Function phase_failure_ceiling_reached 

pub fn phase_failure_ceiling_reached(phase_validate_failures: u32) -> bool

Whether the per-phase Validate-failure total has reached MAX_PHASE_VALIDATE_FAILURES (999.78, F-6).

Why this exists as a named predicate rather than an inline comparison. Mode::should_gate’s Stage::Validate arm returns true unconditionally in Mode::Supervise, so in that mode the ceiling condition and the ordinary-gate condition overlap completely and “a gate fired” carries no information about WHY. Two sites need that distinction and cannot get it from should_gate’s boolean:

• the Validate gate message, whose ceiling clause must appear only at the ceiling — keyed on gating instead, it would appear on every Supervise message and mean nothing;
• the reset of crate::state::State::phase_validate_failures on operator approval, which keyed on gating would clear the total at every Supervise failure so it could never accumulate at all — an unbounded loop wearing a gate on every cycle.

This is the SINGLE implementation of the comparison. No caller may re-derive it: a second copy is exactly the drift hazard that made should_gate take the total as a parameter instead of checking it at the call site, and it must not reappear in a new form here.