muse-crew 0.14.4 → 0.14.5

package/lib/retry-publish.js

@@ -1,5 +1,7 @@
 #!/usr/bin/env node
-// retry-publish.js — Deterministic unknown-recovery retry protocol (2026-09-18, should-fix 5).
+// retry-publish.js — Deterministic unknown-recovery retry protocol (2026-09-18, should-fix 5;
+// ported 2026-09-20: node:sqlite + crew-state.db (blocker 23) and direct
+// tick-worker issuance (blocker 22 — children cannot reach artifact_edit).
 //
 // The cron Step 4.4 retry protocol was prose-owned: the cron agent performed
 // lock handling, journaling, diff generation, ledger writes, mirroring, and
@@ -8,19 +10,20 @@
 //
 // This command owns all deterministic transitions with try/finally lock
 // release. Only the unavoidable `artifact_edit` tool call remains
-// agent-mediated (it requires the artifact namespace, which this process
-// cannot load).
+// tick-mediated (it requires the artifact namespace, which this process
+// cannot load): the session-carrying tick worker issues the edit directly
+// in its own turn — NEVER a child (blocker 22, room #24).
 //
 // Two phases:
 //   Phase 1 (prepare): acquire merge lock, re-check HEAD, re-classify,
 //     journal intent, generate diff. Outputs JSON with the diff path/sha
-//     for the agent to feed to artifact_edit. The lock is HELD on success
-//     (the agent must call phase 2 to release it).
+//     for the tick worker's direct artifact_edit call. The lock is HELD on
+//     success (the tick must call phase 2 to release it).
 //   Phase 2 (complete): given the artifact_edit outcome (accepted/refused),
 //     write the outcome notes, append the ledger entry, mirror verification,
 //     and RELEASE the lock in a finally block.
 //
-// Crash safety: if the agent dies between phases, the lock expires after
+// Crash safety: if the tick dies between phases, the lock expires after
 // 600s and the note journal (`publish: retry-intended` without
 // `publish: retry-issued`) lets the next scan mirror verification-requested
 // without re-triggering — exactly one retry, enforced from notes.
@@ -95,25 +98,24 @@ function writePublishNote(db, taskId, message) {
   ).run(uuid(), taskId, message, nowISO());
 }
 
-// Load the crew DB. We use better-sqlite3 via the crew-api's own dependency
-// resolution — fall back to a clear error if unavailable.
-let Database;
-try {
-  Database = (await import("better-sqlite3")).default;
-} catch {
-  fail("db-unavailable", "better-sqlite3 is not available to retry-publish.js");
-}
-const dbPath = join(crewHome, "crew.db");
+// Load the crew DB via node:sqlite (the runtime's built-in — 2026-09-20,
+// blocker 23: better-sqlite3 is not available and the old code pointed at
+// the wrong database name). crew-api.js opens the same path the same way.
+import { DatabaseSync } from "node:sqlite";
+const dbPath = join(crewHome, "crew-state.db");
 if (!existsSync(dbPath)) fail("no-db", `crew database not found at ${dbPath}`);
-const db = new Database(dbPath);
+const db = new DatabaseSync(dbPath);
 
 const EMPTY_TREE = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
 
-function runMergeLock(action) {
+// The merge lock is per-repo (merge-lock.sh fails closed without
+// CREW_REPO — 2026-09-20: the old code never set it, so the lock could
+// never be acquired). The retry protocol locks the task's own repo.
+function runMergeLock(action, repoPath) {
   const lockScript = join(crewHome, "lib", "merge-lock.sh");
   try {
     execFileSync(lockScript, [action, taskId], {
-      env: { ...process.env, CREW_HOME: crewHome },
+      env: { ...process.env, CREW_HOME: crewHome, CREW_REPO: repoPath },
       encoding: "utf8",
       timeout: 30000,
     });
@@ -126,7 +128,7 @@ function runMergeLock(action) {
 // --- Phase 1: prepare --------------------------------------------------------
 // Acquires the lock, re-checks HEAD, re-classifies, journals intent,
 // generates the diff. On success the lock is HELD and the output carries
-// the diff path/sha for the agent's artifact_edit child.
+// the diff path/sha for the tick worker's direct artifact_edit call.
 
