muse-crew 0.14.4 → 0.14.6

package/AGENTS.md

@@ -18,4 +18,4 @@ Muse Crew source repository. The repo is the product; the personal instance (`$C
 - Git source is authoritative.
 - Never expose this repo publicly.
 - Ship implementation and documentation together.
-- After editing `workflows/*.js`, run `bash tests/run.sh` — `node --check` does NOT catch syntax errors inside function bodies (V8 lazy preparsing), so it cannot validate workflow edits alone. Worse (2026-09-19): raw `node --check` on the unstripped file is a FALSE NEGATIVE — the file parses as a module (top-level `export`), which masks breakage the release gate's export-strip + async-wrap transform exposes (module/script goal confusion). An unterminated string passed raw `node --check` and was caught only by `publish-verdict-first.test.js`'s loader emulation. After any workflow edit, verify with the true gate: `{ echo "async function __crew_workflow__(args) {"; sed 's/^export //' workflows/<f>.js; echo "}"; } > /tmp/w.js && node --check /tmp/w.js` — or just run the suite.
+- After editing `workflows/*.js`, run `bash tests/run.sh` — `node --check` does NOT catch syntax errors inside function bodies (V8 lazy preparsing), so it cannot validate workflow edits alone. Worse (2026-09-19): raw `node --check` on the unstripped file is a FALSE NEGATIVE — the file parses as a module (top-level `export`), which masks breakage the release gate's export-strip + async-wrap transform exposes (module/script goal confusion). An unterminated string passed raw `node --check` and was caught only by the suite's loader emulation (then `publish-verdict-first.test.js`, now the `_validate_workflows` behavioral drive in `tests/workflow-size.test.js`). After any workflow edit, verify with the true gate: `{ echo "async function __crew_workflow__(args) {"; sed 's/^export //' workflows/<f>.js; echo "}"; } > /tmp/w.js && node --check /tmp/w.js` — or just run the suite.

package/API.md

@@ -94,15 +94,68 @@ Atomically park a task for human attention: sets `state` to `parked`, writes the
 
 Returns `{ "ok": true, "task": {...}, "settled_sessions": <n> }` with the updated task record and the count of sessions settled (`0` when none were running).
 
-### `resolvepublishunknown`
+### `scan-publish-intent`
 
-Recovery contract for publish attempts parked with an `unknown` outcome (2026-09-14): the rebuild trigger's child failed structured closeout and the in-flight-only build-state poll could not see the completed build, so the workflow parked fail-closed — but the edit may still have gone through. When a platform audit build completed inside the publish window (between the Integrate-completion event and the unknown-outcome park), this action routes the task to the parent's independent content verification WITHOUT re-issuing the edit and WITHOUT stamping provenance. The original unknown ledger entry and park event are preserved; the resolution is appended to the publish ledger (`outcome: "unknown-resolved"`) and to the event log, and a `publish: verification-requested <commit>` note is written so `scan-verification-pending` claims the task on the next tick. The parent's read-back ([publish verification](docs/publish-verification.md)) remains the real verification and can still fail terminally. Cases that stay parked with `{ "resolved": false, ... }`: task not parked, latest ledger outcome not `unknown`, no usable commit on the unknown entry, no audit build inside the publish window, unobservable publish window (missing Integrate-completion or park event), or an already-resolved attempt (idempotent).
+Claims parked publish intents for the tick worker's direct issuance (0.14.6). For each task parked with `publish: publish-requested <commit> attempt=N`, re-derives the version deterministically (never trusts the ledger's), verifies the staged diff's sha256, checks the intent base against stamped provenance, and claims with a 1-hour lease (CAS on `claim_expiry`). Skips: no intent entry, unparseable note, terminal note, unexpired claim (another tick owns it), base-stale (re-queues to the workflow's Publish), backoff not elapsed.
+
+Returns `{ "intent": [...], "skipped": [...], "requeued": [...] }`. Each intent entry carries `task_id`, `commit`, `attempt` (numeric `publish_attempt`), `version` (`<commit>:<attempt>`), `claim_expiry`, `diff_path`, `diff_sha256`, `ledger_path`.
+
+### `record-intent-issuance`
+
+Records the tick worker's direct issuance outcome (0.14.6). Compare-and-swap on `claim_expiry` — a stale tick writes nothing.
+
+| Field | Type | Required | Notes |
+|-------|------|----------|-------|
+| `task_id` | uuid | yes | Must have an unexpired intent claim |
+| `claim_expiry` | ISO-8601 | yes | Must match the claim's expiry (CAS) |
+| `edit_outcome` | `accepted`\|`refused` | yes | The direct `artifact_edit` outcome |
+| `refusal_text` | string | no | Required when `refused` |
+
+`accepted` writes the issuer-stamped `submitted` ledger entry + `publish: edit-issued` note. `refused` writes `rejected` + terminal `publish: publish-refused`. Returns `{ "recorded": true, "edit_outcome" }` or `{ "recorded": false }` on CAS mismatch.
+
+### `record-builder-report`
+
+Records a builder's refusal report (0.14.6). Mechanically requires the EXACT version in `report_text` — a report that does not echo the version is rejected.
+
+| Field | Type | Required | Notes |
+|-------|------|----------|-------|
+| `task_id` | uuid | yes | |
+| `version` | `<commit>:<attempt>` | yes | Must name an issued attempt |
+| `outcome` | `refused` | yes | (2026-09-20 REVIEW) `acknowledged` is rejected — the positive builder-report path was circular; disk is the sole positive evidence |
+| `report_text` | string | yes | Must contain the exact version |
+
+Returns `{ "ok": true, "publish_attempt" }`. The ack scan consumes refusal reports (terminal `publish: publish-refused`); positive acknowledgements come only from the on-disk version receipt.
+
+### `record-version-ack`
+
+Stamps a version acknowledgement (0.14.6). The version must name an issued attempt for the task/commit.
+
+| Field | Type | Required | Notes |
+|-------|------|----------|-------|
+| `task_id` | uuid | yes | |
+| `version` | `<commit>:<attempt>` | yes | Must match an issued attempt's derived version |
+| `via` | string | yes | `disk` only (2026-09-20 REVIEW) |
+
+Stamps provenance, writes terminal `publish: version-acknowledged`, re-queues the task to `in_progress`. Returns `{ "ok": true, "commit", "publish_attempt", "via" }`. The reclaim path accepts the exact disk version for the currently claimed intent when no `submitted` entry exists (dead tick issued but died before recording).
+
+### `scan-ack-pending`
+
+Evaluates version acknowledgements (0.14.6). For each `edit-issued` task: checks the on-disk `.crew-publish-version-<task_id>` receipt (per-task scoped; the SOLE positive evidence — 2026-09-20 REVIEW removed the circular builder-report positive path). Any exact on-disk acknowledgement for an issued version on the task/commit counts (late earlier attempts included). On ack: provenance + terminal `publish: version-acknowledged` + requeue. On explicit refusal (via builder report): terminal `publish: publish-refused`. On 30-minute window expiry (per attempt, anchored at the LATEST issuance): re-issues with a FRESH version, immediately claimable (no backoff). When the 2-hour total budget from the FIRST issuance is exhausted: terminal `publish: version-timeout` (unobserved within budget — the edit may still have landed).
+
+Returns `{ "acknowledged": [...], "refused": [...], "reissued": [...], "timeouts": [...], "skipped": [...] }`.
+
+A dedicated 5-minute `crew-ack-scan` cron (seed/crons.json) runs this command on an observation-only tick so verdicts land quickly; it never issues edits — issuance stays in the 15-minute poll tick's claim-and-issue path.
+
+### `record-publish-note`
+
+The closed publish-note writer (0.14.6 §1.5). Asserts the note's verb against the writable registry before writing — prose cannot mint new states.
 
