muse-crew 0.14.5 → 0.14.7

package/lib/readback-disk.js

@@ -1,195 +0,0 @@
-#!/usr/bin/env node
-// readback-disk.js — deterministic disk read-back sensor for parent publish
-// verification (docs/publish-verification.md).
-//
-// The read-back gap (2026-09-14): the platform removed `artifact_inspect`
-// and no agent-callable content read-back existed, so every artifact publish
-// parked at `publish: verification-requested` permanently. The platform's
-// artifact edits land in its on-disk working copy of the artifact source
-// (~/workspace/ts-spaces/<slug>/ — verified empirically 2026-09-15: added
-// lines present, removed lines absent across real platform commits), so a
-// deterministic local sensor can replace the removed inspection tool: no
-// LLM, no async handoff, no prose to parse.
-//
-// This script is the SENSOR; lib/verify-publish.js stays the judge. It
-// emits the exact machine-readable findings block the verifier already
-// parses:
-//
-//   FILE: <path>
-//   ADDED: <exact added line from the diff> :: PRESENT|ABSENT
-//   REMOVED: <exact removed line from the diff> :: PRESENT|ABSENT
-//   END_FILE
-//
-// one ADDED line per (+) diff line and one REMOVED line per (-) diff line,
-// in diff order. The verdict is PRESENT iff that exact line occurs in the
-// file's CURRENT on-disk source (whole-line match), ABSENT otherwise.
-//
-// Authority boundary: the sensor reads the platform's working copy of the
-// artifact source — the tree the hosted artifact is built/served from. If
-// the working copy is stale relative to a just-applied edit, the findings
-// honestly report ABSENT and the verifier fails CLOSED (parked, never a
-// false stamp). Staleness can only park, never certify.
-//
-// Usage:
-//   node readback-disk.js --repo-path <path> --commit <sha> --base <sha>
-//       --slug <artifact-slug> --task-id <uuid> [--spaces-root <dir>]
-//
-// --base is the previously-stamped provenance source_commit (or the
-// empty-tree sha 4b825dc642cb6eb9a060e54bf8d69288fbee4904 for a first
-// publish) — the SAME base the verifier uses. --spaces-root defaults to
-// ~/workspace/ts-spaces.
-//
-// Exit codes: 0 ok (findings block on stdout) · 2 usage/validation ·
-// 1 git/diff/read failure. On non-zero exit NOTHING is printed to stdout,
-// so a caller must never save stdout as a findings file.
-//
-// Security: the slug is charset-validated and the resolved space directory
-// must stay under the spaces root (realpath containment); every file path
-// from the diff is likewise contained before reading. A path that escapes
-// is a validation failure (exit 2), never a read.
-
-import { execFileSync } from "node:child_process";
-import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
-import { homedir } from "node:os";
-import { join, resolve } from "node:path";
-
-// --help: before required-arg parsing (shebang⇔CLI contract).
-if (process.argv.slice(2).includes("--help")) {
-  console.log(
-    "usage: node readback-disk.js --repo-path <path> --commit <sha> --base <sha> --task-id <uuid> --slug <artifact-slug> [--spaces-root <dir>]\n" +
-    "the deterministic disk read-back SENSOR: emits the machine-readable findings block (FILE:/ADDED:/REMOVED:/END_FILE)"
-  );
-  process.exit(0);
-}
-
-const EMPTY_TREE = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
-
-function arg(name) {
-  const i = process.argv.indexOf(name);
-  if (i < 0 || i + 1 >= process.argv.length) {
-    fail("usage", `${name} is required.`, 2);
-  }
-  return process.argv[i + 1];
-}
-function fail(code, message, exitCode) {
-  // stderr only — stdout must stay empty on failure.
