Cycle: error-derived timeouts + the Bee-Hive — spec, plan, and the deviation ledger

[OriNachum]

Tracking issue for the cycle seeded from #42 (timeouts), #44 (the Bee-Hive) and #45 (the drone skill). This is where the deviations are documented as they happen, per the operator's standing approval — every dN gets a comment on this thread with what changed and why.

The artifacts

Artifact	Path
Spec (/scope → /think → /challenge)	docs/specs/2026-08-01-error-derived-timeouts-bee-hive-architecture.md
Plan (/spec-to-plan)	docs/plans/2026-08-01-error-derived-timeouts-bee-hive-architecture.md
Session contract	docs/session-contract-2026-08-01.md
Branch	spec/timeouts-bee-hive

Frame: 44 confirmed claims, 31 confirmed honesty conditions, 24 scope entries, 4 parks, 2 rejected claims.
Plan: 15 tasks, 6 waves, 62 coverage targets all covered, 4 recorded risks.

What the cycle owes

1. No timeout can censor evidence again — derived from the token budget (max_tokens / slowest_measured_rate), rate in a dated committed config rather than a literal, and enforced by a CI test that goes red on drift. Including the fan-out wait deadline, which Derive client timeouts from the token budget, not a latency percentile — and enforce the bound in CI #42's own audit missed.
2. The Bee-Hive is measured, not just designed — arm B (worker as a tool: no loop, no turn, no goal) and arm P (the cortex compiles a policy once; the policy plays), with the width rung first — the one the last ladder never reached, and the only axis where orchestration wins by construction.
3. Authored intelligence becomes reusable — /drone create | evoke | list, smoke-proven before save, opt-in and off, staleness surfaced before it misleads.
4. The live series is never damaged — every interaction goes through the amendment protocol plus a recorded deviation.
5. The findings travel — colleague and lobes-cli, negatives included.

The challenge pass, and what it caught

Rigorous (three escalation signals: model-written code execution, concurrency, hard-to-reverse instrument changes). Eleven findings, two settled by source probes with zero dials. The two worth reading on their own:

• The idle bound has its own censoring mode. With the cortex serving --max-num-seqs=2, a queued request legitimately receives nothing for up to a full neighbouring generation. A fixed inter-chunk idle clock would kill it — recreating the exact failure this cycle exists to end, on a brand-new clock. Streaming bounds are therefore two-phase: a queue-aware time-to-first-chunk bound, and an idle bound that applies only after the first chunk arrives.
• The ~9× concurrency figure does not transfer to tiny calls. It was measured on 1200-token completions; a B1 scoped call is tens of tokens, where per-call prefill of repeated context may dominate. The B1 economics claim now needs its own measurement (t8) before the sweep design hardens and cites the wrong number.

Deviations

Recorded against the plan's ledger (devague deviate --list) and documented in comments below as they land. Standing operator approval is on file for this cycle; the record is what makes each one auditable rather than argued.

• d1 — task t13 (governance continuity) moves from wave 0 to wave 1, gaining a dependency on t11 (drone core). Its second acceptance criterion, "the drones-default-off guard joins the governance suite", cannot be written against code that does not exist yet. Both sat in wave 0 and are file-disjoint, so the dependency graph permitted it — but a guard authored in an isolated worktree with no drone surface to check would be vacuous, which is precisely the "tests that passed while the thing they tested was broken" failure corrections.md §3 records. Found at fan-out time, before either agent was spawned.

Deviations recorded against the previous cycle's ledger (orchestrator-worker-architectures), because the running series is still climbing:

• d4 — the fan-out wait deadline DEFAULT_FANOUT_TIMEOUT raised 60.0 → 14860.0 s mid-series, landed as pre-registration amendment 2 (appended and dated, never edited into registered sections). 60 s bounded a whole unit drive against a worker whose measured p95 is 40.78 s for one 1200-token call — roughly 1/248th of the work it bounded. Every manager/hybrid unit would have been cut and recorded fanout-unit-absent, which names a straggler rather than a truncation, so the censoring would have been invisible in the record. The bias has a direction worth stating: arm E never fans out and could not be cut, while M and H fan out by construction — a thumb on the scale against orchestration, in a series whose question is whether orchestration pays. Caught before any M/H cell dialled, so no measured cell is affected and nothing is re-run.
• d5 — amendment 1's deviation record, created late. §18 of the pre-registration and CHANGELOG.md 0.10.0 both state that amendment 1 was recorded as deviation d4. No such record existed — the committed ledger held d1–d3 and nothing else, on both the series branch and main. Two committed documents named an artifact that was never created, and nothing checked, because a deviation id written in prose and a deviation record in the ledger are different objects and only one of them is enforced. The omission surfaced only because amendment 2 asked the CLI for the next id and was handed d4. So d4 is amendment 2; amendment 1's record now exists as d5, marked needs-follow-up. §18 is not rewritten to match — a pre-registration section is appended and dated, never rewritten after the dial, and that rule does not bend for a correction that flatters us. The CHANGELOG gets a corrections entry in the lane that owns it.

That last one is the same defect class that opened the timeout lane — a committed document asserting a change that was never made — found this time in our own accountability trail rather than in a constant.

• embodiment (Claude)

[OriNachum]

Deviation d3 — streaming becomes the default transport, and lands before the measured series

Approved by the operator, 2026-08-01. Classified risky rather than acceptable, because it changes the instrument every remaining measured cell runs on.

What changed

The plan's task t5 was "streaming pilot in worker_seam, flag-gated" — default off, one harness, landing in wave 2 and therefore after t10's width rung. It is now the default transport for every cortex/worker dial, landing before t10 dials.

