muse-crew 0.14.9 → 0.14.11

package/lib/test-worktree-backend.sh

@@ -45,6 +45,48 @@ grep -q "^path=$T/.worktrees/$tid\$" "$T/.worktrees/.registry/$tid" || fail "pre
 out=$(bash "$LIFECYCLE" prepare "$tid") || fail "prepare (reuse) exited non-zero"
 echo "$out" | grep -q '^REUSED' || fail "prepare: expected REUSED on second run: $out"
 
+# Blocker 45 (2026-09-22, room #29 J1): prepare must verify its REUSED
+# invariant. An agent-improvised branch (raw git, bypassing prepare) gets
+# REPAIRED — registry re-registered under the actual branch, never deleted —
+# never silently REUSED.
+tid2="backendtest45"
+out=$(bash "$LIFECYCLE" prepare "$tid2") || fail "prepare (45) exited non-zero: $out"
+echo "$out" | grep -q '^CREATED' || fail "prepare (45): expected CREATED, got: $out"
+# The agent improvises: checks out a branch outside the task/ namespace and
+# commits there, bypassing prepare entirely.
+git -C "$T/.worktrees/$tid2" checkout -qb crew-9eda33ca
+echo improvised >> "$T/.worktrees/$tid2/f.txt"
+(git -C "$T/.worktrees/$tid2" commit -qam improvised) || fail "improvised commit failed"
+out=$(bash "$LIFECYCLE" prepare "$tid2") || fail "prepare (45 repair) exited non-zero: $out"
+echo "$out" | grep -q '^REPAIRED' || fail "prepare: expected REPAIRED on improvised branch, got: $out"
+echo "$out" | grep -q '^REUSED' && fail "prepare: must not print REUSED when the branch invariant fails"
+# The agent's branch survives; the registry attributes the repair honestly.
+git -C "$T" rev-parse --verify "crew-9eda33ca" >/dev/null 2>&1 || fail "repair: agent branch deleted"
+grep -q '^branch=crew-9eda33ca$' "$T/.worktrees/.registry/$tid2" || fail "repair: registry branch not re-registered"
+grep -q '^task_id=backendtest45$' "$T/.worktrees/.registry/$tid2" || fail "repair: registry lost task attribution"
+base_before=$(grep '^base_commit=' "$T/.worktrees/.registry/$tid2")
+# The repair is idempotent: a second prepare repairs again (no spurious
+# REUSED), preserving the registry's other fields.
+out=$(bash "$LIFECYCLE" prepare "$tid2") || fail "prepare (45 second repair) exited non-zero: $out"
+echo "$out" | grep -q '^REPAIRED' || fail "prepare: expected idempotent REPAIRED, got: $out"
+base_after=$(grep '^base_commit=' "$T/.worktrees/.registry/$tid2")
+[ "$base_before" = "$base_after" ] || fail "repair: re-register must preserve base_commit"
+# A worktree back on the canonical branch is REUSED with no repair.
+git -C "$T/.worktrees/$tid2" checkout -q "task/$tid2"
+out=$(bash "$LIFECYCLE" prepare "$tid2") || fail "prepare (45 canonical) exited non-zero: $out"
+echo "$out" | grep -q '^REUSED' || fail "prepare: expected REUSED on canonical branch, got: $out"
+echo "$out" | grep -q '^REPAIRED' && fail "prepare: no spurious REPAIRED on a canonical worktree"
+# resolve-branch falls back to the worktree's actual checked-out branch when
+# the registry is absent and no canonical/prefix ref matches — the
+# classifier's mechanical truth of last resort (not "branch does not exist").
+git -C "$T/.worktrees/$tid2" checkout -qb crew-deadbeef
+rm -f "$T/.worktrees/.registry/$tid2"
+git -C "$T" branch -D -q "task/$tid2"
+resolved=$(bash "$LIFECYCLE" resolve-branch "$tid2") || fail "resolve-branch (45) exited non-zero"
+[ "$resolved" = "crew-deadbeef" ] || fail "resolve-branch: expected the actual branch, got: $resolved"
+bash "$LIFECYCLE" cleanup "$tid2" >/dev/null || fail "cleanup (45) failed"
+[ -d "$T/.worktrees/$tid2" ] && fail "cleanup (45): worktree still exists"
+
 # inspect: diffs the task branch against main
 echo change >> "$T/.worktrees/$tid/f.txt"
 (cd "$T/.worktrees/$tid" && git commit -qam work)

package/lib/worktree-lifecycle.sh

@@ -12,11 +12,23 @@
 # bypassing prepare — task 4e1a1bba, 2026-09-17), resolve_branch() falls
 # back to enumerating refs: the canonical task/<full-id> ref wins, then a
 # task/<id-prefix> ref is tolerated (matched by strict prefix, never
-# created). Canonical stays task/<full-id>; ambiguous prefixes fail closed.
+# created), then the existing worktree's actual checked-out branch
+# (blocker 45, 2026-09-22 — an agent-improvised branch outside the task/
+# namespace is invisible to the prefix scan; the classifier must see the
+# world, not "branch does not exist"). Canonical stays task/<full-id>;
+# ambiguous prefixes fail closed.
+#
+# prepare's reuse contract (blocker 45, 2026-09-22): an existing worktree
+# prints REUSED only when it is checked out on the canonical task/<id>
+# branch. A worktree checked out on another branch (an agent improvised
+# with raw git) is repaired — the registry is re-registered under the
+# actual branch (the branch is never deleted: its commits may be the
+# task's work) — and prepare prints REPAIRED instead of REUSED, so the
+# repair is attributable in the record.
 #
 # Commands:
 #   validate  <task_id>                  — check task ID is safe for branches/paths
-#   prepare   <task_id>                  — create worktree + branch, register ownership
+#   prepare   <task_id>                  — create worktree + branch, register ownership (existing worktree: REUSED, or REPAIRED when re-registered under an improvised branch)
 #   resolve-branch <task_id>             — print the resolved task branch name
 #   inspect   <task_id>                  — diff against the integration target for review
 #   classify-branch <task_id>             — mechanical branch-state classification for Review:
@@ -136,6 +148,17 @@ resolve_branch() {
     echo "ERROR: task id '$task_id' matches multiple task branches: ${matches[*]} — ambiguous, refusing to guess" >&2
     return 1
   fi
+  # Blocker 45 (2026-09-22): the worktree's actual checkout is the mechanical
+  # truth of last resort. An agent-improvised branch (outside the task/
+  # namespace) is invisible to the prefix scan above — the classifier must
+  # see the world, not "branch does not exist".
+  if [ -d "$WORKTREE_DIR/$task_id" ]; then
+    local actual
+    if actual=$(git -C "$WORKTREE_DIR/$task_id" rev-parse --abbrev-ref HEAD 2>/dev/null) && [ -n "$actual" ]; then
+      printf '%s' "$actual"
+      return 0
+    fi
+  fi
   printf '%s' "$canonical"
 }
 
