muse-crew 0.14.6 → 0.14.7

package/workflows/chore.js

@@ -101,6 +101,13 @@ async function telemetryFlush() {
 }
 async function telemetryEnd(status) {
   if (!telemetryRunId) return;
+  // Room #26 blocker 37: record-run-end rejects any status outside the
+  // schema CHECK — and this function swallowed that throw as "non-fatal",
+  // leaving the run row 'running' forever. An invalid status is a
+  // programmer error: fail loud. Transport errors stay non-fatal.
+  if (!["completed", "failed", "parked", "timed_out"].includes(status)) {
+    throw new Error("telemetryEnd: invalid status " + JSON.stringify(status) + " — must be completed|failed|parked|timed_out");
+  }
   // Flush any buffered events before recording the end.
   await telemetryFlush();
   try {
@@ -517,12 +524,6 @@ function extractMarkerLines(workerText) {
   return markers.join("\n");
 }
 
-// See docs/decisions/publish-path.md#already-merged-idem2: idempotency for already-merged tasks.
-function extractAlreadyMerged(workerText) {
-  var m = /repo_diff:\s*none\s*\(already-merged:\s*([0-9a-f]{7,40})(?=[\s)]|$)/i.exec(workerText || "");
-  return m ? { sha: m[1].toLowerCase() } : { sha: null };
-}
-
 
 // See docs/decisions/qa-reproduce.md#worktree-confinement: the Build agent must declare its worktree.
 function extractWorktree(workerText) {
@@ -676,12 +677,24 @@ let mapGateBounceCount = 0;
 // rationalized a skip against explicit instruction text — text alone did not
 // hold, so the decision now lives in workflow code, not agent judgment.
 let releaseDecision = null; // { release: "yes"|"no", version_bump: "patch"|"minor"|"major"|null }
-// Already-merged idempotency: the verified sha from the builder's
-// `repo_diff: none (already-merged: <sha>)` declaration (null when the
-// builder made commits or declared a runtime-state deliverable). The
-// workflow verifies the sha is an ancestor of the integration target at Build closeout;
-// Review's no-diff branch reads this, never the builder's prose.
+// Already-merged attribution (blocker 34, 2026-09-21): the sha of the
+// task-attributed merge when classify-branch reports already-merged.
+// Set ONLY from the classifier's mechanical output — never from agent
+// prose. The agent-authored sha-bearing repo_diff declaration path is
+// deleted; attribution is identity-first from git, then the task's own
+// durable merge records.
 let alreadyMergedSha = null;
+// Room #26 blocker 34 (redesign, 2026-09-21): mechanical branch-state
+// classification at Review entry. Git facts are never adjudicated by a
+// reviewer — the workflow classifies the branch with `classify-branch`
+// (pure git) before Cass is dispatched: "has-work",
+// "already-merged:<sha>", or "empty-no-work". An empty branch with no
+// verified sha and no `repo_diff: none` claim fails mechanically without
+// dispatching Cass; reviewer prose is never parsed for git identity.
+let branchState = null; // "has-work" | "already-merged:<sha>" | "empty-no-work"
+let buildClaimedNoDiff = false; // Build declared plain `repo_diff: none` (no repo change — runtime-state deliverable, or believed already-merged). Same-process Build report only; there is no cross-process hydration — an empty branch on a fresh dispatch with no task-attributed merge fails mechanically.
+let versionTouched = false; // npm: branch changed package.json's `version` (mechanical git fact, blocker-34 follow-up)
+let branchStateErr = ""; // classifier failure detail (fail-closed grounds)
 // Deterministic publish target — computed by the workflow (registry base +
 // bumpVersion), never by the Publish agent.
 let publishTarget = null; // { base, scope, target }
@@ -927,7 +940,12 @@ while (i < STEPS.length) {
     );
     if (!claimResult.claimed) {
       log("Standing down — task " + taskId + " was already claimed by another run");
-      await telemetryEnd("duplicate");
+      // Room #26 blocker 37: telemetryEnd only accepts schema-valid
+      // statuses ("duplicate" violated the CHECK and silently left the run
+      // row 'running' forever). The stand-down is a clean exit — the run
+      // completed without doing work; the duplicate verdict itself stays in
+      // the workflow's returned status and this log line.
+      await telemetryEnd("completed");
       return { status: "duplicate", task_id: taskId, reason: "task already claimed by another run" };
     }
     activeSessionId = claimResult.session_id;
@@ -1121,55 +1139,126 @@ while (i < STEPS.length) {
       "cd " + WORKTREE_HINT + "\n" +
       "git add -A\n" +
       "git commit -m \"chore: " + safeTitle + "\"\n\n" +
-      "If the task's deliverable is runtime state (a cron definition, scheduler change, or dashboard/config state created outside the repo) and the repository genuinely needs no change, do NOT fabricate a commit: leave the branch with no commits ahead of the integration target and declare `repo_diff: none` in your report, naming the runtime-state deliverable. If you verified the deliverable is already on the integration target (a prior merge or hand-repair landed it — do NOT re-implement working code), make no commit and declare `repo_diff: none (already-merged: <sha>)` naming the integration-target commit that carries the work; the workflow verifies the sha is an ancestor of the integration target, and a false declaration fails the phase. Otherwise commit your changes normally.\n\n" +
+      "If the task's deliverable is runtime state (a cron definition, scheduler change, or dashboard/config state created outside the repo) and the repository genuinely needs no change, do NOT fabricate a commit: leave the branch with no commits ahead of the integration target and declare `repo_diff: none` in your report, naming the runtime-state deliverable. If you verified the deliverable is already on the integration target (a prior merge landed it — do NOT re-implement working code), make no commit and declare `repo_diff: none` in your report. The workflow verifies the claim mechanically from git — the task's own merge records, never your declaration, are the proof of delivery. Otherwise commit your changes normally.\n\n" +
       (rejectionNotes ? "REWORK after rejection. Address:\n" + rejectionNotes + "\n\n" : "") +
       "Report back in plain prose: what you built and the outcome." +
       (PUBLISH_TYPE === "npm" ? " End your report with the release: and version_bump: lines exactly as specified above — keep them on their own lines, lowercase, unrephrased — then a line `worktree: ` followed by the exact working directory path from above (copy it verbatim \u2014 it must match character-for-character), then a final line with exactly: VERDICT: PASS if the build is complete, VERDICT: FAIL if it is not." : " End your report with a line `worktree: ` followed by the exact working directory path from above (copy it verbatim \u2014 it must match character-for-character), then exactly one line: VERDICT: PASS if the build is complete, VERDICT: FAIL if it is not.");
 
   } else if (step.name === "Review") {
-    // See docs/decisions/publish-path.md#already-merged-hydra: when this run did not execute, hydration uses the existing merge.