Why the original shape no longer fits

t5 was written when the cortex was held by the running series and could not be probed. Everything below was unknown then and is measured now (docs/live-test-results/streaming-probe.md):

• The gateway's read timeout is per-read. conn.sock.settimeout(read_timeout) plus a chunk-by-chunk relay loop means every chunk restarts the window. Under streaming, the 600 s bound no client value can raise (lobes-cli#169) becomes an inter-chunk idle bound.
• Chunks flow throughout the think. Thinking on: 390 chunks over 43.45 s, max inter-chunk gap 0.124 s, while the first content delta does not arrive until 43.2 s. Non-streaming that is a 43-second wall of silence — the exact shape that killed two series calls at 600 s each.
• Metering survives. The terminal usage chunk arrives with stream_options.include_usage, carrying finish_reason and all token counts.
• The reasoning streams, in delta.reasoning — not vLLM's documented reasoning_content, which is its own trap and is written up separately.

The argument for landing it before t10, not after

This is the load-bearing half of the deviation. Keeping the original ordering would run the width rung — this cycle's headline experiment — on the transport that has already censored this repo four times:

#	clock	what it did
1	worker_seam.REQUEST_TIMEOUT 300 s	censored the completion-length distribution
2	DEFAULT_FANOUT_TIMEOUT 60 s	bounded a whole unit drive at 1/248th of it
3	RETRY_SLEEP_SECONDS 20 s	timed inside the call it retries
4	GATEWAY_READ_TIMEOUT 600 s	in another process; cost the live series two repetitions

Three of the four were invisible in the record at the moment they fired. Running a headline experiment on that transport when a measured alternative exists is not a defensible instrument choice.

Why adoption does not wait for a contended measurement

Claim c38 requires a two-phase bound — a queue-aware time-to-first-chunk bound, then an inter-chunk idle bound only after the first chunk — because a request queued behind --max-num-seqs=2 legitimately receives nothing until scheduled, and a naive idle clock would kill it.

That bound is derived from the queue model (queue depth × the derived per-request bound), not measured. So a contended dial validates the derivation rather than gating it. Both probe dials ran against an idle cortex and are honest about saying nothing regarding the queued case.

The boundary that keeps it honest

No published non-streaming result is re-run or re-graded — the same line d16 drew when it raised the token defaults. Each affected document names the transport that produced it. Token accounting is unaffected (the terminal usage chunk carries the same counts); latency figures across the transport change are not comparable, and the pre-registration says so in its opening rather than in a footnote.

Non-streaming stays reachable behind an explicit flag, and the derived total bounds stay as the outer backstop for a dead transport. A died stream is never blindly retried — lobes' no-retry-once-streaming contract — and stays distinguishable by field (c41), so a partial answer can never read as a short one.

• embodiment (Claude)

[OriNachum]

Cycle closed — PR #49, 15 of 15 tasks accounted for

Artifacts: delivery summary
· accountability map
· session contract
· corrections.md §§10–13.

12 delivered, 3 partial. No fourth state, and nothing averaged.

The three signals

signal	verdict
test_timeout_bounds.py goes red on drift	PASS — 8 of 8 clocks clear (the signal said 7; the AST category found an eighth)
the width rung publishes a verdict either way	PASS — SEPARATED-WIDTH on all four grains, ~3.3× at width 8
a drone's second evocation: 0 cortex calls at ≤5% tokens	SPLIT — 0 cortex calls PASS, 32.0% of authoring tokens FAIL

The third is published as a failure rather than renegotiated. The arithmetic
that would clear it works by disabling the model's reasoning, and nothing in
this cycle graded whether reasoning-off answers are correct — so meeting the
number that way would be optimising the metric rather than the outcome.

h1 is partially ABSENT, and that is the honest headline

"B and P dialled against E/W/M/H — an unmeasured design does not count as
shipped." B1 was dialled: 48 cells, 7,200 calls, 100% acceptance, 0
truncations. B0, B2 and P were not, and no head-to-head against E/W/M/H
exists. The registered stop rule returned CONTINUE; the cycle closed at rung
one with the ladder still climbing.

Four delivery claims are marked unverified rather than asserted: that
B0/B2/P produce measured results, that the Bee-Hive beats E/W/M/H, that scoped
answers are correct at any setting, and that the width result generalises
(n=3, one rig, one model).

Deviations

d1 and d2 (acceptable) serialise t13 behind the drone tier so its
governance guard could not be vacuous. d3 (risky) promoted streaming from
a flag-gated pilot to the default transport, landing before the measured
series — the alternative was measuring a rung on the transport this cycle had
already established was the wrong one.

What travelled

colleague#362 —
they dial the same gateway and cortex; their 120 s default covers ~2,574
completion tokens at the measured rate, and _make_complete sends no
max_tokens, so the rule cannot be applied there at all.
lobes-cli#168 /
#169 — the streaming
follow-up and a cross-link, including a correction in lobes' favour: arming
streaming routes around #169 rather than fixing it.

Review triage

Automated review filed 4 findings; 2 real, 1 narrowed, 1 refuted by
measurement (corrections.md §13). The one that mattered most was also the
one the report under-stated: the glob surface kind bypassed its own
containment guard, reachable from drone list with the executor off — and
the same defect broke c45 by escaping invoke and leaving no ledger record at
all. The refuted one would have added a lock against a race the platform already
prevents.

Next

Follow-up in #48
(reasoning + replication — affordable precisely because W1 measured ~3.3× at
width 8: 3× tokens at ~1× wall clock), and the owed work on making the thinking
mode controllable and pinned before the drone signal is re-measured.

• embodiment (Claude)