muse-crew 0.14.1 → 0.14.3

package/lib/AGENTS.md

@@ -7,12 +7,14 @@ Shell scripts for the crew's infrastructure. Called by workflow scripts, cron, a
 - `schema.sql` — the crew-owned state schema: projects, tasks, poll_state, config, agent_sessions, events. Vocabularies enforced by CHECK constraints; `rejected` is a valid event type (the 2026-09-11 crash was a stored session whose event was rejected). Column names match the historical dashboard tables for a verbatim migration.
 - `crew-release.sh` — immutable release manager: deploy, rollback, prune
 - `merge-lock.sh` — serialized merge lock for concurrent agents: time-based holder lease (bug 2fc8f52f — an unexpired lease is held regardless of process liveness; only an expired lease may be broken). Requires both `CREW_REPO` and `CREW_HOME` (fail closed: BLOCKED, exit 2 when either is unset). Lock file is key=value: task_id, opaque holder identity (never a PID), acquired_at epoch, lease_seconds (default 600, override via MERGE_LOCK_LEASE_SECONDS). acquire/refresh/release/status/force-release; holder-only refresh and release; every op appends to $CREW_HOME/.merge-lock.log
-- `worktree-lifecycle.sh` — the worktree lifecycle seam: prepare/cleanup/inspect/integrate/verify-merge/status/post-deploy/terminal-cleanup/refresh-lock/lock-status over git worktrees (`integrate` reconciles `origin/main` under the merge lock after the task merge — canary `a6d8b0c8`, 2026-09-11 — so the push is a fast-forward; fail-soft with no remote, fail closed on conflict) (`.worktrees/<id>`, branch `task/<id>`). Branch resolution order: the crew registry (`<repo>/.worktrees/.registry/<id>`), then the canonical `task/<full-id>` ref, then a `task/<id-prefix>` ref matched by strict prefix enumeration (task 4e1a1bba — a Build agent may create the branch with raw git from an abbreviated id, bypassing prepare; prefix names are tolerated, never created; ambiguous prefixes fail closed). `resolve-branch` prints the resolved branch for agent-side one-liners. Nothing reconstructs the branch name — every command resolves it. Prepare fails closed on dirty `main`; cleanup is forgiving. `terminal-cleanup` is the run's last act at every park/fail boundary (called from `parkTask` in standard/bugfix/chore): releases the merge lock unconditionally and reclaims the worktree+branch only when the task branch is fully merged into main — unmerged work is preserved for the human by design, and a dirty worktree is reported, never force-removed. `post-deploy` reports worktree removal honestly (a lying "removed" echo hid real leftovers — canary run 9, 2026-09-12). Requires both `CREW_REPO` and `CREW_HOME` (fail closed: BLOCKED, exit 2 when either is unset); `CREW_REPO` is exported so internal merge-lock.sh calls inherit the repo being worked on; `LIB_DIR` defaults to `$CREW_HOME/lib` (`CREW_LIB` override). `lock-status` reports the merge-lock state explicitly (`UNLOCKED`, or key=value: locked=true, task_id, holder, acquired_at, lease_seconds, age_seconds, remaining_seconds — always exit 0) so Publish can distinguish an empty-diff Integrate (no lock taken) from a refresh failure. post-deploy's `.worktrees/` guard is add-then-reset, never an all-negative pathspec: `git add -A -- ':!.worktrees/'` still exits 1 on git 2.43.0 against the crew's own gitignored non-empty `.worktrees/` (room #15 J3), killing post-deploy under `set -e` — a plain `add -A` never errors on ignored paths and the follow-up `git reset -q -- .worktrees/` keeps stray lock files out of main even on pre-gitignore-entry repos.
+- `worktree-lifecycle.sh` — the worktree lifecycle seam: prepare/cleanup/inspect/integrate/verify-merge/status/post-deploy/terminal-cleanup/refresh-lock/lock-status over git worktrees (the integration target is the repo's current checkout — a branch name, or HEAD when detached — resolved by `integration_target()`; nothing in the lifecycle ever checks out a branch. `integrate` merges into the target, reconciles `origin/<target>` under the merge lock after the task merge — canary `a6d8b0c8`, 2026-09-11 — then pushes inline via `do_push` (no agent round-trip; 2026-09-19 REVIEW collapsed the old STEP-2 agent run, which added only a lock refresh). `do_push`: PUSHED (the refspec is always explicit — a branch pushes as `<branch>`, a detached HEAD as `HEAD:<destination>` where the destination is the remote's default branch from `resolve_push_destination()`; 2026-09-19 detached-HEAD audit REDO) / NO_REMOTE_PUSH (no origin — fail-soft, 2026-09-19 REVIEW: the old unconditional push exited 128 and mislabeled it); an unresolvable detached destination fails closed (never a silent skip, never a refusal of a knowable push); on push failure one fetch+merge retry while the lock is held, then fail closed without asserting a cause (never force-push). PUSH_SKIPPED survives only for the nothing-merged R5 path (no merge record + no lock held). Merged-but-unpushed retry recovery: a record whose merge commit IS the live HEAD takes the lock and pushes instead of reporting MERGED_EMPTY. `CREW_STAGED_BASE` guard (ferried from get-provenance): the line must descend from the staged publish base — STAGED_BASE_MISMATCH fails closed before the merge (room #21 J3 shape). `verify-merge` always re-resolves the target from the current checkout and checks the recorded commit against the LIVE tip — never the record's word for the tip (2026-09-19 REVIEW: the old read-back compared the record to itself for target=HEAD). A detached HEAD skips the inline reconcile loudly (NO_REMOTE_RECONCILE) — the inline reconcile needs a static branch target, so on detached the destination is resolved explicitly in do_push, which reconciles lazily on push failure (2026-09-19 detached-HEAD audit REDO; the old "local by design" rationale is rejected); `push-target` is the thin R5 wrapper over `do_push`: refreshes the lock, distinguishes nothing-merged (no record + no lock → loud skip) from lock-lost (fail closed). (`.worktrees/<id>`, branch `task/<id>`). Branch resolution order: the crew registry (`<repo>/.worktrees/.registry/<id>`), then the canonical `task/<full-id>` ref, then a `task/<id-prefix>` ref matched by strict prefix enumeration (task 4e1a1bba — a Build agent may create the branch with raw git from an abbreviated id, bypassing prepare; prefix names are tolerated, never created; ambiguous prefixes fail closed). `resolve-branch` prints the resolved branch for agent-side one-liners. Nothing reconstructs the branch name — every command resolves it. Prepare fails closed on a dirty integration target; cleanup is forgiving. `terminal-cleanup` is the run's last act at every park/fail boundary (called from `parkTask` in standard/bugfix/chore): releases the merge lock unconditionally and reclaims the worktree+branch only when the task branch is fully merged into the integration target — unmerged work is preserved for the human by design, and a dirty worktree is reported, never force-removed. `post-deploy` reports worktree removal honestly (a lying "removed" echo hid real leftovers — canary run 9, 2026-09-12). Requires both `CREW_REPO` and `CREW_HOME` (fail closed: BLOCKED, exit 2 when either is unset); `CREW_REPO` is exported so internal merge-lock.sh calls inherit the repo being worked on; `LIB_DIR` defaults to `$CREW_HOME/lib` (`CREW_LIB` override). `lock-status` reports the merge-lock state explicitly (`UNLOCKED`, or key=value: locked=true, task_id, holder, acquired_at, lease_seconds, age_seconds, remaining_seconds — always exit 0) so Publish can distinguish an empty-diff Integrate (no lock taken) from a refresh failure. post-deploy's `.worktrees/` guard is add-then-reset, never an all-negative pathspec: `git add -A -- ':!.worktrees/'` still exits 1 on git 2.43.0 against the crew's own gitignored non-empty `.worktrees/` (room #15 J3), killing post-deploy under `set -e` — a plain `add -A` never errors on ignored paths and the follow-up `git reset -q -- .worktrees/` keeps stray lock files out of the integration target even on pre-gitignore-entry repos.
