unseen: bound per-repo extraction time; a slow repo skips, never aborts

A pathologically slow repository (observed: tensorzero, 183s to clone,
then `git blame -C` past the 180s command limit) raised
subprocess.TimeoutExpired, which Git.run mislabeled as a fatal
InstrumentFailure("git_launch_failed") and aborted the whole 300-repo
draft. The same slowness stalled throughput (a 54-minute no-progress
gap).

Give each clone a per-repo wall-clock budget (--extract-deadline,
default 240s, plumbed Clones -> Git, counting the initial clone). A
timeout -- a command exceeding the remaining budget, or the budget
elapsing -- raises ExtractionTimeout(Rejected), which the existing
rejection handler turns into an "extraction_timeout" skip so the draw
moves to the next candidate. Genuine launch failures and non-zero git
exits stay fatal; timeouts and launch failures are now distinct. The
deadline is recorded on the report only, not the journal inputs, so
changing it does not refuse resume.

181 unseen tests pass, ruff clean.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

benchmarks/unseen/extract.py

@@ -11,6 +11,7 @@ import ast
 import json
 import re
 import subprocess
+import time
 from pathlib import Path
 
 from .source import Candidate, Rejected
@@ -28,8 +29,15 @@ class InstrumentFailure(ValueError):
     """A failed read or command must never masquerade as an empty history."""
 
 
+class ExtractionTimeout(Rejected):
+    """A slow repository is skipped without aborting the draft."""
+
+
 class Git:
-    def __init__(self, path: Path, *, runner=None, limit_bytes: int | None = None):
+    def __init__(self, path: Path, *, runner=None, limit_bytes: int | None = None, deadline_seconds: float | None = None, _now=None):
+        self._now = _now or time.monotonic
+        self.started = self._now()
+        self.deadline_seconds = deadline_seconds
         self.path = path
         self.runner = runner or subprocess.run
         self.bytes_read = 0
@@ -37,16 +45,27 @@ class Git:
         self.last_blob_bytes = 0
         self.limit_bytes = limit_bytes
 
+    def command_timeout(self) -> float:
+        if self.deadline_seconds is None:
+            return 180
+        remaining = self.deadline_seconds - (self._now() - self.started)
+        if remaining <= 0:
+            raise ExtractionTimeout("extraction_timeout")
+        return min(180, remaining)
+
     def run(self, *args: str, allowed=(0,)) -> str:
+        timeout = self.command_timeout()
         try:
             done = self.runner(
                 ["git", "-c", "core.quotePath=false", "-C", str(self.path), *args],
                 stdin=subprocess.DEVNULL,
                 stdout=subprocess.PIPE,
                 stderr=subprocess.PIPE,
-                timeout=180,
+                timeout=timeout,
                 check=False,
             )
+        except subprocess.TimeoutExpired:
+            raise ExtractionTimeout("extraction_timeout") from None
         except Exception:
             raise InstrumentFailure("git_launch_failed") from None
         if done.returncode not in allowed: