muse-crew 0.6.4 → 0.6.6

package/lib/AGENTS.md

@@ -5,12 +5,12 @@ Shell scripts for the crew's infrastructure. Called by workflow scripts, cron, a
 - `build-registry.js` — deterministic extractor that generates `workflows/registry.json` (workflow step registry) from the workflow files' `meta` blocks at release time; invoked by `crew-release.sh` deploy
 - `crew-release.sh` — immutable release manager: deploy, rollback, prune
 - `merge-lock.sh` — serialized merge lock for concurrent agents: time-based holder lease (bug 2fc8f52f — an unexpired lease is held regardless of process liveness; only an expired lease may be broken). Lock file is key=value: task_id, opaque holder identity (never a PID), acquired_at epoch, lease_seconds (default 600, override via MERGE_LOCK_LEASE_SECONDS). acquire/refresh/release/status/force-release; holder-only refresh and release; every op appends to $CREW_HOME/.merge-lock.log
-- `worktree-lifecycle.sh` — the worktree lifecycle seam: prepare/cleanup/inspect/integrate/verify-merge/status/post-deploy/refresh-lock/lock-status over git worktrees (`.worktrees/<id>`, branch `task/<id>`). The crew registry (`<repo>/.worktrees/.registry/<id>`) is the source of truth for task→branch/path — never reconstruct it from git state. Prepare fails closed on dirty `main`; cleanup is forgiving. `lock-status` reports the merge-lock state explicitly (`UNLOCKED`, or `LOCKED by <holder> since <ts> (pid <pid>)`, always exit 0) so Publish can distinguish an empty-diff Integrate (no lock taken) from a refresh failure.
+- `worktree-lifecycle.sh` — the worktree lifecycle seam: prepare/cleanup/inspect/integrate/verify-merge/status/post-deploy/refresh-lock/lock-status over git worktrees (`.worktrees/<id>`, branch `task/<id>`). The crew registry (`<repo>/.worktrees/.registry/<id>`) is the source of truth for task→branch/path — never reconstruct it from git state. Prepare fails closed on dirty `main`; cleanup is forgiving. `lock-status` reports the merge-lock state explicitly (`UNLOCKED`, or key=value: locked=true, task_id, holder, acquired_at, lease_seconds, age_seconds, remaining_seconds — always exit 0) so Publish can distinguish an empty-diff Integrate (no lock taken) from a refresh failure.
 - `test-worktree-backend.sh` — regression tests for the lifecycle script (validate, prepare/reuse, inspect, status, cleanup, idempotent cleanup, dirty-main preflight) on a scratch repo
 - `test-version-write.sh` — regression tests for the escape-preserving step-8 version write in publish-npm.sh (fixture: current package.json with the \\u2014 escape; extracts the shipped block by anchor)
 - `test-publish-verify.sh` — regression tests for the retry-tolerant step-12 verification in publish-npm.sh (canary 5a027278): extracts the shipped block by anchor and runs it against a fake npm whose read replica lags (non-zero exits, then the old version, then the target) — requires convergence on success, fail-closed `PUBLISH_FAILED=verify` on exhaustion, and `--prefer-online` on every read
 - `test-publish-skip.sh` — regression tests for the no-lock graceful publish skip (park 2026-09-11): `lock-status` returns exact `UNLOCKED`/`LOCKED by <holder> since <ts> (pid <pid>)`; a fake empty-diff integrate takes the MERGED_EMPTY branch and never takes the lock; the shipped step-5 block from publish-npm.sh (extracted by anchor) skips gracefully on UNLOCKED (no park, no `PUBLISH_COMPLETE`), follows the refresh path when a lock is held, and fails closed on a `lock-status` query failure; the gate sits inside the ALREADY_PUBLISHED=0 branch and mutation steps are gated on NO_LOCK_HELD=0
-- `orphan-sweep.sh` — find and clean stale worktrees and merge locks: parses `merge-lock.sh status` key=value fields (never a PID); a lock whose task has a running session is untouched regardless of lease age; a lock with no running session is broken only when its lease is expired (via merge-lock.sh release so the break lands in the audit log)
+- `orphan-sweep.sh` — find and clean stale worktrees and merge locks: parses `merge-lock.sh status` key=value fields (never a PID); a lock whose task has a running session is untouched regardless of lease age; a lock with no running session is broken only when its lease is expired (via merge-lock.sh release so the break lands in the audit log); reaps a lifecycle pin only after N consecutive clean-mode observations (default 3, `ORPHAN_SWEEP_REAP_AFTER`) with the task absent from the active-run list — a single negative observation only plants a tombstone, so a daemon-restart window can't reap a live task's pin
 - `publish-npm.sh` — deterministic npm publish: lock refresh, release install, version write/commit, pack, registry publish, verify, push, post-deploy. Takes TARGET_VERSION as input; idempotent on retry/resume.
 - `compose-evidence.py` — deterministic visual-evidence compositor (Pillow): pairs identical PNG stems from baseline/ and postchange/ dirs, emits `<stem>-sidebyside.png` and amplified-difference `<stem>-overlay.png` into composites/, prints `PAIR`/`SKIP` manifests. Byte-deterministic; nonzero exit on errors.
 - `test-orphan-sweep.sh` — regression tests for orphan-sweep.sh (active-run guard, verified removal, fail-closed)

package/lib/orphan-sweep.sh

@@ -29,6 +29,15 @@
 # task has no running session is safe to remove: any new run re-pins
 # idempotently (mkdir -p + cp) before use.
 #
+# Restart-fragility guard (bug a8bf78ca): pin reaping requires REAP_AFTER
+# (default 3, override via ORPHAN_SWEEP_REAP_AFTER) consecutive clean-mode
+# observations with valid active-run data showing the task absent. A single
+# observation never reaps a pin — a daemon restart can make a live task's
+# session read as not-running for one observation window. A first absence
+# only plants a tombstone marker ($CREW_HOME/.pins/.sweep-suspects/<task>);
+# a task present in the active set is never touched and clears its marker.
+# Report mode and BLOCKED clean (no active-run data) never touch markers.
+#
 # Fail closed: clean mode without either input refuses to remove anything
 # and exits 2. Report mode without either input still runs read-only but
 # prints a banner noting the ACTIVE checks were skipped.
@@ -191,37 +200,81 @@ if [ -d "$WORKTREE_DIR" ]; then
   done
 fi
 
-# --- Reap stale lifecycle pins ---
-# Pins live on persistent disk ($CREW_HOME/.pins/<task>) so a reboot can't
-# strand a run; pins for tasks with no running session are garbage.
+# --- Reap stale lifecycle pins (restart-fragility guard; bug a8bf78ca) ---
+# A pin whose task is absent from the active set is reaped only after
+# REAP_AFTER consecutive clean-mode observations with valid active-run
+# data still show it absent. Counters only — no wall clock.
 PINS_DIR="${CREW_HOME:-$HOME/workspace/.jarvis}/.pins"
+SUSPECTS_DIR="$PINS_DIR/.sweep-suspects"
+REAP_AFTER="${ORPHAN_SWEEP_REAP_AFTER:-3}"
+if [ "$cmd" = "clean" ]; then
+  if ! [[ "$REAP_AFTER" =~ ^[1-9][0-9]*$ ]]; then
+    echo "BLOCKED: ORPHAN_SWEEP_REAP_AFTER='$REAP_AFTER' is not a positive integer — refusing to clean"
+    exit 2
+  fi
+fi
 if [ -d "$PINS_DIR" ]; then
   for pin in "$PINS_DIR"/*/; do
     [ -d "$pin" ] || continue
     task_id=$(basename "$pin")
 
-    # Skip hidden dirs
+    # Skip hidden dirs (the .sweep-suspects dir lives under PINS_DIR)
     [[ "$task_id" == .* ]] && continue
 
     found=1
 
-    # Active runs are never touched.
+    # Active runs are never touched; a pending tombstone is stale.
     if task_is_active "$task_id"; then
+      if [ -f "$SUSPECTS_DIR/$task_id" ]; then
+        rm -f "$SUSPECTS_DIR/$task_id"
+      fi
       echo "ACTIVE_PIN: $task_id — dashboard shows a running session, kept"
       continue
     fi
 
