diff --git a/deploy/vm101/n8n-pi-wrap b/deploy/vm101/n8n-pi-wrap
index e35875d..43c7099 100755
--- a/deploy/vm101/n8n-pi-wrap
+++ b/deploy/vm101/n8n-pi-wrap
@@ -79,7 +79,45 @@ case "$cmd" in
    # MECHANICAL step: validate manifest -> index/log/scoped-lint/commit/PR -> 1 JSON line
    exec "${HOME}/.pi/agent/skills/ingest/scripts/run-ingest.sh" "${genome}"
    ;;
- "pi changed-raw "*)
+  "pi ingest-rework "*)
+    # args: <genome> <raw_path> <feedback_base64>  (3 token).
+    # Feedback in base64 nell'argv: il nodo SSH di n8n non passa stdin, e cosi' i metacaratteri
+    # della review (apici, newline, $(...)) sono neutralizzati.
+    args="${cmd#pi ingest-rework }"
+    genome="${args%% *}"; tmp="${args#* }"
+    raw_path="${tmp%% *}"; fb_b64="${tmp#* }"
+    if [ "$genome" = "$args" ] || [ "$raw_path" = "$tmp" ] || [ -z "$fb_b64" ]; then
+      echo '{"status":"error","reason":"usage: pi ingest-rework <genome> <raw_path> <feedback_b64>"}'; exit 1
+    fi
+    case "$genome"   in ""|*[!a-z0-9-]*)     echo '{"status":"error","reason":"invalid genome"}'; exit 1;; esac
+    case "$raw_path" in raw/*) : ;; *)       echo '{"status":"error","reason":"raw_path must be under raw/"}'; exit 1;; esac
+    case "$raw_path" in *..*|*//*)           echo '{"status":"error","reason":"raw_path traversal"}'; exit 1;; esac
+    case "$raw_path" in *[!A-Za-z0-9._/-]*)  echo '{"status":"error","reason":"raw_path illegal chars"}'; exit 1;; esac
+    case "$fb_b64"   in *[!A-Za-z0-9+/=]*)   echo '{"status":"error","reason":"feedback not base64"}'; exit 1;; esac
+
+    logger -t n8n-pi-wrap "ok: pi ingest-rework ${genome} ${raw_path}"
+    feedback="$(printf '%s' "$fb_b64" | base64 -d 2>/dev/null || true)"
+
+    # lock per-genoma: serializza con gli ingest normali
+    exec 9>"/run/lock/kg-ingest-${genome}.lock" 2>/dev/null || exec 9>"/tmp/kg-ingest-${genome}.lock"
+    if ! flock -n 9; then
+      echo '{"status":"busy","reason":"another ingest is running for this genome","genome":"'"$genome"'"}'; exit 0
+    fi
+    set -a; . "${HOME}/.config/knowledge-genome.env"; set +a
+    cd "${GENOMES_ROOT}/${genome}" || { echo '{"status":"error","reason":"unknown genome"}'; exit 1; }
+    [ -f "$raw_path" ] || { echo '{"status":"error","reason":"raw file not found"}'; exit 1; }
+    : "${KG_LIB_DIR:=${HOME}/knowledge-genome-orchestrator/lib}"
+    source "${KG_LIB_DIR}/clean-start.sh" 2>/dev/null \
+      || { echo '{"status":"error","reason":"clean-start.sh not found"}'; exit 1; }
+    clean_start || { echo '{"status":"error","reason":"clean-start failed"}'; exit 1; }
+    log="$(mktemp -t pi-rework.XXXXXX.log)"
+    INGEST_FEEDBACK="$feedback" \
+      "${HOME}/.pi/agent/skills/ingest/scripts/ingest-semantic.py" "${genome}" "${raw_path}" \
+        >"$log" 2>&1 \
+      || { echo "{\"status\":\"error\",\"stage\":\"semantic\",\"reason\":\"rework failed\",\"log\":\"${log}\"}"; exit 1; }
+    exec "${HOME}/.pi/agent/skills/ingest/scripts/run-ingest.sh" "${genome}"
+    ;;
+  "pi changed-raw "*)
    # List raw/ files changed between two commits, one per line (the webhook payload
    # does NOT include file lists, so vm101's checkout computes the diff itself).
    rest="${cmd#pi changed-raw }"