muse-crew 0.14.5 → 0.14.7

package/lib/merge-lock.sh

@@ -19,6 +19,20 @@
 # (or malformed) lease is broken with logging and re-acquired. Every op
 # appends one line to $CREW_HOME/.merge-lock.log (the audit trail).
 #
+# Stale-break atomicity (R-B1, 2026-09-21): the break's read→rm→create is
+# serialized on a sidecar flock ($LOCK_FILE.flock) and the lease is re-read
+# inside the critical section — the old unconditional rm before the noclobber
+# create let two concurrent reclaimers both win. Refresh rewrites via
+# temp-file + atomic rename so a concurrent reader never sees a torn file,
+# and takes the same sidecar flock so a refresh can never clobber a
+# reclaimer's fresh lock in its read→mv gap (2026-09-21): refresh's
+# identity-only re-check closes the clobber because a reclaim always changes
+# task_id. Refresh never checks expiry — a long build that outran the lease
+# legitimately revives its lock here (publish-npm.sh step 5b relies on it).
+# Release (review pass 2, 2026-09-21) takes the same sidecar flock with the
+# identity re-check inside the critical section, so a release can never rm
+# a reclaimer's fresh lock in its read→rm gap.
+#
 # Usage:
 #   merge-lock.sh acquire <task_id> <holder>  — acquire the lock (0 ok, 1 held)
 #   merge-lock.sh refresh <task_id>           — extend the lease (holder task only)
@@ -44,6 +58,7 @@ fi
 
 LOCK_DIR="$CREW_REPO/.worktrees"
 LOCK_FILE="$LOCK_DIR/.merge-lock"
+FLOCK_FILE="$LOCK_FILE.flock"  # sidecar serializing stale-lease breaks (R-B1) and refresh rewrites (2026-09-21)
 LOG_FILE="$CREW_HOME/.merge-lock.log"
 LEASE_SECONDS="${MERGE_LOCK_LEASE_SECONDS:-600}"
 
@@ -127,55 +142,152 @@ case "$cmd" in
       exit 1
     fi
     # Expired or malformed lease — break it (logged) and re-acquire.
+    # R-B1 (2026-09-21): read→rm→create is serialized on the sidecar flock.
+    # The rm used to run before the noclobber create outside any atomic op,
+    # so two concurrent reclaimers could both win: B read the stale lease,
+    # A reclaimed (rm + create, exit 0), B's rm deleted A's fresh lock, and
+    # B's create then succeeded too. The lease is re-read INSIDE the
+    # critical section — a contender may have refreshed, released, or
+    # reclaimed while we waited on the flock.
     echo "STALE: lease for ${lock_task_id:-unknown} (holder ${lock_holder:-unknown}) expired — breaking" >&2
     log_op acquire "task_id=$task_id holder=$holder result=STALE-BREAK previous_task=${lock_task_id:-unknown} previous_holder=${lock_holder:-unknown}"
-    rm -f "$LOCK_FILE"
-    if write_lock "$task_id" "$holder"; then
-      log_op acquire "task_id=$task_id holder=$holder result=ACQUIRED-RECLAIMED previous_task=${lock_task_id:-unknown}"
-      echo "ACQUIRED by $task_id (holder $holder; reclaimed expired lease from ${lock_task_id:-unknown})"
-      exit 0
-    fi
-    # Lost the race: whoever won the create holds it now.
-    read_lock 2>/dev/null || true
-    log_op acquire "task_id=$task_id holder=$holder result=HELD-RACE holder_task=${lock_task_id:-unknown}"
-    echo "HELD by ${lock_task_id:-unknown} (holder ${lock_holder:-unknown}) — lost reclaim race"
-    exit 1
+    stale_task="${lock_task_id:-unknown}"
+    mkdir -p "$LOCK_DIR"
+    # Subshell exit codes: 0 reclaimed; 10 the re-read found a live lease;
+    # 11 lost the noclobber create to a fresh acquirer racing the break.
+    reclaim_code=0
+    (
+      exec 200>"$FLOCK_FILE"
+      flock -x 200
+      if read_lock; then
+        recheck="$(lock_remaining)"
+        if [ "$recheck" != "unknown" ] && [ "$recheck" -gt 0 ]; then
+          exit 10
+        fi
+      fi
+      rm -f "$LOCK_FILE"
+      if write_lock "$task_id" "$holder"; then
+        exit 0
+      else
+        exit 11
+      fi
+    ) || reclaim_code=$?
+    case "$reclaim_code" in
+      0)
+        log_op acquire "task_id=$task_id holder=$holder result=ACQUIRED-RECLAIMED previous_task=$stale_task"
+        echo "ACQUIRED by $task_id (holder $holder; reclaimed expired lease from $stale_task)"
+        exit 0
+        ;;
+      10)
+        # Re-read found a live lease inside the critical section: another
+        # contender refreshed or reclaimed while we waited on the flock.
+        read_lock 2>/dev/null || true
+        if [ -n "$lock_task_id" ]; then
+          live_remaining="$(lock_remaining)"
+          log_op acquire "task_id=$task_id holder=$holder result=HELD-RECHECK holder_task=$lock_task_id holder_id=$lock_holder remaining=${live_remaining}s"
+          echo "HELD by $lock_task_id (holder $lock_holder, ${live_remaining}s of lease remaining)"
+        else
+          log_op acquire "task_id=$task_id holder=$holder result=HELD-RECHECK holder_task=unknown"
+          echo "HELD — lost the reclaim race to another contender"
+        fi
+        exit 1
+        ;;
+      *)
+        # Lost the noclobber create to a fresh acquirer racing the break:
+        # whoever won the create holds the lock now.
+        read_lock 2>/dev/null || true
+        log_op acquire "task_id=$task_id holder=$holder result=HELD-RACE holder_task=${lock_task_id:-unknown}"
+        echo "HELD by ${lock_task_id:-unknown} (holder ${lock_holder:-unknown}) — lost reclaim race"
+        exit 1
+        ;;
+    esac
     ;;
   refresh)
     [ -z "$task_id" ] && { echo "ERROR: task_id required"; exit 1; }
-    if ! read_lock; then
-      log_op refresh "task_id=$task_id result=NO-LOCK"
-      echo "ERROR: no lock to refresh"
-      exit 1
-    fi
-    if [ "$lock_task_id" != "$task_id" ]; then
-      log_op refresh "task_id=$task_id result=NOT-HOLDER holder_task=$lock_task_id"
-      echo "ERROR: lock held by $lock_task_id, not $task_id"
-      exit 1
-    fi
-    # Extend the lease: acquired_at=now, holder and lease window unchanged.
-    printf 'task_id=%s\nholder=%s\nacquired_at=%s\nlease_seconds=%s\n' \
-      "$lock_task_id" "$lock_holder" "$(date +%s)" "${lock_lease_seconds:-$LEASE_SECONDS}" > "$LOCK_FILE"
-    log_op refresh "task_id=$task_id holder=$lock_holder result=REFRESHED"
-    echo "REFRESHED by $task_id (holder $lock_holder)"
-    exit 0
+    # 2026-09-21: read→identity-check→rewrite is serialized on the sidecar
+    # flock against acquire's reclaim — a holder refreshing after lease
+    # expiry could otherwise clobber a reclaimer's fresh lock inside the
+    # read→mv gap. The re-check inside the critical section is IDENTITY-ONLY:
+    # a reclaim always changes task_id, so identity alone closes the clobber.
+    # There is deliberately NO expiry fail-closed check — a long build that
+    # outran the lease legitimately revives its lock here (publish-npm.sh
+    # step 5b and the workflow Publish prompt rely on it). Fail closed (exit
+    # 1) only if identity no longer matches.
+    refresh_code=0
+    (
+      exec 200>"$FLOCK_FILE"
+      flock -x 200
+      if ! read_lock; then
+        log_op refresh "task_id=$task_id result=NO-LOCK"
+        echo "ERROR: no lock to refresh"
+        exit 1
+      fi
+      if [ "$lock_task_id" != "$task_id" ]; then
+        log_op refresh "task_id=$task_id result=NOT-HOLDER holder_task=$lock_task_id"
+        echo "ERROR: lock held by $lock_task_id, not $task_id"
+        exit 1
+      fi
+      # Extend the lease: acquired_at=now, holder and lease window unchanged.
+      # Write-temp + atomic rename (2026-09-21): a truncating rewrite lets a
+      # concurrent reader observe a torn (partially written) file and misread
+      # the lease as malformed — funneling it spuriously into the reclaim path.
