muse-crew 0.14.4 → 0.14.6

package/lib/crew-api.js

@@ -16,8 +16,9 @@
 //   create-project, update-project, delete-project, list-projects,
 //   get-project, kill-switch, get-config, update-config,
 //   set-provenance, get-provenance, acknowledge-poll,
-//   scan-verification-pending, resolve-publish-unknown,
-//   scan-publish-unknown, record-unknown-classification, record-retry-recheck,
+//   scan-publish-intent, scan-ack-pending,
+//   record-intent-issuance, record-intent-unissuable,
+//   record-builder-report, record-version-ack, record-publish-note,
 //   record-phase (composite), migrate (one-time import)
 //
 // Output is JSON on stdout. Errors are JSON on stderr.
@@ -36,7 +37,7 @@ import { classifySurface } from "./classify-surface.js";
 // never as unrecognized. Pin-adjacent: every runtime-relative dependency
 // of crew-api.js is pinned in the workflows' pinLifecycle (PIN_BASENAMES),
 // mechanically verified by tests/pin-closure.test.js.
-import { matchTerminalPublishNote, TERMINAL_NOTE_MEANINGS } from "./publish-note-vocabulary.js";
+import { matchTerminalPublishNote, TERMINAL_NOTE_MEANINGS, assertWritablePublishNote, assertCodeWritablePublishNote } from "./publish-note-vocabulary.js";
 
 // ---------------------------------------------------------------------------
 // Errors
@@ -1425,6 +1426,17 @@ commands["log-event"] = (db, args) => {
   if (!valid.includes(args.type)) throw usageError(`bad event type: ${args.type}.`);
   const message = (args.message ?? "").trim();
   if (message.length < 1 || message.length > 1000) throw usageError("message is required (1-1000 chars).");
+  // (2026-09-20 REVIEW) State-carrying `publish: <verb>` notes are a closed
+  // set: they are read by the ack/intent scans from the events table, so a
+  // prose log-event with type "note" would bypass the vocabulary guard.
+  // Route them through `record-publish-note` (prose) or the guarded code
+  // writer — never log-event.
+  if (args.type === "note" && /publish:\s*[a-z0-9-]+/.test(message)) {
+    throw usageError(
+      "state-carrying publish notes are closed-vocabulary (lib/publish-note-vocabulary.js) — " +
+      "write them via the `record-publish-note` command, not log-event."
+    );
+  }
   if (args.task_id) requireTask(db, args.task_id);
   const event = {
     id: uuid(), type: args.type, task_id: args.task_id ?? null,
@@ -1445,36 +1457,15 @@ commands["get-events"] = (db, args) => {
   return { events: rows.map(mapEvent) };
 };
 
-// Parent publish verification: scan + atomic claim + reconcile.
-//
-// Finds parked tasks whose latest parent publish note is
-// "publish: verification-requested" (the publisher parks instead of
-// stamping, per docs/publish-verification.md) with no terminal parent
-// verdict and no unexpired verification claim. Each returned task is
-// ATOMICALLY claimed by logging a "publish: verification-claimed"
-// note-event with a lease expiry, so two concurrent scanners (or a
-// retrying tick) cannot start a second verification for the same task.
-// The claim is a note, not a state change: the task stays parked, so the
-// dispatcher never dispatches QA mid-verification.
+// Active-release resolution helpers (2026-09-18, room #15).
 //
-// Also reconciles the verified-but-still-parked gap: a parked task whose
-// latest parent verdict is "publish: verified" is re-queued to in_progress
-// (the verdict was recorded but the re-queue was lost to a crash).
-// Failure verdicts are left parked for human attention (fail-closed).
-//
-// Returns { to_verify: [...], reconciled: [...] }.
-// Each to_verify entry: { task_id, commit, build_agent_id, project_id,
-// repo_path, deploy_slug, crew_release, claim_expires_at }.
-//
-// crew_release is resolved through the crew home's `current` symlink (the
-// immutable active release the release manager maintains) and cross-checked
-// against this code's own realpath (the release it is actually running
-// from). Unresolvable or disputed => throw fail-closed BEFORE the claim
-// transaction: provenance is never stamped with an unknown release.
-//
-// Active-release resolution is split in two (room #15, 2026-09-18):
 // resolveActiveReleaseName (symlink only — for writers) below, and
 // resolveActiveRelease (symlink + self-path cross-check — for verifiers).
+// The old "Parent publish verification: scan + atomic claim + reconcile"
+// block (scan-verification-pending, publish: verification-requested /
+// verification-claimed / verified) was deleted with the 0.14.6
+// version-acknowledgement rewrite — these helpers now serve the ack scan's
+// provenance writers only.
 function resolveActiveReleaseName(crewHome) {
   let linkTarget;
   try {
@@ -1486,240 +1477,45 @@ function resolveActiveReleaseName(crewHome) {
   }
   return basename(resolve(crewHome, linkTarget));
 }
-// The strict resolver for verifiers (scan-verification-pending): the symlink
-// answer PLUS the self-path cross-check — the running code must provably be
-// the active release's own crew-api.js before it stamps verification claims.
-// Stale cron bodies and mid-deploy swaps throw fail-closed here.
+// The strict resolver for provenance writers (scan-ack-pending and
+// record-version-ack): the symlink answer PLUS the self-path cross-check —
+// the running code must provably be the active release's own crew-api.js
+// before it stamps acknowledgement claims. Stale cron bodies and mid-deploy
+// swaps throw fail-closed here.
 function resolveActiveRelease(crewHome) {
   const activeRelease = resolveActiveReleaseName(crewHome);
   const selfPath = new URL(import.meta.url).pathname;
   const selfMatch = selfPath.match(/releases\/([^/]+)\/lib\/crew-api\.js$/);
   if (!selfMatch) {
     throw usageError(
-      `scan-verification-pending: running code is not inside a releases/<name>/lib path (${selfPath}). Refusing to verify.`
+      `ack/intent scan: running code is not inside a releases/<name>/lib path (${selfPath}). Refusing to stamp.`
     );
   }
   if (selfMatch[1] !== activeRelease) {
     throw usageError(
-      `scan-verification-pending: running release ${selfMatch[1]} != active release ${activeRelease} (stale cron body or mid-deploy). Refusing to verify.`
+      `ack/intent scan: running release ${selfMatch[1]} != active release ${activeRelease} (stale cron body or mid-deploy). Refusing to stamp.`
     );
   }
   return activeRelease;
 }
-commands["scan-verification-pending"] = (db, args, ctx) => {
-  const CLAIM_LEASE_MS = 60 * 60 * 1000; // 1 hour
-  const nowMs = Date.now();
-  const claimExpiry = new Date(nowMs + CLAIM_LEASE_MS).toISOString();
-  const releaseName = resolveActiveRelease(ctx.crewHome);
-
-  const parked = db.prepare(
-    `SELECT t.id AS task_id, t.project AS project_id,
-            p.repo_path AS repo_path, p.deploy_slug AS deploy_slug
-     FROM tasks t LEFT JOIN projects p ON p.id = t.project
-     WHERE t.state = 'parked'`
-  ).all();
-
-  const toVerify = [];
-  const reconciled = [];
-  const deferred = []; // not-before in the future (unknown-recovery retry) — claimed by a later tick
-
-  db.exec("BEGIN");
-  try {
-    for (const row of parked) {
-      const notes = db.prepare(
-        `SELECT message, timestamp FROM events
-         WHERE task_id = ? AND type = 'note' AND message LIKE '%publish:%'
-         ORDER BY timestamp DESC LIMIT 20`
-      ).all(row.task_id);
-      if (notes.length === 0) continue;
-      const latest = notes[0].message;
-
-      // Reconcile first: verdict recorded but the re-queue was lost to a
-      // crash (verified-but-still-parked). Failure verdicts stay parked.
-      // Contained-string matching: the workflow's parkTask prepends
-      // "Parked: " to the reason, so a verification request is stored as
-      // "Parked: publish: verification-requested ..." (observed 2026-09-14).
-      // Prefix anchors would never match; see tests/verify-publish.test.js.
-      if (latest.includes("publish: verified")) {
-        db.prepare("UPDATE tasks SET state = 'in_progress', updated_at = ? WHERE id = ?")
-          .run(now(), row.task_id);
-        db.prepare(
-          `INSERT INTO events (id, type, task_id, identity, message, timestamp)
-           VALUES (?, 'note', ?, NULL, ?, ?)`
-        ).run(uuid(), row.task_id,
-          "publish: reconciled verified-but-parked -> in_progress (re-queue lost to a crash)",
-          now());
-        reconciled.push({ task_id: row.task_id });
-        continue;
-      }
-
-      // Terminal parent verdicts (anything the parent decided, except a
-      // fresh request, a procedural error, or an active claim) — never re-verify.
-      const isRequest = latest.includes("publish: verification-requested");
-      const isClaim = latest.includes("publish: verification-claimed");
-      // Procedural errors (worker botched the procedure, not a content
-      // failure) are retryable — treat like a fresh request. Content
-      // failures (verification-failed) stay terminal.
-      const isProceduralError = latest.includes("publish: verification-procedural-error");
-      if (!isRequest && !isClaim && !isProceduralError) continue; // failed / blocked / mismatch: terminal, fail-closed
-
-      if (isClaim) {
-        // Unexpired claim -> another verifier owns it. Expired -> re-claim below.
-        const m = latest.match(/publish: verification-claimed (\S+)/);
-        if (m && Date.parse(m[1]) > nowMs) continue;
-      }
-
-      // Candidate: find the original verification-requested note to extract
-      // the commit and build agent id (the latest note may be an expired claim
-      // or a procedural error).
-      const req = notes.find((n) => n.message.includes("publish: verification-requested"));
-      if (!req) continue;
-      const commitMatch = req.message.match(/verification-requested ([0-9a-f]{40})/);
-      // Fallback: procedural error note carries the commit too.
-      const procMatch = !commitMatch ? latest.match(/verification-procedural-error ([0-9a-f]{40})/) : null;
-      const commit = commitMatch ? commitMatch[1] : (procMatch ? procMatch[1] : null);
-      const buildMatch = req.message.match(/\(build ([0-9a-f-]{36})\)/);
-      // Attempt binding (2026-09-18, blocker 4): the verifier must select the
-      // submitted ledger entry for the exact (task_id, commit, attempt) —
-      // not just (task_id, commit) — or a retry's trigger is indistinguishable
-      // from the original's.
-      const attemptMatch = req.message.match(/attempt=([^\s]+)/);
-      const attempt = attemptMatch ? attemptMatch[1] : null;
-      if (!commit) continue; // malformed request: cannot verify mechanically, leave parked
-      // not-before (2026-09-18, blocker 15): the unknown-recovery retry
-      // protocol mirrors verification-requested with a not-before so the
-      // re-triggered build gets 20 minutes to land before the verification
-      // scan may claim it. Absent = verify immediately (backward compatible).
-      const nbMatch = req.message.match(/not-before=([0-9T:.\-Z+]+)/);
-      const notBeforeMs = nbMatch ? Date.parse(nbMatch[1]) : NaN;
-      if (notBeforeMs > nowMs) {
-        deferred.push({ task_id: row.task_id, commit, not_before: nbMatch[1] });
-        continue;
-      }
-      db.prepare(
-        `INSERT INTO events (id, type, task_id, identity, message, timestamp)
-         VALUES (?, 'note', ?, NULL, ?, ?)`
-      ).run(uuid(), row.task_id, `publish: verification-claimed ${claimExpiry}`, now());
-      toVerify.push({
-        task_id: row.task_id,
-        commit: commit,
-        attempt: attempt,
-        build_agent_id: buildMatch ? buildMatch[1] : null,
-        project_id: row.project_id,
-        repo_path: row.repo_path,
-        deploy_slug: row.deploy_slug,
-        crew_release: releaseName,
-        claim_expires_at: claimExpiry,
-      });
-    }
-    db.exec("COMMIT");
-  } catch (e) { db.exec("ROLLBACK"); throw e; }
-  return { to_verify: toVerify, reconciled, deferred };
-};
-
-// Recovery contract for publish attempts parked with an UNKNOWN outcome
-// (2026-09-14). The structured-output fallback parked the task because no
-// build could be observed — but the edit may still have gone through (the
-// in-flight-only fallback could not see a completed build; fixed
-// in-workflow the same day with the durable audit-dir check). When durable
-// evidence later shows the build DID complete — a platform audit directory
-// created inside the publish window (between Integrate completion and the
-// park event) — this action routes the task to the parent's independent
-// content verification WITHOUT re-issuing the edit and WITHOUT stamping
-// provenance. The original unknown ledger entry and park event are
-// preserved; the resolution is appended to the ledger and the event log.
-// The parent's read-back (docs/publish-verification.md) remains the real
-// verification and can still fail terminally. Never: blind retry, manual
-// stamp, silent state change.
 // ---------------------------------------------------------------------------
-// Shared publish-unknown attempt derivation (2026-09-18, blocker 15).
+// Publish helpers (0.14.6 version-acknowledgement architecture).
 //
-// The publish-unknown recovery state machine (scan-publish-unknown, the
-// manual resolve-publish-unknown, record-unknown-classification) all start
-// from the same durable anchors: the parked task, its project's deploy_slug,
-// and the latest publish ledger entry for the task, which must be outcome
-// "unknown" with a usable commit hash. This helper reads those anchors once
-// so the three commands cannot drift apart.
-//
-// Returns { ok: true, task, slug, repoPath, projectId, commit, attempt,
-//            unknownEntry, unknownTs, ledgerPath, entries }
-// or { ok: false, reason } — the reason strings are the manual command's
-// exact messages (pinned by tests/resolve-publish-unknown.test.js).
+// Publication is a handoff with strong suggestions: the workflow stages a
+// checksummed diff carrying a per-attempt version; the session-carrying tick
+// worker issues it via artifact_edit; acknowledgement is the EXACT version
+// string observed on the artifact's disk or in a version-echoing builder
+// report. Eric's contract: "If we hear that the artifact acknowledges our
+// version, that's it. We don't verify against content." Provenance certifies
+// that an issuance request was ACKNOWLEDGED — never that bytes matched.
 // ---------------------------------------------------------------------------
-function derivePublishUnknownAttempt(db, crewHome, taskId, requireLatest = false) {
-  const task = db.prepare("SELECT id, state, project FROM tasks WHERE id = ?").get(taskId);
-  if (!task) return { ok: false, reason: "unknown task" };
-  if (task.state !== "parked") {
-    return { ok: false, reason: `task is not parked (state=${task.state})` };
-  }
-  const project = db.prepare("SELECT id, deploy_slug, repo_path FROM projects WHERE id = ?").get(task.project);
-  const slug = project && project.deploy_slug;
-  if (!slug) return { ok: false, reason: "project has no deploy_slug" };
-  const ledgerPath = join(crewHome, ".publish-ledger", slug + ".jsonl");
-  let entries = [];
-  try {
-    entries = readFileSync(ledgerPath, "utf8").split("\n")
-      .filter((l) => l.trim().length > 0)
-      .map((l) => JSON.parse(l))
-      .filter((e) => e.task_id === taskId);
-  } catch (e) {
-    return { ok: false, reason: `cannot read publish ledger: ${e.message}` };
-  }
-  if (entries.length === 0) return { ok: false, reason: "no publish ledger entries for this task" };
-  // 2026-09-18, should-fix 6: for crash recovery (requireLatest=false),
-  // derive by the most recent unknown attempt, not the ledger tail. Retry
-  // or observability entries appended after the unknown must not break
-  // recovery. For manual resolve (requireLatest=true), the unknown must be
-  // the latest entry.
-  let unknownEntry = null;
-  if (requireLatest) {
-    // Strict mode: latest entry must be unknown.
-    const latest = entries[entries.length - 1];
-    if (latest.outcome === "unknown-resolved") {
-      return { ok: false, reason: "already resolved (unknown-resolved ledger entry present)" };
-    }
-    if (latest.outcome !== "unknown") {
-      return { ok: false, reason: `latest ledger outcome is '${latest.outcome}', not unknown` };
-    }
-    unknownEntry = latest;
-  } else {
-    // Lenient mode: find the most recent unknown, skipping later non-unknown
-    // entries (retry, observability). If an unknown-resolved follows the
-    // unknown, the attempt is resolved.
-    for (let i = entries.length - 1; i >= 0; i--) {
-      const e = entries[i];
-      if (e.outcome === "unknown-resolved") {
-        return { ok: false, reason: "already resolved (unknown-resolved ledger entry present)" };
-      }
-      if (e.outcome === "unknown") {
-        unknownEntry = e;
-        break;
-      }
-    }
-    if (!unknownEntry) {
-      return { ok: false, reason: "no unresolved unknown ledger entry for this task" };
-    }
-  }
-  if (!unknownEntry.commit || !/^[0-9a-f]{40}$/.test(unknownEntry.commit)) {
-    return { ok: false, reason: "unknown ledger entry carries no usable commit hash" };
-  }
-  return {
-    ok: true, task, slug, repoPath: (project && project.repo_path) || null, projectId: project.id,
-    commit: unknownEntry.commit, attempt: unknownEntry.attempt || null,
-    unknownEntry, unknownTs: unknownEntry.ts || null, ledgerPath, entries,
-  };
-}
 
-// The unknown-recovery state machine reads two note shapes: the machine's
-// own "publish: <transition>" notes, and the workflow's initial
-// "Publish outcome unknown …" park note — which carries no "publish:"
-// marker (composeUnattributedParkReason), so the prefilter must match it
-// explicitly. LIKE is ASCII case-insensitive in SQLite.
-const PUBLISH_NOTE_PREFILTER =
-  `(message LIKE '%publish:%' OR message LIKE '%publish outcome unknown%')`;
+// The ack/intent scans read the note journal through this prefilter. LIKE
+// is ASCII case-insensitive in SQLite.
+const PUBLISH_NOTE_PREFILTER = `(message LIKE '%publish:%')`;
 
-// Latest publish: note for a task (the unknown-recovery state machine's
-// state), or null when the task has no publish notes yet.
+// Latest publish: note for a task (the publish state machines' state), or
+// null when the task has no publish notes yet.
 function latestPublishNote(db, taskId) {
   return db.prepare(
     `SELECT message, timestamp FROM events
@@ -1728,45 +1524,6 @@ function latestPublishNote(db, taskId) {
   ).get(taskId) || null;
 }
 
-// The trigger anchor for an unknown attempt: the issuance-kind "submitted"
-// ledger entry for the same attempt (the trigger issuance), falling back to
-// the oldest by ts for pre-D1 ledgers. The issuance entry binds the trigger
-// instant — verify-publish.js and the decision doc prefer it the same way;
-// binding newest misclassifies builds that complete between issuance and
-// receipt — binding newest misclassifies builds that complete between
-// issuance and receipt (see docs/reviews/critic-0143.md findings A2/R2/O4).
-// Returns the entry or null. A null means the trigger
-// instant is unknowable (or the trigger was never issued) — classification
-// cannot run; the task stays parked for human attention. Fail closed, never
-// guess the anchor.
-function findTriggerEntry(entries, commit, attempt) {
-  // D1 (2026-09-19; entry_kind cut 2026-09-20): the anchor is the OLDEST
-  // submitted entry by ts and the bound instant is its issued_at || ts —
-  // the same fallback verify-publish.js uses. The retired entry_kind
-  // preference filter could never change the bound anchor (issuance and
-  // receipt entries carried the same captured issued_at), so oldest-by-ts
-  // is the whole mechanism.
-  const matches = [];
-  for (let i = 0; i < entries.length; i++) {
-    const e = entries[i];
-    if (e.outcome === "submitted" && e.commit === commit &&
-        (e.attempt || null) === (attempt || null)) {
-      matches.push(e);
-    }
-  }
-  matches.sort((a, b) => (a.ts || "").localeCompare(b.ts || ""));
-  return matches[0] || null;
-}
-
-// The unknown ledger entry's detail says whether the trigger went out.
-// Unknown parks from preflight/toolcheck inconclusives never issued the
-// trigger ("the trigger was NOT issued") — there is no dropped edit to
-// recover, so the unknown-recovery machine must not classify or retry them.
-function triggerWasIssued(unknownEntry) {
-  const detail = String((unknownEntry && unknownEntry.detail) || "");
-  return !/trigger was NOT issued|no trigger issued/i.test(detail);
-}
-
 function writePublishNote(db, taskId, message, ts) {
   db.prepare(
     `INSERT INTO events (id, type, task_id, identity, message, timestamp)
@@ -1774,199 +1531,229 @@ function writePublishNote(db, taskId, message, ts) {
   ).run(uuid(), taskId, message, ts || now());
 }
 
-commands["resolve-publish-unknown"] = (db, args, ctx) => {
-  const taskId = args.task_id;
-  if (!taskId) throw usageError("task_id is required.");
-  requireTask(db, taskId);
-  // Shared attempt anchors (2026-09-18, blocker 15): the task must be
-  // parked, the project must carry a deploy_slug, and the latest publish
-  // ledger entry for the task must be outcome "unknown" with a usable
-  // commit. derivePublishUnknownAttempt keeps the exact reason strings the
-  // recovery contract pins (tests/resolve-publish-unknown.test.js).
-  // requireLatest=true: resolve is a manual action on the current state —
-  // a later non-unknown entry means the state has moved on.
-  const derived = derivePublishUnknownAttempt(db, ctx.crewHome, taskId, true);
-  if (!derived.ok) return { resolved: false, reason: derived.reason };
-  const slug = derived.slug;
-  const ledgerPath = derived.ledgerPath;
-  const latest = derived.unknownEntry;
-
-  // The publish window: Integrate completion -> the unknown-outcome park.
-  // Nothing else touches the artifact during Publish, so an audit dir
-  // created inside this window belongs to this publish attempt.
-  const events = db.prepare(
-    "SELECT type, message, timestamp FROM events WHERE task_id = ? ORDER BY timestamp ASC"
-  ).all(taskId);
-  const integrateDone = [...events].reverse().find((e) =>
-    e.type === "completed" && /integrate completed/i.test(e.message || ""));
-  const parkEvent = [...events].reverse().find((e) =>
-    e.type === "note" && (e.message || "").includes("Publish outcome unknown"));
-  if (!integrateDone || !parkEvent) {
-    return { resolved: false, reason: "cannot determine publish window (missing integrate-completion or unknown-outcome park event)" };
-  }
-  const winStart = Date.parse(integrateDone.timestamp);
-  const winEnd = Date.parse(parkEvent.timestamp);
-  if (!(winStart < winEnd)) {
-    return { resolved: false, reason: "publish window is empty or inverted" };
-  }
-
-  // Audit dirs are named <UTC-timestamp>-<id>; the timestamp is the build's.
-  const auditsDir = join(homedir(), "workspace", "ts-spaces", slug, "audits");
-  let evidenceDirs = [];
+// 0.14.6 §1.1 — the per-attempt publish version: "<commit>:<attempt>".
+// A plain version number, not a hash (2026-09-20: the sha256 "nonce"
+// defended against a forger that doesn't exist — the builder's failure mode
+// is omission, never forging our receipts — while the artifact's real failure
+// mode, an unfaithful carrier, defeats a hash and a counter identically. We
+// own the code, so we count our own attempts; we don't own the artifact, so
+// verification stays observation of its state, never its attestation).
+// Deterministic: no wall clock, no randomness. Byte-identical to
+// lib/compute-publish-diff.js's derivation (which synthesizes the
+// `.crew-publish-version-<task_id>` receipt into the staged diff), so the
+// workflow's staging, the tick's regeneration, and these scans all agree on
+// the string. The commit binds the version to the exact code (a stale receipt
+// from an earlier commit can never equal a fresh version); the attempt
+// counts re-issues of that commit. `attempt` is the 1-based publish attempt;
+// String(attempt) matches the argv string the diff script concatenates.
+function derivePublishVersion(commit, attempt) {
+  return commit + ":" + String(attempt);
+}
+
+// A well-formed publish version: "<40-hex commit>:<positive-integer attempt>".
+function isPublishVersion(s) {
+  return typeof s === "string" && /^[0-9a-f]{40}:[1-9][0-9]*$/.test(s);
+}
+
+// 0.14.6 §1.5 — the closed publish-note writer. Every state-carrying
+// publish-note write by deterministic code in this file goes through
+// writeGuardedPublishNote, which asserts the verb against the code-writable
+// registry (transitional + current terminals) in
+// lib/publish-note-vocabulary.js before writing. Tick prose mints notes
+// only through the `record-publish-note` command, which asserts the
+// prose-writable registry (transitional only — prose can never mint a
+// terminal state). A registry violation is a caller bug (usage).
+function writeGuardedPublishNote(db, taskId, message, ts) {
   try {
-    evidenceDirs = readdirSync(auditsDir).filter((name) => {
-      const m = /^(\d{4})-(\d{2})-(\d{2})T(\d{2})-(\d{2})-(\d{2})Z-/.exec(name);
-      if (!m) return false;
-      const t = Date.parse(`${m[1]}-${m[2]}-${m[3]}T${m[4]}:${m[5]}:${m[6]}Z`);
-      return t > winStart && t <= winEnd;
-    }).sort();
+    assertCodeWritablePublishNote(message);
   } catch (e) {
-    return { resolved: false, reason: `cannot list audit dirs: ${e.message}` };
-  }
-  if (evidenceDirs.length === 0) {
-    return { resolved: false, reason: "no audit build completed inside the publish window — still unknown" };
+    throw usageError(e.message);
   }
-  // (N3) Ambiguity guard: multiple builds in the recovery window have the
-  // same attribution ambiguity as the workflow's immediate verdict — no
-  // single dir can be attributed to this attempt, so resolution stays
-  // unknown. Only when exactly one dir remains is evidenceDirs[0] safe.
-  if (evidenceDirs.length > 1) {
-    return { resolved: false, reason: `audit-dir ambiguity: ${evidenceDirs.length} audit dirs inside the publish window — still unknown` };
-  }
-  const evidenceDir = evidenceDirs[0];
+  writePublishNote(db, taskId, message, ts);
+}
 