-  process.stderr.write(JSON.stringify({ ok: false, error: code, message }) + "\n");
-  process.exit(exitCode);
-}
-
-const repoPath = arg("--repo-path");
-const commit = arg("--commit");
-const base = arg("--base");
-const slug = arg("--slug");
-const taskId = arg("--task-id");
-const spacesRoot = process.argv.includes("--spaces-root")
-  ? arg("--spaces-root")
-  : join(homedir(), "workspace", "ts-spaces");
-
-if (!/^[0-9a-f]{40}$/.test(commit)) fail("usage", "commit must be a 40-char hex sha.", 2);
-if (!/^[0-9a-f]{40}$/.test(base)) fail("usage", "base must be a 40-char hex sha.", 2);
-if (!/^[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(slug)) {
-  fail("usage", `slug ${JSON.stringify(slug)} is not a safe artifact slug.`, 2);
-}
-
-// Resolve the space directory with realpath containment: the slug must not
-// escape the spaces root (no "..", no symlinks pointing out).
-let spaceDir;
-try {
-  const rootReal = realpathSync(spacesRoot);
-  const candReal = realpathSync(join(spacesRoot, slug));
-  if (candReal !== rootReal && !candReal.startsWith(rootReal + "/")) {
-    fail("usage", `slug ${JSON.stringify(slug)} resolves outside the spaces root.`, 2);
-  }
-  spaceDir = candReal;
-} catch (e) {
-  fail("usage", `cannot resolve space dir for slug ${JSON.stringify(slug)}: ${e.message}`, 2);
-}
-try {
-  if (!statSync(spaceDir).isDirectory()) fail("usage", `space dir ${spaceDir} is not a directory.`, 2);
-} catch (e) {
-  fail("usage", `space dir ${spaceDir} unreadable: ${e.message}`, 2);
-}
-
-// The publish delta is base..commit — the same diff the verifier checks the
-// findings against. Refuse a base that is not an ancestor: certifying a
-// diff against an unrelated tree is worse than no read-back.
-if (base !== EMPTY_TREE) {
-  try {
-    execFileSync("git", ["-C", repoPath, "merge-base", "--is-ancestor", base, commit], { stdio: "ignore" });
-  } catch (e) {
-    fail("usage", `base ${base} is not an ancestor of commit ${commit} — refusing to read back an unrelated tree.`, 2);
-  }
-}
-
-let diff;
-try {
-  diff = execFileSync("git", ["-C", repoPath, "diff", base, commit, "--"], {
-    encoding: "utf8", maxBuffer: 4 * 1024 * 1024,
-  });
-} catch (e) {
-  fail("git", `git diff failed: ${e.message}`, 1);
-}
-if (!diff.trim()) {
-  fail("git", "empty diff for commit — nothing to read back.", 1);
-}
-
-// Parse the diff into per-file added/removed lines (byte-identical parser
-// to build-readback-request.js and verify-publish.js: the verifier looks
-// the raw lines up verbatim, so all three must agree on the split).
-const files = [];
-let current = null;
-for (const line of diff.split("\n")) {
-  if (line.startsWith("diff --git")) {
-    const m = line.match(/^diff --git a\/(.+) b\/(.+)$/);
-    current = { path: m ? m[2] : "unknown", added: [], removed: [] };
-    files.push(current);
-  } else if (current && line.startsWith("+") && !line.startsWith("+++")) {
-    current.added.push(line.slice(1));
-  } else if (current && line.startsWith("-") && !line.startsWith("---")) {
-    current.removed.push(line.slice(1));
-  }
-}
-
-// Whole-line content of a disk file, normalized for the membership test.
-// Trailing-newline artifact popped (same convention as verify-publish.js
-// oldTreeLines); one trailing CR stripped per line so CRLF working copies
-// compare honestly against LF diffs. The RAW diff lines are still what get
-// emitted — the verifier looks those up verbatim.
-const norm = (s) => (s.endsWith("\r") ? s.slice(0, -1) : s);
-function diskLines(absPath) {
-  if (!existsSync(absPath)) return new Set(); // missing file: every line ABSENT
-  let text;
-  try {
-    text = readFileSync(absPath, "utf8");
-  } catch (e) {
-    fail("read", `cannot read ${absPath}: ${e.message}`, 1);
-  }
-  const lines = text.split("\n");
-  if (lines.length > 0 && lines[lines.length - 1] === "") lines.pop();
-  return new Set(lines.map(norm));
-}
-
-const out = [];
-for (const f of files) {
-  // Contain every diff path inside the space dir before reading.
-  const abs = resolve(spaceDir, f.path);
-  if (abs !== spaceDir && !abs.startsWith(spaceDir + "/")) {
-    fail("usage", `diff path ${JSON.stringify(f.path)} escapes the space dir.`, 2);
-  }
-  const present = diskLines(abs);
-  out.push(`FILE: ${f.path}`);
-  for (const line of f.added) {
-    out.push(`ADDED: ${line} :: ${present.has(norm(line)) ? "PRESENT" : "ABSENT"}`);
-  }
-  for (const line of f.removed) {
-    out.push(`REMOVED: ${line} :: ${present.has(norm(line)) ? "PRESENT" : "ABSENT"}`);
-  }
-  out.push("END_FILE");
-}
-
-process.stdout.write(out.join("\n") + "\n");
-process.stderr.write(JSON.stringify({
-  ok: true, slug, task_id: taskId, commit, base,
-  files: files.map((f) => f.path),
-} ) + "\n");

package/lib/retry-publish.js

@@ -1,417 +0,0 @@
-#!/usr/bin/env node
-// retry-publish.js — Deterministic unknown-recovery retry protocol (2026-09-18, should-fix 5;
-// ported 2026-09-20: node:sqlite + crew-state.db (blocker 23) and direct
-// tick-worker issuance (blocker 22 — children cannot reach artifact_edit).
-//
-// The cron Step 4.4 retry protocol was prose-owned: the cron agent performed
-// lock handling, journaling, diff generation, ledger writes, mirroring, and
-// cleanup by following template instructions. A missed step (or a tick dying
-// mid-protocol) left the lock held or the state inconsistent.
-//
-// This command owns all deterministic transitions with try/finally lock
-// release. Only the unavoidable `artifact_edit` tool call remains
-// tick-mediated (it requires the artifact namespace, which this process
-// cannot load): the session-carrying tick worker issues the edit directly
-// in its own turn — NEVER a child (blocker 22, room #24).
-//
-// Two phases:
-//   Phase 1 (prepare): acquire merge lock, re-check HEAD, re-classify,
-//     journal intent, generate diff. Outputs JSON with the diff path/sha
-//     for the tick worker's direct artifact_edit call. The lock is HELD on
-//     success (the tick must call phase 2 to release it).
-//   Phase 2 (complete): given the artifact_edit outcome (accepted/refused),
-//     write the outcome notes, append the ledger entry, mirror verification,
-//     and RELEASE the lock in a finally block.
-//
-// Crash safety: if the tick dies between phases, the lock expires after
-// 600s and the note journal (`publish: retry-intended` without
-// `publish: retry-issued`) lets the next scan mirror verification-requested
-// without re-triggering — exactly one retry, enforced from notes.
-//
-// Usage:
-//   node retry-publish.js --crew-home <path> --task-id <uuid> --phase prepare
-//   node retry-publish.js --crew-home <path> --task-id <uuid> --phase complete --edit-outcome <accepted|refused> [--refusal-text <text>]
-//
-// Exit codes: 0 = success, 1 = terminal stop (no retry), 2 = usage error.
-
-import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync, unlinkSync } from "fs";
-import { join } from "path";
-import { execFileSync } from "child_process";
-import { randomUUID as uuid } from "crypto";
-
-const args = process.argv.slice(2);
-function arg(name, required = true, def = undefined) {
-  const i = args.indexOf(name);
-  if (i === -1 || i + 1 >= args.length) {
-    if (required) { console.error(`missing required arg ${name}`); process.exit(2); }
-    return def;
-  }
-  return args[i + 1];
-}
-function fail(code, msg, exitCode = 1) {
-  process.stdout.write(JSON.stringify({ ok: false, code, message: msg }) + "\n");
-  process.exit(exitCode);
-}
-
-// --help: handled before any required-arg parsing so
-// `node retry-publish.js --help` always exits 0 (entry-gate contract).
