@ggui-ai/ui-gen 0.23.0 → 0.24.0

package/src/harness/check/runtime-render/adapter.ts

@@ -6,81 +6,205 @@
 
 import type { EvalIssue } from "../../../evaluation/types-public.js";
 import type { RuntimeRenderCheck } from "../../types-public.js";
-import { runRenderCheck, type RenderCheckIssue } from "./render-check.js";
+import {
+  RENDER_CHECK_KINDS,
+  runRenderCheck,
+  type RenderCheckIssue,
+  type RenderCheckKind,
+  type RunRenderCheckOptions,
+} from "./render-check.js";
+import { resolveRenderCheckHostBounds } from "./render-check-host.js";
 import { prepareMockupProps } from "./prepare-mockup.js";
 
-export const DEFAULT_RUNTIME_RENDER_CHECK: RuntimeRenderCheck = {
-  id: "runtime-render",
-  run: async input => {
-    const { sourceCode, compiledCode, contract, fixtureProps } = input;
+/**
+ * How one runtime-render check instance runs its isolated worker
+ * (ggui#1380). A serving deployment sets the probe's wall-clock bound,
+ * worker heap and concurrency here; every field omitted is the evaluation
+ * lane's behaviour — the host's default bounds and no concurrency cap.
+ */
+export interface RuntimeRenderProbeConfig {
+  /** Wall-clock bound of one isolated check, ms. Default: the host's (30 000). */
+  readonly timeoutMs?: number;
+  /** V8 heap cap of the worker, MB. Default: the host's (512). */
+  readonly heapMb?: number;
+  /**
+   * Live workers this instance may have at once. The (K+1)th check waits
+   * in FIFO order and spawns only when a slot frees; a check that throws
+   * releases its slot. Default: unbounded. Must be a positive integer.
+   */
+  readonly maxConcurrent?: number;
+}
 
-    // Nothing to render / no contract surface to verify — the probe has
-    // no subject, which is different from the probe failing to run.
-    if (compiledCode === null) {
-      return { status: "not-applicable", issues: [], reason: "no compiled code" };
+/**
+ * K-slot FIFO limiter. `undefined` slots = no limiter (the task runs at
+ * once). A slot is released in `finally`, so a rejected task never holds
+ * one.
+ */
+function createSlotLimiter(
+  maxConcurrent: number | undefined
+): <T>(task: (waitedMs: number) => Promise<T>) => Promise<T> {
+  if (maxConcurrent === undefined) return (task) => task(0);
+  if (!Number.isInteger(maxConcurrent) || maxConcurrent < 1) {
+    throw new RangeError(
+      `createRuntimeRenderCheck: maxConcurrent must be a positive integer, got ${maxConcurrent}`
+    );
+  }
+  let active = 0;
+  const waiting: Array<() => void> = [];
+  /** Resolves with the time the caller actually WAITED for a slot: 0 when one was free. */
+  const acquire = (): Promise<number> => {
+    if (active < maxConcurrent) {
+      active += 1;
+      return Promise.resolve(0);
     }
-    if (!contract) {
-      return { status: "not-applicable", issues: [], reason: "no contract surface" };
+    const enqueuedAt = Date.now();
+    return new Promise<number>((resolve) => {
+      waiting.push(() => {
+        active += 1;
+        resolve(Date.now() - enqueuedAt);
+      });
+    });
+  };
+  const release = (): void => {
+    active -= 1;
+    const next = waiting.shift();
+    if (next !== undefined) next();
+  };
+  return async (task) => {
+    const waitedMs = await acquire();
+    try {
+      return await task(waitedMs);
+    } finally {
+      release();
     }
+  };
+}
 
-    const mockup = prepareMockupProps({ contract, fixtureProps });
+/** `{ queuedMs }` when the check actually waited for a slot, `{}` when one was free. */
+function queuedField(queuedMs: number): { readonly queuedMs?: number } {
+  return queuedMs > 0 ? { queuedMs } : {};
+}
 
