[HouMinXi]

Base: main ef5ef54 (wave 1 merged as #346). Two commits: a format-only commit of tests/test_mutation_ledger_ci_controls.py (AST unchanged; CI lints every touched file), then the change. Full record: docs/gsd/future-direction/332-host-failure-classification/phase7-plan.md section 5 (owner decisions of 2026-11-01, what changed, deferrals, review status).

What changes

• W2-10. When the mutation-infra breaker stops right after a round settled preserved, that row and the earned window are kept. The breaker clears the settle after its own save, so a failed breaker save still demotes, as other failures after the settle in the same attempt do.
• W2-9. A later CI run() on a reused StateMachine drops the State the previous run used, as LOCAL already does; a State the caller assigns between runs is kept. Production builds one instance per review, so only the Python API can reach this. CI tests that staged history by reusing an instance now seed a copy. test_p7_reused_ci_instance_carries_its_state became ..._starts_from_an_empty_state.
• W2-8: inadmissible dict. Before, a reply the audit writer cannot encode wiped credit (gate error "audit payload unavailable"). Now, if that reply is its pass's single schema-failed response and the round is otherwise schema/coverage-only, the round records preserved with verdict FAIL, like a parsed schema-fail payload. Literal or I/O receipt damage still wipes. The C3 per-pass checks are shared (_c3_producer, _single_schema_failed_reply).
• W2-8: stall/diagnose. Stall and max-rounds ESCALATED exits write a report-only line, "credit kept by preserved round(s) at cycle(s) ...", just before the stall or ESCALATED category= line. It names only preserves that held clean rounds, and a demotion retracts it.
• W2-8: one INCOMPLETE reader. _l2_infra_observed is the single reader of the L2 INCOMPLETE cause; behaviour is unchanged.
• W2-8: test harness. 34 shared offline helpers moved to tests/_review_harness.py. The test functions are unchanged.
• W2-3. Test only: an acquisition failure beside literal receipt damage keeps the window.

Compatibility

No row field changes; older versions load these rows.

Verification

• Behaviour changes were checked red first: each new test fails on the previous code or under a targeted mutant. Mutant sweeps cover every check in the shared C3 seam.
• Full suite (4 shards) on the round-2 tree: the only failures are the 169 that also fail on the base in this container (credentials, git environment, root, gate evidence, doctor, dogfood, known four). The later delta was run on the touched modules only (1195 passed).
• Pinned ruff 0.17.3 check and format --check are clean on every touched file.

Review follow-up (completed 2026-11-01)

Reviewed head: 9bdb97cb8239d551345301c389c579036a61aa15; merge-base: ef5ef54. The original pending review status in plan section 5.3 records the pre-follow-up snapshot; this section supersedes that status.

• Six lenses covered; no new actionable findings. Security/correctness, code quality, redundancy/style and blast radius received a manual refresh. A fresh independent third general code review at max reasoning and a separate independent requirements/acceptance review at max reasoning both returned No findings over the complete 10-file diff. The four manual refreshes share one reviewer; they are not represented as four independent agent launches.
• Final CE validation/dedup completed. Official Compound Engineering 3.34.0 review-scope.py and findings-mechanics.py processed the six attested review outputs: zero retained findings, zero malformed returns/findings, and zero suppressed candidates. A fresh independent native validator replayed the helpers and checked the source, scope and evidence receipts. This was the scoped final-validation/dedup workflow, not a full CE review-spine rerun or an external cross-model review; the candidate batch was empty.
• Local validation: pinned Ruff 0.17.3 check/format and git diff --check pass. Format-only commit AST equivalence and all 34 extracted harness definitions were checked (only _survivor import order differs). 2,000 local tests passed. Another 232 offline tests (plus their teardown errors) were blocked by this container's protected /tmp/.git ancestor triggering the no-subprocess audit; a representative test fails identically on the exact merge-base. Those local cases are not claimed as passes.
• Exact-head GitHub CI is green: Linux tests, Lint, and CodeQL. Linux logs confirm the tested merge is 9bdb97c into current main 7851ee8: ownership/cancellation 568 passed, cgroup sandbox 32 passed, service-free suite 31,550 passed, 81 skipped, 68 deselected, 2 subtests passed, local process integration 11 passed, 7 deselected.
• A clean synthetic merge against 7851ee8 changes only the intended 10 files and preserves the main-branch Ruff cleanup. No code correction or new commit was needed for this follow-up.
• Still intentionally outside wave 2a: plan section 5.2's producer-side unavailable-cause recording (assigned to wave 2b) and the LOCAL note's current non-display in CLI output. Wave 2b (preserve_basis, per-row UNTRUSTED fingerprints, receipt source/channel and subtype labels) is being implemented separately; it is not included or accepted by this PR's results.

---

Generated by Claude Code

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →