The validation shape: the author's preferred design deserved to ship — after the panel killed the pre-flight probe as capacity self-denial and hardened the survivor into an operating contract.
A Thursday patch for an ambient clinical-note product after one managed-LLM stream hung until a 15-minute watchdog kill, leaving no clinical_notes row and a provider-facing "Note pending..." state forever. Proposed directions: progressive per-encounter transparency (A), a per-request pre-flight model probe and circuit breaker (B), one task per encounter with an 8-minute hard stop (C), and durable pre-attempt state with poison classification (D). The author's preferred shape was D+C+A; the review tested whether it deserved to ship under deadline.
The attempt/lease and clinical_notes(note_status='generating') row must commit before the LLM call, never remain inside a transaction held open during inference. A watchdog kill then leaves recoverable intent instead of a silent hole.
A 50-token call per real request consumes scarce provider and worker capacity precisely during a 9am throttle event. The panel killed it unanimously and replaced it with passive fleet-health detection.
Once one-task-per-message was established as a one-day templating change, both cautious panelists moved to full encounter isolation. Shared IAM, logs, and network policy mean it does not materially narrow the HIPAA authorization footprint.
A late model completion must never overwrite a clinician's finished note. Lease epoch/generation fencing and a terminal manual_charting transition make the human chart win the race.
The shape-level n=2 circuit was withdrawn. The shipped rule fingerprints the exact request, requires repeated failures while the broader fleet is healthy, and quarantines retry budget — not the encounter's clinical content.
One canonical note row catches competing inserts; the epoch gate rejects stale publication after ownership changes. Neither replaces the other.
Reaper storms, task-launch pressure, heartbeat hot rows, clinician-status churn, manual-scribe queue overload, and audit-log throttling all need hysteresis, idempotent launch, and operational limits.
Durable pre-attempt state, per-encounter isolation, actionable clinician status, and fenced publication ship together; active probes do not.
Conditional GO for the patch: the author's D+C+A shape ships hardened; the pre-flight probe is dead; three preserved thresholds are recorded as boundaries, not settled.
Condition: The stalling-endpoint test is a hard release gate; durable pre-attempt state, per-encounter isolation, clinician status, and fenced publication ship together — active probes do not.
GPT-5.6 Sol: An encounter is never intrinsically poisonous from two failures; quarantine is a bounded retry decision, not a content judgment.
Grok 4.5: The stalling-endpoint test is a hard release gate rather than optional follow-up.
Muse Spark 1.1: Shape-based detection stays disabled until at least ten comparable events plus a health gate can support it.