@nanobpm/nano-workforce 0.119.0 → 0.120.1

package/app/service.ts

@@ -70,6 +70,7 @@ import {
   probeOnce,
   READINESS_READY_MESSAGE,
   type ReadinessProbe,
+  readinessPollEvery,
   readinessTimeout,
 } from "./readiness.ts";
 import { clampNudgeMinutes, reviewWaitTimeout } from "./reviewWait.ts";
@@ -1688,6 +1689,10 @@ function capabilityGateTimeout(env: Record<string, string | undefined>): string
   return readinessTimeout({ kind: "capability", target: "" } satisfies ReadinessProbe, env);
 }
 
+function capabilityGatePollEvery(env: Record<string, string | undefined>): string {
+  return readinessPollEvery({ kind: "capability", target: "" } satisfies ReadinessProbe, env);
+}
+
 /** Capability-edge reconcile pass (issue #289). The host half of the "consumer readiness edge":
  * plan-fanout's per-task fan-out parks at the `wait-caps-resolved` message barrier for any task that
  * declared cross-repo capability `needs` (049_plan_task_needs.sql). Here we reconcile, on EVERY pass
@@ -1721,6 +1726,7 @@ export async function pollCapabilityGatesImpl(
 ) {
   const gateTable = capabilityGates(data);
   const probeTimeout = capabilityGateTimeout(env);
+  const probePollEvery = capabilityGatePollEvery(env);
   for (const plan of await plans(data).all()) {
     const planKey = plan.plan_key;
     const processKey = plan.process_key;
@@ -1757,7 +1763,7 @@ export async function pollCapabilityGatesImpl(
           // need as unresolved (it can only clear once the handle is corrected on a re-plan).
           let probeInput: ReturnType<typeof capabilityNeedToProbeInput>;
           try {
-            probeInput = capabilityNeedToProbeInput(need, { planKey, taskId, probeTimeout });
+            probeInput = capabilityNeedToProbeInput(need, { planKey, taskId, probeTimeout, probePollEvery });
           } catch (err) {
             if (err instanceof UnresolvableCapabilityRefError) {
               if (!row) {
@@ -1808,6 +1814,7 @@ export async function pollCapabilityGatesImpl(
                 variables: {
                   gateKey: probeInput.gateKey,
                   probeTimeout: probeInput.probeTimeout,
+                  probePollEvery: probeInput.probePollEvery,
                   onTimeout: probeInput.onTimeout,
                   probe: probeInput.probe,
                 },

package/biome.json

@@ -137,5 +137,28 @@
   ],
   "formatter": {
     "enabled": false
-  }
+  },
+  "overrides": [
+    {
+      "includes": [
+        "workers/readiness-probe/**"
+      ],
+      "linter": {
+        "rules": {
+          "style": {
+            "noRestrictedGlobals": {
+              "level": "error",
+              "options": {
+                "deniedGlobals": {
+                  "setTimeout": "Use engine BPMN timers; readiness-probe must be single-shot.",
+                  "setInterval": "Use engine BPMN timers; readiness-probe must be single-shot.",
+                  "Date": "Use engine BPMN timers; readiness-probe must not read wall-clock time."
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  ]
 }

package/db/migrations/060_plan_wave_rollup.sql

@@ -0,0 +1,52 @@
+-- Wave-progress read model as a derived VIEW (epic #412 — retire worker-maintained projections).
+--
+-- 022_plan_wave_progress.sql denormalised `plans.wave_count` / `plans.current_wave` /
+-- `plans.wave_label` — a per-epic "wave X/N" at-a-glance projection — onto the `plans` row, written
+-- by the wave workers (`record-plan`, `select-wave`, `record-wave`). Its comment cites the sole
+-- reason it was a worker-maintained table rather than a VIEW: "Urban's datasource cannot read a SQL
+-- VIEW". That constraint is gone (nano-ide#424: `gateway.schema()` now introspects
+-- `type IN ('table','view')`), so — exactly like 059 did for the wave-summary rollup — this expresses
+-- the same projection as a DERIVED view: a single source of truth with NO write-path and no drift
+-- from `plan_tasks`.
+--
+-- Reuses 059's `plan_wave_counts` (one row per (plan_key, wave), with the six-way task partition,
+-- including `in_flight`) so the frontier can be derived purely, layered so each view stays a plain
+-- `CREATE VIEW <name> AS SELECT … FROM …` (no CTE / no select-list subquery) — which keeps them
+-- parseable by the static pages↔schema contract guard (scripts/pages-contract.test.ts).
+--
+--   • plan_wave_progress — one row per plan_key with the two numeric projections:
+--       - wave_count   = MAX(wave)+1 (the levelizer emits contiguous waves 0..N-1, so this equals
+--                        `app/waves.ts` `waveCount`). A plan with no LEVELIZED tasks contributes no
+--                        `plan_wave_counts` row, so it is absent here and reads NULL through the
+--                        downstream LEFT JOIN — matching the workers, which leave a taskless plan's
+--                        wave columns NULL.
+--       - current_wave = the live FRONTIER, derived (not process-state-tracked): the lowest wave
+--                        that still has an `in_flight` task (the wave the fleet is actively
+--                        implementing / the wave the merge-barrier is gating), else — once every
+--                        wave has settled (in_flight = 0 everywhere) — pinned to the last index
+--                        MAX(wave). This reproduces the workers' projection: `record-plan` starts it
+--                        at 0 (wave 0 is in flight), `record-wave`/`select-wave` advance it to the
+--                        next gating wave as each wave's PRs merge, and it pins to wave_count-1 on
+--                        completion (a finished epic reads N/N).
+--   • plan_wave_label    — the same two numbers PLUS `wave_label`, the PRE-FORMATTED 1-based "X/N"
+--                          display string (`(current_wave+1)/wave_count`) the epics-index and epic
+--                          banner render, because the dataGrid has no per-cell templating.
+--
+-- Forward-only, additive (a new read model; no schema change to any base table). The runner wraps
+-- each file in its own transaction, so this file must NOT contain BEGIN/COMMIT.
+
+CREATE VIEW plan_wave_progress AS
+SELECT
+  c.plan_key AS plan_key,
+  MAX(c.wave) + 1 AS wave_count,
+  COALESCE(MIN(CASE WHEN c.in_flight > 0 THEN c.wave END), MAX(c.wave)) AS current_wave
+FROM plan_wave_counts c
+GROUP BY c.plan_key;
+
+CREATE VIEW plan_wave_label AS
+SELECT
+  w.plan_key AS plan_key,
+  w.wave_count AS wave_count,
+  w.current_wave AS current_wave,
+  (w.current_wave + 1) || '/' || w.wave_count AS wave_label
+FROM plan_wave_progress w;

