muse-crew 0.14.5 → 0.14.7

package/lib/crew-api.js

@@ -16,8 +16,9 @@
 //   create-project, update-project, delete-project, list-projects,
 //   get-project, kill-switch, get-config, update-config,
 //   set-provenance, get-provenance, acknowledge-poll,
-//   scan-verification-pending, resolve-publish-unknown,
-//   scan-publish-unknown, record-unknown-classification, record-retry-recheck,
+//   scan-publish-intent, scan-ack-pending,
+//   record-intent-issuance, record-intent-unissuable,
+//   record-builder-report, record-version-ack, record-publish-note,
 //   record-phase (composite), migrate (one-time import)
 //
 // Output is JSON on stdout. Errors are JSON on stderr.
@@ -36,7 +37,7 @@ import { classifySurface } from "./classify-surface.js";
 // never as unrecognized. Pin-adjacent: every runtime-relative dependency
 // of crew-api.js is pinned in the workflows' pinLifecycle (PIN_BASENAMES),
 // mechanically verified by tests/pin-closure.test.js.
-import { matchTerminalPublishNote, TERMINAL_NOTE_MEANINGS } from "./publish-note-vocabulary.js";
+import { matchTerminalPublishNote, TERMINAL_NOTE_MEANINGS, assertWritablePublishNote, assertCodeWritablePublishNote } from "./publish-note-vocabulary.js";
 
 // ---------------------------------------------------------------------------
 // Errors
@@ -337,6 +338,74 @@ function openDb(crewHome) {
     }
     // Legacy global-provenance backfill (watermarked, runs at most once).
     backfillProjectProvenance(db);
+    // Migration: cascade-park columns on tasks (room #26 blocker 36,
+    // 2026-09-21). A parked dep strands its todo dependents with zero
+    // telemetry; parking a task now cascade-parks them with structured
+    // attribution on the parked state (park_reason='dep_parked' +
+    // park_dep_id). Same idempotent PRAGMA-check pattern; ADD COLUMN
+    // without a default leaves existing rows NULL ("ordinary park", never
+    // fabricated). The pairing invariant lives in crew-api.js — SQLite
+    // forbids cross-column CHECKs on ADD COLUMN (verified live: "error in
+    // table after add column: no such column").
+    const taskCols = db.prepare("PRAGMA table_info(tasks)").all();
+    if (!taskCols.some((c) => c.name === "park_reason")) {
+      try {
+        db.exec("ALTER TABLE tasks ADD COLUMN park_reason TEXT CHECK (park_reason IS NULL OR park_reason = 'dep_parked')");
+      } catch (e) {
+        // Another process may have added it concurrently; ignore duplicate-column errors.
+        if (!/duplicate column name/i.test(e.message)) throw e;
+      }
+    }
+    if (!taskCols.some((c) => c.name === "park_dep_id")) {
+      try {
+        db.exec("ALTER TABLE tasks ADD COLUMN park_dep_id TEXT");
+      } catch (e) {
+        // Another process may have added it concurrently; ignore duplicate-column errors.
+        if (!/duplicate column name/i.test(e.message)) throw e;
+      }
+    }
+    // Migration: structured verdict records (room #26 blocker 33,
+    // 2026-09-21). Review verdict grounds were destroyed by the 2000-char
+    // session-note truncation — a park on a verified-correct implementation
+    // was unauditable. record-phase now optionally carries the full grounds
+    // and writes them here, uncapped, in the same transaction as the session
+    // note. CREATE TABLE IF NOT EXISTS is natively idempotent (no PRAGMA
+    // dance needed, race-safe). One verdict per recording session
+    // (UNIQUE(session_id)): a re-recorded phase for the same session is the
+    // same evidence, so the first write wins and rows are never revised; a
+    // new Review execution claims a new session and gets its own row. New
+    // table: no backfill — pre-migration verdicts are unrecoverable, which
+    // is the point of this fix.
+    db.exec(`CREATE TABLE IF NOT EXISTS verdicts (
+      id         TEXT PRIMARY KEY,
+      task_id    TEXT NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
+      step       TEXT NOT NULL,
+      attempt    INTEGER NOT NULL CHECK (attempt >= 0),
+      reviewer   TEXT NOT NULL,
+      verdict    TEXT NOT NULL CHECK (verdict IN ('PASS','FAIL','INDETERMINATE')),
+      grounds    TEXT NOT NULL,
+      summary    TEXT NOT NULL,
+      session_id TEXT NOT NULL,
+      created_at TEXT NOT NULL,
+      UNIQUE(session_id)
+    )`);
+    db.exec(`CREATE INDEX IF NOT EXISTS idx_verdicts_task ON verdicts(task_id)`);
+    // Migration: review_basis on verdicts (room #26 blocker 34 redesign,
+    // 2026-09-21). The workflows were already sending review_basis in the
+    // verdict payload and the tests pinned "verdict row carries
+    // review_basis", but validateVerdictPayload dropped it and the table had
+    // no column — the structured basis never landed. Same idempotent
+    // PRAGMA-check pattern as the cascade-park columns; NULL for legacy
+    // rows (unclassified), never fabricated.
+    const verdictCols = db.prepare("PRAGMA table_info(verdicts)").all();
+    if (!verdictCols.some((c) => c.name === "review_basis")) {
+      try {
+        db.exec("ALTER TABLE verdicts ADD COLUMN review_basis TEXT");
+      } catch (e) {
+        // Another process may have added it concurrently; ignore duplicate-column errors.
+        if (!/duplicate column name/i.test(e.message)) throw e;
+      }
+    }
   }
   return db;
 }
@@ -396,6 +465,9 @@ function mapTask(row, taskStates = new Map()) {
     deps,
     filed_by: row.filed_by,
     retry_reset_at: row.retry_reset_at,
+    // Room #26 blocker 36: cascade-park attribution (NULL = ordinary park).
+    park_reason: row.park_reason ?? null,
+    park_dep_id: row.park_dep_id ?? null,
     blocked: deps.some((id) => taskStates.get(id) !== "done"),
     created_at: row.created_at,
     updated_at: row.updated_at,
@@ -433,6 +505,135 @@ function mapEvent(row) {
   };
 }
 
+// Room #26 blocker 33 (2026-09-21): structured, non-lossy verdict records.
+// The session note is truncated at 2000 chars by workflow design; the
+// verdict row carries the full grounds, uncapped.
+function mapVerdict(row) {
+  if (!row) return null;
+  return {
+    id: row.id,
+    task_id: row.task_id,
+    step: row.step,
+    attempt: row.attempt,
+    reviewer: row.reviewer,
+    verdict: row.verdict,
+    grounds: row.grounds,
+    review_basis: row.review_basis ?? null,
+    summary: row.summary,
+    session_id: row.session_id,
+    created_at: row.created_at,
+  };
+}
+
+// RUN-CLOSEOUT ON PARK (room #26 blocker 37, 2026-09-21). Park never
+// closed workflow_runs rows — every park entry point left the task's open
+// rows at 'running' forever. Every park path closes the task's open rows to
+// the given terminal status in the same transaction as the park.
+function closeWorkflowRuns(db, taskId, terminalStatus) {
+  const r = db.prepare(
+    `UPDATE workflow_runs SET status = ?, completed_at = datetime('now')
+     WHERE task_id = ? AND status = 'running'`
+  ).run(terminalStatus, taskId);
+  return Number(r.changes);
+}
+
+// CASCADE-PARK (room #26 blocker 36, 2026-09-21). Park every todo task that
+// depends on any id in parkedIds, with structured attribution on the
+// existing 'parked' state (park_reason='dep_parked', park_dep_id=<the parked
+// dep>) — never a new state, never silent todo, never auto-waived. Then
+// repeat to a fixpoint: a newly parked dependent strands its own
+// dependents. Only todo tasks cascade — an in_progress task's running
+// workflow owns its verdict, so it stays in flight. Emits one 'blocked'
+// event per cascade-parked task, naming the dependent and the parked dep.
+// Returns the list of {id, dep_id} pairs parked.
+function cascadeDepParks(db, parkedIds, timestamp) {
+  const cascaded = [];
+  const frontier = [...parkedIds];
+  const seen = new Set(parkedIds);
+  const parkStmt = db.prepare(
+    `UPDATE tasks SET state = 'parked', park_reason = 'dep_parked', park_dep_id = ?, updated_at = ?
+     WHERE id = ?`);
+  const settleStmt = db.prepare(
+    `UPDATE agent_sessions SET status = 'failed', ended_at = ?
+     WHERE task_id = ? AND status = 'running'`);
+  const eventStmt = db.prepare(
+    `INSERT INTO events (id, type, task_id, identity, message, timestamp)
+     VALUES (?, 'blocked', ?, NULL, ?, ?)`);
+  while (frontier.length > 0) {
+    const parkedId = frontier.shift();
+    const todoRows = db.prepare("SELECT id, deps FROM tasks WHERE state = 'todo'").all();
+    for (const row of todoRows) {
+      if (seen.has(row.id)) continue;
+      if (!parseDeps(row.deps).includes(parkedId)) continue;
+      parkStmt.run(parkedId, timestamp, row.id);
+      settleStmt.run(timestamp, row.id);
+      // Room #26 blocker 37: a cascade-parked dependent may carry a stale
+      // 'running' workflow_runs row (crashed prior run, requeued to todo) —
+      // close it with the park, in the same transaction. Every park path
+      // reaches its dependents through this function, so this one site
+      // covers park-task, update-task, retry-platform-failure, and the
+      // tick reconciliation sweep.
+      closeWorkflowRuns(db, row.id, "parked");
+      eventStmt.run(uuid(), row.id,
+        `dep-parked: ${row.id} parked — dep ${parkedId} is parked; ` +
+        `re-release ${parkedId} or waive this task via update-task to resume`,
+        timestamp);
+      seen.add(row.id);
+      cascaded.push({ id: row.id, dep_id: parkedId });
+      frontier.push(row.id);
+    }
+  }
+  return cascaded;
+}
+
+// RELEASE (room #26 blocker 36, 2026-09-21). When a task leaves 'parked'
+// for any non-parked state, its cascade-parked dependents' contingency is
+// lifted: re-evaluate each. If another of the dependent's deps is still
+// parked, re-attribute the park to that dep (stays parked — never
+// auto-waived past a parked dep); otherwise return it to todo with the
+// attribution cleared. Then repeat to a fixpoint: a dependent returned to
+// todo lifts the contingency of ITS cascade-parked dependents — the release
+// cascades exactly as far as the park did. Emits one 'blocked' event per
+// touched dependent. Returns the list of {id, action, dep_id} outcomes.
+function releaseDepParks(db, releasedId, timestamp) {
+  const outcomes = [];
+  const frontier = [releasedId];
+  const seen = new Set([releasedId]);
+  const depStmt = db.prepare(
+    `SELECT id, deps FROM tasks
+     WHERE state = 'parked' AND park_reason = 'dep_parked' AND park_dep_id = ?`);
+  const stateOf = db.prepare("SELECT state FROM tasks WHERE id = ?");
+  const eventStmt = db.prepare(
+    `INSERT INTO events (id, type, task_id, identity, message, timestamp)
+     VALUES (?, 'blocked', ?, NULL, ?, ?)`);
+  while (frontier.length > 0) {
+    const relId = frontier.shift();
+    for (const row of depStmt.all(relId)) {
+      if (seen.has(row.id)) continue;
+      seen.add(row.id);
+      const otherParked = parseDeps(row.deps).find(
+        (d) => d !== relId && stateOf.get(d)?.state === "parked");
+      if (otherParked) {
+        db.prepare("UPDATE tasks SET park_dep_id = ?, updated_at = ? WHERE id = ?")
+          .run(otherParked, timestamp, row.id);
+        eventStmt.run(uuid(), row.id,
+          `dep-parked: ${row.id} still parked — attribution moved from ${relId} to ${otherParked} (still parked)`,
+          timestamp);
+        outcomes.push({ id: row.id, action: "reattributed", dep_id: otherParked });
+      } else {
+        db.prepare("UPDATE tasks SET state = 'todo', park_reason = NULL, park_dep_id = NULL, updated_at = ? WHERE id = ?")
+          .run(timestamp, row.id);
+        eventStmt.run(uuid(), row.id,
+          `dep-released: ${row.id} returned to todo — dep ${relId} is no longer parked`,
+          timestamp);
+        outcomes.push({ id: row.id, action: "returned_todo" });
+        frontier.push(row.id);
+      }
+    }
+  }
+  return outcomes;
+}
+
 // Retry counting, ported verbatim from the dashboard's retry.ts.
 function countConsecutiveFailures(sessions, retryResetAt) {
   const latest = sessions[0];
@@ -565,6 +766,23 @@ commands["get-dispatch-state"] = (db) => {
      WHERE status = 'running' AND datetime(COALESCE(last_heartbeat, started_at)) < datetime('now', '-1 hour')`
   ).run();
 
+  // Reconcile stranded dependents (room #26 blocker 36, 2026-09-21): park-time
+  // cascades catch new parks, but a legacy or raced row can still sit todo
+  // with a parked dep — and then it would sit forever with zero telemetry.
+  // Every dispatcher tick parks any todo task whose dep is currently
+  // parked, so no task sits todo with a parked dep for more than one tick.
+  // Idempotent (only todo tasks transition, and they stop being todo),
+  // and event-free for tasks already attributed — cascadeDepParks only
+  // writes for newly parked tasks. Same write-on-read precedent as the
+  // zombie-session sweep above.
+  {
+    const parkedIds = db
+      .prepare("SELECT id FROM tasks WHERE state = 'parked'")
+      .all()
+      .map((r) => r.id);
+    if (parkedIds.length > 0) cascadeDepParks(db, parkedIds, now());
+  }
+
   const taskRows = db.prepare("SELECT * FROM tasks").all();
   const projectRows = db.prepare("SELECT * FROM projects ORDER BY display_name").all();
   const configRows = db.prepare("SELECT key, value FROM config WHERE key <> 'simultaneity'").all();
@@ -769,6 +987,13 @@ commands["update-task"] = (db, args, ctx) => {
   const timestamp = now();
   const patch = {};
   setRetryResetAtForTransition(patch, current.state, args.state, timestamp);
+  // Room #26 blocker 36: leaving 'parked' clears this task's own cascade
+  // attribution — the parked->todo waiver is an explicit operator decision
+  // (the task returns todo with blocked=true until its deps are done).
+  if (current.state === "parked" && args.state !== undefined && args.state !== "parked") {
+    patch.park_reason = null;
+    patch.park_dep_id = null;
+  }
   if (args.title !== undefined) {
     const t = args.title.trim();
     if (t.length < 1 || t.length > 200) throw usageError("title must be 1-200 chars.");
@@ -801,6 +1026,21 @@ commands["update-task"] = (db, args, ctx) => {
         `INSERT INTO events (id, type, task_id, identity, message, timestamp)
          VALUES (?, ?, ?, NULL, ?, ?)`
       ).run(uuid(), type, args.id, `Moved \u201c${patch.title ?? current.title}\u201d to ${args.state.replace("_", " ")}.`, timestamp);
+      // Room #26 blocker 36: the dep is no longer parked, so re-evaluate
+      // cascade-parked dependents — their contingency is lifted.
+      if (current.state === "parked" && args.state !== "parked") {
+        releaseDepParks(db, args.id, timestamp);
+      }
+      // Room #26 blocker 36: an operator parking a dep strands its todo
+      // dependents with zero telemetry — cascade-park them in the same
+      // transaction, under the same attribution contract as park-task.
+      if (args.state === "parked" && current.state !== "parked") {
+        // Blocker 37: an operator parking an in-flight task must close its
+        // open workflow_runs rows in the same transaction — park-task and
+        // retry-platform-failure already do; this path was the gap.
+        closeWorkflowRuns(db, args.id, "parked");
+        cascadeDepParks(db, [args.id], timestamp);
+      }
     }
     db.exec("COMMIT");
   } catch (e) { db.exec("ROLLBACK"); throw e; }
@@ -970,6 +1210,14 @@ commands["list-reservations"] = (db) => {
 commands["record-run-start"] = (db, args) => {
   if (!args.task_id) throw usageError("task_id is required.");
   if (!args.workflow) throw usageError("workflow is required.");
+  // A terminal task (parked, done) can never gain a new run: a stale agent
+  // retrying a start against a task that was parked/done since would
+  // resurrect it in the run timeline (2026-09-21 R-2). todo/in_progress
+  // starts stay allowed — telemetry may record before the self-claim.
+  const taskState = db.prepare("SELECT state FROM tasks WHERE id = ?").get(args.task_id);
+  if (taskState && (taskState.state === "parked" || taskState.state === "done")) {
+    throw usageError("task " + args.task_id + " is " + taskState.state + "; cannot start a workflow run.");
+  }
   // The workflow doesn't know its platform run_id; the telemetry run_id is
   // minted here (SQLite-side) so workflow JS never touches randomness.
   const runId = args.run_id || uuid();
@@ -1020,9 +1268,12 @@ commands["record-run-end"] = (db, args) => {
   if (!["completed", "failed", "parked", "timed_out"].includes(status)) {
     throw usageError("status must be completed, failed, parked, or timed_out.");
   }
+  // Terminal runs are immutable: a late run-end can never rewrite a run
+  // the park/fail paths already closed (2026-09-21 R-2). Only a run still
+  // in 'running' may transition; unknown run_ids match nothing (as before).
   db.prepare(
     `UPDATE workflow_runs SET status = ?, completed_at = datetime('now')
-     WHERE run_id = ?`
+     WHERE run_id = ? AND status = 'running'`
   ).run(status, args.run_id);
   return { ok: true, run_id: args.run_id, status };
 };
@@ -1175,8 +1426,15 @@ commands["retry-platform-failure"] = (db, args) => {
           `INSERT INTO events (id, type, task_id, identity, message, timestamp)
            VALUES (?, 'note', ?, NULL, ?, ?)`
         ).run(uuid(), failure.task_id, "Parked: " + msg, ts);
+        // Room #26 blocker 37: park never closed workflow_runs rows — an open
+        // 'running' row would sit forever. Close them to 'parked' in the
+        // same transaction.
+        const closedRuns = closeWorkflowRuns(db, failure.task_id, "parked");
+        // Room #26 blocker 36: the parked dep's todo dependents strand with
+        // zero telemetry otherwise — cascade-park them in the same transaction.
+        const cascadeParked = cascadeDepParks(db, [failure.task_id], ts);
         db.exec("COMMIT");
-        return { ok: true, action: "parked", reason: "max retries exceeded", retry_count: failure.retry_count, settled_sessions: Number(settled.changes) };
+        return { ok: true, action: "parked", reason: "max retries exceeded", retry_count: failure.retry_count, settled_sessions: Number(settled.changes), closed_workflow_runs: closedRuns, cascade_parked: cascadeParked };
       } catch (e) {
         db.exec("ROLLBACK");
         throw e;
@@ -1274,12 +1532,21 @@ commands["park-task"] = (db, args) => {
            notes = notes || ' Parked: ' || ?
        WHERE task_id = ? AND status = 'running'`
     ).run(timestamp, message.slice(0, 500), task.id);
+    // Room #26 blocker 37: park never closed workflow_runs rows — an open
+    // 'running' row would sit forever. Close them to 'parked' in the same
+    // transaction (park is the designed terminal state for the run too).
+    const closedRuns = closeWorkflowRuns(db, task.id, "parked");
+    // Room #26 blocker 36: cascade-park todo dependents in the same
+    // transaction — a parked dep strands them with zero telemetry otherwise.
+    const cascadeParked = cascadeDepParks(db, [task.id], timestamp);
     db.exec("COMMIT");
     const taskStates = new Map(db.prepare("SELECT id, state FROM tasks").all().map((r) => [r.id, r.state]));
     return {
       ok: true,
       task: mapTask({ ...task, state: "parked", updated_at: timestamp }, taskStates),
       settled_sessions: Number(settled.changes),
+      closed_workflow_runs: closedRuns,
+      cascade_parked: cascadeParked,
     };
   } catch (e) { db.exec("ROLLBACK"); throw e; }
 };
@@ -1323,7 +1590,9 @@ commands["recover-task"] = (db, args, ctx) => {
   const note = (args.updated_description ?? "").trim().slice(0, 5000);
   db.exec("BEGIN");
   try {
-    db.prepare("UPDATE tasks SET next_phase = ?, state = ?, updated_at = ? WHERE id = ?")
+    // Room #26 blocker 36: recovery out of 'parked' clears this task's own
+    // cascade attribution and re-evaluates cascade-parked dependents.
+    db.prepare("UPDATE tasks SET next_phase = ?, state = ?, park_reason = NULL, park_dep_id = NULL, updated_at = ? WHERE id = ?")
       .run(targetPhase, newState, timestamp, task.id);
     db.prepare(
       `INSERT INTO events (id, type, task_id, identity, message, timestamp)
@@ -1333,11 +1602,14 @@ commands["recover-task"] = (db, args, ctx) => {
       (task.state !== newState ? ` (state ${task.state} -> ${newState})` : "") +
       (note ? `. ${note}` : ""),
       timestamp);
+    if (task.state === "parked" && newState !== "parked") {
+      releaseDepParks(db, task.id, timestamp);
+    }
     db.exec("COMMIT");
   } catch (e) { db.exec("ROLLBACK"); throw e; }
   const taskStates = new Map(db.prepare("SELECT id, state FROM tasks").all().map((r) => [r.id, r.state]));
   return {
-    task: mapTask({ ...task, next_phase: targetPhase, state: newState, updated_at: timestamp }, taskStates),
+    task: mapTask({ ...task, next_phase: targetPhase, state: newState, park_reason: null, park_dep_id: null, updated_at: timestamp }, taskStates),
     valid_phases: stepNames,
   };
 };
@@ -1425,6 +1697,17 @@ commands["log-event"] = (db, args) => {
   if (!valid.includes(args.type)) throw usageError(`bad event type: ${args.type}.`);
   const message = (args.message ?? "").trim();
   if (message.length < 1 || message.length > 1000) throw usageError("message is required (1-1000 chars).");
+  // (2026-09-20 REVIEW) State-carrying `publish: <verb>` notes are a closed
+  // set: they are read by the ack/intent scans from the events table, so a
+  // prose log-event with type "note" would bypass the vocabulary guard.
+  // Route them through `record-publish-note` (prose) or the guarded code
+  // writer — never log-event.
+  if (args.type === "note" && /publish:\s*[a-z0-9-]+/.test(message)) {
+    throw usageError(
+      "state-carrying publish notes are closed-vocabulary (lib/publish-note-vocabulary.js) — " +
+      "write them via the `record-publish-note` command, not log-event."
+    );
+  }
   if (args.task_id) requireTask(db, args.task_id);
   const event = {
     id: uuid(), type: args.type, task_id: args.task_id ?? null,
@@ -1445,36 +1728,15 @@ commands["get-events"] = (db, args) => {
   return { events: rows.map(mapEvent) };
 };
 
