muse-crew 0.14.6 → 0.14.8

package/workflows/chore.js

@@ -101,6 +101,13 @@ async function telemetryFlush() {
 }
 async function telemetryEnd(status) {
   if (!telemetryRunId) return;
+  // Room #26 blocker 37: record-run-end rejects any status outside the
+  // schema CHECK — and this function swallowed that throw as "non-fatal",
+  // leaving the run row 'running' forever. An invalid status is a
+  // programmer error: fail loud. Transport errors stay non-fatal.
+  if (!["completed", "failed", "parked", "timed_out"].includes(status)) {
+    throw new Error("telemetryEnd: invalid status " + JSON.stringify(status) + " — must be completed|failed|parked|timed_out");
+  }
   // Flush any buffered events before recording the end.
   await telemetryFlush();
   try {
@@ -315,6 +322,142 @@ function buildTransportRetryTrailer(stepName, repoPath, taskId, attempt, reason)
     "if the " + stepName + " work is already complete, report on what was done rather than duplicating side effects. " +
     "Then return your report as JSON in exactly the shape specified above.";
 }
+// parseClassifyFerry — room #26 blocker 42 (2026-09-21). Shape-constrained
+// ferry parser for the classify-branch agent() call. The schema buys SHAPE,
+// not provenance: the fields are LLM-authored, so the parser stays
+// defensive. Byte-identical across standard.js, bugfix.js, chore.js
+// (pinned by tests/already-merged.test.js). Triplication is structural:
+// each workflow ships as a standalone launch payload (240 KiB budget,
+// individually git-archived) — there is no shared module to hold it.
+// The schema is the guard; the prompt is instruction, never load-bearing.
+// Returns { state, diagField, diagText, failReason }:
+//   state: "has-work" | "already-merged:<40-hex>" | "empty-no-work" | null
+//     (null = unparseable/ambiguous/channel violation — UNKNOWN)
+//   diagField: "stderr" | "stdout" | null (which field sourced the DIAG pin)
+//   diagText: the matched DIAG line, or ""
+//   failReason: computed reason, for the retry trailer and the park note
+function parseClassifyFerry(bsResult) {
+  var bsStdout = (bsResult && typeof bsResult.stdout === "string") ? bsResult.stdout : null;
+  var bsStderr = (bsResult && typeof bsResult.stderr === "string") ? bsResult.stderr : null;
+  if (bsStdout === null || bsStderr === null) {
+    return { state: null, diagField: null, diagText: "",
+      failReason: "classifier return fields missing or non-string (stdout and stderr must both be strings)" };
+  }
+  // State channel: stdout ONLY. A BRANCH_STATE match on stderr is never
+  // trusted — workers merge streams constantly, and trusting a channel
+  // swap as truth is the wrong shape. Search, never anchor (blocker 11):
+  // the ferry labels output ("stdout: BRANCH_STATE: has-work"). Collect
+  // ALL matches and dedupe normalized values: exactly one distinct value
+  // is truth; zero or two-or-more is UNKNOWN — alternation order never
+  // adjudicates.
+  var bsRe = /\bBRANCH_STATE:\s*(has-work|already-merged:[0-9a-f]{40}|empty-no-work)(?![\w-])/gi;
+  var bsSeen = {};
+  var bsM;
+  while ((bsM = bsRe.exec(bsStdout)) !== null) {
+    bsSeen[bsM[1].toLowerCase()] = true;
+  }
+  var bsStates = Object.keys(bsSeen);
+  if (bsStates.length !== 1) {
+    return { state: null, diagField: null, diagText: "",
+      failReason: bsStates.length === 0
+        ? "no BRANCH_STATE match in the stdout field"
+        : "ambiguous BRANCH_STATE values in stdout (" + bsStates.length + " distinct)" };
+  }
+  var bsState = bsStates[0];
+  // DIAG pin: search both fields, stderr first. Keep the DIAG: prefix — a
+  // prose mention without it must not satisfy the pin.
+  var bsDiagRe = /DIAG:\s*classify-branch\s+records=\d+\s+resolvable=\d+/;
+  var bsDiagField = bsDiagRe.test(bsStderr) ? "stderr" : (bsDiagRe.test(bsStdout) ? "stdout" : null);
+  var bsDiagText = "";
+  if (bsDiagField !== null) {
+    bsDiagText = bsDiagRe.exec(bsDiagField === "stderr" ? bsStderr : bsStdout)[0];
+  }
+  if (bsState.indexOf("already-merged:") === 0 && bsDiagField === null) {
+    // already-merged's sha flows into Cass's `git diff <sha>^1 <sha>` — a
+    // hallucinated-but-well-formed sha is a false-PASS vector. The script
+    // emits exactly one DIAG on every path that emits a BRANCH_STATE, so a
+    // missing pin means stderr wasn't faithfully ferried: UNKNOWN.
+    // Residual risk, named (blocker-42 fib 4): a worker could fabricate
+    // BOTH fields wholesale — the pin is a tripwire, not proof of
+    // execution. The workflow has no exec channel for a deterministic
+    // cross-check; if the platform ever offers one, verify the sha
+    // against the task's durable merge records directly.
+    return { state: null, diagField: null, diagText: "",
+      failReason: "already-merged without the DIAG pin — stderr not faithfully ferried" };
+  }
+  return { state: bsState, diagField: bsDiagField, diagText: bsDiagText, failReason: "" };
+}
+
+// classifyRetryTrailer — room #26 blocker 42 (2026-09-21). Corrective (not
+// flat) trailer for the in-place classify retries. The failure mode was
+// systematic labeling, not a coin flip: the trailer carries the COMPUTED
+// parse-failure reason, the failed return truncated as a negative example,
+// and the explicit field mapping — feedback from the actual failure,
+// following the buildTransportRetryTrailer idiom. Bound: 2 retries
+// (unmeasured house convention, matches the shared rework bound of 2 —
+// against room retry data). Byte-identical across the three workflows
+// (pinned by tests/already-merged.test.js).
+function classifyRetryTrailer(reason, failedReturn) {
+  // Pass-2 simplification: the reason string already carries the truth
+  // (throw vs parse failure), so one neutral sentence replaces the
+  // throw/parse branch — the stringly-typed prefix contract between the
+  // call site and this function is deleted, not moved. Prompt accuracy,
+  // not prompt hardening.
+  return "\n\nCLASSIFY RETRY: the previous classifier attempt failed (" + reason + "). " +
+    "Return ONLY the two named fields: { \"stdout\": \"<the command's exact stdout>\", \"stderr\": \"<the command's exact stderr>\" }. " +
+    "Put each stream in its named field — do not add labels like \"stdout:\" in front of the content. " +
+    "Previous attempt detail (do not repeat this shape): " + String(failedReturn).slice(0, 200);
+}
+
+// parseVersionFerry — review pass 2, blocker-42 class (2026-09-21). The npm
+// version-check ferry had the full pre-42 shape: schema-less agent(),
+// line-anchored parser, and an unparseable fallback asserting a POSITIVE
+// touched claim that spent the shared rework budget. Same treatment as
+// parseClassifyFerry: shape-constrained {stdout} schema, search-and-dedupe
+// parse, UNKNOWN on unparseable with in-place retries, honest park.
+// Byte-identical across standard.js, bugfix.js, chore.js
+// (pinned by tests/already-merged.test.js).
+// Returns { versionState, failReason }:
+//   versionState: "touched" | "clean" | null (null = UNKNOWN)
+//   failReason: computed reason, for the retry trailer and the park note
+function parseVersionFerry(vtResult) {
+  var vtStdout = (vtResult && typeof vtResult.stdout === "string") ? vtResult.stdout : null;
+  if (vtStdout === null) {
+    return { versionState: null,
+      failReason: "version-check return field missing or non-string (stdout must be a string)" };
+  }
+  // Search, never anchor (blocker 11): the ferry labels output
+  // ("stdout: VERSION_CLEAN"). Collect ALL matches and dedupe normalized
+  // values: exactly one distinct value is truth; zero or two-or-more is
+  // UNKNOWN — alternation order never adjudicates.
+  var vtRe = /\bVERSION_(TOUCHED|CLEAN)(?![\w-])/gi;
+  var vtSeen = {};
+  var vtM;
+  while ((vtM = vtRe.exec(vtStdout)) !== null) {
+    vtSeen[vtM[1].toUpperCase()] = true;
+  }
+  var vtStates = Object.keys(vtSeen);
+  if (vtStates.length !== 1) {
+    return { versionState: null,
+      failReason: vtStates.length === 0
+        ? "no VERSION_(TOUCHED|CLEAN) match in the stdout field"
+        : "ambiguous VERSION values in stdout (" + vtStates.length + " distinct)" };
+  }
+  return { versionState: vtStates[0] === "CLEAN" ? "clean" : "touched", failReason: "" };
+}
+
+// versionRetryTrailer — review pass 2, blocker-42 class (2026-09-21).
+// Neutral corrective trailer for the in-place version-check retries: the
+// computed parse-failure reason plus the failed return as a negative
+// example. Byte-identical across the three workflows
+// (pinned by tests/already-merged.test.js).
+function versionRetryTrailer(reason, failedReturn) {
+  return "\n\nVERSION-CHECK RETRY: the previous version-check attempt failed (" + reason + "). " +
+    "Return ONLY the named field: { \"stdout\": \"<the command's exact stdout>\" }. " +
+    "Put the command's stdout in the named field — do not add labels like \"stdout:\" in front of the content. " +
+    "Previous attempt detail (do not repeat this shape): " + String(failedReturn).slice(0, 200);
+}
+
 // parseToolSignals - bug 3472bf36. The work agent's TOOL CHECK emits two
 // exact signal lines: artifact_tools: ok|missing and
 // shell_transport: ok|unavailable. The workflow reads ONLY these lines.
@@ -517,12 +660,6 @@ function extractMarkerLines(workerText) {
   return markers.join("\n");
 }
 
-// See docs/decisions/publish-path.md#already-merged-idem2: idempotency for already-merged tasks.
-function extractAlreadyMerged(workerText) {
-  var m = /repo_diff:\s*none\s*\(already-merged:\s*([0-9a-f]{7,40})(?=[\s)]|$)/i.exec(workerText || "");
-  return m ? { sha: m[1].toLowerCase() } : { sha: null };
-}
-
 
 // See docs/decisions/qa-reproduce.md#worktree-confinement: the Build agent must declare its worktree.
 function extractWorktree(workerText) {
@@ -676,12 +813,24 @@ let mapGateBounceCount = 0;
 // rationalized a skip against explicit instruction text — text alone did not
 // hold, so the decision now lives in workflow code, not agent judgment.
 let releaseDecision = null; // { release: "yes"|"no", version_bump: "patch"|"minor"|"major"|null }
-// Already-merged idempotency: the verified sha from the builder's
-// `repo_diff: none (already-merged: <sha>)` declaration (null when the
-// builder made commits or declared a runtime-state deliverable). The
-// workflow verifies the sha is an ancestor of the integration target at Build closeout;
-// Review's no-diff branch reads this, never the builder's prose.
+// Already-merged attribution (blocker 34, 2026-09-21): the sha of the
+// task-attributed merge when classify-branch reports already-merged.
+// Set ONLY from the classifier's mechanical output — never from agent
+// prose. The agent-authored sha-bearing repo_diff declaration path is
+// deleted; attribution is identity-first from git, then the task's own
+// durable merge records.
 let alreadyMergedSha = null;
+// Room #26 blocker 34 (redesign, 2026-09-21): mechanical branch-state
+// classification at Review entry. Git facts are never adjudicated by a
+// reviewer — the workflow classifies the branch with `classify-branch`
+// (pure git) before Cass is dispatched: "has-work",
+// "already-merged:<sha>", or "empty-no-work". An empty branch with no
+// verified sha and no `repo_diff: none` claim fails mechanically without
+// dispatching Cass; reviewer prose is never parsed for git identity.
+let branchState = null; // "has-work" | "already-merged:<sha>" | "empty-no-work"
+let buildClaimedNoDiff = false; // Build declared plain `repo_diff: none` (no repo change — runtime-state deliverable, or believed already-merged). Same-process Build report only; there is no cross-process hydration — an empty branch on a fresh dispatch with no task-attributed merge fails mechanically.
+let versionTouched = false; // npm: branch changed package.json's `version` (mechanical git fact, blocker-34 follow-up)
+let branchStateErr = ""; // classifier failure detail (retry trailer + park note grounds)
 // Deterministic publish target — computed by the workflow (registry base +
 // bumpVersion), never by the Publish agent.
 let publishTarget = null; // { base, scope, target }
@@ -927,7 +1076,12 @@ while (i < STEPS.length) {
     );
     if (!claimResult.claimed) {
       log("Standing down — task " + taskId + " was already claimed by another run");
-      await telemetryEnd("duplicate");
+      // Room #26 blocker 37: telemetryEnd only accepts schema-valid
+      // statuses ("duplicate" violated the CHECK and silently left the run
+      // row 'running' forever). The stand-down is a clean exit — the run
+      // completed without doing work; the duplicate verdict itself stays in
+      // the workflow's returned status and this log line.
