@nanobpm/nano-workforce 0.130.0 → 0.131.1

package/CHANGELOG.md

@@ -1,3 +1,19 @@
+## [0.131.1](https://github.com/nanobpm/nano-workforce/compare/v0.131.0...v0.131.1) (2026-08-24)
+
+### Bug Fixes
+
+* **delivery-graph:** seed human-task prompt/context so its form is not contextless ([#502](https://github.com/nanobpm/nano-workforce/issues/502)) ([d2991ea](https://github.com/nanobpm/nano-workforce/commit/d2991ea0ec54e36711c27f58b8901ca85b7179e6)), closes [#499](https://github.com/nanobpm/nano-workforce/issues/499) [#499](https://github.com/nanobpm/nano-workforce/issues/499)
+
+## [0.131.0](https://github.com/nanobpm/nano-workforce/compare/v0.130.0...v0.131.0) (2026-08-23)
+
+### Features
+
+* **delivery-graph:** conditional (guarded) edges → exclusive gateways (ADR 0005 S7) ([#495](https://github.com/nanobpm/nano-workforce/issues/495)) ([48e4fc3](https://github.com/nanobpm/nano-workforce/commit/48e4fc3787067c175dbebdfdd81954dc79e0b167)), closes [nanobpm/nano-workforce#492](https://github.com/nanobpm/nano-workforce/issues/492)
+
+### Bug Fixes
+
+* **cockpit:** suppress idle-worker drill + waiting-for-output note (blank terminal) ([#497](https://github.com/nanobpm/nano-workforce/issues/497)) ([a721c45](https://github.com/nanobpm/nano-workforce/commit/a721c450faf0f3b43ee2d03b2eed312122c3b624)), closes [#496](https://github.com/nanobpm/nano-workforce/issues/496)
+
 ## [0.130.0](https://github.com/nanobpm/nano-workforce/compare/v0.129.1...v0.130.0) (2026-08-23)
 
 ### Features

package/app/agentic/cockpit/supply-boot.test.ts

@@ -128,14 +128,30 @@ test("drilling into a worker subscribes its relay stream on connect", async () =
 
 test("clicking a rendered worker drill button drills its stream", async () => {
   const r = rig();
+  // Only a worker that currently holds a job renders an inline drill button (an idle worker's stream
+  // has no producer — drilling it would blank). Give wk-a a job so its drill affordance is present.
+  // A busy worker relays on the jobKey-scoped `job:<jobKey>` stream (the supply endpoint repoints its
+  // `stream` there — see supply-view.ts), so the fixture uses that scoped id, not the bare instance id.
+  const drillable = { instance: "wk-a", identity: "leaf-1", stream: "job:j-a", family: "senior", host: "h1", jobKeys: ["j-a"], live: true, staleMs: 0 };
+  r.report = { count: 1, workers: [drillable], leaves: [{ token: "leaf-1", workers: [drillable] }] };
   const cockpit = bootSupplyCockpit(r.env);
   await cockpit.refresh();
-  const button = r.host.byClass("cockpit-worker-drill").find((b) => b.getAttribute("data-stream") === "wk-a");
+  const button = r.host.byClass("cockpit-worker-drill").find((b) => b.getAttribute("data-stream") === "job:j-a");
   button?.dispatch("click");
-  assert.equal(cockpit.currentStream, "wk-a");
+  assert.equal(cockpit.currentStream, "job:j-a");
   assert.equal(r.sockets.length, 1);
 });
 
+test("an idle worker (no current job) renders NO inline drill button — its stream has no producer", async () => {
+  const r = rig(); // the default served fixture worker wk-a has jobKeys: [] → idle
+  const cockpit = bootSupplyCockpit(r.env);
+  await cockpit.refresh();
+  const drills = r.host.byClass("cockpit-worker-drill");
+  assert.equal(drills.length, 0, "no drill button is rendered for an idle worker");
+  // The worker is still openable (its name button) and simply has nothing live to stream.
+  assert.equal(r.host.byData("worker", "wk-a").length, 1);
+});
+
 test("relay output is written to the drilled worker's terminal", async () => {
   const r = rig();
   const cockpit = bootSupplyCockpit(r.env);
@@ -146,6 +162,37 @@ test("relay output is written to the drilled worker's terminal", async () => {
   assert.deepEqual(r.terminalWrites, ["boot\n"]);
 });
 
+test("a live drill shows a 'waiting for output' note until the first frame, then clears it", async () => {
+  const r = rig();
+  const cockpit = bootSupplyCockpit(r.env);
+  await cockpit.refresh();
+  const note = () => r.host.byClass("cockpit-terminal-note")[0];
+
+  cockpit.drill("wk-a");
+  r.sockets[0]?.fireOpen();
+  assert.equal(note()?.getAttribute("data-terminal-note"), "waiting", "note armed on a connected-but-quiet stream");
+  assert.match(note()?.textContent ?? "", /waiting for live output/i);
+
+  r.sockets[0]?.deliver({ lane: "bulk", family: "relay", seq: 0, payload: { stream: "wk-a", offset: 0, chunk: "hi\n" } });
+  assert.equal(note()?.getAttribute("data-terminal-note"), "none", "note cleared the instant the first frame is written");
+  assert.equal(note()?.textContent, "");
+});
+
+test("switching to a new stream re-arms the 'waiting' note (the prior stream's cleared note does not persist)", async () => {
+  const r = rig();
+  const cockpit = bootSupplyCockpit(r.env);
+  await cockpit.refresh();
+  const note = () => r.host.byClass("cockpit-terminal-note")[0];
+
+  cockpit.drill("wk-a");
+  r.sockets[0]?.fireOpen();
+  r.sockets[0]?.deliver({ lane: "bulk", family: "relay", seq: 0, payload: { stream: "wk-a", offset: 0, chunk: "x" } });
+  assert.equal(note()?.getAttribute("data-terminal-note"), "none");
+
+  cockpit.drill("wk-b");
+  assert.equal(note()?.getAttribute("data-terminal-note"), "waiting", "the new drill re-arms the waiting note");
+});
+
 test("the terminal survives a list refresh — it is not re-mounted and keeps streaming", async () => {
   const r = rig();
   const cockpit = bootSupplyCockpit(r.env);

package/app/agentic/cockpit/supply-boot.ts

@@ -134,6 +134,7 @@ class SupplyCockpit implements SupplyCockpitHandle {
   readonly #pastRegion: ElementLike | undefined;
   readonly #terminalHost: ElementLike;
   readonly #terminalTitle: ElementLike;
+  readonly #terminalNote: ElementLike;
   readonly #terminalPanel: ElementLike;
   readonly #refreshMs: number;
   readonly #pastFetchTimeoutMs: number;
@@ -246,6 +247,14 @@ class SupplyCockpit implements SupplyCockpitHandle {
     this.#terminalHost.className = "cockpit-terminal-host";
     this.#terminalHost.setAttribute("data-terminal", "host");
     this.#terminalPanel.appendChild(this.#terminalHost);
+    // A status note under the terminal, shown while a LIVE drill has connected but no output has
+    // arrived yet (a quiet job between frames): without it the panel is an indistinguishable blank
+    // black rectangle, so the operator can't tell "connected, waiting" from "broken". Cleared the
+    // instant the first frame is written, and on every mode change.
+    this.#terminalNote = env.doc.createElement("p");
+    this.#terminalNote.className = "cockpit-terminal-note";
+    this.#terminalNote.setAttribute("data-terminal-note", "none");
+    this.#terminalPanel.appendChild(this.#terminalNote);
     shell.appendChild(this.#listRegion);
     if (this.#pastRegion !== undefined) shell.appendChild(this.#pastRegion);
     shell.appendChild(this.#terminalPanel);
@@ -272,6 +281,20 @@ class SupplyCockpit implements SupplyCockpitHandle {
     if (mode === "live") this.#terminalTitle.textContent = "Worker terminal — live";
     else if (mode === "replay") this.#terminalTitle.textContent = "Worker terminal — replay (past session)";
     else this.#terminalTitle.textContent = "Worker terminal";
+    // Any mode change replaces what's behind the panel, so the prior "waiting for output" note is
+    // stale — clear it. A live drill re-arms it (below) once its fresh terminal is mounted.
+    this.#setNote(undefined);
+  }
+
+  /** Show (or clear) the terminal status note — the "connected, waiting for output" affordance. */
+  #setNote(text: string | undefined): void {
+    if (text === undefined) {
+      this.#terminalNote.textContent = "";
+      this.#terminalNote.setAttribute("data-terminal-note", "none");
+      return;
+    }
+    this.#terminalNote.textContent = text;
+    this.#terminalNote.setAttribute("data-terminal-note", "waiting");
   }
 