-if (args.includes("--help")) {
-  console.log(
-    "usage: node retry-publish.js --crew-home <path> --task-id <uuid> --phase <prepare|complete>\n" +
-    "  prepare:  acquire the merge lock, re-check HEAD, re-classify, journal intent, emit the diff\n" +
-    "  complete: --edit-outcome <accepted|refused> [--refusal-text <text>] — write the outcome,\n" +
-    "            append the ledger entry, mirror verification, and release the lock\n" +
-    "exit 0 = success, 1 = terminal stop, 2 = usage error"
-  );
-  process.exit(0);
-}
-
-const crewHome = arg("--crew-home");
-const taskId = arg("--task-id");
-const phase = arg("--phase");
-
-if (!["prepare", "complete"].includes(phase)) {
-  console.error("phase must be 'prepare' or 'complete'");
-  process.exit(2);
-}
-
-// Retry protocol: phase-1 state is a persistent-disk pin
-// ($CREW_HOME/.pins/ — never /tmp: tmpfs is wiped on cell reboot, and the
-// lock release depends on phase 2 reading this state).
-function pinsDir() {
-  const dir = join(crewHome, ".pins");
-  mkdirSync(dir, { recursive: true });
-  return dir;
-}
-function retryStatePath() {
-  return join(pinsDir(), `retry-publish-${taskId}.json`);
-}
-
-// --- Shared helpers ---------------------------------------------------------
-
-function nowISO() { return new Date().toISOString(); }
-
-function writePublishNote(db, taskId, message) {
-  db.prepare(
-    `INSERT INTO events (id, type, task_id, identity, message, timestamp)
-     VALUES (?, 'note', ?, NULL, ?, ?)`
-  ).run(uuid(), taskId, message, nowISO());
-}
-
-// Load the crew DB via node:sqlite (the runtime's built-in — 2026-09-20,
-// blocker 23: better-sqlite3 is not available and the old code pointed at
-// the wrong database name). crew-api.js opens the same path the same way.
-import { DatabaseSync } from "node:sqlite";
-const dbPath = join(crewHome, "crew-state.db");
-if (!existsSync(dbPath)) fail("no-db", `crew database not found at ${dbPath}`);
-const db = new DatabaseSync(dbPath);
-
-const EMPTY_TREE = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
-
-// The merge lock is per-repo (merge-lock.sh fails closed without
-// CREW_REPO — 2026-09-20: the old code never set it, so the lock could
-// never be acquired). The retry protocol locks the task's own repo.
-function runMergeLock(action, repoPath) {
-  const lockScript = join(crewHome, "lib", "merge-lock.sh");
-  try {
-    execFileSync(lockScript, [action, taskId], {
-      env: { ...process.env, CREW_HOME: crewHome, CREW_REPO: repoPath },
-      encoding: "utf8",
-      timeout: 30000,
-    });
-    return { ok: true };
-  } catch (e) {
-    return { ok: false, error: (e.stderr || e.message || "").slice(0, 300) };
-  }
-}
-
-// --- Phase 1: prepare --------------------------------------------------------
-// Acquires the lock, re-checks HEAD, re-classifies, journals intent,
-// generates the diff. On success the lock is HELD and the output carries
-// the diff path/sha for the tick worker's direct artifact_edit call.
-
-if (phase === "prepare") {
-  // Derive the unknown attempt (same derivation as scan-publish-unknown).
-  const task = db.prepare("SELECT id, state, project FROM tasks WHERE id = ?").get(taskId);
-  if (!task) fail("unknown-task", `task ${taskId} not found`);
-  if (task.state !== "parked") fail("not-parked", `task is not parked (state=${task.state})`);
-
-  const project = db.prepare("SELECT id, deploy_slug, repo_path FROM projects WHERE id = ?").get(task.project);
-  const slug = project && project.deploy_slug;
-  if (!slug) fail("no-slug", "project has no deploy_slug");
-  const repoPath = (project && project.repo_path) || null;
-  if (!repoPath) fail("no-repo", "project has no repo_path — the retry protocol locks the task's repo");
-
-  const ledgerPath = join(crewHome, ".publish-ledger", slug + ".jsonl");
-  let entries = [];
-  try {
-    entries = readFileSync(ledgerPath, "utf8").split("\n")
-      .filter((l) => l.trim().length > 0)
-      .map((l) => JSON.parse(l))
-      .filter((e) => e.task_id === taskId);
-  } catch (e) {
-    fail("ledger-unreadable", `cannot read publish ledger: ${e.message}`);
-  }
-  const unknownEntry = entries[entries.length - 1];
-  if (!unknownEntry || unknownEntry.outcome !== "unknown") {
-    fail("not-unknown", "latest ledger entry is not unknown — nothing to retry");
-  }
-  const commit = unknownEntry.commit;
-  const attempt = unknownEntry.attempt || null;
-  if (!commit || !/^[0-9a-f]{40}$/.test(commit)) {
-    fail("bad-commit", "unknown ledger entry carries no usable commit hash");
-  }
-
-  // 1. Re-check HEAD: must still be the retry target.
