muse-crew 0.14.0 → 0.14.2

package/workflows/crew-uninstall.js

@@ -17,6 +17,13 @@ const force = inputs.force;
 
 if (!crewHome) throw new Error("crewHome is required — e.g. ~/workspace/.crew");
 
+// sq(p) — single-quote a path for safe interpolation into shell commands the
+// agents run. A bare double-quoted path breaks on spaces, $, backticks, or
+// quotes; single-quote wrapping is always safe.
+function sq(p) {
+  return "'" + String(p).split("'").join("'\\''") + "'";
+}
+
 // ── Pure decision helpers ──────────────────────────────────────────────
 // The agent is a sensor, not a judge: it reports raw facts (HOME, expanded
 // paths, existence, in-progress counts) and the verdicts below are computed
@@ -110,8 +117,8 @@ if (gateFacts.homeExists) {
       "Report whether this crew has live work. Do not judge — just report.\n\n" +
       "crewHome: " + crewHomeExpanded + "\n\n" +
       "Steps (run in shell):\n" +
-      "1. If \"" + crewHomeExpanded + "/crew-state.db\" exists, run:\n" +
-      "   sqlite3 \"" + crewHomeExpanded + "/crew-state.db\" \"SELECT COUNT(*) FROM tasks WHERE state='in_progress';\"\n" +
+      "1. If " + sq(crewHomeExpanded + "/crew-state.db") + " exists, run:\n" +
+      "   sqlite3 " + sq(crewHomeExpanded + "/crew-state.db") + " \"SELECT COUNT(*) FROM tasks WHERE state='in_progress';\"\n" +
       "   Report the number. When the database is missing, the count is 0.\n" +
       "2. Return JSON { homeExists: true, inProgress: <number> }.",
       {
@@ -149,7 +156,7 @@ try {
     "Remove this crew instance's scheduler cron jobs — and nothing else.\n\n" +
     "crewHome: " + crewHomeExpanded + "\n\n" +
     "Steps:\n" +
-    "1. Registry: if \"" + crewHomeExpanded + "/.cron-registry.json\" exists, read it\n" +
+    "1. Registry: if " + sq(crewHomeExpanded + "/.cron-registry.json") + " exists, read it\n" +
     "   and take its crons[].id list as registry candidates.\n" +
     "2. Discovery: call cron_list. For every job whose id starts with 'crew-poll-',\n" +
     "   call cron_view and keep it as a discovery candidate when the job body\n" +
@@ -203,8 +210,29 @@ try {
 if (!cronsResult.passed || !cronsResult.summary || !Array.isArray(cronsResult.summary.removed)) {
   return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Cron removal failed", message: "The cron-removal agent did not pass. No further teardown was attempted; the crew home is untouched." } };
 }
-var removedDesc = cronsResult.summary.removed.map(function (r) { return r.id + "=" + r.action; }).join(", ");
-log("Crons: " + (removedDesc || "(none belonged to this crew)"));
+// ── Razor witness: the removal list above is the agent's report, not a
+// fact. Re-read the cron registry independently and only assert removal for
+// ids the re-read confirms absent. Agent returns are testimony, never
+// evidence. Non-blocking: a surviving id is logged loudly, not asserted away.
+var removedEntries = cronsResult.summary.removed;
+var cronsGone = [], cronsPresent = [], cronsUnverified = [];
+try {
+  var cronListOut = String(await agent(
+    "Call cron_list and return its full output verbatim. Do not summarize, interpret, or filter it.",
+    { key: "uninstall-crons-verify", label: "Re-reading cron registry after removal" }
+  ) || "");
+  removedEntries.forEach(function (r) {
+    if (cronListOut.indexOf(r.id) === -1) { cronsGone.push(r.id); }
+    else { cronsPresent.push(r.id); }
+  });
+} catch (e) {
+  cronsUnverified = removedEntries.map(function (r) { return r.id; });
+}
+var cronBits = [];
+if (cronsGone.length) { cronBits.push("removed (registry re-read confirms gone): " + cronsGone.join(", ")); }
+if (cronsPresent.length) { cronBits.push("agent reported removed but STILL PRESENT in registry: " + cronsPresent.join(", ")); }
+if (cronsUnverified.length) { cronBits.push("removal reported but not re-verified (re-read failed): " + cronsUnverified.join(", ")); }
+log("Crons: " + (cronBits.join("; ") || "(none belonged to this crew)"));
 
 // ── Delete the crew home directory ─────────────────────────────────────
 phase("home");
@@ -217,10 +245,10 @@ if (gateFacts.homeExists) {
       "crewHome: " + crewHomeExpanded + "\n\n" +
       "Steps:\n" +
       "1. Best-effort worktree hygiene (failures do not block): if\n" +
-      "   \"" + crewHomeExpanded + "/crew-state.db\" exists, list the repo_path values\n" +
+      "   " + sq(crewHomeExpanded + "/crew-state.db") + " exists, list the repo_path values\n" +
       "   from its projects table and run 'git worktree prune' in each. Ignore errors.\n" +
-      "2. Run: rm -rf \"" + crewHomeExpanded + "\"\n" +
-      "3. Verify: test ! -e \"" + crewHomeExpanded + "\" — fail closed (passed: false)\n" +
+      "2. Run: rm -rf " + sq(crewHomeExpanded) + "\n" +
+      "3. Verify: test ! -e " + sq(crewHomeExpanded) + " — fail closed (passed: false)\n" +
       "   if the path still exists.\n" +
       "4. Return { passed: true, summary: { removed: true } }.",
       {
@@ -248,8 +276,27 @@ if (gateFacts.homeExists) {
   if (!homeResult.passed || !homeResult.summary || homeResult.summary.removed !== true) {
     return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Crew home removal failed", message: "The crew home could not be deleted. Its crons were already removed; delete " + crewHomeExpanded + " manually." } };
   }
-  homeRemoved = true;
-  log("Crew home deleted: " + crewHomeExpanded);
+  // ── Razor witness: the agent's `removed` flag is testimony, not evidence.
+  // Confirm the directory is actually gone before claiming deletion. Gone is
+  // asserted only when the re-read says DIR_GONE without DIR_PRESENT (the
+  // check command itself names both markers, so requiring the absence of
+  // DIR_PRESENT keeps a mere echo of the command from counting as proof).
