muse-crew 0.4.5 → 0.4.7

package/lib/test-publish-skip.sh

@@ -0,0 +1,192 @@
+#!/usr/bin/env bash
+# test-publish-skip.sh — regression test for the graceful no-lock publish
+# skip (park 2026-09-11: empty-diff Integrate takes no merge lock, but
+# Publish ran refresh-lock unconditionally and failed closed).
+#
+# Covers:
+#   - worktree-lifecycle.sh lock-status: UNLOCKED (exit 0) with no lock;
+#     LOCKED by <holder> since <ts> (pid <pid>) when held (exit 0).
+#   - fake empty-diff integrate -> lock-status reports UNLOCKED (the lock
+#     is intentionally never taken on the MERGED_EMPTY path).
+#   - the shipped step-5 block of publish-npm.sh (extracted by anchor):
+#       * UNLOCKED -> NO_LOCK_HELD=1, PUBLISH_SKIPPED=no-lock-held, exit 0
+#       * LOCKED (self) -> refresh path runs, NO_LOCK_HELD=0, exit 0
+#       * lock-status query failure -> fail "lock-status", exit 1 (fail-closed)
+#   - structural: the step-5 anchor sits inside the ALREADY_PUBLISHED=0
+#     branch (a resumed run whose post-deploy released the lock prints
+#     nothing), and the mutation steps are gated on NO_LOCK_HELD=0.
+#
+# Anchors: `# STEP-5-ANCHOR` ... `# STEP-5-END` in lib/publish-npm.sh.
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+LIFECYCLE="$SCRIPT_DIR/worktree-lifecycle.sh"
+MERGE_LOCK="$SCRIPT_DIR/merge-lock.sh"
+PUBLISH="$SCRIPT_DIR/publish-npm.sh"
+
+pass=0
+fail_count=0
+ok() { echo "PASS: $1"; pass=$((pass + 1)); }
+no() { echo "FAIL: $1"; fail_count=$((fail_count + 1)); }
+
+TMPBASE="$(mktemp -d)"
+trap 'rm -rf "$TMPBASE"' EXIT
+
+# --- Scratch repo ---
+SCRATCH="$TMPBASE/repo"
+git init -q -b main "$SCRATCH"
+git -C "$SCRATCH" config user.email "test@crew"
+git -C "$SCRATCH" config user.name "crew-test"
+echo ".worktrees/" > "$SCRATCH/.gitignore"
+echo x > "$SCRATCH/f.txt"
+git -C "$SCRATCH" add -A && git -C "$SCRATCH" commit -qm init
+
+export CREW_REPO="$SCRATCH" CREW_LIB="$SCRIPT_DIR"
+
+TASK="skiptest-task-1"
+
+# --- lock-status with no lock held ---
+OUT="$(bash "$LIFECYCLE" lock-status "$TASK" 2>&1)"
+CODE=$?
+if [ $CODE -eq 0 ] && [ "$OUT" = "UNLOCKED" ]; then
+  ok "lock-status reports UNLOCKED with no lock held (exit 0)"
+else
+  no "lock-status UNLOCKED: code=$CODE out='$OUT'"
+fi
+
+# --- lock-status with a lock held ---
+bash "$MERGE_LOCK" acquire "$TASK" "$$" >/dev/null
+OUT="$(bash "$LIFECYCLE" lock-status "$TASK" 2>&1)"
+CODE=$?
+if [ $CODE -eq 0 ] && printf '%s' "$OUT" | grep -Eq "^LOCKED by $TASK since .+ \(pid [0-9]+\)$"; then
+  ok "lock-status reports LOCKED by <holder> since <ts> (pid <pid>) (exit 0)"
+else
+  no "lock-status LOCKED: code=$CODE out='$OUT'"
+fi
+bash "$MERGE_LOCK" release "$TASK" >/dev/null
+
+# --- fake empty-diff integrate: MERGED_EMPTY takes no lock ---
+bash "$LIFECYCLE" prepare "$TASK" >/dev/null 2>&1
+INTEG="$(bash "$LIFECYCLE" integrate "$TASK" "merge: $TASK" 2>&1)"
+if [[ "$INTEG" == MERGED_EMPTY* ]]; then
+  ok "fake empty-diff integrate takes the MERGED_EMPTY branch"
+else
+  no "empty-diff integrate: '$INTEG'"
+fi
+OUT="$(bash "$LIFECYCLE" lock-status "$TASK" 2>&1)"
+if [ "$OUT" = "UNLOCKED" ]; then
+  ok "after MERGED_EMPTY integrate the lock is still UNLOCKED (never taken)"
+else
+  no "lock held after empty-diff integrate: '$OUT'"
+fi
+bash "$LIFECYCLE" cleanup "$TASK" >/dev/null 2>&1
+
+# --- Extract the shipped step-5 block by anchor ---
+BLOCK="$TMPBASE/step5.sh"
+sed -n '/# STEP-5-ANCHOR/,/# STEP-5-END/p' "$PUBLISH" > "$BLOCK"
+if grep -q 'lock-status' "$BLOCK" && grep -q 'PUBLISH_SKIPPED=no-lock-held' "$BLOCK" \
+   && grep -q 'fail "lock-status"' "$BLOCK" && grep -q 'NO_LOCK_HELD=1' "$BLOCK"; then
+  ok "extracted step-5 block from publish-npm.sh"
+else
+  no "step-5 extraction failed (anchors missing)"
+fi
+
+# Runner: provides fail(), env, sources the extracted block, then reports
+# NO_LOCK_HELD and the exit code. Never calls fail = never parks.
+run_block() { # run_block <lock_setup: none|held|broken>
+  local mode="$1"
+  local run="$TMPBASE/run-$mode"
+  mkdir -p "$run"
+  case "$mode" in
+    none) : ;;
+    held) bash "$MERGE_LOCK" acquire "$TASK" "$$" >/dev/null ;;
+    broken) : ;;
+  esac
+  (
+    set -euo pipefail
+    export CREW_REPO="$SCRATCH" TASK_ID="$TASK" REPO_PATH="$SCRATCH"
+    if [ "$mode" = "broken" ]; then
+      export LIFECYCLE="/nonexistent/lifecycle.sh"
+    else
+      export LIFECYCLE="$LIFECYCLE"
+    fi
+    fail() { echo "PUBLISH_FAILED=$1"; [ $# -ge 2 ] && echo "$2"; exit 1; }
+    NO_LOCK_HELD=0
+    # shellcheck disable=SC1090
+    source "$BLOCK"
+    echo "RESULT_NO_LOCK_HELD=$NO_LOCK_HELD"
+  ) > "$run/out" 2>&1
+  local code=$?
+  echo "$code" > "$run/code"
+  case "$mode" in
+    held) bash "$MERGE_LOCK" release "$TASK" >/dev/null 2>&1 || true ;;
+  esac
+}
+
+# --- UNLOCKED: skip gracefully, never park ---
+run_block none
+CODE="$(cat "$TMPBASE/run-none/code")"
+OUT="$(cat "$TMPBASE/run-none/out")"
+if [ "$CODE" -eq 0 ] && [[ "$OUT" == *"PUBLISH_SKIPPED=no-lock-held"* ]] \
+   && [[ "$OUT" == *"RESULT_NO_LOCK_HELD=1"* ]] && [[ "$OUT" != *"PUBLISH_FAILED"* ]]; then
+  ok "step-5 on UNLOCKED: skips gracefully (NO_LOCK_HELD=1, marker printed, exit 0)"
+else
+  no "step-5 UNLOCKED: code=$CODE out='$OUT'"
+fi
+
+# --- LOCKED by self: refresh path runs, no skip ---
+run_block held
+CODE="$(cat "$TMPBASE/run-held/code")"
+OUT="$(cat "$TMPBASE/run-held/out")"
+if [ "$CODE" -eq 0 ] && [[ "$OUT" != *"PUBLISH_SKIPPED"* ]] \
+   && [[ "$OUT" == *"RESULT_NO_LOCK_HELD=0"* ]] && [[ "$OUT" != *"PUBLISH_FAILED"* ]]; then
+  ok "step-5 on LOCKED (self): refresh path runs, no skip marker, exit 0"
+else
+  no "step-5 LOCKED: code=$CODE out='$OUT'"
+fi
+
+# --- lock-status query failure: fail closed ---
+run_block broken
+CODE="$(cat "$TMPBASE/run-broken/code")"
+OUT="$(cat "$TMPBASE/run-broken/out")"
+if [ "$CODE" -ne 0 ] && [[ "$OUT" == *"PUBLISH_FAILED=lock-status"* ]]; then
+  ok "step-5 on lock-status failure: fail-closed PUBLISH_FAILED=lock-status"
+else
+  no "step-5 broken query: code=$CODE out='$OUT'"
+fi
+
+# --- Structural: the gate sits inside the ALREADY_PUBLISHED=0 branch ---
+# (a resumed run whose post-deploy already released the lock must print
+# nothing — its PUBLISHED_ALREADY/PUBLISH_VERIFIED markers say it all).
+AP_LINE="$(grep -n 'if \[ "\$ALREADY_PUBLISHED" = "0" \]; then' "$PUBLISH" | head -1 | cut -d: -f1)"
+ANCHOR_LINE="$(grep -n '# STEP-5-ANCHOR' "$PUBLISH" | head -1 | cut -d: -f1)"
+END_LINE="$(grep -n '# STEP-5-END' "$PUBLISH" | head -1 | cut -d: -f1)"
+if [ -n "$AP_LINE" ] && [ -n "$ANCHOR_LINE" ] && [ -n "$END_LINE" ] \
+   && [ "$AP_LINE" -lt "$ANCHOR_LINE" ] && [ "$ANCHOR_LINE" -lt "$END_LINE" ]; then
+  ok "step-5 anchor sits inside the ALREADY_PUBLISHED=0 branch"
+else
+  no "step-5 anchor placement wrong (ap=$AP_LINE anchor=$ANCHOR_LINE end=$END_LINE)"
+fi
+
+# --- Structural: mutation steps are gated on NO_LOCK_HELD=0 ---
+if grep -q 'if \[ "\$NO_LOCK_HELD" = "0" \]; then' "$PUBLISH" \
+   && grep -q 'fi  # NO_LOCK_HELD=0' "$PUBLISH"; then
+  ok "mutation path is gated on NO_LOCK_HELD=0"
+else
+  no "NO_LOCK_HELD gate missing in publish-npm.sh"
+fi
+
+# --- Structural: PUBLISH_COMPLETE is omitted on the skip path ---
+if grep -q 'PUBLISH_COMPLETE is deliberately not printed' "$PUBLISH"; then
+  ok "skip path omits PUBLISH_COMPLETE (no false publish claim)"
+else
+  no "PUBLISH_COMPLETE skip-path handling missing"
+fi
+
+bash -n "$LIFECYCLE" && ok "worktree-lifecycle.sh syntax OK" || no "worktree-lifecycle.sh syntax"
+bash -n "$PUBLISH" && ok "publish-npm.sh syntax OK" || no "publish-npm.sh syntax"
+
+echo ""
+echo "$pass passed, $fail_count failed"
+exit $((fail_count > 0))