-    if (!alreadyMergedSha) {
-      var hydResult = null;
-      try {
-        hydResult = await agent(
-          "Read the latest completed Build session for task " + taskId + ".\n" +
-          "Run in shell and return the stdout verbatim:\n" + crewCmd("get-state", { events_limit: 1 }) + "\n" +
-          "In the returned sessions array, find the most recent session (by started_at) with task_id \"" + taskId + "\", step \"Build\", and status \"completed\". Return exactly two sections, verbatim, with no commentary:\n" +
-          "SHA: <the session's already_merged_sha field value, or the word null when it is null>\n" +
-          "NOTES:\n<the session's notes field, verbatim>",
-          { key: "hydrate-already-merged" + (reworkCount > 0 ? "-r" + reworkCount : ""), label: "Hydrating already-merged verification" }
-        );
-      } catch (hydErr) {
-        log("Hydration read failed (" + String(hydErr && hydErr.message || hydErr) + "); treating as none declared.");
+    // Room #26 blocker 34 (redesign, 2026-09-21): classify the branch
+    // mechanically BEFORE Cass is dispatched. The classifier is pure git
+    // (classify-branch in the lifecycle script): has-work |
+    // already-merged:<sha> | empty-no-work. Attribution is identity-first
+    // from git, then the task's own durable merge records — there is no
+    // agent-authored declared-sha input and no cross-process hydration
+    // ferry (the re-entry case it served is covered by the durable record
+    // → classifier directly). An unparseable result fails closed as
+    // empty-no-work — an empty branch never passes Review silently, and
+    // the bounce to Build gives the next round a chance to classify.
+    try {
+      var bsResult = await agent(
+        "Classify the task branch state. This is a mechanical git check, not a judgment call.\n" +
+        "Run in shell and return the stdout verbatim, then the single stderr line starting with `DIAG:` verbatim:\n" +
+        LIFECYCLE_ENV + LIFECYCLE + " classify-branch " + taskId,
+        { key: "classify-branch" + (reworkCount > 0 ? "-r" + reworkCount : ""), label: "Classifying branch state (mechanical)" }
+      );
+      var bsStr = (typeof bsResult === "string") ? bsResult : JSON.stringify(bsResult);
+      var bsMatch = /^\s*BRANCH_STATE:\s*(has-work|already-merged:[0-9a-f]{40}|empty-no-work)\s*$/im.exec(bsStr);
+      if (bsMatch) {
+        branchState = bsMatch[1].toLowerCase();
+      } else {
+        branchStateErr = "unparseable classifier output: " + bsStr.slice(0, 120);
       }
-      var hydStr = hydResult ? ((typeof hydResult === "string") ? hydResult : JSON.stringify(hydResult)) : "";
-      var hydSha = /^SHA:\s*([0-9a-f]{7,40})\s*$/im.exec(hydStr);
-      if (hydSha) {
-        alreadyMergedSha = hydSha[1].toLowerCase();
-        log("Hydrated already-merged verification from structured session field: " + alreadyMergedSha);
+      // DIAG pin (blocker 34 design v2.1): the merge-record scan is
+      // load-bearing with no fallback — the classifier's stderr counter is
+      // logged verbatim so silent record loss surfaces in the evidence.
+      var bsDiagMatch = /^[ \t]*DIAG:\s*classify-branch\s+records=\d+\s+resolvable=\d+[ \t]*$/im.exec(bsStr);
+      if (bsDiagMatch) {
+        log(bsDiagMatch[0].trim());
       } else {
-        var hvm = /already_merged_verified:\s*([0-9a-f]{7,40})/i.exec(hydStr);
-        if (hvm) {
-          alreadyMergedSha = hvm[1].toLowerCase();
-          log("Hydrated already-merged verification from Build session notes (fallback): " + alreadyMergedSha);
-        }
+        log("classify-branch: no DIAG: record-scan counter returned (scan unverifiable)");
+      }
+    } catch (bsErr) {
+      branchStateErr = "classifier call failed: " + String(bsErr && bsErr.message || bsErr).slice(0, 120);
+    }
+    if (!branchState) {
+      branchState = "empty-no-work";
+      log("Branch-state classification failed (" + branchStateErr + ") — failing closed as empty-no-work");
+    } else if (branchState.indexOf("already-merged:") === 0) {
+      alreadyMergedSha = branchState.slice("already-merged:".length);
+      log("Branch state already-merged: " + alreadyMergedSha + " (mechanically verified) — Cass reviews the frozen merge diff");
+    } else {
+      log("Branch state: " + branchState);
+    }
+    // buildClaimedNoDiff was set at the Build gate from the full Build
+    // report (same process only). Only an empty branch WITH this claim
+    // goes to Cass for a plausibility judgment; without it, empty-no-work
+    // fails mechanically and Cass is never dispatched.
