chore: Record lack of UI codebase in palette journal - #5

…feating bug

Verified each against the actual ADR text and the sidecar/launcher
source before acting, per this repo's convention.

Finding #1 (critical) was correct: the previous revision's single
retry predicate ("empty response AND finish_reason == 'length'")
cannot fire for the exact live evidence this ADR cites as its own
justification -- a curl timeout with zero bytes received produces no
response object at all, so there is no finish_reason to inspect. As
written, the ADR would not have fixed the reproduced outage motivating
it. Fixed by splitting into two distinct, independently-triggered
retries: Trigger A (no usable response -- timeout, connection failure,
non-2xx) retries at the same budget, since a hang is not a budget
problem; Trigger B (a response was received, empty, finish_reason ==
"length") escalates the budget. Only Trigger B changes max_tokens.

Finding #2 (a real gap): an escalated probe can itself be rejected
outright by a model whose real ceiling sits below the escalated
budget -- a distinct signature from empty content, now its own
recorded outcome (escalated_probe_rejected) rather than blindly
retried or conflated with the down case.

Finding #3 (real arithmetic problem): an unconditional "one retry per
candidate" across up to 12 candidates plus the gateway check was an
unbounded-looking worst case against Layer 1's own 180s readiness
ceiling. Fixed with explicit, computed, shared per-layer retry
budgets: Layer 1 stays within its existing 180s ceiling (12 base
attempts + a capped 4 escalations x 10s = 160s). Layer 2 keeps its
existing, already-evidenced 120s per-attempt timeout UNCHANGED --
verified against this exact file's own prior comment explaining why
30s was raised to 120s (a real reasoning generation can legitimately
need that long, and the job already budgets 120 minutes) --
shortening it would have regressed that fix. Layer 2 gets up to 3
bounded attempts (360s worst case) instead of one with no recovery.

Finding #4: committed to concrete initial values instead of deferring
every number to future telemetry -- each is either already deployed in
this codebase (10s, 120s, 4096, 12) or backed by direct external
documentation (16, per OpenRouter's own schema: "some providers
enforce a minimum of 16"). Both layers now also emit finish_reason,
attempt count, and which trigger fired, so a real follow-up pass can
refine these from actual telemetry.

Finding #5: source citations are now SHA-pinned permalinks
(8b3235d...) instead of bare line numbers that rot as files change.

Co-Authored-By: Claude <[email protected]>