muse-crew 0.13.3 → 0.14.1

package/workflows/crew-uninstall.js

@@ -17,6 +17,13 @@ const force = inputs.force;
 
 if (!crewHome) throw new Error("crewHome is required — e.g. ~/workspace/.crew");
 
+// sq(p) — single-quote a path for safe interpolation into shell commands the
+// agents run. A bare double-quoted path breaks on spaces, $, backticks, or
+// quotes; single-quote wrapping is always safe.
+function sq(p) {
+  return "'" + String(p).split("'").join("'\\''") + "'";
+}
+
 // ── Pure decision helpers ──────────────────────────────────────────────
 // The agent is a sensor, not a judge: it reports raw facts (HOME, expanded
 // paths, existence, in-progress counts) and the verdicts below are computed
@@ -110,8 +117,8 @@ if (gateFacts.homeExists) {
       "Report whether this crew has live work. Do not judge — just report.\n\n" +
       "crewHome: " + crewHomeExpanded + "\n\n" +
       "Steps (run in shell):\n" +
-      "1. If \"" + crewHomeExpanded + "/crew-state.db\" exists, run:\n" +
-      "   sqlite3 \"" + crewHomeExpanded + "/crew-state.db\" \"SELECT COUNT(*) FROM tasks WHERE state='in_progress';\"\n" +
+      "1. If " + sq(crewHomeExpanded + "/crew-state.db") + " exists, run:\n" +
+      "   sqlite3 " + sq(crewHomeExpanded + "/crew-state.db") + " \"SELECT COUNT(*) FROM tasks WHERE state='in_progress';\"\n" +
       "   Report the number. When the database is missing, the count is 0.\n" +
       "2. Return JSON { homeExists: true, inProgress: <number> }.",
       {
@@ -149,7 +156,7 @@ try {
     "Remove this crew instance's scheduler cron jobs — and nothing else.\n\n" +
     "crewHome: " + crewHomeExpanded + "\n\n" +
     "Steps:\n" +
-    "1. Registry: if \"" + crewHomeExpanded + "/.cron-registry.json\" exists, read it\n" +
+    "1. Registry: if " + sq(crewHomeExpanded + "/.cron-registry.json") + " exists, read it\n" +
     "   and take its crons[].id list as registry candidates.\n" +
     "2. Discovery: call cron_list. For every job whose id starts with 'crew-poll-',\n" +
     "   call cron_view and keep it as a discovery candidate when the job body\n" +
@@ -203,8 +210,29 @@ try {
 if (!cronsResult.passed || !cronsResult.summary || !Array.isArray(cronsResult.summary.removed)) {
   return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Cron removal failed", message: "The cron-removal agent did not pass. No further teardown was attempted; the crew home is untouched." } };
 }
-var removedDesc = cronsResult.summary.removed.map(function (r) { return r.id + "=" + r.action; }).join(", ");
-log("Crons: " + (removedDesc || "(none belonged to this crew)"));
+// ── Razor witness: the removal list above is the agent's report, not a
+// fact. Re-read the cron registry independently and only assert removal for
+// ids the re-read confirms absent. Agent returns are testimony, never
+// evidence. Non-blocking: a surviving id is logged loudly, not asserted away.
