muse-crew 0.14.2 → 0.14.3

package/workflows/bugfix.js

@@ -416,7 +416,10 @@ function hydrateReleaseDecision(rec) {
 // fabricated from the diff; it must match the artifact's real content.
 
 // See docs/decisions/publish-path.md#publish-attempt-ledger: every trigger outcome is recorded in the durable ledger.
-async function recordPublishLedger(entry, rework) {
+// keyTag (optional): same-outcome ledger writes in one pass need distinct
+// agent-call keys — the runtime replays cached calls by key, so a shared key
+// silently drops the second write (2026-09-19, submitted-on-issuance).
+async function recordPublishLedger(entry, rework, keyTag) {
   try {
     var ledgerDir = crewHome + "/.publish-ledger";
     var line = JSON.stringify({
@@ -438,7 +441,7 @@ async function recordPublishLedger(entry, rework) {
       "Run: mkdir -p " + sq(ledgerDir) + " && printf '%s\n' " + sq(line) +
       " | sed \"s/@LEDGER_TS@/$(date -u +%Y-%m-%dT%H:%M:%SZ)/\" >> " + sq(ledgerDir + "/" + PUBLISH_SLUG + ".jsonl") + " && echo LEDGER_OK\n" +
       "Return JSON { \"result\": \"<verbatim output>\" } and nothing else.",
-      { key: attemptKey("publish-ledger-" + taskId + "-" + entry.outcome, rework),
+      { key: attemptKey("publish-ledger-" + taskId + "-" + entry.outcome + (keyTag ? "-" + keyTag : ""), rework),
         label: "Recording publish attempt in ledger",
         schema: { type: "object", properties: { result: { type: "string" } }, required: ["result"] } }
     );
@@ -1289,7 +1292,7 @@ while (i < STEPS.length) {
       "The script merges, reconciles, records, and pushes under the merge lock. Informational only: RECONCILED, NO_REMOTE, NO_REMOTE_RECONCILE. Read the output:\n" +
       "- STAGED_BASE_MISMATCH: the line left the staged base (stray checkout). VERDICT: FAIL.\n" +
       "- MERGED_EMPTY — check FIRST (it contains the word MERGED): either a runtime-state deliverable or an already-merged sha the workflow verified (Build declared repo_diff: none). No lock taken, no new commit. Report 'merged empty: no repo changes'. VERDICT: PASS.\n" +
-      "- MERGED: the merge landed; the script pushed inline. Read the push line: PUSHED — report the hash, VERDICT: PASS; PUSH_SKIPPED — the detached line is room-local (the merge commit + record are the evidence), VERDICT: PASS; NO_REMOTE_PUSH — no remote configured, VERDICT: PASS; ERROR after MERGED — a retry recovers the push; report it, VERDICT: FAIL.\n" +
+      "- MERGED: the merge landed; the script pushed inline. Read the push line: PUSHED — report the hash (detached prints PUSHED: origin/main (refspec HEAD:main)), VERDICT: PASS; NO_REMOTE_PUSH — no remote configured, VERDICT: PASS; ERROR after MERGED — a retry recovers the push; report it, VERDICT: FAIL.\n" +
       "- LOCK_HELD: 10-minute backoff exhausted. VERDICT: FAIL.\n" +
       "- CONFLICT: the plain merge failed — aborted, the target is clean, and your task still holds the merge lock. Do NOT fail yet. Resolve it:\n" +
       "RESOLUTION:\n" +
@@ -1302,7 +1305,7 @@ while (i < STEPS.length) {
       "ESCALATE — 'conflict needs human resolution', VERDICT: FAIL — when: 3 attempts are exhausted; the conflict touches generated files, migrations, or public API contracts; or 'looks right + checks pass' is not sufficient for any other reason. On escalation, RELEASE THE LOCK so the task can be reworked later: run CREW_HOME=" + crewHome + " CREW_REPO=" + REPO_PATH + " " + MERGE_LOCK + " release " + taskId + " (release is keyed on task id; no PID needed). Do NOT run post-deploy on escalation — it would delete the untouched task branch the human still needs.\n" +
       "- ERROR: report it. VERDICT: FAIL.\n\n" +
       "R5-PUSH (manual R5 resolution only — the normal path pushed inline). Run: " + LIFECYCLE_ENV + LIFECYCLE + " push-target " + taskId + "\n" +
