muse-crew 0.14.2 → 0.14.4

package/lib/update-watch.js

@@ -22,9 +22,11 @@
 //     every path except a missing --crew-home (exit 2).
 "use strict";
 
-const fs = require("fs");
-const path = require("path");
-const { execFileSync } = require("child_process");
+import fs from "node:fs";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+import { realpathSync } from "node:fs";
+import { fileURLToPath } from "node:url";
 
 const STATE_FILE = ".update-watch.json";
 const LOG_FILE = "update-watch.log";
@@ -653,6 +655,11 @@ function buildRealDeps(crewHome) {
 
 function main() {
   const args = process.argv.slice(2);
+  // --help: before required-arg parsing (entry-gate contract).
+  if (args.includes("--help")) {
+    console.log(USAGE);
+    process.exit(0);
+  }
   let crewHome = null;
   let enrollSha = null;
   let enrollForce = false;
@@ -693,19 +700,29 @@ function main() {
   );
 }
 
-module.exports = {
-  parseSemver: parseSemver,
-  compareSemver: compareSemver,
-  channelAllows: channelAllows,
-  crewDecision: crewDecision,
-  dashboardDecision: dashboardDecision,
-  crewVersionOrdering: crewVersionOrdering,
-  fileCrewUpgrade: fileCrewUpgrade,
-  enrollDashboardBase: enrollDashboardBase,
-  readState: readState,
-  writeState: writeState,
-  appendLog: appendLog,
-  run: run
+export {
+  parseSemver,
+  compareSemver,
+  channelAllows,
+  crewDecision,
+  dashboardDecision,
+  crewVersionOrdering,
+  fileCrewUpgrade,
+  enrollDashboardBase,
+  readState,
+  writeState,
+  appendLog,
+  run
 };
 
-if (require.main === module) main();
+const USAGE = "usage: node update-watch.js --crew-home <path> [--record-dashboard-sha <sha> [--force]]";
+
+const isMainModule = (() => {
+  try {
+    return !!process.argv[1] && realpathSync(process.argv[1]) === fileURLToPath(import.meta.url);
+  } catch {
+    return false;
+  }
+})();
+
+if (isMainModule) main();

package/lib/ux-doctrine.js

@@ -1,3 +1,4 @@
+#!/usr/bin/env node
 // ux-doctrine.js — UX-surface doctrine page resolution.
 //
 // One canonical doctrine page per environment_type value: the crew reads
@@ -11,10 +12,16 @@
 // against this file, so the two can never silently diverge.
 //
 // Pure and deterministic: no clock, no randomness, no I/O.
-"use strict";
+//
+// Module shape (blocker 21): this file is an import-safe shared module —
+// it has NO shebang, so the entry gate bare-loads it (`node ux-doctrine.js`
+// exits 0). The CLI below runs only when the file itself is the process
+// entrypoint.
 
-const { existsSync } = require("node:fs");
-const { join } = require("node:path");
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { realpathSync } from "node:fs";
+import { fileURLToPath } from "node:url";
 
 // THE MAP. environment_type value -> doctrine page filename, relative to
 // the release docs dir ($CREW_HOME/current/docs/). null is unclassified —
@@ -44,12 +51,30 @@ function doctrinePageExists(crewHome, environmentType) {
   return p ? existsSync(p) : false;
 }
 
-module.exports = { DOCTRINE_PAGES, doctrinePage, doctrinePath, doctrinePageExists };
+export { DOCTRINE_PAGES, doctrinePage, doctrinePath, doctrinePageExists };
+
+// realpath: production spawns through $CREW_HOME/current/lib (a symlink),
+// so argv[1] must be resolved before comparison with import.meta.url.
+const isMainModule = (() => {
+  try {
+    return !!process.argv[1] && realpathSync(process.argv[1]) === fileURLToPath(import.meta.url);
+  } catch {
+    return false;
+  }
+})();
 
-if (require.main === module) {
+const USAGE = "usage: node ux-doctrine.js --page <environment_type|null> | --path <crewHome> <environment_type|null>";
+
+if (isMainModule) {
   // CLI: node ux-doctrine.js --page <environment_type>
   //      node ux-doctrine.js --path <crewHome> <environment_type>
   const args = process.argv.slice(2);
+  // Import-safe module contract: a bare invocation (no args) is a load
+  // check, not a usage error — it exits 0. --help always exits 0.
+  if (args.length === 0 || args.includes("--help")) {
+    console.log(USAGE);
+    process.exit(0);
+  }
   if (args[0] === "--page" && args.length === 2) {
     const page = doctrinePage(args[1] === "null" ? null : args[1]);
     console.log(page === null ? "null" : page);
@@ -57,7 +82,7 @@ if (require.main === module) {
     const p = doctrinePath(args[1], args[2] === "null" ? null : args[2]);
     console.log(p === null ? "null" : p);
   } else {
-    console.error("usage: node ux-doctrine.js --page <environment_type|null> | --path <crewHome> <environment_type|null>");
+    console.error(USAGE);
     process.exit(2);
   }
 }

