[HarperZ9]

The remaining findings of the independent review of the 2.0.0 fixes (B1 merged as #472). Each fix has a test that fails on the unfixed tree.

Finding	What changed	Test
D2	A ledger whose writes fail after start (a full disk) is marked failed at the first failed append. Later model calls answer 503 ledger_unavailable before any upstream call. When writes resume the gateway appends a ledger_gap entry and verify passes; a line left cut short is recorded as a break in a new segment. New module harness/gateway_ledger_health.py.	tests/test_gateway_ledger_write_failure.py
A1	verify reads the head record before the segments, so a busy, intact ledger verifies.	tests/test_gateway_ledger_live_verify.py, forced order and a writer thread
N2	Files named like a segment that are not one are ignored and named by verify and the start line.	same file
A2	The second read of a key's row and its admission are one step under one lock, which a call that ends takes too.	tests/test_gateway_admission_lock.py, forced pause, both orders
D1	An unfinished stream's prompt and received text are charged at least a quarter of their characters, rounded up, marked estimated.	same file, real sockets
D3	The fallback to the text protocol starts only on an error that says tools or function calling are unsupported. The session prints one notice and records native_tools_fallback. New module harness/endpoints_tools_fallback.py.	tests/test_code_session_native_fallback_trigger.py
N1	The Lean scan resolves aliases and covers more spawn APIs and an env= that is not exactly lean_env(...). tests/lean_spawn_scan.py states what it cannot see.	tests/test_lean_child_env.py
N3	One deadline for the request line and headers and one for a request body, on every route, before authentication; two seconds for the drain after a refusal.	tests/test_gateway_round3_small_fixes.py
N4	KNOWN-LIMITS names /v1/embeddings among the routes outside the ledger.	docs
N5	gateway-ledger show cuts a field at 80 characters; --full prints it whole.	tests/test_gateway_round3_small_fixes.py

What is stated, not fixed

• Every model interface appends its ledger entry after the provider answered, because the entry holds the reply's hash. The one call that meets a write failure has reached the provider. A plain reply is held back (500); a stream's text has left.
• D3: the Claude API errors page, the OpenAI error-codes guide and the Gemini troubleshooting page (read 2026-11-14) give no exact sentence for "this model cannot take tools". The accepted phrases come from two documented Claude API forms and from error texts quoted in public issue reports, which were not checked against a live host. KNOWN-LIMITS has the row, and the module and the test header cite the pages.
• A2: two calls in flight at the same time keep the documented margin (each reserves its output limit and a quarter of its request bytes). What is closed is admission on a total that another call finished and changed during a pause. The reviewer's forced-interleave probe still prints two served calls and 920 tokens against this branch: its second request now waits for the first one's admission and the two then run together, and the stub's reported input (451 tokens) is larger than the reservation. The test here uses requests whose reservation equals the limit, where the second is refused 429.
• D2: a gateway that stops while its ledger is still failing, with the disk still full, leaves no ledger_gap entry; the log has the failure.
• N3: no cap on open connections.

Found by a second read of this branch

Before the merge another agent read this branch with the code and the intended properties in hand, not my conclusions. It is not an independent review: I started it and I judged its findings. Six of them held up against the code and are fixed here, each with a test that fails when the change is reverted:

• After a refusal that did not read the body (a 401, for one) the gateway discards what the client still sends. That was a buffered read of the promised length, so a client with no credential that sent a byte at a time held its thread for as long as it kept sending. The connection's reader now gives one read(n) a budget: two seconds in that drain, four read timeouts for a body. The body deadline therefore covers every route. gateway_body_drain.py is pinned and unchanged. Checked with plain sockets on Windows and on Linux (WSL): closed at 2.1 and 2.0 s.
• Whether a reply is held to the native rule was decided when the reply arrived, from the process-wide list of models that moved to the text protocol. Sessions in one process share that list, so a model moved by one session while another's reply was on its way made that reply a text-protocol reply, where a prose TOOL line runs. The decision is now what the request carried.
• The segment name pattern used \d, which matches digits of other scripts. ASCII digits only.
• A head record that could not be rewritten after an entry was written did not mark the ledger failed. It does now.
• The fallback wording matched errors about tool_choice, parallel tool calls and tools with images. It is tighter.
• The loop runs the calls as parsed from the record, so the executor shares no argument object with the remembered native reply.

Not changed: a resume whose new segment cannot be removed after a failed start stays failed until a restart (it fails closed); a failed debit for an unfinished stream does not suspend the key (as before this branch); the admission lock is held during the key store read.

Corrected wording

CHANGELOG: "could not open or write its ledger" (the earlier fix covered open only), the sentence on the second read of verify, and "the other ways to start a child". KNOWN-LIMITS: the word-estimate row, the read-timeout row, the first row ("a key holder" was narrower than the fact), and the intro, which now says the reviewer's probes were run again and that these fixes have had no further independent review.

Evidence

• On the unfixed tree (release head 7b7803c6f) the new test files, plus the new scan forms run through the old scan: 81 failed, 6 passed. The six that pass there are controls.
• Each change to the gateway and the session was reverted alone in a scratch copy of this branch (20 reversions; B1's three parts and the five follow-ups above included) and its tests then failed. The first pass found one gap: the A2 test of that moment did not notice two separate locks. The test for a call that ends inside the pause closes it, and that reversion fails now.
• Deadlines (N3) were also checked with plain sockets on Windows and on Linux (WSL): a client that drips header lines, or bytes inside one header line, is closed at about 0.6 s with a 0.5 s timeout, and a dripped body gets 408 at 2.0 s.
• The new gate files pass against a wheel built from this branch, run from a copy of tests/ with no harness/ beside it.
• One existing control changes with D1: the output estimate of its unfinished stream is 9 (a quarter of the received characters) where the word count is 5.
• Constraints kept: gateway_ledger.py 295 lines, no file over 300, no function over 50; gateway.py, gateway_body_drain.py and local_loop.py untouched in this PR. An unimportable gateway_ledger_health yields zero upstream requests (tested).

Not run: any hosted provider, a real full disk (the failure is simulated at the segment's file), macOS. Local runs were targeted slices on Windows; the rest is left to CI.

🤖 Generated with Claude Code