@nanobpm/nano-workforce 0.163.0 → 0.163.2

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## [0.163.2](https://github.com/nanobpm/nano-workforce/compare/v0.163.1...v0.163.2) (2026-08-31)
+
+### Build System
+
+* **deps:** bump @nanobpm/urban-testkit to ^1.0.0 (native callActivity in e2e) ([#635](https://github.com/nanobpm/nano-workforce/issues/635)) ([2020817](https://github.com/nanobpm/nano-workforce/commit/2020817a2b5baeec347b2c808212720ab58328cb)), closes [#631](https://github.com/nanobpm/nano-workforce/issues/631) [#591](https://github.com/nanobpm/nano-workforce/issues/591) [nano-ide#503](https://github.com/nanobpm/nano-ide/issues/503) [#607](https://github.com/nanobpm/nano-workforce/issues/607) [nano-ide#503](https://github.com/nanobpm/nano-ide/issues/503) [#607](https://github.com/nanobpm/nano-workforce/issues/607) [#503](https://github.com/nanobpm/nano-workforce/issues/503) [#607](https://github.com/nanobpm/nano-workforce/issues/607) [nano-ide#503](https://github.com/nanobpm/nano-ide/issues/503)
+
+## [0.163.1](https://github.com/nanobpm/nano-workforce/compare/v0.163.0...v0.163.1) (2026-08-30)
+
+### Bug Fixes
+
+* **plan:** taskless plan follows engine liveness, not empty-plan heuristic ([#624](https://github.com/nanobpm/nano-workforce/issues/624)) ([#626](https://github.com/nanobpm/nano-workforce/issues/626)) ([1dbb0d6](https://github.com/nanobpm/nano-workforce/commit/1dbb0d650c955886588a1e4caf3e8af7b150c4ca)), closes [#623](https://github.com/nanobpm/nano-workforce/issues/623) [#623](https://github.com/nanobpm/nano-workforce/issues/623) [#623](https://github.com/nanobpm/nano-workforce/issues/623)
+
 ## [0.163.0](https://github.com/nanobpm/nano-workforce/compare/v0.162.2...v0.163.0) (2026-08-30)
 
 ### Features

package/SPEC.md

@@ -283,7 +283,7 @@ child grids and a lazily-loaded transcript. The round/escalation grids are
 read-only audit. Open native user-task escalations are additionally resolved
 app-side from the **Tasks** page (`pages/tasks.page.json`, issue #236) — a nav
 tab whose per-kind `dataGrid`s list every open escalation (feature / plan-review
-/ trial-merge / PR review / blocked-run) off the `user_tasks` read-model and
+/ empty-plan / trial-merge / PR review / blocked-run) off the `user_tasks` read-model and
 submit the typed decision to the canonical human completer — so an operator no
 longer depends on Urban's read-only `taskInbox` stub at `/tasks`.
 
@@ -519,7 +519,19 @@ Start(issue) → plan → record-plan → implement (parallel MI) → record-res
 - **`record-plan`** — app worker `pr.record-plan`. Normalizes the tasks (assigns a
   stable `id`/index), writes one `plan_tasks` row each, sets `plans.task_count` and
   status `dispatched`, and **re-emits** the normalized `tasks` so the fan-out
-  iterates the canonical list.
+  iterates the canonical list. It also emits `taskCount`, which the `gw-plan-empty`
+  gateway reads: a taskful plan proceeds to plan-review; an **empty plan**
+  (`{tasks:[]}`) is neither auto-terminated (which rendered "Done" over a still-live
+  instance, #624) nor fed into the adversarial plan-review loop (a plan↔plan-review
+  livelock, #623) — instead it parks at the **`empty-plan-escalation`** operator user
+  task for a human directive: **Accept** a legitimate no-op epic (→ the terminal
+  `EndTasklessDone` end; the poller reconciles the COMPLETED instance to `done`) or
+  **Revise** (→ back to `plan` to re-plan, folding the operator's `notes` into
+  `planFindings` so the guidance reaches the re-plan's `appendPrompt`, mirroring
+  `plan-review-decision`). An empty plan stays NON-terminal
+  (`planning`) with its planner `note` as the `outcome` while parked — terminal
+  status follows engine liveness via `pollTasklessPlanTermination`, never the
+  empty-plan signal (#624).
 - **`implement`** — service task, job type `senior:feature`, **parallel
   multi-instance** over `=tasks` (`inputElement="task"`,
   `outputCollection="results"`). Its base prompt is delivered via the `feature.md`

package/app/agentCompletion.test.ts

@@ -257,6 +257,35 @@ test("conformance-escalation is HUMAN-completable but NOT agent-completable (iss
   assertEquals(completed[0].variables, { note: "filed follow-up" });
 });
 
+test("empty-plan-escalation is HUMAN-completable but NOT agent-completable (issues #623/#624)", async () => {
+  // The empty-plan operator decision mirrors feature-blocked/conformance: a HUMAN operator adjudicates
+  // whether an empty plan is a legitimate no-op (accept) or needs re-planning (revise), through
+  // `completeEscalationAsHuman`. It stays OUTSIDE the agent surface (`ESCALATION_TASK_ELEMENTS`) — the
+  // fleet must never silently auto-resolve the very "no work was produced" case a human must attend.
+  const stores = { task_completions: { rows: [] as any[], key: "id" } };
+  const data = memData(stores);
+  const { engine, completed } = fakeEngine([{ userTaskKey: "ut-e", elementId: "empty-plan-escalation" }]);
+
+  const asAgent = await completeEscalationAsAgent(data, engine, {
+    userTaskKey: "ut-e",
+    agentId: "bot",
+    variables: { directive: "accept" },
+  });
+  assertEquals(asAgent.ok, false, "the agent completer refuses empty-plan-escalation");
+  assertEquals(asAgent.reason, "not a completable task");
+  assertEquals(completed.length, 0);
+
+  const asHuman = await completeEscalationAsHuman(data, engine, {
+    userTaskKey: "ut-e",
+    operatorId: "alice",
+    variables: { directive: "revise", notes: "look again" },
+  });
+  assertEquals(asHuman.ok, true, "the human completer retires empty-plan-escalation");
+  assertEquals(asHuman.elementId, "empty-plan-escalation");
+  assertEquals(completed.length, 1);
+  assertEquals(completed[0].variables, { directive: "revise", notes: "look again" });
+});
+
 test("human completer refuses a non-escalation user task and is a no-op for an unknown key", async () => {
   const stores = { task_completions: { rows: [] as any[], key: "id" } };
   const data = memData(stores);
@@ -543,6 +572,10 @@ test("validateEscalationVariables derives its contract from the canonical .form
   // plan-review-decision -> directive required, allowed proceed/revise
   assertEquals(validateEscalationVariables("plan-review-decision", { directive: "proceed" }), null);
   assert(validateEscalationVariables("plan-review-decision", { directive: "" }) !== null);
+  // empty-plan-escalation -> directive required, allowed accept/revise
+  assertEquals(validateEscalationVariables("empty-plan-escalation", { directive: "accept" }), null);
+  assertEquals(validateEscalationVariables("empty-plan-escalation", { directive: "revise" }), null);
+  assert(validateEscalationVariables("empty-plan-escalation", { directive: "" }) !== null);
   // an element with no linked form contract is not enforced
   assertEquals(validateEscalationVariables("some-other-task", { whatever: 1 }), null);
 });

package/app/agentCompletion.ts

@@ -24,7 +24,7 @@ import { readFileSync } from "node:fs";
 import type { DataLayer, EngineClient } from "@nanobpm/urban";
 import { CONFORMANCE_ESCALATION_ELEMENT } from "./conformance.ts";
 import { DELIVERY_HUMAN_ELEMENT, isDeliveryHumanElement } from "./deliveryHuman.ts";
-import { ACP_PERMISSION_ELEMENT } from "./userTasks.ts";
+import { ACP_PERMISSION_ELEMENT, EMPTY_PLAN_ELEMENT } from "./userTasks.ts";
 
 const now = () => new Date().toISOString();
 
