@nanobpm/nano-workforce 0.120.0 → 0.120.2

package/app/deliveryRunner.test.ts

@@ -29,31 +29,42 @@ const GRAPH: DeliveryGraph = {
   ],
 };
 
-function prepareOk(graph: DeliveryGraph, options = {}) {
-  const r = prepareDeliveryGraph(graph, options);
+async function prepareOk(graph: DeliveryGraph, options = {}) {
+  const r = await prepareDeliveryGraph(graph, options);
   assert(r.ok, `expected ok:true, got ${JSON.stringify(r)}`);
   return r.prepared;
 }
 
-test("content-addressed id: deterministic for the same graph, content-sensitive across graphs", () => {
-  const a = prepareOk(GRAPH);
-  const b = prepareOk(GRAPH);
+test("content-addressed id: deterministic for the same graph, content-sensitive across graphs", async () => {
+  const a = await prepareOk(GRAPH);
+  const b = await prepareOk(GRAPH);
   assert(/^delivery-graph-[0-9a-f]{12}$/.test(a.processDefinitionId), `id is content-addressed, got ${a.processDefinitionId}`);
   assertEquals(a.processDefinitionId, b.processDefinitionId);
 
   // A structurally different graph gets a DIFFERENT id (no collision / no accidental redeploy-as-same).
-  const other = prepareOk({ ...GRAPH, nodes: [...GRAPH.nodes, { id: "extra", kind: "agent", agent: { jobType: "senior:feature" } }], edges: [...GRAPH.edges, { from: "consume", to: "extra" }] });
+  const other = await prepareOk({ ...GRAPH, nodes: [...GRAPH.nodes, { id: "extra", kind: "agent", agent: { jobType: "senior:feature" } }], edges: [...GRAPH.edges, { from: "consume", to: "extra" }] });
   assert(other.processDefinitionId !== a.processDefinitionId, "a different graph yields a different id");
 });
 
-test("the deployable BPMN rewrites the base process id to the content-addressed deploy id", () => {
-  const p = prepareOk(GRAPH);
+test("the deployable BPMN rewrites the base process id to the content-addressed deploy id", async () => {
+  const p = await prepareOk(GRAPH);
   assert(p.bpmn.includes(`<bpmn:process id="${p.processDefinitionId}"`), "process id is the content-addressed id");
   assert(!p.bpmn.includes('<bpmn:process id="delivery-graph"'), "the base id no longer appears as the process id");
 });
 
-test("nodeInputs seeds the exact per-kind fields each node's subProcess ioMapping reads", () => {
-  const p = prepareOk(GRAPH, { nodeTimeout: "PT10M", probeTimeout: "PT20M", escalationSlaTimeout: "PT2H", escalationAssignee: "alice", runKey: "run-7" });
+test("DI (#440): the deployable definition carries diagram interchange bound to the rewritten process id", async () => {
+  // The DEPLOYED definition (not just the compile preview) must render in the process explorer, so it
+  // carries the auto-laid-out `bpmndi:BPMNDiagram`. The top-level plane's `bpmnElement` reference is
+  // rewritten in lock-step with the process id, otherwise the deployed diagram would dangle and render
+  // positionless — the exact bug #440 fixes.
+  const p = await prepareOk(GRAPH);
+  assert(p.bpmn.includes("<bpmndi:BPMNDiagram"), "deployable bpmn carries a diagram");
+  assert(p.bpmn.includes(`bpmnElement="${p.processDefinitionId}"`), "the plane binds to the content-addressed id");
+  assert(!p.bpmn.includes('bpmnElement="delivery-graph"'), "no dangling reference to the base process id remains");
+});
+
+test("nodeInputs seeds the exact per-kind fields each node's subProcess ioMapping reads", async () => {
+  const p = await prepareOk(GRAPH, { nodeTimeout: "PT10M", probeTimeout: "PT20M", escalationSlaTimeout: "PT2H", escalationAssignee: "alice", runKey: "run-7" });
   // Element ids are positional by sorted node id: consume, open-b, publish, watch-b → n0..n3.
   const inputs = p.nodeInputs;
   const byField = (pred: (v: Record<string, unknown>) => boolean) => Object.values(inputs).find((v) => pred(v as Record<string, unknown>)) as Record<string, unknown> | undefined;
@@ -64,6 +75,7 @@ test("nodeInputs seeds the exact per-kind fields each node's subProcess ioMappin
   const wait = byField((v) => "gateKey" in v);
   assertEquals(wait?.gateKey, "run-7:n3");
   assertEquals(wait?.probeTimeout, "PT20M");
+  assertEquals(wait?.probePollEvery, "PT15S");
   assert(wait?.probe && typeof wait.probe === "object", "the wait node carries its ReadinessProbe descriptor");
 
   const human = byField((v) => "escalationSlaTimeout" in v);
@@ -73,12 +85,12 @@ test("nodeInputs seeds the exact per-kind fields each node's subProcess ioMappin
   assertEquals(connector, { target: "npm:install", dedupeKey: "consume-1", payload: null, timeout: "PT10M" });
 });
 
-test("wait gateKeys default to a fresh per-run token so concurrent runs of one graph never cross-correlate", () => {
-  const gateKeyOf = (p: ReturnType<typeof prepareOk>) =>
+test("wait gateKeys default to a fresh per-run token so concurrent runs of one graph never cross-correlate", async () => {
+  const gateKeyOf = (p: Awaited<ReturnType<typeof prepareOk>>) =>
     (Object.values(p.nodeInputs).find((v) => "gateKey" in v) as { gateKey?: string } | undefined)?.gateKey;
 
-  const a = prepareOk(GRAPH);
-  const b = prepareOk(GRAPH);
+  const a = await prepareOk(GRAPH);
+  const b = await prepareOk(GRAPH);
   assert(gateKeyOf(a) && gateKeyOf(b), "each run seeds a wait gateKey");
   assert(gateKeyOf(a) !== gateKeyOf(b), "two runs of the same graph get DISTINCT default gate scopes");
   // The gate key must NOT be derived from the (shared) content digest — that is the bug this guards.
@@ -88,12 +100,12 @@ test("wait gateKeys default to a fresh per-run token so concurrent runs of one g
   assertEquals(a.bpmn, b.bpmn);
 
   // An explicit runKey is honoured verbatim (reproducible seed).
-  const seeded = prepareOk(GRAPH, { runKey: "run-7" });
+  const seeded = await prepareOk(GRAPH, { runKey: "run-7" });
   assertEquals(gateKeyOf(seeded), "run-7:n3");
 });
 
-test("a malformed graph returns the S1 compile errors and prepares nothing", () => {
-  const r = prepareDeliveryGraph({ nodes: [{ id: "a", kind: "agent", agent: { jobType: "j" } }], edges: [{ from: "a", to: "ghost" }] } as unknown as DeliveryGraph);
+test("a malformed graph returns the S1 compile errors and prepares nothing", async () => {
+  const r = await prepareDeliveryGraph({ nodes: [{ id: "a", kind: "agent", agent: { jobType: "j" } }], edges: [{ from: "a", to: "ghost" }] } as unknown as DeliveryGraph);
   assert(!r.ok, "a dangling edge fails to prepare");
   assert(r.errors.some((e) => e.path === "edges[0].to"), `expected a dangling-edge error, got ${JSON.stringify(r.errors)}`);
 });

package/app/deliveryRunner.ts

@@ -17,6 +17,7 @@ import { createHash, randomUUID } from "node:crypto";
 import type { EngineClient } from "@nanobpm/urban";
 import type { DeliveryGraph, DeliveryNode } from "../nano-generated/api-io.d.ts";
 import { assertNever, compileDeliveryGraph, DELIVERY_GRAPH_PROCESS_ID } from "./deliveryGraphCompiler.ts";
+import { DEFAULT_EVERY_MS, msToIsoDuration, parseProbe, readinessPollEvery } from "./readiness.ts";
 
 /** The content digest of a compiled graph — `sha256(bpmn)[:12]` — the single source of truth for the
  * content-addressed deploy id (`delivery-graph-<digest>`) AND the S5 dispatch door's approval token /
@@ -35,6 +36,8 @@ export interface DeliveryRunTimeouts {
   probeTimeout?: string;
   /** `human` node SLA before it records an `escalated` outcome and settles. */
   escalationSlaTimeout?: string;
+  /** `wait` gate retry cadence owned by the engine. */
+  probePollEvery?: string;
   /** Optional explicit assignee for `human` nodes + escalation tasks (else candidate-group routed). */
   escalationAssignee?: string | null;
 }
@@ -51,6 +54,7 @@ export interface DeliveryRunOptions extends DeliveryRunTimeouts {
 const DEFAULTS: Required<Omit<DeliveryRunTimeouts, "escalationAssignee">> = {
   nodeTimeout: "PT30M",
   probeTimeout: "PT30M",
+  probePollEvery: msToIsoDuration(DEFAULT_EVERY_MS),
   escalationSlaTimeout: "P1D",
 };
 
@@ -59,7 +63,7 @@ const DEFAULTS: Required<Omit<DeliveryRunTimeouts, "escalationAssignee">> = {
  * silently seeds `null` into a node body), so both derive from the same node kinds. */
 type NodeInput =
   | { jobType: string; appendPrompt: string; timeout: string }
-  | { gateKey: string; probe: unknown; probeTimeout: string }
+  | { gateKey: string; probe: unknown; probeTimeout: string; probePollEvery: string }
   | { escalationSlaTimeout: string; escalationAssignee: string | null }
   | { target: string; dedupeKey: string | null; payload: Record<string, unknown> | null; timeout: string };
 
@@ -93,8 +97,11 @@ export type RunDeliveryResult =
  * so each call's `wait` `gateKey`s differ (two concurrent runs of the same graph never cross-correlate);
  * pass an explicit `runKey` for a reproducible seed. Returns the S1 compile errors verbatim for a
  * malformed graph. */
-export function prepareDeliveryGraph(graph: DeliveryGraph, options: DeliveryRunOptions = {}): PrepareDeliveryResult {
-  const compiled = compileDeliveryGraph(graph);
+export async function prepareDeliveryGraph(
+  graph: DeliveryGraph,
+  options: DeliveryRunOptions = {},
+): Promise<PrepareDeliveryResult> {
+  const compiled = await compileDeliveryGraph(graph);
   if (!compiled.ok) return { ok: false, errors: compiled.errors };
 
   const digest = deliveryGraphDigest(compiled.bpmn);
@@ -105,6 +112,7 @@ export function prepareDeliveryGraph(graph: DeliveryGraph, options: DeliveryRunO
   const timeouts = {
     nodeTimeout: options.nodeTimeout ?? DEFAULTS.nodeTimeout,
     probeTimeout: options.probeTimeout ?? DEFAULTS.probeTimeout,
+    probePollEvery: options.probePollEvery ?? DEFAULTS.probePollEvery,
     escalationSlaTimeout: options.escalationSlaTimeout ?? DEFAULTS.escalationSlaTimeout,
     escalationAssignee: options.escalationAssignee ?? null,
   };
@@ -127,7 +135,7 @@ export async function runDeliveryGraph(
   graph: DeliveryGraph,
   options: DeliveryRunOptions = {},
 ): Promise<RunDeliveryResult> {
-  const prep = prepareDeliveryGraph(graph, options);
+  const prep = await prepareDeliveryGraph(graph, options);
   if (!prep.ok) return prep;
   const { processDefinitionId, bpmn, nodeInputs } = prep.prepared;
 
@@ -145,23 +153,36 @@ export async function runDeliveryGraph(
 }
 
 /** Rewrite the compiled BPMN's base `bpmn:process` id to the content-addressed deploy id. The base id
- * appears exactly once — as the process element's `id` attribute (element ids are `n<i>`/`gw*`/`Start`/
- * `End`, never the process id) — so a single targeted replacement is unambiguous. */
+ * appears exactly once as the process element's `id` attribute (element ids are `n<i>`/`gw*`/`Start`/
+ * `End`, never the process id), and once more as the top-level `bpmndi:BPMNPlane`'s `bpmnElement`
+ * reference back to that process (the diagram interchange the compiler now attaches, #440). Both must
+ * move together, otherwise the deployed definition carries a DANGLING plane reference and renders
+ * positionless — the very bug DI was added to fix. Nested sub-process planes reference `n<i>` element
+ * ids, which are untouched. */
 function rewriteProcessId(bpmn: string, processDefinitionId: string): string {
-  return bpmn.replace(`id="${DELIVERY_GRAPH_PROCESS_ID}"`, `id="${processDefinitionId}"`);
+  return bpmn
+    .replace(`id="${DELIVERY_GRAPH_PROCESS_ID}"`, `id="${processDefinitionId}"`)
+    .replace(`bpmnElement="${DELIVERY_GRAPH_PROCESS_ID}"`, `bpmnElement="${processDefinitionId}"`);
 }
 
 /** Build the `nodeInputs.<element>` seed for one node, per its kind — the exact fields the compiled
  * subProcess ioMapping pulls. Total over the closed kind set. */
 function buildNodeInput(
   node: DeliveryNode,
-  ctx: { runKey: string; element: string; nodeTimeout: string; probeTimeout: string; escalationSlaTimeout: string; escalationAssignee: string | null },
+  ctx: { runKey: string; element: string; nodeTimeout: string; probeTimeout: string; probePollEvery: string; escalationSlaTimeout: string; escalationAssignee: string | null },
 ): NodeInput {
   switch (node.kind) {
     case "agent":
       return { jobType: node.agent.jobType, appendPrompt: node.agent.prompt ?? "", timeout: ctx.nodeTimeout };
-    case "wait":
-      return { gateKey: `${ctx.runKey}:${ctx.element}`, probe: node.wait, probeTimeout: ctx.probeTimeout };
+    case "wait": {
+      const probe = parseProbe(node.wait);
+      return {
+        gateKey: `${ctx.runKey}:${ctx.element}`,
+        probe: node.wait,
+        probeTimeout: ctx.probeTimeout,
+        probePollEvery: probe.poll?.everyMs ? readinessPollEvery(probe, {}) : ctx.probePollEvery,
+      };
+    }
     case "human":
       return { escalationSlaTimeout: ctx.escalationSlaTimeout, escalationAssignee: ctx.escalationAssignee };
     case "connector":