+var removedEntries = cronsResult.summary.removed;
+var cronsGone = [], cronsPresent = [], cronsUnverified = [];
+try {
+  var cronListOut = String(await agent(
+    "Call cron_list and return its full output verbatim. Do not summarize, interpret, or filter it.",
+    { key: "uninstall-crons-verify", label: "Re-reading cron registry after removal" }
+  ) || "");
+  removedEntries.forEach(function (r) {
+    if (cronListOut.indexOf(r.id) === -1) { cronsGone.push(r.id); }
+    else { cronsPresent.push(r.id); }
+  });
+} catch (e) {
+  cronsUnverified = removedEntries.map(function (r) { return r.id; });
+}
+var cronBits = [];
+if (cronsGone.length) { cronBits.push("removed (registry re-read confirms gone): " + cronsGone.join(", ")); }
+if (cronsPresent.length) { cronBits.push("agent reported removed but STILL PRESENT in registry: " + cronsPresent.join(", ")); }
+if (cronsUnverified.length) { cronBits.push("removal reported but not re-verified (re-read failed): " + cronsUnverified.join(", ")); }
+log("Crons: " + (cronBits.join("; ") || "(none belonged to this crew)"));
 
 // ── Delete the crew home directory ─────────────────────────────────────
 phase("home");
@@ -217,10 +245,10 @@ if (gateFacts.homeExists) {
       "crewHome: " + crewHomeExpanded + "\n\n" +
       "Steps:\n" +
       "1. Best-effort worktree hygiene (failures do not block): if\n" +
-      "   \"" + crewHomeExpanded + "/crew-state.db\" exists, list the repo_path values\n" +
+      "   " + sq(crewHomeExpanded + "/crew-state.db") + " exists, list the repo_path values\n" +
       "   from its projects table and run 'git worktree prune' in each. Ignore errors.\n" +
-      "2. Run: rm -rf \"" + crewHomeExpanded + "\"\n" +
-      "3. Verify: test ! -e \"" + crewHomeExpanded + "\" — fail closed (passed: false)\n" +
+      "2. Run: rm -rf " + sq(crewHomeExpanded) + "\n" +
+      "3. Verify: test ! -e " + sq(crewHomeExpanded) + " — fail closed (passed: false)\n" +
       "   if the path still exists.\n" +
       "4. Return { passed: true, summary: { removed: true } }.",
       {
@@ -248,8 +276,27 @@ if (gateFacts.homeExists) {
   if (!homeResult.passed || !homeResult.summary || homeResult.summary.removed !== true) {
     return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Crew home removal failed", message: "The crew home could not be deleted. Its crons were already removed; delete " + crewHomeExpanded + " manually." } };
   }
-  homeRemoved = true;
-  log("Crew home deleted: " + crewHomeExpanded);
+  // ── Razor witness: the agent's `removed` flag is testimony, not evidence.
+  // Confirm the directory is actually gone before claiming deletion. Gone is
+  // asserted only when the re-read says DIR_GONE without DIR_PRESENT (the
+  // check command itself names both markers, so requiring the absence of
+  // DIR_PRESENT keeps a mere echo of the command from counting as proof).
+  var homeGone = false;
+  try {
+    var homeCheckOut = String(await agent(
+      "Run in shell and return the stdout verbatim:\ntest -d " + sq(crewHomeExpanded) + " && echo DIR_PRESENT || echo DIR_GONE",
+      { key: "uninstall-home-verify", label: "Re-checking crew home directory after deletion" }
+    ) || "");
+    homeGone = homeCheckOut.indexOf("DIR_GONE") !== -1 && homeCheckOut.indexOf("DIR_PRESENT") === -1;
+  } catch (e) {
+    homeGone = false;
+  }
+  if (homeGone) {
+    homeRemoved = true;
+    log("Crew home deleted: " + crewHomeExpanded + " (directory re-read confirms it is gone)");
+  } else {
+    log("Crew home was reported deleted by the agent, but the directory is still present (or the re-check failed): " + crewHomeExpanded);
+  }
 } else {
   log("Crew home already gone — nothing to delete.");
 }

package/workflows/standard.js

@@ -440,6 +440,7 @@ async function recordPublishLedger(entry, rework) {
       attempt: entry.attempt || null,
       agent_id: entry.agent_id || null,
       applied_report: entry.applied_report || null,
+      manifest_before: entry.manifest_before || null,
       outcome: entry.outcome,
       detail: entry.detail || ""
     });
@@ -453,9 +454,7 @@ async function recordPublishLedger(entry, rework) {
         label: "Recording publish attempt in ledger",
         schema: { type: "object", properties: { result: { type: "string" } }, required: ["result"] } }
     );
-    var ok = !!(res && res.result && res.result.indexOf("LEDGER_OK") !== -1);
-    log("Publish ledger: outcome '" + entry.outcome + "' for task " + taskId +
-      (ok ? " recorded." : " NOT confirmed (" + ((res && res.result) || "no output") + ")"));
+    log("Noted publish outcome '" + entry.outcome + "' for task " + taskId + " in ledger");
   } catch (e) {
     log("Publish ledger: write failed for task " + taskId + " (non-fatal, observability only): " + (e && e.message ? e.message : e));
   }
@@ -1442,20 +1441,36 @@ while (i < STEPS.length) {
         // See docs/decisions/publish-path.md#durable-evidence-snapshot: snapshot the audit-dir listing BEFORE the trigger; fallback diffs before/after.