 | Field | Type | Required | Notes |
 |-------|------|----------|-------|
-| `task_id` | uuid | yes | Must be parked with a latest publish-ledger outcome of `unknown` |
+| `task_id` | uuid | yes | |
+| `note` | string | yes | Must start with a registered `publish: <verb>` |
 
-Returns `{ "resolved": true, "task_id", "commit", "evidence_dir", "audit_report_ok" }` on success, or `{ "resolved": false, "reason" }` when the recovery preconditions are not met.
+Writable verbs (tick prose via `record-publish-note`): `publish-requested`, `publish-intent-claimed`, `publish-base-stale`, `edit-issued` (transitional only — prose can never mint a terminal). Deterministic code writes terminals via the code-writable registry: `version-acknowledged`, `publish-refused`, `version-timeout`, `publish-unissuable`. Legacy terminals are recognized but NOT writable by anyone. Returns `{ "ok": true, "verb" }` or a usage error.
 
 ---
 
@@ -483,9 +536,10 @@ project row carries its own publish base (`provenance_source_commit`,
 a crew home with N artifact projects carries N independent bases. There are
 two stamp call paths, and they are different operations on the same row:
 
-- **Full stamp** — called by the parent's publish verification (`lib/verify-publish.js`)
-  after independently verifying the rebuilt artifact: `source_commit` is the
-  verified build commit, `crew_release` the active release at publish time.
+- **Full stamp** — called by the ack scan's `record-version-ack` (the 0.14.6
+  version machine) after the exact per-attempt version is observed on the
+  artifact's disk: `source_commit` is the acknowledged build commit,
+  `crew_release` the active release at publish time.
 - **Refresh** — called by the release installer (`lib/advance-publish-base.js`)
   after installing/activating a crew release: `crew_release` is refreshed to
   the live release identity while preserving the existing `source_commit`.

package/docs/decisions/AGENTS.md

@@ -57,6 +57,9 @@ re-verified that every `docs/decisions/*.md#anchor` reference in
 - `#d1-issuance-time` — D1 issuance-time field (`issued_at`; `entry_kind` cut 2026-09-20)
 - `#detached-head-audit` — Detached-HEAD audit (0.14.2)
 - `#detached-head-audit-redo` — Detached-HEAD audit REDO (0.14.3, supersedes findings 3/5)
+- `#version-acknowledgement` — Version acknowledgement replaces content verification (0.14.6)
+- `#version-review-dispositions` — 2026-09-20 amended REVIEW dispositions (14 mechanical fixes)
+- `#version-not-hash` — 2026-09-20: version number replaces the sha256 nonce
 
 ## qa-reproduce.md — Decision history: qa reproduce
 

package/docs/decisions/publish-path.md

@@ -1,5 +1,18 @@
 # Decision history: publish path
 
+> **SUPERSESSION NOTICE (2026-09-20, 0.14.6 version machine REVIEW):** This
+> document records the decision history of the RETIRED publish machinery
+> (two-party trigger, fire-and-forget observation, content verification,
+> pre-trigger baselines, artifact toolcheck). The sections below describe
+> that machinery in present tense as "Invariants" — they are HISTORICAL,
+> not current. The current publish path is the one-party worker-owned version
+> acknowledgement machine: the workflow stages a checksummed diff and
+> parks with `publish: publish-requested`; the session-carrying tick
+> worker claims the intent, issues the edit via `artifact_edit`, and the
+> ack scan observes the exact per-attempt version on the artifact's disk as
+> the sole positive evidence. See `docs/publish-verification.md` for the
+> current contract.
+
 Relocated from workflow source comments during H5 (2026-09-18). The workflows keep only the relied-upon invariant inline; the full decision history lives here.
 
