test(budget): size the competing-OFF bounds on the preparation window they now measure

tests/codex-integration/codex-sync-api.test.ts

@@ -22,18 +22,23 @@ const COMPETING_OFF_REAP_MS = 5_000;
  *
  * It used to derive them, and three derivations multiplied a single edit: when that shared
  * constant moved 45s -> 90s the outer bound here went 130s -> 265s, which nobody chose and no
- * measurement asked for. A 265s case on a Windows shard that already runs 25 minutes leaves an
- * unsafe margin against the 30-minute job timeout, so one hang would have been reported as a
- * cancelled job rather than as a named Bun timeout.
+ * measurement asked for. A 265s case on a Windows shard that already runs about 25 minutes
+ * leaves an unsafe margin against the 30-minute job timeout, so one hang would have been
+ * reported as a cancelled job rather than as a named Bun timeout.
  *
- * What the case costs in practice: five Windows shard logs put it at 3.7s, 3.8s, 4.1s, 7.6s
- * and 9.4s. What the numbers below are for is the cold-start outlier the reserve was written
- * against — 52.7s of real identity/admission preflight before the flip could even start. They
- * are headroom for that, not a duration, and the child now reports its own preparation time on
- * every green run so the next revision of these bounds can be measured rather than argued.
+ * The Windows reserve existed for a preflight nobody had measured — "CI observed 52.7s before
+ * the flip could even start" — so the child now reports its own preparation window on every
+ * green run. Run 35141541461 measured it at 2740ms on Windows and 423-575ms on Linux and
+ * macOS, with the whole case at 3675ms and 660-780ms; five earlier Windows shard logs put the
+ * case at 3.7s to 9.4s.
+ *
+ * These are still headroom rather than durations, sized so that even the 52.7s outlier the
+ * reserve was written for would fit: 52.7s of preparation still leaves the flip its full boot
+ * budget and its reap inside `COMPETING_OFF_CHILD_MS`. What they no longer do is track an
+ * unrelated shared constant.
  */
-const COMPETING_OFF_BOOT_MS = 40_000;
-const COMPETING_OFF_PREPARATION_MS = process.platform === "win32" ? 80_000 : COMPETING_OFF_BOOT_MS;
+const COMPETING_OFF_BOOT_MS = 30_000;
+const COMPETING_OFF_PREPARATION_MS = process.platform === "win32" ? 55_000 : COMPETING_OFF_BOOT_MS;
 const COMPETING_OFF_CHILD_MS = COMPETING_OFF_PREPARATION_MS + COMPETING_OFF_BOOT_MS + COMPETING_OFF_REAP_MS;
 const COMPETING_OFF_TEST_MS = COMPETING_OFF_CHILD_MS + COMPETING_OFF_REAP_MS;
 let prevCodexHome: string | undefined;

tests/helpers/test-budget.ts

@@ -54,10 +54,15 @@ export const SPAWN_BUDGET_MS = 45_000;
  * production secret writer, which on Windows runs two `hardenSecretPath(..., required: true)`
  * passes, each able to spawn PowerShell for SID resolution and several 30s-budgeted `icacls`
  * calls. That publication is now a plain temp-file rename, so the ceremony is out of the
- * measured window entirely. Across 30 Windows shard logs the surviving readiness waits are
- * 2.0s to 19.7s. 45s covers them; this ceiling covers the possibility that some part of the
- * 50.7s was cold process start rather than ACL work, which the new phase timestamps in
- * `tests/helpers/native-profile-startup-child.ts` will settle on the next slow run.
+ * measured window entirely, and the outlier went with it: across all six Windows shards of run
+ * 35141541461 every readiness wait in that file measured 2.0s to 4.9s, the first child
+ * included. 45s covers that with room to spare.
+ *
+ * This ceiling is kept anyway, for the part of the 50.7s that one run cannot rule out — a
+ * genuinely cold runner rather than ACL work. It costs nothing while the fix holds, because
+ * nothing approaches it. If a breach ever happens the phase timestamps in
+ * `tests/helpers/native-profile-startup-child.ts` name which phase spent the time, and this
+ * constant should be deleted rather than raised.
  *
  * ## Ablation
  *