@nanobpm/nano-workforce 0.208.3 → 0.208.5

package/openapi.yaml

@@ -177,23 +177,27 @@ components:
           additionalProperties: false
           description: >-
             The effective merge policy for this PR's run (issue #916). `requested` is the run's merge
-            intent — the canonical positive `autoMerge` process variable on its convergence loop
-            (falling back to the inverse of the legacy `convergeOnly` variable for a loop seeded
-            before `autoMerge` existed, and to the historical default `true` when the instance is
-            unreadable). `enabled` is the deployment's global `NANO_PR_AUTO_MERGE` switch.
+            intent — served from the durable `pull_requests` projection (issue #947) that
+            `submitPr`/`startMerge` stamp, falling back for a pre-projection (legacy) row to the
+            loop's `autoMerge` process variable (then the inverse of the legacy `convergeOnly`
+            variable, then the historical default `true` when the instance is unreadable).
+            `enabled` is the deployment's global `NANO_PR_AUTO_MERGE` switch.
             `effective` is `requested && enabled && !humanApproval` — the run merges with no further
             gate. `blockedBy` names WHY a requested merge will not proceed: `env` (the global switch
             is off) or `human-approval` (parked at the merge-approval task); null when the merge is
-            effective or none was requested (converge-only).
+            effective or none was requested (converge-only). `stale` is the timing-guard marker
+            (issue #947): true when the policy could not be verified and the row was served from
+            the historical default rather than blocking the serve.
           required:
             - requested
             - enabled
             - effective
             - blockedBy
+            - stale
           properties:
             requested:
               type: boolean
-              description: The run's merge intent (the loop's `autoMerge` variable, or the inverse of its legacy `convergeOnly`).
+              description: The run's merge intent (the durable row projection, or the loop's `autoMerge` variable / the inverse of its legacy `convergeOnly` for a pre-projection row).
             enabled:
               type: boolean
               description: The deployment's global NANO_PR_AUTO_MERGE switch.
@@ -205,6 +209,9 @@ components:
               nullable: true
               enum: ["env", "human-approval", null]
               description: Why a requested merge will not proceed; null when effective or converge-only.
+            stale:
+              type: boolean
+              description: True when the policy could not be verified (a legacy row whose fallback engine read failed) and the row was served from the historical default instead of blocking (issue #947).
         incident:
           type: object
           nullable: true

package/operations/listActivePrs.test.ts

@@ -265,7 +265,7 @@ test("issue #936: N active rows cost a constant 3 engine variable reads, not 3N
   );
   // The batch still projects the per-row policy correctly.
   for (const pr of res.body.prs) {
-    assertEquals(pr.merge, { requested: true, enabled: true, effective: true, blockedBy: null });
+    assertEquals(pr.merge, { requested: true, enabled: true, effective: true, blockedBy: null, stale: false });
   }
 });
 
@@ -420,7 +420,7 @@ test("PR #937 r4: a failed probe after a partial batch drops the partial entry (
   } as any;
   const res = (await handler(input(), { ...memApp([prRow936(1)]), engine: failing } as AppApi)) as any;
   assertEquals(res.status, 200);
-  assertEquals(res.body.prs[0].merge, { requested: true, enabled: true, effective: true, blockedBy: null });
+  assertEquals(res.body.prs[0].merge, { requested: true, enabled: true, effective: true, blockedBy: null, stale: true });
 });
 
 test("PR #937 r4: a cut-off instance is recovered with name-filtered (untruncatable) root probes", async () => {
@@ -476,5 +476,209 @@ test("PR #937 r3: a failed BATCH read still degrades every row to the default (n
   } as any;
   const res = (await handler(input(), { ...memApp([prRow936(1)]), engine: failing } as AppApi)) as any;
   assertEquals(res.status, 200);
-  assertEquals(res.body.prs[0].merge, { requested: true, enabled: true, effective: true, blockedBy: null });
+  assertEquals(res.body.prs[0].merge, { requested: true, enabled: true, effective: true, blockedBy: null, stale: true });
+});
+
+// ── Issue #947: /status serves the merge policy from the app's OWN projection — ZERO engine reads ─
+// The #936/#937 batching left /status at 3 engine-wide `searchVariables` pages plus a per-(instance,
+// name) probe for any name cut from its page. On the loaded merlin host (v0.208.1, 9 PRs) the
+// variables search itself takes ~1.4 s and the engine-wide pages silently truncate, so every active
+// row paid probes — ~30 s per serve and a 502 behind the console proxy. The fix for the CLASS: the
+// merge policy is written onto the `pull_requests` row by the writers that already know it
+// (`submitPr` stamps `merge_requested` at submit/reopen and `merge_human_approval` when it gates a
+// live loop; `startMerge` stamps the merge-stage policy), so the hot read path serves it from the
+// app's own DB and never touches the engine. A NULL `merge_requested` marks a row written before
+// this projection existed; only those legacy rows fall back to the #937 batched engine read.
+
+/** A PR row carrying the durable merge-policy projection (issue #947): the shape every writer
+ *  stamps from this fix on, so /status never pays an engine round-trip for it. */
+function prRow947(n: number, over: Record<string, unknown> = {}) {
+  return { ...prRow936(n), merge_requested: 1, merge_human_approval: 0, ...over };
+}
+
+/** An engine double that counts calls and fails the test if it is read at all. */
+function countingEngine(rows: { name: string; value: string; processInstanceKey: string; scopeKey: string }[] = []) {
+  const queries: { processInstanceKey?: string; scopeKey?: string; name?: string }[] = [];
+  return {
+    queries,
+    searchVariables: async (q: { processInstanceKey?: string; scopeKey?: string; name?: string }) => {
+      queries.push(q);
+      return rows
+        .filter(
+          (r) =>
+            (q.processInstanceKey == null || r.processInstanceKey === q.processInstanceKey) &&
+            (q.scopeKey == null || r.scopeKey === q.scopeKey) &&
+            (q.name == null || r.name === q.name),
+        )
+        .slice(0, 10);
+    },
+  } as any;
+}
+
+test("issue #947: N policy-stamped rows cost ZERO engine reads — /status serves its own projection", async () => {
+  // Red against the pre-fix shape: `activePrs` consulted the engine for every row, so this fails
+  // with 3N+ calls. Green when the merge policy is served from the `pull_requests` projection.
+  const N = 9; // the merlin fleet size that took 29.6 s
+  const rows = Array.from({ length: N }, (_, i) => prRow947(i + 1));
+  const engine = countingEngine();
+  const started = Date.now();
+  const res = (await handler(input(), { ...memApp(rows), engine } as AppApi)) as any;
+  const elapsed = Date.now() - started;
+  assertEquals(res.status, 200);
+  assertEquals(res.body.count, N);
+  assertEquals(
+    engine.queries.length,
+    0,
+    "a row whose merge policy is projected on the pull_requests row never costs an engine round-trip",
+  );
+  assert(
+    elapsed < 1000,
+    `the projected read serves ${N} rows in well under the 2 s acceptance budget (took ${elapsed} ms)`,
+  );
+  for (const pr of res.body.prs) {
+    assertEquals(pr.merge, { requested: true, enabled: true, effective: true, blockedBy: null, stale: false });
+  }
+});
+
+test("issue #947: the projected policy drives requested/blockedBy per row (review-only + approval gate)", async () => {
+  const rows = [
+    prRow947(1, { merge_requested: 0, merge_human_approval: 0 }), // review-only
+    prRow947(2, { merge_requested: 1, merge_human_approval: 1 }), // parked at merge-approval
+    prRow947(3, { merge_requested: 1, merge_human_approval: null }), // gated, approval outstanding
+    prRow947(4, { merge_requested: 1, merge_human_approval: 0 }), // approved / never gated
+  ];
+  const engine = countingEngine();
+  const res = (await handler(input(), { ...memApp(rows), engine } as AppApi)) as any;
+  assertEquals(engine.queries.length, 0);
+  const byKey = (k: string) => res.body.prs.find((p: any) => p.prKey === k).merge;
+  assertEquals(byKey("o/r#1"), { requested: false, enabled: true, effective: false, blockedBy: null, stale: false });
+  assertEquals(byKey("o/r#2"), { requested: true, enabled: true, effective: false, blockedBy: "human-approval", stale: false });
+  assertEquals(byKey("o/r#3"), { requested: true, enabled: true, effective: false, blockedBy: "human-approval", stale: false });
+  assertEquals(byKey("o/r#4"), { requested: true, enabled: true, effective: true, blockedBy: null, stale: false });
+});
+
+test("issue #947: ONLY legacy (unstamped) rows fall back to the batched engine read — stamped rows never do", async () => {
+  // Expand-and-contract back-compat: a row written before the projection existed carries
+  // `merge_requested: NULL`. It keeps the #937 batched engine read (3 constant calls for the whole
+  // legacy set, never per-row), while its stamped siblings are served from the projection.
+  const rows = [
+    prRow947(1, { merge_requested: 1, merge_human_approval: 0 }), // projected
+    prRow936(2), // legacy: no projection columns
+  ];
+  const engine = countingEngine([
+    v("PI-2", "autoMerge", false),
+    v("PI-2", "convergeOnly", true),
+    v("PI-2", "humanApproval", true),
+  ]);
+  const res = (await handler(input(), { ...memApp(rows), engine } as AppApi)) as any;
+  assertEquals(res.status, 200);
+  assertEquals(
+    engine.queries.length,
+    3,
+    "the legacy fallback stays the constant 3 name-filtered reads — never a per-row fan-out",
+  );
+  const byKey = (k: string) => res.body.prs.find((p: any) => p.prKey === k).merge;
+  assertEquals(byKey("o/r#1"), { requested: true, enabled: true, effective: true, blockedBy: null, stale: false });
+  assertEquals(byKey("o/r#2"), { requested: false, enabled: true, effective: false, blockedBy: null, stale: false });
+});
+
+test("issue #947: a legacy row whose engine read fails degrades to the default, flagged stale", async () => {
+  // The timing guard's stale marker: when the policy cannot be verified (engine unreachable for a
+  // legacy row), the row is served immediately from the historical default and flagged `stale`
+  // rather than blocking the serve.
+  const failing = {
+    searchVariables: async () => {
+      throw new Error("engine unreachable");
+    },
+  } as any;
+  const res = (await handler(input(), { ...memApp([prRow936(1)]), engine: failing } as AppApi)) as any;
+  assertEquals(res.status, 200);
+  assertEquals(res.body.prs[0].merge, { requested: true, enabled: true, effective: true, blockedBy: null, stale: true });
+});
+
+// ── PR #950 review: the legacy fallback is BOUNDED and SELF-HEALING ───────────────────────────────
+test("PR #950 review: truncated pages bound legacy per-instance probes, regardless of legacy row count", async () => {
+  const { MAX_PROBED_LEGACY_INSTANCES } = await import("../app/service.ts");
+  const N = 20; // an upgraded install: every row unstamped
+  const rows = Array.from({ length: N }, (_, i) => prRow936(i + 1));
+  // Every engine-wide page is truncated to nothing, so every legacy instance would need probes.
+  const queries: any[] = [];
+  const engine = {
+    searchVariables: async (q: any) => {
+      queries.push(q);
+      if (q.processInstanceKey == null) return [];
+      return [v(q.processInstanceKey, q.name, q.name === "autoMerge")];
+    },
+  } as any;
+  const res = (await handler(input(), { ...memApp(rows), engine } as AppApi)) as any;
+  assertEquals(res.status, 200);
+  assertEquals(res.body.count, N);
+  assert(
+    queries.length <= 3 + 3 * MAX_PROBED_LEGACY_INSTANCES,
+    `engine calls stay bounded (got ${queries.length} for ${N} legacy rows)`,
+  );
+  const stale = res.body.prs.filter((p: any) => p.merge.stale).length;
+  assertEquals(stale, N - MAX_PROBED_LEGACY_INSTANCES, "unprobed rows degrade to the stale default for this serve");
+});
+
+test("PR #950 review: a legacy row whose policy the engine proved is hydrated onto the projection", async () => {
+  const rows: any[] = [prRow936(1), prRow936(2)];
+  const engine = countingEngine([
+    v("PI-1", "autoMerge", false),
+    v("PI-1", "convergeOnly", true),
+    v("PI-1", "humanApproval", false),
+    v("PI-2", "autoMerge", true), // humanApproval PROVEN absent by its root probe (pre-humanApproval loop)
+    v("PI-2", "convergeOnly", false),
+  ]);
+  const app: any = memApp(rows);
+  const writes: unknown[][] = [];
+  app.data.open = () => ({
+    exec: async (sql: string, params: unknown[]) => {
+      assert(/WHERE "pr_key" = \? AND "process_key" = \? AND "merge_requested" IS NULL$/.test(sql), "guarded write-back");
+      writes.push(params);
+      return { changed: 1 };
+    },
+  });
+  const res = (await handler(input(), { ...app, engine } as AppApi)) as any;
+  assertEquals(res.status, 200);
+  assertEquals(
+    [...writes].sort((a, b) => String(a[2]).localeCompare(String(b[2]))),
+    [
+      [0, 0, "o/r#1", "PI-1"],
+      [1, 0, "o/r#2", "PI-2"],
+    ],
+    "complete reads (incl. proven-absent humanApproval) are written back",
+  );
+});
+
+test("PR #950 review: hydration never overwrites a concurrently stamped approval decision", async () => {
+  const rows: any[] = [prRow936(1)];
+  const engine = countingEngine([v("PI-1", "autoMerge", true), v("PI-1", "humanApproval", true)]);
+  const app: any = memApp(rows);
+  const sqls: string[] = [];
+  app.data.open = () => ({
+    exec: async (sql: string) => {
+      sqls.push(sql);
+      return { changed: 1 };
+    },
+  });
+  await handler(input(), { ...app, engine } as AppApi);
+  assertEquals(sqls.length, 1);
+  assert(/"merge_human_approval" = COALESCE\("merge_human_approval", \?\)/.test(sqls[0]), "approval stamp preserved");
+});
+
+test("PR #950 review: the bounded probe window rotates so unhydratable leading rows cannot starve later rows", async () => {
+  const { MAX_PROBED_LEGACY_INSTANCES } = await import("../app/service.ts");
+  const N = MAX_PROBED_LEGACY_INSTANCES * 3;
+  const rows = Array.from({ length: N }, (_, i) => prRow936(i + 1));
+  const probed = new Set<string>();
+  const engine = {
+    searchVariables: async (q: any) => {
+      if (q.processInstanceKey == null) return [];
+      probed.add(q.processInstanceKey);
+      return []; // nothing provable -> never hydrated, stays in the queue
+    },
+  } as any;
+  for (let i = 0; i < 3; i++) await handler(input(), { ...memApp(rows), engine } as AppApi);
+  assertEquals(probed.size, N, "every legacy row is eventually probed");
 });

