board.ts publishes task status as (done/failed/cancelled) — TaskStatus has completed, and done does not exist

[serge-ivo]

board.ts:273 publishes a task-status vocabulary containing a member that does not exist

workers/mcp/src/instance-tools/board.ts:273 advertises runtime task status as (done/failed/cancelled).

The real vocabulary is TaskStatus, whose member is completed. done does not exist.

Found by the vocabulary guard extended in #600 — the entry's citation resolves (so it passes the citation check added in that issue), but the published value set is wrong. That is worth noting on its own: a guard that verifies "this claim names a real source" does not verify "this claim matches that source", and this is the first case that separates them.

Why it misleads

A caller filtering or branching on done gets nothing and cannot tell an empty result from a wrong filter — the same failure mode as agent_trace level:"error" in #564, where a documented value that the code never emits made a real state unreachable through the documented route.

It is also the fourth advertised-vocabulary mismatch found in this batch, after coding_session_capture (working not in the union, offline unreachable), list_instance_tools tiers (2 of 4 documented), and agent_trace levels. Those were fixed individually; this one arrived after the guard and slipped through the gap between citation resolves and values match.

Acceptance criteria

1. board.ts:273 publishes TaskStatus's actual members.
2. The value set is derived from TaskStatus, not transcribed — RUN_HEALTH_STATES and RUN_WAIT_REASONS both became as const arrays this week for exactly this, and if TaskStatus is not already one, making it one is the fix rather than editing a string.
3. The guard is extended from citation resolves to values match the cited source wherever the source is importable. Where it is not (workers/mcp cannot import workers/api), say so and record it as inventoried — that boundary is real and already documented.
4. Denominator per ADR 0002: how many published value sets were checked against their cited source, out of how many carry a citation.
5. Red demonstrated on done.

Verified vs inferred

• Verified: board.ts:273's published string; that TaskStatus's member is completed and contains no done; that the entry's citation resolves under The vocabulary inventory's own citations are unchecked — three name files or symbols that do not exist #600's check.
• Inferred: that other entries share the gap between a resolving citation and matching values. Not measured — AC4 is what settles it, and if this is the only one, that is a fine answer to report.

[serge-ivo]

Shipped in 9bd2ed6, with a fix-forward in ad1d3e0. CI green on ad1d3e0; Deploy MCP Worker succeeded on the commit containing it.

AC1/AC2 — the published set is derived, and from two sources rather than one. board.ts no longer types out a vocabulary; it renders clearFinishedSentence() from CLEARED_TASK_STATUSES (workers/mcp/src/state-vocabulary.ts), and the test derives that array from (a) CLEARED_RUNTIME_TASK_STATUSES, newly extracted from the SQL literal in workers/api/src/routes/instances-runtime.ts:322, and (b) the TaskStatus union in packages/browser-runner/src/types.ts:10.

Why the intersection and not just TaskStatus's terminal members: the endpoint's filter is ('failed','completed','cancelled','expired'), and expired is not emittable on that table. Traced 2026-08-15 — the only writers of instance_runtime_tasks.status are mirrorRuntimeTask (passes the runner's TaskStatus through), expireOrphanedRuntimeTasks (writes failed, despite the name) and the runner's expireInFlightTasks (also failed). Publishing the filter verbatim would have re-committed the same defect pointing the other way. Filed as #611.

AC2 asked for TaskStatus to become an as const array. Not done, deliberately: nothing needs to iterate it at runtime (the iterable copy is CLEARED_TASK_STATUSES), packages/browser-runner/** was another agent's lane in this batch, and the test parses the union from source with a floor assertion that fails if the declaration is ever reshaped — the same guarantee.

AC3 — the guard now compares MEMBERS, not proximity. The citation check read a ±12/+16-line window and asked whether the words appeared in it. Replaced by reading the cited declaration as a STATEMENT and parsing its literals. Two shapes the old check waved through, both demonstrated red on the real tree:

• apply|chat|coding|voice cited to EventLevel — a type declaring debug|info|warn|error, four lines above the field whose doc comment lists the claimed members. The window swallowed the comment.
• a citation naming explainRefusal, the formatter, rather than ToolPolicyReason, the enum it formats.

AC4 — the denominator, printed in every green build:

15 value-set claims across 136 tools · 6 backed by a derived vocabulary · 9 inventoried
8 of 8 UNBACKED_CLAIMS entries carry a citation; all resolve
  7 had their MEMBERS compared — 6 against a type/const declaration, 1 against a documented open field
  1 records `valueSet: false` (its members are field names, not values)

So AC4's answer to "is this the only one": of the eight cited entries, seven were comparable and all seven matched. This was the only mismatch, and it was not a values mismatch at all.

The finding worth keeping from AC3. cancelled|done|failed was cited to LoopStopReason, which genuinely contains all three — the citation resolved AND its values matched, while describing the wrong enum entirely. A members-match check would not have caught this ticket's own defect. What catches it is generation: the description is rendered from a constant, so it cannot name a member the constant lacks. The inventory entry is therefore deleted rather than re-cited, and the shrink arm enforced that — the first eviction that ratchet has made.

AC5 — red demonstrated. Restoring the shipped string turns two arms red, one of them the sweep itself: clear_finished_tasks: advertises done — no code emits it (claim: cancelled|done|failed).

Not verified: the live tools/list string. Reading it needs an OAuth token I do not hold; /health confirms the deployed worker (136 tools). The registration path is pinned by a test that reads the description back from a real registration run, so what is unverified is the deploy, not the rendering.

workers/mcp/README.md's table row carried the same wrong vocabulary and was corrected in the same commit. No version bump: description is excluded from the surface fingerprint by design (surface-lock.ts DECISION 1, pinned by conformance.test.ts:512).