deepline 0.3.460 → 0.3.462

package/dist/bundling-sources/shared_libs/play-runtime/modal-runtime-config.ts

@@ -1,3 +1,4 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
 import type { ModalClient } from 'modal';
 import { isIsolatedRuntimeSchedulerSchema } from './runtime-scheduler-topology';
 import {
@@ -84,15 +85,89 @@ export async function loadModalRequiredConfig(input: {
   };
 }
 
+type ModalGrpcMiddleware = NonNullable<
+  NonNullable<ConstructorParameters<typeof ModalClient>[0]>['grpcMiddleware']
+>[number];
+
+const modalCallSignal = new AsyncLocalStorage<AbortSignal>();
+
+/**
+ * Cancel every Modal control-plane call `fn` makes once `signal` aborts. A
+ * deadline that only stops waiting leaves the call open, so a stuck provider
+ * would pile up unanswered reads behind it.
+ */
+export function withModalCallSignal<T>(
+  signal: AbortSignal,
+  fn: () => Promise<T>,
+): Promise<T> {
+  return modalCallSignal.run(signal, fn);
+}
+
+// Modal runs custom middleware outside its own retry loop, so the signal also
+// ends a retry or throttle wait.
+const cancelModalCallsWithScopedSignal: ModalGrpcMiddleware =
+  async function* (call, options) {
+    const signal = modalCallSignal.getStore();
+    // Every caller shares one auth token refresh, so one read's deadline must
+    // not cancel it.
+    if (
+      !signal ||
+      call.method.path === '/modal.client.ModalClient/AuthTokenGet'
+    ) {
+      return yield* call.next(call.request, options);
+    }
+    return yield* call.next(call.request, {
+      ...options,
+      signal: options.signal
+        ? AbortSignal.any([options.signal, signal])
+        : signal,
+    });
+  };
+
+let sharedModalClient: {
+  tokenId: string;
+  tokenSecret: string;
+  client: Promise<ModalClient>;
+} | null = null;
+
+/**
+ * Each `ModalClient` opens its own gRPC channel and nothing here closes one, so
+ * a client per call grows a long-lived process with every Modal read.
+ */
+function modalClientForTokens(
+  tokenId: string,
+  tokenSecret: string,
+): Promise<ModalClient> {
+  if (
+    sharedModalClient?.tokenId === tokenId &&
+    sharedModalClient.tokenSecret === tokenSecret
+  ) {
+    return sharedModalClient.client;
+  }
+  const client = import('modal').then(
+    ({ ModalClient }) =>
+      new ModalClient({
+        tokenId,
+        tokenSecret,
+        grpcMiddleware: [cancelModalCallsWithScopedSignal],
+      }),
+  );
+  const entry = { tokenId, tokenSecret, client };
+  sharedModalClient = entry;
+  client.catch(() => {
+    if (sharedModalClient === entry) sharedModalClient = null;
+  });
+  return client;
+}
+
 export async function loadModalClientConfig(
   input: { env?: NodeJS.ProcessEnv } = {},
 ): Promise<ModalClientConfig> {
   const env = input.env ?? process.env;
   const tokenId = requiredEnv(env, 'MODAL_TOKEN_ID');
   const tokenSecret = requiredEnv(env, 'MODAL_TOKEN_SECRET');
-  const { ModalClient } = await import('modal');
   return {
-    client: new ModalClient({ tokenId, tokenSecret }),
+    client: await modalClientForTokens(tokenId, tokenSecret),
     appName:
       env.DEEPLINE_MODAL_RUNNER_APP_NAME?.trim() || MODAL_RUNNER_APP_NAME,
     image: env.DEEPLINE_MODAL_RUNNER_IMAGE?.trim() || MODAL_RUNNER_IMAGE,

