muse-crew 0.14.6 → 0.14.8

package/lib/merge-lock.sh

@@ -19,6 +19,20 @@
 # (or malformed) lease is broken with logging and re-acquired. Every op
 # appends one line to $CREW_HOME/.merge-lock.log (the audit trail).
 #
+# Stale-break atomicity (R-B1, 2026-09-21): the break's read→rm→create is
+# serialized on a sidecar flock ($LOCK_FILE.flock) and the lease is re-read
+# inside the critical section — the old unconditional rm before the noclobber
+# create let two concurrent reclaimers both win. Refresh rewrites via
+# temp-file + atomic rename so a concurrent reader never sees a torn file,
+# and takes the same sidecar flock so a refresh can never clobber a
+# reclaimer's fresh lock in its read→mv gap (2026-09-21): refresh's
+# identity-only re-check closes the clobber because a reclaim always changes
+# task_id. Refresh never checks expiry — a long build that outran the lease
+# legitimately revives its lock here (publish-npm.sh step 5b relies on it).
+# Release (review pass 2, 2026-09-21) takes the same sidecar flock with the
+# identity re-check inside the critical section, so a release can never rm
+# a reclaimer's fresh lock in its read→rm gap.
+#
 # Usage:
 #   merge-lock.sh acquire <task_id> <holder>  — acquire the lock (0 ok, 1 held)
 #   merge-lock.sh refresh <task_id>           — extend the lease (holder task only)
@@ -44,6 +58,7 @@ fi
 
 LOCK_DIR="$CREW_REPO/.worktrees"
 LOCK_FILE="$LOCK_DIR/.merge-lock"
+FLOCK_FILE="$LOCK_FILE.flock"  # sidecar serializing stale-lease breaks (R-B1) and refresh rewrites (2026-09-21)
 LOG_FILE="$CREW_HOME/.merge-lock.log"
 LEASE_SECONDS="${MERGE_LOCK_LEASE_SECONDS:-600}"
 
@@ -127,55 +142,152 @@ case "$cmd" in
       exit 1
     fi
     # Expired or malformed lease — break it (logged) and re-acquire.
+    # R-B1 (2026-09-21): read→rm→create is serialized on the sidecar flock.
+    # The rm used to run before the noclobber create outside any atomic op,
+    # so two concurrent reclaimers could both win: B read the stale lease,
+    # A reclaimed (rm + create, exit 0), B's rm deleted A's fresh lock, and
+    # B's create then succeeded too. The lease is re-read INSIDE the
+    # critical section — a contender may have refreshed, released, or
+    # reclaimed while we waited on the flock.
     echo "STALE: lease for ${lock_task_id:-unknown} (holder ${lock_holder:-unknown}) expired — breaking" >&2
     log_op acquire "task_id=$task_id holder=$holder result=STALE-BREAK previous_task=${lock_task_id:-unknown} previous_holder=${lock_holder:-unknown}"
-    rm -f "$LOCK_FILE"
-    if write_lock "$task_id" "$holder"; then
-      log_op acquire "task_id=$task_id holder=$holder result=ACQUIRED-RECLAIMED previous_task=${lock_task_id:-unknown}"
-      echo "ACQUIRED by $task_id (holder $holder; reclaimed expired lease from ${lock_task_id:-unknown})"
-      exit 0
-    fi
-    # Lost the race: whoever won the create holds it now.
-    read_lock 2>/dev/null || true
-    log_op acquire "task_id=$task_id holder=$holder result=HELD-RACE holder_task=${lock_task_id:-unknown}"
-    echo "HELD by ${lock_task_id:-unknown} (holder ${lock_holder:-unknown}) — lost reclaim race"
-    exit 1
+    stale_task="${lock_task_id:-unknown}"
+    mkdir -p "$LOCK_DIR"
+    # Subshell exit codes: 0 reclaimed; 10 the re-read found a live lease;
+    # 11 lost the noclobber create to a fresh acquirer racing the break.
+    reclaim_code=0
+    (
+      exec 200>"$FLOCK_FILE"
+      flock -x 200
+      if read_lock; then
+        recheck="$(lock_remaining)"
+        if [ "$recheck" != "unknown" ] && [ "$recheck" -gt 0 ]; then
+          exit 10
+        fi
+      fi
+      rm -f "$LOCK_FILE"
+      if write_lock "$task_id" "$holder"; then
+        exit 0
+      else
+        exit 11
+      fi
+    ) || reclaim_code=$?
+    case "$reclaim_code" in
+      0)
+        log_op acquire "task_id=$task_id holder=$holder result=ACQUIRED-RECLAIMED previous_task=$stale_task"
+        echo "ACQUIRED by $task_id (holder $holder; reclaimed expired lease from $stale_task)"
+        exit 0
+        ;;
+      10)
+        # Re-read found a live lease inside the critical section: another
+        # contender refreshed or reclaimed while we waited on the flock.
+        read_lock 2>/dev/null || true
+        if [ -n "$lock_task_id" ]; then
+          live_remaining="$(lock_remaining)"
+          log_op acquire "task_id=$task_id holder=$holder result=HELD-RECHECK holder_task=$lock_task_id holder_id=$lock_holder remaining=${live_remaining}s"
+          echo "HELD by $lock_task_id (holder $lock_holder, ${live_remaining}s of lease remaining)"
+        else
+          log_op acquire "task_id=$task_id holder=$holder result=HELD-RECHECK holder_task=unknown"
+          echo "HELD — lost the reclaim race to another contender"
+        fi
+        exit 1
+        ;;
+      *)
+        # Lost the noclobber create to a fresh acquirer racing the break:
+        # whoever won the create holds the lock now.
+        read_lock 2>/dev/null || true
+        log_op acquire "task_id=$task_id holder=$holder result=HELD-RACE holder_task=${lock_task_id:-unknown}"
+        echo "HELD by ${lock_task_id:-unknown} (holder ${lock_holder:-unknown}) — lost reclaim race"
+        exit 1
+        ;;
+    esac
     ;;
   refresh)
     [ -z "$task_id" ] && { echo "ERROR: task_id required"; exit 1; }
-    if ! read_lock; then
-      log_op refresh "task_id=$task_id result=NO-LOCK"
-      echo "ERROR: no lock to refresh"
-      exit 1
-    fi
-    if [ "$lock_task_id" != "$task_id" ]; then
-      log_op refresh "task_id=$task_id result=NOT-HOLDER holder_task=$lock_task_id"
-      echo "ERROR: lock held by $lock_task_id, not $task_id"
-      exit 1
-    fi
-    # Extend the lease: acquired_at=now, holder and lease window unchanged.
-    printf 'task_id=%s\nholder=%s\nacquired_at=%s\nlease_seconds=%s\n' \
-      "$lock_task_id" "$lock_holder" "$(date +%s)" "${lock_lease_seconds:-$LEASE_SECONDS}" > "$LOCK_FILE"
-    log_op refresh "task_id=$task_id holder=$lock_holder result=REFRESHED"