package/app/feature.test.ts

@@ -320,6 +320,7 @@ test("startFeature: no readiness ⇒ readinessProbes/probeTimeout/gateKey seeded
   const v = captured.variables;
   assertEquals(v.readinessProbes, null);
   assertEquals(v.probeTimeout, null);
+  assertEquals(v.probePollEvery, null);
   assertEquals(v.gateKey, null);
   assertEquals(v.resolvedArtifacts, null);
 });
@@ -348,11 +349,12 @@ test("startFeature: readiness probes seed the gate variables + a non-blank corre
     false,
     false,
     null,
-    { probes, probeTimeout: "PT30M" },
+    { probes, probeTimeout: "PT30M", probePollEvery: "PT15S" },
   );
   const v = captured.variables;
   assertEquals(v.readinessProbes, probes);
   assertEquals(v.probeTimeout, "PT30M");
+  assertEquals(v.probePollEvery, "PT15S");
   // The preflight probe worker requires a non-blank gateKey to publish readiness-ready on.
   assertEquals(v.gateKey, "feature-readiness:owner/repo#42");
   assertEquals(v.resolvedArtifacts, null);

package/app/feature.ts

@@ -29,6 +29,7 @@ import { deriveListBucket, deriveStage } from "./stage.ts";
 export interface FeatureReadinessOptions {
   readonly probes?: ReadinessProbe[];
   readonly probeTimeout?: string | null;
+  readonly probePollEvery?: string | null;
 }
 
 /** The BPMN process this module drives (resources/processes/feature.bpmn). */
@@ -367,6 +368,13 @@ export async function startFeature(
         "a non-blank bound. Derive it via parseFeatureReadiness before starting a gated feature.",
     );
   }
+  if (readinessProbes && (readiness.probePollEvery ?? "").trim() === "") {
+    throw new Error(
+      `startFeature(${parsed.planKey}): ${readinessProbes.length} readiness probe(s) seeded without a ` +
+        "probePollEvery — the preflight retry timers (=probePollEvery) require a non-blank cadence. " +
+        "Derive it via parseFeatureReadiness before starting a gated feature.",
+    );
+  }
   // Operator free-text steering for the implementation agent (issue #172 follow-on): blank/absent →
   // null so the implement task's `appendPrompt` FEEL (`customInstructions = null`) skips the block
   // rather than appending an empty "Operator custom instructions" heading.
@@ -487,6 +495,7 @@ export async function startFeature(
       // gate-less run still resolves the variable in that FEEL instead of raising an incident.
       readinessProbes,
       probeTimeout: readinessProbes ? (readiness.probeTimeout ?? null) : null,
+      probePollEvery: readinessProbes ? (readiness.probePollEvery ?? null) : null,
       gateKey: readinessProbes ? `feature-readiness:${parsed.planKey}` : null,
       resolvedArtifacts: null,
     },

package/app/featureReadiness.test.ts

@@ -9,12 +9,12 @@ import { test } from "node:test";
 import { assertEquals } from "#test-assert";
 import { parseFeatureReadiness } from "./featureReadiness.ts";
 
-const ENV = { NANO_READINESS_POLL_TIMEOUT: "PT30M" } as Record<string, string | undefined>;
+const ENV = { NANO_READINESS_POLL_TIMEOUT: "PT30M", NANO_READINESS_POLL_EVERY_MS: "15000" } as Record<string, string | undefined>;
 
 test("parseFeatureReadiness: no intake ⇒ empty probes, null bound (gate skipped)", () => {
-  assertEquals(parseFeatureReadiness(undefined, ENV), { probes: [], probeTimeout: null });
-  assertEquals(parseFeatureReadiness({}, ENV), { probes: [], probeTimeout: null });
-  assertEquals(parseFeatureReadiness({ readiness: [], blockedOn: [] }, ENV), { probes: [], probeTimeout: null });
+  assertEquals(parseFeatureReadiness(undefined, ENV), { probes: [], probeTimeout: null, probePollEvery: null });
+  assertEquals(parseFeatureReadiness({}, ENV), { probes: [], probeTimeout: null, probePollEvery: null });
+  assertEquals(parseFeatureReadiness({ readiness: [], blockedOn: [] }, ENV), { probes: [], probeTimeout: null, probePollEvery: null });
 });
 
 test("parseFeatureReadiness: blockedOn + consumerPackage ⇒ capability probes with derived bound", () => {
@@ -32,6 +32,7 @@ test("parseFeatureReadiness: blockedOn + consumerPackage ⇒ capability probes w
   assertEquals(out.probes[1].match?.capabilityRef, "nanobpm/nano-bpm#808");
   // Every derived probe shares the env default, so the bound is that default.
   assertEquals(out.probeTimeout, "PT30M");
+  assertEquals(out.probePollEvery, "PT15S");
 });
 
