fix(kanban): malformed recorded landed receipt HOLDs on reclamation (t_ad32cdab)

[Kyzcreig]

Argus r4 on #924 (P10, P12a-c): a malformed persisted kind: landed receipt made reclamation raise TypeError/KeyError out of preserve() and remove_workspace_dir(). The workspace was kept, but no held_reason and no workspace_held event were written, so the card's recovery state was silent.

Reproduced on main 67202e8 with the Argus probe: P10 (refs=null) TypeError; P12a (landed=null) TypeError; P12b (no sha) KeyError; P12c (['junk']) TypeError. After the fix all four HOLD. Each writes a persisted reason and a workspace_held event. P11/P4/P7 controls unchanged. P12d (refs=null with no missing repo) still reclaims correctly, because the live landed commits are re-verified.

Changes (hermes_cli/kanban_survivor.py):

• _recorded_landed_claims() checks the recorded receipt shape. A bad shape raises a named SurvivorUnavailable reason.
• _recorded_refs(): a non-list refs vouches for nothing, which gives the ordinary 'recorded repository missing' HOLD.
• Backstop in preserve(): TypeError/KeyError/AttributeError/IndexError from any unchecked persisted shape now HOLDs with a persisted reason. The traceback is logged.

Tests (tests/hermes_cli/test_kanban_survivor_malformed_receipt.py): 7 malformed shapes, each through remove_workspace_dir and kb.safe_remove_workspace_dir, HOLD with a reason and an event. The valid receipt still reclaims through both. The backstop is tested with 4 exception types. On the pre-fix module 18/20 fail; the 2 valid-receipt controls pass. Locally, landed + live_tree + new file: 71 passed.

Hotspot: #1018 (t_60592755) also edits preserve(). Its hunk inserts above landed = ...; this PR changes the lines below it. They don't overlap, but merge order matters.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[Kyzcreig]

🤖 merged-by: apollo · lane: kanban-merge-pass · gate: BYPASS: FleetReview paused by Ace 2026-09-22 (state/fleetreview-pause marker present) · why: t_ad32cdab: kanban survivor: malformed recorded landed receipt must persist a HOLD on reclam; Argus off card review (Ace 13:08), CI green

[ang-prism]

FleetReview

Review: post-merge · head c0c2d2b7a1e3 · duration 4m 43s
Profile: light (merit: default light: lines 228<800, files 2<1000000, hunks 5<1000000, no hot path) · policy: below-size-and-path-gates
Roster: B-assert-ctx → gpt-6-sol (openai), B-state → gpt-6-sol (openai), F → gpt-6-sol (openai), G → grok-4.6 (xai)

Post-merge review (fleetreview:post-merge override): this reviewed the merge commit against its first parent — the bytes that already shipped. It is not a pre-merge gate pass.

profile: light (rule: default light: lines 228<800, files 2<1000000, hunks 5<1000000, no hot path) · round 0 · members: B-assert-ctx, B-state, F, G · families: openai,xai

Confidence: 3/5

Findings

• P1 hermes_cli/kanban_survivor.py:2530 — Malformed survivor state can still bypass the new HOLD backstop · agreed: F (openai)

---

FleetReview provenance · models: B=gpt-6-sol, D=grok-4.6, F=gpt-6-sol · cost: $0.45 · duration: 4m 38s · rounds: 1 · files examined: 2