package/operations/listActivePrs.ts

@@ -20,11 +20,13 @@ export default defineOperation("listActivePrs", async ({ req }, app) => {
     app.log.warn("listActivePrs rejected: missing/invalid shared secret");
     return { status: 401, body: { error: "unauthorized" } };
   }
-  // Per-phase timing (issue #936): /status regressed to ~13 s (and serialised concurrent callers
-  // into proxy 502s) on an unprofiled per-row engine fan-out. The merge-policy engine read is now
-  // ONE batched call inside `activePrs`, and these phase timings make any future regression
-  // attributable from the logs instead of rediscovered by hand. Debug level: /status is a hot
-  // polling endpoint, so this must not spam info.
+  // Per-phase timing (issue #936, budget raised for #947): /status regressed to ~13 s (and
+  // serialised concurrent callers into proxy 502s) on an unprofiled per-row engine fan-out, then
+  // to ~30 s on merlin when the batched fallback's page-cut probes still scaled with the fleet.
+  // The merge-policy engine read is now served from the app's OWN projection (zero engine reads
+  // for every projected row; the #937 batched read only for legacy rows), and these phase timings
+  // make any future regression attributable from the logs instead of rediscovered by hand. Debug
+  // level: /status is a hot polling endpoint, so this must not spam info.
   const t0 = Date.now();
   const [prs, deliveries] = await Promise.all([activePrs(app.data, app.engine), activeDeliveries(app.data)]);
   const readMs = Date.now() - t0;
@@ -42,7 +44,9 @@ export default defineOperation("listActivePrs", async ({ req }, app) => {
   return { status: 200, body: { count: prs.length, prs, deliveries, version: { version, gitSha } } };
 });
 