-// Parent publish verification: scan + atomic claim + reconcile.
-//
-// Finds parked tasks whose latest parent publish note is
-// "publish: verification-requested" (the publisher parks instead of
-// stamping, per docs/publish-verification.md) with no terminal parent
-// verdict and no unexpired verification claim. Each returned task is
-// ATOMICALLY claimed by logging a "publish: verification-claimed"
-// note-event with a lease expiry, so two concurrent scanners (or a
-// retrying tick) cannot start a second verification for the same task.
-// The claim is a note, not a state change: the task stays parked, so the
-// dispatcher never dispatches QA mid-verification.
-//
-// Also reconciles the verified-but-still-parked gap: a parked task whose
-// latest parent verdict is "publish: verified" is re-queued to in_progress
-// (the verdict was recorded but the re-queue was lost to a crash).
-// Failure verdicts are left parked for human attention (fail-closed).
-//
-// Returns { to_verify: [...], reconciled: [...] }.
-// Each to_verify entry: { task_id, commit, build_agent_id, project_id,
-// repo_path, deploy_slug, crew_release, claim_expires_at }.
+// Active-release resolution helpers (2026-09-18, room #15).
 //
-// crew_release is resolved through the crew home's `current` symlink (the
-// immutable active release the release manager maintains) and cross-checked
-// against this code's own realpath (the release it is actually running
-// from). Unresolvable or disputed => throw fail-closed BEFORE the claim
-// transaction: provenance is never stamped with an unknown release.
-//
-// Active-release resolution is split in two (room #15, 2026-09-18):
 // resolveActiveReleaseName (symlink only — for writers) below, and
 // resolveActiveRelease (symlink + self-path cross-check — for verifiers).
+// The old "Parent publish verification: scan + atomic claim + reconcile"
+// block (scan-verification-pending, publish: verification-requested /
+// verification-claimed / verified) was deleted with the 0.14.6
+// version-acknowledgement rewrite — these helpers now serve the ack scan's
+// provenance writers only.
 function resolveActiveReleaseName(crewHome) {
   let linkTarget;
   try {
@@ -1486,240 +1748,45 @@ function resolveActiveReleaseName(crewHome) {
   }
   return basename(resolve(crewHome, linkTarget));
 }
-// The strict resolver for verifiers (scan-verification-pending): the symlink
-// answer PLUS the self-path cross-check — the running code must provably be
-// the active release's own crew-api.js before it stamps verification claims.
-// Stale cron bodies and mid-deploy swaps throw fail-closed here.
+// The strict resolver for provenance writers (scan-ack-pending and
+// record-version-ack): the symlink answer PLUS the self-path cross-check —
+// the running code must provably be the active release's own crew-api.js
+// before it stamps acknowledgement claims. Stale cron bodies and mid-deploy
+// swaps throw fail-closed here.
 function resolveActiveRelease(crewHome) {
   const activeRelease = resolveActiveReleaseName(crewHome);
   const selfPath = new URL(import.meta.url).pathname;
   const selfMatch = selfPath.match(/releases\/([^/]+)\/lib\/crew-api\.js$/);
   if (!selfMatch) {
     throw usageError(
-      `scan-verification-pending: running code is not inside a releases/<name>/lib path (${selfPath}). Refusing to verify.`
+      `ack/intent scan: running code is not inside a releases/<name>/lib path (${selfPath}). Refusing to stamp.`
     );
   }
   if (selfMatch[1] !== activeRelease) {
     throw usageError(
-      `scan-verification-pending: running release ${selfMatch[1]} != active release ${activeRelease} (stale cron body or mid-deploy). Refusing to verify.`
+      `ack/intent scan: running release ${selfMatch[1]} != active release ${activeRelease} (stale cron body or mid-deploy). Refusing to stamp.`
     );
   }
   return activeRelease;
 }
-commands["scan-verification-pending"] = (db, args, ctx) => {
-  const CLAIM_LEASE_MS = 60 * 60 * 1000; // 1 hour
-  const nowMs = Date.now();
-  const claimExpiry = new Date(nowMs + CLAIM_LEASE_MS).toISOString();
-  const releaseName = resolveActiveRelease(ctx.crewHome);
-
-  const parked = db.prepare(
-    `SELECT t.id AS task_id, t.project AS project_id,
-            p.repo_path AS repo_path, p.deploy_slug AS deploy_slug
-     FROM tasks t LEFT JOIN projects p ON p.id = t.project
-     WHERE t.state = 'parked'`
-  ).all();
-
-  const toVerify = [];
-  const reconciled = [];
-  const deferred = []; // not-before in the future (unknown-recovery retry) — claimed by a later tick
-
-  db.exec("BEGIN");
-  try {
-    for (const row of parked) {
-      const notes = db.prepare(
-        `SELECT message, timestamp FROM events
-         WHERE task_id = ? AND type = 'note' AND message LIKE '%publish:%'
-         ORDER BY timestamp DESC LIMIT 20`
-      ).all(row.task_id);
-      if (notes.length === 0) continue;
-      const latest = notes[0].message;
-
-      // Reconcile first: verdict recorded but the re-queue was lost to a
-      // crash (verified-but-still-parked). Failure verdicts stay parked.
-      // Contained-string matching: the workflow's parkTask prepends
-      // "Parked: " to the reason, so a verification request is stored as
-      // "Parked: publish: verification-requested ..." (observed 2026-09-14).
-      // Prefix anchors would never match; see tests/verify-publish.test.js.
-      if (latest.includes("publish: verified")) {
-        db.prepare("UPDATE tasks SET state = 'in_progress', updated_at = ? WHERE id = ?")
-          .run(now(), row.task_id);
-        db.prepare(
-          `INSERT INTO events (id, type, task_id, identity, message, timestamp)
-           VALUES (?, 'note', ?, NULL, ?, ?)`
-        ).run(uuid(), row.task_id,
-          "publish: reconciled verified-but-parked -> in_progress (re-queue lost to a crash)",
-          now());
-        reconciled.push({ task_id: row.task_id });
-        continue;
-      }
-
-      // Terminal parent verdicts (anything the parent decided, except a
-      // fresh request, a procedural error, or an active claim) — never re-verify.
-      const isRequest = latest.includes("publish: verification-requested");
-      const isClaim = latest.includes("publish: verification-claimed");
-      // Procedural errors (worker botched the procedure, not a content
-      // failure) are retryable — treat like a fresh request. Content
-      // failures (verification-failed) stay terminal.
-      const isProceduralError = latest.includes("publish: verification-procedural-error");
-      if (!isRequest && !isClaim && !isProceduralError) continue; // failed / blocked / mismatch: terminal, fail-closed
-
-      if (isClaim) {
-        // Unexpired claim -> another verifier owns it. Expired -> re-claim below.
-        const m = latest.match(/publish: verification-claimed (\S+)/);
-        if (m && Date.parse(m[1]) > nowMs) continue;
-      }
-
-      // Candidate: find the original verification-requested note to extract
-      // the commit and build agent id (the latest note may be an expired claim
-      // or a procedural error).
-      const req = notes.find((n) => n.message.includes("publish: verification-requested"));
-      if (!req) continue;
-      const commitMatch = req.message.match(/verification-requested ([0-9a-f]{40})/);
-      // Fallback: procedural error note carries the commit too.
-      const procMatch = !commitMatch ? latest.match(/verification-procedural-error ([0-9a-f]{40})/) : null;
-      const commit = commitMatch ? commitMatch[1] : (procMatch ? procMatch[1] : null);
-      const buildMatch = req.message.match(/\(build ([0-9a-f-]{36})\)/);
-      // Attempt binding (2026-09-18, blocker 4): the verifier must select the
-      // submitted ledger entry for the exact (task_id, commit, attempt) —
-      // not just (task_id, commit) — or a retry's trigger is indistinguishable
-      // from the original's.
-      const attemptMatch = req.message.match(/attempt=([^\s]+)/);
-      const attempt = attemptMatch ? attemptMatch[1] : null;
-      if (!commit) continue; // malformed request: cannot verify mechanically, leave parked
-      // not-before (2026-09-18, blocker 15): the unknown-recovery retry
-      // protocol mirrors verification-requested with a not-before so the
-      // re-triggered build gets 20 minutes to land before the verification
-      // scan may claim it. Absent = verify immediately (backward compatible).
-      const nbMatch = req.message.match(/not-before=([0-9T:.\-Z+]+)/);
-      const notBeforeMs = nbMatch ? Date.parse(nbMatch[1]) : NaN;
-      if (notBeforeMs > nowMs) {
-        deferred.push({ task_id: row.task_id, commit, not_before: nbMatch[1] });
-        continue;
-      }
-      db.prepare(
-        `INSERT INTO events (id, type, task_id, identity, message, timestamp)
-         VALUES (?, 'note', ?, NULL, ?, ?)`
-      ).run(uuid(), row.task_id, `publish: verification-claimed ${claimExpiry}`, now());
-      toVerify.push({
-        task_id: row.task_id,
-        commit: commit,
-        attempt: attempt,
-        build_agent_id: buildMatch ? buildMatch[1] : null,
-        project_id: row.project_id,
-        repo_path: row.repo_path,
-        deploy_slug: row.deploy_slug,
-        crew_release: releaseName,
-        claim_expires_at: claimExpiry,
-      });
-    }
-    db.exec("COMMIT");
-  } catch (e) { db.exec("ROLLBACK"); throw e; }
-  return { to_verify: toVerify, reconciled, deferred };
-};
-
-// Recovery contract for publish attempts parked with an UNKNOWN outcome
-// (2026-09-14). The structured-output fallback parked the task because no
-// build could be observed — but the edit may still have gone through (the
-// in-flight-only fallback could not see a completed build; fixed
-// in-workflow the same day with the durable audit-dir check). When durable
-// evidence later shows the build DID complete — a platform audit directory
-// created inside the publish window (between Integrate completion and the
-// park event) — this action routes the task to the parent's independent
-// content verification WITHOUT re-issuing the edit and WITHOUT stamping
-// provenance. The original unknown ledger entry and park event are
-// preserved; the resolution is appended to the ledger and the event log.
-// The parent's read-back (docs/publish-verification.md) remains the real
-// verification and can still fail terminally. Never: blind retry, manual
-// stamp, silent state change.
 // ---------------------------------------------------------------------------
-// Shared publish-unknown attempt derivation (2026-09-18, blocker 15).
-//
-// The publish-unknown recovery state machine (scan-publish-unknown, the
-// manual resolve-publish-unknown, record-unknown-classification) all start
-// from the same durable anchors: the parked task, its project's deploy_slug,
-// and the latest publish ledger entry for the task, which must be outcome
-// "unknown" with a usable commit hash. This helper reads those anchors once
-// so the three commands cannot drift apart.
+// Publish helpers (0.14.6 version-acknowledgement architecture).
 //
-// Returns { ok: true, task, slug, repoPath, projectId, commit, attempt,
-//            unknownEntry, unknownTs, ledgerPath, entries }
-// or { ok: false, reason } — the reason strings are the manual command's
-// exact messages (pinned by tests/resolve-publish-unknown.test.js).
+// Publication is a handoff with strong suggestions: the workflow stages a
+// checksummed diff carrying a per-attempt version; the session-carrying tick
+// worker issues it via artifact_edit; acknowledgement is the EXACT version
+// string observed on the artifact's disk or in a version-echoing builder
+// report. Eric's contract: "If we hear that the artifact acknowledges our
+// version, that's it. We don't verify against content." Provenance certifies
+// that an issuance request was ACKNOWLEDGED — never that bytes matched.
 // ---------------------------------------------------------------------------
-function derivePublishUnknownAttempt(db, crewHome, taskId, requireLatest = false) {
-  const task = db.prepare("SELECT id, state, project FROM tasks WHERE id = ?").get(taskId);
-  if (!task) return { ok: false, reason: "unknown task" };
-  if (task.state !== "parked") {
-    return { ok: false, reason: `task is not parked (state=${task.state})` };
-  }
-  const project = db.prepare("SELECT id, deploy_slug, repo_path FROM projects WHERE id = ?").get(task.project);
-  const slug = project && project.deploy_slug;
-  if (!slug) return { ok: false, reason: "project has no deploy_slug" };
-  const ledgerPath = join(crewHome, ".publish-ledger", slug + ".jsonl");
-  let entries = [];
-  try {
-    entries = readFileSync(ledgerPath, "utf8").split("\n")
-      .filter((l) => l.trim().length > 0)
-      .map((l) => JSON.parse(l))
-      .filter((e) => e.task_id === taskId);
-  } catch (e) {
-    return { ok: false, reason: `cannot read publish ledger: ${e.message}` };
-  }
-  if (entries.length === 0) return { ok: false, reason: "no publish ledger entries for this task" };
-  // 2026-09-18, should-fix 6: for crash recovery (requireLatest=false),
-  // derive by the most recent unknown attempt, not the ledger tail. Retry
-  // or observability entries appended after the unknown must not break
-  // recovery. For manual resolve (requireLatest=true), the unknown must be
-  // the latest entry.
-  let unknownEntry = null;
-  if (requireLatest) {
-    // Strict mode: latest entry must be unknown.
-    const latest = entries[entries.length - 1];
-    if (latest.outcome === "unknown-resolved") {
-      return { ok: false, reason: "already resolved (unknown-resolved ledger entry present)" };
-    }
-    if (latest.outcome !== "unknown") {
-      return { ok: false, reason: `latest ledger outcome is '${latest.outcome}', not unknown` };
-    }
-    unknownEntry = latest;
-  } else {
-    // Lenient mode: find the most recent unknown, skipping later non-unknown
-    // entries (retry, observability). If an unknown-resolved follows the
-    // unknown, the attempt is resolved.
-    for (let i = entries.length - 1; i >= 0; i--) {
-      const e = entries[i];
-      if (e.outcome === "unknown-resolved") {
-        return { ok: false, reason: "already resolved (unknown-resolved ledger entry present)" };
-      }
-      if (e.outcome === "unknown") {
-        unknownEntry = e;
-        break;
-      }
-    }
-    if (!unknownEntry) {
-      return { ok: false, reason: "no unresolved unknown ledger entry for this task" };
-    }
-  }
-  if (!unknownEntry.commit || !/^[0-9a-f]{40}$/.test(unknownEntry.commit)) {
-    return { ok: false, reason: "unknown ledger entry carries no usable commit hash" };
-  }
-  return {
-    ok: true, task, slug, repoPath: (project && project.repo_path) || null, projectId: project.id,
-    commit: unknownEntry.commit, attempt: unknownEntry.attempt || null,
-    unknownEntry, unknownTs: unknownEntry.ts || null, ledgerPath, entries,
-  };
-}
 
-// The unknown-recovery state machine reads two note shapes: the machine's
-// own "publish: <transition>" notes, and the workflow's legacy (pre-2026-09-20)
-// "Publish outcome unknown …" park note — which carries no "publish:"
-// marker, so the prefilter must match it explicitly. LIKE is ASCII
-// case-insensitive in SQLite.
-const PUBLISH_NOTE_PREFILTER =
-  `(message LIKE '%publish:%' OR message LIKE '%publish outcome unknown%')`;
+// The ack/intent scans read the note journal through this prefilter. LIKE
+// is ASCII case-insensitive in SQLite.
+const PUBLISH_NOTE_PREFILTER = `(message LIKE '%publish:%')`;
 
-// Latest publish: note for a task (the unknown-recovery state machine's
-// state), or null when the task has no publish notes yet.
+// Latest publish: note for a task (the publish state machines' state), or
+// null when the task has no publish notes yet.
 function latestPublishNote(db, taskId) {
   return db.prepare(
     `SELECT message, timestamp FROM events
@@ -1728,46 +1795,6 @@ function latestPublishNote(db, taskId) {
   ).get(taskId) || null;
 }
 
-// The trigger anchor for an unknown attempt: the ISSUER-WRITTEN "submitted"
-// ledger entry for the same attempt (2026-09-20, one-party worker-owned
-// publish: only the session-carrying tick worker performs issuance, and it
-// stamps its writes issuer="tick-worker"). The workflow never issues and
-// never writes "submitted" — a workflow-written "submitted" (issuer absent,
-// the pre-one-party shape) is a phantom claim and must NOT bind. Within one
-// attempt the anchor is the OLDEST by ts (D1: the bound instant is
-// issued_at || ts, the same fallback verify-publish.js uses).
-// Returns the entry or null. A null means the trigger
-// instant is unknowable (or the trigger was never issued) — classification
-// cannot run; the task stays parked for human attention. Fail closed, never
-// guess the anchor.
-function findTriggerEntry(entries, commit, attempt) {
-  // D1 (2026-09-19; entry_kind cut 2026-09-20; issuer anchor 2026-09-20):
-  // the anchor is the OLDEST tick-worker "submitted" entry by ts and the
-  // bound instant is its issued_at || ts — the same fallback
-  // verify-publish.js uses. A "submitted" without issuer (the retired
-  // workflow write) is not an issuance and never binds.
-  const matches = [];
-  for (let i = 0; i < entries.length; i++) {
-    const e = entries[i];
-    if (e.outcome === "submitted" && e.issuer === "tick-worker" &&
-        e.commit === commit &&
-        (e.attempt || null) === (attempt || null)) {
-      matches.push(e);
-    }
-  }
-  matches.sort((a, b) => (a.ts || "").localeCompare(b.ts || ""));
-  return matches[0] || null;
-}
-
-// The unknown ledger entry's detail says whether the trigger went out.
-// Unknown parks from preflight/toolcheck inconclusives never issued the
-// trigger ("the trigger was NOT issued") — there is no dropped edit to
-// recover, so the unknown-recovery machine must not classify or retry them.
-function triggerWasIssued(unknownEntry) {
-  const detail = String((unknownEntry && unknownEntry.detail) || "");
-  return !/trigger was NOT issued|no trigger issued/i.test(detail);
-}
-
 function writePublishNote(db, taskId, message, ts) {
   db.prepare(
     `INSERT INTO events (id, type, task_id, identity, message, timestamp)
@@ -1775,254 +1802,175 @@ function writePublishNote(db, taskId, message, ts) {
   ).run(uuid(), taskId, message, ts || now());
 }
 
-commands["resolve-publish-unknown"] = (db, args, ctx) => {
-  const taskId = args.task_id;
-  if (!taskId) throw usageError("task_id is required.");
-  requireTask(db, taskId);
-  // Shared attempt anchors (2026-09-18, blocker 15): the task must be
-  // parked, the project must carry a deploy_slug, and the latest publish
-  // ledger entry for the task must be outcome "unknown" with a usable
-  // commit. derivePublishUnknownAttempt keeps the exact reason strings the
-  // recovery contract pins (tests/resolve-publish-unknown.test.js).
-  // requireLatest=true: resolve is a manual action on the current state —
-  // a later non-unknown entry means the state has moved on.
-  const derived = derivePublishUnknownAttempt(db, ctx.crewHome, taskId, true);
-  if (!derived.ok) return { resolved: false, reason: derived.reason };
-  const slug = derived.slug;
-  const ledgerPath = derived.ledgerPath;
-  const latest = derived.unknownEntry;
-
-  // The publish window: Integrate completion -> the unknown-outcome park.
-  // Nothing else touches the artifact during Publish, so an audit dir
-  // created inside this window belongs to this publish attempt.
-  const events = db.prepare(
-    "SELECT type, message, timestamp FROM events WHERE task_id = ? ORDER BY timestamp ASC"
-  ).all(taskId);
-  const integrateDone = [...events].reverse().find((e) =>
-    e.type === "completed" && /integrate completed/i.test(e.message || ""));
-  const parkEvent = [...events].reverse().find((e) =>
-    e.type === "note" && (e.message || "").includes("Publish outcome unknown"));
-  if (!integrateDone || !parkEvent) {
-    return { resolved: false, reason: "cannot determine publish window (missing integrate-completion or unknown-outcome park event)" };
-  }
-  const winStart = Date.parse(integrateDone.timestamp);
-  const winEnd = Date.parse(parkEvent.timestamp);
-  if (!(winStart < winEnd)) {
-    return { resolved: false, reason: "publish window is empty or inverted" };
-  }
-
-  // Audit dirs are named <UTC-timestamp>-<id>; the timestamp is the build's.
-  const auditsDir = join(homedir(), "workspace", "ts-spaces", slug, "audits");
-  let evidenceDirs = [];
+// 0.14.6 §1.1 — the per-attempt publish version: "<commit>:<attempt>".
+// A plain version number, not a hash (2026-09-20: the sha256 "nonce"
+// defended against a forger that doesn't exist — the builder's failure mode
+// is omission, never forging our receipts — while the artifact's real failure
+// mode, an unfaithful carrier, defeats a hash and a counter identically. We
+// own the code, so we count our own attempts; we don't own the artifact, so
+// verification stays observation of its state, never its attestation).
+// Deterministic: no wall clock, no randomness. Byte-identical to
+// lib/compute-publish-diff.js's derivation (which synthesizes the
+// `.crew-publish-version-<task_id>` receipt into the staged diff), so the
+// workflow's staging, the tick's regeneration, and these scans all agree on
+// the string. The commit binds the version to the exact code (a stale receipt
+// from an earlier commit can never equal a fresh version); the attempt
+// counts re-issues of that commit. `attempt` is the 1-based publish attempt;
+// String(attempt) matches the argv string the diff script concatenates.
+function derivePublishVersion(commit, attempt) {
+  return commit + ":" + String(attempt);
+}
+
+// A well-formed publish version: "<40-hex commit>:<positive-integer attempt>".
+function isPublishVersion(s) {
+  return typeof s === "string" && /^[0-9a-f]{40}:[1-9][0-9]*$/.test(s);
+}
+
+// 0.14.6 §1.5 — the closed publish-note writer. Every state-carrying
+// publish-note write by deterministic code in this file goes through
+// writeGuardedPublishNote, which asserts the verb against the code-writable
+// registry (transitional + current terminals) in
+// lib/publish-note-vocabulary.js before writing. Tick prose mints notes
+// only through the `record-publish-note` command, which asserts the
+// prose-writable registry (transitional only — prose can never mint a
+// terminal state). A registry violation is a caller bug (usage).
+function writeGuardedPublishNote(db, taskId, message, ts) {
   try {
-    evidenceDirs = readdirSync(auditsDir).filter((name) => {
-      const m = /^(\d{4})-(\d{2})-(\d{2})T(\d{2})-(\d{2})-(\d{2})Z-/.exec(name);
-      if (!m) return false;
-      const t = Date.parse(`${m[1]}-${m[2]}-${m[3]}T${m[4]}:${m[5]}:${m[6]}Z`);
-      return t > winStart && t <= winEnd;
-    }).sort();
+    assertCodeWritablePublishNote(message);
   } catch (e) {
-    return { resolved: false, reason: `cannot list audit dirs: ${e.message}` };
+    throw usageError(e.message);
   }
-  if (evidenceDirs.length === 0) {
-    return { resolved: false, reason: "no audit build completed inside the publish window — still unknown" };
-  }
-  // (N3) Ambiguity guard: multiple builds in the recovery window have the
-  // same attribution ambiguity as the workflow's immediate verdict — no
-  // single dir can be attributed to this attempt, so resolution stays
-  // unknown. Only when exactly one dir remains is evidenceDirs[0] safe.
-  if (evidenceDirs.length > 1) {
-    return { resolved: false, reason: `audit-dir ambiguity: ${evidenceDirs.length} audit dirs inside the publish window — still unknown` };
-  }
-  const evidenceDir = evidenceDirs[0];
+  writePublishNote(db, taskId, message, ts);
+}
 
-  // Corroboration, observation only: the audit harness's own verdict.
-  let auditOk = null;
+// The publish ledger is a per-slug JSONL file under the crew home
+// ($CREW_HOME/.publish-ledger/<slug>.jsonl): best-effort observability plus
+// the durable anchors the scans read (intent entries, submitted entries).
+function readTaskLedgerEntries(crewHome, slug, taskId) {
+  const ledgerPath = join(crewHome, ".publish-ledger", slug + ".jsonl");
   try {
-    auditOk = JSON.parse(readFileSync(join(auditsDir, evidenceDir, "report.json"), "utf8")).ok === true;
-  } catch (e) { auditOk = null; }
+    return {
+      ok: true, ledgerPath,
+      entries: readFileSync(ledgerPath, "utf8").split("\n")
+        .filter((l) => l.trim().length > 0)
+        .map((l) => JSON.parse(l))
+        .filter((e) => e.task_id === taskId),
+    };
+  } catch (e) {
+    return { ok: false, ledgerPath, reason: `cannot read publish ledger: ${e.message}` };
+  }
+}
 
-  const ts = now();
-  // The verification-requested note must sort strictly after the
-  // unknown-resolved note: scan-verification-pending reads the LATEST
-  // publish: note, and equal timestamps would leave the order undefined.
-  const tsLater = new Date(Date.parse(ts) + 1000).toISOString();
-  db.exec("BEGIN");
-  try {
-    db.prepare(
-      "INSERT INTO events (id, type, task_id, identity, message, timestamp) VALUES (?, 'note', ?, NULL, ?, ?)"
-    ).run(uuid(), taskId,
-      `publish: unknown-resolved ${latest.commit} (audit ${evidenceDir}, report ok=${auditOk}) — durable build evidence inside the publish window; routing to parent content verification. No re-trigger issued, no provenance stamped, original unknown outcome preserved.`,
-      ts);
-    // Mirror the workflow's verification-requested park note so
-    // scan-verification-pending claims it on the next tick.
-    db.prepare(
-      "INSERT INTO events (id, type, task_id, identity, message, timestamp) VALUES (?, 'note', ?, NULL, ?, ?)"
-    ).run(uuid(), taskId,
-      `Parked: publish: verification-requested ${latest.commit} (build agent_id unobserved) — recovered from publish-unknown via resolve-publish-unknown; durable evidence ${evidenceDir}. waiting on the manual read-back in docs/publish-verification.md.`,
-      tsLater);
-    db.prepare("UPDATE tasks SET state = 'parked', updated_at = ? WHERE id = ?").run(tsLater, taskId);
-    db.exec("COMMIT");
-  } catch (e) { db.exec("ROLLBACK"); throw e; }
+// Latest publish-intent ledger entry for (task, commit, publish_attempt):
+// the issuance anchor. The workflow writes attempt 1 (issuer "workflow");
+// the ack scan's re-issue writes attempts 2+ (issuer "tick-worker").
+function findIntentEntry(entries, commit, publishAttempt) {
+  const matches = entries.filter((e) => e.outcome === "publish-intent" &&
+    e.commit === commit && (e.publish_attempt || null) === (publishAttempt || null));
+  matches.sort((a, b) => (a.ts || "").localeCompare(b.ts || ""));
+  return matches[matches.length - 1] || null;
+}
 
-  // Append-only audit trail: the resolution lands in the ledger next to the
-  // original unknown entry (which is never rewritten).
-  try {
-    appendFileSync(ledgerPath, JSON.stringify({
-      ts: new Date(ts).toISOString(),
-      task_id: taskId,
-      workflow: latest.workflow || "unknown",
-      slug,
-      commit: latest.commit,
-      attempt: latest.attempt,
-      agent_id: null,
-      applied_report: null,
-      outcome: "unknown-resolved",
-      detail: `durable build evidence ${evidenceDir} (audit report ok=${auditOk}) inside publish window; routed to parent verification without re-trigger`,
-    }) + "\n");
-  } catch (e) { /* best-effort observability */ }
-
-  return { resolved: true, task_id: taskId, commit: latest.commit, evidence_dir: evidenceDir, audit_report_ok: auditOk };
-};
+// Issuer-written "submitted" entries for (task, commit): the issuance
+// record. Only the session-carrying tick worker performs issuance, and it
+// stamps its writes issuer="tick-worker" — anything else is a phantom claim
+// and never binds. Oldest first (D1: the bound instant is issued_at || ts).
+function findSubmittedEntries(entries, commit) {
+  const matches = entries.filter((e) => e.outcome === "submitted" &&
+    e.issuer === "tick-worker" && e.commit === commit);
+  matches.sort((a, b) => (a.ts || "").localeCompare(b.ts || ""));
+  return matches;
+}
 
-// Cron unknown-recovery scan (2026-09-18, blocker 15). Runs in cron Step 4.5
-// BEFORE scan-verification-pending, so a task the classifier verifies (or
-// the retry protocol re-triggers) is claimed by the verification scan on
-// the same tick.
-//
-// The note is the state machine; this command is the only writer of its
-// transitions. The tick ferries classifier decisions and retry steps — code
-// decides every state change. One atomic transaction per scan: claims,
-// mirrors, and terminal notes all land together or not at all.
+// 0.14.6 §1.3 — record a positive version acknowledgement: stamp provenance
+// (certifying the issuance REQUEST was acknowledged — never byte equality),
+// write the terminal `publish: version-acknowledged` note, and re-queue the
+// task. Shared by scan-ack-pending and the record-version-ack command (the
+// re-claim path). The strict release cross-check refuses to stamp from a
+// stale cron body or a mid-deploy swap — fail closed.
+function recordVersionAck(db, ctx, { taskId, projectId, commit, version, via }) {
+  const releaseName = resolveActiveRelease(ctx.crewHome);
+  const ts = now();
+  stampProvenance(db, {
+    project_id: projectId, source_commit: commit, crew_release: releaseName,
+    published_at: ts, task_id: taskId,
+  });
+  writeGuardedPublishNote(db, taskId,
+    `publish: version-acknowledged ${commit} via=${via} — the artifact acknowledged this attempt's exact version ` +
+    `(${via === "disk" ? "on-disk receipt .crew-publish-version" : "version-echoing builder report"}); ` +
+    `provenance stamped for crew release ${releaseName} (certifies the issuance request was acknowledged, not byte equality). Task re-queued.`,
+    ts);
+  db.prepare("UPDATE tasks SET state = 'in_progress', updated_at = ? WHERE id = ?").run(ts, taskId);
+  return { ok: true, task_id: taskId, commit, version, via, crew_release: releaseName };
+}
+
+// The version on a submitted entry must be the deterministic one for its
+// (task, commit, publish_attempt) — the ledger is advisory; the derivation
+// is the contract. Returns the entry's publish_attempt or null.
+function verifiedSubmittedAttempt(taskId, entry) {
+  const pa = entry.publish_attempt;
+  if (!Number.isInteger(pa) || pa < 1) return null;
+  if (!/^[0-9a-f]{40}$/.test(entry.commit || "")) return null;
+  if (!isPublishVersion(entry.version)) return null;
+  if (entry.version !== derivePublishVersion(entry.commit, pa)) return null;
+  return pa;
+}
+// Publish-intent scan (0.14.6 §1.2/§1.3): claims parked publish intents for
+// the session-carrying tick worker's direct issuance. One atomic
+// transaction per scan: claims and terminal notes all land together or not
+// at all.
 //
 //   latest publish: note                      this scan
-//   "Publish outcome unknown…"                now < park+30m → waiting (no claim, log only)
-//                                             else → atomic 1h claim → due, with classifier inputs
-//   "publish: unknown-recovery-claimed …"     unexpired → skip (a tick owns it)
-//                                             expired → re-claim → due (the tick died mid-classification)
-//   "publish: dropped …"                      budget spent (retry-issued in history) → terminal
-//                                               publish: ambiguous … retry-budget-exhausted
-//                                             else → retry_due (the tick runs the retry protocol)
-//   "publish: retry-intended …" w/o            → mirror publish: verification-requested
-//     "publish: retry-issued"                   (not-before = intended+20m); NEVER re-trigger here
-//   "publish: retry-issued" w/o mirrored      → mirror the missing publish: verification-requested
-//     verification-requested
-//   "publish: publish-requested" (one-party   → atomic 1h claim → intent bucket: the tick issues
-//     intent, 2026-09-20 blocker 22)            the edit directly in its own turn (no child).
-//                                             An issuer-written "submitted" already present →
-//                                             mirror verification-requested, NEVER re-issue.
-//   "publish: publish-intent-claimed …"        → unexpired: skip (a tick owns it); expired:
-//                                             re-claim → intent (the tick runs the
-//                                             manifest-freshness check first)
-//   terminal notes (the closed registry in   → terminal; skipped with the
-//     lib/publish-note-vocabulary.js — the     reason named, never
-//     scan names the recognized note)          "unrecognized"
-//   "publish: verification-requested"         → already routed; ignored (the verification scan owns it)
+//   "publish: publish-requested …"            → atomic 1h claim → intent bucket:
+//                                             the tick issues the edit directly
+//                                             in its own turn (no child).
+//   "publish: publish-intent-claimed …"       → unexpired: skip (a tick owns it);
+//                                             expired: re-claim → intent (the tick
+//                                             checks the dead attempt's version
+//                                             receipt before issuing — never
+//                                             blindly re-issues).
+//   "publish: edit-issued …"                  → already routed; ignored (the ack
+//                                             scan owns it from here).
+//   terminal notes (the closed registry)      → terminal; skipped with the
+//                                             reason named, never "unrecognized".
 //
-// Unknown parks whose trigger was never issued (preflight/toolcheck
-// inconclusives) or whose submitted ledger entry is missing have no
-// knowable trigger anchor: the scan leaves them parked for human attention.
-// Fail closed, never guess.
-commands["scan-publish-unknown"] = (db, args, ctx) => {
+// The tick never issues without a claim, and a claim never outlives its
+// lease. Fail closed, never guess.
+commands["scan-publish-intent"] = (db, args, ctx) => {
   const crewHome = ctx.crewHome;
   const nowMs = Date.now();
-  const quiesceMs = 30 * 60 * 1000;    // design §1.4e: never trust a read before the park is 30m old
   const claimLeaseMs = 60 * 60 * 1000;  // one hour — survives a dead tick, does not block the next one
-  const retrySettleMs = 20 * 60 * 1000; // a re-triggered build gets 20m before verification may claim it
   const EMPTY_TREE = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
 
-  const waiting = [];
-  const due = [];
   const intent = [];
-  const retryDue = [];
-  const mirrored = [];
   const skipped = [];
-  const requeued = []; // F-A4: stale-base intents re-queued to the workflow's Publish
-
-  const skip = (taskId, state, reason) => skipped.push({ task_id: taskId, state, ...(reason ? { reason } : {}) });
-
-  // Shared tail of the unknown branches: derive anchors, check the trigger
-  // went out, find the trigger anchor, write the atomic claim, emit the
-  // classifier inputs. parkNote is the /publish outcome unknown/i note.
-  const claimForClassification = (taskId, notes, parkNote) => {
-    const derived = derivePublishUnknownAttempt(db, crewHome, taskId);
-    if (!derived.ok) { skip(taskId, "derive-failed", derived.reason); return; }
-    if (!triggerWasIssued(derived.unknownEntry)) {
-      skip(taskId, "trigger-never-issued",
-        "the unknown ledger entry records that the trigger was never issued — no dropped edit to recover; stays parked for human attention");
-      return;
-    }
-    const trigger = findTriggerEntry(derived.entries, derived.commit, derived.attempt);
-    // D1 (2026-09-19): the anchor instant is the trigger-issuance instant
-    // (issued_at), not the ledger-write instant (ts) — issued_at || ts.
-    if (!trigger || !(trigger.issued_at || trigger.ts)) {
-      skip(taskId, "no-trigger-anchor",
-        "no submitted ledger entry for this attempt — the trigger instant is unknowable; stays parked for human attention");
-      return;
-    }
-    // Atomic claim: the note IS the claim, written inside this transaction
-    // only while the latest publish: note is still the expected one (the
-    // caller re-checks freshness before invoking this).
-    const expiry = new Date(nowMs + claimLeaseMs).toISOString();
-    writePublishNote(db, taskId,
-      `publish: unknown-recovery-claimed ${expiry} — ${taskId} parked unknown at ${parkNote.timestamp}; claimed for classification (1-hour lease).`,
-      new Date(nowMs).toISOString());
-    // Classifier base: the last verified publish, or the empty tree when
-    // nothing is stamped yet (a first publish) — same convention as the
-    // Step 4.5 read-back sensor.
-    // 2026-09-18, should-fix 4: provenance query failures fail CLOSED —
-    // the empty tree is valid only when there is truly no provenance value.
-    // A query error (locked DB, I/O failure) is not "no provenance"; skip
-    // the task so the next scan retries.
-    let base;
-    try {
-      const prov = db.prepare("SELECT provenance_source_commit FROM projects WHERE id = ?").get(derived.projectId);
-      if (prov && /^[0-9a-f]{40}$/.test(prov.provenance_source_commit)) {
-        base = prov.provenance_source_commit;
-      } else {
-        base = EMPTY_TREE; // truly no provenance value: first publish
-      }
-    } catch (e) {
-      skip(taskId, "provenance-query-failed",
-        `provenance lookup failed (${e.message.slice(0, 200)}); failing closed — the next scan retries`);
-      return;
-    }
-    due.push({
-      task_id: taskId, commit: derived.commit, base,
-      trigger_ts: trigger.issued_at || trigger.ts, park_ts: parkNote.timestamp,
-      slug: derived.slug, repo_path: derived.repoPath,
-      project_id: derived.projectId, claim_expiry: expiry,
-      ledger_path: derived.ledgerPath,
-      // Pre-trigger manifest baseline (design §1.9): the workflow snapshots
-      // the manifest before the trigger into the submitted ledger entry; the
-      // classifier's verified path compares the current manifest against it.
-      // Null when the workflow predates the capture (fail closed downstream).
-      manifest_before: (trigger.manifest_before && typeof trigger.manifest_before === "object")
-        ? trigger.manifest_before : null,
-    });
-  };
+  const requeued = []; // stale-base intents re-queued to the workflow's Publish for re-preparation
 
-  // One-party publish intent (2026-09-20, blocker 22): the workflow parks at
-  // intent — the merged change is staged as a checksummed diff and issuance
-  // belongs to the session-carrying tick worker (no child — blocker 22
-  // proved children cannot reach artifact_edit). The intent ledger entry
-  // (outcome "publish-intent", issuer "workflow") is the durable anchor: the
-  // tick verifies the staged diff's sha256 against it and regenerates from
+  const skip = (taskId, reason, detail) =>
+    skipped.push({ task_id: taskId, ...(reason ? { reason } : {}), ...(detail ? { detail } : {}) });
+
+  // One-party publish intent: the workflow parked at intent — the merged
+  // change is staged as a checksummed diff carrying the per-attempt version,
+  // and issuance belongs to the session-carrying tick worker. The intent
+  // ledger entry (outcome "publish-intent") is the durable anchor: the tick
+  // verifies the staged diff's sha256 against it and regenerates from
   // base..commit when the file is missing. reclaimed=true when a previous
-  // tick's claim expired: the tick runs the manifest-freshness check before
-  // issuing, because the dead tick may have issued and died before
+  // tick's claim expired: the tick checks the dead attempt's version receipt
+  // before issuing, because the dead tick may have issued and died before
   // recording it — a re-claim never blindly re-issues.
   const claimForIntent = (taskId, intentNote, reclaimed, anchorNote) => {
-    const m = intentNote.message.match(/publish: publish-requested\s+([0-9a-f]{40})\s+(\S+)/);
+    const m = intentNote.message.match(/publish:\s*publish-requested\s+([0-9a-f]{40})\s+attempt=(\d+)/);
     if (!m) {
       skip(taskId, "intent-note-unparseable",
-        "the publish-requested note carries no commit hash — stays parked for human attention");
+        "the publish-requested note carries no commit hash + attempt=N — stays parked for human attention");
       return;
     }
     const commit = m[1];
+    const publishAttempt = parseInt(m[2], 10);
     const task = db.prepare("SELECT id, state, project FROM tasks WHERE id = ?").get(taskId);
     if (!task || task.state !== "parked") {
-      skip(taskId, "not-parked", `task is not parked (state=${task && task.state}) — the intent claim requires a parked task`);
+      skip(taskId, "not-parked",
+        `task is not parked (state=${task && task.state}) — the intent claim requires a parked task`);
       return;
     }
     const project = db.prepare("SELECT id, deploy_slug, repo_path FROM projects WHERE id = ?").get(task.project);
@@ -2031,36 +1979,32 @@ commands["scan-publish-unknown"] = (db, args, ctx) => {
       skip(taskId, "no-deploy-slug", "project has no deploy_slug — stays parked for human attention");
       return;
     }
-    // (2026-09-20, critic-0145 F-R5) A null repo_path fails closed at
-    // emission: the tick can neither regenerate nor verify the diff. The
-    // task stays parked for human attention — no claim, no tick work.
+    // A null repo_path fails closed at emission: the tick can neither
+    // regenerate nor verify the diff. No claim, no tick work.
     const repoPath = project && project.repo_path;
     if (!repoPath) {
       skip(taskId, "no-repo-path",
         "project has no repo_path — the intent diff cannot be regenerated or verified; fails closed at emission; stays parked for human attention");
       return;
     }
-    const ledgerPath = join(crewHome, ".publish-ledger", slug + ".jsonl");
-    let entries = [];
-    try {
-      entries = readFileSync(ledgerPath, "utf8").split("\n")
-        .filter((l) => l.trim().length > 0)
-        .map((l) => JSON.parse(l))
-        .filter((e) => e.task_id === taskId);
-    } catch (e) {
-      skip(taskId, "ledger-unreadable", `cannot read publish ledger: ${e.message} — stays parked for human attention`);
+    const ledger = readTaskLedgerEntries(crewHome, slug, taskId);
+    if (!ledger.ok) {
+      skip(taskId, "ledger-unreadable", `${ledger.reason} — stays parked for human attention`);
       return;
     }
-    // Latest intent wins: a reworked task re-parks a fresh intent.
-    const intentEntry = [...entries].reverse().find((e) => e.outcome === "publish-intent") || null;
+    const intentEntry = findIntentEntry(ledger.entries, commit, publishAttempt);
     if (!intentEntry) {
       skip(taskId, "no-intent-entry",
-        "no publish-intent ledger entry for this task — the intent anchor is missing; stays parked for human attention");
+        "no publish-intent ledger entry for this task/commit/attempt — the intent anchor is missing; stays parked for human attention");
       return;
     }
-    if (intentEntry.commit !== commit) {
-      skip(taskId, "intent-commit-mismatch",
-        `intent ledger entry commits ${intentEntry.commit} but the park note names ${commit} — stays parked for human attention`);
+    // The version is protocol: the ledger is advisory — the deterministic
+    // derivation is the contract. A mismatch means the staged diff was not
+    // built by this machine; never issue it.
+    const expectedVersion = derivePublishVersion(commit, publishAttempt);
+    if (intentEntry.version !== expectedVersion) {
+      skip(taskId, "intent-version-mismatch",
+        "the intent entry's version is missing or does not match the deterministic derivation — stays parked for human attention");
       return;
     }
     if (typeof intentEntry.diff_path !== "string" || !intentEntry.diff_path ||
@@ -2069,35 +2013,15 @@ commands["scan-publish-unknown"] = (db, args, ctx) => {
         "the intent entry carries no usable diff_path/diff_sha256 — stays parked for human attention");
       return;
     }
-    // The tick died after issuing but before mirroring: an issuer-written
-    // "submitted" for this commit+attempt exists. NEVER re-issue — mirror
-    // the missing verification request and let content verification be the
-    // arbiter (the same rule as the retry-intended crash window).
-    const issued = entries.some((e) =>
-      e.outcome === "submitted" && e.issuer === "tick-worker" &&
-      e.commit === commit && (e.attempt || null) === (intentEntry.attempt || null));
-    if (issued) {
-      writePublishNote(db, taskId,
-        `publish: verification-requested ${commit} attempt=${intentEntry.attempt} — mirrored by scan-publish-unknown: a tick-worker issuance entry exists without a mirrored request (the tick died between the writes). Waiting on the manual read-back in docs/publish-verification.md.`);
-      mirrored.push({ task_id: taskId, commit, attempt: intentEntry.attempt || null, not_before: null, reason: "intent-issued-without-mirror" });
-      return;
-    }
-    // Freshness CAS: the latest publish: note must still be the note we
-    // branched on — for a first claim that is the intent note; for a
-    // re-claim it is the expired claim note.
+    // Freshness CAS: the latest publish: note must still be the anchor note
+    // — for a first claim that is the intent note; for a re-claim it is the
+    // expired claim note.
     const fresh = latestPublishNote(db, taskId);
-    if (!fresh || !anchorNote || fresh.message !== anchorNote.message) { skip(taskId, "raced"); return; }
-    const manifestBefore = (intentEntry.manifest_before && typeof intentEntry.manifest_before === "object")
-      ? intentEntry.manifest_before : null;
-    const claimedAt = new Date(nowMs).toISOString();
-    const expiry = new Date(nowMs + claimLeaseMs).toISOString();
-    writePublishNote(db, taskId,
-      `publish: publish-intent-claimed ${expiry} — ${taskId} parked at publish intent for ${commit}; claimed for direct issuance by the session-carrying tick worker (1-hour lease).`,
-      claimedAt);
-    // The classifier-base convention: last verified publish, or the empty
-    // tree on a first publish — the tick needs it to regenerate the diff
-    // byte-identically when the staged file is missing. A query error is
-    // not "no provenance" — fail closed.
+    if (!fresh || fresh.message !== anchorNote.message) { skip(taskId, "raced"); return; }
+    // The classifier-base convention: last acknowledged publish, or the
+    // empty tree on a first publish — the tick needs it to regenerate the
+    // diff byte-identically when the staged file is missing. A query error
+    // is not "no provenance" — fail closed.
     let base;
     try {
       const prov = db.prepare("SELECT provenance_source_commit FROM projects WHERE id = ?").get(project.id);
@@ -2111,47 +2035,39 @@ commands["scan-publish-unknown"] = (db, args, ctx) => {
         `provenance lookup failed (${e.message.slice(0, 200)}); failing closed — the next scan retries`);
       return;
     }
-    // (2026-09-20, critic-0145 F-A4) The intent's recorded base must match
-    // stamped provenance: another publish may have landed after the intent
-    // was staged. A stale base means the staged diff is against a superseded
-    // base — re-queue the task (next_phase routes it straight back to the
-    // workflow's Publish, which re-prepares the intent against the new base);
-    // never issue the stale diff. Legacy intents with no recorded base
-    // re-queue exactly once, then re-prepare with a base.
+    // The intent's recorded base must match stamped provenance: another
+    // publish may have landed after the intent was staged. A stale base
+    // means the staged diff is against a superseded base — re-queue the
+    // task (next_phase routes it straight back to the workflow's Publish,
+    // which re-prepares the intent against the new base); never issue the
+    // stale diff. Intents with no recorded base re-queue the same way.
     const intentBase = (typeof intentEntry.base === "string" && /^[0-9a-f]{40}$/.test(intentEntry.base))
       ? intentEntry.base : null;
     if (!intentBase || intentBase !== base) {
-      writePublishNote(db, taskId,
+      const staleAt = new Date(nowMs).toISOString();
+      writeGuardedPublishNote(db, taskId,
         `publish: publish-base-stale ${commit} — the intent's staged diff was computed against base ` +
         `${intentBase ? intentBase.slice(0, 7) : "(none recorded)"} but stamped provenance now reads ` +
-        `${base.slice(0, 7)}; issuing the stale diff risks a spurious content-mismatch. Re-queued: ` +
+        `${base.slice(0, 7)}; issuing the stale diff risks a spurious mismatch. Re-queued: ` +
         `the workflow's Publish re-prepares the intent against the new base.`,
-        claimedAt);
+        staleAt);
       db.prepare("UPDATE tasks SET next_phase = 'Publish', state = 'in_progress', updated_at = ? WHERE id = ?")
         .run(now(), taskId);
       requeued.push({ task_id: taskId, intent_base: intentBase, provenance_base: base });
       return;
     }
-    // (2026-09-20, critic-0145 F-R3) Re-claim with no manifest baseline: the
-    // tick could neither prove a dead tick's issuance nor safely re-issue —
-    // fail closed with a terminal human-attention park; never blind-issue,
-    // never loop indefinitely.
-    if (reclaimed && !manifestBefore) {
-      writePublishNote(db, taskId,
-        `publish: intent-unverifiable ${commit} — one-party intent terminal: this re-claim arrived with ` +
-        `no pre-issuance manifest baseline, so the freshness comparison is unperformable; the tick can ` +
-        `neither prove a dead tick's issuance nor safely re-issue. Parked for human attention.`,
-        claimedAt);
-      skip(taskId, "terminal",
-        "re-claimed intent with a null manifest baseline — 'publish: intent-unverifiable'; parked for human attention");
-      return;
-    }
+    const claimedAt = new Date(nowMs).toISOString();
+    const expiry = new Date(nowMs + claimLeaseMs).toISOString();
+    writeGuardedPublishNote(db, taskId,
+      `publish: publish-intent-claimed ${expiry} — ${taskId} parked at publish intent for ${commit} ` +
+      `(attempt ${publishAttempt}); claimed for direct issuance by the session-carrying tick worker (1-hour lease).`,
+      claimedAt);
     intent.push({
-      task_id: taskId, commit, attempt: intentEntry.attempt || null,
+      task_id: taskId, commit, attempt: publishAttempt, version: expectedVersion,
       slug, repo_path: repoPath,
-      project_id: project.id, ledger_path: ledgerPath, base,
+      project_id: project.id, ledger_path: ledger.ledgerPath, base,
       diff_path: intentEntry.diff_path, diff_sha256: intentEntry.diff_sha256,
-      manifest_before: manifestBefore,
+      files: Array.isArray(intentEntry.files) ? intentEntry.files : null,
       claimed_at: claimedAt, claim_expiry: expiry, reclaimed,
     });
   };
@@ -2171,288 +2087,173 @@ commands["scan-publish-unknown"] = (db, args, ctx) => {
       const latest = notes[0];
       const msg = latest.message;
       const has = (s) => msg.includes(s);
-      const historyHas = (s) => notes.some((n) => n.message.includes(s));
 
-      // Terminal states — the machine never revisits these. The vocabulary is
-      // explicit state (lib/publish-note-vocabulary.js); a recognized terminal
-      // note is skipped as terminal with its meaning, never as unrecognized.
+      // Terminal states — the machine never revisits these. The vocabulary
+      // is explicit state (lib/publish-note-vocabulary.js); a recognized
+      // terminal note is skipped as terminal with its meaning, never as
+      // unrecognized.
       const terminalNote = matchTerminalPublishNote(msg);
       if (terminalNote) {
         skip(taskId, "terminal",
           `recognized terminal note '${terminalNote}' — ${TERMINAL_NOTE_MEANINGS[terminalNote]}`);
         continue;
       }
-      // Already routed into the verification pipeline — the verification
-      // scan owns it from here.
-      if (has("publish: verification-requested")) {
-        skip(taskId, "routed-to-verification");
+      // Already issued — the acknowledgement scan owns the task from here.
+      if (has("publish: edit-issued")) {
+        skip(taskId, "routed-to-ack-scan");
         continue;
       }
-      // A retry went out but the mirrored verification request is missing
-      // (the tick died between the two writes). Mirror it now — the retry is
-      // at least one tick old, so no not-before is needed.
-      if (has("publish: retry-issued")) {
-        if (historyHas("publish: verification-requested")) { skip(taskId, "raced"); continue; }
-        const derived = derivePublishUnknownAttempt(db, crewHome, taskId);
-        if (!derived.ok) { skip(taskId, "derive-failed", derived.reason); continue; }
-        writePublishNote(db, taskId,
-          `publish: verification-requested ${derived.commit} attempt=${derived.attempt} — mirrored by scan-publish-unknown: the retry was issued without a mirrored request (the tick died between the writes). Waiting on the manual read-back in docs/publish-verification.md.`);
-        mirrored.push({ task_id: taskId, commit: derived.commit, attempt: derived.attempt, not_before: null, reason: "retry-issued-without-mirror" });
-        continue;
-      }
-      // A retry-intended note with no retry-issued: the tick died mid-retry
-      // and the trigger may or may not have gone out. NEVER re-trigger here —
-      // route to the verification pipeline and let content verification be
-      // the arbiter (design §1.5 R3).
-      if (has("publish: retry-intended")) {
-        if (historyHas("publish: verification-requested")) { skip(taskId, "raced"); continue; }
-        const derived = derivePublishUnknownAttempt(db, crewHome, taskId);
-        if (!derived.ok) { skip(taskId, "derive-failed", derived.reason); continue; }
-        const m = msg.match(/publish: retry-intended\s+[0-9a-f]{40}\s+(\S+)/);
-        const intendedMs = m ? Date.parse(m[1]) : NaN;
-        const notBefore = new Date(Math.max(nowMs, (intendedMs > 0 ? intendedMs : nowMs) + retrySettleMs)).toISOString();
-        writePublishNote(db, taskId,
-          `publish: verification-requested ${derived.commit} attempt=${derived.attempt} not-before=${notBefore} — mirrored by scan-publish-unknown: a retry-intended note exists without retry-issued (the tick died mid-retry), so the trigger may or may not have gone out; never re-triggering here, content verification is the arbiter. Waiting on the manual read-back in docs/publish-verification.md.`);
-        mirrored.push({ task_id: taskId, commit: derived.commit, attempt: derived.attempt, not_before: notBefore, reason: "retry-intended-without-retry-issued" });
-        continue;
-      }
-      // Classified as dropped and awaiting the retry protocol. Exactly one
-      // retry, enforced from note events (design §1.5): a retry-issued
-      // anywhere in this task's history spends the budget — including a
-      // retry for an earlier unknown attempt on a reworked task. When the
-      // budget is spent the drop is terminal: ambiguous, human attention.
-      if (has("publish: dropped")) {
-        const derived = derivePublishUnknownAttempt(db, crewHome, taskId);
-        if (!derived.ok) { skip(taskId, "derive-failed", derived.reason); continue; }
-        if (historyHas("publish: retry-issued")) {
-          writePublishNote(db, taskId,
-            `publish: ambiguous ${derived.commit} — retry budget exhausted: a publish retry was already issued for this task in an earlier attempt; not retrying blind. Parked for human attention.`);
-          try {
-            appendFileSync(derived.ledgerPath, JSON.stringify({
-              ts: now(), task_id: taskId, workflow: "unknown-recovery", slug: derived.slug,
-              commit: derived.commit, attempt: derived.attempt, agent_id: null,
-              applied_report: null, outcome: "unknown-classified",
-              detail: "retry budget exhausted — ambiguous, terminal",
-            }) + "\n");
-          } catch (e) { /* best-effort observability */ }
-          continue;
-        }
-        // Retry budget free: queue the retry protocol. The tick needs the
-        // classifier base to regenerate the publish diff byte-identically
-        // (compute-publish-diff.js --base), so ferry it from provenance.
-        // The in-lock re-check also needs the trigger anchor and the
-        // pre-trigger manifest baseline (design §1.9).
-        const retryProv = db.prepare(
-          `SELECT provenance_source_commit FROM projects WHERE id = ?`
-        ).get(derived.projectId);
-        const retryBase = (retryProv && retryProv.provenance_source_commit) || EMPTY_TREE;
-        const retryTrigger = findTriggerEntry(derived.entries, derived.commit, derived.attempt);
-        retryDue.push({
-          task_id: taskId, commit: derived.commit, attempt: derived.attempt,
-          slug: derived.slug, repo_path: derived.repoPath, project_id: derived.projectId,
-          ledger_path: derived.ledgerPath, base: retryBase,
-          trigger_ts: (retryTrigger && (retryTrigger.issued_at || retryTrigger.ts)) || null,
-          manifest_before: (retryTrigger && retryTrigger.manifest_before &&
-            typeof retryTrigger.manifest_before === "object") ? retryTrigger.manifest_before : null,
-        });
-        continue;
-      }
-      // One-party publish intent (2026-09-20, blocker 22): the workflow
-      // parked at intent; the session-carrying tick worker issues the edit
-      // directly from the intent bucket — no child, no trigger.
+      // A previous tick claimed this intent. Unexpired: a tick owns it.
+      // Expired: the tick died mid-issuance — re-derive from the original
+      // intent note and re-claim; the re-claiming tick checks the dead
+      // attempt's version receipt before issuing, never blindly re-issues.
       if (has("publish: publish-intent-claimed")) {
-        const m = msg.match(/publish: publish-intent-claimed\s+(\S+)/);
-        const expiryMs = m ? Date.parse(m[1]) : NaN;
+        const cm = msg.match(/publish: publish-intent-claimed\s+(\S+)/);
+        const expiryMs = cm ? Date.parse(cm[1]) : NaN;
         if (expiryMs > 0 && nowMs <= expiryMs) { skip(taskId, "claimed"); continue; }
-        // Expired claim: the tick died mid-issuance. Re-derive from the
-        // original intent note and re-claim — the re-claiming tick runs the
-        // manifest-freshness check before issuing, never blindly re-issues.
         const intentNote = notes.find((n) => n.message.includes("publish: publish-requested"));
-        if (!intentNote) { skip(taskId, "no-intent-note", "expired intent claim with no publish-requested note in history"); continue; }
+        if (!intentNote) {
+          skip(taskId, "no-intent-note", "expired intent claim with no publish-requested note in history");
+          continue;
+        }
+        const fresh = latestPublishNote(db, taskId);
+        if (!fresh || fresh.message !== msg) { skip(taskId, "raced"); continue; }
         claimForIntent(taskId, intentNote, true, latest);
         continue;
       }
+      // The workflow's parked intent.
       if (has("publish: publish-requested")) {
         claimForIntent(taskId, latest, false, latest);
         continue;
       }
-      // A previous tick claimed this task for classification.
-      // A previous tick claimed this task for classification.
-      if (has("publish: unknown-recovery-claimed")) {
-        const m = msg.match(/publish: unknown-recovery-claimed\s+(\S+)/);
-        const expiryMs = m ? Date.parse(m[1]) : NaN;
-        if (expiryMs > 0 && nowMs <= expiryMs) { skip(taskId, "claimed"); continue; }
-        // Expired claim: the tick died mid-classification. Re-derive from
-        // the original unknown note and re-claim.
-        const parkNote = notes.find((n) => /publish outcome unknown/i.test(n.message));
-        if (!parkNote) { skip(taskId, "no-unknown-note", "expired claim with no unknown park note in history"); continue; }
-        const fresh = latestPublishNote(db, taskId);
-        if (!fresh || fresh.message !== msg) { skip(taskId, "raced"); continue; }
-        claimForClassification(taskId, notes, parkNote);
-        continue;
-      }
-      // The initial unknown park note. Quiescence first: the classifier must
-      // never read a manifest younger than 30 minutes past the park.
-      if (/publish outcome unknown/i.test(msg)) {
-        const parkMs = Date.parse(latest.timestamp);
-        if (!(parkMs > 0) || nowMs < parkMs + quiesceMs) {
-          waiting.push({ task_id: taskId, parked_at: latest.timestamp });
-          continue;
-        }
-        // Re-check freshness inside the transaction: the latest publish:
-        // note must still be this unknown note.
-        const fresh = latestPublishNote(db, taskId);
-        if (!fresh || fresh.message !== msg) { skip(taskId, "raced"); continue; }
-        claimForClassification(taskId, notes, latest);
-        continue;
-      }
-      skip(taskId, "unrecognized-publish-note");
+      skip(taskId, "unrecognized-publish-note",
+        `latest publish note is not part of the 0.14.6 machine — stays parked for human attention: ${msg.slice(0, 120)}`);
     }
     db.exec("COMMIT");
   } catch (e) { db.exec("ROLLBACK"); throw e; }
 
-  return { waiting, due, intent, retry_due: retryDue, mirrored, skipped, requeued };
+  return { intent, skipped, requeued };
 };
-
-// One-party intent issuance record (2026-09-20, blocker 22). The
-// session-carrying tick worker issues the artifact_edit DIRECTLY in its own
-// turn (no child — blocker 22 proved children cannot reach artifact_edit)
-// and ferries the outcome here. Code decides: every note and ledger line
-// the outcome implies is written here, atomically, never free-formed by
-// the tick.
+// Record a one-party intent issuance (0.14.6 §1.2): the session-carrying
+// tick worker calls this exactly once per artifact_edit call that completed
+// without error and without an explicit refusal.
 //
-// Args: { task_id, claim_expiry, edit_outcome, refusal_text?, freshness_evidence? } where
-// edit_outcome is "accepted" (the direct artifact_edit call completed
-// without error and without an explicit refusal — and ONLY then; tool
-// unavailable, timeout, or any ambiguous result is not accepted and is
-// never recorded here, the tick logs it and lets the claim expire),
-// "recovered" (a re-claiming tick ran lib/check-intent-freshness.js and the
-// manifest advanced past the intent's baseline — the dead tick issued and
-// died before recording it), or "refused" (the platform explicitly refused
-// the edit).
+// Args: { task_id, claim_expiry, edit_outcome: "accepted"|"refused",
+//         refusal_text? } — omit refusal_text unless refused.
 //
-// The claim_expiry is a compare-and-swap: the record lands only while the
-// latest publish: note is still this tick's intent claim. A stale tick (its
-// claim expired and a newer tick re-claimed) gets { recorded: false } and
-// writes nothing.
+// `accepted` writes the issuer-stamped `submitted` ledger entry (carrying
+// the attempt's version) and mirrors `publish: edit-issued` — the ack scan
+// claims the task on a later tick and evaluates acknowledgement evidence.
+// `refused` writes `rejected` and the terminal `publish: publish-refused`
+// note — no re-issue, ever.
 //
-// Routing:
-//   accepted / recovered → issuer-written "submitted" ledger entry
-//     (issuer "tick-worker"; issued_at = the command's clock — the upper
-//     bound on issuance — for "accepted"; for "recovered", the dead tick's
-//     original claim time — the earliest matching publish-intent-claimed
-//     note for this commit — which lower-bounds the unobserved issuance
-//     instant, 2026-09-20 critic-0145 F-O1) + the tick's freshness evidence
-//     recorded on the "recovered" entry + mirrored
-//     `publish: verification-requested` (the verification scan claims it).
-//   refused             → issuer-written "rejected" ledger entry carrying
-//     the platform's refusal text + terminal `publish: publish-refused`
-//     (parked for human attention — no re-issue, no park-unknown).
+// There is deliberately NO outcome for an inconclusive edit (timeout,
+// transport error, tool unavailable): the tick records NOTHING then — the
+// claim expires, the next scan re-claims, and the re-claiming tick's version
+// check decides. An unrecorded outcome is the only honest record of an
+// unknown one.
 //
-// A "recovered" record without machine freshness evidence is refused: pass
-// freshness_evidence (the check-intent-freshness.js JSON, advanced:true) —
-// an unproven recovery is not recorded (2026-09-20 critic-0145 F-O3/F-R2).
+// The claim_expiry is a compare-and-swap: the record lands only while the
+// latest publish: note is still this tick's intent claim. A stale tick gets
+// { recorded: false } and writes nothing.
+// Shared preamble for the tick worker's claim-guarded record commands
+// (record-intent-issuance, record-intent-unissuable, 2026-09-20 REVIEW):
+// verifies the CAS claim, resolves the project's deploy slug, reads the
+// task's publish ledger, and locates the latest publish-intent entry.
+// Returns { ok: false, reason } when the command must not record, else
+// { ok: true, slug, ledgerPath, intentEntry, commit }. Callers run inside
+// their own BEGIN/COMMIT transaction and ROLLBACK on { ok: false }.
+function resolveClaimedIntent(db, ctx, taskId, claimExpiry) {
+  // CAS: the latest publish: note must still be this tick's claim.
+  const latest = latestPublishNote(db, taskId);
+  if (!latest || !latest.message.includes("publish: publish-intent-claimed") ||
+      !latest.message.includes(claimExpiry)) {
+    return { ok: false, reason: "claim no longer current — another tick owns this task" };
+  }
+  const task = db.prepare("SELECT id, project FROM tasks WHERE id = ?").get(taskId);
+  const project = task && db.prepare("SELECT id, deploy_slug FROM projects WHERE id = ?").get(task.project);
+  const slug = project && project.deploy_slug;
+  if (!slug) return { ok: false, reason: "project has no deploy_slug" };
+  const ledger = readTaskLedgerEntries(ctx.crewHome, slug, taskId);
+  if (!ledger.ok) return { ok: false, reason: ledger.reason };
+  const intentEntry = [...ledger.entries].reverse().find((e) => e.outcome === "publish-intent") || null;
+  if (!intentEntry || !/^[0-9a-f]{40}$/.test(intentEntry.commit || "")) {
+    return { ok: false, reason: "no usable publish-intent ledger entry for this task" };
+  }
+  return { ok: true, slug, ledgerPath: ledger.ledgerPath, intentEntry, commit: intentEntry.commit };
+}
+
 commands["record-intent-issuance"] = (db, args, ctx) => {
   const taskId = args.task_id;
   const claimExpiry = args.claim_expiry;
   const editOutcome = args.edit_outcome;
   if (!taskId) throw usageError("task_id is required.");
   if (!claimExpiry) throw usageError("claim_expiry is required.");
-  if (!["accepted", "recovered", "refused"].includes(editOutcome)) {
+  if (!["accepted", "refused"].includes(editOutcome)) {
     throw usageError(`unknown edit outcome: ${editOutcome}.`);
   }
+  // Reclaimed-claim receipt guard (2026-09-21 R-3): a reclaimed claim
+  // means a previous tick died mid-issuance and may have issued the edit
+  // without recording it. The tick worker MUST run the step-2 receipt
+  // check and report its outcome explicitly: "different" (receipt
+  // readable but differs from this attempt's version), "unreadable"
+  // (receipt missing or unreadable — NOT proof the edit did not land), or
+  // "match" (receipt equals this attempt's version — the edit landed;
+  // acknowledge it via record-version-ack, never re-issue). A missing or
+  // unknown receipt_check on a reclaimed claim is a usage error; "match"
+  // refuses to record (fail closed, no write) so a landed edit is never
+  // re-issued. Non-reclaimed claims take no receipt_check.
+  const reclaimed = args.reclaimed === true || args.reclaimed === "true";
+  const receiptCheck = args.receipt_check;
+  if (reclaimed) {
+    if (!["different", "unreadable", "match"].includes(receiptCheck)) {
+      throw usageError("receipt_check is required for a reclaimed claim (one of: different, unreadable, match).");
+    }
+  } else if (receiptCheck !== undefined && receiptCheck !== null) {
+    throw usageError("receipt_check is only valid for a reclaimed claim.");
+  }
 
