@opengeni/worker-bundle 1.0.1 → 2.0.0

package/src/activities/agent-turn/governance-model.ts

@@ -21,9 +21,9 @@ import {
   type OpenGeniRuntime,
 } from "@opengeni/runtime";
 import { settingsWithResolvedModelContext, type Settings } from "@opengeni/config";
+import { projectReasoningConfigurations, supportsReasoningConfiguration } from "@opengeni/codex";
 import { settingsWithSessionMcpServersForRun } from "../capabilities";
 import { resolveRigProviderImageForRun } from "@opengeni/core";
-import { resolveWorkspacePackRuntime, settingsWithPackSandboxImage } from "../packs";
 import { createModelHistoryAttachmentProjector } from "../run-input";
 import type {
   TurnActivityServices as ActivityServices,
@@ -84,7 +84,6 @@ export type GovernanceModelDeps = {
 
 export type GovernanceModelOk = {
   runtimePreparationStartedAt: number;
-  packRuntime: Awaited<ReturnType<typeof resolveWorkspacePackRuntime>>;
   rigVersion:
     | NonNullable<Awaited<ReturnType<typeof materializeRigVersionForAttempt>>>["version"]
     | null;
@@ -189,17 +188,15 @@ export async function prepareGovernanceAndModel(
     attemptId: input.attemptId,
     executionGeneration: turn.executionGeneration,
   };
-  // Independent workspace reads after the personal-resource fence. Pack,
-  // installed skills, frozen rig, governance snapshots, and model policy do
+  // Independent workspace reads after the personal-resource fence. The
+  // frozen rig, governance snapshots, and model policy do
   // not depend on each other. Company-brain selection still waits on the
   // snapshots below so its receipt stays exact.
   const [
-    packRuntime,
     rigMaterialization,
     [workspace, companyProfileSnapshot, instructionPolicySnapshot, preferenceSnapshot],
     workspaceModelPolicy,
   ] = await Promise.all([
-    resolveWorkspacePackRuntime(db, input.workspaceId),
     session.rigId && session.rigVersionId
       ? (async () =>
           await materializeRigVersionForAttempt(db, {
@@ -280,14 +277,7 @@ export async function prepareGovernanceAndModel(
     // Contribution telemetry must never change model execution semantics.
   }
   // A Rig is always a setup/check layer over the deployment platform sandbox.
-  // The pre-v2 Pack image path remains only for rig-less compatibility sessions.
-  const logicalSandboxSettings = rigVersion
-    ? capabilitySettings
-    : settingsWithPackSandboxImage(
-        capabilitySettings,
-        packRuntime.sandboxImage,
-        packRuntime.sandboxProviderImages,
-      );
+  const logicalSandboxSettings = capabilitySettings;
   const providerImageSelection = await resolveRigProviderImageForRun(
     logicalSandboxSettings,
     rigVersion,
@@ -299,9 +289,8 @@ export async function prepareGovernanceAndModel(
       ? (providerImageSelection.imageId ?? undefined)
       : undefined;
   const baseRunSettings = {
-    // IMAGE PRECEDENCE: a Rig uses the deployment platform base; a rig-less
-    // pre-v2 Pack may retain its compatibility image. A matching verified
-    // provider-native ID is then applied only to fresh creation without
+    // A Rig uses the deployment platform base. A matching verified
+    // provider-native ID is applied only to fresh creation without
     // changing the logical lease image.
     ...providerImageSettings,
     openaiModel: turn.model,
@@ -365,12 +354,20 @@ export async function prepareGovernanceAndModel(
         fileIds,
       }),
   );
+  const useReasoningUpdates =
+    runSettings.reasoningConfigurationUpdatesEnabled &&
+    providerApi === "responses" &&
+    (resolvedModel?.provider.id === "codex" || resolvedModel?.provider.id === "openai") &&
+    supportsReasoningConfiguration(turnExecutionPolicy.upstreamModelId, turn.reasoningEffort);
   const modelHistoryProjector = async (
     items: Array<Record<string, unknown>>,
     projectionOptions?: Parameters<typeof attachmentProjector>[1],
   ) =>
     projectModelInputForCapabilities(
-      await attachmentProjector(items, projectionOptions),
+      projectReasoningConfigurations(
+        await attachmentProjector(items, projectionOptions),
+        useReasoningUpdates,
+      ),
       modelInputPolicy,
     );
   const generatedImageHistoryProjector = async (
@@ -460,7 +457,6 @@ export async function prepareGovernanceAndModel(
   return {
     ok: {
       runtimePreparationStartedAt,
-      packRuntime,
       rigVersion,
       rigName,
       agentHumanInputEnabled,

package/src/activities/agent-turn/history.ts

@@ -1,5 +1,6 @@
 import {
   normalizeProtocolJsonValue,
+  TURN_OPERATIONAL_NOTICE_PREFIX,
   sanitizeHistoryItemsForModel,
   toolCallIdFromSdkItem,
 } from "@opengeni/runtime";
@@ -31,15 +32,20 @@ export function historyRowsToAppend(
   }
   // Canonical model-facing inputs (including machine-input batches) are
   // persisted before inference and therefore live inside the prefix represented
-  // by persistedHistoryCount. System messages synthesized only for this
-  // attempt—recovery diagnostics, credential notices, attachment materialization
-  // notes—must not accidentally become conversation memory during reconciliation.
-  // Advance the in-memory watermark past them, but only allocate durable
-  // positions to actual model/tool output.
+  // by persistedHistoryCount. Explicitly turn-scoped operational notices remain
+  // at their original positions: deleting them rewrites the model-visible prefix
+  // on the next turn and during compaction. Unscoped synthetic system messages
+  // still cannot silently become permanent conversation instructions.
   const rows: Array<{ position: number; item: Record<string, unknown> }> = [];
   for (const [offset, item] of modelReady.slice(persistedHistoryCount).entries()) {
     if (item.type === "message" && item.role === "system") {
-      continue;
+      const content =
+        typeof item.content === "string"
+          ? item.content
+          : Array.isArray(item.content)
+            ? item.content.map((part: { text?: string }) => part.text ?? "").join("")
+            : "";
+      if (!content.startsWith(TURN_OPERATIONAL_NOTICE_PREFIX)) continue;
     }
     rows.push({
       position: nextPosition + rows.length,
@@ -149,10 +155,18 @@ export function pendingToolCallFromSdkEvent(event: unknown): {
     return null;
   }
   const raw = item.rawItem as Record<string, unknown>;
-  // The hosted image call is a complete provider fact carried by one item; it
-  // never receives a separate function result and therefore must not enter the
-  // pending function-call ledger.
-  if (raw.type === "hosted_tool_call" && raw.name === "image_generation_call") return null;
+  // Provider-executed search/image calls carry their outcome in this item,
+  // not a later function result. Registering them as pending leaves an
+  // impossible receipt behind even after the turn completes. Hosted MCP
+  // approval requests are different: they still require a response.
+  const providerData = raw.providerData as Record<string, unknown> | undefined;
+  if (
+    raw.type === "hosted_tool_call" &&
+    raw.name !== "mcp_approval_request" &&
+    providerData?.type !== "mcp_approval_request" &&
+    (raw.status === "completed" || raw.name === "image_generation_call")
+  )
+    return null;
   const callId = toolCallIdFromSdkItem(raw) ?? raw.id;
   const callType = raw.type;
   if (typeof callId !== "string" || callId.length === 0 || typeof callType !== "string") {

package/src/activities/agent-turn/quiescence.ts

@@ -198,13 +198,16 @@ export async function drainAttemptOwnedSandboxWriters(input: {
   gitCredentialRenewals: readonly Pick<GitCredentialRenewalController, "stop">[];
   codemodeTokenRenewal: Pick<CodemodeTokenRenewalController, "stop"> | null;
   runCredentialRenewal: Pick<RunCredentialRenewalController, "stop"> | null;
+  onStage?: (stage: "tool_writers" | "credential_renewals") => void;
 }): Promise<void> {
+  input.onStage?.("tool_writers");
   if (input.toolCancellationFence) {
     input.toolCancellationFence.cancel(
       input.cancellationReason ?? new Error("TURN_ATTEMPT_FENCED"),
     );
     await input.toolCancellationFence.waitForQuiescence();
   }
+  input.onStage?.("credential_renewals");
   await Promise.all(input.gitCredentialRenewals.map(async (renewal) => await renewal.stop()));
   await input.codemodeTokenRenewal?.stop();
   await input.runCredentialRenewal?.stop();