   async refresh(): Promise<void> {
@@ -455,8 +478,24 @@ class SupplyCockpit implements SupplyCockpitHandle {
     try {
       // Fresh terminal for the newly selected worker.
       this.#terminalHost.replaceChildren();
-      const sink = this.#env.createTerminal(this.#terminalHost);
-      this.#terminal = sink;
+      const rawSink = this.#env.createTerminal(this.#terminalHost);
+      this.#terminal = rawSink;
+
+      // Wrap the sink so the FIRST byte of live output clears the "waiting for output" note. A drill
+      // that connects to a quiet stream (a job between frames) otherwise shows a blank panel with no
+      // signal it is working; the note stays until output flows, then vanishes on the first write.
+      // Only `write` is proxied — TerminalSession never disposes the sink (teardown goes through
+      // #terminal, which holds the raw sink), so the wrapper needs nothing else.
+      let cleared = false;
+      const sink: TerminalSink = {
+        write: (chunk) => {
+          if (!cleared) {
+            cleared = true;
+            this.#setNote(undefined);
+          }
+          rawSink.write(chunk);
+        },
+      };
 
       let session: TerminalSession | undefined;
       const client = new RelayChannelClient({
@@ -477,6 +516,9 @@ class SupplyCockpit implements SupplyCockpitHandle {
       client.open();
       this.#drill = { stream, client };
       this.#setMode("live", stream);
+      // Arm the "waiting for output" note (after #setMode, which clears it): shown until the first
+      // frame is written, so a connected-but-quiet stream reads as "waiting", not "broken".
+      this.#setNote("Connected — waiting for live output…");
     } catch (err) {
       // Building the new terminal failed AFTER the prior drill + terminal were already torn down
       // above. Leaving #mode/#shownStream at their prior value would keep the panel showing a stale

package/app/agentic/cockpit/supply-render.test.ts

@@ -64,6 +64,27 @@ test("worker name buttons open the worker detail route and the inline terminal d
   assert.deepEqual(drilled, ["wk-a"]);
 });
 
+test("suppresses the inline drill button for an IDLE worker (no current job → producerless stream)", () => {
+  const host = new FakeElement("body");
+  renderSupply(host, doc, supplyView(sample), { onDrill: () => {}, onOpenWorker: () => {} });
+
+  // wk-a holds job-1 → drillable; wk-b is idle (jobKeys: []) → no drill affordance.
+  const drills = host.byClass("cockpit-worker-drill");
+  assert.equal(drills.length, 1, "exactly one drill button — only for the worker with a live job");
+  assert.equal(drills[0]?.getAttribute("data-instance"), "wk-a");
+  // The idle worker is still openable via its name button; it just cannot be drilled.
+  const idleDrill = host.byData("worker", "wk-b")[0]?.byClass("cockpit-worker-drill") ?? [];
+  assert.equal(idleDrill.length, 0, "the idle worker row has no drill button");
+  assert.ok(
+    host.byClass("cockpit-worker").find((b) => b.getAttribute("data-instance") === "wk-b"),
+    "the idle worker still has its name button (detail page remains reachable)",
+  );
+  // The idle worker's name button carries `data-stream` unconditionally — same as the drillable
+  // worker and the browser mirror — even though its drill affordance is suppressed.
+  const idleName = host.byClass("cockpit-worker").find((b) => b.getAttribute("data-instance") === "wk-b");
+  assert.equal(idleName?.getAttribute("data-stream"), "wk-b", "idle worker's name button still carries data-stream");
+});
+
 test("does NOT render any demand matrix, missing-agent reds, or diversity light", () => {
   const host = new FakeElement("body");
   renderSupply(host, doc, supplyView(sample));

