muse-crew 0.12.0 → 0.13.1

package/seed/cron-body-template.md

@@ -40,11 +40,13 @@ You are the dispatch trigger for Muse Crew. Run the authoritative dispatcher wor
 4.5. **Parent publish verification (docs/publish-verification.md):** The publisher parks instead of stamping provenance; the parent — this tick, the live root agent — verifies content and stamps. Deterministic code detects, reads back, and certifies; you are only the ferry between the deterministic steps (scan → sensor → verifier).
    - Scan (code): `node {crewHome}/lib/crew-api.js --crew-home {crewHome} scan-verification-pending`
      This atomically claims each verification-pending task (1-hour lease, so a second tick cannot double-verify) and reconciles verified-but-still-parked tasks to `in_progress`. It returns `{ to_verify: [...], reconciled: [...] }`. Log both lists. If the scan exits 2 (e.g. the active release cannot be resolved), log the error loudly and continue — do NOT work around it.
-   - **Read-back (deterministic sensor, 2026-09-15):** no platform inspection tool is needed — `lib/readback-disk.js` reads the platform's on-disk working copy of the artifact source (`~/workspace/ts-spaces/<slug>/`) and emits the machine-readable findings block the verifier parses. For each entry in `to_verify`, resolve the base via `get-provenance` (`source_commit`; the empty-tree sha `4b825dc642cb6eb9a060e54bf8d69288fbee4904` when nothing is stamped yet — a first publish), then run:
+   - **Read-back (deterministic sensor, 2026-09-15):** no platform inspection tool is needed — `lib/readback-disk.js` reads the platform's on-disk working copy of the artifact source (`~/workspace/ts-spaces/<slug>/`) and emits the machine-readable findings block the verifier parses. For each entry in `to_verify`, resolve the base via `get-provenance` (`source_commit`; the empty-tree sha `4b825dc642cb6eb9a060e54bf8d69288fbee4904` when nothing is stamped yet — a first publish):
+     `node {crewHome}/lib/crew-api.js --crew-home {crewHome} get-provenance --json '{"project_id": "<project_id>"}'`
+     (use the entry's `project_id` verbatim), then run:
      `node {crewHome}/lib/readback-disk.js --repo-path "<repo_path>" --commit <commit> --base <base> --slug "<deploy_slug>" --task-id <task_id> > /tmp/readback-<task_id>.txt 2> /tmp/readback-<task_id>.err`
      Use the entry's `repo_path` and `deploy_slug` verbatim. If the sensor exits 0, the result file holds the findings block — hand it to the verify step below. If it exits non-zero, do NOT save or use stdout: log `publish: verification-procedural-error <commit> <first line of the .err file>` and leave the task parked — the next tick retries. A sensor failure is procedural (the read could not be performed), never a content verdict. Do NOT judge content yourself, and do NOT stamp provenance.
-   - **Verify (code):** `node {crewHome}/lib/verify-publish.js --crew-home {crewHome} --task-id <task_id> --commit <commit> --base <base> --repo-path "<repo_path>" --slug "<deploy_slug>" --crew-release <crew_release> --inspection-id <task_id>-disk --result-file /tmp/readback-<task_id>.txt`
-     Pass `--build-agent-id <id>` from the entry's `build_agent_id` when it is present. Use the SAME `<base>` the sensor ran with. The verifier parses the findings, compares mechanically against the base..commit diff, checks supersession, and stamps only on a match. Its terminal verdicts (`publish: verified` → task re-queued; `publish: verification-failed` → stays parked) are final — log them and continue.
+   - **Verify (code):** `node {crewHome}/lib/verify-publish.js --crew-home {crewHome} --task-id <task_id> --commit <commit> --base <base> --repo-path "<repo_path>" --slug "<deploy_slug>" --crew-release <crew_release> --project-id <project_id> --inspection-id <task_id>-disk --result-file /tmp/readback-<task_id>.txt`
+     Pass `--build-agent-id <id>` from the entry's `build_agent_id` when it is present. Use the SAME `<base>` the sensor ran with and the entry's `project_id` verbatim. The verifier parses the findings, compares mechanically against the base..commit diff, checks supersession, and stamps only on a match. Its terminal verdicts (`publish: verified` → task re-queued; `publish: verification-failed` → stays parked) are final — log them and continue.