+    // Blocker-34 follow-up: the package.json `version` check is a mechanical
+    // git fact, not a reviewer judgment. For npm projects the workflow checks
+    // it here, before Cass is dispatched — a touched `version` fails Review
+    // mechanically (versions are assigned at publish time, never in
+    // branches). Fail closed: anything but an explicit VERSION_CLEAN counts
+    // as touched.
+    if (PUBLISH_TYPE === "npm") {
+      try {
+        var vtResult = await agent(
+          "Check whether the task branch changed package.json's `version` field. This is a mechanical git check, not a judgment call.\n" +
+          "Run in shell and return the stdout verbatim:\n" +
+          LIFECYCLE_ENV + LIFECYCLE + " version-check " + taskId,
+          { key: "version-check" + (totalReworkCount > 0 ? "-r" + totalReworkCount : ""), label: "Checking package.json version (mechanical)" }
+        );
+        var vtStr = (typeof vtResult === "string") ? vtResult : JSON.stringify(vtResult);
+        var vtMatch = /^\s*VERSION_(TOUCHED|CLEAN)\s*$/im.exec(vtStr);
+        versionTouched = !(vtMatch && vtMatch[1].toUpperCase() === "CLEAN");
+      } catch (vtErr) {
+        versionTouched = true;
+        log("Version check failed (" + String(vtErr && vtErr.message || vtErr).slice(0, 120) + ") — failing closed as touched");
       }
+      log("Review: package.json `version` " + (versionTouched ? "touched by the branch — mechanical FAIL, Cass not dispatched" : "untouched — mechanical check clean"));
+    }
+    // The empty-branch rule Cass used to adjudicate is gone. What she
+    // examines and what rule she applies depend on the classified state —
+    // never on her own judgment of git identity.
+    var reviewChangeExam, reviewBranchRule;
+    if (branchState === "has-work") {
+      reviewChangeExam =
+        "Examine the code changes by running:\n" +
+        LIFECYCLE_ENV + LIFECYCLE + " inspect " + taskId + "\n\n" +
+        "The inspect output is authoritative: it prints the task branch's actual tip commit (TIP) and every commit ahead of the integration target (inspect prints the target name). Base your review ONLY on this output — do NOT run git log yourself to pick commits, and do NOT discuss commit hashes from any other source (they may come from stale rework rounds or a different repo).\n\n";
+      reviewBranchRule =
+        "MECHANICAL FACT (computed by the workflow from git — never by a reviewer): branch state = has-work. The branch has commits ahead of the integration target. Review their content; branch emptiness is settled and is not yours to judge.\n";
+    } else if (branchState.indexOf("already-merged:") === 0) {
+      reviewChangeExam =
+        "The change under review is the frozen merge " + alreadyMergedSha + " — it is already on the integration target (see MECHANICAL FACT below). Examine it by running:\n" +
+        "cd " + REPO_PATH + " && git diff " + alreadyMergedSha + "^1 " + alreadyMergedSha + "\n\n" +
+        "That first-parent diff is the frozen, attributable change. Base your review ONLY on this diff — do NOT run git log to pick commits, and do NOT discuss commit hashes from any other source (they may come from stale rework rounds or a different repo).\n\n";
+      reviewBranchRule =
+        "MECHANICAL FACT (computed by the workflow from git — never by a reviewer): branch state = already-merged:" + alreadyMergedSha + ". The deliverable landed on the integration target via this task's own prior merge " + alreadyMergedSha + " (verified ancestor of the integration target). The branch is empty by design — emptiness is settled fact, not a finding.\n";
+    } else if (buildClaimedNoDiff) {
+      reviewChangeExam =
+        "The branch has no commits ahead of the integration target (see MECHANICAL FACT below) — there is no diff to examine. Judge the Build report's `repo_diff: none` claim on its plausibility.\n\n";
+      reviewBranchRule =
+        "MECHANICAL FACT (computed by the workflow from git — never by a reviewer): the branch has no commits ahead of the integration target and no task-attributed merge on the target was verified; the Build report declares `repo_diff: none` (no repo change). Approve ONLY if the task's deliverable is plausibly runtime state (e.g. a cron definition, scheduler change, or dashboard/config state created outside the repo). Otherwise report 'no commits ahead of the integration target and no plausible runtime-state deliverable — the builder likely forgot to commit', then end your report with exactly this line: VERDICT: FAIL.\n";
+    } else {
+      // Mechanical FAIL — Cass is never dispatched (see the dispatch gate
+      // below). Instructions are unused; keep the shape.
