muse-crew 0.14.1 → 0.14.3

package/workflows/standard.js

@@ -428,7 +428,10 @@ function hydrateReleaseDecision(rec) {
 // it must match the artifact's real content.
 
 // See docs/decisions/publish-path.md#publish-attempt-ledger: every trigger outcome is recorded in the durable ledger.
-async function recordPublishLedger(entry, rework) {
+// keyTag (optional): same-outcome ledger writes in one pass need distinct
+// agent-call keys — the runtime replays cached calls by key, so a shared key
+// silently drops the second write (2026-09-19, submitted-on-issuance).
+async function recordPublishLedger(entry, rework, keyTag) {
   try {
     var ledgerDir = crewHome + "/.publish-ledger";
     var line = JSON.stringify({
@@ -450,7 +453,7 @@ async function recordPublishLedger(entry, rework) {
       "Run: mkdir -p " + sq(ledgerDir) + " && printf '%s\n' " + sq(line) +
       " | sed \"s/@LEDGER_TS@/$(date -u +%Y-%m-%dT%H:%M:%SZ)/\" >> " + sq(ledgerDir + "/" + PUBLISH_SLUG + ".jsonl") + " && echo LEDGER_OK\n" +
       "Return JSON { \"result\": \"<verbatim output>\" } and nothing else.",
-      { key: attemptKey("publish-ledger-" + taskId + "-" + entry.outcome, rework),
+      { key: attemptKey("publish-ledger-" + taskId + "-" + entry.outcome + (keyTag ? "-" + keyTag : ""), rework),
         label: "Recording publish attempt in ledger",
         schema: { type: "object", properties: { result: { type: "string" } }, required: ["result"] } }
     );
@@ -648,7 +651,7 @@ let releaseDecision = null; // { release: "yes"|"no", version_bump: "patch"|"min
 // Already-merged idempotency: the verified sha from the builder's
 // `repo_diff: none (already-merged: <sha>)` declaration (null when the
 // builder made commits or declared a runtime-state deliverable). The
-// workflow verifies the sha is an ancestor of main at Build closeout;
+// workflow verifies the sha is an ancestor of the integration target at Build closeout;
 // Review's no-diff branch reads this, never the builder's prose.
 let alreadyMergedSha = null;
 // Deterministic publish target — computed by the workflow (registry base +
@@ -1119,7 +1122,7 @@ while (i < STEPS.length) {
       "cd " + WORKTREE_HINT + "\n" +
       "git add -A\n" +
       "git commit -m \"" + safeTitle + "\"\n\n" +
-      "If the task's deliverable is runtime state (a cron definition, scheduler change, or dashboard/config state created outside the repo) and the repository genuinely needs no change, do NOT fabricate a commit: leave the branch with no commits ahead of main and declare `repo_diff: none` in your report, naming the runtime-state deliverable. If you verified the deliverable is already on main (a prior merge or hand-repair landed it — do NOT re-implement working code), make no commit and declare `repo_diff: none (already-merged: <sha>)` naming the main commit that carries the work; the workflow verifies the sha is an ancestor of main, and a false declaration fails the phase. Otherwise commit your changes normally.\n\n" +
+      "If the task's deliverable is runtime state (a cron definition, scheduler change, or dashboard/config state created outside the repo) and the repository genuinely needs no change, do NOT fabricate a commit: leave the branch with no commits ahead of the integration target and declare `repo_diff: none` in your report, naming the runtime-state deliverable. If you verified the deliverable is already on the integration target (a prior merge or hand-repair landed it — do NOT re-implement working code), make no commit and declare `repo_diff: none (already-merged: <sha>)` naming the integration-target commit that carries the work; the workflow verifies the sha is an ancestor of the integration target, and a false declaration fails the phase. Otherwise commit your changes normally.\n\n" +
       (rejectionNotes ? "This is REWORK after rejection. Address these specific issues:\n" + rejectionNotes + "\n\n" : "") +
       "Report back in plain prose: what you built and the outcome." +
       (PUBLISH_TYPE === "npm" ? " End your report with the release: and version_bump: lines exactly as specified above — keep them on their own lines, lowercase, unrephrased — then a line `worktree: ` followed by the exact working directory path from above (copy it verbatim \u2014 it must match character-for-character), then a final line with exactly: VERDICT: PASS if the build is complete, VERDICT: FAIL if it is not." : " End your report with a line `worktree: ` followed by the exact working directory path from above (copy it verbatim \u2014 it must match character-for-character), then exactly one line: VERDICT: PASS if the build is complete, VERDICT: FAIL if it is not.");
@@ -1157,16 +1160,16 @@ while (i < STEPS.length) {
       (mapperSpec ? "MAPPER'S SPEC (the builder was asked to implement exactly this):\n" + mapperSpec + "\n\n" : "Read the spec at exactly " + SPEC_PATH + " (fall back to the task description if the file is absent).\n\n") +