package/lib/verify-publish.js

@@ -51,6 +51,19 @@ import {
   makeOldCounter,
   discriminatingLines,
 } from "./publish-content.js";
+// Terminal-note vocabulary (D7, 2026-09-19): the writer-side guard.
+// terminal() asserts its emitted verb is a registry member before writing,
+// so no future terminal verb ships unrecognized by the scans.
+import { matchTerminalPublishNote } from "./publish-note-vocabulary.js";
+
+// --help: before required-arg parsing (shebang⇔CLI contract).
+if (process.argv.slice(2).includes("--help")) {
+  console.log(
+    "usage: node verify-publish.js --repo-path <path> --commit <sha> --base <sha> --task-id <uuid> --slug <artifact-slug> --project-id <id> [--spaces-root <dir>]\n" +
+    "the mechanical publish verification JUDGE: certifies read-back findings against git diff, checks manifest freshness, stamps provenance"
+  );
+  process.exit(0);
+}
 
 function arg(name, required = true) {
   const i = process.argv.indexOf(name);
@@ -89,10 +102,25 @@ function api(command, json) {
   });
   return JSON.parse(out);
 }
+// The terminal verdict this writer emits. A single const (not an inline
+// literal) so the emitted verb and the asserted verb can never drift apart.
+const TERMINAL_VERB = "publish: verification-failed";
 function terminal(reason, detail) {
   // Always lands a terminal parent verdict, then exits 1 (failed) — the
   // task stays parked for human attention. Only the verified path exits 0.
-  const msg = `publish: verification-failed ${commit} ${reason}${detail ? ` — ${detail}` : ""} (read-back ${inspectionId})`;
+  // Writer-side registry guard (D7): the verb is in the terminal-note
+  // registry before the note is written — a writer can never introduce a
+  // terminal verb the scans don't recognize.
+  if (!matchTerminalPublishNote(TERMINAL_VERB)) {
+    // Registry and writer disagree — fail loud, never emit an unrecognized
+    // terminal note.
+    process.stderr.write(JSON.stringify({
+      ok: false, verdict: "vocabulary-mismatch",
+      message: `terminal verb '${TERMINAL_VERB}' is not in the terminal-note registry`,
+    }) + "\n");
+    process.exit(2);
+  }
+  const msg = `${TERMINAL_VERB} ${commit} ${reason}${detail ? ` — ${detail}` : ""} (read-back ${inspectionId})`;
   api("log-event", { task_id: taskId, type: "note", message: msg.slice(0, 1000) });
   process.stderr.write(JSON.stringify({ ok: false, verdict: reason, message: msg }) + "\n");
   process.exit(1);
@@ -298,8 +326,17 @@ if (head !== commit) {
 // 2026-09-18, blocker 4: bind by exact (task_id, commit, attempt) when the
 // attempt is known — the original and retry attempts share a commit, and
 // positional selection is luck. Within one attempt, select the OLDEST
-// submitted entry (the trigger issuance; per blocker 2, audit observations
-// are now "build-observed", not "submitted").
+// submitted entry (the trigger issuance; a receipt-bearing second "submitted"
+// may follow it — the oldest binds the trigger instant, the latest carries
+// the observed agent_id).
+// D1 (2026-09-19; entry_kind cut 2026-09-20): the trigger instant is the
+// ISSUANCE instant, not the ledger-write instant — a slow ledger write must
+// not make a fresh build look stale (room #23 J1). The anchor is the OLDEST
+// submitted entry by ts and the bound instant is its issued_at (falling back
+// to its ts when the capture was unobserved). One anchor, one field — the
+// retired entry_kind preference filter could never change the bound anchor
+// (issuance and receipt entries carried the same captured issued_at), so the
+// oldest-by-ts selection is the whole mechanism.
 let triggerTs = null;
 let manifestBefore = null;
 try {
@@ -313,11 +350,9 @@ try {
     (attempt == null || e.attempt === attempt)
   );
   if (candidates.length > 0) {
-    // Oldest first: the trigger issuance is the first submitted entry for
-    // the attempt (observations are "build-observed" per blocker 2).
     candidates.sort((a, b) => (a.ts || "").localeCompare(b.ts || ""));
     const e = candidates[0];
-    triggerTs = e.ts || null;
+    triggerTs = e.issued_at || e.ts || null;
     if (e.manifest_before && typeof e.manifest_before === "object") manifestBefore = e.manifest_before;
   }
 } catch (e) {

package/lib/worktree-lifecycle.sh

@@ -150,6 +150,24 @@ integration_target() {
   git rev-parse --abbrev-ref HEAD 2>/dev/null || { echo "ERROR: cannot resolve HEAD"; return 1; }
 }
 
+# Resolve the remote branch a detached HEAD pushes to: the remote's default
+# branch (origin/HEAD). Prints the bare branch name (no origin/ prefix).
+# Attached checkouts never need this (their target IS the branch name).
+# Fails when the destination is genuinely unknowable -- the caller fails
+# closed (never a silent skip, never a refusal of a knowable push).
+# (2026-09-19 detached-HEAD audit REDO: the old code treated detached+remote
+# as PUSH_SKIPPED->PASS "by policy", hiding merged work that never reached
+# the remote. The contract is explicit HEAD:<destination> semantics.)
+resolve_push_destination() {
+  cd "$REPO"
+  local sym
+  sym=$(git symbolic-ref --quiet --short refs/remotes/origin/HEAD 2>/dev/null) || {
+    echo "ERROR: detached HEAD with an origin remote, but origin/HEAD is not set -- the push destination is genuinely unknowable; set it (git remote set-head origin -a) and retry -- not pushing"
+    return 1
+  }
+  printf '%s\n' "${sym#origin/}"
+}
+
 # (2026-09-19 REVIEW: the old integration_tip() helper is deleted — it had
 # zero call sites and cmd_verify_merge reimplemented tip resolution inline
 # with different semantics, a drift hazard. Tip resolution lives in exactly
@@ -323,8 +341,15 @@ acquire_merge_lock() {
 # refresh needed) and by cmd_push_target for the R5 manual-conflict path
 # (which refreshes the lock first). Never force-pushes.
 #
-# The caller must hold the merge lock. Prints one of PUSHED / PUSH_SKIPPED /
-# NO_REMOTE_PUSH and returns 0, or prints an ERROR line and returns 1.
+# The caller must hold the merge lock. Prints one of PUSHED /
+# NO_REMOTE_PUSH and returns 0, or prints PUSH_FAILED / CONFLICT / ERROR
+# and returns 1 as labeled. (PUSH_SKIPPED belongs to cmd_push_target's
+# nothing-merged path only -- F-R3.) The push
+# refspec is always explicit: a branch pushes as <branch>, a detached HEAD
+# pushes as HEAD:<destination> where the destination is the remote's
+# default branch resolved by resolve_push_destination() -- never a silent
+# skip (2026-09-19 detached-HEAD audit REDO: PUSH_SKIPPED->PASS on
+# detached+remote hid merged work that never reached the remote).
 do_push() {
   local task_id="$1"
   cd "$REPO"
@@ -332,17 +357,6 @@ do_push() {
   local target
   target=$(integration_target) || return 1
 
-  # Detached HEAD: by design the integration line is local to this checkout
-  # (clean-room staging pins the reviewed commit; no remote ref is claimed
-  # for the detached line), so there is nothing to push. This is a policy
-  # statement, not a git limitation — `git push origin HEAD:<ref>` would
-  # work; we choose not to push the detached line. Room evidence is
-  # preserved in room state; releases ship through the loop's Publish phase.
-  if [ "$target" = "HEAD" ]; then
-    echo "PUSH_SKIPPED: detached HEAD -- the integration line is local by design; nothing to push"
-    return 0
-  fi
-
   # No remote configured: fail soft, loudly. (2026-09-19 REVIEW: the old
   # code ran `git push origin` unconditionally, which exits 128 with no
   # origin, got mislabeled PUSH_REJECTED, and failed the phase — while
@@ -354,8 +368,20 @@ do_push() {
     return 0
   fi
 
-  if git push origin "$target" 2>&1; then
-    echo "PUSHED: origin/$target"
+  # Attached: branch name; detached: remote default branch via resolve_push_destination() (see header).
+  local dest refspec
+  if [ "$target" = "HEAD" ]; then
+    # Surface the resolver's reason: the caller cannot remediate a swallowed
+    # failure, and the retry-promise below must not lie about it (F-R1).
+    dest=$(resolve_push_destination) || { echo "$dest"; return 1; }
+    refspec="HEAD:$dest"
+  else
+    dest="$target"
+    refspec="$target"
+  fi
+
+  if git push origin "$refspec" 2>&1; then
+    echo "PUSHED: origin/$dest (refspec $refspec)"
     return 0
   fi
 
@@ -363,17 +389,17 @@ do_push() {
   # "non-fast-forward" — auth errors got the same label). Recover
   # mechanically while the lock is held: fetch, merge, retry once.
   echo "PUSH_FAILED: push did not complete -- reconciling once while the lock is held"
-  if ! git fetch origin "$target" 2>&1; then
-    echo "ERROR: git fetch origin $target failed -- push not completed"
+  if ! git fetch origin "$dest" 2>&1; then
+    echo "ERROR: git fetch origin $dest failed -- push not completed"
     return 1
   fi
-  if ! git merge --no-edit "origin/$target" -m "merge: push-time reconcile ($task_id)" 2>&1; then
-    echo "CONFLICT: origin/$target diverged with conflicting changes -- aborting"
+  if ! git merge --no-edit "origin/$dest" -m "merge: push-time reconcile ($task_id)" 2>&1; then
+    echo "CONFLICT: origin/$dest diverged with conflicting changes -- aborting"
     git merge --abort 2>/dev/null || true
     return 1
   fi
-  if git push origin "$target" 2>&1; then
-    echo "PUSHED: origin/$target (after reconcile)"
+  if git push origin "$refspec" 2>&1; then
+    echo "PUSHED: origin/$dest (refspec $refspec, after reconcile)"
     return 0
   fi
   echo "ERROR: push failed again after reconcile -- not pushing"
@@ -473,10 +499,12 @@ cmd_integrate() {
   # the Integrate phase fails closed. Fetch and merge the remote branch now
   # so the subsequent push is a fast-forward.
   # Fail-soft when there is no remote; fail closed on a real conflict.
-  # A detached HEAD is local by design (no remote ref is claimed for the
-  # detached line), so there is nothing to reconcile.
+  # Detached: there is no static branch target to reconcile against inline;
+  # do_push resolves the destination explicitly and reconciles on push
+  # failure, so the inline reconcile is skipped here (F-R2 -- the old
+  # "local by design" rationale is the rejected 0.14.2 policy).
   if [ "$target" = "HEAD" ]; then
-    echo "NO_REMOTE_RECONCILE: detached HEAD -- the integration line is local by design; skipping origin reconcile"
+    echo "NO_REMOTE_RECONCILE: detached HEAD -- destination resolved explicitly by do_push, skipping inline reconcile"
   elif git rev-parse --verify "origin/$target" >/dev/null 2>&1; then
     if git fetch origin "$target" 2>&1; then
       if ! git merge --no-edit "origin/$target" -m "merge: reconcile with origin/$target before push ($task_id)" 2>&1; then
@@ -512,7 +540,7 @@ cmd_integrate() {
   # agent run added only a lock refresh). R5's manual-conflict path uses the
   # push-target command instead.
   if ! do_push "$task_id"; then
-    echo "ERROR: push failed after merge $merged_commit -- merge is recorded; retry will recover the push"
+    echo "ERROR: push failed after merge $merged_commit -- merge is recorded; a re-run of push-target retries transient failures, but an unknowable destination needs 'git remote set-head origin -a' (see the ERROR line above -- F-R1)"
     return 1
   fi
 
@@ -834,6 +862,19 @@ cmd_integration_target() {
   integration_target
 }
 
+# Agent-side one-liner: prints the remote branch a push updates. Attached:
+# the branch name. Detached: the resolved destination from
+# resolve_push_destination() (fails when genuinely unknowable).
+cmd_push_destination() {
+  local target
+  target=$(integration_target) || exit 1
+  if [ "$target" = "HEAD" ]; then
+    resolve_push_destination
+  else
+    printf '%s\n' "$target"
+  fi
+}
+
 # Deterministic push of the integration target. Thin wrapper over do_push
 # for the R5 manual-conflict path (re-running `integrate` there misfires on
 # ahead=0 -> MERGED_EMPTY, so the manually-merged line still needs a
@@ -888,6 +929,7 @@ case "$cmd" in
   integrate)    cmd_integrate "${1:?task_id required}" "${2:-}" ;;
   verify-merge) cmd_verify_merge "${1:?task_id required}" ;;
   integration-target) cmd_integration_target ;;
+  push-destination) cmd_push_destination ;;
   push-target)   cmd_push_target "${1:?task_id required}" ;;
   post-deploy)  cmd_post_deploy "${1:?task_id required}" ;;
   terminal-cleanup) cmd_terminal_cleanup "${1:?task_id required}" ;;

package/lib/write-ooda-verdict.js

@@ -1,3 +1,4 @@
+#!/usr/bin/env node
 // write-ooda-verdict.js — deterministic writer for the OODA report's terminal state.
 //
 // After the see-act loop, the QA/repro agent records its verdict as
@@ -34,10 +35,9 @@
 //
 // Exit 0 on success, 2 on bad input. Determinism: no wall-clock reads, no
 // randomness; ts comes only from --ts and is omitted when not passed.
-"use strict";
 
-const { writeFileSync, appendFileSync, mkdirSync, readFileSync, existsSync } = require("node:fs");
-const { join, resolve } = require("node:path");
+import { writeFileSync, appendFileSync, mkdirSync, readFileSync, existsSync } from "node:fs";
+import { join, resolve } from "node:path";
 
 const VERDICTS = { PASS: 1, FAIL: 1, NOT_POSSIBLE: 1 };
 
@@ -85,6 +85,15 @@ function ledgerSeq(ledgerPath) {
 }
 
 function main() {
+  // --help: before required-arg parsing (shebang⇔CLI contract).
+  if (process.argv.slice(2).includes("--help")) {
+    console.log(
+      "usage: node write-ooda-verdict.js --dir <phase-dir> --attempt <id> --verdict <PASS|FAIL|NOT_POSSIBLE>\n" +
+      "       [--summary <text>] [--expected <text>] [--actual <text>] [--missing <json-array>] [--reason <text>] [--ts <iso>]\n" +
+      "--reason is REQUIRED and must be non-empty for FAIL and NOT_POSSIBLE"
+    );
+    process.exit(0);
+  }
   const args = parseArgs(process.argv.slice(2));
   if (!args.dir) fail("missing --dir <phase-dir>");
   if (args.attempt === undefined || String(args.attempt).trim() === "") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.14.2",
+  "version": "0.14.4",
   "description": "Opinionated orchestration for Muse — workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,

package/workflows/bugfix.js

@@ -70,8 +70,10 @@ const COMPUTE_DIFF_SRC = crewHome + "/current/lib/compute-publish-diff.js";
 const COMPUTE_DIFF = RUN_LIB + "/compute-publish-diff.js";
 const CLASSIFY_SURFACE_SRC = crewHome + "/current/lib/classify-surface.js";
 const CLASSIFY_SURFACE = RUN_LIB + "/classify-surface.js";
+const NOTE_VOCAB_SRC = crewHome + "/current/lib/publish-note-vocabulary.js";
+const NOTE_VOCAB = RUN_LIB + "/publish-note-vocabulary.js";
 // See docs/decisions/qa-reproduce.md#pin-basenames: the pin step materializes the required scripts.
-const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, COMPUTE_DIFF, CLASSIFY_SURFACE].map(function (p) { return p.split("/").pop(); });
+const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, COMPUTE_DIFF, CLASSIFY_SURFACE, NOTE_VOCAB].map(function (p) { return p.split("/").pop(); });
 
 // Project config — passed by dispatcher, falls back to dashboard defaults
 const projectConfig = inputs.project_config || {};
@@ -191,19 +193,12 @@ async function reaskVerdict(stepName, reworkSuffix, workerText) {
   return verdict;
 }
 // Transport retry: the work-agent agent() call can throw even when the agent
-// did the work. Stochastic envelope non-compliance (bare prose instead of
-// the native {"status":"ok","result":"..."} envelope) trips the runtime's
-// JSON-candidate heuristic when the prose contains a {...}-looking
-// substring — canary 39457ee9's QA report quoted the change's own
-// {/* ... */} JSX comment, the runtime tried to parse it as JSON, threw,
-// and the workflow discarded a complete VERDICT: PASS report as "no output".
-// The verdict re-ask covers an unreadable verdict inside a RECEIVED report;
-// this covers the report never arriving. The assignment is retried boundedly
-// with fresh keys (never a cached replay) before failing closed. Re-entry is
-// safe: lifecycle scripts answer REUSED for existing worktrees/branches, the
-// retry trailer tells the agent to check existing state first and report
-// rather than duplicate completed side effects, and the rework path already
-// re-runs Build after rejection — Build re-entry is an established pattern.
+// did the work — the runtime's JSON-candidate heuristic trips on brace-shaped
+// prose. Retry the assignment boundedly with fresh keys (never a cached
+// replay) before failing closed. Re-entry is safe: lifecycle scripts answer
+// REUSED for existing worktrees/branches, the retry trailer tells the agent
+// to check existing state first, and Build re-entry after rejection is an
+// established pattern. Full history: docs/decisions/workflow-core.md.
 function workRetryKey(stepName, reworkSuffix, attempt) {
   return "work-" + stepName + reworkSuffix + "-t" + attempt;
 }
@@ -215,7 +210,7 @@ function attemptKey(base, reworkCount) {
 function pinLifecycle(key) {
   return agent(
     "Snapshot lifecycle scripts for version pinning.\n" +
-    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + COMPUTE_DIFF_SRC + " " + COMPUTE_DIFF + " && cp " + CLASSIFY_SURFACE_SRC + " " + CLASSIFY_SURFACE + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
+    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + COMPUTE_DIFF_SRC + " " + COMPUTE_DIFF + " && cp " + CLASSIFY_SURFACE_SRC + " " + CLASSIFY_SURFACE + " && cp " + NOTE_VOCAB_SRC + " " + NOTE_VOCAB + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
     "Return the verbatim output of the ls -1 command as { \"listing\": \"<verbatim output>\" } and nothing else.",
     { key: key, label: "Pinning lifecycle scripts",
       schema: { type: "object", properties: { listing: { type: "string" } }, required: ["listing"] } }
@@ -396,27 +391,11 @@ function hydrateReleaseDecision(rec) {
   return null;
 }
 