+      reviewChangeExam = "";
+      reviewBranchRule = "";
     }
     instructions = "Review independently and cold. No prior context from the builder.\nDo NOT access the task dashboard, event log, or any comments. Your review is based solely on the spec and the code.\n\n" +
       (mapperSpec ? "MAPPER'S SPEC (the builder was asked to implement exactly this):\n" + mapperSpec + "\n\n" : "Read the spec from the task description.\n\n") +
-      "Examine the code changes by running:\n" +
-      LIFECYCLE_ENV + LIFECYCLE + " inspect " + taskId + "\n\n" +
-      "The inspect output is authoritative: it prints the task branch's actual tip commit (TIP) and every commit ahead of the integration target (inspect prints the target name). Base your review ONLY on this output — do NOT run git log yourself to pick commits, and do NOT discuss commit hashes from any other source (they may come from stale rework rounds or a different repo).\n\n" +
+      reviewChangeExam +
       "You can also read specific files in the worktree at:\n" +
       WORKTREE_HINT + "/\n\n" +
       "Check quality, correctness, spec compliance.\n" +
       (SURFACE_TERMINAL ? "TERMINAL UX REVIEW: judge the CLI surface against " + UX_DOCTRINE_PATH + " — help accuracy, error quality, exit codes, output clarity. Reject when the bar is not met.\n" : "") +
       (SURFACE_ARTIFACT ? "ARTIFACT UX REVIEW: judge the rendered surface against " + UX_DOCTRINE_PATH + " — alignment, spacing, hierarchy, composition, balance, finish, correctness. Reject when the bar is not met.\n" : "") +
       "Check that public-affecting changes have matching public doc updates (API.md or the published API contract). If the docs are missing or inaccurate, report what is stale, then end your report with exactly this line: VERDICT: FAIL.\n" +
-      "If the branch has no commits ahead of the integration target (inspect shows an empty commit log), approve ONLY if the Build summary declares `repo_diff: none` with (a) a plausible runtime-state deliverable (e.g. a cron created via the cron tool), or (b) an already-merged declaration `repo_diff: none (already-merged: <sha>)` AND the mechanical fact below confirms the sha verified. MECHANICAL FACT (computed by the workflow, never by the builder): already_merged sha = " + (alreadyMergedSha ? alreadyMergedSha + " (verified ancestor of the integration target: YES)" : "none declared") + ". Otherwise report 'no commits ahead of the integration target and no valid repo_diff: none declaration — the builder likely forgot to commit', then end your report with exactly this line: VERDICT: FAIL.\n" +
-      (PUBLISH_TYPE === "npm" ? "PACKAGE VERSION: this project publishes to the npm registry, and versions are assigned at publish time — never in branches. Two checks:\n" +
-      "(a) The task branch must NOT have changed package.json's `version` field. First resolve the integration target: " + LIFECYCLE_ENV + LIFECYCLE + " integration-target. Then check: cd " + REPO_PATH + " && git diff <target>..." + TASK_BRANCH + " -- package.json (substitute the exact token integration-target printed — when it prints HEAD, use the literal word HEAD: `git diff HEAD...<branch>` diffs the detached checkout against the branch). If the branch touched `version` in any way, report 'versions are assigned at publish time, never in branches — remove the version change' in your notes, then end your report with exactly this line: VERDICT: FAIL.\n" +
-      "(b) The accepted Build report declares: " + releaseDecisionText() + ". " +
+      reviewBranchRule +
+      (PUBLISH_TYPE === "npm" ? "PACKAGE VERSION: this project publishes to the npm registry, and versions are assigned at publish time — never in branches.\n" +
+      "MECHANICAL FACT (computed by the workflow from git — never by a reviewer): the task branch did not change package.json's `version` field. A branch that touches `version` fails Review mechanically before any reviewer is dispatched, so this is settled — do not re-check it.\n" +
+      "The accepted Build report declares: " + releaseDecisionText() + ". " +
       (releaseDecision
         ? "Validate this decision against the change: release must be 'yes' when the change is consumer-observable and 'no' when internal-only; the version_bump scope must fit the change (patch for fixes, minor for new behavior, major for breaking changes). If the decision is wrong or mis-scoped, report your notes, then end with exactly this line: VERDICT: FAIL."
         : "The decision is missing or malformed — report 'Build report must end with release: yes|no and (when release is yes) version_bump: patch|minor|major lines', then end with exactly this line: VERDICT: FAIL.") + "\n" : "") +
@@ -1183,8 +1272,9 @@ while (i < STEPS.length) {
       "Then run: "+ LIFECYCLE_ENV + "WORKFLOW_RUN_ID=" + lockHolder + " CREW_STAGED_BASE=<provenance.source_commit, empty when null> integrate " + taskId + " \"merge: chore: " + safeTitle + "\\\"\\n" +
       "The script merges, reconciles, records, and pushes under the merge lock. Informational only: RECONCILED, NO_REMOTE, NO_REMOTE_RECONCILE. Read the output:\n" +
       "- STAGED_BASE_MISMATCH: the line left the staged base (stray checkout). VERDICT: FAIL.\n" +
-      "- MERGED_EMPTY — check FIRST (it contains the word MERGED): either a runtime-state deliverable or an already-merged sha the workflow verified (Build declared repo_diff: none). No lock taken, no new commit. Report 'merged empty: no repo changes'. VERDICT: PASS.\n" +
+      "- MERGED_EMPTY — check FIRST (it contains the word MERGED): either a runtime-state deliverable or a task-attributed merge the workflow verified from the task's own merge records. No lock taken, no new commit. Report 'merged empty: no repo changes'. VERDICT: PASS.\n" +
       "- MERGED: the merge landed; the script pushed inline. Read the push line: PUSHED — report the hash (detached prints PUSHED: origin/main (refspec HEAD:main)), VERDICT: PASS; NO_REMOTE_PUSH — no remote configured, VERDICT: PASS; ERROR after MERGED — a retry recovers the push; report it, VERDICT: FAIL.\n" +
+      "- STALE_MERGE: the recorded merge no longer matches the task branch (rework moved it after the merge) — the script refused to push stale state. Report the STALE_MERGE line, VERDICT: FAIL.\n" +
       "- LOCK_HELD: 10-minute backoff exhausted. VERDICT: FAIL.\n" +
       "- CONFLICT: the plain merge failed — aborted, the target is clean, and your task still holds the merge lock. Do NOT fail yet. Resolve it:\n" +
       "RESOLUTION:\n" +
@@ -1234,8 +1324,9 @@ while (i < STEPS.length) {
       // See docs/decisions/publish-path.md#deterministic-artifact-publish: the work agent never publishes; the parent runs the deterministic publish script.
       // Blocker 22 (one-party publish, room #24): verified re-entry guard.
