unseen: bound per-repo extraction time; a slow repo skips, never aborts

A pathologically slow repository (observed: tensorzero, 183s to clone,
then `git blame -C` past the 180s command limit) raised
subprocess.TimeoutExpired, which Git.run mislabeled as a fatal
InstrumentFailure("git_launch_failed") and aborted the whole 300-repo
draft. The same slowness stalled throughput (a 54-minute no-progress
gap).

Give each clone a per-repo wall-clock budget (--extract-deadline,
default 240s, plumbed Clones -> Git, counting the initial clone). A
timeout -- a command exceeding the remaining budget, or the budget
elapsing -- raises ExtractionTimeout(Rejected), which the existing
rejection handler turns into an "extraction_timeout" skip so the draw
moves to the next candidate. Genuine launch failures and non-zero git
exits stay fatal; timeouts and launch failures are now distinct. The
deadline is recorded on the report only, not the journal inputs, so
changing it does not refuse resume.

181 unseen tests pass, ruff clean.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

tests/test_unseen_extract.py

@@ -118,6 +118,44 @@ def test_git_failures_are_sanitized_and_not_empty(tmp_path):
         e.Git(tmp_path, runner=failed).run("log")
 
 
+@pytest.mark.parametrize("deadline,timeout", [(None, 180), (240.0, 180), (12.5, 12.5)])
+def test_git_timeout_is_rejection(tmp_path, deadline, timeout):
+    def runner(cmd, **kwargs):
+        assert kwargs["timeout"] == timeout
+        raise subprocess.TimeoutExpired(cmd, kwargs["timeout"])
+
+    git = e.Git(tmp_path, runner=runner, deadline_seconds=deadline, _now=lambda: 0.0)
+    with pytest.raises(e.ExtractionTimeout, match="^extraction_timeout$") as caught:
+        git.run("log")
+    assert isinstance(caught.value, s.Rejected)
+    assert not isinstance(caught.value, e.InstrumentFailure)
+
+
+def test_git_cumulative_deadline_prevents_launch(tmp_path):
+    now, timeouts = [100.0], []
+
+    def runner(cmd, **kwargs):
+        timeouts.append(kwargs["timeout"])
+        now[0] += 4.0
+        return subprocess.CompletedProcess(cmd, 0, b"read", b"")
+
+    git = e.Git(tmp_path, runner=runner, deadline_seconds=10.0, _now=lambda: now[0])
+    assert git.run("log") == "read"
+    assert git.run("log") == "read"
+    now[0] += 3.0  # Time between commands counts as well.
+    with pytest.raises(e.ExtractionTimeout, match="^extraction_timeout$"):
+        git.run("log")
+    assert timeouts == [10.0, 6.0]
+
+
+def test_git_launch_failure_stays_fatal(tmp_path):
+    def runner(cmd, **kwargs):
+        raise FileNotFoundError("private executable path")
+
+    with pytest.raises(e.InstrumentFailure, match="^git_launch_failed$"):
+        e.Git(tmp_path, runner=runner, deadline_seconds=240.0).run("log")
+
+
 def test_walkback_is_bounded_and_file_cap_falls_back(history):
     git, _, candidate, _, _, parent, _ = history