@nanobpm/nano-workforce 0.171.2 → 0.171.3

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## [0.171.3](https://github.com/nanobpm/nano-workforce/compare/v0.171.2...v0.171.3) (2026-08-31)
+
+### Code Refactoring
+
+* compose implement → implement-cell (feature + plan-fanout) ([#646](https://github.com/nanobpm/nano-workforce/issues/646)) ([#656](https://github.com/nanobpm/nano-workforce/issues/656)) ([caca54e](https://github.com/nanobpm/nano-workforce/commit/caca54e42caf0a1db83a8f15092c7c834e05e81f)), closes [#642](https://github.com/nanobpm/nano-workforce/issues/642) [#360](https://github.com/nanobpm/nano-workforce/issues/360) [#642](https://github.com/nanobpm/nano-workforce/issues/642) [#642](https://github.com/nanobpm/nano-workforce/issues/642)
+
 ## [0.171.2](https://github.com/nanobpm/nano-workforce/compare/v0.171.1...v0.171.2) (2026-08-31)
 
 ### Bug Fixes

package/app/deliveryDispatch.test.ts

@@ -56,10 +56,14 @@ function manifestBindings(): Binding[] {
 }
 
 // The deployed process models — scanned for their prompt-bearing agent tasks, the real dispatch
-// corpus the door's verbs must already exist in.
+// corpus the door's verbs must already exist in. Includes the shared S4 atomic cells (ADR 0006): the
+// implement/escalation and trial-merge agent tasks now live in `implement-cell` / `merge-cell`, which
+// `feature.bpmn` and the `plan-fanout` MI body compose by `callActivity`.
 const MODEL_FILES = [
   "feature.bpmn",
   "plan-fanout.bpmn",
+  "implement-cell.bpmn",
+  "merge-cell.bpmn",
   "convergence-loop.bpmn",
   "merge-loop.bpmn",
   "retro.bpmn",
@@ -85,7 +89,7 @@ test("VERB PARITY: every mapped dispatch verb is a real senior:* agent task in t
 });
 
 test("VERB PARITY: the implementation kinds keep the pre-collapse senior:feature target", () => {
-  // feature.bpmn's implement task and plan-fanout.bpmn's per-slice implement task both dispatch
+  // implement-cell.bpmn's agent task (composed by feature.bpmn and the plan-fanout MI body) dispatches
   // senior:feature today — the door preserves that for the single-issue implementation kinds.
   assertEquals(dispatchJobTypeForKind("feature"), "senior:feature");
   assertEquals(dispatchJobTypeForKind("plan-task"), "senior:feature");

package/app/escalationTaxonomy.ts

@@ -39,10 +39,11 @@ export type EscalationKind =
   | "dead-end-base"
   // `mergeProtocol` (app/mergeProtocol.ts) — the repo's declared land method.
   | "merge-protocol"
-  // plan-fanout `w_gw` "clean terminal?" gateway — the implement-stage escalation net (issue #360).
-  // Any non-clean-terminal slice outcome routes through the `record-wave-escalation` worker, which
-  // classifies with this kind: the agent's own answerable question passes through, and a no-machine-
-  // readable result (or a blank-question `escalated`) is synthesised into an answerable one.
+  // The shared `implement-cell`'s `ic_gw` "clean terminal?" gateway — the implement-stage escalation
+  // net (issue #360). Any non-clean-terminal slice outcome routes through the cell's unified
+  // `record-feature-escalation` worker, which classifies with this kind: the agent's own answerable
+  // question passes through, and a no-machine-readable result (or a blank-question `escalated`) is
+  // synthesised into an answerable one.
   | "task";
 
 /** Everything the classifier may need from any raise site. Each field is consumed only by the

package/app/fineGrainedCells.test.ts

@@ -99,3 +99,96 @@ test("feature.bpmn composes its converge step via callActivity to converge-cell
     );
   }
 });
+
+test("feature.bpmn composes its implement step via callActivity to implement-cell — no inlined implement serviceTask", () => {
+  // The implement seam (deferred out of #632, tracked in #646) composes the shared `implement-cell`
+  // via a `callActivity` with an explicit `zeebe:ioMapping`, rather than an inlined `senior:feature`
+  // serviceTask plus a per-caller escalation loop. The atomic cell owns its own escalation retry
+  // (through the shared `human-escalation` cell), so the parent no longer carries the
+  // `record-feature-escalation` / `feature-escalation` / answer-loop gateways.
+  const xml = flat("feature");
+  assert(
+    /<bpmn:callActivity\b[^>]*\bid="implement"[\s\S]*?<zeebe:calledElement\b[^>]*\bprocessId="implement-cell"/.test(xml),
+    "feature.bpmn must compose implement as a callActivity to implement-cell",
+  );
+  assert(
+    !/<bpmn:serviceTask\b[^>]*\bid="implement-task"/.test(xml),
+    "feature.bpmn must not keep an inlined implement-task serviceTask once the cell is composed",
+  );
+  // The inlined escalation loop is relocated into the atomic cell — the parent path must not keep it.
+  assert(
+    !/<bpmn:serviceTask\b[^>]*\bid="record-feature-escalation"/.test(xml),
+    "feature.bpmn must not keep the inlined record-feature-escalation serviceTask once the cell owns escalation",
+  );
+  assert(
+    !/<bpmn:userTask\b[^>]*\bid="feature-escalation"/.test(xml),
+    "feature.bpmn must not keep the inlined feature-escalation userTask once the cell owns escalation",
+  );
+  // Pin the explicit `zeebe:ioMapping` on the implement callActivity block alone (no `propagateAll*`).
+  const implementBlock =
+    xml.match(/<bpmn:callActivity\b[^>]*\bid="implement"[\s\S]*?<\/bpmn:callActivity>/)?.[0] ?? "";
+  assert(
+    /<zeebe:ioMapping>[\s\S]*?<\/zeebe:ioMapping>/.test(implementBlock),
+    "the implement callActivity must carry an explicit zeebe:ioMapping",
+  );
+  assert(
+    /<zeebe:input\b[^>]*\btarget="task"/.test(implementBlock),
+    "the implement callActivity ioMapping must map the task slice into the child scope",
+  );
+  for (const field of ["status", "summary", "pr"]) {
+    assert(
+      new RegExp(`<zeebe:output\\b[^>]*\\btarget="${field}"`).test(implementBlock),
+      `the implement callActivity ioMapping must map the child result field ${field} back into the parent scope`,
+    );
+  }
+});
+
+test("plan-fanout.bpmn composes its per-wave implement step via a callActivity to implement-cell", () => {
+  // Per ADR 0006 §2 the composition "replaces the inlined segments, not the surrounding orchestration":
+  // the multi-instance `implement` subProcess (one token per wave task) keeps its fan-out-specific
+  // capability barrier (`caps-prepare` / `wait-caps`) as surrounding orchestration, and its inlined
+  // implement/escalation SEGMENT (the per-wave `senior:feature` serviceTask, the `w_gw` "clean
+  // terminal?" gateway, and the `record-wave-escalation` recorder) collapses into a `callActivity` to
+  // the shared `implement-cell` — the atomic cell now owns the agent loop and its escalation through the
+  // shared `human-escalation` cell ("a wave IS a callActivity", #464/#646). The MI stays on the
+  // subProcess (one token per wave); the cell is invoked once per token.
+  const xml = flat("plan-fanout");
+  // The MI element is the `implement` subProcess (one token per wave), preserved as the caps-barrier
+  // host; assert its multi-instance loop over `waveTasks`.
+  const implementSub =
+    xml.match(/<bpmn:subProcess\b[^>]*\bid="implement"[\s\S]*?<\/bpmn:subProcess>/)?.[0] ?? "";
+  assert(implementSub.length > 0, "plan-fanout.bpmn must keep the per-wave implement subProcess (the caps-barrier host)");
+  assert(
+    /<bpmn:multiInstanceLoopCharacteristics>[\s\S]*?inputCollection="=waveTasks"/.test(implementSub),
+    "the implement subProcess must be multi-instance — one token per wave task",
+  );
+  // The caps barrier stays in the wave (fan-out-specific, not part of the atomic cell).
+  assert(
+    /<zeebe:taskDefinition\b[^>]*\btype="pr.caps-prepare"/.test(implementSub),
+    "the capability barrier (caps-prepare) stays in the wave as surrounding orchestration",
+  );
+  // The implement/escalation segment is replaced by a callActivity to the shared implement-cell.
+  const cellCall =
+    implementSub.match(/<bpmn:callActivity\b[^>]*\bid="implement-cell-call"[\s\S]*?<\/bpmn:callActivity>/)?.[0] ?? "";
+  assert(
+    /<zeebe:calledElement\b[^>]*\bprocessId="implement-cell"/.test(cellCall),
+    "plan-fanout.bpmn must compose the per-wave implement as a callActivity to implement-cell",
+  );
+  assert(
+    /<zeebe:ioMapping>[\s\S]*?<\/zeebe:ioMapping>/.test(cellCall),
+    "the implement-cell callActivity must carry an explicit zeebe:ioMapping (no propagateAll*)",
+  );
+  assert(
+    /<zeebe:input\b[^>]*\btarget="task"/.test(cellCall) && /<zeebe:input\b[^>]*\btarget="subjectKey"/.test(cellCall),
+    "the implement-cell callActivity must map the wave task and the plan subject key into the child scope",
+  );
+  // The inlined per-wave agent loop + escalation recorder no longer sit on the fan-out path.
+  assert(
+    !/<bpmn:serviceTask\b[^>]*\bid="implement-task"/.test(implementSub),
+    "plan-fanout.bpmn must not keep an inlined implement-task serviceTask once the cell is composed",
+  );
+  assert(
+    !/type="pr.record-wave-escalation"/.test(xml),
+    "plan-fanout.bpmn must not keep the inlined record-wave-escalation recorder (folded into the cell's recorder)",
+  );
+});

package/app/planFanoutCleanTerminal.test.ts

@@ -1,40 +1,43 @@
-// Structural guard for the wave subprocess's "clean terminal?" gateway (w_gw) — the implement-stage
-// escalation net (#358/#360). The whole point of the net is that a slice with NO clean terminal
-// status escalates to a human. The no-result case (implement-task completes with `status`
-// missing/undefined) is EXACTLY what must escalate, so the gateway must not depend on a `not(...)`
-// negation that FEEL leaves `null` for a missing `status` (a null condition takes NO flow and would
-// fall through to the default). We eliminate that failure mode categorically: ESCALATE is the
-// DEFAULT flow and DONE is gated on the closed set of clean terminal statuses — so anything that is
-// not a recognised clean terminal (including a missing/undefined status) escalates, regardless of
-// how the engine evaluates equality against null.
+// Structural guard for the implement cell's "clean terminal?" gateway (ic_gw) — the implement-stage
+// escalation net (#358/#360), now owned by the shared `implement-cell` (ADR 0006 S4). Before the S4
+// composition this gateway lived inline as `plan-fanout.bpmn`'s `w_gw` and `feature.bpmn`'s equivalent;
+// composing the atomic cell relocated it (and its `record-escalation` recorder + `human-escalation`
+// loop) into `implement-cell.bpmn`, which BOTH `feature.bpmn` and the `plan-fanout` MI body compose by
+// `callActivity`. The invariant is unchanged: a slice with NO clean terminal status escalates to a
+// human. The no-result case (the agent completes with `status` missing/undefined) is EXACTLY what must
+// escalate, so the gateway must not depend on a `not(...)` negation that FEEL leaves `null` for a
+// missing `status` (a null condition takes NO flow and would fall through to the default). We eliminate
+// that failure mode categorically: ESCALATE is the DEFAULT flow and DONE is gated on the closed set of
+// clean terminal statuses — so anything that is not a recognised clean terminal (including a
+// missing/undefined status) escalates, regardless of how the engine evaluates equality against null.
 //
 // Pure text assertions over the committed BPMN (no engine), matching the repo's model-guard style.
 import { readFileSync } from "node:fs";
 import { test } from "node:test";
 import { assert, assertStringIncludes } from "#test-assert";
 
-const bpmn = readFileSync("resources/processes/plan-fanout.bpmn", "utf8");
+const bpmn = readFileSync("resources/processes/implement-cell.bpmn", "utf8");
 const flat = bpmn.replace(/\s+/g, " ");
 
-const gw = flat.match(/<bpmn:exclusiveGateway\b[^>]*\bid="w_gw"[^>]*>/)?.[0] ?? "";
-const wDone = flat.match(/<bpmn:sequenceFlow\b[^>]*\bid="w_done"[^>]*\/>|<bpmn:sequenceFlow\b[^>]*\bid="w_done"[\s\S]*?<\/bpmn:sequenceFlow>/)?.[0] ?? "";
-const wEscalate = flat.match(/<bpmn:sequenceFlow\b[^>]*\bid="w_escalate"[^>]*\/>|<bpmn:sequenceFlow\b[^>]*\bid="w_escalate"[\s\S]*?<\/bpmn:sequenceFlow>/)?.[0] ?? "";
+const gw = flat.match(/<bpmn:exclusiveGateway\b[^>]*\bid="ic_gw"[^>]*>/)?.[0] ?? "";
+const icDone = flat.match(/<bpmn:sequenceFlow\b[^>]*\bid="ic_done"[^>]*\/>|<bpmn:sequenceFlow\b[^>]*\bid="ic_done"[\s\S]*?<\/bpmn:sequenceFlow>/)?.[0] ?? "";
+const icEscalate = flat.match(/<bpmn:sequenceFlow\b[^>]*\bid="ic_escalate"[^>]*\/>|<bpmn:sequenceFlow\b[^>]*\bid="ic_escalate"[\s\S]*?<\/bpmn:sequenceFlow>/)?.[0] ?? "";
 
-test("w_gw: ESCALATE is the default flow, so a missing/undefined status can never fall through to done", () => {
-  assert(gw, "w_gw gateway must exist");
-  assertStringIncludes(gw, 'default="w_escalate"', "escalate must be the default — the no-result case escalates, never silently completes");
+test("ic_gw: ESCALATE is the default flow, so a missing/undefined status can never fall through to done", () => {
+  assert(gw, "ic_gw gateway must exist");
+  assertStringIncludes(gw, 'default="ic_escalate"', "escalate must be the default — the no-result case escalates, never silently completes");
 });
 