       // The workflow parks at publish intent; the tick worker issues
-      // artifact_edit, verifies by read-back, stamps provenance, and
-      // re-queues. The dispatcher resumes this task at the Publish step
+      // artifact_edit; the ack scan stamps provenance on exact per-attempt
+      // version acknowledgement (sole positive completion criterion; no
+      // read-back — docs/publish-verification.md) and re-queues. The dispatcher resumes this task at the Publish step
       // (the parked session's own step — the failed→retry path). If the
       // stamped provenance names THIS task and its source_commit is the
       // repo's current HEAD, the merge commit was already published and
@@ -1291,8 +1382,10 @@ while (i < STEPS.length) {
         }
         // See docs/decisions/publish-path.md#step1-builder-source: the builder's source tree is NOT the crew's repo; verify report before stamping.
         // (2026-09-20, one-party worker-owned publish) A verified re-entry
-        // skips the whole issuance tail: the edit already went out, was
-        // verified by the parent read-back, and was stamped. The empty-diff
+        // skips the whole issuance tail: the edit already went out, the
+        // ack scan saw the exact per-attempt version acknowledged (sole
+        // positive completion criterion; no read-back) and it was stamped.
+        // The empty-diff
         // park must not fire on this branch.
         if (!publishSkippedNoLock && !publishAlreadyVerified) {
         // The trigger key of the attempt that last ran, for the publish ledger.
@@ -1547,11 +1640,13 @@ while (i < STEPS.length) {
       // mechanical outcome above. It must not rebuild or re-stamp: a second
       // artifact_edit would trigger a duplicate build.
       // (2026-09-20, one-party worker-owned publish) On a verified re-entry
-      // the publish was issued by the crew worker, verified by the parent
-      // read-back, and stamped — the work agent reports that, VERDICT: PASS.
+      // the publish was issued, the ack scan observed the artifact's exact
+      // version acknowledgement, and provenance was stamped — already
+      // verified, nothing to issue. The work agent reports that,
+      // VERDICT: PASS.
       if (publishAlreadyVerified) {
         instructions = "Publish was already completed and verified for this task — do NOT call artifact_edit, artifact_status, setprovenance, or post-deploy yourself; doing so would disturb the finalized state.\n\n" +
-          "The crew's publish worker issued the artifact edit for the merged commit, the parent's independent content read-back confirmed the artifact contains the merged change, and provenance was stamped (docs/publish-verification.md). This Publish pass is a verified re-entry after the stamp: there is nothing to issue and nothing to re-verify.\n\n" +
+          "Provenance stamps this task's merge commit as published (docs/publish-verification.md): the tick worker issued the edit, the ack scan observed the artifact's exact version acknowledgement — the sole positive completion criterion — and the publish was stamped. Already verified, nothing to issue and nothing to re-verify.\n\n" +
           "For the change summary, run: cd " + REPO_PATH + " && git log -1 --stat\n\n" +
           "Write plain prose describing what was published, then on its own line: VERDICT: PASS\n" +
           "The VERDICT line must be the last line of your report.";
@@ -1564,10 +1659,10 @@ while (i < STEPS.length) {
       instructions = "Publish the merged code to the live artifact.\n\n" +
         "The publish was performed deterministically by the workflow before your step — do NOT call artifact_edit, artifact_status, setprovenance, or post-deploy yourself; doing so would trigger a duplicate build or disturb the finalized state. You perform no publish actions.\n\n" +
         "For the change summary, run: cd " + REPO_PATH + " && git log -1 --stat\n\n" +
-        "Mechanical outcome (the workflow's mechanical steps; content verification is the parent's, still pending):\n" +
+        "Mechanical outcome (the workflow's mechanical steps; the ack scan's version-acknowledgement check is still pending):\n" +
         "- merge lock refreshed: yes\n" +
         "- artifact rebuild triggered and completed: yes\n" +
-        "- provenance stamped: NO — not yet, and you must NOT stamp it. The stamp moved to the parent, which stamps it only after an independent content read-back confirms the artifact actually contains the merged change (docs/publish-verification.md). A stamped-but-hollow build is exactly how canary run 8 (2026-09-11) went green on stale content.\n" +
+        "- provenance stamped: NO — not yet, and you must NOT stamp it. The ack scan stamps it when it observes the artifact's exact on-disk acknowledgement of this attempt's version — version acknowledgement is the sole positive completion criterion (docs/publish-verification.md). A stamped-but-hollow build is exactly how canary run 8 (2026-09-11) went green on stale content.\n" +
         "- post-deploy finalized: yes (worktree removed, merge lock released)\n\n" +
         "POLICY: The live artifact is rebuilt only in this phase, from the repo. Never use artifact_edit to change the artifact directly — fixes go through the repo and the loop. A source fix is not done until the artifact is rebuilt from it here.\n\n" +
         "The repo push already happened in Integrate — do NOT push to git in this phase.\n\n" +
@@ -1611,7 +1706,31 @@ while (i < STEPS.length) {
   var workKeyBase = "work-" + step.name + (reworkCount > 0 ? "-r" + reworkCount : "");
   var workerResult = null;
   var workAttempts = [];
-  for (var workAttempt = 0; workAttempt <= 2; workAttempt++) {
+  // Room #26 blocker 34 (redesign): an empty branch with no verified sha and
+  // no repo_diff: none claim fails Review mechanically — Cass is never
+  // dispatched, so no reviewer adjudicates the emptiness. The synthetic
+  // report below is written by the workflow and flows through the same
+  // verdict extraction, structured verdict recording, and rejection/bounce
+  // path as a real FAIL.
+  // Blocker-34 follow-up: the npm `version` check joins the mechanical gate.
+  // Either mechanical fact fails Review without dispatching Cass.