@@ -91,6 +91,14 @@ export const FEATURE_BLOCKED_TASK_ELEMENT = "feature-blocked";
  *  `CONFORMANCE_ESCALATION_ELEMENT` (app/conformance.ts) — one source of truth, no drift surface. */
 export const CONFORMANCE_ESCALATION_TASK_ELEMENT = CONFORMANCE_ESCALATION_ELEMENT;
 
+/** The `empty-plan-escalation` operator user-task element id (plan-fanout.bpmn) — the native decision a
+ *  plan-fanout run parks on when the planner emits an EMPTY plan. Like `feature-blocked` and
+ *  `conformance-escalation` it is a HUMAN-only operator decision (never agent-answerable, or the fleet
+ *  could silently auto-resolve the very "no work was produced" case a human must adjudicate), so it
+ *  lives OUTSIDE `ESCALATION_TASK_ELEMENTS` and only the HUMAN completer accepts it (issues #623/#624).
+ *  Re-exported from the canonical `EMPTY_PLAN_ELEMENT` (app/userTasks.ts) — one source of truth. */
+export const EMPTY_PLAN_TASK_ELEMENT = EMPTY_PLAN_ELEMENT;
+
 /** The user-task `elementId`s a HUMAN operator may complete from the Tasks inbox via the one canonical
  *  `complete-user-task` door: every agent-answerable escalation PLUS the human-only `feature-blocked`
  *  and `conformance-escalation` acknowledgements, PLUS the advisory ACP permission prompt
@@ -104,6 +112,7 @@ export const HUMAN_COMPLETABLE_ELEMENTS: ReadonlySet<string> = new Set([
   ...ESCALATION_TASK_ELEMENTS,
   FEATURE_BLOCKED_TASK_ELEMENT,
   CONFORMANCE_ESCALATION_TASK_ELEMENT,
+  EMPTY_PLAN_TASK_ELEMENT,
   ACP_PERMISSION_ELEMENT,
 ]);
 
@@ -117,6 +126,7 @@ const ESCALATION_FORM_BY_ELEMENT: Readonly<Record<string, string>> = {
   "wait-answer": "pr-escalation",
   "wait-merge-answer": "pr-escalation",
   "feature-blocked": "feature-blocked",
+  [EMPTY_PLAN_TASK_ELEMENT]: "empty-plan-escalation",
   [CONFORMANCE_ESCALATION_TASK_ELEMENT]: "conformance-escalation",
   // NOTE: the delivery-graph `human` node (`DELIVERY_HUMAN_ELEMENT`, ADR 0005 S3) is intentionally
   // ABSENT here. Unlike the fixed-form escalations above, ONE `delivery-human-task` element is DESIGNED

package/app/epicPhase.test.ts

@@ -15,6 +15,8 @@ test("deriveEpicPhase maps each spine element to its domain phase", () => {
   assertEquals(deriveEpicPhase("review-plan"), EPIC_PHASE.REVIEWING);
   assertEquals(deriveEpicPhase("record-plan-review"), EPIC_PHASE.REVIEWING);
   assertEquals(deriveEpicPhase("plan-review-decision"), EPIC_PHASE.REVIEWING);
+  // The empty-plan operator escalation (gw-plan-empty) is a planning-stage decision (Accept/Revise).
+  assertEquals(deriveEpicPhase("empty-plan-escalation"), EPIC_PHASE.PLANNING);
   // Trial-merge band.
   assertEquals(deriveEpicPhase("trial-merge"), EPIC_PHASE.TRIAL_MERGING);
   assertEquals(deriveEpicPhase("record-trial-merge"), EPIC_PHASE.TRIAL_MERGING);

package/app/epicPhase.ts

@@ -107,6 +107,7 @@ const ELEMENT_PHASE: Readonly<Record<string, string>> = {
   "ensure-base-branch": EPIC_PHASE.PLANNING,
   "plan": EPIC_PHASE.PLANNING,
   "record-plan": EPIC_PHASE.REVIEWING,
+  "empty-plan-escalation": EPIC_PHASE.PLANNING,
   "review-plan": EPIC_PHASE.REVIEWING,
   "record-plan-review": EPIC_PHASE.REVIEWING,
   "plan-review-decision": EPIC_PHASE.REVIEWING,