@@ -239,6 +262,25 @@ unregister() {
   rm -f "$REGISTRY_DIR/$1"
 }
 
+# Blocker 45 (2026-09-22): repair the registry's branch attribution without
+# touching anything else. An existing entry keeps its task_id, base_commit,
+# and created fields — only branch= is rewritten. A missing entry is
+# registered fresh (base_commit "unknown" — honest, not fabricated). The
+# agent's branch is never deleted: its commits may be the task's work.
+reregister_branch() {
+  local task_id="$1" branch="$2"
+  local reg="$REGISTRY_DIR/$task_id"
+  mkdir -p "$REGISTRY_DIR"
+  if [ -f "$reg" ] && grep -q '^branch=' "$reg"; then
+    # Escape sed-replacement metacharacters (branch names can carry &).
+    local esc=${branch//\\/\\\\}
+    esc=${esc//&/\\&}
+    sed -i "s|^branch=.*|branch=$esc|" "$reg"
+  else
+    register "$task_id" "unknown" "$branch" "$WORKTREE_DIR/$task_id"
+  fi
+}
+
 # --- commands ---
 
 cmd_validate() {
@@ -256,9 +298,27 @@ cmd_prepare() {
 
   # Reuse existing worktree
   if [ -d "$WORKTREE_DIR/$task_id" ]; then
-    echo "REUSED: worktree exists at .worktrees/$task_id"
-    local head
+    local head actual_branch canonical_branch
     head=$(cd "$WORKTREE_DIR/$task_id" && git rev-parse HEAD)
+    if ! actual_branch=$(cd "$WORKTREE_DIR/$task_id" && git rev-parse --abbrev-ref HEAD 2>/dev/null); then
+      echo "ERROR: worktree .worktrees/$task_id exists but its checked-out branch is unreadable — refusing to REUSE an unverifiable worktree"
+      return 1
+    fi
+    canonical_branch="task/$task_id"
+    # Blocker 45 (2026-09-22): REUSED asserted an invariant it never checked —
+    # the worktree is on the task's canonical branch. Room #29: a Build agent
+    # improvised branch crew-9eda33ca; the retry's prepare REUSED it blindly
+    # and Review's classify-branch parked on "branch does not exist". Verify
+    # the invariant; on mismatch repair the registry (never delete the
+    # agent's branch — its commits may be the task's work) and attribute the
+    # repair with REPAIRED instead of REUSED.
+    if [ "$actual_branch" != "$canonical_branch" ]; then
+      reregister_branch "$task_id" "$actual_branch"
+      echo "REPAIRED: worktree .worktrees/$task_id checked out on branch $actual_branch (expected $canonical_branch); registry re-registered"
+      echo "HEAD: $head"
+      return 0
+    fi
+    echo "REUSED: worktree exists at .worktrees/$task_id"
     echo "HEAD: $head"
     return 0
   fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.14.9",
+  "version": "0.14.11",
   "description": "Opinionated orchestration for Muse — workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,

package/seed/cron-body-template.md

@@ -87,9 +87,13 @@ The failures below are settled and recorded in the Gate 1 OODA state. The author
         The diff and rules are suggestions now, not byte-exact commands (this also sidesteps the platform newline-escaping defect on verbatim requests — the receipt file is what matters, not byte fidelity).
         Edit-request contract: call artifact_edit exactly once. Never retry the edit yourself. Tool unavailable (the artifact namespace would not load), a timeout, a transport error, or any otherwise ambiguous result is inconclusive: record NOTHING for this task, log the ambiguity in one line, and let the claim expire; the next scan re-claims and step 2's receipt check decides. An unrecorded outcome is the only honest record of an unknown one.
         After the call returns, inspect the result text. (2026-09-20 REVIEW) Do NOT record an "acknowledged" builder report — the positive builder-report path was circular (the worker knows the version, so the report proves nothing) and is removed; the ack scan reads the version receipt from the artifact's disk as the sole positive evidence. If the result is an explicit refusal → `node {crewHome}/lib/crew-api.js --crew-home {crewHome} record-builder-report --json '{"task_id":"<task_id>","version":"<version>","outcome":"refused","report_text":"<refusal text verbatim>"}'` (the command MECHANICALLY rejects unless `report_text` contains the exact version — if the refusal text lacks the version, do NOT call record-builder-report; just proceed to the record step with `refused`).
+     3b. **Attest the payload (code, diagnosis only — never a verdict).** After the `artifact_edit` call returns (only when it completed without error and without an explicit refusal), attest what you transmitted as the payload — two branches, no judgment:
+        - **Verbatim paste:** if you pasted the staged diff file's content unchanged into the handoff's `SUGGESTED PATCH` slot, the transmitted bytes are exactly the staged bytes: attest the `diff_sha256` you already verified in step 1's `sha256sum` (reuse that output — no second hashing needed).
+        - **Re-typed or altered paste:** if you re-typed, reformatted, or otherwise changed the diff while pasting, write the EXACT diff text you transmitted — the text between the ` ```diff ` fences of the handoff's `SUGGESTED PATCH` slot, fences excluded — to a temp file with your file-write tool (never through the shell: interpolating diff bytes into a quoted shell string corrupts `$`, backticks, quotes, and backslashes and would hash bytes that were never transmitted), then `sha256sum /tmp/<task_id>-payload.txt`. The write tool preserves exact bytes, including the trailing newline.
+        The wrapper prose around the patch is not attested — there is no canonical intended bytes for it; the payload is the patch. Pass the 64-hex hash as `transmitted_payload_sha256` on the `record-intent-issuance` call (step 4). Code compares it to the staged `diff_sha256` at record time: MATCH means the attested bytes matched the staged bytes; MISMATCH means the paste deviated (re-typing in transit is the failure mode this catches — the blocker-26 family). A MISMATCH is carried into the `version-acknowledged` note (`payload-fidelity: MISMATCH (transmitted <h> != staged <h>)`) — it never changes any verdict (the ack contract prices receipt-attestation, not byte equality). If the paste deviated, attest the deviation honestly and proceed to step 4 — do not re-paste, do not re-issue (step 3: never retry the edit). Perfect attestation is impossible (the paste itself can deviate); this instrument measures self-reported consistency — a lower bound on the true mutation rate, not the rate. Only an honest worker's MISMATCH carries signal: MATCH is uninformative by construction (copying `diff_sha256` from step 1 is uncloseable), and pre-transport truncation of the paste yields a silent false-MATCH — the quiet direction, accepted under diagnosis-only. Omit `transmitted_payload_sha256` if you cannot attest honestly; absent attestation changes nothing.
      4. **Record the outcome (code):**
-        `node {crewHome}/lib/crew-api.js --crew-home {crewHome} record-intent-issuance --json '{"task_id": "<task_id>", "claim_expiry": "<claim_expiry>", "edit_outcome": "<accepted|refused>", "refusal_text": "<first line>", "reclaimed": <true|false>, "receipt_check": "<different|unreadable>"}'`
-        (omit `refusal_text` unless refused; copy `reclaimed` verbatim from the scan entry — it is mechanical, never inferred; `receipt_check` is REQUIRED when `reclaimed` is true and must name the exact step-2 outcome — omit `receipt_check` when `reclaimed` is false. A `match` in step 2 never reaches this step: the edit already landed, so you ack instead of issuing.) Copy `claim_expiry` verbatim from the scan entry — it is the compare-and-swap. If the command returns `recorded: false`, log the reason and stop: another tick owns the task. `accepted` writes the issuer-stamped `submitted` ledger entry and mirrors `publish: edit-issued <commit> attempt=<n> version=<commit>:<attempt>` (the 4.5 ack scan claims it on a later tick); `refused` writes `rejected` and the terminal `publish: publish-refused` note. There is no outcome for an inconclusive call (step 3) — do not call record-intent-issuance at all when the edit's fate is unknown.
+        `node {crewHome}/lib/crew-api.js --crew-home {crewHome} record-intent-issuance --json '{"task_id": "<task_id>", "claim_expiry": "<claim_expiry>", "edit_outcome": "<accepted|refused>", "refusal_text": "<first line>", "reclaimed": <true|false>, "receipt_check": "<different|unreadable>", "transmitted_payload_sha256": "<64-hex attested in step 3b>"}'`
+        (omit `refusal_text` unless refused; omit `transmitted_payload_sha256` unless you attested in step 3b (accepted outcomes only); copy `reclaimed` verbatim from the scan entry — it is mechanical, never inferred; `receipt_check` is REQUIRED when `reclaimed` is true and must name the exact step-2 outcome — omit `receipt_check` when `reclaimed` is false. A `match` in step 2 never reaches this step: the edit already landed, so you ack instead of issuing.) Copy `claim_expiry` verbatim from the scan entry — it is the compare-and-swap. If the command returns `recorded: false`, log the reason and stop: another tick owns the task. `accepted` writes the issuer-stamped `submitted` ledger entry and mirrors `publish: edit-issued <commit> attempt=<n> version=<commit>:<attempt>` (the 4.5 ack scan claims it on a later tick); `refused` writes `rejected` and the terminal `publish: publish-refused` note. There is no outcome for an inconclusive call (step 3) — do not call record-intent-issuance at all when the edit's fate is unknown.
      - Prose never mints `publish:` notes directly. Any tick-authored publish note goes through exactly one path (code asserts the verb against the closed registry, rejects unknown verbs):
        `node {crewHome}/lib/crew-api.js --crew-home {crewHome} record-publish-note --json '{"task_id":"<task_id>","note":"<full note text>"}'`
    - Crash rules (fail closed, never blind re-issue): if this tick dies between the artifact_edit call and the record step, the next scan re-claims with `reclaimed: true` and step 2's version-receipt check decides between ack (`record-version-ack` with `via: "disk"`) and a fresh issuance — recorded with its explicit `receipt_check`, since a differing/unreadable receipt is not proof the prior attempt's edit did not land. The issuance contract is at-most-one RECORDED issuance per attempt; a duplicate physical issuance across a lease expiry is content-identical (the same checksummed staged diff) and bounded by the ack scan's 2-hour budget.