-/** The wall-clock budget over which a /status serve is logged as slow (issue #936). The endpoint
- *  targets well under 1 s for a handful of rows; anything past this is a regression signal an
- *  operator can grep for. */
-const STATUS_SLOW_MS = 1_000;
+/** The wall-clock budget over which a /status serve is logged as slow (issue #947: raised from the
+ *  #936 1 s to 5 s — the console-proxy timeout is the hard ceiling this must never approach; the
+ *  acceptance target is 2 s at fleet scale, so 5 s leaves headroom that is still an unmistakable
+ *  regression signal an operator can grep for). The endpoint targets well under 1 s for a handful
+ *  of rows now that the merge policy is served from the app's own projection. */
+const STATUS_SLOW_MS = 5_000;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.208.3",
+  "version": "0.208.5",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",

package/resources/processes/implement-cell.bpmn

@@ -17,8 +17,15 @@
       </nano:shapes>
     </bpmn:extensionElements>
     <bpmn:startEvent id="Start" name="Task">
-      <bpmn:outgoing>ic_toImplement</bpmn:outgoing>
+      <bpmn:outgoing>ic_toSliceBranch</bpmn:outgoing>
     </bpmn:startEvent>
+    <bpmn:serviceTask id="slice-branch" name="Stamp slice branch">
+      <bpmn:extensionElements>
+        <zeebe:taskDefinition type="pr.slice-branch" />
+      </bpmn:extensionElements>
+      <bpmn:incoming>ic_toSliceBranch</bpmn:incoming>
+      <bpmn:outgoing>ic_toImplement</bpmn:outgoing>
+    </bpmn:serviceTask>
     <bpmn:serviceTask id="implement-task" name="Implement (agent)">
       <bpmn:extensionElements>
         <zeebe:taskDefinition type="senior:feature" />
@@ -143,7 +150,8 @@
       <bpmn:incoming>ic_reconciled</bpmn:incoming>
       <bpmn:incoming>ic_abandon</bpmn:incoming>
     </bpmn:endEvent>
-    <bpmn:sequenceFlow id="ic_toImplement" sourceRef="Start" targetRef="implement-task" />
+    <bpmn:sequenceFlow id="ic_toSliceBranch" sourceRef="Start" targetRef="slice-branch" />
+    <bpmn:sequenceFlow id="ic_toImplement" sourceRef="slice-branch" targetRef="implement-task" />
     <bpmn:sequenceFlow id="ic_toGw" sourceRef="implement-task" targetRef="ic_gw" />
     <bpmn:sequenceFlow id="ic_done" name="done" sourceRef="ic_gw" targetRef="ic_end">
       <bpmn:conditionExpression xsi:type="bpmn:tFormalExpression">=status = "opened" or status = "blocked" or status = "skipped"</bpmn:conditionExpression>
@@ -175,149 +183,156 @@
           <dc:Bounds x="81" y="143" width="34" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
-      <bpmndi:BPMNShape id="BPMNShape_implement-task" bpmnElement="implement-task">
+      <bpmndi:BPMNShape id="BPMNShape_slice-branch" bpmnElement="slice-branch">
         <dc:Bounds x="216" y="80" width="100" height="80" />
       </bpmndi:BPMNShape>
+      <bpmndi:BPMNShape id="BPMNShape_implement-task" bpmnElement="implement-task">
+        <dc:Bounds x="416" y="80" width="100" height="80" />
+      </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_ic_gw" bpmnElement="ic_gw" isMarkerVisible="true">
-        <dc:Bounds x="441" y="95" width="50" height="50" />
+        <dc:Bounds x="641" y="95" width="50" height="50" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="431" y="62" width="70" height="28" />
+          <dc:Bounds x="631" y="62" width="70" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_reconcile-implement" bpmnElement="reconcile-implement">
-        <dc:Bounds x="616" y="80" width="100" height="80" />
+        <dc:Bounds x="816" y="80" width="100" height="80" />
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_ic_reconcile_gw" bpmnElement="ic_reconcile_gw" isMarkerVisible="true">
-        <dc:Bounds x="816" y="95" width="50" height="50" />
+        <dc:Bounds x="1016" y="95" width="50" height="50" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="801" y="76" width="81" height="14" />
+          <dc:Bounds x="1001" y="76" width="81" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_escalate" bpmnElement="escalate">
-        <dc:Bounds x="1166" y="80" width="100" height="80" />
+        <dc:Bounds x="1366" y="80" width="100" height="80" />
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_record-escalation" bpmnElement="record-escalation">
-        <dc:Bounds x="966" y="80" width="100" height="80" />
+        <dc:Bounds x="1166" y="80" width="100" height="80" />
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_record-escalation-sla" bpmnElement="record-escalation-sla">
-        <dc:Bounds x="416" y="400" width="100" height="80" />
+        <dc:Bounds x="616" y="400" width="100" height="80" />
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_ic_gw_answer" bpmnElement="ic_gw_answer" isMarkerVisible="true">
-        <dc:Bounds x="1366" y="95" width="50" height="50" />
+        <dc:Bounds x="1566" y="95" width="50" height="50" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1323" y="150" width="56" height="14" />
+          <dc:Bounds x="1523" y="150" width="56" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_record-implementing" bpmnElement="record-implementing">
-        <dc:Bounds x="1516" y="240" width="100" height="80" />
+        <dc:Bounds x="1716" y="240" width="100" height="80" />
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_ic_end" bpmnElement="ic_end">
-        <dc:Bounds x="1548" y="102" width="36" height="36" />
+        <dc:Bounds x="1748" y="102" width="36" height="36" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1493" y="143" width="66" height="14" />
+          <dc:Bounds x="1693" y="143" width="66" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_be_implement_sla" bpmnElement="be_implement_sla">
-        <dc:Bounds x="248" y="142" width="36" height="36" />
+        <dc:Bounds x="448" y="142" width="36" height="36" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="170" y="183" width="72" height="28" />
+          <dc:Bounds x="370" y="183" width="72" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
-      <bpmndi:BPMNEdge id="BPMNEdge_ic_toImplement" bpmnElement="ic_toImplement">
+      <bpmndi:BPMNEdge id="BPMNEdge_ic_toSliceBranch" bpmnElement="ic_toSliceBranch">
         <di:waypoint x="116" y="120" />
         <di:waypoint x="216" y="120" />
       </bpmndi:BPMNEdge>
-      <bpmndi:BPMNEdge id="BPMNEdge_ic_toGw" bpmnElement="ic_toGw">
+      <bpmndi:BPMNEdge id="BPMNEdge_ic_toImplement" bpmnElement="ic_toImplement">
         <di:waypoint x="316" y="120" />
-        <di:waypoint x="441" y="120" />
+        <di:waypoint x="416" y="120" />
+      </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_ic_toGw" bpmnElement="ic_toGw">
+        <di:waypoint x="516" y="120" />
+        <di:waypoint x="641" y="120" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_ic_escalate" bpmnElement="ic_escalate">
-        <di:waypoint x="491" y="120" />
-        <di:waypoint x="616" y="120" />
+        <di:waypoint x="691" y="120" />
+        <di:waypoint x="816" y="120" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="520" y="98" width="67" height="14" />
+          <dc:Bounds x="720" y="98" width="67" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_ic_toReconcileGw" bpmnElement="ic_toReconcileGw">
-        <di:waypoint x="716" y="120" />
-        <di:waypoint x="816" y="120" />
+        <di:waypoint x="916" y="120" />
+        <di:waypoint x="1016" y="120" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_ic_toRecordEscalation" bpmnElement="ic_toRecordEscalation">
-        <di:waypoint x="866" y="120" />
-        <di:waypoint x="966" y="120" />
+        <di:waypoint x="1066" y="120" />
+        <di:waypoint x="1166" y="120" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="883" y="128" width="67" height="14" />
+          <dc:Bounds x="1083" y="128" width="67" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_ic_toEscalate" bpmnElement="ic_toEscalate">
-        <di:waypoint x="1066" y="120" />
-        <di:waypoint x="1166" y="120" />
-      </bpmndi:BPMNEdge>
-      <bpmndi:BPMNEdge id="BPMNEdge_ic_toAnswerGw" bpmnElement="ic_toAnswerGw">
         <di:waypoint x="1266" y="120" />
         <di:waypoint x="1366" y="120" />