package/dist/bundling-sources/shared_libs/play-runtime/output-size-limits.ts

@@ -31,7 +31,7 @@ export const LEDGER_TERMINAL_RESULT_MAX_DEPTH = 10;
 export const CONVEX_LEDGER_ARRAY_MAX_ITEMS = 8_192;
 export const CONVEX_LEDGER_OBJECT_MAX_FIELDS = 1_024;
 export const CONVEX_LEDGER_FIELD_NAME_MAX_LENGTH = 1_024;
-/** Customer-visible values and complete authored returns share one 5 MiB cap. */
+/** Customer-visible values and retained authored returns share one 5 MiB cap. */
 export const CUSTOMER_OUTPUT_VALUE_MAX_BYTES = 5 * 1024 * 1024;
 export const CUSTOMER_OUTPUT_TOTAL_MAX_BYTES = 5 * 1024 * 1024;
 /** Inline Postgres receipt contract: one serialized output is at most 10 MiB. */
@@ -58,6 +58,12 @@ export const RUNTIME_RECEIPT_CONTROL_BUFFER_MAX_ITEMS = 2_000;
  * is required to resume execution.
  */
 export const RUNNER_TERMINAL_PUSH_MAX_BODY_BYTES = 16 * 1024 * 1024;
+/**
+ * Oversized sheet admissions use bounded requests with room for returned row
+ * metadata. A single row may exceed this target, up to the unchanged gateway
+ * body ceiling; the target is never a new customer input-value limit.
+ */
+export const RUNTIME_SHEET_START_TARGET_BODY_BYTES = 12 * 1024 * 1024;
 /**
  * Receipt commands are measured before the runtime client adds its request
  * envelope. Keep a full 4 MiB below the gateway body ceiling so one legal
@@ -459,7 +465,7 @@ export const RUN_LIST_OUTPUT_PREVIEW_LIMITS = {
   maxFields: 40,
   // The list endpoint returns multiple historical runs in one polling page.
   // Reserve enough room for run state and legacy rows by keeping each preview
-  // at 4 KiB; the complete authored result remains separately readable up to
+  // at 4 KiB; the retained authored result remains separately readable up to
   // the 5 MiB customer-output ceiling.
   maxBytes: 4_000,
   maxDepth: 4,
@@ -1436,6 +1442,269 @@ export function assertCustomerPlayReturnWithinLimit(input: {
   });
 }
 