package/workflows/bugfix.js

@@ -825,8 +825,52 @@ if (CAPTURE_INDEX < 0) throw new Error("STEPS missing 'Capture' step");
 const REWORK_STEP = STEPS[BUILD_INDEX].name;
 // Shared rework budget: Review and QA rejections draw from the SAME pool of 2.
 // E.g. 2 Review bounces + 1 QA bounce = 3 total > budget -> task blocks.
+// Blocker 46 (2026-09-22): the budget is task-durable, not per-run. A run
+// ends on every operational failure (agent timeout, worktree-confinement
+// failure) and the dispatcher launches a fresh run — the old `let ... = 0`
+// reset the counter on each launch, so a task whose runs kept ending
+// operationally between rejections reworked unboundedly while the designed
+// park stayed unreachable (room #29 J1: 3 rejections across 4 runs, never
+// parked). The counter is seeded from the task's durable event stream at
+// run start (seedReworkCount, after the pin block); in-run increments are
+// unchanged.
 const MAX_TOTAL_REWORK = 2;
 let totalReworkCount = 0;
+// Blocker 46: the first-claim test used totalReworkCount === 0 as a proxy
+// for "this run is entering its first step". The counter is now seeded from
+// task history, so the proxy lies on re-run launches — use an explicit
+// run-local flag instead. The first claim (self-claim with raced-duplicate
+// stand-down) must fire exactly once per run.
+let firstClaimDone = false;
+
+// Blocker 46: count verdict-level `rejected` events (Review/QA rejections —
+// record-phase writes the event type equal to the session status) in the
+// task's durable event stream. Operational failure ends are `failed`, never
+// `rejected`, so they must not spend retry headroom. A failed seed must not
+// strand the run: start at 0 and let the in-run budget govern this run; the
+// seed is retried on the next run.
+async function seedReworkCount() {
+  try {
+    var seed = await agent(
+      "Read this task's event history.\n" +
+      "Run in shell and return the stdout verbatim:\n" + crewCmd("get-events", { task_id: taskId, limit: 100 }) + "\n" +
+      "Count the events whose type is exactly \"rejected\".\n" +
+      "Return JSON { \"rejected_count\": <integer> } and nothing else.",
+      {
+        key: "rework-seed-" + taskId,
+        label: "Seeding shared rework budget from task history",
+        schema: { type: "object", properties: { rejected_count: { type: "number" } }, required: ["rejected_count"] }
+      }
+    );
+    var n = Math.floor(Number(seed && seed.rejected_count) || 0);
+    if (!(n >= 0)) n = 0;
+    if (n > 0) log("Shared rework budget seeded from task history: " + n + " prior rejection(s)");
+    return n;
+  } catch (e) {
+    log("Rework-budget seed unavailable (" + ((e && e.message) || String(e)).slice(0, 120) + ") — starting at 0");
+    return 0;
+  }
+}
 let rejectionNotes = inputs.rejection_notes || "";
 let mapperSpec = "";
 // Visual verdict state: Sage's experiential flag (true/false/null until the
@@ -940,6 +984,11 @@ log("Lifecycle scripts pinned to " + RUN_LIB);
 CREW_API = CREW_API_PINNED;
 log("Crew API pinned to " + CREW_API);
 
+// Blocker 46: seed the task-durable rework budget from the task's event
+// history before the phase loop. Pinned copy, so the seed reads the same
+// release this run executes.
+totalReworkCount = await seedReworkCount();
+
 // Merge-lock holder identity (bug 2fc8f52f): the opaque task+run identity
 // minted at this run's first claim (never a PID — short-lived agent PIDs
 // made every concurrent acquire take the stale path). Set exactly once on
@@ -948,7 +997,7 @@ let lockHolder = taskId;
 
 while (i < STEPS.length) {
   const step = STEPS[i];
-  const isFirstClaim = (i === startStepIndex && totalReworkCount === 0);
+  const isFirstClaim = (i === startStepIndex && !firstClaimDone);
 
