muse-crew 0.14.3 → 0.14.5

package/lib/ux-doctrine.js

@@ -1,3 +1,4 @@
+#!/usr/bin/env node
 // ux-doctrine.js — UX-surface doctrine page resolution.
 //
 // One canonical doctrine page per environment_type value: the crew reads
@@ -11,10 +12,16 @@
 // against this file, so the two can never silently diverge.
 //
 // Pure and deterministic: no clock, no randomness, no I/O.
-"use strict";
+//
+// Module shape (blocker 21): this file is an import-safe shared module —
+// it has NO shebang, so the entry gate bare-loads it (`node ux-doctrine.js`
+// exits 0). The CLI below runs only when the file itself is the process
+// entrypoint.
 
-const { existsSync } = require("node:fs");
-const { join } = require("node:path");
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { realpathSync } from "node:fs";
+import { fileURLToPath } from "node:url";
 
 // THE MAP. environment_type value -> doctrine page filename, relative to
 // the release docs dir ($CREW_HOME/current/docs/). null is unclassified —
@@ -44,12 +51,30 @@ function doctrinePageExists(crewHome, environmentType) {
   return p ? existsSync(p) : false;
 }
 
-module.exports = { DOCTRINE_PAGES, doctrinePage, doctrinePath, doctrinePageExists };
+export { DOCTRINE_PAGES, doctrinePage, doctrinePath, doctrinePageExists };
+
+// realpath: production spawns through $CREW_HOME/current/lib (a symlink),
+// so argv[1] must be resolved before comparison with import.meta.url.
+const isMainModule = (() => {
+  try {
+    return !!process.argv[1] && realpathSync(process.argv[1]) === fileURLToPath(import.meta.url);
+  } catch {
+    return false;
+  }
+})();
 
-if (require.main === module) {
+const USAGE = "usage: node ux-doctrine.js --page <environment_type|null> | --path <crewHome> <environment_type|null>";
+
+if (isMainModule) {
   // CLI: node ux-doctrine.js --page <environment_type>
   //      node ux-doctrine.js --path <crewHome> <environment_type>
   const args = process.argv.slice(2);
+  // Import-safe module contract: a bare invocation (no args) is a load
+  // check, not a usage error — it exits 0. --help always exits 0.
+  if (args.length === 0 || args.includes("--help")) {
+    console.log(USAGE);
+    process.exit(0);
+  }
   if (args[0] === "--page" && args.length === 2) {
     const page = doctrinePage(args[1] === "null" ? null : args[1]);
     console.log(page === null ? "null" : page);
@@ -57,7 +82,7 @@ if (require.main === module) {
     const p = doctrinePath(args[1], args[2] === "null" ? null : args[2]);
     console.log(p === null ? "null" : p);
   } else {
-    console.error("usage: node ux-doctrine.js --page <environment_type|null> | --path <crewHome> <environment_type|null>");
+    console.error(USAGE);
     process.exit(2);
   }
 }

package/lib/verify-publish.js

@@ -51,6 +51,19 @@ import {
   makeOldCounter,
   discriminatingLines,
 } from "./publish-content.js";
+// Terminal-note vocabulary (D7, 2026-09-19): the writer-side guard.
+// terminal() asserts its emitted verb is a registry member before writing,
+// so no future terminal verb ships unrecognized by the scans.
+import { matchTerminalPublishNote } from "./publish-note-vocabulary.js";
+
+// --help: before required-arg parsing (shebang⇔CLI contract).
+if (process.argv.slice(2).includes("--help")) {
+  console.log(
+    "usage: node verify-publish.js --repo-path <path> --commit <sha> --base <sha> --task-id <uuid> --slug <artifact-slug> --project-id <id> [--spaces-root <dir>]\n" +
+    "the mechanical publish verification JUDGE: certifies read-back findings against git diff, checks manifest freshness, stamps provenance"
+  );
+  process.exit(0);
+}
 
