deepline 0.1.200 → 0.1.202

package/dist/bundling-sources/shared_libs/play-runtime/protocol.ts

@@ -32,12 +32,14 @@ export type PlayRunnerRateStateAcquireInput = {
 export type PlayRunnerRateStateAcquireResult = {
   granted: number;
   waitMs: number;
+  /** One independently-expiring concurrency reservation per granted permit. */
+  leaseIds?: string[];
 };
 
 export type PlayRunnerRateStateReleaseInput = {
   bucketId: string;
   rules: PacingRule[];
-  count: number;
+  leaseIds: string[];
   schedulerSchema?: string | null;
 };
 
@@ -47,6 +49,23 @@ export type PlayRunnerRateStatePenalizeInput = {
   schedulerSchema?: string | null;
 };
 
+export type PlayRunnerBudgetCharge = {
+  key: string;
+  amount: number;
+  limit: number;
+};
+
+export type PlayRunnerBudgetChargeInput = {
+  rootRunId: string;
+  reservationId: string;
+  charges: PlayRunnerBudgetCharge[];
+  schedulerSchema?: string | null;
+};
+
+export type PlayRunnerBudgetChargeResult = {
+  counters: Record<string, number>;
+};
+
 export interface PlayRunnerContextConfig {
   executorToken?: string;
   baseUrl?: string;
@@ -70,7 +89,7 @@ export interface PlayRunnerContextConfig {
    * dispatch; `sandbox_public_key` means the runner mints missing sessions
    * through the app runtime API with a per-request public key.
    */
-  dbSessionStrategy?: 'preloaded' | 'sandbox_public_key';
+  dbSessionStrategy?: 'preloaded' | 'sandbox_public_key' | 'gateway_only';
   /**
    * Short-lived scoped Postgres sessions minted by the worker before the runner
    * starts. They are only an initial fast path: the runner still renews through
@@ -78,6 +97,18 @@ export interface PlayRunnerContextConfig {
    * exact-enough match for the requested play/table/operation scope.
    */
   preloadedDbSessions?: PreloadedRuntimeDbSession[];
+  /**
+   * Secret that decrypts `preloadedDbSessions` postgres URLs. The preloaded
+   * sessions are AES-GCM sealed at submit time with the run's original executor
+   * (authority) token, whose string is the key material. Durable schedulers
+   * re-mint a fresh per-attempt executor token (with `run_attempt`/capabilities
+   * claims) for API auth, which changes the token string and would break unwrap
+   * if used as the decryption key. This field pins the stable submit-time secret
+   * so unwrap always uses the exact token that encrypted the sessions,
+   * independent of per-attempt re-minting. Absent means fall back to
+   * `executorToken` (legacy/no-remint paths where they are equal).
+   */
+  postgresSessionUnwrapKey?: string | null;
   rateStateBackend?: PlayRunnerRateStateBackendConfig;
   runtimeSchedulerSchema?: string | null;
   /**
@@ -87,6 +118,13 @@ export interface PlayRunnerContextConfig {
    * of defaulting away from the parent scheduler. Absent means `absurd`.
    */
   childRunProfile?: string | null;
+  /**
+   * The parent worker's absurd release lane id. Posted as the
+   * `x-deepline-absurd-release` header on child `ctx.runPlay` launches so the
+   * child pins to the parent's lane (defense-in-depth). Absent off the absurd
+   * path or on a pre-release parent.
+   */
+  absurdReleaseId?: string | null;
   governance?: GovernanceSnapshot | null;
 }
 

package/dist/bundling-sources/shared_libs/play-runtime/receipt-completion-sink.ts

@@ -40,6 +40,11 @@ interface PendingReceiptCompletion<TInput, TOutput> {
   reject: (error: unknown) => void;
 }
 
+type CapacityWaiter = {
+  resolve: () => void;
+  reject: (error: unknown) => void;
+};
+
 function normalizePositiveInteger(
   value: number | undefined,
   fallback: number,
@@ -81,10 +86,14 @@ export class RuntimeReceiptCompletionSink<TInput, TOutput> {
   readonly maxInputBytes: number;
 