 if (phase === "prepare") {
   // Derive the unknown attempt (same derivation as scan-publish-unknown).
@@ -138,6 +140,7 @@ if (phase === "prepare") {
   const slug = project && project.deploy_slug;
   if (!slug) fail("no-slug", "project has no deploy_slug");
   const repoPath = (project && project.repo_path) || null;
+  if (!repoPath) fail("no-repo", "project has no repo_path — the retry protocol locks the task's repo");
 
   const ledgerPath = join(crewHome, ".publish-ledger", slug + ".jsonl");
   let entries = [];
@@ -174,7 +177,7 @@ if (phase === "prepare") {
   }
 
   // 2. Acquire the merge lock.
-  const lock = runMergeLock("acquire");
+  const lock = runMergeLock("acquire", repoPath);
   if (!lock.ok) {
     process.stdout.write(JSON.stringify({
       ok: true, phase: "prepare", outcome: "lock-held",
@@ -188,7 +191,7 @@ if (phase === "prepare") {
   let lockHeld = true;
   const releaseLock = () => {
     if (lockHeld) {
-      runMergeLock("release");
+      runMergeLock("release", repoPath);
       lockHeld = false;
     }
   };
@@ -205,15 +208,19 @@ if (phase === "prepare") {
     }
 
     const classifierPath = join(crewHome, "lib", "classify-publish-absence.js");
-    // Find the trigger entry for the manifest baseline: the OLDEST submitted
-    // entry by ts (D1, 2026-09-19; entry_kind cut 2026-09-20 — the retired
-    // kind-preference could never change the bound anchor) — it binds
-    // issued_at (falling back to its ts when the capture was unobserved),
-    // the same anchor verify-publish.js and findTriggerEntry use.
+    // Find the trigger entry for the manifest baseline: the OLDEST
+    // tick-worker "submitted" entry by ts (D1, 2026-09-19; entry_kind cut
+    // 2026-09-20; issuer anchor 2026-09-20, one-party worker-owned publish —
+    // only the session-carrying tick worker performs issuance, so only its
+    // stamped writes bind; a workflow-written "submitted" without issuer is
+    // a phantom claim, never a baseline source) — it binds issued_at
+    // (falling back to its ts when the capture was unobserved), the same
+    // anchor verify-publish.js and findTriggerEntry use.
     // agent_id is null on the issuance entry (no receipt observed at trigger
     // time) — the baseline comes from manifest_before, never agent_id.
     const submitted = entries.filter((e) =>
-      e.outcome === "submitted" && e.commit === commit && (attempt == null || e.attempt === attempt));
+      e.outcome === "submitted" && e.issuer === "tick-worker" &&
+      e.commit === commit && (attempt == null || e.attempt === attempt));
     submitted.sort((a, b) => (a.ts || "").localeCompare(b.ts || ""));
     const trigger = submitted[0] || null;
     const manifestBefore = trigger && trigger.manifest_before ? JSON.stringify(trigger.manifest_before) : null;
@@ -295,8 +302,8 @@ if (phase === "prepare") {
       fail("diff-not-ok", `compute-publish-diff.js returned ok:false — intent note stands; next tick mirrors verification-requested`);
     }
 
-    // Success: lock remains HELD. The agent spawns the artifact_edit child
-    // with the diff, then calls phase 2 (complete) to finish.
+    // Success: lock remains HELD. The tick worker issues the edit directly
+    // in its own turn with the diff, then calls phase 2 (complete) to finish.
     // Persist the phase-1 state for phase 2 (crash recovery reads the notes,
     // but phase 2 needs the exact commit/attempt/baseline/ledger path).
     const statePath = retryStatePath();
@@ -313,7 +320,7 @@ if (phase === "prepare") {
       task_id: taskId, commit, attempt,
       diff_path: diffPath, diff_sha256: diffMeta.sha256,
       slug,
-      message: "lock held; spawn the artifact_edit child with the diff, then call phase 2 (complete)",
+      message: "lock held; issue the artifact_edit directly in this tick (the session-carrying tick worker owns issuance), then call phase 2 (complete)",
     }) + "\n");
     process.exit(0);
   } catch (e) {
@@ -339,12 +346,16 @@ if (phase === "complete") {
     fail("no-prepare-state", `no phase-1 state at ${statePath} — the prepare phase did not complete or the state was cleaned`);
   }
   const state = JSON.parse(readFileSync(statePath, "utf8"));
-  const { commit, attempt, slug, ledger_path: ledgerPath, retry_baseline: retryBaseline } = state;
+  const { commit, attempt, slug, repoPath, ledger_path: ledgerPath, retry_baseline: retryBaseline } = state;
+  // (2026-09-20, one-party publish) The phase-1 pin carries repoPath; the
+  // merge lock is repo-scoped, so a missing value is a hard failure — the
+  // finally's release must never run against an undefined repo.
+  if (!repoPath) fail("no-repo-in-state", "phase-1 state has no repoPath — cannot release the merge lock safely; the lock lease expires on its own");
 
