Include serialized-client admission wait in the advertised total deadline

[armstrongsam25]

Fixes #68

The agent implemented Include serialized-client admission wait in the advertised total deadline in a disposable snapshot.

Handoff — repair round complete (no CI try consumed)

Branch: pi-agent/lets-68-admission-deadline @ 16db443 (two commits on top of base fb6c01c)

Controller failure — root cause and fix

The controller's check.sh failed at uv sync --frozen --all-extras: the repo pinned .python-version to 3.14, but only CPython 3.11.17 is installed in this sandbox and uv's interpreter download from python-build-standalone (GitHub) is blocked (tunnel error: unsuccessful). Fix (environment, not a weakened check): commit 16db443 pins .python-version to 3.11 — exactly the precedent fix from the prior pi-agent run (PR #88, issue #67). This only steers local uv interpreter selection; requires-python = ">=3.11,<3.15" admits it, no test asserts the file, and CI still exercises the full 3.11–3.14 matrix via its own setup-python matrix. After the fix, uv sync completes in ~1.2s from the local cache.

Implementation (unchanged from first round, commit d1dffb9)

• src/lets/client.py: absolute deadline created before lock acquisition; timed acquire(timeout=remaining); admission failure raises the new explicit ClientCapacityError (subclass of httpx.TimeoutException) before any transport use; watchdog armed with the remaining budget; lock release in an outer finally. No unbounded queue added.
• tests/unit/test_client_admission.py: 6 deterministic tests — occupied client, multiple waiting callers, zero transport use on admission timeout, close during wait (closed error and bounded-by-deadline variants), serial successful admission via event barriers, and a fake-clock test proving the deadline predates serialization and the watchdog uses the remaining interval.
• docs/integration.md "Client concurrency and deadlines": separate clients or a bounded host executor for parallel MCP/A2A work; synchronous surface explicit. CHANGELOG.md [Unreleased] entry added.

Evidence — exact controller gate sequence reproduced manually (final commit 16db443)

1. uv sync --frozen --all-extras → OK (previously the failing step)
2. uv pip check --python .venv/bin/python → 48 packages compatible
3. ruff check . → clean
4. python -m mypy src/lets → clean
5. pytest -m 'not e2e' --cov=lets --cov-branch → 945 passed, 2 environment skips (Docker/Windows)
6. diff-cover --compare-branch fb6c01c8b1c86337d7b20226d2abe099614d2957 --fail-under=90 → 100% (9/9 changed lines)
7. scripts/check_changed_coverage.py --fail-under 90 → status: "pass", decision artifact at .pi-evidence/changed-coverage-decision.json
8. Focused: test_client_admission.py + test_client.py under the lock-pinned venv → 145 passed; earlier discrimination run showed 4/6 new tests fail on the pre-change logic and 6/6 pass on the fix.

Limits

• Local interpreter is 3.11 only; the 3.11–3.14 matrix and Docker/platform acceptance run in PR CI.
• .pi-evidence/ is left untracked (the controller's own script creates it); tree is otherwise clean.
• PR fix(client): validate finite limits, preserve injected client ownership, and include admission wait in deadline #88 (unmerged, issue Preserve ownership of injected HTTP clients when total deadlines expire #67) also touches _request; trivial rebase possible if it lands later, no intent overlap.
• /opt/pi-control/check.sh and deep-local-check.py were not invoked — the controller owns them; I reproduced their exact commands instead.

The candidate is ready for the controller's independent qualification suite.

Snapshot base: fb6c01c8b1c86337d7b20226d2abe099614d2957.
Change fingerprint: 86fd727978a5969066958464a67675612f0e7cf555659782e9b207addd0203f1.
Local qualification: passed; log SHA-256: dbcb17638a1c1dc5cd24aac760be883158f3ec8133c034f965f7a8d923c5eee0.
CI round: 1/3; current PR commit: a87a804c8e73b397d4670e8d0f3a606b94e17b59.

Changed files:

• .python-version
• CHANGELOG.md
• docs/integration.md
• src/lets/client.py
• tests/unit/test_client_admission.py

Controller-run local test evidence

Checked 48 packages in 3ms
Checked 48 packages in 0.39ms
All installed packages are compatible
All checks passed!
Success: no issues found in 36 source files
........................................................................ [  7%]
........................................................................ [ 15%]
........................................................................ [ 22%]
........................................................................ [ 30%]
........................................................................ [ 38%]
......s................................................................. [ 45%]
....................................... [ 49%]
........................................................................ [ 57%]
........................................................................ [ 64%]
........................................................................ [ 72%]
........................................................................ [ 80%]
........................................................................ [ 87%]
..............................................s......................... [ 95%]
............................................                             [100%]
================================ tests coverage ================================
_______________ coverage: platform linux, python 3.11.17-final-0 _______________

Coverage XML written to file .pi-evidence/coverage.xml
Required test coverage of 74.0% reached. Total coverage: 78.03%
=========================== short test summary info ============================
SKIPPED [1] tests/integration/test_warden_recovery.py:192: this crash harness targets the Windows runtime
SKIPPED [1] tests/unit/test_production_deployment.py:691: Docker CLI is not installed
945 passed, 2 skipped, 2 deselected, 33 subtests passed in 44.15s
-------------
Diff Coverage
Diff: fb6c01c8b1c86337d7b20226d2abe099614d2957..HEAD, staged and unstaged changes
-------------
src/lets/client.py (100%)
-------------
Total:   9 lines
Missing: 0 lines
Coverage: 100%
-------------

{
  "base_sha": "fb6c01c8b1c86337d7b20226d2abe099614d2957",
  "candidate_sha": "16db443fab7cf4d08aed73a5cb2d9bbfd4a0c5ce",
  "changed_paths": [
    ".python-version",
    "CHANGELOG.md",
    "docs/integration.md",
    "src/lets/client.py",
    "tests/unit/test_client_admission.py"
  ],
  "covered_percent": 100.0,
  "fail_under": 90,
  "measured_lines": 9,
  "measured_paths": [
    "src/lets/client.py"
  ],
  "reason": "changed-line coverage is at or above 90%",
  "schema": "lets.changed-coverage-decision/v1",
  "status": "pass",
  "uncovered_lines": 0
}
Controller local qualification completed.

CI evidence:

• quality: SUCCESS (CI evidence)
• Python audit, SBOM, and package smoke: SUCCESS (CI evidence)
• test (ubuntu-latest, py3.11): SUCCESS (CI evidence)
• Container SBOM, hardening smoke, and vulnerability scan: SUCCESS (CI evidence)
• test (ubuntu-latest, py3.12): SUCCESS (CI evidence)
• test (ubuntu-latest, py3.13): SUCCESS (CI evidence)
• test (ubuntu-latest, py3.14): SUCCESS (CI evidence)
• test (windows-latest, py3.11): SUCCESS (CI evidence)
• test (windows-latest, py3.14): SUCCESS (CI evidence)
• distributed Docker acceptance: SUCCESS (CI evidence)
• LETS owner CI aggregate: SUCCESS (CI evidence)

Full local evidence and snapshot manifest remain on the Pi-Agent dashboard for run 05f8b5a8-350b-4667-84f4-14bce148fd6b. Native and distributed gates are qualified by their actual PR workflows; local checks do not claim platform parity.

All CI checks passed; awaiting Sam’s review.
All CI on the current PR head is green; Sam merges.