+      await telemetryEnd("completed");
       return { status: "duplicate", task_id: taskId, reason: "task already claimed by another run" };
     }
     activeSessionId = claimResult.session_id;
@@ -1121,55 +1275,202 @@ while (i < STEPS.length) {
       "cd " + WORKTREE_HINT + "\n" +
       "git add -A\n" +
       "git commit -m \"chore: " + safeTitle + "\"\n\n" +
-      "If the task's deliverable is runtime state (a cron definition, scheduler change, or dashboard/config state created outside the repo) and the repository genuinely needs no change, do NOT fabricate a commit: leave the branch with no commits ahead of the integration target and declare `repo_diff: none` in your report, naming the runtime-state deliverable. If you verified the deliverable is already on the integration target (a prior merge or hand-repair landed it — do NOT re-implement working code), make no commit and declare `repo_diff: none (already-merged: <sha>)` naming the integration-target commit that carries the work; the workflow verifies the sha is an ancestor of the integration target, and a false declaration fails the phase. Otherwise commit your changes normally.\n\n" +
+      "If the task's deliverable is runtime state (a cron definition, scheduler change, or dashboard/config state created outside the repo) and the repository genuinely needs no change, do NOT fabricate a commit: leave the branch with no commits ahead of the integration target and declare `repo_diff: none` in your report, naming the runtime-state deliverable. If you verified the deliverable is already on the integration target (a prior merge landed it — do NOT re-implement working code), make no commit and declare `repo_diff: none` in your report. The workflow verifies the claim mechanically from git — the task's own merge records, never your declaration, are the proof of delivery. Otherwise commit your changes normally.\n\n" +
       (rejectionNotes ? "REWORK after rejection. Address:\n" + rejectionNotes + "\n\n" : "") +
       "Report back in plain prose: what you built and the outcome." +
       (PUBLISH_TYPE === "npm" ? " End your report with the release: and version_bump: lines exactly as specified above — keep them on their own lines, lowercase, unrephrased — then a line `worktree: ` followed by the exact working directory path from above (copy it verbatim \u2014 it must match character-for-character), then a final line with exactly: VERDICT: PASS if the build is complete, VERDICT: FAIL if it is not." : " End your report with a line `worktree: ` followed by the exact working directory path from above (copy it verbatim \u2014 it must match character-for-character), then exactly one line: VERDICT: PASS if the build is complete, VERDICT: FAIL if it is not.");
 
   } else if (step.name === "Review") {
-    // See docs/decisions/publish-path.md#already-merged-hydra: when this run did not execute, hydration uses the existing merge.
-    if (!alreadyMergedSha) {
-      var hydResult = null;
+    // Room #26 blocker 34 (redesign, 2026-09-21): classify the branch
+    // mechanically BEFORE Cass is dispatched. The classifier is pure git
+    // (classify-branch in the lifecycle script): has-work |
+    // already-merged:<sha> | empty-no-work. Attribution is identity-first
+    // from git, then the task's own durable merge records — there is no
+    // agent-authored declared-sha input.
+    // Blocker 42 (2026-09-21): the classifier output crosses an agent()
+    // ferry — the old comment's "no cross-process hydration ferry" was a
+    // fib. Machine facts travel in structured fields ({stdout, stderr}
+    // schema) now, never in prose to be "returned verbatim". The schema
+    // is the guard; the prompt is instruction, never load-bearing.
+    // Unparseable is UNKNOWN, never a positive empty-no-work claim (room
+    // #27: a labeled ferry — "stdout: BRANCH_STATE: has-work" — defeated
+    // the ^-anchored parsers, and the empty-no-work fallback burned the
+    // whole shared rework budget on a branch with real work). UNKNOWN
+    // retries the classify call IN PLACE (up to 2, fresh -u1/-u2 keys — a
+    // full Build round cannot fix an instrument failure, and the only
+    // in-process bounce path spends the shared budget unconditionally).
+    // Instrumentation failures NEVER touch reworkCount: an instrument
+    // failure is not a build-quality failure. Exhaustion parks honestly
+    // as unclassifiable — "unknown keeps the task alive (bounded)"; the
+    // park on exhaustion is the fail-closed part. The UNKNOWN path never
+    // asserts empty-no-work: no log line or park note presents it as the
+    // classification. The string can still appear inside quoted evidence
+    // (the verbatim failed return travels in the trailer and the note).
+    // INVARIANT: branchState leaves this block holding a known value, or
+    // the step has parked — unknown never reaches any consumer below.
+    // Re-classify on EVERY Review entry: rework rewinds this step
+    // in-process, and the branch changed between rounds. The loop's
+    // null-gate governs only the in-place instrument retries within
+    // this pass — without the reset, a second Review pass would trust
+    // the first pass's stale classification and a real fix commit
+    // would never "become has-work".
+    branchState = null;
+    branchStateErr = "";
+    alreadyMergedSha = null;
+    var classifyFailedReturn = "";
+    for (var classifyAttempt = 0; classifyAttempt <= 2 && branchState === null; classifyAttempt++) {
+      var classifyPrompt =
+        "Classify the task branch state. This is a mechanical git check, not a judgment call.\n" +
+        "Run in shell: " + LIFECYCLE_ENV + LIFECYCLE + " classify-branch " + taskId + "\n" +
+        "Return the two streams as the two named fields and nothing else: { \"stdout\": \"<the command's exact stdout>\", \"stderr\": \"<the command's exact stderr>\" }." +
+        (classifyAttempt === 0 ? "" : classifyRetryTrailer(branchStateErr, classifyFailedReturn));
       try {
-        hydResult = await agent(
-          "Read the latest completed Build session for task " + taskId + ".\n" +
-          "Run in shell and return the stdout verbatim:\n" + crewCmd("get-state", { events_limit: 1 }) + "\n" +
-          "In the returned sessions array, find the most recent session (by started_at) with task_id \"" + taskId + "\", step \"Build\", and status \"completed\". Return exactly two sections, verbatim, with no commentary:\n" +
-          "SHA: <the session's already_merged_sha field value, or the word null when it is null>\n" +
-          "NOTES:\n<the session's notes field, verbatim>",
-          { key: "hydrate-already-merged" + (reworkCount > 0 ? "-r" + reworkCount : ""), label: "Hydrating already-merged verification" }
+        var bsResult = await agent(
+          classifyPrompt,
+          { key: "classify-branch" + (classifyAttempt === 0 ? "" : "-u" + classifyAttempt) + (reworkCount > 0 ? "-r" + reworkCount : ""),
+            label: "Classifying branch state (mechanical)" + (classifyAttempt === 0 ? "" : " (instrument retry " + classifyAttempt + " of 2)"),
+            schema: { type: "object", properties: { stdout: { type: "string" }, stderr: { type: "string" } }, required: ["stdout", "stderr"] } }
         );
-      } catch (hydErr) {
-        log("Hydration read failed (" + String(hydErr && hydErr.message || hydErr) + "); treating as none declared.");
+        classifyFailedReturn = (bsResult && typeof bsResult === "object" ? JSON.stringify(bsResult) : String(bsResult)).slice(0, 500);
+        var classifyParsed = parseClassifyFerry(bsResult);
+        if (classifyParsed.state !== null) {
+          branchState = classifyParsed.state;
+          branchStateErr = "";
+          // DIAG pin: advisory for has-work/empty-no-work (blocker-34 v2.1
+          // semantics — logged with its source field so silent record loss
+          // surfaces in the evidence); already-merged is gated on the pin
+          // inside parseClassifyFerry.