   let lockHeld = true;
   const releaseLock = () => {
     if (lockHeld) {
-      runMergeLock("release");
+      runMergeLock("release", repoPath);
       lockHeld = false;
     }
   };
@@ -356,7 +367,7 @@ if (phase === "complete") {
         `publish: retry-refused ${commit} — the platform refused the re-issued edit (${refusalText.split("\n")[0].slice(0, 200)}); not retrying again.`);
       process.stdout.write(JSON.stringify({ ok: true, phase: "complete", outcome: "refused", commit }) + "\n");
     } else {
-      // The child ended after the edit call with no explicit refusal —
+      // The tick worker's direct call ended with no explicit refusal —
       // fire-and-forget, same shape as the first attempt.
       writePublishNote(db, taskId,
         `publish: retry-issued ${commit} — the dropped edit was re-issued once; no explicit refusal was observed.`);
@@ -381,6 +392,7 @@ if (phase === "complete") {
         agent_id: null,
         applied_report: null,
         outcome: "submitted",
+        issuer: "tick-worker",
         manifest_before: retryBaseline,
         detail: "retry trigger re-issued after provably-dropped classification",
       };

package/lib/verify-publish.js

@@ -326,26 +326,28 @@ if (head !== commit) {
 // 2026-09-18, blocker 4: bind by exact (task_id, commit, attempt) when the
 // attempt is known — the original and retry attempts share a commit, and
 // positional selection is luck. Within one attempt, select the OLDEST
-// submitted entry (the trigger issuance; a receipt-bearing second "submitted"
-// may follow it — the oldest binds the trigger instant, the latest carries
-// the observed agent_id).
+// tick-worker "submitted" entry (the worker's issuance; issuer anchor
+// 2026-09-20). A workflow-written "submitted" (issuer absent, the
+// pre-one-party shape) is a phantom claim — never a baseline source, never
+// an anchor — so skip it silently, exactly as findTriggerEntry does.
 // D1 (2026-09-19; entry_kind cut 2026-09-20): the trigger instant is the
 // ISSUANCE instant, not the ledger-write instant — a slow ledger write must
 // not make a fresh build look stale (room #23 J1). The anchor is the OLDEST
-// submitted entry by ts and the bound instant is its issued_at (falling back
-// to its ts when the capture was unobserved). One anchor, one field — the
-// retired entry_kind preference filter could never change the bound anchor
-// (issuance and receipt entries carried the same captured issued_at), so the
-// oldest-by-ts selection is the whole mechanism.
+// tick-worker "submitted" entry by ts and the bound instant is its issued_at
+// (falling back to its ts when the capture was unobserved). One anchor, one
+// field — the retired entry_kind preference filter could never change the
+// bound anchor (issuance and receipt entries carried the same captured
+// issued_at), so the oldest-by-ts selection is the whole mechanism.
 let triggerTs = null;
 let manifestBefore = null;
 try {
   const ledgerText = readFileSync(join(crewHome, ".publish-ledger", slug + ".jsonl"), "utf8");
   const entries = ledgerText.split("\n").filter((l) => l.trim()).map((l) => JSON.parse(l));
-  // Collect all submitted entries matching (task_id, commit[, attempt]).
+  // Collect the tick-worker's issuance entries matching (task_id, commit[, attempt]).
   const candidates = entries.filter((e) =>
     e.task_id === taskId &&
     e.outcome === "submitted" &&
+    e.issuer === "tick-worker" &&
     e.commit === commit &&
     (attempt == null || e.attempt === attempt)
   );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.14.4",
+  "version": "0.14.5",
   "description": "Opinionated orchestration for Muse — workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,

package/seed/cron-body-template.md

@@ -2,6 +2,15 @@
 
 You are the dispatch trigger for Muse Crew. Run the authoritative dispatcher workflow and launch its claims autonomously.
 
