muse-crew 0.14.1 → 0.14.2

package/AGENTS.md

@@ -18,4 +18,4 @@ Muse Crew source repository. The repo is the product; the personal instance (`$C
 - Git source is authoritative.
 - Never expose this repo publicly.
 - Ship implementation and documentation together.
-- After editing `workflows/*.js`, run `bash tests/run.sh` — `node --check` does NOT catch syntax errors inside function bodies (V8 lazy preparsing), so it cannot validate workflow edits alone.
+- After editing `workflows/*.js`, run `bash tests/run.sh` — `node --check` does NOT catch syntax errors inside function bodies (V8 lazy preparsing), so it cannot validate workflow edits alone. Worse (2026-09-19): raw `node --check` on the unstripped file is a FALSE NEGATIVE — the file parses as a module (top-level `export`), which masks breakage the release gate's export-strip + async-wrap transform exposes (module/script goal confusion). An unterminated string passed raw `node --check` and was caught only by `publish-verdict-first.test.js`'s loader emulation. After any workflow edit, verify with the true gate: `{ echo "async function __crew_workflow__(args) {"; sed 's/^export //' workflows/<f>.js; echo "}"; } > /tmp/w.js && node --check /tmp/w.js` — or just run the suite.

package/docs/decisions/publish-path.md

@@ -1125,15 +1125,15 @@ Applies to: standard, bugfix, chore.
 ```
   // Deterministic integrate verification: the agent cannot self-certify a
   // merge. After the Integrate agent claims success, the workflow confirms
-  // mechanically that the task branch tip is an ancestor of main via the
+  // mechanically that the task branch tip is an ancestor of the integration target via the
   // lifecycle script's verify-merge command (which resolves the branch
   // through the crew registry — never by reconstructing "task/"+taskId — so
   // the check cannot verify the wrong branch). The VERIFIED marker is matched
   // by regex on the script's own stdout; agent prose is never read. This
   // closes the hole where an agent reported "merged empty" while approved
   // commits were still stranded on the task branch (bug b1b1f919). A genuine
-  // empty-diff Integrate (MERGED_EMPTY: no commits ahead of main) verifies
-  // vacuously — the tip is then an ancestor of main. Verification failure is
+  // empty-diff Integrate (MERGED_EMPTY: no commits ahead of the integration target) verifies
+  // vacuously — the tip is then an ancestor of the integration target. Verification failure is
   // an operational step failure, not a park: the dispatcher retries Integrate
   // under its consecutive-failure cap, and the retry finds the commits still
   // on the branch and performs the real merge — self-healing.
@@ -1149,14 +1149,14 @@ Applies to: standard, bugfix, chore.
 ```
     // Already-merged idempotency: a `repo_diff: none (already-merged:
     // <sha>)` declaration is verified mechanically — <sha> must resolve
-    // and be an ancestor of main in the configured repo. A fabricated or
+    // and be an ancestor of the integration target in the configured repo. A fabricated or
     // mistaken declaration fails the phase here (the dispatcher retries
     // Build under its consecutive-failure cap); a verified declaration is
     // recorded in alreadyMergedSha for Review's no-diff branch. Without
     // this guard, Build correctly doing nothing left Review with no
     // mechanical way to accept an empty diff, and Cass rejected for "no
-    // commits ahead of main — the builder likely forgot to commit" while
-    // the deliverable sat on main (canary 2026-09-15, task 1d692d91).
+    // commits ahead of the integration target — the builder likely forgot to commit" while
+    // the deliverable sat on the integration target (canary 2026-09-15, task 1d692d91).
     // The sha is hex-only by construction (extractAlreadyMerged), so
     // interpolating it into the shell command cannot inject.
 ```

package/docs/decisions/workflow-core.md

@@ -44,7 +44,7 @@ Applies to: standard, bugfix, chore.
 // that parks or fails must not leak its worktree, branch, or merge lock.
 // The lifecycle's terminal-cleanup releases the lock unconditionally and
 // reclaims the worktree+branch ONLY when the task branch is fully merged
-// into main (then it is redundant); unmerged work is preserved for the
+// into the integration target (then it is redundant); unmerged work is preserved for the
 // human by design. Fire-and-forget with one bounded retry — the merge-lock
 // lease expiry and the orphan sweep are the backstop for a dead transport.
 ```

package/docs/guide.md

@@ -201,7 +201,7 @@ If you don't have a project in mind, the crew can set up a sample: a tiny flashc
 
 ### Worktrees
 
-Each task builds in an isolated git worktree at `<repo>/.worktrees/<task_id>`, on a branch named `task/<task_id>`. The lifecycle manager (`lib/worktree-lifecycle.sh`) owns creation and removal — workflows and agents never run raw `git worktree` commands. The crew's own task→worktree registry (`<repo>/.worktrees/.registry/`) is the source of truth for task→branch/path; `prepare` fails closed when `main` is dirty, and `cleanup` is forgiving so a failed run never strands a worktree.
+Each task builds in an isolated git worktree at `<repo>/.worktrees/<task_id>`, on a branch named `task/<task_id>`. The lifecycle manager (`lib/worktree-lifecycle.sh`) owns creation and removal — workflows and agents never run raw `git worktree` commands. The crew's own task→worktree registry (`<repo>/.worktrees/.registry/`) is the source of truth for task→branch/path; `prepare` fails closed when the integration target is dirty, and `cleanup` is forgiving so a failed run never strands a worktree.
 
