fix(backtests): the pipeline LLM preflight is 5x optimistic and lets uncompletable runs through

[FlyM1ss]

Prod run agent_20260922_202119_fc7bd724 (DJIA 30, 2026-09-07→09-18, deepseek/deepseek-v4-pro, pipeline + platform_credits) was killed at the 3600s limit having completed 47 of the 70 decision bars it needed. No results; the user was billed 81,130 micro-credits for 38 model calls.

_enforce_pipeline_llm_window approved it with what looked like a 2.9x margin:

estimated calls	70 (10 trading days x 7 bars x 1 pipeline step)
allowed	200 — (3600 - 600) // PIPELINE_SECONDS_PER_LLM_CALL
implied wall clock @ 15s/call	1050s
measured wall clock	76.7 s/call (decision-bar cycle: median 63.0s, mean 75.6s, n=46)
calls that fit in 3600s at the measured rate	47

The estimate is 5.1x optimistic, so the headroom is fictional — a run needing ~5370s passed a 3600s budget check.

Two separate errors in the model:

1. The 15s constant was never fitted. It is documented as a calibrated estimate where under-estimating is the safe direction, which is correct for a refusal — but nothing has ever measured it, and it is plainly wrong for a reasoning model.
2. It counts calls, not attempts. Every call on this run made 2 provider attempts (see the OpenRouter issue filed alongside this), and portfolio_manager.py retries an empty reply up to 4x on top of that.

credit_llm_reservations timestamps give per-model wall clock directly, so this is measurable from data already in prod rather than by guessing a bigger constant.

• Re-fit the default from prod data, or make it per-model.
• Account for attempts, not just calls.
• Reconsider sizing the pipeline budget from the window, as _backtest_subprocess_timeout already does for the hosted runtime. ux(backtests): model-prompting runs have no window, time or cost preflight #474 item 1 chose fixed-budget + preflight; the preflight is the half that turned out mis-calibrated.

Related: #474 (closed).

---

Filed from one diagnosis of the same prod run: #522 (why it timed out) · #523 (the dead primary provider) · #524 (why nothing is visible afterwards) · #525 (the refund log flood).