muse-crew 0.14.5 → 0.14.7

package/lib/worktree-lifecycle.sh

@@ -19,6 +19,11 @@
 #   prepare   <task_id>                  — create worktree + branch, register ownership
 #   resolve-branch <task_id>             — print the resolved task branch name
 #   inspect   <task_id>                  — diff against the integration target for review
+#   classify-branch <task_id>             — mechanical branch-state classification for Review:
+#                                        has-work | already-merged:<sha> | empty-no-work (pure git, no judgment)
+#   version-check <task_id>              — mechanical package.json `version` check for Review:
+#                                        VERSION_TOUCHED | VERSION_CLEAN (pure git, no judgment;
+#                                        check failure → stderr + exit 1, fail closed)
 #   integrate <task_id> <commit_msg>     — merge lock → merge into the integration target → report commit
 #   integration-target                   — print the integration target (branch name, or HEAD when detached)
 #   push-target <task_id>                — refresh lock, push the integration target (skipped loudly on detached HEAD)
@@ -62,12 +67,33 @@ MERGE_LOCK="$LIB_DIR/merge-lock.sh"
 
 # Merge records: $CREW_HOME/.merge-records/<task_id> (key=value, append-only,
 # on persistent disk — same durability class as $CREW_HOME/.pins/<task>).
-# Written by cmd_integrate (post-reconcile HEAD). Read by cmd_verify_merge
-# (branch-reclamation fallback) and the workflow. Consumers trust a record
-# only after verifying `git merge-base --is-ancestor <merge_commit> <target-tip>` —
-# a stale record is inert. Removed by cmd_post_deploy (consumed).
+# A durable per-task delivery log: written by cmd_integrate (post-reconcile
+# HEAD), by cmd_integrate's recovery path, and by cmd_push_target's manual
+# path — every merge the lifecycle attributes gets recorded. Read by
+# cmd_verify_merge (branch-reclamation fallback), cmd_push_target's identity
+# check, and classify-branch (Review-entry branch-state classification).
+# Consumers trust a record only after verifying `git merge-base
+# --is-ancestor <merge_commit> <target-tip>` — a stale record is inert, and
+# staleness is decided at read time. Never deleted: the record is the
+# deterministic proof of delivery, not a transient token. Newest block wins
+# (an operator reading the file: the LAST merge_commit= block is
+# authoritative).
 MERGE_RECORDS_DIR="$CREW_HOME/.merge-records"
 
+# append_merge_record(task_id, merge_commit, target): append one block to
+# the task's durable merge record. One atomic printf (not three appends —
+# a torn write against a concurrent reader is benign today but not worth
+# the risk), and cut -d= -f2- on read so values containing `=` survive.
+# (merge-lease fix, 2026-09-12; durable per-task delivery log, 2026-09-21.)
+append_merge_record() {
+  local task_id="$1" merge_commit="$2" target="$3"
+  mkdir -p "$MERGE_RECORDS_DIR"
+  printf 'merge_commit=%s\nintegration_target=%s\nmerged_at=%s\n' \
+    "$merge_commit" "$target" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+    >> "$MERGE_RECORDS_DIR/$task_id"
+  echo "RECORDED: merge commit $merge_commit (target $target) in $MERGE_RECORDS_DIR/$task_id"
+}
+
 # --- helpers ---
 
 # Task branch name. Resolution order (task 4e1a1bba, 2026-09-17):
@@ -336,6 +362,31 @@ acquire_merge_lock() {
   done
 }
 
+# current_branch_merge(branch): print the newest merge commit on live HEAD's
+# first-parent chain whose branch-side parent (^2) is the branch's CURRENT
+# tip — i.e. the merge that brought the branch's present state onto the
+# line. Prints nothing and returns 1 when no such merge exists.
+#
+# (blocker 35, room #26 J3, 2026-09-21): the merged-but-unpushed recovery
+# used to check only that the RECORDED merge is an ancestor of live HEAD.
+# Ancestry proves containment, not identity — rework can move the task
+# branch after the merge was recorded, and the recovery would then push
+# the stale recorded state labeled as the task's deliverable (the task
+# later collided with its own stale merge in theme.css). cmd_integrate
+# always merges with --no-ff, so M^2 is the branch tip at merge time;
+# requiring M^2 == current branch tip proves the merge still represents
+# the branch. The first-parent walk also covers the manual R5 merge
+# (scratch-worktree merge, ff'd onto the line) and do_push's reconcile
+# merges above the recorded commit.
+current_branch_merge() {
+  local branch="$1" tip h p1 p2 rest
+  tip=$(git rev-parse --verify "$branch" 2>/dev/null) || return 1
+  while read -r h p1 p2 rest; do
+    if [ "$p2" = "$tip" ]; then printf '%s' "$h"; return 0; fi
+  done < <(git log --first-parent --min-parents=2 --format='%H %P' HEAD 2>/dev/null)
+  return 1
+}
+
 # Deterministic push of the integration target. Called inline by
 # cmd_integrate on the main path (the lock was just acquired there — no
 # refresh needed) and by cmd_push_target for the R5 manual-conflict path
@@ -450,34 +501,52 @@ cmd_integrate() {
     # merge landed but its push never completed. Take the lock and push now
     # instead of reporting MERGED_EMPTY — otherwise the retry loop parks
     # the task with the work stranded and no path ever pushes it.
-    # The check is ancestor-based, not equality-based: if a prior attempt's
-    # push failed, do_push's retry path may have added a reconcile merge
-    # on top of the recorded commit before failing again. Equality would
-    # miss that and fall through to MERGED_EMPTY — reporting PASS while the
-    # push never happened.
+    # The check is identity-based, not ancestry-based (blocker 35,
+    # 2026-09-21): the old ancestor check proved the recorded merge was
+    # contained in live HEAD but not that it still represents the task
+    # branch — rework moving the branch after the merge made the recovery
+    # push stale state. current_branch_merge finds the merge whose ^2 is
+    # the branch's CURRENT tip: the recorded merge, a do_push reconcile
+    # merge above it, or the manual R5 merge. No such merge plus a record
+    # means the branch moved since the merge — STALE_MERGE fails closed
+    # (never MERGED_EMPTY: an unpushed merge may sit on the line, and
+    # MERGED_EMPTY would report PASS while Publish diffs would still
+    # carry the abandoned work).
     local record_file="$MERGE_RECORDS_DIR/$task_id"
     local recorded_commit=""
     if [ -f "$record_file" ]; then
       recorded_commit=$(grep "^merge_commit=" "$record_file" | tail -1 | cut -d= -f2-)
     fi
-    local live_head
-    live_head=$(git rev-parse HEAD)
-    if [ -n "$recorded_commit" ] && git merge-base --is-ancestor "$recorded_commit" "$live_head" 2>/dev/null; then
+    local live_merge
+    live_merge=$(current_branch_merge "$branch") || live_merge=""
+    if [ -n "$live_merge" ]; then
       acquire_merge_lock "$task_id" || exit 2
       if do_push "$task_id"; then
-        echo "MERGED: $recorded_commit (recovered: merge landed in a prior attempt; push completed now)"
+        # The recovery path lands merges too — record them, or a later
+        # classify-branch sees an unrecorded merge (blocker 34, 2026-09-21).
+        append_merge_record "$task_id" "$live_merge" "$target"
+        if [ "$live_merge" = "$recorded_commit" ]; then
+          echo "MERGED: $live_merge (recovered: merge landed in a prior attempt; push completed now)"
+        else
+          echo "MERGED: $live_merge (recovered: branch tip merged in $live_merge; recorded ${recorded_commit:-none} superseded — push completed now)"
+        fi
       else
-        echo "ERROR: push recovery failed for previously-merged $recorded_commit"
+        echo "ERROR: push recovery failed for previously-merged $live_merge"
         return 1
       fi
       echo "LOCK: held by $task_id — release after deploy with post-deploy"
       return 0
     fi
+    if [ -n "$recorded_commit" ]; then
+      echo "STALE_MERGE: recorded merge $recorded_commit no longer corresponds to $branch (tip $(git rev-parse --verify "$branch" 2>/dev/null)) — no merge of the current tip is on the live line; refusing to push possibly-stale state"
+      return 1
+    fi
     # Approved empty diff: the deliverable was runtime state (cron,
-    # scheduler, dashboard config) or an already-merged sha the workflow
-    # verified — not a repo change. Nothing to merge, nothing to serialize —
-    # the merge lock is intentionally not taken.
-    echo "MERGED_EMPTY: $branch has no commits ahead of $target — runtime-state deliverable or verified already-merged sha, nothing to merge"
+    # scheduler, dashboard config) or a task-attributed merge the
+    # classifier verified from the task's own merge records — not a repo
+    # change. Nothing to merge, nothing to serialize — the merge lock is
+    # intentionally not taken.
+    echo "MERGED_EMPTY: $branch has no commits ahead of $target — runtime-state deliverable or task-attributed merge, nothing to merge"
     return 0
   fi
 
@@ -524,17 +593,11 @@ cmd_integrate() {
   merged_commit=$(git rev-parse HEAD)
   echo "MERGED: $merged_commit"
 
-  # Record the merge commit (merge-lease fix, 2026-09-12): if the branch is
-  # later reclaimed (e.g. under an expired lease), verify-merge can still
-  # confirm the merge landed from this record. Append-only, on persistent
-  # disk. One atomic printf (not three appends — a torn write against a
-  # concurrent reader is benign today but not worth the risk), and cut
-  # -d= -f2- on read so values containing `=` survive.
-  mkdir -p "$MERGE_RECORDS_DIR"
-  printf 'merge_commit=%s\nintegration_target=%s\nmerged_at=%s\n' \
-    "$merged_commit" "$target" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
-    >> "$MERGE_RECORDS_DIR/$task_id"
-  echo "RECORDED: merge commit $merged_commit (target $target) in $MERGE_RECORDS_DIR/$task_id"
+  # Record the merge commit: if the branch is later reclaimed (e.g. under an
+  # expired lease), verify-merge can still confirm the merge landed from this
+  # record. Durable per-task delivery log — never deleted (blocker 34,
+  # 2026-09-21).
+  append_merge_record "$task_id" "$merged_commit" "$target"
 
   # Push inline while the lock is held — no agent round-trip (the old STEP 2
   # agent run added only a lock refresh). R5's manual-conflict path uses the
@@ -670,8 +733,11 @@ cmd_post_deploy() {
   # Release merge lock
   "$MERGE_LOCK" release "$task_id" 2>/dev/null && echo "LOCK: released" || true
 
-  # Consume the merge record — the merge is now deployed
-  rm -f "$MERGE_RECORDS_DIR/$task_id"
+  # The merge record is NOT deleted here (blocker 34, 2026-09-21):
+  # records are an append-only delivery log — they survive deploy so a
+  # later dispatch can still classify the task's branch against the live
+  # target. Consumers validate ancestry at read time; a stale record is
+  # inert. See the MERGE_RECORDS_DIR contract at the top of this file.
 
   echo "DEPLOYED: $final_commit"
 }
@@ -862,6 +928,114 @@ cmd_integration_target() {
   integration_target
 }
 