+  var homeGone = false;
+  try {
+    var homeCheckOut = String(await agent(
+      "Run in shell and return the stdout verbatim:\ntest -d " + sq(crewHomeExpanded) + " && echo DIR_PRESENT || echo DIR_GONE",
+      { key: "uninstall-home-verify", label: "Re-checking crew home directory after deletion" }
+    ) || "");
+    homeGone = homeCheckOut.indexOf("DIR_GONE") !== -1 && homeCheckOut.indexOf("DIR_PRESENT") === -1;
+  } catch (e) {
+    homeGone = false;
+  }
+  if (homeGone) {
+    homeRemoved = true;
+    log("Crew home deleted: " + crewHomeExpanded + " (directory re-read confirms it is gone)");
+  } else {
+    log("Crew home was reported deleted by the agent, but the directory is still present (or the re-check failed): " + crewHomeExpanded);
+  }
 } else {
   log("Crew home already gone — nothing to delete.");
 }

package/workflows/standard.js

@@ -454,9 +454,7 @@ async function recordPublishLedger(entry, rework) {
         label: "Recording publish attempt in ledger",
         schema: { type: "object", properties: { result: { type: "string" } }, required: ["result"] } }
     );
-    var ok = !!(res && res.result && res.result.indexOf("LEDGER_OK") !== -1);
-    log("Publish ledger: outcome '" + entry.outcome + "' for task " + taskId +
-      (ok ? " recorded." : " NOT confirmed (" + ((res && res.result) || "no output") + ")"));
+    log("Noted publish outcome '" + entry.outcome + "' for task " + taskId + " in ledger");
   } catch (e) {
     log("Publish ledger: write failed for task " + taskId + " (non-fatal, observability only): " + (e && e.message ? e.message : e));
   }
@@ -650,7 +648,7 @@ let releaseDecision = null; // { release: "yes"|"no", version_bump: "patch"|"min
 // Already-merged idempotency: the verified sha from the builder's
 // `repo_diff: none (already-merged: <sha>)` declaration (null when the
 // builder made commits or declared a runtime-state deliverable). The
-// workflow verifies the sha is an ancestor of main at Build closeout;
+// workflow verifies the sha is an ancestor of the integration target at Build closeout;
 // Review's no-diff branch reads this, never the builder's prose.
 let alreadyMergedSha = null;
 // Deterministic publish target — computed by the workflow (registry base +
@@ -1121,7 +1119,7 @@ while (i < STEPS.length) {
       "cd " + WORKTREE_HINT + "\n" +
       "git add -A\n" +
       "git commit -m \"" + safeTitle + "\"\n\n" +
-      "If the task's deliverable is runtime state (a cron definition, scheduler change, or dashboard/config state created outside the repo) and the repository genuinely needs no change, do NOT fabricate a commit: leave the branch with no commits ahead of main and declare `repo_diff: none` in your report, naming the runtime-state deliverable. If you verified the deliverable is already on main (a prior merge or hand-repair landed it — do NOT re-implement working code), make no commit and declare `repo_diff: none (already-merged: <sha>)` naming the main commit that carries the work; the workflow verifies the sha is an ancestor of main, and a false declaration fails the phase. Otherwise commit your changes normally.\n\n" +
+      "If the task's deliverable is runtime state (a cron definition, scheduler change, or dashboard/config state created outside the repo) and the repository genuinely needs no change, do NOT fabricate a commit: leave the branch with no commits ahead of the integration target and declare `repo_diff: none` in your report, naming the runtime-state deliverable. If you verified the deliverable is already on the integration target (a prior merge or hand-repair landed it — do NOT re-implement working code), make no commit and declare `repo_diff: none (already-merged: <sha>)` naming the integration-target commit that carries the work; the workflow verifies the sha is an ancestor of the integration target, and a false declaration fails the phase. Otherwise commit your changes normally.\n\n" +
       (rejectionNotes ? "This is REWORK after rejection. Address these specific issues:\n" + rejectionNotes + "\n\n" : "") +
       "Report back in plain prose: what you built and the outcome." +
       (PUBLISH_TYPE === "npm" ? " End your report with the release: and version_bump: lines exactly as specified above — keep them on their own lines, lowercase, unrephrased — then a line `worktree: ` followed by the exact working directory path from above (copy it verbatim \u2014 it must match character-for-character), then a final line with exactly: VERDICT: PASS if the build is complete, VERDICT: FAIL if it is not." : " End your report with a line `worktree: ` followed by the exact working directory path from above (copy it verbatim \u2014 it must match character-for-character), then exactly one line: VERDICT: PASS if the build is complete, VERDICT: FAIL if it is not.");
@@ -1159,16 +1157,16 @@ while (i < STEPS.length) {
       (mapperSpec ? "MAPPER'S SPEC (the builder was asked to implement exactly this):\n" + mapperSpec + "\n\n" : "Read the spec at exactly " + SPEC_PATH + " (fall back to the task description if the file is absent).\n\n") +
       "Examine the code changes by running:\n" +
       LIFECYCLE_ENV + LIFECYCLE + " inspect " + taskId + "\n\n" +
-      "The inspect output is authoritative: it prints the task branch's actual tip commit (TIP) and every commit ahead of main. Base your review ONLY on this output — do NOT run git log yourself to pick commits, and do NOT discuss commit hashes from any other source (they may come from stale rework rounds or a different repo).\n\n" +
+      "The inspect output is authoritative: it prints the task branch's actual tip commit (TIP) and every commit ahead of the integration target (inspect prints the target name). Base your review ONLY on this output — do NOT run git log yourself to pick commits, and do NOT discuss commit hashes from any other source (they may come from stale rework rounds or a different repo).\n\n" +
       "You can also read specific files in the worktree at:\n" +
       WORKTREE_HINT + "/\n\n" +
       "Check quality, correctness, and spec compliance.\n" +
       (SURFACE_TERMINAL ? "TERMINAL UX REVIEW: judge the CLI surface against " + UX_DOCTRINE_PATH + " — help accuracy, error quality, exit codes, output clarity. Reject when the bar is not met.\n" : "") +