+### Known blockers — read first, do not re-derive or re-report
+
+The failures below are settled and recorded in the Gate 1 OODA state. The authoritative list lives at `~/workspace/goals/gate-1-onboarding-canary-passes/hidden_files/ooda/known-blockers.md` — if this copy ever disagrees with that file, the file wins. Their fixes are already queued in the main repo BUILD. If you observe one, log exactly one line — `known-blocker: <id> — <one-line observation>` — and move on. Do NOT write root-cause analysis and do NOT write "follow-up needed"; the follow-up is already owned.
+
+- **Blocker 22 — wrong publication caller (settled 2026-09-20):** workflow children cannot call `artifact_edit` (the builder requires a parent-conversation session id they don't have). The 0.14.x trigger/observation path is dead by architecture; `submitted` writes from it are phantom. Fix in BUILD: one-party worker-owned artifact publication.
+- **Blocker 23 — retry harness cannot access Crew state (settled 2026-09-20):** `lib/retry-publish.js` imported `better-sqlite3` (not shipped; the release uses `node:sqlite`) and targeted `crew.db` instead of the real `crew-state.db`. Every retry prepare returned `db-unavailable` and failed closed before any lock, edit, or journal write. Fixed in BUILD (0.14.5): ported to `node:sqlite` + `$CREW_HOME/crew-state.db`, the missing `CREW_REPO` for the merge lock supplied, and the trigger step converted from a spawned child to the session-carrying tick worker's direct `artifact_edit` call (blocker 22). The retry path is worker-owned issuance now; it is subsumed under one-party publish, not a separate queue.
+
+(Maintainer note: this snapshot is refreshed from known-blockers.md at release time. The poller always treats the file as authoritative.)
+
 ### Steps
 
 0. **Check for platform workflow failures (opacity killer):** The platform records workflow run failures in `runtime.workflow_runs` — these are invisible in the crew DB unless you check. A workflow that dies on a fatal `agent()` error (e.g. "subagent bootstrap is no longer authorized") leaves its task stranded with no explanation.
@@ -39,7 +48,7 @@ You are the dispatch trigger for Muse Crew. Run the authoritative dispatcher wor
 
 4.4. **Unknown-recovery (docs/publish-unknown-recovery.md):** tasks parked with "Publish outcome unknown" are the receipt-less trigger gap (2026-09-18, blocker 15). The note is the state machine; deterministic code owns every transition; you are the ferry (scan → classifier → record / retry protocol). Run this BEFORE Step 4.5 so a re-triggered build's mirrored verification-requested is visible to the verification scan on a later tick. Log every list the scan returns.
    - Scan (code): `node {crewHome}/lib/crew-api.js --crew-home {crewHome} scan-publish-unknown`
-     Returns `{ waiting: [...], due: [...], retry_due: [...], mirrored: [...], skipped: [...] }`. `waiting` = parked < 30m — leave alone, no claim. `mirrored`/`skipped` = already handled by code — log only, take no action.
+     Returns `{ waiting: [...], due: [...], intent: [...], retry_due: [...], mirrored: [...], skipped: [...], requeued: [...] }`. `waiting` = parked < 30m — leave alone, no claim. `mirrored`/`skipped` = already handled by code — log only, take no action. `requeued` = stale-base intents sent back to the workflow's Publish for re-preparation — log only, take no action. `intent` = claimed publish intents — handle in Step 4.4b.
    - For each entry in `due`: classify (code), then record the decision (code). Use the entry's fields verbatim.
      - `node {crewHome}/lib/classify-publish-absence.js --repo-path "<repo_path>" --commit <commit> --base <base> --slug "<slug>" --trigger-ts "<trigger_ts>" --park-ts "<park_ts>" --task-id <task_id> --manifest-before '<manifest_before JSON>'`
        Serialize the entry's `manifest_before` field to compact JSON for the `--manifest-before` value; when the entry's `manifest_before` is null, omit the flag (the classifier falls back to the time-based advance check and the Step 4.5 verifier fails closed without a baseline).
@@ -56,12 +65,8 @@ You are the dispatch trigger for Muse Crew. Run the authoritative dispatcher wor
      - Exit 0 with `{"ok": true, "outcome": "superseded"|"lock-held"|"not-dropped", ...}`: terminal for this tick. Do NOT proceed to the trigger. If `outcome` is `not-dropped`, the output carries the full `classification` — pass it to `record-retry-recheck`: `node {crewHome}/lib/crew-api.js --crew-home {crewHome} record-retry-recheck --json '{"task_id": "<task_id>", "decision": <classification JSON>}'` and STOP for this task.
      - Exit non-zero: the command failed (lock released via try/finally). Log the stderr line and STOP — do NOT trigger.
      