 <a id="fire-and-forget-trigger"></a>
@@ -1361,7 +1374,7 @@ Consumers (one anchor, shared): `lib/verify-publish.js`,
 `lib/crew-api.js::findTriggerEntry`, the classifier
 (`lib/classify-publish-absence.js`), and the retry writer
 (`lib/retry-publish.js`) all take the oldest matching "submitted" by `ts`
-and bind `issued_at || ts`. Platform nonce: deferred, not filed in this
+and bind `issued_at || ts`. Platform version: deferred, not filed in this
 change.
 
 Edge cases:
@@ -1507,3 +1520,233 @@ push-destination, do_push refspec), lib/publish-npm.sh
 (PUSH-TARGET-ANCHOR refspec), workflows/{standard,bugfix,chore}.js
 (STEP-2/R5-PUSH wording), lib/test-detached-integrate.sh (fixture H),
 lib/test-publish-preflight.sh (cases 6/7).
+
+## One-party worker-owned publish (0.14.5, room #24 → blockers 22/23)
+
+**Problem.** Room #24's four journeys all died at Publish on one mechanical
+fact: workflow children cannot call `artifact_edit`. The tool requires a
+parent-conversation session ID that `agent()` children do not have — every
+trigger-child attempt failed with `missing session id`, and the runtime's
+JSON-candidate scan threw on the refusal before the workflow could parse it.
+A second, independent defect: the retry harness (`lib/retry-publish.js`)
+imported the unavailable `better-sqlite3` and pointed at `crew.db` instead
+of `crew-state.db`, so no retry could ever run.
+
+**Decision.** One party owns issuance: the session-carrying tick worker.
+The workflow prepares (preflight, provenance base, checksummed diff via
+`lib/compute-publish-diff.js`, toolcheck, pre-trigger manifest baseline),
+records ONE issuer-stamped ledger entry (`outcome: "publish-intent"`,
+`issuer: "workflow"`, carrying `diff_path`/`diff_sha256`), and parks with
+`publish: publish-requested <commit> <attempt>`. The tick claims the intent
+(`publish: publish-intent-claimed <expiry>`, 1-hour lease, via
+`scan-publish-unknown`'s `intent` bucket), verifies the staged diff's sha256
+(regenerating deterministically from `base..commit` when the file is
+missing), runs the manifest-freshness check on re-claimed intents (the dead
+tick may have issued and died before recording — never blindly re-issue),
+calls `artifact_edit` directly in its own turn, and records the outcome
+through `record-intent-issuance` (CAS on the claim): `accepted`/`recovered`
+→ issuer-stamped `submitted` (`issuer: "tick-worker"`) + mirrored
+`publish: verification-requested`; `refused` → `rejected` + terminal
+`publish: publish-refused`.
+
+**Retired, not reverted.** The trigger child, build-state observation
+machinery, refusal parser, phantom workflow-owned `submitted`, and the
+receipt-less unknown machinery's issuance side are deleted. The
+unknown-recovery classifier survives for legacy parks; its trigger anchor
+is now issuer-bound (only `issuer: "tick-worker"` binds). The retry
+protocol survives ported to `node:sqlite` + `crew-state.db` with the
+missing `CREW_REPO` for the merge lock supplied, and its issuance step is
+the tick worker's direct call. Verified re-entry: a `submitted` without a
+mirrored request mirrors `verification-requested` — never re-issues.
+
+**What it is not.** Not a ledger-as-request queue (no new queue
+abstraction — the intent IS the ledger entry plus the park note). Not a
+revert of room #22's trigger-timing work (that machinery was deleted, and
+room #24 disproved its premise). The new path is proven in parts; the next
+clean room proves it end-to-end.
+
+Applies to: workflows/{standard,bugfix,chore}.js (Publish exits at intent),
+lib/crew-api.js (scan-publish-unknown intent bucket, record-intent-issuance,
+issuer-bound findTriggerEntry), lib/retry-publish.js (node:sqlite port,
+CREW_REPO, direct tick issuance), lib/verify-publish.js (issuer-bound
+trigger anchor), lib/publish-note-vocabulary.js (publish-requested,
+publish-intent-claimed, publish-refused), seed/cron-body-template.md
+(steps 4.4b, 4.4 retry direct-issuance), docs/publish-verification.md,
+docs/publish-unknown-recovery.md.
+
+<a id="version-acknowledgement"></a>
+## Version acknowledgement replaces content verification (0.14.6, 2026-09-20)
+
+**Eric's contract:** "If we hear that the artifact acknowledges our version,
+that's it. We don't verify against content."
+
+The content-verdict machine (read-back, `verify-publish.js`, the unknown-
+recovery classifier, the retry harness) is deleted. Exact per-attempt version
+acknowledgement is the sole positive completion criterion.
+
+**The version:** `sha256("publish-version:v1:" + task_id + ":" + commit + ":" +
+publish_attempt)` — deterministic, 64 hex. Synthesized into the staged diff
+as `.crew-publish-version` (checksum covers it; never committed). The workflow
+replay key (`attempt`, a string) is separate from the numeric
+`publish_attempt`.
+
+**The loop:** workflow stages intent (attempt 1) → tick worker claims via
+`scan-publish-intent` → issues directly → `record-intent-issuance` writes
+`submitted` + `publish: edit-issued` → `scan-ack-pending` watches for the
+exact version on disk or in a builder report. Any issued version for the
+task/commit counts (late earlier attempts included). Refusal is terminal.
+45-min window per attempt, 3 attempts max, 15/45-min backoff. Third expiry
+→ `publish: version-timeout`.
+
+**Provenance certifies request acknowledgement, not byte equality.**
+
+Applies to: lib/compute-publish-diff.js (--task-id/--attempt, version hunk),
+lib/crew-api.js (scan-publish-intent, record-intent-issuance,
+record-builder-report, record-version-ack, scan-ack-pending,
+record-publish-note), lib/publish-note-vocabulary.js (WRITABLE split:
+legacy terminals recognized, not writable), workflows/{standard,bugfix,
+chore}.js (Publish exits at intent with `attempt=1`), seed/cron-body-
+template.md (tick protocol), docs/publish-verification.md,
+docs/publish-unknown-recovery.md (retired).
+
+## 2026-09-20 (post-REVIEW amendment) — bounds re-set, observation split from mutation
+
+Before PUBLISH, Eric challenged the bounds as unmeasured placeholders and
+approved a replacement:
+
+- **Observation is cheap and read-only; mutation is not.** The old bounds
+  coupled them: the 45-minute window + 15/45-minute backoffs + 3-attempt cap
+  were all guesses, and the scan ran inside the 15-minute poll tick, so a
+  verdict could never land sooner than the tick cadence.
+- **New shape:** the ack scan runs on its own 5-minute `crew-ack-scan` cron
+  (observation-only — it never issues edits); the 15-minute poll tick keeps
+  the claim-and-issue path. The scan cadence no longer constrains verdict
+  latency: with 6 scans per window, the verdict lands within one cadence of
+  the ack or the expiry.
+- **New bounds:** 30-minute acknowledgement window per attempt (anchored at
+  the LATEST issuance — evidence-set: room #25's one healthy ack landed
+  ~15-17 minutes after issuance, so the window is ~2x that plus margin),
+  immediate reissue at expiry (`not_before: null` — no backoff), and a
+  2-hour total budget from the FIRST issuance, after which the scan parks
+  terminal `publish: version-timeout`. The fixed 3-attempt cap is gone — a
+  slow-but-healthy artifact no longer false-timeouts, and a dead one still
+  terminates on the budget. The ledger records issued_at and first-seen ack
+  per attempt, so the window is tunable from measured data.
+
+<a id="version-review-dispositions"></a>
+## 2026-09-20 (amended REVIEW dispositions) — 14 mechanical fixes
+
+A five-critic read-only review (Architect, Subtractor, Reliability, Room
+Operator + step-back) of the amended 0.14.6 tree returned
+ACCEPT-WITH-CONCERNS, no REJECTs. All 14 dispositions applied before the
+amended BUILD commit:
+
+1. **Torn reissue staging is note-keyed.** The ack scan's reissue
+   idempotency guard is keyed on the `publish: publish-requested <commit>
+   attempt=N` note — the same anchor `scan-publish-intent` claims on —
+   not the ledger line. A crash between the ledger append and the note
+   write (or a rolled-back COMMIT) leaves an orphan line; the note-keyed
+   guard self-heals by re-appending the content-identical line. Write
+   order stays line-then-note: note-first would park permanently on a
+   tear.
+2. **`publish: version-timeout` vocabulary** now reads the 2-hour
+   acknowledgement-budget meaning, not "three issuance attempts
+   exhausted".
+3. **Dead backoff guard deleted** from `scan-publish-intent` (the amended
+   design never writes `not_before`).
+4. **`not_before` plumbing removed**: no longer on claimed intents,
+   reissue results, or ledger lines — the field is gone entirely, not
+   even null-inline (nothing reads it; a dead field is the opposite of
+   the disposition).
+5. **Version-mismatch is per-entry**: a corrupt submitted entry is
+   quarantined; valid derivation-verified entries still drive the windows
+   and the budget. Only when NO entry verifies does the record park as
+   `version-mismatch`.
+6. **Unparseable latest issuance is an unknown window**: never reported
+   as "window-open"; the budget check still runs (a corrupt latest
+   timestamp cannot defer the terminal timeout), but reissue is withheld
+   until the budget decides.
+7. **Ack-scan failure is mechanical**: nonzero exit → report stderr
+   verbatim, take no other action, no rerun, no other Crew API command,
+   stop.
+8. **Tests extended** in the existing `tests/scan-publish-intent.test.js`
+   (no new file): reissue idempotency across repeated scans, exact `>=`
+   budget boundary (inside reissues, at-boundary times out), unparseable
