[qa] dm_turn fallback masks a fully-dead DM beat as a 'resolved' turn with recycled prose

[100yenadmin]

Audit-confirmed. qa/ui_playtest.sh dm_turn is single-attempt and always writes a chatlog DM row via clawdnd_dm_narration_or_fallback — a beat where claude -p dies entirely 'resolves' with stale prior prose (+ filtered heartbeat), DM_TURNS increments, and assert_behavioral both_sides_acted counts inflate on exactly the broken runs. Fix in flight (heartbeat-repair PR): wrapper-aware fallback + fallback_recovered flag; follow-up: discount flagged rows in behavioral tallies.

[100yenadmin]

Engine-audit deep spec (SYN-01: F12-7 + F12-14 + F13-5)

What is broken

~10.5% of DM invocations (28 no-result + 3×401 of 294 Mac archive files; VM 18+5) produce no usable beat; each is a 100–300s player-visible wait for nothing — or for an auth error rendered as narration. Three interlocking defects:

• (a) a 401-class failure's error text appears in chat as DM prose ("Failed to authenticate…" as narration);
• (b) on play.sh a dead beat now (post-fix(qa+engine): make the beat heartbeat real — flip progress at ingest, decontaminate recap/FTS/lean-tail/fallback (#749) #763) yields an unflagged EMPTY dm row; on play_party (no heartbeat — F12-4) the fallback still recycles the PREVIOUS beat's prose into a row the client hides (engine_logged dedup → app.jsx drops it);
• (c) the fallback_recovered honesty stamp never lands in any QA runner — so this issue's planned gate discount ("discount flagged rows in behavioral tallies") is unimplementable until the overrides are deleted.

Why (root cause, file:line)

• 401 results carry non-empty result text (subtype:"success", is_error:true, api_error_status:401 — verified verbatim, 1164ms sample), so they bypass BOTH the empty-only retry (qa/run_duo.sh:176-190) and the empty-only fallback (qa/lib_beat_driver.sh:138).
• record_dm_reply accepts blank text (scripts/play.sh:437 / :501) → unflagged EMPTY chat row.
• F12-7: qa/run_duo.sh:135, qa/ui_playtest.sh:138, qa/run_party.sh:169 each redefine a 3-arg chatlog AFTER sourcing the lib — clawdnd_chatlog_dm's 3rd arg '{"fallback_recovered":true}' (lib:295) is silently discarded. ui_playtest.sh:181's comment claims the stamp lands — false in that runner. Consumer check: fallback_recovered appears ONLY in lib, tests, and comments; zero refs in qa/assert_behavioral.py or any qa/*.py → write-only even where it works.
• F12-14 (mechanism re-pinned at HEAD post-fix(qa+engine): make the beat heartbeat real — flip progress at ingest, decontaminate recap/FTS/lean-tail/fallback (#749) #763), per lane:
  • play.sh (heartbeat lane): both attempts die after the pre-beat heartbeat → fallback recovers NOTHING → DMSG="" → blank record_dm_reply → log_engine_narration returns 1 → unflagged EMPTY dm row; spinner flipped by the heartbeat, then nothing arrives. The recycled-prose mode is FIXED here; the zero-row mode is the live bug.
  • play_party (no heartbeat — F12-4): nothing breaks the recovery block → fallback recycles the previous beat's prose → record_dm_reply dedups it in the last-8 tail (lib:225-247 already=True) → engine_logged stamped → client DROPS the row (app.jsx engine_logged===true → null) — recycled-prose-invisible mode still live.
  • QA runners: recycled prose rendered as a normal dm row, unstamped (F12-7).
  • The viewer fix(reliability): recover a stalled-mid-stream DM beat — never lock the player out (#623 deeper layer) #746/fix(viewer): budget-aware stuck-backstop — stop false-firing 'stuck' on healthy slow turns (refs #745, follow-up to #746) #761 stuck-backstop does NOT compensate — the masked beat DELIVERS a (hidden/empty) chat row, so "nothing arrived" detection never fires.
• Test-gap mechanism (antipattern A14): test_heartbeat_repair.py:208-271 exercises the LIB chatlog; test_dm_session_remint.py:393-401 only source-greps "clawdnd_chatlog_dm" in src — cannot catch the override.

Evidence

Census re-run at HEAD: Mac archives at 294 files → 28 no-result + 3×401 ≈ 10.5%; VM sweep 18+5. 401 sample verified verbatim. Repo grep proves zero fallback_recovered consumers in gate code.

How to fix (the spec)

1. In the shared resolve path, parse the final result event FIRST — is_error/api_error_status ⇒ beat FAILED: never chat the error text, never fallback-recycle, surface "DM needs re-auth", count into the F13-4 beats_failed scores_db column; budget pre-check before launch.
2. Guard record_dm_reply against blank text (skip chatlog, warn). When FALLBACK_RECOVERED=1 AND the prose dedups as already-logged, emit a wrapper-authored visible failure beat through the engine + stamp {"beat_failed":true} (coordinate the failure-beat UX with [reliability][P0] Stalled-mid-stream DM beat locks the player out with no recovery (the v1.0.4-rc2 holdout) #745 — design it once for both). Preserve the genuine [playtest][CRITICAL] DM turn returns empty player-facing narration on engine-heavy beats #357 win (NEW prose logged then died — detectable via pre-beat log-tail snapshot).
3. Delete the 3 chatlog overrides (lib chatlog verified drop-in superset — reads ambient $CHAT at call time, byte-identical row with no 3rd arg) + add the assert_behavioral.py consumer (count + report; gate policy stays this issue's call).

Test strategy

• 401 fixture → beat recorded failed; chat row contains neither the error string nor recycled prose.
• Pre-beat log has P1 + both attempts die → visible failure row (not P1, not empty, not hidden), logged exactly once; DM logs NEW P2 then dies → P2 used and rendered.
• CLAWDND_FALLBACK_RECOVERED=1 + clawdnd_chatlog_dm present in each runner's function set → row carries the flag (all 3 runners FAIL today); per-runner red-first wrapper-shape test.

Scorecard impact

Gates: no_give_up + cross_persona_sat + behavioral-gate honesty (the discount this issue plans depends on leg 3).

—
effort: M (three S legs) · confidence: high · finding-ids: SYN-01 (F12-7, F12-14, F13-5) · depends_on: F12-4 (party lane converges to the empty-row mode after it lands)
Source: docs/audits/ENGINE-AUDIT-2026-06-11.md (PR #768), synthesis SYN-01 + units 12, 13.