package/app/agentic/cockpit/supply-render.ts

@@ -57,21 +57,31 @@ function workerRow(doc: DocumentLike, worker: SupplyWorkerView, options: RenderS
   const button = el(doc, "button", "cockpit-worker", worker.instance);
   button.setAttribute("type", "button");
   button.setAttribute("data-instance", worker.instance);
+  // The name button always carries `data-stream` — even for an idle (non-drillable) worker — matching
+  // the row's own `data-stream` and the browser mirror (`pages/cockpit/mount.js`). Only the inline
+  // drill affordance is gated by `drillable`; the stream identity of the worker is not.
+  button.setAttribute("data-stream", worker.stream);
   const onOpenWorker = options.onOpenWorker;
+  const onDrill = options.onDrill;
   if (onOpenWorker !== undefined) {
     button.addEventListener("click", () => onOpenWorker(worker.instance));
   }
   nameCell.appendChild(button);
-  const drill = el(doc, "button", "cockpit-worker-drill", "terminal");
-  drill.setAttribute("type", "button");
-  drill.setAttribute("data-instance", worker.instance);
-  drill.setAttribute("data-stream", worker.stream);
-  button.setAttribute("data-stream", worker.stream);
-  const onDrill = options.onDrill;
-  if (onDrill !== undefined) {
-    drill.addEventListener("click", () => onDrill(worker.stream));
+  // The inline live-terminal drill — ONLY for a worker that currently holds a job. An idle worker's
+  // `stream` is its bare instance id, which no producer writes to, so drilling it would open a
+  // permanently blank "live" terminal (the H6 blank-terminal defect). Suppress the affordance
+  // entirely when there is nothing live to stream; the operator can still open the worker's detail
+  // page (and its captured past sessions) via the name button.
+  if (worker.drillable) {
+    const drill = el(doc, "button", "cockpit-worker-drill", "terminal");
+    drill.setAttribute("type", "button");
+    drill.setAttribute("data-instance", worker.instance);
+    drill.setAttribute("data-stream", worker.stream);
+    if (onDrill !== undefined) {
+      drill.addEventListener("click", () => onDrill(worker.stream));
+    }
+    nameCell.appendChild(drill);
   }
-  nameCell.appendChild(drill);
   row.appendChild(nameCell);
 
   row.appendChild(el(doc, "td", "cockpit-td cockpit-supply-family", worker.family));

package/app/agentic/cockpit/supply-view.test.ts

@@ -46,6 +46,21 @@ test("defaults absent family/host to a stable dash and counts + sorts jobKeys",
   assert.equal(w?.jobs, 2);
 });
 
+test("marks a worker drillable iff it currently holds a job (an idle worker has no live stream)", () => {
+  const view = supplyView(
+    report({
+      workers: [
+        { instance: "busy", identity: "t", stream: "job:9", jobKeys: ["9"], live: true, staleMs: 0 },
+        { instance: "idle", identity: "t", stream: "idle", jobKeys: [], live: true, staleMs: 0 },
+      ],
+    }),
+  );
+  const busy = view.workers.find((w) => w.instance === "busy");
+  const idle = view.workers.find((w) => w.instance === "idle");
+  assert.equal(busy?.drillable, true, "a worker with a current job has a live terminal to drill");
+  assert.equal(idle?.drillable, false, "an idle worker's instance stream has no producer — not drillable");
+});
+
 test("sorts leaves by token and workers by instance, with per-leaf live counts", () => {
   const view = supplyView(
     report({

