muse-crew 0.17.2 → 0.17.3

package/lib/standard/phases/review.js

@@ -0,0 +1,281 @@
+// lib/standard/phases/review.js — Review (cass) phase module (sandbox
+// exit, Phase C Piece 1). Import-safe: no side effects on import, bare
+// `node` exits 0.
+//
+// Reads: branch classification (mechanical git), npm package.json
+// `version` state, Build session notes (release decision, repo_diff:none
+// claim), Map session notes (mapper spec), claim/session context.
+// Writes: completed/rejected session + event (notes carry the
+// REVIEW_BASIS line), structured Review verdict row.
+// Transitions: ADVANCE → Integrate on pass. FAIL (mechanical or Cass's
+// verdict) records "rejected" and rewinds to Build against the SHARED
+// Review/QA rework budget (MAX_TOTAL_REWORK = 2, derived durably from
+// rejected events); exhaustion parks with the worktree preserved.
+//
+// Hybrid phase: the mechanical gates run BEFORE any creative review. A
+// mechanical failure uses synthetic prose through the same extraction
+// path and never dispatches Cass.
+
+import {
+  runWorkBoundary, recordPhase, buildEventPreamble, summarizeReport,
+  closeoutPassed, ensureClaimed, latestSessionNotes, lifecycle, parkTask,
+  lifecycleEnvPrefix, log,
+} from "../../workflow-lib.js";
+import {
+  parseClassifyFerry, parseVersionFerry,
+  extractReleaseDecision, releaseDecisionText, extractRepoDiffNone,
+} from "../../extract.js";
+
+export const PHASE = { name: "Review", identity: "cass" };
+const MAX_TOTAL_REWORK = 2;
+
+// runClassifyGate — the mechanical branch classifier (blocker 34/42).
+// Direct execFile, no agent ferry. UNKNOWN retries in place (up to 2);
+// exhaustion parks honestly — never asserts empty-no-work.
+async function runClassifyGate(env) {
+  var taskId = env.taskId;
+  var branchState = null;
+  var branchStateErr = "";
+  var classifyFailedReturn = "";
+  for (var classifyAttempt = 0; classifyAttempt <= 2 && branchState === null; classifyAttempt++) {
+    var parsed;
+    try {
+      var out = await lifecycle(env, "classify-branch", [taskId]);
+      classifyFailedReturn = JSON.stringify({ stdout: out.stdout, stderr: out.stderr }).slice(0, 500);
+      parsed = parseClassifyFerry({ stdout: out.stdout, stderr: out.stderr });
+    } catch (e) {
+      var msg = String((e && e.message) || e);
+      classifyFailedReturn = msg.slice(0, 500);
+      parsed = { state: null, diagField: null, diagText: "", failReason: "classifier call failed: " + msg.slice(0, 120) };
+    }
+    if (parsed.state !== null) {
+      branchState = parsed.state;
+      branchStateErr = "";
+      if (parsed.diagField !== null) {
+        log("classify-branch DIAG pin (" + parsed.diagField + " field): " + parsed.diagText);
+      } else {
+        log("classify-branch: no DIAG: record-scan counter returned (scan unverifiable)");
+      }
+    } else {
+      branchStateErr = parsed.failReason;
+      if (classifyAttempt < 2) {
+        log("classify-branch unparseable (" + branchStateErr + ") — retrying in place (attempt " + (classifyAttempt + 1) + " of 2)");
+      }
+    }
+  }
+  if (branchState === null) {
+    return { parked: await parkTask(env, "Branch state unclassifiable after 2 instrument retries (" + branchStateErr + "; last failure: " + classifyFailedReturn + ") — the classifier instrument failed, not the branch. Human attention needed: inspect the task branch directly to determine its state — no trustworthy branch classification was produced.") };
+  }
+  var alreadyMergedSha = null;
+  if (branchState.indexOf("already-merged:") === 0) {
+    alreadyMergedSha = branchState.slice("already-merged:".length);
+    log("Branch state already-merged: " + alreadyMergedSha + " (DIAG pin present — tripwire satisfied) — Cass reviews the frozen merge diff");
+  } else {
+    log("Branch state: " + branchState);
+  }
+  return { branchState: branchState, branchStateErr: branchStateErr, alreadyMergedSha: alreadyMergedSha };
+}
+
+// runVersionGate — the mechanical package.json `version` check (npm
+// projects only). Same in-place retry shape as the classifier.