package/app/pollTasklessPlanTermination.test.ts

@@ -0,0 +1,188 @@
+// Coverage for `pollTasklessPlanTermination` (issue #624) — the poll pass that owns a TASKLESS plan's
+// COMPLETED → `done` transition from ENGINE truth, so terminal `plans.status` follows engine instance
+// liveness instead of the retired "record-plan with task_count = 0 ⇒ done" heuristic (which rendered
+// the epic "Done" over a still-active, in fact looping, plan-fanout instance).
+//
+// Booted against the real provisioned SQLite data layer (so the `plans` table exists) with a stubbed
+// `searchProcessInstances`, proving: a taskless plan whose instance is STILL ACTIVE stays non-terminal
+// (the core acceptance guarantee); it flips to `done` only once the instance reads COMPLETED; a
+// TASKFUL plan is never touched (its `record-results` finalizer owns `done`); a plan with no engine
+// instance is skipped; and an already-`done` plan is left alone.
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { test } from "node:test";
+import { assertEquals } from "#test-assert";
+import type { DataLayer } from "@nanobpm/urban";
+import { bootTestApp } from "@nanobpm/urban-testkit";
+import { plans } from "./plan.ts";
+import { pollTasklessPlanTermination } from "./service.ts";
+import { withTrackingViews } from "../test/trackingViews.ts";
+
+const APP_ROOT = resolve(import.meta.dirname, "..");
+
+async function withData(fn: (data: DataLayer) => Promise<void>): Promise<void> {
+  const dir = mkdtempSync(join(tmpdir(), "nwf-taskless-term-"));
+  const app = await bootTestApp(APP_ROOT, { env: { NANO_APP_DB_URL: `file:${join(dir, "app.db")}` } });
+  try {
+    await fn(app.db);
+  } finally {
+    await app.stop?.();
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+const now = () => new Date().toISOString();
+
+async function seedPlan(
+  data: DataLayer,
+  over: { status?: string; process_key?: string | null; task_count?: number; outcome?: string | null } = {},
+) {
+  await plans(data).insert({
+    plan_key: "owner/repo#7",
+    repo: "owner/repo",
+    issue_number: 7,
+    issue_url: "https://github.com/owner/repo/issues/7",
+    title: "Epic",
+    status: over.status ?? "planning",
+    task_count: over.task_count ?? 0,
+    outcome: "outcome" in over ? over.outcome : "planner emitted no tasks",
+    process_key: "process_key" in over ? over.process_key : "pi-1",
+    created_at: now(),
+    updated_at: now(),
+  } as never);
+}
+
+test("pollTasklessPlanTermination leaves a taskless plan NON-terminal while its instance is ACTIVE", async () => {
+  await withData(async (data) => {
+    await seedPlan(data, { status: "planning", task_count: 0 });
+    const engine = { searchProcessInstances: async () => [{ processInstanceKey: "pi-1", state: "ACTIVE" }] };
+    await pollTasklessPlanTermination(data, engine as never);
+    // The core acceptance guarantee: a task_count = 0 plan is not terminal while its instance runs.
+    assertEquals((await plans(data).get("owner/repo#7"))?.status, "planning");
+  });
+});
+
+test("pollTasklessPlanTermination flips a taskless plan to done once its instance reads COMPLETED", async () => {
+  await withData(async (data) => {
+    await seedPlan(data, { status: "planning", task_count: 0 });
+    const engine = { searchProcessInstances: async () => [{ processInstanceKey: "pi-1", state: "COMPLETED" }] };
+    await pollTasklessPlanTermination(data, engine as never);
+    const row = await plans(data).get("owner/repo#7");
+    assertEquals(row?.status, "done");
+    assertEquals(row?.outcome, "planner emitted no tasks");
+  });
+});
+
+test("pollTasklessPlanTermination matches a numeric engine processInstanceKey against the string process_key", async () => {
+  await withData(async (data) => {
+    await seedPlan(data, { status: "planning", task_count: 0, process_key: "12345" });
+    const engine = { searchProcessInstances: async () => [{ processInstanceKey: 12345, state: "COMPLETED" }] };
+    await pollTasklessPlanTermination(data, engine as never);
+    assertEquals((await plans(data).get("owner/repo#7"))?.status, "done");
+  });
+});
+
+test("pollTasklessPlanTermination never touches a TASKFUL plan (record-results owns its done)", async () => {
+  await withData(async (data) => {
+    await seedPlan(data, { status: "dispatched", task_count: 3, outcome: null });
+    let called = false;
+    const engine = {
+      searchProcessInstances: async () => {
+        called = true;
+        return [{ processInstanceKey: "pi-1", state: "COMPLETED" }];
+      },
+    };
+    await pollTasklessPlanTermination(data, engine as never);
+    assertEquals(called, false);
+    assertEquals((await plans(data).get("owner/repo#7"))?.status, "dispatched");
+  });
+});
+
+test("pollTasklessPlanTermination skips a taskless plan that has no engine instance yet", async () => {
+  await withData(async (data) => {
+    await seedPlan(data, { status: "planning", task_count: 0, process_key: null });
+    let called = false;
+    const engine = {
+      searchProcessInstances: async () => {
+        called = true;
+        return [];
+      },
+    };
+    await pollTasklessPlanTermination(data, engine as never);
+    assertEquals(called, false);
+    assertEquals((await plans(data).get("owner/repo#7"))?.status, "planning");
+  });
+});
+
+test("pollTasklessPlanTermination never re-touches an already-terminal plan", async () => {
+  await withData(async (data) => {
+    await seedPlan(data, { status: "done", task_count: 0 });
+    let called = false;
+    const engine = {
+      searchProcessInstances: async () => {
+        called = true;
+        return [];
+      },
+    };
+    await pollTasklessPlanTermination(data, engine as never);
+    // `done` is not in EPIC_LIVE_STATUSES, so the pass never queries the engine for it.
+    assertEquals(called, false);
+  });
+});
+
+// A taskless plan whose instance TERMINATED out of band keeps its base `status = planning` (the
+// worker-owned transient the reconciler no longer overwrites) while the ADR-0065 tracking VIEW folds
+// its `derived_status` to `abandoned`. A base-`status` scan would keep re-querying the engine for that
+// already-dead row every pass forever; the pass MUST read `derived_status` off `plansTracking` and skip
+// it. Modelled with the `withTrackingViews` fake so the base `status` and derived `derived_status`
+// diverge exactly as the real terminated instance produces, without a live engine.
+// biome-ignore lint/suspicious/noExplicitAny: test-only fake over dynamic row shapes.
+function trackedMemData(): DataLayer {
+  // biome-ignore lint/suspicious/noExplicitAny: test-only dynamic row store.
+  const store: any[] = [];
+  const tbl = (_name: string, pk = "plan_key") => ({
+    // biome-ignore lint/suspicious/noExplicitAny: test-only dynamic row.
+    async insert(row: any) {
+      store.push({ ...row });
+      return row[pk];
+    },
+    async get(key: unknown) {
+      return store.find((r) => r[pk] === key);
+    },
+    async find(where: Record<string, unknown>) {
+      return store.filter((r) => Object.entries(where).every(([k, v]) => r[k] === v));
+    },
+    // biome-ignore lint/suspicious/noExplicitAny: test-only patch.
+    async update(key: unknown, patch: any) {
+      const r = store.find((x) => x[pk] === key);
+      if (r) Object.assign(r, patch);
+    },
+  });
+  // biome-ignore lint/suspicious/noExplicitAny: test-only fake DataLayer.
+  return { table: withTrackingViews((n: string, pk?: string) => tbl(n, pk)) } as any as DataLayer;
+}
+
+test("pollTasklessPlanTermination skips a derive-only-terminal (TERMINATED) taskless plan without querying the engine", async () => {
+  const data = trackedMemData();
+  // Base `status` still reads live `planning` (frozen transient), but the instance terminated out of
+  // band so the tracking VIEW's `derived_status` is `abandoned`.
+  await plans(data).insert({
+    plan_key: "owner/repo#7",
+    status: "planning",
+    derived_status: "abandoned",
+    task_count: 0,
+    process_key: "pi-1",
+  } as never);
+  let called = false;
+  const engine = {
+    searchProcessInstances: async () => {
+      called = true;
+      return [{ processInstanceKey: "pi-1", state: "COMPLETED" }];
+    },
+  };
+  await pollTasklessPlanTermination(data, engine as never);
+  // The regression guard: a base-status scan would re-query the engine here forever.
+  assertEquals(called, false);
+  assertEquals((await plans(data).get("owner/repo#7"))?.status, "planning");
+});

package/app/service.ts

@@ -68,6 +68,7 @@ import {
   type Plan,
   planReviews,
   plans,
+  plansTracking,
   planTaskDeps,
   planTaskNeeds,
   planTasks,
@@ -2383,6 +2384,57 @@ export async function pollEpicPhase(
   }
 }
 