+      tmp_lock="$(mktemp "$LOCK_DIR/.merge-lock.tmp.XXXXXX")" \
+        || { echo "ERROR: cannot stage lock refresh"; exit 1; }
+      printf 'task_id=%s\nholder=%s\nacquired_at=%s\nlease_seconds=%s\n' \
+        "$lock_task_id" "$lock_holder" "$(date +%s)" "${lock_lease_seconds:-$LEASE_SECONDS}" > "$tmp_lock"
+      mv -f "$tmp_lock" "$LOCK_FILE"
+      log_op refresh "task_id=$task_id holder=$lock_holder result=REFRESHED"
+      echo "REFRESHED by $task_id (holder $lock_holder)"
+      exit 0
+    ) || refresh_code=$?
+    exit "$refresh_code"
     ;;
   release)
     [ -z "$task_id" ] && { echo "ERROR: task_id required"; exit 1; }
-    if ! read_lock; then
-      log_op release "task_id=$task_id result=NOT-LOCKED"
-      echo "RELEASED (was not locked)"
-      exit 0
-    fi
-    if [ "$lock_task_id" = "$task_id" ]; then
-      rm -f "$LOCK_FILE"
-      log_op release "task_id=$task_id holder=$lock_holder result=RELEASED"
-      echo "RELEASED by $task_id"
-      exit 0
-    fi
-    log_op release "task_id=$task_id result=NOT-HOLDER holder_task=$lock_task_id"
-    echo "ERROR: lock held by $lock_task_id, not $task_id"
-    exit 1
+    # 2026-09-21 (review pass 2): read→identity-check→rm is serialized on the
+    # sidecar flock — the same double-hold race class as R-B1 is reachable
+    # here: releaser reads, reclaimer breaks and creates, releaser's rm then
+    # deletes the reclaimer's fresh lock. The identity re-check runs INSIDE
+    # the critical section.
+    release_code=0
+    # The identity check and rm run in a subshell, so the holder name is
+    # ferried out on stdout (subshell variables never reach the parent).
+    release_out="$(
+      (
+        exec 200>"$FLOCK_FILE"
+        flock -x 200
+        if ! read_lock; then
+          exit 10
+        fi
+        if [ "$lock_task_id" != "$task_id" ]; then
+          exit 11
+        fi
+        printf 'holder=%s\n' "$lock_holder"
+        rm -f "$LOCK_FILE"
+        exit 0
+      )
+    )" || release_code=$?
+    release_holder="${release_out#holder=}"
+    case "$release_code" in
+      0)
+        log_op release "task_id=$task_id holder=$release_holder result=RELEASED"
+        echo "RELEASED by $task_id"
+        exit 0
+        ;;
+      10)
+        log_op release "task_id=$task_id result=NOT-LOCKED"
+        echo "RELEASED (was not locked)"
+        exit 0
+        ;;
+      *)
+        # Re-read inside the critical section: identity checked against the
+        # lock as it stands now, not as it stood before the flock.
+        read_lock 2>/dev/null || true
+        log_op release "task_id=$task_id result=NOT-HOLDER holder_task=${lock_task_id:-unknown}"
+        echo "ERROR: lock held by ${lock_task_id:-unknown}, not $task_id"
+        exit 1
+        ;;
+    esac
     ;;
   status)
     if ! read_lock; then

package/lib/publish-note-vocabulary.js

@@ -1,64 +1,157 @@
-// Terminal-note vocabulary registry (D7, 2026-09-19). Explicit state, not
-// prose: every `publish: …` note the state machine treats as terminally
-// parked. Readers (scan-publish-unknown in lib/crew-api.js) consult this;
-// writers assert against it (lib/verify-publish.js's terminal() fails loud
-// before emitting a verb that is not in the registry). Add a note here when
-// a new terminal verb is introduced — the scan recognizes it with no other
-// change.
+// Publish-note vocabulary registry (D7, 2026-09-19; 0.14.6 version-acknowledgement
+// rewrite, 2026-09-20). Explicit state, not prose.
 //
-// This module is the closed-enum pattern's first instance: the audit
-// (room23-design/blanket-call-audit.md §3) lists the other state-carrying
-// string families (the full `publish: <transition>` note shapes, the
-// publish-ledger `outcome` vocabulary, worker-report marker lines) that a
-// later unification pass extends the enum-guard pattern to. The contract
-// for any new family: one registry module, readers consult it, writers
-// assert membership before writing, closed by default and open by edit.
+// 0.14.6 replaced the content-verdict/readback architecture with Eric's
+// publication contract: exact version acknowledgement is the sole positive
+// completion criterion ("If we hear that the artifact acknowledges our
+// version, that's it. We don't verify against content."). Provenance now
+// certifies that an issuance request was ACKNOWLEDGED — never that bytes
+// matched.