         var auditDirsBeforeTrigger = [];
         var auditBeforeOk = false;
+        // Pre-trigger baselines (design §1.9): the audit-dir listing and the
+        // manifest snapshot. The verified-path freshness check compares the
+        // post-trigger manifest against the baseline (built_at advance +
+        // content_sha256 change). Best-effort, never gates — a missing
+        // manifest baseline fails the verified path closed.
+        var preTriggerManifest = null;
         try {
           var auditBefore = await agent(
-            "List the artifact audit directories for slug \"" + PUBLISH_SLUG + "\" (best-effort snapshot, never a gate).\n" +
-            "Run: ls -1 ~/workspace/ts-spaces/" + PUBLISH_SLUG + "/audits/ 2>/dev/null\n" +
-            "Return JSON { \"dirs\": \"<newline-separated names, empty string when the audits directory does not exist or is empty>\" } and nothing else.",
-            { key: attemptKey("publish-audit-before-" + taskId, totalReworkCount), label: "Snapshotting audit dirs before rebuild trigger",
-              schema: { type: "object", properties: { dirs: { type: "string" } }, required: ["dirs"] } }
+            "Capture pre-trigger baselines for slug \"" + PUBLISH_SLUG + "\" (best-effort snapshots, never gates).\n" +
+            "Run: ls -1 ~/workspace/ts-spaces/" + PUBLISH_SLUG + "/audits/ 2>/dev/null; echo ---MANIFEST---; cat ~/workspace/ts-spaces/" + PUBLISH_SLUG + "/.space-build/manifest.json 2>/dev/null\n" +
+            "Return JSON { \"dirs\": \"<newline-separated names, empty string when missing>\", \"manifest\": \"<the manifest's full text, or empty string when missing/unreadable>\" } and nothing else.",
+            { key: attemptKey("publish-baseline-before-" + taskId, totalReworkCount), label: "Snapshotting baselines before rebuild trigger",
+              schema: { type: "object", properties: { dirs: { type: "string" }, manifest: { type: "string" } }, required: ["dirs", "manifest"] } }
           );
           auditDirsBeforeTrigger = String((auditBefore && auditBefore.dirs) || "").split("\n").map(function (s) { return s.trim(); }).filter(function (s) { return s.length > 0; });
+          var manifestText = String((auditBefore && auditBefore.manifest) || "").trim();
+          if (manifestText) {
+            var manifestJson = JSON.parse(manifestText);
+            preTriggerManifest = {
+              built_at: typeof manifestJson.built_at === "string" ? manifestJson.built_at : null,
+              content_sha256: typeof manifestJson.content_sha256 === "string" ? manifestJson.content_sha256 : null,
+            };
+          }
+          // Arm only after both baselines parse.
           auditBeforeOk = true;
-          log("Publish audit-dir snapshot before trigger for task " + taskId + ": " + auditDirsBeforeTrigger.length + " entries");
+          log("Publish pre-trigger baselines for task " + taskId + ": " + auditDirsBeforeTrigger.length + " audit dirs, manifest " + (preTriggerManifest ? "built_at=" + preTriggerManifest.built_at : "none"));
         } catch (auditBeforeErr) {
-          log("Publish audit-dir snapshot before trigger failed for task " + taskId + " (non-fatal): audit fallback DISABLED for this attempt — without a baseline, historical dirs would look new: " + (auditBeforeErr && auditBeforeErr.message ? auditBeforeErr.message : auditBeforeErr));
+          log("Publish pre-trigger baselines failed for task " + taskId + " (non-fatal): audit fallback DISABLED for this attempt — without a baseline, historical dirs would look new: " + (auditBeforeErr && auditBeforeErr.message ? auditBeforeErr.message : auditBeforeErr));
         }
+
         // See docs/decisions/publish-path.md#fire-and-forget-trigger: the trigger child returns immediately; the workflow owns observation and verdict.
         var publishToolsOk = false;
         var publishToolsMissing = false;
@@ -1660,6 +1675,7 @@ while (i < STEPS.length) {
             attempt: rebuildAttemptKey,
             agent_id: rebuildAgentId,
             applied_report: publishAppliedObservation,
+            manifest_before: preTriggerManifest,
             outcome: "submitted",
             detail: "fire-and-forget trigger; build receipt captured by workflow-owned build-state observation (pre/post-trigger diff)"
           }, totalReworkCount);
@@ -1730,7 +1746,8 @@ while (i < STEPS.length) {
                 attempt: rebuildAttemptKey,
                 agent_id: null,
                 applied_report: publishAppliedObservation,
-                outcome: "submitted",
+                manifest_before: preTriggerManifest,
+            outcome: "build-observed",
                 detail: "durable audit evidence shows a build completed during the attempt window (no receipt agent_id — attribution by window, not identity; receipt poll bypassed (verdict decided), routed to parent verification)"
               }, totalReworkCount);
               log("Publish verdict LANDED for task " + taskId + ": a completed build was observed during the attempt window — receipt poll bypassed (verdict decided, no receipt to chain to), routing directly to parent verification.");
@@ -2002,7 +2019,8 @@ while (i < STEPS.length) {
                 attempt: rebuildAttemptKey,
                 agent_id: rebuildAgentId,
                 applied_report: publishAppliedObservation,
-                outcome: "submitted",
+                manifest_before: preTriggerManifest,
+            outcome: "build-observed",
                 detail: "durable audit evidence shows a build completed during the attempt window (audit dir " + newestAuditDirAfterPoll + ", report ok=true); routed to parent verification"
               }, totalReworkCount);
             } else if (auditOkAfterPoll === false) {
@@ -2065,11 +2083,11 @@ while (i < STEPS.length) {
           if (!postDeploy.deployed) {
             return await parkTask("Post-deploy failed after a skipped publish: " + (postDeploy.output || "no output") + ". Nothing was published; worktree cleanup and lock state unknown — human attention needed.");
           }
-          log("Publish skipped cleanly for task " + taskId + " (no lock held) — post-deploy finalized cleanup");
+          log("Publish skipped cleanly for task " + taskId + " (no lock held) — post-deploy step finished");
         } else {
           if (publishFailure) {
             return await parkTask(publishFailure + (postDeploy.deployed
-              ? " Post-deploy finalized cleanup."
+              ? " Post-deploy step finished (cleanup status unknown)."
               : " Post-deploy also failed (" + (postDeploy.output || "no output") + ") — worktree and lock state unknown."));
           }
           if (!publishBuildLanded) {
@@ -2082,7 +2100,7 @@ while (i < STEPS.length) {
             // commit (design §1.5: "the trigger was sent for commit <short-sha>").
             if (publishUnknownFields) publishUnknownFields.commitShortSha = mergeCommitShortForPublish;
             return await parkTask(composeUnattributedParkReason(publishUnknownFields) + (postDeploy.deployed
-              ? " Post-deploy finalized cleanup."
+              ? " Post-deploy step finished (cleanup status unknown)."
               : " Post-deploy also failed (" + (postDeploy.output || "no output") + ") — worktree and lock state unknown."));
           }
           if (!postDeploy.deployed) {
@@ -2111,7 +2129,7 @@ while (i < STEPS.length) {
       // artifact_edit would trigger a duplicate build.