    - Never stamp provenance from prose. Never infer a verdict from an inspector's summary text. The verify script's machine-checked comparison is the only certification.
 
 5. **Monitor launched workflows until terminal (stay-alive — 2026-09-13):** The platform ties async workflow `agent()` authorization to the launcher's lifetime: if THIS tick ends while a workflow is still running, the workflow's next `agent()` call fails with "subagent bootstrap is no longer authorized" / "subagent reservation owner is terminal". Prevention beats recovery here, so this tick is configured with a 90-minute execution timeout (`timeout_secs: 5400` in seed/crons.json) and you MUST stay alive until every launched run reaches a terminal state. Do not exit early while a launched run is still `running` — your death is what kills it.

package/workflows/bugfix.js

@@ -83,13 +83,18 @@ const SCHEMA_SQL_SRC = crewHome + "/lib/schema.sql";
 const SCHEMA_SQL_PINNED = RUN_LIB + "/schema.sql";
 const COMPUTE_DIFF_SRC = crewHome + "/current/lib/compute-publish-diff.js";
 const COMPUTE_DIFF = RUN_LIB + "/compute-publish-diff.js";
-// The six basenames the pin step must materialize — asserted mechanically
+const CLASSIFY_SURFACE_SRC = crewHome + "/current/lib/classify-surface.js";
+const CLASSIFY_SURFACE = RUN_LIB + "/classify-surface.js";
+// The seven basenames the pin step must materialize — asserted mechanically
 // by workflow code from the verbatim listing, never from agent prose.
 // COMPUTE_DIFF is the deterministic publish-diff computer (room #14,
 // 2026-09-17): the diff is computed by this script, never ferried as an
 // agent JSON string. Pinned like the other publish-critical modules so a
 // mid-run release swap cannot change it under the workflow.
-const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, COMPUTE_DIFF].map(function (p) { return p.split("/").pop(); });
+// CLASSIFY_SURFACE is the surface classifier (room #15, 2026-09-18):
+// crew-api.js statically imports it, so the pin must carry it — a pin
+// without it kills every claim with ERR_MODULE_NOT_FOUND.
+const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, COMPUTE_DIFF, CLASSIFY_SURFACE].map(function (p) { return p.split("/").pop(); });
 
 // Project config — passed by dispatcher, falls back to dashboard defaults
 const projectConfig = inputs.project_config || {};
@@ -273,7 +278,7 @@ function attemptKey(base, reworkCount) {
 function pinLifecycle(key) {
   return agent(
     "Snapshot lifecycle scripts for version pinning.\n" +
-    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + COMPUTE_DIFF_SRC + " " + COMPUTE_DIFF + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
+    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + COMPUTE_DIFF_SRC + " " + COMPUTE_DIFF + " && cp " + CLASSIFY_SURFACE_SRC + " " + CLASSIFY_SURFACE + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
     "Return the verbatim output of the ls -1 command as { \"listing\": \"<verbatim output>\" } and nothing else.",
     { key: key, label: "Pinning lifecycle scripts",
       schema: { type: "object", properties: { listing: { type: "string" } }, required: ["listing"] } }
@@ -544,14 +549,34 @@ function extractMarkerLines(workerText) {
 // builder correctly makes no commit because the deliverable is already on
 // main (a prior merge or hand-repair landed it), it declares
 // `repo_diff: none (already-merged: <sha>)` naming the main commit that
-// carries the work. The sha is hex-only (7-40 chars) so the workflow can
-// interpolate it into the mechanical ancestor check without injection
-// risk. Pure — pinned byte-identical across standard/bugfix/chore.
+// carries the work. Room #16 blocker 11 (2026-09-18): the line anchor
+// missed Wren's mid-paragraph declaration, and the persisted notes truncated
+// the tail — so the anchor is gone and a sha followed by `)`, whitespace, or
+// end-of-string (truncation) is accepted. The sha is hex-only (7-40 chars)
+// so the workflow can interpolate it into the mechanical ancestor check
+// without injection risk; a over-long hex run never matches (the lookahead
+// fails on the extra hex char). Pure — pinned byte-identical across
+// standard/bugfix/chore.