   phase(step.name);
   log(step.name + " step (" + step.identity + ") for task " + taskId);
@@ -1113,6 +1162,7 @@ while (i < STEPS.length) {
       return { status: "duplicate", task_id: taskId, reason: "task already claimed by another run" };
     }
     activeSessionId = claimResult.session_id;
+    firstClaimDone = true; // blocker 46: exactly once per run
   } else {
     const claimResult = await agent(
       "Claim a session for this task step.\n" +
@@ -1587,7 +1637,7 @@ while (i < STEPS.length) {
       reviewChangeExam =
         "The branch has no commits ahead of the integration target (see MECHANICAL FACT below) — there is no diff to examine. Judge the Build report's `repo_diff: none` claim on its plausibility.\n\n";
       reviewBranchRule =
-        "MECHANICAL FACT (computed by the workflow from git — never by a reviewer): the branch has no commits ahead of the integration target and no task-attributed merge on the target was verified; the Build report declares `repo_diff: none` (no repo change). Approve ONLY if the task's deliverable is plausibly runtime state (e.g. a cron definition, scheduler change, or dashboard/config state created outside the repo). Otherwise report 'no commits ahead of the integration target and no plausible runtime-state deliverable — the builder likely forgot to commit', then end your report with exactly this line: VERDICT: FAIL.\n";
+        "MECHANICAL FACT (computed by the workflow from git — never by a reviewer): the branch has no commits ahead of the integration target and no task-attributed merge on the target was verified; the Build report declares `repo_diff: none` (no repo change). Approve ONLY if the task's deliverable is plausibly runtime state (e.g. a cron definition, scheduler change, or dashboard/config state created outside the repo). Otherwise report 'no commits ahead of the integration target and no plausible runtime-state deliverable — the branch is empty and no task-attributed merge was verified', then end your report with exactly this line: VERDICT: FAIL.\n";
     } else {
       // Mechanical FAIL — Cass is never dispatched (see the dispatch gate
       // below). Instructions are unused; keep the shape.
@@ -2080,14 +2130,15 @@ while (i < STEPS.length) {
         "You are code-blind QA. You NEVER read source files. Public docs are not source — read them as a user would.\n" +
         "STEP 1: Experiential visual inspection — drive the fixed artifact as a user would, one browser step at a time, and verify the reported bug is actually fixed.\n" +
         "You have a see-act driver: " + crewHome + "/current/lib/see-act.js (a node script; one browser action per invocation; it prints one JSON line to stdout). It launches its own Chromium through a self-contained loopback proxy — the ONLY url you may give it is the local artifact server you start below. Never point it at any other URL.\n" +
+        "SESSION PROTOCOL (multi-step flows): one-shot invocations launch a fresh browser each time, so they cannot drive flows where a later step needs an earlier step's living page state (open a dialog, then confirm it — the second step needs the first step's page state). For those, hold ONE browser alive: node " + crewHome + "/current/lib/see-act.js session-start --name qa --url http://localhost:<N>/ --log " + crewHome + "/task-evidence/" + taskId + "/postchange/ooda-log.jsonl — launches Chromium once in a detached daemon (its control server binds 127.0.0.1 only; the daemon exits after 10 min with no act). The --log path is the SAME ooda-log.jsonl the QA guard reads: every session-act appends its own JSON line in the exact step schema (step, attempt, action, args, exit, screenshot, observation), so you do NOT call append-ooda-step.js for session acts — READ each act's JSON result (the screenshot field is the path to READ with your read tool) and decide the next action. Then drive it: node " + crewHome + "/current/lib/see-act.js session-act --name qa --attempt \"1\" <aria|shot|click|scroll|type> [args] — one action inside the living page. Prefix EVERY session-act invocation with SEE_ACT_ARCHIVE_DIR=" + crewHome + "/task-evidence/" + taskId + "/postchange/ (shell env vars do not persist between your commands, so prefix each one). When done: node " + crewHome + "/current/lib/see-act.js session-end --name qa — closes the browser, prints the session summary, and keeps the session dir as evidence. If session-start exits 3 with a \"NOT POSSIBLE: <reason>\" string, the environment cannot drive a browser: report NOT POSSIBLE: <reason> and continue with the mechanical checks — your VERDICT then covers mechanical checks only.\n" +
         "Actions: aria | shot [--out <png>] [--full] | click [--out <png>] --selector <css> | scroll [--out <png>] --y <pixels|bottom> | type [--out <png>] --selector <css> --text <text>. Add --viewport mobile for a 390x844 frame. The JSON reports console_errors — treat any as a defect signal. Exit code 3 with not_possible set (a \"NOT POSSIBLE: <reason>\" string) means this environment cannot drive a browser: report NOT POSSIBLE: <reason> and continue with the mechanical checks — your VERDICT then covers mechanical checks only.\n" +
         "a. Verify the built artifact exists: test -d ~/workspace/ts-spaces/" + PUBLISH_SLUG + "/client/dist && test -f ~/workspace/ts-spaces/" + PUBLISH_SLUG + "/server/dist/actions.js — if either is missing, report NOT POSSIBLE: built artifact not present at ~/workspace/ts-spaces/" + PUBLISH_SLUG + " and continue with the mechanical checks.\n" +
         "b. Start the local artifact server detached with a log file, then poll the log for readiness (single shell invocation): CREW_HOME=" + crewHome + " setsid nohup node " + crewHome + "/current/lib/serve-artifact.js --space-dir ~/workspace/ts-spaces/" + PUBLISH_SLUG + " --port 0 --tag " + taskId + "-qa > /tmp/qa-server-" + taskId + ".log 2>&1 < /dev/null & for i in $(seq 1 30); do grep -q READY /tmp/qa-server-" + taskId + ".log && break; sleep 1; done; grep -o 'READY port=[0-9]*' /tmp/qa-server-" + taskId + ".log | cut -d= -f2 — the printed number is <N>. If no READY appears, report NOT POSSIBLE: local artifact server did not start (see /tmp/qa-server-" + taskId + ".log) and continue with the mechanical checks.\n" +
         "c. Bounded see-act loop, at most 8 steps: re-run the reproduction steps for the reported bug — does it still occur? Then check the surrounding views for regressions. Prefix EVERY see-act invocation with SEE_ACT_ARCHIVE_DIR=" + crewHome + "/task-evidence/" + taskId + "/postchange/ (shell env vars do not persist between your commands, so prefix each one) — every screenshot is then archived automatically as 001-shot-desktop.png, 002-click-desktop.png, ..., so no frame can be lost. Omit --out; the JSON's screenshot field is the path to READ with your read tool (you can see images).\n" +
-        "c2. After EVERY see-act invocation, append it to the OODA report: node " + crewHome + "/current/lib/append-ooda-step.js --log " + crewHome + "/task-evidence/" + taskId + "/postchange/ooda-log.jsonl --attempt \"1\" --step <N> --action <aria|shot|click|scroll|type> --exit <exit-code> --screenshot <screenshot-from-JSON> --observation \"<1-2 sentences: what the frame showed and what you concluded>\" (omit --screenshot for aria). Steps are strictly monotonic: your first step is --step 1, then 2, 3, ... — the script rejects anything else. If you run the loop again (a new idea, after a restart), that run is --attempt \"2\": attempts never overwrite, they accumulate. Your observation is the payload — say what you saw and what it means, not just what you did. A step you ran but did not log is invisible to everyone after you.\n" +
+        "c2. After EVERY one-shot see-act invocation, append it to the OODA report: node " + crewHome + "/current/lib/append-ooda-step.js --log " + crewHome + "/task-evidence/" + taskId + "/postchange/ooda-log.jsonl --attempt \"1\" --step <N> --action <aria|shot|click|scroll|type> --exit <exit-code> --screenshot <screenshot-from-JSON> --observation \"<1-2 sentences: what the frame showed and what you concluded>\" (omit --screenshot for aria). (Session acts are self-logging — session-act already appended its line; for those, READ the result instead of re-logging.) Steps are strictly monotonic: your first step is --step 1, then 2, 3, ... — the script rejects anything else. If you run the loop again (a new idea, after a restart), that run is --attempt \"2\": attempts never overwrite, they accumulate. Your observation is the payload — say what you saw and what it means, not just what you did. A step you ran but did not log is invisible to everyone after you.\n" +
 "c2b. IMAGE TOOLS (when a raw screenshot is not enough evidence): python3 " + crewHome + "/current/lib/edit-image.py crop --in <frame.png> --out <crop.png> --region x,y,w,h — pixel-exact crop; zoom --factor <f> --center x,y — pixel-crisp zoom back to the original frame size; label --text \"<caption>\" — caption bar; nup --cols 2 --in <a.png> --in <b.png> --labels \"before|after\" — side-by-side grid. Deterministic, no network. Log each with --action crop|zoom|label|nup, --attempt \"1\", and --screenshot <the derivative you READ>. For rich compositions (before/after with real typography, annotated callouts), write an HTML page and render it: node " + crewHome + "/current/lib/render-html.js --in <page.html> --out <composed.png> [--width 1200] — headless Chromium, hermetic (remote assets are blocked and fail the render), deterministic; log with --action compose and --screenshot <the composition you READ>. Derivatives supplement, never replace: keep the source frame archived and name it in --args. READ every derivative you log — an unread image is not evidence.\n" +
         "c3. Start with: SEE_ACT_ARCHIVE_DIR=" + crewHome + "/task-evidence/" + taskId + "/postchange/ node " + crewHome + "/current/lib/see-act.js --url http://localhost:<N>/ aria — read the JSON, log the step. Then: SEE_ACT_ARCHIVE_DIR=" + crewHome + "/task-evidence/" + taskId + "/postchange/ node " + crewHome + "/current/lib/see-act.js --url http://localhost:<N>/ shot — READ the screenshot, log the step. Act on what you see: click, scroll, type, then re-observe, logging each step. Prefer aria (cheap text) to find controls; screenshot when the view changes and for your final verdict frames (one desktop, one mobile). If a click exits non-zero, do NOT retry the same ref blindly: re-run aria first (refs go stale between invocations), then click the fresh ref exactly once. If it still fails, log the failure and move on — a flaky control is a finding, not a loop.\n" +
-        "d. One action per invocation, fresh browser each time: anything reachable by (navigate, one action) is testable — e.g. clicking any tab or button from the landing page. Sequences needing prior in-page state (open a dialog, then confirm it) are not; if the fix needs such a sequence to verify, report NOT POSSIBLE for that part and judge what you can.\n" +
+        "d. Reach: with the session protocol, any flow reachable by N in-page actions is drivable — open the dialog, then confirm it, then judge the result. Without a session (one-shot invocations), anything reachable by (navigate, one action) is testable and sequences needing prior in-page state are not — use a session for those. Report NOT POSSIBLE only when the tooling itself fails (session-start exits 3): a flow you could not reach is not NOT POSSIBLE — name the exact step that stopped you in verdict.json's missing evidence and continue with the mechanical checks.\n" +
         "e. Judge as a user against the task description: is the reported bug fixed AND is nothing else visibly broken? Look for broken layout, overflow, missing or wrong content, stale data, and console errors. Compare against the task's expected behavior, never against source code (you are code-blind). Every frame you captured is already archived under " + crewHome + "/task-evidence/" + taskId + "/postchange/ and indexed in ooda-log.jsonl. A frame you did not read is not evidence. Loading, error, or blank frames never pass. If you cannot complete the loop, say exactly which steps are missing — unknown is not PASS.\n" +
         "f. Kill ONLY the server you started: pkill -f 'serve-artifact[.]js.*--tag " + taskId + "-qa' — never another task's server. (The [.] keeps pkill from matching its own command line.) Do not leave it running.\n" +
         "Then continue with the mechanical checks below. Your VERDICT covers both the visual and the mechanical checks.\n\n" +
@@ -2234,7 +2285,7 @@ while (i < STEPS.length) {
         : "Branch state (classified by the workflow from git): empty-no-work — the task branch has no commits ahead of the integration target, " +
           "no task-attributed merge on the target was verified" + (branchStateErr ? " (branch classification itself failed: " + branchStateErr + ")" : "") + ", " +
           "and the accepted Build report declared no `repo_diff: none` deliverable. " +
-          "No change was reviewed because there is no change to review. The builder likely forgot to commit.\n") +
+          "No change was reviewed because there is no change to review. The branch is empty and no task-attributed merge was verified.\n") +
       "Worktree: " + WORKTREE_HINT + "\n" +
       "Recovery: commit the deliverable on the task branch in the worktree above and re-run Review. If the deliverable is genuinely runtime state outside the repo, declare `repo_diff: none` in the Build report instead of leaving the branch empty without a declaration.\n" +
       "VERDICT: FAIL";

