[TS PBT] Align experiment and campaign-file deadline origins #613

Problem observed in the frozen measurements

The public experiment caller and campaign-file start different timers from the same full relative allocation. This leaves no explicit allocation for JVM startup and final artifact publication inside the caller's cutoff.

In pbt_experiment.py, run_cell starts its monotonic total timer, computes B = total - charged preparation - class replay reserve, and places the full B into configuration.timeoutMillis before source/runtime checks and request serialization. The process guard later receives the remaining time until that earlier cutoff. campaign-file starts PropertyCampaignRunner, which creates a fresh WitnessReplayDeadline(B) only after JVM/CLI startup and request decoding. Native completed-input validation can consume that inner deadline; encoding, stdout and file publication happen afterward.

Concrete observed allocations in the frozen 30-second pilot:

• Mailbox / seed 16061113 / PBT_ONLY: request 19702 ms, measured runner process 19600 ms, external timeout and no artifact.
• DoublyLinkedList narrow: request 19786 ms; all 12 four-mode/seed cells reached the outer guard after about19464-19514 ms, with no artifact. Symbolic cells contain final machine statistics, but no log records the subsequent stage.
• SinglyLinkedList / seed 16061029 / SYMBOLIC_ONLY provides a distinct retained outcome: exit 2 with a saved TIMEOUT result and 93 explicitly unchecked native inputs.

The recorded request-minus-process-duration difference is not a fixed 100 ms subtraction: the exact guard timeout and phase starts were not recorded. It includes elapsed prelaunch work and termination effects. The saved Singly wide JSON prefix separately proves stdout-before-file data loss; that narrow publication defect does not explain every absent artifact.

Acceptance for a focused follow-up to #354:

• Carry the caller's actual remaining cutoff through JVM startup/CLI setup instead of granting a fresh full B afterward.
• Reserve explicit time for result encoding/publication/return inside the existing total allocation; preserve the declared class-replay reserve.
• Record effective allocation, timer origins and available phase timing so a missing file can be distinguished from an explicitly returned incomplete campaign.
• Verify a delayed-start scenario and output/serialization boundary without rerunning the scientific pilot or changing its frozen evidence.
• Keep late, unknown, unsupported, incomplete-native and missing results explicit; do not grant primary credit to killed processes.

This issue does not assert that DoublyLinkedList hangs in user code. Static inspection of the frozen wrapper finds only 3 operation steps, list size at most 6 and index at most 5; pointer-following reverse/toArray loops are not called. Its exact stage at outer termination remains unknown. No selector change is implicated.

Published implementation and post-measurement validation (2026-10-17)

The focused implementation is published in two open PRs, not merged main:

• [TS PBT] Honor caller cutoff in campaign-file #615 at 696e5e9946bb94c94339a1f4d45c6e0860c53736, based on [TS PBT] Save campaign artifacts before stdout publication #614: optional caller epoch cutoff and an explicit publication reserve are converted once to the existing monotonic campaign deadline. The original configuration, property and allocation controls stay unchanged. Expired startup returns a typed DEADLINE at PREPARATION before source capture/backend preparation. Existing public callers retain their default API/timing behavior; file-before-stdout publication is retained.
• Preserve the experiment caller deadline through campaign startup #616 at 560b23d494509d726be2a6347e948b45e7dbf1aa, based on the minimal public experiment Run frozen public PBT comparisons with checked class coverage #586 and requiring [TS PBT] Honor caller cutoff in campaign-file #615: the caller supplies its original fixed cutoff, charges Popen before waiting, uses the same total deadline for native class batches, and converts wall time before monotonic time conservatively so clock-read delay cannot extend the cutoff. The eight-second class reserve is deducted once; the 1000 ms publication reserve remains inside the runner cutoff. Timely exit 0 and a timely exit 1 with a confirmed original fault are valid; exit 2, kills, late artifacts and invalid native JSON cannot receive primary coverage credit.

The CLI change passed 21 focused tests and strict Detekt. The caller change passed 15 Python tests, including a delayed-clock-read regression. Independent read-only review found no remaining P1/P2 defect in either final diff or the composed runner header/default/relation-guidance path. Both #615 and #616 now have all seven CI checks successful at the exact heads above, verified from a fresh GitHub snapshot on 2026-10-17T02:07:52.458193+00:00.

One separate functional check; frozen scientific results unchanged

One isolated joint assembly d6564365fc48edd43f81713421c110adbd358334 ran the predeclared SinglyLinkedList-wide SYMBOLIC_ONLY fixture with seed 16061113 and a deliberate two-second launcher delay inside the same 30-second budget. This was a functional deadline/publication check, not another comparative cell or a rerun of the 270 frozen measurement attempts and diagnostic checks (252 comparative cells plus 18 prefix diagnostics).

The campaign file is valid and contains the same serialized JSON printed to stdout. The process was not externally killed: runner elapsed 17,410 ms, campaign elapsed 15,199 ms, accountable total 20,790/30,000 ms, post-Popen wait allowance 18,620 ms, original request timeout 18,745 ms. Original property/configuration and the original frozen manifest/assembly remain unchanged. The result truthfully reports exit 2, DEADLINE at CONFIRMATION and symbolic TIMEOUT. The summary records 67 unchecked symbolic inputs; the retained raw diagnostic says 66 remain after the attempted replay. Neither number is silently substituted for the other. Primary/full-budget eligibility is false, coverage is incomplete, and no coverage or fault is credited.

Available timing evidence consists of the external epoch cutoff, explicit reserves, post-Popen wait allowance, process elapsed time, existing campaign/phase durations and total accountable time. The receipt's startupAndPublicationChargedMillis = 3546 is the arithmetic difference 18,745 - 15,199; it is not an independently measured sum of startup/serialization phases. Full per-phase origin offsets and the exact stage of every earlier missing artifact are not established.

Receipt SHA: 315e6682ccef9fae73bc2b931e2328fef123425fed417c5b79b8f5f924a2a5f9. Predeclared plan SHA: 32655493870f055a8165736ebf8b65a8ea8f40b9573354257879978a3d6585f8. The local functional directory pbt613-deadline-functional-20261017 retains raw request/artifact/stdout/stderr and an index of 22 hashed files. Frozen c447 measurements and the 39-page second document edition were not rerun, rescored or rewritten.

Remaining boundary and review

The code fix is published and remains subject to user-controlled review/merge. This issue stays open until that merge decision; it is not left as an unimplemented deadline task. The explicit 1000 ms publication reserve is cooperative policy, not a hard guarantee for arbitrary encoding/filesystem/IR loading/cleanup cost. Existing child-deadline snapshots and native verification throughput remain separate limitations. This one functional check does not establish that all former missing artifacts are repaired, complete class coverage, or comparative benefit. No selector change, new session framework or repeated PBT generation was introduced. The acceptance above remains unchanged.