Fail-and-Reroute — Failure You Never Hear About

The journey — a job fails, and you never hear about it

Primitive #2 of the ratified arc. Follow one dispatched job whose engine dies: today that death lands on the lead; after this, the system carries it.

1. What already exists. The sealed room now hands back a typed ending (primitive #1, merged tonight). Three handmade per-engine patches each answer “an engine failed its own way” — the grok nudge, the kimi budget mirror, the codex filter fence. And a proven seed: the sealed-or-reroute pattern that carries a failed codex brief to opus. Right instinct, wrong generality — one pair, hardcoded.
   ↘ go deeper

   Typed values: door-result.py project() → seven categories; routing reads the category ONLY, never reason/partial/prose. Standing laws carried in from retry-policy.sh: committed work never blind-retried; a timeout never retried at the same size. Prior art: this harness’s own Workflow tool — dead worker → null, filtered, pipeline continues.
2. The one idea: one mechanism above the doors. Dispatch → read the typed ending → if it’s a reroutable failure, pick the next fit engine from card facts, record why, dispatch again. Stop when fits are exhausted, a stop-word lands, or the budget is spent. You see exactly one of two things: a finished result, or one complete failure chain. Never a mid-flight death.
   ↘ go deeper — the split

   Two parts on the house line: a PURE decision module (projection + card facts + attempt history in → next-engine-or-stop + basis out, recomputable by any non-author) and a thin loop that invokes doors and writes the record. Lives as a wrapper the caller invokes — not inside doors (they emit facts, judge nothing), not a new dispatcher (the old one is fenced; a second routing truth is how it died).
3. What reroutes — and what never does. Engine death: yes — the canonical case. Timeout: yes, but only to an engine with strictly bigger ceilings (same-size retry is the banned blind retry). A refusal: only when card facts prove the next engine clears the fence — a refusal no fact explains means every engine would refuse, and it surfaces. Cancelled: never — an operator stopped it. Door-sick: never — rerouting through a broken door burns money and hides bay breakage.
4. Fit and the record. Candidates come from the caller’s list, defaulting to the failed card’s fallback chain. Every filter is a mechanical fact — safety facts fail closed, capability facts fail open. Every attempt writes one line: the engine, the ending, the decision, and the exact facts it read — so anyone can replay the decision and get the same answer. That file is deliberately the embryo of primitive #3.
   ↘ go deeper

   Record: staging/reroutes/<job>.jsonl + rerouted_from mirrored into the next attempt’s ledger row. Budgets: each fit at most once, attempt cap 3, wall ceiling 2× the single-attempt timeout (proposals, not measurements). The decision module joins the dangerous list — it gates spend.
5. Honest limits — and one broken chain, named. Reroute trusts the door’s word (that’s why every door gets its own court). Fit is only as current as the cards. And the flagship default chain is broken TODAY: codex’s card falls back to claude, and cardless native engines refuse every dispatch — a named debt from before this arc. Until those cards exist, the codex→claude reroute exercises the honest-exhaustion path, not the carry path. Non-goals fenced: no queues, no prediction, nothing settlement-side (dry dock), no cross-door rescue.

Decided — your four calls, ratified 2026-08-09

Your word: “I’m fine with your recommendations.” All four land as recommended: