@nanobpm/nano-workforce 0.200.4 → 0.200.6

package/app/deliveryRunner.ts

@@ -122,6 +122,10 @@ export interface PreparedDeliveryGraph {
   processDefinitionId: string;
   bpmn: string;
   nodeInputs: Record<string, NodeInput>;
+  /** The per-run token this prepare resolved (`options.runKey` or a fresh random). Surfaced so
+   *  `runDeliveryGraph` seeds the SAME value as a run-root process variable — the reconciliation
+   *  handle a stale-claim relaunch matches a still-running original instance on (issue #852). */
+  runKey: string;
 }
 
 export type PrepareDeliveryResult =
@@ -193,7 +197,7 @@ export async function prepareDeliveryGraph(
     if (element === undefined) continue; // unreachable — resolved covers every node — but keep total.
     nodeInputs[element] = buildNodeInput(node, { runKey, element, ...timeouts, requiredEmits: requiredEmitsByNodeId.get(node.id) ?? EMPTY_REQUIRED_EMITS });
   }
-  return { ok: true, prepared: { processDefinitionId, bpmn, nodeInputs } };
+  return { ok: true, prepared: { processDefinitionId, bpmn, nodeInputs, runKey } };
 }
 
 /** Deploy + start a compiled graph as a running engine-native instance. Idempotent at the DEFINITION
@@ -207,7 +211,7 @@ export async function runDeliveryGraph(
 ): Promise<RunDeliveryResult> {
   const prep = await prepareDeliveryGraph(graph, options);
   if (!prep.ok) return prep;
-  const { processDefinitionId, bpmn, nodeInputs } = prep.prepared;
+  const { processDefinitionId, bpmn, nodeInputs, runKey } = prep.prepared;
 
   await engine.deployResources([{ name: `${processDefinitionId}.bpmn`, content: bpmn, contentType: "application/xml" }]);
   // Per-node repository isolation (#739): the `io.nanobpm.agentTask.repository` envelope is now seeded
@@ -218,10 +222,18 @@ export async function runDeliveryGraph(
   // repository variable is seeded here; the resolution + loud-failure invariant (unresolved agent cell
   // on a non-`repoless` run) and the `repoless`/repo-base conflict guard all live in
   // `injectAgentRepoEnvelopes`, which the prepare step above already ran (throwing before deploy).
+  //
+  // `runKey` IS seeded as a run-root variable (unlike the repo envelope): it is the durable
+  // reconciliation handle a stale-claim relaunch uses to find a still-running ORIGINAL instance of this
+  // run before starting a second one (issue #852 review — thread deliveryGraphRun.ts:180). Every
+  // instance of this content-addressed definition carries its run key, so
+  // `searchProcessInstances({ processDefinitionId, state:"ACTIVE" })` + a `runKey` variable match
+  // identifies the live duplicate a timeout-only reclaim cannot distinguish from a dead claim.
   const { processInstanceKey } = await engine.createInstance({
     processDefinitionId,
     variables: {
       nodeInputs,
+      runKey,
       // Stage 0 transcript correlation (#543): the transcript-endpoint base every agent node's
       // completing worker appends its jobKey-scoped stream to, to emit `transcriptUrl` (see the agent
       // node ioMapping in deliveryGraphCompiler). Seeded once at the run root — the same value for
@@ -233,7 +245,7 @@ export async function runDeliveryGraph(
   // downstream consumers expect a string — coerce (codebase-wide `String(...)` pattern, e.g. app/plan.ts).
   return {
     ok: true,
-    handle: { processDefinitionId, bpmn, nodeInputs, processInstanceKey: String(processInstanceKey) },
+    handle: { processDefinitionId, bpmn, nodeInputs, runKey, processInstanceKey: String(processInstanceKey) },
   };
 }
 

package/app/service.ts

@@ -31,8 +31,9 @@ import { envContract, readEnvOr } from "./contracts.ts";
 import { makeDefaultReadHead } from "./currentHead.ts";
 import { isUniqueConstraintFence } from "./dbFence.ts";
 import { deriveDelivery, EPIC_LIVE_STATUSES, TERMINAL_STATUSES } from "./delivery.ts";
+import { DELIVERY_GRAPH_PROCESS_ID } from "./deliveryGraphCompiler.ts";
 import { sweepExpiredProposals } from "./deliveryGraphProposals.ts";
-import { deliveryGraphRuns, deriveDeliveryPhase, parseHumanLabels } from "./deliveryGraphRun.ts";
+import { deliveryGraphRuns, deriveDeliveryPhase, parseHumanLabels, reconcileOriginalInstanceBeforeRelaunch, reconcileStaleLaunchClaim } from "./deliveryGraphRun.ts";
 import { deliveryHumanContextQuestion, deliveryHumanContextUrl, isDeliveryHumanElement } from "./deliveryHuman.ts";
 import { fleetSupportsDurableResume } from "./durableResume.ts";
 import { deriveEpicPhaseLive, deriveTerminalEpicPhase } from "./epicPhase.ts";
@@ -3049,10 +3050,58 @@ export async function pollTasklessPlanTermination(
  * Scoped to `running` rows (an `awaiting-approval` run has no instance yet), so it stays O(in-flight). */
 export async function pollDeliveryGraphPhase(
   data: DataLayer,
-  engine: Pick<EngineClient, "searchProcessInstances" | "searchUserTasks">,
+  engine: Pick<EngineClient, "searchProcessInstances" | "searchUserTasks" | "searchVariables" | "cancelInstance">,
 ) {
   for (const run of await deliveryGraphRuns(data).find({ status: "running" })) {
-    if (!run.process_key) continue;
+    if (!run.process_key) {
+      // #852: a launch claim that never got an instance key within the TTL died mid-launch (the dispatch
+      // process went down before deploy, so its own `markClaimFailed` never ran). Reconcile it to
+      // `failed` so the cockpit stops showing a phantom in-flight run; a re-dispatch re-claims it. The
+      // flip is a CAS on the snapshot we read (via `reconcileStaleLaunchClaim`), so a claim a concurrent
+      // dispatch has already re-claimed between our `find()` and here is left untouched, never clobbered.
+      // Reconcile-before-retire (issue #852 review — thread deliveryGraphRun.ts:180): the crash may have
+      // happened AFTER `createInstance` succeeded but BEFORE the key was stamped, leaving a LIVE instance
+      // executing this graph's side-effecting nodes. Retiring the row to `failed` and letting a
+      // re-dispatch relaunch would then double-run those nodes. Cancel any still-ACTIVE instance of THIS
+      // run (matched by its seeded `runKey` variable) BEFORE retiring the claim, so the recovery stays
+      // at-most-once. Best-effort: a reconcile read failure must not wedge the pass — log and skip the
+      // retire this pass (the row stays stale-claim `running` and is retried next pass). The definition
+      // id is derived from the row's `digest` (`delivery-graph-<digest>`), NOT the `process_definition_id`
+      // column — that column is stamped only AFTER a successful launch, so it is NULL on exactly the
+      // crashed-mid-launch claim this path exists to recover.
+      //
+      // Fence the engine cancellation with the stale-claim CAS lease (issue #853 review — thread
+      // service.ts:3077): the cancel is passed to `reconcileStaleLaunchClaim` as `finalize`, run INSIDE
+      // the CAS transaction ONLY after the lease flip lands. Two races close:
+      //   • a FRESH `running`/NULL-key claim (still within its TTL) is non-stale, so
+      //     `reconcileStaleLaunchClaim` returns before the flip and the cancel never runs — a legitimate
+      //     just-launched instance (createInstance succeeded, key stamp pending) is never cancelled; and
+      //   • a concurrent dispatch that RE-CLAIMS the row first (refreshing `updated_at`) makes the CAS
+      //     match zero rows, so `finalize` never runs and the live replacement is never cancelled — the
+      //     retire is finalized only for the lease owner, and the lease is non-reclaimable for the
+      //     cancel's duration (the flipped `failed` row fails the dispatch's `status <> 'running'` guard).
+      // Best-effort: a reconcile read failure must not wedge the pass — `finalize` throws, the
+      // transaction rolls back (the row stays stale-claim `running`), we log and skip the retire this
+      // pass, and the next pass retries. A fail-closed `ReconcileConflictError` (an ACTIVE
+      // same-definition instance with no readable run-root `runKey`, e.g. a pre-upgrade legacy original)
+      // takes this same path: the retire is deferred rather than relaunching a possible duplicate.
+      const cancelOriginal = async () => {
+        if (!run.digest) return;
+        const cancelled = await reconcileOriginalInstanceBeforeRelaunch(engine, {
+          runKey: run.run_key,
+          processDefinitionId: `${DELIVERY_GRAPH_PROCESS_ID}-${run.digest}`,
+        });
+        if (cancelled.length > 0) {
+          console.error(`[poller] delivery graph ${run.run_key}: cancelled a still-running original instance before retiring the stale claim: ${cancelled.join(", ")}`);
+        }
+      };
+      try {
+        await reconcileStaleLaunchClaim(data, run, cancelOriginal);
+      } catch (err) {
+        console.error(`[poller] delivery graph ${run.run_key}: reconcile-before-retire failed, leaving the claim for next pass: ${err}`);
+      }
+      continue;
+    }
     const processKey = run.process_key;
     try {
       const [snapshots, parks] = await Promise.all([

package/operations/dispatchDeliveryGraph.test.ts

@@ -15,7 +15,7 @@ import assert from "node:assert/strict";
 import { bootTestApp, type TestApp } from "@nanobpm/urban-testkit";
 import { redactFreeText } from "../app/deliveryGraphCompiler.ts";
 import { deliveryGraphProposals } from "../app/deliveryGraphProposals.ts";
-import { deliveryGraphRuns } from "../app/deliveryGraphRun.ts";
+import { deliveryGraphRuns, LAUNCH_CLAIM_TTL_MS } from "../app/deliveryGraphRun.ts";
 import { isEquivalentReStage, stableProposalRunKey } from "./dispatchDeliveryGraph.ts";
 
 const APP_ROOT = resolve(import.meta.dirname, "..");
@@ -190,6 +190,28 @@ describe("dispatchDeliveryGraph — operator dispatch by staged-proposal digest"
     assert.equal((await deliveryGraphProposals(app.db).get(staged.body.digest))?.status, "dispatched");
   });
 
