@nanobpm/nano-workforce 0.126.0 → 0.128.0

package/app/service.ts

@@ -10,6 +10,7 @@
 import { readFileSync } from "node:fs";
 import type { DataLayer, EngineClient } from "@nanobpm/urban";
 import { ABANDONED_STATUS, abandonUrl, mintAbandonToken, renderAbandonBrief } from "./abandon.ts";
+import { escalationFormId } from "./agentCompletion.ts";
 import { agentSlaTimeout } from "./agentSla.ts";
 import {
   CAPS_RESOLVED_MESSAGE,
@@ -2186,6 +2187,10 @@ interface UserTaskSearchItem {
   elementId?: string;
   processInstanceKey?: string | number;
   state?: string;
+  /** The engine's resolution of the task's `.form` linkage (its `formId="X"`) to the deployed form's
+   *  key, attached to the open task. Denormalised onto the row so the collapsed Tasks grid can render
+   *  the deployed form per row (issue #461). The wire may send a JSON number or string. */
+  formKey?: string | number;
 }
 
 /** One discovered open escalation user task, normalised for projection. */
@@ -2193,6 +2198,9 @@ interface OpenUserTask {
   userTaskKey: string;
   elementId: string;
   processInstanceKey: string;
+  /** The engine-reported `formKey`, or "" when the search omitted it (the poller then falls back to the
+   *  kind's static `.form` linkage). */
+  formKey: string;
 }
 
 /** Engine-first sweep (issue #358): read EVERY open (`CREATED`) native user task from the engine over
@@ -2234,7 +2242,7 @@ async function sweepOpenEscalationTasks(base: string, headers: Record<string, st
       const userTaskKey = it.userTaskKey == null ? "" : String(it.userTaskKey);
       if (!userTaskKey || seen.has(userTaskKey)) continue;
       seen.add(userTaskKey);
-      out.push({ userTaskKey, elementId, processInstanceKey: it.processInstanceKey == null ? "" : String(it.processInstanceKey) });
+      out.push({ userTaskKey, elementId, processInstanceKey: it.processInstanceKey == null ? "" : String(it.processInstanceKey), formKey: it.formKey == null ? "" : String(it.formKey) });
     }
     if (items.length < limit) break; // last page
     from += items.length;
@@ -2379,7 +2387,7 @@ export async function pollUserTasks(
   // element + the instance it parks on) into its desired-row context, enriching from its subject row
   // when the instance is tracked or a per-kind fallback when it is orphaned. Returns `null` for a
   // non-escalation element (the leak guard) so an arbitrary internal user task can never reach the inbox.
-  const contextFor = async (elementId: string, userTaskKey: string, processInstanceKey: string): Promise<UserTaskContext | null> => {
+  const contextFor = async (elementId: string, userTaskKey: string, processInstanceKey: string, formKey: string): Promise<UserTaskContext | null> => {
     if (userTaskKindLabel(elementId) === undefined) return null;
     const subj = subjectByInstance.get(processInstanceKey);
     // Orphaned-task fallback: the kind implies its aggregate even when no subject row references the
@@ -2387,6 +2395,11 @@ export async function pollUserTasks(
     // derived from the predicate rather than the static per-element table.
     const subjectType = subj?.type ?? DEFAULT_SUBJECT_TYPE[elementId] ?? (isDeliveryHumanElement(elementId) ? "delivery" : "plan");
     const subjectKey = subj?.key ?? processInstanceKey;
+    // Denormalise the engine `formKey` so the collapsed Tasks grid renders the deployed `.form` per row
+    // (issue #461). Prefer the engine-resolved key the search reported; fall back to the fixed-form kind's
+    // static `.form` linkage (`escalationFormId`) when the search omitted it — the delivery-graph `human`
+    // node has no static form (varies per node), so it relies wholly on the engine-reported key.
+    const resolvedFormKey = formKey.trim() || escalationFormId(elementId) || null;
     let question: string | null = null;
     switch (elementId) {
       case FEATURE_ESCALATION_ELEMENT:
@@ -2412,17 +2425,17 @@ export async function pollUserTasks(
         question = conformanceEscalationQuestion(subj ? { summary: subj.conformanceSummary } : undefined);
         break;
     }
-    return { userTaskKey, elementId, subjectType, subjectKey, subjectTitle: subj?.title ?? null, subjectUrl: subj?.url ?? null, question, processKey: processInstanceKey };
+    return { userTaskKey, elementId, subjectType, subjectKey, subjectTitle: subj?.title ?? null, subjectUrl: subj?.url ?? null, question, processKey: processInstanceKey, formKey: resolvedFormKey };
   };
 
   // Desired set, deduped by completable key (a task is open at most once; guard a page overlap / a
   // subject seen under two statuses mid-pass).
   const desiredByKey = new Map<string, UserTaskRow>();
-  const project = async (elementId: string | undefined, userTaskKey: string, processInstanceKey: string) => {
+  const project = async (elementId: string | undefined, userTaskKey: string, processInstanceKey: string, formKey: string) => {
     if (!elementId) return;
     const rowKey = userTaskKey.trim();
     if (!rowKey || desiredByKey.has(rowKey)) return;
-    const ctx = await contextFor(elementId, userTaskKey, processInstanceKey);
+    const ctx = await contextFor(elementId, userTaskKey, processInstanceKey, formKey);
     if (!ctx) return;
     const row = buildUserTaskRow(ctx, at);
     if (row) desiredByKey.set(rowKey, row);
@@ -2433,7 +2446,7 @@ export async function pollUserTasks(
     const headers: Record<string, string> = { "content-type": "application/json" };
     if (engineRest.token) headers.authorization = `Bearer ${engineRest.token}`;
     for (const t of await sweepOpenEscalationTasks(base, headers)) {
-      await project(t.elementId, t.userTaskKey, t.processInstanceKey);
+      await project(t.elementId, t.userTaskKey, t.processInstanceKey, t.formKey);
     }
   } else {
     // Reduced-capability fallback (no raw-REST surface): typed-seam per-active-subject scan, tracked-only.
@@ -2441,14 +2454,14 @@ export async function pollUserTasks(
     const scanInstance = async (processKey: string | null | undefined) => {
       if (!processKey || seen.has(processKey)) return;
       seen.add(processKey);
-      let tasks: { userTaskKey: string; elementId?: string }[];
+      let tasks: { userTaskKey: string; elementId?: string; formKey?: string }[];
       try {
         tasks = await engine.openUserTasks({ processInstanceKey: processKey });
       } catch (err) {
         console.error(`[poller] user tasks (${processKey}): ${err}`);
         return;
       }
-      for (const t of tasks) await project(t.elementId, t.userTaskKey, processKey);
+      for (const t of tasks) await project(t.elementId, t.userTaskKey, processKey, t.formKey ?? "");
     };
     for (const status of FEATURE_ACTIVE_STATUSES) for (const run of await featureRuns(data).find({ status })) await scanInstance(run.process_key);
     for (const status of PLAN_ACTIVE_STATUSES) for (const plan of await plans(data).find({ status })) await scanInstance(plan.process_key);

package/app/tasksPage.test.ts

@@ -0,0 +1,44 @@
+// Structure guard for the collapsed Tasks page (issue #461). The Tasks page is ONE `user_tasks`
+// dataGrid (`filter: []`, `orderBy updated_at desc`) with `kind_label` as a "Type" column, completing
+// each row via its ENGINE-declared form (nano-ide#457's `detail.engineForm`) — not seven
+// `element_id`-allowlisted grids each with a hand-authored `detail.form` that duplicates a deployed
+// `.form` resource AND leaves dynamic-id delivery-graph tasks (counted by the `filter: []` badge)
+// rendered by no grid. This test pins that end-state so the anti-pattern can't creep back:
+//   • exactly one `dataGrid`, over `user_tasks`, unfiltered, recency-ordered → badge ≡ list;
+//   • a "Type" column bound to `kind_label`;
+//   • an engine-form detail (`form_key` / `user_task_key`), and NO page-local `detail.form`.
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { test } from "node:test";
+import { assert, assertEquals } from "#test-assert";
+
+// biome-ignore lint/suspicious/noExplicitAny: reading an untyped page manifest for structural assertions
+const page: any = JSON.parse(readFileSync(fileURLToPath(new URL("../pages/tasks.page.json", import.meta.url)), "utf8"));
+// biome-ignore lint/suspicious/noExplicitAny: see above
+const nodes: any[] = page.nodes ?? [];
+// biome-ignore lint/suspicious/noExplicitAny: see above
+const grids: any[] = nodes.filter((n) => n.type === "dataGrid");
+
+test("Tasks page is exactly ONE dataGrid over user_tasks (filter [], orderBy updated_at desc)", () => {
+  assertEquals(grids.length, 1);
+  const [grid] = grids;
+  assertEquals(grid.props.data.table, "user_tasks");
+  assertEquals(grid.props.data.filter, []);
+  assertEquals(grid.props.data.orderBy, { field: "updated_at", dir: "desc" });
+});
+
+test("Tasks grid surfaces kind_label as a 'Type' column", () => {
+  // biome-ignore lint/suspicious/noExplicitAny: see above
+  const typeCol = grids[0].props.columns.find((c: any) => c.field === "kind_label");
+  assert(typeCol, "a kind_label column must exist");
+  assertEquals(typeCol.header, "Type");
+});
+
+test("Tasks grid completes each row via its engine-declared form (nano-ide#457), not a page-local detail.form", () => {
+  const { detail } = grids[0].props;
+  assert(detail?.engineForm, "the grid detail must opt into engineForm rendering");
+  assertEquals(detail.engineForm.formKeyField, "form_key");
+  assertEquals(detail.engineForm.userTaskKeyField, "user_task_key");
+  // The seven bespoke per-type detail.form blocks (each a copy of a deployed `.form`) are gone.
+  for (const g of grids) assert(!g.props.detail?.form, "no grid may carry a page-local detail.form");
+});