       </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_ic_toAnswerGw" bpmnElement="ic_toAnswerGw">
+        <di:waypoint x="1466" y="120" />
+        <di:waypoint x="1566" y="120" />
+      </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_ic_abandon" bpmnElement="ic_abandon">
-        <di:waypoint x="1416" y="120" />
-        <di:waypoint x="1548" y="120" />
+        <di:waypoint x="1616" y="120" />
+        <di:waypoint x="1748" y="120" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1456" y="98" width="53" height="14" />
+          <dc:Bounds x="1656" y="98" width="53" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_ic_retry" bpmnElement="ic_retry">
-        <di:waypoint x="841" y="145" />
-        <di:waypoint x="841" y="280" />
-        <di:waypoint x="1516" y="280" />
+        <di:waypoint x="1041" y="145" />
+        <di:waypoint x="1041" y="280" />
+        <di:waypoint x="1716" y="280" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="846" y="223" width="39" height="14" />
+          <dc:Bounds x="1046" y="223" width="39" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_ic_answerLoop" bpmnElement="ic_answerLoop">
-        <di:waypoint x="1391" y="145" />
-        <di:waypoint x="1391" y="280" />
-        <di:waypoint x="1516" y="280" />
+        <di:waypoint x="1591" y="145" />
+        <di:waypoint x="1591" y="280" />
+        <di:waypoint x="1716" y="280" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1396" y="206" width="49" height="14" />
+          <dc:Bounds x="1596" y="206" width="49" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_ic_done" bpmnElement="ic_done">
-        <di:waypoint x="466" y="145" />
-        <di:waypoint x="466" y="200" />
-        <di:waypoint x="1566" y="200" />
-        <di:waypoint x="1566" y="138" />
+        <di:waypoint x="666" y="145" />
+        <di:waypoint x="666" y="200" />
+        <di:waypoint x="1766" y="200" />
+        <di:waypoint x="1766" y="138" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1000" y="208" width="32" height="14" />
+          <dc:Bounds x="1200" y="208" width="32" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_ic_reconciled" bpmnElement="ic_reconciled">
-        <di:waypoint x="841" y="145" />
-        <di:waypoint x="841" y="180" />
-        <di:waypoint x="1566" y="180" />
-        <di:waypoint x="1566" y="138" />
+        <di:waypoint x="1041" y="145" />
+        <di:waypoint x="1041" y="180" />
+        <di:waypoint x="1766" y="180" />
+        <di:waypoint x="1766" y="138" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1097" y="158" width="53" height="14" />
+          <dc:Bounds x="1297" y="158" width="53" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_ic_slaToEscalate" bpmnElement="ic_slaToEscalate">
-        <di:waypoint x="516" y="440" />
-        <di:waypoint x="1636" y="440" />
-        <di:waypoint x="1636" y="82" />
-        <di:waypoint x="1266" y="82" />
+        <di:waypoint x="716" y="440" />
+        <di:waypoint x="1836" y="440" />
+        <di:waypoint x="1836" y="82" />
+        <di:waypoint x="1466" y="82" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_ic_sla" bpmnElement="ic_sla">
-        <di:waypoint x="266" y="178" />
-        <di:waypoint x="266" y="440" />
-        <di:waypoint x="416" y="440" />
+        <di:waypoint x="466" y="178" />
+        <di:waypoint x="466" y="440" />
+        <di:waypoint x="616" y="440" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="271" y="295" width="70" height="28" />
+          <dc:Bounds x="471" y="295" width="70" height="28" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_ic_reImplement" bpmnElement="ic_reImplement">
-        <di:waypoint x="1516" y="280" />
+        <di:waypoint x="1716" y="280" />
         <di:waypoint x="60" y="280" />
         <di:waypoint x="60" y="60" />
-        <di:waypoint x="266" y="60" />
-        <di:waypoint x="266" y="80" />
+        <di:waypoint x="466" y="60" />
+        <di:waypoint x="466" y="80" />
       </bpmndi:BPMNEdge>
     </bpmndi:BPMNPlane>
   </bpmndi:BPMNDiagram>