-test("w_gw: DONE is gated on the closed set of clean terminal statuses (not a fragile not(...) negation)", () => {
-  assert(wDone, "w_done flow must exist");
-  assertStringIncludes(wDone, "conditionExpression", "the done flow must be conditional, not the default");
-  assertStringIncludes(wDone, 'status = "opened"', "done requires a recognised clean terminal status");
-  assertStringIncludes(wDone, 'status = "blocked"', "done requires a recognised clean terminal status");
-  assertStringIncludes(wDone, 'status = "skipped"', "done requires a recognised clean terminal status");
+test("ic_gw: DONE is gated on the closed set of clean terminal statuses (not a fragile not(...) negation)", () => {
+  assert(icDone, "ic_done flow must exist");
+  assertStringIncludes(icDone, "conditionExpression", "the done flow must be conditional, not the default");
+  assertStringIncludes(icDone, 'status = "opened"', "done requires a recognised clean terminal status");
+  assertStringIncludes(icDone, 'status = "blocked"', "done requires a recognised clean terminal status");
+  assertStringIncludes(icDone, 'status = "skipped"', "done requires a recognised clean terminal status");
 });
 
-test("w_gw: the escalate flow carries no condition — it is the unconditional default sink", () => {
-  assert(wEscalate, "w_escalate flow must exist");
-  assert(!wEscalate.includes("conditionExpression"), "escalate is the default flow and must carry no condition");
-  assert(!wEscalate.includes("not("), "escalate must not depend on a not(...) negation that FEEL leaves null for a missing status");
+test("ic_gw: the escalate flow carries no condition — it is the unconditional default sink", () => {
+  assert(icEscalate, "ic_escalate flow must exist");
+  assert(!icEscalate.includes("conditionExpression"), "escalate is the default flow and must carry no condition");
+  assert(!icEscalate.includes("not("), "escalate must not depend on a not(...) negation that FEEL leaves null for a missing status");
 });

package/app/planFanoutPreflight.test.ts

@@ -66,8 +66,15 @@ test("a never-green producer escalates (bounded) without wedging: probe timeout
   assert(hasFlow("be_pf_sla", "pf_end"), "an elapsed escalation SLA settles the preflight instead of wedging");
 });
 
-test("the bound resolvedArtifacts version rides the implement task's appendPrompt", () => {
-  const task = flat.match(/<bpmn:serviceTask\b[^>]*\bid="implement-task"[\s\S]*?<\/bpmn:serviceTask>/);
-  assert(task, "implement-task must exist");
-  assertStringIncludes(task![0], "resolvedArtifacts", "the bound pkg@version is threaded into the slice prompt");
+test("the bound resolvedArtifacts version rides the implement cell's appendPrompt", () => {
+  // The per-wave implement/escalation segment is composed into `implement-cell` (ADR 0006 S4), so the
+  // bound `pkg@version`s ride the MI `implement-cell` callActivity's ioMapping into the cell, whose
+  // `implement-task` threads them into the slice prompt's appendPrompt.
+  const call = flat.match(/<bpmn:callActivity\b[^>]*\bid="implement-cell-call"[\s\S]*?<\/bpmn:callActivity>/);
+  assert(call, "the implement-cell callActivity must exist");
+  assertStringIncludes(call![0], "resolvedArtifacts", "the bound pkg@version is threaded into the cell's slice prompt");
+  const cell = readFileSync("resources/processes/implement-cell.bpmn", "utf8").replace(/\s+/g, " ");
+  const task = cell.match(/<bpmn:serviceTask\b[^>]*\bid="implement-task"[\s\S]*?<\/bpmn:serviceTask>/);
+  assert(task, "implement-cell must own the implement-task");
+  assertStringIncludes(task![0], "resolvedArtifacts", "the cell's implement-task appendPrompt consumes the bound pkg@version");
 });