       "Examine the code changes by running:\n" +
       LIFECYCLE_ENV + LIFECYCLE + " inspect " + taskId + "\n\n" +
-      "The inspect output is authoritative: it prints the task branch's actual tip commit (TIP) and every commit ahead of main. Base your review ONLY on this output — do NOT run git log yourself to pick commits, and do NOT discuss commit hashes from any other source (they may come from stale rework rounds or a different repo).\n\n" +
+      "The inspect output is authoritative: it prints the task branch's actual tip commit (TIP) and every commit ahead of the integration target (inspect prints the target name). Base your review ONLY on this output — do NOT run git log yourself to pick commits, and do NOT discuss commit hashes from any other source (they may come from stale rework rounds or a different repo).\n\n" +
       "You can also read specific files in the worktree at:\n" +
       WORKTREE_HINT + "/\n\n" +
       "Check quality, correctness, and spec compliance.\n" +
       (SURFACE_TERMINAL ? "TERMINAL UX REVIEW: judge the CLI surface against " + UX_DOCTRINE_PATH + " — help accuracy, error quality, exit codes, output clarity. Reject when the bar is not met.\n" : "") +
       (SURFACE_ARTIFACT ? "ARTIFACT UX REVIEW: judge the rendered surface against " + UX_DOCTRINE_PATH + " — alignment, spacing, hierarchy, composition, balance, finish, correctness. Reject when the bar is not met.\n" : "") +
       "Check that public-affecting changes have matching public doc updates (API.md or the published API contract). If the docs are missing or inaccurate, report what is stale, then end your report with exactly this line: VERDICT: FAIL.\n" +
-      "If the branch has no commits ahead of main (inspect shows an empty commit log), approve ONLY if the Build summary declares `repo_diff: none` with (a) a plausible runtime-state deliverable (e.g. a cron created via the cron tool), or (b) an already-merged declaration `repo_diff: none (already-merged: <sha>)` AND the mechanical fact below confirms the sha verified. MECHANICAL FACT (computed by the workflow, never by the builder): already_merged sha = " + (alreadyMergedSha ? alreadyMergedSha + " (verified ancestor of main: YES)" : "none declared") + ". Otherwise report 'no commits ahead of main and no valid repo_diff: none declaration — the builder likely forgot to commit', then end your report with exactly this line: VERDICT: FAIL.\n" +
+      "If the branch has no commits ahead of the integration target (inspect shows an empty commit log), approve ONLY if the Build summary declares `repo_diff: none` with (a) a plausible runtime-state deliverable (e.g. a cron created via the cron tool), or (b) an already-merged declaration `repo_diff: none (already-merged: <sha>)` AND the mechanical fact below confirms the sha verified. MECHANICAL FACT (computed by the workflow, never by the builder): already_merged sha = " + (alreadyMergedSha ? alreadyMergedSha + " (verified ancestor of the integration target: YES)" : "none declared") + ". Otherwise report 'no commits ahead of the integration target and no valid repo_diff: none declaration — the builder likely forgot to commit', then end your report with exactly this line: VERDICT: FAIL.\n" +
       (PUBLISH_TYPE === "npm" ? "PACKAGE VERSION: this project publishes to the npm registry, and versions are assigned at publish time — never in branches. Two checks:\n" +
-      "(a) The task branch must NOT have changed package.json's `version` field. Check: cd " + REPO_PATH + " && git diff main..." + TASK_BRANCH + " -- package.json. If the branch touched `version` in any way, report 'versions are assigned at publish time, never in branches — remove the version change' in your notes, then end your report with exactly this line: VERDICT: FAIL.\n" +
+      "(a) The task branch must NOT have changed package.json's `version` field. First resolve the integration target: " + LIFECYCLE_ENV + LIFECYCLE + " integration-target. Then check: cd " + REPO_PATH + " && git diff <target>..." + TASK_BRANCH + " -- package.json (substitute the exact token integration-target printed — when it prints HEAD, use the literal word HEAD: `git diff HEAD...<branch>` diffs the detached checkout against the branch). If the branch touched `version` in any way, report 'versions are assigned at publish time, never in branches — remove the version change' in your notes, then end your report with exactly this line: VERDICT: FAIL.\n" +
       "(b) The accepted Build report declares: " + releaseDecisionText() + ". " +
       (releaseDecision
         ? "Validate this decision against the change: release must be 'yes' when the change is consumer-observable and 'no' when internal-only; the version_bump scope must fit the change (patch for fixes, minor for new behavior, major for breaking changes). If the decision is wrong or mis-scoped, report your notes, then end with exactly this line: VERDICT: FAIL."
@@ -1174,36 +1177,32 @@ while (i < STEPS.length) {
       "Write your review as plain prose — findings, then decision. End your report with exactly one line: VERDICT: PASS if the work passes, VERDICT: FAIL if it fails.";
 
   } else if (step.name === "Integrate") {
-    instructions = "Merge the approved task branch into main.\n\n" +
-      "Run: "+ LIFECYCLE_ENV + "WORKFLOW_RUN_ID=" + lockHolder + " integrate " + taskId + " \"merge: " + safeTitle + "\"\n\n" +
-      "Read the output:\n" +
-      "- If it contains MERGED, integration succeeded. Report the merged commit hash.\n" +
-      "- If it contains MERGED_EMPTY, the branch had no commits ahead of main (declared by Build as repo_diff: none — either a runtime-state deliverable or an already-merged sha the workflow verified). Integration succeeded vacuously: the merge lock was NOT taken and there is no new commit. Report 'merged empty: no repo changes — deliverable was runtime state or already on main', then end your report with exactly this line: VERDICT: PASS. SKIP STEP 2 (push): there is no new commit to push.\n" +
-      "- If it contains LOCK_HELD, another task holds the merge lock (mid Integrate/Publish) and the 10-minute bounded backoff is exhausted. Report 'merge lock held after bounded backoff', then end your report with exactly this line: VERDICT: FAIL.\n" +
-      "- If it contains CONFLICT, the plain merge failed — the merge was aborted, main is clean, and your task still holds the merge lock. Do NOT fail yet. Resolve it:\n" +
+    instructions = "Merge the approved task branch into the integration target and push the result.\n" +
+      "The integration target is the repo's current checkout — a branch name, or the literal word HEAD when detached (no branch name exists when detached). Print the exact token with: "+ LIFECYCLE_ENV + LIFECYCLE + " integration-target\n" +
+      "NEVER run git checkout — the lifecycle merges into the current checkout; moving it abandons the line Publish verifies.\n\n" +
+      "Read the staged publish base (return its stdout verbatim):\n" + crewCmd("get-provenance", { project_id: LAUNCH_PROJECT_ID }) + "\n" +
+      "Then run: "+ LIFECYCLE_ENV + "WORKFLOW_RUN_ID=" + lockHolder + " CREW_STAGED_BASE=<provenance.source_commit, empty when null> integrate " + taskId + " \"merge: " + safeTitle + "\\\"\\n" +
+      "The script merges, reconciles, records, and pushes under the merge lock. Informational only: RECONCILED, NO_REMOTE, NO_REMOTE_RECONCILE. Read the output:\n" +
+      "- STAGED_BASE_MISMATCH: the line left the staged base (stray checkout). VERDICT: FAIL.\n" +
+      "- MERGED_EMPTY — check FIRST (it contains the word MERGED): either a runtime-state deliverable or an already-merged sha the workflow verified (Build declared repo_diff: none). No lock taken, no new commit. Report 'merged empty: no repo changes'. VERDICT: PASS.\n" +
+      "- MERGED: the merge landed; the script pushed inline. Read the push line: PUSHED — report the hash (detached prints PUSHED: origin/main (refspec HEAD:main)), VERDICT: PASS; NO_REMOTE_PUSH — no remote configured, VERDICT: PASS; ERROR after MERGED — a retry recovers the push; report it, VERDICT: FAIL.\n" +
+      "- LOCK_HELD: 10-minute backoff exhausted. VERDICT: FAIL.\n" +
+      "- CONFLICT: the plain merge failed — aborted, the target is clean, and your task still holds the merge lock. Do NOT fail yet. Resolve it:\n" +
       "RESOLUTION:\n" +
-      "R1. Refresh the merge lock FIRST (a long resolution must not silently lose the lock to the orphan sweep): "+ LIFECYCLE_ENV + " refresh-lock " + taskId + ". Create a scratch worktree WITH A NEW BRANCH (main is already checked out in the repo checkout, so git forbids checking it out a second time): cd " + REPO_PATH + " && git worktree add -b resolve/" + taskId + " /tmp/crew-resolve-" + taskId + " main. Reproduce the conflict in the scratch worktree: cd /tmp/crew-resolve-" + taskId + " && git merge " + TASK_BRANCH + ". This reproduces the exact conflict (main has not moved — the lock was held throughout). The task branch " + TASK_BRANCH + " is never modified.\n" +
-      "R2. For each conflicted file, read the three sides: git show :1:<file> (base), git show :2:<file> (ours = main), git show :3:<file> (theirs = task branch). Resolve each hunk by keeping both sides' changes when they do not semantically overlap. Version-only hunks resolve to the higher semver (safety net). Never invent new behavior. Leave no markers.\n" +