+//
+// Two registries:
+//   TERMINAL_PUBLISH_NOTES — every `publish: …` note the ack/intent scans
+//     treat as terminally parked. Readers consult this; a recognized
+//     terminal note is skipped as terminal with its meaning, never as
+//     unrecognized. Legacy verbs from the retired content-verdict machine
+//     stay recognized (marked below) so old note history never becomes
+//     "unrecognized" — the new machine never writes them.
+//   TRANSITIONAL_PUBLISH_NOTES — every non-terminal state-carrying
+//     `publish: …` note the 0.14.6 machine writes.
+//
+// Writers are split in two (2026-09-20 REVIEW): deterministic code writes
+// through writeGuardedPublishNote (asserts CODE_WRITABLE_PUBLISH_NOTES —
+// transitional + the four current terminals); tick prose writes only
+// through the `record-publish-note` crew-api command (asserts
+// WRITABLE_PUBLISH_NOTES — transitional ONLY, so prose can never mint a
+// terminal state). A third prose path, `log-event` with type "note", is
+// mechanically rejected for any `publish:` verb — notes are advisory, but
+// only the closed writer may mint state-carrying ones.
+//
+// The one gap: the workflow's `publish: publish-requested` park note is
+// written by the workflow's own parkTask plumbing, not through crew-api —
+// the intent scan validates its shape (commit + attempt) against the intent
+// ledger entry when claiming, which is the mechanical guard for that path.
+//
+// Add a note here when a new verb is introduced — readers recognize it with
+// no other change, and writers cannot emit it without registering it.
 //
 // ESM, no shebang, no side effects on import (import-safe module — bare
 // `node publish-note-vocabulary.js` exits 0).
+//
+// The four 0.14.6 terminals the machine's own deterministic code writes
+// (never tick prose — see the writer split above).
+export const CODE_TERMINAL_PUBLISH_NOTES = [
+  // The artifact acknowledged the attempt's exact version on disk.
+  // Provenance is stamped; the task re-queues. (2026-09-20 REVIEW: disk
+  // is the sole positive evidence — the builder-report path was circular.)
+  "publish: version-acknowledged",
+  // The platform explicitly refused the tick worker's directly-issued edit.
+  // Honest terminal state — no re-issue; parked for human attention.
+  "publish: publish-refused",
+  // The 2-hour acknowledgement budget from first issuance is exhausted with
+  // no acknowledgement (unobserved within budget — the edit may still have
+  // landed). Parked for human attention.
+  "publish: version-timeout",
+  // One-party intent terminal: the diff for the committed intent cannot be
+  // (re)generated byte-identically — the staged file is missing or corrupt,
+  // or the base..commit range cannot be regenerated. Never re-claim, never
+  // loop; parked for human attention.
+  "publish: publish-unissuable",
+];
 export const TERMINAL_PUBLISH_NOTES = [
+  ...CODE_TERMINAL_PUBLISH_NOTES,
+  // Legacy terminals (retired content-verdict/unknown-recovery machine):
+  // recognized so old note history skips as terminal, never written anew.
   "publish: ambiguous",
   "publish: retry-superseded",
   "publish: retry-refused",
   "publish: verified",
   "publish: superseded",
-  // One-party publish refusal (2026-09-20, blocker 22): the session-carrying
-  // tick worker issued the edit directly and the platform refused it.
-  // Honest terminal state — no re-issue, no park-unknown; the task stays
-  // parked for human attention.
-  "publish: publish-refused",
-  // Verification pipeline's terminal content verdict (verify-publish.js).
-  // The task stays parked for human attention; unknown-recovery never
-  // re-enters it. Added 2026-09-19 (Room #23 J1/J3: was mislogged as
-  // unrecognized-publish-note).
   "publish: verification-failed",
-  // (2026-09-20, critic-0145 F-O2) One-party intent terminal: the diff for
-  // the committed intent cannot be (re)generated byte-identically — the
-  // staged file is missing or corrupt, or the base..commit range cannot be
-  // regenerated. Never re-claim, never loop on an hourly reclaim; parked
-  // for human attention.
-  "publish: publish-unissuable",
-  // (2026-09-20, critic-0145 F-R3) One-party intent terminal: a re-claimed
-  // intent arrived with no pre-issuance manifest baseline, so the freshness
-  // comparison is unperformable — the tick can neither prove a dead tick's
-  // issuance nor safely re-issue. Never blind-issue, never loop
-  // indefinitely; parked for human attention.
