muse-crew 0.14.5 → 0.14.7

package/API.md

@@ -34,7 +34,7 @@ Update an existing task's fields. Only `id` is required; all other fields are op
 | `id` | uuid | yes | |
 | `title` | string (1–200) | no | |
 | `description` | string (≤ 3000) | no | |
-| `state` | `todo` · `in_progress` · `parked` · `done` | no | Only the `parked` → `todo` transition stamps `retry_reset_at` to the current server time (UTC, ISO 8601), mechanically restarting the consecutive-failure streak — a re-queued task never inherits its old failures. No other transition stamps it (`parked` → `done`, `todo` → `todo`, and patches without a `state` field do not). |
+| `state` | `todo` · `in_progress` · `parked` · `done` | no | Only the `parked` → `todo` transition stamps `retry_reset_at` to the current server time (UTC, ISO 8601), mechanically restarting the consecutive-failure streak — a re-queued task never inherits its old failures. No other transition stamps it (`parked` → `done`, `todo` → `todo`, and patches without a `state` field do not). Any transition INTO `parked` closes the task's open `workflow_runs` rows to `parked` and fires the dependent cascade-park, exactly like `parktask` (room #26 blocker 37, 2026-09-21: a parked task must never leave a stale `running` telemetry row). |
 | `priority` | `high` · `normal` · `low` | no | |
 | `project` | slug | no | **Project-move guard:** changing this to a different project throws while the task has an active run (an agent session with status `running` that started within the last hour), because the live run keeps the old project's repo context and moving it mid-phase would work on the wrong repo. Wait for the run to finish, or recover/park the task first, then move it. |
 | `workflow` | slug or null | no | |
@@ -92,17 +92,76 @@ Atomically park a task for human attention: sets `state` to `parked`, writes the
 | `task_id` | uuid | yes | |
 | `message` | string (1–1000) | yes | Why the task needs a human; written to the activity feed as a `note` |
 
-Returns `{ "ok": true, "task": {...}, "settled_sessions": <n> }` with the updated task record and the count of sessions settled (`0` when none were running).
+Returns `{ "ok": true, "task": {...}, "settled_sessions": <n>, "closed_workflow_runs": <n>, "cascade_parked": [{ "id", "dep_id" }] }` with the updated task record, the count of sessions settled (`0` when none were running), the count of open `workflow_runs` rows closed to `parked` (`0` when none were open — room #26 blocker 37, 2026-09-21: park never closed telemetry rows, leaving stale `running` rows), and the cascade-parked dependents.
 
-### `resolvepublishunknown`
+**Cascade-park (room #26, 2026-09-21):** parking a task also parks every `todo` task that depends on it — transitively, to a fixpoint — with structured attribution on the existing `parked` state (`park_reason: "dep_parked"`, `park_dep_id` naming the parked dep): never a new state, never silent `todo`, never auto-waived. Each cascade-parked task gets a `blocked` event naming the dependent and the parked dep, and its running sessions are settled. An `in_progress` task is never cascade-parked — a running workflow owns its verdict. The same cascade fires when a task parks through `updatetask` → `parked` or `retry-platform-failure`. When a task leaves `parked` for any other state, its cascade-parked dependents are re-evaluated: re-attributed to another still-parked dep, or returned to `todo` with the attribution cleared. The `parked` → `todo` transition is the designed human waiver — explicit, attributable, never automatic.
 
-Recovery contract for publish attempts parked with an `unknown` outcome (2026-09-14): the rebuild trigger's child failed structured closeout and the in-flight-only build-state poll could not see the completed build, so the workflow parked fail-closed — but the edit may still have gone through. When a platform audit build completed inside the publish window (between the Integrate-completion event and the unknown-outcome park), this action routes the task to the parent's independent content verification WITHOUT re-issuing the edit and WITHOUT stamping provenance. The original unknown ledger entry and park event are preserved; the resolution is appended to the publish ledger (`outcome: "unknown-resolved"`) and to the event log, and a `publish: verification-requested <commit>` note is written so `scan-verification-pending` claims the task on the next tick. The parent's read-back ([publish verification](docs/publish-verification.md)) remains the real verification and can still fail terminally. Cases that stay parked with `{ "resolved": false, ... }`: task not parked, latest ledger outcome not `unknown`, no usable commit on the unknown entry, no audit build inside the publish window, unobservable publish window (missing Integrate-completion or park event), or an already-resolved attempt (idempotent).
+### `scan-publish-intent`
+
+Claims parked publish intents for the tick worker's direct issuance (0.14.6). For each task parked with `publish: publish-requested <commit> attempt=N`, re-derives the version deterministically (never trusts the ledger's), verifies the staged diff's sha256, checks the intent base against stamped provenance, and claims with a 1-hour lease (CAS on `claim_expiry`). Skips: no intent entry, unparseable note, terminal note, unexpired claim (another tick owns it), base-stale (re-queues to the workflow's Publish), backoff not elapsed.
+
+Returns `{ "intent": [...], "skipped": [...], "requeued": [...] }`. Each intent entry carries `task_id`, `commit`, `attempt` (numeric `publish_attempt`), `version` (`<commit>:<attempt>`), `claim_expiry`, `diff_path`, `diff_sha256`, `ledger_path`.
+
+### `record-intent-issuance`
+
+Records the tick worker's direct issuance outcome (0.14.6). Compare-and-swap on `claim_expiry` — a stale tick writes nothing.
+
+| Field | Type | Required | Notes |
+|-------|------|----------|-------|
+| `task_id` | uuid | yes | Must have an unexpired intent claim |
+| `claim_expiry` | ISO-8601 | yes | Must match the claim's expiry (CAS) |
+| `edit_outcome` | `accepted`\|`refused` | yes | The direct `artifact_edit` outcome |
+| `refusal_text` | string | no | Required when `refused` |
+| `reclaimed` | boolean | no | Copy verbatim from the `scan-publish-intent` entry — true when a previous tick died mid-issuance |
+| `receipt_check` | `different`\|`unreadable`\|`match` | required when `reclaimed` is true, forbidden otherwise | The tick worker's step-2 version-receipt check outcome for the reclaimed claim |
+
+`accepted` writes the issuer-stamped `submitted` ledger entry + `publish: edit-issued` note. `refused` writes `rejected` + terminal `publish: publish-refused`. Returns `{ "recorded": true, "edit_outcome" }` or `{ "recorded": false }` on CAS mismatch.
+
+Reclaimed-claim receipt guard (2026-09-21 R-3): a reclaimed claim means a previous tick may have issued the edit without recording it, so `record-intent-issuance` requires the explicit `receipt_check` — the mechanical receipt-check outcome, not a prose judgment. A missing or unknown value is a usage error; `"match"` refuses to record fail-closed (the edit landed — acknowledge via `record-version-ack`, never re-issue); `"different"`/`"unreadable"` record normally with the check carried on the ledger entry. A differing or unreadable receipt is NOT proof the prior attempt's edit did not land — the acknowledgement scan owns that verdict from here.
+
+### `record-builder-report`
+
+Records a builder's refusal report (0.14.6). Mechanically requires the EXACT version in `report_text` — a report that does not echo the version is rejected.
+
+| Field | Type | Required | Notes |
+|-------|------|----------|-------|
+| `task_id` | uuid | yes | |
+| `version` | `<commit>:<attempt>` | yes | Must name an issued attempt |
+| `outcome` | `refused` | yes | (2026-09-20 REVIEW) `acknowledged` is rejected — the positive builder-report path was circular; disk is the sole positive evidence |
+| `report_text` | string | yes | Must contain the exact version |
+
+Returns `{ "ok": true, "publish_attempt" }`. The ack scan consumes refusal reports (terminal `publish: publish-refused`); positive acknowledgements come only from the on-disk version receipt.
+
+### `record-version-ack`
+
+Stamps a version acknowledgement (0.14.6). The version must name an issued attempt for the task/commit.
 
 | Field | Type | Required | Notes |
 |-------|------|----------|-------|
-| `task_id` | uuid | yes | Must be parked with a latest publish-ledger outcome of `unknown` |
+| `task_id` | uuid | yes | |
+| `version` | `<commit>:<attempt>` | yes | Must match an issued attempt's derived version |
+| `via` | string | yes | `disk` only (2026-09-20 REVIEW) |
+
+Stamps provenance, writes terminal `publish: version-acknowledged`, re-queues the task to `in_progress`. Returns `{ "ok": true, "commit", "publish_attempt", "via" }`. The reclaim path accepts the exact disk version for the currently claimed intent when no `submitted` entry exists (dead tick issued but died before recording).
+
+### `scan-ack-pending`
+
+Evaluates version acknowledgements (0.14.6). For each `edit-issued` task: checks the on-disk `.crew-publish-version-<task_id>` receipt (per-task scoped; the SOLE positive evidence — 2026-09-20 REVIEW removed the circular builder-report positive path). Any exact on-disk acknowledgement for an issued version on the task/commit counts (late earlier attempts included). On ack: provenance + terminal `publish: version-acknowledged` + requeue. On explicit refusal (via builder report): terminal `publish: publish-refused`. On 30-minute window expiry (per attempt, anchored at the LATEST issuance): re-issues with a FRESH version, immediately claimable (no backoff). When the 2-hour total budget from the FIRST issuance is exhausted: terminal `publish: version-timeout` (unobserved within budget — the edit may still have landed).
+
+Returns `{ "acknowledged": [...], "refused": [...], "reissued": [...], "timeouts": [...], "skipped": [...] }`.
+
+A dedicated 5-minute `crew-ack-scan` cron (seed/crons.json) runs this command on an observation-only tick so verdicts land quickly; it never issues edits — issuance stays in the 15-minute poll tick's claim-and-issue path.
 
-Returns `{ "resolved": true, "task_id", "commit", "evidence_dir", "audit_report_ok" }` on success, or `{ "resolved": false, "reason" }` when the recovery preconditions are not met.
+### `record-publish-note`
+
+The closed publish-note writer (0.14.6 §1.5). Asserts the note's verb against the writable registry before writing — prose cannot mint new states.
+
+| Field | Type | Required | Notes |
+|-------|------|----------|-------|
+| `task_id` | uuid | yes | |
+| `note` | string | yes | Must start with a registered `publish: <verb>` |
+
+Writable verbs (tick prose via `record-publish-note`): `publish-requested`, `publish-intent-claimed`, `publish-base-stale`, `edit-issued` (transitional only — prose can never mint a terminal). Deterministic code writes terminals via the code-writable registry: `version-acknowledged`, `publish-refused`, `version-timeout`, `publish-unissuable`. Legacy terminals are recognized but NOT writable by anyone. Returns `{ "ok": true, "verb" }` or a usage error.
 
 ---
 
@@ -124,9 +183,9 @@ Create or update an agent session record. Sessions track which identity is worki
 | `notes` | string (≤ 3000) | no | |
 | `failure_reason` | string (≤ 3000) or null | no | |
 | `caveats` | array of `{text, severity}` | no | |
-| `already_merged_sha` | 7–40 lowercase hex or null | no | **Do not set this yourself.** The workflow sets it automatically when it verifies that a task's work is already on the main branch (e.g., landed by a prior run). Written by workflow code (not by the agent's text output) after the `rev-parse` + `merge-base --is-ancestor` check passes; a bad value is a usage error. Review loads it from the field instead of parsing the notes. Null semantics: omitting the field preserves the existing value; passing explicit `null` clears it. `record-phase` always preserves (it never clears). |
+| `already_merged_sha` | 7–40 lowercase hex or null | no | **Superseded (0.14.7, blocker 34):** no workflow writes or reads this field; attribution is classifier-only (the `classify-branch` lifecycle command reports the merge sha on its own `BRANCH_STATE:` line, and Review adopts it from there). Column retained; null on all new rows. Null semantics: omitting the field preserves the existing value; passing explicit `null` clears it. `record-phase` always preserves (it never clears). |
 
-The `already_merged_sha` field exists because session `notes` are hard-capped at 3000 chars: a truthful already-merged declaration at the tail of a long Build report was silently truncated, and Review could not recover it. The sha is managed by the workflow — the workflow writes it after verification, and downstream phases read the field, never the agent's text.
+**Superseded (0.14.7, blocker 34):** no workflow writes or reads this field; attribution is classifier-only. The field's original reason is gone — the pre-Review classifier now answers "already merged, by which merge" in git, before Review, so there is no longer a declaration to carry through session notes. Column retained; null on all new rows.
 
 ### `heartbeat-session`
 
@@ -176,9 +235,35 @@ Atomically record a workflow phase outcome: writes the agent session (with its v
 | `notes` | string (≤ 3000) | no | Phase summary |
 | `event_type` | event type | no | Defaults to the `status` value; use `note` for non-verdict events |
 | `event_message` | string (1–1000) | no | Defaults to "`<identity>` `<step>` `<status>`" |
+| `verdict` | object | no | Optional structured Review verdict record (see below) — the non-lossy verdict grounds |
 
 The CLI exposes this as `record-phase`. All CLI commands use kebab-case (`create-task`, `get-dispatch-state`, etc.) mapping to the action names documented here.
 
+#### Structured verdict records
+
+Session notes are intentionally lossy (truncated at 3000 chars) — Review verdict grounds were destroyed by truncation before reaching `rejectionNotes`, making parks on verified-correct implementations unauditable. `recordphase` optionally carries the full worker report as a verdict payload, validated at the API boundary and written to the `verdicts` table in the same transaction as the session and event, so the lossless record can never be missing when the note exists.
+
+| Field | Type | Required | Notes |
+|-------|------|----------|-------|
+| `step` | `Review` | yes | Verdict records are Review-scoped |
+| `attempt` | integer ≥ 0 | yes | The rework round (0 = first Review) |
+| `reviewer` | string (1–200) | yes | The reviewing identity (e.g. `cass`) |
+| `verdict` | `PASS` · `FAIL` · `INDETERMINATE` | yes | The machine-extracted verdict; `INDETERMINATE` is the fail-closed verdict-extraction failure (bounded re-ask exhausted) — the grounds are still preserved |
+| `grounds` | string (1–1000000) | yes | The full worker report, uncapped |
+| `review_basis` | `mechanical-fail` · `branch-diff` · `runtime-state-none` · `frozen-merge:<40-hex-sha>` · null | no | What the review actually examined (blocker-34 branch classifier). `null` = not branch-classified (docs.js path). Shape-validated at the boundary; malformed values fail the whole `recordphase` call |
+
+`summary` is derived from the session note actually recorded (one source of truth — never a second caller-supplied truncation). One verdict per recording session: a re-recorded phase for the same session is the same evidence, so the first write wins and rows are never revised; a new Review execution claims a new session and gets its own row. A malformed payload fails the whole `recordphase` call (fail closed) — no session, no event, no row. The response carries the recorded (or pre-existing) row as `verdict`, or `null` when no payload was sent.
+
+### `getverdicts`
+
+Return all structured verdict records for a task, ordered by recording time (rework rounds and retries accumulate as separate rows, never overwrite).
+
+| Field | Type | Required | Notes |
+|-------|------|----------|-------|
+| `task_id` | uuid | yes | |
+
+The CLI exposes this as `get-verdicts`.
+
 ---
 
 ## Dispatch
@@ -187,6 +272,8 @@ The CLI exposes this as `record-phase`. All CLI commands use kebab-case (`create
 
 Read the full board state for dispatch decisions. Takes no arguments. Returns all projects with their tasks, simultaneity limits, quiesce state, and active sessions — everything the dispatcher needs to decide what to claim.
 
+Like the zombie-session sweep, this call writes: it first reconciles stranded dependents — any `todo` task whose dep is currently `parked` is cascade-parked with `park_reason: "dep_parked"` attribution (see `parktask`), so no task sits `todo` behind a parked dep for more than one dispatcher tick. Idempotent across ticks; reconciliation parks, never dispatches (cascade-parked tasks carry zero sessions).
+
 Each task in `ready_tasks` carries an explicit retry object:
 
 | Field | Type | Notes |
@@ -209,6 +296,8 @@ A dashboard that omits `retry` or returns an invalid `consecutive_failures` (not
 
 Task `state` vocabulary: `todo` = ready for dispatch; `in_progress` = a workflow run is active or awaiting its next phase; `parked` = human hold, the dispatcher skips it; `done` = all phases finished. `blocked` is never a stored task state — it is derived mechanically from unmet dependencies (surfaced as a `blocked` flag on the task) and never authored by hand.
 
+Park attribution: when a task parks because one of its dependencies parked (cascade-park, see `parktask`), the task record carries `park_reason: "dep_parked"` and `park_dep_id` (the parked dep's id) — machine-queryable attribution on the existing `parked` state, never prose-matched. `null` on both means an ordinary park (human hold); legacy tasks read `null` (no backfill by design). Leaving `parked` clears the attribution.
+
 Session `status` vocabulary: `failed` = a phase was attempted but did not finish (retryable); `rejected` = an explicit phase verdict (Review/QA said no), routed through rework. Workflows never record `blocked` for operational failures — that word is reserved for the dependency signal.
 
 Two namespaces, not one: the vocabulary above is the **dashboard API** (task states, session statuses, event types). Workflow scripts additionally return a **workflow result envelope** to their launcher (`{status: "ok" | "failed" | "parked", ...}`) and may return `{__hatchWorkflowControl: "blocked"}` as a runtime halt signal. The `"blocked"` inside `__hatchWorkflowControl` is a workflow-runtime mechanism, unrelated to the dashboard's dependency-derived `blocked` — same word, different namespace. `parked` as a workflow return means the workflow parked the task via `parktask` and the launcher should treat the run as complete.
@@ -271,6 +360,8 @@ Record the start of a workflow run. The API mints the `run_id` (UUID, SQLite-sid
 
 Returns `{ ok: true, run_id }`.
 