-      "PUSHED — report the merged hash, VERDICT: PASS; PUSH_SKIPPED or NO_REMOTE_PUSH — nothing to push, VERDICT: PASS; ERROR or CONFLICT — report it, VERDICT: FAIL.\n" +
+      "PUSHED — report the merged hash (detached prints PUSHED: origin/main (refspec HEAD:main)), VERDICT: PASS; PUSH_SKIPPED — no push attempted (no record + no lock); NO_REMOTE_PUSH — no remote; VERDICT: PASS; ERROR or CONFLICT — report it, VERDICT: FAIL.\n" +
       "NEVER force-push.\n\n" +
       "Report what happened at each step, ending with exactly one line: VERDICT: PASS or VERDICT: FAIL.";
 
@@ -1640,7 +1643,7 @@ while (i < STEPS.length) {
           log("Publish pre-trigger baseline read failed for task " + taskId + " (" + (baselineErr && baselineErr.message ? baselineErr.message : baselineErr) + ") — receipt attribution skipped; durable audit-dir evidence is the only positive signal");
         }
         // See docs/decisions/publish-path.md#trigger-await: the artifact_edit call is awaited.
-        var rebuildTrigger = null;
+        var rebuildTrigger = null, triggerThrew = false;
         try {
           var triggerText = String(await agent(rebuildPrompt,
             { key: rebuildAttemptKey, label: "Triggering artifact rebuild" }) || "");
@@ -1660,7 +1663,18 @@ while (i < STEPS.length) {
           }
         } catch (triggerErr) {
           log("Publish rebuild trigger for task " + taskId + " threw (" + (triggerErr && triggerErr.message ? triggerErr.message : triggerErr) + ") — outcome unknown until observation confirms it; the edit may have gone through");
+          triggerThrew = true;
         }
+        // (2026-09-19, room #22) Submitted-on-issuance: see docs/decisions/publish-path.md#submitted-on-issuance.
+        await recordPublishLedger({
+          commit: mergeCommitForPublish,
+          attempt: rebuildAttemptKey,
+          agent_id: null,
+          applied_report: publishAppliedObservation,
+          manifest_before: preTriggerManifest,
+          outcome: "submitted",
+          detail: "trigger issuance: rebuild-trigger agent invoked; receipt/observation pending. Invocation only - not evidence of artifact_edit or build acceptance." + (triggerThrew ? "; trigger-threw" : "; trigger-returned")
+        }, totalReworkCount, "issuance");
         // Post-trigger observation (primary, not fallback): the workflow
         // attributes the edit itself. First the in-flight build state — a
         // build whose agent_id is new relative to the pre-trigger baseline
@@ -1780,8 +1794,8 @@ while (i < STEPS.length) {
             applied_report: publishAppliedObservation,
             manifest_before: preTriggerManifest,
             outcome: "submitted",
-            detail: "fire-and-forget trigger; build receipt captured by workflow-owned build-state observation (pre/post-trigger diff)"
-          }, totalReworkCount);
+            detail: "fire-and-forget trigger; build receipt captured by workflow-owned build-state observation (pre/post-trigger diff); observation, not re-issuance"
+          }, totalReworkCount, "receipt");
         } else {
           var newAuditDirs = [];
           try {
@@ -1912,10 +1926,6 @@ while (i < STEPS.length) {
         // its outcome — submitted, rejected, or unknown (unknown is recorded
         // at the park site above). A later run or human matches commit hash +
         // attempt key against the builder's eventual completion.
-        // (2026-09-16) The trigger is fire-and-forget: the observation above
-        // already recorded the ledger's submitted line on both positive paths
-        // and parked on unknown — there is no applied report to observe and
-        // no rejection signal to record.
         // (2026-09-18, H2 verdict-first) The verdict was decided exactly
         // once above; dispatch on it. landed bypasses the receipt poll
         // (the audit evidence already proved completion); an explicit
@@ -2049,21 +2059,12 @@ while (i < STEPS.length) {
             log("Publish build landed for task " + taskId + " — provenance stamp deferred to parent content verification");
           } else {
             // STEP 1b durable audit-dir fallback (2026-09-15, task aadeccc3):
-            // the poll above only observes IN-FLIGHT builds. A build that
-            // finished between the receipt capture and the poll's first check
-            // leaves no in-flight trace — but the platform's audit harness
-            // leaves a durable one (~/workspace/ts-spaces/<slug>/audits/
-            // <timestamp>-<id>/ per completed build). Diff the audit-dir
-            // listing against the pre-trigger snapshot: a timestamped dir
-            // that appeared during the attempt window is evidence a build
-            // completed. Attribution is by window, not by build identity:
-            // the poll's saw_stranger signal only catches stranger builds in
-            // flight AT a check — a stranger that finished entirely inside
-            // the window is indistinguishable, so any observed stranger
-            // blocks attribution and the outcome stays unknown. This never
-            // re-issues the edit and never stamps provenance — ok=true only
-            // routes to the parent's independent content read-back, which
-            // remains the real verification.
+            // the poll observes only in-flight builds; a build that finished
+            // inside the window leaves a durable audit dir. Diff the audit
+            // listing against the pre-trigger snapshot: a new timestamped dir
+            // is evidence a build completed. Attribution is by window, not by build identity: any
+            // observed stranger blocks it. Never re-issues, never stamps;
+            // ok=true routes to the parent's read-back (the verification).
             //
             // The poll end-state is read from the poll's own observations,
             // not from build_done alone: a build in flight at the last check

package/workflows/chore.js

@@ -475,7 +475,10 @@ function hydrateReleaseDecision(rec) {
 // fabricated from the diff; it must match the artifact's real content.
 
 // See docs/decisions/publish-path.md#publish-attempt-ledger: every trigger outcome is recorded in the durable ledger.
-async function recordPublishLedger(entry, rework) {
+// keyTag (optional): same-outcome ledger writes in one pass need distinct
+// agent-call keys — the runtime replays cached calls by key, so a shared key
+// silently drops the second write (2026-09-19, submitted-on-issuance).
+async function recordPublishLedger(entry, rework, keyTag) {
   try {
     var ledgerDir = crewHome + "/.publish-ledger";
     var line = JSON.stringify({
@@ -497,7 +500,7 @@ async function recordPublishLedger(entry, rework) {
       "Run: mkdir -p " + sq(ledgerDir) + " && printf '%s\n' " + sq(line) +
       " | sed \"s/@LEDGER_TS@/$(date -u +%Y-%m-%dT%H:%M:%SZ)/\" >> " + sq(ledgerDir + "/" + PUBLISH_SLUG + ".jsonl") + " && echo LEDGER_OK\n" +
       "Return JSON { \"result\": \"<verbatim output>\" } and nothing else.",
-      { key: attemptKey("publish-ledger-" + taskId + "-" + entry.outcome, rework),
+      { key: attemptKey("publish-ledger-" + taskId + "-" + entry.outcome + (keyTag ? "-" + keyTag : ""), rework),
         label: "Recording publish attempt in ledger",
         schema: { type: "object", properties: { result: { type: "string" } }, required: ["result"] } }
     );
@@ -1195,7 +1198,7 @@ while (i < STEPS.length) {
       "The script merges, reconciles, records, and pushes under the merge lock. Informational only: RECONCILED, NO_REMOTE, NO_REMOTE_RECONCILE. Read the output:\n" +
       "- STAGED_BASE_MISMATCH: the line left the staged base (stray checkout). VERDICT: FAIL.\n" +
       "- MERGED_EMPTY — check FIRST (it contains the word MERGED): either a runtime-state deliverable or an already-merged sha the workflow verified (Build declared repo_diff: none). No lock taken, no new commit. Report 'merged empty: no repo changes'. VERDICT: PASS.\n" +
-      "- MERGED: the merge landed; the script pushed inline. Read the push line: PUSHED — report the hash, VERDICT: PASS; PUSH_SKIPPED — the detached line is room-local (the merge commit + record are the evidence), VERDICT: PASS; NO_REMOTE_PUSH — no remote configured, VERDICT: PASS; ERROR after MERGED — a retry recovers the push; report it, VERDICT: FAIL.\n" +
+      "- MERGED: the merge landed; the script pushed inline. Read the push line: PUSHED — report the hash (detached prints PUSHED: origin/main (refspec HEAD:main)), VERDICT: PASS; NO_REMOTE_PUSH — no remote configured, VERDICT: PASS; ERROR after MERGED — a retry recovers the push; report it, VERDICT: FAIL.\n" +
       "- LOCK_HELD: 10-minute backoff exhausted. VERDICT: FAIL.\n" +
       "- CONFLICT: the plain merge failed — aborted, the target is clean, and your task still holds the merge lock. Do NOT fail yet. Resolve it:\n" +
       "RESOLUTION:\n" +
@@ -1208,7 +1211,7 @@ while (i < STEPS.length) {
       "ESCALATE — 'conflict needs human resolution', VERDICT: FAIL — when: 3 attempts are exhausted; the conflict touches generated files, migrations, or public API contracts; or 'looks right + checks pass' is not sufficient for any other reason. On escalation, RELEASE THE LOCK so the task can be reworked later: run CREW_HOME=" + crewHome + " CREW_REPO=" + REPO_PATH + " " + MERGE_LOCK + " release " + taskId + " (release is keyed on task id; no PID needed). Do NOT run post-deploy on escalation — it would delete the untouched task branch the human still needs.\n" +
       "- ERROR: report it. VERDICT: FAIL.\n\n" +
       "R5-PUSH (manual R5 resolution only — the normal path pushed inline). Run: " + LIFECYCLE_ENV + LIFECYCLE + " push-target " + taskId + "\n" +
-      "PUSHED — report the merged hash, VERDICT: PASS; PUSH_SKIPPED or NO_REMOTE_PUSH — nothing to push, VERDICT: PASS; ERROR or CONFLICT — report it, VERDICT: FAIL.\n" +
+      "PUSHED — report the merged hash (detached prints PUSHED: origin/main (refspec HEAD:main)), VERDICT: PASS; PUSH_SKIPPED — no push attempted (no record + no lock); NO_REMOTE_PUSH — no remote; VERDICT: PASS; ERROR or CONFLICT — report it, VERDICT: FAIL.\n" +
       "NEVER force-push.\n\n" +
       "Report what happened at each step, ending with exactly one line: VERDICT: PASS or VERDICT: FAIL.";
 
@@ -1546,7 +1549,7 @@ while (i < STEPS.length) {
           log("Publish pre-trigger baseline read failed for task " + taskId + " (" + (baselineErr && baselineErr.message ? baselineErr.message : baselineErr) + ") — receipt attribution skipped; durable audit-dir evidence is the only positive signal");
         }
         // See docs/decisions/publish-path.md#trigger-await: the artifact_edit call is awaited.
-        var rebuildTrigger = null;
+        var rebuildTrigger = null, triggerThrew = false;
         try {
           var triggerText = String(await agent(rebuildPrompt,
             { key: rebuildAttemptKey, label: "Triggering artifact rebuild" }) || "");
@@ -1566,7 +1569,18 @@ while (i < STEPS.length) {
           }
         } catch (triggerErr) {
           log("Publish rebuild trigger for task " + taskId + " threw (" + (triggerErr && triggerErr.message ? triggerErr.message : triggerErr) + ") — outcome unknown until observation confirms it; the edit may have gone through");
+          triggerThrew = true;
         }
+        // (2026-09-19, room #22) Submitted-on-issuance: see docs/decisions/publish-path.md#submitted-on-issuance.