+async function runVersionGate(env) {
+  var taskId = env.taskId;
+  var versionState = null;
+  var versionStateErr = "";
+  var versionFailedReturn = "";
+  for (var versionAttempt = 0; versionAttempt <= 2 && versionState === null; versionAttempt++) {
+    var parsed;
+    try {
+      var out = await lifecycle(env, "version-check", [taskId]);
+      versionFailedReturn = JSON.stringify({ stdout: out.stdout }).slice(0, 500);
+      parsed = parseVersionFerry({ stdout: out.stdout });
+    } catch (e) {
+      var msg = String((e && e.message) || e);
+      versionFailedReturn = msg.slice(0, 500);
+      parsed = { versionState: null, failReason: "version-check call failed: " + msg.slice(0, 120) };
+    }
+    if (parsed.versionState !== null) {
+      versionState = parsed.versionState;
+      versionStateErr = "";
+    } else {
+      versionStateErr = parsed.failReason;
+      if (versionAttempt < 2) {
+        log("version-check unparseable (" + versionStateErr + ") — retrying in place (attempt " + (versionAttempt + 1) + " of 2)");
+      }
+    }
+  }
+  if (versionState === null) {
+    return { parked: await parkTask(env, "package.json `version` state unclassifiable after 2 instrument retries (" + versionStateErr + "; last failure: " + versionFailedReturn + ") — the version-check instrument failed, not the branch. Human attention needed: inspect the task branch directly to determine its state — no trustworthy version classification was produced.") };
+  }
+  var touched = (versionState === "touched");
+  log("Review: package.json `version` " + (touched ? "touched by the branch — mechanical FAIL, Cass not dispatched" : "untouched — mechanical check clean"));
+  return { versionTouched: touched };
+}
+
+// buildInstructions — pure function of ctx. The gate facts are stashed in
+// ctx.state.memo.reviewGate by runPhase before the call (keeps the
+// signature pure). Instruction text verbatim from workflows/standard.js
+// (Review branch).
+export function buildInstructions(ctx) {
+  var env = ctx.env;
+  var gate = (ctx.state.memo && ctx.state.memo.reviewGate) || {};
+  var reviewChangeExam, reviewBranchRule;
+  if (gate.branchState === "has-work") {
+    reviewChangeExam =
+      "Examine the code changes by running:\n" +
+      lifecycleEnvPrefix(env) + env.lifecycle + " inspect " + env.taskId + "\n\n" +
+      "The inspect output is authoritative: it prints the task branch's actual tip commit (TIP) and every commit ahead of the integration target (inspect prints the target name). Base your review ONLY on this output — do NOT run git log yourself to pick commits, and do NOT discuss commit hashes from any other source (they may come from stale rework rounds or a different repo).\n\n";
+    reviewBranchRule =
+      "MECHANICAL FACT (computed by the workflow from git — never by a reviewer): branch state = has-work. The branch has commits ahead of the integration target. Review their content; branch emptiness is settled and is not yours to judge.\n";
+  } else if (gate.branchState && gate.branchState.indexOf("already-merged:") === 0) {
+    reviewChangeExam =
+      "The change under review is the frozen merge " + gate.alreadyMergedSha + " — it is already on the integration target (see MECHANICAL FACT below). Examine it by running:\n" +
+      "cd " + env.repoPath + " && git diff " + gate.alreadyMergedSha + "^1 " + gate.alreadyMergedSha + "\n\n" +
+      "That first-parent diff is the frozen, attributable change. Base your review ONLY on this diff — do NOT run git log to pick commits, and do NOT discuss commit hashes from any other source (they may come from stale rework rounds or a different repo).\n\n";
+    reviewBranchRule =
+      "MECHANICAL FACT (computed by the workflow from git — never by a reviewer): branch state = already-merged:" + gate.alreadyMergedSha + ". The deliverable landed on the integration target via this task's own prior merge " + gate.alreadyMergedSha + " (verified ancestor of the integration target). The branch is empty by design — emptiness is settled fact, not a finding.\n";
+  } else if (gate.buildClaimedNoDiff) {
+    reviewChangeExam =