-    let result;
-    try {
-      result = await runRenderCheck({
-        sourceCode,
-        mockupProps: mockup.props,
-        contract,
-      });
-    } catch (e) {
-      // Triad audit (2026-04-27): every error that escapes `runRenderCheck`
-      // is an INFRA problem — happy-dom import failure, ESM/CJS interop
-      // (`Dynamic require of "events"`), bundler name collision (`Window2
-      // is not a constructor`), missing `@testing-library/react`, etc.
-      // Component-level failures are caught and emitted as `RenderCheckIssue`
-      // entries from inside `runRenderCheck`; they don't propagate out.
-      //
-      // An infra failure must never become an eval issue (the coding
-      // agent can't fix the environment — pre-2026-04-27 that phantom
-      // issue dragged every score-below-80 cell's eval-fix loop), but it
-      // must also never be silent to scoring: ggui#403 found the bench
-      // reporting `probe_pass 3/3` on cells where this branch fired on
-      // every invocation. The `infra-skipped` status is the No-Silent-
-      // Block channel — consumers surface it as did-not-run, never pass.
-      const message = e instanceof Error ? e.message : String(e);
-      console.warn(
-        `[runtime-render] probe skipped — infra failure: ${message}`,
-      );
-      return { status: "infra-skipped", issues: [], reason: message };
-    }
+/** The `runRenderCheck` options a config maps to — `undefined` when no bound is set. */
+function toRenderCheckOptions(config: RuntimeRenderProbeConfig): RunRenderCheckOptions | undefined {
+  if (config.timeoutMs === undefined && config.heapMb === undefined) return undefined;
+  return {
+    bounds: {
+      ...(config.timeoutMs !== undefined ? { timeoutMs: config.timeoutMs } : {}),
+      ...(config.heapMb !== undefined ? { heapMb: config.heapMb } : {}),
+    },
+  };
+}
 
-    const hostLoad = result.stats.hostLoad;
-    const load = hostLoad !== undefined ? { hostLoad } : {};
+/**
+ * Build a runtime-render check instance. One FIFO limiter per instance;
+ * the bounds reach `runRenderCheck` on every run. `createRuntimeRenderCheck()`
+ * with no config is {@link DEFAULT_RUNTIME_RENDER_CHECK}'s behaviour.
+ */
+export function createRuntimeRenderCheck(
+  config: RuntimeRenderProbeConfig = {}
+): RuntimeRenderCheck {
+  const limit = createSlotLimiter(config.maxConcurrent);
+  const options = toRenderCheckOptions(config);
+  // A bad bound is refused here, at construction, never at the first probe.
+  if (options !== undefined) resolveRenderCheckHostBounds(options.bounds);
+  return {
+    id: "runtime-render",
+    run: async (input) => {
+      const { sourceCode, compiledCode, contract, fixtureProps } = input;
 
-    // ggui#1299: a check that ran out of wall-clock time is not a verdict on
-    // the component. It becomes the `timed-out` status (did-not-run, never a
-    // pass, never a crash), never an eval issue — so the coding agent is never
-    // told to fix a crash that did not happen.
-    if (result.incomplete !== undefined) {
-      const { elapsedMs, boundMs } = result.incomplete;
-      const loadNote =
-        hostLoad !== undefined
-          ? `; host load ${hostLoad.start.toFixed(1)} → ${hostLoad.end.toFixed(1)} on ${hostLoad.cores} CPUs`
-          : "";
-      const reason = `render check did not finish within ${boundMs} ms (stopped at ${elapsedMs} ms)${loadNote}`;
-      console.warn(`[runtime-render] probe timed out — ${reason}`);
-      return { status: "timed-out", issues: [], reason, elapsedMs, ...load };
-    }
+      // Nothing to render / no contract surface to verify — the probe has
+      // no subject, which is different from the probe failing to run.
+      if (compiledCode === null) {
+        return { status: "not-applicable", issues: [], reason: "no compiled code" };
+      }
+      if (!contract) {
+        return { status: "not-applicable", issues: [], reason: "no contract surface" };
+      }
 