package/app/userTasks.test.ts

@@ -49,11 +49,30 @@ test("buildUserTaskRow: a plan-review task becomes a labelled row with its findi
     subject_url: "https://github.com/o/r/issues/1",
     question: "cap reached: revise scope",
     process_key: "pk-1",
+    form_key: null,
     created_at: AT,
     updated_at: AT,
   });
 });
 
+test("buildUserTaskRow: denormalises the engine form_key, trimming blanks to null (issue #461)", () => {
+  const withForm = buildUserTaskRow(
+    { userTaskKey: "ut-f", elementId: PLAN_REVIEW_ELEMENT, subjectType: "plan", subjectKey: "o/r#1", formKey: "  form-9  " },
+    AT,
+  );
+  assertEquals(withForm?.form_key, "form-9");
+  const blank = buildUserTaskRow(
+    { userTaskKey: "ut-b", elementId: PLAN_REVIEW_ELEMENT, subjectType: "plan", subjectKey: "o/r#1", formKey: "   " },
+    AT,
+  );
+  assertEquals(blank?.form_key, null);
+  const absent = buildUserTaskRow(
+    { userTaskKey: "ut-n", elementId: PLAN_REVIEW_ELEMENT, subjectType: "plan", subjectKey: "o/r#1" },
+    AT,
+  );
+  assertEquals(absent?.form_key, null);
+});
+
 test("buildUserTaskRow: a blank question / missing url normalises to null", () => {
   const row = buildUserTaskRow(
     { userTaskKey: "ut-2", elementId: TRIAL_MERGE_ELEMENT, subjectType: "plan", subjectKey: "o/r#2", question: "   " },

package/app/userTasks.ts

@@ -60,6 +60,11 @@ export interface UserTaskRow {
   subject_url: string | null;
   question: string | null;
   process_key: string | null;
+  /** The engine `formKey` of the parked user task's engine-declared form, denormalised so the single
+   *  collapsed Tasks grid can resolve and render the deployed `.form` per row (nano-ide#457). Derived in
+   *  the poller from the `/v2/user-tasks/search` result, falling back to the fixed-form kinds' static
+   *  `.form` linkage; NULL when neither resolves (the grid degrades to bare completion). */
+  form_key: string | null;
   created_at: string;
   updated_at: string;
 }
@@ -103,6 +108,10 @@ export interface UserTaskContext {
   subjectUrl?: string | null;
   question?: string | null;
   processKey?: string | null;
+  /** The engine-resolved `formKey` of the task's engine-declared form, as the poller read it from the
+   *  `/v2/user-tasks/search` result (or the fixed-form fallback). Optional/blank tolerated —
+   *  `buildUserTaskRow` normalises a blank to NULL. */
+  formKey?: string | null;
 }
 
 /** Pure: turn one resolved open escalation task into its desired read-model row, or `null` when the
@@ -123,6 +132,7 @@ export function buildUserTaskRow(ctx: UserTaskContext, at: string = now()): User
   const subjectKey = ctx.subjectKey.trim() || (ctx.processKey ?? "").trim() || userTaskKey;
   const question = typeof ctx.question === "string" && ctx.question.trim() ? ctx.question.trim() : null;
   const subjectTitle = typeof ctx.subjectTitle === "string" && ctx.subjectTitle.trim() ? ctx.subjectTitle.trim() : subjectKey;
+  const formKey = typeof ctx.formKey === "string" && ctx.formKey.trim() ? ctx.formKey.trim() : null;
   return {
     user_task_key: userTaskKey,
     element_id: ctx.elementId,
@@ -133,6 +143,7 @@ export function buildUserTaskRow(ctx: UserTaskContext, at: string = now()): User
     subject_url: ctx.subjectUrl ?? null,
     question,
     process_key: ctx.processKey ?? null,
+    form_key: formKey,
     created_at: at,
     updated_at: at,
   };
@@ -158,7 +169,8 @@ function sameRow(a: UserTaskRow, b: UserTaskRow): boolean {
     a.subject_title === b.subject_title &&
     a.subject_url === b.subject_url &&
     a.question === b.question &&
-    a.process_key === b.process_key
+    a.process_key === b.process_key &&
+    a.form_key === b.form_key
   );
 }
 