   #pending: Array<PendingReceiptCompletion<TInput, TOutput>> = [];
-  #pendingBytes = 0;
+  #pendingHead = 0;
+  /** Pending plus in-flight bytes. Released only after transport settles. */
+  #residentBytes = 0;
+  #capacityWaiters: CapacityWaiter[] = [];
   #flushTimer: ReceiptCompletionSinkTimer | null = null;
   #flushPromise: Promise<void> | null = null;
   #closed = false;
+  #failure: Error | null = null;
   #completeMany: (inputs: TInput[]) => Promise<TOutput[]>;
   #estimateBytes: (input: TInput) => number;
   #onFlushStart?: (event: ReceiptCompletionSinkFlushEvent) => void;
@@ -124,20 +133,16 @@ export class RuntimeReceiptCompletionSink<TInput, TOutput> {
     return this.addMany([input]).then((outputs) => outputs[0]!);
   }
 
-  addMany(inputs: readonly TInput[]): Promise<TOutput[]> {
+  async addMany(inputs: readonly TInput[]): Promise<TOutput[]> {
     if (inputs.length === 0) return Promise.resolve([]);
-    if (this.#closed) {
-      return Promise.reject(
-        new Error('Runtime receipt completion sink is already closed.'),
-      );
-    }
-
-    const outputPromises = inputs.map((input) => this.#enqueue(input));
+    this.#throwIfUnavailable();
+    const outputPromises = inputs.map((input) => this.#admit(input));
     this.#scheduleFlush();
-    return Promise.all(outputPromises);
+    return await Promise.all(outputPromises);
   }
 
   async flush(): Promise<void> {
+    if (this.#failure) throw this.#failure;
     this.#clearFlushTimer();
     this.#flushPromise ??= this.#runFlushLoop().finally(() => {
       this.#flushPromise = null;
@@ -147,18 +152,19 @@ export class RuntimeReceiptCompletionSink<TInput, TOutput> {
 
   async close(): Promise<void> {
     this.#closed = true;
+    this.#wakeCapacityWaiters();
     await this.flush();
   }
 
   getStats(): { pending: number; pendingBytes: number; flushing: boolean } {
     return {
-      pending: this.#pending.length,
-      pendingBytes: this.#pendingBytes,
+      pending: this.#pendingCount(),
+      pendingBytes: this.#residentBytes,
       flushing: Boolean(this.#flushPromise),
     };
   }
 
-  #enqueue(input: TInput): Promise<TOutput> {
+  async #admit(input: TInput): Promise<TOutput> {
     const bytes = Math.max(1, Math.ceil(this.#estimateBytes(input)));
     if (bytes > this.maxInputBytes) {
       return Promise.reject(
@@ -167,25 +173,32 @@ export class RuntimeReceiptCompletionSink<TInput, TOutput> {
         ),
       );
     }
-
-    if (
-      this.#pending.length >= this.maxBatchSize ||
-      this.#pendingBytes + bytes > this.maxBufferedBytes
-    ) {
+    if (bytes > this.maxBufferedBytes) {
+      throw new ReceiptCompletionBufferLimitError(
+        `Runtime receipt completion payload is ${bytes} bytes, above the ${this.maxBufferedBytes} byte sink capacity.`,
+      );
+    }
+    while (this.#residentBytes + bytes > this.maxBufferedBytes) {
+      this.#throwIfUnavailable();
       void this.flush().catch(() => undefined);
+      await new Promise<void>((resolve, reject) => {
+        this.#capacityWaiters.push({ resolve, reject });
+      });
     }
-
-    return new Promise<TOutput>((resolve, reject) => {
+    this.#throwIfUnavailable();
+    this.#residentBytes += bytes;
+    const completion = new Promise<TOutput>((resolve, reject) => {
       this.#pending.push({ input, bytes, resolve, reject });
-      this.#pendingBytes += bytes;
-      if (this.#pending.length >= this.maxBatchSize) {
+      if (this.#pendingCount() >= this.maxBatchSize) {
         void this.flush().catch(() => undefined);
       }
     });
+    this.#scheduleFlush();
+    return await completion;
   }
 