 ## Filing a task
 
@@ -336,7 +336,7 @@ Configuration (per project, via the existing `getconfig` / `updateconfig` action
 
 The crew upgrades itself through the normal dispatch loop. An upgrade task carries a `source:` line in its description naming where the new release comes from:
 
-- `source: repo` (default when absent) — deploys the task project's repo at its current HEAD. This is how you ship repo changes to your running crew: change the code, merge to main, then file an upgrade task pointing at that repo.
+- `source: repo` (default when absent) — deploys the task project's repo at its current HEAD. This is how you ship repo changes to your running crew: change the code, merge into the integration target (the repo's current checkout), then file an upgrade task pointing at that repo.
 - `source: npm@x.y.z` — installs the published `muse-crew` package at that exact version from the public npm registry. Use this to move the crew onto a known-good release — including one that predates the upgrade workflow itself.
 
 Both paths deploy through the stable `crew-release.sh` on persistent disk (never the release under upgrade), then verify mechanically: the live release equals the target, the release registry parses, and `crew-api get-state` works. Handover is automatic — the next polling tick launches the dispatcher from the new release through the `current` symlink. In-flight runs finish on the old release via the per-task lib pin, so an upgrade mid-flight does not break running work.
@@ -379,7 +379,7 @@ Each phase has an assigned identity — a character with a defined personality:
 | Map | **Mara** | Designer |
 | Build | **Wren** | Quietest one, trusts the plan |
 | Review | **Cass** | Fair but exacting — holds the spec as the contract |
-| Integrate | **Wren** | Merges the work, pushes `main` to the repo (succeeds vacuously when the task branch is empty — runtime-state deliverable) |
+| Integrate | **Wren** | Merges the work into the integration target and pushes it (succeeds vacuously when the task branch is empty — runtime-state deliverable) |
 | Publish | **Wren** | Ships the merged code to the publish target (skipped when none). The workflow verifies the side effect mechanically — npm via registry version; artifact via an independent content read-back before the parent stamps provenance (see `docs/publish-verification.md`) — and fails closed if the worker's report and system state disagree |
 | QA | **Hazel** | Code-blind, persistent, wears persona costumes |
 | Reproduce | **Hazel** | Reproduces bugs before fixing |