+- `test-detached-integrate.sh` — behavioral regression tests for the detached-HEAD Integrate fix (room #21 J3, 2026-09-19; extended 2026-09-19 REVIEW): fixture A stages a detached HEAD (reviewed SHA + crew-init commit) and proves integrate leaves HEAD detached, keeps the reviewed SHA and crew-init as ancestors, lands the task merge, never moves main, records `integration_target=HEAD`, verify-merge VERIFIEDs, and push-target reports NO_REMOTE_PUSH (fixture A has no origin); fixture B proves the branch path still merges, reconciles, and pushes inline to a local origin; fixture C proves verify-merge checks the record against the LIVE tip (a detached line reset past the merge does NOT verify; the branch-gone path verifies only when the recorded commit is an ancestor of the live tip); fixture D proves the no-remote branch path fails soft with NO_REMOTE_PUSH (exit 0); fixture E proves the CREW_STAGED_BASE guard (non-ancestor base → STAGED_BASE_MISMATCH before any merge; true base → STAGED_BASE_OK); fixture F proves merged-but-unpushed retry recovery (re-running integrate after a crashed push takes the lock and pushes instead of parking on MERGED_EMPTY); fixture H proves the detached-HEAD audit REDO contract (2026-09-19) on a detached checkout with a local origin: push-destination fails closed when origin/HEAD is unset (genuinely unknowable destination), otherwise resolves the remote default branch; integrate pushes inline as `HEAD:main` (`PUSHED: origin/main (refspec HEAD:main)`), the remote ref advances to the merge commit, local main stays at the reviewed base, HEAD stays detached, verify-merge VERIFIEDs, and push-target re-pushes idempotently. Scratch dirs under /tmp only; CREW_HOME lives outside the scratch repos (as in real rooms) so lock files never trip the integrate preflight.
 - `test-worktree-backend.sh` — regression tests for the lifecycle script (validate, prepare/reuse, inspect, status, cleanup, idempotent cleanup, dirty-main preflight, integrate remote-reconcile with fixture sensitivity + no-remote fail-soft) on scratch repos
 - `test-version-write.sh` — regression tests for the escape-preserving step-8 version write in publish-npm.sh (fixture: current package.json with the \\u2014 escape; extracts the shipped block by anchor)
 - `test-publish-verify.sh` — regression tests for the retry-tolerant step-12 verification in publish-npm.sh (canary 5a027278): extracts the shipped block by anchor and runs it against a fake npm whose read replica lags (non-zero exits, then the old version, then the target) — requires convergence on success, fail-closed `PUBLISH_FAILED=verify` on exhaustion, and `--prefer-online` on every read
 - `test-publish-skip.sh` — regression tests for the no-lock graceful publish skip (park 2026-09-11): `lock-status` returns exact `UNLOCKED`/`LOCKED by <holder> since <ts> (pid <pid>)`; a fake empty-diff integrate takes the MERGED_EMPTY branch and never takes the lock; the shipped step-5 block from publish-npm.sh (extracted by anchor) skips gracefully on UNLOCKED (no park, no `PUBLISH_COMPLETE`), follows the refresh path when a lock is held, and fails closed on a `lock-status` query failure; the gate sits inside the ALREADY_PUBLISHED=0 branch and mutation steps are gated on NO_LOCK_HELD=0
-- `publish-npm.sh` — deterministic npm publish: lock refresh, release install, version write/commit, pack, registry publish, verify, push, post-deploy. Takes TARGET_VERSION as input; idempotent on retry/resume.
+- `publish-npm.sh` — deterministic npm publish: preflight (npm capability + push-destination resolution — the push refspec is resolved before any mutation: a branch name, or `HEAD:<destination>` on a detached checkout via the lifecycle's `push-destination` command; a genuinely unknowable destination fails fast here with `PUBLISH_FAILED=env`, before any mutation — 2026-09-19 detached-HEAD audit REDO: detached publication is legitimate and must work, not refuse), lock refresh, release install, version write/commit, pack, registry publish, verify, push, post-deploy. Takes TARGET_VERSION as input; idempotent on retry/resume.
+- `test-publish-preflight.sh` — regression tests for the npm publish capability preflight: the PREFLIGHT block extracted by anchor, helper -f/-r checks, placement, full-script runs (helper missing / credential missing / credential present + DRY_RUN / old helper without --check / real-helper probe), plus the detached-HEAD audit REDO cases (2026-09-19): a detached fixture repo with a local origin — origin/HEAD set + DRY_RUN=1 passes through to PUBLISH_DRY_RUN=1 (no refusal), origin/HEAD unset fails closed with PUBLISH_FAILED=env before any mutation, repo untouched; and the attached+no-origin case (critic F-A1: the anchor used to check no-origin only on the detached branch — attached+no-origin now fails closed pre-mutation too). Runs against scratch repos; the real-helper probe is credential-dependent (author machine only).
 - `compose-evidence.py` — deterministic visual-evidence compositor (Pillow): pairs identical PNG stems from baseline/ and postchange/ dirs, emits `<stem>-sidebyside.png` and amplified-difference `<stem>-overlay.png` into composites/, prints `PAIR`/`SKIP` manifests. Byte-deterministic; nonzero exit on errors.