+Refuses (2026-09-21, fail closed): starting a run for a task already in a terminal or parked state is rejected — a late start after an external park must not resurrect a `running` row.
+
 ### `record-run-event`
 
 Record a single telemetry event. Prefer `record-run-events-batch` for multiple events.
@@ -303,6 +394,8 @@ Record the terminal state of a workflow run.
 | `run_id` | string | Required. |
 | `status` | string | Required. One of `completed`, `failed`, `parked`, `timed_out`. |
 
+Late-write guard (2026-09-21, fail closed): the end update only lands when the run's status is still `running`. A zombie/duplicate worker's late end after the row was closed to `parked` (or any other terminal state) is a silent no-op — parking is the designed terminal state for the run, and a late writer must never overwrite it.
+
 ### `get-run-timeline`
 
 Get a workflow run (or all runs for a task) with its events.
@@ -360,7 +453,7 @@ Retry a task whose workflow died on a platform failure. Clears the stale reserva
 - on `requeued`: running sessions → `stalled` (the dispatcher already treats `stalled` as a retry candidate);
 - on `parked`: running sessions → `failed` (what `recover-task` accepts), same as `park-task`.
 
-Returns `{ ok: true, action: "requeued"|"parked"|"skipped", ..., settled_sessions: <n> }`.
+Returns `{ ok: true, action: "requeued"|"parked"|"skipped", ..., settled_sessions: <n>, closed_workflow_runs: <n> }` — the parked path also closes the task's open `workflow_runs` rows to `parked` in the same transaction (room #26 blocker 37, 2026-09-21).
 
 **Supersede guard:** if a newer platform run has been linked for this task since this failure's run, the task is already owned by the successor — the retry is skipped instead of clobbering live work (a late detection of an old dead run never resets a redispatched task).
 
@@ -483,9 +576,10 @@ project row carries its own publish base (`provenance_source_commit`,
 a crew home with N artifact projects carries N independent bases. There are
 two stamp call paths, and they are different operations on the same row:
 
-- **Full stamp** — called by the parent's publish verification (`lib/verify-publish.js`)
-  after independently verifying the rebuilt artifact: `source_commit` is the
-  verified build commit, `crew_release` the active release at publish time.
+- **Full stamp** — called by the ack scan's `record-version-ack` (the 0.14.6
+  version machine) after the exact per-attempt version is observed on the
+  artifact's disk: `source_commit` is the acknowledged build commit,
+  `crew_release` the active release at publish time.
 - **Refresh** — called by the release installer (`lib/advance-publish-base.js`)
   after installing/activating a crew release: `crew_release` is refreshed to
   the live release identity while preserving the existing `source_commit`.

package/docs/decisions/AGENTS.md

@@ -28,7 +28,9 @@ re-verified that every `docs/decisions/*.md#anchor` reference in
 - `#provenance-refresh` — Provenance refresh for self-publishes
 - `#parent-owned-verification` — Publish content verification — parent-owned
 - `#already-merged-corrective` — Already-merged corrective
+- `#false-negative-review-guard` — False-negative Review guard (room #26 blocker 34 — deleted, redesigned as the pre-Review branch-state classifier)
 - `#merge-record-helpers` — Merge-record helpers
+- `#stale-merge-recovery-identity` — Stale-merge recovery identity (room #26 blocker 35)
 - `#publish-diff-base` — Publish diff base (BASE..HEAD)
 - `#attribution-limitation` — Attribution timing limitation
 - `#read-back-request` — Publish read-back request (currently unavailable)
@@ -57,6 +59,9 @@ re-verified that every `docs/decisions/*.md#anchor` reference in
 - `#d1-issuance-time` — D1 issuance-time field (`issued_at`; `entry_kind` cut 2026-09-20)
 - `#detached-head-audit` — Detached-HEAD audit (0.14.2)
 - `#detached-head-audit-redo` — Detached-HEAD audit REDO (0.14.3, supersedes findings 3/5)
+- `#version-acknowledgement` — Version acknowledgement replaces content verification (0.14.6)
+- `#version-review-dispositions` — 2026-09-20 amended REVIEW dispositions (14 mechanical fixes)
+- `#version-not-hash` — 2026-09-20: version number replaces the sha256 nonce
 
 ## qa-reproduce.md — Decision history: qa reproduce
 

package/docs/decisions/publish-path.md

@@ -1,5 +1,18 @@
 # Decision history: publish path
 
+> **SUPERSESSION NOTICE (2026-09-20, 0.14.6 version machine REVIEW):** This
+> document records the decision history of the RETIRED publish machinery
+> (two-party trigger, fire-and-forget observation, content verification,
+> pre-trigger baselines, artifact toolcheck). The sections below describe
+> that machinery in present tense as "Invariants" — they are HISTORICAL,
+> not current. The current publish path is the one-party worker-owned version
+> acknowledgement machine: the workflow stages a checksummed diff and
+> parks with `publish: publish-requested`; the session-carrying tick
+> worker claims the intent, issues the edit via `artifact_edit`, and the
+> ack scan observes the exact per-attempt version on the artifact's disk as
+> the sole positive evidence. See `docs/publish-verification.md` for the
+> current contract.
+
 Relocated from workflow source comments during H5 (2026-09-18). The workflows keep only the relied-upon invariant inline; the full decision history lives here.
 
 <a id="fire-and-forget-trigger"></a>
@@ -694,16 +707,39 @@ Applies to: chore.
 <a id="already-merged-corrective"></a>
 ## Already-merged corrective
 
-Invariant: when Review rejects an empty branch but the work is already on main (workflow-verified sha), Wren must declare it — not re-implement or re-commit already-landed work. Scoped to the empty-branch rejection.
+Invariant: whether the branch's work is already on the line is a git fact, answered BEFORE Review in git, never in prose and never by the reviewer. The pre-Review branch-state classifier (`classify-branch <task_id>` in `lib/worktree-lifecycle.sh`, pure git) emits exactly one stdout line — `BRANCH_STATE: has-work | already-merged:<40-hex> | empty-no-work` — and exits 1 with diagnostics on stderr when the branch is unclassifiable (fail closed: an unclassifiable branch is treated as empty-no-work, a mechanical FAIL).
 