package/app/agentic/cockpit/supply-view.ts

@@ -111,6 +111,14 @@ export interface SupplyWorkerView {
   readonly jobKeys: readonly string[];
   /** The number of current jobs. */
   readonly jobs: number;
+  /**
+   * Whether this worker has a LIVE terminal to drill into. True only while it holds a current job:
+   * a worker relays its terminal on the jobKey-scoped `job:<jobKey>` stream, and the supply endpoint
+   * repoints {@link stream} at it. An IDLE worker (no jobs) has its `stream` default back to the bare
+   * instance id — a stream NO producer ever writes to — so drilling it opens a permanently blank
+   * "live" terminal. The renderer suppresses the drill affordance when this is false.
+   */
+  readonly drillable: boolean;
   /**
    * The engine context for each of this worker's current jobs (H6), sorted by jobKey — so the operator
    * sees which process instance / plan the terminal belongs to. Empty when nothing correlates.
@@ -200,6 +208,7 @@ function workerView(
     host: worker.host ?? "—",
     jobKeys,
     jobs: jobKeys.length,
+    drillable: jobKeys.length > 0,
     correlations,
     liveness: liveness(worker, staleAfterMs),
     staleMs: worker.staleMs,

package/app/deliveryGraph.test.ts

@@ -355,3 +355,282 @@ test("invalid-fact-type: an emitted fact missing its `type` is rejected", () =>
   const err = hasCode(errors, "invalid-fact-type");
   assertEquals(err.path, "nodes[0].emits[0].type");
 });
+
+// ── S7: guarded (conditional) edges — the exclusive-gateway extension (ADR 0005 S7) ────────────────
+// A guarded split node emits a scalar outcome fact and routes on it: exactly one out-edge's `when`
+// value matches at runtime (or the `default` else-branch fires). These cases exercise the new
+// validation surface — guard shape, scalar-fact resolution, exhaustiveness, no-mixing, and the
+// exclusive-merge parity the compiler relies on.
+
+/** Mode A (adopt), the ADR's motivating guarded split: `bump` emits a scalar `result`; a guard routes
+ *  the breaking outcome through `migrate`, the default (green) straight to `release`, and the branches
+ *  re-converge at `release` (an exclusive merge). Exhaustive via its `default`. */
+const GUARDED_ADOPT = {
+  name: "adopt",
+  nodes: [
+    { id: "bump", kind: "agent", agent: { jobType: "senior:feature" }, emits: [{ name: "result", type: "string" }] },
+    { id: "migrate", kind: "agent", agent: { jobType: "senior:feature" } },
+    { id: "release", kind: "connector", connector: { target: "npm:publish" } },
+  ],
+  edges: [
+    { from: "bump", to: "migrate", when: "bump.result", equals: "breaking" },
+    { from: "bump", to: "release", default: true },
+    { from: "migrate", to: "release" },
+  ],
+};
+
+test("S7 happy: a well-formed guarded split (with a default) validates with no errors", () => {
+  assertEquals(validateDeliveryGraph(GUARDED_ADOPT), []);
+});
+
+test("S7 happy: a boolean fact guarded on BOTH values is exhaustive without a default", () => {
+  const errors = validateDeliveryGraph({
+    nodes: [
+      { id: "gate", kind: "agent", agent: { jobType: "j" }, emits: [{ name: "ok", type: "boolean" }] },
+      { id: "yes", kind: "agent", agent: { jobType: "j" } },
+      { id: "no", kind: "agent", agent: { jobType: "j" } },
+    ],
+    edges: [
+      { from: "gate", to: "yes", when: "gate.ok", equals: true },
+      { from: "gate", to: "no", when: "gate.ok", equals: false },
+    ],
+  });
+  assertEquals(errors, []);
+});
+
+test("S7 non-exhaustive-split: a string guard without a default is rejected", () => {
