muse-crew 0.14.6 → 0.14.7

package/lib/test-merge-lock.sh

@@ -7,7 +7,10 @@
 # process is alive (PID liveness is never consulted); an expired lease is
 # reclaimed with logging; refresh extends the lease; release is
 # holder-only; status emits parseable holder/age/remaining fields; every
-# op appends to the merge-lock audit log. Exits 0 only if every case passes.
+# op appends to the merge-lock audit log. Case 14 pins the R-B1 fix: the
+# stale break's read→rm→create is serialized on the sidecar flock, so 8
+# concurrent reclaimers of an expired lease produce exactly one winner per
+# round (60 rounds). Exits 0 only if every case passes.
 
 set -uo pipefail
 
@@ -120,6 +123,32 @@ out=$(env -u CREW_REPO -u CREW_HOME "$LOCK" acquire task-x "task-x/run" 2>&1); c
 [ "$code" -eq 2 ] && [[ "$out" == *"BLOCKED"* ]] \
   && ok "13c: unset both on acquire exits 2 with BLOCKED" || no "13c: exit $code, out: $out"
 
+# --- Case 14: concurrent reclaim of an expired lease — exactly one winner ---
+# R-B1 (2026-09-21): the stale break used to rm the lock file before the
+# noclobber create, outside any atomic op, so N concurrent reclaimers could
+# all believe they held the lock (Reliability reproduced 54/60 bad rounds
+# with 8 contenders). The break is now serialized on the sidecar flock with
+# an in-critical-section re-read: exactly one contender exits 0 per round,
+# whatever the interleave (winners counted by exit code, not by reading the
+# lock file afterwards).
+bad_rounds=0
+for round in $(seq 1 60); do
+  printf 'task_id=old-task\nholder=old-task/run-old\nacquired_at=1577836800\nlease_seconds=600\n' \
+    > "$CREW_REPO/.worktrees/.merge-lock"
+  codes_file="$TMPBASE/reclaim-codes-$round"
+  rm -f "$codes_file"
+  for n in $(seq 1 8); do
+    ( "$LOCK" acquire "reclaimer-$n" "reclaimer-$n/run" >/dev/null 2>&1; echo "$?" >> "$codes_file" ) &
+  done
+  wait
+  winners=$(grep -c '^0$' "$codes_file" 2>/dev/null || true)
+  rm -f "$codes_file"
+  [ "$winners" -eq 1 ] || bad_rounds=$((bad_rounds + 1))
+done
+[ "$bad_rounds" -eq 0 ] \
+  && ok "14: 60 rounds x 8 concurrent reclaimers — exactly one exit-0 winner per round" \
+  || no "14: $bad_rounds/60 rounds had != 1 winner"
+
 echo ""
 echo "merge-lock: $pass passed, $fail failed"
 [ "$fail" -eq 0 ]

package/lib/worktree-lifecycle.sh

@@ -19,6 +19,11 @@
 #   prepare   <task_id>                  — create worktree + branch, register ownership
 #   resolve-branch <task_id>             — print the resolved task branch name
 #   inspect   <task_id>                  — diff against the integration target for review
+#   classify-branch <task_id>             — mechanical branch-state classification for Review:
+#                                        has-work | already-merged:<sha> | empty-no-work (pure git, no judgment)
+#   version-check <task_id>              — mechanical package.json `version` check for Review:
+#                                        VERSION_TOUCHED | VERSION_CLEAN (pure git, no judgment;
+#                                        check failure → stderr + exit 1, fail closed)
 #   integrate <task_id> <commit_msg>     — merge lock → merge into the integration target → report commit
 #   integration-target                   — print the integration target (branch name, or HEAD when detached)
 #   push-target <task_id>                — refresh lock, push the integration target (skipped loudly on detached HEAD)
@@ -62,12 +67,33 @@ MERGE_LOCK="$LIB_DIR/merge-lock.sh"
 
 # Merge records: $CREW_HOME/.merge-records/<task_id> (key=value, append-only,
 # on persistent disk — same durability class as $CREW_HOME/.pins/<task>).
-# Written by cmd_integrate (post-reconcile HEAD). Read by cmd_verify_merge
-# (branch-reclamation fallback) and the workflow. Consumers trust a record
-# only after verifying `git merge-base --is-ancestor <merge_commit> <target-tip>` —
-# a stale record is inert. Removed by cmd_post_deploy (consumed).
+# A durable per-task delivery log: written by cmd_integrate (post-reconcile
+# HEAD), by cmd_integrate's recovery path, and by cmd_push_target's manual
+# path — every merge the lifecycle attributes gets recorded. Read by
+# cmd_verify_merge (branch-reclamation fallback), cmd_push_target's identity
+# check, and classify-branch (Review-entry branch-state classification).
+# Consumers trust a record only after verifying `git merge-base
+# --is-ancestor <merge_commit> <target-tip>` — a stale record is inert, and
+# staleness is decided at read time. Never deleted: the record is the
+# deterministic proof of delivery, not a transient token. Newest block wins
+# (an operator reading the file: the LAST merge_commit= block is
+# authoritative).
 MERGE_RECORDS_DIR="$CREW_HOME/.merge-records"
 
+# append_merge_record(task_id, merge_commit, target): append one block to
+# the task's durable merge record. One atomic printf (not three appends —
+# a torn write against a concurrent reader is benign today but not worth
+# the risk), and cut -d= -f2- on read so values containing `=` survive.
+# (merge-lease fix, 2026-09-12; durable per-task delivery log, 2026-09-21.)
+append_merge_record() {
+  local task_id="$1" merge_commit="$2" target="$3"
+  mkdir -p "$MERGE_RECORDS_DIR"
+  printf 'merge_commit=%s\nintegration_target=%s\nmerged_at=%s\n' \
+    "$merge_commit" "$target" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+    >> "$MERGE_RECORDS_DIR/$task_id"
+  echo "RECORDED: merge commit $merge_commit (target $target) in $MERGE_RECORDS_DIR/$task_id"
+}
+
 # --- helpers ---
 
 # Task branch name. Resolution order (task 4e1a1bba, 2026-09-17):
@@ -336,6 +362,31 @@ acquire_merge_lock() {
   done
 }
 
+# current_branch_merge(branch): print the newest merge commit on live HEAD's
+# first-parent chain whose branch-side parent (^2) is the branch's CURRENT
+# tip — i.e. the merge that brought the branch's present state onto the
+# line. Prints nothing and returns 1 when no such merge exists.
+#
+# (blocker 35, room #26 J3, 2026-09-21): the merged-but-unpushed recovery
+# used to check only that the RECORDED merge is an ancestor of live HEAD.
+# Ancestry proves containment, not identity — rework can move the task
+# branch after the merge was recorded, and the recovery would then push
+# the stale recorded state labeled as the task's deliverable (the task
+# later collided with its own stale merge in theme.css). cmd_integrate
+# always merges with --no-ff, so M^2 is the branch tip at merge time;
+# requiring M^2 == current branch tip proves the merge still represents
+# the branch. The first-parent walk also covers the manual R5 merge
+# (scratch-worktree merge, ff'd onto the line) and do_push's reconcile
+# merges above the recorded commit.
+current_branch_merge() {
+  local branch="$1" tip h p1 p2 rest
+  tip=$(git rev-parse --verify "$branch" 2>/dev/null) || return 1
+  while read -r h p1 p2 rest; do
+    if [ "$p2" = "$tip" ]; then printf '%s' "$h"; return 0; fi
+  done < <(git log --first-parent --min-parents=2 --format='%H %P' HEAD 2>/dev/null)
+  return 1
+}
+
 # Deterministic push of the integration target. Called inline by
 # cmd_integrate on the main path (the lock was just acquired there — no
 # refresh needed) and by cmd_push_target for the R5 manual-conflict path
@@ -450,34 +501,52 @@ cmd_integrate() {
     # merge landed but its push never completed. Take the lock and push now
     # instead of reporting MERGED_EMPTY — otherwise the retry loop parks
     # the task with the work stranded and no path ever pushes it.
-    # The check is ancestor-based, not equality-based: if a prior attempt's
-    # push failed, do_push's retry path may have added a reconcile merge
-    # on top of the recorded commit before failing again. Equality would
-    # miss that and fall through to MERGED_EMPTY — reporting PASS while the
-    # push never happened.
+    # The check is identity-based, not ancestry-based (blocker 35,
+    # 2026-09-21): the old ancestor check proved the recorded merge was
+    # contained in live HEAD but not that it still represents the task
+    # branch — rework moving the branch after the merge made the recovery
+    # push stale state. current_branch_merge finds the merge whose ^2 is
+    # the branch's CURRENT tip: the recorded merge, a do_push reconcile
+    # merge above it, or the manual R5 merge. No such merge plus a record
+    # means the branch moved since the merge — STALE_MERGE fails closed
+    # (never MERGED_EMPTY: an unpushed merge may sit on the line, and
+    # MERGED_EMPTY would report PASS while Publish diffs would still
+    # carry the abandoned work).
     local record_file="$MERGE_RECORDS_DIR/$task_id"
     local recorded_commit=""
     if [ -f "$record_file" ]; then
       recorded_commit=$(grep "^merge_commit=" "$record_file" | tail -1 | cut -d= -f2-)
     fi
-    local live_head
-    live_head=$(git rev-parse HEAD)
-    if [ -n "$recorded_commit" ] && git merge-base --is-ancestor "$recorded_commit" "$live_head" 2>/dev/null; then
+    local live_merge
+    live_merge=$(current_branch_merge "$branch") || live_merge=""
+    if [ -n "$live_merge" ]; then
       acquire_merge_lock "$task_id" || exit 2
       if do_push "$task_id"; then
-        echo "MERGED: $recorded_commit (recovered: merge landed in a prior attempt; push completed now)"
+        # The recovery path lands merges too — record them, or a later
+        # classify-branch sees an unrecorded merge (blocker 34, 2026-09-21).
+        append_merge_record "$task_id" "$live_merge" "$target"
+        if [ "$live_merge" = "$recorded_commit" ]; then
+          echo "MERGED: $live_merge (recovered: merge landed in a prior attempt; push completed now)"
+        else
+          echo "MERGED: $live_merge (recovered: branch tip merged in $live_merge; recorded ${recorded_commit:-none} superseded — push completed now)"
+        fi
       else
-        echo "ERROR: push recovery failed for previously-merged $recorded_commit"
+        echo "ERROR: push recovery failed for previously-merged $live_merge"
         return 1
       fi
       echo "LOCK: held by $task_id — release after deploy with post-deploy"
       return 0
     fi
+    if [ -n "$recorded_commit" ]; then
+      echo "STALE_MERGE: recorded merge $recorded_commit no longer corresponds to $branch (tip $(git rev-parse --verify "$branch" 2>/dev/null)) — no merge of the current tip is on the live line; refusing to push possibly-stale state"
+      return 1
+    fi
     # Approved empty diff: the deliverable was runtime state (cron,
-    # scheduler, dashboard config) or an already-merged sha the workflow
-    # verified — not a repo change. Nothing to merge, nothing to serialize —
-    # the merge lock is intentionally not taken.
-    echo "MERGED_EMPTY: $branch has no commits ahead of $target — runtime-state deliverable or verified already-merged sha, nothing to merge"
+    # scheduler, dashboard config) or a task-attributed merge the
+    # classifier verified from the task's own merge records — not a repo
+    # change. Nothing to merge, nothing to serialize — the merge lock is
+    # intentionally not taken.
+    echo "MERGED_EMPTY: $branch has no commits ahead of $target — runtime-state deliverable or task-attributed merge, nothing to merge"
     return 0
   fi
 
@@ -524,17 +593,11 @@ cmd_integrate() {
   merged_commit=$(git rev-parse HEAD)
   echo "MERGED: $merged_commit"
 
-  # Record the merge commit (merge-lease fix, 2026-09-12): if the branch is
-  # later reclaimed (e.g. under an expired lease), verify-merge can still
-  # confirm the merge landed from this record. Append-only, on persistent
-  # disk. One atomic printf (not three appends — a torn write against a
-  # concurrent reader is benign today but not worth the risk), and cut
-  # -d= -f2- on read so values containing `=` survive.
-  mkdir -p "$MERGE_RECORDS_DIR"
-  printf 'merge_commit=%s\nintegration_target=%s\nmerged_at=%s\n' \
-    "$merged_commit" "$target" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
-    >> "$MERGE_RECORDS_DIR/$task_id"
-  echo "RECORDED: merge commit $merged_commit (target $target) in $MERGE_RECORDS_DIR/$task_id"
+  # Record the merge commit: if the branch is later reclaimed (e.g. under an
+  # expired lease), verify-merge can still confirm the merge landed from this
+  # record. Durable per-task delivery log — never deleted (blocker 34,
+  # 2026-09-21).
+  append_merge_record "$task_id" "$merged_commit" "$target"
 
   # Push inline while the lock is held — no agent round-trip (the old STEP 2
   # agent run added only a lock refresh). R5's manual-conflict path uses the
@@ -670,8 +733,11 @@ cmd_post_deploy() {
   # Release merge lock
   "$MERGE_LOCK" release "$task_id" 2>/dev/null && echo "LOCK: released" || true
 
-  # Consume the merge record — the merge is now deployed
-  rm -f "$MERGE_RECORDS_DIR/$task_id"
+  # The merge record is NOT deleted here (blocker 34, 2026-09-21):
+  # records are an append-only delivery log — they survive deploy so a
+  # later dispatch can still classify the task's branch against the live
+  # target. Consumers validate ancestry at read time; a stale record is
+  # inert. See the MERGE_RECORDS_DIR contract at the top of this file.
 
   echo "DEPLOYED: $final_commit"
 }
@@ -862,6 +928,114 @@ cmd_integration_target() {
   integration_target
 }
 
+# Branch-state classification for Review entry (blocker 34, 2026-09-21).
+# Usage: classify-branch <task_id>
+# Stdout: exactly one successful line —
+#   BRANCH_STATE: has-work | already-merged:<40-hex> | empty-no-work
+# Stderr: exactly one DIAG line per invocation —
+#   DIAG: classify-branch records=<n> resolvable=<m>
+# (blocker 34 design v2.1). Merge records are load-bearing with no
+# fallback: silent record loss must surface as records>0 resolvable=0,
+# never as a lying empty-no-work. The workflow logs the DIAG line
+# verbatim.
+# Resolution failure: exit 1 with diagnostics on stderr, no BRANCH_STATE
+# line (the workflow fails closed; there is no fourth stdout state).
+#
+# Attribution is identity-first, never declared:
+#   1. current-tip identity — the live merge carrying the current branch
+#      tip (current_branch_merge, blocker 35's identity primitive). If the
+#      tip is on the live line via a merge, that merge IS the deliverable.
+#   2. the task's own durable merge records, newest first (at most 20
+#      candidates scanned; garbage/unresolvable entries skipped). The
+#      first record that resolves to a MERGE commit and is an ancestor of
+#      the live target wins; the SHA is canonicalized to full 40-hex.
+# Poison rule: the newest RESOLVABLE non-ancestor record poisons the
+# fallback — an older record is never accepted beneath a newer known-
+# stale one. The answer then is empty-no-work (stderr notes the poison),
+# never a fabricated already-merged.
+# The branch is empty here, so the blocker-35 identity/ancestry
+# distinction does not apply: there is no moved branch to go stale
+# against, and every candidate is this task's own record.
+cmd_classify_branch() {
+  local task_id="$1"
+  validate_task_id "$task_id"
+
+  # DIAG pin (blocker 34 design v2.1): every invocation emits exactly one
+  # stderr line counting the durable merge-record scan. Merge records are
+  # load-bearing with no fallback — silent record loss (deleted file, torn
+  # lines, gc'd objects) must surface as records>0 resolvable=0, never as
+  # a lying empty-no-work. records = candidates scanned (valid-hex
+  # merge_commit= lines, at most 20); resolvable = candidates that resolved
+  # to MERGE commits. Paths that bypass the scan report 0/0. The workflow
+  # logs this line verbatim.
+  local diag_records=0 diag_resolvable=0
+  diag() { echo "DIAG: classify-branch records=$diag_records resolvable=$diag_resolvable" >&2; }
+
+  local branch
+  branch=$(resolve_branch "$task_id") || { echo "classify-branch: cannot resolve task branch" >&2; diag; return 1; }
+
+  cd "$REPO"
+  git rev-parse --verify "$branch" >/dev/null 2>&1 || { echo "classify-branch: branch $branch does not exist" >&2; diag; return 1; }
+
+  local target
+  target=$(integration_target) || { echo "classify-branch: cannot resolve integration target" >&2; diag; return 1; }
+
+  local ahead
+  ahead=$(git rev-list --count "$target..$branch" 2>/dev/null) || { echo "classify-branch: rev-list failed" >&2; diag; return 1; }
+  if [ "$ahead" -gt 0 ]; then
+    diag
+    echo "BRANCH_STATE: has-work"
+    return 0
+  fi
+
+  # 1. Current-tip identity.
+  local tip_merge
+  if tip_merge=$(current_branch_merge "$branch" 2>/dev/null); then
+    tip_merge=$(git rev-parse --verify "$tip_merge" 2>/dev/null) || tip_merge=""
+    if [ -n "$tip_merge" ] && git merge-base --is-ancestor "$tip_merge" "$target" 2>/dev/null; then
+      diag
+      echo "BRANCH_STATE: already-merged:$tip_merge"
+      return 0
+    fi
+  fi
+
+  # 2. Durable merge records, newest first. Empty-file-safe: no pipelines
+  # under set -e/pipefail, at most 20 candidate lines read.
+  local rec="$MERGE_RECORDS_DIR/$task_id"
+  if [ -f "$rec" ]; then
+    local count=0 sha full poisoned=""
+    while IFS= read -r line && [ "$count" -lt 20 ]; do
+      case "$line" in
+        merge_commit=*) sha="${line#merge_commit=}" ;;
+        *) continue ;;
+      esac
+      case "$sha" in ""|*[!0-9a-f]*) continue ;; esac
+      count=$((count + 1))
+      diag_records=$((diag_records + 1))
+      full=$(git rev-parse --verify --quiet "$sha" 2>/dev/null) || continue
+      # A merge commit: the frozen first-parent diff the workflow reviews
+      # only exists for merges. A non-merge ancestor is never the task's
+      # merge — skipped, not poison (garbage must not veto delivery).
+      git rev-parse --verify --quiet "$full^2" >/dev/null 2>&1 || continue
+      diag_resolvable=$((diag_resolvable + 1))
+      if git merge-base --is-ancestor "$full" "$target" 2>/dev/null; then
+        if [ -n "$poisoned" ]; then
+          echo "classify-branch: newest resolvable record $poisoned is stale (not an ancestor of $target); refusing older record $full" >&2
+          break
+        fi
+        diag
+        echo "BRANCH_STATE: already-merged:$full"
+        return 0
+      fi
+      [ -z "$poisoned" ] && poisoned="$full"
+    done < <(tac "$rec" 2>/dev/null)
+  fi
+
+  diag
+  echo "BRANCH_STATE: empty-no-work"
+  return 0
+}
+
 # Agent-side one-liner: prints the remote branch a push updates. Attached:
 # the branch name. Detached: the resolved destination from
 # resolve_push_destination() (fails when genuinely unknowable).
@@ -897,8 +1071,22 @@ cmd_push_target() {
     # The lock tells them apart.
     if cmd_refresh_lock "$task_id" >/dev/null 2>&1; then
       echo "LOCK: refreshed for push (manual-merge path)"
-      do_push "$task_id"
-      return $?
+      # Blocker 34 (2026-09-21): the manual merge has no record yet —
+      # attribute it by current-tip identity, push, and record ONLY after
+      # the push succeeds. A failed push records nothing.
+      local branch manual_merge push_target_name
+      if branch=$(resolve_branch "$task_id" 2>/dev/null) \
+        && manual_merge=$(current_branch_merge "$branch" 2>/dev/null) \
+        && [ -n "$manual_merge" ]; then
+        if do_push "$task_id"; then
+          push_target_name=$(integration_target) || push_target_name="unknown"
+          append_merge_record "$task_id" "$manual_merge" "$push_target_name"
+          return 0
+        fi
+        return 1
+      fi
+      echo "ERROR: cannot attribute a manual merge for $task_id — no merge of the current branch tip is on the live line" >&2
+      return 1
     fi
     echo "PUSH_SKIPPED: no merge record for $task_id and no lock held -- nothing was merged, nothing to push"
     return 0
@@ -912,10 +1100,70 @@ cmd_push_target() {
   fi
   echo "LOCK: refreshed for push"
 
+  # Blocker-35 (2026-09-21): the ERROR-after-MERGED retry pushed live HEAD
+  # with no check that it still carries the task's deliverable — rework
+  # between the merge and the retry made it push stale state. Prove the
+  # branch's current tip was merged onto the live line before pushing.
+  # Branch gone (merge-lease reclaim): no rework could have moved it, so
+  # the recorded merge on the line is still the deliverable.
+  local branch live_merge recorded_commit
+  recorded_commit=$(grep "^merge_commit=" "$record_file" | tail -1 | cut -d= -f2-)
+  live_merge=""
+  if branch=$(resolve_branch "$task_id" 2>/dev/null); then
+    if git rev-parse --verify "$branch" >/dev/null 2>&1; then
+      live_merge=$(current_branch_merge "$branch") || live_merge=""
+    elif [ -n "$recorded_commit" ] && git merge-base --is-ancestor "$recorded_commit" "$(git rev-parse HEAD 2>/dev/null)" 2>/dev/null; then
+      live_merge="$recorded_commit"
+    fi
+  else
+    echo "ERROR: cannot resolve task branch for $task_id — not pushing without a verifiable branch"
+    return 1
+  fi
+  if [ -z "$live_merge" ]; then
+    echo "STALE_MERGE: no merge of the current ${branch:-unknown} tip is on the live line (recorded: ${recorded_commit:-none}) — the task branch changed since the recorded merge; refusing to push possibly-stale state"
+    return 1
+  fi
+  echo "PUSH_IDENTITY_OK: pushing merge $live_merge carrying the current $branch tip"
+
   do_push "$task_id"
   return $?
 }
 
+# Usage: version-check <task_id>
+# Output: exactly one machine line on stdout:
+#   VERSION_TOUCHED      — the task branch's three-dot diff against the
+#                          integration target touches package.json's `version`
+#                          field (versions are assigned at publish time,
+#                          never in branches)
+#   VERSION_CLEAN        — no `version` change on the branch
+# A check failure (unresolvable branch/target, diff error) prints
+# diagnostics on stderr and exits 1 — the workflow treats that as touched
+# (fail closed). There is no VERSION_CHECK_FAILED stdout token (blocker
+# 34, 2026-09-21): stdout carries only the two real states.
+# A deterministic git fact for Review: the reviewer never adjudicates it.
+cmd_version_check() {
+  local task_id="$1"
+  validate_task_id "$task_id"
+
+  local branch
+  branch=$(resolve_branch "$task_id") || { echo "version-check: cannot resolve task branch" >&2; return 1; }
+
+  cd "$REPO"
+  git rev-parse --verify "$branch" >/dev/null 2>&1 || { echo "version-check: branch $branch does not exist" >&2; return 1; }
+
+  local target
+  target=$(integration_target) || { echo "version-check: cannot resolve integration target" >&2; return 1; }
+
+  local diff
+  diff=$(git diff "$target...$branch" -- package.json 2>/dev/null) || { echo "version-check: diff failed" >&2; return 1; }
+  if printf '%s' "$diff" | grep -qE '^[+-].*"version"[[:space:]]*:'; then
+    echo "VERSION_TOUCHED"
+  else
+    echo "VERSION_CLEAN"
+  fi
+  return 0
+}
+
 # --- dispatch ---
 