   db.exec("BEGIN");
   try {
-    // CAS: the latest publish: note must still be this tick's claim.
-    const latest = latestPublishNote(db, taskId);
-    if (!latest || !latest.message.includes("publish: publish-intent-claimed") ||
-        !latest.message.includes(claimExpiry)) {
+    const pre = resolveClaimedIntent(db, ctx, taskId, claimExpiry);
+    if (!pre.ok) { db.exec("ROLLBACK"); return { recorded: false, reason: pre.reason }; }
+    const { slug, ledgerPath, intentEntry, commit } = pre;
+    if (reclaimed && receiptCheck === "match") {
       db.exec("ROLLBACK");
-      return { recorded: false, reason: "claim no longer current — another tick owns this task" };
+      return { recorded: false, reason: "receipt already matches the claimed version — the edit landed; acknowledge via record-version-ack, never re-issue" };
     }
-    // The intent anchor: the workflow's issuer-written intent entry.
-    const task = db.prepare("SELECT id, project FROM tasks WHERE id = ?").get(taskId);
-    const project = task && db.prepare("SELECT id, deploy_slug FROM projects WHERE id = ?").get(task.project);
-    const slug = project && project.deploy_slug;
-    if (!slug) {
+    const publishAttempt = intentEntry.publish_attempt;
+    const version = intentEntry.version;
+    if (!Number.isInteger(publishAttempt) || publishAttempt < 1 ||
+        version !== derivePublishVersion(commit, publishAttempt)) {
       db.exec("ROLLBACK");
-      return { recorded: false, reason: "project has no deploy_slug" };
-    }
-    const ledgerPath = join(ctx.crewHome, ".publish-ledger", slug + ".jsonl");
-    let entries = [];
-    try {
-      entries = readFileSync(ledgerPath, "utf8").split("\n")
-        .filter((l) => l.trim().length > 0)
-        .map((l) => JSON.parse(l))
-        .filter((e) => e.task_id === taskId);
-    } catch (e) {
-      db.exec("ROLLBACK");
-      return { recorded: false, reason: `cannot read publish ledger: ${e.message}` };
-    }
-    const intentEntry = [...entries].reverse().find((e) => e.outcome === "publish-intent") || null;
-    if (!intentEntry || !/^[0-9a-f]{40}$/.test(intentEntry.commit || "")) {
-      db.exec("ROLLBACK");
-      return { recorded: false, reason: "no usable publish-intent ledger entry for this task" };
+      return { recorded: false, reason: "intent entry carries no usable publish_attempt/version — refusing to record" };
     }
     const ts = now();
-    const commit = intentEntry.commit;
-    const attempt = intentEntry.attempt || null;
-    // (2026-09-20, critic-0145 F-O1) A recovered issuance's instant is
-    // unobserved, but it is LOWER-BOUNDED by the dead tick's original
-    // claim: the earliest publish-intent-claimed note for this commit (not
-    // the reclaimer's later claim). Binding issued_at to that time keeps
-    // the verifier's staleness check honest — the old null fell back to
-    // the recovery record's later timestamp and made a genuine
-    // already-completed build look stale.
-    let recoveredIssuedAt = null;
-    if (editOutcome === "recovered") {
-      const deadClaim = db.prepare(
-        `SELECT timestamp FROM events
-         WHERE task_id = ? AND type = 'note' AND message LIKE '%publish: publish-intent-claimed%'
-           AND message LIKE ?
-         ORDER BY timestamp ASC LIMIT 1`
-      ).get(taskId, `%${commit}%`);
-      recoveredIssuedAt = (deadClaim && deadClaim.timestamp) || null;
-    }
-    // (2026-09-20, critic-0145 F-O3/F-R2) A recovery must carry machine
-    // evidence: the check-intent-freshness.js JSON with advanced:true. An
-    // unproven recovery is not recorded — the command fails the call so the
-    // tick cannot write an honest-looking "recovered" on prose.
-    let freshnessEvidence = null;
-    if (editOutcome === "recovered") {
-      const ev = args.freshness_evidence;
-      const evObj = typeof ev === "string" ? (() => { try { return JSON.parse(ev); } catch { return null; } })() : ev;
-      if (!evObj || typeof evObj !== "object" || evObj.ok !== true || evObj.advanced !== true) {
-        throw usageError("recovered requires freshness_evidence — the check-intent-freshness.js JSON with advanced:true.");
-      }
-      freshnessEvidence = evObj;
-    }
     const ledgerLine = {
       ts, task_id: taskId, workflow: "intent-issuance", slug,
-      commit, attempt, agent_id: null, applied_report: null,
+      commit, attempt: intentEntry.attempt || null, publish_attempt: publishAttempt, version,
+      agent_id: null, applied_report: null,
       issuer: "tick-worker",
       diff_sha256: intentEntry.diff_sha256 || null,
-      manifest_before: intentEntry.manifest_before || null,
-      freshness_evidence: freshnessEvidence,
+      issued_at: editOutcome === "accepted" ? ts : null,
+      receipt_check: reclaimed ? receiptCheck : null,
     };
     let note;
     if (editOutcome === "refused") {
       const refusalText = String(args.refusal_text || "no refusal text recorded").split("\n")[0].slice(0, 500);
       ledgerLine.outcome = "rejected";
-      ledgerLine.issued_at = null;
-      ledgerLine.detail = `platform refused the directly-issued edit: ${refusalText}`;
+      ledgerLine.detail = `platform refused the directly-issued edit: ${refusalText}` +
+        (reclaimed ? ` (reclaimed claim; step-2 receipt check was '${receiptCheck}')` : "");
       // Terminal: parked for human attention. "publish: publish-refused"
       // is registered in lib/publish-note-vocabulary.js (the closed
       // registry — the writer-side guard pattern from D7).
-      note = `publish: publish-refused ${commit} — the platform refused the issued edit (${refusalText}). No re-issue; parked for human attention.`;
+      note = `publish: publish-refused ${commit} attempt=${publishAttempt} — the platform refused the issued edit (${refusalText}). No re-issue; parked for human attention.`;
     } else {
       ledgerLine.outcome = "submitted";
-      ledgerLine.issued_at = editOutcome === "accepted" ? ts : recoveredIssuedAt;
-      ledgerLine.detail = editOutcome === "accepted"
-        ? "edit issued directly by the session-carrying tick worker (one-party publish)"
-        : `recovered: the manifest advanced past the intent's baseline (freshness evidence recorded) — the dead tick issued and died before recording it; issuance attributed to the dead tick, issued_at lower-bounded by the dead tick's original claim at ${recoveredIssuedAt || "unknown"}`;
-      note = `publish: verification-requested ${commit} attempt=${attempt} — issued directly by the session-carrying tick worker (one-party publish). Waiting on the manual read-back in docs/publish-verification.md.`;
+      ledgerLine.detail = "edit issued directly by the session-carrying tick worker (one-party publish); the staged diff carried the per-attempt version receipt" +
+        (reclaimed ? `; reclaimed claim, step-2 receipt check was '${receiptCheck}' (a differing or unreadable receipt is not proof the prior attempt's edit did not land)` : "");
+      note = `publish: edit-issued ${commit} attempt=${publishAttempt} version=${version} — issued directly by the session-carrying tick worker (one-party publish). The acknowledgement scan owns the task from here: exact version string, 30-minute window.`;
     }
     try {
       appendFileSync(ledgerPath, JSON.stringify(ledgerLine) + "\n");
@@ -2460,29 +2261,11 @@ commands["record-intent-issuance"] = (db, args, ctx) => {
       db.exec("ROLLBACK");
       return { recorded: false, reason: `cannot append publish ledger: ${e.message}` };
     }
-    writePublishNote(db, taskId, note, ts);
+    writeGuardedPublishNote(db, taskId, note, ts);
     db.exec("COMMIT");
-    return { recorded: true, edit_outcome: editOutcome, task_id: taskId, commit, note };
+    return { recorded: true, edit_outcome: editOutcome, task_id: taskId, commit, publish_attempt: publishAttempt, note };
   } catch (e) { db.exec("ROLLBACK"); throw e; }
 };
-
-// Record a one-party intent as unissuable (2026-09-20, critic-0145 F-O2).
-// The session-carrying tick worker calls this when the staged diff cannot
-// be (re)generated byte-identically — the staged file is missing and
-// compute-publish-diff --commit fails, or the regenerated hash does not
-// match the intent's diff_sha256. Code decides: the terminal
-// `publish: publish-unissuable` note and an issuer-written ledger entry
-// (outcome "unissuable", issuer "tick-worker") are written here,
-// atomically, never free-formed by the tick.
-//
-// Args: { task_id, claim_expiry, reason } where reason is a short
-// machine-readable cause (missing-staged-diff, diff-unregenerable,
-// hash-mismatch-after-regeneration).
-//
-// The claim_expiry is a compare-and-swap: the record lands only while the
-// latest publish: note is still this tick's intent claim. A stale tick gets
-// { recorded: false } and writes nothing. The terminal note means the scan
-// never re-claims — no hourly reclaim loop on an unissuable diff.
 commands["record-intent-unissuable"] = (db, args, ctx) => {
   const taskId = args.task_id;
   const claimExpiry = args.claim_expiry;
@@ -2493,38 +2276,10 @@ commands["record-intent-unissuable"] = (db, args, ctx) => {
 
   db.exec("BEGIN");
   try {
-    // CAS: the latest publish: note must still be this tick's claim.
-    const latest = latestPublishNote(db, taskId);
-    if (!latest || !latest.message.includes("publish: publish-intent-claimed") ||
-        !latest.message.includes(claimExpiry)) {
-      db.exec("ROLLBACK");
-      return { recorded: false, reason: "claim no longer current — another tick owns this task" };
-    }
-    const task = db.prepare("SELECT id, project FROM tasks WHERE id = ?").get(taskId);
-    const project = task && db.prepare("SELECT id, deploy_slug FROM projects WHERE id = ?").get(task.project);
-    const slug = project && project.deploy_slug;
-    if (!slug) {
-      db.exec("ROLLBACK");
-      return { recorded: false, reason: "project has no deploy_slug" };
-    }
-    const ledgerPath = join(ctx.crewHome, ".publish-ledger", slug + ".jsonl");
-    let entries = [];
-    try {
-      entries = readFileSync(ledgerPath, "utf8").split("\n")
-        .filter((l) => l.trim().length > 0)
-        .map((l) => JSON.parse(l))
-        .filter((e) => e.task_id === taskId);
-    } catch (e) {
-      db.exec("ROLLBACK");
-      return { recorded: false, reason: `cannot read publish ledger: ${e.message}` };
-    }
-    const intentEntry = [...entries].reverse().find((e) => e.outcome === "publish-intent") || null;
-    if (!intentEntry || !/^[0-9a-f]{40}$/.test(intentEntry.commit || "")) {
-      db.exec("ROLLBACK");
-      return { recorded: false, reason: "no usable publish-intent ledger entry for this task" };
-    }
+    const pre = resolveClaimedIntent(db, ctx, taskId, claimExpiry);
+    if (!pre.ok) { db.exec("ROLLBACK"); return { recorded: false, reason: pre.reason }; }
+    const { slug, ledgerPath, intentEntry, commit } = pre;
     const ts = now();
-    const commit = intentEntry.commit;
     const attempt = intentEntry.attempt || null;
     const ledgerLine = {
       ts, task_id: taskId, workflow: "intent-issuance", slug,
@@ -2544,197 +2299,512 @@ commands["record-intent-unissuable"] = (db, args, ctx) => {
     // lib/publish-note-vocabulary.js (the closed registry — the writer-side
     // guard pattern from D7).
     const note = `publish: publish-unissuable ${commit} — the intent's staged diff cannot be (re)generated byte-identically (${reason}). Never re-claim, never loop; parked for human attention.`;
-    writePublishNote(db, taskId, note, ts);
+    writeGuardedPublishNote(db, taskId, note, ts);
     db.exec("COMMIT");
     return { recorded: true, task_id: taskId, commit, note };
   } catch (e) { db.exec("ROLLBACK"); throw e; }
 };
-
-// Record the unknown-recovery classifier's decision (2026-09-18, blocker
-// 15). The tick ferries: it runs lib/classify-publish-absence.js for each
-// scan-publish-unknown "due" entry and passes the classifier's JSON here.
-// Code decides: every note the decision implies is written here, atomically,
-// never free-formed by the tick.
+// Acknowledgement scan (0.14.6 §1.3): evaluates acknowledgement evidence
+// for issued edits. Eric's contract: exact version acknowledgement is the
+// SOLE positive completion criterion — "If we hear that the artifact
+// acknowledges our version, that's it. We don't verify against content."
 //
-// Args: { task_id, claim_expiry, decision } where decision is the
-// classifier's { ok, decision, reasons, details } JSON.
+// Per parked task whose latest publish: note is `publish: edit-issued`:
+//   - the artifact's on-disk version receipt
+//     (<spaces>/ts-spaces/<slug>/.crew-publish-version-<task_id>) equals ANY issued
+//     version for this task+commit (a late earlier attempt counts), OR a
+//     version-echoing builder report (outcome acknowledged) names one
+//       → acknowledged: provenance stamped (certifying the request was
+//         acknowledged, not byte equality), terminal
+//         `publish: version-acknowledged`, task re-queued.
+//   - else a builder report (outcome refused) names an issued version
+//       → refused: terminal `publish: publish-refused`.
+//   - else the 30-minute window from the LATEST issuance is still open
+//       → skipped (window-open).
+//   - else the 2-hour total budget from the FIRST issuance is not exhausted
+//       → reissued: a fresh intent is staged with a fresh version,
+//         immediately claimable (no backoff); the NEXT tick's intent scan
+//         claims it. This tick issues nothing.
+//   - else → version-timeout: terminal `publish: version-timeout`.
 //
-// The claim_expiry is a compare-and-swap: the record lands only while the
-// latest publish: note is still this tick's claim. A stale tick (its claim
-// expired and a newer tick re-claimed) gets { recorded: false } and writes
-// nothing.
+// One atomic transaction per scan. The command is fully code-local — no
+// claim notes, no tick mediation. `spaces_root` arg overrides the ts-spaces
+// root (tests); production reads ~/workspace/ts-spaces.
 //
-// Routing (design §1.4/§1.5):
-//   verified          → publish: verification-requested (no not-before: the
-//                       content is already the new state) + unknown-resolved
-//                       ledger entry; the verification scan claims it.
-//   provably-dropped  → publish: dropped (the next scan queues the retry
-//                       protocol). No ledger resolution — the attempt is
-//                       still logically unknown.
-//   applied-not-built / ambiguous
-//                     → publish: ambiguous (terminal) + unknown-classified
-//                       ledger entry. Parked for human attention.
-//   deferred          → no note: the claim expires and the next scan
-//                       re-claims. A deferred classification is not a verdict.
-//   superseded        → publish: superseded (terminal) + unknown-classified
-//                       ledger entry. HEAD moved; recovery aborted.
-commands["record-unknown-classification"] = (db, args, ctx) => {
-  const taskId = args.task_id;
-  const claimExpiry = args.claim_expiry;
-  const decision = args.decision;
-  if (!taskId) throw usageError("task_id is required.");
-  if (!claimExpiry) throw usageError("claim_expiry is required.");
-  if (!decision || typeof decision !== "object") throw usageError("decision is required (the classifier's JSON).");
-  const verdict = decision.decision;
-  const valid = ["verified", "provably-dropped", "applied-not-built", "ambiguous", "deferred", "superseded"];
-  if (!valid.includes(verdict)) throw usageError(`unknown classifier decision: ${verdict}.`);
+// Returns { acknowledged, refused, reissued, timeouts, skipped }.
+commands["scan-ack-pending"] = (db, args, ctx) => {
+  const crewHome = ctx.crewHome;
+  const nowMs = Date.now();
+  // (2026-09-20, Eric's call) 30-minute acknowledgement window per attempt,
+  // 2-hour TOTAL budget from the FIRST issuance of the commit — then terminal
+  // version-timeout. No backoff: a reissue staged at window expiry is
+  // immediately claimable; the window expiry is the only spacing. The window
+  // anchors at the LATEST issuance (each attempt gets its own window); the
+  // budget anchors at the FIRST (the whole publish effort gets one budget,
+  // however many attempts fit). The 30-minute window is evidence-set: room
+  // #25's one healthy ack landed ~15-17 minutes after issuance — the window
+  // is ~2x that plus margin. The ledger records issued_at and first-seen ack
+  // for every attempt, so the real distribution is measurable and the window
+  // is tunable from data, not from a placeholder.
+  const ACK_WINDOW_MS = 30 * 60 * 1000;
+  const TOTAL_BUDGET_MS = 2 * 60 * 60 * 1000;
+  const EMPTY_TREE = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
+  const spacesRoot = (args && args.spaces_root) || join(homedir(), "workspace", "ts-spaces");
+  // The release running this scan must provably be the active release
+  // before it stamps acknowledgement claims — fail the whole scan closed
+  // on a stale cron body or mid-deploy swap.
+  const releaseName = resolveActiveRelease(crewHome);
+  const computeDiffScript = new URL("./compute-publish-diff.js", import.meta.url).pathname;
+
+  const acknowledged = [];
+  const refused = [];
+  const reissued = [];
+  const timeouts = [];
+  const skipped = [];
+  const skip = (taskId, reason, detail) =>
+    skipped.push({ task_id: taskId, ...(reason ? { reason } : {}), ...(detail ? { detail } : {}) });
+
+  const parked = db.prepare(`SELECT id AS task_id FROM tasks WHERE state = 'parked'`).all();
 