 function extractAlreadyMerged(workerText) {
-  var m = /^repo_diff:\s*none\s*\(already-merged:\s*([0-9a-f]{7,40})\)/im.exec(workerText || "");
+  var m = /repo_diff:\s*none\s*\(already-merged:\s*([0-9a-f]{7,40})(?=[\s)]|$)/i.exec(workerText || "");
   return m ? { sha: m[1].toLowerCase() } : { sha: null };
 }
 
+// Explicit artifact refusal (room #16 blocker 10, 2026-09-18): the rebuild
+// trigger child ends its turn with `ARTIFACT_EDIT_REFUSED: <text>` when
+// artifact_edit explicitly refuses the edit (e.g. the artifact does not
+// exist). A refusal is conclusive negative evidence — the edit provably did
+// NOT go through — distinct from an unconsumed trigger return (unknown).
+// Pure — pinned byte-identical across standard/bugfix/chore.
+// The signal must be the ENTIRE trimmed turn output (not a line within prose):
+// the trigger child is instructed to end its turn with exactly this line and
+// nothing else. A confused child quoting the instructions back in prose must
+// NOT produce a conclusive negative — that degrades to unknown (fail-closed).
+function extractRefusal(workerText) {
+  var m = /^ARTIFACT_EDIT_REFUSED:\s*(.+?)\s*$/.exec(String(workerText || "").trim());
+  return m ? m[1].slice(0, 300) : null;
+}
+
 // Worktree confinement: the Build agent must declare the exact worktree
 // path it built in on a `worktree:` marker line. The workflow compares it
 // against WORKTREE_HINT mechanically (exact string match) — never by
@@ -1373,23 +1398,40 @@ while (i < STEPS.length) {
   } else if (step.name === "Review") {
     // Already-merged hydration: when this run did not execute Build itself
     // (dispatcher resume at Review after a platform death between phases),
-    // recover the workflow-attested verification from the latest completed
-    // Build session notes. The `already_merged_verified:` line was written
-    // by the workflow after a mechanical ancestor check — it is trusted;
-    // the builder's bare declaration never is. Absent the line, the
-    // mechanical fact below reads "none declared" and Cass fails closed.
+    // recover the workflow-verified sha. Room #16 blocker 11: the structured
+    // session field is read FIRST — the `already_merged_verified:` notes line
+    // is only a fallback, because session notes are hard-capped at 3000
+    // chars and a truthful declaration at the report's tail was silently
+    // truncated. The structured value was written by the workflow after a
+    // mechanical ancestor check — it is trusted; the builder's bare
+    // declaration never is. Absent both, the mechanical fact below reads
+    // "none declared" and Cass fails closed. The hydration read is best-effort:
+    // a transport throw degrades to "none declared" rather than crashing Review.
     if (!alreadyMergedSha) {
-      var hydNotes = await agent(
-        "Read the latest completed Build session notes for task " + taskId + ".\n" +
-        "Run in shell and return the stdout verbatim:\n" + crewCmd("get-state", { events_limit: 1 }) + "\n" +
-        "In the returned sessions array, find the most recent session (by started_at) with task_id \"" + taskId + "\", step \"Build\", and status \"completed\". Return ONLY its notes field, verbatim, with no commentary.",
-        { key: "hydrate-already-merged" + (totalReworkCount > 0 ? "-r" + totalReworkCount : ""), label: "Hydrating already-merged verification" }
-      );
-      var hydStr = (typeof hydNotes === "string") ? hydNotes : JSON.stringify(hydNotes);
-      var hvm = /already_merged_verified:\s*([0-9a-f]{7,40})/i.exec(hydStr);
-      if (hvm) {
-        alreadyMergedSha = hvm[1].toLowerCase();
-        log("Hydrated already-merged verification from Build session notes: " + alreadyMergedSha);
+      var hydResult = null;
+      try {
+        hydResult = await agent(
+          "Read the latest completed Build session for task " + taskId + ".\n" +
+          "Run in shell and return the stdout verbatim:\n" + crewCmd("get-state", { events_limit: 1 }) + "\n" +
+          "In the returned sessions array, find the most recent session (by started_at) with task_id \"" + taskId + "\", step \"Build\", and status \"completed\". Return exactly two sections, verbatim, with no commentary:\n" +
+          "SHA: <the session's already_merged_sha field value, or the word null when it is null>\n" +
+          "NOTES:\n<the session's notes field, verbatim>",
+          { key: "hydrate-already-merged" + (totalReworkCount > 0 ? "-r" + totalReworkCount : ""), label: "Hydrating already-merged verification" }
+        );
+      } catch (hydErr) {
+        log("Hydration read failed (" + String(hydErr && hydErr.message || hydErr) + "); treating as none declared.");
+      }
+      var hydStr = hydResult ? ((typeof hydResult === "string") ? hydResult : JSON.stringify(hydResult)) : "";
+      var hydSha = /^SHA:\s*([0-9a-f]{7,40})\s*$/im.exec(hydStr);
+      if (hydSha) {
+        alreadyMergedSha = hydSha[1].toLowerCase();
+        log("Hydrated already-merged verification from structured session field: " + alreadyMergedSha);
+      } else {
+        var hvm = /already_merged_verified:\s*([0-9a-f]{7,40})/i.exec(hydStr);
+        if (hvm) {
+          alreadyMergedSha = hvm[1].toLowerCase();
+          log("Hydrated already-merged verification from Build session notes (fallback): " + alreadyMergedSha);
+        }
       }
     }
     instructions = "Review independently and cold. You have NOT seen any reasoning from the builder.\nDo NOT access the task dashboard, event log, or any comments. Your review is based solely on the spec and the code.\n\n" +
@@ -1532,6 +1574,85 @@ while (i < STEPS.length) {
         // Skipped entirely when no lock was held — nothing merged, nothing
         // to ship.
         if (!publishSkippedNoLock) {
+        // The trigger key of the attempt that last ran, for the publish ledger.
+        // Minted once here (not re-minted per use site) so the ledger always
+        // records the exact key that was issued — and so a re-minted duplicate
+        // can never drift from it. Defined before the preflight so pre-trigger
+        // parks (room #16 blocker 10) record the same attempt key.
+        var rebuildAttemptKey = attemptKey("publish-artifact-rebuild-" + taskId, totalReworkCount);
+        // STEP 0.5 (mechanical, room #16 blocker 10): assert the artifact
+        // target exists before any artifact_status / artifact_edit call. The
+        // project was classified as an artifact surface (deploy_slug set),
+        // but setup never provisioned the artifact — Publish then entered
+        // the trigger path against a slug with no on-disk target and the
+        // edit failed opaquely ("web artifact <slug> was not found on
+        // disk"), which the ledger could only record as unknown. A missing
+        // target is conclusive negative evidence: the edit provably did NOT
+        // go through, so this parks rejected (not unknown) with the actual
+        // missing path — no trigger issued, no blind retry, no observation
+        // polling. The check is a pure filesystem stat; the path is
+        // workflow-computed, never agent prose. An inconclusive check
+        // (throw / unparseable signal) is fail-closed unknown: without
+        // proof the target exists, no edit is issued. The slug is
+        // interpolated into a shell command — a slug outside [a-zA-Z0-9_-]
+        // (e.g. from a hand-edited space.json) is treated as inconclusive
+        // rather than risking shell injection.
+        var artifactTargetDir = "~/workspace/ts-spaces/" + PUBLISH_SLUG + "/";
+        var preflightSignal = "";
+        var preflightInconclusive = false;
+        // Misconfiguration fast path: artifact surface with no slug is not a
+        // signal problem — it's a project setup defect. Park rejected with a
+        // truthful reason, not "inconclusive."
+        if (!PUBLISH_SLUG) {
+          await recordPublishLedger({
+            commit: mergeCommitForPublish,
+            attempt: rebuildAttemptKey,
+            agent_id: null,
+            applied_report: null,
+            outcome: "rejected",
+            detail: "artifact surface with empty deploy_slug (preflight): the project is classified as artifact but has no deploy_slug — misconfiguration, not a missing artifact. No edit was issued."