package/app/service.ts

@@ -2782,22 +2782,36 @@ export async function pollUserTasks(
       await project(t.elementId, t.userTaskKey, t.processInstanceKey, t.rootProcessInstanceKey, t.formKey);
     }
   } else {
-    // Reduced-capability fallback (no raw-REST surface): typed-seam per-active-subject scan, tracked-only.
-    // The typed `openUserTasks` seam carries no parent/root key, so a child-instance task cannot be
-    // correlated here — this path reaches a task only THROUGH the tracked subject whose OWN instance it
-    // parks on (root correlation is a no-op, passed as "").
+    // Reduced-capability fallback (no raw-REST surface): typed-seam per-active-subject scan. The typed
+    // seam now carries the parent/root keys (`@nanobpm/urban` ≥ 0.90 / `@nanobpm/engine-wasm` ≥ 0.8.6,
+    // Magikcraft/nano-bpm#977), so — unlike the pre-#646 tracked-only path — a task parked inside a
+    // callActivity CHILD instance (the shared `human-escalation`/`implement-cell` cells, ADR 0006 S4)
+    // correlates back to this tracked subject too: each subject instance is scanned BOTH directly (its
+    // own top-level escalations) AND across its whole callActivity hierarchy via the `rootProcessInstanceKey`
+    // filter (its native-child cell escalations), so an `implement-cell` → `human-escalation` grandchild
+    // escalation surfaces on this path exactly as it does on the raw-REST sweep (issue #633/#646). Deduped
+    // by `userTaskKey` in `project`, so the direct + hierarchy passes never double-project a shared task.
     const seen = new Set<string>();
     const scanInstance = async (processKey: string | null | undefined) => {
       if (!processKey || seen.has(processKey)) return;
       seen.add(processKey);
-      let tasks: { userTaskKey: string; elementId?: string; formKey?: string }[];
+      let direct: { userTaskKey: string; elementId?: string; formKey?: string }[];
+      let hierarchy: { userTaskKey: string; elementId?: string; processInstanceKey?: string; rootProcessInstanceKey?: string; formKey?: string }[];
       try {
-        tasks = await engine.openUserTasks({ processInstanceKey: processKey });
+        [direct, hierarchy] = await Promise.all([
+          engine.openUserTasks({ processInstanceKey: processKey }),
+          engine.openUserTasks({ rootProcessInstanceKey: processKey }),
+        ]);
       } catch (err) {
         console.error(`[poller] user tasks (${processKey}): ${err}`);
         return;
       }
-      for (const t of tasks) await project(t.elementId, t.userTaskKey, processKey, "", t.formKey ?? "");
+      // Direct tasks park on the subject's OWN instance, so their process/root instance IS `processKey`.
+      for (const t of direct) await project(t.elementId, t.userTaskKey, processKey, processKey, t.formKey ?? "");
+      // Hierarchy tasks carry their own (child) `processInstanceKey` and the shared `rootProcessInstanceKey`
+      // (= this subject) the engine reports, so `contextFor` correlates the child-instance task to the
+      // tracked subject via the root rather than stranding it as an orphan.
+      for (const t of hierarchy) await project(t.elementId, t.userTaskKey, t.processInstanceKey ?? processKey, t.rootProcessInstanceKey ?? processKey, t.formKey ?? "");
     };
     for (const status of FEATURE_ACTIVE_STATUSES) for (const run of await featureRuns(data).find({ status })) await scanInstance(run.process_key);
     for (const status of PLAN_ACTIVE_STATUSES) for (const plan of await plans(data).find({ status })) await scanInstance(plan.process_key);
@@ -2867,27 +2881,32 @@ export async function pollUserTasks(
     // element inside a DESCENDANT instance that the parent's `openUserTasks` never reports. Confirming
     // the parent alone would read "no escalation open" and wrongly flip a genuinely-parked child-cell run
     // back to `running` whenever THIS pass's sweep missed it (truncated/unavailable, so it is absent from
-    // `desired`). Include the callActivity descendants when the raw-REST surface is available; the
-    // reduced-capability seam (no `rest`) cannot walk the hierarchy, so it stays parent-only (child-cell
-    // correlation is a no-op on that path anyway). Any per-instance query error is negative evidence, not
-    // proof the run is unparked — skip the heal and leave the row for a later pass (parity with before).
-    const confirmInstances = [run.process_key];
-    if (rest) confirmInstances.push(...(await searchDescendantInstanceKeys(rest.base, rest.headers, run.process_key)));
+    // `desired`). The typed seam now carries the parent/root keys (`@nanobpm/urban` ≥ 0.90, #646), so BOTH
+    // surfaces walk the hierarchy: the raw-REST surface enumerates descendant instances, and the
+    // reduced-capability seam (no `rest`) confirms via the `rootProcessInstanceKey` filter — a
+    // root-scoped `openUserTasks` reports every open task across the run's whole tree in one query. Any
+    // query error is negative evidence, not proof the run is unparked — skip the heal and leave the row
+    // for a later pass (parity with before).
     let stillParked = false;
     let queryErrored = false;
-    for (const instanceKey of confirmInstances) {
-      let openTasks: { elementId?: string }[];
-      try {
-        openTasks = await engine.openUserTasks({ processInstanceKey: instanceKey });
-      } catch (err) {
-        console.error(`[poller] escalated-run self-heal (${run.feature_key} @ ${instanceKey}): ${err}`);
-        queryErrored = true;
-        break;
-      }
-      if (openTasks.some((t) => t.elementId === FEATURE_ESCALATION_ELEMENT || t.elementId === HUMAN_ESCALATION_ELEMENT)) {
-        stillParked = true;
-        break;
+    try {
+      if (rest) {
+        const confirmInstances = [run.process_key, ...(await searchDescendantInstanceKeys(rest.base, rest.headers, run.process_key))];
+        for (const instanceKey of confirmInstances) {
+          const openTasks = await engine.openUserTasks({ processInstanceKey: instanceKey });
+          if (openTasks.some((t) => t.elementId === FEATURE_ESCALATION_ELEMENT || t.elementId === HUMAN_ESCALATION_ELEMENT)) {
+            stillParked = true;
+            break;
+          }
+        }
+      } else {
+        // Reduced path: one root-scoped query covers the parent AND every callActivity descendant.
+        const openTasks = await engine.openUserTasks({ rootProcessInstanceKey: run.process_key });
+        stillParked = openTasks.some((t) => t.elementId === FEATURE_ESCALATION_ELEMENT || t.elementId === HUMAN_ESCALATION_ELEMENT);
       }
+    } catch (err) {
+      console.error(`[poller] escalated-run self-heal (${run.feature_key} @ ${run.process_key}): ${err}`);
+      queryErrored = true;
     }
     if (queryErrored || stillParked) continue;
     await featureRuns(data).update(run.feature_key, { status: "running", updated_at: at });

package/e2e/agent-answerable.e2e.ts

@@ -1,13 +1,14 @@
 // End-to-end proof for agent-answerable escalations (epic #156, slice U6; ADR 0046). Boots the whole
 // app against the WASM engine and drives the REAL plan-fanout.bpmn to the implementation-phase task
-// escalation — the native `feature-escalation` userTask + form the human path (U2) completes — then
+// escalation — the native `escalation` userTask (formId `feature-escalation`) on the `human-escalation`
+// grandchild the shared implement-cell spawns, which the human path (U2) completes — then
 // completes it through the HOST-SIDE AGENT COMPLETER (`completeEscalationAsAgent`) instead of a raw
 // human completion. It proves the three things U6 promises:
 //
 //   1. an AGENT assignee completing the SAME `.form` resumes the process with typed vars IDENTICAL to
 //      a human completion — asserted on the cumulative taken sequence flows: `{resolution:"answer"}`
-//      routes `w_gw_answer -> implement-task`, exactly as the U2 human test asserts (an empty/wrong
-//      completion would take the abandon default);
+//      routes `ic_gw_answer -> record-implementing -> implement-task`, exactly as the U2 human test
+//      asserts (an empty/wrong completion would take the abandon default);
 //   2. attribution is recorded — the `task_completions` ledger row is actor_kind=agent + the agent id
 //      + the submitted variables;
 //   3. the completion is reversible — a human reverts it, and the ledger records who + when.
@@ -111,7 +112,9 @@ describe("agent-answerable escalations (U6 — same form, agent completer, attri
   }
 
   async function openTask(app: TestApp, processKey: string, elementId: string): Promise<InboxTask> {
-    const tasks = await app.engine.searchUserTasks({ processInstanceKey: processKey });
+    // Root-scoped: after the ADR 0006 S4 composition the escalation user task parks on a
+    // `human-escalation` grandchild instance the shared `implement-cell` spawns, not on the parent.
+    const tasks = await app.engine.searchUserTasks({ rootProcessInstanceKey: processKey });
     const match = tasks.find((t) => t.elementId === elementId);
     assert.ok(match, `expected an open ${elementId} user task (open: ${tasks.map((t) => t.elementId).join(", ")})`);
     return match!;
@@ -134,8 +137,8 @@ describe("agent-answerable escalations (U6 — same form, agent completer, attri
         },
       },
       async ({ app, processKey }) => {
-        const task = await openTask(app, processKey, "feature-escalation");
-        assert.ok(task.userTaskKey, "the feature escalation carries a completable userTaskKey");
+        const task = await openTask(app, processKey, "escalation");
+        assert.ok(task.userTaskKey, "the human-escalation cell task carries a completable userTaskKey");
 
         // Complete AS AN AGENT through the host-side completer — the same typed `{resolution, answer}`
         // a human submits through the inbox, only the caller differs.
@@ -145,18 +148,18 @@ describe("agent-answerable escalations (U6 — same form, agent completer, attri
           variables: { resolution: "answer", answer: "use v2" },
         });
         assert.equal(r.ok, true, "the agent completer accepted the escalation completion");
-        assert.equal(r.elementId, "feature-escalation");
+        assert.equal(r.elementId, "escalation");
         await app.settle();
 
         // IDENTICAL resume to the human path (mirrors U2's human test): the typed resolution loops
-        // the child back to re-dispatch the SAME task — NOT the abandon default.
+        // the cell back to re-dispatch the SAME task through its implementing-reset — NOT the abandon default.
         const flows = takenFlows(app);
         assert.ok(
-          flows.includes("w_gw_answer->implement-task"),
-          `agent answer routed back to implement-task (flows: ${flows.join(", ")})`,
+          flows.includes("ic_gw_answer->record-implementing") && flows.includes("record-implementing->implement-task"),
+          `agent answer routed back to implement-task through the cell reset (flows: ${flows.join(", ")})`,
         );
         assert.ok(
-          !flows.includes("w_gw_answer->w_end"),
+          !flows.includes("ic_gw_answer->ic_end"),
           "the abandon (default) flow was NOT taken",
         );
 
