raise cold sidecar query budget

[TheGreenCedar]

Outcome

Cold Agent-profile retrieval gets a bounded 1.5-second primary-query window. The packet-level deadline, stage order, cancellation, cache publication, and incomplete-result eligibility remain unchanged.

Closes #1039
Refs #998
Refs #918
Refs #1006
Refs #1063

Why

The live Windows proof in #1006 reached a healthy full Agent generation with verified Vulkan work, but representative cold primary queries exhausted the former 1,000 ms cap before the unchanged packet/drill seam could complete. Warm requests passed on the same generation, isolating the remaining gap to the primary request window.

What changed

• Raised the primary single-query default and cap from 1,000 ms to 1,500 ms.
• Preserved the existing reserve arithmetic, request deadline, cancellation traces, packet/search admission, ranker, and cache rules.
• Updated the changelog and the two documents that state the product query budget.
• Removed an intermediate CPU stats row and a test that replayed one machine's timing literals. The real Windows Vulkan cold proof remains the acceptance boundary.

How to review

1. Confirm sidecar_budget_ms still clamps explicit requests and now defaults/caps at 1,500 ms.
2. Confirm the executor's later-stage reserve arithmetic is unchanged.
3. Confirm existing tests still cover the cap, remaining-budget allocation, and fail-closed deadline behavior.
4. Treat external Windows Vulkan evidence as required; this source change does not substitute synthetic timings for hardware proof.

Verification

Current local head b81ef76:

• cargo fmt --all -- --check
• cargo test --locked -p codestory-runtime sidecar_budget_respects_latency_cap -- --nocapture
• cargo test --locked -p codestory-retrieval graph_stage_uses_remaining_total_budget_across_query_orders -- --nocapture
• cargo test --locked -p codestory-retrieval non_broad_stage_deadline_remains_blocking_after_later_stages -- --nocapture
• node .github/scripts/check-doc-links.mjs — 69 files, 281 links
• git diff --check
• Independent review: no P1/P2 findings

The branch still needs its final base refresh and exact-head hosted source proof after the Mac and runtime-identity lanes land.

Hardware acceptance

The Windows orchestrator owns the remaining external proof. It must use the exact final packaged windows-x64 artifact from an isolated cache and retain:

• provisioning, checksums, repair, and full status evidence;
• native Vulkan device, positive layer offload, verified meaningful work, and embed smoke;
• a successful first packet with eligible primary results and no stage_deadline;
• packet/drill parity from one packet execution;
• exact head, run, artifact, and archive identities;
• proof-owned cleanup with no remaining PID, port, container, or cache state.

The PR remains draft until that evidence passes. It does not claim a page-cache-cold benchmark, a new percentile baseline, or a release-ready Windows asset.

Risk

An uncached primary sidecar query may run up to 500 ms longer. The cap remains within the existing packet target and cannot extend work beyond the executor's hard request deadline.

[TheGreenCedar]

Review context

PR #1052 owns the bounded scheduler change for #1039: the supported Windows Agent path reached full verified Vulkan readiness but its first representative packet exhausted fixed stage deadlines. I independently reviewed exact head 129731604ddcd6e4e69e973e2cb2db86e2608469 against base 72c674e5484b9175214846be3dcc7333105d200b.

Review scope

• Inspected the primary-query cap, the extracted effective-stage budget helper, the two recorded cold sequences, fail-closed trace eligibility, documentation, and the explicit CPU-only statistics evidence.
• Confirmed the change raises only the single-query cap from 1,000 ms to 1,500 ms; packet batch limits, stage order, static reserves, cancellation, caching, and late/incomplete-result admission are unchanged.
• Confirmed the deterministic regression contains no sleeps and fails under the previous 1,000 ms cap for the motivating sequence.
• Confirmed the helper preserves the executor's existing reserve arithmetic rather than introducing a second scheduler.
• P1/P2 code findings: none.

Disposition

• Disposition: keep draft.
• Hosted merge condition: remaining exact-head macOS ARM workspace and Windows concurrency cells pass.
• Product acceptance condition: run the unchanged first-packet/parity seam on a supported external Windows x64 Vulkan host from an isolated cold Agent cache and retain the packaged archive SHA plus proof-owned cleanup evidence.

This review validates the code boundary. It does not turn the local CPU stats into Vulkan evidence, waive the external cold first-packet contract, or claim the disclosed 70.95-second retrieval-index warning is acceptable release performance.

[TheGreenCedar]

Base refresh completed on exact head 701fa87e43e3a6de0938784a85a92934a2a27af5.

The branch is rebased onto dev/codestory-next at 9c97808a7eb6604dae36b714f4d88c26885f9665; the conflict resolution preserves both #1051's freshness changelog/stats evidence and this lane's cold-stage evidence. The implementation diff remains bounded and the earlier no-P1/P2 review disposition still applies. Hosted checks are rerunning.

This PR intentionally remains draft: a real Windows x64 Vulkan cold first-packet/parity run is still required before readiness or merge.

[TheGreenCedar]

Windows orchestrator update

I am the Windows orchestrator for PR #1052's external Windows x64 Vulkan acceptance.

The PR is now at b81ef76d09a8333c5f3f46cb2483613dc6cf566e. That update inlines the existing scheduler reserve arithmetic and removes proof-shaped test/stats rows; it does not change the Windows native-process start-identity path that blocked the live run.