package/lib/worktree-lifecycle.sh

@@ -19,6 +19,7 @@
 #   cleanup   <task_id>                  — remove worktree + branch (no lock)
 #   status    <task_id>                  — report worktree state
 #   refresh-lock <task_id>               — refresh merge lock timestamp (resets staleness clock)
+#   lock-status <task_id>                — report merge lock state: UNLOCKED or LOCKED by <holder> since <ts> (pid <pid>)
 #   sweep     [report|clean]             — find/clean orphans + stale locks
 #
 # Exit codes:
@@ -202,13 +203,39 @@ cmd_integrate() {
     return 0
   fi
 
-  # Acquire merge lock
+  # Acquire the merge lock (serializes version assignment across concurrent
+  # runs). The holder is the opaque task+run identity from WORKFLOW_RUN_ID —
+  # never a PID (bug 2fc8f52f: short-lived agent PIDs made every concurrent
+  # acquire take the stale path). Another task mid Integrate/Publish is
+  # normal under simultaneity>1: bounded backoff (30s sleeps, 10min cap,
+  # overridable via MERGE_LOCK_RETRY_SECS / MERGE_LOCK_RETRY_CAP_SECS), then
+  # give up with LOCK_HELD so the workflow records the failure with a reason
+  # (dispatcher retries under its cap, parks after the cap).
+  local holder="${WORKFLOW_RUN_ID:-$task_id}"
+  local retry_secs="${MERGE_LOCK_RETRY_SECS:-30}"
+  local retry_cap="${MERGE_LOCK_RETRY_CAP_SECS:-600}"
+  local waited=0
   local lock_result
-  if ! lock_result=$("$MERGE_LOCK" acquire "$task_id" "$$"); then
-    echo "LOCK_HELD: $lock_result"
-    exit 2
-  fi
-  echo "$lock_result"
+  while true; do
+    if lock_result=$("$MERGE_LOCK" acquire "$task_id" "$holder"); then
+      echo "$lock_result"
+      break
+    fi
+    case "$lock_result" in
+      HELD*)
+        if [ "$waited" -ge "$retry_cap" ]; then
+          echo "LOCK_HELD: $lock_result (waited ${waited}s of ${retry_cap}s backoff)"
+          exit 2
+        fi
+        sleep "$retry_secs"
+        waited=$((waited + retry_secs))
+        ;;
+      *)
+        echo "LOCK_ERROR: $lock_result"
+        exit 2
+        ;;
+    esac
+  done
 
   # Merge
   if ! git merge --no-ff "$branch" -m "$commit_msg" 2>&1; then
@@ -338,7 +365,17 @@ cmd_sweep() {
 cmd_refresh_lock() {
   local task_id="$1"
   validate_task_id "$task_id"
-  "$MERGE_LOCK" refresh "$task_id" "$$"
+  "$MERGE_LOCK" refresh "$task_id"
+}
+
+cmd_lock_status() {
+  local task_id="$1"
+  validate_task_id "$task_id"
+  # Passthrough to the lock's own status readout. Scripts never call
+  # merge-lock.sh directly — this keeps the seam. Always exits 0:
+  # UNLOCKED is explicit state (an empty-diff Integrate intentionally
+  # takes no lock), never an error.
+  "$MERGE_LOCK" status
 }
 
 # --- dispatch ---
@@ -355,10 +392,11 @@ case "$cmd" in
   cleanup)      cmd_cleanup "${1:?task_id required}" ;;
   status)       cmd_status "${1:?task_id required}" ;;
   refresh-lock) cmd_refresh_lock "${1:?task_id required}" ;;
+  lock-status)  cmd_lock_status "${1:?task_id required}" ;;
   sweep)        cmd_sweep "${1:-report}" ;;
   *)
     echo "Usage: worktree-lifecycle.sh <command> [args]"
-    echo "Commands: validate, prepare, inspect, integrate, post-deploy, cleanup, status, refresh-lock, sweep"
+    echo "Commands: validate, prepare, inspect, integrate, post-deploy, cleanup, status, refresh-lock, lock-status, sweep"
     exit 1
     ;;
 esac

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.4.5",
+  "version": "0.4.7",
   "description": "Opinionated orchestration for Muse \u2014 workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,

package/workflows/bugfix.js

@@ -510,6 +510,12 @@ if (missingInitialPins.length > 0) {
 }
 log("Lifecycle scripts pinned to " + RUN_LIB);
 
+// Merge-lock holder identity (bug 2fc8f52f): the opaque task+run identity
+// minted at this run's first claim (never a PID — short-lived agent PIDs
+// made every concurrent acquire take the stale path). Set exactly once on
+// the first claim; stable for the rest of the run's lifetime.
+let lockHolder = taskId;
+
 while (i < STEPS.length) {
   const step = STEPS[i];
   const isFirstClaim = (i === startStepIndex && totalReworkCount === 0);
@@ -693,6 +699,13 @@ while (i < STEPS.length) {
     activeSessionId = claimResult.session_id;
   }
 
+  // Mint the merge-lock holder identity once: task+session of this run's
+  // first claim. The task ID alone cannot distinguish two runs of the same
+  // task (re-dispatch after park), and a PID is not a valid holder at all.
+  if (lockHolder === taskId && activeSessionId) {
+    lockHolder = taskId + "/" + activeSessionId;
+  }
+
   // ── Capture: baseline evidence for experiential tasks ─────────────
   // Hazel's QA capture pass runs right after Triage, before Map, for tasks
   // Sage flagged experiential. The capture itself is parent-driven (the
@@ -870,11 +883,11 @@ while (i < STEPS.length) {
 
   } else if (step.name === "Integrate") {
     instructions = "Merge the approved task branch into main.\n\n" +
-      "Run: "+ LIFECYCLE_ENV + " integrate " + taskId + " \"merge: fix: " + safeTitle + "\"\n\n" +
+      "Run: "+ LIFECYCLE_ENV + "WORKFLOW_RUN_ID=" + lockHolder + " integrate " + taskId + " \"merge: fix: " + safeTitle + "\"\n\n" +
       "Read the output:\n" +
       "- If it contains MERGED, integration succeeded. Report the merged commit hash.\n" +
       "- If it contains MERGED_EMPTY, the branch had no commits ahead of main (a runtime-state deliverable, declared by Build as repo_diff: none). Integration succeeded vacuously: the merge lock was NOT taken and there is no new commit. Report 'merged empty: no repo changes — deliverable was runtime state', then end your report with exactly this line: VERDICT: PASS. SKIP STEP 2 (push): there is no new commit to push.\n" +
-      "- If it contains LOCK_HELD, another task holds the merge lock (mid Integrate/Publish). Report 'merge lock held', then end your report with exactly this line: VERDICT: FAIL.\n" +
+      "- If it contains LOCK_HELD, another task holds the merge lock (mid Integrate/Publish) and the 10-minute bounded backoff is exhausted. Report 'merge lock held after bounded backoff', then end your report with exactly this line: VERDICT: FAIL.\n" +
       "- If it contains CONFLICT, the plain merge failed — the merge was aborted, main is clean, and your task still holds the merge lock. Do NOT fail yet. Resolve it:\n" +
       "RESOLUTION:\n" +
       "R1. Refresh the merge lock FIRST (a long resolution must not silently lose the lock to the orphan sweep): "+ LIFECYCLE_ENV + " refresh-lock " + taskId + ". Create a scratch worktree WITH A NEW BRANCH (main is already checked out in the repo checkout, so git forbids checking it out a second time): cd " + REPO_PATH + " && git worktree add -b resolve/" + taskId + " /tmp/crew-resolve-" + taskId + " main. Reproduce the conflict in the scratch worktree: cd /tmp/crew-resolve-" + taskId + " && git merge " + TASK_BRANCH + ". This reproduces the exact conflict (main has not moved — the lock was held throughout). The task branch " + TASK_BRANCH + " is never modified.\n" +
@@ -903,13 +916,17 @@ while (i < STEPS.length) {
       instructions = "Publish the npm package by running exactly ONE command — the deterministic publish script.\n" +
         "The release decision is already made and recorded: release: yes, version_bump: " + publishTarget.scope +
         ", target version " + publishTarget.target + " (computed as " + publishTarget.base + " + " + publishTarget.scope +
-        " → " + publishTarget.target + " by the workflow, not by you). There is no decision to make and no skip path.\n\n" +
+        " → " + publishTarget.target + " by the workflow, not by you). There is no decision to make; the script itself skips gracefully when no merge lock is held.\n\n" +
         "Run exactly this command and no other publish-related commands:\n" +
         "TASK_ID=" + taskId + " REPO_PATH=" + REPO_PATH + " PKG=muse-crew TARGET_VERSION=" + publishTarget.target +
         " CREW_HOME=" + crewHome + " LIFECYCLE=" + LIFECYCLE + " RELEASE_SCRIPT=" + RELEASE_SCRIPT +
         " bash " + PUBLISH_NPM + "\n\n" +
         "Do NOT run npm, npm pack, npm publish, or the python publish script yourself. Do NOT compare local and registry versions. Do NOT decide whether to publish.\n\n" +
         "If the command exits nonzero, put the script's PUBLISH_FAILED line in your report, then end your report with exactly this line: VERDICT: FAIL.\n" +
+        "If the script's output contains PUBLISH_SKIPPED=no-lock-held, the publish was skipped gracefully: Integrate reported MERGED_EMPTY (no commits ahead of main), so no merge lock was taken and there is nothing to ship. Paste the marker block verbatim into your report, then end your report with exactly these three lines, in this order — lowercase, no trailing period, do not rephrase:\n" +
+        "TARGET_VERSION=" + publishTarget.target + " computed as " + publishTarget.base + " + " + publishTarget.scope + " → " + publishTarget.target + "\n" +
+        "skipped: no-lock-held (empty-diff Integrate — nothing merged, nothing to ship)\n" +
+        "VERDICT: PASS\n\n" +
         "If it exits zero, paste the script's COMPLETE marker block verbatim into your report, then end your report with exactly these three lines, in this order — lowercase, no trailing period, do not rephrase:\n" +
         "TARGET_VERSION=" + publishTarget.target + " computed as " + publishTarget.base + " + " + publishTarget.scope + " → " + publishTarget.target + "\n" +
         "published: muse-crew@" + publishTarget.target + "\n" +
@@ -928,20 +945,34 @@ while (i < STEPS.length) {
       // getprovenance-vs-HEAD verification below stays as the final gate.
       var artifactPublish = null;
       var publishLockRefreshed = false;
+      var publishSkippedNoLock = false;
       try {
-        // STEP 0 (mechanical): refresh the merge lock so a long build cannot
-        // go stale mid-publish.
-        var lockRefresh = await agent(
-          "Run: "+ LIFECYCLE_ENV + " refresh-lock " + taskId + "\n" +
-          "Return JSON { \"refreshed\": <true if the command exited zero, false otherwise>, \"output\": \"<trimmed stdout>\" } and nothing else.",
-          { key: attemptKey("publish-lock-refresh-" + taskId, totalReworkCount), label: "Refreshing merge lock for publish",
-            schema: { type: "object", properties: { refreshed: { type: "boolean" }, output: { type: "string" } }, required: ["refreshed"] } }
+        // STEP 0 (mechanical): read the merge-lock state explicitly — never
+        // infer it from prose. An empty-diff Integrate (MERGED_EMPTY)
+        // intentionally takes no lock: nothing merged, nothing to ship. When
+        // no lock is held, Publish skips the publish path gracefully instead
+        // of failing closed on refresh-lock (park 2026-09-11).
+        var lockState = await agent(
+          "Run: "+ LIFECYCLE_ENV + " lock-status " + taskId + "\n" +
+          "If the output is exactly UNLOCKED, return JSON { \"state\": \"UNLOCKED\" } and run nothing else.\n" +