+# Branch-state classification for Review entry (blocker 34, 2026-09-21).
+# Usage: classify-branch <task_id>
+# Stdout: exactly one successful line —
+#   BRANCH_STATE: has-work | already-merged:<40-hex> | empty-no-work
+# Stderr: exactly one DIAG line per invocation —
+#   DIAG: classify-branch records=<n> resolvable=<m>
+# (blocker 34 design v2.1). Merge records are load-bearing with no
+# fallback: silent record loss must surface as records>0 resolvable=0,
+# never as a lying empty-no-work. The workflow logs the DIAG line
+# verbatim.
+# Resolution failure: exit 1 with diagnostics on stderr, no BRANCH_STATE
+# line (the workflow fails closed; there is no fourth stdout state).
+#
+# Attribution is identity-first, never declared:
+#   1. current-tip identity — the live merge carrying the current branch
+#      tip (current_branch_merge, blocker 35's identity primitive). If the
+#      tip is on the live line via a merge, that merge IS the deliverable.
+#   2. the task's own durable merge records, newest first (at most 20
+#      candidates scanned; garbage/unresolvable entries skipped). The
+#      first record that resolves to a MERGE commit and is an ancestor of
+#      the live target wins; the SHA is canonicalized to full 40-hex.
+# Poison rule: the newest RESOLVABLE non-ancestor record poisons the
+# fallback — an older record is never accepted beneath a newer known-
+# stale one. The answer then is empty-no-work (stderr notes the poison),
+# never a fabricated already-merged.
+# The branch is empty here, so the blocker-35 identity/ancestry
+# distinction does not apply: there is no moved branch to go stale
+# against, and every candidate is this task's own record.
+cmd_classify_branch() {
+  local task_id="$1"
+  validate_task_id "$task_id"
+
+  # DIAG pin (blocker 34 design v2.1): every invocation emits exactly one
+  # stderr line counting the durable merge-record scan. Merge records are
+  # load-bearing with no fallback — silent record loss (deleted file, torn
+  # lines, gc'd objects) must surface as records>0 resolvable=0, never as
+  # a lying empty-no-work. records = candidates scanned (valid-hex
+  # merge_commit= lines, at most 20); resolvable = candidates that resolved
+  # to MERGE commits. Paths that bypass the scan report 0/0. The workflow
+  # logs this line verbatim.
+  local diag_records=0 diag_resolvable=0
+  diag() { echo "DIAG: classify-branch records=$diag_records resolvable=$diag_resolvable" >&2; }
+
+  local branch
+  branch=$(resolve_branch "$task_id") || { echo "classify-branch: cannot resolve task branch" >&2; diag; return 1; }
+
+  cd "$REPO"
+  git rev-parse --verify "$branch" >/dev/null 2>&1 || { echo "classify-branch: branch $branch does not exist" >&2; diag; return 1; }
+
+  local target
+  target=$(integration_target) || { echo "classify-branch: cannot resolve integration target" >&2; diag; return 1; }
+
+  local ahead
+  ahead=$(git rev-list --count "$target..$branch" 2>/dev/null) || { echo "classify-branch: rev-list failed" >&2; diag; return 1; }
+  if [ "$ahead" -gt 0 ]; then
+    diag
+    echo "BRANCH_STATE: has-work"
+    return 0
+  fi
+
+  # 1. Current-tip identity.
+  local tip_merge
+  if tip_merge=$(current_branch_merge "$branch" 2>/dev/null); then
+    tip_merge=$(git rev-parse --verify "$tip_merge" 2>/dev/null) || tip_merge=""
+    if [ -n "$tip_merge" ] && git merge-base --is-ancestor "$tip_merge" "$target" 2>/dev/null; then
+      diag
+      echo "BRANCH_STATE: already-merged:$tip_merge"
+      return 0
+    fi
+  fi
+
+  # 2. Durable merge records, newest first. Empty-file-safe: no pipelines
+  # under set -e/pipefail, at most 20 candidate lines read.
+  local rec="$MERGE_RECORDS_DIR/$task_id"
+  if [ -f "$rec" ]; then
+    local count=0 sha full poisoned=""
+    while IFS= read -r line && [ "$count" -lt 20 ]; do
+      case "$line" in
+        merge_commit=*) sha="${line#merge_commit=}" ;;
+        *) continue ;;
+      esac
+      case "$sha" in ""|*[!0-9a-f]*) continue ;; esac
+      count=$((count + 1))
+      diag_records=$((diag_records + 1))
+      full=$(git rev-parse --verify --quiet "$sha" 2>/dev/null) || continue
+      # A merge commit: the frozen first-parent diff the workflow reviews
+      # only exists for merges. A non-merge ancestor is never the task's
+      # merge — skipped, not poison (garbage must not veto delivery).
+      git rev-parse --verify --quiet "$full^2" >/dev/null 2>&1 || continue
+      diag_resolvable=$((diag_resolvable + 1))
+      if git merge-base --is-ancestor "$full" "$target" 2>/dev/null; then
+        if [ -n "$poisoned" ]; then
+          echo "classify-branch: newest resolvable record $poisoned is stale (not an ancestor of $target); refusing older record $full" >&2
+          break
+        fi
+        diag
+        echo "BRANCH_STATE: already-merged:$full"
+        return 0
+      fi
+      [ -z "$poisoned" ] && poisoned="$full"
+    done < <(tac "$rec" 2>/dev/null)
+  fi
+
+  diag
+  echo "BRANCH_STATE: empty-no-work"
+  return 0
+}
+
 # Agent-side one-liner: prints the remote branch a push updates. Attached:
 # the branch name. Detached: the resolved destination from
 # resolve_push_destination() (fails when genuinely unknowable).
@@ -897,8 +1071,22 @@ cmd_push_target() {
     # The lock tells them apart.
     if cmd_refresh_lock "$task_id" >/dev/null 2>&1; then
       echo "LOCK: refreshed for push (manual-merge path)"
-      do_push "$task_id"
-      return $?
+      # Blocker 34 (2026-09-21): the manual merge has no record yet —
+      # attribute it by current-tip identity, push, and record ONLY after
+      # the push succeeds. A failed push records nothing.
+      local branch manual_merge push_target_name
+      if branch=$(resolve_branch "$task_id" 2>/dev/null) \
+        && manual_merge=$(current_branch_merge "$branch" 2>/dev/null) \
+        && [ -n "$manual_merge" ]; then
+        if do_push "$task_id"; then
+          push_target_name=$(integration_target) || push_target_name="unknown"
+          append_merge_record "$task_id" "$manual_merge" "$push_target_name"
+          return 0
+        fi
+        return 1
+      fi
+      echo "ERROR: cannot attribute a manual merge for $task_id — no merge of the current branch tip is on the live line" >&2
+      return 1
     fi
     echo "PUSH_SKIPPED: no merge record for $task_id and no lock held -- nothing was merged, nothing to push"
     return 0
@@ -912,10 +1100,70 @@ cmd_push_target() {
   fi
   echo "LOCK: refreshed for push"
 