-    echo "REFRESHED by $task_id (holder $lock_holder)"
-    exit 0
+    # 2026-09-21: read→identity-check→rewrite is serialized on the sidecar
+    # flock against acquire's reclaim — a holder refreshing after lease
+    # expiry could otherwise clobber a reclaimer's fresh lock inside the
+    # read→mv gap. The re-check inside the critical section is IDENTITY-ONLY:
+    # a reclaim always changes task_id, so identity alone closes the clobber.
+    # There is deliberately NO expiry fail-closed check — a long build that
+    # outran the lease legitimately revives its lock here (publish-npm.sh
+    # step 5b and the workflow Publish prompt rely on it). Fail closed (exit
+    # 1) only if identity no longer matches.
+    refresh_code=0
+    (
+      exec 200>"$FLOCK_FILE"
+      flock -x 200
+      if ! read_lock; then
+        log_op refresh "task_id=$task_id result=NO-LOCK"
+        echo "ERROR: no lock to refresh"
+        exit 1
+      fi
+      if [ "$lock_task_id" != "$task_id" ]; then
+        log_op refresh "task_id=$task_id result=NOT-HOLDER holder_task=$lock_task_id"
+        echo "ERROR: lock held by $lock_task_id, not $task_id"
+        exit 1
+      fi
+      # Extend the lease: acquired_at=now, holder and lease window unchanged.
+      # Write-temp + atomic rename (2026-09-21): a truncating rewrite lets a
+      # concurrent reader observe a torn (partially written) file and misread
+      # the lease as malformed — funneling it spuriously into the reclaim path.
+      tmp_lock="$(mktemp "$LOCK_DIR/.merge-lock.tmp.XXXXXX")" \
+        || { echo "ERROR: cannot stage lock refresh"; exit 1; }
+      printf 'task_id=%s\nholder=%s\nacquired_at=%s\nlease_seconds=%s\n' \
+        "$lock_task_id" "$lock_holder" "$(date +%s)" "${lock_lease_seconds:-$LEASE_SECONDS}" > "$tmp_lock"
+      mv -f "$tmp_lock" "$LOCK_FILE"
+      log_op refresh "task_id=$task_id holder=$lock_holder result=REFRESHED"
+      echo "REFRESHED by $task_id (holder $lock_holder)"
+      exit 0
+    ) || refresh_code=$?
+    exit "$refresh_code"
     ;;
   release)
     [ -z "$task_id" ] && { echo "ERROR: task_id required"; exit 1; }
-    if ! read_lock; then
-      log_op release "task_id=$task_id result=NOT-LOCKED"
-      echo "RELEASED (was not locked)"
-      exit 0
-    fi
-    if [ "$lock_task_id" = "$task_id" ]; then
-      rm -f "$LOCK_FILE"
-      log_op release "task_id=$task_id holder=$lock_holder result=RELEASED"
-      echo "RELEASED by $task_id"
-      exit 0
-    fi
-    log_op release "task_id=$task_id result=NOT-HOLDER holder_task=$lock_task_id"
-    echo "ERROR: lock held by $lock_task_id, not $task_id"
-    exit 1
+    # 2026-09-21 (review pass 2): read→identity-check→rm is serialized on the
+    # sidecar flock — the same double-hold race class as R-B1 is reachable
+    # here: releaser reads, reclaimer breaks and creates, releaser's rm then
+    # deletes the reclaimer's fresh lock. The identity re-check runs INSIDE
+    # the critical section.
+    release_code=0
+    # The identity check and rm run in a subshell, so the holder name is
+    # ferried out on stdout (subshell variables never reach the parent).
+    release_out="$(
+      (
+        exec 200>"$FLOCK_FILE"
+        flock -x 200
+        if ! read_lock; then
+          exit 10
+        fi
+        if [ "$lock_task_id" != "$task_id" ]; then
+          exit 11
+        fi
+        printf 'holder=%s\n' "$lock_holder"
+        rm -f "$LOCK_FILE"
+        exit 0
+      )
+    )" || release_code=$?
+    release_holder="${release_out#holder=}"
+    case "$release_code" in
+      0)
+        log_op release "task_id=$task_id holder=$release_holder result=RELEASED"
+        echo "RELEASED by $task_id"
+        exit 0
+        ;;
+      10)
+        log_op release "task_id=$task_id result=NOT-LOCKED"
+        echo "RELEASED (was not locked)"
+        exit 0
+        ;;
+      *)
+        # Re-read inside the critical section: identity checked against the
+        # lock as it stands now, not as it stood before the flock.
+        read_lock 2>/dev/null || true
+        log_op release "task_id=$task_id result=NOT-HOLDER holder_task=${lock_task_id:-unknown}"
+        echo "ERROR: lock held by ${lock_task_id:-unknown}, not $task_id"
+        exit 1
+        ;;
+    esac
     ;;
   status)
     if ! read_lock; then