-  // Corroboration, observation only: the audit harness's own verdict.
-  let auditOk = null;
+// The publish ledger is a per-slug JSONL file under the crew home
+// ($CREW_HOME/.publish-ledger/<slug>.jsonl): best-effort observability plus
+// the durable anchors the scans read (intent entries, submitted entries).
+function readTaskLedgerEntries(crewHome, slug, taskId) {
+  const ledgerPath = join(crewHome, ".publish-ledger", slug + ".jsonl");
   try {
-    auditOk = JSON.parse(readFileSync(join(auditsDir, evidenceDir, "report.json"), "utf8")).ok === true;
-  } catch (e) { auditOk = null; }
+    return {
+      ok: true, ledgerPath,
+      entries: readFileSync(ledgerPath, "utf8").split("\n")
+        .filter((l) => l.trim().length > 0)
+        .map((l) => JSON.parse(l))
+        .filter((e) => e.task_id === taskId),
+    };
+  } catch (e) {
+    return { ok: false, ledgerPath, reason: `cannot read publish ledger: ${e.message}` };
+  }
+}
 
-  const ts = now();
-  // The verification-requested note must sort strictly after the
-  // unknown-resolved note: scan-verification-pending reads the LATEST
-  // publish: note, and equal timestamps would leave the order undefined.
-  const tsLater = new Date(Date.parse(ts) + 1000).toISOString();
-  db.exec("BEGIN");
-  try {
-    db.prepare(
-      "INSERT INTO events (id, type, task_id, identity, message, timestamp) VALUES (?, 'note', ?, NULL, ?, ?)"
-    ).run(uuid(), taskId,
-      `publish: unknown-resolved ${latest.commit} (audit ${evidenceDir}, report ok=${auditOk}) — durable build evidence inside the publish window; routing to parent content verification. No re-trigger issued, no provenance stamped, original unknown outcome preserved.`,
-      ts);
-    // Mirror the workflow's verification-requested park note so
-    // scan-verification-pending claims it on the next tick.
-    db.prepare(
-      "INSERT INTO events (id, type, task_id, identity, message, timestamp) VALUES (?, 'note', ?, NULL, ?, ?)"
-    ).run(uuid(), taskId,
-      `Parked: publish: verification-requested ${latest.commit} (build agent_id unobserved) — recovered from publish-unknown via resolve-publish-unknown; durable evidence ${evidenceDir}. waiting on the manual read-back in docs/publish-verification.md.`,
-      tsLater);
-    db.prepare("UPDATE tasks SET state = 'parked', updated_at = ? WHERE id = ?").run(tsLater, taskId);
-    db.exec("COMMIT");
-  } catch (e) { db.exec("ROLLBACK"); throw e; }
+// Latest publish-intent ledger entry for (task, commit, publish_attempt):
+// the issuance anchor. The workflow writes attempt 1 (issuer "workflow");
+// the ack scan's re-issue writes attempts 2+ (issuer "tick-worker").
+function findIntentEntry(entries, commit, publishAttempt) {
+  const matches = entries.filter((e) => e.outcome === "publish-intent" &&
+    e.commit === commit && (e.publish_attempt || null) === (publishAttempt || null));
+  matches.sort((a, b) => (a.ts || "").localeCompare(b.ts || ""));
+  return matches[matches.length - 1] || null;
+}
 
-  // Append-only audit trail: the resolution lands in the ledger next to the
-  // original unknown entry (which is never rewritten).
-  try {
-    appendFileSync(ledgerPath, JSON.stringify({
-      ts: new Date(ts).toISOString(),
-      task_id: taskId,
-      workflow: latest.workflow || "unknown",
-      slug,
-      commit: latest.commit,
-      attempt: latest.attempt,
-      agent_id: null,
-      applied_report: null,
-      outcome: "unknown-resolved",
-      detail: `durable build evidence ${evidenceDir} (audit report ok=${auditOk}) inside publish window; routed to parent verification without re-trigger`,
-    }) + "\n");
-  } catch (e) { /* best-effort observability */ }
-
-  return { resolved: true, task_id: taskId, commit: latest.commit, evidence_dir: evidenceDir, audit_report_ok: auditOk };
-};
+// Issuer-written "submitted" entries for (task, commit): the issuance
+// record. Only the session-carrying tick worker performs issuance, and it
+// stamps its writes issuer="tick-worker" — anything else is a phantom claim
+// and never binds. Oldest first (D1: the bound instant is issued_at || ts).
+function findSubmittedEntries(entries, commit) {
+  const matches = entries.filter((e) => e.outcome === "submitted" &&
+    e.issuer === "tick-worker" && e.commit === commit);
+  matches.sort((a, b) => (a.ts || "").localeCompare(b.ts || ""));
+  return matches;
+}
 
-// Cron unknown-recovery scan (2026-09-18, blocker 15). Runs in cron Step 4.5
-// BEFORE scan-verification-pending, so a task the classifier verifies (or
-// the retry protocol re-triggers) is claimed by the verification scan on
-// the same tick.
-//
-// The note is the state machine; this command is the only writer of its
-// transitions. The tick ferries classifier decisions and retry steps — code
-// decides every state change. One atomic transaction per scan: claims,
-// mirrors, and terminal notes all land together or not at all.
+// 0.14.6 §1.3 — record a positive version acknowledgement: stamp provenance
+// (certifying the issuance REQUEST was acknowledged — never byte equality),
+// write the terminal `publish: version-acknowledged` note, and re-queue the
+// task. Shared by scan-ack-pending and the record-version-ack command (the
+// re-claim path). The strict release cross-check refuses to stamp from a
+// stale cron body or a mid-deploy swap — fail closed.
+function recordVersionAck(db, ctx, { taskId, projectId, commit, version, via }) {
+  const releaseName = resolveActiveRelease(ctx.crewHome);
+  const ts = now();
+  stampProvenance(db, {
+    project_id: projectId, source_commit: commit, crew_release: releaseName,
+    published_at: ts, task_id: taskId,
+  });
+  writeGuardedPublishNote(db, taskId,
+    `publish: version-acknowledged ${commit} via=${via} — the artifact acknowledged this attempt's exact version ` +
+    `(${via === "disk" ? "on-disk receipt .crew-publish-version" : "version-echoing builder report"}); ` +
+    `provenance stamped for crew release ${releaseName} (certifies the issuance request was acknowledged, not byte equality). Task re-queued.`,
+    ts);
+  db.prepare("UPDATE tasks SET state = 'in_progress', updated_at = ? WHERE id = ?").run(ts, taskId);
+  return { ok: true, task_id: taskId, commit, version, via, crew_release: releaseName };
+}
+
+// The version on a submitted entry must be the deterministic one for its
+// (task, commit, publish_attempt) — the ledger is advisory; the derivation
+// is the contract. Returns the entry's publish_attempt or null.
+function verifiedSubmittedAttempt(taskId, entry) {
+  const pa = entry.publish_attempt;
+  if (!Number.isInteger(pa) || pa < 1) return null;
+  if (!/^[0-9a-f]{40}$/.test(entry.commit || "")) return null;
+  if (!isPublishVersion(entry.version)) return null;
+  if (entry.version !== derivePublishVersion(entry.commit, pa)) return null;
+  return pa;
+}
+// Publish-intent scan (0.14.6 §1.2/§1.3): claims parked publish intents for
+// the session-carrying tick worker's direct issuance. One atomic
+// transaction per scan: claims and terminal notes all land together or not
+// at all.
 //
 //   latest publish: note                      this scan
-//   "Publish outcome unknown…"                now < park+30m → waiting (no claim, log only)
-//                                             else → atomic 1h claim → due, with classifier inputs
-//   "publish: unknown-recovery-claimed …"     unexpired → skip (a tick owns it)
-//                                             expired → re-claim → due (the tick died mid-classification)
-//   "publish: dropped …"                      budget spent (retry-issued in history) → terminal
-//                                               publish: ambiguous … retry-budget-exhausted
-//                                             else → retry_due (the tick runs the retry protocol)
-//   "publish: retry-intended …" w/o            → mirror publish: verification-requested
-//     "publish: retry-issued"                   (not-before = intended+20m); NEVER re-trigger here
-//   "publish: retry-issued" w/o mirrored      → mirror the missing publish: verification-requested
-//     verification-requested
-//   terminal notes (the closed registry in   → terminal; skipped with the
-//     lib/publish-note-vocabulary.js — the     reason named, never
-//     scan names the recognized note)          "unrecognized"
-//   "publish: verification-requested"         → already routed; ignored (the verification scan owns it)
+//   "publish: publish-requested …"            → atomic 1h claim → intent bucket:
+//                                             the tick issues the edit directly
+//                                             in its own turn (no child).
+//   "publish: publish-intent-claimed …"       → unexpired: skip (a tick owns it);
+//                                             expired: re-claim → intent (the tick
+//                                             checks the dead attempt's version
+//                                             receipt before issuing — never
+//                                             blindly re-issues).
+//   "publish: edit-issued …"                  → already routed; ignored (the ack
+//                                             scan owns it from here).
+//   terminal notes (the closed registry)      → terminal; skipped with the
+//                                             reason named, never "unrecognized".
 //
-// Unknown parks whose trigger was never issued (preflight/toolcheck
-// inconclusives) or whose submitted ledger entry is missing have no
-// knowable trigger anchor: the scan leaves them parked for human attention.
-// Fail closed, never guess.
-commands["scan-publish-unknown"] = (db, args, ctx) => {
+// The tick never issues without a claim, and a claim never outlives its
+// lease. Fail closed, never guess.
+commands["scan-publish-intent"] = (db, args, ctx) => {
   const crewHome = ctx.crewHome;
   const nowMs = Date.now();
-  const quiesceMs = 30 * 60 * 1000;    // design §1.4e: never trust a read before the park is 30m old
   const claimLeaseMs = 60 * 60 * 1000;  // one hour — survives a dead tick, does not block the next one
-  const retrySettleMs = 20 * 60 * 1000; // a re-triggered build gets 20m before verification may claim it
   const EMPTY_TREE = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
 
-  const waiting = [];
-  const due = [];
-  const retryDue = [];
-  const mirrored = [];
+  const intent = [];
   const skipped = [];
-
-  const skip = (taskId, state, reason) => skipped.push({ task_id: taskId, state, ...(reason ? { reason } : {}) });
-
-  // Shared tail of the unknown branches: derive anchors, check the trigger
-  // went out, find the trigger anchor, write the atomic claim, emit the
-  // classifier inputs. parkNote is the /publish outcome unknown/i note.
-  const claimForClassification = (taskId, notes, parkNote) => {
-    const derived = derivePublishUnknownAttempt(db, crewHome, taskId);
-    if (!derived.ok) { skip(taskId, "derive-failed", derived.reason); return; }
-    if (!triggerWasIssued(derived.unknownEntry)) {
-      skip(taskId, "trigger-never-issued",
-        "the unknown ledger entry records that the trigger was never issued — no dropped edit to recover; stays parked for human attention");
+  const requeued = []; // stale-base intents re-queued to the workflow's Publish for re-preparation
+
+  const skip = (taskId, reason, detail) =>
+    skipped.push({ task_id: taskId, ...(reason ? { reason } : {}), ...(detail ? { detail } : {}) });
+
+  // One-party publish intent: the workflow parked at intent — the merged
+  // change is staged as a checksummed diff carrying the per-attempt version,
+  // and issuance belongs to the session-carrying tick worker. The intent
+  // ledger entry (outcome "publish-intent") is the durable anchor: the tick
+  // verifies the staged diff's sha256 against it and regenerates from
+  // base..commit when the file is missing. reclaimed=true when a previous
+  // tick's claim expired: the tick checks the dead attempt's version receipt
+  // before issuing, because the dead tick may have issued and died before
+  // recording it — a re-claim never blindly re-issues.
+  const claimForIntent = (taskId, intentNote, reclaimed, anchorNote) => {
+    const m = intentNote.message.match(/publish:\s*publish-requested\s+([0-9a-f]{40})\s+attempt=(\d+)/);
+    if (!m) {
+      skip(taskId, "intent-note-unparseable",
+        "the publish-requested note carries no commit hash + attempt=N — stays parked for human attention");
       return;
     }
-    const trigger = findTriggerEntry(derived.entries, derived.commit, derived.attempt);
-    // D1 (2026-09-19): the anchor instant is the trigger-issuance instant
-    // (issued_at), not the ledger-write instant (ts) — issued_at || ts.
-    if (!trigger || !(trigger.issued_at || trigger.ts)) {
-      skip(taskId, "no-trigger-anchor",
-        "no submitted ledger entry for this attempt — the trigger instant is unknowable; stays parked for human attention");
+    const commit = m[1];
+    const publishAttempt = parseInt(m[2], 10);
+    const task = db.prepare("SELECT id, state, project FROM tasks WHERE id = ?").get(taskId);
+    if (!task || task.state !== "parked") {
+      skip(taskId, "not-parked",
+        `task is not parked (state=${task && task.state}) — the intent claim requires a parked task`);
       return;
     }
-    // Atomic claim: the note IS the claim, written inside this transaction
-    // only while the latest publish: note is still the expected one (the
-    // caller re-checks freshness before invoking this).
-    const expiry = new Date(nowMs + claimLeaseMs).toISOString();
-    writePublishNote(db, taskId,
-      `publish: unknown-recovery-claimed ${expiry} — ${taskId} parked unknown at ${parkNote.timestamp}; claimed for classification (1-hour lease).`,
-      new Date(nowMs).toISOString());
-    // Classifier base: the last verified publish, or the empty tree when
-    // nothing is stamped yet (a first publish) — same convention as the
-    // Step 4.5 read-back sensor.
-    // 2026-09-18, should-fix 4: provenance query failures fail CLOSED —
-    // the empty tree is valid only when there is truly no provenance value.
-    // A query error (locked DB, I/O failure) is not "no provenance"; skip
-    // the task so the next scan retries.
+    const project = db.prepare("SELECT id, deploy_slug, repo_path FROM projects WHERE id = ?").get(task.project);
+    const slug = project && project.deploy_slug;
+    if (!slug) {
+      skip(taskId, "no-deploy-slug", "project has no deploy_slug — stays parked for human attention");
+      return;
+    }
+    // A null repo_path fails closed at emission: the tick can neither
+    // regenerate nor verify the diff. No claim, no tick work.
+    const repoPath = project && project.repo_path;
+    if (!repoPath) {
+      skip(taskId, "no-repo-path",
+        "project has no repo_path — the intent diff cannot be regenerated or verified; fails closed at emission; stays parked for human attention");
+      return;
+    }
+    const ledger = readTaskLedgerEntries(crewHome, slug, taskId);
+    if (!ledger.ok) {
+      skip(taskId, "ledger-unreadable", `${ledger.reason} — stays parked for human attention`);
+      return;
+    }
+    const intentEntry = findIntentEntry(ledger.entries, commit, publishAttempt);
+    if (!intentEntry) {
+      skip(taskId, "no-intent-entry",
+        "no publish-intent ledger entry for this task/commit/attempt — the intent anchor is missing; stays parked for human attention");
+      return;
+    }
+    // The version is protocol: the ledger is advisory — the deterministic
+    // derivation is the contract. A mismatch means the staged diff was not
+    // built by this machine; never issue it.
+    const expectedVersion = derivePublishVersion(commit, publishAttempt);
+    if (intentEntry.version !== expectedVersion) {
+      skip(taskId, "intent-version-mismatch",
+        "the intent entry's version is missing or does not match the deterministic derivation — stays parked for human attention");
+      return;
+    }
+    if (typeof intentEntry.diff_path !== "string" || !intentEntry.diff_path ||
+        !/^[0-9a-f]{64}$/.test(intentEntry.diff_sha256 || "")) {
+      skip(taskId, "intent-diff-unusable",
+        "the intent entry carries no usable diff_path/diff_sha256 — stays parked for human attention");
+      return;
+    }
+    // Freshness CAS: the latest publish: note must still be the anchor note
+    // — for a first claim that is the intent note; for a re-claim it is the
+    // expired claim note.
+    const fresh = latestPublishNote(db, taskId);
+    if (!fresh || fresh.message !== anchorNote.message) { skip(taskId, "raced"); return; }
+    // The classifier-base convention: last acknowledged publish, or the
+    // empty tree on a first publish — the tick needs it to regenerate the
+    // diff byte-identically when the staged file is missing. A query error
+    // is not "no provenance" — fail closed.
     let base;
     try {
-      const prov = db.prepare("SELECT provenance_source_commit FROM projects WHERE id = ?").get(derived.projectId);
+      const prov = db.prepare("SELECT provenance_source_commit FROM projects WHERE id = ?").get(project.id);
       if (prov && /^[0-9a-f]{40}$/.test(prov.provenance_source_commit)) {
         base = prov.provenance_source_commit;
       } else {
@@ -1977,18 +1764,40 @@ commands["scan-publish-unknown"] = (db, args, ctx) => {
         `provenance lookup failed (${e.message.slice(0, 200)}); failing closed — the next scan retries`);
       return;
     }
-    due.push({
-      task_id: taskId, commit: derived.commit, base,
-      trigger_ts: trigger.issued_at || trigger.ts, park_ts: parkNote.timestamp,
-      slug: derived.slug, repo_path: derived.repoPath,
-      project_id: derived.projectId, claim_expiry: expiry,
-      ledger_path: derived.ledgerPath,
-      // Pre-trigger manifest baseline (design §1.9): the workflow snapshots
-      // the manifest before the trigger into the submitted ledger entry; the
-      // classifier's verified path compares the current manifest against it.
-      // Null when the workflow predates the capture (fail closed downstream).
-      manifest_before: (trigger.manifest_before && typeof trigger.manifest_before === "object")
-        ? trigger.manifest_before : null,
+    // The intent's recorded base must match stamped provenance: another
+    // publish may have landed after the intent was staged. A stale base
+    // means the staged diff is against a superseded base — re-queue the
+    // task (next_phase routes it straight back to the workflow's Publish,
+    // which re-prepares the intent against the new base); never issue the
+    // stale diff. Intents with no recorded base re-queue the same way.
+    const intentBase = (typeof intentEntry.base === "string" && /^[0-9a-f]{40}$/.test(intentEntry.base))
+      ? intentEntry.base : null;
+    if (!intentBase || intentBase !== base) {
+      const staleAt = new Date(nowMs).toISOString();
+      writeGuardedPublishNote(db, taskId,
+        `publish: publish-base-stale ${commit} — the intent's staged diff was computed against base ` +
+        `${intentBase ? intentBase.slice(0, 7) : "(none recorded)"} but stamped provenance now reads ` +
+        `${base.slice(0, 7)}; issuing the stale diff risks a spurious mismatch. Re-queued: ` +
+        `the workflow's Publish re-prepares the intent against the new base.`,
+        staleAt);
+      db.prepare("UPDATE tasks SET next_phase = 'Publish', state = 'in_progress', updated_at = ? WHERE id = ?")
+        .run(now(), taskId);
+      requeued.push({ task_id: taskId, intent_base: intentBase, provenance_base: base });
+      return;
+    }
+    const claimedAt = new Date(nowMs).toISOString();
+    const expiry = new Date(nowMs + claimLeaseMs).toISOString();
+    writeGuardedPublishNote(db, taskId,
+      `publish: publish-intent-claimed ${expiry} — ${taskId} parked at publish intent for ${commit} ` +
+      `(attempt ${publishAttempt}); claimed for direct issuance by the session-carrying tick worker (1-hour lease).`,
+      claimedAt);
+    intent.push({
+      task_id: taskId, commit, attempt: publishAttempt, version: expectedVersion,
+      slug, repo_path: repoPath,
+      project_id: project.id, ledger_path: ledger.ledgerPath, base,
+      diff_path: intentEntry.diff_path, diff_sha256: intentEntry.diff_sha256,
+      files: Array.isArray(intentEntry.files) ? intentEntry.files : null,
+      claimed_at: claimedAt, claim_expiry: expiry, reclaimed,
     });
   };
 
@@ -2007,315 +1816,636 @@ commands["scan-publish-unknown"] = (db, args, ctx) => {
       const latest = notes[0];
       const msg = latest.message;
       const has = (s) => msg.includes(s);
-      const historyHas = (s) => notes.some((n) => n.message.includes(s));
 
-      // Terminal states — the machine never revisits these. The vocabulary is
-      // explicit state (lib/publish-note-vocabulary.js); a recognized terminal
-      // note is skipped as terminal with its meaning, never as unrecognized.
+      // Terminal states — the machine never revisits these. The vocabulary
+      // is explicit state (lib/publish-note-vocabulary.js); a recognized
+      // terminal note is skipped as terminal with its meaning, never as
+      // unrecognized.
       const terminalNote = matchTerminalPublishNote(msg);
       if (terminalNote) {
         skip(taskId, "terminal",
           `recognized terminal note '${terminalNote}' — ${TERMINAL_NOTE_MEANINGS[terminalNote]}`);
         continue;
       }
-      // Already routed into the verification pipeline — the verification
-      // scan owns it from here.
-      if (has("publish: verification-requested")) {
-        skip(taskId, "routed-to-verification");
-        continue;
-      }
-      // A retry went out but the mirrored verification request is missing
-      // (the tick died between the two writes). Mirror it now — the retry is
-      // at least one tick old, so no not-before is needed.
-      if (has("publish: retry-issued")) {
-        if (historyHas("publish: verification-requested")) { skip(taskId, "raced"); continue; }
-        const derived = derivePublishUnknownAttempt(db, crewHome, taskId);
-        if (!derived.ok) { skip(taskId, "derive-failed", derived.reason); continue; }
-        writePublishNote(db, taskId,
-          `publish: verification-requested ${derived.commit} attempt=${derived.attempt} — mirrored by scan-publish-unknown: the retry was issued without a mirrored request (the tick died between the writes). Waiting on the manual read-back in docs/publish-verification.md.`);
-        mirrored.push({ task_id: taskId, commit: derived.commit, attempt: derived.attempt, not_before: null, reason: "retry-issued-without-mirror" });
-        continue;
-      }
-      // A retry-intended note with no retry-issued: the tick died mid-retry
-      // and the trigger may or may not have gone out. NEVER re-trigger here —
-      // route to the verification pipeline and let content verification be
-      // the arbiter (design §1.5 R3).
-      if (has("publish: retry-intended")) {
-        if (historyHas("publish: verification-requested")) { skip(taskId, "raced"); continue; }
-        const derived = derivePublishUnknownAttempt(db, crewHome, taskId);
-        if (!derived.ok) { skip(taskId, "derive-failed", derived.reason); continue; }
-        const m = msg.match(/publish: retry-intended\s+[0-9a-f]{40}\s+(\S+)/);
-        const intendedMs = m ? Date.parse(m[1]) : NaN;
-        const notBefore = new Date(Math.max(nowMs, (intendedMs > 0 ? intendedMs : nowMs) + retrySettleMs)).toISOString();
-        writePublishNote(db, taskId,
-          `publish: verification-requested ${derived.commit} attempt=${derived.attempt} not-before=${notBefore} — mirrored by scan-publish-unknown: a retry-intended note exists without retry-issued (the tick died mid-retry), so the trigger may or may not have gone out; never re-triggering here, content verification is the arbiter. Waiting on the manual read-back in docs/publish-verification.md.`);
-        mirrored.push({ task_id: taskId, commit: derived.commit, attempt: derived.attempt, not_before: notBefore, reason: "retry-intended-without-retry-issued" });
+      // Already issued — the acknowledgement scan owns the task from here.
+      if (has("publish: edit-issued")) {
+        skip(taskId, "routed-to-ack-scan");
         continue;
       }
-      // Classified as dropped and awaiting the retry protocol. Exactly one
-      // retry, enforced from note events (design §1.5): a retry-issued
-      // anywhere in this task's history spends the budget — including a
-      // retry for an earlier unknown attempt on a reworked task. When the
-      // budget is spent the drop is terminal: ambiguous, human attention.
-      if (has("publish: dropped")) {
-        const derived = derivePublishUnknownAttempt(db, crewHome, taskId);
-        if (!derived.ok) { skip(taskId, "derive-failed", derived.reason); continue; }
-        if (historyHas("publish: retry-issued")) {
-          writePublishNote(db, taskId,
-            `publish: ambiguous ${derived.commit} — retry budget exhausted: a publish retry was already issued for this task in an earlier attempt; not retrying blind. Parked for human attention.`);
-          try {
-            appendFileSync(derived.ledgerPath, JSON.stringify({
-              ts: now(), task_id: taskId, workflow: "unknown-recovery", slug: derived.slug,
-              commit: derived.commit, attempt: derived.attempt, agent_id: null,
-              applied_report: null, outcome: "unknown-classified",
-              detail: "retry budget exhausted — ambiguous, terminal",
-            }) + "\n");
-          } catch (e) { /* best-effort observability */ }
+      // A previous tick claimed this intent. Unexpired: a tick owns it.
+      // Expired: the tick died mid-issuance — re-derive from the original
+      // intent note and re-claim; the re-claiming tick checks the dead
+      // attempt's version receipt before issuing, never blindly re-issues.
+      if (has("publish: publish-intent-claimed")) {
+        const cm = msg.match(/publish: publish-intent-claimed\s+(\S+)/);
+        const expiryMs = cm ? Date.parse(cm[1]) : NaN;
+        if (expiryMs > 0 && nowMs <= expiryMs) { skip(taskId, "claimed"); continue; }
+        const intentNote = notes.find((n) => n.message.includes("publish: publish-requested"));
+        if (!intentNote) {
+          skip(taskId, "no-intent-note", "expired intent claim with no publish-requested note in history");
           continue;
         }
-        // Retry budget free: queue the retry protocol. The tick needs the
-        // classifier base to regenerate the publish diff byte-identically
-        // (compute-publish-diff.js --base), so ferry it from provenance.
-        // The in-lock re-check also needs the trigger anchor and the
-        // pre-trigger manifest baseline (design §1.9).
-        const retryProv = db.prepare(
-          `SELECT provenance_source_commit FROM projects WHERE id = ?`
-        ).get(derived.projectId);
-        const retryBase = (retryProv && retryProv.provenance_source_commit) || EMPTY_TREE;
-        const retryTrigger = findTriggerEntry(derived.entries, derived.commit, derived.attempt);
-        retryDue.push({
-          task_id: taskId, commit: derived.commit, attempt: derived.attempt,
-          slug: derived.slug, repo_path: derived.repoPath, project_id: derived.projectId,
-          ledger_path: derived.ledgerPath, base: retryBase,
-          trigger_ts: (retryTrigger && (retryTrigger.issued_at || retryTrigger.ts)) || null,
-          manifest_before: (retryTrigger && retryTrigger.manifest_before &&
-            typeof retryTrigger.manifest_before === "object") ? retryTrigger.manifest_before : null,
-        });
-        continue;
-      }
-      // A previous tick claimed this task for classification.
-      // A previous tick claimed this task for classification.
-      if (has("publish: unknown-recovery-claimed")) {
-        const m = msg.match(/publish: unknown-recovery-claimed\s+(\S+)/);
-        const expiryMs = m ? Date.parse(m[1]) : NaN;
-        if (expiryMs > 0 && nowMs <= expiryMs) { skip(taskId, "claimed"); continue; }
-        // Expired claim: the tick died mid-classification. Re-derive from
-        // the original unknown note and re-claim.
-        const parkNote = notes.find((n) => /publish outcome unknown/i.test(n.message));
-        if (!parkNote) { skip(taskId, "no-unknown-note", "expired claim with no unknown park note in history"); continue; }
         const fresh = latestPublishNote(db, taskId);
         if (!fresh || fresh.message !== msg) { skip(taskId, "raced"); continue; }
-        claimForClassification(taskId, notes, parkNote);
+        claimForIntent(taskId, intentNote, true, latest);
         continue;
       }
-      // The initial unknown park note. Quiescence first: the classifier must
-      // never read a manifest younger than 30 minutes past the park.
-      if (/publish outcome unknown/i.test(msg)) {
-        const parkMs = Date.parse(latest.timestamp);
-        if (!(parkMs > 0) || nowMs < parkMs + quiesceMs) {
-          waiting.push({ task_id: taskId, parked_at: latest.timestamp });
-          continue;
-        }
-        // Re-check freshness inside the transaction: the latest publish:
-        // note must still be this unknown note.
-        const fresh = latestPublishNote(db, taskId);
-        if (!fresh || fresh.message !== msg) { skip(taskId, "raced"); continue; }
-        claimForClassification(taskId, notes, latest);
+      // The workflow's parked intent.
+      if (has("publish: publish-requested")) {
+        claimForIntent(taskId, latest, false, latest);
         continue;
       }
-      skip(taskId, "unrecognized-publish-note");
+      skip(taskId, "unrecognized-publish-note",
+        `latest publish note is not part of the 0.14.6 machine — stays parked for human attention: ${msg.slice(0, 120)}`);
     }
     db.exec("COMMIT");
   } catch (e) { db.exec("ROLLBACK"); throw e; }
 
-  return { waiting, due, retry_due: retryDue, mirrored, skipped };
+  return { intent, skipped, requeued };
 };
-
-// Record the unknown-recovery classifier's decision (2026-09-18, blocker
-// 15). The tick ferries: it runs lib/classify-publish-absence.js for each
-// scan-publish-unknown "due" entry and passes the classifier's JSON here.
-// Code decides: every note the decision implies is written here, atomically,
-// never free-formed by the tick.
+// Record a one-party intent issuance (0.14.6 §1.2): the session-carrying
+// tick worker calls this exactly once per artifact_edit call that completed
+// without error and without an explicit refusal.
 //
-// Args: { task_id, claim_expiry, decision } where decision is the
-// classifier's { ok, decision, reasons, details } JSON.
+// Args: { task_id, claim_expiry, edit_outcome: "accepted"|"refused",
+//         refusal_text? } — omit refusal_text unless refused.
 //
-// The claim_expiry is a compare-and-swap: the record lands only while the
-// latest publish: note is still this tick's claim. A stale tick (its claim
-// expired and a newer tick re-claimed) gets { recorded: false } and writes
-// nothing.
+// `accepted` writes the issuer-stamped `submitted` ledger entry (carrying
+// the attempt's version) and mirrors `publish: edit-issued` — the ack scan
+// claims the task on a later tick and evaluates acknowledgement evidence.
+// `refused` writes `rejected` and the terminal `publish: publish-refused`
+// note — no re-issue, ever.
+//
+// There is deliberately NO outcome for an inconclusive edit (timeout,
+// transport error, tool unavailable): the tick records NOTHING then — the
+// claim expires, the next scan re-claims, and the re-claiming tick's version
+// check decides. An unrecorded outcome is the only honest record of an
+// unknown one.
 //
-// Routing (design §1.4/§1.5):
-//   verified          → publish: verification-requested (no not-before: the
-//                       content is already the new state) + unknown-resolved
-//                       ledger entry; the verification scan claims it.
-//   provably-dropped  → publish: dropped (the next scan queues the retry
-//                       protocol). No ledger resolution — the attempt is
-//                       still logically unknown.
-//   applied-not-built / ambiguous
-//                     → publish: ambiguous (terminal) + unknown-classified
-//                       ledger entry. Parked for human attention.
-//   deferred          → no note: the claim expires and the next scan
-//                       re-claims. A deferred classification is not a verdict.
-//   superseded        → publish: superseded (terminal) + unknown-classified
-//                       ledger entry. HEAD moved; recovery aborted.
-commands["record-unknown-classification"] = (db, args, ctx) => {
+// The claim_expiry is a compare-and-swap: the record lands only while the
+// latest publish: note is still this tick's intent claim. A stale tick gets
+// { recorded: false } and writes nothing.
+// Shared preamble for the tick worker's claim-guarded record commands
+// (record-intent-issuance, record-intent-unissuable, 2026-09-20 REVIEW):
+// verifies the CAS claim, resolves the project's deploy slug, reads the
+// task's publish ledger, and locates the latest publish-intent entry.
+// Returns { ok: false, reason } when the command must not record, else
+// { ok: true, slug, ledgerPath, intentEntry, commit }. Callers run inside
+// their own BEGIN/COMMIT transaction and ROLLBACK on { ok: false }.
+function resolveClaimedIntent(db, ctx, taskId, claimExpiry) {
+  // CAS: the latest publish: note must still be this tick's claim.
+  const latest = latestPublishNote(db, taskId);
+  if (!latest || !latest.message.includes("publish: publish-intent-claimed") ||
+      !latest.message.includes(claimExpiry)) {
+    return { ok: false, reason: "claim no longer current — another tick owns this task" };
+  }
+  const task = db.prepare("SELECT id, project FROM tasks WHERE id = ?").get(taskId);
+  const project = task && db.prepare("SELECT id, deploy_slug FROM projects WHERE id = ?").get(task.project);
+  const slug = project && project.deploy_slug;
+  if (!slug) return { ok: false, reason: "project has no deploy_slug" };
+  const ledger = readTaskLedgerEntries(ctx.crewHome, slug, taskId);
+  if (!ledger.ok) return { ok: false, reason: ledger.reason };
+  const intentEntry = [...ledger.entries].reverse().find((e) => e.outcome === "publish-intent") || null;
+  if (!intentEntry || !/^[0-9a-f]{40}$/.test(intentEntry.commit || "")) {
+    return { ok: false, reason: "no usable publish-intent ledger entry for this task" };
+  }
+  return { ok: true, slug, ledgerPath: ledger.ledgerPath, intentEntry, commit: intentEntry.commit };
+}
+
+commands["record-intent-issuance"] = (db, args, ctx) => {
   const taskId = args.task_id;
   const claimExpiry = args.claim_expiry;
-  const decision = args.decision;
+  const editOutcome = args.edit_outcome;
   if (!taskId) throw usageError("task_id is required.");
   if (!claimExpiry) throw usageError("claim_expiry is required.");
-  if (!decision || typeof decision !== "object") throw usageError("decision is required (the classifier's JSON).");
-  const verdict = decision.decision;
-  const valid = ["verified", "provably-dropped", "applied-not-built", "ambiguous", "deferred", "superseded"];
-  if (!valid.includes(verdict)) throw usageError(`unknown classifier decision: ${verdict}.`);
+  if (!["accepted", "refused"].includes(editOutcome)) {
+    throw usageError(`unknown edit outcome: ${editOutcome}.`);
+  }
 
