Private-target review pool is three OpenRouter free ZDR routes; a single 429 burst fails every review closed

[seonghobae]

Observed

After #2146 (ZDR feed keyed by model_id) reached main (64f483db9d052322c65bcdf1675d66138156f306), the private consumer ContextualWisdomLab/late-life-anxiety-reanalysis PR #10 (head a1cd5bc6783c6510dfcf937f523c733366e82213) was reopened. noema-review run 34738383583 / job 103673946748 (2026-09-13 04:50 UTC) now gets past catalog admission and fails at preflight instead. Artifact noema-sidecar-evidence 10311872313, contextual-orchestrator-preflight.json:

candidate_count: 3, probed_count: 3, rejected_count: 3, ready_count: 0, target_ready: 8, account_skip_after_429: 2
openrouter inclusionai/ling-3.0-flash-fin:free   rejected HTTPError 429 attempts=1
openrouter inclusionai/ling-3.0-flash-sante:free rejected HTTPError 429 attempts=1
openrouter inclusionai/ling-3.0-flash-vl:free    rejected HTTPError 429 attempts=1

Sanitized stderr also shows provider_discovery_failed provider=bytez code=http_status_500 (pre-existing, #1915). strix run 34738383616 fails the same way.

Why this is a pool/contract gap, not the #2146 defect

With CONTEXTUAL_ORCHESTRATOR_REQUIRE_ZDR=true (every private/internal target per ADR-0003), the only routes that can ever be attested are OpenRouter feed entries that are also free. Today's feed intersected with discovery yields exactly these three Novita-served :free models, all on the single OPENROUTER_API_KEY account. nvidia_nim/nvidia_nim_sub are affirmatively not ZDR; bytez is unattested. One 429 burst on OpenRouter's free tier therefore rejects every candidate, account_skip_after_429 retires the only account, and the run fails closed with no retry, so private repositories effectively cannot get a hosted review even though the policy path is now correct.

Next action (owner: central review sidecar / launcher; CO for provider adds)

1. Decide whether the launcher preflight may honor OpenRouter's Retry-After / rate-limit reset on 429 when the remaining candidate set is a single account (a provider-stated wait, not an arbitrary retry budget), and measure the runner-time cost against the current queue saturation (ops: diagnose and bound organization GitHub Actions queue starvation #712, Actions queue saturation: 120 open PRs + self-amplifying scheduler block all org merges (pg-erd-cloud: 0 merges since 2026-08-20) #1531). Deliverable: ADR-0003 amendment + RED/GREEN preflight test with a controllable 429→200 double.
2. Widen the attested ZDR free pool: track Integrate Experiential Labs KV source into canonical review bootstrap #2119 (Experiential Labs, needs endpoint-specific attestation) and the CO pin advance chore(ci): advance the vendored orchestrator pin to 012beaac and guard unattested providers #2137 (fix(discovery): recover usable Bytez chat models), and re-census the feed∩discovery set after each.
3. Until 1 or 2 lands, private consumer PRs need the operator infra-exception path documented in guideline §11 for the three sidecar reviews only; substantive gates (bootstrap, scan-pr-queue, CodeQL, SAST) now run on those heads.

Internal review date: 2026-09-15 (two days, because the manuscript PR is blocked on review capacity only). This date is a next-action deadline, not a fix promise.

Refs #2146, #2122, #2119, #2137, #1915, ContextualWisdomLab/late-life-anxiety-reanalysis#10.

[seonghobae]

Additional occurrence (public target, so not ZDR-gated but same 429 burst class): .github PR #2155 head 3452ed560, noema-review job 103714113314 (2026-09-13 ~11:10Z) — 12 HTTPError entries, 9 with http_status: 429, no verdict published. Recording here rather than opening a new issue; the run is left for the daily repair re-dispatch.