       if (publishSkippedNoLock) {
         instructions = "Publish was skipped deterministically by the workflow before your step — do NOT call artifact_edit, artifact_status, setprovenance, or post-deploy yourself; doing so would disturb the finalized state.\n\n" +
-          "Integrate reported MERGED_EMPTY (the task branch had no commits ahead of main), so no merge lock was taken and there is nothing to ship. The workflow finalized cleanup via post-deploy.\n\n" +
+          "Integrate reported MERGED_EMPTY (the task branch had no commits ahead of main), so no merge lock was taken and there is nothing to ship. Post-deploy step finished per its return — do NOT run post-deploy yourself.\n\n" +
           "Write plain prose describing the skip, then on its own line: VERDICT: PASS\n" +
           "The VERDICT line must be the last line of your report.";
       } else {
@@ -2740,6 +2758,7 @@ while (i < STEPS.length) {
     // means the parent's independent read-back has not happened yet; this
     // park is NOT proof the content is correct.
     return await parkTask("publish: verification-requested " + mergeCommitForPublish +
+      " attempt=" + rebuildAttemptKey +
       " Do NOT republish: a duplicate build would re-publish the same change. " +
       "Artifact build landed, post-deploy finalized, provenance not stamped — the crew has not yet independently confirmed the live artifact contains exactly the change; waiting on the manual read-back in docs/publish-verification.md. " +
       "Appendix: build=" + (rebuildAgentId || "agent_id unobserved") + "; provenance=unstamped; content_check=pending.");

package/workflows/upgrade.js

@@ -79,6 +79,12 @@ const NEXT_PHASE_ROUTED = (typeof inputs.next_phase === "string" && inputs.next_
 // (2026-09-16: the silent default let a run resolve against the dev home).
 if (!inputs.crewHome) throw new Error("crewHome is required — pass the crew home explicitly; no default");
 const crewHome = inputs.crewHome;
+// sq(p) — single-quote a path for safe interpolation into shell commands the
+// agents run. A bare double-quoted path breaks on spaces, $, backticks, or
+// quotes; single-quote wrapping is always safe.
+function sq(p) {
+  return "'" + String(p).split("'").join("'\\''") + "'";
+}
 // Crew API: the workflow calls the crew-owned CLI, not the dashboard.
 // The CLI implements the API.md contract against $CREW_HOME/crew-state.db.
 const CREW_API_SRC = crewHome + "/current/lib/crew-api.js";
@@ -91,7 +97,7 @@ let CREW_API = CREW_API_SRC;
 // returns the stdout verbatim (the CLI emits JSON on stdout).
 function crewCmd(command, args) {
   var json = JSON.stringify(args || {}).replace(/'/g, "'\\''");
-  return "node " + CREW_API + " --crew-home " + crewHome + " " + command + " --json '" + json + "'";
+  return "node " + sq(CREW_API) + " --crew-home " + sq(crewHome) + " " + command + " --json '" + json + "'";
 }
 // Telemetry (2026-09-13): structured run timeline. The workflow mints a
 // telemetry run_id at startup via record-run-start (the API generates it
@@ -104,7 +110,7 @@ let telemetryBuffer = [];
 async function telemetryStart(workflowName) {
   try {
     const out = await agent(crewCmd("record-run-start", {
-      task_id: taskId, workflow: workflowName, launched_by: "cron"
+      task_id: taskId, workflow: workflowName, launched_by: inputs.launched_by
     }), { key: "telemetry-start", label: "Recording run start" });
     const parsed = typeof out === "string" ? JSON.parse(out) : out;
     if (parsed && parsed.run_id) telemetryRunId = parsed.run_id;
@@ -178,7 +184,7 @@ const LAUNCH_PROJECT_ID = inputs.project_id || "";
 // parks fail-closed at Triage.
 const REPO_PATH = projectConfig.repo_path || "";
 // Env prefix baked into every lifecycle invocation the agents run.
-const LIFECYCLE_ENV = "CREW_HOME=" + crewHome + " CREW_REPO=" + REPO_PATH + " ";
+const LIFECYCLE_ENV = "CREW_HOME=" + sq(crewHome) + " CREW_REPO=" + REPO_PATH + " ";
 // The stable release script — deploys, reports the live release.