-// Publish read-back request (currently unavailable): the verbatim_request
-// the parent protocol (docs/publish-verification.md) would hand to an
-// independent read-back tool after the artifact build lands. artifact_inspect
-// was removed by the platform (2026-09-14); artifact.inspect is malfunction
-// diagnosis, not a substitute — so no agent-callable read-back tool exists
-// and this request cannot currently be issued. Pure function — no I/O, no
-// clock. The request carries the merged diff as the expected change and asks
-// for an independent read of the artifact's actual source: for each file, the
-// exact current text of the changed regions plus a per-line present/absent
-// finding. Until a read-back path exists, the parent cannot independently
-// confirm content and verification parks at "publish: verification-requested"
-// (see docs/publish-verification.md). This preserves the circularity break
-// that hollowed canary run 8 (2026-09-11): the old verifyAppliedChanges
-// compared the builder's applied-report against the diff the report was
-// derived from — a fabricated report passed by construction. The report
-// itself is gone now (2026-09-16 fire-and-forget trigger). Independent
-// read-back cannot be
-// fabricated from the diff; it must match the artifact's real content.
-
 // See docs/decisions/publish-path.md#publish-attempt-ledger: every trigger outcome is recorded in the durable ledger.
-async function recordPublishLedger(entry, rework) {
+// keyTag (optional): same-outcome ledger writes in one pass need distinct
+// agent-call keys — the runtime replays cached calls by key, so a shared key
+// silently drops the second write (2026-09-19, submitted-on-issuance).
+async function recordPublishLedger(entry, rework, keyTag) {
   try {
     var ledgerDir = crewHome + "/.publish-ledger";
     var line = JSON.stringify({
@@ -430,7 +409,10 @@ async function recordPublishLedger(entry, rework) {
       applied_report: entry.applied_report || null,
       manifest_before: entry.manifest_before || null,
       outcome: entry.outcome,
-      detail: entry.detail || ""
+      detail: entry.detail || "",
+      // D1 (2026-09-19): issued_at = upper bound on the trigger-issuance
+      // instant (null when no trigger); ts = ledger-write instant.
+      issued_at: entry.issued_at || null,
     });
     var sq = function(s) { return "'" + String(s).split("'").join("'\\''") + "'"; };
     var res = await agent(
@@ -438,7 +420,7 @@ async function recordPublishLedger(entry, rework) {
       "Run: mkdir -p " + sq(ledgerDir) + " && printf '%s\n' " + sq(line) +
       " | sed \"s/@LEDGER_TS@/$(date -u +%Y-%m-%dT%H:%M:%SZ)/\" >> " + sq(ledgerDir + "/" + PUBLISH_SLUG + ".jsonl") + " && echo LEDGER_OK\n" +
       "Return JSON { \"result\": \"<verbatim output>\" } and nothing else.",
-      { key: attemptKey("publish-ledger-" + taskId + "-" + entry.outcome, rework),
+      { key: attemptKey("publish-ledger-" + taskId + "-" + entry.outcome + (keyTag ? "-" + keyTag : ""), rework),