package/lib/qa-db.js

@@ -0,0 +1,132 @@
+// qa-db.js — fresh per-run QA database for the local artifact server.
+//
+// Import-safe: no side effects on import. `node qa-db.js` with no args exits
+// 0 (the release entry gate executes bare non-CLI lib modules).
+//
+// `openQaDb(spaceDir)` opens a drizzle db over a FRESH per-run SQLite
+// database, migrated from the space's own `drizzle/` migrations in journal
+// order — the same migration path a fresh production install takes — and
+// never a copy of the shipped app.db. The database file lives in a per-run
+// temp dir, so the server stays read-only w.r.t. the space directory and QA
+// writes can never contaminate production data (the B38 contamination
+// class: audit sessions writing verification data into the live artifact's
+// production DB).
+//
+// Driver: drizzle-orm/sqlite-proxy resolved from the space's own
+// node_modules (so the driver matches the artifact's drizzle version), over
+// node:sqlite (built-in). Zero extra dependencies in the crew release.
+//
+// Proxy contract, verified mechanically against drizzle-orm 0.45.2's
+// COMPILED runtime (sqlite-proxy/driver.js, sqlite-proxy/session.js,
+// utils.js — not just the .d.ts):
+//   - utils.js mapResultRow(columns, row, ...) reads row[columnIndex]:
+//     rows must be POSITIONAL value arrays in SQL column order. The proxy
+//     prepares with { returnArrays: true }, so node:sqlite returns rows
+//     as positional arrays — duplicate column names (self-joins, t.*,
+//     joins of overlapping schemas) survive by ordinal. The object-keyed
+//     default would silently collapse them.
+//   - session.js get(): mapGetResult(clientResult.rows) — a miss must be
+//     FALSY rows (returns undefined); a hit must be the single row as a
+//     positional array (it is NOT wrapped — mapGetResult treats rows as the
+//     row itself).
+//   - session.js all()/values(): { rows } is destructured and .map'ed, so
+//     rows must be an array of positional arrays.
+//   - session.js run(): the callback's return is handed to the caller; the
+//     declared type is Promise<{rows: any[]}> — {rows: []} is the honest
+//     empty shape.
+//   - session.js batch(): batchResults.map((result, i) =>
+//     preparedQueries[i].mapResult(result, true)) — each item must be one
+//     per-query {rows} object in order; mapResult with isFromBatch unwraps
+//     rows.rows before the same get/all mapping above.
+//   - driver.js drizzle(callback, batchCallback?, config?): the second
+//     positional arg is the batch callback when it is a function.
+
+import { DatabaseSync } from "node:sqlite";
+import { createRequire } from "node:module";
+import { pathToFileURL } from "node:url";
+import { join } from "node:path";
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { mkdtemp } from "node:fs/promises";
+import { tmpdir } from "node:os";
+
+// sqlite-proxy callback over a node:sqlite DatabaseSync. See the contract
+// note at the top of this file.
+export function sqliteProxyCallback(sqlite) {
+  const one = async (sql, params, method) => {
+    // node:sqlite Statements have no close(); the DatabaseSync owns them
+    // and they are reclaimed with it.
+    // returnArrays: rows come back as POSITIONAL value arrays, so
+    // duplicate column names (self-joins, t.*, joins of overlapping
+    // schemas) survive by ordinal. The object-keyed default would
+    // silently collapse them — Object.values() would drop the earlier
+    // columns entirely.
+    const stmt = sqlite.prepare(sql, { returnArrays: true });
+    if (method === "run") {
+      stmt.run(...params);
+      return { rows: [] };
+    }
+    if (method === "all" || method === "values") {
+      return { rows: stmt.all(...params) };
+    }
+    if (method === "get") {
+      const row = stmt.get(...params);
+      return row === undefined ? { rows: undefined } : { rows: row };
+    }
+    throw new Error("sqlite-proxy: unknown method " + method);
+  };
+  return one;
+}
+
+// Fresh per-run QA database for spaceDir. Resolves to
+// { db, close } — db is the drizzle instance handed to ctx.db(); close()
+// releases the sqlite handle (best effort on kill). Throws with a clear
+// reason when the space has no drizzle migrations or drizzle-orm cannot be
+// resolved from its node_modules; callers degrade gracefully (the server
+// still boots, ctx.db throws the reason when called).
+export async function openQaDb(spaceDir) {
+  const drizzleDir = join(spaceDir, "drizzle");
+  const journalPath = join(drizzleDir, "meta", "_journal.json");
+  if (!existsSync(journalPath)) {
+    throw new Error("no drizzle migrations at " + journalPath);
+  }
+  const journal = JSON.parse(await readFile(journalPath, "utf8"));
+  const entries = [...(journal.entries || [])].sort((a, b) => a.idx - b.idx);
+  if (entries.length === 0) {
+    throw new Error("empty drizzle journal at " + journalPath);
+  }
+  // Per-run temp dir — never the space dir, never the shipped app.db.
+  const dbDir = await mkdtemp(join(tmpdir(), "serve-artifact-db-"));
+  const sqlite = new DatabaseSync(join(dbDir, "qa.db"));
+  try {
+    sqlite.exec("PRAGMA foreign_keys = ON;");
+    for (const entry of entries) {
+      const sqlPath = join(drizzleDir, entry.tag + ".sql");
+      sqlite.exec(await readFile(sqlPath, "utf8"));
+    }
+  } catch (err) {
+    try { sqlite.close(); } catch { /* best effort */ }
+    throw new Error("migration failed: " + String((err && err.message) || err).slice(0, 200));
+  }
+  // drizzle-orm/sqlite-proxy resolved from the space's own node_modules, so
+  // the driver matches the artifact's drizzle version.
+  let db;
+  try {
+    const spaceRequire = createRequire(join(spaceDir, "package.json"));
+    const proxyEntry = spaceRequire.resolve("drizzle-orm/sqlite-proxy");
+    const { drizzle } = await import(pathToFileURL(proxyEntry).href);
+    const one = sqliteProxyCallback(sqlite);
+    db = drizzle(one, async (items) => {
+      const out = [];
+      for (const item of items) out.push(await one(item.sql, item.params, item.method));
+      return out;
+    });
+  } catch (err) {
+    try { sqlite.close(); } catch { /* best effort */ }
+    throw new Error("cannot build drizzle db: " + String((err && err.message) || err).slice(0, 200));
+  }
+  return {
+    db,
+    close() { try { sqlite.close(); } catch { /* best effort on kill */ } },
+  };
+}