 const DEPLOY_SCRIPT = crewHome + "/crew-release.sh";
 
@@ -195,7 +201,7 @@ if (!taskId) {
 function pinLifecycle(key) {
   return agent(
     "Snapshot lifecycle scripts for version pinning.\n" +
-    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + CLASSIFY_SURFACE_SRC + " " + CLASSIFY_SURFACE + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
+    "Run: mkdir -p " + sq(RUN_LIB) + " && cp " + sq(LIFECYCLE_SRC) + " " + sq(LIFECYCLE) + " && cp " + sq(MERGE_LOCK_SRC) + " " + sq(MERGE_LOCK) + " && cp " + sq(PUBLISH_NPM_SRC) + " " + sq(PUBLISH_NPM) + " && cp " + sq(CREW_API_SRC) + " " + sq(CREW_API_PINNED) + " && cp " + sq(SCHEMA_SQL_SRC) + " " + sq(SCHEMA_SQL_PINNED) + " && cp " + sq(CLASSIFY_SURFACE_SRC) + " " + sq(CLASSIFY_SURFACE) + " && chmod +x " + sq(LIFECYCLE) + " " + sq(MERGE_LOCK) + " " + sq(PUBLISH_NPM) + " && ls -1 " + sq(RUN_LIB) + "\n" +
     "Return the verbatim output of the ls -1 command as { \"listing\": \"<verbatim output>\" } and nothing else.",
     { key: key, label: "Pinning lifecycle scripts",
       schema: { type: "object", properties: { listing: { type: "string" } }, required: ["listing"] } }
@@ -258,7 +264,7 @@ async function computeUpgradePlan(evidenceKey, noteIdentity) {
       (sourceIsRepo
         ? "2. The workflow was told source is repo. Check that " + REPO_PATH + "/workflows is a directory AND " + REPO_PATH + "/lib/crew-release.sh exists — repo_ok is true only if both hold. Run: git -C " + REPO_PATH + " rev-parse HEAD and capture the sha as head (empty string if the command fails).\n"
         : "2. The workflow was told source is not repo. Skip all repo checks: return repo_ok false and head as an empty string.\n") +
-      "3. Run: " + DEPLOY_SCRIPT + " current " + crewHome + " — capture the full trimmed stdout as current.\n" +
+      "3. Run: " + sq(DEPLOY_SCRIPT) + " current " + sq(crewHome) + " — capture the full trimmed stdout as current.\n" +
       "Return JSON { \"source_line\": \"<verbatim>\", \"repo_ok\": <bool>, \"head\": \"<sha or empty>\", \"current\": \"<trimmed stdout>\" } and nothing else.",
       {
         key: evidenceKey,
@@ -583,8 +589,8 @@ while (i < STEPS.length) {
     const stagingDir = crewHome + "/.upgrade-staging/" + upgradePlan.version;
     const deployShell =
       (upgradePlan.source === "repo")
-        ? DEPLOY_SCRIPT + " deploy " + REPO_PATH + " " + crewHome
-        : "STAGING=\"" + stagingDir + "\" && mkdir -p \"$STAGING\" && cd \"$STAGING\" && npm init -y >/dev/null 2>&1 && npm install muse-crew@" + upgradePlan.version;
+        ? sq(DEPLOY_SCRIPT) + " deploy " + REPO_PATH + " " + sq(crewHome)
+        : "STAGING=" + sq(stagingDir) + " && mkdir -p \"$STAGING\" && cd \"$STAGING\" && npm init -y >/dev/null 2>&1 && npm install muse-crew@" + upgradePlan.version;
     const deploySteps =
       "1. Run the install (npm source only):\n" + (upgradePlan.source === "repo" ? "   (skipped — repo source has nothing to install)\n" : "   " + deployShell + "\n") +
       "2. Run the deploy:\n   " + (upgradePlan.source === "repo"
@@ -594,10 +600,10 @@ while (i < STEPS.length) {
         // so the deploy source is the installed package root, not the
         // staging root. Do not rely on a $STAGING shell variable persisting
         // between separate shell invocations.