+  var mechanicalFailReason = (versionTouched ? "version-touched" : (branchState === "empty-no-work" && !buildClaimedNoDiff ? "empty-no-work" : null));
+  var mechanicalReviewFail = (step.name === "Review" && mechanicalFailReason !== null);
+  if (mechanicalReviewFail) {
+    log("Review: " + mechanicalFailReason + " — mechanical FAIL, Cass not dispatched");
+    workerResult =
+      "MECHANICAL REVIEW VERDICT (written by the workflow — no reviewer was dispatched).\n" +
+      (mechanicalFailReason === "version-touched"
+        ? "Package.json `version` (checked by the workflow from git): the task branch changed the `version` field. Versions are assigned at publish time — never in branches. Remove the version change.\n"
+        : "Branch state (classified by the workflow from git): empty-no-work — the task branch has no commits ahead of the integration target, " +
+          "no task-attributed merge on the target was verified" + (branchStateErr ? " (branch classification itself failed: " + branchStateErr + ")" : "") + ", " +
+          "and the accepted Build report declared no `repo_diff: none` deliverable. " +
+          "No change was reviewed because there is no change to review. The builder likely forgot to commit.\n") +
+      "Worktree: " + WORKTREE_HINT + "\n" +
+      "Recovery: commit the deliverable on the task branch in the worktree above and re-run Review. If the deliverable is genuinely runtime state outside the repo, declare `repo_diff: none` in the Build report instead of leaving the branch empty without a declaration.\n" +
+      "VERDICT: FAIL";
+  }
+  for (var workAttempt = 0; workAttempt <= 2 && !mechanicalReviewFail; workAttempt++) {
     var workKey = workAttempt === 0 ? workKeyBase : workRetryKey(step.name, (reworkCount > 0 ? "-r" + reworkCount : ""), workAttempt);
     var prevAttempt = workAttempt === 0 ? null : workAttempts[workAttempt - 1];
     var retryReason = workAttempt === 0 ? null : (prevAttempt.threw ? "discarded" : (prevAttempt.outcome === "missing-artifact-tools" ? "no-tools" : (prevAttempt.outcome === "unavailable-shell-transport" ? "no-transport" : "empty")));
@@ -1709,7 +1828,18 @@ while (i < STEPS.length) {
         "Run in shell and return the stdout verbatim:\n" + crewCmd("record-phase", {
           task_id: taskId,
           session: { id: activeSessionId, task_id: taskId, identity: step.identity, step: step.name, status: "failed", notes: "Worker report had no single unambiguous VERDICT: PASS/FAIL line (bounded re-ask exhausted)" },
-          event: { task_id: taskId, type: "failed", message: step.name + " verdict line missing or ambiguous, re-ask exhausted — phase failed, dispatcher will retry" }
+          event: { task_id: taskId, type: "failed", message: step.name + " verdict line missing or ambiguous, re-ask exhausted — phase failed, dispatcher will retry" },
+          // Room #26 blocker 33: INDETERMINATE verdict record — the report
+          // could not be read at all, but its full text is still preserved
+          // as grounds. Review-scoped; other verdict steps keep the
+          // existing failed-session behavior with no verdict row.
+          verdict: (step.name === "Review" ? {
+            step: "Review",
+            attempt: reworkCount,
+            reviewer: step.identity,
+            verdict: "INDETERMINATE",
+            grounds: workerText
+          } : null)
         }) + "\n",
         { key: "record-block-" + step.name, label: "Recording verdict failure" }
       );
@@ -1755,40 +1885,13 @@ while (i < STEPS.length) {
     }
     log("Build worktree confinement passed: " + wt.path);
 
-    // See docs/decisions/publish-path.md#already-merged-idem: an already-merged repo_diff is idempotent; no rebuild.
-    var am = extractAlreadyMerged(workerText);
-    if (am.sha) {
-      var amCheck = await agent(
-        "Verify the builder's already-merged declaration.\n" +
-        "Run in shell and return the stdout verbatim:\n" +
-        "TARGET=$(" + LIFECYCLE_ENV + LIFECYCLE + " integration-target) && cd " + REPO_PATH + " && git rev-parse --verify --quiet " + am.sha + " >/dev/null && git merge-base --is-ancestor " + am.sha + " $TARGET && echo ALREADY_MERGED_YES || echo ALREADY_MERGED_NO",
-        { key: "verify-already-merged" + (reworkCount > 0 ? "-r" + reworkCount : ""), label: "Verifying already-merged declaration" }
-      );
-      var amOut = (typeof amCheck === "string") ? amCheck : JSON.stringify(amCheck);
-      if (!/ALREADY_MERGED_YES/.test(amOut)) {
-        log("Build already-merged declaration failed verification — " + am.sha + " is not an ancestor of the integration target — marking failed for retry");
-        await agent(
-          "Record already-merged verification failure.\n" +
-          "Run in shell and return the stdout verbatim:\n" + crewCmd("record-phase", {
-            task_id: taskId,
-            session: { id: activeSessionId, task_id: taskId, identity: step.identity, step: step.name, status: "failed",
-              notes: "Build declared repo_diff: none (already-merged: " + am.sha + ") but " + am.sha + " is not an ancestor of the integration target in the configured repo. The declaration is fabricated or mistaken; the work is not on the integration target. Phase failed for retry" },
-            event: { task_id: taskId, type: "failed", message: "Build already-merged declaration failed verification — " + am.sha + " not an ancestor of the integration target, phase failed, dispatcher will retry" }
-          }),
-          { key: "record-already-merged-fail-" + step.name, label: "Recording already-merged verification failure" }
-        );
-        return {
-          __hatchWorkflowControl: "blocked",
-          result: {
-            blocked_reason: "Build already-merged declaration failed verification",
-            message: "The builder declared repo_diff: none (already-merged: " + am.sha + ") but " + am.sha + " is not an ancestor of the integration target. The work is not on the integration target; the phase is marked failed and the dispatcher will retry Build.",
-            task_id: taskId
-          }
-        };
-      }
-      alreadyMergedSha = am.sha;
-      log("Build already-merged declaration verified: " + am.sha + " is an ancestor of the integration target");
-    }
+    // Room #26 blocker 34 (redesign, 2026-09-21): capture the plain
+    // `repo_diff: none` (no repo change) claim from the FULL Build report.