-    echo "STALE_PIN: $task_id — no running session, safe to remove"
+    # Clean mode: count consecutive negative observations; reap only after
+    # REAP_AFTER of them. Report mode stays read-only and never touches
+    # markers — only clean-mode observations count.
     if [ "$cmd" = "clean" ]; then
+      count=0
+      marker="$SUSPECTS_DIR/$task_id"
+      if [ -f "$marker" ]; then
+        count=$(cat "$marker" 2>/dev/null || echo 0)
+        [[ "$count" =~ ^[0-9]+$ ]] || count=0
+      fi
+      count=$((count + 1))
+      if [ "$count" -lt "$REAP_AFTER" ]; then
+        mkdir -p "$SUSPECTS_DIR"
+        printf '%s\n' "$count" > "$marker"
+        echo "SUSPECT_PIN: $task_id — no running session (observation $count/$REAP_AFTER), kept for now"
+        continue
+      fi
+      echo "STALE_PIN: $task_id — no running session for $REAP_AFTER consecutive observations, removing"
       rm -rf "$pin"
+      rm -f "$marker"
       if [ ! -d "$pin" ]; then
         echo "  → removed"
       else
         echo "  → FAILED: pin still present after rm, left in place"
         any_failed=1
       fi
+      continue
     fi
+
+    echo "STALE_PIN: $task_id — no running session, safe to remove"
   done
+
+  # Prune tombstones whose pin dir no longer exists (e.g. a run cleaned up
+  # its own pin). Deleting state is a clean-mode action only.
+  if [ "$cmd" = "clean" ] && [ -d "$SUSPECTS_DIR" ]; then
+    for marker in "$SUSPECTS_DIR"/*; do
+      [ -f "$marker" ] || continue
+      marker_task=$(basename "$marker")
+      if [ ! -d "$PINS_DIR/$marker_task" ]; then
+        rm -f "$marker"
+      fi
+    done
+  fi
 fi
 
 if [ "$found" -eq 0 ]; then

package/lib/publish-npm.sh

@@ -115,6 +115,28 @@ if [ "$ALREADY_PUBLISHED" = "0" ]; then
     # empty diff and fails closed at the numstat check.
     # STEP-8-ANCHOR: version write (escape-preserving)
     PKG_JSON="$REPO_PATH/package.json"
+    # STRANDED-ANCHOR: resume after a killed publish (release commit made,
+    # registry never updated). If the working tree's package.json already
+    # carries TARGET_VERSION and HEAD is the script's own release commit for
+    # it, the version write is a no-op by design — skip it and let step 9
+    # confirm the commit. If HEAD is NOT the release commit, fail closed:
+    # a foreign version bump must never be papered over by a publish.
+    PRE_VER="$(PKG_JSON="$PKG_JSON" node -p "JSON.parse(require('fs').readFileSync(process.env.PKG_JSON,'utf8')).version")" \
+      || fail "version-write" "could not parse package.json before write"
+    STRANDED=0
+    if [ "$PRE_VER" = "$TARGET_VERSION" ]; then
+      case "$HEAD_MSG" in
+        "release: $PKG@$TARGET_VERSION"*)
+          STRANDED=1
+          echo "PUBLISH_STRANDED_RESUME=1"
+          ;;
+        *)
+          fail "version-diff" "package.json already at $TARGET_VERSION but HEAD is not its release commit: $HEAD_MSG"
+          ;;
+      esac
+    fi
+    # STRANDED-END
+    if [ "$STRANDED" = "0" ]; then
     ESCAPED_VER="$(printf '%s' "$TARGET_VERSION" | sed 's/[&\\]/\\&/g')"
     sed -i -E 's/^([[:space:]]*"version"[[:space:]]*:[[:space:]]*)"[^"]*"/\1"'"$ESCAPED_VER"'"/' "$PKG_JSON" \
       || fail "version-write" "sed could not write $TARGET_VERSION into package.json"
@@ -129,6 +151,7 @@ if [ "$ALREADY_PUBLISHED" = "0" ]; then
     ADD_DEL="$(git -C "$REPO_PATH" diff --numstat -- package.json | tr '\t' ' ')"
     [ "$ADD_DEL" = "1 1 package.json" ] \
       || fail "version-diff" "expected a single-line version change, got: $ADD_DEL"
+    fi
     # STEP-8-END
 
     # 9. Commit only if changed (retried run leaves the commit in place).

package/lib/test-orphan-sweep.sh

@@ -129,12 +129,19 @@ echo "$out" | grep -q "NOTE: no active-run data provided; ACTIVE checks skipped"
 echo "$out" | grep -q "MERGED: T7" && ok "6: MERGED line still listed" || no "6: MERGED line missing from report"
 