 - `compose-evidence-caption.js` — deterministic QA-evidence caption composer (2026-09-14): given `--crew-home`, `--task-id`, and the resolved `--audit-dir` name, extracts the task title/description, the QA verdict, the `publish: verified` commit (or the task's project-scoped provenance record when it belongs to this task), and the merge commit's subject line from the project repo — and prints the out-of-context transition Eric asked for (problem → solution → evidence handoff) to stdout. The caller appends the desktop/mobile attachment lines after this caption. Verdict source (2026-09-16): Hazel's `task-evidence/<taskId>/postchange/verdict.json` is authoritative, then the last line of the append-only `verdicts.jsonl` ledger, then the newest legacy `visual_verdict:` note (the parent visual-verdict protocol was retired 2026-09-15). Honest labels: "provenance not yet stamped" when no commit is known, "no QA verdict recorded" when none exists, and the visual-protocol-unavailable note only when no verdict evidence exists at all, the newest `baseline:` note is `baseline: none`, AND captures exist (a `baseline: none` note means no baseline captures to compare against — it never overrules a real QA verdict; the note's premise is the post-deploy capture, so without captures it would fabricate evidence again). Capture guard (2026-09-17, room #14): the composer resolves the audit dir itself (`<home>/workspace/ts-spaces/<deploy_slug>/audits/<auditDir>/`, the same root crew-api.js and readback-disk.js resolve) and verifies `screenshot.png` + `screenshot-mobile.png` are files before claiming "desktop + mobile captures below" — a bare `--audit-dir` name is never trusted. Missing deploy_slug, missing dir, or missing PNGs gets the honest no-captures opener and Evidence line (terminal surfaces named explicitly: "terminal surface — QA judges the CLI, not pixels"); the caller only appends attachment lines when its own freshness check passes. "Latest" is by event timestamp, sorted explicitly. Exits non-zero on missing input.
 - `edit-image.py` — deterministic pixel-level evidence editing (2026-09-15, Pillow): `crop --region x,y,w,h` (pixel-exact, rejects out-of-bounds), `zoom --factor <f> [--center x,y]` (nearest-neighbor, returns to source frame size), `label --text <caption>` (caption bar), `nup --cols <n> --in <a.png> --in <b.png> [--labels "a|b"]` (side-by-side grid). Byte-deterministic PNG output; no network, no time, no randomness. Derivatives supplement raw frames — the source frame stays archived.
@@ -31,7 +33,7 @@ Shell scripts for the crew's infrastructure. Called by workflow scripts, cron, a
 - `update-watch.js` — deterministic automatic update watcher (2026-09-16, zero deps): `node update-watch.js --crew-home <path>` (missing arg → usage, exit 2; every other path exits 0). Watches the public npm registry (`npm view muse-crew version` pinned to `https://registry.npmjs.org/`) vs `crew-release.sh current` and files a `workflow: "upgrade"` task with `source: npm@<version>` when policy (`auto_update_crew`, `update_channel`) and channel gating allow; watches `git ls-remote origin HEAD` on the first `deploy_type=artifact` project vs `$CREW_HOME/.update-watch.json` and files a `workflow: "chore"` task carrying the mechanical dashboard-upgrade journey. Reads the `.crew-version` compatibility anchor at the new ref via `git fetch` + `git show <sha>:.crew-version` (never the working tree) and orders dashboard-led: a declared newer crew files the crew upgrade task FIRST and the dashboard task notes it follows the crew upgrade (declaration bypasses `update_channel`, not the `auto_update_crew=false` opt-out); a declared older crew skips the dashboard leg entirely as a human decision; a missing/invalid/unfetchable anchor fails open to the dashboard leg as today. Idempotency via the same state file (records at file time); check failures log to `$CREW_HOME/update-watch.log` and are never thrown. Safety: only files tasks — never deploys, never touches the artifact/config/scheduler. Run by the daily `crew-update-watch` cron through the `current` symlink (latest release); deliberately NOT in the lib-pinning `PIN_BASENAMES`.
 - `gitignore.js` — deterministic .gitignore management for crew-owned paths (2026-09-17): the crew touches exactly one user-owned file outside `.orchestration/` — the repo's `.gitignore`. `ensureGitignoreEntries(repoPath, entries)` creates the file when missing, appends missing entries (exact line match, no duplicates), preserves existing content byte-for-byte, and is idempotent. `describeGitignoreChange(repoPath, entries)` renders the exact diff for the setup consent conversation. Crew-owned entries: `.worktrees/`, `.orchestration/user/`. CLI: `--repo <path> [--dry-run]`.
 - `repo-orchestration.js` — repository-local `.orchestration/` scaffold (2026-09-17): `scaffoldRepoOrchestration(repoPath, crewRepoPath)` creates `$REPO/.orchestration/{workflows,identities,phases,user}/`, seeds workflows/identities/phases from the crew repo's platform defaults with no-clobber semantics (existing project customizations never overwritten), and writes a README in `user/` explaining it's for local config. Idempotent. CLI: `--repo <path> --crew-repo <path>`.
-- `setup-project-repo.js` — repo-local setup composer for a registered project (2026-09-17, setup-commit 2026-09-18): runs the `.orchestration/` scaffold plus the `.gitignore` update (only with explicit `--consent`), then COMMITS both via `commit-scaffold.js` so the repo's main checkout is clean when setup finishes (room #13: an uncommitted scaffold deterministically broke the first task's Integrate). Refuses loudly when `.gitignore` has pre-existing uncommitted changes (never sweeps the user's edits into the setup commit); `.orchestration/` is crew-owned so pre-existing content there is committed, not refused. The CLI-path equivalent of crew-init's dashboard-mode repo setup; the dashboard calls the same script. No new API endpoint — composition of existing deterministic modules. CLI: `--repo <path> --crew-repo <path> [--consent]`; prints `{ orchestration, gitignore, commit }`, exits non-zero on any failure.
+- `setup-project-repo.js` — repo-local setup composer for a registered project (2026-09-17, setup-commit 2026-09-18): runs the `.orchestration/` scaffold plus the `.gitignore` update (only with explicit `--consent`), then COMMITS both via `commit-scaffold.js` so the repo's primary checkout is clean when setup finishes (room #13: an uncommitted scaffold deterministically broke the first task's Integrate). Refuses loudly when `.gitignore` has pre-existing uncommitted changes (never sweeps the user's edits into the setup commit); `.orchestration/` is crew-owned so pre-existing content there is committed, not refused. The CLI-path equivalent of crew-init's dashboard-mode repo setup; the dashboard calls the same script. No new API endpoint — composition of existing deterministic modules. CLI: `--repo <path> --crew-repo <path> [--consent]`; prints `{ orchestration, gitignore, commit }`, exits non-zero on any failure.