package/workers/caps-prepare/worker.test.ts

@@ -60,3 +60,14 @@ test("caps-prepare: a malformed need is dropped — only a valid remainder gates
   );
   assertEquals(mixed.hasNeeds, true, "a valid need still gates even alongside a malformed one");
 });
+
+// Issue #945: caps-prepare runs in the plan-fanout MI body, whose un-declared result keys land on the
+// SHARED epic root — so it must NOT stamp the per-slice branch.create (a sibling would overwrite it).
+// The emitter lives in each implement-cell instance (`pr.slice-branch`) instead.
+test("caps-prepare: does NOT emit the per-slice branch.create (it would leak across MI siblings) (#945)", async () => {
+  const out = await handler(
+    { variables: { planKey: "owner/repo#7", taskId: "t1", needs: [] } } as any,
+    {} as any,
+  );
+  assertEquals(Object.keys(out).filter((k) => k.startsWith("io.nanobpm.agentTask")), []);
+});

package/workers/slice-branch/worker.test.ts

@@ -0,0 +1,31 @@
+// Unit coverage for `pr.slice-branch` (issue #945): the per-slice deterministic `branch.create`,
+// emitted as the FLAT dotted variable the c8ctl harness reads, derived from the ONE canonical
+// `sliceBranchCreate`.
+import { test } from "node:test";
+import { assertEquals } from "#test-assert";
+import { AGENT_TASK_BRANCH_CREATE_VAR, sliceBranchCreate } from "../../app/repoEnvelope.ts";
+import handler from "./worker.ts";
+
+async function run(task: unknown): Promise<Record<string, unknown>> {
+  return (await handler({ variables: { task } } as any, {} as any)) ?? {};
+}
+
+test("slice-branch: stamps feat/<task.id> as the flat dotted branch.create (#945)", async () => {
+  const out = await run({ id: "t1", prompt: "x" });
+  assertEquals(out[AGENT_TASK_BRANCH_CREATE_VAR], "feat/t1");
+  assertEquals(out[AGENT_TASK_BRANCH_CREATE_VAR], sliceBranchCreate("t1"));
+});
+
+test("slice-branch: distinct slices derive distinct branches (sibling isolation is per-instance) (#945)", async () => {
+  const a = await run({ id: "t1" });
+  const b = await run({ id: "t2" });
+  assertEquals(a[AGENT_TASK_BRANCH_CREATE_VAR], "feat/t1");
+  assertEquals(b[AGENT_TASK_BRANCH_CREATE_VAR], "feat/t2");
+});
+
+test("slice-branch: a missing/blank/implausible/non-string id emits nothing (#945)", async () => {
+  for (const task of [undefined, null, "t1", [], {}, { id: "" }, { id: "  " }, { id: "bad..id" }, { id: 7 }]) {
+    const out = await run(task);
+    assertEquals(AGENT_TASK_BRANCH_CREATE_VAR in out, false, `no branch.create for ${JSON.stringify(task)}`);
+  }
+});