+   first issuance (`first-issuance-unparseable` park), unparseable latest
+   issuance (reissue withheld), duplicate submitted entries (deduped),
+   corrupt version beside a valid entry (quarantined), all-invalid
+   versions (`version-mismatch` park), on-disk version naming no issued
+   attempt (ignored), per-task receipts never cross-attributed, torn
+   reissue prepare self-heals via the note-keyed guard.
+9. **Receipt scoped per task** (verified possible): per-project
+   simultaneity defaults to 2 and parked tasks don't count as in-flight,
+   so two same-project tasks CAN sit in `edit-issued` concurrently — a
+   shared per-slug `.crew-publish-version` would let each issuance
+   overwrite the other's acknowledgement (receipt ping-pong). The
+   receipt is now `.crew-publish-version-<task_id>` in the staged diff
+   hunk and on disk.
+10. **Cron id overrides validated at init**: an override must start with
+    `<manifest-id>-`, so uninstall's prefix-based discovery fallback can
+    always find the job even if `.cron-registry.json` is lost.
+11. **`crew-burn-room.sh`** (outside the repo): `--crons-removed` caller
+    attestation is REQUIRED — the script refuses to burn without it
+    (fail-closed; it cannot reach the scheduler, so the contract is
+    honest: the caller removes poll/ack-scan/update-watch/journey-watch
+    via cron.remove first and attests the ids). `roomNN-journey-watch`
+    added to the convention list. `--ts-spaces <slugs>` moves the room's
+    artifact records into the trash (already-gone is fine).
+12. **Stuck-publish runbook** in `docs/guide.md`: the ack scan stages
+    reissues, the poll tick issues them — if the poll tick is down,
+    reissues stay staged and the budget eventually parks
+    `publish: version-timeout`.
+13. **Receipt scope documented**: the version proves adoption into the
+    artifact's on-disk source tree — not a successful rebuild or
+    redeployment.
+14. **Result taxonomy fixed**: `timeouts[]` is terminal-budget exhaustion
+    only; window expiries are `reissued[]`.
+
+**Follow-up fix found in final pre-commit inspection (same day):** the
+version-not-hash cut left the old 64-hex nonce regex in the Publish
+phase of `workflows/standard.js`, `bugfix.js`, and `chore.js` — the
+format gate would have rejected every `<commit>:<attempt>` version and
+parked every publish. All three now mirror `isPublishVersion()` from
+`lib/crew-api.js`, and `tests/compute-publish-diff.test.js` carries a
+mechanical guard asserting the workflow regex matches the library's
+(and the stale 64-hex shape is gone). The full suite passed before this
+was found because no test executes the workflow's Publish gate — the
+guard closes that hole.
+
+Step-back conclusions recorded: the five-minute observer costs ~192
+marginal task-mode turns/day/room (accepted for current VERIFY
+turnaround); the machine is a compensating control for the platform's
+missing real completion receipt and should be deleted the day the
+platform issues one (see `docs/publish-verification.md`
+§ Decommissioning). Non-blocking backlog: at final timeout, a
+machine-owned audit-directory check could split the park note into
+"landed-but-receiptless" vs "platform-silent".
+
+<a id="version-not-hash"></a>
+## 2026-09-20 — Version number replaces the sha256 nonce
+
+Eric: a nonce is a hash plus a version number — why not just the version
+number? He was right. The sha256 defended against a forger that doesn't
+exist: the builder's failure mode is omission (zero-tool runs), never
+forging our receipts. The artifact's real failure mode — an unfaithful
+carrier that mangles bytes or ignores the request — defeats a hash and a
+plain counter identically. We own the code, so we count our own attempts;
+we don't own the artifact, so verification stays observation of its state,
+never its attestation. The hash pretended to buy attestation.
+
+The per-attempt version is now `<commit>:<attempt>` (e.g.
+`4b825dc6…:2`) — no hash, no task_id (the receipt path
+`.crew-publish-version-<task_id>` and the per-task ledger scoping already
+carry the task). The commit binds the version to the exact code, so a stale
+receipt from an earlier commit can never equal a fresh version — the binding
+the hash used to provide, kept without the cryptography. Derivation is a
+plain concatenation, byte-identical between `compute-publish-diff.js` and
+`derivePublishVersion()` in `crew-api.js`; well-formedness is
+`/^[0-9a-f]{40}:[1-9][0-9]*$/` (`isPublishVersion`). The retry machine,
+windows, budget, and terminal vocabulary are unchanged — only the token got
+honest. Side benefit, and Eric's original motive: the version is
+human-readable observability ("roughly what's deployed") where the hash was
+opaque.