+  const errors = validateDeliveryGraph({
+    nodes: [
+      { id: "bump", kind: "agent", agent: { jobType: "j" }, emits: [{ name: "result", type: "string" }] },
+      { id: "migrate", kind: "agent", agent: { jobType: "j" } },
+    ],
+    edges: [{ from: "bump", to: "migrate", when: "bump.result", equals: "breaking" }],
+  });
+  hasCode(errors, "non-exhaustive-split");
+});
+
+test("S7 mixed-fan-out: a node whose out-edges MIX a guard with a plain edge is rejected", () => {
+  const errors = validateDeliveryGraph({
+    nodes: [
+      { id: "bump", kind: "agent", agent: { jobType: "j" }, emits: [{ name: "result", type: "string" }] },
+      { id: "a", kind: "agent", agent: { jobType: "j" } },
+      { id: "b", kind: "agent", agent: { jobType: "j" } },
+    ],
+    edges: [
+      { from: "bump", to: "a", when: "bump.result", equals: "x" },
+      { from: "bump", to: "b" },
+    ],
+  });
+  hasCode(errors, "mixed-fan-out");
+});
+
+test("S7 bad-when: a guard on an UNDECLARED fact is rejected", () => {
+  const errors = validateDeliveryGraph({
+    nodes: [
+      { id: "bump", kind: "agent", agent: { jobType: "j" }, emits: [{ name: "result", type: "string" }] },
+      { id: "a", kind: "agent", agent: { jobType: "j" } },
+      { id: "b", kind: "agent", agent: { jobType: "j" } },
+    ],
+    edges: [
+      { from: "bump", to: "a", when: "bump.nope", equals: "x" },
+      { from: "bump", to: "b", default: true },
+    ],
+  });
+  const err = hasCode(errors, "bad-when");
+  assertEquals(err.path, "edges[0].when");
+});
+
+test("S7 bad-when: a guard on a NON-SCALAR (artifact) fact is rejected", () => {
+  const errors = validateDeliveryGraph({
+    nodes: [
+      { id: "bump", kind: "human", human: {}, emits: [{ name: "art", type: "artifact" }] },
+      { id: "a", kind: "agent", agent: { jobType: "j" } },
+      { id: "b", kind: "agent", agent: { jobType: "j" } },
+    ],
+    edges: [
+      { from: "bump", to: "a", when: "bump.art", equals: "x" },
+      { from: "bump", to: "b", default: true },
+    ],
+  });
+  hasCode(errors, "bad-when");
+});
+
+test("S7 bad-when: a guard referencing a fact of a DIFFERENT node than the edge producer is rejected", () => {
+  const errors = validateDeliveryGraph({
+    nodes: [
+      { id: "bump", kind: "agent", agent: { jobType: "j" }, emits: [{ name: "result", type: "string" }] },
+      { id: "other", kind: "agent", agent: { jobType: "j" }, emits: [{ name: "result", type: "string" }] },
+      { id: "a", kind: "agent", agent: { jobType: "j" } },
+      { id: "b", kind: "agent", agent: { jobType: "j" } },
+    ],
+    edges: [
+      { from: "bump", to: "a", when: "other.result", equals: "x" },
+      { from: "bump", to: "b", default: true },
+    ],
+  });
+  hasCode(errors, "bad-when");
+});
+
+test("S7 guard-missing-equals: `when` without `equals` is rejected", () => {
+  const errors = validateDeliveryGraph({
+    nodes: [
+      { id: "bump", kind: "agent", agent: { jobType: "j" }, emits: [{ name: "result", type: "string" }] },
+      { id: "a", kind: "agent", agent: { jobType: "j" } },
+      { id: "b", kind: "agent", agent: { jobType: "j" } },
+    ],
+    edges: [
+      { from: "bump", to: "a", when: "bump.result" },
+      { from: "bump", to: "b", default: true },
+    ],
+  });
+  hasCode(errors, "guard-missing-equals");
+});
+
+test("S7 guard-type-mismatch: an `equals` whose type differs from the fact's declared type is rejected", () => {
+  const errors = validateDeliveryGraph({
+    nodes: [
+      { id: "bump", kind: "agent", agent: { jobType: "j" }, emits: [{ name: "n", type: "number" }] },