 - `commit-scaffold.js` — deterministic setup-scaffold commit (2026-09-18): stages only `.orchestration/` (+ `.gitignore` with `--gitignore`) and commits with a message naming exactly what was staged. Idempotent (`nothing-to-commit`, never an empty commit); not-a-git-repo is a clean no-op; missing `.orchestration/` and commit failures (e.g. no git identity) throw loudly — the commit belongs to the user, so no identity is ever invented here. Exports `isPathDirty` (porcelain check for one path) for the composer's pre-mutation guard. CLI: `--repo <path> [--gitignore]`.
 - `sample-project.js` — optional sample-project setup (2026-09-17): extracts `seed/sample-project.tar.gz` (stripping the `sample-project/` prefix), `git init`, initial commit. No remote required. Registration happens via the existing `create-project` action — no sample-specific endpoint. CLI: `--tarball <path> --dest <dir> --name <project-name>`.
 - `compute-publish-diff.js` — deterministic publish-diff computer (2026-09-18, room #14): replaces the agent-ferried `git diff` JSON string field (the JSON ferry dropped a valid 700-line diff — "Publish diff parsed to zero files"). Runs `git diff <base> <HEAD>` via argv (no shell), writes the raw diff bytes to `--out`, and prints only a small JSON summary (`commit`, `base`, `diff_file`, `sha256`, `bytes`, `file_count`, `changed_lines` = added+removed, never raw diff output lines, `files`, `has_binary`, `has_rename`). Empty-tree base is the first-publish ancestor (hardcoded, never `merge-base` on the empty tree); non-ancestor is semantic JSON (`ok:false, error:"not-ancestor"`, exit 0); usage errors exit 2 with nothing on stdout. Pinned per-run alongside the other lifecycle files (`COMPUTE_DIFF` in `PIN_BASENAMES`) so a mid-run release swap cannot change it under the workflow.

package/lib/crew-api.js

@@ -1721,13 +1721,15 @@ function latestPublishNote(db, taskId) {
   ).get(taskId) || null;
 }
 
-// The trigger anchor for an unknown attempt: the "submitted" ledger entry
-// for the same attempt, recorded when the trigger went out. Returns the
-// entry or null. A null means the trigger instant is unknowable (or the
-// trigger was never issued) — classification cannot run; the task stays
-// parked for human attention. Fail closed, never guess the anchor.
+// The trigger anchor for an unknown attempt: the OLDEST "submitted" ledger
+// entry for the same attempt (the trigger issuance). Oldest binds the trigger
+// instant — verify-publish.js and the decision doc bind oldest; binding newest
+// misclassifies builds that complete between issuance and receipt (A2/R2/O4).
+// Returns the entry or null. A null means the trigger instant is unknowable
+// (or the trigger was never issued) — classification cannot run; the task
+// stays parked for human attention. Fail closed, never guess the anchor.
 function findTriggerEntry(entries, commit, attempt) {
-  for (let i = entries.length - 1; i >= 0; i--) {
+  for (let i = 0; i < entries.length; i++) {
     const e = entries[i];
     if (e.outcome === "submitted" && e.commit === commit &&
         (e.attempt || null) === (attempt || null)) {

package/lib/publish-npm.sh

@@ -82,7 +82,42 @@ if [ "$PREFLIGHT_CHECK_CODE" -ne 0 ] \
 fi
 # PREFLIGHT-END
 
-# 3. Dry run: markers only, no lock, no deploy, no mutation.
+# PUSH-TARGET-ANCHOR: resolve the push destination before ANY mutation.
+# The destination is the integration target resolved by the lifecycle, not a
+# hardcoded `main` (2026-09-19 REVIEW: the old `git push origin main` was a
+# stale clone of the same hardcoding the integrate fix removed). A detached
+# HEAD pushes as HEAD:<destination>, with the destination resolved explicitly
+# by the lifecycle's push-destination command (2026-09-19 detached-HEAD audit
+# REDO: the old code refused every detached checkout; detached publication
+# is legitimate and must work). Fail here, before the version-bump commit
+# and the registry publish, only when the destination is genuinely
+# unknowable -- never after a side effect you cannot roll back. (The old
+# position of this check -- step 13, after the npm publish -- left a shipped
+# version with a failed phase and a retry loop.)
+# No-origin is checked for BOTH shapes (2026-09-19 critic finding F-A1):
+# step 13 pushes unconditionally, so an attached checkout with no origin
+# would otherwise fail PUBLISH_FAILED=push after the version-bump commit
+# and the registry publish. A version-bump commit with nowhere to record it
+# would ship an npm version with no git provenance, so no-remote fails
+# closed here rather than skipping like the integrate path (F-F6).
+[ -n "${LIFECYCLE:-}" ] || fail "env" "LIFECYCLE is not set -- cannot resolve the push destination before mutation (F-R4)"
+PUSH_TARGET="$(CREW_HOME="${CREW_HOME:-}" CREW_REPO="$REPO_PATH" bash "$LIFECYCLE" integration-target 2>&1)" \
+  || fail "integration-target" "$PUSH_TARGET"
+if ! git -C "$REPO_PATH" remote get-url origin >/dev/null 2>&1; then
+  fail "env" "no origin remote configured: the version-bump commit could not be pushed anywhere -- no version-bump commit was created and nothing was published"
+fi
+PUSH_REFSPEC="$PUSH_TARGET"
+if [ "$PUSH_TARGET" = "HEAD" ]; then
+  PUSH_DEST="$(CREW_HOME="${CREW_HOME:-}" CREW_REPO="$REPO_PATH" bash "$LIFECYCLE" push-destination 2>&1)" \
+    || fail "env" "$PUSH_DEST"
+  PUSH_REFSPEC="HEAD:$PUSH_DEST"
+fi
+# PUSH-TARGET-END
+
+# 3. Dry run: markers only, no lock, no deploy, no mutation. The push
+# preflight above already ran, so even a dry run fails closed on a
+# genuinely unknowable push destination (see case 7 in
+# lib/test-publish-preflight.sh -- F-R9).
 if [ "${DRY_RUN:-0}" = "1" ]; then
   echo "PUBLISH_DRY_RUN=1"
   exit 0
@@ -281,7 +316,9 @@ LOCK_OUT2="$(CREW_HOME="${CREW_HOME:-}" CREW_REPO="$REPO_PATH" bash "${LIFECYCLE
   || fail "lock-refresh" "$LOCK_OUT2"
 
 # 13. Push the version-bump commit (idempotent: no-op if already pushed).
-PUSH_OUT="$(git -C "$REPO_PATH" push origin main 2>&1)" \
+# PUSH_REFSPEC was resolved in the preflight above -- a branch name, or
+# HEAD:<destination> on a detached checkout (never a bare HEAD).
+PUSH_OUT="$(git -C "$REPO_PATH" push origin "$PUSH_REFSPEC" 2>&1)" \
   || fail "push" "$PUSH_OUT"
 echo "PUBLISH_PUSHED=1"
 

package/lib/retry-publish.js

@@ -180,8 +180,11 @@ if (phase === "prepare") {
     }
 
     const classifierPath = join(crewHome, "lib", "classify-publish-absence.js");
-    // Find the trigger entry for the manifest baseline.
-    const trigger = [...entries].reverse().find((e) =>
+    // Find the trigger entry for the manifest baseline: the OLDEST matching
+    // "submitted" (the trigger issuance), matching verify-publish.js's anchor.
+    // agent_id is null on the issuance entry (no receipt observed at trigger
+    // time) — the baseline comes from manifest_before, never agent_id.
+    const trigger = entries.find((e) =>
       e.outcome === "submitted" && e.commit === commit && (attempt == null || e.attempt === attempt));
     const manifestBefore = trigger && trigger.manifest_before ? JSON.stringify(trigger.manifest_before) : null;
 

package/lib/test-detached-integrate.sh

@@ -0,0 +1,416 @@
+#!/bin/bash
+# test-detached-integrate.sh — behavioral regression tests for the
+# detached-HEAD Integrate fix (room #21, J3, 2026-09-19).
+#
+# The defect: cmd_integrate ran require_clean_main, whose unconditional
+# `git checkout main` abandoned a detached-HEAD room line (reviewed SHA +
+# crew-init commit). Publish then failed closed on ancestry and the journey
+# parked. The fix: the integration target is the repo's current checkout
+# (branch name, or HEAD when detached); nothing in the lifecycle ever
+# checks out a branch.
+#
+# Fixture A (detached HEAD — the room #21 shape):
+#   reviewed commit A, detached HEAD, crew-init commit B on top, task
+#   branch from B with work commit C. Integrate must:
+#   1. report integration-target = HEAD
+#   2. MERGE with exit 0
+#   3. leave HEAD detached (no checkout happened)
+#   4. keep A (reviewed SHA) and B (crew-init) as ancestors of HEAD —
+#      the exact J3 failure was B being abandoned
+#   5. land C (the task work) as an ancestor of HEAD via a real merge
+#      commit with two parents
+#   6. NOT move the main branch (it still points at A)
+#   7. write integration_target=HEAD in the merge record
+#   8. verify-merge → VERIFIED
+#   9. push-target → NO_REMOTE_PUSH (fixture A has no origin; a detached
+#      line with no remote has nowhere to push -- loud, not silent)
+#
+# Fixture B (branch — the old behavior is preserved):
+#   repo on main with a local bare origin. Integrate merges, reconciles,
+#   and pushes inline; push-target also PUSHEDs to origin.
+#
+# Fixture C (detached HEAD, live-tip verify-merge — 2026-09-19 REVIEW):
+#   verify-merge must check the record against the LIVE HEAD, never the
+#   record's word for the tip: a detached line reset past the merge does
+#   NOT verify; with the branch gone it verifies only when the recorded
+#   commit is an ancestor of the live tip.
+#
+# Fixture D (branch, no remote — 2026-09-19 REVIEW blocker 3):
+#   the old push-target ran `git push origin` with no origin → exit 128
+#   mislabeled PUSH_REJECTED. Now the inline push fails soft with
+#   NO_REMOTE_PUSH and exit 0.
+#
+# Fixture E (staged-base guard — 2026-09-19 REVIEW #10):
+#   CREW_STAGED_BASE naming a non-ancestor fails closed with
+#   STAGED_BASE_MISMATCH before any merge; the true staged base proceeds
+#   with STAGED_BASE_OK.
+#
+# Fixture F (merged-but-unpushed retry recovery — 2026-09-19 REVIEW):
+#   a prior attempt merged but never pushed (lock released to simulate the
+#   crash): re-running integrate takes the lock and pushes instead of
+#   parking on MERGED_EMPTY.
+#
+# Fixture H (detached HEAD with an origin — 2026-09-19 detached-HEAD audit
+# REDO): H1 proves push-destination fails closed when origin/HEAD is unset
+# (genuinely unknowable destination); H2-H5 prove the detached line pushes
+# explicitly as HEAD:main — inline push reports
+# `PUSHED: origin/main (refspec HEAD:main)`, the remote ref advances to the
+# merge commit, local main stays at the reviewed base, HEAD stays detached,
+# verify-merge VERIFIEDs, and push-target re-pushes idempotently.
+#
+# Hermetic: scratch dirs under /tmp only, removed at start (and end).
+set -u
+
+REPO_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+LIFECYCLE="$REPO_DIR/lib/worktree-lifecycle.sh"
+
+fail() { echo "FAIL: $1"; exit 1; }
+
+T=/tmp/crew-detached-integrate-test
+rm -rf "$T"
+mkdir -p "$T"
+
+# ---------------- Fixture A: detached HEAD ----------------
+A_DIR="$T/fixture-a"
+mkdir -p "$A_DIR"
+cd "$A_DIR"
+git init -q -b main .
+git config user.email test@test.t
+git config user.name test
+echo reviewed > f.txt
+git add -A
+git commit -qm "reviewed base"
+A_SHA=$(git rev-parse HEAD)
+
+# Detach at the reviewed SHA (clean-room staging pins it), then commit the
+# crew-init stamp on top — the detached line Integrate must not abandon.