-  let head;
-  try {
-    head = execFileSync("git", ["-C", repoPath, "rev-parse", "HEAD"], { encoding: "utf8" }).trim();
-  } catch (e) {
-    fail("head-unreadable", `git rev-parse HEAD failed: ${e.message}`);
-  }
-  if (head !== commit) {
-    writePublishNote(db, taskId,
-      `publish: retry-superseded ${commit} — HEAD is ${head}; the retry target moved. Recovery aborted.`);
-    process.stdout.write(JSON.stringify({ ok: true, phase: "prepare", outcome: "superseded", commit, head }) + "\n");
-    process.exit(0);
-  }
-
-  // 2. Acquire the merge lock.
-  const lock = runMergeLock("acquire", repoPath);
-  if (!lock.ok) {
-    process.stdout.write(JSON.stringify({
-      ok: true, phase: "prepare", outcome: "lock-held",
-      message: `merge lock held for ${taskId}; the drop note is still latest, so the next tick retries`,
-    }) + "\n");
-    process.exit(0);
-  }
-
-  // From here to the end of phase 1, the lock is held. Any failure must
-  // release it — try/finally.
-  let lockHeld = true;
-  const releaseLock = () => {
-    if (lockHeld) {
-      runMergeLock("release", repoPath);
-      lockHeld = false;
-    }
-  };
-
-  try {
-    // 3. Inside the lock, re-classify.
-    let base = EMPTY_TREE;
-    try {
-      const prov = db.prepare("SELECT provenance_source_commit FROM projects WHERE id = ?").get(project.id);
-      if (prov && /^[0-9a-f]{40}$/.test(prov.provenance_source_commit)) base = prov.provenance_source_commit;
-    } catch (e) {
-      releaseLock();
-      fail("provenance-query-failed", `provenance lookup failed: ${e.message} — failing closed`);
-    }
-
-    const classifierPath = join(crewHome, "lib", "classify-publish-absence.js");
-    // Find the trigger entry for the manifest baseline: the OLDEST
-    // tick-worker "submitted" entry by ts (D1, 2026-09-19; entry_kind cut
-    // 2026-09-20; issuer anchor 2026-09-20, one-party worker-owned publish —
-    // only the session-carrying tick worker performs issuance, so only its
-    // stamped writes bind; a workflow-written "submitted" without issuer is
-    // a phantom claim, never a baseline source) — it binds issued_at
-    // (falling back to its ts when the capture was unobserved), the same
-    // anchor verify-publish.js and findTriggerEntry use.
-    // agent_id is null on the issuance entry (no receipt observed at trigger
-    // time) — the baseline comes from manifest_before, never agent_id.
-    const submitted = entries.filter((e) =>
-      e.outcome === "submitted" && e.issuer === "tick-worker" &&
-      e.commit === commit && (attempt == null || e.attempt === attempt));
-    submitted.sort((a, b) => (a.ts || "").localeCompare(b.ts || ""));
-    const trigger = submitted[0] || null;
-    const manifestBefore = trigger && trigger.manifest_before ? JSON.stringify(trigger.manifest_before) : null;
-
-    // Find the park note timestamp for quiesce calculation.