+  # Blocker-35 (2026-09-21): the ERROR-after-MERGED retry pushed live HEAD
+  # with no check that it still carries the task's deliverable — rework
+  # between the merge and the retry made it push stale state. Prove the
+  # branch's current tip was merged onto the live line before pushing.
+  # Branch gone (merge-lease reclaim): no rework could have moved it, so
+  # the recorded merge on the line is still the deliverable.
+  local branch live_merge recorded_commit
+  recorded_commit=$(grep "^merge_commit=" "$record_file" | tail -1 | cut -d= -f2-)
+  live_merge=""
+  if branch=$(resolve_branch "$task_id" 2>/dev/null); then
+    if git rev-parse --verify "$branch" >/dev/null 2>&1; then
+      live_merge=$(current_branch_merge "$branch") || live_merge=""
+    elif [ -n "$recorded_commit" ] && git merge-base --is-ancestor "$recorded_commit" "$(git rev-parse HEAD 2>/dev/null)" 2>/dev/null; then
+      live_merge="$recorded_commit"
+    fi
+  else
+    echo "ERROR: cannot resolve task branch for $task_id — not pushing without a verifiable branch"
+    return 1
+  fi
+  if [ -z "$live_merge" ]; then
+    echo "STALE_MERGE: no merge of the current ${branch:-unknown} tip is on the live line (recorded: ${recorded_commit:-none}) — the task branch changed since the recorded merge; refusing to push possibly-stale state"
+    return 1
+  fi
+  echo "PUSH_IDENTITY_OK: pushing merge $live_merge carrying the current $branch tip"
+
   do_push "$task_id"
   return $?
 }
 
+# Usage: version-check <task_id>
+# Output: exactly one machine line on stdout:
+#   VERSION_TOUCHED      — the task branch's three-dot diff against the
+#                          integration target touches package.json's `version`
+#                          field (versions are assigned at publish time,
+#                          never in branches)
+#   VERSION_CLEAN        — no `version` change on the branch
+# A check failure (unresolvable branch/target, diff error) prints
+# diagnostics on stderr and exits 1 — the workflow treats that as touched
+# (fail closed). There is no VERSION_CHECK_FAILED stdout token (blocker
+# 34, 2026-09-21): stdout carries only the two real states.
+# A deterministic git fact for Review: the reviewer never adjudicates it.
+cmd_version_check() {
+  local task_id="$1"
+  validate_task_id "$task_id"
+
+  local branch
+  branch=$(resolve_branch "$task_id") || { echo "version-check: cannot resolve task branch" >&2; return 1; }
+
+  cd "$REPO"
+  git rev-parse --verify "$branch" >/dev/null 2>&1 || { echo "version-check: branch $branch does not exist" >&2; return 1; }
+
+  local target
+  target=$(integration_target) || { echo "version-check: cannot resolve integration target" >&2; return 1; }
+
+  local diff
+  diff=$(git diff "$target...$branch" -- package.json 2>/dev/null) || { echo "version-check: diff failed" >&2; return 1; }
+  if printf '%s' "$diff" | grep -qE '^[+-].*"version"[[:space:]]*:'; then
+    echo "VERSION_TOUCHED"
+  else
+    echo "VERSION_CLEAN"
+  fi
+  return 0
+}
+
 # --- dispatch ---
 