+      "The branch has no commits ahead of the integration target (see MECHANICAL FACT below) — there is no diff to examine. Judge the Build report's `repo_diff: none` claim on its plausibility.\n\n";
+    reviewBranchRule =
+      "MECHANICAL FACT (computed by the workflow from git — never by a reviewer): the branch has no commits ahead of the integration target and no task-attributed merge on the target was verified; the Build report declares `repo_diff: none` (no repo change). Approve ONLY if the task's deliverable is plausibly runtime state (e.g. a cron definition, scheduler change, or dashboard/config state created outside the repo). Otherwise report 'no commits ahead of the integration target and no plausible runtime-state deliverable — the branch is empty and no task-attributed merge was verified', then end your report with exactly this line: VERDICT: FAIL.\n";
+  } else {
+    // Mechanical FAIL — Cass is never dispatched (see the dispatch gate
+    // below). Instructions are unused; keep the shape.
+    reviewChangeExam = "";
+    reviewBranchRule = "";
+  }
+  return "Review independently and cold. You have NOT seen any reasoning from the builder.\nDo NOT access the task dashboard, event log, or any comments. Your review is based solely on the spec and the code.\n\n" +
+    (gate.mapperSpec ? "MAPPER'S SPEC (the builder was asked to implement exactly this):\n" + gate.mapperSpec + "\n\n" : "Read the spec at exactly " + env.specPath + " (fall back to the task description if the file is absent).\n\n") +
+    reviewChangeExam +
+    "You can also read specific files in the worktree at:\n" +
+    env.worktreeHint + "/\n\n" +
+    "Check quality, correctness, and spec compliance.\n" +
+    (env.surfaceTerminal ? "TERMINAL UX REVIEW: judge the CLI surface against " + env.uxDoctrinePath + " — help accuracy, error quality, exit codes, output clarity. Reject when the bar is not met.\n" : "") +
+    (env.surfaceArtifact ? "ARTIFACT UX REVIEW: judge the rendered surface against " + env.uxDoctrinePath + " — alignment, spacing, hierarchy, composition, balance, finish, correctness. Reject when the bar is not met.\n" : "") +
+    "Check that public-affecting changes have matching public doc updates (API.md or the published API contract). If the docs are missing or inaccurate, report what is stale, then end your report with exactly this line: VERDICT: FAIL.\n" +
+    reviewBranchRule +
+    (env.publishType === "npm" ? "PACKAGE VERSION: this project publishes to the npm registry, and versions are assigned at publish time — never in branches.\n" +
+    "MECHANICAL FACT (computed by the workflow from git — never by a reviewer): the task branch did not change package.json's `version` field. A branch that touches `version` fails Review mechanically before any reviewer is dispatched, so this is settled — do not re-check it.\n" +
+    "The accepted Build report declares: " + releaseDecisionText(gate.releaseDecision) + ". " +
+    (gate.releaseDecision
+      ? "Validate this decision against the change: release must be 'yes' when the change is consumer-observable and 'no' when internal-only; the version_bump scope must fit the change (patch for fixes, minor for new behavior, major for breaking changes). If the decision is wrong or mis-scoped, report your notes, then end with exactly this line: VERDICT: FAIL."
+      : "The decision is missing or malformed — report 'Build report must end with release: yes|no and (when release is yes) version_bump: patch|minor|major lines', then end with exactly this line: VERDICT: FAIL.") + "\n" : "") +
+    "Write your review as plain prose — findings, then decision. End your report with exactly one line: VERDICT: PASS if the work passes, VERDICT: FAIL if it fails.";
+}
+
+export async function runPhase(ctx) {
+  var env = ctx.env, state = ctx.state;
+  var taskId = env.taskId;
+  var claimed = await ensureClaimed(env, state, PHASE);
+  if (claimed.type !== "CLAIMED") return claimed;
+
+  // Mechanical gates run BEFORE Cass is dispatched. Re-classified on
+  // every Review entry: rework rewinds here and the branch changed.