package/workflows/chore.js

@@ -793,6 +793,50 @@ if (CAPTURE_INDEX < 0) throw new Error("STEPS missing 'Capture' step");
 const REWORK_STEP = STEPS[BUILD_INDEX].name;
 const MAX_REWORK = 2;
 let reworkCount = 0;
+// Blocker 46 (2026-09-22): the budget is task-durable, not per-run. A run
+// ends on every operational failure (agent timeout, worktree-confinement
+// failure) and the dispatcher launches a fresh run — the old `let ... = 0`
+// reset the counter on each launch, so a task whose runs kept ending
+// operationally between rejections reworked unboundedly while the designed
+// park stayed unreachable (room #29 J1: 3 rejections across 4 runs, never
+// parked). The counter is seeded from the task's durable event stream at
+// run start (seedReworkCount, after the pin block); in-run increments are
+// unchanged.
+// Blocker 46: the first-claim test used reworkCount === 0 as a proxy for
+// "this run is entering its first step". The counter is now seeded from
+// task history, so the proxy lies on re-run launches — use an explicit
+// run-local flag instead. The first claim (self-claim with raced-duplicate
+// stand-down) must fire exactly once per run.
+let firstClaimDone = false;
+
+// Blocker 46: count verdict-level `rejected` events (Review/QA rejections —
+// record-phase writes the event type equal to the session status) in the
+// task's durable event stream. Operational failure ends are `failed`, never
+// `rejected`, so they must not spend retry headroom. A failed seed must not
+// strand the run: start at 0 and let the in-run budget govern this run; the
+// seed is retried on the next run.
+async function seedReworkCount() {
+  try {
+    var seed = await agent(
+      "Read this task's event history.\n" +
+      "Run in shell and return the stdout verbatim:\n" + crewCmd("get-events", { task_id: taskId, limit: 100 }) + "\n" +
+      "Count the events whose type is exactly \"rejected\".\n" +
+      "Return JSON { \"rejected_count\": <integer> } and nothing else.",
+      {
+        key: "rework-seed-" + taskId,
+        label: "Seeding shared rework budget from task history",
+        schema: { type: "object", properties: { rejected_count: { type: "number" } }, required: ["rejected_count"] }
+      }
+    );
+    var n = Math.floor(Number(seed && seed.rejected_count) || 0);
+    if (!(n >= 0)) n = 0;
+    if (n > 0) log("Shared rework budget seeded from task history: " + n + " prior rejection(s)");
+    return n;
+  } catch (e) {
+    log("Rework-budget seed unavailable (" + ((e && e.message) || String(e)).slice(0, 120) + ") — starting at 0");
+    return 0;
+  }
+}
 let rejectionNotes = inputs.rejection_notes || "";
 let mapperSpec = "";
 // Visual verdict state: Sage's experiential flag (true/false/null until the
@@ -904,6 +948,11 @@ log("Lifecycle scripts pinned to " + RUN_LIB);
 CREW_API = CREW_API_PINNED;
 log("Crew API pinned to " + CREW_API);
 