-        : DEPLOY_SCRIPT + " deploy \"" + stagingDir + "/node_modules/muse-crew\" " + crewHome) +
+        : sq(DEPLOY_SCRIPT) + " deploy " + sq(stagingDir + "/node_modules/muse-crew") + " " + sq(crewHome)) +
       " — capture ALL of the command's output and its exit code (run the command, then echo EXIT_CODE=$?).\n" +
       (upgradePlan.source === "npm"
-        ? "3. Remove the staging dir: rm -rf \"" + stagingDir + "\" — best-effort, ALWAYS, even when the deploy fails. Log whether the removal succeeded. Never let cleanup change the deploy outcome.\n"
+        ? "3. Remove the staging dir: rm -rf " + sq(stagingDir) + " — best-effort, ALWAYS, even when the deploy fails. Log whether the removal succeeded. Never let cleanup change the deploy outcome.\n"
         : "") +
       "Do not run git checkout, git pull, or any repo-mutating command. Do not publish to npm — the npm source only INSTALLS the published package. Do not touch the scheduler.";
     var deployResult;
@@ -630,9 +636,12 @@ while (i < STEPS.length) {
       await recordPhase("Deploy", step.identity, activeSessionId, "failed", msg);
       return await parkTask(msg);
     }
-    log("Deploy succeeded for task " + taskId + " — target " + upgradePlan.target);
+    // Razor: exit 0 is the deploy agent's testimony, not proof the release
+    // swap landed. Success is claimed only after Verify's independent checks
+    // pass below.
+    log("Deploy agent returned exit 0 for task " + taskId + " — target " + upgradePlan.target + " (Verify checks pending)");
     await recordPhase("Deploy", step.identity, activeSessionId, "completed",
-      "deployed " + upgradePlan.target + " (" + upgradePlan.source + ")\ndeploy output:\n" + deployOutput.slice(0, 1500));
+      "deploy command exit 0 for " + upgradePlan.target + " (" + upgradePlan.source + ") — Verify checks pending\ndeploy output:\n" + deployOutput.slice(0, 1500));
     i++;
     continue;
   }
@@ -663,7 +672,7 @@ while (i < STEPS.length) {
       curCheck = await agent(
         TOOL_CHECK_PREAMBLE +
         "Read the live release identity.\n" +
-        "Run: " + DEPLOY_SCRIPT + " current " + crewHome + "\n" +
+        "Run: " + sq(DEPLOY_SCRIPT) + " current " + sq(crewHome) + "\n" +
         "Return JSON { \"current\": \"<trimmed stdout>\" } and nothing else.",
         {
           key: "verify-current",
@@ -695,7 +704,7 @@ while (i < STEPS.length) {
       regCheck = await agent(
         TOOL_CHECK_PREAMBLE +
         "Read the deployed registry.\n" +
-        "Run: cat " + crewHome + "/workflows/registry.json\n" +
+        "Run: cat " + sq(crewHome + "/workflows/registry.json") + "\n" +
         "Return JSON { \"raw\": \"<the file's full content, verbatim>\" } and nothing else.",
         {
           key: "verify-registry",
@@ -740,7 +749,7 @@ while (i < STEPS.length) {
       gsCheck = await agent(
         TOOL_CHECK_PREAMBLE +
         "Check the crew database is readable by the OLD release's CLI. Use the PINNED path below — NOT " + crewHome + "/current — because the workflow swapped `current` under itself at Deploy and the live path may already point at the new release.\n" +
-        "Run: node " + CREW_API_PINNED + " --crew-home " + crewHome + " get-state --json '{}'; echo EXIT_CODE=$?\n" +
+        "Run: node " + sq(CREW_API_PINNED) + " --crew-home " + sq(crewHome) + " get-state --json '{}'; echo EXIT_CODE=$?\n" +
         "Return JSON { \"exit\": <the exit code as an integer> } and nothing else.",
         {
           key: "verify-get-state",
@@ -762,6 +771,11 @@ while (i < STEPS.length) {
     }
     log("Verify check 3 passed for task " + taskId + ": pinned crew-api.js get-state exits 0");
 
+    // The success claim lives here now: all three independent checks re-read
+    // the world and confirm the swap — the deploy agent's exit 0 alone never
+    // proved it.
+    log("Deploy succeeded for task " + taskId + " — target " + target + " (Verify: live release, registry, and pinned CLI all confirm)");
+
     await agent(
       "Log the completed upgrade.\n" +
       "Run in shell and return the stdout verbatim:\n" + crewCmd("log-event", {