 # --- Case 7: lifecycle pins — active kept, stale reaped ---
+# A stale pin now needs ORPHAN_SWEEP_REAP_AFTER consecutive observations;
+# set 1 here to exercise the immediate-reap path directly.
 new_fixture case7
 export CREW_HOME="$TMPBASE/case7home"
 mkdir -p "$CREW_HOME/.pins/$UUID_PIN" "$CREW_HOME/.pins/STALEPIN"
 echo x > "$CREW_HOME/.pins/$UUID_PIN/worktree-lifecycle.sh"
 echo x > "$CREW_HOME/.pins/STALEPIN/worktree-lifecycle.sh"
-out=$(CREW_ACTIVE_TASKS="$UUID_PIN" "$SWEEP" clean 2>&1); code=$?
+out=$(CREW_ACTIVE_TASKS="$UUID_PIN" ORPHAN_SWEEP_REAP_AFTER=1 "$SWEEP" clean 2>&1); code=$?
+[ "$code" -eq 0 ] && ok "7: clean exits 0 with pins present" || no "7: exit $code, want 0"
+[ -d "$CREW_HOME/.pins/$UUID_PIN" ] && ok "7: active task's pin kept" || no "7: active task's pin removed"
+[ ! -d "$CREW_HOME/.pins/STALEPIN" ] && ok "7: stale pin removed" || no "7: stale pin still present"
+echo "$out" | grep -q "ACTIVE_PIN: $UUID_PIN" && ok "7: ACTIVE_PIN line printed" || no "7: no ACTIVE_PIN line in output"
+echo "$out" | grep -q "STALE_PIN: STALEPIN" && ok "7: STALE_PIN line printed" || no "7: no STALE_PIN line in output"
 [ "$code" -eq 0 ] && ok "7: clean exits 0 with pins present" || no "7: exit $code, want 0"
 [ -d "$CREW_HOME/.pins/$UUID_PIN" ] && ok "7: active task's pin kept" || no "7: active task's pin removed"
 [ ! -d "$CREW_HOME/.pins/STALEPIN" ] && ok "7: stale pin removed" || no "7: stale pin still present"
@@ -184,6 +191,86 @@ echo "$out" | grep -q "$SHORT_ACTIVE" && ok "10: BLOCKED line names the bad entr
 git show-ref --verify --quiet "refs/heads/task/$UUID_ACTIVE" && ok "10: branch preserved" || no "10: branch deleted despite BLOCKED"
 [ -d "$CREW_HOME/.pins/$UUID_ACTIVE" ] && ok "10: pin preserved" || no "10: pin removed despite BLOCKED"
 
+# --- Case 11: one bad observation doesn't reap (the incident's exact case) ---
+# REAP_AFTER=2: first clean with the task absent only plants a tombstone;
+# the second consecutive absence reaps the pin and clears the marker.
+UUID_TOMB="3472bf36-1549-44bd-bc06-e0c80aef0007"
+new_fixture case11
+export CREW_HOME="$TMPBASE/case11home"
+mkdir -p "$CREW_HOME/.pins/$UUID_TOMB"
+echo x > "$CREW_HOME/.pins/$UUID_TOMB/worktree-lifecycle.sh"
+out=$(CREW_ACTIVE_TASKS="" ORPHAN_SWEEP_REAP_AFTER=2 "$SWEEP" clean 2>&1); code=$?
+[ "$code" -eq 0 ] && ok "11: first clean exits 0" || no "11: first clean exit $code, want 0"
+[ -d "$CREW_HOME/.pins/$UUID_TOMB" ] && ok "11: pin intact after one bad observation" || no "11: pin reaped after ONE observation — the bug"
+echo "$out" | grep -q "SUSPECT_PIN: $UUID_TOMB — no running session (observation 1/2)" && ok "11: SUSPECT_PIN 1/2 line printed" || no "11: no SUSPECT_PIN 1/2 line in output"
+[ "$(cat "$CREW_HOME/.pins/.sweep-suspects/$UUID_TOMB" 2>/dev/null)" = "1" ] && ok "11: tombstone marker holds count 1" || no "11: tombstone marker missing or wrong"
+out=$(CREW_ACTIVE_TASKS="" ORPHAN_SWEEP_REAP_AFTER=2 "$SWEEP" clean 2>&1); code=$?
+[ "$code" -eq 0 ] && ok "11: second clean exits 0" || no "11: second clean exit $code, want 0"
+[ ! -d "$CREW_HOME/.pins/$UUID_TOMB" ] && ok "11: pin reaped after second consecutive absence" || no "11: pin still present after two observations"
+echo "$out" | grep -q "no running session for 2 consecutive observations" && ok "11: reap line cites consecutive observations" || no "11: no consecutive-observations line in output"
+[ ! -f "$CREW_HOME/.pins/.sweep-suspects/$UUID_TOMB" ] && ok "11: marker removed after reap" || no "11: marker left behind after reap"
+
+# --- Case 12: recovery clears the tombstone ---
+new_fixture case12
+export CREW_HOME="$TMPBASE/case12home"
+mkdir -p "$CREW_HOME/.pins/$UUID_TOMB"
+echo x > "$CREW_HOME/.pins/$UUID_TOMB/worktree-lifecycle.sh"
+out=$(CREW_ACTIVE_TASKS="" ORPHAN_SWEEP_REAP_AFTER=2 "$SWEEP" clean 2>&1); code=$?
+[ "$(cat "$CREW_HOME/.pins/.sweep-suspects/$UUID_TOMB" 2>/dev/null)" = "1" ] && ok "12: tombstone planted on first absence" || no "12: no tombstone after first absence"
+out=$(CREW_ACTIVE_TASKS="$UUID_TOMB" ORPHAN_SWEEP_REAP_AFTER=2 "$SWEEP" clean 2>&1); code=$?
+[ "$code" -eq 0 ] && ok "12: recovery clean exits 0" || no "12: recovery clean exit $code, want 0"
+[ -d "$CREW_HOME/.pins/$UUID_TOMB" ] && ok "12: pin intact after recovery" || no "12: pin removed despite task being active"
+[ ! -f "$CREW_HOME/.pins/.sweep-suspects/$UUID_TOMB" ] && ok "12: tombstone cleared on recovery" || no "12: tombstone left behind after recovery"
+echo "$out" | grep -q "ACTIVE_PIN: $UUID_TOMB" && ok "12: ACTIVE_PIN line printed" || no "12: no ACTIVE_PIN line in output"
+
+# --- Case 13: report mode never counts as an observation ---
+new_fixture case13
+export CREW_HOME="$TMPBASE/case13home"
+mkdir -p "$CREW_HOME/.pins/$UUID_TOMB"
+echo x > "$CREW_HOME/.pins/$UUID_TOMB/worktree-lifecycle.sh"
+out=$(CREW_ACTIVE_TASKS="" ORPHAN_SWEEP_REAP_AFTER=2 "$SWEEP" clean 2>&1); code=$?
+[ "$(cat "$CREW_HOME/.pins/.sweep-suspects/$UUID_TOMB" 2>/dev/null)" = "1" ] && ok "13: tombstone planted by clean" || no "13: no tombstone after clean"