+// Blocker 46: seed the task-durable rework budget from the task's event
+// history before the phase loop. Pinned copy, so the seed reads the same
+// release this run executes.
+reworkCount = await seedReworkCount();
+
 // Merge-lock holder identity (bug 2fc8f52f): the opaque task+run identity
 // minted at this run's first claim (never a PID — short-lived agent PIDs
 // made every concurrent acquire take the stale path). Set exactly once on
@@ -912,7 +961,7 @@ let lockHolder = taskId;
 
 while (i < STEPS.length) {
   const step = STEPS[i];
-  const isFirstClaim = (i === startStepIndex && reworkCount === 0);
+  const isFirstClaim = (i === startStepIndex && !firstClaimDone);
 
   phase(step.name);
   log(step.name + " step (" + step.identity + ") for task " + taskId);
@@ -1084,6 +1133,7 @@ while (i < STEPS.length) {
       return { status: "duplicate", task_id: taskId, reason: "task already claimed by another run" };
     }
     activeSessionId = claimResult.session_id;
+    firstClaimDone = true; // blocker 46: exactly once per run
     await telemetryEvent("claim", step.name + " claimed");
     // Flush telemetry before proceeding — the claim is a critical point.
     // If a subsequent agent() fails, we want the claim event persisted.
@@ -1450,7 +1500,7 @@ while (i < STEPS.length) {
       reviewChangeExam =
         "The branch has no commits ahead of the integration target (see MECHANICAL FACT below) — there is no diff to examine. Judge the Build report's `repo_diff: none` claim on its plausibility.\n\n";
       reviewBranchRule =
-        "MECHANICAL FACT (computed by the workflow from git — never by a reviewer): the branch has no commits ahead of the integration target and no task-attributed merge on the target was verified; the Build report declares `repo_diff: none` (no repo change). Approve ONLY if the task's deliverable is plausibly runtime state (e.g. a cron definition, scheduler change, or dashboard/config state created outside the repo). Otherwise report 'no commits ahead of the integration target and no plausible runtime-state deliverable — the builder likely forgot to commit', then end your report with exactly this line: VERDICT: FAIL.\n";
+        "MECHANICAL FACT (computed by the workflow from git — never by a reviewer): the branch has no commits ahead of the integration target and no task-attributed merge on the target was verified; the Build report declares `repo_diff: none` (no repo change). Approve ONLY if the task's deliverable is plausibly runtime state (e.g. a cron definition, scheduler change, or dashboard/config state created outside the repo). Otherwise report 'no commits ahead of the integration target and no plausible runtime-state deliverable — the branch is empty and no task-attributed merge was verified', then end your report with exactly this line: VERDICT: FAIL.\n";
     } else {
       // Mechanical FAIL — Cass is never dispatched (see the dispatch gate
       // below). Instructions are unused; keep the shape.
@@ -1935,7 +1985,7 @@ while (i < STEPS.length) {
         : "Branch state (classified by the workflow from git): empty-no-work — the task branch has no commits ahead of the integration target, " +
           "no task-attributed merge on the target was verified" + (branchStateErr ? " (branch classification itself failed: " + branchStateErr + ")" : "") + ", " +
           "and the accepted Build report declared no `repo_diff: none` deliverable. " +
-          "No change was reviewed because there is no change to review. The builder likely forgot to commit.\n") +
+          "No change was reviewed because there is no change to review. The branch is empty and no task-attributed merge was verified.\n") +
       "Worktree: " + WORKTREE_HINT + "\n" +
       "Recovery: commit the deliverable on the task branch in the worktree above and re-run Review. If the deliverable is genuinely runtime state outside the repo, declare `repo_diff: none` in the Build report instead of leaving the branch empty without a declaration.\n" +
       "VERDICT: FAIL";

package/workflows/standard.js

@@ -790,8 +790,52 @@ if (CAPTURE_INDEX < 0) throw new Error("STEPS missing 'Capture' step");
 const REWORK_STEP = STEPS[BUILD_INDEX].name;
 // Shared rework budget: Review and QA rejections draw from the SAME pool of 2.
 // E.g. 2 Review bounces + 1 QA bounce = 3 total > budget -> task blocks.
+// Blocker 46 (2026-09-22): the budget is task-durable, not per-run. A run
+// ends on every operational failure (agent timeout, worktree-confinement
+// failure) and the dispatcher launches a fresh run — the old `let ... = 0`
+// reset the counter on each launch, so a task whose runs kept ending
+// operationally between rejections reworked unboundedly while the designed
+// park stayed unreachable (room #29 J1: 3 rejections across 4 runs, never
+// parked). The counter is seeded from the task's durable event stream at
+// run start (seedReworkCount, after the pin block); in-run increments are
+// unchanged.
 const MAX_TOTAL_REWORK = 2;
 let totalReworkCount = 0;
+// Blocker 46: the first-claim test used totalReworkCount === 0 as a proxy
+// for "this run is entering its first step". The counter is now seeded from
+// task history, so the proxy lies on re-run launches — use an explicit
+// run-local flag instead. The first claim (self-claim with raced-duplicate
+// stand-down) must fire exactly once per run.
+let firstClaimDone = false;
+
+// Blocker 46: count verdict-level `rejected` events (Review/QA rejections —
+// record-phase writes the event type equal to the session status) in the
+// task's durable event stream. Operational failure ends are `failed`, never
+// `rejected`, so they must not spend retry headroom. A failed seed must not
+// strand the run: start at 0 and let the in-run budget govern this run; the
+// seed is retried on the next run.
+async function seedReworkCount() {
+  try {
+    var seed = await agent(
+      "Read this task's event history.\n" +
+      "Run in shell and return the stdout verbatim:\n" + crewCmd("get-events", { task_id: taskId, limit: 100 }) + "\n" +
+      "Count the events whose type is exactly \"rejected\".\n" +
+      "Return JSON { \"rejected_count\": <integer> } and nothing else.",
+      {
+        key: "rework-seed-" + taskId,
+        label: "Seeding shared rework budget from task history",
+        schema: { type: "object", properties: { rejected_count: { type: "number" } }, required: ["rejected_count"] }
+      }
+    );
+    var n = Math.floor(Number(seed && seed.rejected_count) || 0);
+    if (!(n >= 0)) n = 0;
+    if (n > 0) log("Shared rework budget seeded from task history: " + n + " prior rejection(s)");
+    return n;
+  } catch (e) {
+    log("Rework-budget seed unavailable (" + ((e && e.message) || String(e)).slice(0, 120) + ") — starting at 0");
+    return 0;
+  }
+}
 let rejectionNotes = inputs.rejection_notes || "";
 let mapperSpec = "";
 // Visual verdict state: Sage's experiential flag (true/false/null until the
@@ -899,6 +943,11 @@ log("Lifecycle scripts pinned to " + RUN_LIB);
 CREW_API = CREW_API_PINNED;
 log("Crew API pinned to " + CREW_API);
 