package/db/migrations/061_plan_delivery_rollup.sql

@@ -0,0 +1,98 @@
+-- Epic delivery read model as a derived VIEW, plus the composite `plans` read model the pages bind
+-- (epic #412 — retire worker-maintained projections).
+--
+-- 029_plan_delivery.sql denormalised `plans.delivery` ('converging'|'landed'|NULL) and
+-- `plans.delivery_label` onto the `plans` row, recomputed each poll pass by `pollDelivery`
+-- (app/service.ts) which joins each `plan_tasks.pr_key` → `pull_requests.status`. The PURE derivation
+-- lives in `deriveDelivery`/`TERMINAL_STATUSES` (app/delivery.ts). Its comment cites the sole reason
+-- it was a poller-maintained table rather than a VIEW: "Urban's datasource cannot read a SQL VIEW".
+-- That constraint is gone (nano-ide#424), so this expresses the SAME `deriveDelivery` logic as a
+-- DERIVED view — a single source of truth with NO write-path and no drift.
+--
+-- Layered so each view stays a plain `CREATE VIEW <name> AS SELECT … FROM …` (no CTE / no
+-- select-list subquery), parseable by scripts/pages-contract.test.ts:
+--
+--   • plan_delivery_counts — one row per plan_key with the three counts `deriveDelivery` folds over
+--                            the slice PRs (only tasks that OPENED a PR — `pr_key IS NOT NULL` —
+--                            count, mirroring `pollDelivery`'s `if (!t.pr_key) continue`):
+--                              - prs_opened   = number of slice tasks with a PR.
+--                              - prs_merged   = those whose PR reached `status = 'merged'`.
+--                              - prs_in_flight = those whose PR is NON-terminal (`status` NOT IN
+--                                `TERMINAL_STATUSES` = converged/merged/abandoned). A `pr_key` with
+--                                no `pull_requests` row (status NULL, the poller's MISSING_PR_STATUS
+--                                sentinel) is non-terminal, so it counts as in flight — a DB desync
+--                                can never wrongly promote an epic to `landed`.
+--   • plan_delivery        — the derived signal + PRE-FORMATTED label, per `deriveDelivery`:
+--                              - NULL when the plan is not `done` or opened no PRs (no positive
+--                                signal yet), OR every PR is terminal but not all merged
+--                                (resolved-not-landed).
+--                              - 'converging' + "M/O slices merged, F converging" when ≥1 PR is in
+--                                flight.
+--                              - 'landed' + "O/O slices merged" when every slice PR merged
+--                                (prs_in_flight = 0 AND prs_merged = prs_opened > 0).
+--   • plan_read_model      — the `plans` row with its wave (060) and delivery projections DERIVED
+--                            from the views instead of read from the denormalised columns. This is
+--                            the datasource the operator pages (overview / epic-detail) bind, so that
+--                            when the wave-1 cleanup task DROPs plans.wave_label / plans.current_wave
+--                            / plans.wave_count / plans.delivery / plans.delivery_label, every page
+--                            already reads the single-source-of-truth views. It projects only the
+--                            `plans` columns those pages reference, plus the five derived columns.
+--
+-- Forward-only, additive. NO BEGIN/COMMIT — the runner wraps each file in its own transaction.
+
+CREATE VIEW plan_delivery_counts AS
+SELECT
+  t.plan_key AS plan_key,
+  COUNT(t.pr_key) AS prs_opened,
+  SUM(CASE WHEN t.pr_key IS NOT NULL AND p.status = 'merged' THEN 1 ELSE 0 END) AS prs_merged,
+  SUM(CASE WHEN t.pr_key IS NOT NULL AND (p.status IS NULL OR p.status NOT IN ('converged', 'merged', 'abandoned')) THEN 1 ELSE 0 END) AS prs_in_flight
+FROM plan_tasks t
+LEFT JOIN pull_requests p ON p.pr_key = t.pr_key
+GROUP BY t.plan_key;
+
+CREATE VIEW plan_delivery AS
+SELECT
+  pl.plan_key AS plan_key,
+  CASE
+    WHEN pl.status IS NOT 'done' OR COALESCE(c.prs_opened, 0) = 0 THEN NULL
+    WHEN COALESCE(c.prs_in_flight, 0) > 0 THEN 'converging'
+    WHEN c.prs_merged = c.prs_opened THEN 'landed'
+    ELSE NULL
+  END AS delivery,
+  CASE
+    WHEN pl.status IS NOT 'done' OR COALESCE(c.prs_opened, 0) = 0 THEN NULL
+    WHEN COALESCE(c.prs_in_flight, 0) > 0 THEN c.prs_merged || '/' || c.prs_opened || ' slices merged, ' || c.prs_in_flight || ' converging'
+    WHEN c.prs_merged = c.prs_opened THEN c.prs_opened || '/' || c.prs_opened || ' slices merged'
+    ELSE NULL
+  END AS delivery_label
+FROM plans pl
+LEFT JOIN plan_delivery_counts c ON c.plan_key = pl.plan_key;
+
+CREATE VIEW plan_read_model AS
+SELECT
+  pl.plan_key AS plan_key,
+  pl.repo AS repo,
+  pl.issue_number AS issue_number,
+  pl.issue_url AS issue_url,
+  pl.title AS title,
+  pl.status AS status,
+  pl.task_count AS task_count,
+  pl.process_key AS process_key,
+  pl.outcome AS outcome,
+  pl.updated_at AS updated_at,
+  pl.epic_phase AS epic_phase,
+  pl.base_branch AS base_branch,
+  pl.wait_gate_label AS wait_gate_label,
+  pl.bound_artifacts AS bound_artifacts,
+  pl.promotion_pr AS promotion_pr,
+  pl.promotion_state AS promotion_state,
+  pl.list_bucket AS list_bucket,
+  pl.ack_open AS ack_open,
+  wl.wave_count AS wave_count,
+  wl.current_wave AS current_wave,
+  wl.wave_label AS wave_label,
+  d.delivery AS delivery,
+  d.delivery_label AS delivery_label
+FROM plans pl
+LEFT JOIN plan_wave_label wl ON wl.plan_key = pl.plan_key
+LEFT JOIN plan_delivery d ON d.plan_key = pl.plan_key;