+          if (classifyParsed.diagField !== null) {
+            log("classify-branch DIAG pin (" + classifyParsed.diagField + " field): " + classifyParsed.diagText);
+          } else {
+            log("classify-branch: no DIAG: record-scan counter returned (scan unverifiable)");
+          }
+        } else {
+          branchStateErr = classifyParsed.failReason;
+          if (classifyAttempt < 2) {
+            log("classify-branch unparseable (" + branchStateErr + ") — retrying in place (attempt " + (classifyAttempt + 1) + " of 2)");
+          }
+        }
+      } catch (bsErr) {
+        classifyFailedReturn = String(bsErr && bsErr.message || bsErr).slice(0, 500);
+        branchStateErr = "classifier call failed: " + String(bsErr && bsErr.message || bsErr).slice(0, 120);
+        if (classifyAttempt < 2) {
+          log("classify-branch instrument failure (" + branchStateErr + ") — retrying in place (attempt " + (classifyAttempt + 1) + " of 2)");
+        }
       }
-      var hydStr = hydResult ? ((typeof hydResult === "string") ? hydResult : JSON.stringify(hydResult)) : "";
-      var hydSha = /^SHA:\s*([0-9a-f]{7,40})\s*$/im.exec(hydStr);
-      if (hydSha) {
-        alreadyMergedSha = hydSha[1].toLowerCase();
-        log("Hydrated already-merged verification from structured session field: " + alreadyMergedSha);
-      } else {
-        var hvm = /already_merged_verified:\s*([0-9a-f]{7,40})/i.exec(hydStr);
-        if (hvm) {
-          alreadyMergedSha = hvm[1].toLowerCase();
-          log("Hydrated already-merged verification from Build session notes (fallback): " + alreadyMergedSha);
+    }
+    if (branchState === null) {
+      // Exhaustion: park honestly. An instrument failure is not a
+      // measurement of emptiness — never "empty-no-work".
+      return await parkTask("Branch state unclassifiable after 2 instrument retries (" + branchStateErr + "; last failure: " + classifyFailedReturn + ") — the classifier instrument failed, not the branch. Human attention needed: inspect the task branch directly to determine its state — no trustworthy branch classification was produced.");
+    }
+    if (branchState.indexOf("already-merged:") === 0) {
+      alreadyMergedSha = branchState.slice("already-merged:".length);
+      log("Branch state already-merged: " + alreadyMergedSha + " (DIAG pin present — tripwire satisfied) — Cass reviews the frozen merge diff");
+    } else {
+      log("Branch state: " + branchState);
+    }
+    // buildClaimedNoDiff was set at the Build gate from the full Build
+    // report (same process only). Only an empty branch WITH this claim
+    // goes to Cass for a plausibility judgment; without it, empty-no-work
+    // fails mechanically and Cass is never dispatched.
+    // Blocker-34 follow-up: the package.json `version` check is a mechanical
+    // git fact, not a reviewer judgment. For npm projects the workflow checks
+    // it here, before Cass is dispatched — a touched `version` fails Review
+    // mechanically (versions are assigned at publish time, never in
+    // branches). Review pass 2 (blocker-42 class): this ferry had the full
+    // pre-42 shape — schema-less agent(), line-anchored parser, and an
+    // unparseable fallback asserting a POSITIVE touched claim that spent the
+    // shared rework budget. Same treatment as the classifier:
+    // shape-constrained {stdout} schema, search-and-dedupe parse, UNKNOWN
+    // with in-place retries, honest park. An instrument failure is not a
+    // measurement of touched — never assert touched from unparseable output.
+    if (PUBLISH_TYPE === "npm") {
+      var versionState = null; // "touched" | "clean" | null (null = UNKNOWN)
+      var versionStateErr = "";
+      var versionFailedReturn = "";
+      for (var versionAttempt = 0; versionAttempt <= 2 && versionState === null; versionAttempt++) {
+        var versionPrompt =
+          "Check whether the task branch changed package.json's `version` field. This is a mechanical git check, not a judgment call.\n" +
+          "Run in shell: " + LIFECYCLE_ENV + LIFECYCLE + " version-check " + taskId + "\n" +
+          "Return the command's exact stdout as the single named field and nothing else: { \"stdout\": \"<the command's exact stdout>\" }." +
+          (versionAttempt === 0 ? "" : versionRetryTrailer(versionStateErr, versionFailedReturn));
+        try {
+          var vtResult = await agent(
+            versionPrompt,
+            { key: "version-check" + (versionAttempt === 0 ? "" : "-u" + versionAttempt) + (reworkCount > 0 ? "-r" + reworkCount : ""),
+              label: "Checking package.json version (mechanical)" + (versionAttempt === 0 ? "" : " (instrument retry " + versionAttempt + " of 2)"),
+              schema: { type: "object", properties: { stdout: { type: "string" } }, required: ["stdout"] } }
+          );
+          versionFailedReturn = (vtResult && typeof vtResult === "object" ? JSON.stringify(vtResult) : String(vtResult)).slice(0, 500);
+          var vtParsed = parseVersionFerry(vtResult);
+          if (vtParsed.versionState !== null) {
+            versionState = vtParsed.versionState;
+            versionStateErr = "";
+          } else {
+            versionStateErr = vtParsed.failReason;
+            if (versionAttempt < 2) {
+              log("version-check unparseable (" + versionStateErr + ") — retrying in place (attempt " + (versionAttempt + 1) + " of 2)");
+            }
+          }
+        } catch (vtErr) {
+          versionFailedReturn = String(vtErr && vtErr.message || vtErr).slice(0, 500);
+          versionStateErr = "version-check call failed: " + String(vtErr && vtErr.message || vtErr).slice(0, 120);
+          if (versionAttempt < 2) {
+            log("version-check instrument failure (" + versionStateErr + ") — retrying in place (attempt " + (versionAttempt + 1) + " of 2)");
+          }
         }
       }
+      if (versionState === null) {
+        // Exhaustion: park honestly. An instrument failure is not a
+        // measurement of touched — never assert touched.
+        return await parkTask("package.json `version` state unclassifiable after 2 instrument retries (" + versionStateErr + "; last failure: " + versionFailedReturn + ") — the version-check instrument failed, not the branch. Human attention needed: inspect the task branch directly to determine its state — no trustworthy version classification was produced.");
+      }
+      versionTouched = (versionState === "touched");
+      log("Review: package.json `version` " + (versionTouched ? "touched by the branch — mechanical FAIL, Cass not dispatched" : "untouched — mechanical check clean"));
+    }
+    // The empty-branch rule Cass used to adjudicate is gone. What she
+    // examines and what rule she applies depend on the classified state —
+    // never on her own judgment of git identity.
