@nylorun/runtime 0.26.0-beta → 0.27.0-beta

package/dist/tenant/sessions.js

@@ -9,14 +9,17 @@ import { approvalRefusal, codeToolRefusal } from "@nylorun/core/define";
 import { aggregateWaits, isWorkflowManifest } from "../core/flow-host.js";
 import { canonical } from "../store/canonical.js";
 import { sandboxSpecOf } from "../sandbox/resolve.js";
-import { withRuntimeTools, withSandbox } from "../sandbox/session-sandbox.js";
-import { authoredRuntimeBlocks, declaredSandboxes } from "../sandbox/share.js";
+import { declaredSandboxes } from "../sandbox/share.js";
 import { effectiveSandboxConfig, readSandboxConfig } from "../sandbox/tenant-config.js";
 import { HARNESS_ID, checkPlacement, requirePods } from "../sandbox/placement.js";
 import { openEnvironment, recordAttachment } from "./environments.js";
 import { harnessOf, } from "./context.js";
 import { fail } from "./http.js";
-import { missingDefinitionFiles } from "./definition-files.js";
+import { definitionFileIssues } from "./definition-files.js";
+import { limitsInForce, readSkillLimits, readTenantLimits } from "./limits.js";
+import { readRuntimeLimits } from "./runtime-limits.js";
+import { httpToolTimeoutIssues } from "../gates/http-tool.js";
+import { requiresIssues } from "./limits.js";
 /** A session's creation identity: everything but the request id. */
 const sessionIdentity = (value) => {
     const { requestId: _requestId, ...body } = value ?? {};
@@ -66,18 +69,25 @@ export async function putDefinition(ctx, agentId, body, options = {}) {
     const declared = declaredSandboxes(body.manifest);
     if (declared.length > 0)
         fail(400, `${declared.join(", ")} declares a sandbox. Agents no longer declare one: remove .sandbox(), create an Environment with the sandbox (PUT /v1/environments/{id}) and open the session on it, createSession({ environment }). See MIGRATION.md.`);
-    const runtime = authoredRuntimeBlocks(body.manifest);
-    if (runtime.length > 0)
-        fail(400, `${runtime.join(", ")} sets runtime, which only the Runtime writes when it pins a session's agent. Remove it and register the manifest your builder makes.`);
     const definition = {
         ...body,
         manifestHash: hashManifest(body.manifest),
     };
     const files = [...definitionFilesOf(body.manifest)];
     await ctx.store.tx(async (t) => {
-        const missing = await missingDefinitionFiles(t, body.manifest);
+        const limits = await readRuntimeLimits(t);
+        const issues = [
+            ...httpToolTimeoutIssues(body.manifest, limits.httpToolTimeoutMs),
+            ...requiresIssues(body.manifest.requires, limits),
+        ];
+        if (issues.length > 0)
+            fail(400, issues.join(" "));
+        const { totalBytes } = await readSkillLimits(t);
+        const { missing, oversized } = await definitionFileIssues(t, body.manifest, totalBytes);
         if (missing.length > 0)
             fail(400, `The definition names ${missing.length} file(s) the Runtime does not hold; upload each with PUT /v1/files/<sha256> first: ${missing.join(", ")}`, { code: "definition_files_missing", details: { missing } });
+        if (oversized.length > 0)
+            fail(413, `This Tenant allows a skill's files at most ${totalBytes} bytes together: ${oversized.map((skill) => `'${skill.name}' holds ${skill.bytes}`).join(", ")}`, { code: "limit_exceeded", details: { limitBytes: totalBytes, skills: oversized } });
         if (options.dryRun)
             return;
         await t.put("definitions", agentId, definition);
@@ -158,6 +168,8 @@ export async function putSession(ctx, id, body, access, options = {}) {
             });
         if (!isWorkflowManifest(definition.manifest))
             await checkRequirements(t, definition.manifest, environment);
+        if (environment !== undefined)
+            await checkSkillLimit(t, definition.manifest, environment);
         const config = await readSandboxConfig(t);
         // The harness the session runs for its life (R4.1): its Environment's, else ours. A flow
         // runs in core and our engine, whatever its Environment names.