package/docs/guide.md

@@ -17,7 +17,7 @@ This is the full setup and operations reference. If you're new, start with the [
 - A **release** — the first immutable snapshot of the crew's runtime code.
 - An **`.orchestration/` directory** in the crew home with identities, personas, workflow docs, and feedback conventions.
 - A **project registration** — the task service registered as its own first project.
-- **Cron jobs** — the scheduler state declared in `seed/crons.json`: a polling loop (every 15 minutes via Muse's scheduling, even when nobody's in the conversation). The scheduler identity is dashboard-independent — chosen once at first init (no owner; the platform rejects `cli:` owners) — so deleting the dashboard artifact does not stop the crew. Removing a crew entirely is `crew-uninstall`'s job.
+- **Cron jobs** — the scheduler state declared in `seed/crons.json`: a polling loop (every 15 minutes via Muse's scheduling, even when nobody's in the conversation), a 5-minute acknowledgement scan (observation-only — runs `scan-ack-pending` so publish verdicts land quickly; it never issues edits), and a daily update watcher. The scheduler identity is dashboard-independent — chosen once at first init (no owner; the platform rejects `cli:` owners) — so deleting the dashboard artifact does not stop the crew. Removing a crew entirely is `crew-uninstall`'s job.
 
 The agent running in the main chat receives the dispatcher's claims and launches each task workflow. Workflows can't launch workflows, so this handoff is structural.
 
@@ -126,7 +126,7 @@ The run has four phases:
 
 1. **Gates** — the crew home must be inside the workspace (uninstall refuses to delete anything outside it), and `confirm: true` must be present. Either missing blocks the run before anything is touched.
 2. **Safety** — if any task is `in_progress`, the run blocks unless `force: true`. Uninstalling under live workflows would strand them.
-3. **Crons** — removes the crew's scheduler jobs, and only those: the exact ids from `$CREW_HOME/.cron-registry.json` (written by init; covers id overrides), plus discovery of `crew-poll-*` jobs whose body contains the crew home path (covers installs from before the registry existed). Anything not on that union is never touched — shared crons are safe by construction, and a missing home still gets its orphaned crons removed.
+3. **Crons** — removes the crew's scheduler jobs, and only those: the exact ids from `$CREW_HOME/.cron-registry.json` (written by init; covers id overrides), plus discovery of `crew-poll-*` / `crew-ack-scan-*` / `crew-update-watch-*` jobs whose body contains the crew home path (covers installs from before the registry existed). Anything not on that union is never touched — shared crons are safe by construction, and a missing home still gets its orphaned crons removed.
 4. **Home** — best-effort `git worktree prune` on the crew's project repos, then deletes the crew home directory and verifies it is gone.
 
 Dashboard artifacts are left untouched — uninstall removes the crew instance (its crons and its home), never the user's artifacts.
@@ -230,7 +230,10 @@ A task in `todo` state becomes eligible for dispatch on the next polling tick. A
 
 ## How the loop works
 
-Every 15 minutes, the `crew-poll` cron fires:
+Every 15 minutes, the `crew-poll` cron fires. (Publish verdicts don't wait
+for it: a separate 5-minute `crew-ack-scan` cron runs the observation-only
+`scan-ack-pending` pass so acknowledgements, refusals, and timeouts land
+within one scan cadence — issuance stays in the poll tick below.)
 
 1. **Cron runs the dispatcher** — `crew-dispatch.js` with the task service slug and `crewHome` as arguments.
 
@@ -364,9 +367,42 @@ Bugfix tasks reproduce at the layer where the bug lives — not always in the br
 
 The workflow dispatches the Reproduce strategy mechanically on the classification. A garbled or missing marker degrades to `artifact` (the old behavior) — a task is never parked on it. The experiential loop is forbidden for engine/docs tasks: if the reproducer drives the browser anyway, the closeout fails the phase loudly for retry, so wrong-layer verdicts never reach Map.
 
-### Publish content verification
+### Publish acknowledgement
 
-The artifact builder's `applied` report is derived from the diff the workflow carries to it, so comparing the report to the diff is circular — canary run 8 (2026-09-11) stamped provenance on a hollow build and every phase went green. The workflow therefore never stamps provenance itself: after the build lands it parks with `publish: verification-requested <commit> (build <agent_id|agent_id unobserved>)`. "Landed" requires positive evidence (canary 2026-09-15, task `1d692d91`): the build poll must have positively observed our build — a running build with the receipt `agent_id`, or a completed-build record matching it. Absence of a running build is not evidence our build ran; an unobserved "done" is an unknown outcome, parked fail-closed with an append-only `unknown` ledger entry — never parked as verification-requested. The parent protocol owns the independent content confirmation (parent-driven — see `docs/publish-verification.md`); the park message records the observed builder build identifier as `(build <agent_id|agent_id unobserved>)`, and the parent correlates the read-back's live build agent_id against it — a mismatch logs `publish: build-mismatch <commit> …`, stays parked, and is never stamped (parent-driven — see `docs/publish-verification.md` step 4b). The independent read-back step is currently unavailable: `artifact_inspect` was removed by the platform (2026-09-14) and no agent-callable replacement exists (`artifact.inspect` is malfunction diagnosis, not a read-back tool), so the parent cannot confirm content independently and tasks stay parked at verification-requested until a read-back path exists. QA's provenance check then enforces the stamp mechanically, so an unverified publish fails loudly in QA instead of passing silently.
+Eric's publication contract (2026-09-20): "If we hear that the artifact acknowledges our version, that's it. We don't verify against content."
+
+The workflow never stamps provenance itself, and it doesn't issue the edit: workflow children cannot call `artifact_edit` (the tool requires a parent-conversation session id they don't have), so publish is one-party. The workflow prepares — preflight, provenance base, checksummed diff with the deterministic per-attempt version — writes one issuer-stamped `publish-intent` ledger entry, and parks with `publish: publish-requested <commit> attempt=N`. The session-carrying tick worker (the only caller class that can reach `artifact_edit`) claims the intent via `scan-publish-intent`, re-derives the version, verifies the diff's sha256, issues the edit directly in its own turn, and records the issuer-stamped `submitted` entry plus `publish: edit-issued` via `record-intent-issuance`.
+
+The ack scan (`scan-ack-pending`) owns the verdict from there: the exact per-attempt version on the artifact's disk is the sole positive completion criterion (2026-09-20 REVIEW removed the circular builder-report positive path; builder reports carry explicit refusals only). Bounds: 30-minute window per attempt, 2-hour total budget from first issuance, no backoff (reissue immediately claimable), fresh version per attempt. Explicit refusal parks terminally (`publish: publish-refused`); budget exhaustion parks `publish: version-timeout`. Silence is unknown and fails closed. See `docs/publish-verification.md` for the full protocol. QA's provenance check then enforces the stamp mechanically, so an unacknowledged publish fails loudly in QA instead of passing silently.
+
+### When publish is stuck
+
+Two different workers move a publish forward, and they own different halves:
+
+- The **5-minute `crew-ack-scan`** is observation-only: it watches the
+  on-disk version receipt and, when a 30-minute window expires, stages the
+  next attempt's intent (fresh version, immediately claimable). It never
+  issues an edit.
+- The **15-minute poll tick** is the only half that issues: its
+  `scan-publish-intent` claims staged intents and its session-carrying
+  worker calls `artifact_edit`.
+
+If the poll tick is down, reissues stay staged and unclaimed — the task
+sits at `publish: edit-issued` (or `publish: publish-requested` for a
+staged reissue) with no new issuance, and eventually the 2-hour total
+budget expires and the ack scan writes the terminal
+`publish: version-timeout`. The timeout is honest: the budget is measured
+from the first issuance, not from the last successful observation, so a
+dead issuer cannot stretch it.
+
+**Runbook:** check the poll tick first — is `crew-poll-*` enabled and
+producing recent tick reports? If yes, the stuck task is a publish-path
+problem (diagnose via `docs/publish-verification.md`'s Operator recovery).
+If no, the ack scan's staged reissues are waiting on an issuer that isn't
+running — fix the poll tick, not the publish machine. In either case, do
+not hand-issue the edit: issuance belongs to the tick worker's
+claim-and-issue path, and an out-of-band edit has no ledger anchor for
+the ack scan to verify against.
 