   "publish: intent-unverifiable",
 ];
 export const TERMINAL_NOTE_MEANINGS = {
-  "publish: ambiguous": "unknown-recovery terminal: could not prove the drop; parked for human attention",
-  "publish: retry-superseded": "retry protocol terminal: superseded; parked for human attention",
-  "publish: retry-refused": "retry protocol terminal: platform refused the re-issued edit; parked for human attention",
-  "publish: verified": "publish verified and stamped; task re-queued (terminal for the scan)",
-  "publish: superseded": "HEAD moved past the attempt; recovery aborted; parked for human attention",
-  "publish: publish-refused": "one-party publish terminal: the platform refused the tick worker's directly-issued edit; parked for human attention",
-  "publish: verification-failed": "verification pipeline's terminal content verdict — parked for human attention",
+  "publish: version-acknowledged": "the artifact acknowledged this attempt's exact version — provenance stamped; task re-queued (terminal for the scans)",
+  "publish: publish-refused": "the platform refused the tick worker's directly-issued edit (or a builder report carried the version + an explicit refusal) — parked for human attention",
+  "publish: version-timeout": "the 2-hour acknowledgement budget from first issuance expired with no version acknowledgement (unobserved within budget — the edit may still have landed; the outcome is unknown) — parked for human attention",
   "publish: publish-unissuable": "one-party intent terminal: the intent diff cannot be (re)generated byte-identically; parked for human attention",
-  "publish: intent-unverifiable": "one-party intent terminal: re-claimed intent with no manifest baseline — freshness unprovable; parked for human attention",
+  "publish: ambiguous": "legacy (retired unknown-recovery): could not prove the drop; parked for human attention",
+  "publish: retry-superseded": "legacy (retired retry protocol): superseded; parked for human attention",
+  "publish: retry-refused": "legacy (retired retry protocol): platform refused the re-issued edit; parked for human attention",
+  "publish: verified": "legacy (retired content-verdict pipeline): publish verified and stamped; task re-queued",
+  "publish: superseded": "legacy (retired unknown-recovery): HEAD moved past the attempt; recovery aborted; parked for human attention",
+  "publish: verification-failed": "legacy (retired content-verdict pipeline): terminal content verdict — parked for human attention",
+  "publish: intent-unverifiable": "legacy (retired manifest-freshness path): re-claimed intent with no manifest baseline; parked for human attention",
 };
+// 0.14.6 transitional notes — every non-terminal state-carrying note the
+// machine writes. The ack scan (scan-ack-pending) is atomic code and needs
+// no claim note of its own.
+export const TRANSITIONAL_PUBLISH_NOTES = [
+  // The workflow parked at Publish with a checksummed publish-intent ledger
+  // entry (carries the per-attempt version). The intent scan claims these.
+  "publish: publish-requested",
+  // The intent scan claimed this tick's issuance lease (1 hour).
+  "publish: publish-intent-claimed",
+  // The intent's staged diff was computed against a superseded base —
+  // re-queued for the workflow's Publish to re-prepare. Never issued.
+  "publish: publish-base-stale",
+  // The tick worker issued the edit and recorded it (issuer-stamped
+  // submitted ledger entry). The ack scan owns the task from here.
+  "publish: edit-issued",
+];
+// The prose-writable set (0.14.6 §1.5, closed publish-note writer): the ONLY
+// verbs tick prose may mint, via the `record-publish-note` crew-api command.
+// Transitional notes only — prose can never mint a terminal state. Legacy
+// terminals are recognized (read-side, so old note history still skips as
+// terminal) but NOT writable — history stays readable; nothing new may be
+// written in the old tongue.
+export const WRITABLE_PUBLISH_NOTES = [
+  ...TRANSITIONAL_PUBLISH_NOTES,
+];
+// The code-writable set: deterministic code (the scans and the guarded
+// record-* commands) writes through writeGuardedPublishNote, which asserts
+// here — transitional notes plus the four current terminals the machine
+// itself transitions to. Legacy terminals are never written anew.
+export const CODE_WRITABLE_PUBLISH_NOTES = [
+  ...TRANSITIONAL_PUBLISH_NOTES,
+  ...CODE_TERMINAL_PUBLISH_NOTES,
+];
+function extractPublishVerb(message) {
+  const m = /publish:\s*([a-z0-9-]+)/.exec(String(message || ""));
+  return m ? `publish: ${m[1]}` : null;
+}
 export function matchTerminalPublishNote(message) {
   for (const note of TERMINAL_PUBLISH_NOTES) {
     if (message.includes(note)) return note; // same substring semantics the scan already uses
   }
   return null;
 }
+// Prose-side guard (0.14.6 §1.5, closed publish-note writer): the
+// `record-publish-note` command asserts here. Returns the matched
+// "publish: <verb>". Throws (usage) on anything else — prose cannot mint
+// new states, and cannot mint terminal states.