   db.exec("BEGIN");
   try {
-    // CAS: the latest publish: note must still be this tick's claim.
-    const latest = latestPublishNote(db, taskId);
-    if (!latest || !latest.message.includes("publish: unknown-recovery-claimed") ||
-        !latest.message.includes(claimExpiry)) {
+    const pre = resolveClaimedIntent(db, ctx, taskId, claimExpiry);
+    if (!pre.ok) { db.exec("ROLLBACK"); return { recorded: false, reason: pre.reason }; }
+    const { slug, ledgerPath, intentEntry, commit } = pre;
+    const publishAttempt = intentEntry.publish_attempt;
+    const version = intentEntry.version;
+    if (!Number.isInteger(publishAttempt) || publishAttempt < 1 ||
+        version !== derivePublishVersion(commit, publishAttempt)) {
       db.exec("ROLLBACK");
-      return { recorded: false, reason: "claim no longer current — another tick owns this task" };
+      return { recorded: false, reason: "intent entry carries no usable publish_attempt/version — refusing to record" };
+    }
+    const ts = now();
+    const ledgerLine = {
+      ts, task_id: taskId, workflow: "intent-issuance", slug,
+      commit, attempt: intentEntry.attempt || null, publish_attempt: publishAttempt, version,
+      agent_id: null, applied_report: null,
+      issuer: "tick-worker",
+      diff_sha256: intentEntry.diff_sha256 || null,
+      issued_at: editOutcome === "accepted" ? ts : null,
+    };
+    let note;
+    if (editOutcome === "refused") {
+      const refusalText = String(args.refusal_text || "no refusal text recorded").split("\n")[0].slice(0, 500);
+      ledgerLine.outcome = "rejected";
+      ledgerLine.detail = `platform refused the directly-issued edit: ${refusalText}`;
+      // Terminal: parked for human attention. "publish: publish-refused"
+      // is registered in lib/publish-note-vocabulary.js (the closed
+      // registry — the writer-side guard pattern from D7).
+      note = `publish: publish-refused ${commit} attempt=${publishAttempt} — the platform refused the issued edit (${refusalText}). No re-issue; parked for human attention.`;
+    } else {
+      ledgerLine.outcome = "submitted";
+      ledgerLine.detail = "edit issued directly by the session-carrying tick worker (one-party publish); the staged diff carried the per-attempt version receipt";
+      note = `publish: edit-issued ${commit} attempt=${publishAttempt} version=${version} — issued directly by the session-carrying tick worker (one-party publish). The acknowledgement scan owns the task from here: exact version string, 30-minute window.`;
     }
-    const derived = derivePublishUnknownAttempt(db, ctx.crewHome, taskId);
-    if (!derived.ok) {
+    try {
+      appendFileSync(ledgerPath, JSON.stringify(ledgerLine) + "\n");
+    } catch (e) {
       db.exec("ROLLBACK");
-      return { recorded: false, reason: derived.reason };
+      return { recorded: false, reason: `cannot append publish ledger: ${e.message}` };
     }
-    const reasons = Array.isArray(decision.reasons) ? decision.reasons.join("; ") : "";
-    const ts = now();
+    writeGuardedPublishNote(db, taskId, note, ts);
+    db.exec("COMMIT");
+    return { recorded: true, edit_outcome: editOutcome, task_id: taskId, commit, publish_attempt: publishAttempt, note };
+  } catch (e) { db.exec("ROLLBACK"); throw e; }
+};
+commands["record-intent-unissuable"] = (db, args, ctx) => {
+  const taskId = args.task_id;
+  const claimExpiry = args.claim_expiry;
+  const reason = String(args.reason || "").split("\n")[0].slice(0, 200);
+  if (!taskId) throw usageError("task_id is required.");
+  if (!claimExpiry) throw usageError("claim_expiry is required.");
+  if (!reason) throw usageError("reason is required.");
 
-    const appendLedger = (outcome, detail) => {
-      try {
-        appendFileSync(derived.ledgerPath, JSON.stringify({
-          ts, task_id: taskId, workflow: "unknown-recovery", slug: derived.slug,
-          commit: derived.commit, attempt: derived.attempt, agent_id: null,
-          applied_report: null, outcome, detail,
-        }) + "\n");
-      } catch (e) { /* best-effort observability */ }
+  db.exec("BEGIN");
+  try {
+    const pre = resolveClaimedIntent(db, ctx, taskId, claimExpiry);
+    if (!pre.ok) { db.exec("ROLLBACK"); return { recorded: false, reason: pre.reason }; }
+    const { slug, ledgerPath, intentEntry, commit } = pre;
+    const ts = now();
+    const attempt = intentEntry.attempt || null;
+    const ledgerLine = {
+      ts, task_id: taskId, workflow: "intent-issuance", slug,
+      commit, attempt, agent_id: null, applied_report: null,
+      issuer: "tick-worker", outcome: "unissuable", issued_at: null,
+      diff_sha256: intentEntry.diff_sha256 || null,
+      manifest_before: intentEntry.manifest_before || null,
+      detail: `intent diff unissuable: ${reason} — the staged diff cannot be (re)generated byte-identically; parked for human attention`,
     };
-
-    if (verdict === "deferred") {
-      // No note: the claim expires, the next scan re-claims and retries the
-      // classification. A deferred classification is explicitly not a verdict.
-      db.exec("COMMIT");
-      return { recorded: true, decision: verdict, task_id: taskId, note: "deferred — claim left to expire" };
+    try {
+      appendFileSync(ledgerPath, JSON.stringify(ledgerLine) + "\n");
+    } catch (e) {
+      db.exec("ROLLBACK");
+      return { recorded: false, reason: `cannot append publish ledger: ${e.message}` };
     }
+    // Terminal: "publish: publish-unissuable" is registered in
+    // lib/publish-note-vocabulary.js (the closed registry — the writer-side
+    // guard pattern from D7).
+    const note = `publish: publish-unissuable ${commit} — the intent's staged diff cannot be (re)generated byte-identically (${reason}). Never re-claim, never loop; parked for human attention.`;
+    writeGuardedPublishNote(db, taskId, note, ts);
+    db.exec("COMMIT");
+    return { recorded: true, task_id: taskId, commit, note };
+  } catch (e) { db.exec("ROLLBACK"); throw e; }
+};
+// Acknowledgement scan (0.14.6 §1.3): evaluates acknowledgement evidence
+// for issued edits. Eric's contract: exact version acknowledgement is the
+// SOLE positive completion criterion — "If we hear that the artifact
+// acknowledges our version, that's it. We don't verify against content."
+//
+// Per parked task whose latest publish: note is `publish: edit-issued`:
+//   - the artifact's on-disk version receipt
+//     (<spaces>/ts-spaces/<slug>/.crew-publish-version-<task_id>) equals ANY issued
+//     version for this task+commit (a late earlier attempt counts), OR a
+//     version-echoing builder report (outcome acknowledged) names one
+//       → acknowledged: provenance stamped (certifying the request was
+//         acknowledged, not byte equality), terminal
+//         `publish: version-acknowledged`, task re-queued.
+//   - else a builder report (outcome refused) names an issued version
+//       → refused: terminal `publish: publish-refused`.
+//   - else the 30-minute window from the LATEST issuance is still open
+//       → skipped (window-open).
+//   - else the 2-hour total budget from the FIRST issuance is not exhausted
+//       → reissued: a fresh intent is staged with a fresh version,
+//         immediately claimable (no backoff); the NEXT tick's intent scan
+//         claims it. This tick issues nothing.
+//   - else → version-timeout: terminal `publish: version-timeout`.
+//
+// One atomic transaction per scan. The command is fully code-local — no
+// claim notes, no tick mediation. `spaces_root` arg overrides the ts-spaces
+// root (tests); production reads ~/workspace/ts-spaces.
+//
+// Returns { acknowledged, refused, reissued, timeouts, skipped }.
+commands["scan-ack-pending"] = (db, args, ctx) => {
+  const crewHome = ctx.crewHome;
+  const nowMs = Date.now();
+  // (2026-09-20, Eric's call) 30-minute acknowledgement window per attempt,
+  // 2-hour TOTAL budget from the FIRST issuance of the commit — then terminal
+  // version-timeout. No backoff: a reissue staged at window expiry is
+  // immediately claimable; the window expiry is the only spacing. The window
+  // anchors at the LATEST issuance (each attempt gets its own window); the
+  // budget anchors at the FIRST (the whole publish effort gets one budget,
+  // however many attempts fit). The 30-minute window is evidence-set: room
+  // #25's one healthy ack landed ~15-17 minutes after issuance — the window
+  // is ~2x that plus margin. The ledger records issued_at and first-seen ack
+  // for every attempt, so the real distribution is measurable and the window
+  // is tunable from data, not from a placeholder.
+  const ACK_WINDOW_MS = 30 * 60 * 1000;
+  const TOTAL_BUDGET_MS = 2 * 60 * 60 * 1000;
+  const EMPTY_TREE = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
+  const spacesRoot = (args && args.spaces_root) || join(homedir(), "workspace", "ts-spaces");
+  // The release running this scan must provably be the active release
+  // before it stamps acknowledgement claims — fail the whole scan closed
+  // on a stale cron body or mid-deploy swap.
+  const releaseName = resolveActiveRelease(crewHome);
+  const computeDiffScript = new URL("./compute-publish-diff.js", import.meta.url).pathname;
+
+  const acknowledged = [];
+  const refused = [];
+  const reissued = [];
+  const timeouts = [];
+  const skipped = [];
+  const skip = (taskId, reason, detail) =>
+    skipped.push({ task_id: taskId, ...(reason ? { reason } : {}), ...(detail ? { detail } : {}) });
 
-    let note;
-    if (verdict === "verified") {
-      note = `publish: verification-requested ${derived.commit} attempt=${derived.attempt} — unknown-recovery classifier verified the content already shows the new state (${reasons}); routed without re-trigger. Waiting on the manual read-back in docs/publish-verification.md.`;
-      writePublishNote(db, taskId, note, ts);
-      appendLedger("unknown-resolved",
-        `classifier verified: content shows the new state; routed to parent verification without re-trigger (${reasons})`);
-    } else if (verdict === "provably-dropped") {
-      note = `publish: dropped ${derived.commit} — unknown-recovery classifier: the trigger went out and the platform provably dropped the edit (${reasons}); queued for the retry protocol.`;
-      writePublishNote(db, taskId, note, ts);
-      // No ledger resolution: the attempt is still logically unknown until
-      // the retry protocol journals its outcome.
-    } else if (verdict === "superseded") {
-      note = `publish: superseded ${derived.commit} — unknown-recovery classifier: HEAD moved past the attempt commit (${reasons}); recovery aborted. Parked for human attention.`;
-      writePublishNote(db, taskId, note, ts);
-      appendLedger("unknown-classified", `classifier superseded — terminal (${reasons})`);
-    } else {
-      // applied-not-built, ambiguous: the classifier could not prove the
-      // drop. Terminal — parked for human attention, never retried blind.
-      note = `publish: ambiguous ${derived.commit} — unknown-recovery classifier could not prove the edit was dropped (${verdict}: ${reasons}); not retrying blind. Parked for human attention.`;
-      writePublishNote(db, taskId, note, ts);
-      appendLedger("unknown-classified", `classifier ${verdict} — terminal, no retry (${reasons})`);
+  const parked = db.prepare(`SELECT id AS task_id FROM tasks WHERE state = 'parked'`).all();
+
+  db.exec("BEGIN");
+  try {
+    for (const row of parked) {
+      const taskId = row.task_id;
+      const latest = latestPublishNote(db, taskId);
+      if (!latest || !latest.message.includes("publish: edit-issued")) { skip(taskId, "not-issued"); continue; }
+      const m = latest.message.match(/publish:\s*edit-issued\s+([0-9a-f]{40})\s+attempt=(\d+)/);
+      if (!m) {
+        skip(taskId, "edit-issued-unparseable",
+          "the edit-issued note carries no commit hash + attempt=N — stays parked for human attention");
+        continue;
+      }
+      const commit = m[1];
+      const task = db.prepare("SELECT id, state, project FROM tasks WHERE id = ?").get(taskId);
+      const project = task && db.prepare("SELECT id, deploy_slug, repo_path FROM projects WHERE id = ?").get(task.project);
+      const slug = project && project.deploy_slug;
+      if (!slug) { skip(taskId, "no-deploy-slug"); continue; }
+      const ledger = readTaskLedgerEntries(crewHome, slug, taskId);
+      if (!ledger.ok) { skip(taskId, "ledger-unreadable", ledger.reason); continue; }
+      // The issuance record: issuer-stamped submitted entries with
+      // derivation-verified versions. A version that fails the derivation is
+      // not this machine's — the whole attempt is unusable, fail closed.
+      const submittedAll = findSubmittedEntries(ledger.entries, commit);
+      if (submittedAll.length === 0) {
+        skip(taskId, "no-issuance-record",
+          "no issuer-stamped submitted ledger entry for this commit — failing closed; stays parked for human attention");
+        continue;
+      }
+      // The ack version is derived deterministically from (task, commit,
+      // attempt) — §1.1. An entry whose version fails the derivation is a
+      // phantom claim: it never binds (D2). A corrupt entry poisons only
+      // itself — it is quarantined while valid entries still drive the
+      // windows and the budget, so one bad ledger line can never park the
+      // whole record before the budget is evaluated. Only
+      // derivation-verified entries anchor the clocks below.
+      const attempts = [];
+      const validEntries = [];
+      for (const e of submittedAll) {
+        const pa = verifiedSubmittedAttempt(taskId, e);
+        if (pa === null) continue;
+        if (!attempts.includes(pa)) attempts.push(pa);
+        validEntries.push(e);
+      }
+      if (attempts.length === 0) {
+        skip(taskId, "version-mismatch",
+          "no submitted entry's version passes the deterministic derivation — the issuance record is unusable; stays parked for human attention");
+        continue;
+      }
+      attempts.sort((a, b) => a - b);
+      const expectedVersion = (a) => derivePublishVersion(commit, a);
+
+      // --- acknowledgement evidence (§1.3): the version receipt on disk, or
+      // a version-echoing builder report. ANY issued version for this
+      // task+commit counts — including a late earlier attempt's. The
+      // receipt is scoped per task (`.crew-publish-version-<task_id>`):
+      // two tasks of the same project can sit in `edit-issued`
+      // concurrently (per-project simultaneity defaults to 2), and a
+      // shared per-slug receipt would let each issuance overwrite the
+      // other's acknowledgement — receipt ping-pong with no false ack.
+      let diskVersion = null;
+      try {
+        diskVersion = readFileSync(join(spacesRoot, slug, ".crew-publish-version-" + taskId), "utf8").trim() || null;
+        if (diskVersion && !isPublishVersion(diskVersion)) diskVersion = null;
+      } catch { diskVersion = null; }
+      const reports = db.prepare(
+        `SELECT version, outcome FROM builder_reports WHERE task_id = ?`
+      ).all(taskId);
+      // (2026-09-20 REVIEW) Disk is the SOLE positive evidence. The
+      // builder-report "acknowledged" path was circular: the tick worker
+      // knows the version (it was in the scan entry), so report_text
+      // containing the version proves version knowledge, not artifact/platform
+      // origin. A worker can fabricate an acknowledged report and cause
+      // false provenance stamping. Builder reports are retained for
+      // explicit REFUSALS only (negative evidence).
+      const ackedAttempt = attempts.find((a) => diskVersion === expectedVersion(a));
+      if (ackedAttempt !== undefined) {
+        recordVersionAck(db, ctx, {
+          taskId, projectId: project.id, commit, version: expectedVersion(ackedAttempt), via: "disk",
+        });
+        acknowledged.push({ task_id: taskId, commit, attempt: ackedAttempt, via: "disk", crew_release: releaseName });
+        continue;
+      }
+      // Explicit refusal naming an issued version: terminal, no re-issue.
+      const refusedAttempt = attempts.find((a) =>
+        reports.some((r) => r.outcome === "refused" && r.version === expectedVersion(a)));
+      if (refusedAttempt !== undefined) {
+        writeGuardedPublishNote(db, taskId,
+          `publish: publish-refused ${commit} attempt=${refusedAttempt} — the builder's report carried the ` +
+          `attempt's exact version with an explicit refusal. No re-issue; parked for human attention.`,
+          new Date(nowMs).toISOString());
+        refused.push({ task_id: taskId, commit, attempt: refusedAttempt });
+        continue;
+      }
+      // The acknowledgement window runs from the LATEST issuance of this
+      // commit — a 30-minute window PER ATTEMPT (0.14.6 §1.3, design §3, as
+      // re-set 2026-09-20). Anchoring at the earliest issuance would give
+      // attempts 2+ no window at all: they are always issued after attempt
+      // 1's window expired, so the scan would re-issue or time out
+      // immediately after they were issued. Late acknowledgements for any
+      // previously issued version are still accepted above; only the
+      // re-issue/timeout clock follows the latest attempt.
+      const latestIssuance = validEntries[validEntries.length - 1];
+      const issuedAtMs = Date.parse(latestIssuance.issued_at || latestIssuance.ts);
+      if (issuedAtMs > 0 && nowMs < issuedAtMs + ACK_WINDOW_MS) { skip(taskId, "window-open"); continue; }
+      // An unparseable latest issuance is an UNKNOWN window — never call
+      // it "window-open". The budget check below still runs, so a corrupt
+      // latest timestamp cannot defer the terminal timeout forever; only
+      // the re-issue is withheld (re-issuing into an unknown window would
+      // risk a duplicate issuance the budget cannot yet justify).
+      // Window expired. Budget remains → re-issue with a FRESH version;
+      // budget exhausted → terminal version-timeout. The budget is measured
+      // from the FIRST issuance of this commit: the whole publish effort
+      // gets one 2-hour budget, however many 30-minute attempts fit inside
+      // it. A fixed attempt cap would false-timeout a slow-but-healthy
+      // artifact; a pure window with no budget would retry forever.
+      const firstIssuance = validEntries[0];
+      const firstIssuedAtMs = Date.parse(firstIssuance.issued_at || firstIssuance.ts);
+      if (!(firstIssuedAtMs > 0)) {
+        skip(taskId, "first-issuance-unparseable",
+          "the first submitted entry's issued_at is unparseable — failing closed; stays parked for human attention");
+        continue;
+      }
+      const maxAttempt = Math.max(...attempts);
+      if (nowMs - firstIssuedAtMs >= TOTAL_BUDGET_MS) {
+        writeGuardedPublishNote(db, taskId,
+          `publish: version-timeout ${commit} — the 2-hour acknowledgement budget is exhausted ` +
+          `(${maxAttempt} attempts, no version acknowledgement; unobserved within budget — the edit may ` +
+          `still have landed; the outcome is unknown). Parked for human attention.`,
+          new Date(nowMs).toISOString());
+        timeouts.push({ task_id: taskId, commit, attempts: maxAttempt });
+        continue;
+      }
+      if (!(issuedAtMs > 0)) {
+        skip(taskId, "latest-issuance-unparseable",
+          "the latest submitted entry's issued_at is unparseable — the acknowledgement window state is " +
+          "unknown and the total budget is not exhausted; stays parked for human attention");
+        continue;
+      }
+      const newAttempt = maxAttempt + 1;
+      // Idempotency: a previous scan may already have prepared this
+      // attempt. The guard is keyed on the SAME anchor the intent scan
+      // claims on — the `publish: publish-requested <commit> attempt=N`
+      // note — not the ledger line. The ledger append and the note write
+      // are not atomic: a crash between them (or a rolled-back COMMIT)
+      // leaves an orphan ledger line with no note, and a line-keyed guard
+      // would skip it as "already prepared" until the budget forced the
+      // terminal timeout. Keyed on the note, a torn prepare self-heals:
+      // the orphan line is content-identical (deterministic version) and the
+      // intent scan claims the re-appended line exactly once. Do NOT
+      // reverse the write order: a note-without-line tear would park
+      // permanently with no budget-expiry resolution.
+      const prepareNote = db.prepare(
+        `SELECT id FROM events WHERE task_id = ? AND type = 'note'
+         AND message LIKE ? LIMIT 1`
+      ).get(taskId, `publish: publish-requested ${commit} attempt=${newAttempt} %`);
+      if (prepareNote) { skip(taskId, "reissue-already-prepared"); continue; }
+      // The re-issue diff is recomputed against CURRENT stamped provenance
+      // (or the empty tree): the ack scan stages the attempt the way the
+      // workflow staged attempt 1. A query error is not "no provenance" —
+      // fail closed.
+      let base;
+      try {
+        const prov = db.prepare("SELECT provenance_source_commit FROM projects WHERE id = ?").get(project.id);
+        base = (prov && /^[0-9a-f]{40}$/.test(prov.provenance_source_commit))
+          ? prov.provenance_source_commit : EMPTY_TREE;
+      } catch (e) {
+        skip(taskId, "provenance-query-failed",
+          `provenance lookup failed (${e.message.slice(0, 200)}); failing closed — the next scan retries`);
+        continue;
+      }
+      const repoPath = project.repo_path;
+      if (!repoPath) { skip(taskId, "no-repo-path"); continue; }
+      const newVersion = derivePublishVersion(commit, newAttempt);
+      const diffPath = join(crewHome, ".publish-diffs", `${taskId}-a${newAttempt}.diff`);
+      let diffJson = null;
+      try {
+        const out = execFileSync("node", [computeDiffScript,
+          "--repo-path", repoPath, "--base", base, "--commit", commit,
+          "--task-id", taskId, "--attempt", String(newAttempt), "--out", diffPath],
+          { encoding: "utf8", timeout: 60000, stdio: ["ignore", "pipe", "pipe"] });
+        diffJson = JSON.parse(String(out).trim());
+      } catch (e) {
+        skip(taskId, "reissue-diff-failed", `diff recomputation failed: ${String((e && e.message) || e).slice(0, 200)}`);
+        continue;
+      }
+      if (!diffJson || diffJson.ok !== true || diffJson.version !== newVersion ||
+          !/^[0-9a-f]{64}$/.test(diffJson.sha256 || "")) {
+        skip(taskId, "reissue-diff-unusable",
+          "the recomputed diff is unusable (version mismatch or bad checksum) — stays parked for human attention");
+        continue;
+      }
+      // No backoff: the reissue is immediately claimable by the next intent
+      // scan. The window expiry is the only spacing — a slow artifact gets
+      // its full window per attempt, and a dropped one is retried on the
+      // next tick, not after an arbitrary extra wait.
+      const ts = new Date(nowMs).toISOString();
+      const intentLine = {
+        ts, task_id: taskId, workflow: "ack-reissue", slug,
+        commit, attempt: null, publish_attempt: newAttempt, version: newVersion,
+        agent_id: null, applied_report: null,
+        issuer: "tick-worker",
+        diff_path: diffPath, diff_sha256: diffJson.sha256,
+        files: Array.isArray(diffJson.files) ? diffJson.files : null,
+        base, outcome: "publish-intent",
+        detail: `ack scan re-issue: attempt ${maxAttempt}'s 30-minute window expired with no version acknowledgement; ` +
+          `fresh version staged, immediately claimable (no backoff)`,
+      };
+      try {
+        appendFileSync(ledger.ledgerPath, JSON.stringify(intentLine) + "\n");
+      } catch (e) {
+        skip(taskId, "reissue-ledger-failed", `cannot append publish ledger: ${e.message}`);
+        continue;
+      }
+      writeGuardedPublishNote(db, taskId,
+        `publish: publish-requested ${commit} attempt=${newAttempt} — ack scan re-issue attempt ${newAttempt}: ` +
+        `no version acknowledgement within the 30-minute window; fresh version staged, immediately claimable ` +
+        `(2-hour total budget from first issuance).`,
+        ts);
+      reissued.push({ task_id: taskId, commit, attempt: newAttempt });
     }
     db.exec("COMMIT");
-    return { recorded: true, decision: verdict, task_id: taskId, note };
   } catch (e) { db.exec("ROLLBACK"); throw e; }
+
+  return { acknowledged, refused, reissued, timeouts, skipped };
 };
 