 function arg(name, required = true) {
   const i = process.argv.indexOf(name);
@@ -89,10 +102,25 @@ function api(command, json) {
   });
   return JSON.parse(out);
 }
+// The terminal verdict this writer emits. A single const (not an inline
+// literal) so the emitted verb and the asserted verb can never drift apart.
+const TERMINAL_VERB = "publish: verification-failed";
 function terminal(reason, detail) {
   // Always lands a terminal parent verdict, then exits 1 (failed) — the
   // task stays parked for human attention. Only the verified path exits 0.
-  const msg = `publish: verification-failed ${commit} ${reason}${detail ? ` — ${detail}` : ""} (read-back ${inspectionId})`;
+  // Writer-side registry guard (D7): the verb is in the terminal-note
+  // registry before the note is written — a writer can never introduce a
+  // terminal verb the scans don't recognize.
+  if (!matchTerminalPublishNote(TERMINAL_VERB)) {
+    // Registry and writer disagree — fail loud, never emit an unrecognized
+    // terminal note.
+    process.stderr.write(JSON.stringify({
+      ok: false, verdict: "vocabulary-mismatch",
+      message: `terminal verb '${TERMINAL_VERB}' is not in the terminal-note registry`,
+    }) + "\n");
+    process.exit(2);
+  }
+  const msg = `${TERMINAL_VERB} ${commit} ${reason}${detail ? ` — ${detail}` : ""} (read-back ${inspectionId})`;
   api("log-event", { task_id: taskId, type: "note", message: msg.slice(0, 1000) });
   process.stderr.write(JSON.stringify({ ok: false, verdict: reason, message: msg }) + "\n");
   process.exit(1);
@@ -298,25 +326,35 @@ if (head !== commit) {
 // 2026-09-18, blocker 4: bind by exact (task_id, commit, attempt) when the
 // attempt is known — the original and retry attempts share a commit, and
 // positional selection is luck. Within one attempt, select the OLDEST
-// submitted entry (the trigger issuance; a receipt-bearing second "submitted"
-// may follow it — the oldest binds the trigger instant, the latest carries
-// the observed agent_id).
+// tick-worker "submitted" entry (the worker's issuance; issuer anchor
+// 2026-09-20). A workflow-written "submitted" (issuer absent, the
+// pre-one-party shape) is a phantom claim — never a baseline source, never
+// an anchor — so skip it silently, exactly as findTriggerEntry does.
+// D1 (2026-09-19; entry_kind cut 2026-09-20): the trigger instant is the
+// ISSUANCE instant, not the ledger-write instant — a slow ledger write must
+// not make a fresh build look stale (room #23 J1). The anchor is the OLDEST
+// tick-worker "submitted" entry by ts and the bound instant is its issued_at
+// (falling back to its ts when the capture was unobserved). One anchor, one
+// field — the retired entry_kind preference filter could never change the
+// bound anchor (issuance and receipt entries carried the same captured
+// issued_at), so the oldest-by-ts selection is the whole mechanism.
 let triggerTs = null;
 let manifestBefore = null;
 try {
   const ledgerText = readFileSync(join(crewHome, ".publish-ledger", slug + ".jsonl"), "utf8");
   const entries = ledgerText.split("\n").filter((l) => l.trim()).map((l) => JSON.parse(l));
-  // Collect all submitted entries matching (task_id, commit[, attempt]).
+  // Collect the tick-worker's issuance entries matching (task_id, commit[, attempt]).
   const candidates = entries.filter((e) =>
     e.task_id === taskId &&
     e.outcome === "submitted" &&
+    e.issuer === "tick-worker" &&
     e.commit === commit &&
     (attempt == null || e.attempt === attempt)
   );
   if (candidates.length > 0) {
     candidates.sort((a, b) => (a.ts || "").localeCompare(b.ts || ""));
     const e = candidates[0];
-    triggerTs = e.ts || null;
+    triggerTs = e.issued_at || e.ts || null;
     if (e.manifest_before && typeof e.manifest_before === "object") manifestBefore = e.manifest_before;
   }
 } catch (e) {

package/lib/write-ooda-verdict.js

@@ -1,3 +1,4 @@
+#!/usr/bin/env node
 // write-ooda-verdict.js — deterministic writer for the OODA report's terminal state.
 //
 // After the see-act loop, the QA/repro agent records its verdict as
@@ -34,10 +35,9 @@
 //
 // Exit 0 on success, 2 on bad input. Determinism: no wall-clock reads, no
 // randomness; ts comes only from --ts and is omitted when not passed.
-"use strict";
 
-const { writeFileSync, appendFileSync, mkdirSync, readFileSync, existsSync } = require("node:fs");
-const { join, resolve } = require("node:path");
+import { writeFileSync, appendFileSync, mkdirSync, readFileSync, existsSync } from "node:fs";
+import { join, resolve } from "node:path";
 
 const VERDICTS = { PASS: 1, FAIL: 1, NOT_POSSIBLE: 1 };
 
@@ -85,6 +85,15 @@ function ledgerSeq(ledgerPath) {
 }
 
 function main() {
+  // --help: before required-arg parsing (shebang⇔CLI contract).
+  if (process.argv.slice(2).includes("--help")) {
+    console.log(
+      "usage: node write-ooda-verdict.js --dir <phase-dir> --attempt <id> --verdict <PASS|FAIL|NOT_POSSIBLE>\n" +
+      "       [--summary <text>] [--expected <text>] [--actual <text>] [--missing <json-array>] [--reason <text>] [--ts <iso>]\n" +
+      "--reason is REQUIRED and must be non-empty for FAIL and NOT_POSSIBLE"
+    );
+    process.exit(0);
+  }
   const args = parseArgs(process.argv.slice(2));
   if (!args.dir) fail("missing --dir <phase-dir>");
   if (args.attempt === undefined || String(args.attempt).trim() === "") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.14.3",
+  "version": "0.14.5",
   "description": "Opinionated orchestration for Muse — workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,

package/seed/cron-body-template.md

@@ -2,6 +2,15 @@
 
 You are the dispatch trigger for Muse Crew. Run the authoritative dispatcher workflow and launch its claims autonomously.
 
+### Known blockers — read first, do not re-derive or re-report
+
+The failures below are settled and recorded in the Gate 1 OODA state. The authoritative list lives at `~/workspace/goals/gate-1-onboarding-canary-passes/hidden_files/ooda/known-blockers.md` — if this copy ever disagrees with that file, the file wins. Their fixes are already queued in the main repo BUILD. If you observe one, log exactly one line — `known-blocker: <id> — <one-line observation>` — and move on. Do NOT write root-cause analysis and do NOT write "follow-up needed"; the follow-up is already owned.
+
+- **Blocker 22 — wrong publication caller (settled 2026-09-20):** workflow children cannot call `artifact_edit` (the builder requires a parent-conversation session id they don't have). The 0.14.x trigger/observation path is dead by architecture; `submitted` writes from it are phantom. Fix in BUILD: one-party worker-owned artifact publication.
+- **Blocker 23 — retry harness cannot access Crew state (settled 2026-09-20):** `lib/retry-publish.js` imported `better-sqlite3` (not shipped; the release uses `node:sqlite`) and targeted `crew.db` instead of the real `crew-state.db`. Every retry prepare returned `db-unavailable` and failed closed before any lock, edit, or journal write. Fixed in BUILD (0.14.5): ported to `node:sqlite` + `$CREW_HOME/crew-state.db`, the missing `CREW_REPO` for the merge lock supplied, and the trigger step converted from a spawned child to the session-carrying tick worker's direct `artifact_edit` call (blocker 22). The retry path is worker-owned issuance now; it is subsumed under one-party publish, not a separate queue.
+
+(Maintainer note: this snapshot is refreshed from known-blockers.md at release time. The poller always treats the file as authoritative.)
+
 ### Steps
 
 0. **Check for platform workflow failures (opacity killer):** The platform records workflow run failures in `runtime.workflow_runs` — these are invisible in the crew DB unless you check. A workflow that dies on a fatal `agent()` error (e.g. "subagent bootstrap is no longer authorized") leaves its task stranded with no explanation.
@@ -39,7 +48,7 @@ You are the dispatch trigger for Muse Crew. Run the authoritative dispatcher wor
 