+  test("#852: a launch claim stranded by a crash mid-launch (running, no process key, past the TTL) does not wedge the proposal — a re-dispatch LAUNCHES it", async () => {
+    const app = await boot();
+    assert.ok(app.api);
+    const api = app.api;
+    const staged = await api.call<{ digest: string }>("compileDeliveryGraph", { body: HUMAN_ONLY });
+    const digest = staged.body.digest;
+    // The merlin state: the claim row + identity were written, then the process died before deploy.
+    const stale = new Date(Date.now() - LAUNCH_CLAIM_TTL_MS - 60_000).toISOString();
+    await deliveryGraphRuns(app.db).insert({
+      run_key: digest, process_key: null, process_definition_id: null, digest, status: "running", side_effecting: 0,
+      node_count: 1, human_node_count: 1, side_effect_count: 0, title: "manual gate", phase: "Running", phase_node_id: null,
+      human_labels: null, created_at: stale, updated_at: stale, acknowledged_at: null,
+    });
+    const res = await api.call<{ ok: boolean; alreadyRunning: boolean; processInstanceKey?: string }>("dispatchDeliveryGraph", {
+      body: { digest, repoless: true },
+    });
+    assert.equal(res.status, 202, JSON.stringify(res.body));
+    assert.equal(res.body.alreadyRunning, false, "must not short-circuit onto the phantom run");
+    assert.ok(res.body.processInstanceKey, "a real instance was started");
+    assert.equal((await deliveryGraphProposals(app.db).get(digest))?.status, "dispatched");
+  });
+
   test("re-dispatching an ALREADY-dispatched digest → 400 (the proposal is consumed; the run shows in the in-flight grid)", async () => {
     const app = await boot();
     assert.ok(app.api);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.200.4",
+  "version": "0.200.6",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",
@@ -70,7 +70,7 @@
   },
   "devDependencies": {
     "@biomejs/biome": "^2.4.11",
-    "@nanobpm/urban-testkit": "^1.4.0",
+    "@nanobpm/urban-testkit": "^1.6.0",
     "@nanobpm/workflow": "^0.15.0",
     "@semantic-release/changelog": "^7.0.0",
     "@semantic-release/git": "^11.0.0",

package/pages/delivery-graphs/staged.mount.js

@@ -53,6 +53,12 @@ const DEFAULT_REFRESH_MS = 5000;
 // forever, so the busy() lock never clears and the UI is stranded; on timeout the AbortController
 // rejects the fetch, surfacing as an error banner and re-enabling the controls via the finally blocks.
 const REQUEST_TIMEOUT_MS = 30000;
+// The dispatch POST gets its own, much longer budget (#852): the server lays out + deploys the graph
+// before it answers, which for a large graph legitimately takes minutes (54 nodes ≈ 105 s on merlin).
+// Aborting at 30 s showed the operator a failure while the launch was still in flight. Stays bounded so
+// a genuinely hung door still releases the controls. Kept under the server's launch-claim TTL
+// (`LAUNCH_CLAIM_TTL_MS`, 15 min) so the UI never gives up AFTER a crashed launch became re-claimable.
+const DISPATCH_TIMEOUT_MS = 10 * 60_000;
 
 // The confirm shown before a dispatch — dispatching authorises every side-effecting node, so the
 // operator acknowledges that the launch (and its side effects) is content-addressed to this graph.
@@ -273,9 +279,9 @@ export function mountStagedProposals(host, config = {}) {
 
   /** Fetch JSON from a door and return { status, body } (never throws on an HTTP error). Rejects
    * (AbortError) if the request outlives REQUEST_TIMEOUT_MS so a hung door can't wedge the busy lock. */
-  async function request(url, init) {
+  async function request(url, init, timeoutMs = REQUEST_TIMEOUT_MS) {
     const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
     try {
       const res = await fetch(url, { ...init, headers: headers(url), signal: controller.signal });
       let body = {};
@@ -291,7 +297,7 @@ export function mountStagedProposals(host, config = {}) {
   }
 
   const get = (url) => request(url, { method: "GET" });
-  const post = (url, payload) => request(url, { method: "POST", body: JSON.stringify(payload) });
+  const post = (url, payload, timeoutMs) => request(url, { method: "POST", body: JSON.stringify(payload) }, timeoutMs);
 