+  var cg = await runClassifyGate(env);
+  if (cg.parked) return cg.parked;
+  var versionTouched = false;
+  if (env.publishType === "npm") {
+    var vg = await runVersionGate(env);
+    if (vg.parked) return vg.parked;
+    versionTouched = vg.versionTouched;
+  }
+
+  // Cross-phase handoffs re-derived from durable session notes.
+  var buildNotes = await latestSessionNotes(env, "Build", "completed");
+  state.memo.reviewGate = {
+    branchState: cg.branchState,
+    alreadyMergedSha: cg.alreadyMergedSha,
+    buildClaimedNoDiff: extractRepoDiffNone(buildNotes),
+    releaseDecision: extractReleaseDecision(buildNotes),
+    mapperSpec: await latestSessionNotes(env, "Map", "completed"),
+  };
+
+  // The empty-branch rule Cass used to adjudicate is gone. What she
+  // examines and what rule she applies depend on the classified state —
+  // never on her own judgment of git identity.
+  var mechanicalFailReason = (versionTouched ? "version-touched" : (cg.branchState === "empty-no-work" && !state.memo.reviewGate.buildClaimedNoDiff ? "empty-no-work" : null));
+  var mechanicalReviewFail = (mechanicalFailReason !== null);
+  var workerText, verdictPassed;
+  if (mechanicalReviewFail) {
+    log("Review: " + mechanicalFailReason + " — mechanical FAIL, Cass not dispatched");
+    workerText =
+      "MECHANICAL REVIEW VERDICT (written by the workflow — no reviewer was dispatched).\n" +
+      (mechanicalFailReason === "version-touched"
+        ? "Package.json `version` (checked by the workflow from git): the task branch changed the `version` field. Versions are assigned at publish time — never in branches. Remove the version change.\n"
+        : "Branch state (classified by the workflow from git): empty-no-work — the task branch has no commits ahead of the integration target, " +
+          "no task-attributed merge on the target was verified" + (cg.branchStateErr ? " (branch classification itself failed: " + cg.branchStateErr + ")" : "") + ", " +
+          "and the accepted Build report declared no `repo_diff: none` deliverable. " +
+          "No change was reviewed because there is no change to review. The branch is empty and no task-attributed merge was verified.\n") +
+      "Worktree: " + env.worktreeHint + "\n" +
+      "Recovery: commit the deliverable on the task branch in the worktree above and re-run Review. If the deliverable is genuinely runtime state outside the repo, declare `repo_diff: none` in the Build report instead of leaving the branch empty without a declaration.\n" +
+      "VERDICT: FAIL";
+    verdictPassed = false;
+  } else {
+    var boundary = await runWorkBoundary(env, state, {
+      phase: PHASE.name, identity: PHASE.identity,
+      instructions: buildInstructions(ctx),
+      eventPreamble: buildEventPreamble(env, PHASE.name),
+      crewApiLine: false, verdictStep: true,
+    });
+    if (boundary.type !== "BOUNDARY_DONE") return boundary;
+    workerText = boundary.workerText;
+    verdictPassed = closeoutPassed(boundary);
+  }
+
+  var passed = verdictPassed === true;
+  var summary = summarizeReport(workerText);
+  // Machine-readable review basis, prepended to the session notes for
+  // observability (proof rooms read the summary to see what Review
+  // examined and why a reviewer was or was not dispatched).