   #scheduleFlush(): void {
-    if (this.#flushTimer || this.#flushPromise || this.#pending.length === 0) {
+    if (this.#flushTimer || this.#flushPromise || this.#pendingCount() === 0) {
       return;
     }
     this.#flushTimer = setTimeout(() => {
@@ -201,28 +214,36 @@ export class RuntimeReceiptCompletionSink<TInput, TOutput> {
   }
 
   async #runFlushLoop(): Promise<void> {
-    while (this.#pending.length > 0) {
+    while (this.#pendingCount() > 0) {
       const batch = this.#takeBatch();
-      await this.#flushBatch(batch);
+      try {
+        await this.#flushBatch(batch);
+      } catch (error) {
+        this.#fail(error);
+        throw this.#failure;
+      }
     }
   }
 
   #takeBatch(): Array<PendingReceiptCompletion<TInput, TOutput>> {
     const batch: Array<PendingReceiptCompletion<TInput, TOutput>> = [];
     let batchBytes = 0;
-    while (this.#pending.length > 0 && batch.length < this.maxBatchSize) {
-      const next = this.#pending[0]!;
-      if (
-        batch.length > 0 &&
-        batchBytes + next.bytes > this.maxBufferedBytes
-      ) {
+    while (this.#pendingCount() > 0 && batch.length < this.maxBatchSize) {
+      const next = this.#pending[this.#pendingHead]!;
+      if (batch.length > 0 && batchBytes + next.bytes > this.maxBufferedBytes) {
         break;
       }
-      this.#pending.shift();
-      this.#pendingBytes -= next.bytes;
+      this.#pendingHead += 1;
       batch.push(next);
       batchBytes += next.bytes;
     }
+    if (
+      this.#pendingHead > 1_024 &&
+      this.#pendingHead * 2 >= this.#pending.length
+    ) {
+      this.#pending = this.#pending.slice(this.#pendingHead);
+      this.#pendingHead = 0;
+    }
     return batch;
   }
 
@@ -257,6 +278,44 @@ export class RuntimeReceiptCompletionSink<TInput, TOutput> {
         error,
       });
       throw error;
+    } finally {
+      this.#residentBytes = Math.max(0, this.#residentBytes - bytes);
+      this.#wakeCapacityWaiters();
+    }
+  }
+
+  #pendingCount(): number {
+    return this.#pending.length - this.#pendingHead;
+  }
+
+  #throwIfUnavailable(): void {
+    if (this.#failure) throw this.#failure;
+    if (this.#closed) {
+      throw new Error('Runtime receipt completion sink is already closed.');
+    }
+  }
+
+  #wakeCapacityWaiters(): void {
+    const waiters = this.#capacityWaiters;
+    this.#capacityWaiters = [];
+    for (const waiter of waiters) {
+      if (this.#failure) waiter.reject(this.#failure);
+      else if (this.#closed) {
+        waiter.reject(
+          new Error('Runtime receipt completion sink is already closed.'),
+        );
+      } else waiter.resolve();
+    }
+  }
+
+  #fail(error: unknown): void {
+    this.#failure =
+      error instanceof Error ? error : new Error(String(error ?? 'Unknown'));
+    while (this.#pendingCount() > 0) {
+      const pending = this.#pending[this.#pendingHead++]!;
+      this.#residentBytes = Math.max(0, this.#residentBytes - pending.bytes);
+      pending.reject(this.#failure);
     }
+    this.#wakeCapacityWaiters();
   }
 }

package/dist/bundling-sources/shared_libs/play-runtime/resource-governor.ts

@@ -3,6 +3,7 @@ import type { PlayExecutionGovernor, WorkLease } from './governor/governor';
 export type RuntimeResourceLease = WorkLease;
 
 export type RuntimeResourceObservation = {
+  toolId?: string | null;
   providerResourceKey?: string | null;
   rowEstimatedBytes?: number | null;
   rowAdmissionWaitMs?: number | null;
@@ -172,12 +173,19 @@ export function createRuntimeResourceGovernor(input: {
       }
       if (
         observation.providerSuccess === true &&
-        observation.providerResourceKey
+        (observation.toolId || observation.providerResourceKey)
       ) {
-        input.executionGovernor.observeProviderSuccess({
-          provider: observation.providerResourceKey,
-          latencyMs: observation.providerLatencyMs,
-        });
+        if (observation.toolId) {
+          input.executionGovernor.observeToolSuccess({
+            toolId: observation.toolId,
+            latencyMs: observation.providerLatencyMs,
+          });
+        } else {
+          input.executionGovernor.observeProviderSuccess({
+            provider: observation.providerResourceKey!,
+            latencyMs: observation.providerLatencyMs,
+          });
+        }
       }
     }
   };

package/dist/bundling-sources/shared_libs/play-runtime/run-ledger.ts

@@ -31,6 +31,32 @@ export type PlayRunLedgerEventSource =
   | 'coordinator'
   | 'system';
 