-      "R3. Verify in the scratch worktree, in this order: (a) git diff --check is clean; (b) git grep -n '^<<<<<<<' -- . returns nothing; (c) node --check every changed .js file (conflicted files plus everything listed by git diff --name-only). If any check fails, refresh the merge lock ("+ LIFECYCLE_ENV + " refresh-lock " + taskId + "), then retry the resolution using the failure output as context — max 3 attempts total.\n" +
+      "R1. Refresh the merge lock FIRST (a long resolution must not silently lose the lock to the orphan sweep): "+ LIFECYCLE_ENV + " refresh-lock " + taskId + ". Create a scratch worktree WITH A NEW BRANCH (the integration target is checked out in the repo, so create the scratch worktree from HEAD — never check out another branch in the repo checkout): cd " + REPO_PATH + " && git worktree add -b resolve/" + taskId + " /tmp/crew-resolve-" + taskId + " HEAD. Reproduce the conflict in the scratch worktree: cd /tmp/crew-resolve-" + taskId + " && git merge " + TASK_BRANCH + ". This reproduces the exact conflict (the integration target has not moved — the lock was held throughout). The task branch " + TASK_BRANCH + " is never modified.\n" +
+      "R2. For each conflicted file, read the three sides: git show :1:<file> (base), git show :2:<file> (ours = the integration target), git show :3:<file> (theirs = task branch). Resolve each hunk by keeping both sides' changes when they do not semantically overlap. Version-only hunks resolve to the higher semver (safety net). Never invent new behavior. Leave no markers.\n" +
+      "R3. Verify in the scratch worktree, in this order: (a) git diff --check is clean; (b) git grep -n '^<<<<<<<' -- . returns nothing; (c) node --check every changed .js file (conflicted files plus everything listed by git diff --name-only). If any check fails, refresh the merge lock ("+ LIFECYCLE_ENV + " refresh-lock " + taskId + "), then retry using the failure output as context — max 3 attempts total.\n" +
       "R4. Commit the resolution on resolve/" + taskId + ": git add -A && git commit -m \"resolve conflicts: " + taskId + "\".\n" +
-      "R5. Back in " + REPO_PATH + ": git checkout main && git merge --ff-only resolve/" + taskId + ". This fast-forwards — main has not moved while the lock was held. Then STEP 2 applies: git push origin main. Report the merged commit hash.\n" +
+      "R5. Back in " + REPO_PATH + ": git merge --ff-only resolve/" + taskId + " — merges the resolution into the current checkout (the integration target; no git checkout anywhere). It fast-forwards — the target has not moved under the lock. Report the merged hash.\n" +
       "R6. Clean up: cd " + REPO_PATH + " && git worktree remove --force /tmp/crew-resolve-" + taskId + " && git branch -D resolve/" + taskId + ".\n" +
-      "ESCALATE — report 'conflict needs human resolution', then end your report with exactly this line: VERDICT: FAIL — when: 3 attempts are exhausted; the conflict touches generated files, migrations, or public API contracts; or 'looks right + checks pass' is not sufficient for any other reason. On escalation, RELEASE THE LOCK so the task can be reworked later: run CREW_HOME=" + crewHome + " CREW_REPO=" + REPO_PATH + " " + MERGE_LOCK + " release " + taskId + " (release is keyed on task id; no PID needed). Do NOT run post-deploy on escalation — it would delete the untouched task branch the human still needs.\n" +
-      "- If it contains ERROR, something else failed. Report the error, then end your report with exactly this line: VERDICT: FAIL.\n\n" +
-      "\n" +
-      "STEP 2: Push the merged main to the remote repository.\n" +
-      "First, refresh the merge lock — a slow push must not let the 600s lease expire under you: " + LIFECYCLE_ENV + LIFECYCLE + " refresh-lock " + taskId + ". If the refresh fails, report 'merge lock lost before push' and end your report with exactly this line: VERDICT: FAIL. Do not push without the lock.\n" +
-      "Run: cd " + REPO_PATH + " && git push origin main\n" +
-      "- If the push succeeds, report the merged commit hash.\n" +
-      "- If the push is rejected as non-fast-forward (the remote has commits not present locally),\n" +
-      "  NEVER force-push. Do not run any --force variant. The lifecycle's `integrate` already reconciled origin/main under the merge lock, so a rejection means the remote advanced after that reconcile — recover mechanically while you still hold the lock:\n" +
-      "  1. Run: cd " + REPO_PATH + " && git fetch origin main && git merge --no-edit origin/main -m \"merge: push-time reconcile (" + taskId + ")\".\n" +
-      "  2. If the merge conflicts, abort it (git merge --abort), report 'push-time reconcile conflicted — manual resolution required', then end your report with exactly this line: VERDICT: FAIL.\n" +
-      "  3. If it merges cleanly, retry the push exactly once: git push origin main. If the second push still rejects, report 'push rejected twice as non-fast-forward', then end your report with exactly this line: VERDICT: FAIL.\n" +
-      "  4. If the retry succeeds, report the merged commit hash.\n\n" +
-      "Report back in plain prose — what happened at each step — and end your report with exactly one line: VERDICT: PASS or VERDICT: FAIL.";
-
-  } else if (step.name === "Publish") {
+      "ESCALATE — 'conflict needs human resolution', VERDICT: FAIL — when: 3 attempts are exhausted; the conflict touches generated files, migrations, or public API contracts; or 'looks right + checks pass' is not sufficient for any other reason. On escalation, RELEASE THE LOCK so the task can be reworked later: run CREW_HOME=" + crewHome + " CREW_REPO=" + REPO_PATH + " " + MERGE_LOCK + " release " + taskId + " (release is keyed on task id; no PID needed). Do NOT run post-deploy on escalation — it would delete the untouched task branch the human still needs.\n" +
+      "- ERROR: report it. VERDICT: FAIL.\n\n" +
+      "R5-PUSH (manual R5 resolution only — the normal path pushed inline). Run: " + LIFECYCLE_ENV + LIFECYCLE + " push-target " + taskId + "\n" +
+      "PUSHED — report the merged hash (detached prints PUSHED: origin/main (refspec HEAD:main)), VERDICT: PASS; PUSH_SKIPPED — no push attempted (no record + no lock); NO_REMOTE_PUSH — no remote; VERDICT: PASS; ERROR or CONFLICT — report it, VERDICT: FAIL.\n" +
+      "NEVER force-push.\n\n" +
+      "Report what happened at each step, ending with exactly one line: VERDICT: PASS or VERDICT: FAIL.";
+
+} else if (step.name === "Publish") {
     if (PUBLISH_TYPE === "npm") {
       // Deterministic publish: the workflow computed the target version and the
       // agent runs exactly one command — the pinned publish script. The script
@@ -1220,7 +1219,7 @@ while (i < STEPS.length) {
         " bash " + PUBLISH_NPM + "\n\n" +
         "Do NOT run npm, npm pack, npm publish, or the python publish script yourself. Do NOT compare local and registry versions. Do NOT decide whether to publish.\n\n" +
         "If the command exits nonzero, put the script's PUBLISH_FAILED line in your report, then end your report with exactly this line: VERDICT: FAIL.\n" +
-        "If the script's output contains PUBLISH_SKIPPED=no-lock-held, the publish was skipped gracefully: Integrate reported MERGED_EMPTY (no commits ahead of main), so no merge lock was taken and there is nothing to ship. Paste the marker block verbatim into your report, then end your report with exactly these three lines, in this order — lowercase, no trailing period, do not rephrase:\n" +
+        "If the script's output contains PUBLISH_SKIPPED=no-lock-held, the publish was skipped gracefully: Integrate reported MERGED_EMPTY (no commits ahead of the integration target), so no merge lock was taken and there is nothing to ship. Paste the marker block verbatim into your report, then end your report with exactly these three lines, in this order — lowercase, no trailing period, do not rephrase:\n" +
         "TARGET_VERSION=" + publishTarget.target + " computed as " + publishTarget.base + " + " + publishTarget.scope + " → " + publishTarget.target + "\n" +
         "skipped: no-lock-held (empty-diff Integrate — nothing merged, nothing to ship)\n" +
         "VERDICT: PASS\n\n" +
@@ -1537,7 +1536,7 @@ while (i < STEPS.length) {
           log("Publish pre-trigger baseline read failed for task " + taskId + " (" + (baselineErr && baselineErr.message ? baselineErr.message : baselineErr) + ") — receipt attribution skipped; durable audit-dir evidence is the only positive signal");
         }
         // See docs/decisions/publish-path.md#trigger-await: the artifact_edit call is awaited.
-        var rebuildTrigger = null;
+        var rebuildTrigger = null, triggerThrew = false;
         try {
           var triggerText = String(await agent(rebuildPrompt,
             { key: rebuildAttemptKey, label: "Triggering artifact rebuild" }) || "");
@@ -1557,7 +1556,18 @@ while (i < STEPS.length) {
           }
         } catch (triggerErr) {
           log("Publish rebuild trigger for task " + taskId + " threw (" + (triggerErr && triggerErr.message ? triggerErr.message : triggerErr) + ") — outcome unknown until observation confirms it; the edit may have gone through");
+          triggerThrew = true;
         }
+        // (2026-09-19, room #22) Submitted-on-issuance: see docs/decisions/publish-path.md#submitted-on-issuance.
+        await recordPublishLedger({
+          commit: mergeCommitForPublish,
+          attempt: rebuildAttemptKey,
+          agent_id: null,
+          applied_report: publishAppliedObservation,
+          manifest_before: preTriggerManifest,
+          outcome: "submitted",
+          detail: "trigger issuance: rebuild-trigger agent invoked; receipt/observation pending. Invocation only - not evidence of artifact_edit or build acceptance." + (triggerThrew ? "; trigger-threw" : "; trigger-returned")
+        }, totalReworkCount, "issuance");
         // Post-trigger observation (primary, not fallback): the workflow
         // attributes the edit itself. First the in-flight build state — a
         // build whose agent_id is new relative to the pre-trigger baseline
@@ -1677,8 +1687,8 @@ while (i < STEPS.length) {
             applied_report: publishAppliedObservation,
             manifest_before: preTriggerManifest,
             outcome: "submitted",
-            detail: "fire-and-forget trigger; build receipt captured by workflow-owned build-state observation (pre/post-trigger diff)"
-          }, totalReworkCount);
+            detail: "fire-and-forget trigger; build receipt captured by workflow-owned build-state observation (pre/post-trigger diff); observation, not re-issuance"
+          }, totalReworkCount, "receipt");
         } else {
           var newAuditDirs = [];
           try {
@@ -1809,10 +1819,6 @@ while (i < STEPS.length) {
         // its outcome — submitted, rejected, or unknown (unknown is recorded
         // at the park site above). A later run or human matches commit hash +
         // attempt key against the builder's eventual completion.
-        // (2026-09-16) The trigger is fire-and-forget: the observation above
-        // already recorded the ledger's submitted line on both positive paths
-        // and parked on unknown — there is no applied report to observe and
-        // no rejection signal to record.
         // (2026-09-18, H2 verdict-first) The verdict was decided exactly
         // once above; dispatch on it. landed bypasses the receipt poll
         // (the audit evidence already proved completion); an explicit
@@ -1946,21 +1952,12 @@ while (i < STEPS.length) {
             log("Publish build landed for task " + taskId + " — provenance stamp deferred to parent content verification");
           } else {
             // STEP 1b durable audit-dir fallback (2026-09-15, task aadeccc3):
-            // the poll above only observes IN-FLIGHT builds. A build that
-            // finished between the receipt capture and the poll's first check
-            // leaves no in-flight trace — but the platform's audit harness
-            // leaves a durable one (~/workspace/ts-spaces/<slug>/audits/
-            // <timestamp>-<id>/ per completed build). Diff the audit-dir
-            // listing against the pre-trigger snapshot: a timestamped dir
-            // that appeared during the attempt window is evidence a build
-            // completed. Attribution is by window, not by build identity:
-            // the poll's saw_stranger signal only catches stranger builds in
-            // flight AT a check — a stranger that finished entirely inside
-            // the window is indistinguishable, so any observed stranger
-            // blocks attribution and the outcome stays unknown. This never
-            // re-issues the edit and never stamps provenance — ok=true only
-            // routes to the parent's independent content read-back, which
-            // remains the real verification.
+            // the poll observes only in-flight builds; a build that finished
+            // inside the window leaves a durable audit dir. Diff the audit
+            // listing against the pre-trigger snapshot: a new timestamped dir
+            // is evidence a build completed. Attribution is by window, not by build identity: any
+            // observed stranger blocks it. Never re-issues, never stamps;
+            // ok=true routes to the parent's read-back (the verification).
             //
             // The poll end-state is read from the poll's own observations,
             // not from build_done alone: a build in flight at the last check
@@ -2129,7 +2126,7 @@ while (i < STEPS.length) {
       // artifact_edit would trigger a duplicate build.
       if (publishSkippedNoLock) {
         instructions = "Publish was skipped deterministically by the workflow before your step — do NOT call artifact_edit, artifact_status, setprovenance, or post-deploy yourself; doing so would disturb the finalized state.\n\n" +
-          "Integrate reported MERGED_EMPTY (the task branch had no commits ahead of main), so no merge lock was taken and there is nothing to ship. Post-deploy step finished per its return — do NOT run post-deploy yourself.\n\n" +
+          "Integrate reported MERGED_EMPTY (the task branch had no commits ahead of the integration target), so no merge lock was taken and there is nothing to ship. Post-deploy step finished per its return — do NOT run post-deploy yourself.\n\n" +
           "Write plain prose describing the skip, then on its own line: VERDICT: PASS\n" +
           "The VERDICT line must be the last line of your report.";
       } else {
@@ -2158,7 +2155,7 @@ while (i < STEPS.length) {
     // publish skip becomes a loud QA failure with evidence, not a pass.
     var npmPublishCheck = (PUBLISH_TYPE === "npm" && releaseDecision && releaseDecision.release === "yes")
       ? "NPM PUBLISH CHECK: the accepted Build report declared release: yes, so this run's Publish phase must have published — UNLESS it was skipped deterministically on an empty-diff Integrate. Find this task's recorded Publish result: run in shell and return the stdout verbatim:\n" + crewCmd("get-state", { events_limit: 1 }) + "\n, then find the session for this task_id with step \"Publish\" (status completed) in the returned sessions array and read its session notes (the Publish agent's summary — event history does NOT carry it).\n" +
-      "CHECK THE SKIP PATH FIRST: if the notes contain a line matching skipped: no-lock-held, Publish was skipped deterministically — Integrate reported MERGED_EMPTY (no commits ahead of main), so no merge lock was taken and there was nothing to ship. Verify the notes contain that skip-marker line and do NOT contain a line matching published: muse-crew@. Do NOT run npm view and do NOT demand registry movement — nothing was supposed to ship. Report 'npm publish check: Publish skipped deterministically (empty-diff Integrate — nothing to ship)' and PASS this check.\n" +
+      "CHECK THE SKIP PATH FIRST: if the notes contain a line matching skipped: no-lock-held, Publish was skipped deterministically — Integrate reported MERGED_EMPTY (no commits ahead of the integration target), so no merge lock was taken and there was nothing to ship. Verify the notes contain that skip-marker line and do NOT contain a line matching published: muse-crew@. Do NOT run npm view and do NOT demand registry movement — nothing was supposed to ship. Report 'npm publish check: Publish skipped deterministically (empty-diff Integrate — nothing to ship)' and PASS this check.\n" +
       "Only when the notes contain no skip marker must the publish have landed — run the full verification below.\n" +
       "Extract the line matching TARGET_VERSION=<new-version> computed as <base> + <scope> → <new-version> (the workflow appends it to the Publish notes, so it is always present). If the line is missing, report 'npm publish verification failed: Publish notes did not carry the computed target version', then end your report with exactly this line: VERDICT: FAIL.\n" +
       "Verify the bump SCOPE: the <scope> in that line MUST equal the accepted version_bump scope \"" + releaseDecision.version_bump + "\" — if it differs, report the mismatch, then end your report with exactly this line: VERDICT: FAIL. Verify the ARITHMETIC: <base> + <scope> must equal <new-version> (patch increments the last segment only, e.g. 0.3.0 + patch → 0.3.1; minor increments the middle and resets the last to 0; major increments the first and resets the rest to 0) — if the math is wrong, report it, then end your report with exactly this line: VERDICT: FAIL.\n" +
@@ -2209,7 +2206,7 @@ while (i < STEPS.length) {
         "Public docs (API.md, README) are NOT source code — read them freely, exactly as a user would.\n" +
         "Read the shared UX bar FIRST: " + UX_DOCTRINE_PATH + " — it is the bar the whole crew builds to, and your verdict judges against it point by point.\n\n" +
         "STEP 1: Experiential terminal inspection — drive the CLI as a user would, one command at a time.\n" +
-        "a. The CLI under test lives in " + REPO_PATH + " (the merged change is on main there). Start like a new user: run --help. You may RUN the CLI; you may never READ its source.\n" +
+        "a. The CLI under test lives in " + REPO_PATH + " (the merged change is on the integration target there). Start like a new user: run --help. You may RUN the CLI; you may never READ its source.\n" +
         "b. Terminal targets for this task: " + termTargetsLine + ".\n" +
         "c. Bounded terminal loop — at most 8 commands. For each target: run it RIGHT (the happy path), then run it WRONG on purpose (bad flags, missing args, nonexistent files, empty input, contradictory flags). Error quality is half the grade: every failure must exit non-zero, say what went wrong in plain language, and tell the user the fix. A raw stack trace shown to a user is a defect — file it as one.\n" +
         "d. Evidence: capture EVERY invocation as a transcript. Run: mkdir -p " + termEvidence + "\n" +
@@ -2432,19 +2429,19 @@ while (i < STEPS.length) {
       var amCheck = await agent(
         "Verify the builder's already-merged declaration.\n" +
         "Run in shell and return the stdout verbatim:\n" +
-        "cd " + REPO_PATH + " && git rev-parse --verify --quiet " + am.sha + " >/dev/null && git merge-base --is-ancestor " + am.sha + " main && echo ALREADY_MERGED_YES || echo ALREADY_MERGED_NO",
+        "TARGET=$(" + LIFECYCLE_ENV + LIFECYCLE + " integration-target) && cd " + REPO_PATH + " && git rev-parse --verify --quiet " + am.sha + " >/dev/null && git merge-base --is-ancestor " + am.sha + " $TARGET && echo ALREADY_MERGED_YES || echo ALREADY_MERGED_NO",
         { key: "verify-already-merged" + (totalReworkCount > 0 ? "-r" + totalReworkCount : ""), label: "Verifying already-merged declaration" }
       );