+  var reviewBasisNote;
+  if (mechanicalReviewFail) {
+    reviewBasisNote = "REVIEW_BASIS: none — mechanical FAIL (" + mechanicalFailReason + "), no reviewer dispatched";
+  } else if (cg.branchState.indexOf("already-merged:") === 0) {
+    reviewBasisNote = "REVIEW_BASIS: frozen merge " + cg.alreadyMergedSha + " — reviewed via git diff " + cg.alreadyMergedSha + "^1 " + cg.alreadyMergedSha;
+  } else if (cg.branchState === "has-work") {
+    reviewBasisNote = "REVIEW_BASIS: branch diff — reviewed via inspect output (task branch vs integration target)";
+  } else {
+    reviewBasisNote = "REVIEW_BASIS: runtime-state-none — no repo change; plausibility of Build's repo_diff: none claim";
+  }
+  summary = reviewBasisNote + "\n" + summary;
+  var reviewBasis =
+    mechanicalReviewFail ? "mechanical-fail" :
+    cg.branchState.indexOf("already-merged:") === 0 ? "frozen-merge:" + cg.alreadyMergedSha :
+    cg.branchState === "has-work" ? "branch-diff" : "runtime-state-none";
+  var status = passed ? "completed" : "rejected";
+  await recordPhase(env, {
+    task_id: taskId,
+    session: { id: state.activeSessionId, task_id: taskId, identity: PHASE.identity, step: PHASE.name, status: status, notes: summary },
+    event: { task_id: taskId, type: status, identity: PHASE.identity, message: PHASE.name + " " + status + " by " + PHASE.identity },
+    // Structured, non-lossy Review verdict record. The session note above
+    // is truncated; the verdict row carries the full worker report as
+    // grounds, written in the same transaction. attempt is the rework
+    // round (0 = first Review).
+    verdict: {
+      step: "Review",
+      attempt: state.reworkCount,
+      // A mechanical FAIL has no reviewer — the workflow wrote the verdict.
+      reviewer: mechanicalReviewFail ? "workflow" : PHASE.identity,
+      verdict: passed ? "PASS" : "FAIL",
+      review_basis: reviewBasis,
+      grounds: workerText,
+    },
+  });
+
+  if (!passed) {
+    // Shared rework budget: Review and QA rejections draw from the SAME
+    // pool of 2 (source: MAX_TOTAL_REWORK, derived durably by counting
+    // "rejected" events). The rejected event above is already recorded,
+    // so the new count is state.reworkCount + 1.
+    var newRework = state.reworkCount + 1;
+    if (newRework > MAX_TOTAL_REWORK) {
+      log("Shared rework budget exhausted for task " + taskId + " — worktree preserved at " + env.worktreePreservedHint + " for manual inspection");
+      return await parkTask(env, "Exceeded shared rework budget (" + MAX_TOTAL_REWORK + " total rework attempts across Review and QA) after Review rejection. Worktree preserved.");
+    }
+    log("Review rejected — bouncing to Build (rework #" + newRework + " of " + MAX_TOTAL_REWORK + ")");
+    return { type: "REWIND", next: "Build", reason: "Review rejected — bouncing to Build (rework #" + newRework + " of " + MAX_TOTAL_REWORK + ")" };
+  }
+  log("Review complete for task " + taskId);
+  return { type: "ADVANCE", next: "Integrate" };
+}

package/lib/standard/phases/triage.js

@@ -0,0 +1,64 @@
+// lib/standard/phases/triage.js — Triage (sage) phase module (sandbox
+// exit, Phase C Piece 1). Import-safe: no side effects on import, bare
+// `node` exits 0.
+//
+// Reads: task/project/surface facts, claim/session context.
+// Writes: completed/rejected session + event; the machine-read
+// `experiential: yes|no` marker line and the optional `terminal_targets:`
+// line. The durable cross-run handoff is the Triage session notes.
+// Transitions: ADVANCE → Capture (a rejected Triage still advances; only
+// Review, Integrate, and Publish have special failure paths).
+
+import {
+  runWorkBoundary, recordPhase, buildEventPreamble, summarizeReport,
+  closeoutPassed, ensureClaimed, log,
+} from "../../workflow-lib.js";
+import { extractExperiential } from "../../extract.js";
+
+export const PHASE = { name: "Triage", identity: "sage" };
+
+// buildInstructions — pure function of ctx. Verbatim from
+// workflows/standard.js (Triage branch).