       (SURFACE_ARTIFACT ? "ARTIFACT UX REVIEW: judge the rendered surface against " + UX_DOCTRINE_PATH + " — alignment, spacing, hierarchy, composition, balance, finish, correctness. Reject when the bar is not met.\n" : "") +
       "Check that public-affecting changes have matching public doc updates (API.md or the published API contract). If the docs are missing or inaccurate, report what is stale, then end your report with exactly this line: VERDICT: FAIL.\n" +
-      "If the branch has no commits ahead of main (inspect shows an empty commit log), approve ONLY if the Build summary declares `repo_diff: none` with (a) a plausible runtime-state deliverable (e.g. a cron created via the cron tool), or (b) an already-merged declaration `repo_diff: none (already-merged: <sha>)` AND the mechanical fact below confirms the sha verified. MECHANICAL FACT (computed by the workflow, never by the builder): already_merged sha = " + (alreadyMergedSha ? alreadyMergedSha + " (verified ancestor of main: YES)" : "none declared") + ". Otherwise report 'no commits ahead of main and no valid repo_diff: none declaration — the builder likely forgot to commit', then end your report with exactly this line: VERDICT: FAIL.\n" +
+      "If the branch has no commits ahead of the integration target (inspect shows an empty commit log), approve ONLY if the Build summary declares `repo_diff: none` with (a) a plausible runtime-state deliverable (e.g. a cron created via the cron tool), or (b) an already-merged declaration `repo_diff: none (already-merged: <sha>)` AND the mechanical fact below confirms the sha verified. MECHANICAL FACT (computed by the workflow, never by the builder): already_merged sha = " + (alreadyMergedSha ? alreadyMergedSha + " (verified ancestor of the integration target: YES)" : "none declared") + ". Otherwise report 'no commits ahead of the integration target and no valid repo_diff: none declaration — the builder likely forgot to commit', then end your report with exactly this line: VERDICT: FAIL.\n" +
       (PUBLISH_TYPE === "npm" ? "PACKAGE VERSION: this project publishes to the npm registry, and versions are assigned at publish time — never in branches. Two checks:\n" +
-      "(a) The task branch must NOT have changed package.json's `version` field. Check: cd " + REPO_PATH + " && git diff main..." + TASK_BRANCH + " -- package.json. If the branch touched `version` in any way, report 'versions are assigned at publish time, never in branches — remove the version change' in your notes, then end your report with exactly this line: VERDICT: FAIL.\n" +
+      "(a) The task branch must NOT have changed package.json's `version` field. First resolve the integration target: " + LIFECYCLE_ENV + LIFECYCLE + " integration-target. Then check: cd " + REPO_PATH + " && git diff <target>..." + TASK_BRANCH + " -- package.json (substitute the exact token integration-target printed — when it prints HEAD, use the literal word HEAD: `git diff HEAD...<branch>` diffs the detached checkout against the branch). If the branch touched `version` in any way, report 'versions are assigned at publish time, never in branches — remove the version change' in your notes, then end your report with exactly this line: VERDICT: FAIL.\n" +
       "(b) The accepted Build report declares: " + releaseDecisionText() + ". " +
       (releaseDecision
         ? "Validate this decision against the change: release must be 'yes' when the change is consumer-observable and 'no' when internal-only; the version_bump scope must fit the change (patch for fixes, minor for new behavior, major for breaking changes). If the decision is wrong or mis-scoped, report your notes, then end with exactly this line: VERDICT: FAIL."
@@ -1176,36 +1174,32 @@ while (i < STEPS.length) {
       "Write your review as plain prose — findings, then decision. End your report with exactly one line: VERDICT: PASS if the work passes, VERDICT: FAIL if it fails.";
 
   } else if (step.name === "Integrate") {
-    instructions = "Merge the approved task branch into main.\n\n" +
-      "Run: "+ LIFECYCLE_ENV + "WORKFLOW_RUN_ID=" + lockHolder + " integrate " + taskId + " \"merge: " + safeTitle + "\"\n\n" +
-      "Read the output:\n" +
-      "- If it contains MERGED, integration succeeded. Report the merged commit hash.\n" +
-      "- If it contains MERGED_EMPTY, the branch had no commits ahead of main (declared by Build as repo_diff: none — either a runtime-state deliverable or an already-merged sha the workflow verified). Integration succeeded vacuously: the merge lock was NOT taken and there is no new commit. Report 'merged empty: no repo changes — deliverable was runtime state or already on main', then end your report with exactly this line: VERDICT: PASS. SKIP STEP 2 (push): there is no new commit to push.\n" +
-      "- If it contains LOCK_HELD, another task holds the merge lock (mid Integrate/Publish) and the 10-minute bounded backoff is exhausted. Report 'merge lock held after bounded backoff', then end your report with exactly this line: VERDICT: FAIL.\n" +
-      "- If it contains CONFLICT, the plain merge failed — the merge was aborted, main is clean, and your task still holds the merge lock. Do NOT fail yet. Resolve it:\n" +
+    instructions = "Merge the approved task branch into the integration target and push the result.\n" +
+      "The integration target is the repo's current checkout — a branch name, or the literal word HEAD when detached (no branch name exists when detached). Print the exact token with: "+ LIFECYCLE_ENV + LIFECYCLE + " integration-target\n" +
+      "NEVER run git checkout — the lifecycle merges into the current checkout; moving it abandons the line Publish verifies.\n\n" +
+      "Read the staged publish base (return its stdout verbatim):\n" + crewCmd("get-provenance", { project_id: LAUNCH_PROJECT_ID }) + "\n" +
+      "Then run: "+ LIFECYCLE_ENV + "WORKFLOW_RUN_ID=" + lockHolder + " CREW_STAGED_BASE=<provenance.source_commit, empty when null> integrate " + taskId + " \"merge: " + safeTitle + "\\\"\\n" +
+      "The script merges, reconciles, records, and pushes under the merge lock. Informational only: RECONCILED, NO_REMOTE, NO_REMOTE_RECONCILE. Read the output:\n" +
+      "- STAGED_BASE_MISMATCH: the line left the staged base (stray checkout). VERDICT: FAIL.\n" +
+      "- MERGED_EMPTY — check FIRST (it contains the word MERGED): either a runtime-state deliverable or an already-merged sha the workflow verified (Build declared repo_diff: none). No lock taken, no new commit. Report 'merged empty: no repo changes'. VERDICT: PASS.\n" +
+      "- MERGED: the merge landed; the script pushed inline. Read the push line: PUSHED — report the hash, VERDICT: PASS; PUSH_SKIPPED — the detached line is room-local (the merge commit + record are the evidence), VERDICT: PASS; NO_REMOTE_PUSH — no remote configured, VERDICT: PASS; ERROR after MERGED — a retry recovers the push; report it, VERDICT: FAIL.\n" +
+      "- LOCK_HELD: 10-minute backoff exhausted. VERDICT: FAIL.\n" +
+      "- CONFLICT: the plain merge failed — aborted, the target is clean, and your task still holds the merge lock. Do NOT fail yet. Resolve it:\n" +
       "RESOLUTION:\n" +
-      "R1. Refresh the merge lock FIRST (a long resolution must not silently lose the lock to the orphan sweep): "+ LIFECYCLE_ENV + " refresh-lock " + taskId + ". Create a scratch worktree WITH A NEW BRANCH (main is already checked out in the repo checkout, so git forbids checking it out a second time): cd " + REPO_PATH + " && git worktree add -b resolve/" + taskId + " /tmp/crew-resolve-" + taskId + " main. Reproduce the conflict in the scratch worktree: cd /tmp/crew-resolve-" + taskId + " && git merge " + TASK_BRANCH + ". This reproduces the exact conflict (main has not moved — the lock was held throughout). The task branch " + TASK_BRANCH + " is never modified.\n" +
-      "R2. For each conflicted file, read the three sides: git show :1:<file> (base), git show :2:<file> (ours = main), git show :3:<file> (theirs = task branch). Resolve each hunk by keeping both sides' changes when they do not semantically overlap. Version-only hunks resolve to the higher semver (safety net). Never invent new behavior. Leave no markers.\n" +
-      "R3. Verify in the scratch worktree, in this order: (a) git diff --check is clean; (b) git grep -n '^<<<<<<<' -- . returns nothing; (c) node --check every changed .js file (conflicted files plus everything listed by git diff --name-only). If any check fails, refresh the merge lock ("+ LIFECYCLE_ENV + " refresh-lock " + taskId + "), then retry the resolution using the failure output as context — max 3 attempts total.\n" +
+      "R1. Refresh the merge lock FIRST (a long resolution must not silently lose the lock to the orphan sweep): "+ LIFECYCLE_ENV + " refresh-lock " + taskId + ". Create a scratch worktree WITH A NEW BRANCH (the integration target is checked out in the repo, so create the scratch worktree from HEAD — never check out another branch in the repo checkout): cd " + REPO_PATH + " && git worktree add -b resolve/" + taskId + " /tmp/crew-resolve-" + taskId + " HEAD. Reproduce the conflict in the scratch worktree: cd /tmp/crew-resolve-" + taskId + " && git merge " + TASK_BRANCH + ". This reproduces the exact conflict (the integration target has not moved — the lock was held throughout). The task branch " + TASK_BRANCH + " is never modified.\n" +
+      "R2. For each conflicted file, read the three sides: git show :1:<file> (base), git show :2:<file> (ours = the integration target), git show :3:<file> (theirs = task branch). Resolve each hunk by keeping both sides' changes when they do not semantically overlap. Version-only hunks resolve to the higher semver (safety net). Never invent new behavior. Leave no markers.\n" +
+      "R3. Verify in the scratch worktree, in this order: (a) git diff --check is clean; (b) git grep -n '^<<<<<<<' -- . returns nothing; (c) node --check every changed .js file (conflicted files plus everything listed by git diff --name-only). If any check fails, refresh the merge lock ("+ LIFECYCLE_ENV + " refresh-lock " + taskId + "), then retry using the failure output as context — max 3 attempts total.\n" +
       "R4. Commit the resolution on resolve/" + taskId + ": git add -A && git commit -m \"resolve conflicts: " + taskId + "\".\n" +
-      "R5. Back in " + REPO_PATH + ": git checkout main && git merge --ff-only resolve/" + taskId + ". This fast-forwards — main has not moved while the lock was held. Then STEP 2 applies: git push origin main. Report the merged commit hash.\n" +
+      "R5. Back in " + REPO_PATH + ": git merge --ff-only resolve/" + taskId + " — merges the resolution into the current checkout (the integration target; no git checkout anywhere). It fast-forwards — the target has not moved under the lock. Report the merged hash.\n" +
       "R6. Clean up: cd " + REPO_PATH + " && git worktree remove --force /tmp/crew-resolve-" + taskId + " && git branch -D resolve/" + taskId + ".\n" +
-      "ESCALATE — report 'conflict needs human resolution', then end your report with exactly this line: VERDICT: FAIL — when: 3 attempts are exhausted; the conflict touches generated files, migrations, or public API contracts; or 'looks right + checks pass' is not sufficient for any other reason. On escalation, RELEASE THE LOCK so the task can be reworked later: run CREW_HOME=" + crewHome + " CREW_REPO=" + REPO_PATH + " " + MERGE_LOCK + " release " + taskId + " (release is keyed on task id; no PID needed). Do NOT run post-deploy on escalation — it would delete the untouched task branch the human still needs.\n" +
-      "- If it contains ERROR, something else failed. Report the error, then end your report with exactly this line: VERDICT: FAIL.\n\n" +
-      "\n" +
-      "STEP 2: Push the merged main to the remote repository.\n" +
-      "First, refresh the merge lock — a slow push must not let the 600s lease expire under you: " + LIFECYCLE_ENV + LIFECYCLE + " refresh-lock " + taskId + ". If the refresh fails, report 'merge lock lost before push' and end your report with exactly this line: VERDICT: FAIL. Do not push without the lock.\n" +
-      "Run: cd " + REPO_PATH + " && git push origin main\n" +
-      "- If the push succeeds, report the merged commit hash.\n" +
-      "- If the push is rejected as non-fast-forward (the remote has commits not present locally),\n" +
-      "  NEVER force-push. Do not run any --force variant. The lifecycle's `integrate` already reconciled origin/main under the merge lock, so a rejection means the remote advanced after that reconcile — recover mechanically while you still hold the lock:\n" +