+          "Otherwise the lock is held: run "+ LIFECYCLE_ENV + " refresh-lock " + taskId + " (a long build must not silently lose the lock to the orphan sweep), then return JSON { \"state\": \"LOCKED\", \"refreshed\": <true if the refresh exited zero, false otherwise>, \"output\": \"<trimmed refresh stdout>\" } and nothing else.",
+          { key: attemptKey("publish-lock-refresh-" + taskId, totalReworkCount), label: "Reading merge lock state for publish",
+            schema: { type: "object", properties: { state: { type: "string" }, refreshed: { type: "boolean" }, output: { type: "string" } }, required: ["state"] } }
         );
-        if (!lockRefresh.refreshed) {
-          return await parkTask("Publish lock refresh failed: " + (lockRefresh.output || "no output") + ". Fail-closed — lock state unknown.");
+        if ((lockState.state || "").trim() === "UNLOCKED") {
+          publishSkippedNoLock = true;
+          log("Publish skipped for task " + taskId + ": no merge lock held (empty-diff Integrate) — nothing to ship");
+        } else {
+          if (!lockState.refreshed) {
+            return await parkTask("Publish lock refresh failed: " + (lockState.output || "no output") + ". Fail-closed — lock state unknown.");
+          }
+          publishLockRefreshed = true;
         }
-        publishLockRefreshed = true;
-        // STEP 1 (mechanical): trigger the rebuild with one narrow call. The
+        // STEP 1 (mechanical): trigger the rebuild with one narrow call.
+        // Skipped entirely when no lock was held — nothing merged, nothing
+        // to ship.
+        if (!publishSkippedNoLock) {
+        // (below) the rebuild trigger, bounded poll, and provenance stamp
         // agent only makes the artifact_edit call and reports whether it was
         // accepted — no prose claim to trust. If the artifact tool namespace
         // is missing from this child it reports honestly and the workflow
@@ -962,14 +993,46 @@ while (i < STEPS.length) {
         }
         var publishFailure = null;
         if (rebuildTrigger.edit_started) {
-          // STEP 1b (mechanical): bounded poll for build completion.
-          var buildPoll = await agent(
-            "Poll artifact_status for slug \"" + PUBLISH_SLUG + "\" until no build is running. Check every 30 seconds, up to 20 checks (10 minutes max).\n" +
-            "Return JSON { \"build_done\": <true if no build is running within budget, false on timeout>, \"status\": \"<final status or timeout note>\" } and nothing else.",
-            { key: attemptKey("publish-artifact-poll-" + taskId, totalReworkCount), label: "Waiting for artifact build to complete",
-              schema: { type: "object", properties: { build_done: { type: "boolean" }, status: { type: "string" } }, required: ["build_done"] },
-              timeoutMs: 660000 }
-          );
+          // STEP 1b (mechanical): bounded poll for build completion, chunked so
+          // the merge-lock lease is refreshed before it can expire. The 600s
+          // lease is shorter than the worst-case 10-minute build poll, so the
+          // poll runs in three chunks (7 checks x 30s ~= 3.5 min each) with a
+          // holder-only lease refresh between chunks. If a refresh fails, the
+          // lock was lost: stop the run and park the task — never continue to
+          // a provenance stamp or version assignment without holding the lock.
+          var buildPoll = null;
+          for (var chunk = 1; chunk <= 3; chunk++) {
+            if (chunk > 1) {
+              var refreshPoll = await agent(
+                "Refresh the merge lock for task " + taskId + ".\n" +
+                "Run: " + LIFECYCLE_ENV + " refresh-lock " + taskId + "\n" +
+                "If the output contains REFRESHED, return JSON { \"held\": true } and nothing else. Otherwise return JSON { \"held\": false, \"output\": \"<verbatim output>\" } and nothing else.",
+                { key: attemptKey("publish-lock-refresh-poll-" + taskId + "-c" + chunk, totalReworkCount), label: "Refreshing merge lock during build poll",
+                  schema: { type: "object", properties: { held: { type: "boolean" }, output: { type: "string" } }, required: ["held"] },
+                  timeoutMs: 60000 }
+              );
+              if (!refreshPoll || refreshPoll.held !== true) {
+                return await parkTask("Merge-lock lease lost during the artifact build poll (refresh before chunk " + chunk + " of 3 failed: " + ((refreshPoll && refreshPoll.output) || "no output") + "). Fail-closed: stopping before any provenance stamp or version assignment.");
+              }
+            }
+            // Chunk 1 keeps the original stable key; later chunks use -c<N>
+            // suffixed keys. All are attemptKey-scoped so rework passes stay
+            // disjoint (replay-key contract).
+            var pollKey = (chunk === 1)
+              ? attemptKey("publish-artifact-poll-" + taskId, totalReworkCount)
+              : attemptKey("publish-artifact-poll-" + taskId + "-c" + chunk, totalReworkCount);
+            buildPoll = await agent(
+              "Poll artifact_status for slug \"" + PUBLISH_SLUG + "\" until no build is running. Check every 30 seconds, up to 7 checks (3.5 minutes max).\n" +
+              "Return JSON { \"build_done\": <true if no build is running within budget, false on timeout>, \"status\": \"<final status or timeout note>\" } and nothing else.",
+              { key: pollKey, label: "Waiting for artifact build to complete (chunk " + chunk + " of 3)",
+                schema: { type: "object", properties: { build_done: { type: "boolean" }, status: { type: "string" } }, required: ["build_done"] },
+                timeoutMs: 270000 }
+            );
+            if (buildPoll && buildPoll.build_done) { break; }
+          }
+          if (!buildPoll || !buildPoll.build_done) {
+            buildPoll = { build_done: false, status: (buildPoll && buildPoll.status) || "build still running after the 10.5-minute bounded poll" };
+          }
           if (buildPoll.build_done) {
             // STEP 1c (mechanical): stamp provenance from workflow-computed values.
             var provStamp = await agent(
@@ -993,25 +1056,34 @@ while (i < STEPS.length) {
         } else {
           publishFailure = "Artifact rebuild trigger failed: " + (rebuildTrigger.error || "artifact_edit not accepted") + ". The publish did not land.";
         }
-        // STEP 2 (mechanical, always once the lock was refreshed): post-deploy
+        } // end: publishSkippedNoLock — no rebuild, no stamp, nothing to ship
+        // STEP 2 (mechanical, always — skip path included): post-deploy
         // commits builder leftovers if any, removes the worktree, and releases
-        // the merge lock — even when the publish itself failed, so a skipped
-        // or failed publish can never leave the lock held (canary b5efd1b1).
+        // the merge lock (forgiving when none is held) — even when the publish
+        // itself failed, so a skipped or failed publish can never leave the
+        // lock held (canary b5efd1b1).
         var postDeploy = await agent(
           "Run: "+ LIFECYCLE_ENV + " post-deploy " + taskId + "\n" +
           "Return JSON { \"deployed\": <true if the output contains DEPLOYED, false otherwise>, \"output\": \"<trimmed output>\" } and nothing else.",
           { key: attemptKey("publish-postdeploy-" + taskId, totalReworkCount), label: "Finalizing publish (post-deploy)",
             schema: { type: "object", properties: { deployed: { type: "boolean" }, output: { type: "string" } }, required: ["deployed"] } }
