RHA is the verification backend: failure-triggered, bounded, tree-recursive repair over the artifact, guided by a standing taxonomy of mechanical AI bug classes and the frozen test corpus.
Sweep the whole artifact — deterministic detectors (imports, symbols, types, wiring contracts, stubs, env) plus the entire frozen suite. Every finding binds to a feature node through the ownership index (localization); same-class findings elsewhere in the tree ride into the repair context (generalization). Pick the upstream-most failing node — the smallest meaningful target, since healing it may clear everything downstream — and apply a bounded repair: the model may only return files that node owns, enforced deterministically, not by prompt discipline. Re-run the node's own check, then its dependents' checks, read from the forward dependency pointers. A failure surfacing at a dependent becomes its own error node and its own bounded repair: the recursion is bidirectional and moves through the software like a diagnostic tree.
Identical finding signatures, or a best-count that stops improving, mean the tries are correlated. Per the invocation doctrine, RHA then takes an entropy reset: fresh draws from the frozen contract alone — no broken code in context — across a temperature ladder, keeping whichever the verifier scores best. Still stuck, the node escalates: to the Supervisor if one is configured, then to the human, recorded in the ledger. Escalation never falls back to whole-artifact regeneration; no code path exists that can write outside one node's ownership boundary.
Budgets: max passes bound depth per node, max episodes bound sweeps across the tree; both are backstops — the stall detectors are the real control.