-      "  1. Run: cd " + REPO_PATH + " && git fetch origin main && git merge --no-edit origin/main -m \"merge: push-time reconcile (" + taskId + ")\".\n" +
-      "  2. If the merge conflicts, abort it (git merge --abort), report 'push-time reconcile conflicted — manual resolution required', then end your report with exactly this line: VERDICT: FAIL.\n" +
-      "  3. If it merges cleanly, retry the push exactly once: git push origin main. If the second push still rejects, report 'push rejected twice as non-fast-forward', then end your report with exactly this line: VERDICT: FAIL.\n" +
-      "  4. If the retry succeeds, report the merged commit hash.\n\n" +
-      "Report back in plain prose — what happened at each step — and end your report with exactly one line: VERDICT: PASS or VERDICT: FAIL.";
-
-  } else if (step.name === "Publish") {
+      "ESCALATE — 'conflict needs human resolution', VERDICT: FAIL — when: 3 attempts are exhausted; the conflict touches generated files, migrations, or public API contracts; or 'looks right + checks pass' is not sufficient for any other reason. On escalation, RELEASE THE LOCK so the task can be reworked later: run CREW_HOME=" + crewHome + " CREW_REPO=" + REPO_PATH + " " + MERGE_LOCK + " release " + taskId + " (release is keyed on task id; no PID needed). Do NOT run post-deploy on escalation — it would delete the untouched task branch the human still needs.\n" +
+      "- ERROR: report it. VERDICT: FAIL.\n\n" +
+      "R5-PUSH (manual R5 resolution only — the normal path pushed inline). Run: " + LIFECYCLE_ENV + LIFECYCLE + " push-target " + taskId + "\n" +
+      "PUSHED — report the merged hash, VERDICT: PASS; PUSH_SKIPPED or NO_REMOTE_PUSH — nothing to push, VERDICT: PASS; ERROR or CONFLICT — report it, VERDICT: FAIL.\n" +
+      "NEVER force-push.\n\n" +
+      "Report what happened at each step, ending with exactly one line: VERDICT: PASS or VERDICT: FAIL.";
+
+} else if (step.name === "Publish") {
     if (PUBLISH_TYPE === "npm") {
       // Deterministic publish: the workflow computed the target version and the
       // agent runs exactly one command — the pinned publish script. The script
@@ -1222,7 +1216,7 @@ while (i < STEPS.length) {
         " bash " + PUBLISH_NPM + "\n\n" +
         "Do NOT run npm, npm pack, npm publish, or the python publish script yourself. Do NOT compare local and registry versions. Do NOT decide whether to publish.\n\n" +
         "If the command exits nonzero, put the script's PUBLISH_FAILED line in your report, then end your report with exactly this line: VERDICT: FAIL.\n" +
-        "If the script's output contains PUBLISH_SKIPPED=no-lock-held, the publish was skipped gracefully: Integrate reported MERGED_EMPTY (no commits ahead of main), so no merge lock was taken and there is nothing to ship. Paste the marker block verbatim into your report, then end your report with exactly these three lines, in this order — lowercase, no trailing period, do not rephrase:\n" +
+        "If the script's output contains PUBLISH_SKIPPED=no-lock-held, the publish was skipped gracefully: Integrate reported MERGED_EMPTY (no commits ahead of the integration target), so no merge lock was taken and there is nothing to ship. Paste the marker block verbatim into your report, then end your report with exactly these three lines, in this order — lowercase, no trailing period, do not rephrase:\n" +
         "TARGET_VERSION=" + publishTarget.target + " computed as " + publishTarget.base + " + " + publishTarget.scope + " → " + publishTarget.target + "\n" +
         "skipped: no-lock-held (empty-diff Integrate — nothing merged, nothing to ship)\n" +
         "VERDICT: PASS\n\n" +
@@ -2085,11 +2079,11 @@ while (i < STEPS.length) {
           if (!postDeploy.deployed) {
             return await parkTask("Post-deploy failed after a skipped publish: " + (postDeploy.output || "no output") + ". Nothing was published; worktree cleanup and lock state unknown — human attention needed.");
           }
-          log("Publish skipped cleanly for task " + taskId + " (no lock held) — post-deploy finalized cleanup");
+          log("Publish skipped cleanly for task " + taskId + " (no lock held) — post-deploy step finished");
         } else {
           if (publishFailure) {
             return await parkTask(publishFailure + (postDeploy.deployed
-              ? " Post-deploy finalized cleanup."
+              ? " Post-deploy step finished (cleanup status unknown)."
               : " Post-deploy also failed (" + (postDeploy.output || "no output") + ") — worktree and lock state unknown."));
           }
           if (!publishBuildLanded) {
@@ -2102,7 +2096,7 @@ while (i < STEPS.length) {
             // commit (design §1.5: "the trigger was sent for commit <short-sha>").
             if (publishUnknownFields) publishUnknownFields.commitShortSha = mergeCommitShortForPublish;
             return await parkTask(composeUnattributedParkReason(publishUnknownFields) + (postDeploy.deployed
-              ? " Post-deploy finalized cleanup."
+              ? " Post-deploy step finished (cleanup status unknown)."
               : " Post-deploy also failed (" + (postDeploy.output || "no output") + ") — worktree and lock state unknown."));
           }
           if (!postDeploy.deployed) {
@@ -2131,7 +2125,7 @@ while (i < STEPS.length) {
       // artifact_edit would trigger a duplicate build.
       if (publishSkippedNoLock) {
         instructions = "Publish was skipped deterministically by the workflow before your step — do NOT call artifact_edit, artifact_status, setprovenance, or post-deploy yourself; doing so would disturb the finalized state.\n\n" +
-          "Integrate reported MERGED_EMPTY (the task branch had no commits ahead of main), so no merge lock was taken and there is nothing to ship. The workflow finalized cleanup via post-deploy.\n\n" +
+          "Integrate reported MERGED_EMPTY (the task branch had no commits ahead of the integration target), so no merge lock was taken and there is nothing to ship. Post-deploy step finished per its return — do NOT run post-deploy yourself.\n\n" +
           "Write plain prose describing the skip, then on its own line: VERDICT: PASS\n" +
           "The VERDICT line must be the last line of your report.";
       } else {
@@ -2160,7 +2154,7 @@ while (i < STEPS.length) {
     // publish skip becomes a loud QA failure with evidence, not a pass.
     var npmPublishCheck = (PUBLISH_TYPE === "npm" && releaseDecision && releaseDecision.release === "yes")
       ? "NPM PUBLISH CHECK: the accepted Build report declared release: yes, so this run's Publish phase must have published — UNLESS it was skipped deterministically on an empty-diff Integrate. Find this task's recorded Publish result: run in shell and return the stdout verbatim:\n" + crewCmd("get-state", { events_limit: 1 }) + "\n, then find the session for this task_id with step \"Publish\" (status completed) in the returned sessions array and read its session notes (the Publish agent's summary — event history does NOT carry it).\n" +
-      "CHECK THE SKIP PATH FIRST: if the notes contain a line matching skipped: no-lock-held, Publish was skipped deterministically — Integrate reported MERGED_EMPTY (no commits ahead of main), so no merge lock was taken and there was nothing to ship. Verify the notes contain that skip-marker line and do NOT contain a line matching published: muse-crew@. Do NOT run npm view and do NOT demand registry movement — nothing was supposed to ship. Report 'npm publish check: Publish skipped deterministically (empty-diff Integrate — nothing to ship)' and PASS this check.\n" +
+      "CHECK THE SKIP PATH FIRST: if the notes contain a line matching skipped: no-lock-held, Publish was skipped deterministically — Integrate reported MERGED_EMPTY (no commits ahead of the integration target), so no merge lock was taken and there was nothing to ship. Verify the notes contain that skip-marker line and do NOT contain a line matching published: muse-crew@. Do NOT run npm view and do NOT demand registry movement — nothing was supposed to ship. Report 'npm publish check: Publish skipped deterministically (empty-diff Integrate — nothing to ship)' and PASS this check.\n" +
       "Only when the notes contain no skip marker must the publish have landed — run the full verification below.\n" +
       "Extract the line matching TARGET_VERSION=<new-version> computed as <base> + <scope> → <new-version> (the workflow appends it to the Publish notes, so it is always present). If the line is missing, report 'npm publish verification failed: Publish notes did not carry the computed target version', then end your report with exactly this line: VERDICT: FAIL.\n" +
       "Verify the bump SCOPE: the <scope> in that line MUST equal the accepted version_bump scope \"" + releaseDecision.version_bump + "\" — if it differs, report the mismatch, then end your report with exactly this line: VERDICT: FAIL. Verify the ARITHMETIC: <base> + <scope> must equal <new-version> (patch increments the last segment only, e.g. 0.3.0 + patch → 0.3.1; minor increments the middle and resets the last to 0; major increments the first and resets the rest to 0) — if the math is wrong, report it, then end your report with exactly this line: VERDICT: FAIL.\n" +
@@ -2211,7 +2205,7 @@ while (i < STEPS.length) {
         "Public docs (API.md, README) are NOT source code — read them freely, exactly as a user would.\n" +
         "Read the shared UX bar FIRST: " + UX_DOCTRINE_PATH + " — it is the bar the whole crew builds to, and your verdict judges against it point by point.\n\n" +
         "STEP 1: Experiential terminal inspection — drive the CLI as a user would, one command at a time.\n" +
-        "a. The CLI under test lives in " + REPO_PATH + " (the merged change is on main there). Start like a new user: run --help. You may RUN the CLI; you may never READ its source.\n" +
+        "a. The CLI under test lives in " + REPO_PATH + " (the merged change is on the integration target there). Start like a new user: run --help. You may RUN the CLI; you may never READ its source.\n" +
         "b. Terminal targets for this task: " + termTargetsLine + ".\n" +
         "c. Bounded terminal loop — at most 8 commands. For each target: run it RIGHT (the happy path), then run it WRONG on purpose (bad flags, missing args, nonexistent files, empty input, contradictory flags). Error quality is half the grade: every failure must exit non-zero, say what went wrong in plain language, and tell the user the fix. A raw stack trace shown to a user is a defect — file it as one.\n" +
         "d. Evidence: capture EVERY invocation as a transcript. Run: mkdir -p " + termEvidence + "\n" +
@@ -2434,19 +2428,19 @@ while (i < STEPS.length) {
       var amCheck = await agent(
         "Verify the builder's already-merged declaration.\n" +
         "Run in shell and return the stdout verbatim:\n" +
-        "cd " + REPO_PATH + " && git rev-parse --verify --quiet " + am.sha + " >/dev/null && git merge-base --is-ancestor " + am.sha + " main && echo ALREADY_MERGED_YES || echo ALREADY_MERGED_NO",
+        "TARGET=$(" + LIFECYCLE_ENV + LIFECYCLE + " integration-target) && cd " + REPO_PATH + " && git rev-parse --verify --quiet " + am.sha + " >/dev/null && git merge-base --is-ancestor " + am.sha + " $TARGET && echo ALREADY_MERGED_YES || echo ALREADY_MERGED_NO",
         { key: "verify-already-merged" + (totalReworkCount > 0 ? "-r" + totalReworkCount : ""), label: "Verifying already-merged declaration" }
       );
       var amOut = (typeof amCheck === "string") ? amCheck : JSON.stringify(amCheck);
       if (!/ALREADY_MERGED_YES/.test(amOut)) {
-        log("Build already-merged declaration failed verification — " + am.sha + " is not an ancestor of main — marking failed for retry");
+        log("Build already-merged declaration failed verification — " + am.sha + " is not an ancestor of the integration target — marking failed for retry");
         await agent(
           "Record already-merged verification failure.\n" +
           "Run in shell and return the stdout verbatim:\n" + crewCmd("record-phase", {
             task_id: taskId,
             session: { id: activeSessionId, task_id: taskId, identity: step.identity, step: step.name, status: "failed",
-              notes: "Build declared repo_diff: none (already-merged: " + am.sha + ") but " + am.sha + " is not an ancestor of main in the configured repo. The declaration is fabricated or mistaken; the work is not on main. Phase failed for retry" },
-            event: { task_id: taskId, type: "failed", message: "Build already-merged declaration failed verification — " + am.sha + " not an ancestor of main, phase failed, dispatcher will retry" }
+              notes: "Build declared repo_diff: none (already-merged: " + am.sha + ") but " + am.sha + " is not an ancestor of the integration target in the configured repo. The declaration is fabricated or mistaken; the work is not on the integration target. Phase failed for retry" },
+            event: { task_id: taskId, type: "failed", message: "Build already-merged declaration failed verification — " + am.sha + " not an ancestor of the integration target, phase failed, dispatcher will retry" }
           }),
           { key: "record-already-merged-fail-" + step.name, label: "Recording already-merged verification failure" }
         );
@@ -2454,13 +2448,13 @@ while (i < STEPS.length) {
           __hatchWorkflowControl: "blocked",
           result: {
             blocked_reason: "Build already-merged declaration failed verification",
-            message: "The builder declared repo_diff: none (already-merged: " + am.sha + ") but " + am.sha + " is not an ancestor of main. The work is not on main; the phase is marked failed and the dispatcher will retry Build.",
+            message: "The builder declared repo_diff: none (already-merged: " + am.sha + ") but " + am.sha + " is not an ancestor of the integration target. The work is not on the integration target; the phase is marked failed and the dispatcher will retry Build.",
             task_id: taskId
           }
         };
       }
       alreadyMergedSha = am.sha;
-      log("Build already-merged declaration verified: " + am.sha + " is an ancestor of main");
+      log("Build already-merged declaration verified: " + am.sha + " is an ancestor of the integration target");
     }
   }
 
@@ -2531,7 +2525,7 @@ while (i < STEPS.length) {
       integrateVerifyOut = "";
     }
     if (/^VERIFIED:/m.test(integrateVerifyOut)) {
-      log("Integrate verified for task " + taskId + ": task branch tip is an ancestor of main");
+      log("Integrate verified for task " + taskId + ": task branch tip is an ancestor of the integration target");
     } else {
       var integrateVerifyReason = integrateVerifyOut
         ? integrateVerifyOut.split("\n")[0].slice(0, 200)
@@ -2714,12 +2708,12 @@ while (i < STEPS.length) {
     }
     rejectionNotes = summary;
     // Already-merged corrective (room #16 blocker 11): when Review rejected
-    // an empty branch but the work is already on main (the workflow verified
+    // an empty branch but the work is already on the integration target (the workflow verified
     // the sha), Wren must declare it — not re-implement or re-commit
     // already-landed work. Scoped to the empty-branch rejection; any other
     // rejection already carries its own specific notes.