-    const parkNote = db.prepare(
-      `SELECT message, timestamp FROM events WHERE task_id = ? AND type = 'note'
-       AND (message LIKE '%publish: dropped%' OR message LIKE '%publish outcome unknown%')
-       ORDER BY timestamp DESC LIMIT 1`
-    ).get(taskId);
-    if (!parkNote) {
-      releaseLock();
-      fail("no-park-note", "no dropped/unknown park note found — cannot determine quiesce window");
-    }
-
-    const classifierArgs = [
-      classifierPath,
-      "--slug", slug,
-      "--commit", commit,
-      "--base", base,
-      "--trigger-ts", trigger ? (trigger.issued_at || trigger.ts) : parkNote.timestamp,
-      "--park-ts", parkNote.timestamp,
-      "--repo-path", repoPath,
-    ];
-    if (manifestBefore) classifierArgs.push("--manifest-before", manifestBefore);
-
-    let classification;
-    try {
-      const out = execFileSync("node", classifierArgs, { encoding: "utf8", maxBuffer: 4 * 1024 * 1024 });
-      classification = JSON.parse(out);
-    } catch (e) {
-      releaseLock();
-      fail("classifier-failed", `classify-publish-absence.js failed: ${(e.stderr || e.message).slice(0, 300)}`);
-    }
-
-    if (!classification.ok || classification.decision !== "provably-dropped") {
-      // Not dropped — release the lock and route via the existing
-      // record-retry-recheck path (the code owns the routing).
-      releaseLock();
-      process.stdout.write(JSON.stringify({
-        ok: true, phase: "prepare", outcome: "not-dropped",
-        decision: classification.decision,
-        message: "re-classification is not provably-dropped; the tick routes via record-retry-recheck",
-        classification,
-      }) + "\n");
-      process.exit(0);
-    }
-
-    // 3b. Capture the pre-retry manifest baseline (inside the lock).
-    let retryBaseline = null;
-    try {
-      const m = JSON.parse(readFileSync(join(process.env.HOME, "workspace", "ts-spaces", slug, ".space-build", "manifest.json"), "utf8"));
-      if (m && typeof m.built_at === "string" && typeof m.content_sha256 === "string") {
-        retryBaseline = { built_at: m.built_at, content_sha256: m.content_sha256 };
-      }
-    } catch { /* missing/unparsable → null; the verifier fails closed without a baseline */ }
-
-    // 4. Journal the intent BEFORE the trigger.
-    writePublishNote(db, taskId,
-      `publish: retry-intended ${commit} ${nowISO()} — re-issuing the dropped edit once; if this tick dies before the trigger returns, the next scan mirrors verification-requested rather than re-triggering.`);
-
-    // 5. Regenerate the diff deterministically.
-    const diffPath = `/tmp/retry-diff-${taskId}.txt`;
-    let diffMeta;
-    try {
-      const out = execFileSync("node", [
-        join(crewHome, "lib", "compute-publish-diff.js"),
-        "--repo-path", repoPath,
-        "--base", base,
-        "--out", diffPath,
-      ], { encoding: "utf8" });
-      diffMeta = JSON.parse(out);
-    } catch (e) {
-      releaseLock();
-      fail("diff-failed", `compute-publish-diff.js failed: ${(e.stderr || e.message).slice(0, 300)} — intent note stands; next tick mirrors verification-requested`);
-    }
-    if (!diffMeta.ok) {
-      releaseLock();
-      fail("diff-not-ok", `compute-publish-diff.js returned ok:false — intent note stands; next tick mirrors verification-requested`);
-    }
-
-    // Success: lock remains HELD. The tick worker issues the edit directly
-    // in its own turn with the diff, then calls phase 2 (complete) to finish.
-    // Persist the phase-1 state for phase 2 (crash recovery reads the notes,
-    // but phase 2 needs the exact commit/attempt/baseline/ledger path).
-    const statePath = retryStatePath();
-    writeFileSync(statePath, JSON.stringify({
-      task_id: taskId, commit, attempt, slug, repoPath,
-      project_id: project.id, ledger_path: ledgerPath,
-      retry_baseline: retryBaseline,
-      diff_path: diffPath, diff_sha256: diffMeta.sha256,
-      prepared_at: nowISO(),
-    }));
-
-    process.stdout.write(JSON.stringify({
-      ok: true, phase: "prepare", outcome: "ready",
-      task_id: taskId, commit, attempt,
-      diff_path: diffPath, diff_sha256: diffMeta.sha256,
-      slug,
-      message: "lock held; issue the artifact_edit directly in this tick (the session-carrying tick worker owns issuance), then call phase 2 (complete)",
-    }) + "\n");
-    process.exit(0);
-  } catch (e) {
-    releaseLock();
-    throw e;
-  }
-}
-
-// --- Phase 2: complete -------------------------------------------------------
-// Given the artifact_edit outcome, write the outcome notes, append the
-// ledger entry, mirror verification, and RELEASE the lock (finally).
-
-if (phase === "complete") {
-  const editOutcome = arg("--edit-outcome");
-  if (!["accepted", "refused"].includes(editOutcome)) {
-    console.error("--edit-outcome must be 'accepted' or 'refused'");
-    process.exit(2);
-  }
-  const refusalText = arg("--refusal-text", false, "");
-
-  const statePath = retryStatePath();
-  if (!existsSync(statePath)) {
-    fail("no-prepare-state", `no phase-1 state at ${statePath} — the prepare phase did not complete or the state was cleaned`);
-  }
-  const state = JSON.parse(readFileSync(statePath, "utf8"));
-  const { commit, attempt, slug, repoPath, ledger_path: ledgerPath, retry_baseline: retryBaseline } = state;
-  // (2026-09-20, one-party publish) The phase-1 pin carries repoPath; the
-  // merge lock is repo-scoped, so a missing value is a hard failure — the
-  // finally's release must never run against an undefined repo.
-  if (!repoPath) fail("no-repo-in-state", "phase-1 state has no repoPath — cannot release the merge lock safely; the lock lease expires on its own");
-
-  let lockHeld = true;
-  const releaseLock = () => {
-    if (lockHeld) {
-      runMergeLock("release", repoPath);
-      lockHeld = false;
-    }
-  };
-
-  try {
-    if (editOutcome === "refused") {
-      // Conclusive negative: rejected, not unknown. Terminal.
-      writePublishNote(db, taskId,
-        `publish: retry-refused ${commit} — the platform refused the re-issued edit (${refusalText.split("\n")[0].slice(0, 200)}); not retrying again.`);
-      process.stdout.write(JSON.stringify({ ok: true, phase: "complete", outcome: "refused", commit }) + "\n");
-    } else {
-      // The tick worker's direct call ended with no explicit refusal —
-      // fire-and-forget, same shape as the first attempt.
-      writePublishNote(db, taskId,
-        `publish: retry-issued ${commit} — the dropped edit was re-issued once; no explicit refusal was observed.`);
-
-      // Mirror verification with a settle window.
-      const settleMs = Number(process.env.CREW_RETRY_SETTLE_MS) > 0
-        ? Number(process.env.CREW_RETRY_SETTLE_MS)
-        : 20 * 60 * 1000;
-      const notBefore = new Date(Date.now() + settleMs).toISOString();
-      const retryAttempt = attempt ? `${attempt}-retry1` : "retry1";
-      writePublishNote(db, taskId,
-        `publish: verification-requested ${commit} attempt=${retryAttempt} not-before=${notBefore} — unknown-recovery retried the dropped edit once; content verification is the arbiter. Waiting on the manual read-back in docs/publish-verification.md.`);
-
-      // Append the -retry1 ledger entry with the pre-retry baseline (required).
-      const ledgerEntry = {
-        ts: nowISO(),
-        task_id: taskId,
-        workflow: "unknown-recovery",
-        slug,
-        commit,
-        attempt: retryAttempt,
-        agent_id: null,
-        applied_report: null,
-        outcome: "submitted",
-        issuer: "tick-worker",
-        manifest_before: retryBaseline,
-        detail: "retry trigger re-issued after provably-dropped classification",
-      };
-      try {
-        appendFileSync(ledgerPath, JSON.stringify(ledgerEntry) + "\n");
-      } catch (e) {
-        // Best-effort: the note journal is the source of truth, not the ledger.
-        console.error(`ledger append failed (non-fatal): ${e.message}`);
-      }
-
-      process.stdout.write(JSON.stringify({
-        ok: true, phase: "complete", outcome: "issued",
-        commit, attempt: retryAttempt, not_before: notBefore,
-      }) + "\n");
-    }
-  } finally {
-    releaseLock();
-    // Clean up the phase-1 state file (best-effort).
-    try { unlinkSync(statePath); } catch {}
-  }
-  process.exit(0);
-}