package/db/migrations/062_merges_per_day_view.sql

@@ -0,0 +1,72 @@
+-- Merged-per-day throughput / burn-up as a derived SQL VIEW (epic #412, retiring the 051 flat table).
+--
+-- 051_merges_per_day.sql created the DENORMALISED `merges_per_day` read table (day / merged /
+-- cumulative / bar) that `pollMergesPerDay` (app/mergesPerDay.ts) recomputes each poll pass from the
+-- `merges` audit rows (004_merge.sql). Its comment cites the ONE reason it could not simply be a
+-- VIEW: "Urban's page datasource cannot read a SQL VIEW" (gateway.ts `schema()` whitelisted
+-- `type='table'` only). That constraint is GONE — nano-ide#424 made `gateway.schema()` introspect
+-- `type IN ('table','view')` and tag a view read-only, and #411 (059_plan_wave_summary.sql)
+-- established the layered-VIEW pattern. So the aggregate becomes what AGENTS.md always wanted
+-- ("Derivation over duplication"): a VIEW that is a single source of truth with NO write-path and no
+-- possibility of drift from the `merges` audit trail.
+--
+-- This migration is WAVE-0 / PURELY ADDITIVE: it adds the VIEW and the Velocity page is repointed
+-- onto it, but the `merges_per_day` TABLE and its `pollMergesPerDay` write-path are LEFT IN PLACE (a
+-- harmless duplicate) so the surface never goes stale while both coexist. A wave-1 cleanup task
+-- ("retire-projection-writepaths-cleanup") drops the table and deletes the write-path AFTER this
+-- merges.
+--
+-- The VIEW must reproduce the CURRENT projection EXACTLY, including two subtleties beyond the 051
+-- comment's canonical `SELECT date(at) AS day, COUNT(DISTINCT pr_key) …`:
+--   • the day is bucketed in the operator's LOCAL calendar day (issue #361) — `date(at, 'localtime')`,
+--     not UTC — matching `deriveMergesPerDay`, so a merge either side of a local midnight lands on the
+--     day the operator saw it;
+--   • `bar` is the SAME pre-formatted proportional block-character string the `prose` renderer draws
+--     today (the renderer has no per-cell templating / no chart node, so the bar must arrive
+--     ready-to-show): a run of `█` glyphs whose length is `max(1, round((merged / busiest) * 30))`
+--     (min one glyph for any non-zero day; the busiest day is 30 wide), i.e. exactly
+--     `barFor()`/`BAR_WIDTH`/`BAR_FULL` in app/mergesPerDay.ts.
+--
+-- Layered into TWO plain views so each is a `CREATE VIEW <name> AS SELECT … FROM …` with NO CTE and
+-- NO select-list subquery — which keeps them parseable by the static pages↔schema contract guard
+-- (scripts/pages-contract.test.ts), exactly as 059 layers its counts → summary:
+--
+--   • merges_per_day_counts — one row per local calendar day: `day` + `merged`
+--     (COUNT(DISTINCT pr_key) so a PR with several `merged` audit rows on one day — an
+--     already-merged short-circuit or a retry — counts once; `queued`/`blocked` rows are excluded).
+--   • merges_per_day_view   — the same rows PLUS the burn-up `cumulative`
+--     (`SUM(merged) OVER (ORDER BY day)` — a window function in the select list, allowed by the
+--     guard) and the pre-formatted `bar`. The bar length uses `MAX(merged) OVER ()` (the busiest
+--     day) as the scale; the block run is built with SQLite string funcs
+--     (`hex(zeroblob(n))` → 2n '0' chars → `substr` to n → `replace` to the `█` glyph), the same
+--     trick 059 uses for its progress bar. Both live in the SELECT list, not a subquery, so the
+--     guard can still read every output column.
+--
+-- Forward-only, additive (a new read model, no change to any base table). The runner wraps each file
+-- in its own transaction, so this file must NOT contain BEGIN/COMMIT.
+
+CREATE VIEW merges_per_day_counts AS
+SELECT
+  date(m.at, 'localtime') AS day,
+  COUNT(DISTINCT m.pr_key) AS merged
+FROM merges m
+WHERE m.outcome = 'merged'
+GROUP BY date(m.at, 'localtime');
+
+CREATE VIEW merges_per_day_view AS
+SELECT
+  c.day AS day,
+  c.merged AS merged,
+  SUM(c.merged) OVER (ORDER BY c.day) AS cumulative,
+  CASE
+    WHEN c.merged <= 0 OR MAX(c.merged) OVER () <= 0 THEN ''
+    ELSE replace(
+      substr(
+        hex(zeroblob(max(1, CAST(round((c.merged * 1.0 / MAX(c.merged) OVER ()) * 30.0) AS INTEGER)))),
+        1,
+        max(1, CAST(round((c.merged * 1.0 / MAX(c.merged) OVER ()) * 30.0) AS INTEGER))
+      ),
+      '0', '█'
+    )
+  END AS bar
+FROM merges_per_day_counts c;