+      { id: "a", kind: "agent", agent: { jobType: "j" } },
+      { id: "b", kind: "agent", agent: { jobType: "j" } },
+    ],
+    edges: [
+      { from: "bump", to: "a", when: "bump.n", equals: "not-a-number" },
+      { from: "bump", to: "b", default: true },
+    ],
+  });
+  hasCode(errors, "guard-type-mismatch");
+});
+
+test("S7 guard-default-conflict: an edge with both `default` and `when` is rejected", () => {
+  const errors = validateDeliveryGraph({
+    nodes: [
+      { id: "bump", kind: "agent", agent: { jobType: "j" }, emits: [{ name: "result", type: "string" }] },
+      { id: "a", kind: "agent", agent: { jobType: "j" } },
+    ],
+    edges: [{ from: "bump", to: "a", when: "bump.result", equals: "x", default: true }],
+  });
+  hasCode(errors, "guard-default-conflict");
+});
+
+test("S7 multiple-defaults: more than one `default` out-edge on a split is rejected", () => {
+  const errors = validateDeliveryGraph({
+    nodes: [
+      { id: "bump", kind: "agent", agent: { jobType: "j" }, emits: [{ name: "result", type: "string" }] },
+      { id: "a", kind: "agent", agent: { jobType: "j" } },
+      { id: "b", kind: "agent", agent: { jobType: "j" } },
+      { id: "c", kind: "agent", agent: { jobType: "j" } },
+    ],
+    edges: [
+      { from: "bump", to: "a", when: "bump.result", equals: "x" },
+      { from: "bump", to: "b", default: true },
+      { from: "bump", to: "c", default: true },
+    ],
+  });
+  hasCode(errors, "multiple-defaults");
+});
+
+test("S7 exclusive-merge-parity: a parallel AND-join fed by an exclusive-split branch is rejected (the deadlock shape)", () => {
+  // `indep` always fires; `x` fires only on the "a" branch of `split`. A plain fan-in of {indep, x}
+  // into `sink` would be a parallel AND-join that waits forever for `x` when the else-branch is taken.
+  const errors = validateDeliveryGraph({
+    nodes: [
+      { id: "split", kind: "agent", agent: { jobType: "j" }, emits: [{ name: "result", type: "string" }] },
+      { id: "x", kind: "agent", agent: { jobType: "j" } },
+      { id: "y", kind: "agent", agent: { jobType: "j" } },
+      { id: "indep", kind: "agent", agent: { jobType: "j" } },
+      { id: "sink", kind: "agent", agent: { jobType: "j" } },
+    ],
+    edges: [
+      { from: "split", to: "x", when: "split.result", equals: "a" },
+      { from: "split", to: "y", default: true },
+      { from: "x", to: "sink" },
+      { from: "indep", to: "sink" },
+    ],
+  });
+  hasCode(errors, "exclusive-merge-parity");
+});
+
+test("S7 default:false is not a default — a `default: false` sibling of a guard is a plain edge and MIXES the fan-out", () => {
+  // `default` is a flag: only `true` marks the else-branch. `default: false` must NOT be treated as
+  // present (else it silently escapes both the guarded and the plain classification and bypasses the
+  // no-mixing rule). Here it must fall through to `plain` and trip mixed-fan-out.
+  const errors = validateDeliveryGraph({
+    nodes: [
+      { id: "bump", kind: "agent", agent: { jobType: "j" }, emits: [{ name: "result", type: "string" }] },
+      { id: "a", kind: "agent", agent: { jobType: "j" } },
+      { id: "b", kind: "agent", agent: { jobType: "j" } },
+    ],
+    edges: [
+      { from: "bump", to: "a", when: "bump.result", equals: "x" },
+      { from: "bump", to: "b", default: false },
+    ],
+  });
+  hasCode(errors, "mixed-fan-out");
+});
+
+test("S7 exclusive-merge-parity: terminal nodes that MIX a conditional tail with an always-firing tail are rejected (the End-sink deadlock/double-fire shape)", () => {
