test(daemon): pin startup budget observation boundaries

[BunsDev]

Context

Related: #1001; stacked on draft #931.
Base: test/884-threads-real-daemon at 8576f41.
Tracking: OpenCoven/coven-threads bead threads-n74.

Objective: protect the existing startup-budget interpretation without guessing the cause of the intermittent Windows initial-start failures.
Acceptance: deterministic coverage of parent preparation versus launch costs, unchanged child store elapsed duration, and exact deadline preservation through start and restart.
Non-goals: production repair, timeout/retry changes, SQL/durability/authority changes, additional hosted diagnostic attempts, or closure of human gates.

Source findings and implementation

Only crates/coven-cli/src/daemon.rs changes, inside its existing test module:

• A synthetic timeline table holds child store work at 600ms while independently varying parent preparation and launch costs. It checks the production budget formatter and deadline predicate. Equal child elapsed time can fit or exhaust the parent deadline.
• A controller regression executes both ensure_background_server_with_controllers_until and restart_background_server_with_controllers_until. It requires the exact supplied deadline at readiness, injects expiry using remaining_at (no sleep), checks error propagation, one launch/one wait, and no published status.

Canonical sources consulted: AGENTS.md, CONTRIBUTING.md, README.md; daemon.rs lifecycle entrypoints, LifecycleDeadline, SystemDaemonStartController, start_background_server_with_spawn, start_with_budget_observation, initialize_daemon_store, Windows serve ordering and existing controller/checkpoint tests; store.rs initialize_store_with_observer and its six initialization phases; Cargo.toml, .cargo/config.toml, and the PR template.

The real source supports a single outer budget: home resolution, locking, discovery/stop, launch, and readiness consume it. The before/after-spawn labels bracket the entire start controller, including preparation/status construction, not just the OS spawn syscall. Windows binds the pipe before initialize_daemon_store, which completes before status publication. Store checkpoints begin at child store entry, independent of the parent's deadline. Child execution can overlap launch; the two parent samples do not locate child store entry.

Therefore this rejects the proposed diagnosis as an established cause, not the possibility of budget pressure. Successful observations on issue 1001 cannot explain the earlier failed launches. No unsupported production correction is included. These are unit regressions, not real-daemon E2E or a Windows failure reproduction.

Commands and results

Run in a NEW isolated worktree /tmp/coven-1001-startup-budget-20260911:

• cargo test --locked -p coven-cli --bin coven startup_budget -- --nocapture: 3 passed.
• cargo test --locked -p coven-cli --bin coven -- startup_ lifecycle_deadline daemon_store_initialization ensure_background_server restart_: 45 passed, including after restoring the mutation below.
• Sensitivity experiment: temporarily renewed the deadline at the ensure readiness call. cargo test --locked -p coven-cli --bin coven startup_budget_is_not_renewed_between_launch_and_readiness failed at the exact-deadline assertion as intended. Removed the mutation; final diff is test-only.
• cargo fmt --check: passed after formatting the new assertions.
• cargo clippy --locked -p coven-cli --bin coven --tests -- -D warnings: passed.
• python3 scripts/check-secrets.py: passed.
• git diff --check: passed.
• python3 scripts/check-coven-privacy.py --staged: run before commit (see publication evidence).

An initial attempt to pass multiple filters before Cargo's -- separator was rejected by Cargo; the corrected command above passed. No full-workspace suite or native Windows run was performed locally. No Threads Cargo override was used: these daemon unit tests use the locked dependency, and no current-Threads E2E claim is made.

Risk, rollback, and handoff

Test-only change; no public API, authority, privacy, migration, audit, SQL, deadline, retry, or runtime behavior change. The one-hour test deadline is a filesystem hang guard; exact expiry is synthetic, not a widened production timeout. Rollback is reverting this commit.

No existing worktree modified. No main push, merge, protection bypass, human review impersonation, or deliberate hosted rerun. Native failing-case causation remains unresolved in #1001. Reviewed integration, real-daemon boundary acceptance, and Nova/Val gates remain separate and open.

[BunsDev]

Publication evidence: committed and pushed d0fab9e with DCO signoff and Copilot co-author trailer. python3 scripts/check-coven-privacy.py --staged passed for the one changed file; pre-commit gitleaks also passed. Final worktree is clean. This is a test-only stacked contribution, not closure of #1001.

[BunsDev]

Hosted CI run 34664640288 completed successfully for head d0fab9e, including the PR gate. This supplements the targeted local regression and mutation-sensitivity evidence; it is not a reproduction or repair of the intermittent initial-start failure. macOS CI was intentionally skipped by workflow classification. No retries or deadline changes were introduced; #1001 remains unresolved.

[Copilot]

🟢 Approval recommended

Test-only changes passed the supplied checks with no unresolved issues.

Pull request overview

Adds deterministic daemon startup-budget regression tests without changing production behavior.

Changes:

• Separates parent preparation, launch, and child-store timing.
• Verifies exact deadline propagation through ensure and restart paths.
• Confirms timeout handling and no status publication after expiry.

File summaries

File	Description
crates/coven-cli/src/daemon.rs	Adds startup-budget and deadline regression tests.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.