Returns `null` for a missing column,
+ *  preserving the previous `?? null` contract. */
+export function lookupColumn(row: Record<string, unknown>, name: string): unknown {
+  if (Object.hasOwn(row, name)) return row[name] ?? null;
+  const folded = name.toLowerCase();
+  for (const key of Object.keys(row)) {
+    if (key.toLowerCase() === folded) return row[key] ?? null;
+  }
+  return null;
+}
+
 // ───────────────────────────────────────── defineReadModel ───────────────────────────────────────
 
 /** The declarative read-model input passed to {@link defineReadModel}. */

package/src/runtime/core/validate.test.ts

@@ -398,3 +398,344 @@ test("instanceTracking with a valid positive pollMs has no pollMs issue", () =>
   });
   assert.deepEqual(issues, []);
 });
+
+// ── readModel (ADR 0065, the writer→source inversion) ───────────────────────────────────────────
+// The new `instanceTracking.readModel` validation surface: identifier shape, base-table/statusField
+// collisions (folded case-insensitively, matching SQLite), and duplicate managed-VIEW names across
+// bindings. These lock the author-time guard to the VIEW-provisioning behavior it stands in for.
+
+test("a valid instanceTracking.readModel override has no issues", () => {
+  const issues = collectManifestIssues({
+    ...valid,
+    instanceTracking: [
+      {
+        table: "plans",
+        keyField: "process_key",
+        statusField: "status",
+        activeStatuses: ["planning"],
+        onTerminated: { set: { status: "abandoned" } },
+        readModel: { view: "plans_status", statusColumn: "effective_status" },
+      },
+    ],
+  });
+  assert.deepEqual(issues, []);
+});
+
+test("a non-object readModel is flagged", () => {
+  const issues = collectManifestIssues({
+    ...valid,
+    instanceTracking: [
+      {
+        table: "plans",
+        keyField: "process_key",
+        statusField: "status",
+        onTerminated: { set: { status: "abandoned" } },
+        readModel: "nope",
+      },
+    ],
+  });
+  assert.ok(issues.some((i) => i.path === "instanceTracking[0].readModel"));
+});
+
+test("a non-identifier readModel.view / statusColumn is flagged", () => {
+  const issues = collectManifestIssues({
+    ...valid,
+    instanceTracking: [
+      {
+        table: "plans",
+        keyField: "process_key",
+        statusField: "status",
+        onTerminated: { set: { status: "abandoned" } },
+        readModel: { view: "has space", statusColumn: "1bad" },
+      },
+    ],
+  });
+  assert.ok(issues.some((i) => i.path === "instanceTracking[0].readModel.view"));
+  assert.ok(issues.some((i) => i.path === "instanceTracking[0].readModel.statusColumn"));
+});
+
+test("readModel.view colliding with the base table is flagged case-insensitively", () => {
+  const issues = collectManifestIssues({
+    ...valid,
+    instanceTracking: [
+      {
+        table: "plans",
+        keyField: "process_key",
+        statusField: "status",
+        onTerminated: { set: { status: "abandoned" } },
+        readModel: { view: "Plans" }, // folds to the base table name
+      },
+    ],
+  });
+  assert.ok(issues.some((i) => i.path === "instanceTracking[0].readModel.view"));
+});
+
+test("a reserved-prefix readModel.view is flagged (hidden from the datasource surface)", () => {
+  // A `_urban_*` / `_nano_*` / `sqlite_*` view provisions fine but is filtered out of gateway.schema(),
+  // so a page reads `unknown table`. Reject it at author time, on the explicit override, case-insensitively.
+  for (const view of ["_urban_status", "_NANO_status", "sqlite_meta"]) {
+    const issues = collectManifestIssues({
+      ...valid,
+      instanceTracking: [
+        {
+          table: "plans",
+          keyField: "process_key",
+          statusField: "status",
+          onTerminated: { set: { status: "abandoned" } },
+          readModel: { view },
+        },
+      ],
+    });
+    assert.ok(
+      issues.some((i) => i.path === "instanceTracking[0].readModel.view"),
+      `expected reserved view "${view}" to be flagged`,
+    );
+  }
+});
+
+test("a reserved-prefix default VIEW (from a reserved base table) is flagged on `table`", () => {
+  // With no override the VIEW defaults to `<table>__tracking`; a `_urban_*` base table therefore yields a
+  // reserved default view name. The issue is attributed to `table` since there is no explicit view.
+  const issues = collectManifestIssues({
+    ...valid,
+    instanceTracking: [
+      {
+        table: "_urban_plans",
+        keyField: "process_key",
+        statusField: "status",
+        onTerminated: { set: { status: "abandoned" } },
+      },
+    ],
+  });
+  assert.ok(issues.some((i) => i.path === "instanceTracking[0].table"));
+});
+
+test("a reserved base table with a NON-reserved explicit view is flagged on `table` (issue #452 review)", () => {
+  // The reserved-VIEW guard only inspects the effective VIEW NAME. A binding
+  // `table: "_urban_instance_state", readModel: { view: "tracking" }` slips past it: the published
+  // `tracking` VIEW is non-reserved (so gateway.schema() exposes it) yet SELECTs the runtime's hidden
+  // sidecar rows. Tracking a reserved runtime table is never legitimate — reject it on `table`.
+  const issues = collectManifestIssues({
+    ...valid,
+    instanceTracking: [
+      {
+        table: "_urban_instance_state",
+        keyField: "process_key",
+        statusField: "status",
+        onTerminated: { set: { status: "abandoned" } },
+        readModel: { view: "tracking" },
+      },
+    ],
+  });
+  assert.ok(
+    issues.some((i) => i.path === "instanceTracking[0].table" && i.message.includes("reserved prefix")),
+    "expected a reserved base-table issue on `table`",
+  );
+});
+
+test("non-identifier table / keyField / statusField are flagged (they compile into VIEW SQL)", () => {
+  // `table`/`keyField`/`statusField` are interpolated into the derived VIEW's DDL and predicates, so a
+  // non-identifier (e.g. `external-orders`) that historically only passed the non-empty check would
+  // validate yet throw at VIEW construction. Enforce the identifier rule at author time (No Drift).
+  const issues = collectManifestIssues({
+    ...valid,
+    instanceTracking: [
+      {
+        table: "external-orders",
+        keyField: "process key",
+        statusField: "the.status",
+        onTerminated: { set: { status: "abandoned" } },
+      },
+    ],
+  });
+  assert.ok(issues.some((i) => i.path === "instanceTracking[0].table"));
+  assert.ok(issues.some((i) => i.path === "instanceTracking[0].keyField"));
+  assert.ok(issues.some((i) => i.path === "instanceTracking[0].statusField"));
+});
+
+test("a STATUS-LESS instanceTracking binding accepts a non-identifier table/keyField (no VIEW is built)", () => {
+  // A binding with no `statusField` provisions no derived VIEW; it only feeds projections and is polled
+  // through `api.data.table()`, whose `Table<T>` gateway `quoteIdent`s the base table + key column. So a
+  // hyphenated/spaced name like `external-orders` / `process key` works and MUST NOT be rejected here —
+  // the SQL_IDENT rule applies only when a VIEW is actually built (No Drift with provisioning).
+  const issues = collectManifestIssues({
+    ...valid,
+    instanceTracking: [
+      {
+        table: "external-orders",
+        keyField: "process key",
+        onTerminated: { set: { status: "abandoned" } },
+      },
+    ],
+  });
+  assert.ok(!issues.some((i) => i.path === "instanceTracking[0].table"));
+  assert.ok(!issues.some((i) => i.path === "instanceTracking[0].keyField"));
+});
+
+test("an unknown key inside readModel is flagged (additionalProperties: false)", () => {
+  // A typo like `statusColum` would silently fall back to the default derived column while the page reads
+  // the wrong field. Mirror the `network` block's unknown-key rejection.
+  const issues = collectManifestIssues({
+    ...valid,
+    instanceTracking: [
+      {
+        table: "plans",
+        keyField: "process_key",
+        statusField: "status",
+        onTerminated: { set: { status: "abandoned" } },
+        readModel: { view: "plans_board", statusColum: "eff_status" },
+      },
+    ],
+  });
+  assert.ok(issues.some((i) => i.path === "instanceTracking[0].readModel.statusColum"));
+});
+
+test("readModel.statusColumn colliding with statusField is flagged case-insensitively", () => {
+  const issues = collectManifestIssues({
+    ...valid,
+    instanceTracking: [
+      {
+        table: "plans",
+        keyField: "process_key",
+        statusField: "status",
+        onTerminated: { set: { status: "abandoned" } },
+        readModel: { statusColumn: "Status" }, // folds to statusField -> stored column shadows the derived one
+      },
+    ],
+  });
+  assert.ok(issues.some((i) => i.path === "instanceTracking[0].readModel.statusColumn"));
+});
+
+test("two bindings folding to the same managed-VIEW name are flagged", () => {
+  const issues = collectManifestIssues({
+    ...valid,
+    instanceTracking: [
+      {
+        table: "plans",
+        keyField: "process_key",
+        statusField: "status",
+        onTerminated: { set: { status: "abandoned" } },
+      },
+      {
+        // Same base table, no distinct override → both default to `plans__tracking`.
+        table: "plans",
+        keyField: "other_key",
+        statusField: "status",
+        onTerminated: { set: { status: "abandoned" } },
+      },
+    ],
+  });
+  assert.ok(issues.some((i) => i.path === "instanceTracking[1].readModel.view"));
+});
+
+test("two bindings whose readModel.view differ only by case are flagged", () => {
+  const issues = collectManifestIssues({
+    ...valid,
+    instanceTracking: [
+      {
+        table: "plans",
+        keyField: "process_key",
+        statusField: "status",
+        onTerminated: { set: { status: "abandoned" } },
+        readModel: { view: "shared_status" },
+      },
+      {
+        table: "orders",
+        keyField: "process_key",
+        statusField: "status",
+        onTerminated: { set: { status: "abandoned" } },
+        readModel: { view: "Shared_Status" }, // folds to the first binding's view
+      },
+    ],
+  });
+  assert.ok(issues.some((i) => i.path === "instanceTracking[1].readModel.view"));
+});
+
+test("distinct managed-VIEW names across bindings on the same table have no view collision", () => {
+  const issues = collectManifestIssues({
+    ...valid,
+    instanceTracking: [
+      {
+        table: "plans",
+        keyField: "process_key",
+        statusField: "status",
+        onTerminated: { set: { status: "abandoned" } },
+        readModel: { view: "plans_a" },
+      },
+      {
+        table: "plans",
+        keyField: "other_key",
+        statusField: "status",
+        onTerminated: { set: { status: "abandoned" } },
+        readModel: { view: "plans_b" },
+      },
+    ],
+  });
+  assert.deepEqual(issues, []);
+});
+
+test("statusField folding to the default derived column (no override) is flagged", () => {
+  // With no `readModel.statusColumn`, the VIEW derives under the default `derived_status`. A binding
+  // whose `statusField` IS `derived_status` therefore collides with the default derived column exactly
+  // as an explicit override would — SQLite keeps the stored base column and the derived read is stale.
+  // This is the omitted-override path the runtime would otherwise only discover at boot.
+  const issues = collectManifestIssues({
+    ...valid,
+    instanceTracking: [
+      {
+        table: "plans",
+        keyField: "process_key",
+        statusField: "Derived_Status", // folds to the default derived column name
+        onTerminated: { set: { Derived_Status: "abandoned" } },
+      },
+    ],
+  });
+  assert.ok(issues.some((i) => i.path === "instanceTracking[0].statusField"));
+});
+
+test("an explicit readModel.statusColumn that differs from the default derived column is not falsely flagged", () => {
+  // statusField == default derived column, but an explicit override moves the derived column elsewhere:
+  // no collision, so the omitted-override guard must NOT fire.
+  const issues = collectManifestIssues({
+    ...valid,
+    instanceTracking: [
+      {
+        table: "plans",
+        keyField: "process_key",
+        statusField: "derived_status",
+        onTerminated: { set: { derived_status: "abandoned" } },
+        readModel: { statusColumn: "effective_status" },
+      },
+    ],
+  });
+  assert.deepEqual(issues, []);
+});
+
+test("a managed VIEW name colliding with another binding's base table is flagged", () => {
+  // SQLite shares one namespace for tables and views: a managed VIEW named `orders` (binding 0) collides
+  // with binding 1's base table `orders`, so `CREATE VIEW` would fail at boot and binding 0 loses its
+  // derived surface. Reject it at author time.
+  const issues = collectManifestIssues({
+    ...valid,
+    instanceTracking: [
+      {
+        table: "plans",
+        keyField: "process_key",
+        statusField: "status",
+        onTerminated: { set: { status: "abandoned" } },
+        readModel: { view: "orders" }, // folds to binding[1]'s base table
+      },
+      {
+        table: "orders",
+        keyField: "process_key",
+        statusField: "status",
+        onTerminated: { set: { status: "abandoned" } },
+      },
+    ],
+  });
+  assert.ok(
+    issues.some(
+      (i) => i.path === "instanceTracking[0].readModel.view" && i.message.includes("base table"),
+    ),
+  );
+});