+/** Poll pass (issue #624): own the taskless plan's COMPLETED → `done` transition from ENGINE truth.
+ *
+ * A taskless plan (`task_count = 0`, the planner emitted no tasks) is NO LONGER collapsed to terminal
+ * `done` by `record-plan` — "the planner produced nothing this pass" is an INTERMEDIATE state, not an
+ * ended process (the plan-fanout instance is still live and may re-plan, escalate, or be cancelled).
+ * So the plan stays non-terminal (`planning`) until its process instance ACTUALLY ends, and terminal
+ * `plans.status` follows engine instance liveness rather than the empty-plan heuristic that rendered
+ * the epic "Done" over a live (in fact looping) instance.
+ *
+ * This pass owns the COMPLETED → `done` edge for such plans, mirroring the delivery-graph
+ * COMPLETED → `done` transition ({@link pollDeliveryGraphPhase}): `instanceTracking`'s `onTerminated`
+ * edge reconciles only TERMINATED (→ `abandoned` on `derived_status`), never COMPLETED, so a taskless
+ * plan whose instance ends GREEN would otherwise stay `planning` forever. A taskful plan reaches
+ * `done` through its own `record-results` finalizer, so this pass is scoped to `task_count = 0` and to
+ * the live rows only. Liveness is read off the ADR-0065 derived tracking VIEW (`plansTracking`'s
+ * `derived_status`), NOT the base `plans.status`: a taskless plan whose instance TERMINATED out of
+ * band keeps base `status = planning`/`dispatched` while `derived_status` folds to `abandoned`, so a
+ * base-status scan would re-query the engine for that already-dead row every pass forever. Skipping
+ * rows whose `derived_status` is no longer live confines the engine read to genuinely-live plans and
+ * never races a worker-owned terminal. Best-effort +
+ * idempotent: writes only on a real COMPLETED read, so a steady-state pass over a still-active
+ * instance is a no-op (the acceptance guarantee — a taskless plan is never terminal while active). */
+export async function pollTasklessPlanTermination(
+  data: DataLayer,
+  engine: Pick<EngineClient, "searchProcessInstances">,
+) {
+  for (const status of EPIC_LIVE_STATUSES) {
+    for (const plan of await plansTracking(data).find({ status })) {
+      if (plan.task_count !== 0 || !plan.process_key) continue;
+      // Base `status` is live, but the instance may have TERMINATED out of band (folding
+      // `derived_status` → `abandoned`); skip such derive-only-terminal rows so the pass only
+      // queries the engine for genuinely-live plans (ADR-0065).
+      if (!EPIC_LIVE_STATUSES.some((s) => s === plan.derived_status)) continue;
+      const processKey = plan.process_key;
+      try {
+        const snapshots = await engine.searchProcessInstances({ processInstanceKeys: [processKey] });
+        const state = snapshots.find((s) => String(s.processInstanceKey) === processKey)?.state ?? null;
+        if (state === "COMPLETED") {
+          await plans(data).update(plan.plan_key, {
+            status: "done",
+            outcome: plan.outcome ?? "planner emitted no tasks",
+            updated_at: now(),
+          });
+        }
+      } catch (err) {
+        console.error(`[poller] taskless plan termination ${plan.plan_key}: ${err}`);
+      }
+    }
+  }
+}
+
 /** Poll pass (ADR 0005 slice S5): reconcile each RUNNING delivery-graph run's derived phase from
  * engine truth, and complete it when its instance ends. A delivery graph is a DYNAMIC compiled
  * process with no happy-path host worker, so — unlike `plans`/`feature_runs`, whose spine workers
@@ -2622,6 +2674,7 @@ export async function pollOnce(
   await pollLineage(data);
   await pollUserTasks(data, engine, engineRest);
   await pollEpicPhase(data, engine);
+  await pollTasklessPlanTermination(data, engine);
   await pollDeliveryGraphPhase(data, engine);
   await pollDeliveryProposals(data);
   if (engineRest) {

package/app/userTasks.ts

@@ -30,6 +30,13 @@ const now = () => new Date().toISOString();
  *  when the adversarial review loop exhausts its budget without approval. */
 export const PLAN_REVIEW_ELEMENT = "plan-review-decision";
 
+/** The empty-plan operator escalation user task (plan-fanout.bpmn) — a human directive (accept/revise)
+ *  when the planner emits an EMPTY plan (`{tasks:[]}`). Instead of auto-terminating the run from an
+ *  intermediate signal (which rendered "Done" over a still-live instance, #624) or feeding the empty
+ *  plan into the adversarial plan-review loop (a plan↔plan-review livelock, #623), the run parks here
+ *  for operator attention: Accept a legitimate no-op epic (→ terminal done) or Revise (→ re-plan). */
+export const EMPTY_PLAN_ELEMENT = "empty-plan-escalation";
+
 /** The trial-merge escalation user task (plan-fanout.bpmn) — a human decision (proceed/rebase/abandon)
  *  when a wave's trial merge comes back red. */
 export const TRIAL_MERGE_ELEMENT = "trial-merge-decision";
@@ -87,6 +94,7 @@ export const USER_TASK_KIND_LABELS: Readonly<Record<string, string>> = {
   [FEATURE_ESCALATION_ELEMENT]: "Feature escalation",
   [FEATURE_BLOCKED_ELEMENT]: "Blocked feature run",
   [PLAN_REVIEW_ELEMENT]: "Plan review",
+  [EMPTY_PLAN_ELEMENT]: "Empty plan",
   [TRIAL_MERGE_ELEMENT]: "Trial merge",
   [PR_WAIT_ANSWER_ELEMENT]: "PR review",
   [PR_WAIT_MERGE_ANSWER_ELEMENT]: "PR merge",

package/docs/mcp-runbook.md

@@ -130,7 +130,10 @@ and does **not** resolve `$ref`s, so every projected (non-`x-mcp`) request-body
 in `openapi.yaml` presents an inline `type: object` body with no `$ref`; the two graph doors
 additionally carry a worked `example` — an agent discovers the body shape (and calls the tool
 with a real object, not a
-stringified one) from the surface alone. The two graph doors split by convention:
+stringified one) from the surface alone — and even if an agent's client emits a
+stringified object body, the door itself now **faithfully parses** it rather than
+rejecting it (nano-ide#503, a server-side input-compatibility behavior that needs no
+client upgrade — see the faithful-transport note below). The two graph doors split by convention:
 `compileDeliveryGraph` takes the **structured `DeliveryGraph` object** (and *stages*);
 `previewDeliveryGraph` takes the **text shape `{ "graphJson": "<serialized DeliveryGraph>" }`**
 (and is *pure*). Every validation failure returns `issues`/`errors` as `[{ path, message }]`.
@@ -138,9 +141,14 @@ The inline bodies are **derived** from `components.schemas` by
 `scripts/inline-mcp-bodies.ts` (single source of truth; run `npm run gen:mcp-bodies` after
 editing a component), and `npm run check:mcp-bodies` + `test/mcp-tool-schemas.test.ts` (which
 runs the real projector) fail CI if a `$ref` ever re-leaks. The upstream projector fix that
-would make this mitigation unnecessary is tracked in
+would make the **schema** mitigation unnecessary is tracked in
 [nano-ide#501](https://github.com/nanobpm/nano-ide/issues/501) (#502 self-contained schemas,
-#503 faithful object-body transport, #504 real-spec conformance guard).
+#504 real-spec conformance guard). **#503 faithful object-body transport has landed** —
+`@nanobpm/urban` 0.87 ships ADR 0067's `normalizeBodyArg`, so the MCP door now **parses** a
+stringified object body and forwards it faithfully instead of rejecting it with `expected object,
+got string`. That retired the nwf-local stringified-body reject mitigation: the e2e guard in
+`e2e/mcp-surface.e2e.ts` now asserts the door faithfully parses a stringified body (the
+`assertObjectBodyAccepted` detector's teeth stay pinned synthetically).
 
 ## 5. Fallback
 
@@ -178,13 +186,16 @@ depends on:
 
 - every projected tool schema is `$ref`-free with an explicit `type` (a leaked
   `$ref` is unresolvable in the MCP context);
-- an object argument arrives **as an object**, never coerced to a string;
+- an object argument arrives **as an object** — and a stringified one is faithfully
+  **parsed** by the door (ADR 0067 / nano-ide#503, `@nanobpm/urban` ≥ 0.87), never
+  rejected as `expected object, got string`;
 - validation failures answer uniformly with `issues[{path,message}]`;
 - side-effecting calls stage nothing, so the suite is safe to re-run.
 
 It runs in CI under `npm run e2e` (hermetic — no socket, no GitHub), so a
-reintroduced `$ref` or a stringified object body fails the build instead of
-reaching an agent.
+reintroduced `$ref` fails the build, and a stringified object body is asserted to be
+faithfully parsed by the door (ADR 0067 / nano-ide#503) instead of reaching an agent
+mis-serialized.
 