+export function buildInstructions(ctx) {
+  var env = ctx.env;
+  return "Validate the task against the project's repo at " + env.repoPath + " — that exact checkout, not any other copy of the project on disk. If you run git commands, cd " + env.repoPath + " first.\nCheck clarity, note dependencies, confirm the standard workflow assignment.\nWrite a brief triage assessment as notes for the next step.\nReport back in plain prose — what you found.\nEXPERIENTIAL FLAG: does this task change anything a user can directly observe in the project's user-facing surface? " + env.surfaceTriageDesc + " For an artifact surface that means rendered and visible — pages, components, styles, layout, copy, visual states. For a terminal surface it means the CLI experience — command output, help text, flags, error messages, defaults. The shared UX bar is " + (env.uxDoctrinePath ? env.uxDoctrinePath + " — flag experiential when the task touches anything it covers." : "not classified for this project — flag experiential when the task touches anything user-observable in the surface described above.") + " If yes it is experiential and gets baseline evidence (plus an experiential verdict where the workflow has a QA phase). For terminal-surface tasks also declare the CLI surface to exercise: end your report with a line `terminal_targets: <comma-separated CLI commands/flags>` (machine-read; optional — falls back to the task description). End your report with exactly one line on its own, lowercase, unrephrased: experiential: yes — or experiential: no. This line is machine-read.";
+}
+
+export async function runPhase(ctx) {
+  var env = ctx.env, state = ctx.state;
+  var claimed = await ensureClaimed(env, state, PHASE);
+  if (claimed.type !== "CLAIMED") return claimed;
+
+  var boundary = await runWorkBoundary(env, state, {
+    phase: PHASE.name, identity: PHASE.identity,
+    instructions: buildInstructions(ctx),
+    eventPreamble: buildEventPreamble(env, PHASE.name),
+    crewApiLine: true, verdictStep: false,
+  });
+  if (boundary.type !== "BOUNDARY_DONE") return boundary;
+
+  // Triage is not a verdict step: producing output means passed.
+  var passed = closeoutPassed(boundary);
+  var workerText = boundary.workerText;
+  var summary = summarizeReport(workerText);
+  var status = passed ? "completed" : "rejected";
+  await recordPhase(env, {
+    task_id: env.taskId,
+    session: { id: state.activeSessionId, task_id: env.taskId, identity: PHASE.identity, step: PHASE.name, status: status, notes: summary },
+    event: { task_id: env.taskId, type: status, identity: PHASE.identity, message: PHASE.name + " " + status + " by " + PHASE.identity },
+  });
+  if (!passed) {
+    // A rejected Triage still advances; the rejection is recorded.
+    log("Triage rejected for task " + env.taskId + " — advancing");
+    return { type: "ADVANCE", next: "Capture", experiential: null };
+  }
+  // Stash the terminal targets run-locally (re-derivable from the Triage
+  // session notes' terminal_targets: marker line on a resumed run).
+  var ttm = /^terminal_targets:\s*(.+)/im.exec(workerText || "");
+  state.memo.terminalTargets = ttm ? ttm[1].trim().slice(0, 300) : "";
+  log("Triage complete for task " + env.taskId);
+  return {
+    type: "ADVANCE", next: "Capture",
+    experiential: extractExperiential(workerText),
+  };
+}

package/lib/test-detached-integrate.sh

@@ -56,6 +56,13 @@
 #   with STALE_MERGE — never push the stale state, never fall through to
 #   MERGED_EMPTY (an unpushed merge sits on the line).
 #
+# Fixture F4 (fast-forward recovery — 2026-09-27, Park 14): the work
+#   landed on the line by fast-forward (no merge commit), but a merge IS
+#   recorded and the branch tip is exactly the target tip. Re-running
+#   integrate must recover via the ff path (lock + push) — not
+#   STALE_MERGE, not MERGED_EMPTY. Exact tip equality only; ancestry
+#   alone never recovers (blocker-35).