         );
-        if (publishFailure) {
-          return await parkTask(publishFailure + (postDeploy.deployed
-            ? " Post-deploy finalized cleanup."
-            : " Post-deploy also failed (" + (postDeploy.output || "no output") + ") — worktree and lock state unknown."));
-        }
-        if (!postDeploy.deployed) {
-          return await parkTask("Post-deploy failed after a stamped publish: " + (postDeploy.output || "no output") + ". The publish landed but worktree cleanup and lock release are unknown — human attention needed.");
+        if (publishSkippedNoLock) {
+          if (!postDeploy.deployed) {
+            return await parkTask("Post-deploy failed after a skipped publish: " + (postDeploy.output || "no output") + ". Nothing was published; worktree cleanup and lock state unknown — human attention needed.");
+          }
+          log("Publish skipped cleanly for task " + taskId + " (no lock held) — post-deploy finalized cleanup");
+        } else {
+          if (publishFailure) {
+            return await parkTask(publishFailure + (postDeploy.deployed
+              ? " Post-deploy finalized cleanup."
+              : " Post-deploy also failed (" + (postDeploy.output || "no output") + ") — worktree and lock state unknown."));
+          }
+          if (!postDeploy.deployed) {
+            return await parkTask("Post-deploy failed after a stamped publish: " + (postDeploy.output || "no output") + ". The publish landed but worktree cleanup and lock release are unknown — human attention needed.");
+          }
+          log("Deterministic artifact publish completed for task " + taskId + ": provenance at " + artifactPublish.source_commit);
         }
-        log("Deterministic artifact publish completed for task " + taskId + ": provenance at " + artifactPublish.source_commit);
       } catch (pubErr) {
         // Best-effort cleanup: if the lock was refreshed, try to release it
         // before parking so the failure cannot wedge the next run.
@@ -1032,6 +1104,12 @@ while (i < STEPS.length) {
       // The work agent no longer performs the publish — it reports on the
       // mechanical outcome above. It must not rebuild or re-stamp: a second
       // artifact_edit would trigger a duplicate build.
+      if (publishSkippedNoLock) {
+        instructions = "Publish was skipped deterministically by the workflow before your step — do NOT call artifact_edit, artifact_status, setprovenance, or post-deploy yourself; doing so would disturb the finalized state.\n\n" +
+          "Integrate reported MERGED_EMPTY (the task branch had no commits ahead of main), so no merge lock was taken and there is nothing to ship. The workflow finalized cleanup via post-deploy.\n\n" +
+          "Write plain prose describing the skip, then on its own line: VERDICT: PASS\n" +
+          "The VERDICT line must be the last line of your report.";
+      } else {
       instructions = "Publish the merged code to the live artifact.\n\n" +
         "The publish was performed deterministically by the workflow before your step — do NOT call artifact_edit, artifact_status, setprovenance, or post-deploy yourself; doing so would trigger a duplicate build or disturb the finalized state. You perform no publish actions.\n\n" +
         "For the change summary, run: cd " + REPO_PATH + " && git log -1 --stat\n\n" +
@@ -1044,6 +1122,7 @@ while (i < STEPS.length) {
         "The repo push already happened in Integrate — do NOT push to git in this phase.\n\n" +
         "Write plain prose describing what was published, then on its own line: VERDICT: PASS\n" +
         "The VERDICT line must be the last line of your report.";
+      }
 } else if (PUBLISH_TYPE === "vercel") {
       // vercel publish is not yet implemented — block without inventing behavior
       instructions = "The project's publish target is \"vercel\", which is not yet implemented.\n" +
@@ -1055,7 +1134,9 @@ while (i < STEPS.length) {
     // declared release: yes, QA verifies the registry actually moved. A silent
     // publish skip becomes a loud QA failure with evidence, not a pass.
     var npmPublishCheck = (PUBLISH_TYPE === "npm" && releaseDecision && releaseDecision.release === "yes")
-      ? "NPM PUBLISH CHECK: the accepted Build report declared release: yes, so this run's Publish phase must have published. Find this task's recorded Publish result: call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"getstate\", args: { \"events_limit\": 1 }, then find the session for this task_id with step \"Publish\" (status completed) in the returned sessions array and read its session notes (the Publish agent's summary — event history does NOT carry it).\n" +
+      ? "NPM PUBLISH CHECK: the accepted Build report declared release: yes, so this run's Publish phase must have published — UNLESS it was skipped deterministically on an empty-diff Integrate. Find this task's recorded Publish result: call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"getstate\", args: { \"events_limit\": 1 }, then find the session for this task_id with step \"Publish\" (status completed) in the returned sessions array and read its session notes (the Publish agent's summary — event history does NOT carry it).\n" +
+      "CHECK THE SKIP PATH FIRST: if the notes contain a line matching skipped: no-lock-held, Publish was skipped deterministically — Integrate reported MERGED_EMPTY (no commits ahead of main), so no merge lock was taken and there was nothing to ship. Verify the notes contain that skip-marker line and do NOT contain a line matching published: muse-crew@. Do NOT run npm view and do NOT demand registry movement — nothing was supposed to ship. Report 'npm publish check: Publish skipped deterministically (empty-diff Integrate — nothing to ship)' and PASS this check.\n" +
+      "Only when the notes contain no skip marker must the publish have landed — run the full verification below.\n" +
       "Extract the line matching TARGET_VERSION=<new-version> computed as <base> + <scope> → <new-version> (the workflow appends it to the Publish notes, so it is always present). If the line is missing, report 'npm publish verification failed: Publish notes did not carry the computed target version', then end your report with exactly this line: VERDICT: FAIL.\n" +
       "Verify the bump SCOPE: the <scope> in that line MUST equal the accepted version_bump scope \"" + releaseDecision.version_bump + "\" — if it differs, report the mismatch, then end your report with exactly this line: VERDICT: FAIL. Verify the ARITHMETIC: <base> + <scope> must equal <new-version> (patch increments the last segment only, e.g. 0.3.0 + patch → 0.3.1; minor increments the middle and resets the last to 0; major increments the first and resets the rest to 0) — if the math is wrong, report it, then end your report with exactly this line: VERDICT: FAIL.\n" +
       "Extract the published version from the notes line matching published: muse-crew@<version>. It MUST equal <new-version> from the TARGET_VERSION line. Then run: npm view muse-crew version. The registry version MUST equal <new-version>. If any of these checks fails, report 'npm publish verification failed: [details]', then end your report with exactly this line: VERDICT: FAIL.\n"
@@ -1250,8 +1331,21 @@ while (i < STEPS.length) {
   const status = passed ? "completed" : (step.name === "Integrate" || step.name === "Publish" ? "failed" : "rejected");
 