-    return {
-      status: "ran",
-      issues: result.issues
-        .map(toEvalIssue)
-        .filter((x): x is EvalIssue => x !== null),
-      ...load,
-    };
-  },
-};
+      const mockup = prepareMockupProps({ contract, fixtureProps });
+
+      // ggui#1380 — the adapter's own clock around the check: every status
+      // that reached the check (`ran`, `timed-out`, `infra-skipped`) reports
+      // how long it took, so a reader of the probe meta can tell a 2 s probe
+      // from a 30 s one on the same status. The two not-applicable returns
+      // above carry nothing: nothing ran.
+      // The clock starts when the slot is acquired, so `elapsedMs` is the
+      // check's own wall-clock; the time the check actually WAITED for a slot
+      // is `queuedMs` (present only when it queued) — a latency reader needs
+      // the two apart exactly when a serving deployment queues more probes
+      // than it has slots. A check that found a slot free carries no key.
+      let queuedMs = 0;
+      let t0 = Date.now();
+      let result;
+      try {
+        result = await limit((waitedMs) => {
+          queuedMs = waitedMs;
+          t0 = Date.now();
+          return runRenderCheck(
+            {
+              sourceCode,
+              mockupProps: mockup.props,
+              contract,
+            },
+            options
+          );
+        });
+      } catch (e) {
+        // Triad audit (2026-04-27): every error that escapes `runRenderCheck`
+        // is an INFRA problem — happy-dom import failure, ESM/CJS interop
+        // (`Dynamic require of "events"`), bundler name collision (`Window2
+        // is not a constructor`), missing `@testing-library/react`, etc.
+        // Component-level failures are caught and emitted as `RenderCheckIssue`
+        // entries from inside `runRenderCheck`; they don't propagate out.
+        //
+        // An infra failure must never become an eval issue (the coding
+        // agent can't fix the environment — pre-2026-04-27 that phantom
+        // issue dragged every score-below-80 cell's eval-fix loop), but it
+        // must also never be silent to scoring: ggui#403 found the bench
+        // reporting `probe_pass 3/3` on cells where this branch fired on
+        // every invocation. The `infra-skipped` status is the No-Silent-
+        // Block channel — consumers surface it as did-not-run, never pass.
+        const message = e instanceof Error ? e.message : String(e);
+        console.warn(`[runtime-render] probe skipped — infra failure: ${message}`);
+        return { status: "infra-skipped", issues: [], reason: message, elapsedMs: Date.now() - t0, ...queuedField(queuedMs) };
+      }
+
+      const hostLoad = result.stats.hostLoad;
+      const load = hostLoad !== undefined ? { hostLoad } : {};
+
+      // ggui#1299: a check that ran out of wall-clock time is not a verdict on
+      // the component. It becomes the `timed-out` status (did-not-run, never a
+      // pass, never a crash), never an eval issue — so the coding agent is never
+      // told to fix a crash that did not happen.
+      if (result.incomplete !== undefined) {
+        const { elapsedMs, boundMs } = result.incomplete;
+        const loadNote =
+          hostLoad !== undefined
+            ? `; host load ${hostLoad.start.toFixed(1)} → ${hostLoad.end.toFixed(1)} on ${hostLoad.cores} CPUs`
+            : "";
+        const reason = `render check did not finish within ${boundMs} ms (stopped at ${elapsedMs} ms)${loadNote}`;
+        console.warn(`[runtime-render] probe timed out — ${reason}`);
+        // One clock for every status that reached the worker: the adapter's
+        // wall-clock around the check. The worker's own reading survives in
+        // `reason` ("stopped at N ms").
+        return { status: "timed-out", issues: [], reason, elapsedMs: Date.now() - t0, ...queuedField(queuedMs), ...load };
+      }
+
+      return {
+        status: "ran",
+        issues: result.issues.map(toEvalIssue).filter((x): x is EvalIssue => x !== null),
+        elapsedMs: Date.now() - t0,
+        ...queuedField(queuedMs),
+        renderMs: result.stats.renderMs,
+        ...load,
+      };
+    },
+  };
+}
+
+/** The evaluation lane's instance: the host's default bounds, no concurrency cap. */
+export const DEFAULT_RUNTIME_RENDER_CHECK: RuntimeRenderCheck = createRuntimeRenderCheck();
 
 /**
  * Map a runtime-render crash reason to a class-specific fix string.
@@ -177,11 +301,7 @@ export function classifyRenderCrashFix(reason: string): string {
       "(b) check it's an array before iterating (`Array.isArray(x) && ...`)."
     );
   }
-  if (
-    r.includes("cannot read") ||
-    r.includes("undefined is not") ||
-    r.includes("null is not")
-  ) {
+  if (r.includes("cannot read") || r.includes("undefined is not") || r.includes("null is not")) {
     return (
       "Null/undefined access. Add optional chaining (`obj?.field`) and " +
       "default values for optional props/state before reading nested fields. " +
@@ -195,7 +315,32 @@ export function classifyRenderCrashFix(reason: string): string {
   );
 }
 
-function toEvalIssue(issue: RenderCheckIssue): EvalIssue | null {
+/** The prefix every probe issue's subcategory carries: `runtime:<check>[:<subject>]`. */
+const RUNTIME_SUBCATEGORY_PREFIX = "runtime:";
+
+/**
+ * The check a probe issue's subcategory names (ggui#1380) — the inverse of
+ * the `runtime:<check>[:<subject>]` form {@link toEvalIssue} writes, so a
+ * round can list WHICH checks failed from the issues alone. `undefined` for
+ * anything that is not a probe subcategory naming a member of
+ * {@link RENDER_CHECK_KINDS} (an axis check's subcategory, a did-not-run
+ * code such as `runtime:probe-timeout`, a bare check name).
+ */
+export function parseRuntimeSubcategory(subcategory: string): RenderCheckKind | undefined {
+  if (!subcategory.startsWith(RUNTIME_SUBCATEGORY_PREFIX)) return undefined;
+  const rest = subcategory.slice(RUNTIME_SUBCATEGORY_PREFIX.length);
+  const separator = rest.indexOf(":");
+  const check = separator === -1 ? rest : rest.slice(0, separator);
+  return RENDER_CHECK_KINDS.find((kind) => kind === check);
+}
+
+/**
+ * One probe finding → the eval issue the loop feeds back and the metadata
+ * counts. Exported for the pin that every switch case below is a member of
+ * {@link RENDER_CHECK_KINDS} and round-trips through
+ * {@link parseRuntimeSubcategory}.
+ */
+export function toEvalIssue(issue: RenderCheckIssue): EvalIssue | null {
   // verified → no issue (silent pass)
   if (issue.outcome === "verified" || issue.outcome === "skipped") return null;
 
@@ -228,7 +373,7 @@ function toEvalIssue(issue: RenderCheckIssue): EvalIssue | null {
     diagParts.push(
       "primed" in diag.inputPriming
         ? `input priming: ${diag.inputPriming.primed} control(s) filled before the click`
-        : `input priming failed: ${diag.inputPriming.error}`,
+        : `input priming failed: ${diag.inputPriming.error}`
     );
   }
   const diagSuffix = diagParts.length ? ` [observed: ${diagParts.join("; ")}]` : "";
@@ -264,9 +409,10 @@ function toEvalIssue(issue: RenderCheckIssue): EvalIssue | null {
       };
 
     case "action-wiring": {
-      const fix = issue.outcome === "unverified"
-        ? `Source shows the action callback flowing into a non-native or custom-component prop. If wiring is intentional (e.g., Dropdown.onChange, drag-drop), this warn is informational — manual/browser verification is required to confirm. Otherwise wire to a native onClick={() => ${subject}(payload)} on <button> or design-system <Button>.`
-        : `Wire ${subject}() to a native event prop. Common fix: <Button onClick={() => ${subject}(payload)}>Label</Button>. Source-AST analysis didn't find this wiring in your JSX.`;
+      const fix =
+        issue.outcome === "unverified"
+          ? `Source shows the action callback flowing into a non-native or custom-component prop. If wiring is intentional (e.g., Dropdown.onChange, drag-drop), this warn is informational — manual/browser verification is required to confirm. Otherwise wire to a native onClick={() => ${subject}(payload)} on <button> or design-system <Button>.`
+          : `Wire ${subject}() to a native event prop. Common fix: <Button onClick={() => ${subject}(payload)}>Label</Button>. Source-AST analysis didn't find this wiring in your JSX.`;
       return {
         tier: 0,
         result,

package/src/harness/check/runtime-render/index.ts

@@ -10,15 +10,26 @@
 //   - declared stream events update the DOM when emitted    (warn)
 
 import { installProductionActShim } from "./production-act-shim.js";
+import type { RenderCheckHostBounds } from "./render-check-host.js";
 
-export { runRenderCheck, type RenderCheckResult, type RenderCheckIssue } from "./render-check.js";
+export {
+  RENDER_CHECK_KINDS,
+  runRenderCheck,
+  type RenderCheckKind,
+  type RenderCheckResult,
+  type RenderCheckIssue,
+} from "./render-check.js";
 export { createProbe, createProbeWireConfig, type Probe } from "./probe.js";
 export { prepareMockupProps, type MockupPropsResult } from "./prepare-mockup.js";
 export {
   DEFAULT_RUNTIME_RENDER_CHECK,
   classifyRenderCrashFix,
+  createRuntimeRenderCheck,
   isRecoverableRenderCrash,
+  parseRuntimeSubcategory,
+  type RuntimeRenderProbeConfig,
 } from "./adapter.js";
+export type { RenderCheckHostBounds, RenderCheckHostOptions } from "./render-check-host.js";
 
 /**
  * Pre-warm the runtime-render probe's runtime dependencies so the first
@@ -41,7 +52,11 @@ export {
  *
  * Returns the wall-clock spent loading.
  */
-export async function warmupRuntimeRenderProbe(): Promise<{ ms: number; loaded: number; missing: number }> {
+export async function warmupRuntimeRenderProbe(): Promise<{
+  ms: number;
+  loaded: number;
+  missing: number;
+}> {
   const start = Date.now();
   let loaded = 0;
   let missing = 0;
@@ -67,3 +82,61 @@ export async function warmupRuntimeRenderProbe(): Promise<{ ms: number; loaded:
   ]);
   return { ms: Date.now() - start, loaded, missing };
 }
+
+/**
+ * The component the boot warm renders: a constant element, an empty
+ * contract — nothing to click, nothing to cover, one compile and one
+ * render in the worker.
+ */
+const WARMUP_COMPONENT = "export default function Warmup() { return <div>warm</div>; }";
+
+/**
+ * Warm the PROCESS that runs every probe (ggui#1380): spawn one real check
+ * worker on a trivial component through the same host every probe uses.
+ * Afterwards the node binary, the worker's module tree and esbuild's
+ * service have all run once on this machine (OS page cache warm), and the
+ * result says whether that process can run a check at all — which
+ * `warmupRuntimeRenderProbe` (an import in THIS process) cannot tell.
+ *
+ * `bounds` are the subprocess bounds for the one run; a serving deployment
+ * passes the same bounds it will probe with. Never throws: a worker that
+ * cannot run is `{ ok: false, reason }`, so a boot sequence can log it and
+ * decide, instead of dying in a fire-and-forget.
+ */
+export async function warmupRuntimeRenderWorker(
+  bounds?: Partial<RenderCheckHostBounds>
+): Promise<{ ok: true; ms: number } | { ok: false; ms: number; reason: string }> {
+  const start = Date.now();
+  try {
+    // Lazy: the host pulls `@ggui-ai/sandbox` (spawn machinery); keep it off
+    // the import graph of everything that only needs the in-process check.
+    const { runRenderCheckViaWorker } = await import("./render-check-host.js");
+    const result = await runRenderCheckViaWorker(
+      { sourceCode: WARMUP_COMPONENT, mockupProps: {}, contract: {} },
+      bounds !== undefined ? { bounds } : {}
+    );
+    const ms = Date.now() - start;
+    if (result.incomplete !== undefined) {
+      return {
+        ok: false,
+        ms,
+        reason: `the warm-up check did not finish within ${result.incomplete.boundMs} ms (stopped at ${result.incomplete.elapsedMs} ms)`,
+      };
+    }
+    const blocking = result.issues.find(
+      (i) => i.outcome === "failed" || i.outcome === "unverified"
+    );
+    if (blocking !== undefined) {
+      return { ok: false, ms, reason: `${blocking.check} ${blocking.outcome}: ${blocking.reason}` };
+    }
+    return { ok: true, ms };
+  } catch (err) {
+    // The host itself never throws for a worker fault; what reaches here is
+    // the spawn layer refusing to run at all (an invalid bound, no binary).
+    return {
+      ok: false,
+      ms: Date.now() - start,
+      reason: err instanceof Error ? err.message : String(err),
+    };
+  }
+}

package/src/harness/check/runtime-render/render-check-host.ts

@@ -48,12 +48,70 @@ import type { ProbeHostLoad } from '../../../evaluation/types-public.js';
 import type { RenderCheckResult, RunRenderCheckInput } from './render-check.js';
 
 /**
- * Wall-clock bound for one isolated check. The rich probe renders,
- * clicks every declared action, and re-renders streams — slower than
- * the smoke worker's 12s budget; 30s bounds runaway components while
- * staying far under any generation-turn budget.
+ * The subprocess bounds of one isolated check (ggui#1380). They are
+ * INPUTS of the host, not constants: a serving deployment runs the probe
+ * under its own memory and latency budget and sets them per check
+ * instance (`createRuntimeRenderCheck`); the evaluation lane runs on the
+ * defaults below, which are the values the host always used.
  */
-const CHECK_TIMEOUT_MS = 30_000;
+export interface RenderCheckHostBounds {
+  /**
+   * Wall-clock bound for one isolated check. The rich probe renders,
+   * clicks every declared action, and re-renders streams — slower than
+   * the smoke worker's 12s budget; 30s bounds runaway components while
+   * staying far under any generation-turn budget.
+   */
+  readonly timeoutMs: number;
+  /**
+   * V8 heap cap. The worker realm loads react-dom, happy-dom and
+   * testing-library on top of the component itself; 512 MB leaves
+   * headroom while still bounding pathological allocation.
+   */
+  readonly heapMb: number;
+  /**
+   * Grace between SIGTERM and SIGKILL once the bound is crossed. The
+   * effective value is `min(gracePeriodMs, floor(timeoutMs / 2))` —
+   * `runSandboxed` requires the grace to be strictly below the bound, so
+   * a short bound never trips its RangeError.
+   */
+  readonly gracePeriodMs: number;
+}
+
+export const DEFAULT_RENDER_CHECK_HOST_BOUNDS: RenderCheckHostBounds = {
+  timeoutMs: 30_000,
+  heapMb: 512,
+  gracePeriodMs: 2_000,
+};
+
+/**
+ * Fill the caller's partial bounds from the defaults and clamp the grace
+ * below the bound. Exported so the kill-path pin can run a fixture under
+ * exactly the numbers the host would pass for the same input.
+ */
+export function resolveRenderCheckHostBounds(
+  bounds: Partial<RenderCheckHostBounds> = {},
+): RenderCheckHostBounds {
+  const timeoutMs = bounds.timeoutMs ?? DEFAULT_RENDER_CHECK_HOST_BOUNDS.timeoutMs;
+  const heapMb = bounds.heapMb ?? DEFAULT_RENDER_CHECK_HOST_BOUNDS.heapMb;
+  // Refused at construction, like `maxConcurrent`: a 0 / NaN / fractional
+  // bound would otherwise flow into the sandbox's flags as a nonsense number.
+  // `timeoutMs` needs room for a grace of at least 1 ms below it.
+  if (!Number.isInteger(timeoutMs) || timeoutMs < 2) {
+    throw new RangeError(`render-check: timeoutMs must be an integer ≥ 2, got ${timeoutMs}`);
+  }
+  if (!Number.isInteger(heapMb) || heapMb < 1) {
+    throw new RangeError(`render-check: heapMb must be a positive integer, got ${heapMb}`);
+  }
+  const requestedGrace = bounds.gracePeriodMs ?? DEFAULT_RENDER_CHECK_HOST_BOUNDS.gracePeriodMs;
+  const gracePeriodMs = Math.max(1, Math.min(requestedGrace, Math.floor(timeoutMs / 2)));
+  return { timeoutMs, heapMb, gracePeriodMs };
+}
+
+/** Options of {@link runRenderCheckViaWorker}. */
+export interface RenderCheckHostOptions {
+  /** Subprocess bounds; every field omitted falls to {@link DEFAULT_RENDER_CHECK_HOST_BOUNDS}. */
+  readonly bounds?: Partial<RenderCheckHostBounds>;
+}
 