-     Trigger (agent-mediated — the ONLY prose-owned step):
-     Spawn ONE child (subagent) whose first instruction loads the artifact namespace (`tool_search.load_tool_namespace` with paths `["artifact"]`), with this exact brief — the same shape as the workflow's first attempt:
-        "The change to apply is the unified diff in the file \"<diff_path>\" (sha256 <diff_sha256>).
-        1. Verify the file: run sha256sum on it. If the printed hash is not exactly <diff_sha256>, STOP and end your turn — do not call artifact_edit.
-        2. Read the file's full content.
-        3. Call artifact_edit with slug \"<slug>\" and verbatim_request:
+     Trigger (tick-mediated — the ONLY prose-owned step):
+     Load the artifact namespace in YOUR OWN turn (`tool_search.load_tool_namespace` with paths `["artifact"]`) and call `artifact_edit` directly — NEVER spawn a child (blocker 22, room #24: children cannot reach artifact_edit). First verify the staged diff: `sha256sum "<diff_path>"` must print exactly `<diff_sha256>`; if it does not, STOP and end this task's retry (log loudly — the claim expires, the next tick re-claims; a mismatched diff never becomes an edit). Read the verified file's full content and call artifact_edit with slug `"<slug>"` and this verbatim_request:
         'Apply the following change to your source tree, then rebuild and deploy.
 
         UNIFIED DIFF (relative to your source tree):
@@ -76,22 +81,51 @@ You are the dispatch trigger for Muse Crew. Run the authoritative dispatcher wor
         - If any hunk does not apply cleanly, STOP and report the failure — do not improvise or skip hunks.
         - Do not make any other source changes.
         - After applying, rebuild and deploy.'
-        Edit-request contract (read carefully):
-        - Call artifact_edit exactly once with the slug and verbatim_request above. Never retry the edit yourself: if the edit is not accepted, do NOT call artifact_edit again — end your turn.
-        - If artifact_edit explicitly refuses the edit (the call is rejected — e.g. the artifact does not exist), do NOT call artifact_edit again: end your turn with exactly one line and nothing else: ARTIFACT_EDIT_REFUSED: <the refusal text, one line>.
-        - If artifact_edit is not available after the load, do NOT improvise — end your turn.
-        - You do NOT call setprovenance, artifact_inspect, or post-deploy yourself.
-        No report is needed: do not return JSON, do not summarize what you did, do not echo the diff. End your turn after the artifact_edit call."
-        Wait for the child to finish. The child's final text is your only signal.
+        Edit-request contract:
+        - Call artifact_edit exactly once with the slug and verbatim_request above. Never retry the edit yourself: if the edit is not accepted, do NOT call artifact_edit again — proceed to the complete phase below.
+        - If artifact_edit explicitly refuses the edit (the call is rejected — e.g. the artifact does not exist), do NOT call artifact_edit again: record the first line of the refusal for the complete phase below.
+        - If artifact_edit is not available after the load, do NOT improvise — log it and proceed to the complete phase with `refused` and the refusal text "artifact tool namespace unavailable in tick".
      