package/lib/AGENTS.md

@@ -7,7 +7,8 @@ Shell scripts for the crew's infrastructure. Called by workflow scripts, cron, a
 - `schema.sql` — the crew-owned state schema: projects, tasks, poll_state, config, agent_sessions, events. Vocabularies enforced by CHECK constraints; `rejected` is a valid event type (the 2026-09-11 crash was a stored session whose event was rejected). Column names match the historical dashboard tables for a verbatim migration.
 - `crew-release.sh` — immutable release manager: deploy, rollback, prune
 - `merge-lock.sh` — serialized merge lock for concurrent agents: time-based holder lease (bug 2fc8f52f — an unexpired lease is held regardless of process liveness; only an expired lease may be broken). Requires both `CREW_REPO` and `CREW_HOME` (fail closed: BLOCKED, exit 2 when either is unset). Lock file is key=value: task_id, opaque holder identity (never a PID), acquired_at epoch, lease_seconds (default 600, override via MERGE_LOCK_LEASE_SECONDS). acquire/refresh/release/status/force-release; holder-only refresh and release; every op appends to $CREW_HOME/.merge-lock.log
-- `worktree-lifecycle.sh` — the worktree lifecycle seam: prepare/cleanup/inspect/integrate/verify-merge/status/post-deploy/terminal-cleanup/refresh-lock/lock-status over git worktrees (`integrate` reconciles `origin/main` under the merge lock after the task merge — canary `a6d8b0c8`, 2026-09-11 — so the push is a fast-forward; fail-soft with no remote, fail closed on conflict) (`.worktrees/<id>`, branch `task/<id>`). Branch resolution order: the crew registry (`<repo>/.worktrees/.registry/<id>`), then the canonical `task/<full-id>` ref, then a `task/<id-prefix>` ref matched by strict prefix enumeration (task 4e1a1bba — a Build agent may create the branch with raw git from an abbreviated id, bypassing prepare; prefix names are tolerated, never created; ambiguous prefixes fail closed). `resolve-branch` prints the resolved branch for agent-side one-liners. Nothing reconstructs the branch name — every command resolves it. Prepare fails closed on dirty `main`; cleanup is forgiving. `terminal-cleanup` is the run's last act at every park/fail boundary (called from `parkTask` in standard/bugfix/chore): releases the merge lock unconditionally and reclaims the worktree+branch only when the task branch is fully merged into main — unmerged work is preserved for the human by design, and a dirty worktree is reported, never force-removed. `post-deploy` reports worktree removal honestly (a lying "removed" echo hid real leftovers — canary run 9, 2026-09-12). Requires both `CREW_REPO` and `CREW_HOME` (fail closed: BLOCKED, exit 2 when either is unset); `CREW_REPO` is exported so internal merge-lock.sh calls inherit the repo being worked on; `LIB_DIR` defaults to `$CREW_HOME/lib` (`CREW_LIB` override). `lock-status` reports the merge-lock state explicitly (`UNLOCKED`, or key=value: locked=true, task_id, holder, acquired_at, lease_seconds, age_seconds, remaining_seconds — always exit 0) so Publish can distinguish an empty-diff Integrate (no lock taken) from a refresh failure. post-deploy's `.worktrees/` guard is add-then-reset, never an all-negative pathspec: `git add -A -- ':!.worktrees/'` still exits 1 on git 2.43.0 against the crew's own gitignored non-empty `.worktrees/` (room #15 J3), killing post-deploy under `set -e` — a plain `add -A` never errors on ignored paths and the follow-up `git reset -q -- .worktrees/` keeps stray lock files out of main even on pre-gitignore-entry repos.
+- `worktree-lifecycle.sh` — the worktree lifecycle seam: prepare/cleanup/inspect/integrate/verify-merge/status/post-deploy/terminal-cleanup/refresh-lock/lock-status over git worktrees (the integration target is the repo's current checkout — a branch name, or HEAD when detached — resolved by `integration_target()`; nothing in the lifecycle ever checks out a branch. `integrate` merges into the target, reconciles `origin/<target>` under the merge lock after the task merge — canary `a6d8b0c8`, 2026-09-11 — then pushes inline via `do_push` (no agent round-trip; 2026-09-19 REVIEW collapsed the old STEP-2 agent run, which added only a lock refresh). `do_push`: PUSHED / PUSH_SKIPPED (detached HEAD — the line is local by design, a policy choice not a git limitation) / NO_REMOTE_PUSH (no origin — fail-soft, 2026-09-19 REVIEW: the old unconditional push exited 128 and mislabeled it); on push failure one fetch+merge retry while the lock is held, then fail closed without asserting a cause (never force-push). Merged-but-unpushed retry recovery: a record whose merge commit IS the live HEAD takes the lock and pushes instead of reporting MERGED_EMPTY. `CREW_STAGED_BASE` guard (ferried from get-provenance): the line must descend from the staged publish base — STAGED_BASE_MISMATCH fails closed before the merge (room #21 J3 shape). `verify-merge` always re-resolves the target from the current checkout and checks the recorded commit against the LIVE tip — never the record's word for the tip (2026-09-19 REVIEW: the old read-back compared the record to itself for target=HEAD). A detached HEAD skips the reconcile loudly (NO_REMOTE_RECONCILE) — room #21 J3, 2026-09-19 — fail-soft with no remote, fail closed on conflict; `push-target` is the thin R5 wrapper over `do_push`: refreshes the lock, distinguishes nothing-merged (no record + no lock → loud skip) from lock-lost (fail closed). (`.worktrees/<id>`, branch `task/<id>`). Branch resolution order: the crew registry (`<repo>/.worktrees/.registry/<id>`), then the canonical `task/<full-id>` ref, then a `task/<id-prefix>` ref matched by strict prefix enumeration (task 4e1a1bba — a Build agent may create the branch with raw git from an abbreviated id, bypassing prepare; prefix names are tolerated, never created; ambiguous prefixes fail closed). `resolve-branch` prints the resolved branch for agent-side one-liners. Nothing reconstructs the branch name — every command resolves it. Prepare fails closed on a dirty integration target; cleanup is forgiving. `terminal-cleanup` is the run's last act at every park/fail boundary (called from `parkTask` in standard/bugfix/chore): releases the merge lock unconditionally and reclaims the worktree+branch only when the task branch is fully merged into the integration target — unmerged work is preserved for the human by design, and a dirty worktree is reported, never force-removed. `post-deploy` reports worktree removal honestly (a lying "removed" echo hid real leftovers — canary run 9, 2026-09-12). Requires both `CREW_REPO` and `CREW_HOME` (fail closed: BLOCKED, exit 2 when either is unset); `CREW_REPO` is exported so internal merge-lock.sh calls inherit the repo being worked on; `LIB_DIR` defaults to `$CREW_HOME/lib` (`CREW_LIB` override). `lock-status` reports the merge-lock state explicitly (`UNLOCKED`, or key=value: locked=true, task_id, holder, acquired_at, lease_seconds, age_seconds, remaining_seconds — always exit 0) so Publish can distinguish an empty-diff Integrate (no lock taken) from a refresh failure. post-deploy's `.worktrees/` guard is add-then-reset, never an all-negative pathspec: `git add -A -- ':!.worktrees/'` still exits 1 on git 2.43.0 against the crew's own gitignored non-empty `.worktrees/` (room #15 J3), killing post-deploy under `set -e` — a plain `add -A` never errors on ignored paths and the follow-up `git reset -q -- .worktrees/` keeps stray lock files out of the integration target even on pre-gitignore-entry repos.