 cmd="${1:-}"
@@ -929,6 +1177,8 @@ case "$cmd" in
   integrate)    cmd_integrate "${1:?task_id required}" "${2:-}" ;;
   verify-merge) cmd_verify_merge "${1:?task_id required}" ;;
   integration-target) cmd_integration_target ;;
+  classify-branch) cmd_classify_branch "${1:?task_id required}" ;;
+  version-check) cmd_version_check "${1:?task_id required}" ;;
   push-destination) cmd_push_destination ;;
   push-target)   cmd_push_target "${1:?task_id required}" ;;
   post-deploy)  cmd_post_deploy "${1:?task_id required}" ;;
@@ -940,7 +1190,7 @@ case "$cmd" in
   merge-record) cmd_merge_record "${1:?task_id required}" ;;
   *)
     echo "Usage: worktree-lifecycle.sh <command> [args]"
-    echo "Commands: validate, prepare, resolve-branch, inspect, integrate, integration-target, push-target, verify-merge, post-deploy, terminal-cleanup, cleanup, status, refresh-lock, lock-status, merge-record"
+    echo "Commands: validate, prepare, resolve-branch, inspect, classify-branch, version-check, integrate, integration-target, push-target, verify-merge, post-deploy, terminal-cleanup, cleanup, status, refresh-lock, lock-status, merge-record"
     exit 1
     ;;
 esac

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.14.6",
+  "version": "0.14.7",
   "description": "Opinionated orchestration for Muse — workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,

package/seed/cron-body-template.md

@@ -41,9 +41,9 @@ The failures below are settled and recorded in the Gate 1 OODA state. The author
 
 1. **Load tools:** Call tool_search_load_tool_namespace with paths ["workflow_launch"].
 
-2. **Load the workflow registry:** Read the file "{crewHome}/workflows/registry.json" with the read tool and parse it as JSON. If the file does not exist (the live release predates the registry), proceed without it — omit the `registry` arg and the dispatcher will load the registry the slow way and log a warning. If the read FAILS on a file that exists (transient read error — observed 2026-09-13; the file itself was healthy and later ticks read it fine), retry the read once; if it still fails, write the error text into your run summary (observability — never silently swallow a failed read) and proceed without the registry the same way.
+2. **Load the workflow registry:** Read the file "{crewHome}/workflows/registry.json" with the read tool and keep its RAW TEXT — do NOT parse it, do NOT re-emit it as a JSON object. Pass the text verbatim: never reformat, summarize, or hand-transcribe it (room #26: 15+ launch rejections 09-19→09-21 from garbled nested-object args, and one hallucinated registry that passed validation). If the file does not exist (the live release predates the registry), proceed without it — omit the `registryText` arg and the dispatcher will load the registry the slow way and log a warning. If the read FAILS on a file that exists (transient read error — observed 2026-09-13; the file itself was healthy and later ticks read it fine), retry the read once; if it still fails, write the error text into your run summary (observability — never silently swallow a failed read) and proceed without the registry the same way.
 
-3. **Run the dispatcher:** Call workflow_launch with scriptPath "{crewHome}/workflows/crew-dispatch.js" and args {"crewHome": "{crewHome}", "registry": <parsed registry JSON, or omit the key when the file was missing>}.
+3. **Run the dispatcher:** Call workflow_launch with scriptPath "{crewHome}/workflows/crew-dispatch.js" and args {"crewHome": "{crewHome}", "registryText": <raw registry file text, or omit the key when the file was missing>}. The dispatcher parses the text itself — a nested-object `registry` arg is not accepted. If the launch is rejected, retry once with only {"crewHome": "{crewHome}"} (the sanctioned fallback — the dispatcher loads the registry the slow way); a second rejection is a platform problem, not an args problem — write it in your run summary and move on.
 
    Wait for it to complete. It reads the crew's task state, determines eligibility, claims tasks, acknowledges the poll, and returns structured results.
 
@@ -69,7 +69,7 @@ The failures below are settled and recorded in the Gate 1 OODA state. The author
         then re-run the sha256sum. If the regeneration exits non-zero, or the hash still does not match after regeneration, the diff is UNISSUABLE — record it terminally (code, never prose):
         `node {crewHome}/lib/crew-api.js --crew-home {crewHome} record-intent-unissuable --json '{"task_id": "<task_id>", "claim_expiry": "<claim_expiry>", "reason": "<missing-staged-diff|diff-unregenerable|hash-mismatch-after-regeneration>"}'`
         (copy `claim_expiry` verbatim from the scan entry — it is the compare-and-swap). This writes the terminal `publish: publish-unissuable` note and an issuer-stamped ledger entry — parked for human attention. Never re-claim, never loop on an hourly reclaim; a diff that cannot be checksummed never becomes an edit.
-     2. **Re-claim check — the version receipt decides (code):** when the entry's `reclaimed` is true, a previous tick died mid-issuance and may have issued the edit without recording it. Read the artifact's on-disk version receipt `~/workspace/ts-spaces/<slug>/.crew-publish-version-<task_id>` (trim whitespace) and compare it to the entry's `version`. If it EQUALS the dead attempt's version → the edit landed: call `record-version-ack --json '{"task_id":"<task_id>","version":"<entry version>","via":"disk"}'` and NEVER re-issue. If it differs or the file is unreadable → the edit provably did not land (the receipt is the only positive signal): proceed to issuance. Never decide this from prose, from `artifact_status`, or from an inspector's summary.
+     2. **Re-claim check — the version receipt decides (code):** when the entry's `reclaimed` is true, a previous tick died mid-issuance and may have issued the edit without recording it. Read the artifact's on-disk version receipt `~/workspace/ts-spaces/<slug>/.crew-publish-version-<task_id>` (trim whitespace) and compare it to the entry's `version`. If it EQUALS the dead attempt's version → the edit landed: call `record-version-ack --json '{"task_id":"<task_id>","version":"<entry version>","via":"disk"}'` and NEVER re-issue (report `receipt_check: "match"` for the record). If it differs → `receipt_check: "different"`. If the file is missing or unreadable → `receipt_check: "unreadable"`. A differing or unreadable receipt is NOT proof the edit did not land — the async edit may have issued while the receipt was never applied or is not yet visible. Never decide this from prose, from `artifact_status`, or from an inspector's summary. You MUST run this check and report its exact outcome to the record step (step 4) — the record API refuses reclaimed claims without an explicit `receipt_check`.
      3. **Issue the edit directly — in this turn, never in a child.** Load the artifact namespace in your own turn (`tool_search.load_tool_namespace` with paths `["artifact"]`) and call `artifact_edit` with the entry's `slug` and this suggestion handoff (paste the verified staged diff file's full content):
         'Adopt the following change into your source tree, then rebuild and redeploy.
 
@@ -88,11 +88,11 @@ The failures below are settled and recorded in the Gate 1 OODA state. The author
         Edit-request contract: call artifact_edit exactly once. Never retry the edit yourself. Tool unavailable (the artifact namespace would not load), a timeout, a transport error, or any otherwise ambiguous result is inconclusive: record NOTHING for this task, log the ambiguity in one line, and let the claim expire; the next scan re-claims and step 2's receipt check decides. An unrecorded outcome is the only honest record of an unknown one.
         After the call returns, inspect the result text. (2026-09-20 REVIEW) Do NOT record an "acknowledged" builder report — the positive builder-report path was circular (the worker knows the version, so the report proves nothing) and is removed; the ack scan reads the version receipt from the artifact's disk as the sole positive evidence. If the result is an explicit refusal → `node {crewHome}/lib/crew-api.js --crew-home {crewHome} record-builder-report --json '{"task_id":"<task_id>","version":"<version>","outcome":"refused","report_text":"<refusal text verbatim>"}'` (the command MECHANICALLY rejects unless `report_text` contains the exact version — if the refusal text lacks the version, do NOT call record-builder-report; just proceed to the record step with `refused`).
      4. **Record the outcome (code):**
-        `node {crewHome}/lib/crew-api.js --crew-home {crewHome} record-intent-issuance --json '{"task_id": "<task_id>", "claim_expiry": "<claim_expiry>", "edit_outcome": "<accepted|refused>", "refusal_text": "<first line>"}'`
-        (omit `refusal_text` unless refused). Copy `claim_expiry` verbatim from the scan entry — it is the compare-and-swap. If the command returns `recorded: false`, log the reason and stop: another tick owns the task. `accepted` writes the issuer-stamped `submitted` ledger entry and mirrors `publish: edit-issued <commit> attempt=<n> version=<commit>:<attempt>` (the 4.5 ack scan claims it on a later tick); `refused` writes `rejected` and the terminal `publish: publish-refused` note. There is no outcome for an inconclusive call (step 3) — do not call record-intent-issuance at all when the edit's fate is unknown.
+        `node {crewHome}/lib/crew-api.js --crew-home {crewHome} record-intent-issuance --json '{"task_id": "<task_id>", "claim_expiry": "<claim_expiry>", "edit_outcome": "<accepted|refused>", "refusal_text": "<first line>", "reclaimed": <true|false>, "receipt_check": "<different|unreadable>"}'`
+        (omit `refusal_text` unless refused; copy `reclaimed` verbatim from the scan entry — it is mechanical, never inferred; `receipt_check` is REQUIRED when `reclaimed` is true and must name the exact step-2 outcome — omit `receipt_check` when `reclaimed` is false. A `match` in step 2 never reaches this step: the edit already landed, so you ack instead of issuing.) Copy `claim_expiry` verbatim from the scan entry — it is the compare-and-swap. If the command returns `recorded: false`, log the reason and stop: another tick owns the task. `accepted` writes the issuer-stamped `submitted` ledger entry and mirrors `publish: edit-issued <commit> attempt=<n> version=<commit>:<attempt>` (the 4.5 ack scan claims it on a later tick); `refused` writes `rejected` and the terminal `publish: publish-refused` note. There is no outcome for an inconclusive call (step 3) — do not call record-intent-issuance at all when the edit's fate is unknown.
      - Prose never mints `publish:` notes directly. Any tick-authored publish note goes through exactly one path (code asserts the verb against the closed registry, rejects unknown verbs):
        `node {crewHome}/lib/crew-api.js --crew-home {crewHome} record-publish-note --json '{"task_id":"<task_id>","note":"<full note text>"}'`
-   - Crash rules (fail closed, never blind re-issue): if this tick dies between the artifact_edit call and the record step, the next scan re-claims with `reclaimed: true` and step 2's version-receipt check decides between ack (`record-version-ack` with `via: "disk"`) and a fresh issuance. The issuance contract is at-most-one RECORDED issuance per attempt; a duplicate physical issuance across a lease expiry is content-identical (the same checksummed staged diff) and bounded by the ack scan's 2-hour budget.
+   - Crash rules (fail closed, never blind re-issue): if this tick dies between the artifact_edit call and the record step, the next scan re-claims with `reclaimed: true` and step 2's version-receipt check decides between ack (`record-version-ack` with `via: "disk"`) and a fresh issuance — recorded with its explicit `receipt_check`, since a differing/unreadable receipt is not proof the prior attempt's edit did not land. The issuance contract is at-most-one RECORDED issuance per attempt; a duplicate physical issuance across a lease expiry is content-identical (the same checksummed staged diff) and bounded by the ack scan's 2-hour budget.
 
 4.5. **Acknowledgement scan (version, 0.14.6):** the version acknowledgement is the entire publish verdict — Eric's contract: "If we hear that the artifact acknowledges our version, that's it. We don't verify against content." No content verification, no manifest comparison, no read-back. A dedicated 5-minute `crew-ack-scan` cron runs the same scan on an observation-only tick (it never issues edits) so verdicts land quickly; this tick ALSO runs the scan AFTER 4.4b so an issued edit's verdict path is synchronous. Deterministic code evaluates the evidence and owns every transition; you only log.
    - Scan (code): `node {crewHome}/lib/crew-api.js --crew-home {crewHome} scan-ack-pending`

package/workflows/AGENTS.md

@@ -2,7 +2,7 @@
 
 Executable Muse workflow scripts (JavaScript). These are what the workflow runtime actually runs.
 
-- `crew-dispatch.js` — reads the board, recommends eligible tasks, returns structured launch records (the launched workflow self-claims; the dispatcher never writes claims). Skips tasks on quiesced projects and on projects with no repo_path configured.
+- `crew-dispatch.js` — reads the board, recommends eligible tasks, returns structured launch records (the launched workflow self-claims; the dispatcher never writes claims). Skips tasks on quiesced projects and on projects with no repo_path configured. Registry seam (2026-09-21): prefers raw `inputs.registryText` with deterministic `JSON.parse` — never LLM re-emission; loudly falls back to slow registry loading for missing/non-string/malformed input; validates every `reworkTarget` names a real step; the slow-loaded registry is re-validated and fails closed (throw) — no second fallback.
 
 All four workflow scripts share byte-identical transport helpers (`workRetryKey`, `buildTransportRetryTrailer`, `describeWorkAgentFailure` — pinned by `tests/closeout.test.js`). The transport-retry loop treats a worker report naming the missing artifact tool namespace (bug 3472bf36, a per-launch platform flake) as a retryable attempt with a fresh launch rather than accepting a useless report.