 ## Identities
 
@@ -380,7 +416,7 @@ Each phase has an assigned identity — a character with a defined personality:
 | Build | **Wren** | Quietest one, trusts the plan |
 | Review | **Cass** | Fair but exacting — holds the spec as the contract |
 | Integrate | **Wren** | Merges the work into the integration target and pushes it (succeeds vacuously when the task branch is empty — runtime-state deliverable) |
-| Publish | **Wren** | Ships the merged code to the publish target (skipped when none). The workflow verifies the side effect mechanically — npm via registry version; artifact via an independent content read-back before the parent stamps provenance (see `docs/publish-verification.md`) — and fails closed if the worker's report and system state disagree |
+| Publish | **Wren** | Ships the merged code to the publish target (skipped when none). The workflow prepares the publish but never issues it — artifact issuance is tick-worker-owned (one-party, blocker 22); npm via registry version; artifact via the tick worker's direct edit plus an independent content read-back before the parent stamps provenance (see `docs/publish-verification.md`) — and fails closed on any unverified outcome |
 | QA | **Hazel** | Code-blind, persistent, wears persona costumes |
 | Reproduce | **Hazel** | Reproduces bugs before fixing |
 | Write | **Tate** | Docs writer, observational voice |

package/docs/publish-unknown-recovery.md

@@ -1,113 +1,28 @@
-# Publish-unknown recovery (blocker 15, 2026-09-18)
-
-When a standard/bugfix Publish parks with "Publish outcome unknown", the
-artifact-edit trigger went out fire-and-forget and no receipt came back —
-async was planned for, receipt-less was not. The unknown-recovery loop
-closes that gap without re-issuing blindly.
-
-## The note is the state machine
-
-Recovery state lives in the task's `note` events, keyed on machine-written
-`publish: <transition>` markers. Deterministic code (`lib/crew-api.js`) owns
-every transition; the cron tick (Step 4.4) is only the ferry between the
-deterministic steps. The initial park note is the workflow's
-"Publish outcome unknown …" note (no `publish:` marker — the scan matches it
-explicitly); every transition after that is machine-written.
-
-State diagram (latest `publish:` note wins; history is the retry budget):
-
-```
-"Publish outcome unknown" park
-  (< 30m) ──waiting──> scan: waiting (leave alone)
-  (>= 30m) ──scan──> publish: unknown-recovery-claimed <expiry>   (1h lease)
-       │
-       ├─ tick runs lib/classify-publish-absence.js, then
-       │  record-unknown-classification (CAS on the claim expiry):
-       │
-       ├─ verified ──────────> publish: verification-requested <commit>
-       │                        (content IS present; Step 4.5 verifies;
-       │                         ledger: unknown-resolved)
-       ├─ provably-dropped ──> publish: dropped <commit>
-       │                        (queues the retry protocol, next tick)
-       ├─ applied-not-built / ambiguous ──> publish: ambiguous <commit>
-       │                        (terminal; ledger: unknown-classified)
-       ├─ superseded ────────> publish: superseded <commit>  (terminal)
-       └─ deferred ──────────> (no note; the claim expires; the next scan
-                                re-claims and re-classifies)
-```
-
-Retry protocol (Step 4.4, for `publish: dropped` with a free budget):
-
-```
-publish: dropped
-  ── tick: HEAD == commit? no ──> publish: retry-superseded (terminal)
-  ── tick: acquire merge lock publish-retry:<task> (600s); held ──> stop, retry next tick
-  ── tick: re-read content in the lock (classifier)
-       ├─ not provably-dropped ──> record-retry-recheck routes it
-       │    (verified → verification-requested; ambiguous → terminal;
-       │     superseded → terminal; deferred → no-op)
-       └─ provably-dropped ──> publish: retry-intended <commit> <ts>
-            ── trigger (same child shape as the first attempt)
-            ├─ ARTIFACT_EDIT_REFUSED ──> publish: retry-refused (terminal)
-            └─ no refusal ──> publish: retry-issued <commit>
-                 ──> publish: verification-requested <commit> not-before=<ts+20m>
-                     (Step 4.5 skips not-before entries until the window passes)
-                 ──> one -retry1 ledger entry (best-effort)
-            ── release the merge lock (every path)
-```
-
-Crash recovery (fail closed, never re-trigger blind):
-
-- `publish: retry-intended` without `retry-issued` → the next scan mirrors