   db.exec("BEGIN");
   try {
-    // CAS: the latest publish: note must still be this tick's claim.
-    const latest = latestPublishNote(db, taskId);
-    if (!latest || !latest.message.includes("publish: unknown-recovery-claimed") ||
-        !latest.message.includes(claimExpiry)) {
-      db.exec("ROLLBACK");
-      return { recorded: false, reason: "claim no longer current — another tick owns this task" };
-    }
-    const derived = derivePublishUnknownAttempt(db, ctx.crewHome, taskId);
-    if (!derived.ok) {
-      db.exec("ROLLBACK");
-      return { recorded: false, reason: derived.reason };
-    }
-    const reasons = Array.isArray(decision.reasons) ? decision.reasons.join("; ") : "";
-    const ts = now();
-
-    const appendLedger = (outcome, detail) => {
+    for (const row of parked) {
+      const taskId = row.task_id;
+      const latest = latestPublishNote(db, taskId);
+      if (!latest || !latest.message.includes("publish: edit-issued")) { skip(taskId, "not-issued"); continue; }
+      const m = latest.message.match(/publish:\s*edit-issued\s+([0-9a-f]{40})\s+attempt=(\d+)/);
+      if (!m) {
+        skip(taskId, "edit-issued-unparseable",
+          "the edit-issued note carries no commit hash + attempt=N — stays parked for human attention");
+        continue;
+      }
+      const commit = m[1];
+      const task = db.prepare("SELECT id, state, project FROM tasks WHERE id = ?").get(taskId);
+      const project = task && db.prepare("SELECT id, deploy_slug, repo_path FROM projects WHERE id = ?").get(task.project);
+      const slug = project && project.deploy_slug;
+      if (!slug) { skip(taskId, "no-deploy-slug"); continue; }
+      const ledger = readTaskLedgerEntries(crewHome, slug, taskId);
+      if (!ledger.ok) { skip(taskId, "ledger-unreadable", ledger.reason); continue; }
+      // The issuance record: issuer-stamped submitted entries with
+      // derivation-verified versions. A version that fails the derivation is
+      // not this machine's — the whole attempt is unusable, fail closed.
+      const submittedAll = findSubmittedEntries(ledger.entries, commit);
+      if (submittedAll.length === 0) {
+        skip(taskId, "no-issuance-record",
+          "no issuer-stamped submitted ledger entry for this commit — failing closed; stays parked for human attention");
+        continue;
+      }
+      // The ack version is derived deterministically from (task, commit,
+      // attempt) — §1.1. An entry whose version fails the derivation is a
+      // phantom claim: it never binds (D2). A corrupt entry poisons only
+      // itself — it is quarantined while valid entries still drive the
+      // windows and the budget, so one bad ledger line can never park the
+      // whole record before the budget is evaluated. Only
+      // derivation-verified entries anchor the clocks below.
+      const attempts = [];
+      const validEntries = [];
+      for (const e of submittedAll) {
+        const pa = verifiedSubmittedAttempt(taskId, e);
+        if (pa === null) continue;
+        if (!attempts.includes(pa)) attempts.push(pa);
+        validEntries.push(e);
+      }
+      if (attempts.length === 0) {
+        skip(taskId, "version-mismatch",
+          "no submitted entry's version passes the deterministic derivation — the issuance record is unusable; stays parked for human attention");
+        continue;
+      }
+      attempts.sort((a, b) => a - b);
+      const expectedVersion = (a) => derivePublishVersion(commit, a);
+
+      // --- acknowledgement evidence (§1.3): the version receipt on disk, or
+      // a version-echoing builder report. ANY issued version for this
+      // task+commit counts — including a late earlier attempt's. The
+      // receipt is scoped per task (`.crew-publish-version-<task_id>`):
+      // two tasks of the same project can sit in `edit-issued`
+      // concurrently (per-project simultaneity defaults to 2), and a
+      // shared per-slug receipt would let each issuance overwrite the
+      // other's acknowledgement — receipt ping-pong with no false ack.
+      let diskVersion = null;
       try {
-        appendFileSync(derived.ledgerPath, JSON.stringify({
-          ts, task_id: taskId, workflow: "unknown-recovery", slug: derived.slug,
-          commit: derived.commit, attempt: derived.attempt, agent_id: null,
-          applied_report: null, outcome, detail,
-        }) + "\n");
-      } catch (e) { /* best-effort observability */ }
-    };
-
-    if (verdict === "deferred") {
-      // No note: the claim expires, the next scan re-claims and retries the
-      // classification. A deferred classification is explicitly not a verdict.
-      db.exec("COMMIT");
-      return { recorded: true, decision: verdict, task_id: taskId, note: "deferred — claim left to expire" };
-    }
-
-    let note;
-    if (verdict === "verified") {
-      note = `publish: verification-requested ${derived.commit} attempt=${derived.attempt} — unknown-recovery classifier verified the content already shows the new state (${reasons}); routed without re-trigger. Waiting on the manual read-back in docs/publish-verification.md.`;
-      writePublishNote(db, taskId, note, ts);
-      appendLedger("unknown-resolved",
-        `classifier verified: content shows the new state; routed to parent verification without re-trigger (${reasons})`);
-    } else if (verdict === "provably-dropped") {
-      note = `publish: dropped ${derived.commit} — unknown-recovery classifier: the trigger went out and the platform provably dropped the edit (${reasons}); queued for the retry protocol.`;
-      writePublishNote(db, taskId, note, ts);
-      // No ledger resolution: the attempt is still logically unknown until
-      // the retry protocol journals its outcome.
-    } else if (verdict === "superseded") {
-      note = `publish: superseded ${derived.commit} — unknown-recovery classifier: HEAD moved past the attempt commit (${reasons}); recovery aborted. Parked for human attention.`;
-      writePublishNote(db, taskId, note, ts);
-      appendLedger("unknown-classified", `classifier superseded — terminal (${reasons})`);
-    } else {
-      // applied-not-built, ambiguous: the classifier could not prove the
-      // drop. Terminal — parked for human attention, never retried blind.
-      note = `publish: ambiguous ${derived.commit} — unknown-recovery classifier could not prove the edit was dropped (${verdict}: ${reasons}); not retrying blind. Parked for human attention.`;
-      writePublishNote(db, taskId, note, ts);
-      appendLedger("unknown-classified", `classifier ${verdict} — terminal, no retry (${reasons})`);
+        diskVersion = readFileSync(join(spacesRoot, slug, ".crew-publish-version-" + taskId), "utf8").trim() || null;
+        if (diskVersion && !isPublishVersion(diskVersion)) diskVersion = null;
+      } catch { diskVersion = null; }
+      const reports = db.prepare(
+        `SELECT version, outcome FROM builder_reports WHERE task_id = ?`
+      ).all(taskId);
+      // (2026-09-20 REVIEW) Disk is the SOLE positive evidence. The
+      // builder-report "acknowledged" path was circular: the tick worker
+      // knows the version (it was in the scan entry), so report_text
+      // containing the version proves version knowledge, not artifact/platform
+      // origin. A worker can fabricate an acknowledged report and cause
+      // false provenance stamping. Builder reports are retained for
+      // explicit REFUSALS only (negative evidence).
+      const ackedAttempt = attempts.find((a) => diskVersion === expectedVersion(a));
+      if (ackedAttempt !== undefined) {
+        recordVersionAck(db, ctx, {
+          taskId, projectId: project.id, commit, version: expectedVersion(ackedAttempt), via: "disk",
+        });
+        acknowledged.push({ task_id: taskId, commit, attempt: ackedAttempt, via: "disk", crew_release: releaseName });
+        continue;
+      }
+      // Explicit refusal naming an issued version: terminal, no re-issue.
+      const refusedAttempt = attempts.find((a) =>
+        reports.some((r) => r.outcome === "refused" && r.version === expectedVersion(a)));
+      if (refusedAttempt !== undefined) {
+        writeGuardedPublishNote(db, taskId,
+          `publish: publish-refused ${commit} attempt=${refusedAttempt} — the builder's report carried the ` +
+          `attempt's exact version with an explicit refusal. No re-issue; parked for human attention.`,
+          new Date(nowMs).toISOString());
+        refused.push({ task_id: taskId, commit, attempt: refusedAttempt });
+        continue;
+      }
+      // The acknowledgement window runs from the LATEST issuance of this
+      // commit — a 30-minute window PER ATTEMPT (0.14.6 §1.3, design §3, as
+      // re-set 2026-09-20). Anchoring at the earliest issuance would give
+      // attempts 2+ no window at all: they are always issued after attempt
+      // 1's window expired, so the scan would re-issue or time out
+      // immediately after they were issued. Late acknowledgements for any
+      // previously issued version are still accepted above; only the
+      // re-issue/timeout clock follows the latest attempt.
+      const latestIssuance = validEntries[validEntries.length - 1];
+      const issuedAtMs = Date.parse(latestIssuance.issued_at || latestIssuance.ts);
+      if (issuedAtMs > 0 && nowMs < issuedAtMs + ACK_WINDOW_MS) { skip(taskId, "window-open"); continue; }
+      // An unparseable latest issuance is an UNKNOWN window — never call
+      // it "window-open". The budget check below still runs, so a corrupt
+      // latest timestamp cannot defer the terminal timeout forever; only
+      // the re-issue is withheld (re-issuing into an unknown window would
+      // risk a duplicate issuance the budget cannot yet justify).
+      // Window expired. Budget remains → re-issue with a FRESH version;
+      // budget exhausted → terminal version-timeout. The budget is measured
+      // from the FIRST issuance of this commit: the whole publish effort
+      // gets one 2-hour budget, however many 30-minute attempts fit inside
+      // it. A fixed attempt cap would false-timeout a slow-but-healthy
+      // artifact; a pure window with no budget would retry forever.
+      const firstIssuance = validEntries[0];
+      const firstIssuedAtMs = Date.parse(firstIssuance.issued_at || firstIssuance.ts);
+      if (!(firstIssuedAtMs > 0)) {
+        skip(taskId, "first-issuance-unparseable",
+          "the first submitted entry's issued_at is unparseable — failing closed; stays parked for human attention");
+        continue;
+      }
+      const maxAttempt = Math.max(...attempts);
+      if (nowMs - firstIssuedAtMs >= TOTAL_BUDGET_MS) {
+        writeGuardedPublishNote(db, taskId,
+          `publish: version-timeout ${commit} — the 2-hour acknowledgement budget is exhausted ` +
+          `(${maxAttempt} attempts, no version acknowledgement; unobserved within budget — the edit may ` +
+          `still have landed; the outcome is unknown). Parked for human attention.`,
+          new Date(nowMs).toISOString());
+        timeouts.push({ task_id: taskId, commit, attempts: maxAttempt });
+        continue;
+      }
+      if (!(issuedAtMs > 0)) {
+        skip(taskId, "latest-issuance-unparseable",
+          "the latest submitted entry's issued_at is unparseable — the acknowledgement window state is " +
+          "unknown and the total budget is not exhausted; stays parked for human attention");
+        continue;
+      }
+      const newAttempt = maxAttempt + 1;
+      // Idempotency: a previous scan may already have prepared this
+      // attempt. The guard is keyed on the SAME anchor the intent scan
+      // claims on — the `publish: publish-requested <commit> attempt=N`
+      // note — not the ledger line. The ledger append and the note write
+      // are not atomic: a crash between them (or a rolled-back COMMIT)
+      // leaves an orphan ledger line with no note, and a line-keyed guard
+      // would skip it as "already prepared" until the budget forced the
+      // terminal timeout. Keyed on the note, a torn prepare self-heals:
+      // the orphan line is content-identical (deterministic version) and the
+      // intent scan claims the re-appended line exactly once. Do NOT
+      // reverse the write order: a note-without-line tear would park
+      // permanently with no budget-expiry resolution.
+      const prepareNote = db.prepare(
+        `SELECT id FROM events WHERE task_id = ? AND type = 'note'
+         AND message LIKE ? LIMIT 1`
+      ).get(taskId, `publish: publish-requested ${commit} attempt=${newAttempt} %`);
+      if (prepareNote) { skip(taskId, "reissue-already-prepared"); continue; }
+      // The re-issue diff is recomputed against CURRENT stamped provenance
+      // (or the empty tree): the ack scan stages the attempt the way the
+      // workflow staged attempt 1. A query error is not "no provenance" —
+      // fail closed.
+      let base;
+      try {
+        const prov = db.prepare("SELECT provenance_source_commit FROM projects WHERE id = ?").get(project.id);
+        base = (prov && /^[0-9a-f]{40}$/.test(prov.provenance_source_commit))
+          ? prov.provenance_source_commit : EMPTY_TREE;
+      } catch (e) {
+        skip(taskId, "provenance-query-failed",
+          `provenance lookup failed (${e.message.slice(0, 200)}); failing closed — the next scan retries`);
+        continue;
+      }
+      const repoPath = project.repo_path;
+      if (!repoPath) { skip(taskId, "no-repo-path"); continue; }
+      const newVersion = derivePublishVersion(commit, newAttempt);
+      const diffPath = join(crewHome, ".publish-diffs", `${taskId}-a${newAttempt}.diff`);
+      let diffJson = null;
+      try {
+        const out = execFileSync("node", [computeDiffScript,
+          "--repo-path", repoPath, "--base", base, "--commit", commit,
+          "--task-id", taskId, "--attempt", String(newAttempt), "--out", diffPath],
+          { encoding: "utf8", timeout: 60000, stdio: ["ignore", "pipe", "pipe"] });
+        diffJson = JSON.parse(String(out).trim());
+      } catch (e) {
+        skip(taskId, "reissue-diff-failed", `diff recomputation failed: ${String((e && e.message) || e).slice(0, 200)}`);
+        continue;
+      }
+      if (!diffJson || diffJson.ok !== true || diffJson.version !== newVersion ||
+          !/^[0-9a-f]{64}$/.test(diffJson.sha256 || "")) {
+        skip(taskId, "reissue-diff-unusable",
+          "the recomputed diff is unusable (version mismatch or bad checksum) — stays parked for human attention");
+        continue;
+      }
+      // No backoff: the reissue is immediately claimable by the next intent
+      // scan. The window expiry is the only spacing — a slow artifact gets
+      // its full window per attempt, and a dropped one is retried on the
+      // next tick, not after an arbitrary extra wait.
+      const ts = new Date(nowMs).toISOString();
+      const intentLine = {
+        ts, task_id: taskId, workflow: "ack-reissue", slug,
+        commit, attempt: null, publish_attempt: newAttempt, version: newVersion,
+        agent_id: null, applied_report: null,
+        issuer: "tick-worker",
+        diff_path: diffPath, diff_sha256: diffJson.sha256,
+        files: Array.isArray(diffJson.files) ? diffJson.files : null,
+        base, outcome: "publish-intent",
+        detail: `ack scan re-issue: attempt ${maxAttempt}'s 30-minute window expired with no version acknowledgement; ` +
+          `fresh version staged, immediately claimable (no backoff)`,
+      };
+      try {
+        appendFileSync(ledger.ledgerPath, JSON.stringify(intentLine) + "\n");
+      } catch (e) {
+        skip(taskId, "reissue-ledger-failed", `cannot append publish ledger: ${e.message}`);
+        continue;
+      }
+      writeGuardedPublishNote(db, taskId,
+        `publish: publish-requested ${commit} attempt=${newAttempt} — ack scan re-issue attempt ${newAttempt}: ` +
+        `no version acknowledgement within the 30-minute window; fresh version staged, immediately claimable ` +
+        `(2-hour total budget from first issuance).`,
+        ts);
+      reissued.push({ task_id: taskId, commit, attempt: newAttempt });
     }
     db.exec("COMMIT");
-    return { recorded: true, decision: verdict, task_id: taskId, note };
   } catch (e) { db.exec("ROLLBACK"); throw e; }
+
+  return { acknowledged, refused, reissued, timeouts, skipped };
 };
 