+const JSON_OUTPUT_TRUNCATION_SUFFIX = '…[truncated]';
+const OMIT_JSON_OUTPUT_VALUE = Symbol('OMIT_JSON_OUTPUT_VALUE');
+
+type JsonOutputProjection = {
+  value: unknown;
+  bytes: number;
+  truncated: boolean;
+};
+
+function jsonStringCharacterBytes(value: string, index: number) {
+  const code = value.charCodeAt(index);
+  if (code === 0x22 || code === 0x5c) return { bytes: 2, width: 1 };
+  if (code <= 0x1f) {
+    return {
+      bytes:
+        code === 0x08 ||
+        code === 0x09 ||
+        code === 0x0a ||
+        code === 0x0c ||
+        code === 0x0d
+          ? 2
+          : 6,
+      width: 1,
+    };
+  }
+  if (code >= 0xd800 && code <= 0xdbff) {
+    const next = value.charCodeAt(index + 1);
+    return next >= 0xdc00 && next <= 0xdfff
+      ? { bytes: 4, width: 2 }
+      : { bytes: 6, width: 1 };
+  }
+  if (code >= 0xdc00 && code <= 0xdfff) return { bytes: 6, width: 1 };
+  if (code <= 0x7f) return { bytes: 1, width: 1 };
+  if (code <= 0x7ff) return { bytes: 2, width: 1 };
+  return { bytes: 3, width: 1 };
+}
+
+function truncateJsonStringToByteLimit(
+  value: string,
+  limitBytes: number,
+): JsonOutputProjection | null {
+  if (limitBytes < 2) return null;
+  const suffixBytes = jsonStringByteLength(JSON_OUTPUT_TRUNCATION_SUFFIX) - 2;
+  const prefixLimitBytes = limitBytes - 2 - suffixBytes;
+  if (prefixLimitBytes < 0) {
+    return { value: '', bytes: 2, truncated: true };
+  }
+
+  let prefixBytes = 0;
+  let prefixEnd = 0;
+  while (prefixEnd < value.length) {
+    const next = jsonStringCharacterBytes(value, prefixEnd);
+    if (prefixBytes + next.bytes > prefixLimitBytes) break;
+    prefixBytes += next.bytes;
+    prefixEnd += next.width;
+  }
+
+  const projected = `${value.slice(0, prefixEnd)}${JSON_OUTPUT_TRUNCATION_SUFFIX}`;
+  return {
+    value: projected,
+    bytes: jsonStringByteLength(projected),
+    truncated: true,
+  };
+}
+
+function projectJsonValueWithinByteLimit(
+  value: unknown,
+  limitBytes: number,
+  key: string,
+  inArray: boolean,
+  toJsonAlreadyApplied = false,
+): JsonOutputProjection | null {
+  let normalized = value;
+  if (
+    !toJsonAlreadyApplied &&
+    normalized !== null &&
+    typeof normalized === 'object' &&
+    typeof (normalized as { toJSON?: unknown }).toJSON === 'function'
+  ) {
+    normalized = (normalized as { toJSON: (key: string) => unknown }).toJSON(
+      key,
+    );
+    return projectJsonValueWithinByteLimit(
+      normalized,
+      limitBytes,
+      key,
+      inArray,
+      true,
+    );
+  }
+
+  if (
+    normalized === undefined ||
+    typeof normalized === 'function' ||
+    typeof normalized === 'symbol'
+  ) {
+    return inArray
+      ? { value: null, bytes: 4, truncated: false }
+      : { value: OMIT_JSON_OUTPUT_VALUE, bytes: 0, truncated: false };
+  }
+
+  let measurement: BoundedJsonByteLength;
+  try {
+    measurement = jsonByteLengthUpTo(normalized, limitBytes);
+  } catch (error) {
+    throw new Error(
+      `play return cannot be serialized as JSON: ${error instanceof Error ? error.message : String(error)}`,
+    );
+  }
+  if (!measurement.exceeded) {
+    return {
+      value: normalized,
+      bytes: measurement.bytes,
+      truncated: false,
+    };
+  }
+
+  if (typeof normalized === 'string') {
+    return truncateJsonStringToByteLimit(normalized, limitBytes);
+  }
+
+  if (Array.isArray(normalized)) {
+    if (limitBytes < 2) return null;
+    const values: unknown[] = [];
+    let bytes = 2;
+    let truncated = false;
+    for (let index = 0; index < normalized.length; index += 1) {
+      const separatorBytes = values.length > 0 ? 1 : 0;
+      const childLimitBytes = limitBytes - bytes - separatorBytes;
+      if (childLimitBytes < 1) {
+        truncated = true;
+        break;
+      }
+      const child = projectJsonValueWithinByteLimit(
+        normalized[index],
+        childLimitBytes,
+        String(index),
+        true,
+      );
+      if (!child || child.value === OMIT_JSON_OUTPUT_VALUE) {
+        truncated = true;
+        break;
+      }
+      values.push(child.value);
+      bytes += separatorBytes + child.bytes;
+      if (child.truncated) {
+        truncated = true;
+        break;
+      }
+    }
+    return {
+      value: values,
+      bytes,
+      truncated: truncated || values.length < normalized.length,
+    };
+  }
+
+  if (normalized !== null && typeof normalized === 'object') {
+    if (limitBytes < 2) return null;
+    const output = Object.create(null) as Record<string, unknown>;
+    const entries = Object.keys(normalized);
+    let bytes = 2;
+    let fields = 0;
+    let truncated = false;
+    for (const childKey of entries) {
+      const childValue = (normalized as Record<string, unknown>)[childKey];
+      if (
+        childValue === undefined ||
+        typeof childValue === 'function' ||
+        typeof childValue === 'symbol'
+      ) {
+        continue;
+      }
+      const keyBytes = jsonStringByteLength(childKey) + 1;
+      const separatorBytes = fields > 0 ? 1 : 0;
+      const childLimitBytes = limitBytes - bytes - separatorBytes - keyBytes;
+      if (childLimitBytes < 1) {
+        truncated = true;
+        break;
+      }
+      const child = projectJsonValueWithinByteLimit(
+        childValue,
+        childLimitBytes,
+        childKey,
+        false,
+      );
+      if (!child || child.value === OMIT_JSON_OUTPUT_VALUE) {
+        truncated = true;
+        break;
+      }
+      output[childKey] = child.value;
+      bytes += separatorBytes + keyBytes + child.bytes;
+      fields += 1;
+      if (child.truncated) {
+        truncated = true;
+        break;
+      }
+    }
+    return {
+      value: output,
+      bytes,
+      truncated: truncated || fields < entries.length,
+    };
+  }
+
+  return null;
+}
+
+export function truncateCustomerPlayReturnWithinLimit(input: {
+  value: Record<string, unknown>;
+  path?: string;
+  totalLimitBytes?: number;
+}): {
+  value: Record<string, unknown>;
+  truncated: boolean;
+  originalBytesAtLeast: number;
+  retainedBytes: number;
+  limitBytes: number;
+} {
+  const path = input.path ?? 'play return';
+  const limitBytes = input.totalLimitBytes ?? CUSTOMER_OUTPUT_TOTAL_MAX_BYTES;
+  let measurement: BoundedJsonByteLength;
+  try {
+    measurement = jsonByteLengthUpTo(input.value, limitBytes);
+  } catch (error) {
+    throw new Error(
+      `${path} cannot be serialized as JSON: ${error instanceof Error ? error.message : String(error)}`,
+    );
+  }
+  if (!measurement.exceeded) {
+    return {
+      value: input.value,
+      truncated: false,
+      originalBytesAtLeast: measurement.bytes,
+      retainedBytes: measurement.bytes,
+      limitBytes,
+    };
+  }
+
+  const projection = projectJsonValueWithinByteLimit(
+    input.value,
+    limitBytes,
+    '',
+    false,
+  );
+  if (
+    !projection ||
+    projection.value === OMIT_JSON_OUTPUT_VALUE ||
+    !projection.value ||
+    typeof projection.value !== 'object' ||
+    Array.isArray(projection.value)
+  ) {
+    throw new Error(`${path} could not be truncated to valid JSON output.`);
+  }
+  return {
+    value: projection.value as Record<string, unknown>,
+    truncated: true,
+    originalBytesAtLeast: measurement.bytes,
+    retainedBytes: projection.bytes,
+    limitBytes,
+  };
+}
+
 const RUNTIME_RECEIPT_OUTPUT_SIZE_ADVICE =
   'This receipt result is too large for durable call caching. This usually means raw search results, HTML, or a large list is being cached as one cell. Parse it before returning it from the tool boundary.';
 

