pipeline: a triage outage routes the turn to SimpleLookup, silently collapsing the pipeline into a bare loop

[macanderson]

What happened

On the 2026-08-10 post-Phase-2 re-baseline (mp2-*, SUT 314344c), 4 of 8 pipeline trials ran with no management roles at all — worker only, no triage, no research, no plan. The correlation with a provider-side triage failure is exact, 4 for 4:

Pipeline trial	triage failed at provider	management roles that ran
build-pov-ray	yes	none — worker only
extract-elf	yes	none — worker only
path-tracing	yes	none — worker only
qemu-alpine-ssh	yes	none — worker only
cobol-modernization	no	triage, research, plan
kv-store-grpc	no	triage, plan
pypi-server	no	triage, plan
raman-fitting	no	triage, research, plan

The error event, verbatim from stella-events.jsonl:

triage did not answer, so this turn's class came from the deterministic keyword floor: the triage call failed at the provider (retryable: true)

Why

The worker turn is protected by the rate-limit park built in #2677/#2744 — 26 turn_parked events across that panel, 24 wakes, zero retries_exhausted. The pipeline's management calls are not: crates/stella-pipeline/src/triage.rs runs under RetryPolicy::deterministic().

That exclusion was deliberate in #2677 ("only foreground request sources get 529 retries at all — background classifiers bail immediately"). This issue is a request to revisit it with evidence, not a report of an unnoticed bug.

Why it matters

The exclusion was reasoned about as "a classifier gives up and we fall back to a keyword floor" — a small, local degradation. What the trace shows is larger: when triage dies, the research and plan stages never run either, so the whole staged pipeline degenerates into a bare loop that still pays the pipeline's overhead. On this panel that was half the arm, and it is invisible in the solve count — the cells still score, they just are not measuring the pipeline.

It also corrupts any A/B between the arms. The pipeline arm's cost was +39% overall, but the one cell where research actually ran (cobol-modernization) was 37% cheaper than bare while making more tool calls:

cobol-modernization	worker steps	tool calls	input tokens	mean input/step	cost
bare loop	57	56 (all worker)	1.43M	25k	$0.273
pipeline	27	62 (36 in research)	0.63M	14k	$0.167

So the measured "pipeline is more expensive" conclusion is mostly an artifact of the collapse, not a property of the pipeline.

Files

• crates/stella-pipeline/src/triage.rs — RetryPolicy::deterministic()
• crates/stella-core/src/driver/rate_limit.rs — the park the worker gets
• crates/stella-pipeline/src/pipeline.rs — stage sequencing after a failed triage

Repro / verify

Run the TB2.1 panel, pipeline arm, against a provider under sustained 429 pressure (16 concurrent trials on a ~4-concurrent plan reproduces it reliably). Census role from step_usage per trial: a collapsed trial shows only worker. Cross-check against the error events for the keyword-floor string.

Definition of done

Either:

• (a) the management roles get a bounded park, so a throttled triage retries instead of bailing; or
• (b) the deliberate exclusion stands and the consequence becomes loud — a run whose management layer collapsed must be distinguishable from one that ran the pipeline, rather than scoring silently as a pipeline trial. Per invariant 10, that means a signal a consumer can branch on, not just a log line.

Whichever is chosen, a witness test that fails on today's code: a pipeline turn whose triage call is rejected with 429 must not silently skip research and plan.

Related

• CORRECTION: retry ladder fails fast under sustained rate limiting — make the Retry-After ceiling budget-aware with parked long waits #2677 (built the park; declared the triage exclusion deliberate)
• pipeline: triage times out at its 10s ceiling on 79% of bench calls — every decision silently falls back to the keyword floor #2414 (same keyword-floor fallback; cause there was the 10s timeout, not a provider error)
• bench/runner: classify a 429-retries_exhausted exit as infrastructure, and rate-limit the fan-out (the two #2667 halves not fixed by the core park) #2741, stella-model/core: 529 (overloaded) classifies as Transport, so a sustained 529 brownout never reaches the rate-limit park #2742, stella-core: a soft stop during a rate-limit park aborts the turn as a Failure instead of the graceful boundary soft-stop exit #2743 (residue from the same work; none covers this)

[macanderson]

Two sibling findings from the same 2026-08-10 TB2.1 panel, filed separately:

• core: usage_incomplete records model "unknown", so a failed call cannot be attributed to the model that made it #2831 — usage_incomplete records model: "unknown" (435 rows in that panel), so a failed call cannot be attributed to the model that made it.
• protocol: usage_incomplete and goal_verdict cite #2703 as their gap issue, but #2703 is the meta-task and asks for umbrella issues that were never filed #2832 — usage_incomplete and goal_verdict cite protocol: populate all ~41 signal-consumer ledger rows from the audit table; file the RecordedOnly umbrella issues (worker: haiku) #2703 as their consumer-ledger gap issue, but protocol: populate all ~41 signal-consumer ledger rows from the audit table; file the RecordedOnly umbrella issues (worker: haiku) #2703 is the meta-task; the umbrella issues it asks for were never filed. core: usage_incomplete records model "unknown", so a failed call cannot be attributed to the model that made it #2831 is an instance of what that gap allows to go unnoticed.

The fix for this issue is PR #2830.