-Applies to: standard, bugfix, chore.
+Attribution is identity-first, never declared: (1) the live merge carrying the branch's CURRENT tip (`current_branch_merge`, blocker 35's identity primitive) — if the tip is on the live line via a merge, that merge IS the deliverable; (2) the task's own durable merge records (`$CREW_HOME/.merge-records/<task_id>`, append-only, preserved by post-deploy), newest first, at most 20 candidates — the first that resolves to a MERGE commit and is an ancestor of the live integration target wins, canonicalized to full 40-hex. An arbitrary non-merge ancestor is never the task's merge. The newest stale-but-resolvable record poisons older fallback.
+
+Routing: `has-work` → Cass reviews the normal inspect; `already-merged:<sha>` → Cass reviews the frozen first-parent diff (`git diff <sha>^1 <sha>`) — she judges quality/spec compliance, never emptiness; `empty-no-work` → mechanical FAIL, Cass never dispatched — unless the plain `repo_diff: none` runtime-state marker survives in the Build notes, in which case Cass gets a plausibility judgment (the only empty-branch case she ever sees). The old empty-branch rule, the Build's SHA-bearing `repo_diff: none (already-merged: <sha>)` declaration, the declared-sha classifier input, Review hydration, and the post-rejection corrective are all deleted. The structured `review_basis` verdict field records what the review actually examined (`mechanical-fail` | `branch-diff` | `runtime-state-none` | `frozen-merge:<sha>`).
+
+Applies to: standard, bugfix, chore. docs.js has no empty-branch rule and carries no classifier.
+
+```
+    // Already-merged corrective (room #26 blocker 34, redesign 2026-09-21):
+    // branch state is classified in git before Review (classify-branch):
+    // has-work | already-merged:<sha> | empty-no-work. The reviewer never
+    // adjudicates git identity.
+```
+
+<a id="false-negative-review-guard"></a>
+## False-negative Review guard (deleted — redesigned as the pre-Review branch-state classifier)
+
+Incident: room #26 J2 parked after cass's Review false-rejected an empty branch. The shuffle deliverable had already landed on main via the task's own prior Integrate (merge e69ae33e), so the rework Build committed nothing — and at 06:25:49Z the Build had in fact declared `repo_diff: none (already-merged: e69ae33ea11d696e428a17290fce6e33d1833312)` in its report (earlier notes omitted this declaration — the correction matters: the evidence WAS there). Cass rejected at 06:30:34Z anyway, claiming no declaration existed and confusing the verified sha with git's empty-tree object (4b825dc642cb6eb9a060e54bf8d69288fbee4904). The shared rework budget burned on the false negative and the journey parked.
+
+First fix (deleted): a post-rejection safeguard — the workflow checked the task's merge record after Review rejected, recovered the sha, skipped the budget check for guard-fired rounds, and parsed reviewer prose for the empty-branch sentence to drive git state. It worked but answered the question AFTER the rejection, in prose, at the wrong layer.
+
+Redesign (2026-09-21, blocker 34, v2.1): the question is answered BEFORE Review, in git, never in prose — see `#already-merged-corrective` for the canonical design. The declared-sha path was deleted from the classifier per the v2.1 reconciliation: the classifier is a pure function of (branch, merge records, target), `classify-branch <task_id>`, one argument. Merge records survive deployment (post-deploy no longer deletes them — they are the durable per-task delivery log). Routing summary: `has-work` → Cass on the normal inspect; `already-merged:<sha>` → Cass reviews the frozen first-parent diff; `empty-no-work` → mechanical FAIL without dispatching Cass, with the `REVIEW_BASIS:` session-note marker naming the basis (mechanical-fail / frozen-merge / branch-diff / runtime-state-none). The plain `repo_diff: none` runtime-state claim is captured at Build closeout from the full report (same-process Review never depends on the 2000-char session-note truncation); there is no hydration fallback for the plain claim. The rework budget applies uniformly to every rejection; no prose regex ever drives git state. The post-rejection guard, its test file, and the Case A/B budget exceptions are deleted.
+
+Follow-up (2026-09-21, same shape): the npm `package.json` version check is also a mechanical git fact, not a reviewer judgment. `lib/worktree-lifecycle.sh` gains `version-check <task_id>` (pure git, no LLM): stdout carries only `VERSION_TOUCHED` (the branch's three-dot diff against the integration target touches the `version` field — versions are assigned at publish time, never in branches) or `VERSION_CLEAN` — anything else is a resolution failure (stderr, exit 1, fail closed). For npm projects the workflow runs it before Review; anything but an explicit `VERSION_CLEAN` joins the mechanical FAIL gate (no Cass dispatch). Cass keeps judging release necessity and version-bump scope — never whether the branch touched the field.
+
+Applies to: standard, bugfix, chore. docs.js has no empty-branch rule and carries no classifier.
 
 ```
-    // Already-merged corrective (room #16 blocker 11): when Review rejected
-    // an empty branch but the work is already on main (the workflow verified
-    // the sha), Wren must declare it — not re-implement or re-commit
-    // already-landed work. Scoped to the empty-branch rejection; any other
-    // rejection already carries its own specific notes.
+// Room #26 blocker 34 (redesign): the classifier is pure git
+// (classify-branch in the lifecycle script): has-work |
+// already-merged:<sha> | empty-no-work. Git facts are never
+// adjudicated by a reviewer.
 ```
 