         label: "Recording publish attempt in ledger",
         schema: { type: "object", properties: { result: { type: "string" } }, required: ["result"] } }
     );
@@ -1289,7 +1271,7 @@ while (i < STEPS.length) {
       "The script merges, reconciles, records, and pushes under the merge lock. Informational only: RECONCILED, NO_REMOTE, NO_REMOTE_RECONCILE. Read the output:\n" +
       "- STAGED_BASE_MISMATCH: the line left the staged base (stray checkout). VERDICT: FAIL.\n" +
       "- MERGED_EMPTY — check FIRST (it contains the word MERGED): either a runtime-state deliverable or an already-merged sha the workflow verified (Build declared repo_diff: none). No lock taken, no new commit. Report 'merged empty: no repo changes'. VERDICT: PASS.\n" +
-      "- MERGED: the merge landed; the script pushed inline. Read the push line: PUSHED — report the hash, VERDICT: PASS; PUSH_SKIPPED — the detached line is room-local (the merge commit + record are the evidence), VERDICT: PASS; NO_REMOTE_PUSH — no remote configured, VERDICT: PASS; ERROR after MERGED — a retry recovers the push; report it, VERDICT: FAIL.\n" +
+      "- MERGED: the merge landed; the script pushed inline. Read the push line: PUSHED — report the hash (detached prints PUSHED: origin/main (refspec HEAD:main)), VERDICT: PASS; NO_REMOTE_PUSH — no remote configured, VERDICT: PASS; ERROR after MERGED — a retry recovers the push; report it, VERDICT: FAIL.\n" +
       "- LOCK_HELD: 10-minute backoff exhausted. VERDICT: FAIL.\n" +
       "- CONFLICT: the plain merge failed — aborted, the target is clean, and your task still holds the merge lock. Do NOT fail yet. Resolve it:\n" +
       "RESOLUTION:\n" +
@@ -1302,7 +1284,7 @@ while (i < STEPS.length) {
       "ESCALATE — 'conflict needs human resolution', VERDICT: FAIL — when: 3 attempts are exhausted; the conflict touches generated files, migrations, or public API contracts; or 'looks right + checks pass' is not sufficient for any other reason. On escalation, RELEASE THE LOCK so the task can be reworked later: run CREW_HOME=" + crewHome + " CREW_REPO=" + REPO_PATH + " " + MERGE_LOCK + " release " + taskId + " (release is keyed on task id; no PID needed). Do NOT run post-deploy on escalation — it would delete the untouched task branch the human still needs.\n" +
       "- ERROR: report it. VERDICT: FAIL.\n\n" +
       "R5-PUSH (manual R5 resolution only — the normal path pushed inline). Run: " + LIFECYCLE_ENV + LIFECYCLE + " push-target " + taskId + "\n" +
-      "PUSHED — report the merged hash, VERDICT: PASS; PUSH_SKIPPED or NO_REMOTE_PUSH — nothing to push, VERDICT: PASS; ERROR or CONFLICT — report it, VERDICT: FAIL.\n" +
+      "PUSHED — report the merged hash (detached prints PUSHED: origin/main (refspec HEAD:main)), VERDICT: PASS; PUSH_SKIPPED — no push attempted (no record + no lock); NO_REMOTE_PUSH — no remote; VERDICT: PASS; ERROR or CONFLICT — report it, VERDICT: FAIL.\n" +
       "NEVER force-push.\n\n" +
       "Report what happened at each step, ending with exactly one line: VERDICT: PASS or VERDICT: FAIL.";
 