       var amOut = (typeof amCheck === "string") ? amCheck : JSON.stringify(amCheck);
       if (!/ALREADY_MERGED_YES/.test(amOut)) {
-        log("Build already-merged declaration failed verification — " + am.sha + " is not an ancestor of main — marking failed for retry");
+        log("Build already-merged declaration failed verification — " + am.sha + " is not an ancestor of the integration target — marking failed for retry");
         await agent(
           "Record already-merged verification failure.\n" +
           "Run in shell and return the stdout verbatim:\n" + crewCmd("record-phase", {
             task_id: taskId,
             session: { id: activeSessionId, task_id: taskId, identity: step.identity, step: step.name, status: "failed",
-              notes: "Build declared repo_diff: none (already-merged: " + am.sha + ") but " + am.sha + " is not an ancestor of main in the configured repo. The declaration is fabricated or mistaken; the work is not on main. Phase failed for retry" },
-            event: { task_id: taskId, type: "failed", message: "Build already-merged declaration failed verification — " + am.sha + " not an ancestor of main, phase failed, dispatcher will retry" }
+              notes: "Build declared repo_diff: none (already-merged: " + am.sha + ") but " + am.sha + " is not an ancestor of the integration target in the configured repo. The declaration is fabricated or mistaken; the work is not on the integration target. Phase failed for retry" },
+            event: { task_id: taskId, type: "failed", message: "Build already-merged declaration failed verification — " + am.sha + " not an ancestor of the integration target, phase failed, dispatcher will retry" }
           }),
           { key: "record-already-merged-fail-" + step.name, label: "Recording already-merged verification failure" }
         );
@@ -2452,13 +2449,13 @@ while (i < STEPS.length) {
           __hatchWorkflowControl: "blocked",
           result: {
             blocked_reason: "Build already-merged declaration failed verification",
-            message: "The builder declared repo_diff: none (already-merged: " + am.sha + ") but " + am.sha + " is not an ancestor of main. The work is not on main; the phase is marked failed and the dispatcher will retry Build.",
+            message: "The builder declared repo_diff: none (already-merged: " + am.sha + ") but " + am.sha + " is not an ancestor of the integration target. The work is not on the integration target; the phase is marked failed and the dispatcher will retry Build.",
             task_id: taskId
           }
         };
       }
       alreadyMergedSha = am.sha;
-      log("Build already-merged declaration verified: " + am.sha + " is an ancestor of main");
+      log("Build already-merged declaration verified: " + am.sha + " is an ancestor of the integration target");
     }
   }
 
@@ -2529,7 +2526,7 @@ while (i < STEPS.length) {
       integrateVerifyOut = "";
     }
     if (/^VERIFIED:/m.test(integrateVerifyOut)) {
-      log("Integrate verified for task " + taskId + ": task branch tip is an ancestor of main");
+      log("Integrate verified for task " + taskId + ": task branch tip is an ancestor of the integration target");
     } else {
       var integrateVerifyReason = integrateVerifyOut
         ? integrateVerifyOut.split("\n")[0].slice(0, 200)
@@ -2712,12 +2709,12 @@ while (i < STEPS.length) {
     }
     rejectionNotes = summary;
     // Already-merged corrective (room #16 blocker 11): when Review rejected
-    // an empty branch but the work is already on main (the workflow verified
+    // an empty branch but the work is already on the integration target (the workflow verified
     // the sha), Wren must declare it — not re-implement or re-commit
     // already-landed work. Scoped to the empty-branch rejection; any other
     // rejection already carries its own specific notes.
-    if (step.name === "Review" && alreadyMergedSha && /no commits ahead of main/i.test(summary)) {
-      rejectionNotes += "\n\nCORRECTIVE (from the workflow, not the reviewer): the deliverable is already on main — the workflow mechanically verified that " + alreadyMergedSha + " is an ancestor of main. Do NOT re-implement the work and do NOT create a new commit for it. In your Build report, declare exactly: repo_diff: none (already-merged: " + alreadyMergedSha + ") — then end with VERDICT: PASS.";
+    if (step.name === "Review" && alreadyMergedSha && /no commits ahead of (main|the integration target)/i.test(summary)) {
+      rejectionNotes += "\n\nCORRECTIVE (from the workflow, not the reviewer): the deliverable is already on the integration target — the workflow mechanically verified that " + alreadyMergedSha + " is an ancestor of the integration target. Do NOT re-implement the work and do NOT create a new commit for it. In your Build report, declare exactly: repo_diff: none (already-merged: " + alreadyMergedSha + ") — then end with VERDICT: PASS.";
       log("Rework corrective appended for task " + taskId + ": already-merged " + alreadyMergedSha + " — Wren must declare, not rebuild");
     }
     i = BUILD_INDEX;