+- `test-detached-integrate.sh` — behavioral regression tests for the detached-HEAD Integrate fix (room #21 J3, 2026-09-19; extended 2026-09-19 REVIEW): fixture A stages a detached HEAD (reviewed SHA + crew-init commit) and proves integrate leaves HEAD detached, keeps the reviewed SHA and crew-init as ancestors, lands the task merge, never moves main, records `integration_target=HEAD`, verify-merge VERIFIEDs, and push-target PUSH_SKIPPEDs; fixture B proves the branch path still merges, reconciles, and pushes inline to a local origin; fixture C proves verify-merge checks the record against the LIVE tip (a detached line reset past the merge does NOT verify; the branch-gone path verifies only when the recorded commit is an ancestor of the live tip); fixture D proves the no-remote branch path fails soft with NO_REMOTE_PUSH (exit 0); fixture E proves the CREW_STAGED_BASE guard (non-ancestor base → STAGED_BASE_MISMATCH before any merge; true base → STAGED_BASE_OK); fixture F proves merged-but-unpushed retry recovery (re-running integrate after a crashed push takes the lock and pushes instead of parking on MERGED_EMPTY). Scratch dirs under /tmp only; CREW_HOME lives outside the scratch repos (as in real rooms) so lock files never trip the integrate preflight.
 - `test-worktree-backend.sh` — regression tests for the lifecycle script (validate, prepare/reuse, inspect, status, cleanup, idempotent cleanup, dirty-main preflight, integrate remote-reconcile with fixture sensitivity + no-remote fail-soft) on scratch repos
 - `test-version-write.sh` — regression tests for the escape-preserving step-8 version write in publish-npm.sh (fixture: current package.json with the \\u2014 escape; extracts the shipped block by anchor)
 - `test-publish-verify.sh` — regression tests for the retry-tolerant step-12 verification in publish-npm.sh (canary 5a027278): extracts the shipped block by anchor and runs it against a fake npm whose read replica lags (non-zero exits, then the old version, then the target) — requires convergence on success, fail-closed `PUBLISH_FAILED=verify` on exhaustion, and `--prefer-online` on every read
@@ -31,7 +32,7 @@ Shell scripts for the crew's infrastructure. Called by workflow scripts, cron, a
 - `update-watch.js` — deterministic automatic update watcher (2026-09-16, zero deps): `node update-watch.js --crew-home <path>` (missing arg → usage, exit 2; every other path exits 0). Watches the public npm registry (`npm view muse-crew version` pinned to `https://registry.npmjs.org/`) vs `crew-release.sh current` and files a `workflow: "upgrade"` task with `source: npm@<version>` when policy (`auto_update_crew`, `update_channel`) and channel gating allow; watches `git ls-remote origin HEAD` on the first `deploy_type=artifact` project vs `$CREW_HOME/.update-watch.json` and files a `workflow: "chore"` task carrying the mechanical dashboard-upgrade journey. Reads the `.crew-version` compatibility anchor at the new ref via `git fetch` + `git show <sha>:.crew-version` (never the working tree) and orders dashboard-led: a declared newer crew files the crew upgrade task FIRST and the dashboard task notes it follows the crew upgrade (declaration bypasses `update_channel`, not the `auto_update_crew=false` opt-out); a declared older crew skips the dashboard leg entirely as a human decision; a missing/invalid/unfetchable anchor fails open to the dashboard leg as today. Idempotency via the same state file (records at file time); check failures log to `$CREW_HOME/update-watch.log` and are never thrown. Safety: only files tasks — never deploys, never touches the artifact/config/scheduler. Run by the daily `crew-update-watch` cron through the `current` symlink (latest release); deliberately NOT in the lib-pinning `PIN_BASENAMES`.
 - `gitignore.js` — deterministic .gitignore management for crew-owned paths (2026-09-17): the crew touches exactly one user-owned file outside `.orchestration/` — the repo's `.gitignore`. `ensureGitignoreEntries(repoPath, entries)` creates the file when missing, appends missing entries (exact line match, no duplicates), preserves existing content byte-for-byte, and is idempotent. `describeGitignoreChange(repoPath, entries)` renders the exact diff for the setup consent conversation. Crew-owned entries: `.worktrees/`, `.orchestration/user/`. CLI: `--repo <path> [--dry-run]`.
 - `repo-orchestration.js` — repository-local `.orchestration/` scaffold (2026-09-17): `scaffoldRepoOrchestration(repoPath, crewRepoPath)` creates `$REPO/.orchestration/{workflows,identities,phases,user}/`, seeds workflows/identities/phases from the crew repo's platform defaults with no-clobber semantics (existing project customizations never overwritten), and writes a README in `user/` explaining it's for local config. Idempotent. CLI: `--repo <path> --crew-repo <path>`.
-- `setup-project-repo.js` — repo-local setup composer for a registered project (2026-09-17, setup-commit 2026-09-18): runs the `.orchestration/` scaffold plus the `.gitignore` update (only with explicit `--consent`), then COMMITS both via `commit-scaffold.js` so the repo's main checkout is clean when setup finishes (room #13: an uncommitted scaffold deterministically broke the first task's Integrate). Refuses loudly when `.gitignore` has pre-existing uncommitted changes (never sweeps the user's edits into the setup commit); `.orchestration/` is crew-owned so pre-existing content there is committed, not refused. The CLI-path equivalent of crew-init's dashboard-mode repo setup; the dashboard calls the same script. No new API endpoint — composition of existing deterministic modules. CLI: `--repo <path> --crew-repo <path> [--consent]`; prints `{ orchestration, gitignore, commit }`, exits non-zero on any failure.
+- `setup-project-repo.js` — repo-local setup composer for a registered project (2026-09-17, setup-commit 2026-09-18): runs the `.orchestration/` scaffold plus the `.gitignore` update (only with explicit `--consent`), then COMMITS both via `commit-scaffold.js` so the repo's primary checkout is clean when setup finishes (room #13: an uncommitted scaffold deterministically broke the first task's Integrate). Refuses loudly when `.gitignore` has pre-existing uncommitted changes (never sweeps the user's edits into the setup commit); `.orchestration/` is crew-owned so pre-existing content there is committed, not refused. The CLI-path equivalent of crew-init's dashboard-mode repo setup; the dashboard calls the same script. No new API endpoint — composition of existing deterministic modules. CLI: `--repo <path> --crew-repo <path> [--consent]`; prints `{ orchestration, gitignore, commit }`, exits non-zero on any failure.
 - `commit-scaffold.js` — deterministic setup-scaffold commit (2026-09-18): stages only `.orchestration/` (+ `.gitignore` with `--gitignore`) and commits with a message naming exactly what was staged. Idempotent (`nothing-to-commit`, never an empty commit); not-a-git-repo is a clean no-op; missing `.orchestration/` and commit failures (e.g. no git identity) throw loudly — the commit belongs to the user, so no identity is ever invented here. Exports `isPathDirty` (porcelain check for one path) for the composer's pre-mutation guard. CLI: `--repo <path> [--gitignore]`.
 - `sample-project.js` — optional sample-project setup (2026-09-17): extracts `seed/sample-project.tar.gz` (stripping the `sample-project/` prefix), `git init`, initial commit. No remote required. Registration happens via the existing `create-project` action — no sample-specific endpoint. CLI: `--tarball <path> --dest <dir> --name <project-name>`.
 - `compute-publish-diff.js` — deterministic publish-diff computer (2026-09-18, room #14): replaces the agent-ferried `git diff` JSON string field (the JSON ferry dropped a valid 700-line diff — "Publish diff parsed to zero files"). Runs `git diff <base> <HEAD>` via argv (no shell), writes the raw diff bytes to `--out`, and prints only a small JSON summary (`commit`, `base`, `diff_file`, `sha256`, `bytes`, `file_count`, `changed_lines` = added+removed, never raw diff output lines, `files`, `has_binary`, `has_rename`). Empty-tree base is the first-publish ancestor (hardcoded, never `merge-base` on the empty tree); non-ancestor is semantic JSON (`ok:false, error:"not-ancestor"`, exit 0); usage errors exit 2 with nothing on stdout. Pinned per-run alongside the other lifecycle files (`COMPUTE_DIFF` in `PIN_BASENAMES`) so a mid-run release swap cannot change it under the workflow.