+    // Each Build round sets this fresh from its own report; there is no
+    // cross-process fallback. The agent-authored already-merged
+    // declaration and its Build-closeout verification are deleted —
+    // attribution is the classifier's job at Review entry.
+    buildClaimedNoDiff = /repo_diff:\s*none/im.test(workerText || "");
   }
 
   // Deterministic closeout: no formatter agent. The verdict is mechanical
@@ -1901,9 +2004,23 @@ while (i < STEPS.length) {
   } else {
     summary = (stepResult.summary || "Step completed").slice(0, 2000 - workerMarkers.length - 1) + (workerMarkers ? "\n" + workerMarkers : "");
   }
-  // See docs/decisions/publish-path.md#already-merged: when the Build gate verifies already-merged, attestation is recorded.
-  if (step.name === "Build" && alreadyMergedSha) {
-    summary += "\nalready_merged_verified: " + alreadyMergedSha;
+  // Room #26 blocker 34 (redesign, 2026-09-21): machine-readable review
+  // basis, prepended to Review session notes for observability (proof
+  // rooms read the summary to see what Review examined and why a
+  // reviewer was or was not dispatched).
+  if (step.name === "Review" && branchState) {
+    var reviewBasisNote;
+    if (mechanicalReviewFail) {
+      reviewBasisNote = "REVIEW_BASIS: none — mechanical FAIL (" + mechanicalFailReason + "), no reviewer dispatched";
+    } else if (branchState.indexOf("already-merged:") === 0) {
+      var rbSha = branchState.slice("already-merged:".length);
+      reviewBasisNote = "REVIEW_BASIS: frozen merge " + rbSha + " — reviewed via git diff " + rbSha + "^1 " + rbSha;
+    } else if (branchState === "has-work") {
+      reviewBasisNote = "REVIEW_BASIS: branch diff — reviewed via inspect output (task branch vs integration target)";
+    } else {
+      reviewBasisNote = "REVIEW_BASIS: runtime-state-none — no repo change; plausibility of Build's repo_diff: none claim";
+    }
+    summary = reviewBasisNote + "\n" + summary;
   }
 
   // Capture mapper's spec for Build and Review
@@ -1925,16 +2042,43 @@ while (i < STEPS.length) {
     releaseDecision = extractReleaseDecision(workerText);
   }
 
+  // Room #26 blocker 34 (redesign, 2026-09-21): structured review basis
+  // for the verdict row — what the review actually examined. A mechanical
+  // FAIL has no reviewer and no basis beyond the mechanical fact. Only
+  // computed for Review (branchState is null on other steps).
+  var reviewBasis = null;
+  if (step.name === "Review" && branchState) {
+    reviewBasis =
+      mechanicalReviewFail ? "mechanical-fail" :
+      branchState.indexOf("already-merged:") === 0 ? "frozen-merge:" + branchState.slice("already-merged:".length) :
+      branchState === "has-work" ? "branch-diff" : "runtime-state-none";
+  }
+
   await agent(
     "Update session and log event.\n" +
     "Run in shell and return the stdout verbatim:\n" + crewCmd("record-phase", {
       task_id: taskId,
-      // Room #16 blocker 11: the workflow-verified already-merged sha as
-      // structured control state. Only the Build gate sets alreadyMergedSha
-      // (after the mechanical ancestor check); the API validates the shape
-      // and a later write without the field never clears it (COALESCE).
-      session: { id: activeSessionId, task_id: taskId, identity: step.identity, step: step.name, status: status, notes: summary, already_merged_sha: (step.name === "Build" ? alreadyMergedSha : null) },
-      event: { task_id: taskId, type: status, identity: step.identity, message: step.name + " " + status + " by " + step.identity }
+      // Room #26 blocker 34 (2026-09-21): the already_merged_sha session
+      // field is no longer written — the agent-authored declaration path
+      // is deleted and nothing reads it. Removing the Crew API/database
+      // column is a separate API-surface follow-up, not bundled here.
+      session: { id: activeSessionId, task_id: taskId, identity: step.identity, step: step.name, status: status, notes: summary },
+      event: { task_id: taskId, type: status, identity: step.identity, message: step.name + " " + status + " by " + step.identity },
+      // Room #26 blocker 33: structured, non-lossy Review verdict record.
+      // The session note above is truncated; the verdict row carries the
+      // full worker report as grounds, written in the same transaction.
+      // attempt is the rework round (0 = first Review).
+      verdict: (step.name === "Review" && verdictPassed !== null ? {
+        step: "Review",
+        attempt: reworkCount,
+        // Room #26 blocker 34 (redesign): a mechanical FAIL has no
+        // reviewer — the workflow wrote the verdict. Identity rows still say
+        // the Review step ran.
+        reviewer: mechanicalReviewFail ? "workflow" : step.identity,
+        verdict: verdictPassed ? "PASS" : "FAIL",
+        review_basis: reviewBasis,
+        grounds: workerText
+      } : null)
     }) + "\n",
     {
       key: "record-" + step.name + (reworkCount > 0 ? "-r" + reworkCount : "") + (mapGateBounceCount > 0 ? "-g" + mapGateBounceCount : ""),
@@ -1943,21 +2087,20 @@ while (i < STEPS.length) {
   );
 
   if (!passed && step.name === "Review") {
+    // Room #26 blocker 34 (redesign, 2026-09-21): the false-negative guard,
+    // the Case B budget skip, and the already-merged corrective are all
+    // gone. Emptiness is classified mechanically before Review, so a
+    // rejected Review is never re-adjudicated here — the workflow owns the
+    // git facts, the reviewer owns quality/spec compliance, and the budget
+    // applies uniformly to every rejection. A rejected frozen merge
+    // bounces with the reviewer's notes; a real fix commit becomes
+    // has-work, and a do-nothing loop exhausts the normal budget.
     reworkCount++;
     if (reworkCount > MAX_REWORK) {
       log("Max rework attempts reached for task " + taskId + " — worktree preserved at " + WORKTREE_PRESERVED_HINT + " for manual inspection");
       return await parkTask("Exceeded " + MAX_REWORK + " rework attempts after Review rejection. Worktree preserved.");
     }
     rejectionNotes = summary;
-    // Already-merged corrective (room #16 blocker 11): when Review rejected
-    // an empty branch but the work is already on the integration target (the workflow verified
-    // the sha), Wren must declare it — not re-implement or re-commit
-    // already-landed work. Scoped to the empty-branch rejection; any other
-    // rejection already carries its own specific notes.