 test("parseFeatureReadiness: blockedOn without consumerPackage ⇒ command state probes (merged-is-enough)", () => {
@@ -43,6 +44,7 @@ test("parseFeatureReadiness: blockedOn without consumerPackage ⇒ command state
     onTimeout: "escalate",
   });
   assertEquals(out.probeTimeout, "PT30M");
+  assertEquals(out.probePollEvery, "PT15S");
 });
 
 test("parseFeatureReadiness: full readiness descriptors round-trip through parseProbe", () => {
@@ -82,6 +84,7 @@ test("parseFeatureReadiness: a longer per-probe budget wins the derived bound",
     ENV,
   );
   assertEquals(out.probeTimeout, "PT3600S");
+  assertEquals(out.probePollEvery, "PT15S");
 });
 
 test("parseFeatureReadiness: a bare repo#N handle is rejected (cannot name a provenance repo)", () => {

package/app/featureReadiness.ts

@@ -26,6 +26,7 @@ import {
   DEFAULT_READINESS_TIMEOUT,
   parseProbe,
   type ReadinessProbe,
+  readinessPollEvery,
   readinessTimeout,
 } from "./readiness.ts";
 import { isoDurationToMs } from "./reviewWait.ts";
@@ -47,6 +48,7 @@ export interface FeatureReadinessInput {
 export interface FeatureReadiness {
   readonly probes: ReadinessProbe[];
   readonly probeTimeout: string | null;
+  readonly probePollEvery: string | null;
 }
 
 function isNonEmptyString(v: unknown): v is string {
@@ -104,7 +106,7 @@ function desugarHandle(handle: string, consumerPackage: string | null): Readines
 }
 
 /** Parse + desugar a feature's optional intake readiness into the gate's `readinessProbes` +
- * `probeTimeout`. Accepts EITHER the full `readiness` descriptor list OR the `blockedOn` shorthand
+ * `probeTimeout`/`probePollEvery`. Accepts EITHER the full `readiness` descriptor list OR the `blockedOn` shorthand
  * (or both — they concatenate). Returns an empty probe set (gate skipped) when neither is present.
  *
  * Throws a descriptive error on a malformed descriptor (via {@link parseProbe}), a `blockedOn` entry
@@ -139,7 +141,7 @@ export function parseFeatureReadiness(
     }
   }
 
-  if (probes.length === 0) return { probes: [], probeTimeout: null };
+  if (probes.length === 0) return { probes: [], probeTimeout: null, probePollEvery: null };
 
   // One bound governs the whole preflight's escalation timers — the LONGEST of the probes' derived
   // timeouts (via the canonical `readinessTimeout`), so no probe is cut short. Mirrors the epic
@@ -147,5 +149,8 @@ export function parseFeatureReadiness(
   const probeTimeout = probes
     .map((p) => readinessTimeout(p, env))
     .reduce((a, b) => (isoDurationToMs(b, DEFAULT_READINESS_TIMEOUT) > isoDurationToMs(a, DEFAULT_READINESS_TIMEOUT) ? b : a));
-  return { probes, probeTimeout };
+  const probePollEvery = probes
+    .map((p) => readinessPollEvery(p, env))
+    .reduce((a, b) => (isoDurationToMs(b, DEFAULT_READINESS_TIMEOUT) < isoDurationToMs(a, DEFAULT_READINESS_TIMEOUT) ? b : a));
+  return { probes, probeTimeout, probePollEvery };
 }

package/app/plan.test.ts

@@ -350,7 +350,7 @@ test("startPlan fails fast when readiness probes are seeded without a probeTimeo
         engine,
         { repo: "owner/repo", number: 292, url: "https://github.com/owner/repo/issues/292", planKey: PLAN_KEY },
         "epic/gate-branch",
-        { readinessProbes: [probe] as any, probeTimeout: "   " },
+        { readinessProbes: [probe] as any, probeTimeout: "   ", probePollEvery: "PT15S" },
       ),
     Error,
     "probeTimeout",

package/app/plan.ts

@@ -964,6 +964,7 @@ function assertAcyclic(adjacency: Map<string, Set<string>>): void {
 export interface StartPlanOptions {
   readinessProbes?: ReadinessProbe[];
   probeTimeout?: string;
+  probePollEvery?: string;
 }
 
