[puretensor]

A consolidation response of [] for captures classified as commitments preserves those captures but returns success from the chunk handler. Their retry count never increases, so an oldest-first batch can select the same captures forever and prevent newer work from being processed.

Empty consolidation now enters the existing provider-failure path: bisect the batch, process healthy neighbours, charge isolated failures and quarantine after three attempts. Captures remain stored with processed=0. The failed parent consumes nothing, preventing double-counting of noise when child batches are reclassified.

Original-code evidence at a95a43b: cargo test -p ptask-distill empty_consolidation --locked produced two expected failures. A healthy neighbour was not processed, and a batch-size-one empty result retained zero attempts. Both tests now pass, including mixed noise, accurate consumption counts, three-attempt quarantine, later-queue progress and retained quarantined input. Severity: medium, with high confidence from deterministic mock-provider tests; no production provider was called.

Validation on Rust 1.98.1, all exit 0:

cargo test --workspace --locked
cargo clippy --workspace --all-targets --locked -- -D warnings
cargo build --workspace --locked
cargo test -p ptask-distill --features native-ml --locked
cargo clippy -p ptask-distill --all-targets --features native-ml --locked -- -D warnings
cargo fmt --all -- --check
cargo deny check advisories licenses sources
bash scripts/ci-version-check.sh
bash scripts/generated-artifacts.sh --check
bash scripts/ci-production-build-check.sh
actionlint
python3 -m unittest discover -s scripts/tests -v
PYTHONPATH=dashboard python3 -m unittest discover -s dashboard/tests -v
node --test dashboard/tests/face_unlock.test.mjs dashboard/tests/face_unlock_markup.test.mjs dashboard/tests/domains_markup.test.mjs
git diff --check
git diff origin/main -- . ':!Cargo.lock' | gitleaks stdin --redact --no-banner --log-level warn

Builds used a dedicated audit target directory and CPU fence; database tests used disposable stores.

Compatibility: zero-candidate responses remain parseable, but failed conversion of kept commitments is now retried and quarantined under the existing policy. An extended provider outage can quarantine otherwise valid captures; the existing operational guide documents inspection and recovery. No capture is deleted and no schema change is needed. Workspace, internal requirements, lockfile and manpage bump together to v3.30.7; no dependency upgrade. Independent branch from main at a95a43b, with no dependency on other audit PRs. Reconcile version stamps when landing multiple audit branches. No overlapping open work found. Remote CI runs separately; local results above were executed.

Additional validation limits

Native-feature tests include existing model-dependent cases that can return early when assets are unavailable; model-loaded coverage is not claimed. Local builds were debug workspace builds, not release or cross-target builds. Dependency-policy checks passed with pre-existing yanked chacha20 0.10.0 and unused BSD-2-Clause allowance warnings. The upstream-backed chacha20 correction is isolated in PR #102, not folded into this defect branch.