[Dong1017]

Preserve closed failure diagnostics

Refs #248; follow-up to #280. This five-file software-only correction preserves evidence for future failures without changing the paid execution policy.

• Retain fixed worker status/reason codes, bounded transport-invocation counts and outer executor status/return code/elapsed time from trusted result paths—even if controller summary writing stops.
• Preserve existing safe provider error categories before the edit agent generalizes failure. Allow only exact enums or bounded HTTP status codes; exclude arbitrary exception text, responses, headers, environment and commands.
• Distinguish a recorded zero transport invocations from missing/interrupted evidence (null). Neither consumed slots nor transport invocation counts establish HTTP delivery, billing or success.
• Keep unknown-usage stopping, no second arm after uncertain completion, full reservation retention and no retries/refunds. No admission, oracle, timing, shared qualifier or credential-scope changes.

This does not recover the first run's cause. Run 41159550621 retained one consumed A2 slot with unknown completion/usage; that does not prove per-request authorization succeeded or HTTP was sent. A3 did not start, and both grades are INCONCLUSIVE. The existing $162.72 reservation remains retained; actual billing is unknown. Its execution window has expired. This PR does not authorize or perform another paid attempt, alter that freeze, or replace original evidence.

Reviewed source and verification

Published head a8ab81ad30355f69a87ff4344dbb9bda3b2f313d preserves independently reviewed local commit 66a39a82da7743a0dafe35b825dc123635f1eb72, tree 48086800b28f04a4f5a98329f56a596cdc2ba88f. Current main is unchanged from the reviewed base: exactly five files, +214/-5. Changed worker/controller bytes intentionally cannot match the old frozen source identities.

• 196 affected offline tests passed, plus 20 worker tests after import-only cleanup; whole-tree Ruff and diff checks passed.
• Independent exact-commit review found no blocking findings and passed 34 focused offline tests.
• Controls cover real send_message with mock HTTP 401/429/5xx, invalid JSON, credential echo, network errors, arbitrary-text canaries, malformed/missing results and slot consumption followed by gate rejection with zero transport invocations.
• Packaging reads already generated files only. It cannot retry execution, settle costs or promote diagnostic availability to PASS.
• Current-head Ready run 41163947370 passed both Python 3.10/3.11 full checks, both installed-package checks and model-free task/actor qualification; its test-merge tree equals the reviewed tree above. Draft lint and declaration policy also passed. The earlier opened-event Ready run was superseded/cancelled when the draft became Ready, not counted as PASS.
• Native code review completed on this head with no findings or unresolved findings; native security review was not run. The independent scoped source review is separate. These software checks establish neither the first run's cause nor permission for another paid run.

Authorship

Actual implementation and independent review: Codex / gpt-6-astra / xhigh. The API publication wrapper preserves the locally tested source tree; source review, CI and operational authorization remain distinct.

{"schema_version":1,"head_sha":"a8ab81ad30355f69a87ff4344dbb9bda3b2f313d","human_only":false,"material_ai_authors":[{"tool":"Codex (closed KV failure diagnostics)","model_id":"gpt-6-astra","effort":"xhigh","role":"author"}]}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-31T03:21:41.480400Z	a8ab81a	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Dong1017]

Scoped software LGTM: no blocking source findings for head a8ab81ad30355f69a87ff4344dbb9bda3b2f313d, against main 3ece458ceaa92c5dad8d8e0b1e782a6961400b96.

I independently matched the remote tree 48086800b28f04a4f5a98329f56a596cdc2ba88f and all five changed blobs to previously reviewed local 66a39a82 (+214/-5). There is no new integration-code delta. My 34 focused offline tests on those identical bytes are reused, not represented as a new full-suite run.

The correction retains only closed reason/error codes, bounded transport-invocation counts and executor status/return code/elapsed time from fixed trusted files. Arbitrary exception/provider text is excluded. Recorded zero remains distinct from unavailable null; the gate-rejection control demonstrates that a consumed slot can coexist with zero transport invocations. Unknown usage still stops the next arm and retains the full reservation; no retry/refund, oracle, timing or credential-scope change is introduced. Packaging only reads existing outputs and cannot turn diagnostic availability into an experimental PASS.

CI remains pending: replacement Ready 41163947370 is pending at this read; superseded-run cancellations are not passes or source failures. Declarations and Draft checks passed. Native review is still running. This source conclusion does not replace applicable current-head CI; the existing author is monitoring it.

The first run's missing cause, delivery and billing remain unknown. These changed source identities deliberately do not satisfy the expired old freeze, and this review authorizes no new paid attempt. COMMENTED only: no formal approval, merge, model/hardware execution or ledger change.