      Phase 2 — complete (deterministic):
      `node {crewHome}/lib/retry-publish.js --crew-home {crewHome} --task-id <task_id> --phase complete --edit-outcome <accepted|refused> [--refusal-text "<first line>"]`
-     - If the child's final text starts with `ARTIFACT_EDIT_REFUSED`: `--edit-outcome refused --refusal-text "<first line of the refusal>"`.
+     - If artifact_edit explicitly refused the edit: `--edit-outcome refused --refusal-text "<first line of the refusal>"`.
      - Otherwise: `--edit-outcome accepted`.
-     - The command writes the outcome notes, appends the `-retry1` ledger entry (with the pre-retry `manifest_before` baseline), mirrors verification-requested, and RELEASES the lock in a finally block. Exit 0 means the protocol completed.
+     - The command writes the outcome notes, appends the `-retry1` ledger entry (issuer `tick-worker`, with the pre-retry `manifest_before` baseline), mirrors verification-requested, and RELEASES the lock in a finally block. Exit 0 means the protocol completed.
      
    - Crash rules (fail closed, never re-trigger blind): if this tick dies anywhere in the retry protocol, the note journal is the recovery state. `publish: retry-intended` without `retry-issued` → the next scan mirrors `verification-requested` (never re-triggers). `publish: retry-issued` without a mirrored request → the next scan mirrors it. A leaked merge lock expires after 600s. The next tick's scan never emits `retry_due` for a task with `retry-issued` in history — exactly one retry, enforced from notes, not from the ledger.
 