package/src/activities/agent-turn/recovery-warning.ts

@@ -0,0 +1,18 @@
+import { getSandboxRecoveryDiscontinuity, type Database } from "@opengeni/db";
+
+/** Opt-in belongs to this warning-aware worker implementation, not the DB
+ * client, role defaults or deployment configuration. Claim stamps it locally. */
+export const FILESYSTEM_DISCONTINUITY_PROTOCOL = 1 as const;
+
+export async function recoveryAwareSessionInstructions(
+  db: Database,
+  workspaceId: string,
+  session: { id: string; instructions?: string | null },
+): Promise<string> {
+  const filesystemDiscontinuity = await getSandboxRecoveryDiscontinuity(
+    db,
+    workspaceId,
+    session.id,
+  );
+  return [session.instructions, filesystemDiscontinuity].filter(Boolean).join("\n\n");
+}

package/src/activities/agent-turn/run-credentials.ts

@@ -287,13 +287,10 @@ export async function prepareRunCredentials(deps: PrepareRunCredentialsDeps) {
   // provider may supply it; unset still self-mints GitHub from settings.
   // gitToken/gitTokens are undefined on the selfhosted skip path (the machine
   // uses its own git creds).
-  // Git and MCP credentials share one lineage snapshot for this turn. A
-  // host that supplies both ports must never see two independently resolved
-  // roots for the same execution merely because the call sites are far apart.
+  // Git credential providers share one lineage snapshot for this turn.
+  // MCP access uses the native accepted connection context independently.
   const needsHostCredentialRoot = Boolean(
-    connectionCredentials?.gitCredentials ||
-    personalGitHubCredentials ||
-    connectionCredentials?.mcpCredentials,
+    connectionCredentials?.gitCredentials || personalGitHubCredentials,
   );
   const hostCredentialRootSessionId = needsHostCredentialRoot
     ? await getSessionRootId(db, input.workspaceId, input.sessionId)
@@ -748,7 +745,6 @@ export async function prepareRunCredentials(deps: PrepareRunCredentialsDeps) {
     initialRunCredentialMaterial,
     runCredentialsNote,
     authorizeGitHubTokenMint,
-    hostCredentialRootSessionId,
     gitCredentialAuthority,
     codemodeAuthority,
     sandboxArtifactRuntime,