 /** Register a plan row (if new) and start the plan-fanout process. Idempotent on
@@ -988,6 +989,13 @@ export async function startPlan(
         "bound. Derive it via readinessTimeout (see planLowering) before starting a gated dependent.",
     );
   }
+  if (probes && (opts.probePollEvery ?? "").trim() === "") {
+    throw new Error(
+      `startPlan(${parsed.planKey}): ${probes.length} readiness probe(s) seeded without a probePollEvery — ` +
+        "the preflight retry timers (=probePollEvery) require a non-blank cadence. Derive it via " +
+        "readinessPollEvery (see planLowering) before starting a gated dependent.",
+    );
+  }
   const table = plans(data);
   const existing = await table.get(parsed.planKey);
   if (existing && !PLAN_TERMINAL_STATUSES.includes(existing.status)) {
@@ -1108,6 +1116,7 @@ export async function startPlan(
       // the variable in that FEEL expression instead of raising an incident.
       readinessProbes: probes,
       probeTimeout: opts.probeTimeout ?? null,
+      probePollEvery: opts.probePollEvery ?? null,
       // The preflight probe worker (`pr.readiness-probe`) requires a non-blank `gateKey` correlation
       // key (it publishes `readiness-ready` on it). The typed `ReadinessProbeIn` envelope projects it
       // from THIS process scope (not task-local ioMapping), so it is seeded here — one per dependent

package/app/planFanoutPreflight.test.ts

@@ -48,21 +48,21 @@ test("the preflight is a multi-instance subprocess over =readinessProbes collect
 });
 
 test("the preflight reuses the pr.readiness-probe worker and the readiness-escalation form (no reinvention)", () => {
-  const sub = flat.match(/<bpmn:subProcess\b[^>]*\bid="readiness-preflight"[\s\S]*?<\/bpmn:subProcess>/)![0];
-  assertStringIncludes(sub, 'type="pr.readiness-probe"', "reuses the existing capability probe worker");
-  assertStringIncludes(sub, 'value="ReadinessProbeIn"', "feeds the shared probe input envelope");
-  assertStringIncludes(sub, 'value="ReadinessProbeOut"', "reads the shared probe output envelope");
-  assertStringIncludes(sub, 'formId="readiness-escalation"', "reuses the existing readiness escalation form");
+  assertStringIncludes(flat, 'type="pr.readiness-probe"', "reuses the existing capability probe worker");
+  assertStringIncludes(flat, 'value="ReadinessProbeIn"', "feeds the shared probe input envelope");
+  assertStringIncludes(flat, 'value="ReadinessProbeOut"', "reads the shared probe output envelope");
+  assertStringIncludes(flat, 'formId="readiness-escalation"', "reuses the existing readiness escalation form");
 });
 
 test("a never-green producer escalates (bounded) without wedging: probe timeout + SLA both settle the gate", () => {
-  const sub = flat.match(/<bpmn:subProcess\b[^>]*\bid="readiness-preflight"[\s\S]*?<\/bpmn:subProcess>/)![0];
-  // The probe carries an interrupting timeout bound (reuses the gate's =probeTimeout), and the human
-  // escalation carries the shared SLA bound — so a stuck producer can never wedge the dependent.
-  assertStringIncludes(sub, "=probeTimeout", "the probe is bounded by the reused =probeTimeout");
-  assertStringIncludes(sub, "=escalationSlaTimeout", "the escalation is bounded by the shared SLA");
-  assert(hasFlow("be_pf_probe_timeout", "readiness-escalation-pf"), "a timed-out probe routes to escalation");
-  assert(hasFlow("pf_gw", "readiness-escalation-pf"), "a not-ready probe routes to escalation");
+  // The probe loop carries an interrupting timeout bound (reuses the gate's =probeTimeout), and the
+  // human escalation carries the shared SLA bound — so a stuck producer can never wedge the dependent.
+  assertStringIncludes(flat, "=probeTimeout", "the probe loop is bounded by the reused =probeTimeout");
+  assertStringIncludes(flat, "=probePollEvery", "retry cadence is driven by the engine timer");
+  assertStringIncludes(flat, "=escalationSlaTimeout", "the escalation is bounded by the shared SLA");
+  assert(hasFlow("be_pf_probe_timeout", "preflight-probe-last-attempt"), "a timed-out loop routes to one last empirical probe");
+  assert(hasFlow("preflight-probe-last-attempt", "pf_gw"), "the last attempt can still take the ready path");
+  assert(hasFlow("pf_gw", "readiness-escalation-pf"), "a not-ready final probe routes to escalation");
   assert(hasFlow("be_pf_sla", "pf_end"), "an elapsed escalation SLA settles the preflight instead of wedging");
 });
 

package/app/planLowering.test.ts

@@ -139,6 +139,7 @@ test("deriveEpicSchedule: a dependent with MULTIPLE inbound edges waits for ALL
   assertEquals(dep.producers.sort(), ["o/r#1", "o/r#2"]);
   assertEquals(dep.probes.length, 2); // one probe per producer — must satisfy both to fan out
   assert(dep.probeTimeout.startsWith("PT") || dep.probeTimeout.startsWith("P"), "an ISO-8601 bound");
+  assert(dep.probePollEvery.startsWith("PT") || dep.probePollEvery.startsWith("P"), "an ISO-8601 cadence");
 });
 