-  `verification-requested` with `not-before=intended+20m`. The trigger may
-  or may not have gone out; content verification is the arbiter.
-- `publish: retry-issued` without a mirrored request → the next scan writes
-  the missing mirror.
-- Exactly one retry per task, enforced from note history: the scan emits
-  `retry_due` only when no `publish: retry-issued` exists in the task's
-  history — including a retry for an earlier unknown attempt on a reworked
-  task. When the budget is spent, the drop is terminal: `publish: ambiguous`.
-
-## Commands
-
-- `scan-publish-unknown` — the cron scan (Step 4.5 of the old numbering).
-  Returns `{ waiting, due, retry_due, mirrored, skipped }`. `due` entries
-  ferry the classifier inputs: `commit`, `trigger_ts` (from the `submitted`
-  ledger entry — never a time window), `park_ts`, `slug`, `repo_path`,
-  `base` (provenance `source_commit`, else the empty tree), and
-  `claim_expiry` for the record CAS. `retry_due` entries ferry the retry
-  inputs (`commit`, `attempt`, `slug`, `repo_path`, `base`, `ledger_path`).
-- `record-unknown-classification --json '{task_id, claim_expiry, decision}'`
-  — routes the classifier's decision; CAS on the claim expiry (a stale tick
-  records nothing).
-- `record-retry-recheck --json '{task_id, decision}'` — routes the retry
-  protocol's in-lock content re-read; CAS on latest being `publish: dropped`.
-- `resolve-publish-unknown` — the manual one-shot for a single parked task
-  (unchanged; the audit-window contract, not the classifier).
-
-## Classifier (lib/classify-publish-absence.js)
-
-Decides, from the task's repo and the platform's on-disk state, whether the
-dropped edit is proven:
-
-- `verified` — the content IS present (the platform applied it; the receipt
-  was the only thing lost). Never re-issue.
-- `provably-dropped` — the old source is live AND the manifest shows no
-  build since the trigger. Only this decision may retry.
-- `applied-not-built` — the new source is live but no build ran (the
-  trigger reached the platform but the build didn't). Ambiguous outcome,
-  terminal: a retry would double-apply.
-- `ambiguous` — the content check is inconclusive. Never retry blind.
-- `deferred` — not yet quiesced; re-check next tick.
-- `superseded` — HEAD moved past the attempt's commit. Terminal.
-
-The classifier's verified path requires the CURRENT manifest to be a new
-build identity: `built_at` advanced past the trigger AND `content_sha256`
-differs from the pre-trigger baseline the workflow snapshots into the
-submitted ledger entry (design §1.9 — defeats a replayed manifest). When
-the baseline is unavailable the classifier falls back to the time-based
-advance check and notes it; the Step 4.5 verifier (`lib/verify-publish.js`)
-is the strict gate and fails closed without a baseline before stamping.
-Build-in-flight is checked twice bracketing the content read via manifest
-state change (no mtime heuristics), and the suite carries add-only and
-removal-only regression fixtures.
+# Publish-unknown recovery — RETIRED (0.14.6)
+
+The unknown-recovery machinery (the `publish: unknown-*` note state machine,
+`lib/classify-publish-absence.js`, `lib/retry-publish.js`,
+`lib/resolve-publish-unknown` flow) is RETIRED as of 0.14.6 (2026-09-20).
+
+It is subsumed by the version attempt loop: a 30-minute acknowledgement
+window per attempt, fresh per-attempt versions with immediate reissue (no
+backoff), a 2-hour total budget from first issuance, and `scan-ack-pending`
+as the sole verdict. There is no separate unknown state — silence within
+the window is unknown and fails closed; expiry re-issues with a fresh version;
+budget exhaustion parks `publish: version-timeout`.
+
+See `docs/publish-verification.md` for the current protocol.
+
+## Historical note
+
+The unknown path existed because the old two-party publish fired the
+artifact edit through a trigger child and got no receipt back — async was
+planned for, receipt-less was not. The one-party publish (2026-09-20,
+blocker 22) retired the trigger child: the workflow parks at intent, the
+session-carrying tick worker issues directly, and the ack scan attributes
+by exact version. The `publish: ambiguous`, `publish: retry-superseded`,
+`publish: retry-refused`, `publish: verified`, `publish: superseded`,
+`publish: verification-failed`, and `publish: intent-unverifiable` verbs
+remain in the vocabulary's legacy registry — the exact list in
+`lib/publish-note-vocabulary.js` (no wildcard families). Recognized so old
+note history skips as terminal, never written anew.