package/lib/publish-npm.sh

@@ -281,7 +281,15 @@ LOCK_OUT2="$(CREW_HOME="${CREW_HOME:-}" CREW_REPO="$REPO_PATH" bash "${LIFECYCLE
   || fail "lock-refresh" "$LOCK_OUT2"
 
 # 13. Push the version-bump commit (idempotent: no-op if already pushed).
-PUSH_OUT="$(git -C "$REPO_PATH" push origin main 2>&1)" \
+# The destination is the integration target resolved by the lifecycle, not a
+# hardcoded `main` (2026-09-19 REVIEW: the old `git push origin main` was a
+# stale clone of the same hardcoding the integrate fix removed).
+PUSH_TARGET="$(CREW_HOME="${CREW_HOME:-}" CREW_REPO="$REPO_PATH" bash "${LIFECYCLE:?LIFECYCLE is required}" integration-target 2>&1)" \
+  || fail "integration-target" "$PUSH_TARGET"
+if [ "$PUSH_TARGET" = "HEAD" ]; then
+  fail "push" "detached HEAD: publish-npm cannot push a version-bump commit from a detached checkout"
+fi
+PUSH_OUT="$(git -C "$REPO_PATH" push origin "$PUSH_TARGET" 2>&1)" \
   || fail "push" "$PUSH_OUT"
 echo "PUBLISH_PUSHED=1"
 

package/lib/test-detached-integrate.sh

@@ -0,0 +1,340 @@
+#!/bin/bash
+# test-detached-integrate.sh — behavioral regression tests for the
+# detached-HEAD Integrate fix (room #21, J3, 2026-09-19).
+#
+# The defect: cmd_integrate ran require_clean_main, whose unconditional
+# `git checkout main` abandoned a detached-HEAD room line (reviewed SHA +
+# crew-init commit). Publish then failed closed on ancestry and the journey
+# parked. The fix: the integration target is the repo's current checkout
+# (branch name, or HEAD when detached); nothing in the lifecycle ever
+# checks out a branch.
+#
+# Fixture A (detached HEAD — the room #21 shape):
+#   reviewed commit A, detached HEAD, crew-init commit B on top, task
+#   branch from B with work commit C. Integrate must:
+#   1. report integration-target = HEAD
+#   2. MERGE with exit 0
+#   3. leave HEAD detached (no checkout happened)
+#   4. keep A (reviewed SHA) and B (crew-init) as ancestors of HEAD —
+#      the exact J3 failure was B being abandoned
+#   5. land C (the task work) as an ancestor of HEAD via a real merge
+#      commit with two parents
+#   6. NOT move the main branch (it still points at A)
+#   7. write integration_target=HEAD in the merge record
+#   8. verify-merge → VERIFIED
+#   9. push-target → PUSH_SKIPPED (detached HEAD has no remote counterpart)
+#
+# Fixture B (branch — the old behavior is preserved):
+#   repo on main with a local bare origin. Integrate merges, reconciles,
+#   and pushes inline; push-target also PUSHEDs to origin.
+#
+# Fixture C (detached HEAD, live-tip verify-merge — 2026-09-19 REVIEW):
+#   verify-merge must check the record against the LIVE HEAD, never the
+#   record's word for the tip: a detached line reset past the merge does
+#   NOT verify; with the branch gone it verifies only when the recorded
+#   commit is an ancestor of the live tip.
+#
+# Fixture D (branch, no remote — 2026-09-19 REVIEW blocker 3):
+#   the old push-target ran `git push origin` with no origin → exit 128
+#   mislabeled PUSH_REJECTED. Now the inline push fails soft with
+#   NO_REMOTE_PUSH and exit 0.
+#
+# Fixture E (staged-base guard — 2026-09-19 REVIEW #10):
+#   CREW_STAGED_BASE naming a non-ancestor fails closed with
+#   STAGED_BASE_MISMATCH before any merge; the true staged base proceeds
+#   with STAGED_BASE_OK.
+#
+# Fixture F (merged-but-unpushed retry recovery — 2026-09-19 REVIEW):
+#   a prior attempt merged but never pushed (lock released to simulate the
+#   crash): re-running integrate takes the lock and pushes instead of
+#   parking on MERGED_EMPTY.
+#
+# Hermetic: scratch dirs under /tmp only, removed at start (and end).
+set -u
+
+REPO_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+LIFECYCLE="$REPO_DIR/lib/worktree-lifecycle.sh"
+
+fail() { echo "FAIL: $1"; exit 1; }
+
+T=/tmp/crew-detached-integrate-test
+rm -rf "$T"
+mkdir -p "$T"
+
+# ---------------- Fixture A: detached HEAD ----------------
+A_DIR="$T/fixture-a"
+mkdir -p "$A_DIR"
+cd "$A_DIR"
+git init -q -b main .
+git config user.email test@test.t
+git config user.name test
+echo reviewed > f.txt
+git add -A
+git commit -qm "reviewed base"
+A_SHA=$(git rev-parse HEAD)
+
+# Detach at the reviewed SHA (clean-room staging pins it), then commit the
+# crew-init stamp on top — the detached line Integrate must not abandon.
+git checkout -q --detach HEAD
+echo crew-init >> f.txt
+git commit -qam "crew-init: stamp provenance"
+B_SHA=$(git rev-parse HEAD)
+git symbolic-ref -q HEAD >/dev/null && fail "fixture A: HEAD should be detached"
+
+export CREW_REPO="$A_DIR"
+export CREW_HOME="$A_DIR/home"
+export CREW_LIB="$REPO_DIR/lib"  # merge-lock.sh lives in the repo's lib, not the scratch crew home
+tid="detached1"
+
+# 1. integration-target resolves to HEAD
+out=$(bash "$LIFECYCLE" integration-target) || fail "integration-target exited non-zero: $out"
+[ "$out" = "HEAD" ] || fail "integration-target: expected HEAD, got: $out"
+
+# prepare + task work
+out=$(bash "$LIFECYCLE" prepare "$tid") || fail "prepare exited non-zero: $out"
+echo task-work >> "$A_DIR/.worktrees/$tid/f.txt"
+(cd "$A_DIR/.worktrees/$tid" && git commit -qam "task work")
+C_SHA=$(cd "$A_DIR/.worktrees/$tid" && git rev-parse HEAD)
+
+# 2. integrate
+out=$(bash "$LIFECYCLE" integrate "$tid" "merge: $tid" 2>&1) || fail "integrate exited non-zero: $out"
+echo "$out" | grep -q '^MERGED:' || fail "integrate: expected MERGED, got: $out"
+echo "$out" | grep -q 'NO_REMOTE_RECONCILE: detached HEAD' || fail "integrate: expected NO_REMOTE_RECONCILE, got: $out"
+
+# 3. HEAD is still detached — no checkout happened
+git symbolic-ref -q HEAD >/dev/null && fail "integrate checked out a branch: HEAD is now attached"
+
+# 4. the detached line survived: reviewed SHA and crew-init are ancestors
+git merge-base --is-ancestor "$A_SHA" HEAD || fail "reviewed SHA $A_SHA is no longer an ancestor of HEAD"
+git merge-base --is-ancestor "$B_SHA" HEAD || fail "crew-init commit $B_SHA was abandoned (the J3 defect)"
+
+# 5. the task work landed via a real merge commit
+git merge-base --is-ancestor "$C_SHA" HEAD || fail "task commit $C_SHA is not an ancestor of HEAD"
+MERGE_SHA=$(git rev-parse HEAD)
+parents=$(git rev-list --parents -n 1 "$MERGE_SHA" | wc -w)
+[ "$parents" -eq 3 ] || fail "expected a 2-parent merge commit, got $parents words in: $(git rev-list --parents -n 1 "$MERGE_SHA")"
+
+# 6. main was not touched
+MAIN_SHA=$(git rev-parse main)
+[ "$MAIN_SHA" = "$A_SHA" ] || fail "main moved during integrate: $MAIN_SHA != reviewed $A_SHA"
+
+# 7. merge record names the target
+rec=$(bash "$LIFECYCLE" merge-record "$tid")
+echo "$rec" | grep -q '^integration_target=HEAD$' || fail "merge record missing integration_target=HEAD: $rec"
+
+# 8. verify-merge
+out=$(bash "$LIFECYCLE" verify-merge "$tid") || fail "verify-merge exited non-zero: $out"
+echo "$out" | grep -q '^VERIFIED:' || fail "verify-merge: expected VERIFIED, got: $out"
+
+# 9. push-target skips loudly on a detached HEAD
+out=$(bash "$LIFECYCLE" push-target "$tid") || fail "push-target exited non-zero: $out"
+echo "$out" | grep -q '^PUSH_SKIPPED: detached HEAD' || fail "push-target: expected PUSH_SKIPPED, got: $out"
+
+echo "fixture A (detached HEAD): all checks passed"
+
+# ---------------- Fixture C: verify-merge checks the record against the LIVE tip ----------------
+# (2026-09-19 REVIEW blockers 1+2: the old verify-merge compared the merge
+# record against itself for target=HEAD — is-ancestor(X, X) is a tautology
+# that certified merges no longer on the line.)
+# Still in fixture A's repo ($A_DIR); task detached1 is merged at $MERGE_SHA.
+cd "$A_DIR"
+export CREW_REPO="$A_DIR"
+export CREW_HOME="$A_DIR/home"
+
+# C1: reset the detached line backward past the merge — the merge is no
+# longer on the line. verify-merge must NOT verify.
+git reset -q --hard "$B_SHA"
+out=$(bash "$LIFECYCLE" verify-merge "$tid" 2>&1) && fail "C1: verify-merge exited 0 for a merge no longer on the line: $out"
+echo "$out" | grep -q '^VERIFIED:' && fail "C1: VERIFIED a reset-away merge: $out"
+echo "C1: verify-merge rejects a detached line reset past the merge"
+
+# C2: restore the merge, remove the worktree, delete the task branch
+# (merge-lease reclaim path). verify-merge must VERIFY from the record —
+# but only because the recorded commit is an ancestor of the LIVE tip.
+git reset -q --hard "$MERGE_SHA"
+BRANCH=$(bash "$LIFECYCLE" resolve-branch "$tid") || fail "C2: resolve-branch failed"
+git worktree remove --force "$A_DIR/.worktrees/$tid" || fail "C2: worktree remove failed"
+git branch -q -D "$BRANCH" || fail "C2: could not delete task branch $BRANCH"
+out=$(bash "$LIFECYCLE" verify-merge "$tid" 2>&1) || fail "C2: verify-merge exited non-zero: $out"
+echo "$out" | grep -q '^VERIFIED:' || fail "C2: expected VERIFIED via record fallback, got: $out"
+echo "$out" | grep -q 'gone but recorded merge commit' || fail "C2: expected the branch-gone record path, got: $out"
+echo "fixture C (live-tip verify-merge): all checks passed"
+
+# ---------------- Fixture B: branch with a local origin ----------------
+B_DIR="$T/fixture-b"
+REMOTE="$T/remote.git"
+mkdir -p "$B_DIR"
+git init -q --bare "$REMOTE"
+cd "$B_DIR"
+git init -q -b main .
+git config user.email test@test.t
+git config user.name test
+echo base > f.txt
+git add -A
+git commit -qm "base"
+git remote add origin "$REMOTE"
+git push -q origin main
+
+export CREW_REPO="$B_DIR"
+export CREW_HOME="$B_DIR/home"
+tid="branch1"
+
+out=$(bash "$LIFECYCLE" integration-target) || fail "B integration-target exited non-zero"
+[ "$out" = "main" ] || fail "B integration-target: expected main, got: $out"
+
+out=$(bash "$LIFECYCLE" prepare "$tid") || fail "B prepare exited non-zero: $out"
+echo task-work >> "$B_DIR/.worktrees/$tid/f.txt"
+(cd "$B_DIR/.worktrees/$tid" && git commit -qam "task work")
+
+out=$(bash "$LIFECYCLE" integrate "$tid" "merge: $tid" 2>&1) || fail "B integrate exited non-zero: $out"
+echo "$out" | grep -q '^MERGED:' || fail "B integrate: expected MERGED, got: $out"
+echo "$out" | grep -q '^RECONCILED: merged origin/main into main' || fail "B integrate: expected RECONCILED, got: $out"
+
+rec=$(bash "$LIFECYCLE" merge-record "$tid")
+echo "$rec" | grep -q '^integration_target=main$' || fail "B merge record missing integration_target=main: $rec"
+
+out=$(bash "$LIFECYCLE" verify-merge "$tid") || fail "B verify-merge exited non-zero: $out"
+echo "$out" | grep -q '^VERIFIED:' || fail "B verify-merge: expected VERIFIED, got: $out"
+
+# push-target pushes the branch to the local origin
+out=$(bash "$LIFECYCLE" push-target "$tid" 2>&1) || fail "B push-target exited non-zero: $out"
+echo "$out" | grep -q '^PUSHED: origin/main' || fail "B push-target: expected PUSHED, got: $out"
+LOCAL_MAIN=$(git rev-parse main)
+REMOTE_MAIN=$(git --git-dir="$REMOTE" rev-parse refs/heads/main)
+[ "$LOCAL_MAIN" = "$REMOTE_MAIN" ] || fail "B origin/main not updated: $REMOTE_MAIN != $LOCAL_MAIN"
+
+echo "fixture B (branch + origin): all checks passed"
+
+# ---------------- Fixture D: branch target, no remote ----------------
+# (2026-09-19 REVIEW blocker 3: push-target ran `git push origin` with no
+# origin → exit 128 mislabeled PUSH_REJECTED. Now: fail-soft NO_REMOTE_PUSH.)
+D_DIR="$T/fixture-d"
+mkdir -p "$D_DIR"
+cd "$D_DIR"
+git init -q -b main .
+git config user.email test@test.t
+git config user.name test
+echo base > f.txt
+git add -A
+git commit -qm "base"
+export CREW_REPO="$D_DIR"
+# CREW_HOME lives OUTSIDE the repo (as in real rooms): the lock files are
+# crew state, and nesting them in the repo would trip the integrate
+# preflight on the retry in fixture F.
+export CREW_HOME="$T/home-d"
+tid="noremote1"
+
+out=$(bash "$LIFECYCLE" prepare "$tid") || fail "D prepare failed: $out"
+echo work >> "$D_DIR/.worktrees/$tid/f.txt"
+(cd "$D_DIR/.worktrees/$tid" && git commit -qam "work")
+
+# integrate pushes inline now: MERGED + NO_REMOTE (reconcile) + NO_REMOTE_PUSH
+out=$(bash "$LIFECYCLE" integrate "$tid" "merge: $tid" 2>&1) || fail "D integrate exited non-zero: $out"
+echo "$out" | grep -q '^MERGED:' || fail "D: expected MERGED, got: $out"
