immuneHits / savedRevenue count non-repair capsules (hold_and_notify, nonRepairable)

[adrianhihi]

Summary

PcecEngine.repair() increments stats.immuneHits and stats.savedRevenue,
and records immune: true in the audit log, for any existing gene with
qValue > 0.3 (pcec.ts, gene-map lookup branch). That gate does not
distinguish strategies that complete the original call from strategies that
halt it — hold_and_notify and capsules marked nonRepairable: true
(e.g. insufficient-funds) satisfy qValue > 0.3 and are therefore counted as
immune "successes" with attributed savedRevenue.

Why this is incorrect

immuneHits / savedRevenue are intended to measure repairs that completed the
intended operation. A capsule that correctly halts (and does not complete the
call) is a different outcome and should not be tallied as a completed repair.
observe-mode capsules have the same property (they record/advise, they do not
repair).

Fix direction

Exclude nonRepairable genes and observe-mode capsules from immuneHits /
savedRevenue, or split the counters into repairHits (completed the call) vs
haltHits (correctly stopped). Audit log already has the data to backfill the
distinction (strategy, nonRepairable).

Refs

• packages/core/KNOWN_ISSUES.md KI-2
• Surfaced during the 2.8.1 detection-vs-repair audit.

Target milestone: 2.8.2 or 2.9.0. Suggested label: honesty-debt.