   let disposed = false;
   // True while the last completed load failed — so a subsequent successful load knows to clear its own
@@ -372,9 +378,9 @@ export function mountStagedProposals(host, config = {}) {
   // the list on the next poll — refresh immediately so the operator sees it leave.
   async function doDispatch(payload) {
     busy(true);
-    setStatus("Dispatching…");
+    setStatus("Dispatching… laying out and deploying the graph — a large graph can take a few minutes.");
     try {
-      const { status, body } = await post(dispatchUrl, payload);
+      const { status, body } = await post(dispatchUrl, payload, DISPATCH_TIMEOUT_MS);
       if ((status === 202 || status === 200) && body.ok) {
         setStatus("\u2713 Dispatched — the run is now in flight.", "ok");
         await refresh();
@@ -382,7 +388,12 @@ export function mountStagedProposals(host, config = {}) {
         setStatus(body && body.error ? body.error : "Dispatch failed.", "err");
       }
     } catch (err) {
-      setStatus(err && err.message ? err.message : "Dispatch request failed.", "err");
+      setStatus(
+        err && err.name === "AbortError"
+          ? "Dispatch is taking longer than expected — it may still be launching. Check Active Delivery Graphs before dispatching again."
+          : err && err.message ? err.message : "Dispatch request failed.",
+        "err",
+      );
     } finally {
       busy(false);
     }

package/resources/prompts/feature.md

@@ -133,6 +133,17 @@ you on the right side of it:
    (`Refs #N` / `Part of #N`) and **leave #N open** (or convert #N into a
    tracking/umbrella issue for the remainder). The classifier flags a PR that
    closes #N while leaving part of #N's stated scope undelivered and untracked.
+   **This rule governs your COMMIT MESSAGES and your PR TITLE too, not just the PR
+   body.** This repo family squash-merges with `COMMIT_MESSAGES`, so a `Closes #N`
+   in **any commit body** closes the issue on merge — even after you correct the PR
+   body to `Part of #N`. The **PR title becomes the squash commit SUBJECT**, so a
+   closing keyword in the title (`fix: parser slice (Closes #N)`) likewise closes #N
+   on merge. A partial slice whose PR body says `Part of #N` but whose first commit —
+   or whose title — still carries `Closes #N` *still* closes the broader parent on
+   merge, and the scope gate scans the title and commit bodies as well as the PR
+   body. So when you split scope, write `Part of #N` (never a closing keyword) in the
+   PR **title**, the PR body, and every commit body; if an early commit already
+   closed it, amend/reword that commit before you push.
 2. **A deferred remainder must be a FILED, tracked issue — never just prose.** If
    your PR defers part of its scope, **file a follow-up issue for each deferred
    item** and link it in the PR body with an explicit tracking marker the classifier

package/resources/prompts/plan.md

@@ -84,10 +84,15 @@ For every distinct child issue number `N` you find:
 - Otherwise, emit **one task** for it (see the output contract), with:
   - `id` = `issue-N`,
   - `title` = the sub-issue's title,
-  - `prompt` = a self-contained brief built from the sub-issue's body, and end
-    the prompt with an explicit instruction to the implementing agent to open its
-    PR against this specific sub-issue and include `Closes #N` in the PR body so
-    the sub-issue is linked and auto-closed on merge.
+  - `prompt` = a self-contained brief built from the sub-issue's body carrying
+    **#N's FULL stated scope** (every acceptance criterion / checkbox of the
+    sub-issue — an adopted sub-issue task owns its whole sub-issue, so the brief
+    must not silently cover only part of it), and end the prompt with an explicit
+    instruction to the implementing agent to open its PR against this specific
+    sub-issue and include `Closes #N` in the PR body so the sub-issue is linked and
+    auto-closed on merge. A closing keyword is only correct because the task
+    delivers #N in full; **never pair `Closes #N` with a brief scoped to a subset
+    of #N** (see "Closing keywords" below).
   - `dependsOn` = **honour any inter-sub-issue ordering the human declared.** Scan
     the sub-issue's body for an explicit dependency directive — a line such as
     `Depends-on: #7`, `Depends on #7`, or `Blocked by #7` (case-insensitive; there
@@ -192,6 +197,58 @@ a cohesive published artifact at the same time. Reserve genuinely separate packa
 for the consumer-facing cases above, and say in the task prompt which consumer
 justifies the split.
 
