fix(gate,health): exact seeded-interval query check and honest probe budget

Review fixes (PR #218):

- The query phase asks for the exact deterministic seeded interval
  [FirstWindow, LastWindow+5m) — exactly 2016 windows, inside the engine
  read-range cap, excluding the protocol's live windows — instead of a
  trailing window with boundary-trimmed expectations. HOT_RETENTION_DAYS=8
  in the gate config keeps every seeded window alive through the run.
  Completeness now asserts extra == 0 as well as missing == 0; the extra
  count was previously computed and discarded.

- READY_AGGREGATE_DISK_BUDGET_MB returns to the real tier allocation
  (2304 MB) and READY_MAX_AGGREGATE_DISK_RATIO defaults to 1.0: readiness
  fails exactly at the tier boundary instead of using a synthetic 2560
  denominator to fake the same trip point. Boundary pinned by tests at
  one byte below, exactly at, and one byte above the tier.

- Comment wording: 4 MiB/window projects to 4.5 GiB, which exceeds the
  4.0 GiB main tier rather than merely consuming it.

Author: aksOps

CLAUDE.md

@@ -701,8 +701,8 @@ Thresholds (`0` disables that probe):
 | `READY_MAX_FINALIZE_FAILURE_STREAK` | 3 | Same shape, on the finalizer. |
 | `READY_MAX_ADMISSION_RATIO` | 0.9 | Below the 0.95 the DLQ/pipeline probes use: the writer's admission bound is what turns an Export into `RESOURCE_EXHAUSTED`, so readiness says "stop sending" before clients are refused, not while they are. |
 | `READY_MAX_DELTA_LOG_AGE_S` | 1800 | 2× (`WindowSize` 5m + `AllowedLateness` 10m). A window is finalizable 900s after it opens, so a healthy oldest entry tops out just past 900s plus one finalize tick. |
-| `READY_AGGREGATE_DISK_BUDGET_MB` | 2560 | `aggregate.db`'s share of the 8 GiB data budget (#201 Q1). The disk watchdog enforces the **volume**; this enforces the **tier**, so a runaway aggregate file is visible before it eats another tier's allocation. |
-| `READY_MAX_AGGREGATE_DISK_RATIO` | 0.9 | Warn inside the tier before the volume-level ladder starts shedding. |
+| `READY_AGGREGATE_DISK_BUDGET_MB` | 2304 | `aggregate.db`'s share of the 8 GiB data budget (#201 Q1). The disk watchdog enforces the **volume**; this enforces the **tier**, so a runaway aggregate file is visible before it eats another tier's allocation. |
+| `READY_MAX_AGGREGATE_DISK_RATIO` | 1.0 | Readiness fails exactly at the tier allocation. Full-density steady state (~0.92 of the tier) is legitimate; earlier warning is the volume-level watchdog ladder's job. |
 
 ## Security & Supply Chain
 

internal/api/health_runtime_test.go

@@ -63,7 +63,7 @@ func TestReadyFlipsOnEachAggregateRuntimeProbe(t *testing.T) {
 		{"finalize failure streak", "aggregate_finalizer", func(rt *AggregateRuntime) { rt.FinalizeFailureStreak = 4 }, "4"},
 		{"admission saturation", "aggregate_admission", func(rt *AggregateRuntime) { rt.AdmissionRatio = 0.91 }, "0.91"},
 		{"delta log age", "aggregate_delta_log", func(rt *AggregateRuntime) { rt.DeltaLogAgeSeconds = 1801 }, "1801"},
-		{"aggregate disk", "aggregate_disk", func(rt *AggregateRuntime) { rt.DiskUsedBytes = 1400 << 20 }, "0.91"},
+		{"aggregate disk", "aggregate_disk", func(rt *AggregateRuntime) { rt.DiskUsedBytes = 1536 << 20 }, "1"},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			s := newTestServer(t)
@@ -213,3 +213,32 @@ func TestLiveUnaffectedByRuntimeProbeFailures(t *testing.T) {
 		t.Fatalf("/live status = %q, want alive", body["status"])
 	}
 }
+
+// TestAggregateDiskProbeTierBoundary pins the probe to the honest semantics:
+// the budget field IS the tier allocation and the 1.0 default ratio means
+// readiness fails exactly at the boundary — one byte below passes, the
+// boundary itself and anything above it fail.
+func TestAggregateDiskProbeTierBoundary(t *testing.T) {
+	const tier = int64(2304) << 20
+	for _, tc := range []struct {
+		name string
+		used int64
+		want int
+	}{
+		{"one byte below the tier", tier - 1, http.StatusOK},
+		{"exactly at the tier", tier, http.StatusServiceUnavailable},
+		{"one byte above the tier", tier + 1, http.StatusServiceUnavailable},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			s := newTestServer(t)
+			rt := healthyRuntime()
+			rt.DiskUsedBytes = tc.used
+			rt.DiskBudgetBytes = tier
+			s.SetAggregateRuntimeProbe(func() AggregateRuntime { return rt })
+			if code, checks := readyChecks(t, s); code != tc.want {
+				t.Fatalf("/ready = %d with used=%d budget=%d, want %d (checks: %v)",
+					code, tc.used, tier, tc.want, checks)
+			}
+		})
+	}
+}