+echo "$out" | grep -q '^NO_REMOTE: no origin/main' || fail "D: expected NO_REMOTE reconcile skip, got: $out"
+echo "$out" | grep -q '^NO_REMOTE_PUSH: no origin remote configured' || fail "D: expected NO_REMOTE_PUSH, got: $out"
+
+# push-target directly (record exists, lock still held from integrate):
+# same fail-soft, exit 0
+out=$(bash "$LIFECYCLE" push-target "$tid" 2>&1) || fail "D push-target exited non-zero: $out"
+echo "$out" | grep -q '^NO_REMOTE_PUSH' || fail "D push-target: expected NO_REMOTE_PUSH, got: $out"
+
+echo "fixture D (branch, no remote): all checks passed"
+
+# ---------------- Fixture E: staged-base guard ----------------
+# (2026-09-19 REVIEW #10: a stray checkout redirecting the line must fail
+# closed at Integrate — before the merge lands on the wrong line.)
+E_DIR="$T/fixture-e"
+mkdir -p "$E_DIR"
+cd "$E_DIR"
+git init -q -b main .
+git config user.email test@test.t
+git config user.name test
+echo reviewed > f.txt
+git add -A
+git commit -qm "reviewed"
+E_BASE=$(git rev-parse HEAD)
+git checkout -q --detach HEAD
+echo init >> f.txt
+git commit -qam "crew-init"
+E_LINE=$(git rev-parse HEAD)
+export CREW_REPO="$E_DIR"
+export CREW_HOME="$E_DIR/home"
+tid="stagedbase1"
+
+out=$(bash "$LIFECYCLE" prepare "$tid") || fail "E prepare failed: $out"
+echo work >> "$E_DIR/.worktrees/$tid/f.txt"
+(cd "$E_DIR/.worktrees/$tid" && git commit -qam "work")
+
+# A base that is NOT an ancestor of the detached line: a sibling commit on
+# main (the shape a stray `git checkout main` leaves behind).
+git checkout -q main
+echo stray >> f.txt
+git commit -qam "stray main commit"
+STRAY_SHA=$(git rev-parse HEAD)
+git checkout -q --detach "$E_LINE"
+
+out=$(CREW_STAGED_BASE="$STRAY_SHA" bash "$LIFECYCLE" integrate "$tid" "merge: $tid" 2>&1) && \
+  fail "E: integrate with a non-ancestor staged base should fail: $out"
+echo "$out" | grep -q '^STAGED_BASE_MISMATCH' || fail "E: expected STAGED_BASE_MISMATCH, got: $out"
+[ "$(git rev-parse HEAD)" = "$E_LINE" ] || fail "E: HEAD moved despite STAGED_BASE_MISMATCH"
+
+# The real staged base is an ancestor — the merge proceeds.
+out=$(CREW_STAGED_BASE="$E_BASE" bash "$LIFECYCLE" integrate "$tid" "merge: $tid" 2>&1) || \
+  fail "E: integrate with the true staged base failed: $out"
+echo "$out" | grep -q '^STAGED_BASE_OK' || fail "E: expected STAGED_BASE_OK, got: $out"
+echo "$out" | grep -q '^MERGED:' || fail "E: expected MERGED, got: $out"
+
+echo "fixture E (staged-base guard): all checks passed"
+
+# ---------------- Fixture F: merged-but-unpushed retry recovery ----------------
+# (2026-09-19 REVIEW: a prior attempt's merge landed but its push never
+# completed — the retry must push instead of parking on MERGED_EMPTY.)
+# Reuse fixture D: task noremote1 is merged (recorded commit == live HEAD)
+# with no origin. Release the lock to simulate the crashed attempt, then
+# re-run integrate: ahead==0 and recorded==live → acquire + push now.
+cd "$D_DIR"
+export CREW_REPO="$D_DIR"
+export CREW_HOME="$T/home-d"
+"$REPO_DIR/lib/merge-lock.sh" release "noremote1" >/dev/null 2>&1 || fail "F: lock release failed"
+out=$(bash "$LIFECYCLE" integrate "noremote1" "merge: noremote1" 2>&1) || \
+  fail "F integrate exited non-zero: $out"
+echo "$out" | grep -q 'recovered: merge landed in a prior attempt' || \
+  fail "F: expected push recovery, got: $out"
+echo "$out" | grep -q '^NO_REMOTE_PUSH' || fail "F: expected NO_REMOTE_PUSH in recovery, got: $out"
+
+# F2: ancestor-based recovery — a prior attempt's push failed AFTER do_push's
+# retry path added a reconcile merge on top of the recorded commit, then
+# failed again. The record names M1 but live HEAD is M2 (M1's descendant).
+# Equality-based recovery would miss this and wrongly report MERGED_EMPTY —
+# a PASS with the push never completed.
+"$REPO_DIR/lib/merge-lock.sh" release "noremote1" >/dev/null 2>&1 || fail "F2: lock release failed"
+git commit -q --allow-empty -m "simulate: do_push retry-reconcile merge" || fail "F2: empty commit failed"
+out=$(bash "$LIFECYCLE" integrate "noremote1" "merge: noremote1" 2>&1) || \
+  fail "F2 integrate exited non-zero: $out"
+echo "$out" | grep -q 'recovered: merge landed in a prior attempt' || \
+  fail "F2: expected ancestor-based push recovery, got: $out"
+echo "$out" | grep -q '^MERGED_EMPTY' && fail "F2: wrongly MERGED_EMPTY while the push never completed: $out"
+
+echo "fixture F (merged-but-unpushed recovery): all checks passed"
+
+# ---------------- Fixture G: push-target after MERGED_EMPTY ----------------
+# (2026-09-19 REVIEW #8: MERGED_EMPTY takes no lock and writes no record —
+# push-target must skip loudly, not report a misleading "lock lost".)
+# Reuse fixture D's repo: a task with no commits ahead merges empty.
+cd "$D_DIR"
+export CREW_REPO="$D_DIR"
+export CREW_HOME="$T/home-d"
+tid="empty1"
+out=$(bash "$LIFECYCLE" prepare "$tid") || fail "G prepare failed: $out"
+# no commits in the worktree — nothing ahead of the target
+out=$(bash "$LIFECYCLE" integrate "$tid" "merge: $tid" 2>&1) || fail "G integrate exited non-zero: $out"
+echo "$out" | grep -q '^MERGED_EMPTY' || fail "G: expected MERGED_EMPTY, got: $out"
+out=$(bash "$LIFECYCLE" push-target "$tid" 2>&1) || fail "G push-target exited non-zero: $out"
+echo "$out" | grep -q 'no merge record' || fail "G: expected nothing-merged skip, got: $out"
+echo "$out" | grep -qi 'lock lost' && fail "G: misleading lock-lost error: $out"
+
+echo "fixture G (push-target after MERGED_EMPTY): all checks passed"
+
+rm -rf "$T"
+echo "PASS: detached-HEAD integrate fixtures"