+### Closing keywords → only a FULL-scope slice may close its issue
+
+When you decompose one issue into several slices, each slice delivers only **part**
+of that issue's acceptance criteria. A slice scoped to a subset of an issue's scope
+**must not be told to close that issue** — that is the exact planning defect this
+rule exists to prevent (a node scoped to one of an issue's three acceptance
+criteria was told to "close" it, the remainder was lost, and a human had to file
+the follow-up and rewrite the PR by hand).
+
+So, when you author each slice's `prompt`:
+
+- **Only instruct a closing keyword (`Closes/Fixes/Resolves #N`) in a slice whose
+  brief delivers #N's FULL stated scope — and say so in an issue-anchored
+  whole-scope phrase the deterministic validator recognises.** If exactly one
+  slice covers the whole issue (the common single-task case), it may close it. If
+  you split the issue across slices, the parent issue is **broader** than any one
+  slice — so **no slice** closes it with a bare brief: instruct each partial slice
+  to reference the parent non-blockingly (`Part of #N` / `Refs #N`) and **leave
+  #N open**, OR designate one final slice that carries the `Closes #N`. That final
+  slice is the exception only when its brief makes it **own and verify #N's
+  COMPLETE stated scope** — every acceptance criterion, not just the remainder.
+  `dependsOn` on the sibling slices orders the merges, but it does **not** by
+  itself make the final slice's brief full-scope: a final slice scoped only to
+  "the remaining criterion" is still a partial brief and must **not** close #N.
+  Scope the final closer to re-verify the whole issue (its brief must direct it to
+  check every checkbox and confirm the siblings' merged work satisfies them)
+  before it emits `Closes #N`.
+  **The validator (`validateDeliveryGraph`) enforces this deterministically:** an
+  `agent.prompt` that closes an issue is rejected unless the brief also carries an
+  explicit **issue-anchored whole-scope acknowledgement TIED TO THE ISSUE IT
+  CLOSES**. Anchor the acknowledgement to the **same** issue — e.g. "delivers #N's
+  full stated scope", "every acceptance criterion of #N", "all of #N", "the whole
+  issue #N". A marker that names a **different** issue than the one you close
+  (acknowledge #11's scope, but `Closes #12`), or one that attributes the scope to
+  **siblings/other slices** ("the full scope of #N is handled by siblings"), does
+  **not** count — the validator credits a whole-scope phrase to issue #N only when it
+  sits in the same clause as #N (or when the prompt references exactly one issue) and
+  is not attributed to others. When a prompt closes more than one issue, give **each**
+  closing target its own anchored acknowledgement. A **bare adverb of completeness does not count** —
+  "fully", "completely", "end-to-end", "in full", "in its entirety" can modify a
+  *partial* deliverable ("implement one criterion fully"), so the validator
+  ignores them; always name the issue's whole scope, not just an adverb.
+- **The remainder must be tracked, never dropped.** Every acceptance criterion of
+  the split issue must be covered by **some** slice in this plan (collectively the
+  slices must deliver #N's whole scope). Do not emit a slice set that silently
+  under-delivers the parent while one slice closes it.
+- **This governs the COMMIT MESSAGES you tell the agent to write, too.** This repo
+  family squash-merges with `COMMIT_MESSAGES`, so a `Closes #N` in **any commit
+  body** closes the issue on merge even if the PR body says `Part of #N`. When a
+  slice is partial, instruct the agent to write `Part of #N` (never a closing
+  keyword) in **both** the PR body and every commit body.
+
 ## Output contract
 
 Write a JSON object of **result variables** to the file named by the

package/resources/prompts/scope-classify.md

@@ -46,13 +46,46 @@ result.
 
 ## What to do
 
-1. **Read the PR body.** `gh pr view <prNumber> --repo <repo> --json body,title`.
+1. **Read the PR body, the PR TITLE, AND the commit bodies.**
+   `gh pr view <prNumber> --repo <repo> --json body,title`.
    Extract every issue the body **closes with a GitHub closing keyword** —
    `close/closes/closed`, `fix/fixes/fixed`, `resolve/resolves/resolved` followed by
-   `#N`, `owner/repo#N`, or a full issue URL. A **non-closing** reference (`Refs #N`,
+   `#N`, `owner/repo#N`, or a full issue URL. GitHub also recognises an **optional colon**
+   between the keyword and its target (`Closes: #12`, `Fixes: owner/repo#12`), so treat the
+   colon form as a closing reference too. A **non-closing** reference (`Refs #N`,
    `Part of #N`, `Depends-on #N`, `Follow-up: #N`) does **not** close an issue —
    ignore those for the closing-scope check (but note the follow-up links; see below).
 
+   **Scan the PR TITLE with these exact same closing-keyword rules too.** This repo
+   family squash-merges, so the **PR title becomes the squash commit SUBJECT**
+   (`AGENTS.md` "PR titles must be Conventional too — they become the release trigger"),
+   and GitHub honours a closing keyword in the squash subject exactly like one in the
+   body or a commit. So a conventional title such as `fix: parser slice (Closes #12)`
+   **closes #12 on merge** even when the body only says `Part of #12` and every commit
+   is clean. Treat a closing keyword found in the **title** exactly like one in the PR
+   body — add its `#N` to the set of closed issues you judge below (and if the slice is
+   partial, tell the human to reword the title to a non-closing form).
+
+   **Then scan the PR's commit messages for the same closing keywords.** Use the
+   **full commit history** — fetch base and head, then
+   `git log --format='%H%n%B' origin/<base>..<head>` (or `git log origin/<base>..<head>`).
+   **Do NOT rely on `gh pr view <prNumber> --repo <repo> --json commits` for this:**
+   the GitHub CLI silently truncates the `commits` field at **100 entries**, so on a
+   101–250-commit PR it can miss an offending `Closes #N` in a later commit and
+   incorrectly clear the scope gate. If you must use the API instead of `git log`,
+   page it explicitly (`gh api --paginate .../pulls/<prNumber>/commits`) rather than
+   the capped `--json commits`. Likewise do **not** use `gh pr diff` here — it returns
+   only the patch, not the commit subjects/bodies, so it cannot detect a closing
+   keyword and would incorrectly clear the PR. This matters because this repo
+   family **squash-merges with `COMMIT_MESSAGES`**: the squash commit concatenates
+   every commit body, so a `Closes #N` left in **any commit body closes #N on
+   merge** even when the PR body was later corrected to `Part of #N`. Treat a
+   closing keyword found in a commit body **exactly** like one in the PR body — add
+   its `#N` to the set of closed issues you judge below. A PR whose body says
+   `Part of #N` but whose commit body still carries `Closes #N`, while part of #N's
+   scope is undelivered and untracked, is a genuine under-delivery you must block
+   (name the offending commit and tell the human to reword/amend it to `Part of #N`).
+
 2. **If there are no closing-keyword issues, the PR closes nothing** — there is no
    broader-scoped parent to under-deliver. Return **`scopeBlocked: false`** and stop.
 

package/scripts/scope-closing-keyword.test.ts

@@ -0,0 +1,139 @@
+// Guard for issue #858: a planner must not scope an agent node to PART of an issue while still
+// telling it to CLOSE that issue, and the scope gate + agent contract must cover COMMIT bodies.
+//
+// Field case (merlin, delivery graph `5e36636255ab`): node `i12`'s prompt said "implement
+// nano-supervisor#12 and open a PR … that closes it", but the body only described one of #12's
+// three acceptance criteria. The agent did exactly that and wrote `Closes #12` in BOTH the PR body
+// and the commit body. The convergence scope gate blocked, but a human still had to file the
+// follow-up and rewrite the PR. The defect was in planning: a node scoped narrower than its issue
+// must not be told to close it. The repo squash-merges with `COMMIT_MESSAGES`, so a `Closes #N` in a
+// commit body closes the issue on merge even after the PR body is corrected — so the agent contract,
+// the planner, and the scope gate must all reason about commit bodies, not just the PR body.
+//
+// These are prompt CONTRACTS (not code paths): the planner (`plan.md`), the implementation agent
+// (`feature.md`), and the scope gate (`scope-classify.md`) are all prompt-driven. This test pins the
+// guidance so a future prompt edit cannot silently drop the guard that closes this failure class.
+import { test } from "node:test";
+import { assert } from "#test-assert";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+const PROMPTS_DIR = join(import.meta.dirname, "..", "resources", "prompts");
+const read = (name: string): string => readFileSync(join(PROMPTS_DIR, name), "utf8");
+
+// The GitHub closing keywords, as the gate/agent must recognise them. A "closing keyword" in prose
+// is any of these; a non-closing ref (`Part of`, `Refs`, `Follow-up`) is explicitly NOT.
+const CLOSING_KEYWORDS = ["close", "fix", "resolve"];
+
+// The closing-keyword SYNTAX each prompt must document for EVERY verb family — the canonical
+// instruction triplet `Closes/Fixes/Resolves` (or the inflected `close/closes/closed …
+// fix/fixes/fixed … resolve/resolves/resolved` listing). Asserting the syntax (not a bare
+// `includes("fix")`, which passes for unrelated reasons) means dropping a family from a contract —
+// e.g. removing `Fixes` — turns the test red instead of leaving it green.
+const CLOSING_SYNTAX = [
+  /closes?\/fixes?\/resolves?/i,
+  /close\/closes\/closed[\s\S]*fix\/fixes\/fixed[\s\S]*resolve\/resolves\/resolved/i,
+];
+
+test("feature.md: the closing-keyword rule covers COMMIT MESSAGES, not just the PR body", () => {
+  const feature = read("feature.md").toLowerCase();
+  // The agent contract must tell the agent a closing keyword in a commit body closes the issue on
+  // merge (the COMMIT_MESSAGES squash concern), so a partial slice must write `Part of #N` in both.
+  assert(
+    feature.includes("commit messages") || feature.includes("commit body") || feature.includes("commit bodies"),
+    "feature.md must tie the closing-keyword rule to commit messages/bodies",
+  );
+  assert(feature.includes("commit_messages"), "feature.md must name the COMMIT_MESSAGES squash behaviour");
+});
+
+test("plan.md: a partial slice must not be told to close its broader-scoped parent issue", () => {
+  const plan = read("plan.md");
+  const lower = plan.toLowerCase();
+  // The decomposition step must carry explicit closing-keyword guidance for split issues.
+  assert(lower.includes("closing keyword"), "plan.md must discuss closing keywords for slices");
+  // A full-scope requirement must gate a closing keyword, and a partial slice must use `Part of #N`.
+  assert(lower.includes("full"), "plan.md must require FULL scope before a slice closes an issue");
+  assert(plan.includes("Part of #N"), "plan.md must steer a partial slice to `Part of #N`");
+  // The planner guidance must also reach commit messages (the COMMIT_MESSAGES squash concern).
+  assert(lower.includes("commit_messages") || lower.includes("commit bod"), "plan.md must cover commit bodies");
+});
+
+test("scope-classify.md: the scope gate scans COMMIT bodies for closing keywords too", () => {
+  const gate = read("scope-classify.md");
+  const lower = gate.toLowerCase();
+  // The gate must read the PR's commits (not only its body) for closing keywords.
+  assert(lower.includes("commit"), "scope-classify.md must mention commits");
+  // It must name the commit body/message as the thing to scan…
+  assert(
+    lower.includes("commit bod") || lower.includes("commit message"),
+    "scope-classify.md must instruct reading commit bodies/messages",
+  );
+  // …AND prescribe an actual FULL-HISTORY retrieval mechanism the contract permits (`git log` or an
+  // explicitly `--paginate`d API call). Merely mentioning "commit bodies" — or the capped, explicitly
+  // FORBIDDEN `--json commits` — is not enough: deleting the real retrieval instruction would leave a
+  // substring-only check green while the gate silently loses its ability to see a `Closes #N` in a
+  // later commit of a >100-commit PR (issue #858 round-5 review).
+  assert(
+    /git\s+log/.test(lower) || lower.includes("--paginate"),
+    "scope-classify.md must prescribe a full-history commit retrieval (`git log` or a `--paginate`d " +
+      "API call), not the capped `--json commits`",
+  );
+  // It must explain WHY: the COMMIT_MESSAGES squash carries a commit-body closing keyword to merge.
+  assert(lower.includes("commit_messages"), "scope-classify.md must name the COMMIT_MESSAGES squash behaviour");
+});
+
+test("scope-classify.md: the scope gate scans the PR TITLE for closing keywords (squash subject)", () => {
+  const gate = read("scope-classify.md");
+  const lower = gate.toLowerCase();
+  // A closing keyword in the PR title becomes the squash commit SUBJECT and closes the issue on merge,
+  // so the gate must scan the title with the same closing-keyword rules as the body/commits — not only
+  // fetch it (issue #858 round-16 review). Pin the instruction, not just the `--json body,title` fetch.
+  assert(lower.includes("title"), "scope-classify.md must reference the PR title");
+  assert(
+    /scan\s+the\s+pr\s+title|title[\s\S]{0,80}closing[- ]keyword|closing[- ]keyword[\s\S]{0,80}title/.test(lower),
+    "scope-classify.md must instruct scanning the PR TITLE with the closing-keyword rules",
+  );
+  // …and explain WHY the title matters: it becomes the squash commit subject.
+  assert(
+    /squash\s+(?:commit\s+)?subject|title\s+becomes\s+the\s+squash/.test(lower),
+    "scope-classify.md must explain the title becomes the squash commit subject",
+  );
+});
+
+test("feature.md: the no-close-on-partial rule also governs the PR TITLE (squash subject)", () => {
+  const lower = read("feature.md").toLowerCase();
+  // The agent authors the PR title, so its contract must warn that a closing keyword there closes the
+  // issue on merge (title -> squash subject), not only the body/commit bodies (issue #858 round-16).
+  assert(lower.includes("title"), "feature.md must reference the PR title in the closing-keyword rule");
+  assert(
+    /title\s+becomes\s+the\s+squash|squash\s+(?:commit\s+)?subject/.test(lower),
+    "feature.md must tie the PR title to the squash commit subject",
+  );
+});
+
+test("all three prompts recognise the full set of GitHub closing keywords", () => {
+  for (const name of ["feature.md", "plan.md", "scope-classify.md"]) {
+    const lower = read(name).toLowerCase();
+    for (const kw of CLOSING_KEYWORDS) {
+      assert(lower.includes(kw), `${name} must reference the closing keyword family "${kw}"`);
+    }
+  }
+});
+
+// Stronger than the substring check above: pin the closing-keyword SYNTAX in each prompt, so a future
+// edit that drops a verb family from the contract (e.g. `Closes/Resolves` with `Fixes` removed) fails
+// loudly instead of staying green because the word "fix" still appears somewhere unrelated.
+test("all three prompts document the closing-keyword SYNTAX for every verb family (close/fix/resolve)", () => {
+  for (const name of ["feature.md", "plan.md", "scope-classify.md"]) {
+    const text = read(name);
+    assert(
+      CLOSING_SYNTAX.some((re) => re.test(text)),
+      `${name} must document the Closes/Fixes/Resolves closing-keyword triplet (or the inflected ` +
+        `close/closes/closed … listing), not merely the bare substrings`,
+    );
+    assert(
+      /\bcloses?\s+#(?:n|\d)/i.test(text),
+      `${name} must show the actionable \`Closes #N\` instruction form`,
+    );
+  }
+});

package/test/delivery-graphs-staged-slow-dispatch.test.ts

@@ -0,0 +1,85 @@
+// #852 — a large graph's dispatch legitimately takes minutes (layout + deploy: ~105 s for 54 nodes on
+// merlin). The staged view aborted EVERY request at a 30 s timeout and rendered the AbortError as the
+// dispatch failure — the operator saw a "crash" while the server was still launching. The dispatch POST
+// must outlive a slow-but-healthy launch (bounded by its own, much longer budget) and tell the operator
+// it is still working.
+import { mock, test } from "node:test";
+import { assert, assertEquals } from "#test-assert";
+import { parseHTML } from "linkedom";
+import { mountStagedProposals } from "../pages/delivery-graphs/staged.mount.js";
+
+const STAGED_URL = "https://app.test/app/api/delivery-graph/staged";
+const DISPATCH_URL = "https://app.test/app/api/actions/delivery-graph/dispatch";
+const PROPOSAL = {
+  digest: "abc123def456",
+  title: "Big graph",
+  sideEffecting: true,
+  nodeCount: 54,
+  humanNodeCount: 2,
+  sideEffectCount: 34,
+  createdAt: "2026-01-01T00:00:00.000Z",
+  expiresAt: "2026-01-02T00:00:00.000Z",
+};
+
+const flush = async () => {
+  for (let i = 0; i < 6; i++) await new Promise((resolve) => setImmediate(resolve));
+};
+
+test("#852: a dispatch slower than the generic 30 s request timeout is NOT aborted — it completes and reports success", async () => {
+  const { window: domWindow, document } = parseHTML("<!doctype html><html><body><div id='host'></div></body></html>");
+  const host = document.getElementById("host");
+  assert(host, "host");
+  let resolveDispatch: (() => void) | undefined;
+  let aborted = false;
+  const origFetch = globalThis.fetch;
+  globalThis.fetch = async (input, init) => {
+    const url = String(input);
+    if (url === STAGED_URL) return new Response(JSON.stringify({ proposals: [PROPOSAL] }), { status: 200 });
+    if (url === DISPATCH_URL) {
+      return await new Promise<Response>((resolve, reject) => {
+        init?.signal?.addEventListener("abort", () => {
+          aborted = true;
+          reject(new DOMException("signal is aborted without reason", "AbortError"));
+        });
+        resolveDispatch = () => resolve(new Response(JSON.stringify({ ok: true, status: "running" }), { status: 202 }));
+      });
+    }
+    return new Response("{}", { status: 404 });
+  };
+  const win = { confirm: () => false, prompt: () => null, location: { href: "https://app.test/delivery-graphs/", origin: "https://app.test" }, parent: undefined as unknown };
+  win.parent = win;
+  const origWindow = Reflect.get(globalThis, "window");
+  Reflect.set(globalThis, "window", win);
+  mock.timers.enable({ apis: ["setTimeout", "setInterval"] });
+  const dispose = mountStagedProposals(host, { stagedUrl: STAGED_URL, dispatchUrl: DISPATCH_URL, refreshMs: 1_000_000_000 });
+  const click = (sel: string) => {
+    const el = host.querySelector(sel);
+    assert(el, `missing ${sel}`);
+    el.dispatchEvent(new domWindow.Event("click", { bubbles: true, cancelable: true }));
+  };
+  try {
+    await flush();
+    click("[data-dispatch]");
+    await flush();
+    click("[data-dispatch-confirm]");
+    await flush();
+    assert(resolveDispatch, "the dispatch POST was sent");
+    // Two minutes of a healthy-but-slow launch (layout + deploy) — well past the old 30 s abort.
+    for (let s = 0; s < 120; s++) {
+      mock.timers.tick(1000);
+      await flush();
+    }
+    assertEquals(aborted, false, "the dispatch request must not be aborted while the server is still launching");
+    const working = host.querySelector(".status")?.textContent ?? "";
+    assert(/dispatching/i.test(working), `the operator is told it is still working, got: ${working}`);
+    resolveDispatch();
+    await flush();
+    const status = host.querySelector(".status")?.textContent ?? "";
+    assert(/dispatched/i.test(status), `expected success, got: ${status}`);
+  } finally {
+    dispose();
+    mock.timers.reset();
+    globalThis.fetch = origFetch;
+    Reflect.set(globalThis, "window", origWindow);
+  }
+});