Windows evidence remains:

• Retained packaged head: 701fa87e43e3a6de0938784a85a92934a2a27af5 from workflow 29256237926.
• Windows x64 archive SHA-256: 58e560bb91c2e1b715c9b460ad14253131ee9f51e84e7865c4eaa11a058897e3.
• The managed llama.cpp server selected Vulkan0 on the AMD Radeon RX 7900 XT and logged 13/13 layers offloaded to the GPU.
• The original isolated run and a second bounded retry both failed before retrieval indexing or packet/drill execution with native embedding identity did not converge after spawn: live native embedding process start identity is unavailable.
• retrieval down cleared the retry sidecar state. No retry-owned process, container, or listener remains. The isolated cache still retains non-live broker/lease bookkeeping for the exited repair PID; that is not acceptance-grade cleanup and will be reconciled and rechecked in the fix proof.

The blocker now has a dedicated PR-sized owner in #1067. That lane will replace the Windows PowerShell/CIM exact start-identity read with OpenProcess/GetProcessTimes while preserving the persisted windows:<ticks> format and the existing fail-closed PID-reuse checks. It will land on dev/codestory-next; #1052 will then rebase and rerun an exact-head packaged cold parity proof.

Mac orchestrator handoff: the Windows failure does not invalidate the existing Mac evidence or require the Mac lane to stop. Please keep Mac proof and release claims separate. I will post a Windows closeout here with the fix SHA, rebased #1052 SHA, archive checksum, packet/drill result, and cleanup evidence.

Disposition: keep #1052 draft. This update proves neither packet/drill parity nor acceptance of the current head.

[TheGreenCedar]

Windows orchestrator update

I am the Windows orchestrator for PR #1052's external Windows x64 Vulkan acceptance.

The dedicated fix lane is now draft PR #1070 at exact head 6d3e3e2e5a319021fbd57a3579e4b7f6cae342bc. Its exact-head source proof passed, and both Windows x64 and Windows ARM64 package cells completed successfully in platform run 29281875582. I downloaded the exact Windows x64 archive and verified SHA-256 662ed6f80f3025e475320c3a25affdd1157158d8549c29f2a757f4c34f030dd2.

The fresh isolated live retry still failed with native embedding identity did not converge after spawn: live native embedding process start identity is unavailable. The new native exact start-identity query did succeed immediately. The remaining failure is the later CIM snapshot's approximate start-time conversion: this host returns Win32_Process.CreationDate as System.DateTime, while the script passes it to the DMTF converter and receives no StartedAtEpochMs.

The retry again proved the AMD Radeon RX 7900 XT Vulkan path with 13/13 layers offloaded, but it stopped before retrieval reached full or packet/drill execution. Cleanup is proof-scoped and complete: no proof-owned process, container, listener, sidecar state, or active broker record remains; unrelated resources were left untouched.

PR #1070 remains draft while its minimal fix is adapted to source the Windows snapshot's approximate start time from native GetProcessTimes, retaining CIM only for executable and arguments. After a new exact head passes independent review, source proof, Windows package proof, and an isolated packaged live proof, #1052 can rebase in that order and rerun its unchanged-generation packet/drill parity acceptance.

Mac-orchestrator handoff: the existing Mac evidence remains valid and independent. Windows will update #1052 again after the revised fix merges and #1052 is rebased; no Mac rerun is implied by this Windows-only blocker.

[TheGreenCedar]

Windows orchestrator update

I am the Windows orchestrator for PR #1052's external Windows x64 Vulkan acceptance.

The Windows identity fix is merged into dev/codestory-next in two commits:

• 6f3f8a23a85033599c674c8e402b0254fc2f752f from [codex] make windows native embedding start identity reliable #1070
• e5477a1f41ba231c847ce472c2b090631adaa779 from [codex] use native process time for windows embedding snapshot #1072

PR #1052 was rebased directly onto those commits and force-updated to exact head c24a7972542e87086c0f28999fc67687474ba920. The rebased product diff is only the bounded primary sidecar budget change from 1.0 to 1.5 seconds plus its changelog/docs updates. Focused scheduler/deadline tests, format, docs links, and diff checks passed.

A fresh isolated Windows x64 run of the exact release-built CLI (SHA-256 b9552eaaf7a3935ba1386725040c939a95e088f6b4bfcc13f16b0a830a10871f) reached:

• agent_packet_search=ready
• retrieval_mode=full
• gpu_proof=verified
• AMD Radeon RX 7900 XT on Vulkan0, CPU fallback disabled
• embed smoke 13 ms
• managed PID 45700, start identity windows:639195741748528190
• generation repo-v1-670ad7db4da1546b-e98fa387f635b50b

The packet/drill parity wrapper then stopped before packet execution because packet admission rejected that same verified proof as not matching the selected runtime. This is the already-separated runtime-identity migration seam, not a scheduler deadline failure; no stage_deadline packet result was produced. Per owner direction, I am not opening or implementing another side lane here.

Mac-orchestrator handoff: the existing Mac evidence remains independent and unchanged. Windows proof-owned cleanup follows merge; no Mac rerun is requested.

[TheGreenCedar]

Windows orchestrator closeout

PR #1052 is merged into dev/codestory-next as a92c4308993fc223b6c0ee333db621fc5ef9b1e3; issue #1039 is closed. The merged ancestry includes Windows identity fixes 6f3f8a23a85033599c674c8e402b0254fc2f752f and e5477a1f41ba231c847ce472c2b090631adaa779.

Final Windows truth remains as recorded above: exact head c24a7972542e87086c0f28999fc67687474ba920 reached fresh/full retrieval with verified RX 7900 XT Vulkan proof, while packet/drill parity was blocked before packet execution by the separate verified-proof/runtime-identity admission mismatch. This is not recorded as a parity pass.

Cleanup is complete: proof PIDs 53652 and 45700 are dead; proof-owned container and listener counts are zero; all three isolated proof cache directories were removed; remote PR branches were already deleted. Mac evidence remains independent and no Mac rerun is requested.