 cmd="${1:-}"
@@ -929,6 +1177,8 @@ case "$cmd" in
   integrate)    cmd_integrate "${1:?task_id required}" "${2:-}" ;;
   verify-merge) cmd_verify_merge "${1:?task_id required}" ;;
   integration-target) cmd_integration_target ;;
+  classify-branch) cmd_classify_branch "${1:?task_id required}" ;;
+  version-check) cmd_version_check "${1:?task_id required}" ;;
   push-destination) cmd_push_destination ;;
   push-target)   cmd_push_target "${1:?task_id required}" ;;
   post-deploy)  cmd_post_deploy "${1:?task_id required}" ;;
@@ -940,7 +1190,7 @@ case "$cmd" in
   merge-record) cmd_merge_record "${1:?task_id required}" ;;
   *)
     echo "Usage: worktree-lifecycle.sh <command> [args]"
-    echo "Commands: validate, prepare, resolve-branch, inspect, integrate, integration-target, push-target, verify-merge, post-deploy, terminal-cleanup, cleanup, status, refresh-lock, lock-status, merge-record"
+    echo "Commands: validate, prepare, resolve-branch, inspect, classify-branch, version-check, integrate, integration-target, push-target, verify-merge, post-deploy, terminal-cleanup, cleanup, status, refresh-lock, lock-status, merge-record"
     exit 1
     ;;
 esac

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.14.5",
+  "version": "0.14.7",
   "description": "Opinionated orchestration for Muse — workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,

package/seed/AGENTS.md

@@ -5,6 +5,7 @@ Init source data. Everything `crew-init.js` reads when setting up a new crew ins
 - `crons.json` — the declarative cron manifest; crew-init creates/updates each entry idempotently; `enabled` is a creation-time default only
 - `cron-body-template.md` — template for creating the dispatch cron job
 - `cron-body-update-watch.md` — template for the daily `crew-update-watch` cron job: runs `lib/update-watch.js --crew-home {crewHome}` verbatim and reports stdout
+- `cron-body-ack-scan.md` — template for the 5-minute `crew-ack-scan` cron job: runs the observation-only `scan-ack-pending` pass so publish verdicts land quickly. It never issues artifact edits — issuance stays in the 15-minute poll tick's claim-and-issue path.
 - `posture.md` — PM posture that shapes the user's assistant for crew interaction
 - `feedback/` — feedback feature placeholder
 - `workflows/` — human-readable workflow definitions, copied to `$CREW_HOME/.orchestration/workflows/` during init

package/seed/cron-body-ack-scan.md

@@ -0,0 +1,44 @@
+# Muse Crew acknowledgement scan (fast observation tick)
+
+You are the ack-scan worker for the Muse Crew at {crewHome}. This is an
+observation-only tick: it runs the version acknowledgement scan every 5
+minutes so publish verdicts land quickly. It NEVER issues artifact edits —
+issuance belongs to the 15-minute poll tick's Step 4.4/4.4b claim-and-issue
+path.
+
+1. Run the scan verbatim:
+
+   ```
+   node {crewHome}/lib/crew-api.js --crew-home {crewHome} scan-ack-pending
+   ```
+
+   The command cross-checks that the running release is the active one
+   (`resolveActiveRelease`); if it reports a release mismatch, do NOT
+   proceed — log the mismatch and stop.
+
+   Failure behavior (mechanical): if the scan exits nonzero, report its
+   stderr verbatim as the complete result of this tick, take NO other
+   action, do NOT rerun the scan, do NOT invoke any other Crew API
+   command, and stop. A release mismatch ("not the active release") is a
+   stop, not a retry. A nonzero exit is never retried inside this tick —
+   the next 5-minute tick runs the scan again on its own.
+
+2. Log every list the scan returns: `acknowledged`, `refused`, `reissued`,
+   `timeouts`, `skipped`.
+   - `acknowledged` / `refused` / `timeouts` are fully handled by code — take
+     NO action.
+   - `reissued` entries are fresh intents staged for the poll tick —
+     immediately claimable, no backoff. This worker does NOT claim or
+     issue them; the poll tick's `scan-publish-intent` +
+     `record-intent-issuance` path does that.
+   - `skipped` with `window-open` means the attempt's 30-minute window from
+     latest issuance is still open — no action. The scan runs every 5 minutes
+     so the scan's own latency never eats the window: with 6 scans per
+     window, the verdict lands within one cadence of the ack or the expiry.
+
+3. Verdicts are evidence-only. The exact per-attempt version string on the
+   artifact's disk is the sole positive signal; a `scan-ack-pending` result
+   that names `acknowledged` IS the verdict. Never stamp provenance from
+   prose, never infer a verdict from timing, and never issue a publish edit
+   yourself — a publish edit is always the tick worker's directly-issued
+   `artifact_edit` against a claimed intent, never an agent-issued one.