package/db/migrations/064_lineage_thread_view.sql

@@ -0,0 +1,75 @@
+-- Lineage read-model: derive the view-expressible identity columns of `lineage_threads` (epic
+-- #412 — "Retire worker-maintained denormalized projections in favour of SQL VIEWs").
+--
+-- `lineage_threads` (037_lineage.sql) is a denormalised read table `pollLineage` (app/lineage.ts)
+-- rewrites every poll pass, stitching request → implementation → PR(s) → convergence → merge into
+-- one narrative per `root_request_key`. Its comment cited "Urban's datasource cannot read a SQL
+-- VIEW" as the sole reason to denormalise; nano-ide#424 removed that constraint (gateway.schema()
+-- now introspects `type IN ('table','view')`), so the parts that are plain rollups of data that
+-- ALREADY exists should be DERIVED, not duplicated (AGENTS.md "Derivation over duplication / no
+-- drift surfaces"), exactly as 059_plan_wave_summary.sql did for the plans wave/delivery rollups.
+--
+-- AUDIT — per column, is it a clean rollup or genuinely procedural?
+--
+--   VIEW-EXPRESSIBLE (pure structural function of which origin table the root matches — no frontier
+--   logic, no representative-PR selection, no formatting — so a plain parseable view reproduces them
+--   EXACTLY as `deriveLineage` does):
+--     • `kind`      — 'epic' when the root is a `plans.plan_key`, 'feature' when it is a
+--                     `feature_runs.feature_key`, else 'pr' (self-rooted human/webhook PR). The
+--                     epic-before-feature precedence mirrors `collectThreads`, which sets the plan
+--                     thread after the feature thread for the same key.
+--     • `issue_url` — the matched origin's `issue_url` (`plans`/`feature_runs`), NULL for a
+--                     self-rooted PR — exactly `deriveLineage`'s `origin.kind === "pr" ? null : …`.
+--     • `title`     — the matched origin's `title` for an epic/feature thread. A self-rooted PR's
+--                     title is the PROCEDURAL representative-PR pick, so it falls back to the
+--                     poller-written `lineage_threads.title` for kind 'pr' (see below).
+--
+--   PROCEDURAL (multi-stage frontier / ordering logic in the pure `deriveLineage`, which selects a
+--   representative PR — "first non-terminal by pr_key, else last by pr_key" — branches on origin
+--   kind + feature pre-hand-off, rolls epic fan-out up via `deriveDelivery`, and formats round /
+--   slice-count label strings; none of this is a plain no-CTE / no-select-list-subquery view, and
+--   forcing it would risk diverging from the tested derivation): `stage`, `stage_label`,
+--   `process_key`, `active`, plus the membership columns `pr_count` / `pr_keys` (which union a
+--   root's threaded PRs with its origin's own `pr_key` / `plan_tasks.pr_key` and dedupe across
+--   roots — not a clean grouped join) and the self-rooted `title`. These stay written by
+--   `pollLineage` for the wave-1 cleanup task to trim; this view PASSES THEM THROUGH from
+--   `lineage_threads` so the single Lineage grid keeps rendering identically.
+--
+-- The view is a plain `CREATE VIEW <name> AS SELECT … FROM …` — no CTE, no select-list subquery,
+-- every column aliased — so the static pages↔schema contract guard (scripts/pages-contract.test.ts)
+-- can introspect its output columns to whitelist the repointed page. CASE / COALESCE in the select
+-- list are fine (they are not subqueries).
+--
+-- Forward-only, additive: a new read model, no schema change to any base table, no DROP. The runner
+-- wraps each file in its own transaction, so this file must NOT contain BEGIN/COMMIT. This task owns
+-- the disjoint migration block 064-069; a single view suffices, so 065-069 are left unused.
+
+CREATE VIEW lineage_thread_view AS
+SELECT
+  lt.root_request_key AS root_request_key,
+  CASE
+    WHEN pl.plan_key IS NOT NULL THEN 'epic'
+    WHEN fr.feature_key IS NOT NULL THEN 'feature'
+    ELSE 'pr'
+  END AS kind,
+  CASE
+    WHEN pl.plan_key IS NOT NULL THEN pl.title
+    WHEN fr.feature_key IS NOT NULL THEN fr.title
+    ELSE lt.title
+  END AS title,
+  CASE
+    WHEN pl.plan_key IS NOT NULL THEN pl.issue_url
+    WHEN fr.feature_key IS NOT NULL THEN fr.issue_url
+    ELSE NULL
+  END AS issue_url,
+  lt.stage AS stage,
+  lt.stage_label AS stage_label,
+  lt.process_key AS process_key,
+  lt.pr_keys AS pr_keys,
+  lt.pr_count AS pr_count,
+  lt.active AS active,
+  lt.created_at AS created_at,
+  lt.updated_at AS updated_at
+FROM lineage_threads lt
+LEFT JOIN plans pl ON pl.plan_key = lt.root_request_key
+LEFT JOIN feature_runs fr ON fr.feature_key = lt.root_request_key;