+/**
+ * Live progress for a single step/node.
+ *
+ * Verified producer semantics (workers_edge map executor —
+ * `apps/play-runner-workers/src/entry.ts`):
+ *
+ * - `completed` counts SUCCESSFULLY written rows ONLY, never failures/skips.
+ *   In-flight it is `min(total, totalRowsWritten + completedExecutedRows)`
+ *   where `completedExecutedRows` increments on success only (entry.ts:5635);
+ *   failures increment the separate `failedExecutedRows` (entry.ts:5684).
+ *   At map finalize it is set to `finalizedRowsWritten` (successes).
+ * - `failed` counts settled-but-failed rows (row-failure isolation persists
+ *   these; they re-execute on the next run).
+ * - `total` is the settled-row denominator. In-flight it is the row-count
+ *   estimate (`rowCountHint`); at map finalize it is reconciled to
+ *   `completed + failed` and CAN SHRINK from the initial estimate when rows are
+ *   filtered/skipped. So `total` is monotonic-up during flight but is corrected
+ *   down to the settled count at terminal.
+ *
+ * Terminal invariant: once the step is settled, `completed + failed === total`.
+ * Because `completed` is successes-only (NOT all-settled), readers must NOT
+ * assume `completed === total` at terminal — a truthful terminal render is
+ * `{total} rows` when `failed === 0`, else a `completed`/`failed`/`total`
+ * breakdown. See `settleRunningStepsOnTerminal` for why the reducer does not
+ * force `completed = total`.
+ */
 export type PlayRunLedgerStepProgress = {
   completed?: number;
   total?: number;
@@ -775,6 +801,23 @@ function retryablePlatformDeployFailureSnapshot(
   );
 }
 
+// Force-settles steps still marked `running` when the RUN reaches a terminal
+// status (the fallback for steps that never emitted their own step.completed,
+// e.g. a crash between the last progress bump and the terminal event). This
+// only flips status and stamps `completedAt`; it deliberately does NOT
+// reconcile `progress.completed` to `progress.total`.
+//
+// Why not reconcile: per PlayRunLedgerStepProgress semantics, `completed`
+// counts SUCCESSES ONLY, so `completed === total` is NOT a valid invariant at
+// terminal — a run can legitimately settle with failed/skipped rows (row-
+// failure isolation). Forcing `completed = total` here would fabricate
+// successes that never happened and falsify the persisted counts. The truthful
+// terminal counts are carried by the producer's final reconciled bump, which
+// the workers_edge finalize path now drains BEFORE emitting step.completed
+// (entry.ts finalize ordering invariant). This settle path is the last-resort
+// heal for the missing-final-bump case, where the honest thing is "we know it
+// stopped, we do not know it fully succeeded" — leave the last observed
+// counts, just mark it settled so the UI stops rendering a live ticker.
 function settleRunningStepsOnTerminal(
   snapshot: PlayRunLedgerSnapshot,
   status: Extract<PlayRunLedgerStepStatus, 'completed' | 'failed'>,

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/backends/daytona-lifecycle.ts

@@ -5,13 +5,26 @@ import type {
   PlayRunnerResult,
 } from '@shared_libs/play-runtime/protocol';
 import { shouldCleanupSandboxInBackground } from '@shared_libs/play-runtime/daytona-runtime-config';
+import { isIsolatedRuntimeSchedulerSchema } from '@shared_libs/play-runtime/runtime-scheduler-topology';
 
 const DAYTONA_CREATE_TIMEOUT_SECONDS = 10;
-const DAYTONA_CREATE_HEDGE_DELAYS_MS = [0, 200, 400, 700] as const;
-const DAYTONA_CREATE_ACQUIRE_TIMEOUT_MS = 3_500;
+const DAYTONA_CREATE_RETRY_DELAYS_MS = [0, 500, 1_500] as const;
 const DAYTONA_AUTO_STOP_INTERVAL_MINUTES = 5;
 const DAYTONA_AUTO_ARCHIVE_INTERVAL_MINUTES = 15;
 const DAYTONA_SANDBOX_LABEL_SOURCE = 'deepline-play-runner';
+// The hosted Daytona API pins sandbox resources to the creating snapshot: it
+// rejects create-time resource overrides for snapshot sandboxes (400 "Cannot
+// specify Sandbox resources when using a snapshot") and does not serve
+// POST /sandbox/:id/resize (404 "Cannot POST"). The resource boundary is
+// therefore the default snapshot's grant, verified against these pins after
+// create. If Daytona changes the default snapshot's resources, sandbox
+// acquisition fails loudly instead of silently running plays on a different
+// compute boundary; bump these pins deliberately when that happens.
+export const DAYTONA_SANDBOX_CPU = 1;
+export const DAYTONA_SANDBOX_MEMORY_GIB = 1;
+export const DAYTONA_SANDBOX_DISK_GIB = 3;
+export const DAYTONA_SANDBOX_GPU = 0;
+const DAYTONA_NETWORK_ALLOW_LIST_ENV = 'DEEPLINE_DAYTONA_NETWORK_ALLOW_LIST';
 
 export const DAYTONA_CANCELLED_ERROR = 'Daytona play runner cancelled';
 
@@ -35,7 +48,7 @@ export type OneShotDaytonaSandboxLifecycle = {
   dispose: () => Promise<void>;
 };
 
-type HedgedDaytonaCreateResult = {
+type DaytonaCreateResult = {
   sandbox: DaytonaSandbox;
   attempt: number;
   attemptElapsedMs: number;
@@ -64,6 +77,48 @@ export function validateDaytonaExecutionContext(
   return orgId;
 }
 
+/**
+ * Outbound-network policy for a one-shot sandbox. The invariant this protects:
+ * CUSTOMER code in PRODUCTION never runs with unrestricted egress — the
+ * production worker must provision `DEEPLINE_DAYTONA_NETWORK_ALLOW_LIST`
+ * (comma-separated CIDRs, per the Daytona `networkAllowList` contract) and
+ * every prod sandbox is created `networkBlockAll: true` + that allow-list.
+ *
+ * "Production" here is the RUN'S topology, not the build flag: a run whose
+ * scheduler schema is isolated (per-PR preview CI, per-worktree dev — see
+ * `isIsolatedRuntimeSchedulerSchema`) executes synthetic internal test plays
+ * against dynamic per-PR hosts (Vercel preview app, per-PR Fly gateway) whose
+ * IPs cannot be enumerated as stable CIDRs, so the allow-list requirement
+ * cannot apply there. `NODE_ENV=production` alone is the wrong key — the Fly
+ * worker image bakes it for BOTH prod and preview fleets (build optimization),
+ * which made every preview sandbox create fail. Fail-closed: an absent schema
+ * is the production topology, never "unknown".
+ *
+ * An explicitly provisioned allow-list is always honored (preview included),
+ * so a future preview fleet with enumerable egress can opt in to full parity.
+ */
+export function resolveDaytonaSandboxNetworkPolicy(input: {
+  runtimeSchedulerSchema: string | null | undefined;
+  env?: NodeJS.ProcessEnv;
+}): { networkAllowList: string | null } {
+  const env = input.env ?? process.env;
+  const networkAllowList = env[DAYTONA_NETWORK_ALLOW_LIST_ENV]?.trim() || null;
+  if (
+    !networkAllowList &&
+    env.NODE_ENV === 'production' &&
+    !isIsolatedRuntimeSchedulerSchema(input.runtimeSchedulerSchema)
+  ) {
+    throw new Error(
+      `${DAYTONA_NETWORK_ALLOW_LIST_ENV} is required for production runs. ` +
+        `Refusing to start customer code with unrestricted outbound network ` +
+        `access. Provision a comma-separated CIDR allow-list on the production ` +
+        `worker. (Isolated-schema runs — preview CI / worktrees — are exempt: ` +
+        `they execute synthetic internal plays against dynamic per-PR hosts.)`,
+    );
+  }
+  return { networkAllowList };
+}
+
 async function createOneShotDaytonaSandbox(input: {
   daytona: DaytonaClient;
   orgId: string;
@@ -86,6 +141,9 @@ async function createOneShotDaytonaSandbox(input: {
   if (workflowId) labels.workflowId = workflowId;
   if (playId) labels.playId = playId;
   if (runId) labels.runId = runId;
+  const { networkAllowList } = resolveDaytonaSandboxNetworkPolicy({
+    runtimeSchedulerSchema: input.context.runtimeSchedulerSchema ?? null,
+  });
 
   // Intentionally omit image/snapshot so Daytona uses its default fast sandbox
   // image; custom images would add build/pull tax to one-shot cold starts.
@@ -95,136 +153,60 @@ async function createOneShotDaytonaSandbox(input: {
       ephemeral: true,
       autoStopInterval: DAYTONA_AUTO_STOP_INTERVAL_MINUTES,
       autoArchiveInterval: DAYTONA_AUTO_ARCHIVE_INTERVAL_MINUTES,
+      ...(networkAllowList
+        ? {
+            networkBlockAll: true,
+            networkAllowList,
+          }
+        : {}),
     },
     { timeout: DAYTONA_CREATE_TIMEOUT_SECONDS },
   );
 }
 
-function cleanupLateDaytonaCreate(input: {
-  sandbox: DaytonaSandbox;
-  attempt: number;
-  emitStage: DaytonaStageEmitter;
-}): void {
-  void input.sandbox.delete(30).then(
-    () =>
-      input.emitStage('create:late_cleanup_done', {
-        sandboxId: input.sandbox.id,
-        attempt: input.attempt,
-      }),
-    (error: unknown) => {
-      console.warn('[play-runner.daytona.create_late_cleanup_failed]', {
-        sandboxId: input.sandbox.id,
-        attempt: input.attempt,
-        error: error instanceof Error ? error.message : String(error),
-      });
-    },
-  );
-}
-
-async function createHedgedOneShotDaytonaSandbox(input: {
+async function createRetriedOneShotDaytonaSandbox(input: {
   daytona: DaytonaClient;
   orgId: string;
   context: DaytonaExecutionContext;
   emitStage: DaytonaStageEmitter;
   startedAt: number;
-}): Promise<HedgedDaytonaCreateResult> {
-  return await new Promise<HedgedDaytonaCreateResult>((resolve, reject) => {
-    let settled = false;
-    let startedAttempts = 0;
-    let rejectedAttempts = 0;
-    const errors: string[] = [];
-    const timers: ReturnType<typeof setTimeout>[] = [];
-
-    const clearTimers = () => {
-      while (timers.length > 0) {
-        const timer = timers.pop();
-        if (timer) clearTimeout(timer);
-      }
-    };
-
-    const rejectIfExhausted = () => {
-      if (
-        settled ||
-        rejectedAttempts !== DAYTONA_CREATE_HEDGE_DELAYS_MS.length
-      ) {
-        return;
-      }
-      settled = true;
-      clearTimers();
-      reject(
-        new Error(
-          `Daytona sandbox create failed across ${rejectedAttempts} attempts: ${errors.join('; ')}`,
-        ),
-      );
-    };
-
-    const startAttempt = (attempt: number) => {
-      if (settled) return;
-      startedAttempts = Math.max(startedAttempts, attempt);
-      if (attempt > 1) {
-        input.emitStage('create:retry', {
-          attempt: attempt - 1,
-          elapsedMs: Date.now() - input.startedAt,
-          reason: 'hedge_delay',
-        });
-      }
-      const attemptStartedAt = Date.now();
-      void createOneShotDaytonaSandbox({
+}): Promise<DaytonaCreateResult> {
+  const errors: string[] = [];
+  for (const [index, delayMs] of DAYTONA_CREATE_RETRY_DELAYS_MS.entries()) {
+    const attempt = index + 1;
+    if (delayMs > 0) {
+      input.emitStage('create:retry', {
+        attempt: index,
+        elapsedMs: Date.now() - input.startedAt,
+        reason: 'bounded_backoff',
+        delayMs,
+      });
+      await new Promise((resolve) => setTimeout(resolve, delayMs));
+    }
+    const attemptStartedAt = Date.now();
+    try {
+      const sandbox = await createOneShotDaytonaSandbox({
         daytona: input.daytona,
         orgId: input.orgId,
         context: input.context,
-      }).then(
-        (sandbox) => {
-          if (settled) {
-            cleanupLateDaytonaCreate({
-              sandbox,
-              attempt,
-              emitStage: input.emitStage,
-            });
-            return;
-          }
-          settled = true;
-          clearTimers();
-          resolve({
-            sandbox,
-            attempt,
-            attemptElapsedMs: Date.now() - attemptStartedAt,
-          });
-        },
-        (error: unknown) => {
-          rejectedAttempts += 1;
-          errors.push(error instanceof Error ? error.message : String(error));
-          console.warn('[play-runner.daytona.create_attempt_failed]', {
-            attempt,
-            error: error instanceof Error ? error.message : String(error),
-          });
-          rejectIfExhausted();
-        },
-      );
-    };
-
-    for (const [index, delayMs] of DAYTONA_CREATE_HEDGE_DELAYS_MS.entries()) {
-      const attempt = index + 1;
-      if (delayMs === 0) {
-        startAttempt(attempt);
-      } else {
-        timers.push(setTimeout(() => startAttempt(attempt), delayMs));
-      }
+      });
+      return {
+        sandbox,
+        attempt,
+        attemptElapsedMs: Date.now() - attemptStartedAt,
+      };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      errors.push(message);
+      console.warn('[play-runner.daytona.create_attempt_failed]', {
+        attempt,
+        error: message,
+      });
     }
-
-    timers.push(
-      setTimeout(() => {
-        if (settled) return;
-        settled = true;
-        clearTimers();
-        reject(
-          new Error(
-            `Daytona sandbox create did not complete within ${DAYTONA_CREATE_ACQUIRE_TIMEOUT_MS}ms after starting ${startedAttempts} attempts.`,
-          ),
-        );
-      }, DAYTONA_CREATE_ACQUIRE_TIMEOUT_MS),
-    );
-  });
+  }
+  throw new Error(
+    `Daytona sandbox create failed across ${errors.length} bounded attempts: ${errors.join('; ')}`,
+  );
 }
 