package/db/migrations/077_user_tasks_form_key.sql

@@ -0,0 +1,25 @@
+-- Denormalise the engine `form_key` onto the unified Tasks-inbox read-model (issue #461) — additive,
+-- nullable. The collapsed Tasks page renders ONE `user_tasks` grid and completes each heterogeneous row
+-- via its ENGINE-declared form (nano-ide#457's `detail.engineForm`), instead of seven
+-- `element_id`-allowlisted grids each with a hand-authored `detail.form` copy of a deployed `.form`.
+-- Rendering the deployed form per row needs the task's engine `formKey` on the row, so the grid can
+-- resolve `GET /app/actions/form?formKey=<row.form_key>` — the SAME single source of truth
+-- `taskInbox` uses (no page-local field duplication).
+--
+-- Derived in the canonical poller path exactly as `kind_label` is (no drift surface): `pollUserTasks`
+-- (app/service.ts) reads the engine-resolved `formKey` from the Camunda `/v2/user-tasks/search` result
+-- and `buildUserTaskRow` (app/userTasks.ts) writes it, falling back to the fixed-form kinds' static
+-- `.form` linkage (`ESCALATION_FORM_BY_ELEMENT`, app/agentCompletion.ts) when the search omits it.
+-- NULL when neither resolves — the grid degrades to bare completion, matching `taskInbox`.
+--
+-- Forward-only, additive (expand): a new nullable column on an existing table, no shape rewrite and no
+-- backfill (the poller repopulates every open row on its next pass). Numbered after the current highest
+-- prefix (076); the runner wraps each file in its own transaction, so this file must NOT contain
+-- BEGIN/COMMIT.
+ALTER TABLE user_tasks ADD COLUMN form_key TEXT;
+
+-- The collapsed Tasks page reads `user_tasks` UNFILTERED ordered by `updated_at desc` (pages/tasks.page.json),
+-- an access pattern the existing composite indexes (`(element_id, updated_at)`, `(subject, element_id)`) can't
+-- serve — SQLite would scan + sort the whole table as the inbox grows. Front the unified inbox's sort with a
+-- single-column index on `updated_at`. Additive and idempotent.
+CREATE INDEX IF NOT EXISTS idx_user_tasks_updated ON user_tasks(updated_at);

package/db/migrations/078_agentic_correlation.sql

@@ -0,0 +1,32 @@
+-- Durable per-job worker attribution + engine context (#485, provisioning #232).
+--
+-- The in-memory correlation registry (app/agentic/correlation.ts) is the live jobKey ⇄ worker join,
+-- but it is RELEASED on job end / worker disconnect and is empty after a restart. So a COMPLETED
+-- (past) session — what the cockpit "past sessions" / worker-history view reads — otherwise loses
+-- which worker ran it (instance / identity / host) and its process-instance / plan context. The
+-- package-mirrored transcript store (024_agentic_transcript.sql, byte-for-byte guarded) carries no
+-- correlation columns, so this app-side table closes the gap WITHOUT touching that mirrored schema.
+--
+-- The relay slice records a row here at job-completion time; the transcript read path falls back to
+-- it when the live registry has released the job. Advisory / read-only (ADR 0056) — it NEVER gates a
+-- BPMN sequence flow.
+--
+-- Single source of truth: this DDL mirrors AGENTIC_CORRELATION_SCHEMA_SQL in
+-- app/agentic/correlation-store.ts byte-for-byte; a drift-guard test (correlation-store.test.ts) pins
+-- the two together.
+CREATE TABLE IF NOT EXISTS agentic_correlation (
+  job_key TEXT PRIMARY KEY,
+  stream TEXT NOT NULL,
+  instance TEXT NOT NULL,
+  identity TEXT,
+  host TEXT,
+  process_instance_key TEXT,
+  bpmn_process_id TEXT,
+  element_id TEXT,
+  plan_key TEXT,
+  linked_at TEXT,
+  completed_at TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS ix_agentic_correlation_instance ON agentic_correlation (instance);
+CREATE INDEX IF NOT EXISTS ix_agentic_correlation_process_instance ON agentic_correlation (process_instance_key);
+CREATE INDEX IF NOT EXISTS ix_agentic_correlation_plan ON agentic_correlation (plan_key);

package/docs/adr/0006-delivery-units-one-representation.md

@@ -20,7 +20,7 @@ to collapse three bespoke status unions into one),
 nano-ide **#424** (datasource can read a SQL VIEW — the *data-level* unlock),
 nano-workforce **#416** (the PR bumping the testkit to engine-wasm 0.7.2, which executes `callActivity`
 — the *process-level* unlock),
-nano-workforce **#464** (the tracking issue with slices S1–S5),
+nano-workforce **#464** (the tracking issue with slices S1–S6),
 nano-workforce **#305** (consolidate escalations on native `user_tasks` — a natural sub-step of S1/S3).
 
 ## Context
@@ -89,7 +89,7 @@ because it did nothing. **Unlocked by #416** (engine-wasm 0.4.0 → **0.7.2**).
 **Verified live:** a `callActivity` parent+child model deployed through engine-wasm 0.7.2 runs to
 `COMPLETED`. Caveat: #416 bumps only the **dev-only** `@nanobpm/urban-testkit`; the production
 `@nanobpm/urban` broker does not itself pin `engine-wasm`, so this verification proves the in-process
-testkit, not the broker/runtime that will execute future `callActivity` models. S4/S5 therefore also
+testkit, not the broker/runtime that will execute future `callActivity` models. S4–S6 therefore also
 carry a **deployment-runtime prerequisite** — the deployed broker's `engine-core` must carry the same
 `callActivity` support — which green testkit CI does not by itself guarantee.
 
@@ -129,18 +129,52 @@ a copy — expressed here as the **target** state:
   content digest (`app/deliveryGraphRun.ts` `computeRunKey`) — so S2's compatibility VIEWs map each
   legacy key onto the new identity, ensuring unrelated runs are never merged onto one row.
 
-### 2. Process encoding — shared cells composed by `callActivity`
-
-- Extract the atomic *implement-cell* (and its sibling wait-gate and human-escalation cells) into
-  standalone processes (`resources/processes/implement-cell.bpmn`, …).
-- Compose them by reference — replacing only the inlined *implement/escalation segment*, not the
-  surrounding orchestration: in **feature** (`feature.bpmn`) the readiness preflight, base-branch setup,
-  `record-feature`, and convergence handoff are retained; only the implement-cell segment becomes one
-  `callActivity`. **Epic** = the multi-instance `implement` body is a `callActivity`; **delivery graph**
-  = the compiler *emits* `callActivity` references, not inlined subprocess copies.
+### 2. Process encoding — **fine-grained** cells composed by `callActivity`
+
+The primitive is a set of **small, single-purpose cells** — `implement-cell`, `converge-cell`,
+`merge-cell`, plus the sibling wait-gate and human-escalation cells — each a standalone process
+(`resources/processes/implement-cell.bpmn`, …), composed by reference and gated by edges. This is a
+deliberate choice of granularity **over** a single coarse whole-feature subprocess with opaque
+completion flags.
+
+- Compose by reference, replacing the inlined segments, not the surrounding orchestration: in
+  **feature** (`feature.bpmn`) the readiness preflight, base-branch setup, and `record-feature` remain;
+  the implement/escalation segment and the convergence/merge tail each become `callActivity`s. **Epic**
+  = the multi-instance `implement` body is a `callActivity`; **delivery graph** = the compiler *emits*
+  `callActivity` references, not inlined subprocess copies.
+- `feature` / `epic` are **derived macros** over the cells, not hand-written processes: a `feature`
+  expands to `implement → converge? → merge?`, so the cells stay the single source of truth and the
+  common case is still one node. (Same derivation discipline as the data encoding: compose by
+  reference, never inline a copy.)
+- **Why fine-grained, not coarse.** A coarse whole-feature `callActivity` with `converge?`/`merge?`
+  flags buries those steps *inside* the black box, so a graph can never insert a gate *between*
+  "converged" and "merged". Fine-grained cells let a graph converge features A **and** B, then hold and
+  land both behind a single `human`/`wait` fan-in — the integration-branch / gated-landing pattern.
+  `feature.bpmn` already separates `converge` (its `gw-converge` gateway) from `autoMerge`, so the seam
+  exists today; this promotes it to a **node boundary** the graph can wire (see §3).
 - This is gated on the engine-wasm 0.7.2 unlock, which is now live on `main`.
 
-### 3. Status lifecycle — one derived union
+### 3. Node completion policy — `converge` / `merge` are first-class cells, not smuggled state
+
+Today the "get to green, then land" tail lives in two places the delivery graph cannot reach: a gateway
+*inside* `feature.bpmn` (`gw-converge` + the `autoMerge` boolean on `ConvergeFeatureIn`), and — for a
+delivery-graph `agent` node — **free text in a prompt** (`{ jobType: "senior:feature", prompt: "un-draft
++ merge #B" }`), with the graph only *observing* the result via a downstream `wait` node that emits
+`mergedSha`. A graph therefore drives merge by asking an agent nicely, not structurally. Promote them to
+first-class, edge-gated cells:
+
+- **`converge`** = drive the PR through its review-convergence loop to green. **`merge`** = land it.
+  These are deliberately **separable phases** (`feature.bpmn` already splits `gw-converge` from
+  `autoMerge`), so a graph can stop at "green" and gate the landing behind any upstream node.
+- A `feature`/`epic` node's `converge?` / `merge?` selectors choose whether the derived macro (§2)
+  includes those cells; omitting `merge` and wiring an explicit `merge` cell downstream of a gate is the
+  advanced case.
+- **`merge` is two-level (ADR 0003 base-branch admission).** A unit's `merge` cell lands onto the
+  epic/graph **base branch**, never `main` directly; the graph's final merge-to-`main` is a *separate*
+  top-level step. `feature.bpmn`'s `autoMerge` is exactly this per-unit knob — do not collapse the two
+  levels.
+
+### 4. Status lifecycle — one derived union
 
 The three bespoke status unions collapse into **one derived union** via ADR 0065's `defineReadModel`,
 so a change to lifecycle semantics is made once and derived everywhere, not re-declared per
@@ -153,7 +187,7 @@ representation. These unions are **not** identical today — features use
 separate node contract — plus the per-shape mapping and precedence and the write/`instanceTracking`
 behavior — not merely projecting an existing value.
 
-### 4. Preserve — the static-vs-adaptive execution axis (do NOT bundle it)
+### 5. Preserve — the static-vs-adaptive execution axis (do NOT bundle it)
 
 This ADR consolidates the *representation*, not the *execution strategy*. ADR 0005's deliberate
 distinction stays intact: **plan-fanout remains adaptive** (agent-discovered slices, waves that adapt),
@@ -183,8 +217,8 @@ their topology is produced. Unifying that axis is explicitly out of scope here.
 
 ## Rollout (see #464 for the live checklist)
 
-Each slice is independently shippable; the process slices (S4/S5) are sequenced behind the engine-wasm
-0.7.2 unlock. The **dev-testkit** side of that unlock has landed (#416, verified in-process above); S4/S5
+Each slice is independently shippable; the process slices (S4–S6) are sequenced behind the engine-wasm
+0.7.2 unlock. The **dev-testkit** side of that unlock has landed (#416, verified in-process above); S4–S6
 additionally gate on the **deployed broker/runtime** carrying verified `callActivity` support (the
 deployment-runtime prerequisite noted above), not on #416 alone.
 
@@ -207,15 +241,20 @@ deployment-runtime prerequisite noted above), not on #416 alone.
   bindings and every other writer off the legacy tables does the table-to-VIEW contract phase retire the
   legacy write paths.
 - **S3 · collapse doors** — unify the three `instanceTracking` bindings + `senior:*` dispatch doors.
-- **S4 · shared cells** — extract the atomic `implement-cell.bpmn` **and its sibling wait-gate and
-  human-escalation cells** (Decision §2) into standalone processes; `feature.bpmn` + the `plan-fanout`
-  MI body compose them via `callActivity`.
-- **S5 · compiler emits calls** — `deliveryGraphCompiler` references shared cells instead of inlining
+- **S4 · fine-grained cells** — extract `implement-cell.bpmn`, `converge-cell.bpmn`, `merge-cell.bpmn`
+  **and the sibling wait-gate and human-escalation cells** (Decision §2) into standalone processes;
+  `feature.bpmn` + the `plan-fanout` MI body compose them via `callActivity`, with `feature`/`epic` as
+  derived macros over the cells.
+- **S5 · `converge?` / `merge?` as first-class node policy** — promote convergence + landing from the
+  `feature.bpmn` `gw-converge`/`autoMerge` gateway and the delivery-graph *prompt prose* into edge-gated
+  `converge`/`merge` cell nodes on the delivery vocabulary (Decision §3); honour ADR 0003 two-level
+  merge (unit → base branch; graph → `main`).
+- **S6 · compiler emits calls** — `deliveryGraphCompiler` references shared cells instead of inlining
   per-node copies.
 
 ## Non-goals / deferred
 
-- **Unifying the static-vs-adaptive execution axis** (see Decision §4) — preserved deliberately.
+- **Unifying the static-vs-adaptive execution axis** (see Decision §5) — preserved deliberately.
 - **Changing the downstream PR/convergence loop** — already single-sourced (`pull_requests`); untouched.
 - **Cross-repo/platform representation** — this ADR is nano-workforce-local; any platform-wide delivery
   aggregate would be a separate nano-bpm ADR.

package/e2e/delivery-graph.e2e.ts

@@ -24,6 +24,7 @@ import { connectorDedupeKey, deliveryConnectorDispatches, dispatchConnector } fr
 import { readConnectorInput } from "../workers/delivery-connector/worker.ts";
 import { runDeliveryGraph } from "../app/deliveryRunner.ts";
 import type { DeliveryGraph } from "../nano-generated/api-io.d.ts";
+import { deterministicProbeSeam } from "./support/probe-exec.ts";
 
 const APP_ROOT = resolve(import.meta.dirname, "..");
 const GITHUB_ENV: Record<string, string> = { NANO_PR_GITHUB_TRANSPORT: "token", GITHUB_TOKEN: "" };
@@ -57,9 +58,15 @@ describe("delivery-graph runner — engine-native execution (S4)", () => {
     apps.push(app);
     return app;
   };
+  // The `wait` nodes drive `command: true`/`false` probes through the shared readiness-probe worker.
+  // Inject the deterministic exec so they resolve within the virtual clock's drain fixpoint instead
+  // of racing a real subprocess `settle()` cannot await (issue #450).
+  const probeSeam = deterministicProbeSeam("delivery-graph e2e");
+  before(() => probeSeam.install());
   after(async () => {
     for (const app of apps) await app.stop?.();
     for (const d of dirs) rmSync(d, { recursive: true, force: true });
+    probeSeam.restoreAndAssertHermetic();
   });
 
   test("runs end-to-end: agent, wait, human execute; edges gate; fan-in works; human fact late-binds into the connector", async () => {

package/e2e/feature-preflight.e2e.ts

@@ -24,6 +24,7 @@ import { after, before, describe, test } from "node:test";
 import { fileURLToPath } from "node:url";
 import { bootTestApp, type TestApp } from "@nanobpm/urban-testkit";
 import { admitGithubState, installAdmitGithub } from "./support/github-admit.ts";
+import { deterministicProbeSeam } from "./support/probe-exec.ts";
 
 const APP_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 
@@ -92,12 +93,17 @@ async function boot(): Promise<{ app: TestApp; dbDir: string }> {
 
 describe("single-issue feature intake readiness gate (feature.bpmn, issue #295)", () => {
   let restoreGithub: (() => void) | undefined;
+  const probeSeam = deterministicProbeSeam("feature-preflight e2e");
 
   before(() => {
     for (const [k, v] of Object.entries(GITHUB_ENV_OVERRIDES)) {
       savedEnv.set(k, process.env[k]);
       process.env[k] = v;
     }
+    // Inject the deterministic probe exec so the `command: true` probe resolves WITHIN the virtual
+    // clock's drain fixpoint instead of spawning a real subprocess whose wall-clock completion
+    // `settle()` cannot await — the flake behind this suite (issue #450).
+    probeSeam.install();
     // `pr.ensure-base-branch` reads the base ref via the token transport, which would throw
     // `no GitHub transport available` under an empty token. Pin the shared hermetic admit-github
     // stub (dummy token + fetch intercept) like the sibling preflight e2e so base-branch admission
@@ -106,6 +112,7 @@ describe("single-issue feature intake readiness gate (feature.bpmn, issue #295)"
   });
   after(() => {
     restoreGithub?.();
+    probeSeam.restoreAndAssertHermetic();
     for (const [k, v] of savedEnv) {
       if (v === undefined) delete process.env[k];
       else process.env[k] = v;

package/e2e/inter-epic-dependency.e2e.ts

@@ -23,6 +23,7 @@ import { after, before, describe, test } from "node:test";
 import { fileURLToPath } from "node:url";
 import { bootTestApp, type TestApp } from "@nanobpm/urban-testkit";
 import { admitGithubState, installAdmitGithub } from "./support/github-admit.ts";
+import { deterministicProbeSeam } from "./support/probe-exec.ts";
 
 const APP_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 
@@ -89,8 +90,14 @@ async function boot(): Promise<{ app: TestApp; dbDir: string }> {
 
 describe("inter-epic capability gate — adversarial (plan-fanout.bpmn, issue #292 S5)", () => {
   let restoreGithub: (() => void) | undefined;
+  // The adversarial gates poll `command: false` (never-green) probes through the readiness-probe
+  // worker; inject the deterministic exec so each poll resolves inside the virtual clock's drain
+  // fixpoint (the escalation/timeout path is driven by engine-clock advancement, not a real
+  // subprocess) — issue #450.
+  const probeSeam = deterministicProbeSeam("inter-epic adversarial e2e");
 
   before(() => {
+    probeSeam.install();
     for (const [k, v] of Object.entries(GITHUB_ENV_OVERRIDES)) {
       savedEnv.set(k, process.env[k]);
       process.env[k] = v;
@@ -105,6 +112,7 @@ describe("inter-epic capability gate — adversarial (plan-fanout.bpmn, issue #2
       if (v === undefined) delete process.env[k];
       else process.env[k] = v;
     }
+    probeSeam.restoreAndAssertHermetic();
   });
 