-    if (step.name === "Review" && alreadyMergedSha && /no commits ahead of (main|the integration target)/i.test(summary)) {
-      rejectionNotes += "\n\nCORRECTIVE (from the workflow, not the reviewer): the deliverable is already on the integration target — the workflow mechanically verified that " + alreadyMergedSha + " is an ancestor of the integration target. Do NOT re-implement the work and do NOT create a new commit for it. In your Build report, declare exactly: repo_diff: none (already-merged: " + alreadyMergedSha + ") — then end with VERDICT: PASS.";
-      log("Rework corrective appended for task " + taskId + ": already-merged " + alreadyMergedSha + " — Wren must declare, not rebuild");
-    }
     i = BUILD_INDEX;
     log("Review rejected — bouncing to Build (rework #" + reworkCount + ")");
     continue;

package/workflows/crew-dispatch.js

@@ -46,10 +46,43 @@ const MAX_TASKS_PER_POLL = inputs.maxTasksPerPoll || 6;
 
 // Workflow step registry: static per release. The poll cron body reads
 // <crewHome>/workflows/registry.json (generated at release time from the
-// workflow files, which stay the single source of truth) and passes it as
-// inputs.registry. Fall back to the agent() load only when the caller
-// predates the registry — slow, but never broken.
-var registryResult = inputs.registry;
+// workflow files, which stay the single source of truth) and ferries the
+// RAW FILE TEXT as inputs.registryText. The dispatcher parses it
+// deterministically — the poller LLM never parses-and-re-emits a nested
+// object into the tool call. (Room #26: 15+ "schema validation" launch
+// rejections 09-19→09-21 from the LLM garbling the nested object, plus one
+// hallucinated-but-shape-valid registry that silently drove dispatch with
+// wrong step tables.) A string arg is trivially well-formed at the
+// tool-call boundary — the same ferry pattern the board already uses.
+// Fall back to the agent() load only when the caller predates the registry
+// — slow, but never broken.
+function parseRegistryText(text) {
+  if (text === undefined || text === null) {
+    return { ok: false, reason: "registryText is missing" };
+  }
+  if (typeof text !== "string") {
+    return { ok: false, reason: "registryText is not a string" };
+  }
+  try {
+    return { ok: true, registry: JSON.parse(text) };
+  } catch (e) {
+    return { ok: false, reason: "registryText is not valid JSON: " + e.message };
+  }
+}
+var registryResult = null;
+var registryTextResult = parseRegistryText(inputs.registryText);
+if (registryTextResult.ok) {
+  registryResult = registryTextResult.registry;
+} else if (inputs.registryText !== undefined && inputs.registryText !== null) {
+  // Present but unusable: name the defect, then fall through to the slow load.
+  log("WARNING: " + registryTextResult.reason + " — falling back to slow registry load");
+} else if (inputs.registry !== undefined && inputs.registry !== null) {
+  // Legacy: pre-string-ferry poller prompts passed the parsed object.
+  // Same validation applies; a garbled object falls through to the slow
+  // load exactly like a missing one.
+  log("WARNING: legacy inputs.registry object received — prefer the registryText string ferry");
+  registryResult = inputs.registry;
+}
 // Nested-registry seam (2026-09-20): a malformed nested registry object
 // (e.g. a workflow key mapping to null/undefined, or a steps entry without
 // a name) used to die deep in the lookup tables with a cryptic TypeError
@@ -78,6 +111,18 @@ function validateRegistry(reg) {
     if (typeof wf.reworkTarget !== "string") {
       return { ok: false, reason: "workflow '" + wfNames[i] + "' has no reworkTarget string" };
     }
+    // Content pin (room #26): a shape-valid registry can still be
+    // hallucinated — 2026-09-21 a poller ferried docs.reworkTarget="Build"
+    // (docs.js has no Build step) and it passed shape validation, silently
+    // driving dispatch with wrong step tables. The rework target must name
+    // a real step of its own workflow; this invariant is release-independent.
+    var stepNames = {};
+    for (var j = 0; j < wf.steps.length; j++) {
+      stepNames[wf.steps[j].name] = true;
+    }
+    if (!stepNames[wf.reworkTarget]) {
+      return { ok: false, reason: "workflow '" + wfNames[i] + "' reworkTarget '" + wf.reworkTarget + "' names no step" };
+    }
   }
   return { ok: true };
 }
@@ -113,6 +158,14 @@ if (!registryResult) {
       }
     }
   );
+  // The slow agent load is the same untrusted ferry as the args path — a
+  // hallucinated registry would silently drive dispatch with wrong step
+  // tables. Re-run the existing validation on the slow-loaded result and
+  // fail closed with the same reason; there is no second fallback.
+  var slowCheck = validateRegistry(registryResult);
+  if (!slowCheck.ok) {
+    throw new Error("registry slow load failed validation (" + slowCheck.reason + ") — cannot derive step tables; aborting dispatch");
+  }
 }
 
 // Derive lookup tables from canonical definitions