 // ── lowerAdmittedSet ────────────────────────────────────────────────────────────────────────────
@@ -160,6 +161,7 @@ test("lowerAdmittedSet starts roots with no probe and dependents with their seed
   const depProbes = byKey.get("o/r#2")?.["readinessProbes"] as unknown[] | null;
   assert(Array.isArray(depProbes) && depProbes.length === 1, "dependent seeded with one capability probe");
   assert(byKey.get("o/r#2")?.["probeTimeout"] != null, "dependent seeded with a bounded timeout");
+  assert(byKey.get("o/r#2")?.["probePollEvery"] != null, "dependent seeded with a poll cadence");
 
   // Durable edge materialized (after the plans rows exist), and a plans row per epic.
   assertEquals((tables.get("plan_deps") ?? []).length, 1);

package/app/planLowering.ts

@@ -35,7 +35,7 @@ import {
   recordPlanDep,
   startPlan,
 } from "./plan.ts";
-import { type ReadinessProbe, readinessTimeout } from "./readiness.ts";
+import { type ReadinessProbe, readinessPollEvery, readinessTimeout } from "./readiness.ts";
 
 /** Derive the `capability` readiness probe for ONE inbound inter-epic edge: it goes green when the
  * producer epic (`depends_on_plan_key`) has published a release of `package` whose provenance carries
@@ -64,6 +64,7 @@ export interface DependentGate {
   probes: ReadinessProbe[];
   producers: string[];
   probeTimeout: string;
+  probePollEvery: string;
 }
 
 /** The pure schedule derived from a validated set: the ROOTS to start immediately and the
@@ -104,7 +105,10 @@ export function deriveEpicSchedule(
     const probeTimeout = probes
       .map((p) => readinessTimeout(p, env))
       .reduce((a, b) => (isoLonger(a, b) ? a : b));
-    dependents.push({ planKey, probes, producers: edgesForKey.map((e) => e.depends_on_plan_key), probeTimeout });
+    const probePollEvery = probes
+      .map((p) => readinessPollEvery(p, env))
+      .reduce((a, b) => (isoLonger(a, b) ? b : a));
+    dependents.push({ planKey, probes, producers: edgesForKey.map((e) => e.depends_on_plan_key), probeTimeout, probePollEvery });
   }
   return { roots, dependents };
 }
@@ -161,6 +165,7 @@ export async function lowerAdmittedSet(
     await startPlan(data, engine, parsed, staged.base_branch, {
       readinessProbes: gate?.probes,
       probeTimeout: gate?.probeTimeout,
+      probePollEvery: gate?.probePollEvery,
     });
   }
 

package/app/pollUserTasks.test.ts

@@ -535,4 +535,52 @@ test("pollUserTasks (engine-first): pages through a large open set (no first-pag
   }
 
   assertEquals((stores.user_tasks ?? []).length, 150);
-});
+});
+test("pollUserTasks (engine-first): surfaces an inlined delivery-graph human task, enriched + bucketed as `delivery` (issue #442)", async () => {
+  // A delivery-graph `human` node is compiled (S4) as an INLINED user task with a per-node id
+  // `delivery-human-task__<node>` — the bare `delivery-human-task` never appears at runtime. The poller's
+  // leak guards must recognise it through the single-source-of-truth predicate (`userTaskKindLabel` /
+  // `isDeliveryHumanElement`), NOT exact `USER_TASK_KIND_LABELS` membership — else every delivery-graph
+  // human gate is silently dropped from the Tasks inbox and no operator can tick it off (merlin task 35002).
+  const { data, stores } = memData({
+    delivery_graph_runs: [
+      { run_key: "delivery-graph-403eb22e", process_key: "dg-1", status: "running", title: "release runbook" },
+    ],
+  });
+  const restore = stubUserTaskSearch([
+    { userTaskKey: "35002", elementId: "delivery-human-task__n1", processInstanceKey: "dg-1", state: "CREATED" },
+  ]);
+  try {
+    await pollUserTasks(data, fakeEngine({}), REST);
+  } finally {
+    restore();
+  }
+
+  const byKey = Object.fromEntries((stores.user_tasks ?? []).map((r) => [r.user_task_key, r]));
+  assertEquals(Object.keys(byKey), ["35002"]);
+  assertEquals(byKey["35002"].element_id, "delivery-human-task__n1");
+  assertEquals(byKey["35002"].kind_label, "Delivery: human step");
+  assertEquals(byKey["35002"].subject_type, "delivery");
+  assertEquals(byKey["35002"].subject_key, "delivery-graph-403eb22e");
+  assertEquals(byKey["35002"].subject_title, "release runbook");
+});
+
+test("pollUserTasks (engine-first): a delivery-human task on an UNTRACKED run still surfaces (bucketed `delivery`, instance fallback) (issue #442)", async () => {
+  // Even with no `delivery_graph_runs` row referencing the instance, the kind implies its aggregate, so
+  // the row renders and stays answerable — mirroring the orphaned-escalation guarantee (#358).
+  const { data, stores } = memData({});
+  const restore = stubUserTaskSearch([
+    { userTaskKey: "35002", elementId: "delivery-human-task__n1", processInstanceKey: "dg-9", state: "CREATED" },
+  ]);
+  try {
+    await pollUserTasks(data, fakeEngine({}), REST);
+  } finally {
+    restore();
+  }
+
+  const byKey = Object.fromEntries((stores.user_tasks ?? []).map((r) => [r.user_task_key, r]));
+  assertEquals(Object.keys(byKey), ["35002"]);
+  assertEquals(byKey["35002"].kind_label, "Delivery: human step");
+  assertEquals(byKey["35002"].subject_type, "delivery");
+  assertEquals(byKey["35002"].subject_key, "dg-9"); // instance fallback — non-blank so it renders
+});