+export function assertWritablePublishNote(message) {
+  const verb = extractPublishVerb(message);
+  if (!verb || !WRITABLE_PUBLISH_NOTES.includes(verb)) {
+    throw new Error(
+      `unregistered publish-note verb ${verb === null ? "(none found)" : `'${verb}'`} — ` +
+      `tick prose may only mint transitional publish notes (lib/publish-note-vocabulary.js); ` +
+      `terminal states are written by deterministic code, never prose. Legacy terminals are recognized but not writable.`
+    );
+  }
+  return verb;
+}
+// Code-side guard: writeGuardedPublishNote asserts here. Returns the
+// matched "publish: <verb>". Throws on anything else — a registry
+// violation is a caller bug (usage).
+export function assertCodeWritablePublishNote(message) {
+  const verb = extractPublishVerb(message);
+  if (!verb || !CODE_WRITABLE_PUBLISH_NOTES.includes(verb)) {
+    throw new Error(
+      `unregistered publish-note verb ${verb === null ? "(none found)" : `'${verb}'`} — ` +
+      `state-carrying publish notes are a closed set (lib/publish-note-vocabulary.js); ` +
+      `register the verb before writing it. Legacy terminals are recognized but never written anew.`
+    );
+  }
+  return verb;
+}

package/lib/qa-db.js

@@ -0,0 +1,132 @@
+// qa-db.js — fresh per-run QA database for the local artifact server.
+//
+// Import-safe: no side effects on import. `node qa-db.js` with no args exits
+// 0 (the release entry gate executes bare non-CLI lib modules).
+//
+// `openQaDb(spaceDir)` opens a drizzle db over a FRESH per-run SQLite
+// database, migrated from the space's own `drizzle/` migrations in journal
+// order — the same migration path a fresh production install takes — and
+// never a copy of the shipped app.db. The database file lives in a per-run
+// temp dir, so the server stays read-only w.r.t. the space directory and QA
+// writes can never contaminate production data (the B38 contamination
+// class: audit sessions writing verification data into the live artifact's
+// production DB).
+//
+// Driver: drizzle-orm/sqlite-proxy resolved from the space's own
+// node_modules (so the driver matches the artifact's drizzle version), over
+// node:sqlite (built-in). Zero extra dependencies in the crew release.
+//
+// Proxy contract, verified mechanically against drizzle-orm 0.45.2's
+// COMPILED runtime (sqlite-proxy/driver.js, sqlite-proxy/session.js,
+// utils.js — not just the .d.ts):
+//   - utils.js mapResultRow(columns, row, ...) reads row[columnIndex]:
+//     rows must be POSITIONAL value arrays in SQL column order. The proxy
+//     prepares with { returnArrays: true }, so node:sqlite returns rows
+//     as positional arrays — duplicate column names (self-joins, t.*,
+//     joins of overlapping schemas) survive by ordinal. The object-keyed
+//     default would silently collapse them.
+//   - session.js get(): mapGetResult(clientResult.rows) — a miss must be
+//     FALSY rows (returns undefined); a hit must be the single row as a
+//     positional array (it is NOT wrapped — mapGetResult treats rows as the
+//     row itself).
+//   - session.js all()/values(): { rows } is destructured and .map'ed, so
+//     rows must be an array of positional arrays.
+//   - session.js run(): the callback's return is handed to the caller; the
+//     declared type is Promise<{rows: any[]}> — {rows: []} is the honest
+//     empty shape.
+//   - session.js batch(): batchResults.map((result, i) =>
+//     preparedQueries[i].mapResult(result, true)) — each item must be one
+//     per-query {rows} object in order; mapResult with isFromBatch unwraps
+//     rows.rows before the same get/all mapping above.
+//   - driver.js drizzle(callback, batchCallback?, config?): the second
+//     positional arg is the batch callback when it is a function.
+
+import { DatabaseSync } from "node:sqlite";
+import { createRequire } from "node:module";
+import { pathToFileURL } from "node:url";
+import { join } from "node:path";
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { mkdtemp } from "node:fs/promises";
+import { tmpdir } from "node:os";
+
+// sqlite-proxy callback over a node:sqlite DatabaseSync. See the contract
+// note at the top of this file.