+          }, totalReworkCount);
+          return await parkTask("Publish cannot proceed for task " + taskId + ": the project is classified as an artifact surface but has no deploy_slug. This is a project configuration defect — set a deploy_slug for the project, then re-run Publish. Human attention needed.");
+        }
+        if (!/^[a-zA-Z0-9_-]+$/.test(PUBLISH_SLUG)) {
+          preflightInconclusive = true;
+          log("Publish artifact preflight for task " + taskId + ": PUBLISH_SLUG has an unsafe shape — inconclusive, fail-closed");
+        } else try {
+          var preflight = await agent(
+            "Check whether the artifact target directory exists.\n" +
+            "Run in shell: test -d ~/workspace/ts-spaces/" + PUBLISH_SLUG + "/ && echo ARTIFACT_TARGET: present || echo ARTIFACT_TARGET: missing\n" +
+            "Return JSON { \"signal\": \"<the exact ARTIFACT_TARGET line>\" } and nothing else.",
+            { key: attemptKey("publish-artifact-preflight-" + taskId, totalReworkCount), label: "Checking artifact target exists",
+              schema: { type: "object", properties: { signal: { type: "string" } }, required: ["signal"] } }
+          );
+          preflightSignal = String((preflight && preflight.signal) || "");
+        } catch (preflightErr) {
+          preflightInconclusive = true;
+          log("Publish artifact preflight for task " + taskId + " threw (" + (preflightErr && preflightErr.message ? preflightErr.message : preflightErr) + ") — inconclusive, fail-closed");
+        }
+        if (!preflightInconclusive && /ARTIFACT_TARGET:\s*missing/.test(preflightSignal)) {
+          await recordPublishLedger({
+            commit: mergeCommitForPublish,
+            attempt: rebuildAttemptKey,
+            agent_id: null,
+            applied_report: null,
+            outcome: "rejected",
+            detail: "artifact target directory missing (preflight): " + artifactTargetDir + " does not exist — setup never provisioned the artifact for deploy_slug " + PUBLISH_SLUG + ". The edit provably did not go through: no trigger issued, no blind retry"
+          }, totalReworkCount);
+          return await parkTask("Publish cannot proceed for task " + taskId + ": the artifact target directory " + artifactTargetDir + " does not exist. The project is classified as an artifact surface (deploy_slug " + PUBLISH_SLUG + ") but setup never provisioned the artifact — this is conclusive (rejected, not unknown): no edit was issued. Create the artifact via the Muse UI (Publish edits an existing artifact; it never creates one), then re-run init and Publish. Human attention needed.");
+        }
+        if (preflightInconclusive || !/ARTIFACT_TARGET:\s*present/.test(preflightSignal)) {
+          await recordPublishLedger({
+            commit: mergeCommitForPublish,
+            attempt: rebuildAttemptKey,
+            agent_id: null,
+            applied_report: null,
+            outcome: "unknown",
+            detail: "artifact preflight inconclusive (no parsable ARTIFACT_TARGET signal): target existence unproven, so the trigger was NOT issued; unknown parks fail closed with no blind retry"
+          }, totalReworkCount);
+          return await parkTask("Publish cannot proceed for task " + taskId + ": the artifact target preflight was inconclusive (no parsable signal). Target existence is unproven, so no edit was issued and nothing was retried blindly. Human attention needed.");
+        }
+        log("Publish artifact preflight for task " + taskId + ": target " + artifactTargetDir + " present");
         // (below) the diff computation, rebuild trigger, application
         // verification, bounded poll, and provenance stamp. The builder
         // only makes the artifact_edit call and reports the applied
@@ -1548,7 +1669,7 @@ while (i < STEPS.length) {
         // first publish (no provenance stamped yet).
         var EMPTY_TREE_SHA = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
         var provResult = await agent(
-          crewCmd("get-provenance", {}) + "\n" +
+          crewCmd("get-provenance", { project_id: LAUNCH_PROJECT_ID }) + "\n" +
           "Return JSON { \"provenance\": <the CLI's provenance object, or null when nothing is stamped> } and nothing else. Do not interpret it.",
           { key: attemptKey("publish-provenance-base-" + taskId, totalReworkCount), label: "Reading stamped publish base",
             schema: { type: "object", properties: { provenance: { type: ["object", "null"] } }, required: ["provenance"] } }
@@ -1642,14 +1763,10 @@ while (i < STEPS.length) {
           "- After applying, rebuild and deploy.'\n" +
           "Edit-request contract (read carefully):\n" +
           "- Call artifact_edit exactly once with the slug and verbatim_request above. Never retry the edit yourself: if the edit is not accepted, do NOT call artifact_edit again — end your turn.\n" +
+          "- If artifact_edit explicitly refuses the edit (the call is rejected — e.g. the artifact does not exist), do NOT call artifact_edit again: end your turn with exactly one line and nothing else: ARTIFACT_EDIT_REFUSED: <the refusal text, one line>.\n" +
           "- If artifact_edit is not available after the load, do NOT improvise — end your turn.\n" +
           "- You do NOT call setprovenance, artifact_inspect, or post-deploy yourself.\n" +
           "No report is needed: do not return JSON, do not summarize what you did, do not echo the diff. End your turn after the artifact_edit call.\n";
-        // The trigger key of the attempt that last ran, for the publish ledger.
-        // Minted once here (not re-minted per use site) so the ledger always
-        // records the exact key that was issued — and so a re-minted duplicate
-        // can never drift from it.
-        var rebuildAttemptKey = attemptKey("publish-artifact-rebuild-" + taskId, totalReworkCount);
         // The artifact build's agent_id, attributed to this edit by the
         // workflow-owned observation below. The agent_id is the artifact
         // system's in-flight correlation ID (research 2026-09-12):
@@ -1815,9 +1932,27 @@ while (i < STEPS.length) {
         // re-trigger duplicated the edit on 2026-09-12).
         var rebuildTrigger = null;
         try {
-          var triggerResultLength = String(await agent(rebuildPrompt,
-            { key: rebuildAttemptKey, label: "Triggering artifact rebuild" }) || "").length;
-          log("Publish rebuild trigger for task " + taskId + " returned (" + triggerResultLength + " chars; awaited but return intentionally unconsumed)");
+          var triggerText = String(await agent(rebuildPrompt,
+            { key: rebuildAttemptKey, label: "Triggering artifact rebuild" }) || "");
+          log("Publish rebuild trigger for task " + taskId + " returned (" + triggerText.length + " chars; awaited; scanned only for the explicit refusal signal)");
+          // Explicit refusal (room #16 blocker 10): the child ends its turn
+          // with ARTIFACT_EDIT_REFUSED when artifact_edit explicitly refused.
+          // Conclusive negative evidence — the edit provably did NOT go
+          // through — so this parks rejected and skips observation polling.
+          // A missing/unparseable signal is NOT a refusal: it stays unknown
+          // and fail-closed below.
+          var refusalText = extractRefusal(triggerText);
+          if (refusalText) {
+            await recordPublishLedger({
+              commit: mergeCommitForPublish,
+              attempt: rebuildAttemptKey,
+              agent_id: null,
+              applied_report: null,
+              outcome: "rejected",
+              detail: "artifact_edit explicitly refused the edit (parsed ARTIFACT_EDIT_REFUSED signal): " + refusalText + " — conclusive negative: the edit provably did not go through, no observation polling, no blind retry"
+            }, totalReworkCount);
+            return await parkTask("Publish cannot proceed for task " + taskId + ": artifact_edit explicitly refused the edit (" + refusalText + "). This is conclusive (rejected, not unknown): the edit did not go through. Repair or provision the artifact target, then re-run Publish. Human attention needed.");
+          }
         } catch (triggerErr) {
           log("Publish rebuild trigger for task " + taskId + " threw (" + (triggerErr && triggerErr.message ? triggerErr.message : triggerErr) + ") — outcome unknown until observation confirms it; the edit may have gone through");
         }
@@ -2399,7 +2534,7 @@ while (i < STEPS.length) {
     if (PUBLISH_TYPE === "artifact") {
       instructions = "PROVENANCE CHECK (this project publishes to a dashboard artifact).\n" +
         "Provenance is crew-owned state: read it from the Crew API, never from the artifact's own getprovenance action (a different, non-authoritative store).\n" +
-        "Run in shell and return the stdout verbatim:\n" + crewCmd("get-provenance", {}) + "\n" +
+        "Run in shell and return the stdout verbatim:\n" + crewCmd("get-provenance", { project_id: LAUNCH_PROJECT_ID }) + "\n" +
         "If provenance is null, report 'provenance missing — publish did not stamp source/crew release', then end your report with exactly this line: VERDICT: FAIL.\n" +
         "Run: cd " + REPO_PATH + " && git rev-parse HEAD — call this LIVE_HEAD.\n" +
         "Run: test -d " + crewHome + "/releases/<provenance.crew_release> (substitute the real stamped hash; do not run the literal placeholder). If the directory does not exist, report 'provenance mismatch: crew_release [value from get-provenance] not found in release registry', then end your report with exactly this line: VERDICT: FAIL.\n" +
@@ -2944,11 +3079,11 @@ while (i < STEPS.length) {
       // dashboard QA source check).