+#
 # Fixture I (push-target identity — blocker 35, 2026-09-21): the
 #   ERROR-after-MERGED retry path. I1: stale record → STALE_MERGE and the
 #   remote ref does not move. I2: branch restored to the merged tip → the
@@ -378,6 +385,46 @@ echo "$out" | grep -q 'recovered:' && fail "F3: recovered a stale merge: $out"
 [ "$(git rev-parse HEAD)" = "$F3_M1" ] || fail "F3: HEAD moved during STALE_MERGE"
 echo "fixture F3 (stale record fails closed on re-integrate): all checks passed"
 
+# ---------------- Fixture F4: fast-forward recovery — recorded merge, tip == target, no merge commit ----------------
+# (2026-09-27, Park 14): the work landed on the line by fast-forward in a
+# prior attempt, so no merge commit exists — but a merge IS recorded and the
+# branch tip is exactly the target tip. Re-running integrate must recover
+# (take the lock, push) via the ff path — not STALE_MERGE (the tip is the
+# deliverable, not stale), not MERGED_EMPTY (a recorded merge exists, and
+# MERGED_EMPTY would skip the push). ff_integrated accepts only exact tip
+# equality: a branch moved backward after the ff is still an ancestor of
+# the target, and ancestry alone must not recover (blocker-35 F3 shape).
+# Reuse fixture D's repo (no remote): new task, merge, then reset the line
+# to the branch tip, dropping the merge commit.
+cd "$D_DIR"
+export CREW_REPO="$D_DIR"
+export CREW_HOME="$T/home-d"
+tid="ff1"
+"$REPO_DIR/lib/merge-lock.sh" release "stale1" >/dev/null 2>&1 || fail "F4: lock release failed"
+out=$(bash "$LIFECYCLE" prepare "$tid") || fail "F4 prepare failed: $out"
+BRANCH=$(bash "$LIFECYCLE" resolve-branch "$tid") || fail "F4 resolve-branch failed"
+echo work >> "$D_DIR/.worktrees/$tid/f.txt"
+(cd "$D_DIR/.worktrees/$tid" && git commit -qam "work w1")
+F4_W1=$(git rev-parse "$BRANCH")
+git worktree remove --force "$D_DIR/.worktrees/$tid" || fail "F4: worktree remove failed"
+out=$(bash "$LIFECYCLE" integrate "$tid" "merge: $tid" 2>&1) || fail "F4 integrate failed: $out"
+echo "$out" | grep -q '^MERGED:' || fail "F4: expected MERGED, got: $out"
+# Simulate the ff landing: the line goes to the branch tip directly, no
+# merge commit. The record still names the merge from the integrate above.
+git reset -q --hard "$F4_W1" || fail "F4: reset to branch tip failed"
+[ "$(git rev-parse HEAD)" = "$F4_W1" ] || fail "F4: HEAD not at branch tip"
+[ "$(git rev-parse "$BRANCH")" = "$F4_W1" ] || fail "F4: branch not at tip"
+git rev-parse -q --verify HEAD^2 >/dev/null && fail "F4: HEAD is still a merge commit"
+"$REPO_DIR/lib/merge-lock.sh" release "$tid" >/dev/null 2>&1 || fail "F4: lock release failed"
+out=$(bash "$LIFECYCLE" integrate "$tid" "merge: $tid" 2>&1) || fail "F4 re-integrate failed: $out"
+echo "$out" | grep -q '^MERGED:' || fail "F4: expected MERGED recovery, got: $out"
+echo "$out" | grep -q 'recovered: branch tip fast-forwarded' || fail "F4: expected ff recovery, got: $out"
+echo "$out" | grep -q '^STALE_MERGE' && fail "F4: STALE_MERGE on a fast-forwarded tip: $out"
+echo "$out" | grep -q '^MERGED_EMPTY' && fail "F4: fell through to MERGED_EMPTY with a recorded merge: $out"
+out=$(bash "$LIFECYCLE" lock-status "$tid" 2>&1)
+echo "$out" | grep -q '^locked=true' || fail "F4: ff recovery did not take the lock: $out"
+echo "fixture F4 (fast-forward recovery): all checks passed"
+
 # ---------------- Fixture I: branch + origin — stale push-target and the R5-manual shape ----------------
 # (blocker 35): the ERROR-after-MERGED retry path (push-target) pushed live
 # HEAD with no check. I1: stale record → STALE_MERGE, the remote ref does