package/lib/schema.sql

@@ -64,6 +64,17 @@ CREATE TABLE IF NOT EXISTS tasks (
   deps           TEXT NOT NULL DEFAULT '[]',
   filed_by       TEXT,
   retry_reset_at TEXT,
+  -- Cascade-park attribution (room #26 blocker 36, 2026-09-21). When a task
+  -- parks, its todo dependents cascade-park with structured attribution on
+  -- the existing 'parked' state — never a new state, never silent todo,
+  -- never auto-waived. park_reason is a closed single-column CHECK
+  -- ('dep_parked' only); park_dep_id names the parked dep. NULL on both =
+  -- ordinary park (human hold). The pairing invariant (reason<->dep)
+  -- cannot be a schema CHECK — SQLite forbids cross-column CHECKs on
+  -- ADD COLUMN — so it is enforced by crew-api.js, the single writer of
+  -- these columns.
+  park_reason    TEXT CHECK (park_reason IS NULL OR park_reason = 'dep_parked'),
+  park_dep_id    TEXT,
   created_at     TEXT NOT NULL,
   updated_at     TEXT NOT NULL
 );
@@ -108,6 +119,45 @@ CREATE TABLE IF NOT EXISTS agent_sessions (
     (already_merged_sha NOT GLOB '*[^0-9a-f]*' AND length(already_merged_sha) BETWEEN 7 AND 40))
 );
 
+-- Room #26 blocker 33 (2026-09-21): structured, non-lossy verdict records.
+-- Review verdict grounds were destroyed by the 2000-char session-note
+-- truncation (the workflow slices the worker report before record-phase
+-- writes it as notes) — a park on a verified-correct implementation was
+-- unauditable because the grounds past char 2000 existed nowhere. The fib:
+-- "the review notes are the review record." The notes are lossy by design
+-- (downstream consumers read them: rejectionNotes, the QA backstop, the
+-- dashboard); this table is the lossless record. record-phase optionally
+-- carries the full grounds and writes the row in the same transaction as
+-- the session note, so the record can never be missing when the note
+-- exists. `summary` is the truncated note actually recorded (provenance of
+-- what the lossy path carried); `grounds` is the full worker report,
+-- uncapped. One verdict per recording session: a re-recorded phase for the
+-- same session is the same evidence, so the first write wins (ON CONFLICT
+-- DO NOTHING) and rows are never revised. A new Review execution claims a
+-- new session, so rework rounds and dispatcher retries each get their own
+-- row, ordered by created_at.
+-- `verdict` is the machine-extracted verdict; INDETERMINATE is the
+-- fail-closed extraction failure (re-ask exhausted) — the grounds are still
+-- preserved even though no verdict could be read.
+CREATE TABLE IF NOT EXISTS verdicts (
+  id         TEXT PRIMARY KEY,
+  task_id    TEXT NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
+  step       TEXT NOT NULL,
+  attempt    INTEGER NOT NULL CHECK (attempt >= 0),
+  reviewer   TEXT NOT NULL,
+  verdict    TEXT NOT NULL CHECK (verdict IN ('PASS', 'FAIL', 'INDETERMINATE')),
+  grounds    TEXT NOT NULL,
+  summary    TEXT NOT NULL,
+  -- Room #26 blocker 34 (redesign): what the review actually examined —
+  -- mechanical-fail | branch-diff | runtime-state-none | frozen-merge:<sha>.
+  -- NULL = not a classified review (e.g. docs.js path, legacy rows).
+  review_basis TEXT,
+  session_id TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  UNIQUE(session_id)
+);
+CREATE INDEX IF NOT EXISTS idx_verdicts_task ON verdicts(task_id);
+
 CREATE TABLE IF NOT EXISTS events (
   id        TEXT PRIMARY KEY,
   type      TEXT NOT NULL CHECK (type IN

package/lib/serve-artifact.js

@@ -14,9 +14,17 @@
 //
 // Fidelity notes (what this is and isn't):
 // - The served client and action handlers are the artifact's own built code.
-// - The Ctx is locally built: privileged handlers run from the space's own
+// - The Ctx is locally built: ctx.db is a drizzle db over a fresh per-run
+//   SQLite database, migrated from the space's own drizzle/ migrations (the
+//   same migration path a fresh production install takes) — never the
+//   shipped app.db, so the server stays read-only w.r.t. the space
+//   directory and QA writes can never contaminate production data;
+//   privileged handlers run from the space's own
 //   server/dist/privileged.js when present; blobs are stored in a per-run
-//   temp dir and served back at /__blobs/<key>.
+//   temp dir and served back at /__blobs/<key>. When the space has no
+//   drizzle migrations (or drizzle-orm can't be resolved from its
+//   node_modules), the server still boots and ctx.db throws a clear error
+//   when called.
 // - Environment (CREW_HOME and friends) is inherited from the caller — export
 //   what the artifact's server needs before starting this.
 //
@@ -27,6 +35,7 @@ import { join, normalize, dirname, sep } from "node:path";
 import { existsSync } from "node:fs";
 import { readFile, writeFile, mkdir, mkdtemp } from "node:fs/promises";
 import { tmpdir } from "node:os";
+import { openQaDb } from "./qa-db.js";
 
 function parseArgs(argv) {
   const out = { spaceDir: null, port: 0, tag: null };
@@ -85,6 +94,23 @@ async function main() {
     privilegedByName = new Map(privilegedHandlers.entries.map((e) => [e.contract.name, e.handler]));
   }
 
+  // ctx.db: best-effort. A space with drizzle/ migrations gets a working db
+  // (fresh per-run, migrated from the space's own migrations — the harness
+  // can finally drive db-backed success paths); anything else still boots
+  // and ctx.db throws a clear error when called, instead of 500ing as
+  // "not a function".
+  let dbAccessor;
+  let qaHandle = null;
+  try {
+    const qa = await openQaDb(args.spaceDir);
+    dbAccessor = () => qa.db;
+    qaHandle = qa;
+  } catch (err) {
+    const reason = String((err && err.message) || err);
+    process.stderr.write("serve-artifact.js: ctx.db unavailable: " + reason.slice(0, 200) + "\n");
+    dbAccessor = () => { throw new Error("ctx.db is not available in the local QA server: " + reason); };
+  }
+
   // Local blob store (outside the space dir — the server stays read-only
   // w.r.t. the space). Keys are path-safe segments; anything else is rejected.
   const BLOB_DIR = await mkdtemp(join(tmpdir(), "serve-artifact-blobs-"));
@@ -100,6 +126,7 @@ async function main() {
   function makeCtx(def) {
     const declared = new Set(((def && def.privileged) || []).map((c) => c.name));
     return {
+      db: dbAccessor,
       async executePrivileged(contract, actionArgs) {
         if (!contract || typeof contract.name !== "string") throw new Error("executePrivileged: bad contract descriptor");
         if (!declared.has(contract.name)) throw new Error("executePrivileged(" + contract.name + ") was not declared by this action");
@@ -201,6 +228,23 @@ async function main() {
   server.listen(args.port, "127.0.0.1", () => {
     process.stdout.write("READY port=" + server.address().port + "\n");
   });
+
+  // Graceful shutdown: SIGTERM/SIGINT close the listener and the QA db, then
+  // exit. (An earlier revision only closed the db on signal — the process
+  // ignored termination and leaked. Caught by tests/serve-artifact-db.test.js.)
+  let shuttingDown = false;
+  for (const sig of ["SIGTERM", "SIGINT"]) {
+    process.on(sig, () => {
+      if (shuttingDown) return;
+      shuttingDown = true;
+      const finish = () => {
+        try { if (qaHandle) qaHandle.close(); } catch {}
+        process.exit(0);
+      };
+      server.close(finish);
+      setTimeout(finish, 1500).unref();
+    });
+  }
 }
 
 main().catch((e) => {

package/lib/test-detached-integrate.sh

@@ -50,6 +50,18 @@
 #   crash): re-running integrate takes the lock and pushes instead of
 #   parking on MERGED_EMPTY.
 #
+# Fixture F3 (stale-record recovery — blocker 35, 2026-09-21): rework moved
+#   the task branch backward after the merge was recorded, so the recorded
+#   merge carries abandoned work. Re-running integrate must fail closed
+#   with STALE_MERGE — never push the stale state, never fall through to
+#   MERGED_EMPTY (an unpushed merge sits on the line).
+#
+# Fixture I (push-target identity — blocker 35, 2026-09-21): the
+#   ERROR-after-MERGED retry path. I1: stale record → STALE_MERGE and the
+#   remote ref does not move. I2: branch restored to the merged tip → the
+#   legitimate retry still PUSHEDs. I3: the manual R5 shape (stale record
+#   plus a newer manual merge of the current tip on the line) → PUSHEDs.
+#
 # Fixture H (detached HEAD with an origin — 2026-09-19 detached-HEAD audit
 # REDO): H1 proves push-destination fails closed when origin/HEAD is unset
 # (genuinely unknowable destination); H2-H5 prove the detached line pushes
@@ -327,6 +339,116 @@ echo "$out" | grep -q '^MERGED_EMPTY' && fail "F2: wrongly MERGED_EMPTY while th
 
 echo "fixture F (merged-but-unpushed recovery): all checks passed"
 
+# ---------------- Fixture F3: stale record — branch moved after the merge ----------------
+# (blocker 35, room #26 J3, 2026-09-21): rework moved the task branch
+# BACKWARD after the merge was recorded (the recorded merge now carries
+# abandoned work). The recovery must NOT push the stale recorded state
+# labeled as the deliverable — STALE_MERGE fails closed, and it must not
+# fall through to MERGED_EMPTY either (an unpushed merge sits on the
+# line; MERGED_EMPTY would report PASS while a later publish diff would
+# still carry the abandoned work).
+# Reuse fixture D's repo (no remote): new task, merge, then reset the
+# branch to its pre-work base.
+cd "$D_DIR"
+export CREW_REPO="$D_DIR"
+export CREW_HOME="$T/home-d"
+tid="stale1"
+# Fixture F2's integrate left noremote1's lock held — release it so this
+# task's integrate doesn't back off on a foreign holder.
+"$REPO_DIR/lib/merge-lock.sh" release "noremote1" >/dev/null 2>&1 || fail "F3: lock release failed"
+out=$(bash "$LIFECYCLE" prepare "$tid") || fail "F3 prepare failed: $out"
+BRANCH=$(bash "$LIFECYCLE" resolve-branch "$tid") || fail "F3 resolve-branch failed"
+F3_BASE=$(git rev-parse "$BRANCH")
+echo work >> "$D_DIR/.worktrees/$tid/f.txt"
+(cd "$D_DIR/.worktrees/$tid" && git commit -qam "work w1")
+F3_W1=$(git rev-parse "$BRANCH")
+git worktree remove --force "$D_DIR/.worktrees/$tid" || fail "F3: worktree remove failed"
+out=$(bash "$LIFECYCLE" integrate "$tid" "merge: $tid" 2>&1) || fail "F3 integrate failed: $out"
+echo "$out" | grep -q '^MERGED:' || fail "F3: expected MERGED, got: $out"
+F3_M1=$(git rev-parse HEAD)
+# Rework abandons w1: the branch goes back to its pre-work base.
+git branch -q -f "$BRANCH" "$F3_BASE" || fail "F3: branch reset failed"
+[ "$(git rev-parse "$BRANCH")" = "$F3_BASE" ] || fail "F3: branch not reset"
+"$REPO_DIR/lib/merge-lock.sh" release "$tid" >/dev/null 2>&1 || fail "F3: lock release failed"
+out=$(bash "$LIFECYCLE" integrate "$tid" "merge: $tid" 2>&1) && \
+  fail "F3: integrate with a stale record should fail, got: $out"
+echo "$out" | grep -q '^STALE_MERGE' || fail "F3: expected STALE_MERGE, got: $out"
+echo "$out" | grep -q '^MERGED_EMPTY' && fail "F3: fell through to MERGED_EMPTY on a stale record: $out"
+echo "$out" | grep -q 'recovered:' && fail "F3: recovered a stale merge: $out"
+[ "$(git rev-parse HEAD)" = "$F3_M1" ] || fail "F3: HEAD moved during STALE_MERGE"
+echo "fixture F3 (stale record fails closed on re-integrate): all checks passed"
+
+# ---------------- Fixture I: branch + origin — stale push-target and the R5-manual shape ----------------
+# (blocker 35): the ERROR-after-MERGED retry path (push-target) pushed live
+# HEAD with no check. I1: stale record → STALE_MERGE, the remote ref does
+# not move. I2: branch restored to the merged tip → the legitimate retry
+# still PUSHEDs (identity check is not a refusal policy). I3: the manual
+# R5 shape (stale record + a newer manual merge of the CURRENT tip on the
+# line) → PUSHEDs — the identity check must not strand a good line.
+I_DIR="$T/fixture-i"
+I_REMOTE="$T/remote-i.git"
+git init -q --bare "$I_REMOTE"
+mkdir -p "$I_DIR"
+cd "$I_DIR"
+git init -q -b main .
+git config user.email test@test.t
+git config user.name test
+echo base > f.txt
+git add -A
+git commit -qm "base"
+git remote add origin "$I_REMOTE"
+git push -q origin main
+git symbolic-ref refs/remotes/origin/HEAD refs/remotes/origin/main
+export CREW_REPO="$I_DIR"
+export CREW_HOME="$I_DIR/home"
+export CREW_LIB="$REPO_DIR/lib"
+tid="staleorigin1"
+out=$(bash "$LIFECYCLE" prepare "$tid") || fail "I prepare failed: $out"
+BRANCH=$(bash "$LIFECYCLE" resolve-branch "$tid") || fail "I resolve-branch failed"
+I_BASE=$(git rev-parse "$BRANCH")
+echo work >> "$I_DIR/.worktrees/$tid/f.txt"
+(cd "$I_DIR/.worktrees/$tid" && git commit -qam "work w1")
+I_W1=$(git rev-parse "$BRANCH")
+git worktree remove --force "$I_DIR/.worktrees/$tid" || fail "I: worktree remove failed"
+out=$(bash "$LIFECYCLE" integrate "$tid" "merge: $tid" 2>&1) || fail "I integrate failed: $out"
+echo "$out" | grep -q '^MERGED:' || fail "I: expected MERGED, got: $out"
+echo "$out" | grep -q '^PUSHED: origin/main' || fail "I: expected inline PUSHED, got: $out"
+I_M1=$(git rev-parse HEAD)
+[ "$(git --git-dir="$I_REMOTE" rev-parse refs/heads/main)" = "$I_M1" ] || fail "I: remote not at M1"
+
+# I1: rework abandons w1 (branch back to base); push-target must refuse.
+git branch -q -f "$BRANCH" "$I_BASE" || fail "I1: branch reset failed"
+out=$(bash "$LIFECYCLE" push-target "$tid" 2>&1) && \
+  fail "I1: push-target with a stale record should fail, got: $out"
+echo "$out" | grep -q '^STALE_MERGE' || fail "I1: expected STALE_MERGE, got: $out"
+[ "$(git --git-dir="$I_REMOTE" rev-parse refs/heads/main)" = "$I_M1" ] || \
+  fail "I1: remote moved despite STALE_MERGE"
+echo "fixture I1 (stale push-target fails closed): passed"
+
+# I2: branch restored to the merged tip — the legitimate retry pushes.
+git branch -q -f "$BRANCH" "$I_W1" || fail "I2: branch restore failed"
+out=$(bash "$LIFECYCLE" push-target "$tid" 2>&1) || fail "I2 push-target failed: $out"
+echo "$out" | grep -q '^PUSH_IDENTITY_OK' || fail "I2: expected PUSH_IDENTITY_OK, got: $out"
+echo "$out" | grep -q '^PUSHED: origin/main' || fail "I2: expected PUSHED, got: $out"
+echo "fixture I2 (legitimate retry still pushes): passed"
+
+# I3: the manual R5 shape — stale record M1, but the line carries a newer
+# manual merge of the CURRENT tip w2. push-target must PUSH (no regression).
+echo work2 >> "$I_DIR/.worktrees/$tid/f.txt"
+(cd "$I_DIR/.worktrees/$tid" && git commit -qam "work w2")
+I_W2=$(git rev-parse "$BRANCH")
+git merge -q --no-ff "$BRANCH" -m "manual r5 merge" || fail "I3: manual merge failed"
+I_R=$(git rev-parse HEAD)
+[ "$(git rev-list --parents -n 1 "$I_R" | awk '{print $3}')" = "$I_W2" ] || \
+  fail "I3: manual merge ^2 is not the branch tip"
+out=$(bash "$LIFECYCLE" push-target "$tid" 2>&1) || fail "I3 push-target failed: $out"
+echo "$out" | grep -q '^PUSHED: origin/main' || fail "I3: expected PUSHED for the R5-manual shape, got: $out"
+[ "$(git --git-dir="$I_REMOTE" rev-parse refs/heads/main)" = "$I_R" ] || \
+  fail "I3: remote not at the manual merge"
+echo "fixture I3 (R5-manual shape still pushes): passed"
+
+echo "fixture I (stale push-target identity): all checks passed"
+
 # ---------------- Fixture G: push-target after MERGED_EMPTY ----------------
 # (2026-09-19 REVIEW #8: MERGED_EMPTY takes no lock and writes no record —
 # push-target must skip loudly, not report a misleading "lock lost".)