 4.4. **Unknown-recovery (docs/publish-unknown-recovery.md):** tasks parked with "Publish outcome unknown" are the receipt-less trigger gap (2026-09-18, blocker 15). The note is the state machine; deterministic code owns every transition; you are the ferry (scan → classifier → record / retry protocol). Run this BEFORE Step 4.5 so a re-triggered build's mirrored verification-requested is visible to the verification scan on a later tick. Log every list the scan returns.
    - Scan (code): `node {crewHome}/lib/crew-api.js --crew-home {crewHome} scan-publish-unknown`
-     Returns `{ waiting: [...], due: [...], retry_due: [...], mirrored: [...], skipped: [...] }`. `waiting` = parked < 30m — leave alone, no claim. `mirrored`/`skipped` = already handled by code — log only, take no action.
+     Returns `{ waiting: [...], due: [...], intent: [...], retry_due: [...], mirrored: [...], skipped: [...], requeued: [...] }`. `waiting` = parked < 30m — leave alone, no claim. `mirrored`/`skipped` = already handled by code — log only, take no action. `requeued` = stale-base intents sent back to the workflow's Publish for re-preparation — log only, take no action. `intent` = claimed publish intents — handle in Step 4.4b.
    - For each entry in `due`: classify (code), then record the decision (code). Use the entry's fields verbatim.
      - `node {crewHome}/lib/classify-publish-absence.js --repo-path "<repo_path>" --commit <commit> --base <base> --slug "<slug>" --trigger-ts "<trigger_ts>" --park-ts "<park_ts>" --task-id <task_id> --manifest-before '<manifest_before JSON>'`
        Serialize the entry's `manifest_before` field to compact JSON for the `--manifest-before` value; when the entry's `manifest_before` is null, omit the flag (the classifier falls back to the time-based advance check and the Step 4.5 verifier fails closed without a baseline).
@@ -56,12 +65,8 @@ You are the dispatch trigger for Muse Crew. Run the authoritative dispatcher wor
      - Exit 0 with `{"ok": true, "outcome": "superseded"|"lock-held"|"not-dropped", ...}`: terminal for this tick. Do NOT proceed to the trigger. If `outcome` is `not-dropped`, the output carries the full `classification` — pass it to `record-retry-recheck`: `node {crewHome}/lib/crew-api.js --crew-home {crewHome} record-retry-recheck --json '{"task_id": "<task_id>", "decision": <classification JSON>}'` and STOP for this task.
      - Exit non-zero: the command failed (lock released via try/finally). Log the stderr line and STOP — do NOT trigger.
      
-     Trigger (agent-mediated — the ONLY prose-owned step):
-     Spawn ONE child (subagent) whose first instruction loads the artifact namespace (`tool_search.load_tool_namespace` with paths `["artifact"]`), with this exact brief — the same shape as the workflow's first attempt:
-        "The change to apply is the unified diff in the file \"<diff_path>\" (sha256 <diff_sha256>).
-        1. Verify the file: run sha256sum on it. If the printed hash is not exactly <diff_sha256>, STOP and end your turn — do not call artifact_edit.
-        2. Read the file's full content.
-        3. Call artifact_edit with slug \"<slug>\" and verbatim_request:
+     Trigger (tick-mediated — the ONLY prose-owned step):
+     Load the artifact namespace in YOUR OWN turn (`tool_search.load_tool_namespace` with paths `["artifact"]`) and call `artifact_edit` directly — NEVER spawn a child (blocker 22, room #24: children cannot reach artifact_edit). First verify the staged diff: `sha256sum "<diff_path>"` must print exactly `<diff_sha256>`; if it does not, STOP and end this task's retry (log loudly — the claim expires, the next tick re-claims; a mismatched diff never becomes an edit). Read the verified file's full content and call artifact_edit with slug `"<slug>"` and this verbatim_request:
         'Apply the following change to your source tree, then rebuild and deploy.
 
         UNIFIED DIFF (relative to your source tree):
@@ -76,22 +81,51 @@ You are the dispatch trigger for Muse Crew. Run the authoritative dispatcher wor
         - If any hunk does not apply cleanly, STOP and report the failure — do not improvise or skip hunks.
         - Do not make any other source changes.
         - After applying, rebuild and deploy.'
-        Edit-request contract (read carefully):
-        - Call artifact_edit exactly once with the slug and verbatim_request above. Never retry the edit yourself: if the edit is not accepted, do NOT call artifact_edit again — end your turn.
-        - If artifact_edit explicitly refuses the edit (the call is rejected — e.g. the artifact does not exist), do NOT call artifact_edit again: end your turn with exactly one line and nothing else: ARTIFACT_EDIT_REFUSED: <the refusal text, one line>.
-        - If artifact_edit is not available after the load, do NOT improvise — end your turn.
-        - You do NOT call setprovenance, artifact_inspect, or post-deploy yourself.
-        No report is needed: do not return JSON, do not summarize what you did, do not echo the diff. End your turn after the artifact_edit call."
-        Wait for the child to finish. The child's final text is your only signal.
+        Edit-request contract:
+        - Call artifact_edit exactly once with the slug and verbatim_request above. Never retry the edit yourself: if the edit is not accepted, do NOT call artifact_edit again — proceed to the complete phase below.
+        - If artifact_edit explicitly refuses the edit (the call is rejected — e.g. the artifact does not exist), do NOT call artifact_edit again: record the first line of the refusal for the complete phase below.
+        - If artifact_edit is not available after the load, do NOT improvise — log it and proceed to the complete phase with `refused` and the refusal text "artifact tool namespace unavailable in tick".
      
      Phase 2 — complete (deterministic):
      `node {crewHome}/lib/retry-publish.js --crew-home {crewHome} --task-id <task_id> --phase complete --edit-outcome <accepted|refused> [--refusal-text "<first line>"]`
-     - If the child's final text starts with `ARTIFACT_EDIT_REFUSED`: `--edit-outcome refused --refusal-text "<first line of the refusal>"`.
+     - If artifact_edit explicitly refused the edit: `--edit-outcome refused --refusal-text "<first line of the refusal>"`.
      - Otherwise: `--edit-outcome accepted`.
-     - The command writes the outcome notes, appends the `-retry1` ledger entry (with the pre-retry `manifest_before` baseline), mirrors verification-requested, and RELEASES the lock in a finally block. Exit 0 means the protocol completed.
+     - The command writes the outcome notes, appends the `-retry1` ledger entry (issuer `tick-worker`, with the pre-retry `manifest_before` baseline), mirrors verification-requested, and RELEASES the lock in a finally block. Exit 0 means the protocol completed.
      
    - Crash rules (fail closed, never re-trigger blind): if this tick dies anywhere in the retry protocol, the note journal is the recovery state. `publish: retry-intended` without `retry-issued` → the next scan mirrors `verification-requested` (never re-triggers). `publish: retry-issued` without a mirrored request → the next scan mirrors it. A leaked merge lock expires after 600s. The next tick's scan never emits `retry_due` for a task with `retry-issued` in history — exactly one retry, enforced from notes, not from the ledger.
 