+    var reviewChangeExam, reviewBranchRule;
+    if (branchState === "has-work") {
+      reviewChangeExam =
+        "Examine the code changes by running:\n" +
+        LIFECYCLE_ENV + LIFECYCLE + " inspect " + taskId + "\n\n" +
+        "The inspect output is authoritative: it prints the task branch's actual tip commit (TIP) and every commit ahead of the integration target (inspect prints the target name). Base your review ONLY on this output — do NOT run git log yourself to pick commits, and do NOT discuss commit hashes from any other source (they may come from stale rework rounds or a different repo).\n\n";
+      reviewBranchRule =
+        "MECHANICAL FACT (computed by the workflow from git — never by a reviewer): branch state = has-work. The branch has commits ahead of the integration target. Review their content; branch emptiness is settled and is not yours to judge.\n";
+    } else if (branchState.indexOf("already-merged:") === 0) {
+      reviewChangeExam =
+        "The change under review is the frozen merge " + alreadyMergedSha + " — it is already on the integration target (see MECHANICAL FACT below). Examine it by running:\n" +
+        "cd " + REPO_PATH + " && git diff " + alreadyMergedSha + "^1 " + alreadyMergedSha + "\n\n" +
+        "That first-parent diff is the frozen, attributable change. Base your review ONLY on this diff — do NOT run git log to pick commits, and do NOT discuss commit hashes from any other source (they may come from stale rework rounds or a different repo).\n\n";
+      reviewBranchRule =
+        "MECHANICAL FACT (computed by the workflow from git — never by a reviewer): branch state = already-merged:" + alreadyMergedSha + ". The deliverable landed on the integration target via this task's own prior merge " + alreadyMergedSha + " (verified ancestor of the integration target). The branch is empty by design — emptiness is settled fact, not a finding.\n";
+    } else if (buildClaimedNoDiff) {
+      reviewChangeExam =
+        "The branch has no commits ahead of the integration target (see MECHANICAL FACT below) — there is no diff to examine. Judge the Build report's `repo_diff: none` claim on its plausibility.\n\n";
+      reviewBranchRule =
+        "MECHANICAL FACT (computed by the workflow from git — never by a reviewer): the branch has no commits ahead of the integration target and no task-attributed merge on the target was verified; the Build report declares `repo_diff: none` (no repo change). Approve ONLY if the task's deliverable is plausibly runtime state (e.g. a cron definition, scheduler change, or dashboard/config state created outside the repo). Otherwise report 'no commits ahead of the integration target and no plausible runtime-state deliverable — the builder likely forgot to commit', then end your report with exactly this line: VERDICT: FAIL.\n";
+    } else {
+      // Mechanical FAIL — Cass is never dispatched (see the dispatch gate
+      // below). Instructions are unused; keep the shape.
+      reviewChangeExam = "";
+      reviewBranchRule = "";
     }
     instructions = "Review independently and cold. No prior context from the builder.\nDo NOT access the task dashboard, event log, or any comments. Your review is based solely on the spec and the code.\n\n" +
       (mapperSpec ? "MAPPER'S SPEC (the builder was asked to implement exactly this):\n" + mapperSpec + "\n\n" : "Read the spec from the task description.\n\n") +
-      "Examine the code changes by running:\n" +
-      LIFECYCLE_ENV + LIFECYCLE + " inspect " + taskId + "\n\n" +
-      "The inspect output is authoritative: it prints the task branch's actual tip commit (TIP) and every commit ahead of the integration target (inspect prints the target name). Base your review ONLY on this output — do NOT run git log yourself to pick commits, and do NOT discuss commit hashes from any other source (they may come from stale rework rounds or a different repo).\n\n" +
+      reviewChangeExam +
       "You can also read specific files in the worktree at:\n" +
       WORKTREE_HINT + "/\n\n" +
       "Check quality, correctness, spec compliance.\n" +
       (SURFACE_TERMINAL ? "TERMINAL UX REVIEW: judge the CLI surface against " + UX_DOCTRINE_PATH + " — help accuracy, error quality, exit codes, output clarity. Reject when the bar is not met.\n" : "") +
       (SURFACE_ARTIFACT ? "ARTIFACT UX REVIEW: judge the rendered surface against " + UX_DOCTRINE_PATH + " — alignment, spacing, hierarchy, composition, balance, finish, correctness. Reject when the bar is not met.\n" : "") +
       "Check that public-affecting changes have matching public doc updates (API.md or the published API contract). If the docs are missing or inaccurate, report what is stale, then end your report with exactly this line: VERDICT: FAIL.\n" +
-      "If the branch has no commits ahead of the integration target (inspect shows an empty commit log), approve ONLY if the Build summary declares `repo_diff: none` with (a) a plausible runtime-state deliverable (e.g. a cron created via the cron tool), or (b) an already-merged declaration `repo_diff: none (already-merged: <sha>)` AND the mechanical fact below confirms the sha verified. MECHANICAL FACT (computed by the workflow, never by the builder): already_merged sha = " + (alreadyMergedSha ? alreadyMergedSha + " (verified ancestor of the integration target: YES)" : "none declared") + ". Otherwise report 'no commits ahead of the integration target and no valid repo_diff: none declaration — the builder likely forgot to commit', then end your report with exactly this line: VERDICT: FAIL.\n" +
-      (PUBLISH_TYPE === "npm" ? "PACKAGE VERSION: this project publishes to the npm registry, and versions are assigned at publish time — never in branches. Two checks:\n" +
-      "(a) The task branch must NOT have changed package.json's `version` field. First resolve the integration target: " + LIFECYCLE_ENV + LIFECYCLE + " integration-target. Then check: cd " + REPO_PATH + " && git diff <target>..." + TASK_BRANCH + " -- package.json (substitute the exact token integration-target printed — when it prints HEAD, use the literal word HEAD: `git diff HEAD...<branch>` diffs the detached checkout against the branch). If the branch touched `version` in any way, report 'versions are assigned at publish time, never in branches — remove the version change' in your notes, then end your report with exactly this line: VERDICT: FAIL.\n" +
-      "(b) The accepted Build report declares: " + releaseDecisionText() + ". " +
+      reviewBranchRule +
+      (PUBLISH_TYPE === "npm" ? "PACKAGE VERSION: this project publishes to the npm registry, and versions are assigned at publish time — never in branches.\n" +
+      "MECHANICAL FACT (computed by the workflow from git — never by a reviewer): the task branch did not change package.json's `version` field. A branch that touches `version` fails Review mechanically before any reviewer is dispatched, so this is settled — do not re-check it.\n" +
+      "The accepted Build report declares: " + releaseDecisionText() + ". " +
       (releaseDecision
         ? "Validate this decision against the change: release must be 'yes' when the change is consumer-observable and 'no' when internal-only; the version_bump scope must fit the change (patch for fixes, minor for new behavior, major for breaking changes). If the decision is wrong or mis-scoped, report your notes, then end with exactly this line: VERDICT: FAIL."