       try {
         var provRefresh = await agent(
-          "Run in shell and read the stdout JSON:\n" + crewCmd("get-provenance", {}) + "\n" +
+          "Run in shell and read the stdout JSON:\n" + crewCmd("get-provenance", { project_id: LAUNCH_PROJECT_ID }) + "\n" +
           "If the response has no provenance (null), return JSON { \"refreshed\": false, \"reason\": \"no-record\" } and stop. " +
           "Otherwise run: basename $(readlink " + crewHome + "/current) — call this REL; " +
           "run: date -u +%Y-%m-%dT%H:%M:%SZ — call this TS. " +
-          "Then run in shell: node " + CREW_API + " --crew-home " + crewHome + " set-provenance --json '{\"source_commit\":\"<the existing provenance.source_commit value>\",\"crew_release\":\"<REL>\",\"published_at\":\"<TS>\",\"task_id\":\"" + taskId + "\"}' " +
+          "Then run in shell: node " + CREW_API + " --crew-home " + crewHome + " set-provenance --json '{\"project_id\":\"" + LAUNCH_PROJECT_ID + "\",\"source_commit\":\"<the existing provenance.source_commit value>\",\"crew_release\":\"<REL>\",\"published_at\":\"<TS>\",\"task_id\":\"" + taskId + "\"}' " +
           "(substitute the real values; the JSON must be single-quote-wrapped for the shell). " +
           "Return JSON { \"refreshed\": <true if the set-provenance stdout contains ok: true, false otherwise>, \"crew_release\": \"<REL trimmed>\", \"published_at\": \"<TS trimmed>\" } and nothing else.",
           { key: attemptKey("publish-provenance-refresh-" + taskId, totalReworkCount), label: "Refreshing dashboard provenance after crew release",
@@ -3057,8 +3192,12 @@ while (i < STEPS.length) {
     "Update the session and log the event.\n" +
     "Run in shell and return the stdout verbatim:\n" + crewCmd("record-phase", {
       task_id: taskId,
+      // Room #16 blocker 11: the workflow-verified already-merged sha as
+      // structured control state. Only the Build gate sets alreadyMergedSha
+      // (after the mechanical ancestor check); the API validates the shape
+      // and a later write without the field never clears it (COALESCE).
       session: { id: activeSessionId, task_id: taskId, identity: step.identity, step: step.name,
-        status: status, notes: summary },
+        status: status, notes: summary, already_merged_sha: (step.name === "Build" ? alreadyMergedSha : null) },
       event: { task_id: taskId, type: status, identity: step.identity,
         message: step.name + " " + status + " by " + step.identity }
     }),
@@ -3091,6 +3230,15 @@ while (i < STEPS.length) {
       return await parkTask("Exceeded shared rework budget (" + MAX_TOTAL_REWORK + " total rework attempts across Review and QA) after " + step.name + " rejection. Worktree preserved.");
     }
     rejectionNotes = summary;
+    // Already-merged corrective (room #16 blocker 11): when Review rejected
+    // an empty branch but the work is already on main (the workflow verified
+    // the sha), Wren must declare it — not re-implement or re-commit
+    // already-landed work. Scoped to the empty-branch rejection; any other
+    // rejection already carries its own specific notes.
+    if (step.name === "Review" && alreadyMergedSha && /no commits ahead of main/i.test(summary)) {
+      rejectionNotes += "\n\nCORRECTIVE (from the workflow, not the reviewer): the deliverable is already on main — the workflow mechanically verified that " + alreadyMergedSha + " is an ancestor of main. Do NOT re-implement the work and do NOT create a new commit for it. In your Build report, declare exactly: repo_diff: none (already-merged: " + alreadyMergedSha + ") — then end with VERDICT: PASS.";
+      log("Rework corrective appended for task " + taskId + ": already-merged " + alreadyMergedSha + " — Wren must declare, not rebuild");
+    }
     i = BUILD_INDEX;
     log(step.name + " rejected — bouncing to Build (rework #" + totalReworkCount + " of " + MAX_TOTAL_REWORK + ")");
     continue;