package/e2e/delivery-graph.e2e.ts

@@ -172,7 +172,7 @@ describe("delivery-graph runner — engine-native execution (S4)", () => {
       ],
       edges: [],
     };
-    const run = await runDeliveryGraph(app.engine, graph, { probeTimeout: "PT2S", escalationSlaTimeout: "PT1H" });
+    const run = await runDeliveryGraph(app.engine, graph, { probeTimeout: "PT2S", probePollEvery: "PT1S", escalationSlaTimeout: "PT1H" });
     assert.ok(run.ok, `graph should deploy + run, got ${JSON.stringify(run)}`);
     await app.settle();
 
@@ -188,6 +188,7 @@ describe("delivery-graph runner — engine-native execution (S4)", () => {
     // wait is BOUNDED — its poll budget elapses and it escalates onto a human-completable task, parking
     // for a human rather than silently wedging or falsely resolving.
     assert.ok(!takenFlows(app).some((f) => f.endsWith("->End")), "the wait branch never falsely resolves to End");
+    await app.advanceTime(2_100);
     const esc = (await app.engine.searchUserTasks({ state: "CREATED" })).filter((t) => t.elementId?.endsWith("__esc"));
     assert.ok(
       esc.length >= 1,

package/e2e/feature-preflight.e2e.ts

@@ -77,6 +77,7 @@ function featureVars(overrides: Record<string, unknown>): Record<string, unknown
     customInstructions: null,
     readinessProbes: null,
     probeTimeout: null,
+    probePollEvery: null,
     gateKey: null,
     resolvedArtifacts: null,
     ...overrides,
@@ -129,6 +130,7 @@ describe("single-issue feature intake readiness gate (feature.bpmn, issue #295)"
             },
           ],
           probeTimeout: "PT30M",
+          probePollEvery: "PT15S",
           gateKey: "feature-readiness:owner/repo#7",
         }),
       });

package/e2e/inter-epic-dependency.e2e.ts

@@ -66,6 +66,7 @@ function planVars(overrides: Record<string, unknown>): Record<string, unknown> {
     waveCount: 1,
     readinessProbes: null,
     probeTimeout: null,
+    probePollEvery: null,
     gateKey: null,
     resolvedArtifacts: null,
     ...overrides,
@@ -115,6 +116,7 @@ describe("inter-epic capability gate — adversarial (plan-fanout.bpmn, issue #2
         variables: planVars({
           readinessProbes: [redProbe()],
           probeTimeout: "PT2S",
+          probePollEvery: "PT1S",
           gateKey: "preflight:owner/repo#2",
         }),
       });
@@ -133,7 +135,8 @@ describe("inter-epic capability gate — adversarial (plan-fanout.bpmn, issue #2
         !flows.includes("readiness-preflight->ensure-base-branch"),
         "the gate HOLDS wave 0 — a parked dependent never reaches the fan-out head",
       );
-      // The token is parked on the escalation user task, not lost.
+      await app.advanceTime(2_100);
+      // The token is parked on the escalation user task after the engine-owned timeout, not lost.
       const tasks = (await app.engine.searchUserTasks({ processInstanceKey })).filter(
         (t) => t.elementId === "readiness-escalation-pf",
       );
@@ -153,10 +156,12 @@ describe("inter-epic capability gate — adversarial (plan-fanout.bpmn, issue #2
         variables: planVars({
           readinessProbes: [redProbe()],
           probeTimeout: "PT2S",
+          probePollEvery: "PT1S",
           gateKey: "preflight:owner/repo#2",
         }),
       });
       await app.settle();
+      await app.advanceTime(2_100);
 
       const escalations = (await app.engine.searchUserTasks({ processInstanceKey })).filter(
         (t) => t.elementId === "readiness-escalation-pf",
@@ -196,6 +201,7 @@ describe("inter-epic capability gate — adversarial (plan-fanout.bpmn, issue #2
         }),
       });
       await app.settle();
+      await app.advanceTime(2_100);
 
       // Parked on the escalation, no human acts. Before the SLA it has NOT proceeded.
       const before = takenFlows(app);

package/e2e/plan-fanout-preflight.e2e.ts

@@ -65,6 +65,7 @@ function planVars(overrides: Record<string, unknown>): Record<string, unknown> {
     waveCount: 1,
     readinessProbes: null,
     probeTimeout: null,
+    probePollEvery: null,
     gateKey: null,
     resolvedArtifacts: null,
     ...overrides,
@@ -116,6 +117,7 @@ describe("plan-fanout inter-epic capability preflight (plan-fanout.bpmn, issue #
             },
           ],
           probeTimeout: "PT30M",
+          probePollEvery: "PT15S",
           gateKey: "preflight:owner/repo#2",
         }),
       });

package/e2e/readiness-gate.e2e.ts

@@ -18,14 +18,14 @@
 // The probes are deterministic shell builtins (`true`/`false`) so the flow is hermetic — no
 // network, no GitHub. GitHub transport is still forced offline to match the sibling e2es.
 import assert from "node:assert/strict";
-import { mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
+import { mkdirSync, rmSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { after, before, describe, test } from "node:test";
 import { fileURLToPath } from "node:url";
 import { bootTestApp, type TestApp } from "@nanobpm/urban-testkit";
 
 const APP_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+let dbSeq = 0;
 
 const GITHUB_ENV_OVERRIDES: Record<string, string> = {
   NANO_PR_GITHUB_TRANSPORT: "token",
@@ -49,7 +49,8 @@ function takenFlows(app: TestApp): string[] {
 // Each scenario boots its own app so `takenSequenceFlows` (engine-global + cumulative) reflects
 // exactly one instance's history.
 async function boot(): Promise<{ app: TestApp; dbDir: string }> {
-  const dbDir = mkdtempSync(join(tmpdir(), "nwf-readiness-"));
+  const dbDir = join(APP_ROOT, ".test-artifacts", `nwf-readiness-${process.pid}-${dbSeq++}`);
+  mkdirSync(dbDir, { recursive: true });
   const app = await bootTestApp(APP_ROOT, { env: { NANO_APP_DB_URL: `file:${join(dbDir, "app.db")}` } });
   return { app, dbDir };
 }
@@ -79,6 +80,7 @@ describe("nano-workforce artifact-readiness wait-gate (readiness-gate.bpmn)", ()
           probe: { kind: "command", target: "true", poll: { everyMs: 5, timeoutMs: 5000, backoff: "fixed" } },
           // A long engine timer that must NOT fire — readiness wins the race first.
           probeTimeout: "PT30M",
+          probePollEvery: "PT15S",
           onTimeout: "escalate",
         },
       });
@@ -90,8 +92,8 @@ describe("nano-workforce artifact-readiness wait-gate (readiness-gate.bpmn)", ()
         `the gate released on the readiness signal (flows: ${flows.join(", ")})`,
       );
       assert.ok(
-        flows.includes("probe->probe-done"),
-        "the probe branch settled after publishing the readiness signal",
+        flows.includes("probe-loop->probe-done"),
+        "the probe loop branch settled after publishing the readiness signal",
       );
       // The gate never timed out — no escalation userTask exists.
       const tasks = await app.engine.searchUserTasks({});
@@ -115,15 +117,16 @@ describe("nano-workforce artifact-readiness wait-gate (readiness-gate.bpmn)", ()
           gateKey: "gate-timeout-1",
           // `false` is never ready; a tiny local budget makes the worker exhaust fast (real time),
           // leaving the ENGINE timer as the authoritative bound.
-          probe: { kind: "command", target: "false", poll: { everyMs: 5, timeoutMs: 40, backoff: "fixed" } },
+          probe: { kind: "command", target: "false", poll: { everyMs: 15_000, timeoutMs: 60_000, backoff: "fixed" } },
           probeTimeout: "PT1M",
+          probePollEvery: "PT15S",
           onTimeout: "escalate",
         },
       });
       await app.settle();
 
-      // The wait has NOT hung and has NOT yet escalated: the probe branch settled not-ready, and the
-      // gate is parked on the timer catch — no escalation userTask before the timer's duration.
+      // The wait has NOT hung and has NOT yet escalated: the first single-shot probe returned not-ready,
+      // and the retry cadence is parked on the engine-owned poll timer.
       const beforeTimer = await app.engine.searchUserTasks({ processInstanceKey });
       assert.equal(
         beforeTimer.filter((t) => t.elementId === "readiness-escalation").length,
@@ -133,9 +136,18 @@ describe("nano-workforce artifact-readiness wait-gate (readiness-gate.bpmn)", ()
       const beforeFlows = takenFlows(app);
       assert.ok(!beforeFlows.includes("wait-ready->gate-ready"), "a never-green probe never releases as ready");
 
-      // Advancing past the engine timer is the ONLY thing that ends the wait — proving the bound is
-      // engine-owned. The token races off the timer catch onto the escalation userTask.
-      await app.advanceTime(61_000);
+      await app.advanceTime(15_000);
+      const afterPoll = takenFlows(app);
+      assert.ok(afterPoll.includes("wait-poll->probe"), "the engine timer, not a worker sleep loop, schedules the next probe");
+      assert.equal(
+        (await app.engine.searchUserTasks({ processInstanceKey })).filter((t) => t.elementId === "readiness-escalation").length,
+        0,
+        "one poll interval only re-probes; it does not consume the timeout",
+      );
+
+      // Advancing past the engine timer is the ONLY thing that ends the wait. The timeout arm routes
+      // through one last empirical probe before the event-based gateway timer opens escalation.
+      await app.advanceTime(46_000);
 
       const afterFlows = takenFlows(app);
       assert.ok(
@@ -171,6 +183,7 @@ describe("nano-workforce artifact-readiness wait-gate (readiness-gate.bpmn)", ()
           gateKey: "gate-abandon-1",
           probe: { kind: "command", target: "false", poll: { everyMs: 5, timeoutMs: 40, backoff: "fixed" } },
           probeTimeout: "PT1M",
+          probePollEvery: "PT15S",
           onTimeout: "escalate",
         },
       });
@@ -209,6 +222,7 @@ describe("nano-workforce artifact-readiness wait-gate (readiness-gate.bpmn)", ()
           gateKey: "gate-continue-1",
           probe: { kind: "command", target: "false", poll: { everyMs: 5, timeoutMs: 40, backoff: "fixed" } },
           probeTimeout: "PT1M",
+          probePollEvery: "PT15S",
           onTimeout: "continue",
         },
       });
@@ -236,6 +250,7 @@ describe("nano-workforce artifact-readiness wait-gate (readiness-gate.bpmn)", ()
           // Neither probe.onTimeout nor a top-level onTimeout is declared.
           probe: { kind: "command", target: "false", poll: { everyMs: 5, timeoutMs: 40, backoff: "fixed" } },
           probeTimeout: "PT1M",
+          probePollEvery: "PT15S",
         },
       });
       await app.settle();
@@ -266,6 +281,7 @@ describe("nano-workforce artifact-readiness wait-gate (readiness-gate.bpmn)", ()
           // The descriptor asks to continue; a stale top-level onTimeout says escalate. probe wins.
           probe: { kind: "command", target: "false", onTimeout: "continue", poll: { everyMs: 5, timeoutMs: 40, backoff: "fixed" } },
           probeTimeout: "PT1M",
+          probePollEvery: "PT15S",
           onTimeout: "escalate",
         },
       });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.119.0",
+  "version": "0.120.1",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",

package/pages/epic-detail.page.json

@@ -92,7 +92,7 @@
         "data": {
           "kind": "datasource",
           "source": "app",
-          "table": "plans",
+          "table": "plan_read_model",
           "orderBy": { "field": "updated_at", "dir": "desc" },
           "filter": [{ "field": "plan_key", "eqParam": true }]
         },
@@ -137,7 +137,7 @@
         "data": {
           "kind": "datasource",
           "source": "app",
-          "table": "plans",
+          "table": "plan_read_model",
           "orderBy": { "field": "updated_at", "dir": "desc" },
           "filter": [{ "field": "plan_key", "eqParam": true }]
         },

package/pages/lineage.page.json

@@ -87,7 +87,7 @@
         "data": {
           "kind": "datasource",
           "source": "app",
-          "table": "lineage_threads",
+          "table": "lineage_thread_view",
           "orderBy": { "field": "updated_at", "dir": "desc" },
           "filter": [{ "field": "active", "in": [1] }]
         },

package/pages/overview.page.json

@@ -140,7 +140,7 @@
         "data": {
           "kind": "datasource",
           "source": "app",
-          "table": "plans",
+          "table": "plan_read_model",
           "orderBy": { "field": "updated_at", "dir": "desc" },
           "filter": [{ "field": "list_bucket", "in": ["active"] }]
         },

package/pages/velocity.page.json

@@ -85,7 +85,7 @@
         "data": {
           "kind": "datasource",
           "source": "app",
-          "table": "merges_per_day",
+          "table": "merges_per_day_view",
           "orderBy": { "field": "day", "dir": "asc" }
         },
         "header": "{{day}} \u00b7 {{merged}} merged \u00b7 \u03a3 {{cumulative}}",