package/src/activities/agent-turn/run.ts

@@ -1,5 +1,5 @@
+import { getSessionAuthorityProjection } from "@opengeni/db";
 import { createKnowledgeSourceSyncActivities } from "../knowledge-source-sync";
-import { prepareTurnKnowledgeSources } from "./knowledge-sources";
 import {
   assertModelConnectionAllowsTurn,
   freezeAgentLearningPolicy,
@@ -11,7 +11,11 @@ import {
   getMaterializedSandboxFileResources,
   markSandboxFileResourcesMaterialized,
 } from "@opengeni/db";
-import { sandboxOperationMetricObserver } from "@opengeni/observability";
+import {
+  sandboxOperationMetricObserver,
+  turnExecutionTelemetryKey,
+  withTraceContext,
+} from "@opengeni/observability";
 import {
   REMOTE_COMPACTION_V2_BETA_FEATURE,
   REMOTE_COMPACTION_V2_IMPLEMENTATION,
@@ -152,7 +156,11 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
   // final model checkpoint happens while the activity still owns its complete
   // turn graph and must not suppress collection after that graph is released.
   const turnCompletionMemoryCollector = createModelCheckpointMemoryCollector();
-  return async function runAgentTurn(input: RunAgentTurnInput): Promise<RunAgentTurnResult> {
+  const runAgentTurn = async (
+    input: RunAgentTurnInput,
+    resolvedServices: ActivityServices,
+    activitySpan: ReturnType<ActivityServices["observability"]["startSpan"]>,
+  ): Promise<RunAgentTurnResult> => {
     const {
       settings,
       catalogSourceSettings = settings,
@@ -169,7 +177,7 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
       connectionCredentials,
       personalGitHubCredentials,
       startVideoGenerationWorkflow,
-    } = await services();
+    } = resolvedServices;
     const activityContext = currentActivityContext();
     const cancellationSignal = activityContext?.cancellationSignal;
     // Temporal cancellation is not the only way an activity loses ownership:
@@ -207,11 +215,6 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
     });
     const dispatchId = activityContext?.info.activityId ?? randomUUID();
     const activityStarted = performance.now();
-    const activitySpan = observability.startSpan("worker.run_agent_segment", {
-      "opengeni.session_id": input.sessionId,
-      "opengeni.workflow_id": input.workflowId,
-      "opengeni.trigger_kind": input.trigger.kind,
-    });
     const acknowledgeLostAttemptOwnership = (): void => {
       // A stale terminal/recovery settlement can lose either to a benign
       // successor or to Pause/Steer closing this exact attempt. Only the
@@ -434,8 +437,26 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
           executionGeneration: attempt.executionGeneration,
         },
       });
+      const attachmentAuthority = await getSessionAuthorityProjection(
+        db,
+        input.workspaceId,
+        input.sessionId,
+      );
+      if (!attachmentAuthority) throw new Error("Session attachment authority unavailable");
       return await withSessionRlsActorContext(
         {
+          sessionAttachmentReadAccess: {
+            sessionId: input.sessionId,
+            authorityEpoch: attachmentAuthority.authorityEpoch,
+            actor: {
+              kind: "agent_attempt",
+              subjectId: "service:agent-turn",
+              callerSessionId: input.sessionId,
+              turnId: attempt.turnId,
+              attemptId: input.attemptId,
+              executionGeneration: attempt.executionGeneration,
+            },
+          },
           subjectId: "service:agent-turn",
           initiatingHumanSubjectId: fileAuthoritySubjectId,
           privateFileOwnerSubjectId:
@@ -511,7 +532,6 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
           });
           const {
             runtimePreparationStartedAt,
-            packRuntime,
             rigVersion,
             rigName,
             agentHumanInputEnabled,
@@ -556,6 +576,12 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
                     runSettings,
                     input.workspaceId,
                     providerTurn.effectiveCodexCredentialId ?? "",
+                    undefined,
+                    {
+                      turnId: turn.id,
+                      holderId: leases.codex.holderId!,
+                      generation: leases.codex.generation!,
+                    },
                   );
                   const resolveTrackedToken = async (
                     resolve: () => ReturnType<typeof resolver.getToken>,
@@ -1030,44 +1056,7 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
             knowledgeRecoveryNote =
               "[OpenGeni confirmation recovery unavailable] Do not assume an earlier remember confirmation was published. Inspect the current Knowledge or instruction review.";
           }
-          const attachmentPreparationNote = await prepareTurnKnowledgeSources({
-            settings: runSettings,
-            scope: {
-              accountId: input.accountId,
-              workspaceId: input.workspaceId,
-              sessionId: input.sessionId,
-              turnId: turn.id,
-              attemptId: input.attemptId,
-              executionGeneration: attempt.executionGeneration,
-            },
-            // Only attachments on this accepted turn are new source inputs.
-            // Session-level file receipts remain historical context and must
-            // never trigger metadata reads, downloads, or re-preparation.
-            resources: turn.resources,
-            selectedTools: session.firstPartyMcpTools,
-            permissions: session.firstPartyMcpPermissions,
-            learningMode: learning.effective.knowledge,
-            signal: cancellationSignal,
-            onOutcome: async (outcome) => {
-              if (outcome.status === "disabled") return;
-              await eventing.publish!(
-                [
-                  {
-                    type:
-                      outcome.status === "failed"
-                        ? "knowledge.source.failed"
-                        : "knowledge.source.prepared",
-                    payload: outcome,
-                  },
-                ],
-                true,
-              );
-            },
-          });
-
-          const knowledgeSourcePreparationNote =
-            [knowledgeRecoveryNote, attachmentPreparationNote].filter(Boolean).join("\n\n") ||
-            undefined;
+          const knowledgeSourcePreparationNote = knowledgeRecoveryNote;
 
           const sandboxRoute = await resolveSandboxRoute({
             input,
@@ -1148,7 +1137,6 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
             establishPolicy,
             initialRunCredentialMaterial,
             runCredentialsNote,
-            hostCredentialRootSessionId,
             codemodeAuthority,
             sandboxArtifactRuntime,
             sandboxEnvironment,
@@ -1268,7 +1256,6 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
           ];
           const toolRuntime = await prepareTurnToolRuntime({
             fetchKnowledgeSource: sourceActivities.runKnowledgeSourceSyncBatch,
-            selectedSkillActivations: packRuntime.skillActivations,
             input,
             catalogSourceSettings,
             db,
@@ -1277,7 +1264,6 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
             objectStorage,
             observability,
             cancellationSignal,
-            connectionCredentials,
             eventing,
             attempt,
             sandboxState,
@@ -1295,7 +1281,6 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
             lazyToolTransport,
             turnTools,
             connectionScope,
-            hostCredentialRootSessionId,
             sandboxArtifactRuntime,
             activeSandboxBackend,
             groupBoxBackend,
@@ -1771,4 +1756,35 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
       });
     }
   };
+  return async (input: RunAgentTurnInput): Promise<RunAgentTurnResult> => {
+    const resolvedServices = await services();
+    const correlationId = turnExecutionTelemetryKey(
+      input.workspaceId,
+      input.sessionId,
+      input.attemptId,
+    );
+    const span = resolvedServices.observability.startSpan(
+      "worker.run_agent_segment",
+      {
+        "opengeni.trigger_kind": input.trigger.kind,
+        correlationId,
+      },
+      { parent: null },
+    );
+    try {
+      return await withTraceContext(span, () => {
+        try {
+          resolvedServices.observability.info("worker execution started", { correlationId });
+        } catch {
+          // Correlation diagnostics never affect execution or admission.
+        }
+        return runAgentTurn(input, resolvedServices, span);
+      });
+    } catch (error) {
+      span.end({ error });
+      throw error;
+    } finally {
+      span.end();
+    }
+  };
 }

package/src/activities/agent-turn/sandbox-establish.ts

@@ -6,7 +6,10 @@ import {
   assertPersonalMachineForAttempt,
   type SandboxRecord,
 } from "@opengeni/db";
-import { sandboxOperationMetricObserver } from "@opengeni/observability";
+import {
+  sandboxOperationMetricObserver,
+  sandboxCaptureWaitMetricObserver,
+} from "@opengeni/observability";
 import {
   withRunCredentialsSession,
   runOwnedSandboxSetup,
@@ -29,7 +32,7 @@ import {
   type MintedRunGitCredentials,
   type SandboxCodemodeAuthority,
 } from "../environment";
-import { rigProviderImageSourceImage } from "../packs";
+import { rigProviderImageSourceImage } from "../sandbox-images";
 import type { TurnActivityServices as ActivityServices, RunAgentTurnInput } from "../types";
 import type { currentActivityContext } from "../streaming";
 import { resumeBoxForTurn, type ResumedTurnSandbox } from "../../sandbox-resume";
@@ -444,6 +447,7 @@ export async function establishTurnSandbox(deps: EstablishTurnSandboxDeps): Prom
             bus,
             onOp: machineOpObserver.observer,
             onSandboxOperation: sandboxOperationObserver,
+            onSandboxCaptureWait: sandboxCaptureWaitMetricObserver(observability),
             opJournal,
           },
           {
@@ -515,6 +519,7 @@ export async function establishTurnSandbox(deps: EstablishTurnSandboxDeps): Prom
               opJournal,
               onOp: machineOpObserver.observer,
               onSandboxOperation: sandboxOperationObserver,
+              onSandboxCaptureWait: sandboxCaptureWaitMetricObserver(observability),
               onHomeSandboxRebound,
               ...(runtimeCancellationSignal ? { waitSignal: runtimeCancellationSignal } : {}),
             },
@@ -755,6 +760,7 @@ export async function establishTurnSandbox(deps: EstablishTurnSandboxDeps): Prom
               bus,
               opJournal,
               onSandboxOperation: sandboxOperationObserver,
+              onSandboxCaptureWait: sandboxCaptureWaitMetricObserver(observability),
               onHomeSandboxLost: publishSandboxLost,
               onHomeSandboxRebound,
               ...(runtimeCancellationSignal ? { waitSignal: runtimeCancellationSignal } : {}),
@@ -1004,6 +1010,7 @@ export async function bindLazySandboxProvisioner(
                 {
                   settings: runSettings,
                   environment: sandboxEnvironment,
+                  recordLazyManifest: true,
                   onRuntimeEvent: async (event) => {
                     await eventing.publish?.([{ type: event.type, payload: event.payload }], true);
                   },
@@ -1122,6 +1129,7 @@ export async function bindLazySandboxProvisioner(
         opJournal,
         onOp: machineOpObserver.observer,
         onSandboxOperation: sandboxOperationObserver,
+        onSandboxCaptureWait: sandboxCaptureWaitMetricObserver(observability),
         onHomeSandboxLost: publishSandboxLost,
         onHomeSandboxRebound,
         ...(runtimeCancellationSignal ? { waitSignal: runtimeCancellationSignal } : {}),

package/src/activities/agent-turn/sandbox-route.ts

@@ -268,15 +268,6 @@ export async function reconcileActiveSandboxPointer(
   return { pointer: reread, record: rereadRecord };
 }
 
-/**
- * Warm the Modal private-registry image for the image ref this turn actually
- * resolved, not only the deployment-global OPENGENI_MODAL_IMAGE_REF warmed at
- * worker boot. A provider-native modalImageId bypasses registry import and is
- * resolved by ModalImageSelector.fromId during create. Otherwise packs can
- * override `modalImageRef` per workspace/turn, so a private pack image must be
- * resolved before sandbox creation or Modal falls back to the unauthenticated
- * `fromTag` path.
- */
 export async function ensureTurnModalRegistryImage(
   runSettings: Settings,
   sandboxCreationBackend: Settings["sandboxBackend"] | undefined,
@@ -302,17 +293,6 @@ export type SandboxArtifactRuntimeAdmission = Readonly<{
   environment: Readonly<Record<string, string>>;
 }>;
 
-/**
- * Admit the optional native standalone-file runtime only for the deployment's
- * exact base sandbox image contract. A pack/rig image override is an
- * independent filesystem and therefore fails closed even when the deployment
- * base image is capable. Collaborative artifact skills are admitted separately
- * from the frozen canonical tool catalog.
- *
- * This keeps lazy provisioning intact: CI/release proves the image closure,
- * while a before-agent-start doctor verifies the actual box before any model
- * call. No speculative sandbox is created merely to populate the skill index.
- */
 export function sandboxArtifactRuntimeAdmission(
   deploymentSettings: Settings,
   runSettings: Settings,

package/src/activities/agent-turn/sandbox-runtime.ts

@@ -8,6 +8,7 @@ import {
 } from "@opengeni/db";
 import {
   RoutingMutationOutcomeUnknownError,
+  runManagedCodemodeClientHook,
   type EstablishedSandboxSession,
 } from "@opengeni/runtime";
 import {
@@ -18,7 +19,10 @@ import {
 import { createRuntimeBatcher, currentActivityContext } from "../streaming";
 import type { TurnActivityServices as ActivityServices, RunAgentTurnInput } from "../types";
 import { maybePersistWarmWorkspaceSnapshot, type ResumedTurnSandbox } from "../../sandbox-resume";
-import { recordCreditMicros } from "../../observability-metrics";
+import {
+  recordCreditMicros,
+  runtimeMetricsHooksForObservability,
+} from "../../observability-metrics";
 import { ChannelAPartialMutationError } from "@opengeni/runtime/sandbox";
 
 import { safeErrorDiagnostic } from "./errors";
@@ -124,16 +128,37 @@ export function createSandboxTurnRuntime(deps: SandboxTurnRuntimeDeps) {
   // alive. Keep setup/snapshot persistence on the rebound raw session while
   // preserving the SDK-owned routing proxy for eager turns. Lazy turns hold the
   // proxy separately, so their worker-side handle may replace its raw session.
-  const onHomeSandboxRebound = (rebound: {
+  const onHomeSandboxRebound = async (rebound: {
     established: EstablishedSandboxSession;
     leaseEpoch: number;
-  }): void => {
+  }): Promise<void> => {
     const current = sandboxState.resolvedSandbox;
+    if (!current) throw new Error("Home sandbox rebound before turn sandbox admission");
+    if (
+      rebound.established.backendId !== "selfhosted" &&
+      rebound.established.instanceId !== current.established.instanceId
+    ) {
+      // An older archive may lack this worker release's selected client. Only
+      // prepare that client, never replay turn-start hooks/credentials/resources.
+      // Fence the replacement itself, not the stale turn-start handle. Both
+      // mutation admission and settlement precede raw-state/route publication.
+      const commandFence = eventing.toolCancellationFenceRef.current;
+      await runWorkspaceMutationForSandbox(
+        { ...current, established: rebound.established, leaseEpoch: rebound.leaseEpoch },
+        "homeSandboxClientPreparation",
+        () =>
+          runManagedCodemodeClientHook(rebound.established.session as never, {
+            environment: {},
+            ...(commandFence
+              ? { commandRunner: commandFence.runSandboxCommand.bind(commandFence) }
+              : {}),
+          }),
+      );
+    }
     const previousSession = current?.established.session;
     const preserveRoutingProxy =
       current !== null && previousSession !== sandboxState.setupBoxSession;
     sandboxState.setupBoxSession = rebound.established.session;
-    if (!current) return;
     current.leaseEpoch = rebound.leaseEpoch;
     current.established = preserveRoutingProxy
       ? {
@@ -539,8 +564,10 @@ export function createSandboxTurnRuntime(deps: SandboxTurnRuntimeDeps) {
       // MID-SESSION snapshot (sandbox-file-persistence): while the turn holds
       // the box, fold a fresh /workspace snapshot onto the lease every
       // sandboxSnapshotIntervalMs, so a box death the reaper never sees
-      // (Modal hard timeout mid-busy, OOM, infra) costs at most one interval
-      // of work — a legit multi-day turn is otherwise completely unprotected
+      // (Modal hard timeout mid-busy, OOM, infra) has a recent recovery point
+      // when capture succeeds. This interval is not a maximum recovery-point
+      // age: live writers and failed captures can defer publication. A legit
+      // multi-day turn is otherwise completely unprotected
       // (the reaper only drain-persists IDLE leases). Uses the UN-proxied box
       // session (setupBoxSession): the routing veneer could swap mid-op and a
       // selfhosted target has no persistWorkspace anyway. Best-effort +
@@ -558,7 +585,13 @@ export function createSandboxTurnRuntime(deps: SandboxTurnRuntimeDeps) {
         })
       ) {
         const snapshot = maybePersistWarmWorkspaceSnapshot(
-          { db, settings, objectStorage },
+          {
+            db,
+            settings,
+            objectStorage,
+            sandboxMetrics: runtimeMetricsHooksForObservability(observability),
+            observability,
+          },
           {
             accountId: input.accountId,
             workspaceId: input.workspaceId,

package/src/activities/agent-turn/skill-remove.ts

@@ -0,0 +1,46 @@
+import type { AttemptToolDefinition } from "@opengeni/codemode";
+import { z } from "zod";
+import type { SkillWriteReceipt } from "@opengeni/contracts";
+
+export const SkillRemoveRequest = z
+  .object({
+    operationId: z.uuid(),
+    skillId: z.uuid(),
+    expectedRevisionId: z.uuid().nullable(),
+    expectedScopeVersion: z.number().int().positive(),
+    reason: z.string().min(1).max(2000),
+  })
+  .strict();
+
+export function createSkillRemoveAttemptToolDefinition(input: {
+  authorize: () => Promise<void>;
+  remove: (request: z.infer<typeof SkillRemoveRequest>) => Promise<SkillWriteReceipt>;
+}): AttemptToolDefinition {
+  return {
+    identity: { serverId: "opengeni", toolName: "skill_remove" },
+    modelName: "skill_remove",
+    codemodePath: ["opengeni", "skill_remove"],
+    title: "Permanently remove Skill",
+    description:
+      "Permanently delete a saved Skill and ALL its stored revisions, not a recoverable hide. Conversations remain unchanged. Read the exact Skill first; supply its current active revision and scope version. Built-in, repository and inline session Skills cannot be removed. Automatic applies deletion; Review first retains an explicitly labeled deletion proposal for human review in Knowledge > Needs review; Off refuses changes. Reuse the same operationId and exact arguments after an uncertain result. Never report a pending proposal as deleted.",
+    inputSchema: JSON.parse(JSON.stringify(z.toJSONSchema(SkillRemoveRequest))),
+    annotations: {
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: true,
+      openWorldHint: false,
+    },
+    source: "opengeni",
+    approval: "none",
+    execute: async (args) => {
+      await input.authorize();
+      const output = await input.remove(SkillRemoveRequest.parse(args));
+      const text = JSON.stringify(output);
+      return {
+        isError: false,
+        content: [{ type: "text", text }],
+        structuredContent: JSON.parse(text),
+      };
+    },
+  };
+}