+git checkout -q --detach HEAD
+echo crew-init >> f.txt
+git commit -qam "crew-init: stamp provenance"
+B_SHA=$(git rev-parse HEAD)
+git symbolic-ref -q HEAD >/dev/null && fail "fixture A: HEAD should be detached"
+
+export CREW_REPO="$A_DIR"
+export CREW_HOME="$A_DIR/home"
+export CREW_LIB="$REPO_DIR/lib"  # merge-lock.sh lives in the repo's lib, not the scratch crew home
+tid="detached1"
+
+# 1. integration-target resolves to HEAD
+out=$(bash "$LIFECYCLE" integration-target) || fail "integration-target exited non-zero: $out"
+[ "$out" = "HEAD" ] || fail "integration-target: expected HEAD, got: $out"
+
+# prepare + task work
+out=$(bash "$LIFECYCLE" prepare "$tid") || fail "prepare exited non-zero: $out"
+echo task-work >> "$A_DIR/.worktrees/$tid/f.txt"
+(cd "$A_DIR/.worktrees/$tid" && git commit -qam "task work")
+C_SHA=$(cd "$A_DIR/.worktrees/$tid" && git rev-parse HEAD)
+
+# 2. integrate
+out=$(bash "$LIFECYCLE" integrate "$tid" "merge: $tid" 2>&1) || fail "integrate exited non-zero: $out"
+echo "$out" | grep -q '^MERGED:' || fail "integrate: expected MERGED, got: $out"
+echo "$out" | grep -q 'NO_REMOTE_RECONCILE: detached HEAD' || fail "integrate: expected NO_REMOTE_RECONCILE, got: $out"
+
+# 3. HEAD is still detached — no checkout happened
+git symbolic-ref -q HEAD >/dev/null && fail "integrate checked out a branch: HEAD is now attached"
+
+# 4. the detached line survived: reviewed SHA and crew-init are ancestors
+git merge-base --is-ancestor "$A_SHA" HEAD || fail "reviewed SHA $A_SHA is no longer an ancestor of HEAD"
+git merge-base --is-ancestor "$B_SHA" HEAD || fail "crew-init commit $B_SHA was abandoned (the J3 defect)"
+
+# 5. the task work landed via a real merge commit
+git merge-base --is-ancestor "$C_SHA" HEAD || fail "task commit $C_SHA is not an ancestor of HEAD"
+MERGE_SHA=$(git rev-parse HEAD)
+parents=$(git rev-list --parents -n 1 "$MERGE_SHA" | wc -w)
+[ "$parents" -eq 3 ] || fail "expected a 2-parent merge commit, got $parents words in: $(git rev-list --parents -n 1 "$MERGE_SHA")"
+
+# 6. main was not touched
+MAIN_SHA=$(git rev-parse main)
+[ "$MAIN_SHA" = "$A_SHA" ] || fail "main moved during integrate: $MAIN_SHA != reviewed $A_SHA"
+
+# 7. merge record names the target
+rec=$(bash "$LIFECYCLE" merge-record "$tid")
+echo "$rec" | grep -q '^integration_target=HEAD$' || fail "merge record missing integration_target=HEAD: $rec"
+
+# 8. verify-merge
+out=$(bash "$LIFECYCLE" verify-merge "$tid") || fail "verify-merge exited non-zero: $out"
+echo "$out" | grep -q '^VERIFIED:' || fail "verify-merge: expected VERIFIED, got: $out"
+
+# 9. push-target on a detached HEAD with no remote: loud NO_REMOTE_PUSH
+out=$(bash "$LIFECYCLE" push-target "$tid") || fail "push-target exited non-zero: $out"
+echo "$out" | grep -q '^NO_REMOTE_PUSH: no origin remote configured' || fail "push-target: expected NO_REMOTE_PUSH, got: $out"
+
+echo "fixture A (detached HEAD): all checks passed"
+
+# ---------------- Fixture C: verify-merge checks the record against the LIVE tip ----------------
+# (2026-09-19 REVIEW blockers 1+2: the old verify-merge compared the merge
+# record against itself for target=HEAD — is-ancestor(X, X) is a tautology
+# that certified merges no longer on the line.)
+# Still in fixture A's repo ($A_DIR); task detached1 is merged at $MERGE_SHA.
+cd "$A_DIR"
+export CREW_REPO="$A_DIR"
+export CREW_HOME="$A_DIR/home"
+
+# C1: reset the detached line backward past the merge — the merge is no
+# longer on the line. verify-merge must NOT verify.
+git reset -q --hard "$B_SHA"
+out=$(bash "$LIFECYCLE" verify-merge "$tid" 2>&1) && fail "C1: verify-merge exited 0 for a merge no longer on the line: $out"
+echo "$out" | grep -q '^VERIFIED:' && fail "C1: VERIFIED a reset-away merge: $out"
+echo "C1: verify-merge rejects a detached line reset past the merge"
+
+# C2: restore the merge, remove the worktree, delete the task branch
+# (merge-lease reclaim path). verify-merge must VERIFY from the record —
+# but only because the recorded commit is an ancestor of the LIVE tip.
+git reset -q --hard "$MERGE_SHA"
+BRANCH=$(bash "$LIFECYCLE" resolve-branch "$tid") || fail "C2: resolve-branch failed"
+git worktree remove --force "$A_DIR/.worktrees/$tid" || fail "C2: worktree remove failed"
+git branch -q -D "$BRANCH" || fail "C2: could not delete task branch $BRANCH"
+out=$(bash "$LIFECYCLE" verify-merge "$tid" 2>&1) || fail "C2: verify-merge exited non-zero: $out"
+echo "$out" | grep -q '^VERIFIED:' || fail "C2: expected VERIFIED via record fallback, got: $out"
+echo "$out" | grep -q 'gone but recorded merge commit' || fail "C2: expected the branch-gone record path, got: $out"
+echo "fixture C (live-tip verify-merge): all checks passed"
+
+# ---------------- Fixture B: branch with a local origin ----------------
+B_DIR="$T/fixture-b"
+REMOTE="$T/remote.git"
+mkdir -p "$B_DIR"
+git init -q --bare "$REMOTE"
+cd "$B_DIR"
+git init -q -b main .
+git config user.email test@test.t
+git config user.name test
+echo base > f.txt
+git add -A
+git commit -qm "base"
+git remote add origin "$REMOTE"
+git push -q origin main
+
+export CREW_REPO="$B_DIR"
+export CREW_HOME="$B_DIR/home"
+tid="branch1"
+
+out=$(bash "$LIFECYCLE" integration-target) || fail "B integration-target exited non-zero"
+[ "$out" = "main" ] || fail "B integration-target: expected main, got: $out"
+
+out=$(bash "$LIFECYCLE" prepare "$tid") || fail "B prepare exited non-zero: $out"
+echo task-work >> "$B_DIR/.worktrees/$tid/f.txt"
+(cd "$B_DIR/.worktrees/$tid" && git commit -qam "task work")
+
+out=$(bash "$LIFECYCLE" integrate "$tid" "merge: $tid" 2>&1) || fail "B integrate exited non-zero: $out"
+echo "$out" | grep -q '^MERGED:' || fail "B integrate: expected MERGED, got: $out"
+echo "$out" | grep -q '^RECONCILED: merged origin/main into main' || fail "B integrate: expected RECONCILED, got: $out"
+
+rec=$(bash "$LIFECYCLE" merge-record "$tid")
+echo "$rec" | grep -q '^integration_target=main$' || fail "B merge record missing integration_target=main: $rec"
+
+out=$(bash "$LIFECYCLE" verify-merge "$tid") || fail "B verify-merge exited non-zero: $out"
+echo "$out" | grep -q '^VERIFIED:' || fail "B verify-merge: expected VERIFIED, got: $out"
+
+# push-target pushes the branch to the local origin
+out=$(bash "$LIFECYCLE" push-target "$tid" 2>&1) || fail "B push-target exited non-zero: $out"
+echo "$out" | grep -q '^PUSHED: origin/main' || fail "B push-target: expected PUSHED, got: $out"
+LOCAL_MAIN=$(git rev-parse main)
+REMOTE_MAIN=$(git --git-dir="$REMOTE" rev-parse refs/heads/main)
+[ "$LOCAL_MAIN" = "$REMOTE_MAIN" ] || fail "B origin/main not updated: $REMOTE_MAIN != $LOCAL_MAIN"
+
+echo "fixture B (branch + origin): all checks passed"
+
+# ---------------- Fixture D: branch target, no remote ----------------
+# (2026-09-19 REVIEW blocker 3: push-target ran `git push origin` with no
+# origin → exit 128 mislabeled PUSH_REJECTED. Now: fail-soft NO_REMOTE_PUSH.)