+out=$(CREW_ACTIVE_TASKS="" ORPHAN_SWEEP_REAP_AFTER=2 "$SWEEP" report 2>&1); code=$?
+[ "$code" -eq 0 ] && ok "13: report exits 0" || no "13: report exit $code, want 0"
+[ "$(cat "$CREW_HOME/.pins/.sweep-suspects/$UUID_TOMB" 2>/dev/null)" = "1" ] && ok "13: marker still 1 after report" || no "13: report mode counted as an observation"
+[ -d "$CREW_HOME/.pins/$UUID_TOMB" ] && ok "13: pin intact after report" || no "13: report mode removed a pin"
+out=$(CREW_ACTIVE_TASKS="" ORPHAN_SWEEP_REAP_AFTER=2 "$SWEEP" clean 2>&1); code=$?
+[ ! -d "$CREW_HOME/.pins/$UUID_TOMB" ] && ok "13: report did not advance the count (second clean reaps at 2/2)" || no "13: pin not reaped after two clean observations"
+
+# --- Case 14: BLOCKED (no active data) never counts as an observation ---
+new_fixture case14
+export CREW_HOME="$TMPBASE/case14home"
+mkdir -p "$CREW_HOME/.pins/$UUID_TOMB"
+echo x > "$CREW_HOME/.pins/$UUID_TOMB/worktree-lifecycle.sh"
+out=$(CREW_ACTIVE_TASKS="" ORPHAN_SWEEP_REAP_AFTER=2 "$SWEEP" clean 2>&1); code=$?
+[ "$(cat "$CREW_HOME/.pins/.sweep-suspects/$UUID_TOMB" 2>/dev/null)" = "1" ] && ok "14: tombstone planted by clean" || no "14: no tombstone after clean"
+out=$(env -u CREW_ACTIVE_TASKS -u CREW_ACTIVE_TASKS_FILE ORPHAN_SWEEP_REAP_AFTER=2 "$SWEEP" clean 2>&1); code=$?
+[ "$code" -eq 2 ] && ok "14: clean without active data exits 2" || no "14: exit $code, want 2"
+echo "$out" | grep -q "BLOCKED" && ok "14: BLOCKED line printed" || no "14: no BLOCKED line in output"
+[ "$(cat "$CREW_HOME/.pins/.sweep-suspects/$UUID_TOMB" 2>/dev/null)" = "1" ] && ok "14: marker still 1 after BLOCKED" || no "14: BLOCKED counted as an observation"
+[ -d "$CREW_HOME/.pins/$UUID_TOMB" ] && ok "14: pin intact after BLOCKED" || no "14: pin removed despite BLOCKED"
+
+# --- Case 15: markers for pins that no longer exist are pruned ---
+new_fixture case15
+export CREW_HOME="$TMPBASE/case15home"
+mkdir -p "$CREW_HOME/.pins/.sweep-suspects"
+printf '1\n' > "$CREW_HOME/.pins/.sweep-suspects/$UUID_TOMB"   # pin dir gone (run cleaned it up itself)
+out=$(CREW_ACTIVE_TASKS="" "$SWEEP" clean 2>&1); code=$?
+[ "$code" -eq 0 ] && ok "15: clean exits 0" || no "15: exit $code, want 0"
+[ ! -f "$CREW_HOME/.pins/.sweep-suspects/$UUID_TOMB" ] && ok "15: orphaned marker pruned" || no "15: orphaned marker still present"
+
+# --- Case 16: invalid ORPHAN_SWEEP_REAP_AFTER fails closed ---
+new_fixture case16
+export CREW_HOME="$TMPBASE/case16home"
+mkdir -p "$CREW_HOME/.pins/$UUID_TOMB"
+echo x > "$CREW_HOME/.pins/$UUID_TOMB/worktree-lifecycle.sh"
+out=$(CREW_ACTIVE_TASKS="" ORPHAN_SWEEP_REAP_AFTER=foo "$SWEEP" clean 2>&1); code=$?
+[ "$code" -eq 2 ] && ok "16: non-numeric override exits 2" || no "16: exit $code, want 2"
+echo "$out" | grep -q "BLOCKED" && ok "16: BLOCKED line printed" || no "16: no BLOCKED line in output"
+[ -d "$CREW_HOME/.pins/$UUID_TOMB" ] && ok "16: pin untouched on invalid override" || no "16: pin removed despite invalid override"
+out=$(CREW_ACTIVE_TASKS="" ORPHAN_SWEEP_REAP_AFTER=0 "$SWEEP" clean 2>&1); code=$?
+[ "$code" -eq 2 ] && ok "16: zero override exits 2" || no "16: zero override exit $code, want 2"
+
 echo ""
 echo "== $pass passed, $fail failed =="
 [ "$fail" -eq 0 ]