+// Blocker 46: seed the task-durable rework budget from the task's event
+// history before the phase loop. Pinned copy, so the seed reads the same
+// release this run executes.
+totalReworkCount = await seedReworkCount();
+
 // Merge-lock holder identity (bug 2fc8f52f): the opaque task+run identity
 // minted at this run's first claim (never a PID — short-lived agent PIDs
 // made every concurrent acquire take the stale path). Set exactly once on
@@ -907,7 +956,7 @@ let lockHolder = taskId;
 
 while (i < STEPS.length) {
   const step = STEPS[i];
-  const isFirstClaim = (i === startStepIndex && totalReworkCount === 0);
+  const isFirstClaim = (i === startStepIndex && !firstClaimDone);
 
   phase(step.name);
   log(step.name + " step (" + step.identity + ") for task " + taskId);
@@ -1072,6 +1121,7 @@ while (i < STEPS.length) {
       return { status: "duplicate", task_id: taskId, reason: "task already claimed by another run" };
     }
     activeSessionId = claimResult.session_id;
+    firstClaimDone = true; // blocker 46: exactly once per run
   } else {
     const claimResult = await agent(
       "Claim a session for this task step.\n" +
@@ -1476,7 +1526,7 @@ while (i < STEPS.length) {
       reviewChangeExam =
         "The branch has no commits ahead of the integration target (see MECHANICAL FACT below) — there is no diff to examine. Judge the Build report's `repo_diff: none` claim on its plausibility.\n\n";
       reviewBranchRule =
-        "MECHANICAL FACT (computed by the workflow from git — never by a reviewer): the branch has no commits ahead of the integration target and no task-attributed merge on the target was verified; the Build report declares `repo_diff: none` (no repo change). Approve ONLY if the task's deliverable is plausibly runtime state (e.g. a cron definition, scheduler change, or dashboard/config state created outside the repo). Otherwise report 'no commits ahead of the integration target and no plausible runtime-state deliverable — the builder likely forgot to commit', then end your report with exactly this line: VERDICT: FAIL.\n";
+        "MECHANICAL FACT (computed by the workflow from git — never by a reviewer): the branch has no commits ahead of the integration target and no task-attributed merge on the target was verified; the Build report declares `repo_diff: none` (no repo change). Approve ONLY if the task's deliverable is plausibly runtime state (e.g. a cron definition, scheduler change, or dashboard/config state created outside the repo). Otherwise report 'no commits ahead of the integration target and no plausible runtime-state deliverable — the branch is empty and no task-attributed merge was verified', then end your report with exactly this line: VERDICT: FAIL.\n";
     } else {
       // Mechanical FAIL — Cass is never dispatched (see the dispatch gate
       // below). Instructions are unused; keep the shape.
@@ -1969,14 +2019,15 @@ while (i < STEPS.length) {
         "Public docs (API.md, README, published action schemas) are NOT source code — read them freely, exactly as a user would.\n\n" +
         "STEP 1: Experiential visual inspection — drive the artifact as a user would, one browser step at a time.\n" +
         "You have a see-act driver: " + crewHome + "/current/lib/see-act.js (a node script; one browser action per invocation; it prints one JSON line to stdout). It launches its own Chromium through a self-contained loopback proxy — the ONLY url you may give it is the local artifact server you start below. Never point it at any other URL.\n" +
+        "SESSION PROTOCOL (multi-step flows): one-shot invocations launch a fresh browser each time, so they cannot drive flows where a later step needs an earlier step's living page state (open a deck, then click Study — the second step needs the first step's page state). For those, hold ONE browser alive: node " + crewHome + "/current/lib/see-act.js session-start --name qa --url http://localhost:<N>/ --log " + crewHome + "/task-evidence/" + taskId + "/postchange/ooda-log.jsonl — launches Chromium once in a detached daemon (its control server binds 127.0.0.1 only; the daemon exits after 10 min with no act). The --log path is the SAME ooda-log.jsonl the QA guard reads: every session-act appends its own JSON line in the exact step schema (step, attempt, action, args, exit, screenshot, observation), so you do NOT call append-ooda-step.js for session acts — READ each act's JSON result (the screenshot field is the path to READ with your read tool) and decide the next action. Then drive it: node " + crewHome + "/current/lib/see-act.js session-act --name qa --attempt \"1\" <aria|shot|click|scroll|type> [args] — one action inside the living page. Prefix EVERY session-act invocation with SEE_ACT_ARCHIVE_DIR=" + crewHome + "/task-evidence/" + taskId + "/postchange/ (shell env vars do not persist between your commands, so prefix each one). When done: node " + crewHome + "/current/lib/see-act.js session-end --name qa — closes the browser, prints the session summary, and keeps the session dir as evidence. If session-start exits 3 with a \"NOT POSSIBLE: <reason>\" string, the environment cannot drive a browser: report NOT POSSIBLE: <reason> and judge what you can.\n" +
         "Actions: aria | shot [--out <png>] [--full] | click [--out <png>] --selector <css> | scroll [--out <png>] --y <pixels|bottom> | type [--out <png>] --selector <css> --text <text>. Add --viewport mobile for a 390x844 frame. The JSON reports console_errors — treat any as a defect signal. Exit code 3 with not_possible set (a \"NOT POSSIBLE: <reason>\" string) means this environment cannot drive a browser: report NOT POSSIBLE: <reason> and continue with the mechanical checks — your VERDICT then covers mechanical checks only.\n" +
         "a. Verify the built artifact exists: test -d ~/workspace/ts-spaces/" + PUBLISH_SLUG + "/client/dist && test -f ~/workspace/ts-spaces/" + PUBLISH_SLUG + "/server/dist/actions.js — if either is missing, report NOT POSSIBLE: built artifact not present at ~/workspace/ts-spaces/" + PUBLISH_SLUG + " and continue with the mechanical checks.\n" +
         "b. Start the local artifact server detached with a log file, then poll the log for readiness (single shell invocation): CREW_HOME=" + crewHome + " setsid nohup node " + crewHome + "/current/lib/serve-artifact.js --space-dir ~/workspace/ts-spaces/" + PUBLISH_SLUG + " --port 0 --tag " + taskId + "-qa > /tmp/qa-server-" + taskId + ".log 2>&1 < /dev/null & for i in $(seq 1 30); do grep -q READY /tmp/qa-server-" + taskId + ".log && break; sleep 1; done; grep -o 'READY port=[0-9]*' /tmp/qa-server-" + taskId + ".log | cut -d= -f2 — the printed number is <N>. If no READY appears, report NOT POSSIBLE: local artifact server did not start (see /tmp/qa-server-" + taskId + ".log) and continue with the mechanical checks.\n" +