+4.4b. **One-party intent issuance (2026-09-20, blocker 22):** the workflow parks at Publish with a `publish: publish-requested` note and a checksummed `publish-intent` ledger entry; issuance belongs to YOU, the session-carrying tick worker, calling `artifact_edit` directly in this turn. The Step 4.4 scan returns the `intent: [...]` bucket — each entry is claimed for this tick (1-hour lease) and carries `task_id`, `commit`, `attempt`, `slug`, `repo_path`, `base`, `diff_path`, `diff_sha256`, `manifest_before`, `claim_expiry`, and `reclaimed`.
+   - For each intent entry:
+     1. **Verify the staged diff (code):** `sha256sum "<diff_path>"` must print exactly `diff_sha256`. If the file is missing, regenerate deterministically and re-verify:
+        `node {crewHome}/lib/compute-publish-diff.js --repo-path "<repo_path>" --base <base> --commit <commit> --out "<diff_path>"`
+        then re-run the sha256sum. The `--commit` flag is honored: the script diffs `base..<commit>` (never an implicit HEAD) and reports that target as `commit`. If the regeneration exits non-zero, or the hash still does not match after regeneration, the diff is UNISSUABLE — record it terminally (code, never prose):
+        `node {crewHome}/lib/crew-api.js --crew-home {crewHome} record-intent-unissuable --json '{"task_id": "<task_id>", "claim_expiry": "<claim_expiry>", "reason": "<missing-staged-diff|diff-unregenerable|hash-mismatch-after-regeneration>"}'`
+        (copy `claim_expiry` verbatim from the scan entry — it is the compare-and-swap). This writes the terminal `publish: publish-unissuable` note and an issuer-stamped ledger entry — parked for human attention. Never re-claim, never loop on an hourly reclaim; a diff that cannot be checksummed never becomes an edit.
+     2. **Freshness check on a re-claimed intent (code, never prose):** when the entry's `reclaimed` is true, a previous tick died mid-issuance and may have issued the edit without recording it. Run the deterministic freshness helper — it reads the on-disk artifact manifest at `~/workspace/ts-spaces/<slug>/.space-build/manifest.json` (the same path the verifier uses) and compares `content_sha256`/`built_at` against the entry's `manifest_before`:
+        `node {crewHome}/lib/check-intent-freshness.js --slug "<slug>" --manifest-before '<manifest_before JSON>'`
+        (copy the entry's `manifest_before` verbatim as JSON; use the entry's `slug` verbatim). The helper prints exactly one JSON object: `{ok:true, advanced:<true|false>, baseline:{...}, current:{...}}`. If `advanced` is true → the edit is already live: record `recovered` in step 4 below (passing the helper's stdout JSON as `freshness_evidence`) and NEVER re-issue. If `advanced` is false → the manifest still shows the pre-edit state: proceed to issuance. If the helper exits non-zero or prints `ok:false` → the freshness question is unanswerable: record NOTHING, log loudly in one line, and let the claim expire — the next scan re-claims. Never decide this from prose, from `artifact_status`, or from an inspector's summary.
+     3. **Issue the edit directly — in this turn, never in a child.** Blocker 22 is proven: workflow children cannot reach `artifact_edit` (room #24's four journeys died on exactly this). Load the artifact namespace in your own turn and call `artifact_edit` with the entry's `slug` and this verbatim_request (paste the verified diff file's full content verbatim):
+        'Apply the following change to your source tree, then rebuild and deploy.
+
+        UNIFIED DIFF (relative to your source tree):
+        ```diff
+        <the full content of the verified file, pasted verbatim>
+        ```
+
+        Rules:
+        - For each file in the diff, apply its hunks to the same path in your source tree (use git apply or equivalent).
+        - For a new file (--- /dev/null), create it with the added (+) lines as its full content.
+        - For a deleted file (+++ /dev/null), delete it.
+        - If any hunk does not apply cleanly, STOP and report the failure — do not improvise or skip hunks.
+        - Do not make any other source changes.
+        - After applying, rebuild and deploy.'
+        Call artifact_edit exactly once. Never retry it yourself. If the call is explicitly refused, note the first line of the refusal text.
+        `accepted` means exactly one thing: the direct `artifact_edit` call completed without error and without an explicit refusal. Tool unavailable (the artifact namespace would not load), a timeout, a transport error, or any otherwise ambiguous result is NOT accepted and NOT refused — it is inconclusive: record NOTHING for this task, log the ambiguity in one line, and let the claim expire; the next scan re-claims and step 2's freshness check decides. An unrecorded outcome is the only honest record of an unknown one.
+     4. **Record the outcome (code):**
+        `node {crewHome}/lib/crew-api.js --crew-home {crewHome} record-intent-issuance --json '{"task_id": "<task_id>", "claim_expiry": "<claim_expiry>", "edit_outcome": "<accepted|refused|recovered>", "refusal_text": "<first line>"}'`
+        (omit `refusal_text` unless refused). For `recovered`, pass `freshness_evidence` with the step-2 helper's stdout JSON verbatim — the command refuses a recovery without machine evidence. Copy `claim_expiry` verbatim from the scan entry — it is the compare-and-swap. If the command returns `recorded: false`, log the reason and stop: another tick owns the task. `accepted`/`recovered` writes the issuer-stamped `submitted` ledger entry and mirrors `publish: verification-requested` (the Step 4.5 scan claims it on this or a later tick); `refused` writes `rejected` and the terminal `publish: publish-refused` note. There is no outcome for an inconclusive call (step 3) — do not call record-intent-issuance at all when the edit's fate is unknown.
+   - Crash rules (fail closed, never blind re-issue): if this tick dies between the artifact_edit call and the record step, the next scan re-claims with `reclaimed: true` and step 2's manifest-freshness check decides between `recovered` and a fresh issuance. The issuance contract is at-most-one RECORDED issuance per attempt: a duplicate physical issuance remains possible across a lease expiry when the first attempt's fate went unrecorded (the dead tick issued but died before recording), but it is content-identical — the same checksummed diff — and the verifier's content check bounds it. If the tick dies before issuing, the claim simply expires and the next tick claims it.
+
 4.5. **Parent publish verification (docs/publish-verification.md):** The publisher parks instead of stamping provenance; the parent — this tick, the live root agent — verifies content and stamps. Deterministic code detects, reads back, and certifies; you are only the ferry between the deterministic steps (scan → sensor → verifier).
    - Scan (code): `node {crewHome}/lib/crew-api.js --crew-home {crewHome} scan-verification-pending`
      This atomically claims each verification-pending task (1-hour lease, so a second tick cannot double-verify) and reconciles verified-but-still-parked tasks to `in_progress`. It returns `{ to_verify: [...], reconciled: [...] }`. Log both lists. If the scan exits 2 (e.g. the active release cannot be resolved), log the error loudly and continue — do NOT work around it.