         : "The decision is missing or malformed — report 'Build report must end with release: yes|no and (when release is yes) version_bump: patch|minor|major lines', then end with exactly this line: VERDICT: FAIL.") + "\n" : "") +
@@ -1183,8 +1484,9 @@ while (i < STEPS.length) {
       "Then run: "+ LIFECYCLE_ENV + "WORKFLOW_RUN_ID=" + lockHolder + " CREW_STAGED_BASE=<provenance.source_commit, empty when null> integrate " + taskId + " \"merge: chore: " + safeTitle + "\\\"\\n" +
       "The script merges, reconciles, records, and pushes under the merge lock. Informational only: RECONCILED, NO_REMOTE, NO_REMOTE_RECONCILE. Read the output:\n" +
       "- STAGED_BASE_MISMATCH: the line left the staged base (stray checkout). VERDICT: FAIL.\n" +
-      "- MERGED_EMPTY — check FIRST (it contains the word MERGED): either a runtime-state deliverable or an already-merged sha the workflow verified (Build declared repo_diff: none). No lock taken, no new commit. Report 'merged empty: no repo changes'. VERDICT: PASS.\n" +
+      "- MERGED_EMPTY — check FIRST (it contains the word MERGED): either a runtime-state deliverable or a task-attributed merge the workflow verified from the task's own merge records. No lock taken, no new commit. Report 'merged empty: no repo changes'. VERDICT: PASS.\n" +
       "- MERGED: the merge landed; the script pushed inline. Read the push line: PUSHED — report the hash (detached prints PUSHED: origin/main (refspec HEAD:main)), VERDICT: PASS; NO_REMOTE_PUSH — no remote configured, VERDICT: PASS; ERROR after MERGED — a retry recovers the push; report it, VERDICT: FAIL.\n" +
+      "- STALE_MERGE: the recorded merge no longer matches the task branch (rework moved it after the merge) — the script refused to push stale state. Report the STALE_MERGE line, VERDICT: FAIL.\n" +
       "- LOCK_HELD: 10-minute backoff exhausted. VERDICT: FAIL.\n" +
       "- CONFLICT: the plain merge failed — aborted, the target is clean, and your task still holds the merge lock. Do NOT fail yet. Resolve it:\n" +
       "RESOLUTION:\n" +
@@ -1234,8 +1536,9 @@ while (i < STEPS.length) {
       // See docs/decisions/publish-path.md#deterministic-artifact-publish: the work agent never publishes; the parent runs the deterministic publish script.
       // Blocker 22 (one-party publish, room #24): verified re-entry guard.
       // The workflow parks at publish intent; the tick worker issues
-      // artifact_edit, verifies by read-back, stamps provenance, and
-      // re-queues. The dispatcher resumes this task at the Publish step
+      // artifact_edit; the ack scan stamps provenance on exact per-attempt
+      // version acknowledgement (sole positive completion criterion; no
+      // read-back — docs/publish-verification.md) and re-queues. The dispatcher resumes this task at the Publish step
       // (the parked session's own step — the failed→retry path). If the
       // stamped provenance names THIS task and its source_commit is the
       // repo's current HEAD, the merge commit was already published and
@@ -1291,8 +1594,10 @@ while (i < STEPS.length) {
         }
         // See docs/decisions/publish-path.md#step1-builder-source: the builder's source tree is NOT the crew's repo; verify report before stamping.
         // (2026-09-20, one-party worker-owned publish) A verified re-entry
-        // skips the whole issuance tail: the edit already went out, was
-        // verified by the parent read-back, and was stamped. The empty-diff
+        // skips the whole issuance tail: the edit already went out, the
+        // ack scan saw the exact per-attempt version acknowledged (sole
+        // positive completion criterion; no read-back) and it was stamped.
+        // The empty-diff
         // park must not fire on this branch.
         if (!publishSkippedNoLock && !publishAlreadyVerified) {
         // The trigger key of the attempt that last ran, for the publish ledger.
@@ -1547,11 +1852,13 @@ while (i < STEPS.length) {
       // mechanical outcome above. It must not rebuild or re-stamp: a second
       // artifact_edit would trigger a duplicate build.
       // (2026-09-20, one-party worker-owned publish) On a verified re-entry
-      // the publish was issued by the crew worker, verified by the parent
-      // read-back, and stamped — the work agent reports that, VERDICT: PASS.
+      // the publish was issued, the ack scan observed the artifact's exact
+      // version acknowledgement, and provenance was stamped — already
+      // verified, nothing to issue. The work agent reports that,
+      // VERDICT: PASS.
       if (publishAlreadyVerified) {
         instructions = "Publish was already completed and verified for this task — do NOT call artifact_edit, artifact_status, setprovenance, or post-deploy yourself; doing so would disturb the finalized state.\n\n" +
-          "The crew's publish worker issued the artifact edit for the merged commit, the parent's independent content read-back confirmed the artifact contains the merged change, and provenance was stamped (docs/publish-verification.md). This Publish pass is a verified re-entry after the stamp: there is nothing to issue and nothing to re-verify.\n\n" +
+          "Provenance stamps this task's merge commit as published (docs/publish-verification.md): the tick worker issued the edit, the ack scan observed the artifact's exact version acknowledgement — the sole positive completion criterion — and the publish was stamped. Already verified, nothing to issue and nothing to re-verify.\n\n" +
           "For the change summary, run: cd " + REPO_PATH + " && git log -1 --stat\n\n" +
           "Write plain prose describing what was published, then on its own line: VERDICT: PASS\n" +
           "The VERDICT line must be the last line of your report.";
@@ -1564,10 +1871,10 @@ while (i < STEPS.length) {
       instructions = "Publish the merged code to the live artifact.\n\n" +
         "The publish was performed deterministically by the workflow before your step — do NOT call artifact_edit, artifact_status, setprovenance, or post-deploy yourself; doing so would trigger a duplicate build or disturb the finalized state. You perform no publish actions.\n\n" +
         "For the change summary, run: cd " + REPO_PATH + " && git log -1 --stat\n\n" +
-        "Mechanical outcome (the workflow's mechanical steps; content verification is the parent's, still pending):\n" +
+        "Mechanical outcome (the workflow's mechanical steps; the ack scan's version-acknowledgement check is still pending):\n" +
         "- merge lock refreshed: yes\n" +
         "- artifact rebuild triggered and completed: yes\n" +
-        "- provenance stamped: NO — not yet, and you must NOT stamp it. The stamp moved to the parent, which stamps it only after an independent content read-back confirms the artifact actually contains the merged change (docs/publish-verification.md). A stamped-but-hollow build is exactly how canary run 8 (2026-09-11) went green on stale content.\n" +
+        "- provenance stamped: NO — not yet, and you must NOT stamp it. The ack scan stamps it when it observes the artifact's exact on-disk acknowledgement of this attempt's version — version acknowledgement is the sole positive completion criterion (docs/publish-verification.md). A stamped-but-hollow build is exactly how canary run 8 (2026-09-11) went green on stale content.\n" +
         "- post-deploy finalized: yes (worktree removed, merge lock released)\n\n" +
         "POLICY: The live artifact is rebuilt only in this phase, from the repo. Never use artifact_edit to change the artifact directly — fixes go through the repo and the loop. A source fix is not done until the artifact is rebuilt from it here.\n\n" +
         "The repo push already happened in Integrate — do NOT push to git in this phase.\n\n" +
@@ -1611,7 +1918,31 @@ while (i < STEPS.length) {
   var workKeyBase = "work-" + step.name + (reworkCount > 0 ? "-r" + reworkCount : "");
   var workerResult = null;
   var workAttempts = [];
-  for (var workAttempt = 0; workAttempt <= 2; workAttempt++) {
+  // Room #26 blocker 34 (redesign): an empty branch with no verified sha and
+  // no repo_diff: none claim fails Review mechanically — Cass is never
+  // dispatched, so no reviewer adjudicates the emptiness. The synthetic
+  // report below is written by the workflow and flows through the same
+  // verdict extraction, structured verdict recording, and rejection/bounce
+  // path as a real FAIL.
+  // Blocker-34 follow-up: the npm `version` check joins the mechanical gate.
+  // Either mechanical fact fails Review without dispatching Cass.
+  var mechanicalFailReason = (versionTouched ? "version-touched" : (branchState === "empty-no-work" && !buildClaimedNoDiff ? "empty-no-work" : null));
+  var mechanicalReviewFail = (step.name === "Review" && mechanicalFailReason !== null);
+  if (mechanicalReviewFail) {
+    log("Review: " + mechanicalFailReason + " — mechanical FAIL, Cass not dispatched");
+    workerResult =
+      "MECHANICAL REVIEW VERDICT (written by the workflow — no reviewer was dispatched).\n" +
+      (mechanicalFailReason === "version-touched"
+        ? "Package.json `version` (checked by the workflow from git): the task branch changed the `version` field. Versions are assigned at publish time — never in branches. Remove the version change.\n"
+        : "Branch state (classified by the workflow from git): empty-no-work — the task branch has no commits ahead of the integration target, " +
+          "no task-attributed merge on the target was verified" + (branchStateErr ? " (branch classification itself failed: " + branchStateErr + ")" : "") + ", " +
+          "and the accepted Build report declared no `repo_diff: none` deliverable. " +
+          "No change was reviewed because there is no change to review. The builder likely forgot to commit.\n") +
+      "Worktree: " + WORKTREE_HINT + "\n" +
+      "Recovery: commit the deliverable on the task branch in the worktree above and re-run Review. If the deliverable is genuinely runtime state outside the repo, declare `repo_diff: none` in the Build report instead of leaving the branch empty without a declaration.\n" +
+      "VERDICT: FAIL";
+  }
+  for (var workAttempt = 0; workAttempt <= 2 && !mechanicalReviewFail; workAttempt++) {
     var workKey = workAttempt === 0 ? workKeyBase : workRetryKey(step.name, (reworkCount > 0 ? "-r" + reworkCount : ""), workAttempt);
     var prevAttempt = workAttempt === 0 ? null : workAttempts[workAttempt - 1];
     var retryReason = workAttempt === 0 ? null : (prevAttempt.threw ? "discarded" : (prevAttempt.outcome === "missing-artifact-tools" ? "no-tools" : (prevAttempt.outcome === "unavailable-shell-transport" ? "no-transport" : "empty")));
@@ -1709,7 +2040,18 @@ while (i < STEPS.length) {
         "Run in shell and return the stdout verbatim:\n" + crewCmd("record-phase", {
           task_id: taskId,
           session: { id: activeSessionId, task_id: taskId, identity: step.identity, step: step.name, status: "failed", notes: "Worker report had no single unambiguous VERDICT: PASS/FAIL line (bounded re-ask exhausted)" },
-          event: { task_id: taskId, type: "failed", message: step.name + " verdict line missing or ambiguous, re-ask exhausted — phase failed, dispatcher will retry" }
+          event: { task_id: taskId, type: "failed", message: step.name + " verdict line missing or ambiguous, re-ask exhausted — phase failed, dispatcher will retry" },
+          // Room #26 blocker 33: INDETERMINATE verdict record — the report
+          // could not be read at all, but its full text is still preserved
+          // as grounds. Review-scoped; other verdict steps keep the
+          // existing failed-session behavior with no verdict row.
+          verdict: (step.name === "Review" ? {
+            step: "Review",
+            attempt: reworkCount,
+            reviewer: step.identity,
+            verdict: "INDETERMINATE",
+            grounds: workerText
+          } : null)
         }) + "\n",
         { key: "record-block-" + step.name, label: "Recording verdict failure" }
       );
@@ -1755,40 +2097,13 @@ while (i < STEPS.length) {
     }
     log("Build worktree confinement passed: " + wt.path);
 
-    // See docs/decisions/publish-path.md#already-merged-idem: an already-merged repo_diff is idempotent; no rebuild.
-    var am = extractAlreadyMerged(workerText);
-    if (am.sha) {
-      var amCheck = await agent(
-        "Verify the builder's already-merged declaration.\n" +
-        "Run in shell and return the stdout verbatim:\n" +
-        "TARGET=$(" + LIFECYCLE_ENV + LIFECYCLE + " integration-target) && cd " + REPO_PATH + " && git rev-parse --verify --quiet " + am.sha + " >/dev/null && git merge-base --is-ancestor " + am.sha + " $TARGET && echo ALREADY_MERGED_YES || echo ALREADY_MERGED_NO",
-        { key: "verify-already-merged" + (reworkCount > 0 ? "-r" + reworkCount : ""), label: "Verifying already-merged declaration" }
-      );
-      var amOut = (typeof amCheck === "string") ? amCheck : JSON.stringify(amCheck);
-      if (!/ALREADY_MERGED_YES/.test(amOut)) {
-        log("Build already-merged declaration failed verification — " + am.sha + " is not an ancestor of the integration target — marking failed for retry");
-        await agent(
-          "Record already-merged verification failure.\n" +
-          "Run in shell and return the stdout verbatim:\n" + crewCmd("record-phase", {
-            task_id: taskId,
-            session: { id: activeSessionId, task_id: taskId, identity: step.identity, step: step.name, status: "failed",
-              notes: "Build declared repo_diff: none (already-merged: " + am.sha + ") but " + am.sha + " is not an ancestor of the integration target in the configured repo. The declaration is fabricated or mistaken; the work is not on the integration target. Phase failed for retry" },
-            event: { task_id: taskId, type: "failed", message: "Build already-merged declaration failed verification — " + am.sha + " not an ancestor of the integration target, phase failed, dispatcher will retry" }
-          }),
-          { key: "record-already-merged-fail-" + step.name, label: "Recording already-merged verification failure" }
-        );
-        return {
-          __hatchWorkflowControl: "blocked",
-          result: {
-            blocked_reason: "Build already-merged declaration failed verification",
-            message: "The builder declared repo_diff: none (already-merged: " + am.sha + ") but " + am.sha + " is not an ancestor of the integration target. The work is not on the integration target; the phase is marked failed and the dispatcher will retry Build.",
-            task_id: taskId
-          }
-        };
-      }
-      alreadyMergedSha = am.sha;
-      log("Build already-merged declaration verified: " + am.sha + " is an ancestor of the integration target");
-    }
+    // Room #26 blocker 34 (redesign, 2026-09-21): capture the plain
+    // `repo_diff: none` (no repo change) claim from the FULL Build report.
+    // Each Build round sets this fresh from its own report; there is no
+    // cross-process fallback. The agent-authored already-merged
+    // declaration and its Build-closeout verification are deleted —
+    // attribution is the classifier's job at Review entry.