package/lib/test-publish-skip.sh

@@ -59,8 +59,9 @@ fi
 bash "$MERGE_LOCK" acquire "$TASK" "$$" >/dev/null
 OUT="$(bash "$LIFECYCLE" lock-status "$TASK" 2>&1)"
 CODE=$?
-if [ $CODE -eq 0 ] && printf '%s' "$OUT" | grep -Eq "^LOCKED by $TASK since .+ \(pid [0-9]+\)$"; then
-  ok "lock-status reports LOCKED by <holder> since <ts> (pid <pid>) (exit 0)"
+if [ $CODE -eq 0 ] && printf '%s' "$OUT" | grep -Eq "^locked=true$" \
+  && printf '%s' "$OUT" | grep -Eq "^task_id=$TASK$"; then
+  ok "lock-status reports key=value (locked=true, task_id=$TASK) (exit 0)"
 else
   no "lock-status LOCKED: code=$CODE out='$OUT'"
 fi

package/lib/test-publish-stranded.sh

@@ -0,0 +1,154 @@
+#!/usr/bin/env bash
+# test-publish-stranded.sh — regression test for the stranded-release resume
+# in lib/publish-npm.sh (park 2026-09-11).
+#
+# A service restart can kill a Publish run between the release commit and the
+# registry PUT. The release commit is pushed, but npm never got the tarball.
+# Replaying the script must not fail the version-diff guard (the write is a
+# no-op because package.json already carries the target): the script detects
+# the stranded state and resumes at pack/publish. A package.json already at
+# the target whose HEAD is NOT the script's own release commit is a foreign
+# version bump and must fail closed.
+#
+# Self-contained: extracts the shipped STRANDED block from lib/publish-npm.sh
+# by anchor and runs it against scratch checkouts.
+#
+# Anchors: `# STRANDED-ANCHOR` ... `# STRANDED-END` in lib/publish-npm.sh.
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PUBLISH="$SCRIPT_DIR/publish-npm.sh"
+
+PKG="muse-crew"
+TARGET_VERSION="9.9.9"
+STRANDED_MSG="release: muse-crew@9.9.9 (task-aaa)"
+STRANDED_MSG_BARE="release: muse-crew@9.9.9"
+
+pass=0
+fail_count=0
+ok() { echo "PASS: $1"; pass=$((pass + 1)); }
+no() { echo "FAIL: $1"; fail_count=$((fail_count + 1)); }
+
+TMPBASE="$(mktemp -d)"
+trap 'rm -rf "$TMPBASE"' EXIT
+
+# --- Extract the shipped STRANDED block by anchor ---
+BLOCK="$TMPBASE/stranded.sh"
+sed -n '/# STRANDED-ANCHOR/,/# STRANDED-END/p' "$PUBLISH" > "$BLOCK"
+if grep -q 'PUBLISH_STRANDED_RESUME=1' "$BLOCK" && grep -q 'fail "version-diff"' "$BLOCK"; then
+  ok "extracted STRANDED block from publish-npm.sh"
+else
+  no "STRANDED extraction failed (anchors missing)"
+fi
+
+# make_checkout <version> <head-msg>: a scratch git checkout whose
+# package.json carries <version> and whose HEAD message is <head-msg>.
+make_checkout() {
+  local ver="$1" msg="$2" dir="$TMPBASE/checkout-$RANDOM"
+  mkdir -p "$dir"
+  git -C "$dir" init -q
+  git -C "$dir" config user.email "test@test"
+  git -C "$dir" config user.name "test"
+  printf '{\n  "name": "muse-crew",\n  "version": "%s"\n}\n' "$ver" > "$dir/package.json"
+  git -C "$dir" add package.json
+  git -C "$dir" commit -q -m "$msg"
+  printf '%s' "$dir"
+}
+
+# run_stranded <checkout-dir> <head-msg>: runs the shipped block with
+# PKG_JSON/PKG/TARGET_VERSION/HEAD_MSG set; captures stdout in $OUT.
+run_stranded() {
+  local dir="$1" msg="$2" runner="$TMPBASE/runner-$RANDOM.sh"
+  {
+    echo 'fail() { echo "PUBLISH_FAILED=$1"; shift; echo "$1"; exit 1; }'
+    cat "$BLOCK"
+    echo 'echo "STRANDED_RESULT=$STRANDED"'
+  } > "$runner"
+  chmod +x "$runner"
+  OUT="$(PKG_JSON="$dir/package.json" PKG="$PKG" \
+    TARGET_VERSION="$TARGET_VERSION" HEAD_MSG="$msg" \
+    bash "$runner" 2>&1)"
+  local code=$?
+  echo "$OUT"
+  return "$code"
+}
+
+# --- Case 1: stranded release commit (with task id) — resume, no write ---
+DIR1="$(make_checkout "$TARGET_VERSION" "$STRANDED_MSG")"
+BEFORE1="$(cat "$DIR1/package.json")"
+OUT="$(run_stranded "$DIR1" "$STRANDED_MSG")"
+CODE=$?
+if [ "$CODE" -eq 0 ]; then
+  ok "stranded resume: block exits 0"
+else
+  no "stranded resume: block exited $CODE (output: $OUT)"
+fi
+case "$OUT" in
+  *"PUBLISH_STRANDED_RESUME=1"*)
+    ok "stranded resume: prints PUBLISH_STRANDED_RESUME=1" ;;
+  *) no "stranded resume: missing PUBLISH_STRANDED_RESUME=1 (output: $OUT)" ;;
+esac
+case "$OUT" in
+  *"STRANDED_RESULT=1"*)
+    ok "stranded resume: STRANDED=1 (skips the version write)" ;;
+  *) no "stranded resume: expected STRANDED=1 (output: $OUT)" ;;
+esac
+if [ "$(cat "$DIR1/package.json")" = "$BEFORE1" ]; then
+  ok "stranded resume: package.json untouched (write skipped)"
+else
+  no "stranded resume: package.json was modified"
+fi
+
+# --- Case 2: bare release message form (no task id) — also resumes ---
+DIR2="$(make_checkout "$TARGET_VERSION" "$STRANDED_MSG_BARE")"
+OUT="$(run_stranded "$DIR2" "$STRANDED_MSG_BARE")"
+CODE=$?
+if [ "$CODE" -eq 0 ] && grep -q 'PUBLISH_STRANDED_RESUME=1' <<< "$OUT"; then
+  ok "bare release message form also resumes"
+else
+  no "bare release message form failed to resume (code $CODE, output: $OUT)"
+fi
+
+# --- Case 3: foreign version bump — fail closed ---
+DIR3="$(make_checkout "$TARGET_VERSION" "merge: some other fix")"
+OUT="$(run_stranded "$DIR3" "merge: some other fix")"
+CODE=$?
+if [ "$CODE" -ne 0 ]; then
+  ok "foreign version: block fails closed (non-zero exit)"
+else
+  no "foreign version: block exited 0 despite foreign HEAD"
+fi
+case "$OUT" in
+  *"PUBLISH_FAILED=version-diff"*)
+    ok "foreign version: keeps the PUBLISH_FAILED=version-diff marker" ;;
+  *) no "foreign version: missing PUBLISH_FAILED=version-diff (output: $OUT)" ;;
+esac
+case "$OUT" in
+  *"not its release commit"*)
+    ok "foreign version: detail names the mismatch" ;;
+  *) no "foreign version: missing mismatch detail (output: $OUT)" ;;
+esac
+
+# --- Case 4: normal path (package.json behind) — no resume, write proceeds ---
+DIR4="$(make_checkout "9.9.8" "merge: some other fix")"
+OUT="$(run_stranded "$DIR4" "merge: some other fix")"
+CODE=$?
+if [ "$CODE" -eq 0 ]; then
+  ok "normal path: block exits 0"
+else
+  no "normal path: block exited $CODE (output: $OUT)"
+fi
+case "$OUT" in
+  *"STRANDED_RESULT=0"*)
+    ok "normal path: STRANDED=0 (version write proceeds)" ;;
+  *) no "normal path: expected STRANDED=0 (output: $OUT)" ;;
+esac
+case "$OUT" in
+  *"PUBLISH_STRANDED_RESUME=1"*) no "normal path: must not print PUBLISH_STRANDED_RESUME=1" ;;
+  *) ok "normal path: no stranded-resume marker" ;;
+esac
+
+echo ""
+echo "$pass passed, $fail_count failed."
+[ "$fail_count" -eq 0 ]