internal/api/server.go

@@ -119,7 +119,7 @@ func DefaultReadinessThresholds() ReadinessThresholds {
 		MaxFinalizeFailureStreak: 3,
 		MaxAdmissionRatio:        0.9,
 		MaxDeltaLogAgeSeconds:    1800,
-		MaxAggregateDiskRatio:    0.9,
+		MaxAggregateDiskRatio:    1.0,
 	}
 }
 

internal/config/config.go

@@ -664,9 +664,9 @@ func Load(customPath string) (*Config, error) {
 		ExemplarTracesPerServiceWindow: getEnvInt("EXEMPLAR_TRACES_PER_SERVICE_WINDOW", 25),
 		ExemplarTracesGlobalWindow:     getEnvInt("EXEMPLAR_TRACES_GLOBAL_WINDOW", 1500),
 		ExemplarBytesPerServiceWindow:  getEnvInt("EXEMPLAR_BYTES_PER_SERVICE_WINDOW", 512*1024),
-		// 3 MiB, not 4 (#201 Q2). 4 MiB/window consumes the entire 4.0 GiB
-		// main tier under the optimistic 2x amplification assumption and
-		// leaves no operational margin; it stays configurable, it is not the
+		// 3 MiB, not 4 (#201 Q2). 4 MiB/window projects to 4.5 GiB under the
+		// 2x amplification assumption, exceeding the 4.0 GiB main tier
+		// outright; it stays configurable, it is not the
 		// default until the seven-day gate (#202) proves it fits.
 		ExemplarBytesGlobalWindow:         getEnvInt("EXEMPLAR_BYTES_GLOBAL_WINDOW", 3*1024*1024),
 		ExemplarHealthyRate:               getEnvFloat("EXEMPLAR_HEALTHY_RATE", 0.005),
@@ -700,17 +700,17 @@ func Load(customPath string) (*Config, error) {
 		// readiness should say "stop sending" before clients are being refused,
 		// not while they are.
 		ReadyMaxAdmissionRatio: getEnvFloat("READY_MAX_ADMISSION_RATIO", 0.9),
-		// The aggregate tier allocation is 2.25 GiB (#201 Q1, rebalanced
+		// 2.25 GiB is the aggregate tier allocation (#201 Q1, rebalanced
 		// 2026-08-22 after the gate measured 2.08 GiB at full density). The
-		// probe budget is deliberately 2560 so the 0.90 warn ratio trips at
-		// 0.9 x 2560 MB = 2304 MB — exactly the tier boundary. Full-density
-		// steady state (~0.92 of the tier) is legitimate and must not flip
-		// readiness; crossing the tier allocation must.
+		// field IS the tier budget — no synthetic denominators. Full-density
+		// steady state (~0.92 of the tier) is legitimate, so the ratio below
+		// defaults to 1.0: readiness fails exactly at the tier boundary, and
+		// earlier warning belongs to the volume-level watchdog ladder.
 		// The disk watchdog enforces the VOLUME; this enforces the tier, so a
 		// runaway aggregate file is visible before it eats another tier's
 		// allocation and takes the whole volume past 95% with it.
-		ReadyAggregateDiskBudgetMB: getEnvInt("READY_AGGREGATE_DISK_BUDGET_MB", 2560),
-		ReadyMaxAggregateDiskRatio: getEnvFloat("READY_MAX_AGGREGATE_DISK_RATIO", 0.9),
+		ReadyAggregateDiskBudgetMB: getEnvInt("READY_AGGREGATE_DISK_BUDGET_MB", 2304),
+		ReadyMaxAggregateDiskRatio: getEnvFloat("READY_MAX_AGGREGATE_DISK_RATIO", 1.0),
 	}
 
 	// Parse AGGREGATE_METRIC_DIMS config

internal/config/config_test.go

@@ -1034,11 +1034,11 @@ func TestLoad_ReadinessThresholdDefaults(t *testing.T) {
 	if cfg.ReadyMaxAdmissionRatio != 0.9 {
 		t.Errorf("READY_MAX_ADMISSION_RATIO = %v, want 0.9", cfg.ReadyMaxAdmissionRatio)
 	}
-	if cfg.ReadyAggregateDiskBudgetMB != 2560 {
-		t.Errorf("READY_AGGREGATE_DISK_BUDGET_MB = %d, want 2560", cfg.ReadyAggregateDiskBudgetMB)
+	if cfg.ReadyAggregateDiskBudgetMB != 2304 {
+		t.Errorf("READY_AGGREGATE_DISK_BUDGET_MB = %d, want 2304", cfg.ReadyAggregateDiskBudgetMB)
 	}
-	if cfg.ReadyMaxAggregateDiskRatio != 0.9 {
-		t.Errorf("READY_MAX_AGGREGATE_DISK_RATIO = %v, want 0.9", cfg.ReadyMaxAggregateDiskRatio)
+	if cfg.ReadyMaxAggregateDiskRatio != 1.0 {
+		t.Errorf("READY_MAX_AGGREGATE_DISK_RATIO = %v, want 1.0", cfg.ReadyMaxAggregateDiskRatio)
 	}
 }
 

