fix(receipts): three bookkeeping paths that swallowed failure with pass

All three wrap a receipt/delivery-note call in 'except Exception: pass' with
a comment saying bookkeeping must never break the real work. That part was
right — the search still returns, the reply still goes out, the tool result
still stands.

'pass' is the part that was not. A receipt path broken for weeks looked
exactly like one that never needed to fire, on the live chat route, the
reply-delivery note, and the dev-mode tool receipt.

Each now records a degradation and returns exactly what it returned before,
opting out of the fail-closed policy: a receipt recorder throwing is a
degraded bookkeeping lane, not a reason to fail a delivered reply.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: codex

core/transparency/dev_mode.py

@@ -195,8 +195,16 @@ async def complete_tool_execution(self, trace: ToolExecutionTrace,
                 from core.conversation.surface_disposition import record_tool_receipt
 
                 record_tool_receipt(trace.tool_name, ok=bool(result.get("ok", False)))
-            except Exception:  # never let bookkeeping break a tool result
-                pass
+            except Exception as exc:  # never let bookkeeping break a tool result
+                # The tool result stands. A receipt recorder that throws on
+                # every call is a real fault, and `pass` was hiding it.
+                record_degradation(
+                    "transparency_dev_mode",
+                    exc,
+                    severity="warning",
+                    action="returned the tool result after receipt bookkeeping failed",
+                    enforce_failure_policy=False,
+                )
 
         if self.level != TransparencyLevel.SILENT:
             if deferred:

interface/routes/chat.py

@@ -10074,6 +10074,7 @@ def _complete_repairable_truncated_reply(user_message: Any, reply_text: Any) ->
     _log_response_quality_metrics,
     _reply_assessment_requires_repair,
 )
+from core.runtime.errors import record_degradation
 
 # ── Conversation Lane Helpers ─────────────────────────────────
 
@@ -16762,8 +16763,17 @@ async def _collect_desktop_required_search_evidence(
         from core.conversation.surface_disposition import record_tool_receipt
 
         record_tool_receipt("web_search", ok=bool(result.get("ok")))
-    except Exception:  # bookkeeping must never break a collected search
-        pass
+    except Exception as exc:  # bookkeeping must never break a collected search
+        # `pass` here meant a receipt path broken forever looked exactly like
+        # one that never needed to fire. The search still returns; the
+        # bookkeeping failure is now on the record.
+        record_degradation(
+            "chat_routes",
+            exc,
+            severity="warning",
+            action="returned the collected search after tool-receipt bookkeeping failed",
+            enforce_failure_policy=False,
+        )
 
     return {
         "ok": bool(result.get("ok")),

interface/routes/chat_quality.py

@@ -63,8 +63,17 @@ def _log_response_quality_metrics(
         from core.conversation.surface_delivery import note_route_delivered
 
         note_route_delivered(reply_text)
-    except Exception:  # bookkeeping must never break a delivered reply
-        pass
+    except Exception as exc:  # bookkeeping must never break a delivered reply
+        # The reply still goes out. A delivery-note path that has been broken
+        # for weeks should not be indistinguishable from one that simply had
+        # nothing to note.
+        record_degradation(
+            "chat_quality",
+            exc,
+            severity="warning",
+            action="delivered the reply after route-delivery bookkeeping failed",
+            enforce_failure_policy=False,
+        )
 
     try:
         assessment_reasons: tuple[str, ...] = ()