package/dist/bundling-sources/shared_libs/play-runtime/play-run-recovery-policy.ts

@@ -1,3 +1,4 @@
+import { boundedProviderTextForLog } from './provider-text-for-log';
 import { RUNTIME_RELIABILITY_POLICY } from './runtime-reliability-policy';
 
 /**
@@ -45,6 +46,7 @@ export type PlayRunRecoveryReason =
   | 'daytona_sandbox_acquisition_unavailable_before_execution'
   | 'runtime_scheduler_unavailable_before_execution'
   | 'runtime_initialization_transport_before_execution'
+  | 'runner_startup_not_live_before_execution'
   | 'runtime_traffic_hold_before_execution'
   | 'runtime_traffic_throttled_before_execution';
 
@@ -145,6 +147,29 @@ export function playRunRecoveryLogDetail(
   }
 }
 
+/**
+ * The provider's own words from the cause of a recovery error, for the same
+ * defer log and under the same rules as the detail above. One reason covers a
+ * spend limit and a busy provider, and only this text tells them apart. gRPC
+ * `details` wins because `message` spends the bound on the RPC path first.
+ */
+export function playRunRecoveryProviderText(error: unknown): string | null {
+  try {
+    if (!isPlayRunRecoveryError(error)) return null;
+    const cause: unknown = error.cause;
+    if (!cause || typeof cause !== 'object') return null;
+    const { details, message } = cause as {
+      details?: unknown;
+      message?: unknown;
+    };
+    return (
+      boundedProviderTextForLog(details) ?? boundedProviderTextForLog(message)
+    );
+  } catch {
+    return null;
+  }
+}
+
 function errorCode(error: unknown): string | number | null {
   if (!error || typeof error !== 'object') return null;
   const code = (error as { code?: unknown }).code;
@@ -369,6 +394,32 @@ export function recoveryForModalRunnerStartupFailure(
   });
 }
 
+/**
+ * No sandbox this attempt started got a live runner: the runner never reached
+ * the sandbox, because its upload or command failed, or it never reached the
+ * gateway. The worker never parked a runner, so none could release customer
+ * code, and the attempt fence rejects any runner left behind. The fault can
+ * outlast an attempt's own starts, so it waits on the durable defer ladder
+ * rather than failing the run. It names no provider: a bad host or the
+ * sandbox's network is not a provider account fault, so it must not open a
+ * provider circuit.
+ */
+export function recoveryForRunnerStartupNotLive(
+  error: unknown,
+): PlayRunRecoveryError {
+  return new PlayRunRecoveryError({
+    decision: {
+      stage: 'pre_code',
+      action: 'defer',
+      reason: 'runner_startup_not_live_before_execution',
+      dependency: 'runtime',
+    },
+    message:
+      'The sandbox runner did not start before customer execution began.',
+    cause: error,
+  });
+}
+
 /**
  * A runner transport classifier has already proved that the result has no
  * customer rows or steps. Keep its engine retry typed so an ordinary failed

package/dist/bundling-sources/shared_libs/play-runtime/play-runs/sandbox-cleanup/contracts.ts

@@ -17,6 +17,8 @@ export type SandboxCleanupResource = {
 export type SandboxCleanupDeleteOutcome =
   | { kind: 'deleted'; routingDomain: string | null }
   | { kind: 'already_absent'; routingDomain: string | null }
+  /** Nothing failed, but the provider has not yet shown the resource is gone. */
+  | { kind: 'pending'; code: string; detail: string }
   /** The provider outcome is ambiguous or failed; its resource remains live. */
   | { kind: 'failed'; code: string; detail: string };
 

package/dist/bundling-sources/shared_libs/play-runtime/play-runs/sandbox-cleanup/job.ts

@@ -37,6 +37,14 @@ export function createSandboxCleanupJob(
 
       try {
         const deletion = await ports.deletion.delete(input);
+        if (deletion.kind === 'pending') {
+          return await scheduleRetry(
+            ports,
+            input,
+            deletion.detail,
+            confirmationReadDelay(input.resource.failureCount + 1),
+          );
+        }
         if (deletion.kind === 'failed') {
           if (deletion.code === 'missing_routing_domain') {
             const reason = `missing_routing_domain: ${deletion.detail}`.slice(
@@ -120,8 +128,8 @@ async function scheduleRetry(
   ports: SandboxCleanupPorts,
   input: SandboxCleanupInput,
   error: string,
+  retryAfterMs = retryDelay(input.resource.failureCount + 1),
 ): Promise<SandboxCleanupOutcome> {
-  const retryAfterMs = retryDelay(input.resource.failureCount + 1);
   const scheduled = await ports.store.retry({
     resource: input.resource,
     error,
@@ -139,6 +147,24 @@ function retryDelay(nextFailureCount: number): number {
   );
 }
 
+/**
+ * Janitor sightings put Daytona's record about 3 seconds behind an accepted
+ * delete on Oct 31 (115 sightings of 10,785 deletes, 5-minute passes). Reading
+ * at 5 seconds usually needs one read, so a cleanup costs three control
+ * requests. At 500,000 cleanups a month that is under 1 request per second, and
+ * the 4/s dense-load peak stays near 12/s, against a budget of 25/s. Doubling
+ * to 5 minutes leaves a stuck sandbox costing one read per interval.
+ */
+const CONFIRMATION_READ_DELAY_MS = 5_000;
+
+function confirmationReadDelay(nextFailureCount: number): number {
+  return Math.min(
+    5 * 60_000,
+    CONFIRMATION_READ_DELAY_MS *
+      2 ** Math.min(6, Math.max(0, nextFailureCount - 1)),
+  );
+}
+
 function validate(input: SandboxCleanupInput): void {
   const { resource } = input;
   if (!resource.sandboxId.trim() || !resource.runId.trim()) {

package/dist/bundling-sources/shared_libs/play-runtime/play-runtime-batching-registry.ts

@@ -2,6 +2,7 @@ import { bouncebanBatchStrategies } from './/bounceban-batching';
 import type { AnyBatchOperationStrategy } from './batching-types';
 import { bettercontactBatchStrategies } from './bettercontact-batching';
 import { DEFAULT_PLAY_RUNTIME_BATCH_STRATEGIES } from './default-batch-strategies';
+import { freeCompanyLookupBatchStrategies } from './free-company-lookup-batching';
 import { fullenrichBatchStrategies } from './fullenrich-batching';
 import { opensosdataBatchStrategies } from './opensosdata-batching';
 import { zerobounceBatchStrategies } from './zerobounce-batching';
@@ -15,6 +16,7 @@ export const PLAY_RUNTIME_BATCH_OPERATION_REGISTRY: Record<
   ...DEFAULT_PLAY_RUNTIME_BATCH_STRATEGIES,
   ...bettercontactBatchStrategies,
   ...bouncebanBatchStrategies,
+  ...freeCompanyLookupBatchStrategies,
   ...fullenrichBatchStrategies,
   ...opensosdataBatchStrategies,
   ...testAsyncBatchStrategies,

package/dist/bundling-sources/shared_libs/play-runtime/protocol.ts

@@ -312,6 +312,9 @@ export interface RunnerPushExecutionConfig {
   /** The provider that acquired this sandbox, which a Daytona-selected launch
    * can differ from after fallback. Absent from older workers. */
   sandboxProvider?: 'daytona' | 'modal';
+  /** Test drill only: how long the sandbox watchdog withholds heartbeats once
+   * customer code starts. Absent from every ordinary launch. */
+  heartbeatSilenceMs?: number;
 }
 
 export interface PlayRunnerExecutionConfig {

package/dist/bundling-sources/shared_libs/play-runtime/provider-text-for-log.ts

@@ -0,0 +1,63 @@
+const LOGGED_PROVIDER_TEXT_MAX_CHARS = 160;
+
+/**
+ * Credential redaction for a provider control-plane error message. Shared by
+ * lookup-failure descriptions and the provider text below.
+ */
+export function redactProviderErrorDetail(value: string): string {
+  return value
+    .replace(
+      /authorization\s*[=:]\s*bearer\s+[^\s,;]+/gi,
+      'Authorization=Bearer [redacted]',
+    )
+    .replace(
+      /(authorization\s*[=:]\s*)(?!bearer\s+\[redacted\])[^\s,;]+/gi,
+      '$1[redacted]',
+    )
+    .replace(/(bearer\s+)[^\s,;]+/gi, '$1[redacted]')
+    .replace(/((?:api[_-]?key|token)\s*[=:]\s*)[^\s,;]+/gi, '$1[redacted]')
+    .replace(/\s+/g, ' ')
+    .trim()
+    .slice(0, 1_000);
+}
+
+/**
+ * Provider free text (for example a sandbox `errorReason`) for logs. This
+ * field is written by the provider, so it is redacted more strictly than the
+ * shared function alone: URL userinfo, any authorization scheme, password,
+ * secret, token, signature, credential and key pairs in query, header or JSON
+ * form, email addresses, and opaque identifiers such as organization ids. It
+ * is then cut to one short fixed bound so an upstream response is never
+ * copied wholesale.
+ */
+export function boundedProviderTextForLog(value: unknown): string | null {
+  if (typeof value !== 'string') return null;
+  const strict = value
+    .replace(/(\b[a-z][a-z0-9+.-]*:\/\/)[^\s/@]+@/gi, '$1[redacted]@')
+    .replace(
+      /(authorization\s*[=:]\s*["']?)(?:[a-z]+\s+)?[^\s,;"']+/gi,
+      '$1[redacted]',
+    )
+    .replace(/\b(basic|bearer)\s+[A-Za-z0-9+/=._~-]{8,}/gi, '$1 [redacted]')
+    .replace(
+      /(["']?[\w.-]*(?:password|passwd|secret|token|signature|credential|api[_-]?key|access[_-]?key)[\w.-]*["']?\s*[=:]\s*)(?:"[^"]*"|'[^']*'|[^\s&,;"'}\]]+)/gi,
+      '$1[redacted]',
+    )
+    .replace(
+      /[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)+/g,
+      '[redacted-email]',
+    )
+    .replace(
+      /\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/gi,
+      '[redacted-id]',
+    )
+    .replace(
+      /\b(?=[A-Za-z0-9_-]*\d)(?=[A-Za-z0-9_-]*[A-Za-z])[A-Za-z0-9_-]{24,}\b/g,
+      '[redacted-id]',
+    );
+  const bounded = redactProviderErrorDetail(strict).slice(
+    0,
+    LOGGED_PROVIDER_TEXT_MAX_CHARS,
+  );
+  return bounded || null;
+}

package/dist/bundling-sources/shared_libs/play-runtime/resource-governor.ts

@@ -230,7 +230,26 @@ export type RuntimeResourceObservation = {
   sheetFlushBytes?: number | null;
 };
 
+/** Decoded runner execute-response envelopes; permits are not resident memory. */
+export type RuntimeToolResponseBodyAdmissionSnapshot = {
+  turns: number;
+  measuredTurns: number;
+  decodedUtf8BytesTotal: number;
+  decodedUtf8BytesMax: number;
+  /** Peak concurrent expected-or-measured reservations; not RSS or heap usage. */
+  permitBytesPeak: number;
+  queuedTurns: number;
+  /** Budget refusal checks, not distinct delayed calls or rows. */
+  budgetRefusals: number;
+  progressAdmissions: number;
+  unpricedAdmissions: number;
+};
+
 export type RuntimeResourceSnapshot = {
+  /** Optional for snapshots produced before byte-lane telemetry was added. */
+  memoryAdmission?: {
+    toolResponseBody: RuntimeToolResponseBodyAdmissionSnapshot;
+  };
   /**
    * Selected execute-route stages across every physical request that published
    * the complete timing header. Kept once per run so mixed-provider fixtures