   // Deterministic publish verification: the agent cannot self-certify a publish.
+  // Skip-aware (park 2026-09-11): when the deterministic publish script found
+  // no merge lock held (empty-diff Integrate), it skips the publish path
+  // gracefully and emits the machine-readable PUBLISH_SKIPPED=no-lock-held
+  // marker. Verification is then vacuous — nothing was shipped, and the
+  // registry must NOT have moved. The marker is script-emitted explicit state
+  // (pasted verbatim per the Publish agent instructions), not agent prose; a
+  // report without the marker still runs the full verification fail-closed.
   var publishVerified = false;
+  var npmPublishSkipped = false;
   if (step.name === "Publish" && PUBLISH_TYPE === "npm" && publishTarget) {
+    if (/^PUBLISH_SKIPPED=no-lock-held$/m.test(workerText || "")) {
+      npmPublishSkipped = true;
+      log("Publish skipped for task " + taskId + " (no merge lock held — empty-diff Integrate): publish verification vacuous, nothing was shipped");
+    }
+    if (!npmPublishSkipped) {
     try {
       var verifyResult = await agent(
         "Run: npm view muse-crew version 2>/dev/null. Return JSON { \"registry_version\": \"<output trimmed>\" } and nothing else.",
@@ -1268,6 +1362,7 @@ while (i < STEPS.length) {
     } catch (e) {
       return await parkTask("Publish verification failed: could not read the registry version (" + (e && e.message ? e.message : e) + "). Fail-closed.");
     }
+    } // end: !npmPublishSkipped — a skipped publish has nothing to verify
   }
 
   // Artifact publish verification: the worker cannot self-certify a deploy.
@@ -1275,6 +1370,14 @@ while (i < STEPS.length) {
   // integrated commit. A stale or missing provenance means the publish did not
   // land — fail closed, do not trust the worker's prose.
   if (step.name === "Publish" && PUBLISH_TYPE === "artifact" && PUBLISH_SLUG) {
+    // Skip-aware (park 2026-09-11): an empty-diff Integrate takes no merge
+    // lock, and the deterministic publish path skips rebuild/stamp entirely —
+    // there is no new provenance to compare against HEAD, so verification is
+    // vacuous. publishSkippedNoLock is workflow-computed state from the
+    // explicit lock-status read in STEP 0, not agent prose.
+    if (publishSkippedNoLock) {
+      log("Publish skipped for task " + taskId + " (no merge lock held — empty-diff Integrate): artifact verification vacuous, nothing was shipped");
+    } else {
     try {
       var headResult = await agent(
         "Run: cd " + REPO_PATH + " && git rev-parse HEAD. Return JSON { \"head\": \"<output trimmed>\" } and nothing else.",
@@ -1298,6 +1401,7 @@ while (i < STEPS.length) {
     } catch (e) {
       return await parkTask("Publish verification failed: could not read artifact provenance (" + (e && e.message ? e.message : e) + "). Fail-closed.");
     }
+    } // end: !publishSkippedNoLock — a skipped publish has nothing to verify
   }
 
   // Session notes. Machine-readable marker lines are extracted from the full
@@ -1306,9 +1410,13 @@ while (i < STEPS.length) {
   // reading TARGET_VERSION=) depend on them.
   let summary;
   var workerMarkers = extractMarkerLines(workerText);
-  if (step.name === "Publish" && PUBLISH_TYPE === "npm" && publishTarget && publishVerified) {
+  if (step.name === "Publish" && PUBLISH_TYPE === "npm" && publishTarget && (publishVerified || npmPublishSkipped)) {
+    // The skip path records the computed target and the explicit skip — never
+    // "published:", which would be a false claim (nothing was shipped).
     const markerLines = "TARGET_VERSION=" + publishTarget.target + " computed as " + publishTarget.base + " + " + publishTarget.scope + " → " + publishTarget.target + "\n" +
-      "published: muse-crew@" + publishTarget.target;
+      (npmPublishSkipped
+        ? "skipped: no-lock-held (empty-diff Integrate — nothing merged, nothing to ship)"
+        : "published: muse-crew@" + publishTarget.target);
     summary = (stepResult.summary || "Step completed").slice(0, 2000 - markerLines.length - workerMarkers.length - 2) + "\n" + markerLines + (workerMarkers ? "\n" + workerMarkers : "");
   } else {
     summary = (stepResult.summary || "Step completed").slice(0, 2000 - workerMarkers.length - 1) + (workerMarkers ? "\n" + workerMarkers : "");