 **Extending it (new per-tool case).** Import `bootMcpHarness` from
 `e2e/support/mcp-harness.ts` in your own `e2e/<slice>.e2e.ts` and drive

package/e2e/mcp-surface.e2e.ts

@@ -6,7 +6,8 @@
 // `e2e/support/mcp-harness.ts` module. It PINS the client-visible contract the S0 defect broke:
 //
 //   • every projected tool schema is `$ref`-free with an explicit `type` (S0 / nano-ide#502);
-//   • an object argument arrives AS AN OBJECT, never coerced to a string (S0 / nano-ide#503);
+//   • an object argument arrives AS AN OBJECT — and a stringified one is faithfully PARSED, not
+//     rejected, now that ADR 0067 / nano-ide#503 landed upstream in @nanobpm/urban 0.87;
 //   • validation failures answer uniformly with `issues[{path,message}]`;
 //   • the reads parse; the mutating framework tools are gated; side-effecting calls leave NO live
 //     staged proposal behind (safe to run repeatedly).
@@ -192,9 +193,14 @@ describe("MCP surface e2e — the runtime-served /app/mcp handshake, per tool (S
     );
   });
 
-  // The falsifiable core (issue #607 acceptance): DELIBERATELY reintroducing either half of the S0
+  // The falsifiable core (issue #607 acceptance): DELIBERATELY reintroducing the SCHEMA half of the S0
   // defect makes the harness fail. These pin the detector's teeth independently of whether S0 has
-  // landed — so the guard cannot silently rot into a no-op.
+  // landed — so the guard cannot silently rot into a no-op. The object-body-stringification half
+  // (nano-ide#503) is now fixed UPSTREAM — @nanobpm/urban 0.87 lands ADR 0067 "faithful object-body
+  // transport" (`normalizeBodyArg`), so the door PARSES a stringified object body and forwards it
+  // faithfully instead of rejecting it. That retired the nwf-local reject mitigation (docs/mcp-runbook.md
+  // §4): the live door can no longer produce the S0 signature to exercise end-to-end, so that half is
+  // now covered by a live faithful-parse assertion plus a synthetic detector-teeth check below.
   describe("reintroducing the S0 defect fails the build", () => {
     test("a $ref in a tool schema is caught by the self-containment assertion", () => {
       const good = { type: "object", properties: { body: { type: "object", properties: { n: { type: "number" } } } } };
@@ -208,17 +214,42 @@ describe("MCP surface e2e — the runtime-served /app/mcp handshake, per tool (S
       assert.throws(() => assertSchemaSelfContained(typeless, "synthetic-typeless"), /type/, "a typeless schema must throw");
     });
 
-    test("a stringified object body is rejected by the door and caught by assertObjectBodyAccepted", async () => {
-      // Simulate the S0 client coercion: send the body as a JSON STRING instead of an object.
-      const res = await h.callTool("compileDeliveryGraph", { body: JSON.stringify(MINIMAL_VALID_GRAPH) });
-      assert.ok(res.isError, "a stringified object body must be rejected by the door");
+    test("a stringified object body is faithfully parsed by the door (ADR 0067 / nano-ide#503)", async () => {
+      // Simulate the old S0 client coercion: send the body as a JSON STRING instead of an object.
+      // @nanobpm/urban 0.87's faithful object-body transport (ADR 0067 `normalizeBodyArg`) now PARSES
+      // it and forwards it faithfully — no longer the "expected object, got string" rejection the
+      // nwf-local S0 mitigation used to raise. Drive the PURE previewDeliveryGraph door so the
+      // parsed-and-compiled graph stages nothing.
+      const res = await h.callTool("previewDeliveryGraph", {
+        body: JSON.stringify({ graphJson: JSON.stringify(MINIMAL_VALID_GRAPH) }),
+      });
+      assert.ok(!res.isError, `the door must faithfully parse a stringified object body: ${res.text}`);
       assert.ok(
-        res.text.includes(STRINGIFIED_BODY_MESSAGE),
-        `the door must report "${STRINGIFIED_BODY_MESSAGE}": ${res.text}`,
+        !res.text.includes(STRINGIFIED_BODY_MESSAGE),
+        `faithful transport must not reject with "${STRINGIFIED_BODY_MESSAGE}": ${res.text}`,
       );
-      // The harness's guard must recognize that signature as a failure.
+      assert.doesNotThrow(
+        () => assertObjectBodyAccepted(res, "previewDeliveryGraph"),
+        "a faithfully parsed object body must pass assertObjectBodyAccepted",
+      );
+      const json = res.json as { ok?: boolean; staged?: boolean } | undefined;
+      assert.equal(json?.ok, true, `previewDeliveryGraph must compile the parsed graph: ${res.text}`);
+      assert.equal(json?.staged, false, "previewDeliveryGraph is PURE — it must never stage");
+    });
+
+    test("assertObjectBodyAccepted still flags an S0 stringified-body signature (detector teeth)", () => {
+      // The live door can no longer produce the S0 signature (fixed upstream, ADR 0067), so pin the
+      // detector's teeth SYNTHETICALLY — mirroring the $ref/typeless guards above — so the helper
+      // cannot rot into a no-op if the signature ever re-surfaces from another surface.
+      const s0Result = {
+        isError: true,
+        text: `validation failed: body: ${STRINGIFIED_BODY_MESSAGE}`,
+        json: undefined,
+        httpStatus: 422,
+        raw: undefined,
+      };
       assert.throws(
-        () => assertObjectBodyAccepted(res, "compileDeliveryGraph"),
+        () => assertObjectBodyAccepted(s0Result, "synthetic-stringified"),
         /stringified/,
         "assertObjectBodyAccepted must flag a stringified-body result",
       );

package/e2e/plan-fanout.e2e.ts

@@ -241,27 +241,30 @@ describe("plan-fanout escalations (U2 — task + plan-review + trial-merge → u
     );
   });
 
-  // Empty-plan short-circuit (issue #623 — regression for Merlin instance-46 / epic #1067). A
+  // Empty-plan escalation (issues #623/#624 — regression for Merlin instance-46 / epic #1067). A
   // planner that legitimately emits `{tasks:[]}` (meta/tracking epic, or all sub-issues closed) must
-  // reach a terminal state WITHOUT entering the adversarial plan-review loop — feeding an empty plan
-  // into review caused a plan↔plan-review livelock (it can neither be approved nor produce findings).
-  test("empty plan short-circuits to the taskless-done end, never entering plan-review (issue #623)", async () => {
+  // NOT enter the adversarial plan-review loop (feeding an empty plan into review caused a
+  // plan↔plan-review livelock — it can neither be approved nor produce findings), and must NOT
+  // auto-terminate from an intermediate signal while the instance is still live (#624). Instead it is
+  // parked for OPERATOR ATTENTION at the `empty-plan-escalation` user task; a human then Accepts
+  // (no-op done) or Revises (re-plan).
+  test("empty plan parks at the operator escalation (non-terminal), never entering plan-review (issues #623/#624)", async () => {
     let reviewCalls = 0;
     await withApp(
       {
         "senior:plan": () => ({ tasks: [], note: "all sub-issues closed" }),
-        // If this ever fires, the short-circuit failed and the empty plan entered the review loop.
+        // If this ever fires, the empty plan wrongly entered the review loop.
         "senior:plan-review": () => {
           reviewCalls += 1;
           return { approved: false, findings: "" };
         },
         "senior:feature": () => ({ status: "blocked", summary: "n/a" }),
       },
-      async ({ app, planKey }) => {
+      async ({ app, planKey, processKey }) => {
         const flows = takenFlows(app);
         assert.ok(
-          flows.includes("gw-plan-empty->EndTasklessDone"),
-          `empty plan routed to the taskless-done end (flows: ${flows.join(", ")})`,
+          flows.includes("gw-plan-empty->empty-plan-escalation"),
+          `empty plan routed to the operator escalation (flows: ${flows.join(", ")})`,
         );
         assert.ok(
           !flows.includes("gw-plan-empty->review-plan"),
@@ -269,11 +272,83 @@ describe("plan-fanout escalations (U2 — task + plan-review + trial-merge → u
         );
         assert.equal(reviewCalls, 0, "the plan-review agent must never run for an empty plan");
 
-        const plan = await app.db
+        // The instance is parked at the operator user task — a completable escalation exists.
+        const task = await openTask(app, processKey, "empty-plan-escalation");
+        assert.ok(task.userTaskKey, "the empty-plan escalation carries a completable userTaskKey");
+
+        // While parked, the plan is NON-terminal: the instance is still live (#624), so terminal
+        // `done` is owned by the poller on COMPLETED, not written here from the empty-plan signal.
+        const parked = await app.db
           .table<{ plan_key: string; status: string; outcome: string | null }>("plans", "plan_key")
           .findOne({ plan_key: planKey });
-        assert.equal(plan?.status, "done", "the empty plan reached a terminal done state");
-        assert.equal(plan?.outcome, "all sub-issues closed", "the planner note was recorded as the outcome");
+        assert.equal(parked?.status, "planning", "a parked empty plan stays non-terminal (planning)");
+        assert.equal(parked?.outcome, "all sub-issues closed", "the planner note was recorded as the outcome");
+      },
+    );
+  });
+
+  test("empty-plan escalation: accept routes to the taskless-done end (no-op epic)", async () => {
+    await withApp(
+      {
+        "senior:plan": () => ({ tasks: [], note: "all sub-issues closed" }),
+        "senior:plan-review": () => ({ approved: true, findings: "" }),
+        "senior:feature": () => ({ status: "blocked", summary: "n/a" }),
+      },
+      async ({ app, processKey }) => {
+        const task = await openTask(app, processKey, "empty-plan-escalation");
+        await app.engine.completeUserTask(task.userTaskKey, { directive: "accept", notes: "meta epic" });
+        await app.settle();
+
+        const flows = takenFlows(app);
+        assert.ok(
+          flows.includes("gw-empty-plan-answer->EndTasklessDone"),
+          `accept routed to the taskless-done end (flows: ${flows.join(", ")})`,
+        );
+        assert.ok(
+          !flows.includes("gw-empty-plan-answer->plan"),
+          "the revise (default) flow was NOT taken",
+        );
+      },
+    );
+  });
+
+  test("empty-plan escalation: revise re-plans, re-parking a still-empty plan at the operator (never auto-terminating)", async () => {
+    let reviewCalls = 0;
+    const planPrompts: Array<string | undefined> = [];
+    await withApp(
+      {
+        "senior:plan": (job) => {
+          planPrompts.push((job.variables as Record<string, unknown>).appendPrompt as string | undefined);
+          return { tasks: [], note: "all sub-issues closed" };
+        },
+        "senior:plan-review": () => {
+          reviewCalls += 1;
+          return { approved: true, findings: "" };
+        },
+        "senior:feature": () => ({ status: "blocked", summary: "n/a" }),
+      },
+      async ({ app, processKey }) => {
+        const task = await openTask(app, processKey, "empty-plan-escalation");
+        await app.engine.completeUserTask(task.userTaskKey, { directive: "revise", notes: "look again" });
+        await app.settle();
+
+        const flows = takenFlows(app);
+        assert.ok(
+          flows.includes("gw-empty-plan-answer->plan"),
+          `revise routed back to the planner (flows: ${flows.join(", ")})`,
+        );
+        // The operator's revision guidance must actually reach the re-plan: `empty-plan-escalation`
+        // folds `notes` into `planFindings`, which the `plan` task renders into its `appendPrompt`.
+        const rePlanPrompt = planPrompts.at(-1);
+        assert.ok(
+          rePlanPrompt?.includes("look again"),
+          `operator revise notes were delivered to the re-plan appendPrompt (got: ${JSON.stringify(rePlanPrompt)})`,
+        );
+        // The re-plan is still empty, so it re-parks at a fresh operator escalation — it neither
+        // enters plan-review nor auto-terminates.
+        const reparked = await openTask(app, processKey, "empty-plan-escalation");
+        assert.ok(reparked.userTaskKey, "a still-empty re-plan re-parks at the operator escalation");
+        assert.equal(reviewCalls, 0, "the plan-review agent must never run for an empty plan");
       },
     );
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.163.0",
+  "version": "0.163.2",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",
@@ -61,12 +61,12 @@
   },
   "dependencies": {
     "@nanobpm/agentic": "^0.4.0",
-    "@nanobpm/urban": "^0.86.0",
+    "@nanobpm/urban": "^0.87.0",
     "bpmn-auto-layout": "^2.0.0-alpha.2"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.4.11",
-    "@nanobpm/urban-testkit": "^0.14.0",
+    "@nanobpm/urban-testkit": "^1.0.0",
     "@nanobpm/workflow": "^0.14.0",
     "@semantic-release/changelog": "^7.0.0",
     "@semantic-release/git": "^11.0.0",

package/resources/forms/empty-plan-escalation.form

@@ -0,0 +1,31 @@
+{
+  "id": "empty-plan-escalation",
+  "schemaVersion": 18,
+  "type": "default",
+  "components": [
+    {
+      "type": "text",
+      "text": "The planner produced an **empty plan** (no tasks) for this epic. This can be a legitimate no-op (a meta/tracking epic, or one whose sub-issues are all closed) or a planning failure. It is parked here for an operator to decide — it does NOT auto-terminate and does NOT re-enter the adversarial plan-review loop."
+    },
+    {
+      "type": "select",
+      "key": "directive",
+      "label": "Directive",
+      "values": [
+        { "label": "Accept — a legitimate no-op epic; complete the run", "value": "accept" },
+        { "label": "Revise — send it back to the planner to re-plan", "value": "revise" }
+      ],
+      "validate": {
+        "required": true
+      }
+    },
+    {
+      "type": "textarea",
+      "key": "notes",
+      "label": "Revision guidance for the planner",
+      "conditional": {
+        "hide": "=directive != \"revise\""
+      }
+    }
+  ]
+}