package/lib/worktree-lifecycle.sh

@@ -20,7 +20,7 @@
 #   cleanup   <task_id>                  — remove worktree + branch (no lock)
 #   status    <task_id>                  — report worktree state
 #   refresh-lock <task_id>               — refresh merge lock timestamp (resets staleness clock)
-#   lock-status <task_id>                — report merge lock state: UNLOCKED or LOCKED by <holder> since <ts> (pid <pid>)
+#   lock-status <task_id>                — report merge lock state: UNLOCKED, or key=value lock status (locked=true, task_id, holder, acquired_at, lease_seconds, age_seconds, remaining_seconds)
 #   sweep     [report|clean]             — find/clean orphans + stale locks
 #
 # Exit codes:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.6.4",
+  "version": "0.6.6",
   "description": "Opinionated orchestration for Muse \u2014 workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,

package/workflows/crew-dispatch.js

@@ -384,12 +384,6 @@ if (parkJobs.length > 0) {
   } catch (parkErr) {
     log("WARNING: park batch failed (" + (parkErr.message || String(parkErr)).slice(0, 200) + ") — tasks remain retryable");
   }
-} else {
-  // Cap disabled, or no retry candidates: pre-cap behavior.
-  for (var dr = 0; dr < retryCandidates.length; dr++) {
-    var drc = retryCandidates[dr];
-    eligible.push({ task: drc.task, startStep: drc.startStep, reason: "retry", workflow: drc.workflow });
-  }
 }
 
 log("Eligible: " + eligible.length + " tasks (" + retryCandidates.length + " retry candidates)");
@@ -617,7 +611,20 @@ await agent(
   { key: "ack", label: "Acknowledging poll", schema: { type: "object" } }
 );
 
-var recommended = results.filter(function(r) { return r.action === "recommended"; });
+var recommended = [];
+var seenClaims = {};
+results.forEach(function(r) {
+  if (r.action !== "recommended") { return; }
+  if (seenClaims[r.task_id]) {
+    // Mechanical guard: a single run must never emit the same task twice in
+    // its claims array. The self-claim stand-down path was designed for
+    // cross-tick races, not for one run claiming a task against itself.
+    log("WARNING: dropped duplicate claim for task " + r.task_id + " within this run (kept first)");
+    return;
+  }
+  seenClaims[r.task_id] = true;
+  recommended.push(r);
+});
 var completed = results.filter(function(r) { return r.action === "completed"; });
 var msg = "Dispatch complete.";
 if (recommended.length > 0) {