package/app/readiness.test.ts

@@ -37,6 +37,7 @@ import {
   type ProbeExec,
   type PrObservation,
   prViewCommand,
+  readinessPollEvery,
   readinessTimeout,
   readinessTimeoutMs,
   redactString,
@@ -585,6 +586,14 @@ test("readinessTimeoutMs: the ms twin of readinessTimeout — same precedence, n
   );
 });
 
+
+test("readinessPollEvery: derives the engine retry cadence from descriptor/env/default with clamp", () => {
+  assertEquals(readinessPollEvery(parseProbe({ kind: "http", target: "x", poll: { everyMs: 1500 } }), {}), "PT2S");
+  assertEquals(readinessPollEvery(parseProbe({ kind: "http", target: "x" }), { NANO_READINESS_POLL_EVERY_MS: "2500" }), "PT3S");
+  assertEquals(readinessPollEvery(parseProbe({ kind: "http", target: "x", poll: { everyMs: MAX_EVERY_MS + 1 } }), {}), msToIsoDuration(MAX_EVERY_MS));
+  assertEquals(readinessPollEvery(parseProbe({ kind: "http", target: "x" }), { NANO_READINESS_POLL_EVERY_MS: "bad" }), msToIsoDuration(DEFAULT_EVERY_MS));
+});
+
 test("probeBudgetMs: prefers the seeded probeTimeout (the gate timer's bound), falling back to the env twin", () => {
   const probe = parseProbe({ kind: "http", target: "x" });
   // The seeded probeTimeout wins over the ambient env — binding worker and engine to ONE per-instance

package/app/readiness.ts

@@ -776,6 +776,31 @@ export function readinessTimeout(
   return isoDuration(readEnvOr("NANO_READINESS_POLL_TIMEOUT", DEFAULT_READINESS_TIMEOUT, env), DEFAULT_READINESS_TIMEOUT);
 }
 
+/** The poll cadence (an ISO-8601 duration) seeded onto a readiness-gate instance as `probePollEvery`:
+ * the descriptor's `poll.everyMs` when present, else `NANO_READINESS_POLL_EVERY_MS`, else the built-in
+ * {@link DEFAULT_EVERY_MS}, clamped to {@link MAX_EVERY_MS}. Since Option A (#428), the engine — not the
+ * worker — owns the retry cadence: the `wait-poll` timers in `readiness-gate.bpmn` (and the preflight
+ * loops in `feature.bpmn`/`plan-fanout.bpmn`) read `=probePollEvery`, re-activating the now single-shot
+ * `pr.readiness-probe` once per interval. Derived here so whoever seeds a gate derives the cadence from
+ * ONE place (mirroring {@link readinessTimeout} for the bound), and worker/engine can never drift.
+ * `msToIsoDuration` rounds up (via `Math.ceil`) to a whole second, with a one-second minimum, so the
+ * timer never rounds to an immediately-refiring zero-length duration (which would reintroduce a
+ * busy-spin — the very defect Option A removes). */
+export function readinessPollEvery(
+  probe: ReadinessProbe,
+  env: Record<string, string | undefined> = process.env,
+): string {
+  const declared = probe.poll?.everyMs;
+  const ms =
+    typeof declared === "number" && declared >= 1
+      ? Math.min(Math.trunc(declared), MAX_EVERY_MS)
+      : (() => {
+          const envEvery = Number(readEnvOr("NANO_READINESS_POLL_EVERY_MS", String(DEFAULT_EVERY_MS), env));
+          return Number.isFinite(envEvery) && envEvery >= 1 ? Math.min(Math.trunc(envEvery), MAX_EVERY_MS) : DEFAULT_EVERY_MS;
+        })();
+  return msToIsoDuration(ms);
+}
+
 /** The effective gate budget in **milliseconds** — the ms twin of {@link readinessTimeout}, resolved
  * by the SAME precedence (descriptor `poll.timeoutMs`, else `NANO_READINESS_POLL_TIMEOUT`, else the
  * built-in default) and sharing its env key + default. The worker's local poll budget MUST use this