 <a id="merge-record-helpers"></a>
@@ -721,6 +757,15 @@ Applies to: standard, bugfix, chore.
 // no clock. Byte-identical in standard.js, bugfix.js, chore.js.
 ```
 
+<a id="stale-merge-recovery-identity"></a>
+## Stale-merge recovery identity (blocker 35, 2026-09-21)
+
+Room #26 J3 parked after 3 consecutive Integrate failures. Mechanical: Integrate #1 merged locally but the push failed on an SSH host-key flake; the ERROR-after-MERGED retry path later pushed a stale merge; meanwhile rework had changed the task branch, so subsequent Integrates collided with the task's own stale merge (CONFLICT in theme.css). Two fibs: (a) the push environment is trusted but flaked; (b) "retry the push" assumed branch state == pushed state.
+
+The fix is in the lifecycle, not the prompt. The old merged-but-unpushed recovery checked only that the RECORDED merge is an ancestor of live HEAD — ancestry proves containment, not identity. Both recovery paths (`cmd_integrate`'s ahead==0 branch and `cmd_push_target`'s record path) now prove identity via `current_branch_merge()`: the newest merge on live HEAD's first-parent chain whose branch-side parent (^2) is the branch's CURRENT tip. cmd_integrate always merges with --no-ff, so M^2 is the branch tip at merge time. The first-parent walk also covers do_push's reconcile merges above the recorded commit and the manual R5 merge (scratch-worktree merge, ff'd onto the line). No such merge plus a record means the branch moved since the merge — STALE_MERGE fails closed (never pushed, never MERGED_EMPTY: an unpushed merge may sit on the line and MERGED_EMPTY would report PASS while the publish diff still carries the abandoned work). Branch gone (merge-lease reclaim): no rework could have moved it, so the recorded merge on the line is still the deliverable — the old ancestry check is kept for exactly that case. The STALE_MERGE marker is documented in the Integrate instructions as VERDICT: FAIL (standard/bugfix/chore).
+
+Applies to: lib/worktree-lifecycle.sh; standard, bugfix, chore (one marker line).
+
 <a id="publish-diff-base"></a>
 ## Publish diff base (BASE..HEAD)
 
@@ -911,6 +956,8 @@ Applies to: standard, bugfix, chore.
 <a id="already-merged-hydration"></a>
 ## Already-merged hydration
 
+**Superseded (2026-09-21, blocker 34 redesign):** the hydration ferry (structured field first, notes fallback) is deleted. See `#already-merged-corrective` for the current design.
+
 Invariant: when the run did not execute Build itself, recover the workflow-verified sha; the structured session field is read FIRST, the notes line is only a fallback (session notes are hard-capped at 3000 chars).
 
 Applies to: standard, bugfix, chore.
@@ -932,6 +979,8 @@ Applies to: standard, bugfix, chore.
 <a id="already-merged-declaration"></a>
 ## Already-merged declaration
 
+**Superseded (2026-09-21, blocker 34 redesign):** the agent-authored `repo_diff: none (already-merged: <sha>)` declaration is deleted. See `#already-merged-corrective` for the current design.
+
 Invariant: when the builder correctly makes no commit because the deliverable is already on main, it declares repo_diff: none (already-merged: <sha>) naming the main commit that carries the work.
 
 Applies to: standard, bugfix, chore.
@@ -1065,6 +1114,8 @@ Applies to: standard, bugfix, chore.
 <a id="already-merged"></a>
 ## Already-merged attestation
 
+**Superseded (2026-09-21, blocker 34 redesign):** the Build-gate attestation (`already_merged_verified:`) is deleted. See `#already-merged-corrective` for the current design.
+
 Invariant: when the Build gate verifies already-merged, attestation is recorded.
 
 Applies to: standard, bugfix, chore.
@@ -1142,6 +1193,8 @@ Applies to: standard, bugfix, chore.
 <a id="already-merged-idem"></a>
 ## Already-merged idempotency
 
+**Superseded (2026-09-21, blocker 34 redesign):** the agent-authored declaration + mechanical verification is deleted. See `#already-merged-corrective` for the current design.
+
 Invariant: an already-merged repo_diff is idempotent; no rebuild.
 
 Applies to: standard, bugfix, chore.
@@ -1239,6 +1292,8 @@ Applies to: standard, bugfix, chore.
 <a id="already-merged-hydra"></a>
 ## Already-merged hydration
 
+**Superseded (2026-09-21, blocker 34 redesign):** the hydration ferry is deleted. See `#already-merged-corrective` for the current design.
+
 Invariant: when this run did not execute, hydration uses the existing merge.
 
 Applies to: standard, bugfix, chore.
@@ -1260,7 +1315,13 @@ Applies to: standard, bugfix, chore.
 <a id="already-merged-idem2"></a>
 ## Already-merged idempotency
 
-Invariant: idempotency for already-merged tasks.
+**Superseded (2026-09-21, blocker 34 redesign):** the agent-authored
+`repo_diff: none (already-merged: <sha>)` declaration is deleted. Attribution
+is now classifier-only — see `#already-merged-corrective` for the current
+design (pre-Review `classify-branch`, identity-first from git, no declared
+sha, no hydration, no Build-closeout verification).
+
+Invariant (historical): idempotency for already-merged tasks.
 
 Applies to: standard, bugfix, chore.
 
@@ -1361,7 +1422,7 @@ Consumers (one anchor, shared): `lib/verify-publish.js`,
 `lib/crew-api.js::findTriggerEntry`, the classifier
 (`lib/classify-publish-absence.js`), and the retry writer
 (`lib/retry-publish.js`) all take the oldest matching "submitted" by `ts`
-and bind `issued_at || ts`. Platform nonce: deferred, not filed in this
+and bind `issued_at || ts`. Platform version: deferred, not filed in this
 change.
 
 Edge cases:
@@ -1560,3 +1621,180 @@ trigger anchor), lib/publish-note-vocabulary.js (publish-requested,
 publish-intent-claimed, publish-refused), seed/cron-body-template.md
 (steps 4.4b, 4.4 retry direct-issuance), docs/publish-verification.md,
 docs/publish-unknown-recovery.md.
+
+<a id="version-acknowledgement"></a>
+## Version acknowledgement replaces content verification (0.14.6, 2026-09-20)
+
+**Eric's contract:** "If we hear that the artifact acknowledges our version,
+that's it. We don't verify against content."
+
+The content-verdict machine (read-back, `verify-publish.js`, the unknown-
+recovery classifier, the retry harness) is deleted. Exact per-attempt version
+acknowledgement is the sole positive completion criterion.
+
+**The version:** `sha256("publish-version:v1:" + task_id + ":" + commit + ":" +
+publish_attempt)` — deterministic, 64 hex. Synthesized into the staged diff
+as `.crew-publish-version` (checksum covers it; never committed). The workflow
+replay key (`attempt`, a string) is separate from the numeric
+`publish_attempt`.
+
+**The loop:** workflow stages intent (attempt 1) → tick worker claims via
+`scan-publish-intent` → issues directly → `record-intent-issuance` writes
+`submitted` + `publish: edit-issued` → `scan-ack-pending` watches for the
+exact version on disk or in a builder report. Any issued version for the
+task/commit counts (late earlier attempts included). Refusal is terminal.
+45-min window per attempt, 3 attempts max, 15/45-min backoff. Third expiry
+→ `publish: version-timeout`.
+
+**Provenance certifies request acknowledgement, not byte equality.**
+
+Applies to: lib/compute-publish-diff.js (--task-id/--attempt, version hunk),
+lib/crew-api.js (scan-publish-intent, record-intent-issuance,
+record-builder-report, record-version-ack, scan-ack-pending,
+record-publish-note), lib/publish-note-vocabulary.js (WRITABLE split:
+legacy terminals recognized, not writable), workflows/{standard,bugfix,
+chore}.js (Publish exits at intent with `attempt=1`), seed/cron-body-
+template.md (tick protocol), docs/publish-verification.md,
+docs/publish-unknown-recovery.md (retired).
+
+## 2026-09-20 (post-REVIEW amendment) — bounds re-set, observation split from mutation
+
+Before PUBLISH, Eric challenged the bounds as unmeasured placeholders and
+approved a replacement:
+
+- **Observation is cheap and read-only; mutation is not.** The old bounds
+  coupled them: the 45-minute window + 15/45-minute backoffs + 3-attempt cap
+  were all guesses, and the scan ran inside the 15-minute poll tick, so a
+  verdict could never land sooner than the tick cadence.
+- **New shape:** the ack scan runs on its own 5-minute `crew-ack-scan` cron
+  (observation-only — it never issues edits); the 15-minute poll tick keeps
+  the claim-and-issue path. The scan cadence no longer constrains verdict
+  latency: with 6 scans per window, the verdict lands within one cadence of
+  the ack or the expiry.
+- **New bounds:** 30-minute acknowledgement window per attempt (anchored at
+  the LATEST issuance — evidence-set: room #25's one healthy ack landed
+  ~15-17 minutes after issuance, so the window is ~2x that plus margin),
+  immediate reissue at expiry (`not_before: null` — no backoff), and a
+  2-hour total budget from the FIRST issuance, after which the scan parks
+  terminal `publish: version-timeout`. The fixed 3-attempt cap is gone — a
+  slow-but-healthy artifact no longer false-timeouts, and a dead one still
+  terminates on the budget. The ledger records issued_at and first-seen ack
+  per attempt, so the window is tunable from measured data.
+
+<a id="version-review-dispositions"></a>
+## 2026-09-20 (amended REVIEW dispositions) — 14 mechanical fixes
+
+A five-critic read-only review (Architect, Subtractor, Reliability, Room
+Operator + step-back) of the amended 0.14.6 tree returned
+ACCEPT-WITH-CONCERNS, no REJECTs. All 14 dispositions applied before the
+amended BUILD commit:
+
+1. **Torn reissue staging is note-keyed.** The ack scan's reissue
+   idempotency guard is keyed on the `publish: publish-requested <commit>
+   attempt=N` note — the same anchor `scan-publish-intent` claims on —
+   not the ledger line. A crash between the ledger append and the note
+   write (or a rolled-back COMMIT) leaves an orphan line; the note-keyed
+   guard self-heals by re-appending the content-identical line. Write
+   order stays line-then-note: note-first would park permanently on a
+   tear.
+2. **`publish: version-timeout` vocabulary** now reads the 2-hour
+   acknowledgement-budget meaning, not "three issuance attempts
+   exhausted".
+3. **Dead backoff guard deleted** from `scan-publish-intent` (the amended
+   design never writes `not_before`).
+4. **`not_before` plumbing removed**: no longer on claimed intents,
+   reissue results, or ledger lines — the field is gone entirely, not
+   even null-inline (nothing reads it; a dead field is the opposite of
+   the disposition).
+5. **Version-mismatch is per-entry**: a corrupt submitted entry is
+   quarantined; valid derivation-verified entries still drive the windows
+   and the budget. Only when NO entry verifies does the record park as
+   `version-mismatch`.
+6. **Unparseable latest issuance is an unknown window**: never reported
+   as "window-open"; the budget check still runs (a corrupt latest
+   timestamp cannot defer the terminal timeout), but reissue is withheld
+   until the budget decides.
+7. **Ack-scan failure is mechanical**: nonzero exit → report stderr
+   verbatim, take no other action, no rerun, no other Crew API command,
+   stop.
+8. **Tests extended** in the existing `tests/scan-publish-intent.test.js`
+   (no new file): reissue idempotency across repeated scans, exact `>=`
+   budget boundary (inside reissues, at-boundary times out), unparseable
+   first issuance (`first-issuance-unparseable` park), unparseable latest
+   issuance (reissue withheld), duplicate submitted entries (deduped),
+   corrupt version beside a valid entry (quarantined), all-invalid
+   versions (`version-mismatch` park), on-disk version naming no issued
+   attempt (ignored), per-task receipts never cross-attributed, torn
+   reissue prepare self-heals via the note-keyed guard.
+9. **Receipt scoped per task** (verified possible): per-project
+   simultaneity defaults to 2 and parked tasks don't count as in-flight,
+   so two same-project tasks CAN sit in `edit-issued` concurrently — a
+   shared per-slug `.crew-publish-version` would let each issuance
+   overwrite the other's acknowledgement (receipt ping-pong). The
+   receipt is now `.crew-publish-version-<task_id>` in the staged diff
+   hunk and on disk.
+10. **Cron id overrides validated at init**: an override must start with
+    `<manifest-id>-`, so uninstall's prefix-based discovery fallback can
+    always find the job even if `.cron-registry.json` is lost.
+11. **`crew-burn-room.sh`** (outside the repo): `--crons-removed` caller
+    attestation is REQUIRED — the script refuses to burn without it
+    (fail-closed; it cannot reach the scheduler, so the contract is
+    honest: the caller removes poll/ack-scan/update-watch/journey-watch
+    via cron.remove first and attests the ids). `roomNN-journey-watch`
+    added to the convention list. `--ts-spaces <slugs>` moves the room's
+    artifact records into the trash (already-gone is fine).
+12. **Stuck-publish runbook** in `docs/guide.md`: the ack scan stages
+    reissues, the poll tick issues them — if the poll tick is down,
+    reissues stay staged and the budget eventually parks
+    `publish: version-timeout`.
+13. **Receipt scope documented**: the version proves adoption into the
+    artifact's on-disk source tree — not a successful rebuild or
+    redeployment.
+14. **Result taxonomy fixed**: `timeouts[]` is terminal-budget exhaustion
+    only; window expiries are `reissued[]`.
+
+**Follow-up fix found in final pre-commit inspection (same day):** the
+version-not-hash cut left the old 64-hex nonce regex in the Publish
+phase of `workflows/standard.js`, `bugfix.js`, and `chore.js` — the
+format gate would have rejected every `<commit>:<attempt>` version and
+parked every publish. All three now mirror `isPublishVersion()` from
+`lib/crew-api.js`, and `tests/compute-publish-diff.test.js` carries a
+mechanical guard asserting the workflow regex matches the library's
+(and the stale 64-hex shape is gone). The full suite passed before this
+was found because no test executes the workflow's Publish gate — the
+guard closes that hole.
+
+Step-back conclusions recorded: the five-minute observer costs ~192
+marginal task-mode turns/day/room (accepted for current VERIFY
+turnaround); the machine is a compensating control for the platform's
+missing real completion receipt and should be deleted the day the
+platform issues one (see `docs/publish-verification.md`
+§ Decommissioning). Non-blocking backlog: at final timeout, a
+machine-owned audit-directory check could split the park note into
+"landed-but-receiptless" vs "platform-silent".
+
+<a id="version-not-hash"></a>
+## 2026-09-20 — Version number replaces the sha256 nonce
+
+Eric: a nonce is a hash plus a version number — why not just the version
+number? He was right. The sha256 defended against a forger that doesn't
+exist: the builder's failure mode is omission (zero-tool runs), never
+forging our receipts. The artifact's real failure mode — an unfaithful
+carrier that mangles bytes or ignores the request — defeats a hash and a
+plain counter identically. We own the code, so we count our own attempts;
+we don't own the artifact, so verification stays observation of its state,
+never its attestation. The hash pretended to buy attestation.
+
+The per-attempt version is now `<commit>:<attempt>` (e.g.
+`4b825dc6…:2`) — no hash, no task_id (the receipt path
+`.crew-publish-version-<task_id>` and the per-task ledger scoping already
+carry the task). The commit binds the version to the exact code, so a stale
+receipt from an earlier commit can never equal a fresh version — the binding
+the hash used to provide, kept without the cryptography. Derivation is a
+plain concatenation, byte-identical between `compute-publish-diff.js` and
+`derivePublishVersion()` in `crew-api.js`; well-formedness is
+`/^[0-9a-f]{40}:[1-9][0-9]*$/` (`isPublishVersion`). The retry machine,
+windows, budget, and terminal vocabulary are unchanged — only the token got
+honest. Side benefit, and Eric's original motive: the version is
+human-readable observability ("roughly what's deployed") where the hash was
+opaque.

package/docs/decisions/qa-reproduce.md

@@ -484,3 +484,33 @@ Applies to: standard, bugfix, chore.
 // tests/pin-location.test.js.
 ```
 