   // ── S5 P1 — the gate HOLDS wave 0 ───────────────────────────────────────────────────────────────

package/e2e/plan-fanout-preflight.e2e.ts

@@ -22,6 +22,7 @@ import { after, before, describe, test } from "node:test";
 import { fileURLToPath } from "node:url";
 import { bootTestApp, type TestApp } from "@nanobpm/urban-testkit";
 import { admitGithubState, installAdmitGithub } from "./support/github-admit.ts";
+import { deterministicProbeSeam } from "./support/probe-exec.ts";
 
 const APP_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 
@@ -80,12 +81,17 @@ async function boot(): Promise<{ app: TestApp; dbDir: string }> {
 
 describe("plan-fanout inter-epic capability preflight (plan-fanout.bpmn, issue #292 S3)", () => {
   let restoreGithub: (() => void) | undefined;
+  const probeSeam = deterministicProbeSeam("plan-fanout-preflight e2e");
 
   before(() => {
     for (const [k, v] of Object.entries(GITHUB_ENV_OVERRIDES)) {
       savedEnv.set(k, process.env[k]);
       process.env[k] = v;
     }
+    // Inject the deterministic probe exec so the `command: true` probe resolves WITHIN the virtual
+    // clock's drain fixpoint instead of spawning a real subprocess whose wall-clock completion
+    // `settle()` cannot await — the flake behind this suite (issue #450).
+    probeSeam.install();
     // The fan-out head (`pr.ensure-base-branch`, ADR 0003) reads/creates the base ref via the token
     // transport, which would throw `no GitHub transport available` under an empty token. Pin the
     // shared hermetic admit-github stub (dummy token + fetch intercept) like the sibling plan-fanout
@@ -94,6 +100,7 @@ describe("plan-fanout inter-epic capability preflight (plan-fanout.bpmn, issue #
   });
   after(() => {
     restoreGithub?.();
+    probeSeam.restoreAndAssertHermetic();
     for (const [k, v] of savedEnv) {
       if (v === undefined) delete process.env[k];
       else process.env[k] = v;

package/e2e/plan-fanout-sla.e2e.ts

@@ -25,6 +25,7 @@ import { fileURLToPath } from "node:url";
 import type { EngineJob } from "@nanobpm/urban/runtime";
 import { bootTestApp, type TestApp } from "@nanobpm/urban-testkit";
 import { admitGithubState, installAdmitGithub } from "./support/github-admit.ts";
+import { advancePastTimer } from "./support/time.ts";
 
 const APP_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 
@@ -154,7 +155,7 @@ describe("plan-fanout escalation SLA + assignment (U5)", () => {
 
         // Never answer — let the SLA elapse. The interrupting boundary cancels the parked task and
         // routes to the task-done end (the safe auto-abandon default).
-        await app.advanceTime(PAST_SLA_MS);
+        await advancePastTimer(app, PAST_SLA_MS);
 
         const flows = takenFlows(app);
         assert.ok(
@@ -180,7 +181,7 @@ describe("plan-fanout escalation SLA + assignment (U5)", () => {
         await openTask(app, processKey, "plan-review-decision");
         await assertAssignmentFilterable(app, processKey, "plan-review-decision");
 
-        await app.advanceTime(PAST_SLA_MS);
+        await advancePastTimer(app, PAST_SLA_MS);
 
         const flows = takenFlows(app);
         assert.ok(
@@ -221,7 +222,7 @@ describe("plan-fanout escalation SLA + assignment (U5)", () => {
         await openTask(app, processKey, "trial-merge-decision");
         await assertAssignmentFilterable(app, processKey, "trial-merge-decision");
 
-        await app.advanceTime(PAST_SLA_MS);
+        await advancePastTimer(app, PAST_SLA_MS);
 
         const flows = takenFlows(app);
         assert.ok(

package/e2e/plan-fanout.e2e.ts

@@ -22,6 +22,7 @@ import { fileURLToPath } from "node:url";
 import type { EngineJob } from "@nanobpm/urban/runtime";
 import { bootTestApp, type TestApp } from "@nanobpm/urban-testkit";
 import { admitGithubState, installAdmitGithub } from "./support/github-admit.ts";
+import { advancePastTimer } from "./support/time.ts";
 
 const APP_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 
@@ -413,8 +414,7 @@ describe("plan-fanout escalations (U2 — task + plan-review + trial-merge → u
 
         // Never publish caps-resolved — let the bound (default P1D) elapse. Advancing past it is the
         // ONLY way the token can move, so this proves the wait is genuinely bounded.
-        await app.advanceTime(25 * 60 * 60 * 1000);
-        await app.settle();
+        await advancePastTimer(app, 25 * 60 * 60 * 1000);
 
         const flows = takenFlows(app);
         assert.ok(