+export function sqliteProxyCallback(sqlite) {
+  const one = async (sql, params, method) => {
+    // node:sqlite Statements have no close(); the DatabaseSync owns them
+    // and they are reclaimed with it.
+    // returnArrays: rows come back as POSITIONAL value arrays, so
+    // duplicate column names (self-joins, t.*, joins of overlapping
+    // schemas) survive by ordinal. The object-keyed default would
+    // silently collapse them — Object.values() would drop the earlier
+    // columns entirely.
+    const stmt = sqlite.prepare(sql, { returnArrays: true });
+    if (method === "run") {
+      stmt.run(...params);
+      return { rows: [] };
+    }
+    if (method === "all" || method === "values") {
+      return { rows: stmt.all(...params) };
+    }
+    if (method === "get") {
+      const row = stmt.get(...params);
+      return row === undefined ? { rows: undefined } : { rows: row };
+    }
+    throw new Error("sqlite-proxy: unknown method " + method);
+  };
+  return one;
+}
+
+// Fresh per-run QA database for spaceDir. Resolves to
+// { db, close } — db is the drizzle instance handed to ctx.db(); close()
+// releases the sqlite handle (best effort on kill). Throws with a clear
+// reason when the space has no drizzle migrations or drizzle-orm cannot be
+// resolved from its node_modules; callers degrade gracefully (the server
+// still boots, ctx.db throws the reason when called).
+export async function openQaDb(spaceDir) {
+  const drizzleDir = join(spaceDir, "drizzle");
+  const journalPath = join(drizzleDir, "meta", "_journal.json");
+  if (!existsSync(journalPath)) {
+    throw new Error("no drizzle migrations at " + journalPath);
+  }
+  const journal = JSON.parse(await readFile(journalPath, "utf8"));
+  const entries = [...(journal.entries || [])].sort((a, b) => a.idx - b.idx);
+  if (entries.length === 0) {
+    throw new Error("empty drizzle journal at " + journalPath);
+  }
+  // Per-run temp dir — never the space dir, never the shipped app.db.
+  const dbDir = await mkdtemp(join(tmpdir(), "serve-artifact-db-"));
+  const sqlite = new DatabaseSync(join(dbDir, "qa.db"));
+  try {
+    sqlite.exec("PRAGMA foreign_keys = ON;");
+    for (const entry of entries) {
+      const sqlPath = join(drizzleDir, entry.tag + ".sql");
+      sqlite.exec(await readFile(sqlPath, "utf8"));
+    }
+  } catch (err) {
+    try { sqlite.close(); } catch { /* best effort */ }
+    throw new Error("migration failed: " + String((err && err.message) || err).slice(0, 200));
+  }
+  // drizzle-orm/sqlite-proxy resolved from the space's own node_modules, so
+  // the driver matches the artifact's drizzle version.
+  let db;
+  try {
+    const spaceRequire = createRequire(join(spaceDir, "package.json"));
+    const proxyEntry = spaceRequire.resolve("drizzle-orm/sqlite-proxy");
+    const { drizzle } = await import(pathToFileURL(proxyEntry).href);
+    const one = sqliteProxyCallback(sqlite);
+    db = drizzle(one, async (items) => {
+      const out = [];
+      for (const item of items) out.push(await one(item.sql, item.params, item.method));
+      return out;
+    });
+  } catch (err) {
+    try { sqlite.close(); } catch { /* best effort */ }
+    throw new Error("cannot build drizzle db: " + String((err && err.message) || err).slice(0, 200));
+  }
+  return {
+    db,
+    close() { try { sqlite.close(); } catch { /* best effort on kill */ } },
+  };
+}

package/lib/schema.sql

@@ -64,6 +64,17 @@ CREATE TABLE IF NOT EXISTS tasks (
   deps           TEXT NOT NULL DEFAULT '[]',
   filed_by       TEXT,
   retry_reset_at TEXT,
+  -- Cascade-park attribution (room #26 blocker 36, 2026-09-21). When a task
+  -- parks, its todo dependents cascade-park with structured attribution on
+  -- the existing 'parked' state — never a new state, never silent todo,
+  -- never auto-waived. park_reason is a closed single-column CHECK
+  -- ('dep_parked' only); park_dep_id names the parked dep. NULL on both =
+  -- ordinary park (human hold). The pairing invariant (reason<->dep)
+  -- cannot be a schema CHECK — SQLite forbids cross-column CHECKs on
+  -- ADD COLUMN — so it is enforced by crew-api.js, the single writer of
+  -- these columns.
