fix(launcher+hardware): #72 hung-backend signal + #65 SF2 fallback log

[mbachaud]

Summary

Two narrow fixes from the open-issues triage following PR #82.

• REST /api/control/start returns 200 on hung backend after PR #68 cold-start timeout change #72 REST /api/control/start returned 200 + pid on a hung backend after PR feat(observability): native Grafana telem setup script + spawn-order + port-collision fixes #68 made supervisor.start() non-fatal on /stats timeout. New supervisor.last_start_pending flag flips on the timeout branch; REST returns 202 Accepted with {ok, pid, started_pending: true, message} so external automation can render a yellow "starting…" badge instead of treating it as success. Same treatment on /api/control/restart. The dead StartupTimeout paths are removed from the except tuples.
• Operational silent-failure modes: Headroom upstream rewrite, hardware balloon, ribosome paid WARN, WAL bloat #65 SF2 Hardware-fallback was surfaced via the Windows tray balloon only — headless deployments (server, supervisor-managed, agents) had no signal. _detect() now emits one log.warning(\"Hardware fallback: requested=X active=cpu — ...\") on the explicit-device fallback path. auto→cpu stays silent (not a fallback, just a CPU-only box).

Closes #72, partially closes #65 (SF2 only).

Issue triage (#64, #65, #72, #73, #74)

#	Status
#72 REST hung backend	Fixed in this PR (option 2 from the issue — started_pending field + 202).
#65 SF1 Headroom rewrites HELIX_SERVER_UPSTREAM silently	Already fixed — app.py:329-339 already logs both ON (%s -> %s) and OFF (direct upstream) transitions with both values.
#65 SF2 Hardware fallback misses headless	Fixed in this PR (summary WARNING line in _detect).
#65 SF3 Ribosome paid WARN easy to miss	Already fixed — server.py:677-685 emits the startup WARN; /health.ribosome_cost_class field exists (server.py:2888); helix_ribosome_info{cost_class=...} Prometheus info-metric exists (telemetry.py:534-548).
#65 SF4 WAL bloat from non-canonical readers	Effectively addressed — docs/TROUBLESHOOTING.md already has the WAL bloat section with detection guidance and the /admin/checkpoint?mode=TRUNCATE admin endpoint. The issue suggested a separate docs/operational/wal-bloat.md; the content is there, just under TROUBLESHOOTING. Recommend closing as effectively done unless you want the content split out.
#64 Spec-vs-code design questions (HELIX_DEVICE overload / /consolidate body / <helix:no_match/> freshness)	Not actionable from a code-only PR. Each is three options that need a design call before any code moves.
#73 BROAD tighten expression_tokens 12000→6k-8k	Bench-gated. Issue's acceptance criteria require running the standard bench suite (diamond / needle_1000) at the candidate value, demonstrating no recall regression, and committing the bench artifact under overnight_logs/. Out of scope for a code-only PR.
#74 PLR gate ([plr] enabled = true)	Bench-gated + artifact-gated. Requires training a fresh stacked_plr.joblib, committing it, and the standard bench delta. Out of scope for a code-only PR.

Changes

File	Diff
helix_context/launcher/supervisor.py	_last_start_pending attr (init to False), last_start_pending property, sets on adopt path (False), timeout path (True), success path (False)
helix_context/launcher/app.py	/api/control/start and /api/control/restart return 202 + started_pending: true on pending; drops StartupTimeout from except tuples + import
helix_context/hardware.py	_detect() emits log.warning(\"Hardware fallback: requested=X active=cpu — ...\") on the explicit-device fallback path
tests/test_launcher_app.py	Updated success-shape assertions; new test_start_pending_returns_202_with_started_pending_field + restart counterpart; replaced obsolete test_start_timeout_returns_500 with test_start_supervisor_error_returns_500
tests/test_launcher_supervisor.py	Existing happy-path + timeout tests now also assert last_start_pending
tests/test_hardware.py	test_fallback_emits_summary_warning_for_headless_operators (pins WARNING content), test_auto_picker_does_not_emit_fallback_warning (pins no-fire-on-auto-to-cpu invariant)
CHANGELOG.md	Two new Unreleased entries

Test plan

• pytest tests/test_launcher_app.py tests/test_launcher_supervisor.py tests/test_hardware.py — 101/101 pass.
• Full mock suite: pytest tests/ -m \"not live\" — 1930 passed / 15 skipped / 21 deselected / 2 xfailed in 8m10s. Master baseline was 1924; this PR adds 4 tests + 2 assertions.
• No live tests in scope (no ribosome / no embedding model paths touched).

Recommendation on remaining open issues

• Close Operational silent-failure modes: Headroom upstream rewrite, hardware balloon, ribosome paid WARN, WAL bloat #65 as resolved (SF1/3/4 already done, SF2 fixed here). If you want SF4's WAL doc broken out separately, file a fresh small docs-only issue rather than keeping Operational silent-failure modes: Headroom upstream rewrite, hardware balloon, ribosome paid WARN, WAL bloat #65 open.
• Leave Spec-vs-code design questions: HELIX_DEVICE overload, /consolidate body, freshness in <helix:no_match/> #64, BROAD tighten: expression_tokens 12000 -> 6k-8k (bench-gated) #73, PLR gate: train artifact + bench gate before flipping [plr] enabled = true #74 open. They're real but each needs a decision/bench gate before code can move. Spec-vs-code design questions: HELIX_DEVICE overload, /consolidate body, freshness in <helix:no_match/> #64 is the only one of the three that I could draft code for if you pick options — let me know.