package/resources/processes/plan-fanout.bpmn

@@ -293,8 +293,25 @@
       <bpmn:outgoing>f_plan_empty</bpmn:outgoing>
       <bpmn:outgoing>f_toReviewPlan</bpmn:outgoing>
     </bpmn:exclusiveGateway>
-    <bpmn:endEvent id="EndTasklessDone" name="Taskless done (no-op epic)">
+    <bpmn:userTask id="empty-plan-escalation" name="Empty plan — operator attention (human)">
+      <bpmn:extensionElements>
+        <zeebe:formDefinition formId="empty-plan-escalation" />
+        <zeebe:userTask />
+        <zeebe:assignmentDefinition candidateGroups="operators" assignee="=escalationAssignee" />
+        <zeebe:ioMapping>
+          <zeebe:output source="=(if planFindings = null then &#34;&#34; else planFindings) + (if (notes = null or notes = &#34;&#34;) then &#34;&#34; else &#34;&#10;&#10;Human guidance:&#10;&#34; + notes)" target="planFindings" />
+        </zeebe:ioMapping>
+      </bpmn:extensionElements>
       <bpmn:incoming>f_plan_empty</bpmn:incoming>
+      <bpmn:outgoing>f_toGwEmptyAnswer</bpmn:outgoing>
+    </bpmn:userTask>
+    <bpmn:exclusiveGateway id="gw-empty-plan-answer" name="accept no-op?" default="f_empty_revise">
+      <bpmn:incoming>f_toGwEmptyAnswer</bpmn:incoming>
+      <bpmn:outgoing>f_empty_accept</bpmn:outgoing>
+      <bpmn:outgoing>f_empty_revise</bpmn:outgoing>
+    </bpmn:exclusiveGateway>
+    <bpmn:endEvent id="EndTasklessDone" name="Taskless done (no-op epic)">
+      <bpmn:incoming>f_empty_accept</bpmn:incoming>
     </bpmn:endEvent>
     <bpmn:serviceTask id="review-plan" name="Review plan (agent)">
       <bpmn:extensionElements>
@@ -622,9 +639,14 @@
     <bpmn:sequenceFlow id="f_toPlan" sourceRef="ensure-base-branch" targetRef="plan" />
     <bpmn:sequenceFlow id="f_toRecordPlan" sourceRef="plan" targetRef="record-plan" />
     <bpmn:sequenceFlow id="f_toPlanEmptyGw" sourceRef="record-plan" targetRef="gw-plan-empty" />
-    <bpmn:sequenceFlow id="f_plan_empty" name="no tasks" sourceRef="gw-plan-empty" targetRef="EndTasklessDone">
+    <bpmn:sequenceFlow id="f_plan_empty" name="no tasks" sourceRef="gw-plan-empty" targetRef="empty-plan-escalation">
       <bpmn:conditionExpression xsi:type="bpmn:tFormalExpression">=taskCount = 0</bpmn:conditionExpression>
     </bpmn:sequenceFlow>
+    <bpmn:sequenceFlow id="f_toGwEmptyAnswer" sourceRef="empty-plan-escalation" targetRef="gw-empty-plan-answer" />
+    <bpmn:sequenceFlow id="f_empty_accept" name="accept (no-op)" sourceRef="gw-empty-plan-answer" targetRef="EndTasklessDone">
+      <bpmn:conditionExpression xsi:type="bpmn:tFormalExpression">=directive = "accept"</bpmn:conditionExpression>
+    </bpmn:sequenceFlow>
+    <bpmn:sequenceFlow id="f_empty_revise" name="revise" sourceRef="gw-empty-plan-answer" targetRef="plan" />
     <bpmn:sequenceFlow id="f_toReviewPlan" name="has tasks" sourceRef="gw-plan-empty" targetRef="review-plan" />
     <bpmn:sequenceFlow id="f_toRecordPlanReview" sourceRef="review-plan" targetRef="record-plan-review" />
     <bpmn:sequenceFlow id="f_toGwPlanReview" sourceRef="record-plan-review" targetRef="gw-plan-review" />
@@ -700,13 +722,22 @@
       <bpmndi:BPMNShape id="BPMNShape_gw-plan-empty" bpmnElement="gw-plan-empty" isMarkerVisible="true">
         <dc:Bounds x="1166" y="284" width="50" height="50" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1123" y="339" width="57" height="28" />
+          <dc:Bounds x="1163" y="359" width="57" height="28" />
+        </bpmndi:BPMNLabel>
+      </bpmndi:BPMNShape>
+      <bpmndi:BPMNShape id="BPMNShape_empty-plan-escalation" bpmnElement="empty-plan-escalation">
+        <dc:Bounds x="1316" y="589" width="100" height="80" />
+      </bpmndi:BPMNShape>
+      <bpmndi:BPMNShape id="BPMNShape_gw-empty-plan-answer" bpmnElement="gw-empty-plan-answer" isMarkerVisible="true">
+        <dc:Bounds x="1541" y="604" width="50" height="50" />
+        <bpmndi:BPMNLabel>
+          <dc:Bounds x="1543" y="571" width="46" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_EndTasklessDone" bpmnElement="EndTasklessDone">
-        <dc:Bounds x="1348" y="451" width="36" height="36" />
+        <dc:Bounds x="1723" y="611" width="36" height="36" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1327" y="492" width="78" height="42" />
+          <dc:Bounds x="1702" y="652" width="78" height="42" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_review-plan" bpmnElement="review-plan">
@@ -718,7 +749,7 @@
       <bpmndi:BPMNShape id="BPMNShape_gw-plan-review" bpmnElement="gw-plan-review" isMarkerVisible="true">
         <dc:Bounds x="1716" y="284" width="50" height="50" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1668" y="339" width="67" height="28" />
+          <dc:Bounds x="1668" y="359" width="67" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_plan-review-decision" bpmnElement="plan-review-decision">
@@ -727,7 +758,7 @@
       <bpmndi:BPMNShape id="BPMNShape_gw-plan-answer" bpmnElement="gw-plan-answer" isMarkerVisible="true">
         <dc:Bounds x="2066" y="444" width="50" height="50" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="2121" y="455" width="67" height="28" />
+          <dc:Bounds x="2058" y="411" width="67" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_select-wave" bpmnElement="select-wave">
@@ -844,7 +875,7 @@
         <di:waypoint x="1766" y="309" />
         <di:waypoint x="2216" y="309" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1899" y="287" width="60" height="14" />
+          <dc:Bounds x="1961" y="287" width="60" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_toImplement" bpmnElement="f_toImplement">
@@ -877,6 +908,15 @@
         <di:waypoint x="6004" y="309" />
         <di:waypoint x="6104" y="309" />
       </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_f_empty_revise" bpmnElement="f_empty_revise">
+        <di:waypoint x="1566" y="654" />
+        <di:waypoint x="1566" y="689" />
+        <di:waypoint x="816" y="689" />
+        <di:waypoint x="816" y="349" />
+        <bpmndi:BPMNLabel>
+          <dc:Bounds x="1168" y="667" width="46" height="14" />
+        </bpmndi:BPMNLabel>
+      </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_plan_revise" bpmnElement="f_plan_revise">
         <di:waypoint x="1741" y="284" />
         <di:waypoint x="1741" y="249" />
@@ -892,7 +932,7 @@
         <di:waypoint x="816" y="549" />
         <di:waypoint x="816" y="349" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1431" y="557" width="46" height="14" />
+          <dc:Bounds x="1431" y="527" width="46" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_toRecordTrialMerge" bpmnElement="f_toRecordTrialMerge">
@@ -930,10 +970,14 @@
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_plan_empty" bpmnElement="f_plan_empty">
         <di:waypoint x="1191" y="334" />
-        <di:waypoint x="1191" y="469" />
-        <di:waypoint x="1348" y="469" />
+        <di:waypoint x="1191" y="354" />
+        <di:waypoint x="2136" y="354" />
+        <di:waypoint x="2136" y="558" />
+        <di:waypoint x="1296" y="558" />
+        <di:waypoint x="1296" y="609" />
+        <di:waypoint x="1316" y="609" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1196" y="395" width="57" height="14" />
+          <dc:Bounds x="2141" y="489" width="57" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_plan_escalate" bpmnElement="f_plan_escalate">
@@ -945,11 +989,11 @@
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_plan_answer_proceed" bpmnElement="f_plan_answer_proceed">
-        <di:waypoint x="2091" y="444" />
-        <di:waypoint x="2091" y="309" />
-        <di:waypoint x="2216" y="309" />
+        <di:waypoint x="2116" y="469" />
+        <di:waypoint x="2266" y="469" />
+        <di:waypoint x="2266" y="349" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="2096" y="370" width="53" height="14" />
+          <dc:Bounds x="2165" y="447" width="53" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_runTrialMerge" bpmnElement="f_runTrialMerge">
@@ -1005,6 +1049,17 @@
         <di:waypoint x="616" y="469" />
         <di:waypoint x="616" y="349" />
       </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_f_toGwEmptyAnswer" bpmnElement="f_toGwEmptyAnswer">
+        <di:waypoint x="1416" y="629" />
+        <di:waypoint x="1541" y="629" />
+      </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_f_empty_accept" bpmnElement="f_empty_accept">
+        <di:waypoint x="1591" y="629" />
+        <di:waypoint x="1723" y="629" />
+        <bpmndi:BPMNLabel>
+          <dc:Bounds x="1631" y="596" width="53" height="28" />
+        </bpmndi:BPMNLabel>
+      </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_toGwPlanAnswer" bpmnElement="f_toGwPlanAnswer">
         <di:waypoint x="1966" y="469" />
         <di:waypoint x="2066" y="469" />
@@ -1029,7 +1084,7 @@
         <di:waypoint x="816" y="547" />
         <di:waypoint x="816" y="349" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1426" y="514" width="81" height="28" />
+          <dc:Bounds x="1326" y="514" width="81" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_trial_sla" bpmnElement="f_trial_sla">

package/workers/record-plan/worker.test.ts

@@ -84,15 +84,19 @@ test("record-plan dispatches a taskful plan and levelizes its tasks (wave progre
   assertEquals(plans[0].wave_label, undefined);
 });
 
-test("record-plan marks a taskless plan done (no wave-progress columns written)", async () => {
+test("record-plan keeps a taskless plan NON-terminal (planning) with an outcome note (issue #624)", async () => {
   const { app, plans } = fakeApp();
   const out = await handler(
     { variables: { planKey: "owner/repo#137", tasks: [], note: "planner emitted no tasks" } } as any,
     app,
   );
-  assertEquals(plans[0].status, "done");
-  // taskCount 0 routes the plan-fanout gateway (`gw-plan-empty`) to the terminal taskless-done arm,
-  // short-circuiting the adversarial plan-review loop that would otherwise livelock (issue #623).
+  // A taskless plan is INTERMEDIATE, not terminal: the plan-fanout instance is still live (may
+  // re-plan / escalate / be cancelled). Terminal `done` follows engine liveness (reconciled by the
+  // poller), never this empty-plan heuristic, so the status stays non-terminal here (issue #624).
+  assertEquals(plans[0].status, "planning");
+  assertEquals(plans[0].task_count, 0);
+  // `taskCount` still drives the plan-fanout gateway (`gw-plan-empty`): zero routes to the operator
+  // empty-plan escalation instead of the adversarial plan-review loop (issues #623/#624).
   assertEquals((out as any).taskCount, 0);
   assertEquals(plans[0].outcome, "planner emitted no tasks");
   assertEquals(plans[0].wave_count, undefined);

package/workers/record-plan/worker.ts

@@ -10,6 +10,13 @@
 //   • records the task count, moves the plan to `dispatched`, and emits `currentWave = 0`
 //     plus `waveCount` so the wave loop (`select-wave → implement → record-wave`) can run.
 //
+// A TASKLESS plan (the planner emitted no tasks) is NOT terminal here (issue #624): "the planner
+// produced nothing this pass" is an intermediate state, not an ended process — the plan-fanout
+// instance is still live and may re-plan, escalate, or be cancelled. The plan stays NON-terminal
+// (`planning`, with an `outcome` note for observability); terminal `plans.status` follows ENGINE
+// instance liveness, reconciled by the poller (COMPLETED → `done`; TERMINATED → `abandoned`), never
+// this empty-plan heuristic.
+//
 // If the planner emits a malformed DAG (cycle / unknown or self dependency / duplicate id),
 // levelization can't order the tasks. Rather than dead-lock the plan we DEGRADE to the old
 // flat behaviour — a single wave (wave 0) of all tasks, run fully in parallel — and log a
@@ -38,10 +45,13 @@ interface NormalTask {
 interface Out extends Record<string, unknown> {
   currentWave: number;
   waveCount: number;
-  // Task count of the recorded plan. The plan-fanout gateway (`gw-plan-empty`) reads this to
-  // SHORT-CIRCUIT an intentionally-empty plan (`{tasks:[]}`) to a terminal taskless-done arm
-  // BEFORE the adversarial plan-review gate (issue #623). Feeding an empty plan into review
-  // caused a plan↔plan-review livelock — it can neither be approved nor produce findings.
+  // Task count of the recorded plan. The plan-fanout gateway (`gw-plan-empty`) reads this to route
+  // an intentionally-empty plan (`{tasks:[]}`) to the OPERATOR empty-plan escalation
+  // (`empty-plan-escalation`) — a human decides Accept (no-op done) or Revise (re-plan) — instead of
+  // the adversarial plan-review gate (issues #623/#624). Feeding an empty plan into review caused a
+  // plan↔plan-review livelock (it can neither be approved nor produce findings), and auto-terminating
+  // it (issue #625) reached a terminal verdict from an intermediate signal while the instance was
+  // still live; escalating for operator attention resolves both.
   taskCount: number;
 }
 
@@ -143,7 +153,6 @@ const handler: AppJobHandler<In, Out> = async (job, app) => {
   }
 
   const patch: Record<string, unknown> = {
-    status: tasks.length > 0 ? "dispatched" : "done",
     task_count: tasks.length,
     // Operator-visibility wave progress (wave_count / current_wave / wave_label) was RETIRED as a
     // stored projection (epic #412) — the epics-index reads it from the `plan_wave_label` /
@@ -151,11 +160,25 @@ const handler: AppJobHandler<In, Out> = async (job, app) => {
     // denormalises it onto the `plans` row.
     updated_at: ts,
   };
-  if (tasks.length === 0) patch.outcome = note ? str(note) : "planner emitted no tasks";
+  if (tasks.length > 0) {
+    patch.status = "dispatched";
+  } else {
+    // Taskless plan: DO NOT collapse to terminal `done` (issue #624). "The planner produced nothing
+    // this pass" is an INTERMEDIATE state, NOT an ended process — the plan-fanout instance is still
+    // live and may re-plan, escalate, or be cancelled. Terminal `plans.status` must follow ENGINE
+    // instance liveness, not this per-pass empty-plan heuristic, or the epic renders "Done" over a
+    // still-active (in fact looping) instance. So the plan stays NON-terminal (`planning`) until the
+    // poller sees the instance actually end: COMPLETED → `done` (pollTasklessPlanTermination,
+    // app/service.ts — the same poller that owns the delivery-graph COMPLETED→done transition) or
+    // TERMINATED → `abandoned` (instanceTracking's `onTerminated` derived edge). The outcome note is
+    // still recorded for observability; it is phase/label copy, not a terminal-status signal.
+    patch.status = "planning";
+    patch.outcome = note ? str(note) : "planner emitted no tasks";
+  }
   await plans(app.data).update(planKey, patch);
 
-  // Kick off the wave loop at wave 0. `taskCount` lets the BPMN gateway terminate an empty plan
-  // before the review loop (issue #623).
+  // Kick off the wave loop at wave 0. `taskCount` lets the BPMN gateway (`gw-plan-empty`) route an
+  // empty plan to the operator empty-plan escalation instead of the review loop (issues #623/#624).
   return { currentWave: 0, waveCount, taskCount: tasks.length };
 };