 async function acquireOneShotDaytonaSandbox(input: {
@@ -235,13 +217,33 @@ async function acquireOneShotDaytonaSandbox(input: {
   startedAt: number;
 }): Promise<AcquiredDaytonaSandbox> {
   input.emitStage('create:start');
-  const result = await createHedgedOneShotDaytonaSandbox(input);
+  const result = await createRetriedOneShotDaytonaSandbox(input);
+  const granted = {
+    cpu: result.sandbox.cpu,
+    memoryGiB: result.sandbox.memory,
+    diskGiB: result.sandbox.disk,
+    gpu: result.sandbox.gpu ?? 0,
+  };
+  if (
+    granted.cpu !== DAYTONA_SANDBOX_CPU ||
+    granted.memoryGiB !== DAYTONA_SANDBOX_MEMORY_GIB ||
+    granted.diskGiB !== DAYTONA_SANDBOX_DISK_GIB ||
+    granted.gpu !== DAYTONA_SANDBOX_GPU
+  ) {
+    await result.sandbox.delete(30).catch(() => undefined);
+    throw new Error(
+      `Daytona sandbox resource boundary mismatch: expected cpu=${DAYTONA_SANDBOX_CPU} memoryGiB=${DAYTONA_SANDBOX_MEMORY_GIB} diskGiB=${DAYTONA_SANDBOX_DISK_GIB} gpu=${DAYTONA_SANDBOX_GPU}, granted cpu=${granted.cpu} memoryGiB=${granted.memoryGiB} diskGiB=${granted.diskGiB} gpu=${granted.gpu}`,
+    );
+  }
   const billingStartedAt = Date.now();
   input.emitStage('create:done', {
     sandboxId: result.sandbox.id,
     attempt: result.attempt,
     elapsedMs: billingStartedAt - input.startedAt,
     attemptElapsedMs: result.attemptElapsedMs,
+    cpu: granted.cpu,
+    memoryGiB: granted.memoryGiB,
+    diskGiB: granted.diskGiB,
   });
   return {
     sandbox: result.sandbox,