+D_DIR="$T/fixture-d"
+mkdir -p "$D_DIR"
+cd "$D_DIR"
+git init -q -b main .
+git config user.email test@test.t
+git config user.name test
+echo base > f.txt
+git add -A
+git commit -qm "base"
+export CREW_REPO="$D_DIR"
+# CREW_HOME lives OUTSIDE the repo (as in real rooms): the lock files are
+# crew state, and nesting them in the repo would trip the integrate
+# preflight on the retry in fixture F.
+export CREW_HOME="$T/home-d"
+tid="noremote1"
+
+out=$(bash "$LIFECYCLE" prepare "$tid") || fail "D prepare failed: $out"
+echo work >> "$D_DIR/.worktrees/$tid/f.txt"
+(cd "$D_DIR/.worktrees/$tid" && git commit -qam "work")
+
+# integrate pushes inline now: MERGED + NO_REMOTE (reconcile) + NO_REMOTE_PUSH
+out=$(bash "$LIFECYCLE" integrate "$tid" "merge: $tid" 2>&1) || fail "D integrate exited non-zero: $out"
+echo "$out" | grep -q '^MERGED:' || fail "D: expected MERGED, got: $out"
+echo "$out" | grep -q '^NO_REMOTE: no origin/main' || fail "D: expected NO_REMOTE reconcile skip, got: $out"
+echo "$out" | grep -q '^NO_REMOTE_PUSH: no origin remote configured' || fail "D: expected NO_REMOTE_PUSH, got: $out"
+
+# push-target directly (record exists, lock still held from integrate):
+# same fail-soft, exit 0
+out=$(bash "$LIFECYCLE" push-target "$tid" 2>&1) || fail "D push-target exited non-zero: $out"
+echo "$out" | grep -q '^NO_REMOTE_PUSH' || fail "D push-target: expected NO_REMOTE_PUSH, got: $out"
+
+echo "fixture D (branch, no remote): all checks passed"
+
+# ---------------- Fixture E: staged-base guard ----------------
+# (2026-09-19 REVIEW #10: a stray checkout redirecting the line must fail
+# closed at Integrate — before the merge lands on the wrong line.)
+E_DIR="$T/fixture-e"
+mkdir -p "$E_DIR"
+cd "$E_DIR"
+git init -q -b main .
+git config user.email test@test.t
+git config user.name test
+echo reviewed > f.txt
+git add -A
+git commit -qm "reviewed"
+E_BASE=$(git rev-parse HEAD)
+git checkout -q --detach HEAD
+echo init >> f.txt
+git commit -qam "crew-init"
+E_LINE=$(git rev-parse HEAD)
+export CREW_REPO="$E_DIR"
+export CREW_HOME="$E_DIR/home"
+tid="stagedbase1"
+
+out=$(bash "$LIFECYCLE" prepare "$tid") || fail "E prepare failed: $out"
+echo work >> "$E_DIR/.worktrees/$tid/f.txt"
+(cd "$E_DIR/.worktrees/$tid" && git commit -qam "work")
+
+# A base that is NOT an ancestor of the detached line: a sibling commit on
+# main (the shape a stray `git checkout main` leaves behind).
+git checkout -q main
+echo stray >> f.txt
+git commit -qam "stray main commit"
+STRAY_SHA=$(git rev-parse HEAD)
+git checkout -q --detach "$E_LINE"
+
+out=$(CREW_STAGED_BASE="$STRAY_SHA" bash "$LIFECYCLE" integrate "$tid" "merge: $tid" 2>&1) && \
+  fail "E: integrate with a non-ancestor staged base should fail: $out"
+echo "$out" | grep -q '^STAGED_BASE_MISMATCH' || fail "E: expected STAGED_BASE_MISMATCH, got: $out"
+[ "$(git rev-parse HEAD)" = "$E_LINE" ] || fail "E: HEAD moved despite STAGED_BASE_MISMATCH"
+
+# The real staged base is an ancestor — the merge proceeds.
+out=$(CREW_STAGED_BASE="$E_BASE" bash "$LIFECYCLE" integrate "$tid" "merge: $tid" 2>&1) || \
+  fail "E: integrate with the true staged base failed: $out"
+echo "$out" | grep -q '^STAGED_BASE_OK' || fail "E: expected STAGED_BASE_OK, got: $out"
+echo "$out" | grep -q '^MERGED:' || fail "E: expected MERGED, got: $out"
+
+echo "fixture E (staged-base guard): all checks passed"
+
+# ---------------- Fixture F: merged-but-unpushed retry recovery ----------------
+# (2026-09-19 REVIEW: a prior attempt's merge landed but its push never
+# completed — the retry must push instead of parking on MERGED_EMPTY.)
+# Reuse fixture D: task noremote1 is merged (recorded commit == live HEAD)
+# with no origin. Release the lock to simulate the crashed attempt, then
+# re-run integrate: ahead==0 and recorded==live → acquire + push now.
+cd "$D_DIR"
+export CREW_REPO="$D_DIR"
+export CREW_HOME="$T/home-d"
+"$REPO_DIR/lib/merge-lock.sh" release "noremote1" >/dev/null 2>&1 || fail "F: lock release failed"
+out=$(bash "$LIFECYCLE" integrate "noremote1" "merge: noremote1" 2>&1) || \
+  fail "F integrate exited non-zero: $out"
+echo "$out" | grep -q 'recovered: merge landed in a prior attempt' || \
+  fail "F: expected push recovery, got: $out"
+echo "$out" | grep -q '^NO_REMOTE_PUSH' || fail "F: expected NO_REMOTE_PUSH in recovery, got: $out"
+
+# F2: ancestor-based recovery — a prior attempt's push failed AFTER do_push's
+# retry path added a reconcile merge on top of the recorded commit, then
+# failed again. The record names M1 but live HEAD is M2 (M1's descendant).
+# Equality-based recovery would miss this and wrongly report MERGED_EMPTY —
+# a PASS with the push never completed.