+        await recordPublishLedger({
+          commit: mergeCommitForPublish,
+          attempt: rebuildAttemptKey,
+          agent_id: null,
+          applied_report: publishAppliedObservation,
+          manifest_before: preTriggerManifest,
+          outcome: "submitted",
+          detail: "trigger issuance: rebuild-trigger agent invoked; receipt/observation pending. Invocation only - not evidence of artifact_edit or build acceptance." + (triggerThrew ? "; trigger-threw" : "; trigger-returned")
+        }, reworkCount, "issuance");
         // Post-trigger observation (primary, not fallback): the workflow
         // attributes the edit itself. First the in-flight build state — a
         // build whose agent_id is new relative to the pre-trigger baseline
@@ -1686,8 +1700,8 @@ while (i < STEPS.length) {
             applied_report: publishAppliedObservation,
             manifest_before: preTriggerManifest,
             outcome: "submitted",
-            detail: "fire-and-forget trigger; build receipt captured by workflow-owned build-state observation (pre/post-trigger diff)"
-          }, reworkCount);
+            detail: "fire-and-forget trigger; build receipt captured by workflow-owned build-state observation (pre/post-trigger diff); observation, not re-issuance"
+          }, reworkCount, "receipt");
         } else {
           var newAuditDirs = [];
           try {
@@ -1818,10 +1832,6 @@ while (i < STEPS.length) {
         // its outcome — submitted, rejected, or unknown (unknown is recorded
         // at the park site above). A later run or human matches commit hash +
         // attempt key against the builder's eventual completion.
-        // (2026-09-16) The trigger is fire-and-forget: the observation above
-        // already recorded the ledger's submitted line on both positive paths
-        // and parked on unknown — there is no applied report to observe and
-        // no rejection signal to record.
         // (2026-09-18, H2 verdict-first) The verdict was decided exactly
         // once above; dispatch on it. landed bypasses the receipt poll
         // (the audit evidence already proved completion); an explicit
@@ -1955,21 +1965,12 @@ while (i < STEPS.length) {
             log("Publish build landed for task " + taskId + " — provenance stamp deferred to parent content verification");
           } else {
             // STEP 1b durable audit-dir fallback (2026-09-15, task aadeccc3):
-            // the poll above only observes IN-FLIGHT builds. A build that
-            // finished between the receipt capture and the poll's first check
-            // leaves no in-flight trace — but the platform's audit harness
-            // leaves a durable one (~/workspace/ts-spaces/<slug>/audits/
-            // <timestamp>-<id>/ per completed build). Diff the audit-dir
-            // listing against the pre-trigger snapshot: a timestamped dir
-            // that appeared during the attempt window is evidence a build
-            // completed. Attribution is by window, not by build identity:
-            // the poll's saw_stranger signal only catches stranger builds in
-            // flight AT a check — a stranger that finished entirely inside
-            // the window is indistinguishable, so any observed stranger
-            // blocks attribution and the outcome stays unknown. This never
-            // re-issues the edit and never stamps provenance — ok=true only
-            // routes to the parent's independent content read-back, which
-            // remains the real verification.
+            // the poll observes only in-flight builds; a build that finished
+            // inside the window leaves a durable audit dir. Diff the audit
+            // listing against the pre-trigger snapshot: a new timestamped dir
+            // is evidence a build completed. Attribution is by window, not by build identity: any
+            // observed stranger blocks it. Never re-issues, never stamps;
+            // ok=true routes to the parent's read-back (the verification).
             //
             // The poll end-state is read from the poll's own observations,
             // not from build_done alone: a build in flight at the last check

package/workflows/standard.js

@@ -428,7 +428,10 @@ function hydrateReleaseDecision(rec) {
 // it must match the artifact's real content.
 
 // See docs/decisions/publish-path.md#publish-attempt-ledger: every trigger outcome is recorded in the durable ledger.
-async function recordPublishLedger(entry, rework) {
+// keyTag (optional): same-outcome ledger writes in one pass need distinct
+// agent-call keys — the runtime replays cached calls by key, so a shared key
+// silently drops the second write (2026-09-19, submitted-on-issuance).
