d05114e895
_validate_stall still guards stall_window_s >= max ttft_timeout_s, but its stated reason no longer holds: TTFT waiting is productive time and never reaches the stall account. The check is harmless and stays, so the docstring now says why it is kept rather than implying a live hazard. .env.example dropped the "must be >= max TTFT" advice for what the window actually measures.