-// Retry-protocol re-check routing (2026-09-18, blocker 15). The tick runs
-// the retry protocol from inside the merge lock; its pre-trigger content
-// re-read (lib/classify-publish-absence.js) can come back something other
-// than provably-dropped. This command routes that decision — code-owned, so
-// the tick never free-forms the state machine.
+// Record the artifact platform's report text for an issued edit (0.14.6
+// §1.4). The tick worker calls this after each artifact_edit call with the
+// result/refusal text verbatim.
 //
-// Args: { task_id, decision } where decision is the classifier's JSON
-//   ({ ok:true, decision, reasons, details }).
-// CAS: the latest publish: note must still be "publish: dropped" — the merge
-// lock is the mutual exclusion; the CAS is the backstop against a tick that
-// died after another writer moved the state.
+// Args: { task_id, version, outcome: "acknowledged"|"refused",
+//         report_text }.
 //
-//   verified            → publish: verification-requested (content is
-//                         present now; no not-before) + unknown-resolved
-//                         ledger entry.
-//   provably-dropped    → no-op: the tick proceeds with the retry.
-//   applied-not-built / ambiguous → publish: ambiguous (terminal).
-//   superseded          → publish: superseded (terminal).
-//   deferred            → no-op: the drop note stays latest; the next scan
-//                         re-queues the protocol and re-reads.
-commands["record-retry-recheck"] = (db, args, ctx) => {
-  const crewHome = ctx?.crewHome;
-  if (!crewHome) throw usageError("crewHome is required (internal context).");
-  const taskId = String(args?.task_id ?? "").trim();
+// Mechanical guards (the command, not prose, decides):
+//   - report_text must contain the EXACT version string, else rejected;
+//   - the version must match an issued attempt for this task (derived, never
+//     trusted from prose), else rejected.
+// A refused report naming an issued version terminal-parks the task at the
+// next ack scan (`publish: publish-refused`). (2026-09-20 REVIEW) The
+// "acknowledged" outcome is rejected: it was circular (the worker knows
+// the version, so the report proves nothing), and disk is the sole positive
+// evidence. The rows persist as evidence.
+commands["record-builder-report"] = (db, args, ctx) => {
+  const taskId = args.task_id;
+  const version = args.version;
+  const outcome = args.outcome;
+  const reportText = args.report_text;
   if (!taskId) throw usageError("task_id is required.");
-  const decision = args?.decision;
-  if (!decision || typeof decision !== "object" || decision.ok !== true) {
-    throw usageError("decision is required — pass the classifier's JSON (ok:true).");
+  if (!isPublishVersion(version)) throw usageError("version must be the per-attempt publish version (<commit>:<attempt>).");
+  // (2026-09-20 REVIEW) "acknowledged" is rejected — the positive
+  // builder-report path was circular. Disk is the sole positive evidence.
+  if (outcome !== "refused") throw usageError(`unknown outcome: ${outcome} (only "refused" is accepted).`);
+  if (typeof reportText !== "string" || !reportText.includes(version)) {
+    throw usageError("report_text must contain the exact version string — the report is mechanically rejected otherwise.");
   }
-  const valid = ["verified", "provably-dropped", "applied-not-built", "ambiguous", "deferred", "superseded"];
-  if (!valid.includes(decision.decision)) {
-    throw usageError(`unknown classifier decision: ${decision.decision}.`);
+  const task = db.prepare("SELECT id, state, project FROM tasks WHERE id = ?").get(taskId);
+  if (!task) throw notFound(`unknown task: ${taskId}`);
+  if (task.state !== "parked") {
+    throw usageError(`task is not parked (state=${task.state}) — builder reports attach to parked publish tasks.`);
   }
-  requireTask(db, taskId);
-  const derived = derivePublishUnknownAttempt(db, crewHome, taskId);
-  if (!derived.ok) throw usageError(`cannot derive the unknown attempt: ${derived.reason}.`);
-  const latest = latestPublishNote(db, taskId);
-  if (!latest || !latest.message.includes("publish: dropped")) {
-    return {
-      recorded: false,
-      reason: "latest publish: note is no longer publish: dropped — another writer moved the state; recorded nothing.",
-    };
+  const project = db.prepare("SELECT id, deploy_slug FROM projects WHERE id = ?").get(task.project);
+  const slug = project && project.deploy_slug;
+  if (!slug) throw usageError("project has no deploy_slug.");
+  const ledger = readTaskLedgerEntries(ctx.crewHome, slug, taskId);
+  if (!ledger.ok) throw usageError(ledger.reason);
+  let matched = null;
+  for (const e of ledger.entries) {
+    if (e.outcome !== "submitted" || e.issuer !== "tick-worker") continue;
+    if (verifiedSubmittedAttempt(taskId, e) === null) continue;
+    if (derivePublishVersion(e.commit, e.publish_attempt) === version) { matched = e; break; }
+  }
+  if (!matched) {
+    throw usageError("version does not match any issued attempt for this task — the report is rejected.");
   }
-  const d = decision.decision;
-  const reasons = Array.isArray(decision.reasons) ? decision.reasons.join("; ") : "";
-  const commit = derived.commit;
-  if (d === "provably-dropped" || d === "deferred") {
-    // No state change: the tick proceeds (dropped) or the next scan
-    // re-queues the protocol (deferred).
-    return { recorded: false, reason: `re-check decision ${d}: no state change; the drop note stands.` };
-  }
-  if (d === "verified") {
-    writePublishNote(db, taskId,
-      `publish: verification-requested ${commit} attempt=${derived.attempt} — unknown-recovery retry re-check: the content is present now, so no retry was needed. Waiting on the manual read-back in docs/publish-verification.md.`);
-    try {
-      appendFileSync(derived.ledgerPath, JSON.stringify({
-        ts: now(), task_id: taskId, workflow: "unknown-recovery", slug: derived.slug,
-        commit, attempt: derived.attempt, agent_id: null, applied_report: null,
-        outcome: "unknown-resolved",
-        detail: `retry re-check verified (was: ${reasons})`,
-      }) + "\n");
-    } catch (e) { /* best-effort observability */ }
-    return { recorded: true, decision: d, routed: "verification-requested" };
-  }
-  // applied-not-built / ambiguous → terminal; superseded → terminal.
-  const terminal = d === "superseded" ? "superseded" : "ambiguous";
-  const noteBody = terminal === "superseded"
-    ? `publish: superseded ${commit} — unknown-recovery retry re-check: the retry target moved (${reasons}); not retrying a stale commit. Parked for human attention.`
-    : `publish: ambiguous ${commit} — unknown-recovery retry re-check: ${reasons}; not retrying blind. Parked for human attention.`;
-  writePublishNote(db, taskId, noteBody);
+  db.prepare(
+    `INSERT INTO builder_reports (id, task_id, version, outcome, report_text, created_at)
+     VALUES (?, ?, ?, ?, ?, ?)`
+  ).run(uuid(), taskId, version, outcome, reportText.slice(0, 20000), now());
+  return {
+    ok: true, task_id: taskId, version, outcome,
+    commit: matched.commit, publish_attempt: matched.publish_attempt,
+  };
+};
+
+// Record a positive version acknowledgement found off the ack scan's path
+// (0.14.6 §1.3): the re-claiming tick read the dead attempt's version receipt
+// from the artifact's disk. The version must name an issued attempt for this
+// task (derived, never trusted) — ANY issued version for the task counts,
+// including a late earlier attempt's. (2026-09-20 REVIEW) The reclaim path
+// also accepts the exact disk version for the currently claimed intent when
+// no submitted entry exists (dead tick issued but died before recording).
+// Stamps provenance, writes the terminal `publish: version-acknowledged`
+// note, re-queues the task.
+//
+// Args: { task_id, version, via: "disk" }.
+commands["record-version-ack"] = (db, args, ctx) => {
+  const taskId = args.task_id;
+  const version = args.version;
+  const via = args.via;
+  if (!taskId) throw usageError("task_id is required.");
+  if (!isPublishVersion(version)) throw usageError("version must be the per-attempt publish version (<commit>:<attempt>).");
+  if (via !== "disk") throw usageError(`unknown via: ${via} (only "disk" is accepted).`);
+  const task = db.prepare("SELECT id, state, project FROM tasks WHERE id = ?").get(taskId);
+  if (!task) throw notFound(`unknown task: ${taskId}`);
+  if (task.state !== "parked") {
+    throw usageError(`task is not parked (state=${task.state}) — version acks attach to parked publish tasks.`);
+  }
+  const project = db.prepare("SELECT id, deploy_slug FROM projects WHERE id = ?").get(task.project);
+  const slug = project && project.deploy_slug;
+  if (!slug) throw usageError("project has no deploy_slug.");
+  const ledger = readTaskLedgerEntries(ctx.crewHome, slug, taskId);
+  if (!ledger.ok) throw usageError(ledger.reason);
+  let matched = null;
+  for (const e of ledger.entries) {
+    if (e.outcome !== "submitted" || e.issuer !== "tick-worker") continue;
+    if (verifiedSubmittedAttempt(taskId, e) === null) continue;
+    if (derivePublishVersion(e.commit, e.publish_attempt) === version) { matched = e; break; }
+  }
+  // (2026-09-20 REVIEW) Reclaim path: a tick that died after issuing but
+  // before recording has no submitted entry. The code-written active claim
+  // (publish-intent-claimed note) + the exact on-disk derived version for
+  // the claimed intent's commit+attempt proves the dead issuance occurred.
+  // Arbitrary/non-current/non-derived versions are still rejected.
+  if (!matched) {
+    const claimed = latestPublishNote(db, taskId);
+    const intentEntry = [...ledger.entries].reverse().find((e) => e.outcome === "publish-intent") || null;
+    if (claimed && claimed.message.includes("publish: publish-intent-claimed") &&
+        intentEntry && /^[0-9a-f]{40}$/.test(intentEntry.commit || "") &&
+        Number.isInteger(intentEntry.publish_attempt) && intentEntry.publish_attempt >= 1 &&
+        derivePublishVersion(intentEntry.commit, intentEntry.publish_attempt) === version &&
+        via === "disk") {
+      matched = {
+        commit: intentEntry.commit,
+        publish_attempt: intentEntry.publish_attempt,
+        // No submitted entry — the reclaim synthesizes the ack from the
+        // claimed intent. The issued_at is unknown; the ack is timeless.
+      };
+    }
+  }
+  if (!matched) {
+    throw usageError("version does not match any issued attempt for this task — the ack is rejected.");
+  }
+  db.exec("BEGIN");
   try {
-    appendFileSync(derived.ledgerPath, JSON.stringify({
-      ts: now(), task_id: taskId, workflow: "unknown-recovery", slug: derived.slug,
-      commit, attempt: derived.attempt, agent_id: null, applied_report: null,
-      outcome: "unknown-classified",
-      detail: `retry re-check ${d}: terminal (${reasons})`,
-    }) + "\n");
-  } catch (e) { /* best-effort observability */ }
-  return { recorded: true, decision: d, routed: terminal };
+    const res = recordVersionAck(db, ctx, {
+      taskId, projectId: project.id, commit: matched.commit, version, via,
+    });
+    db.exec("COMMIT");
+    return res;
+  } catch (e) { db.exec("ROLLBACK"); throw e; }
 };
 
-// Composite: record a phase's session verdict AND its event in one
-// transaction. This is the operation that used to crash the workflow when the
-// two writes went to different contracts: the session stored, the event
-// rejected, the run dead. One transaction, one vocabulary, no partial state.
+// The closed publish-note writer's prose entry point (0.14.6 §1.5): the
+// ONLY way for tick prose to write a state-carrying `publish: <verb>` note.
+// The verb is asserted against the closed registry in
+// lib/publish-note-vocabulary.js — prose cannot mint new `publish: <verb>`
+// states; an unregistered verb is a usage error, never a note.
+//
+// Args: { task_id, note } — the full note text.
+commands["record-publish-note"] = (db, args) => {
+  const taskId = args.task_id;
+  const note = String(args.note || "");
+  if (!taskId) throw usageError("task_id is required.");
+  if (!note) throw usageError("note is required.");
+  const task = db.prepare("SELECT id, state FROM tasks WHERE id = ?").get(taskId);
+  if (!task) throw notFound(`unknown task: ${taskId}`);
+  if (task.state !== "parked") {
+    throw usageError(`task is not parked (state=${task.state}) — publish notes attach to parked tasks.`);
+  }
+  let verb;
+  try {
+    verb = assertWritablePublishNote(note);
+  } catch (e) {
+    throw usageError(e.message);
+  }
+  writePublishNote(db, taskId, note);
+  return { ok: true, task_id: taskId, verb };
+};
 commands["record-phase"] = (db, args) => {
   if (!args.task_id) throw usageError("task_id is required.");
   requireTask(db, args.task_id);
@@ -2404,7 +2534,7 @@ function tryStampInitialProvenance(db, projectId, crewHome, repoPath, deployType
   // Symlink-only resolution: the stamp records the crew home's ACTIVE
   // release — it must not depend on which copy of this file is running.
   // The strict self-path cross-check lives in resolveActiveRelease, used by
-  // scan-verification-pending; requiring it here silently skipped the stamp
+  // the ack/intent scans; requiring it here silently skipped the stamp
   // for every setup path that invokes crew-api.js outside the release tree
   // (room #15: create-project through the npm package's own lib/).
   try { releaseName = resolveActiveReleaseName(crewHome); } catch { releaseName = null; }
@@ -2650,7 +2780,7 @@ commands["update-config"] = (db, args) => {
 // never touches another's row.
 function stampProvenance(db, { project_id, source_commit, crew_release, published_at, task_id }) {
   // task_id invariant (2026-09-19 REVIEW): task_id is set by every REAL
-  // publish (lib/verify-publish.js and the workflow provenance-refresh paths)
+  // publish (the version ack scan and the workflow provenance-refresh paths)
   // and is null for initial stamps (tryStampInitialProvenance) and for
   // publish-base advances (lib/advance-publish-base.js). So
   // provenance.task_id != null ⟺ a real publish has stamped this project.
@@ -2745,12 +2875,12 @@ commands["migrate"] = (db, args) => {
 
 // import-json: one-time import from a dashboard exportCrewState JSON payload.
 // Used for the live migration (the artifact's app.db is never opened directly).
-// Args: { data: { projects: [...], tasks: [...], agent_sessions: [...], events: [...], config: [...], poll_state: [...] } }
+// Args: { data: { projects: [...], tasks: [...], agent_sessions: [...], events: [...], config: [...], poll_state: [...], builder_reports: [...] } }
 // Or pipe the JSON via stdin.
 commands["import-json"] = (db, args) => {
   const data = args.data;
   if (!data || typeof data !== "object") throw usageError("data must be the exportCrewState JSON object.");
-  const tables = ["projects", "tasks", "poll_state", "config", "agent_sessions", "events"];
+  const tables = ["projects", "tasks", "poll_state", "config", "agent_sessions", "events", "builder_reports"];
   const counts = {};
   db.exec("BEGIN");
   try {