-    if (step.name === "Review" && alreadyMergedSha && /no commits ahead of main/i.test(summary)) {
-      rejectionNotes += "\n\nCORRECTIVE (from the workflow, not the reviewer): the deliverable is already on main — the workflow mechanically verified that " + alreadyMergedSha + " is an ancestor of main. Do NOT re-implement the work and do NOT create a new commit for it. In your Build report, declare exactly: repo_diff: none (already-merged: " + alreadyMergedSha + ") — then end with VERDICT: PASS.";
+    if (step.name === "Review" && alreadyMergedSha && /no commits ahead of (main|the integration target)/i.test(summary)) {
+      rejectionNotes += "\n\nCORRECTIVE (from the workflow, not the reviewer): the deliverable is already on the integration target — the workflow mechanically verified that " + alreadyMergedSha + " is an ancestor of the integration target. Do NOT re-implement the work and do NOT create a new commit for it. In your Build report, declare exactly: repo_diff: none (already-merged: " + alreadyMergedSha + ") — then end with VERDICT: PASS.";
       log("Rework corrective appended for task " + taskId + ": already-merged " + alreadyMergedSha + " — Wren must declare, not rebuild");
     }
     i = BUILD_INDEX;

package/workflows/upgrade.js

@@ -79,6 +79,12 @@ const NEXT_PHASE_ROUTED = (typeof inputs.next_phase === "string" && inputs.next_
 // (2026-09-16: the silent default let a run resolve against the dev home).
 if (!inputs.crewHome) throw new Error("crewHome is required — pass the crew home explicitly; no default");
 const crewHome = inputs.crewHome;
+// sq(p) — single-quote a path for safe interpolation into shell commands the
+// agents run. A bare double-quoted path breaks on spaces, $, backticks, or
+// quotes; single-quote wrapping is always safe.
+function sq(p) {
+  return "'" + String(p).split("'").join("'\\''") + "'";
+}
 // Crew API: the workflow calls the crew-owned CLI, not the dashboard.
 // The CLI implements the API.md contract against $CREW_HOME/crew-state.db.
 const CREW_API_SRC = crewHome + "/current/lib/crew-api.js";
@@ -91,7 +97,7 @@ let CREW_API = CREW_API_SRC;
 // returns the stdout verbatim (the CLI emits JSON on stdout).
 function crewCmd(command, args) {
   var json = JSON.stringify(args || {}).replace(/'/g, "'\\''");
-  return "node " + CREW_API + " --crew-home " + crewHome + " " + command + " --json '" + json + "'";
+  return "node " + sq(CREW_API) + " --crew-home " + sq(crewHome) + " " + command + " --json '" + json + "'";
 }
 // Telemetry (2026-09-13): structured run timeline. The workflow mints a
 // telemetry run_id at startup via record-run-start (the API generates it
@@ -178,7 +184,7 @@ const LAUNCH_PROJECT_ID = inputs.project_id || "";
 // parks fail-closed at Triage.
 const REPO_PATH = projectConfig.repo_path || "";
 // Env prefix baked into every lifecycle invocation the agents run.
-const LIFECYCLE_ENV = "CREW_HOME=" + crewHome + " CREW_REPO=" + REPO_PATH + " ";
+const LIFECYCLE_ENV = "CREW_HOME=" + sq(crewHome) + " CREW_REPO=" + REPO_PATH + " ";
 // The stable release script — deploys, reports the live release.
 const DEPLOY_SCRIPT = crewHome + "/crew-release.sh";
 
@@ -195,7 +201,7 @@ if (!taskId) {
 function pinLifecycle(key) {
   return agent(
     "Snapshot lifecycle scripts for version pinning.\n" +
-    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + CLASSIFY_SURFACE_SRC + " " + CLASSIFY_SURFACE + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
+    "Run: mkdir -p " + sq(RUN_LIB) + " && cp " + sq(LIFECYCLE_SRC) + " " + sq(LIFECYCLE) + " && cp " + sq(MERGE_LOCK_SRC) + " " + sq(MERGE_LOCK) + " && cp " + sq(PUBLISH_NPM_SRC) + " " + sq(PUBLISH_NPM) + " && cp " + sq(CREW_API_SRC) + " " + sq(CREW_API_PINNED) + " && cp " + sq(SCHEMA_SQL_SRC) + " " + sq(SCHEMA_SQL_PINNED) + " && cp " + sq(CLASSIFY_SURFACE_SRC) + " " + sq(CLASSIFY_SURFACE) + " && chmod +x " + sq(LIFECYCLE) + " " + sq(MERGE_LOCK) + " " + sq(PUBLISH_NPM) + " && ls -1 " + sq(RUN_LIB) + "\n" +
     "Return the verbatim output of the ls -1 command as { \"listing\": \"<verbatim output>\" } and nothing else.",
     { key: key, label: "Pinning lifecycle scripts",
       schema: { type: "object", properties: { listing: { type: "string" } }, required: ["listing"] } }
@@ -258,7 +264,7 @@ async function computeUpgradePlan(evidenceKey, noteIdentity) {
       (sourceIsRepo
         ? "2. The workflow was told source is repo. Check that " + REPO_PATH + "/workflows is a directory AND " + REPO_PATH + "/lib/crew-release.sh exists — repo_ok is true only if both hold. Run: git -C " + REPO_PATH + " rev-parse HEAD and capture the sha as head (empty string if the command fails).\n"
         : "2. The workflow was told source is not repo. Skip all repo checks: return repo_ok false and head as an empty string.\n") +
-      "3. Run: " + DEPLOY_SCRIPT + " current " + crewHome + " — capture the full trimmed stdout as current.\n" +
+      "3. Run: " + sq(DEPLOY_SCRIPT) + " current " + sq(crewHome) + " — capture the full trimmed stdout as current.\n" +
       "Return JSON { \"source_line\": \"<verbatim>\", \"repo_ok\": <bool>, \"head\": \"<sha or empty>\", \"current\": \"<trimmed stdout>\" } and nothing else.",
       {
         key: evidenceKey,
@@ -583,8 +589,8 @@ while (i < STEPS.length) {