@@ -1640,7 +1622,7 @@ while (i < STEPS.length) {
           log("Publish pre-trigger baseline read failed for task " + taskId + " (" + (baselineErr && baselineErr.message ? baselineErr.message : baselineErr) + ") — receipt attribution skipped; durable audit-dir evidence is the only positive signal");
         }
         // See docs/decisions/publish-path.md#trigger-await: the artifact_edit call is awaited.
-        var rebuildTrigger = null;
+        var rebuildTrigger = null, triggerThrew = false;
         try {
           var triggerText = String(await agent(rebuildPrompt,
             { key: rebuildAttemptKey, label: "Triggering artifact rebuild" }) || "");
@@ -1660,7 +1642,36 @@ while (i < STEPS.length) {
           }
         } catch (triggerErr) {
           log("Publish rebuild trigger for task " + taskId + " threw (" + (triggerErr && triggerErr.message ? triggerErr.message : triggerErr) + ") — outcome unknown until observation confirms it; the edit may have gone through");
+          triggerThrew = true;
         }
+        // D1 (2026-09-19; F-A1 upper-bound 2026-09-20): issued_at is an UPPER
+        // bound on issuance — captured AFTER the trigger-agent call returns,
+        // ferried from one shell date call (workflows have no clock) and
+        // validated mechanically; null when unobserved (fallback: ts).
+        // See docs/decisions/publish-path.md#d1-issuance-time.
+        var triggerIssuedAt = null;
+        try {
+          var issuedAtFerry = await agent(
+            "Run: date -u +%Y-%m-%dT%H:%M:%SZ\n" +
+            "Return JSON { \"ts\": \"<the date output, verbatim>\" } and nothing else.",
+            { key: attemptKey("publish-issued-at-" + taskId, totalReworkCount), label: "Capturing post-trigger instant (upper bound on issuance)",
+              schema: { type: "object", properties: { ts: { type: "string" } }, required: ["ts"] } }
+          );
+          var issuedAtRaw = String((issuedAtFerry && issuedAtFerry.ts) || "").trim();
+          if (/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z$/.test(issuedAtRaw)) triggerIssuedAt = issuedAtRaw;
+        } catch (issuedAtErr) { /* issued_at stays null: the verifier falls back to ts */ }
+        if (!triggerIssuedAt) log("Publish issuance instant unobserved for task " + taskId + " — issued_at null; the freshness gate falls back to ledger-write ts");
+        // (2026-09-19, room #22) Submitted-on-issuance: see docs/decisions/publish-path.md#submitted-on-issuance.
+        await recordPublishLedger({
+          commit: mergeCommitForPublish,
+          attempt: rebuildAttemptKey,
+          agent_id: null,
+          applied_report: publishAppliedObservation,
+          manifest_before: preTriggerManifest,
+          outcome: "submitted",
+          issued_at: triggerIssuedAt,
+          detail: "trigger issuance: rebuild-trigger agent invoked; receipt/observation pending. Invocation only - not evidence of artifact_edit or build acceptance." + (triggerThrew ? "; trigger-threw" : "; trigger-returned")
+        }, totalReworkCount, "issuance");
         // Post-trigger observation (primary, not fallback): the workflow
         // attributes the edit itself. First the in-flight build state — a
         // build whose agent_id is new relative to the pre-trigger baseline
@@ -1780,8 +1791,9 @@ while (i < STEPS.length) {
             applied_report: publishAppliedObservation,
             manifest_before: preTriggerManifest,
             outcome: "submitted",
-            detail: "fire-and-forget trigger; build receipt captured by workflow-owned build-state observation (pre/post-trigger diff)"
-          }, totalReworkCount);
+            issued_at: triggerIssuedAt,
+            detail: "fire-and-forget trigger; build receipt captured by workflow-owned build-state observation (pre/post-trigger diff); observation, not re-issuance"
+          }, totalReworkCount, "receipt");
         } else {
           var newAuditDirs = [];
           try {
@@ -1912,10 +1924,6 @@ while (i < STEPS.length) {
         // its outcome — submitted, rejected, or unknown (unknown is recorded
         // at the park site above). A later run or human matches commit hash +
         // attempt key against the builder's eventual completion.
-        // (2026-09-16) The trigger is fire-and-forget: the observation above
-        // already recorded the ledger's submitted line on both positive paths
-        // and parked on unknown — there is no applied report to observe and
-        // no rejection signal to record.
         // (2026-09-18, H2 verdict-first) The verdict was decided exactly
         // once above; dispatch on it. landed bypasses the receipt poll
         // (the audit evidence already proved completion); an explicit
@@ -2049,21 +2057,12 @@ while (i < STEPS.length) {
             log("Publish build landed for task " + taskId + " — provenance stamp deferred to parent content verification");
           } else {
             // STEP 1b durable audit-dir fallback (2026-09-15, task aadeccc3):
-            // the poll above only observes IN-FLIGHT builds. A build that
-            // finished between the receipt capture and the poll's first check
-            // leaves no in-flight trace — but the platform's audit harness
-            // leaves a durable one (~/workspace/ts-spaces/<slug>/audits/
-            // <timestamp>-<id>/ per completed build). Diff the audit-dir
-            // listing against the pre-trigger snapshot: a timestamped dir
-            // that appeared during the attempt window is evidence a build
-            // completed. Attribution is by window, not by build identity:
-            // the poll's saw_stranger signal only catches stranger builds in
-            // flight AT a check — a stranger that finished entirely inside
-            // the window is indistinguishable, so any observed stranger
-            // blocks attribution and the outcome stays unknown. This never
-            // re-issues the edit and never stamps provenance — ok=true only
-            // routes to the parent's independent content read-back, which
-            // remains the real verification.
+            // the poll observes only in-flight builds; a build that finished
+            // inside the window leaves a durable audit dir. Diff the audit
+            // listing against the pre-trigger snapshot: a new timestamped dir
+            // is evidence a build completed. Attribution is by window, not by build identity: any
+            // observed stranger blocks it. Never re-issues, never stamps;
+            // ok=true routes to the parent's read-back (the verification).
             //
             // The poll end-state is read from the poll's own observations,
             // not from build_done alone: a build in flight at the last check