+"$REPO_DIR/lib/merge-lock.sh" release "noremote1" >/dev/null 2>&1 || fail "F2: lock release failed"
+git commit -q --allow-empty -m "simulate: do_push retry-reconcile merge" || fail "F2: empty commit failed"
+out=$(bash "$LIFECYCLE" integrate "noremote1" "merge: noremote1" 2>&1) || \
+  fail "F2 integrate exited non-zero: $out"
+echo "$out" | grep -q 'recovered: merge landed in a prior attempt' || \
+  fail "F2: expected ancestor-based push recovery, got: $out"
+echo "$out" | grep -q '^MERGED_EMPTY' && fail "F2: wrongly MERGED_EMPTY while the push never completed: $out"
+
+echo "fixture F (merged-but-unpushed recovery): all checks passed"
+
+# ---------------- Fixture G: push-target after MERGED_EMPTY ----------------
+# (2026-09-19 REVIEW #8: MERGED_EMPTY takes no lock and writes no record —
+# push-target must skip loudly, not report a misleading "lock lost".)
+# Reuse fixture D's repo: a task with no commits ahead merges empty.
+cd "$D_DIR"
+export CREW_REPO="$D_DIR"
+export CREW_HOME="$T/home-d"
+tid="empty1"
+out=$(bash "$LIFECYCLE" prepare "$tid") || fail "G prepare failed: $out"
+# no commits in the worktree — nothing ahead of the target
+out=$(bash "$LIFECYCLE" integrate "$tid" "merge: $tid" 2>&1) || fail "G integrate exited non-zero: $out"
+echo "$out" | grep -q '^MERGED_EMPTY' || fail "G: expected MERGED_EMPTY, got: $out"
+out=$(bash "$LIFECYCLE" push-target "$tid" 2>&1) || fail "G push-target exited non-zero: $out"
+echo "$out" | grep -q 'no merge record' || fail "G: expected nothing-merged skip, got: $out"
+echo "$out" | grep -qi 'lock lost' && fail "G: misleading lock-lost error: $out"
+
+echo "fixture G (push-target after MERGED_EMPTY): all checks passed"
+
+# ---------------- Fixture H: detached HEAD with an origin ----------------
+# (2026-09-19 detached-HEAD audit REDO: a detached line with a remote is
+# pushed explicitly as HEAD:<destination> -- the remote's default branch --
+# never silently skipped, never refused. The local branch the line
+# descends from is NOT moved; only the remote ref advances.)
+H_DIR="$T/fixture-h"
+H_REMOTE="$T/remote-h.git"
+git init -q --bare "$H_REMOTE"
+mkdir -p "$H_DIR"
+cd "$H_DIR"
+git init -q -b main .
+git config user.email test@test.t
+git config user.name test
+echo reviewed > f.txt
+git add -A
+git commit -qm "reviewed base"
+H_BASE=$(git rev-parse HEAD)
+git remote add origin "$H_REMOTE"
+git push -q origin main
+git fetch -q origin
+# Detach at the reviewed base, crew-init stamp on top -- the detached line
+# the REDO must push explicitly (set origin/HEAD only after H1).
+git checkout -q --detach HEAD
+echo crew-init >> f.txt
+git commit -qam "crew-init: stamp provenance"
+H_LINE=$(git rev-parse HEAD)
+git symbolic-ref -q HEAD >/dev/null && fail "fixture H: HEAD should be detached"
+export CREW_REPO="$H_DIR"
+export CREW_HOME="$H_DIR/home"
+export CREW_LIB="$REPO_DIR/lib"
+# H1: origin/HEAD not set -- the destination is genuinely unknowable --
+# push-destination fails closed (never a silent skip, never a bare-HEAD push)
+out=$(bash "$LIFECYCLE" push-destination 2>&1) && fail "H1: push-destination should fail without origin/HEAD: $out"
+echo "$out" | grep -q 'genuinely unknowable' || fail "H1: expected unknowable error, got: $out"
+echo "fixture H1 (unknowable destination fails closed): passed"
+# Now set the remote default branch explicitly (hermetic: no `remote set-head -a` network round-trip)
+git symbolic-ref refs/remotes/origin/HEAD refs/remotes/origin/main
+tid="detachedorigin1"
+
+# H2: push-destination resolves the remote default branch
+out=$(bash "$LIFECYCLE" push-destination) || fail "H2 push-destination exited non-zero: $out"
+[ "$out" = "main" ] || fail "H2 push-destination: expected main, got: $out"
+
+# H3: prepare + task work, then integrate pushes inline as HEAD:main
+out=$(bash "$LIFECYCLE" prepare "$tid") || fail "H3 prepare exited non-zero: $out"
+echo task-work >> "$H_DIR/.worktrees/$tid/f.txt"
+(cd "$H_DIR/.worktrees/$tid" && git commit -qam "task work")
+out=$(bash "$LIFECYCLE" integrate "$tid" "merge: $tid" 2>&1) || fail "H3 integrate exited non-zero: $out"
+echo "$out" | grep -q '^MERGED:' || fail "H3 integrate: expected MERGED, got: $out"
+echo "$out" | grep -q '^PUSHED: origin/main (refspec HEAD:main)' || fail "H3 integrate: expected explicit detached PUSHED, got: $out"
+
+# H4: HEAD still detached; the detached line survived; the remote advanced
+git symbolic-ref -q HEAD >/dev/null && fail "H4: HEAD should still be detached"
+H_MERGE=$(git rev-parse HEAD)
+git merge-base --is-ancestor "$H_BASE" HEAD || fail "H4: reviewed base abandoned"
+git merge-base --is-ancestor "$H_LINE" HEAD || fail "H4: detached line abandoned"
+[ "$(git rev-parse main)" = "$H_BASE" ] || fail "H4: local main moved (must stay at the reviewed base)"
+[ "$(git --git-dir="$H_REMOTE" rev-parse refs/heads/main)" = "$H_MERGE" ] || fail "H4: origin/main not updated to the merge commit"
+
+# H5: verify-merge VERIFIEDs; push-target re-pushes idempotently as HEAD:main
+out=$(bash "$LIFECYCLE" verify-merge "$tid") || fail "H5 verify-merge exited non-zero: $out"
+echo "$out" | grep -q '^VERIFIED:' || fail "H5: expected VERIFIED, got: $out"
+out=$(bash "$LIFECYCLE" push-target "$tid") || fail "H5 push-target exited non-zero: $out"
+echo "$out" | grep -q '^PUSHED: origin/main (refspec HEAD:main)' || fail "H5 push-target: expected idempotent PUSHED, got: $out"
+
+echo "fixture H (detached HEAD + origin): all checks passed"
+
+rm -rf "$T"
+echo "PASS: detached-HEAD integrate fixtures"