[swkeever]

Main's CI has failed since #400 (ctx.wait_for_callback) merged: in the full mutation run, Mutation module (volcano_sdk._durable_callback_token) reports timed_out: 2 for handed_off mutants 1 and 2. That fails the merge queue for every entry (#413 was removed with failed_checks).

Both mutants stop handed_off from refusing an awaitable. test_the_submitter_refuses_a_hand_off_that_returns_an_awaitable then fails at pytest.raises without closing the coroutine its hand-off created. Plain pytest still exits in about 4 s, but under mutmut's forked worker the run hits its CPU limit, so the kill is recorded as a timeout.

The test now records the coroutine's state, then closes it whether or not the refusal fired, and asserts on the recorded state. A missing refusal fails cleanly. No runtime code changes.

msgpack

This also carries the msgpack 1.2.4 lock bump from #413. pip-audit fails every PR's test jobs on msgpack 1.2.2 (CVE-2026-114613), and neither fix can merge alone: this test fix fails the audit, and the bump fails the queue's mutation run. msgpack is dev-only (pip-audit → cachecontrol), so this cuts no release.

Checks

• bash scripts/audit_dependencies.sh: no known vulnerabilities.

• MUTATION_MODULE=volcano_sdk._durable_callback_token poe mutation: before, timed_out: 1 locally (mutant 2); after, 68 killed, 62 type-checked, no failures.

• ruff format --check, ruff check, mypy on the test file.

• pytest src/volcano_sdk/_tests/test_durable_callback_token.py, tests/unit/test_test_integrity.py, tests/unit/test_quality_policy.py.

Full suite deferred to CI.

🤖 Generated with Claude Code

[github-actions]

AI review: no P0-P2 findings

Reviewed dd3b479. Run log

The PR rewrites test_the_submitter_refuses_a_hand_off_that_returns_an_awaitable so the test always closes the coroutine its hand-off created, even when the refusal never fires. It records the coroutine state before closing it, so the assertions check the same thing as before. It also bumps the dev-only msgpack lock entry from 1.2.2 to 1.2.4 to clear pip-audit. Risk is low: no runtime code changes, and the test still catches the handed_off mutants because pytest.raises fails when nothing is raised.

⚪ P3

• uv.lock:2 Lockfile format revision drops from 5 to 3 without explanation

Not checked: The AI review read the diff, the code, and the PR's text; it ran no tests or builds and read nothing outside this repository.

• Whether CI's uv sync --locked with the pinned uv 0.12.17 accepts the revision-3 lockfile.
• Whether the full mutation run for volcano_sdk._durable_callback_token now finishes with no timed-out mutants under mutmut's forked workers.
• Whether msgpack 1.2.4 clears the pip-audit advisory reported against 1.2.2.
• CI must confirm that the updated lockfile syncs successfully and the two handed_off mutants fail without timing out.

Human review: not needed

[github-actions]

⚪ P3: Lockfile format revision drops from 5 to 3 without explanation

The lock was regenerated with a uv that writes revision = 3, while main's lock (last rewritten by Dependabot's own, newer uv) is at revision = 5. The rest of the file is byte-identical, so nothing is lost. CI's pinned uv 0.12.17 should accept either. Still, the next Dependabot lock update will likely flip it back to 5, so expect churn in future diffs. Mention it in the description, or regenerate so the header stays at 5 if your local uv supports it.

_{Found by claude-opus-5-5}