+4.4b. **One-party intent issuance (2026-09-20, blocker 22):** the workflow parks at Publish with a `publish: publish-requested` note and a checksummed `publish-intent` ledger entry; issuance belongs to YOU, the session-carrying tick worker, calling `artifact_edit` directly in this turn. The Step 4.4 scan returns the `intent: [...]` bucket — each entry is claimed for this tick (1-hour lease) and carries `task_id`, `commit`, `attempt`, `slug`, `repo_path`, `base`, `diff_path`, `diff_sha256`, `manifest_before`, `claim_expiry`, and `reclaimed`.
+   - For each intent entry:
+     1. **Verify the staged diff (code):** `sha256sum "<diff_path>"` must print exactly `diff_sha256`. If the file is missing, regenerate deterministically and re-verify:
+        `node {crewHome}/lib/compute-publish-diff.js --repo-path "<repo_path>" --base <base> --commit <commit> --out "<diff_path>"`
+        then re-run the sha256sum. The `--commit` flag is honored: the script diffs `base..<commit>` (never an implicit HEAD) and reports that target as `commit`. If the regeneration exits non-zero, or the hash still does not match after regeneration, the diff is UNISSUABLE — record it terminally (code, never prose):
+        `node {crewHome}/lib/crew-api.js --crew-home {crewHome} record-intent-unissuable --json '{"task_id": "<task_id>", "claim_expiry": "<claim_expiry>", "reason": "<missing-staged-diff|diff-unregenerable|hash-mismatch-after-regeneration>"}'`
+        (copy `claim_expiry` verbatim from the scan entry — it is the compare-and-swap). This writes the terminal `publish: publish-unissuable` note and an issuer-stamped ledger entry — parked for human attention. Never re-claim, never loop on an hourly reclaim; a diff that cannot be checksummed never becomes an edit.
+     2. **Freshness check on a re-claimed intent (code, never prose):** when the entry's `reclaimed` is true, a previous tick died mid-issuance and may have issued the edit without recording it. Run the deterministic freshness helper — it reads the on-disk artifact manifest at `~/workspace/ts-spaces/<slug>/.space-build/manifest.json` (the same path the verifier uses) and compares `content_sha256`/`built_at` against the entry's `manifest_before`:
+        `node {crewHome}/lib/check-intent-freshness.js --slug "<slug>" --manifest-before '<manifest_before JSON>'`
+        (copy the entry's `manifest_before` verbatim as JSON; use the entry's `slug` verbatim). The helper prints exactly one JSON object: `{ok:true, advanced:<true|false>, baseline:{...}, current:{...}}`. If `advanced` is true → the edit is already live: record `recovered` in step 4 below (passing the helper's stdout JSON as `freshness_evidence`) and NEVER re-issue. If `advanced` is false → the manifest still shows the pre-edit state: proceed to issuance. If the helper exits non-zero or prints `ok:false` → the freshness question is unanswerable: record NOTHING, log loudly in one line, and let the claim expire — the next scan re-claims. Never decide this from prose, from `artifact_status`, or from an inspector's summary.
+     3. **Issue the edit directly — in this turn, never in a child.** Blocker 22 is proven: workflow children cannot reach `artifact_edit` (room #24's four journeys died on exactly this). Load the artifact namespace in your own turn and call `artifact_edit` with the entry's `slug` and this verbatim_request (paste the verified diff file's full content verbatim):
+        'Apply the following change to your source tree, then rebuild and deploy.
+
+        UNIFIED DIFF (relative to your source tree):
+        ```diff
+        <the full content of the verified file, pasted verbatim>
+        ```
+
+        Rules:
+        - For each file in the diff, apply its hunks to the same path in your source tree (use git apply or equivalent).
+        - For a new file (--- /dev/null), create it with the added (+) lines as its full content.
+        - For a deleted file (+++ /dev/null), delete it.
+        - If any hunk does not apply cleanly, STOP and report the failure — do not improvise or skip hunks.
+        - Do not make any other source changes.
+        - After applying, rebuild and deploy.'
+        Call artifact_edit exactly once. Never retry it yourself. If the call is explicitly refused, note the first line of the refusal text.
+        `accepted` means exactly one thing: the direct `artifact_edit` call completed without error and without an explicit refusal. Tool unavailable (the artifact namespace would not load), a timeout, a transport error, or any otherwise ambiguous result is NOT accepted and NOT refused — it is inconclusive: record NOTHING for this task, log the ambiguity in one line, and let the claim expire; the next scan re-claims and step 2's freshness check decides. An unrecorded outcome is the only honest record of an unknown one.
+     4. **Record the outcome (code):**
+        `node {crewHome}/lib/crew-api.js --crew-home {crewHome} record-intent-issuance --json '{"task_id": "<task_id>", "claim_expiry": "<claim_expiry>", "edit_outcome": "<accepted|refused|recovered>", "refusal_text": "<first line>"}'`
+        (omit `refusal_text` unless refused). For `recovered`, pass `freshness_evidence` with the step-2 helper's stdout JSON verbatim — the command refuses a recovery without machine evidence. Copy `claim_expiry` verbatim from the scan entry — it is the compare-and-swap. If the command returns `recorded: false`, log the reason and stop: another tick owns the task. `accepted`/`recovered` writes the issuer-stamped `submitted` ledger entry and mirrors `publish: verification-requested` (the Step 4.5 scan claims it on this or a later tick); `refused` writes `rejected` and the terminal `publish: publish-refused` note. There is no outcome for an inconclusive call (step 3) — do not call record-intent-issuance at all when the edit's fate is unknown.
+   - Crash rules (fail closed, never blind re-issue): if this tick dies between the artifact_edit call and the record step, the next scan re-claims with `reclaimed: true` and step 2's manifest-freshness check decides between `recovered` and a fresh issuance. The issuance contract is at-most-one RECORDED issuance per attempt: a duplicate physical issuance remains possible across a lease expiry when the first attempt's fate went unrecorded (the dead tick issued but died before recording), but it is content-identical — the same checksummed diff — and the verifier's content check bounds it. If the tick dies before issuing, the claim simply expires and the next tick claims it.
+
 4.5. **Parent publish verification (docs/publish-verification.md):** The publisher parks instead of stamping provenance; the parent — this tick, the live root agent — verifies content and stamps. Deterministic code detects, reads back, and certifies; you are only the ferry between the deterministic steps (scan → sensor → verifier).
    - Scan (code): `node {crewHome}/lib/crew-api.js --crew-home {crewHome} scan-verification-pending`
      This atomically claims each verification-pending task (1-hour lease, so a second tick cannot double-verify) and reconciles verified-but-still-parked tasks to `in_progress`. It returns `{ to_verify: [...], reconciled: [...] }`. Log both lists. If the scan exits 2 (e.g. the active release cannot be resolved), log the error loudly and continue — do NOT work around it.