@@ -171,13 +183,14 @@ export async function putSession(ctx, id, body, access, options = {}) {
         const spec = environment === undefined || environment.kind === "none"
             ? undefined
             : sandboxSpecOf(environment.applied, effectiveSandboxConfig(config).limits.idle);
-        const pinned = spec === undefined ? runtimeTools(definition) : pin(definition, spec);
+        // The session pins its definition as registered (protocol 15): the sandbox's spec stays on
+        // the session, and the harness words the facts and defines the tools.
         const created = {
             id,
             agentId: body.agentId,
             ownerUserId: body.ownerUserId,
-            manifest: pinned.manifest ?? definition.manifest,
-            manifestHash: pinned.manifestHash ?? definition.manifestHash,
+            manifest: definition.manifest,
+            manifestHash: definition.manifestHash,
             definitionHash: definition.manifestHash,
             implementationVersion: definition.implementationVersion,
             info: body.info,
@@ -224,26 +237,16 @@ async function checkRequirements(t, manifest, environment) {
     fail(409, `Agent ${manifest.id} requires ${missing.map((gap) => (gap.startsWith("secret:") ? `the secret ${gap.slice(7)}` : gap === "pod" ? "a pod Environment" : "a sandbox")).join(", ")}, and ${where}.`, { code: "environment_unsuitable", details: { missing } });
 }
 /**
- * The manifest a session without a sandbox pins: each agent's `runtime` block, with
- * `read_artifact` (R2b C11) and its skill tools; nothing for a workflow.
+ * Refuses a session whose agent carries a skill larger than its Environment allows: its
+ * manifest's `limits.skills.totalBytes`, else the Tenant's, never above the Tenant's.
+ * `409 environment_unsuitable`, with each skill and its size in `details.skills`.
  */
-function runtimeTools(definition) {
-    if (isWorkflowManifest(definition.manifest))
-        return {};
-    const pinned = withRuntimeTools(definition.manifest);
-    if (!pinned.ok)
-        return fail(400, pinned.message);
-    return { manifest: pinned.manifest, manifestHash: pinned.manifestHash };
-}
-/** The manifest a session with a sandbox pins: the definition with the sandbox in its `runtime` block. */
-function pin(definition, spec) {
-    // A workflow's manifest stays as registered: its agents inherit the sandbox when they start.
-    if (isWorkflowManifest(definition.manifest))
-        return {};
-    const sandboxed = withSandbox(definition.manifest, spec);
-    if (!sandboxed.ok)
-        return fail(400, sandboxed.message);
-    return { manifest: sandboxed.manifest, manifestHash: sandboxed.manifestHash };
+async function checkSkillLimit(t, manifest, environment) {
+    const limitBytes = limitsInForce(await readTenantLimits(t), environment.applied.limits).skills.totalBytes;
+    const { oversized } = await definitionFileIssues(t, manifest, limitBytes);
+    if (oversized.length === 0)
+        return;
+    fail(409, `Environment ${environment.id} allows a skill's files at most ${limitBytes} bytes together, and agent ${manifest.id} carries ${oversized.map((skill) => `'${skill.name}' (${skill.bytes})`).join(", ")}.`, { code: "environment_unsuitable", details: { limitBytes, skills: oversized } });
 }
 /** The session resource returned by `GET`/`PUT /v1/sessions/:id`. */
 export async function sessionView(t, s) {

package/dist/tenant/signing-keys.d.ts

@@ -48,7 +48,7 @@ export declare class SigningKeys {
     /**
      * Rotates: previous → revoked, current → previous, standby → current, new standby. Refused
      * with 409 while the previous key may still verify live tokens (retired less than the
-     * longest token lifetime, `maxTtlSeconds` or `TOKEN_TTL_MAX_SECONDS`, plus a minute ago), unless
+     * longest token lifetime, `maxTtlSeconds` or `keys.tokenTtlMaxSeconds`, plus a minute ago), unless
      * `force`.