     const stagingDir = crewHome + "/.upgrade-staging/" + upgradePlan.version;
     const deployShell =
       (upgradePlan.source === "repo")
-        ? DEPLOY_SCRIPT + " deploy " + REPO_PATH + " " + crewHome
-        : "STAGING=\"" + stagingDir + "\" && mkdir -p \"$STAGING\" && cd \"$STAGING\" && npm init -y >/dev/null 2>&1 && npm install muse-crew@" + upgradePlan.version;
+        ? sq(DEPLOY_SCRIPT) + " deploy " + REPO_PATH + " " + sq(crewHome)
+        : "STAGING=" + sq(stagingDir) + " && mkdir -p \"$STAGING\" && cd \"$STAGING\" && npm init -y >/dev/null 2>&1 && npm install muse-crew@" + upgradePlan.version;
     const deploySteps =
       "1. Run the install (npm source only):\n" + (upgradePlan.source === "repo" ? "   (skipped — repo source has nothing to install)\n" : "   " + deployShell + "\n") +
       "2. Run the deploy:\n   " + (upgradePlan.source === "repo"
@@ -594,10 +600,10 @@ while (i < STEPS.length) {
         // so the deploy source is the installed package root, not the
         // staging root. Do not rely on a $STAGING shell variable persisting
         // between separate shell invocations.
-        : DEPLOY_SCRIPT + " deploy \"" + stagingDir + "/node_modules/muse-crew\" " + crewHome) +
+        : sq(DEPLOY_SCRIPT) + " deploy " + sq(stagingDir + "/node_modules/muse-crew") + " " + sq(crewHome)) +
       " — capture ALL of the command's output and its exit code (run the command, then echo EXIT_CODE=$?).\n" +
       (upgradePlan.source === "npm"
-        ? "3. Remove the staging dir: rm -rf \"" + stagingDir + "\" — best-effort, ALWAYS, even when the deploy fails. Log whether the removal succeeded. Never let cleanup change the deploy outcome.\n"
+        ? "3. Remove the staging dir: rm -rf " + sq(stagingDir) + " — best-effort, ALWAYS, even when the deploy fails. Log whether the removal succeeded. Never let cleanup change the deploy outcome.\n"
         : "") +
       "Do not run git checkout, git pull, or any repo-mutating command. Do not publish to npm — the npm source only INSTALLS the published package. Do not touch the scheduler.";
     var deployResult;
@@ -630,9 +636,12 @@ while (i < STEPS.length) {
       await recordPhase("Deploy", step.identity, activeSessionId, "failed", msg);
       return await parkTask(msg);
     }
-    log("Deploy succeeded for task " + taskId + " — target " + upgradePlan.target);
+    // Razor: exit 0 is the deploy agent's testimony, not proof the release
+    // swap landed. Success is claimed only after Verify's independent checks
+    // pass below.
+    log("Deploy agent returned exit 0 for task " + taskId + " — target " + upgradePlan.target + " (Verify checks pending)");
     await recordPhase("Deploy", step.identity, activeSessionId, "completed",
-      "deployed " + upgradePlan.target + " (" + upgradePlan.source + ")\ndeploy output:\n" + deployOutput.slice(0, 1500));
+      "deploy command exit 0 for " + upgradePlan.target + " (" + upgradePlan.source + ") — Verify checks pending\ndeploy output:\n" + deployOutput.slice(0, 1500));
     i++;
     continue;
   }
@@ -663,7 +672,7 @@ while (i < STEPS.length) {
       curCheck = await agent(
         TOOL_CHECK_PREAMBLE +
         "Read the live release identity.\n" +
-        "Run: " + DEPLOY_SCRIPT + " current " + crewHome + "\n" +
+        "Run: " + sq(DEPLOY_SCRIPT) + " current " + sq(crewHome) + "\n" +
         "Return JSON { \"current\": \"<trimmed stdout>\" } and nothing else.",
         {
           key: "verify-current",
@@ -695,7 +704,7 @@ while (i < STEPS.length) {
       regCheck = await agent(
         TOOL_CHECK_PREAMBLE +
         "Read the deployed registry.\n" +
-        "Run: cat " + crewHome + "/workflows/registry.json\n" +
+        "Run: cat " + sq(crewHome + "/workflows/registry.json") + "\n" +
         "Return JSON { \"raw\": \"<the file's full content, verbatim>\" } and nothing else.",
         {
           key: "verify-registry",
@@ -740,7 +749,7 @@ while (i < STEPS.length) {
       gsCheck = await agent(
         TOOL_CHECK_PREAMBLE +
         "Check the crew database is readable by the OLD release's CLI. Use the PINNED path below — NOT " + crewHome + "/current — because the workflow swapped `current` under itself at Deploy and the live path may already point at the new release.\n" +
-        "Run: node " + CREW_API_PINNED + " --crew-home " + crewHome + " get-state --json '{}'; echo EXIT_CODE=$?\n" +
+        "Run: node " + sq(CREW_API_PINNED) + " --crew-home " + sq(crewHome) + " get-state --json '{}'; echo EXIT_CODE=$?\n" +
         "Return JSON { \"exit\": <the exit code as an integer> } and nothing else.",
         {
           key: "verify-get-state",
@@ -762,6 +771,11 @@ while (i < STEPS.length) {
     }
     log("Verify check 3 passed for task " + taskId + ": pinned crew-api.js get-state exits 0");
 
+    // The success claim lives here now: all three independent checks re-read
+    // the world and confirm the swap — the deploy agent's exit 0 alone never
+    // proved it.
+    log("Deploy succeeded for task " + taskId + " — target " + target + " (Verify: live release, registry, and pinned CLI all confirm)");
+
     await agent(
       "Log the completed upgrade.\n" +
       "Run in shell and return the stdout verbatim:\n" + crewCmd("log-event", {