test/gate/gatecore/assert.go

@@ -540,6 +540,10 @@ func queryAssertions(r *Result, t Thresholds) []Assertion {
 				"query surface "+c.Name+" returned every seeded window",
 				c.URL, int64(c.WindowsReturned), int64(c.WindowsExpected),
 				fmt.Sprintf("%d windows missing", c.MissingWindows)))
+			out = append(out, eqInt(id+".windows_extra", catQuery,
+				"query surface "+c.Name+" returned no windows outside the seeded interval",
+				c.URL, int64(c.ExtraWindows), 0,
+				fmt.Sprintf("%d extra windows", c.ExtraWindows)))
 		}
 		if c.CoverageExpected != "" {
 			out = append(out, pass(id+".coverage", catQuery,

test/gate/gatecore/jsonscan_test.go

@@ -97,8 +97,8 @@ func TestWindowCoverage(t *testing.T) {
 	base := time.Date(2026, 8, 22, 0, 0, 0, 0, time.UTC)
 	pts := []WindowPoint{
 		{Timestamp: base},
-		{Timestamp: base.Add(10 * time.Minute)},
-		{Timestamp: base.Add(30 * time.Minute)}, // outside the expected set
+		{Timestamp: base.Add(10*time.Minute + 42*time.Second)}, // unaligned: same window as base+10m
+		{Timestamp: base.Add(30 * time.Minute)},                // outside the expected set
 	}
 	expected := []int64{base.Unix(), base.Add(5 * time.Minute).Unix(), base.Add(10 * time.Minute).Unix()}
 	returned, missing, extra := WindowCoverage(pts, expected, 300)

test/gate/gatecore/result.go

@@ -351,6 +351,7 @@ type QueryCheck struct {
 	WindowsReturned int                `json:"windows_returned,omitempty"`
 	WindowsExpected int                `json:"windows_expected,omitempty"`
 	MissingWindows  int                `json:"missing_windows,omitempty"`
+	ExtraWindows    int                `json:"extra_windows,omitempty"`
 	Scalars         map[string]float64 `json:"scalars,omitempty"`
 	BodyBytes       int                `json:"body_bytes"`
 	Error           string             `json:"error,omitempty"`

test/gate/main.go

@@ -694,22 +694,16 @@ func (g *gate) collectDisk() {
 }
 
 func (g *gate) collectQueries(prefill prefillFacts) {
-	// The trailing true seven-day window, not first-seeded-window..now: after
-	// ~4h of protocol the seeded range spans 7d+4h, which the engine's read
-	// guard refuses (cap: 7d + one window). Retention has also made seeded
-	// windows older than 7d eligible for purge, so they cannot be part of a
-	// completeness expectation. Expected coverage is trimmed to the seeded
-	// windows strictly inside the trailing range.
-	end := time.Now().UTC()
-	start := end.Add(-7 * 24 * time.Hour)
+	// The exact deterministic seeded interval, not first-seeded-window..now:
+	// the latter grows past the engine's read-range cap (7d + one window) as
+	// the protocol runs. [FirstWindow, LastWindow+5m) spans exactly the 2016
+	// seeded windows (7d, inside the cap), excludes the protocol's own live
+	// windows, and HOT_RETENTION_DAYS=8 in the gate config keeps every seeded
+	// window alive through the run — so completeness is missing==0 AND
+	// extra==0 over the full deterministic set.
+	start := time.Unix(prefill.FirstWindow, 0).UTC()
+	end := time.Unix(prefill.LastWindow, 0).UTC().Add(5 * time.Minute)
 	expected := windowRange(prefill.FirstWindow, prefill.LastWindow)
-	trimmed := expected[:0]
-	for _, w := range expected {
-		if w >= start.Unix()+300 {
-			trimmed = append(trimmed, w)
-		}
-	}
-	expected = trimmed
 
 	g.res.Queries.PrefillRangeStart = start
 	g.res.Queries.PrefillRangeEnd = end

test/gate/queries.go

@@ -77,8 +77,9 @@ func (g *gate) runAPICheck(spec gatecore.APICheck, sevenDayStart, sevenDayEnd ti
 			c.Error = perr.Error()
 			return c
 		}
-		returned, missing, _ := gatecore.WindowCoverage(pts, expectedWindows, gatecore.WindowSecs)
+		returned, missing, extra := gatecore.WindowCoverage(pts, expectedWindows, gatecore.WindowSecs)
 		c.WindowsReturned, c.MissingWindows, c.WindowsExpected = returned, missing, len(expectedWindows)
+		c.ExtraWindows = extra
 	}
 	// Whatever coverage marker arrived is always recorded; only surfaces the
 	// config marks as required are gated on it.