+    buildClaimedNoDiff = /repo_diff:\s*none/im.test(workerText || "");
   }
 
   // Deterministic closeout: no formatter agent. The verdict is mechanical
@@ -1901,9 +2216,23 @@ while (i < STEPS.length) {
   } else {
     summary = (stepResult.summary || "Step completed").slice(0, 2000 - workerMarkers.length - 1) + (workerMarkers ? "\n" + workerMarkers : "");
   }
-  // See docs/decisions/publish-path.md#already-merged: when the Build gate verifies already-merged, attestation is recorded.
-  if (step.name === "Build" && alreadyMergedSha) {
-    summary += "\nalready_merged_verified: " + alreadyMergedSha;
+  // Room #26 blocker 34 (redesign, 2026-09-21): machine-readable review
+  // basis, prepended to Review session notes for observability (proof
+  // rooms read the summary to see what Review examined and why a
+  // reviewer was or was not dispatched).
+  if (step.name === "Review" && branchState) {
+    var reviewBasisNote;
+    if (mechanicalReviewFail) {
+      reviewBasisNote = "REVIEW_BASIS: none — mechanical FAIL (" + mechanicalFailReason + "), no reviewer dispatched";
+    } else if (branchState.indexOf("already-merged:") === 0) {
+      var rbSha = branchState.slice("already-merged:".length);
+      reviewBasisNote = "REVIEW_BASIS: frozen merge " + rbSha + " — reviewed via git diff " + rbSha + "^1 " + rbSha;
+    } else if (branchState === "has-work") {
+      reviewBasisNote = "REVIEW_BASIS: branch diff — reviewed via inspect output (task branch vs integration target)";
+    } else {
+      reviewBasisNote = "REVIEW_BASIS: runtime-state-none — no repo change; plausibility of Build's repo_diff: none claim";
+    }
+    summary = reviewBasisNote + "\n" + summary;
   }
 
   // Capture mapper's spec for Build and Review
@@ -1925,16 +2254,43 @@ while (i < STEPS.length) {
     releaseDecision = extractReleaseDecision(workerText);
   }
 
+  // Room #26 blocker 34 (redesign, 2026-09-21): structured review basis
+  // for the verdict row — what the review actually examined. A mechanical
+  // FAIL has no reviewer and no basis beyond the mechanical fact. Only
+  // computed for Review (branchState is null on other steps).
+  var reviewBasis = null;
+  if (step.name === "Review" && branchState) {
+    reviewBasis =
+      mechanicalReviewFail ? "mechanical-fail" :
+      branchState.indexOf("already-merged:") === 0 ? "frozen-merge:" + branchState.slice("already-merged:".length) :
+      branchState === "has-work" ? "branch-diff" : "runtime-state-none";
+  }
+
   await agent(
     "Update session and log event.\n" +
     "Run in shell and return the stdout verbatim:\n" + crewCmd("record-phase", {
       task_id: taskId,
-      // Room #16 blocker 11: the workflow-verified already-merged sha as
-      // structured control state. Only the Build gate sets alreadyMergedSha
-      // (after the mechanical ancestor check); the API validates the shape
-      // and a later write without the field never clears it (COALESCE).
-      session: { id: activeSessionId, task_id: taskId, identity: step.identity, step: step.name, status: status, notes: summary, already_merged_sha: (step.name === "Build" ? alreadyMergedSha : null) },
-      event: { task_id: taskId, type: status, identity: step.identity, message: step.name + " " + status + " by " + step.identity }
+      // Room #26 blocker 34 (2026-09-21): the already_merged_sha session
+      // field is no longer written — the agent-authored declaration path
+      // is deleted and nothing reads it. Removing the Crew API/database
+      // column is a separate API-surface follow-up, not bundled here.
+      session: { id: activeSessionId, task_id: taskId, identity: step.identity, step: step.name, status: status, notes: summary },
+      event: { task_id: taskId, type: status, identity: step.identity, message: step.name + " " + status + " by " + step.identity },
+      // Room #26 blocker 33: structured, non-lossy Review verdict record.
+      // The session note above is truncated; the verdict row carries the
+      // full worker report as grounds, written in the same transaction.
+      // attempt is the rework round (0 = first Review).
+      verdict: (step.name === "Review" && verdictPassed !== null ? {
+        step: "Review",
+        attempt: reworkCount,
+        // Room #26 blocker 34 (redesign): a mechanical FAIL has no
+        // reviewer — the workflow wrote the verdict. Identity rows still say
+        // the Review step ran.
+        reviewer: mechanicalReviewFail ? "workflow" : step.identity,
+        verdict: verdictPassed ? "PASS" : "FAIL",
+        review_basis: reviewBasis,
+        grounds: workerText
+      } : null)
     }) + "\n",
     {
       key: "record-" + step.name + (reworkCount > 0 ? "-r" + reworkCount : "") + (mapGateBounceCount > 0 ? "-g" + mapGateBounceCount : ""),
@@ -1943,21 +2299,20 @@ while (i < STEPS.length) {
   );
 
   if (!passed && step.name === "Review") {
+    // Room #26 blocker 34 (redesign, 2026-09-21): the false-negative guard,
+    // the Case B budget skip, and the already-merged corrective are all
+    // gone. Emptiness is classified mechanically before Review, so a
+    // rejected Review is never re-adjudicated here — the workflow owns the
+    // git facts, the reviewer owns quality/spec compliance, and the budget
+    // applies uniformly to every rejection. A rejected frozen merge
+    // bounces with the reviewer's notes; a real fix commit becomes
+    // has-work, and a do-nothing loop exhausts the normal budget.
     reworkCount++;
     if (reworkCount > MAX_REWORK) {
       log("Max rework attempts reached for task " + taskId + " — worktree preserved at " + WORKTREE_PRESERVED_HINT + " for manual inspection");
       return await parkTask("Exceeded " + MAX_REWORK + " rework attempts after Review rejection. Worktree preserved.");
     }
     rejectionNotes = summary;
-    // Already-merged corrective (room #16 blocker 11): when Review rejected
-    // an empty branch but the work is already on the integration target (the workflow verified
-    // the sha), Wren must declare it — not re-implement or re-commit
-    // already-landed work. Scoped to the empty-branch rejection; any other
-    // rejection already carries its own specific notes.
-    if (step.name === "Review" && alreadyMergedSha && /no commits ahead of (main|the integration target)/i.test(summary)) {
-      rejectionNotes += "\n\nCORRECTIVE (from the workflow, not the reviewer): the deliverable is already on the integration target — the workflow mechanically verified that " + alreadyMergedSha + " is an ancestor of the integration target. Do NOT re-implement the work and do NOT create a new commit for it. In your Build report, declare exactly: repo_diff: none (already-merged: " + alreadyMergedSha + ") — then end with VERDICT: PASS.";
-      log("Rework corrective appended for task " + taskId + ": already-merged " + alreadyMergedSha + " — Wren must declare, not rebuild");
-    }
     i = BUILD_INDEX;
     log("Review rejected — bouncing to Build (rework #" + reworkCount + ")");
     continue;