      */
     rotate(t: Tx, kek: Buffer, maxTtlSeconds: number, force: boolean): Promise<SigningKeyRow[]>;

package/dist/tenant/signing-keys.js

@@ -15,12 +15,10 @@
  */
 import { exportJWK, exportPKCS8, generateKeyPair, importJWK, importPKCS8, } from "jose";
 import { newSigningKeyId, SIGNING_KEY_ID_PATTERN, } from "@nylorun/core/compatibility";
-import { TOKEN_TTL_MAX_SECONDS } from "@nylorun/core/contracts";
 import { decryptSecret, encryptSecret } from "../vault/crypto.js";
 import { fail } from "./http.js";
+import { hostTuning } from "../tuning.js";
 const ALG = "ES256";
-/** Grace added to the longest token lifetime before a previous key may be revoked. */
-const ROTATION_GRACE_MS = 60_000;
 export class SigningKeys {
     options;
     publicKeys = new Map();
@@ -107,7 +105,7 @@ export class SigningKeys {
     /**
      * Rotates: previous → revoked, current → previous, standby → current, new standby. Refused
      * with 409 while the previous key may still verify live tokens (retired less than the
-     * longest token lifetime, `maxTtlSeconds` or `TOKEN_TTL_MAX_SECONDS`, plus a minute ago), unless
+     * longest token lifetime, `maxTtlSeconds` or `keys.tokenTtlMaxSeconds`, plus a minute ago), unless
      * `force`.
      */
     async rotate(t, kek, maxTtlSeconds, force) {
@@ -118,8 +116,9 @@ export class SigningKeys {
         const [previous] = await t.signingKeys(["previous"]);
         if (previous && !force) {
             const retired = Date.parse(previous.retiredAt ?? previous.createdAt);
-            const longest = Math.max(maxTtlSeconds, TOKEN_TTL_MAX_SECONDS);
-            const until = retired + longest * 1000 + ROTATION_GRACE_MS;
+            const longest = Math.max(maxTtlSeconds, hostTuning().keys.tokenTtlMaxSeconds);
+            // The grace added to the longest token lifetime before a previous key may be revoked.
+            const until = retired + longest * 1000 + hostTuning().tenant.signingKeyRotationGraceMs;
             if (until > now.getTime())
                 fail(409, "The previous key may still verify live tokens", {
                     code: "request_rejected",

package/dist/tenant/status.js

@@ -1,11 +1,10 @@
 import { FIXTURE_MODEL_SETTING, seedFixtureModel } from "./model-setting.js";
 import { ENVIRONMENTS_CONFIG_SETTING, writeSandboxConfig } from "../sandbox/tenant-config.js";
+import { hostTuning } from "../tuning.js";
 /** The Tenant's harnesses, for its status and the Host's. */
 export function harnessStatusOf(ctx) {
     return { mode: ctx.mcp ? "in-process" : "remote", ...ctx.harness.status() };
 }
-/** How long status waits for the execution to list stuck invocations. */
-const STUCK_TIMEOUT_MS = 5000;
 /** `TenantStatus.execution`: paused and backing-off invocations, or why they are unknown. */
 async function executionStatus(stuckInvocations) {
     let timer;
@@ -13,7 +12,9 @@ async function executionStatus(stuckInvocations) {
         const stuck = await Promise.race([
             stuckInvocations(),
             new Promise((_, reject) => {
-                timer = setTimeout(() => reject(new Error("Timed out listing stuck invocations")), STUCK_TIMEOUT_MS);
+                timer = setTimeout(() => reject(new Error("Timed out listing stuck invocations")), 
+                // How long status waits for the execution to list stuck invocations.
+                hostTuning().tenant.statusTimeoutMs);
             }),
         ]);
         return {

package/dist/tenant/streams.js

@@ -1,17 +1,16 @@
 import { basinOf } from "../streams/basin.js";
 import { createStreamRelay, } from "../streams/relay/core.js";
 import { retry } from "../retry.js";
+import { hostTuning } from "../tuning.js";
 import { checkSessionStreams, currentBasin } from "./session-streams.js";
-const RETRY_MIN_MS = 100;
-const RETRY_MAX_MS = 2000;
-/** The longest wait between two `ensureTenant` attempts while the basin is being repaired. */
-const BASIN_RETRY_MAX_MS = 5000;
-/** A repair started within this long after the last one succeeded waits for the next failure. */
-const BASIN_REPAIR_COOLDOWN_MS = 1000;
-/** How often every session stream is checked against its session (backstop for lost signals). */
-const FEED_CHECK_MS = 30_000;
-/** How long a retired basin stays for readers that have not moved yet. */
-const RETIRE_GRACE_MS = 60_000;
+/*
+ * Timings are the Host tuning's `streams` group (`tuning.ts`): `retry` for deletions and
+ * repairs, `basinRetryMaxMs` (the longest wait between two `ensureTenant` attempts while the
+ * basin is being repaired), `basinRepairCooldownMs` (a repair started within this long after the
+ * last one succeeded waits for the next failure), `feedCheckMs` (how often every session stream is
+ * checked against its session, the backstop for lost signals), `retireGraceMs` (how long a retired
+ * basin stays for readers that have not moved yet).
+ */
 const messageOf = (error) => error instanceof Error ? error.message : String(error);
 /**
  * Wires the Tenant to Durable Streams: reads its basin generation, checks the basin, starts
@@ -25,7 +24,7 @@ export async function wireStreams(ctx, options) {
     const { store, streams, tenantId } = options;
     const logger = ctx.config.logger;
     const stop = new AbortController();
-    const graceMs = options.retireGraceMs ?? RETIRE_GRACE_MS;
+    const graceMs = options.retireGraceMs ?? hostTuning().streams.retireGraceMs;
     // Nothing is reported once the wiring stops: the Tenant (and its log directory) may be gone,
     // and a throwing report in a detached loop would be an unhandled rejection.
     const report = (what) => (error) => {
@@ -53,7 +52,7 @@ export async function wireStreams(ctx, options) {
         });
     relay?.start();
     // Streams whose session was reset end on the `sessions.reset` signal; this catches lost ones.
-    const feedCheck = setInterval(() => void checkSessionStreams(ctx).catch(report("session stream check failed")), FEED_CHECK_MS);
+    const feedCheck = setInterval(() => void checkSessionStreams(ctx).catch(report("session stream check failed")), hostTuning().streams.feedCheckMs);
     feedCheck.unref();
     const retiring = new Set();
     const timers = new Set();
@@ -94,9 +93,8 @@ export async function wireStreams(ctx, options) {
     async function deleteRetired(generation) {
         try {
             await retry(() => streams.deleteTenant(basinOf(tenantId, generation)), {
-                minMs: RETRY_MIN_MS,
-                maxMs: RETRY_MAX_MS,
-                attempts: 5,
+                ...hostTuning().streams.retry,
+                attempts: hostTuning().streams.retireAttempts,
             });
             await store.tx((t) => t.forgetRetiredGeneration(generation));
             logger.info("retired stream basin deleted", { generation });
@@ -160,7 +158,7 @@ export async function streamsStatus(ctx, options = {}) {
     const wiring = ctx.sessionStreams.wiring;
     return {
         reachable: wiring
-            ? await probe(wiring.streams, options.probeTimeoutMs ?? 2000)
+            ? await probe(wiring.streams, options.probeTimeoutMs ?? hostTuning().streams.probeTimeoutMs)
             : false,
         basin: wiring?.basin() ?? { ready: false, failures: 0, lastError: null },
         generation: ctx.sessionStreams.generation,
@@ -215,17 +213,17 @@ function basinKeeper(streams, basinKey, signal, onError) {
         repair() {
             if (repairing || signal.aborted)
                 return;
-            if (ready && readyFor === basinKey() && Date.now() - repairedAt < BASIN_REPAIR_COOLDOWN_MS)
+            if (ready && readyFor === basinKey() && Date.now() - repairedAt < hostTuning().streams.basinRepairCooldownMs)
                 return;
             repairing = true;
             ready = false;
             void (async () => {
                 await retry(ensure, {
-                    minMs: RETRY_MIN_MS,
-                    maxMs: BASIN_RETRY_MAX_MS,
+                    minMs: hostTuning().streams.retry.minMs,
+                    maxMs: hostTuning().streams.basinRetryMaxMs,
                     signal,
                     onError: (error) => {
-                        if (failures === 1 || failures % 10 === 0)
+                        if (failures === 1 || failures % hostTuning().streams.basinLogEveryFailures === 0)
                             onError(error);
                     },
                 }).then(() => (repairedAt = Date.now()), () => undefined);

package/dist/tenant/sweep.d.ts

@@ -1,32 +1,12 @@
 import type { PendingRequest } from "../store/types.js";
 import type { TenantContext } from "./context.js";
-/**
- * How old an outbox row is before the sweep delivers it, unless its delivery after commit
- * already failed (then it is due at once): longer than that delivery can take with its
- * retries, so the sweep does not send again, and double the load on, an execution that is
- * only slow. Sending one twice is harmless either way (the idempotency key).
- */
-export declare const OUTBOX_GRACE_MS = 30000;
-/**
- * How often the orphan scan, and the stale pod sandbox check, run after the first pass of a
- * Tenant opened on this process.
- */
-export declare const ORPHAN_SCAN_MS = 60000;
-/**
- * How long one pass may spend draining the outbox, and paging through orphaned sessions.
- * A backlog is worked off over several passes rather than holding one (and with it the
- * Tenant's sweep object in the execution) for long.
- */
-export declare const DRAIN_BUDGET_MS = 2000;
 export declare function sweep(ctx: TenantContext): Promise<void>;
-/** Failed deliveries after which the sweep parks an outbox row (`Tx.failOutbox`). */
-export declare const MAX_OUTBOX_ATTEMPTS = 10;
 /**
  * Deliver the outbox rows that are due (`Tx.pendingOutbox`: older than `graceMs`, or whose
  * delivery failed), oldest first, batch after batch until none is left or `budgetMs` is
  * spent, and delete the delivered ones. Each row is delivered on its own: one that fails
  * (Restate refuses it, or a Runtime that does not know a wake's reason) is tried again later,
- * with backoff, so it never holds back the rows behind it, and after `MAX_OUTBOX_ATTEMPTS`
+ * with backoff, so it never holds back the rows behind it, and after `sweep.outboxAttempts`
  * failures it is parked: logged once, at error, and kept in the outbox for an operator. A
  * parked wake's session is still re-woken by the orphan scan while it is runnable, and a
  * parked sandbox signal's pod by the stale pod check. A row the Tenant declines (it is

package/dist/tenant/sweep.js

@@ -8,19 +8,19 @@
  *    a delivery after commit that failed, or that a crash between the commit and the send cut
  *    off. The first pass on this process takes every row, so a previous process's are not
  *    left waiting; later passes take those whose delivery after commit failed and those older
- *    than `OUTBOX_GRACE_MS` (the database's clock), batch after batch within
- *    `DRAIN_BUDGET_MS`. Each row carries the idempotency key it was first sent with, so a
+ *    than `sweep.outboxGraceMs` (Host tuning) (the database's clock), batch after batch within
+ *    `sweep.drainBudgetMs`. Each row carries the idempotency key it was first sent with, so a
  *    request the execution did accept before the crash, or one still being sent after its
  *    commit, runs once. Rows are delivered one by one: a row that fails is retried with
- *    backoff and parked after `MAX_OUTBOX_ATTEMPTS` (`deliverOutbox`), and no delivery fails
+ *    backoff and parked after `sweep.outboxAttempts` (`deliverOutbox`), and no delivery fails
  *    the step.
  * 2. **Linked agents.** Pending workflow `agent` effects whose linked turn already settled
  *    are completed and the workflow is woken. A linked turn's settle does both in its own
  *    transaction; this is the backstop for one that settle left pending, such as an effect
  *    an older Runtime wrote.
  * 3. **Orphaned sessions.** On this process's first pass for the Tenant, then at most every
- *    `ORPHAN_SCAN_MS`: `running` or `runnable` sessions with no owner, or an owner whose lease
- *    expired, are woken with reason `recover`, page by page within `DRAIN_BUDGET_MS`; a scan
+ *    `sweep.orphanScanMs`: `running` or `runnable` sessions with no owner, or an owner whose lease
+ *    expired, are woken with reason `recover`, page by page within `sweep.drainBudgetMs`; a scan
  *    the budget cut short goes on at the next pass. Neither a lost wake (step 1) nor a Worker
  *    that died mid-advance (the execution retries that advance, which takes over, §11.4)
  *    needs it: it is the backstop for what the execution itself lost or ended without an
@@ -34,7 +34,7 @@
  *    orphan scan, pod Environments whose change stalled get a reconcile (`reconcileStalePods`).
  *    Environments unused for their `lifecycle.deleteAfter` are deleted
  *    (`sweepUnusedEnvironments`).
- * 5. **Control signals.** Signals on the control bus older than `SIGNAL_RETENTION_MS` are
+ * 5. **Control signals.** Signals on the control bus older than `sweep.signalRetentionMs` are
  *    deleted: followers read back only the last two minutes (`store/postgres/control.ts`).
  * 6. **Hooks.** Callbacks registered with `ctx.onSweep`.
  *
@@ -46,27 +46,20 @@
 import { sweepUnusedEnvironments } from "./environments.js";
 import { sweepPendingSeeds } from "../artifacts/disk.js";
 import { pendingAgentEffects, reconcilePendingAgentEffect, } from "../core/flow-host.js";
-const BATCH = 100;
-/** How long a control signal is kept after it was written. */
-const SIGNAL_RETENTION_MS = 60 * 60 * 1000;
-/**
- * How old an outbox row is before the sweep delivers it, unless its delivery after commit
- * already failed (then it is due at once): longer than that delivery can take with its
- * retries, so the sweep does not send again, and double the load on, an execution that is
- * only slow. Sending one twice is harmless either way (the idempotency key).
- */
-export const OUTBOX_GRACE_MS = 30_000;
-/**
- * How often the orphan scan, and the stale pod sandbox check, run after the first pass of a
- * Tenant opened on this process.
- */
-export const ORPHAN_SCAN_MS = 60_000;
-/**
- * How long one pass may spend draining the outbox, and paging through orphaned sessions.
- * A backlog is worked off over several passes rather than holding one (and with it the
- * Tenant's sweep object in the execution) for long.
+import { hostTuning } from "../tuning.js";
+/*
+ * The sweep's timings are the Host tuning's `sweep` group (`tuning.ts`):
+ * - `outboxGraceMs`: how old an outbox row is before the sweep delivers it, unless its delivery
+ *   after commit already failed (then it is due at once): longer than that delivery can take with
+ *   its retries, so the sweep does not send again, and double the load on, an execution that is
+ *   only slow. Sending one twice is harmless either way (the idempotency key).
+ * - `orphanScanMs`: how often the orphan scan, and the stale pod sandbox check, run after the
+ *   first pass of a Tenant opened on this process.
+ * - `drainBudgetMs`: how long one pass may spend draining the outbox, and paging through
+ *   orphaned sessions. A backlog is worked off over several passes rather than holding one (and
+ *   with it the Tenant's sweep object in the execution) for long.
+ * - `batchSize`, `signalRetentionMs`, `outboxAttempts`, `outboxRetry`, `stalePodMs`.
  */
-export const DRAIN_BUDGET_MS = 2000;
 /**
  * Each open Tenant's sweep state on this process: when its last orphan scan finished, the
  * last session id of one that ran out of budget, which the next pass goes on from, and when
@@ -82,10 +75,10 @@ export async function sweep(ctx) {
     passes.set(ctx, pass);
     const scanOrphans = pass.orphansAt === undefined ||
         pass.orphansAfter !== undefined ||
-        now.getTime() - pass.orphansAt >= ORPHAN_SCAN_MS;
-    const checkPods = pass.podsAt === undefined || now.getTime() - pass.podsAt >= ORPHAN_SCAN_MS;
+        now.getTime() - pass.orphansAt >= hostTuning().sweep.orphanScanMs;
+    const checkPods = pass.podsAt === undefined || now.getTime() - pass.podsAt >= hostTuning().sweep.orphanScanMs;
     const steps = [
-        ["outbox", () => deliverOutbox(ctx, first ? 0 : OUTBOX_GRACE_MS)],
+        ["outbox", () => deliverOutbox(ctx, first ? 0 : hostTuning().sweep.outboxGraceMs)],
         ["linked", () => reconcileLinkedAgents(ctx)],
         ...(scanOrphans
             ? [
@@ -127,7 +120,7 @@ export async function sweep(ctx) {
         ["mcp", async () => ctx.mcp?.sweep()],
         [
             "signals",
-            () => ctx.store.tx((t) => t.pruneSignals(new Date(now.getTime() - SIGNAL_RETENTION_MS))),
+            () => ctx.store.tx((t) => t.pruneSignals(new Date(now.getTime() - hostTuning().sweep.signalRetentionMs))),
         ],
         ...[...ctx.sweepHooks].map((hook) => ["hook", hook]),
     ];
@@ -149,30 +142,26 @@ export async function sweep(ctx) {
     if (failure)
         throw failure.error;
 }
-/** Failed deliveries after which the sweep parks an outbox row (`Tx.failOutbox`). */
-export const MAX_OUTBOX_ATTEMPTS = 10;
-/** How long after its first failed delivery the sweep tries a row again; doubled each time. */
-const RETRY_MS = 5000;
-const RETRY_MAX_MS = 10 * 60_000;
 /**
  * Deliver the outbox rows that are due (`Tx.pendingOutbox`: older than `graceMs`, or whose
  * delivery failed), oldest first, batch after batch until none is left or `budgetMs` is
  * spent, and delete the delivered ones. Each row is delivered on its own: one that fails
  * (Restate refuses it, or a Runtime that does not know a wake's reason) is tried again later,
- * with backoff, so it never holds back the rows behind it, and after `MAX_OUTBOX_ATTEMPTS`
+ * with backoff, so it never holds back the rows behind it, and after `sweep.outboxAttempts`
  * failures it is parked: logged once, at error, and kept in the outbox for an operator. A
  * parked wake's session is still re-woken by the orphan scan while it is runnable, and a
  * parked sandbox signal's pod by the stale pod check. A row the Tenant declines (it is
  * closing) stays as it is, and ends the drain. Never throws for a delivery; returns the rows
  * delivered.
  */
-export async function deliverOutbox(ctx, graceMs = 0, budgetMs = DRAIN_BUDGET_MS) {
+export async function deliverOutbox(ctx, graceMs = 0, budgetMs = hostTuning().sweep.drainBudgetMs) {
     const deadline = Date.now() + budgetMs;
     const delivered = [];
+    const batchSize = hostTuning().sweep.batchSize;
     for (;;) {
-        const pending = await ctx.store.tx((t) => t.pendingOutbox(graceMs, BATCH));
+        const pending = await ctx.store.tx((t) => t.pendingOutbox(graceMs, batchSize));
         const batch = [];
-        let done = pending.length < BATCH;
+        let done = pending.length < batchSize;
         try {
             for (const row of pending) {
                 if (Date.now() >= deadline) {
@@ -206,8 +195,11 @@ export async function deliverOutbox(ctx, graceMs = 0, budgetMs = DRAIN_BUDGET_MS
 /** Records a failed delivery of `row`: retried with backoff, parked after the last attempt. */
 async function failed(ctx, row, error) {
     const attempts = row.attempts + 1;
-    const park = attempts >= MAX_OUTBOX_ATTEMPTS;
-    const retryInMs = Math.min(RETRY_MS * 2 ** (attempts - 1), RETRY_MAX_MS);
+    // Parked after `sweep.outboxAttempts` failed deliveries (`Tx.failOutbox`); tried again after
+    // `outboxRetry.minMs`, doubled each time.
+    const { outboxAttempts, outboxRetry } = hostTuning().sweep;
+    const park = attempts >= outboxAttempts;
+    const retryInMs = Math.min(outboxRetry.minMs * 2 ** (attempts - 1), outboxRetry.maxMs);
     await ctx.store.tx((t) => t.failOutbox(row, { retryInMs, park }));
     const { request } = row;
     const fields = {
@@ -235,29 +227,28 @@ export async function reconcileLinkedAgents(ctx) {
  * after `after`, until none is left or `budgetMs` is spent. Returns the ids woken, and the last
  * id when the budget ran out first (`next`, where the next scan goes on).
  */
-export async function wakeOrphanedSessions(ctx, now = new Date(), after, budgetMs = DRAIN_BUDGET_MS) {
+export async function wakeOrphanedSessions(ctx, now = new Date(), after, budgetMs = hostTuning().sweep.drainBudgetMs) {
     const deadline = Date.now() + budgetMs;
     const woken = [];
+    const batchSize = hostTuning().sweep.batchSize;
     let cursor = after;
     for (;;) {
-        const page = await ctx.store.tx((t) => t.orphanedSessions(now, BATCH, cursor));
+        const page = await ctx.store.tx((t) => t.orphanedSessions(now, batchSize, cursor));
         for (const session of page) {
             await ctx.wake(session.id, { reason: "recover" });
             woken.push(session.id);
             cursor = session.id;
         }
-        if (page.length < BATCH)
+        if (page.length < batchSize)
             return { woken };
         if (Date.now() >= deadline)
             return { woken, next: cursor };
     }
 }
-/** A pod sandbox in a change this long without a reconcile gets one from the sweep. */
-const STALE_POD_MS = 60_000;
 /**
  * Pod sandboxes (F7.2) whose change has not finished (creating, deleting, an old volume still
  * to delete, an expiry not yet recorded), or that should run but whose engine is not connected,
- * and whose row has not moved for a minute, get a reconcile: a pod or volume deleted outside
+ * and whose row has not moved for `sweep.stalePodMs` (a minute), get a reconcile: a pod or volume deleted outside
  * the Runtime is found, and a change goes on whose reconcile the execution itself lost (its
  * retry timer, an invocation an operator killed, Restate's state wiped) or whose outbox row
  * was parked. A reconcile a commit asked for is never lost: it is in the outbox.
@@ -267,7 +258,7 @@ async function reconcileStalePods(ctx, now) {
         return;
     const stale = await ctx.store.tx(async (t) => (await t.listEnvironments()).filter((row) => {
         const pod = row.pod;
-        if (!pod || now.getTime() - Date.parse(row.updatedAt) < STALE_POD_MS)
+        if (!pod || now.getTime() - Date.parse(row.updatedAt) < hostTuning().sweep.stalePodMs)
             return false;
         return (pod.desired === "deleted" ||
             pod.retiring !== undefined ||