fix: run exact publishers on current main

[brokemac79]

Summary

Repairs queued exact-review publication without reducing the queue's existing
parallel publisher capacity.

• Validate the immutable artifact against its producer SHA, but run the
  publisher from current main so repaired publication logic is used.
• Recognize legacy artifacts with no durable review-lease tuple and safely
  enqueue one fresh exact review instead of attempting a stale target mutation.
• Remove the exact publisher's second action-ledger state publication, which
  amplified shared clawsweeper-state contention after the actual review
  publication had already completed.

Incident evidence

This is deliberately not a claim that #592 was the original incident cause.

• openclaw/openclaw#107787's review run
  29408820027
  started at 2026-07-15T10:38:19Z, 26 seconds before feat: serialize exact review publication #592 merged at
  10:38:45Z. It created the full review comment at 10:46:50Z, then its
  publisher reported RoutableSyncPublishRaceError while committing the
  durable result. That prevented the deferred verdict router from applying the
  expected target labels. The comment is visible at
  #107787 comment 4979684095.
  This proves the shared-state publication failure predates feat: serialize exact review publication #592.
• feat: serialize exact review publication #592 separately split exact review generation from publishing and checked the
  publisher out at the artifact's historical source_sha. A queued artifact
  therefore runs code from before later publisher repairs. fix: forward exact review bundle commands #593 corrected the
  bundle-command spelling but did not change that historical checkout.
• fix: preserve exact review leases and requeue legacy artifacts #612 added the correct current-main behavior for legacy tuple-less artifacts:
  requeue a fresh review instead of applying an artifact that cannot prove the
  visible review lease. That behavior cannot help an artifact whose publisher
  is still executing a pre-fix: preserve exact review leases and requeue legacy artifacts #612 checkout. A representative failed publisher is
  run 29460181512
  for issue #574, which
  reported that the live durable tuple existed while its local report had no
  durable lease identity.
• The exact action ledger is observability data. Keeping it as a second
  best-effort state write makes the shared-state race worse; it is not required
  to publish the verdict or route labels.

Related: #592, #593, #610, #611, #612, #614.

Implementation and safety

The artifact validator still binds the producer SHA and target identity. Only
the implementation checkout changes to main. Legacy tuple-less artifacts do
not receive state/target publication credentials and do not mutate their target;
they dispatch one signed fresh exact review using the existing source-drift
route. Normal exact publication keeps its existing 24-slot capacity and broad
publication stays target-scoped.

This is an immediate repair for historical artifact execution and avoidable
state-write pressure. It does not claim to fully solve the older shared-state
race demonstrated by #107787. A separate bounded state-write critical-section
repair remains warranted.

Validation

pnpm run build:all
pnpm exec node --test --test-name-pattern 'exact event review hands immutable artifacts|publish workflow dispatches immediate apply|trusted comment router owns command ledger capacity retries|every action-ledger publication authenticates' test/sweep-workflow.test.ts test/clawsweeper-action-ledger.test.ts test/repair/command-ops-action-ledger.test.ts
pnpm exec node -e "const fs=require('node:fs'); const YAML=require('yaml'); YAML.parse(fs.readFileSync('.github/workflows/sweep.yml','utf8')); console.log('sweep.yml parsed')"
git diff --check
codex review --uncommitted
git fetch origin main --prune
codex review --base origin/main

Focused proof: 6 passing tests; TypeScript build and workflow YAML parse pass.
Both Codex review passes were clean. actionlint is not installed on this host.
The full workflow suite has five established native-Windows baseline failures
because WSL cannot execute /bin/bash; the touched tests pass and a Linux
Crabbox build completed.

Risk and rollout

This touches a GitHub Actions workflow, so GitHub App/OAuth workflow scope is
the deployment risk. Roll out by observing the next legacy and current exact
publisher runs: legacy artifacts should complete by requeueing once, while
normal artifacts should publish/routably defer without the extra ledger commit.
No bulk backlog replay is included.

[brokemac79]

@clawsweeper review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The item is closed; no stale verdict was published.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/29475479678
• Updated: 2026-07-16T06:03:15.906Z