         "c. Bounded see-act loop, at most 8 steps: drive the artifact as a user would, one browser step at a time. Prefix EVERY see-act invocation with SEE_ACT_ARCHIVE_DIR=" + crewHome + "/task-evidence/" + taskId + "/postchange/ (shell env vars do not persist between your commands, so prefix each one) — every screenshot is then archived automatically as 001-shot-desktop.png, 002-click-desktop.png, ..., so no frame can be lost. Omit --out; the JSON's screenshot field is the path to READ with your read tool (you can see images).\n" +
-        "c2. After EVERY see-act invocation, append it to the OODA report: node " + crewHome + "/current/lib/append-ooda-step.js --log " + crewHome + "/task-evidence/" + taskId + "/postchange/ooda-log.jsonl --attempt \"1\" --step <N> --action <aria|shot|click|scroll|type> --exit <exit-code> --screenshot <screenshot-from-JSON> --observation \"<1-2 sentences: what the frame showed and what you concluded>\" (omit --screenshot for aria). Steps are strictly monotonic: your first step is --step 1, then 2, 3, ... — the script rejects anything else. If you run the loop again (a new idea, after a restart), that run is --attempt \"2\": attempts never overwrite, they accumulate. Your observation is the payload — say what you saw and what it means, not just what you did. A step you ran but did not log is invisible to everyone after you.\n" +
+        "c2. After EVERY one-shot see-act invocation, append it to the OODA report: node " + crewHome + "/current/lib/append-ooda-step.js --log " + crewHome + "/task-evidence/" + taskId + "/postchange/ooda-log.jsonl --attempt \"1\" --step <N> --action <aria|shot|click|scroll|type> --exit <exit-code> --screenshot <screenshot-from-JSON> --observation \"<1-2 sentences: what the frame showed and what you concluded>\" (omit --screenshot for aria). (Session acts are self-logging — session-act already appended its line; for those, READ the result instead of re-logging.) Steps are strictly monotonic: your first step is --step 1, then 2, 3, ... — the script rejects anything else. If you run the loop again (a new idea, after a restart), that run is --attempt \"2\": attempts never overwrite, they accumulate. Your observation is the payload — say what you saw and what it means, not just what you did. A step you ran but did not log is invisible to everyone after you.\n" +
 "c2b. IMAGE TOOLS (when a raw screenshot is not enough evidence): python3 " + crewHome + "/current/lib/edit-image.py crop --in <frame.png> --out <crop.png> --region x,y,w,h — pixel-exact crop; zoom --factor <f> --center x,y — pixel-crisp zoom back to the original frame size; label --text \"<caption>\" — caption bar; nup --cols 2 --in <a.png> --in <b.png> --labels \"before|after\" — side-by-side grid. Deterministic, no network. Log each with --action crop|zoom|label|nup, --attempt \"1\", and --screenshot <the derivative you READ>. For rich compositions (before/after with real typography, annotated callouts), write an HTML page and render it: node " + crewHome + "/current/lib/render-html.js --in <page.html> --out <composed.png> [--width 1200] — headless Chromium, hermetic (remote assets are blocked and fail the render), deterministic; log with --action compose and --screenshot <the composition you READ>. Derivatives supplement, never replace: keep the source frame archived and name it in --args. READ every derivative you log — an unread image is not evidence.\n" +
         "c3. Start with: SEE_ACT_ARCHIVE_DIR=" + crewHome + "/task-evidence/" + taskId + "/postchange/ node " + crewHome + "/current/lib/see-act.js --url http://localhost:<N>/ aria — read the JSON, log the step. Then: SEE_ACT_ARCHIVE_DIR=" + crewHome + "/task-evidence/" + taskId + "/postchange/ node " + crewHome + "/current/lib/see-act.js --url http://localhost:<N>/ shot — READ the screenshot, log the step. Act on what you see: click, scroll, type, then re-observe, logging each step. Prefer aria (cheap text) to find controls; screenshot when the view changes and for your final verdict frames (one desktop, one mobile). If a click exits non-zero, do NOT retry the same ref blindly: re-run aria first (refs go stale between invocations), then click the fresh ref exactly once. If it still fails, log the failure and move on — a flaky control is a finding, not a loop.\n" +
-        "d. One action per invocation, fresh browser each time: anything reachable by (navigate, one action) is testable — e.g. clicking any tab or button from the landing page. Sequences needing prior in-page state (open a dialog, then confirm it) are not; if the task's change needs such a sequence, report NOT POSSIBLE for that part and judge what you can.\n" +
+        "d. Reach: with the session protocol, any flow reachable by N in-page actions is drivable — open the deck, then click Study, then judge the study view. Without a session (one-shot invocations), anything reachable by (navigate, one action) is testable and sequences needing prior in-page state are not — use a session for those. Report NOT POSSIBLE only when the tooling itself fails (session-start exits 3): a flow you could not reach is not NOT POSSIBLE — name the exact step that stopped you in verdict.json's missing evidence and judge what you did reach.\n" +
         "e. Judge as a user against the task description: does the change render correctly? Look for broken layout, overflow, missing or wrong content, stale data, and console errors. Compare against the task's expected behavior, never against source code (you are code-blind). Every frame you captured is already archived under " + crewHome + "/task-evidence/" + taskId + "/postchange/ and indexed in ooda-log.jsonl. A frame you did not read is not evidence. Loading, error, or blank frames never pass. If you cannot complete the loop, say exactly which steps are missing — unknown is not PASS.\n" +
         "f. Kill ONLY the server you started: pkill -f 'serve-artifact[.]js.*--tag " + taskId + "-qa' — never another task's server. (The [.] keeps pkill from matching its own command line.) Do not leave it running.\n" +
         "Then continue with the mechanical checks below. Your VERDICT covers both the visual and the mechanical checks.\n\n" +
@@ -2101,7 +2152,7 @@ while (i < STEPS.length) {
         : "Branch state (classified by the workflow from git): empty-no-work — the task branch has no commits ahead of the integration target, " +
           "no task-attributed merge on the target was verified" + (branchStateErr ? " (branch classification itself failed: " + branchStateErr + ")" : "") + ", " +
           "and the accepted Build report declared no `repo_diff: none` deliverable. " +
-          "No change was reviewed because there is no change to review. The builder likely forgot to commit.\n") +
+          "No change was reviewed because there is no change to review. The branch is empty and no task-attributed merge was verified.\n") +
       "Worktree: " + WORKTREE_HINT + "\n" +
       "Recovery: commit the deliverable on the task branch in the worktree above and re-run Review. If the deliverable is genuinely runtime state outside the repo, declare `repo_diff: none` in the Build report instead of leaving the branch empty without a declaration.\n" +
       "VERDICT: FAIL";