@@ -168,7 +171,7 @@ describe("agent-answerable escalations (U6 — same form, agent completer, attri
         const row = completions[0];
         assert.equal(row.actor_kind, "agent");
         assert.equal(row.actor_id, "senior:answer-bot");
-        assert.equal(row.element_id, "feature-escalation");
+        assert.equal(row.element_id, "escalation");
         assert.deepEqual(JSON.parse(row.variables_json), { resolution: "answer", answer: "use v2" });
         assert.equal(row.reversible, 1, "an agent completion is reversible");
         assert.equal(row.reverted, 0);

package/e2e/feature-preflight.e2e.ts

@@ -158,8 +158,9 @@ describe("single-issue feature intake readiness gate (feature.bpmn, issue #295)"
       );
       assert.ok(
         flows.includes("ensure-base-branch->record-feature-implementing") &&
-          flows.includes("record-feature-implementing->implement-task"),
-        `the run reaches the implement agent only after the gate (flows: ${flows.join(", ")})`,
+          flows.includes("record-feature-implementing->implement") &&
+          flows.includes("Start->implement-task"),
+        `the run reaches the implement agent (via the implement cell) only after the gate (flows: ${flows.join(", ")})`,
       );
       // A green probe never escalates.
       const tasks = await app.engine.searchUserTasks({ processInstanceKey });
@@ -190,8 +191,9 @@ describe("single-issue feature intake readiness gate (feature.bpmn, issue #295)"
       );
       assert.ok(!flows.includes("gw-readiness->readiness-preflight"), "an ungated feature never enters the preflight");
       assert.ok(
-        flows.includes("record-feature-implementing->implement-task"),
-        "an ungated feature reaches the implement agent",
+        flows.includes("record-feature-implementing->implement") &&
+          flows.includes("Start->implement-task"),
+        "an ungated feature reaches the implement agent (via the implement cell)",
       );
     } finally {
       await app.stop();

package/e2e/feature-run.e2e.ts

@@ -3,8 +3,9 @@
 //   • raise-only — the agent opens a PR, `converge` is off → the run ends at `opened`, no hand-off;
 //   • raise + converge — with `converge` on, the opened PR is enrolled into the convergence loop
 //     (a `pull_requests` row appears) and the feature_run lands `converging`;
-//   • escalate + resume — the agent escalates, a native `feature-escalation` user task parks the
-//     run, and answering re-dispatches the SAME implement task (mirrors the epic slice).
+//   • escalate + resume — the agent escalates, the shared implement-cell spawns a `human-escalation`
+//     grandchild whose native `escalation` user task parks the run, and answering re-dispatches the
+//     SAME implement task inside the cell (mirrors the epic slice).
 //
 // The gateway assertions are the falsifiable core: the WASM engine folds a completed instance's
 // variables away, so we assert on the cumulative taken sequence flows (an empty/wrong result takes a
@@ -236,23 +237,26 @@ describe("single-issue feature run (#172 — feature.bpmn)", () => {
       },
       { baseBranch: "epic/e2e" },
       async ({ app, processKey }) => {
-        const tasks = await app.engine.searchUserTasks({ processInstanceKey: processKey });
-        const task = tasks.find((t) => t.elementId === "feature-escalation") as InboxTask | undefined;
-        assert.ok(task?.userTaskKey, "the feature escalation parked a completable native user task");
+        // The escalation user task now lives on a `human-escalation` grandchild instance the shared
+        // `implement-cell` spawns (ADR 0006 S4), so it is found root-scoped, by the cell's `escalation`
+        // element — not `feature-escalation` on the parent (that inline task no longer exists).
+        const tasks = await app.engine.searchUserTasks({ rootProcessInstanceKey: processKey });
+        const task = tasks.find((t) => t.elementId === "escalation") as InboxTask | undefined;
+        assert.ok(task?.userTaskKey, "the human-escalation cell parked a completable native user task on a child instance");
 
         await app.engine.completeUserTask(task!.userTaskKey, { resolution: "answer", answer: "use v2" });
         await app.settle();
 
         const flows = takenFlows(app);
         assert.ok(
-          flows.includes("w_gw_answer->record-feature-implementing"),
-          `answer re-dispatched through the implementing-reset task (flows: ${flows.join(", ")})`,
+          flows.includes("ic_gw_answer->record-implementing"),
+          `answer re-dispatched through the cell's implementing-reset task (flows: ${flows.join(", ")})`,
         );
         assert.ok(
-          flows.includes("record-feature-implementing->implement-task"),
-          `the reset task re-enters the same implement task (flows: ${flows.join(", ")})`,
+          flows.includes("record-implementing->implement-task"),
+          `the reset task re-enters the same implement task inside the cell (flows: ${flows.join(", ")})`,
         );
-        assert.ok(!flows.includes("w_gw_answer->record-feature"), "the abandon (default) flow was NOT taken");
+        assert.ok(!flows.includes("ic_gw_answer->ic_end"), "the abandon (default) flow was NOT taken");
         assert.equal(calls, 2, "the implementation agent was re-dispatched exactly once after the answer");
       },
     );
@@ -289,9 +293,9 @@ describe("single-issue feature run (#172 — feature.bpmn)", () => {
       assert.equal(parked.status, "escalated", "the run parks at escalated while awaiting the answer");
       assert.ok(parked.process_key, "the parked run carries its engine process-instance key");
 
-      const tasks = await app.engine.searchUserTasks({ processInstanceKey: parked.process_key! });
-      const task = tasks.find((t) => t.elementId === "feature-escalation") as InboxTask | undefined;
-      assert.ok(task?.userTaskKey, "the feature escalation parked a completable native user task");
+      const tasks = await app.engine.searchUserTasks({ rootProcessInstanceKey: parked.process_key! });
+      const task = tasks.find((t) => t.elementId === "escalation") as InboxTask | undefined;
+      assert.ok(task?.userTaskKey, "the human-escalation cell parked a completable native user task on a child instance");
 
       await app.engine.completeUserTask(task!.userTaskKey, { resolution: "answer", answer: "use v2" });
       await app.settle();
@@ -315,19 +319,24 @@ describe("single-issue feature run (#172 — feature.bpmn)", () => {
       },
       { baseBranch: "epic/e2e" },
       async ({ app, processKey }) => {
-        const tasks = await app.engine.searchUserTasks({ processInstanceKey: processKey });
-        const task = tasks.find((t) => t.elementId === "feature-escalation") as InboxTask | undefined;
-        assert.ok(task?.userTaskKey, "the feature escalation parked a completable native user task");
+        const tasks = await app.engine.searchUserTasks({ rootProcessInstanceKey: processKey });
+        const task = tasks.find((t) => t.elementId === "escalation") as InboxTask | undefined;
+        assert.ok(task?.userTaskKey, "the human-escalation cell parked a completable native user task on a child instance");
 
         await app.engine.completeUserTask(task!.userTaskKey, { resolution: "abandon" });
         await app.settle();
 
         const flows = takenFlows(app);
         assert.ok(
-          flows.includes("w_gw_answer->record-feature"),
-          `abandon routed to record-feature (flows: ${flows.join(", ")})`,
+          flows.includes("ic_gw_answer->ic_end"),
+          `abandon took the cell's default abandon flow to the task-done end (flows: ${flows.join(", ")})`,
+        );
+        assert.ok(!flows.includes("ic_gw_answer->record-implementing"), "the answer loop was NOT taken");
+        // The abandoned cell completes and the parent routes to its terminal recorder exactly once.
+        assert.ok(
+          flows.includes("implement->record-feature"),
+          `the completed cell routes the parent to record-feature (flows: ${flows.join(", ")})`,
         );
-        assert.ok(!flows.includes("w_gw_answer->record-feature-implementing"), "the answer loop was NOT taken");
       },
     );
   });
@@ -345,16 +354,19 @@ describe("single-issue feature run (#172 — feature.bpmn)", () => {
       },
       { baseBranch: "epic/e2e" },
       async ({ app, featureKey, processKey }) => {
-        // The `record-feature-escalation` service task runs on the escalated arm (before the user task),
+        // The cell's `record-escalation` service task runs on the escalated arm (before the human task),
         // so the row already carries the flipped status when the run parks, and the agent's question is
         // recorded in the `feature_escalations` audit log the poller reads (issue #332 dropped the
         // denormalised `feature_runs.escalation_question` column).
         const parked = await featureRow(app, featureKey);
         assert.equal(parked.status, "escalated", "the escalated status is surfaced on the read model");
 
-        const tasks = await app.engine.searchUserTasks({ processInstanceKey: processKey });
-        const task = tasks.find((t) => t.elementId === "feature-escalation") as InboxTask | undefined;
-        assert.ok(task?.userTaskKey, "the feature escalation parked a completable native user task");
+        // The escalation parks on a `human-escalation` grandchild instance (ADR 0006 S4), so it is found
+        // root-scoped, by the cell's `escalation` element — the reduced-path poller correlates that
+        // grandchild task back to the feature subject via its rootProcessInstanceKey (real child execution).
+        const tasks = await app.engine.searchUserTasks({ rootProcessInstanceKey: processKey });
+        const task = tasks.find((t) => t.elementId === "escalation") as InboxTask | undefined;
+        assert.ok(task?.userTaskKey, "the human-escalation cell parked a completable native user task on a child instance");
 
         // The poller projects the parked task onto the Tasks inbox `user_tasks` read-model by reading
         // the engine directly, sourcing the question from the `feature_escalations` audit log.
@@ -376,9 +388,9 @@ describe("single-issue feature run (#172 — feature.bpmn)", () => {
 
         const flows = takenFlows(app);
         assert.ok(
-          flows.includes("w_gw_answer->record-feature-implementing") &&
-            flows.includes("record-feature-implementing->implement-task"),
-          `the answer re-dispatched the same implement task through the reset (flows: ${flows.join(", ")})`,
+          flows.includes("ic_gw_answer->record-implementing") &&
+            flows.includes("record-implementing->implement-task"),
+          `the answer re-dispatched the same implement task through the cell's reset (flows: ${flows.join(", ")})`,
         );
         assert.equal(calls, 2, "the implementation agent was re-dispatched exactly once after the answer");