-// Retry-protocol re-check routing (2026-09-18, blocker 15). The tick runs
-// the retry protocol from inside the merge lock; its pre-trigger content
-// re-read (lib/classify-publish-absence.js) can come back something other
-// than provably-dropped. This command routes that decision — code-owned, so
-// the tick never free-forms the state machine.
+// Record the artifact platform's report text for an issued edit (0.14.6
+// §1.4). The tick worker calls this after each artifact_edit call with the
+// result/refusal text verbatim.
 //
-// Args: { task_id, decision } where decision is the classifier's JSON
-//   ({ ok:true, decision, reasons, details }).
-// CAS: the latest publish: note must still be "publish: dropped" — the merge
-// lock is the mutual exclusion; the CAS is the backstop against a tick that
-// died after another writer moved the state.
+// Args: { task_id, version, outcome: "acknowledged"|"refused",
+//         report_text }.
 //
-//   verified            → publish: verification-requested (content is
-//                         present now; no not-before) + unknown-resolved
-//                         ledger entry.
-//   provably-dropped    → no-op: the tick proceeds with the retry.
-//   applied-not-built / ambiguous → publish: ambiguous (terminal).
-//   superseded          → publish: superseded (terminal).
-//   deferred            → no-op: the drop note stays latest; the next scan
-//                         re-queues the protocol and re-reads.
-commands["record-retry-recheck"] = (db, args, ctx) => {
-  const crewHome = ctx?.crewHome;
-  if (!crewHome) throw usageError("crewHome is required (internal context).");
-  const taskId = String(args?.task_id ?? "").trim();
+// Mechanical guards (the command, not prose, decides):
+//   - report_text must contain the EXACT version string, else rejected;
+//   - the version must match an issued attempt for this task (derived, never
+//     trusted from prose), else rejected.
+// A refused report naming an issued version terminal-parks the task at the
+// next ack scan (`publish: publish-refused`). (2026-09-20 REVIEW) The
+// "acknowledged" outcome is rejected: it was circular (the worker knows
+// the version, so the report proves nothing), and disk is the sole positive
+// evidence. The rows persist as evidence.
+commands["record-builder-report"] = (db, args, ctx) => {
+  const taskId = args.task_id;
+  const version = args.version;
+  const outcome = args.outcome;
+  const reportText = args.report_text;
   if (!taskId) throw usageError("task_id is required.");
-  const decision = args?.decision;
-  if (!decision || typeof decision !== "object" || decision.ok !== true) {
-    throw usageError("decision is required — pass the classifier's JSON (ok:true).");
+  if (!isPublishVersion(version)) throw usageError("version must be the per-attempt publish version (<commit>:<attempt>).");
+  // (2026-09-20 REVIEW) "acknowledged" is rejected — the positive
+  // builder-report path was circular. Disk is the sole positive evidence.
+  if (outcome !== "refused") throw usageError(`unknown outcome: ${outcome} (only "refused" is accepted).`);
+  if (typeof reportText !== "string" || !reportText.includes(version)) {
+    throw usageError("report_text must contain the exact version string — the report is mechanically rejected otherwise.");
   }
-  const valid = ["verified", "provably-dropped", "applied-not-built", "ambiguous", "deferred", "superseded"];
-  if (!valid.includes(decision.decision)) {
-    throw usageError(`unknown classifier decision: ${decision.decision}.`);
+  const task = db.prepare("SELECT id, state, project FROM tasks WHERE id = ?").get(taskId);
+  if (!task) throw notFound(`unknown task: ${taskId}`);
+  if (task.state !== "parked") {
+    throw usageError(`task is not parked (state=${task.state}) — builder reports attach to parked publish tasks.`);
   }
-  requireTask(db, taskId);
-  const derived = derivePublishUnknownAttempt(db, crewHome, taskId);
-  if (!derived.ok) throw usageError(`cannot derive the unknown attempt: ${derived.reason}.`);
-  const latest = latestPublishNote(db, taskId);
-  if (!latest || !latest.message.includes("publish: dropped")) {
-    return {
-      recorded: false,
-      reason: "latest publish: note is no longer publish: dropped — another writer moved the state; recorded nothing.",
-    };
+  const project = db.prepare("SELECT id, deploy_slug FROM projects WHERE id = ?").get(task.project);
+  const slug = project && project.deploy_slug;
+  if (!slug) throw usageError("project has no deploy_slug.");
+  const ledger = readTaskLedgerEntries(ctx.crewHome, slug, taskId);
+  if (!ledger.ok) throw usageError(ledger.reason);
+  let matched = null;
+  for (const e of ledger.entries) {
+    if (e.outcome !== "submitted" || e.issuer !== "tick-worker") continue;
+    if (verifiedSubmittedAttempt(taskId, e) === null) continue;
+    if (derivePublishVersion(e.commit, e.publish_attempt) === version) { matched = e; break; }
+  }
+  if (!matched) {
+    throw usageError("version does not match any issued attempt for this task — the report is rejected.");
   }
-  const d = decision.decision;
-  const reasons = Array.isArray(decision.reasons) ? decision.reasons.join("; ") : "";
-  const commit = derived.commit;
-  if (d === "provably-dropped" || d === "deferred") {
-    // No state change: the tick proceeds (dropped) or the next scan
-    // re-queues the protocol (deferred).
-    return { recorded: false, reason: `re-check decision ${d}: no state change; the drop note stands.` };
-  }
-  if (d === "verified") {
-    writePublishNote(db, taskId,
-      `publish: verification-requested ${commit} attempt=${derived.attempt} — unknown-recovery retry re-check: the content is present now, so no retry was needed. Waiting on the manual read-back in docs/publish-verification.md.`);
-    try {
-      appendFileSync(derived.ledgerPath, JSON.stringify({
-        ts: now(), task_id: taskId, workflow: "unknown-recovery", slug: derived.slug,
-        commit, attempt: derived.attempt, agent_id: null, applied_report: null,
-        outcome: "unknown-resolved",
-        detail: `retry re-check verified (was: ${reasons})`,
-      }) + "\n");
-    } catch (e) { /* best-effort observability */ }
-    return { recorded: true, decision: d, routed: "verification-requested" };
-  }
-  // applied-not-built / ambiguous → terminal; superseded → terminal.
-  const terminal = d === "superseded" ? "superseded" : "ambiguous";
-  const noteBody = terminal === "superseded"
-    ? `publish: superseded ${commit} — unknown-recovery retry re-check: the retry target moved (${reasons}); not retrying a stale commit. Parked for human attention.`
-    : `publish: ambiguous ${commit} — unknown-recovery retry re-check: ${reasons}; not retrying blind. Parked for human attention.`;
-  writePublishNote(db, taskId, noteBody);
+  db.prepare(
+    `INSERT INTO builder_reports (id, task_id, version, outcome, report_text, created_at)
+     VALUES (?, ?, ?, ?, ?, ?)`
+  ).run(uuid(), taskId, version, outcome, reportText.slice(0, 20000), now());
+  return {
+    ok: true, task_id: taskId, version, outcome,
+    commit: matched.commit, publish_attempt: matched.publish_attempt,
+  };
+};
+
+// Record a positive version acknowledgement found off the ack scan's path
+// (0.14.6 §1.3): the re-claiming tick read the dead attempt's version receipt
+// from the artifact's disk. The version must name an issued attempt for this
+// task (derived, never trusted) — ANY issued version for the task counts,
+// including a late earlier attempt's. (2026-09-20 REVIEW) The reclaim path
+// also accepts the exact disk version for the currently claimed intent when
+// no submitted entry exists (dead tick issued but died before recording).
+// Stamps provenance, writes the terminal `publish: version-acknowledged`
+// note, re-queues the task.
+//
+// Args: { task_id, version, via: "disk" }.
+commands["record-version-ack"] = (db, args, ctx) => {
+  const taskId = args.task_id;
+  const version = args.version;
+  const via = args.via;
+  if (!taskId) throw usageError("task_id is required.");
+  if (!isPublishVersion(version)) throw usageError("version must be the per-attempt publish version (<commit>:<attempt>).");
+  if (via !== "disk") throw usageError(`unknown via: ${via} (only "disk" is accepted).`);
+  const task = db.prepare("SELECT id, state, project FROM tasks WHERE id = ?").get(taskId);
+  if (!task) throw notFound(`unknown task: ${taskId}`);
+  if (task.state !== "parked") {
+    throw usageError(`task is not parked (state=${task.state}) — version acks attach to parked publish tasks.`);
+  }
+  const project = db.prepare("SELECT id, deploy_slug FROM projects WHERE id = ?").get(task.project);
+  const slug = project && project.deploy_slug;
+  if (!slug) throw usageError("project has no deploy_slug.");
+  const ledger = readTaskLedgerEntries(ctx.crewHome, slug, taskId);
+  if (!ledger.ok) throw usageError(ledger.reason);
+  let matched = null;
+  for (const e of ledger.entries) {
+    if (e.outcome !== "submitted" || e.issuer !== "tick-worker") continue;
+    if (verifiedSubmittedAttempt(taskId, e) === null) continue;
+    if (derivePublishVersion(e.commit, e.publish_attempt) === version) { matched = e; break; }
+  }
+  // (2026-09-20 REVIEW) Reclaim path: a tick that died after issuing but
+  // before recording has no submitted entry. The code-written active claim
+  // (publish-intent-claimed note) + the exact on-disk derived version for
+  // the claimed intent's commit+attempt proves the dead issuance occurred.
+  // Arbitrary/non-current/non-derived versions are still rejected.
+  if (!matched) {
+    const claimed = latestPublishNote(db, taskId);
+    const intentEntry = [...ledger.entries].reverse().find((e) => e.outcome === "publish-intent") || null;
+    if (claimed && claimed.message.includes("publish: publish-intent-claimed") &&
+        intentEntry && /^[0-9a-f]{40}$/.test(intentEntry.commit || "") &&
+        Number.isInteger(intentEntry.publish_attempt) && intentEntry.publish_attempt >= 1 &&
+        derivePublishVersion(intentEntry.commit, intentEntry.publish_attempt) === version &&
+        via === "disk") {
+      matched = {
+        commit: intentEntry.commit,
+        publish_attempt: intentEntry.publish_attempt,
+        // No submitted entry — the reclaim synthesizes the ack from the
+        // claimed intent. The issued_at is unknown; the ack is timeless.
+      };
+    }
+  }
+  if (!matched) {
+    throw usageError("version does not match any issued attempt for this task — the ack is rejected.");
+  }
+  db.exec("BEGIN");
   try {
-    appendFileSync(derived.ledgerPath, JSON.stringify({
-      ts: now(), task_id: taskId, workflow: "unknown-recovery", slug: derived.slug,
-      commit, attempt: derived.attempt, agent_id: null, applied_report: null,
-      outcome: "unknown-classified",
-      detail: `retry re-check ${d}: terminal (${reasons})`,
-    }) + "\n");
-  } catch (e) { /* best-effort observability */ }
-  return { recorded: true, decision: d, routed: terminal };
+    const res = recordVersionAck(db, ctx, {
+      taskId, projectId: project.id, commit: matched.commit, version, via,
+    });
+    db.exec("COMMIT");
+    return res;
+  } catch (e) { db.exec("ROLLBACK"); throw e; }
+};
+
+// The closed publish-note writer's prose entry point (0.14.6 §1.5): the
+// ONLY way for tick prose to write a state-carrying `publish: <verb>` note.
+// The verb is asserted against the closed registry in
+// lib/publish-note-vocabulary.js — prose cannot mint new `publish: <verb>`
+// states; an unregistered verb is a usage error, never a note.
+//
+// Args: { task_id, note } — the full note text.
+commands["record-publish-note"] = (db, args) => {
+  const taskId = args.task_id;
+  const note = String(args.note || "");
+  if (!taskId) throw usageError("task_id is required.");
+  if (!note) throw usageError("note is required.");
+  const task = db.prepare("SELECT id, state FROM tasks WHERE id = ?").get(taskId);
+  if (!task) throw notFound(`unknown task: ${taskId}`);
+  if (task.state !== "parked") {
+    throw usageError(`task is not parked (state=${task.state}) — publish notes attach to parked tasks.`);
+  }
+  let verb;
+  try {
+    verb = assertWritablePublishNote(note);
+  } catch (e) {
+    throw usageError(e.message);
+  }
+  writePublishNote(db, taskId, note);
+  return { ok: true, task_id: taskId, verb };
 };
 
-// Composite: record a phase's session verdict AND its event in one
-// transaction. This is the operation that used to crash the workflow when the
-// two writes went to different contracts: the session stored, the event
-// rejected, the run dead. One transaction, one vocabulary, no partial state.
+// STRUCTURED VERDICT RECORDS (room #26 blocker 33, 2026-09-21). Review
+// verdict grounds were destroyed by the 2000-char session-note truncation —
+// a park on a verified-correct implementation was unauditable. record-phase
+// optionally carries the full grounds (`args.verdict`); they are validated
+// at the API boundary and written to the verdicts table in the same
+// transaction as the session note + event, so the lossless record can never
+// be missing when the note exists. One verdict per recording session: a
+// re-recorded phase for the same session is the same evidence, so the first
+// write wins (ON CONFLICT DO NOTHING) and rows are never revised. A new
+// Review execution claims a new session, so rework rounds and dispatcher
+// retries each get their own row.
+const VERDICT_RECORD_STEPS = ["Review"];
+const VERDICT_VALUES = ["PASS", "FAIL", "INDETERMINATE"];
+const MAX_VERDICT_GROUNDS = 1000000;
+
+function validateVerdictPayload(taskId, verdict, sessionRow) {
+  if (typeof verdict !== "object" || verdict === null)
+    throw usageError("verdict must be an object.");
+  const { step, attempt, reviewer, verdict: value, grounds, review_basis } = verdict;
+  if (!VERDICT_RECORD_STEPS.includes(step))
+    throw usageError(`verdict step must be one of: ${VERDICT_RECORD_STEPS.join(", ")}.`);
+  if (!Number.isInteger(attempt) || attempt < 0)
+    throw usageError("verdict attempt must be a non-negative integer.");
+  if (typeof reviewer !== "string" || reviewer.trim().length < 1 || reviewer.length > 200)
+    throw usageError("verdict reviewer is required (1-200 chars).");
+  if (!VERDICT_VALUES.includes(value))
+    throw usageError(`verdict must be one of: ${VERDICT_VALUES.join(", ")}.`);
+  if (typeof grounds !== "string" || grounds.length < 1 || grounds.length > MAX_VERDICT_GROUNDS)
+    throw usageError(`verdict grounds are required (1-${MAX_VERDICT_GROUNDS} chars).`);
+  // Room #26 blocker 34 (redesign): the structured review basis — what the
+  // review actually examined. NULL when the review was not branch-classified
+  // (docs.js path). Shape-pinned at the API boundary: a lowercase kind tag,
+  // optionally qualified by a 40-hex merge sha (frozen-merge:<sha>).
+  let reviewBasis = null;
+  if (review_basis !== undefined && review_basis !== null) {
+    // Exact closed set (blocker 34 redesign, 2026-09-21): the workflows emit
+    // only branch-diff, mechanical-fail, runtime-state-none, or
+    // frozen-merge:<40-hex-sha>. A broad regex would accept fabricated kinds.
+    if (typeof review_basis !== "string" ||
+        !/^(branch-diff|mechanical-fail|runtime-state-none|frozen-merge:[0-9a-f]{40})$/.test(review_basis))
+      throw usageError("verdict review_basis must be null or one of 'branch-diff', 'mechanical-fail', 'runtime-state-none', 'frozen-merge:<40-hex-sha>'.");
+    reviewBasis = review_basis;
+  }
+  return {
+    id: uuid(),
+    task_id: taskId,
+    step,
+    attempt,
+    reviewer: reviewer.trim(),
+    verdict: value,
+    grounds,
+    review_basis: reviewBasis,
+    // summary is derived from the session note actually recorded — one
+    // source of truth, never a second caller-supplied truncation.
+    summary: sessionRow.notes,
+    session_id: sessionRow.id,
+    created_at: now(),
+  };
+}
+
 commands["record-phase"] = (db, args) => {
   if (!args.task_id) throw usageError("task_id is required.");
   requireTask(db, args.task_id);
@@ -2770,6 +2840,13 @@ commands["record-phase"] = (db, args) => {
     id: uuid(), type: event.type, task_id: args.task_id,
     identity: event.identity ?? sessionRow.identity, message, timestamp,
   };
+  // Blocker 33: validate the optional structured verdict BEFORE the
+  // transaction — a malformed payload fails the whole phase record (fail
+  // closed), never a silently dropped verdict.
+  const verdictRow = args.verdict == null
+    ? null
+    : validateVerdictPayload(args.task_id, args.verdict, sessionRow);
+  let recordedVerdict = null;
   db.exec("BEGIN");
   try {
     db.prepare(
@@ -2786,9 +2863,39 @@ commands["record-phase"] = (db, args) => {
     db.prepare(
       `INSERT INTO events (id, type, task_id, identity, message, timestamp)
        VALUES (@id, @type, @task_id, @identity, @message, @timestamp)`).run(eventRow);
+    // Blocker 33: the verdict lands in the same transaction as the session
+    // note + event — the lossless record can never be missing when the note
+    // exists. Idempotency is session-keyed: a re-recorded phase for the
+    // same session is the same evidence (first write wins, never revised);
+    // a new Review execution claims a new session and gets its own row.
+    if (verdictRow) {
+      const verdictInsert = db.prepare(
+        `INSERT INTO verdicts (id, task_id, step, attempt, reviewer, verdict,
+          grounds, review_basis, summary, session_id, created_at)
+         VALUES (@id, @task_id, @step, @attempt, @reviewer, @verdict,
+          @grounds, @review_basis, @summary, @session_id, @created_at)
+         ON CONFLICT(session_id) DO NOTHING`).run(verdictRow);
+      recordedVerdict = verdictInsert.changes === 1
+        ? verdictRow
+        : db.prepare(
+            `SELECT * FROM verdicts WHERE session_id = ?`).get(verdictRow.session_id);
+    }
     db.exec("COMMIT");
   } catch (e) { db.exec("ROLLBACK"); throw e; }
-  return { session: mapSession(sessionRow), event: mapEvent(eventRow) };
+  return { session: mapSession(sessionRow), event: mapEvent(eventRow),
+    verdict: mapVerdict(recordedVerdict) };
+};
+
+// Blocker 33 read surface: all structured verdict records for a task,
+// ordered by recording time (rework rounds and retries accumulate as
+// separate rows, never overwrite).
+commands["get-verdicts"] = (db, args) => {
+  if (!args.task_id) throw usageError("task_id is required.");
+  requireTask(db, args.task_id);
+  const rows = db.prepare(
+    `SELECT * FROM verdicts WHERE task_id = ? ORDER BY created_at ASC`
+  ).all(args.task_id);
+  return { verdicts: rows.map(mapVerdict) };
 };
 
 // Initial provenance stamp (2026-09-16, clean-room task ada95b71): the first
@@ -2823,7 +2930,7 @@ function tryStampInitialProvenance(db, projectId, crewHome, repoPath, deployType
   // Symlink-only resolution: the stamp records the crew home's ACTIVE
   // release — it must not depend on which copy of this file is running.
   // The strict self-path cross-check lives in resolveActiveRelease, used by
-  // scan-verification-pending; requiring it here silently skipped the stamp
+  // the ack/intent scans; requiring it here silently skipped the stamp
   // for every setup path that invokes crew-api.js outside the release tree
   // (room #15: create-project through the npm package's own lib/).
   try { releaseName = resolveActiveReleaseName(crewHome); } catch { releaseName = null; }
@@ -3069,7 +3176,7 @@ commands["update-config"] = (db, args) => {
 // never touches another's row.
 function stampProvenance(db, { project_id, source_commit, crew_release, published_at, task_id }) {
   // task_id invariant (2026-09-19 REVIEW): task_id is set by every REAL
-  // publish (lib/verify-publish.js and the workflow provenance-refresh paths)
+  // publish (the version ack scan and the workflow provenance-refresh paths)
   // and is null for initial stamps (tryStampInitialProvenance) and for
   // publish-base advances (lib/advance-publish-base.js). So
   // provenance.task_id != null ⟺ a real publish has stamped this project.
@@ -3164,12 +3271,12 @@ commands["migrate"] = (db, args) => {
 
 // import-json: one-time import from a dashboard exportCrewState JSON payload.
 // Used for the live migration (the artifact's app.db is never opened directly).
-// Args: { data: { projects: [...], tasks: [...], agent_sessions: [...], events: [...], config: [...], poll_state: [...] } }
+// Args: { data: { projects: [...], tasks: [...], agent_sessions: [...], events: [...], config: [...], poll_state: [...], builder_reports: [...] } }
 // Or pipe the JSON via stdin.
 commands["import-json"] = (db, args) => {
   const data = args.data;
   if (!data || typeof data !== "object") throw usageError("data must be the exportCrewState JSON object.");
-  const tables = ["projects", "tasks", "poll_state", "config", "agent_sessions", "events"];
+  const tables = ["projects", "tasks", "poll_state", "config", "agent_sessions", "events", "builder_reports"];
   const counts = {};
   db.exec("BEGIN");
   try {