+
+<a id="content-finding-attribution"></a>
+## Content-finding attribution (blocker 38, 2026-09-21)
+
+Invariant: Hazel reports user-visible content observations in a machine-readable CONTENT-FINDINGS block; the workflow classifies each against the task's publish-diff file set by mechanical set membership; attributable findings become workflow-filed bugfixes; environment-attributable findings are recorded as note events with their attribution — never a bugfix; unknown attribution (diff unavailable) fails closed as "unknown", never assumed environment-attributable. The QA verdict is never overridden by finding attribution — if Hazel reports FAIL, it stands; the recorded attributions give the human evidence to distinguish environment residue from task failure.
+
+Applies to: standard, bugfix.
+
+```
+// Room #26 (2026-09-21): an earlier hosted audit created a "Timer
+// verification deck" through the live artifact; a later shared-concurrent
+// audit observed that persistent row as user-facing content and criticized
+// it. The live production app.db persisted through redeploy while isolated
+// audit DBs sat unused — the shared-concurrent path wrote production.
+// Delphi panel converged 4–0: the required platform fix is isolation using
+// the incumbent isolated workspaces; the crew-side guard classifies
+// findings by attribution. Platform-side isolation is out of crew scope —
+// the crew does not control the hosted shared-concurrent audit write path
+// (zero repo hits; audit data lives under ~/workspace/ts-spaces/<slug>/).
+// Crew-side guard (this decision): publish diff file set persisted at
+// Publish; CONTENT-FINDINGS protocol in the QA prompt (Hazel never files
+// content bugfixes directly); deterministic classifyContentFinding at QA
+// closeout; findings recorded with attribution, never suppressed for
+// looking audit-y. Unknown attribution fails closed — the verdict stands.
+// "live-data" is never in a git publish diff, so it always classifies
+// environment-attributable: the crew has no live-DB write path (blocker 32:
+// QA writes go to a fresh per-run temp DB), so live content is never the
+// task's change. Functional and non-content failures are untouched — they
+// remain actionable.
+```