+async function recordPublishLedger(entry, rework, keyTag) {
   try {
     var ledgerDir = crewHome + "/.publish-ledger";
     var line = JSON.stringify({
@@ -450,7 +453,7 @@ async function recordPublishLedger(entry, rework) {
       "Run: mkdir -p " + sq(ledgerDir) + " && printf '%s\n' " + sq(line) +
       " | sed \"s/@LEDGER_TS@/$(date -u +%Y-%m-%dT%H:%M:%SZ)/\" >> " + sq(ledgerDir + "/" + PUBLISH_SLUG + ".jsonl") + " && echo LEDGER_OK\n" +
       "Return JSON { \"result\": \"<verbatim output>\" } and nothing else.",
-      { key: attemptKey("publish-ledger-" + taskId + "-" + entry.outcome, rework),
+      { key: attemptKey("publish-ledger-" + taskId + "-" + entry.outcome + (keyTag ? "-" + keyTag : ""), rework),
         label: "Recording publish attempt in ledger",
         schema: { type: "object", properties: { result: { type: "string" } }, required: ["result"] } }
     );
@@ -1182,7 +1185,7 @@ while (i < STEPS.length) {
       "The script merges, reconciles, records, and pushes under the merge lock. Informational only: RECONCILED, NO_REMOTE, NO_REMOTE_RECONCILE. Read the output:\n" +
       "- STAGED_BASE_MISMATCH: the line left the staged base (stray checkout). VERDICT: FAIL.\n" +
       "- MERGED_EMPTY — check FIRST (it contains the word MERGED): either a runtime-state deliverable or an already-merged sha the workflow verified (Build declared repo_diff: none). No lock taken, no new commit. Report 'merged empty: no repo changes'. VERDICT: PASS.\n" +
-      "- MERGED: the merge landed; the script pushed inline. Read the push line: PUSHED — report the hash, VERDICT: PASS; PUSH_SKIPPED — the detached line is room-local (the merge commit + record are the evidence), VERDICT: PASS; NO_REMOTE_PUSH — no remote configured, VERDICT: PASS; ERROR after MERGED — a retry recovers the push; report it, VERDICT: FAIL.\n" +
+      "- MERGED: the merge landed; the script pushed inline. Read the push line: PUSHED — report the hash (detached prints PUSHED: origin/main (refspec HEAD:main)), VERDICT: PASS; NO_REMOTE_PUSH — no remote configured, VERDICT: PASS; ERROR after MERGED — a retry recovers the push; report it, VERDICT: FAIL.\n" +
       "- LOCK_HELD: 10-minute backoff exhausted. VERDICT: FAIL.\n" +
       "- CONFLICT: the plain merge failed — aborted, the target is clean, and your task still holds the merge lock. Do NOT fail yet. Resolve it:\n" +
       "RESOLUTION:\n" +
@@ -1195,7 +1198,7 @@ while (i < STEPS.length) {
       "ESCALATE — 'conflict needs human resolution', VERDICT: FAIL — when: 3 attempts are exhausted; the conflict touches generated files, migrations, or public API contracts; or 'looks right + checks pass' is not sufficient for any other reason. On escalation, RELEASE THE LOCK so the task can be reworked later: run CREW_HOME=" + crewHome + " CREW_REPO=" + REPO_PATH + " " + MERGE_LOCK + " release " + taskId + " (release is keyed on task id; no PID needed). Do NOT run post-deploy on escalation — it would delete the untouched task branch the human still needs.\n" +
       "- ERROR: report it. VERDICT: FAIL.\n\n" +
       "R5-PUSH (manual R5 resolution only — the normal path pushed inline). Run: " + LIFECYCLE_ENV + LIFECYCLE + " push-target " + taskId + "\n" +
-      "PUSHED — report the merged hash, VERDICT: PASS; PUSH_SKIPPED or NO_REMOTE_PUSH — nothing to push, VERDICT: PASS; ERROR or CONFLICT — report it, VERDICT: FAIL.\n" +
+      "PUSHED — report the merged hash (detached prints PUSHED: origin/main (refspec HEAD:main)), VERDICT: PASS; PUSH_SKIPPED — no push attempted (no record + no lock); NO_REMOTE_PUSH — no remote; VERDICT: PASS; ERROR or CONFLICT — report it, VERDICT: FAIL.\n" +
       "NEVER force-push.\n\n" +
       "Report what happened at each step, ending with exactly one line: VERDICT: PASS or VERDICT: FAIL.";
 
@@ -1533,7 +1536,7 @@ while (i < STEPS.length) {
           log("Publish pre-trigger baseline read failed for task " + taskId + " (" + (baselineErr && baselineErr.message ? baselineErr.message : baselineErr) + ") — receipt attribution skipped; durable audit-dir evidence is the only positive signal");
         }
         // See docs/decisions/publish-path.md#trigger-await: the artifact_edit call is awaited.
-        var rebuildTrigger = null;
+        var rebuildTrigger = null, triggerThrew = false;
         try {
           var triggerText = String(await agent(rebuildPrompt,
             { key: rebuildAttemptKey, label: "Triggering artifact rebuild" }) || "");
@@ -1553,7 +1556,18 @@ while (i < STEPS.length) {
           }
         } catch (triggerErr) {
           log("Publish rebuild trigger for task " + taskId + " threw (" + (triggerErr && triggerErr.message ? triggerErr.message : triggerErr) + ") — outcome unknown until observation confirms it; the edit may have gone through");
+          triggerThrew = true;
         }
+        // (2026-09-19, room #22) Submitted-on-issuance: see docs/decisions/publish-path.md#submitted-on-issuance.
+        await recordPublishLedger({
+          commit: mergeCommitForPublish,
+          attempt: rebuildAttemptKey,
+          agent_id: null,
+          applied_report: publishAppliedObservation,
+          manifest_before: preTriggerManifest,
+          outcome: "submitted",
+          detail: "trigger issuance: rebuild-trigger agent invoked; receipt/observation pending. Invocation only - not evidence of artifact_edit or build acceptance." + (triggerThrew ? "; trigger-threw" : "; trigger-returned")
+        }, totalReworkCount, "issuance");
         // Post-trigger observation (primary, not fallback): the workflow
         // attributes the edit itself. First the in-flight build state — a
         // build whose agent_id is new relative to the pre-trigger baseline
@@ -1673,8 +1687,8 @@ while (i < STEPS.length) {
             applied_report: publishAppliedObservation,
             manifest_before: preTriggerManifest,
             outcome: "submitted",
-            detail: "fire-and-forget trigger; build receipt captured by workflow-owned build-state observation (pre/post-trigger diff)"
-          }, totalReworkCount);
+            detail: "fire-and-forget trigger; build receipt captured by workflow-owned build-state observation (pre/post-trigger diff); observation, not re-issuance"
+          }, totalReworkCount, "receipt");
         } else {
           var newAuditDirs = [];
           try {
@@ -1805,10 +1819,6 @@ while (i < STEPS.length) {
         // its outcome — submitted, rejected, or unknown (unknown is recorded
         // at the park site above). A later run or human matches commit hash +
         // attempt key against the builder's eventual completion.
-        // (2026-09-16) The trigger is fire-and-forget: the observation above
-        // already recorded the ledger's submitted line on both positive paths
-        // and parked on unknown — there is no applied report to observe and
-        // no rejection signal to record.
         // (2026-09-18, H2 verdict-first) The verdict was decided exactly
         // once above; dispatch on it. landed bypasses the receipt poll
         // (the audit evidence already proved completion); an explicit
@@ -1942,21 +1952,12 @@ while (i < STEPS.length) {
             log("Publish build landed for task " + taskId + " — provenance stamp deferred to parent content verification");
           } else {
             // STEP 1b durable audit-dir fallback (2026-09-15, task aadeccc3):
-            // the poll above only observes IN-FLIGHT builds. A build that
-            // finished between the receipt capture and the poll's first check
-            // leaves no in-flight trace — but the platform's audit harness
-            // leaves a durable one (~/workspace/ts-spaces/<slug>/audits/
-            // <timestamp>-<id>/ per completed build). Diff the audit-dir
-            // listing against the pre-trigger snapshot: a timestamped dir
-            // that appeared during the attempt window is evidence a build
-            // completed. Attribution is by window, not by build identity:
-            // the poll's saw_stranger signal only catches stranger builds in
-            // flight AT a check — a stranger that finished entirely inside
-            // the window is indistinguishable, so any observed stranger
-            // blocks attribution and the outcome stays unknown. This never
-            // re-issues the edit and never stamps provenance — ok=true only
-            // routes to the parent's independent content read-back, which
-            // remains the real verification.
+            // the poll observes only in-flight builds; a build that finished
+            // inside the window leaves a durable audit dir. Diff the audit
+            // listing against the pre-trigger snapshot: a new timestamped dir
+            // is evidence a build completed. Attribution is by window, not by build identity: any
+            // observed stranger blocks it. Never re-issues, never stamps;
+            // ok=true routes to the parent's read-back (the verification).
             //
             // The poll end-state is read from the poll's own observations,
             // not from build_done alone: a build in flight at the last check