 /**
  * stdout cap. The verdict JSON carries issue lists with diagnostics
@@ -62,16 +120,14 @@ const CHECK_TIMEOUT_MS = 30_000;
  */
 const CHECK_STDOUT_CAP = 2 * 1024 * 1024;
 
-/**
- * V8 heap cap. The worker realm loads react-dom, happy-dom and
- * testing-library on top of the component itself; 512 MB leaves
- * headroom while still bounding pathological allocation.
- */
-const CHECK_NODE_HEAP_MB = 512;
-
 const WORKER_BASENAME = 'render-check-worker';
 
-function resolveWorkerSpawn(): { command: string; args: string[] } {
+/**
+ * How the host spawns the worker from THIS location: the built dist sibling
+ * when one exists, else the source `.ts` through tsx. Exported so the entry
+ * guard can be pinned with the same spawn the host makes (no build needed).
+ */
+export function resolveWorkerSpawn(): { command: string; args: string[] } {
   const jsCandidates = [
     // Sibling — when import.meta.url is already .../harness/check/runtime-render/.
     new URL(`./${WORKER_BASENAME}.js`, import.meta.url),
@@ -126,18 +182,20 @@ function unverified(reason: string, t0: number): RenderCheckResult {
 }
 
 /**
- * Map one sandbox result onto a `RenderCheckResult`. Exported for the
- * unit pins — the spawn itself is exercised by the integration test.
+ * Map one sandbox result onto a `RenderCheckResult`. `boundMs` is the
+ * wall-clock bound the run was given, reported on a timeout. Exported for
+ * the unit pins — the spawn itself is exercised by the integration test.
  */
 export function mapSandboxResultToCheckResult(
   result: SandboxResult,
   t0: number,
+  boundMs: number = DEFAULT_RENDER_CHECK_HOST_BOUNDS.timeoutMs,
 ): RenderCheckResult {
   if (result.outcome === 'timeout') {
     return {
       ok: false,
       issues: [],
-      incomplete: { kind: 'timeout', elapsedMs: result.durationMs, boundMs: CHECK_TIMEOUT_MS },
+      incomplete: { kind: 'timeout', elapsedMs: result.durationMs, boundMs },
       stats: { actionsChecked: 0, streamsChecked: 0, renderMs: Date.now() - t0 },
     };
   }
@@ -187,11 +245,15 @@ export function mapSandboxResultToCheckResult(
 
 /**
  * Run the render check in an isolated subprocess. See module doc.
+ * `options.bounds` sets the subprocess bounds for this run; omitted
+ * fields are the evaluation lane's defaults.
  */
 export async function runRenderCheckViaWorker(
   input: RunRenderCheckInput,
+  options: RenderCheckHostOptions = {},
 ): Promise<RenderCheckResult> {
   const t0 = Date.now();
+  const bounds = resolveRenderCheckHostBounds(options.bounds);
   let spawn: { command: string; args: string[] };
   try {
     spawn = resolveWorkerSpawn();
@@ -203,9 +265,10 @@ export async function runRenderCheckViaWorker(
   const result = await runSandboxed({
     command: spawn.command,
     args: spawn.args,
-    timeoutMs: CHECK_TIMEOUT_MS,
+    timeoutMs: bounds.timeoutMs,
+    gracePeriodMs: bounds.gracePeriodMs,
     maxStdoutBytes: CHECK_STDOUT_CAP,
-    nodeHeapMb: CHECK_NODE_HEAP_MB,
+    nodeHeapMb: bounds.heapMb,
     stdin: JSON.stringify(input),
     // NODE_ENV steers React's production vs development build — keep
     // parity with the caller; everything else stays on the sandbox's
@@ -218,6 +281,6 @@ export async function runRenderCheckViaWorker(
     end: loadavg()[0] ?? 0,
     cores: availableParallelism(),
   };
-  const mapped = mapSandboxResultToCheckResult(result, t0);
+  const mapped = mapSandboxResultToCheckResult(result, t0, bounds.timeoutMs);
   return { ...mapped, stats: { ...mapped.stats, hostLoad } };
 }