+  // `split` fans an exhaustive XOR to two leaves (`cond`/`other` — exactly one fires); `indep` always
+  // fires. All three are graph leaves, so the End sink joins them. A parallel join there deadlocks on
+  // the untaken branch; an exclusive merge double-fires when both `indep` and a branch arrive. The
+  // validator must reject the mix so the compiler's End-gateway choice is sound.
+  const errors = validateDeliveryGraph({
+    nodes: [
+      { id: "split", kind: "agent", agent: { jobType: "j" }, emits: [{ name: "result", type: "string" }] },
+      { id: "cond", kind: "agent", agent: { jobType: "j" } },
+      { id: "other", kind: "agent", agent: { jobType: "j" } },
+      { id: "feed", kind: "agent", agent: { jobType: "j" } },
+      { id: "indep", kind: "agent", agent: { jobType: "j" } },
+    ],
+    edges: [
+      { from: "split", to: "cond", when: "split.result", equals: "a" },
+      { from: "split", to: "other", default: true },
+      { from: "feed", to: "indep" },
+    ],
+  });
+  hasCode(errors, "exclusive-merge-parity");
+});
+
+test("S7 default-only node is NOT an exclusive split — a lone `default: true` out-edge always fires and must not mark downstream leaves conditional", () => {
+  // `fork` unconditionally fans to `p` and `q` (a parallel fork). `q` has a SINGLE out-edge marked
+  // `default: true` with no guarded `when` sibling — semantically that edge always fires, so `q` is
+  // NOT an exclusive split. Leaves {p, z} are both always-firing and join cleanly at the End sink.
+  // Deriving `splitNodes` from `when`-guarded edges only (not a lone `default`) keeps `q` off the
+  // split set; treating a default-only node as a split spuriously marks `z` conditional and trips a
+  // false End-sink exclusive-merge-parity error.
+  const errors = validateDeliveryGraph({
+    nodes: [
+      { id: "fork", kind: "agent", agent: { jobType: "j" } },
+      { id: "p", kind: "agent", agent: { jobType: "j" } },
+      { id: "q", kind: "agent", agent: { jobType: "j" } },
+      { id: "z", kind: "agent", agent: { jobType: "j" } },
+    ],
+    edges: [
+      { from: "fork", to: "p" },
+      { from: "fork", to: "q" },
+      { from: "q", to: "z", default: true },
+    ],
+  });
+  assertEquals(errors, []);
+});
+
+test("S7 single-target guarded fan-out is NOT an exclusive split — a node whose guarded + default edges all converge on ONE downstream node has no real fan-out and must not mark that node conditional", () => {
+  // `gate` has a guarded edge and a `default` edge that BOTH target `conv` — one distinct downstream
+  // node, so there is no structural fan-out: `conv` fires whenever `gate` does. Deriving `splitNodes`
+  // from "has a guarded edge" alone wrongly adds `gate` to the split set, marking `conv` conditional;
+  // then leaves {conv, indep} look like a mixed conditional/always-firing End sink and trip a false
+  // exclusive-merge-parity error. A split must fan to >=2 distinct targets to be exclusive.
+  const errors = validateDeliveryGraph({
+    nodes: [
+      { id: "gate", kind: "agent", agent: { jobType: "j" }, emits: [{ name: "result", type: "string" }] },
+      { id: "conv", kind: "agent", agent: { jobType: "j" } },
+      { id: "feed", kind: "agent", agent: { jobType: "j" } },
+      { id: "indep", kind: "agent", agent: { jobType: "j" } },
+    ],
+    edges: [
+      { from: "gate", to: "conv", when: "gate.result", equals: "a" },
+      { from: "gate", to: "conv", default: true },
+      { from: "feed", to: "indep" },
+    ],
+  });
+  assertEquals(errors, []);
+});