+  park_reason    TEXT CHECK (park_reason IS NULL OR park_reason = 'dep_parked'),
+  park_dep_id    TEXT,
   created_at     TEXT NOT NULL,
   updated_at     TEXT NOT NULL
 );
@@ -108,6 +119,45 @@ CREATE TABLE IF NOT EXISTS agent_sessions (
     (already_merged_sha NOT GLOB '*[^0-9a-f]*' AND length(already_merged_sha) BETWEEN 7 AND 40))
 );
 
+-- Room #26 blocker 33 (2026-09-21): structured, non-lossy verdict records.
+-- Review verdict grounds were destroyed by the 2000-char session-note
+-- truncation (the workflow slices the worker report before record-phase
+-- writes it as notes) — a park on a verified-correct implementation was
+-- unauditable because the grounds past char 2000 existed nowhere. The fib:
+-- "the review notes are the review record." The notes are lossy by design
+-- (downstream consumers read them: rejectionNotes, the QA backstop, the
+-- dashboard); this table is the lossless record. record-phase optionally
+-- carries the full grounds and writes the row in the same transaction as
+-- the session note, so the record can never be missing when the note
+-- exists. `summary` is the truncated note actually recorded (provenance of
+-- what the lossy path carried); `grounds` is the full worker report,
+-- uncapped. One verdict per recording session: a re-recorded phase for the
+-- same session is the same evidence, so the first write wins (ON CONFLICT
+-- DO NOTHING) and rows are never revised. A new Review execution claims a
+-- new session, so rework rounds and dispatcher retries each get their own
+-- row, ordered by created_at.
+-- `verdict` is the machine-extracted verdict; INDETERMINATE is the
+-- fail-closed extraction failure (re-ask exhausted) — the grounds are still
+-- preserved even though no verdict could be read.
+CREATE TABLE IF NOT EXISTS verdicts (
+  id         TEXT PRIMARY KEY,
+  task_id    TEXT NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
+  step       TEXT NOT NULL,
+  attempt    INTEGER NOT NULL CHECK (attempt >= 0),
+  reviewer   TEXT NOT NULL,
+  verdict    TEXT NOT NULL CHECK (verdict IN ('PASS', 'FAIL', 'INDETERMINATE')),
+  grounds    TEXT NOT NULL,
+  summary    TEXT NOT NULL,
+  -- Room #26 blocker 34 (redesign): what the review actually examined —
+  -- mechanical-fail | branch-diff | runtime-state-none | frozen-merge:<sha>.
+  -- NULL = not a classified review (e.g. docs.js path, legacy rows).
+  review_basis TEXT,
+  session_id TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  UNIQUE(session_id)
+);
+CREATE INDEX IF NOT EXISTS idx_verdicts_task ON verdicts(task_id);
+
 CREATE TABLE IF NOT EXISTS events (
   id        TEXT PRIMARY KEY,
   type      TEXT NOT NULL CHECK (type IN
@@ -205,3 +255,22 @@ CREATE TABLE IF NOT EXISTS platform_run_tasks (
   linked_at       TEXT NOT NULL DEFAULT (datetime('now'))
 );
 CREATE INDEX IF NOT EXISTS platform_run_tasks_task_id_idx ON platform_run_tasks(task_id);
+
+-- Builder reports (0.14.6, 2026-09-20). The tick worker records the artifact
+-- platform's report text verbatim after each directly-issued edit via the
+-- `record-builder-report` command. The command mechanically rejects unless
+-- the report text contains the exact per-attempt version, so every row here is
+-- a version-keyed refusal the ack scan can evaluate: outcome 'refused' + a
+-- version matching an issued attempt = terminal publish-refused. (The old
+-- 'acknowledged' outcome was cut 2026-09-20 REVIEW as circular — disk is the
+-- sole positive evidence.) Rows are evidence, never deleted by the scans.
+CREATE TABLE IF NOT EXISTS builder_reports (
+  id          TEXT PRIMARY KEY,
+  task_id     TEXT NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
+  version     TEXT NOT NULL,
+  outcome     TEXT NOT NULL CHECK (outcome IN ('acknowledged', 'refused')),
+  report_text TEXT NOT NULL,
+  created_at  TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS builder_reports_task_id_idx ON builder_reports(task_id);
+CREATE INDEX IF NOT EXISTS builder_reports_version_idx ON builder_reports(version);