dsh-ptc-plus 0.5.1 → 0.5.2

package/internal/config-spec.js

@@ -1,4 +1,5 @@
 import { CAPABILITY_POLICY_DEFAULT } from './capability-policy.js'
+import { PROMPT_TEXT_DEFAULT } from './prompt-text.js'
 
 /** Configuration fields shared by the Host schema and settings card. */
 export const MAX_TIMER_DELAY_MS = 2_147_483_647
@@ -215,6 +216,68 @@ export const CONFIG_FIELDS = Object.freeze([
     description: 'worker 重启后从 session journal 重建可恢复的 REPL 状态。',
     descriptionEn: 'Rebuilds recoverable REPL state from the session journal after a worker restart.',
   },
+  {
+    key: 'retentionPayloadRuns',
+    type: 'integer',
+    default: 8,
+    min: 8,
+    max: 512,
+    label: '保留最近单元格数',
+    labelEn: 'Retained recent cells',
+    description: '检查点保留最近多少个单元格的参数原文。调大能直接编辑更久以前的计算，但检查点更大；更早的单元格需要从会话日志重新折叠才能编辑或重新发布。',
+    descriptionEn: 'How many recent cells keep their argument text in the checkpoint. A larger window keeps more history editable without a log read but grows the checkpoint; older cells must be refolded from the session log to be edited or republished.',
+  },
+  {
+    key: 'retentionPayloadBytes',
+    type: 'integer',
+    default: 8388608,
+    min: 1048576,
+    max: 16777216,
+    label: '保留载荷预算 (UTF-8 bytes)',
+    labelEn: 'Retained payload budget (UTF-8 bytes)',
+    description: '保留单元格参数原文的累计上限。达到上限后最旧的原文被移除，检查点体积因此与会话写入总量无关；单个超过预算的单元格也会被移除并从日志重折。检查点体积约为本预算的两倍，上限 16 MiB 对应约 32 MB 的最坏情况。',
+    descriptionEn: 'Cumulative budget for the retained argument text. Past it the oldest payload is removed, which keeps the checkpoint independent of how much the session wrote; a single cell larger than the budget is removed as well and refolded from the log. A checkpoint is roughly twice this budget, so the 16 MiB maximum bounds the worst case near 32 MB.',
+  },
+  {
+    key: 'retentionClusters',
+    type: 'integer',
+    default: 8,
+    min: 0,
+    max: 50000,
+    label: '保留单元格簇上限',
+    labelEn: 'Retained cluster limit',
+    description: '检查点保留多少个单元格簇的身份与观测，超过后最旧的簇折进区间摘要（其后续操作需要从日志重折）。默认与"保留最近单元格数"一致，所以检查点不会随会话长度线性增长；调大能保留更多无需重折的恢复证据，但检查点更大。填 0 表示不限制：不做按数量的折叠，只由载荷预算约束体积。',
+    descriptionEn: 'How many cell clusters keep their identity and observations in the checkpoint; older ones fold into an interval summary and need a log refold afterwards. It defaults to the retained-cells window, which is what keeps a long session from growing linearly; a larger value keeps more recovery evidence without a refold at the cost of a bigger checkpoint. 0 means unlimited: no count-based folding, with the payload budget as the only bound.',
+  },
+  {
+    key: 'capabilityPromptTextEnabled',
+    type: 'boolean',
+    default: true,
+    label: '提示文本',
+    labelEn: 'Prompt text',
+    description: '把「提示文本」页签里改写的固定句子应用到模型的请求、工具说明、能力方案与提示；关闭后这些渠道一律回到内置文本，已保存的改写保留但暂停生效。',
+    descriptionEn: 'Applies the sentences edited in the Prompt text tab to model requests, tool descriptions, the capability plan and tips. When off, those channels use the built-in text; saved edits are kept but paused.',
+  },
+  {
+    key: 'promptText',
+    type: 'string',
+    default: PROMPT_TEXT_DEFAULT,
+    label: '提示文本覆盖',
+    labelEn: 'Prompt text overrides',
+    description: '按槽位 id 覆盖插件写给模型的固定提示文本；空对象表示使用内置文本。诊断、信封与由配置派生的策略句始终只读。',
+    descriptionEn: 'Override the fixed prompt text the plugin writes for the model, keyed by slot id; an empty document keeps the built-in text. Diagnostics, message envelopes and configuration-derived policy sentences stay read-only.',
+  },
+  {
+    key: 'unmeasuredCellLimit',
+    type: 'integer',
+    default: 2,
+    min: 1,
+    max: Number.MAX_SAFE_INTEGER,
+    label: '连续未测量 cell 丢弃阈值',
+    labelEn: 'Consecutive unmeasured cells before the worker is dropped',
+    description: '连续第几个未测量 cell 触发丢弃 live worker（默认 2：第一个保留，第二个丢弃）；已证明的 frontier 保留给下一 cell 重放。',
+    descriptionEn: 'The consecutive unmeasured cell that drops the live worker (default 2: the first is kept, the second drops it). The proved frontier stays replayable for the next cell.',
+  },
   {
     key: 'officialReplPriority',
     type: 'boolean',
@@ -288,6 +351,50 @@ export const CONFIG_FIELDS = Object.freeze([
     description: '限制单个 cell 的日志和返回结果的合计大小。',
     descriptionEn: 'Limits the combined size of one cell\'s logs and returned result.',
   },
+  {
+    key: 'sampleBoundMs',
+    type: 'integer',
+    default: 1_000,
+    min: 1,
+    max: MAX_TIMER_DELAY_MS,
+    label: '计算基线采样等待上限 (ms)',
+    labelEn: 'Compute-baseline sample wait limit (ms)',
+    description: '等待 worker 回答计算基线采样的上限；宿主忙碌时先读空 helper 通道再判断缺失，未观察到的采样按未测量 no-op 结算，是否保留 worker 由 unmeasuredCellLimit 决定；transport 报告退出、断连或无法发送时仍走 worker-exit 重置。',
+    descriptionEn: 'Bounds the wait for the worker compute-baseline answer. A busy host reads the helper channel out before concluding an answer is missing; an unobserved sample settles as an unmeasured no-op and unmeasuredCellLimit decides whether the worker stays; a transport-reported exit, disconnect or unsendable request keeps the worker-exit reset route.',
+  },
+  {
+    key: 'workerReclaimMs',
+    type: 'integer',
+    default: 5_000,
+    min: 1_000,
+    max: MAX_TIMER_DELAY_MS,
+    label: 'worker 回收确认上限 (ms)',
+    labelEn: 'Worker reclamation confirmation limit (ms)',
+    description: '停止 helper 的关闭阶段上限（至少 1000ms）；exit 确认与其后的输出关闭各自以此为上界，release grace 会被压缩以给 kill 预留至少 1000ms 的确认窗口。worker 创建与关闭时读取当前配置。cell 触发的 session kernel exit 超时会保留 helper 并在会话释放前阻止后续 cell；startup、idle 或输出关闭路径的失败，以及 binding console 与 candidate helper，只保留实例并在释放时报告。',
+    descriptionEn: 'Bounds one close stage of a stopped helper (at least 1000 ms): exit confirmation and the following output close are each bounded by it, with the release grace capped so the kill keeps at least a 1000 ms confirmation window. Read from the current configuration when a worker is created or closed. A cell-driven session-kernel exit miss retains the helper and blocks later cells until the session is released; a startup, idle or output-close miss, and the binding console and candidate helpers, only retain the instance and report it at release.',
+  },
+  {
+    key: 'startupProbeMs',
+    type: 'integer',
+    default: 5_000,
+    min: 1,
+    max: MAX_TIMER_DELAY_MS,
+    label: 'REPL 启动探针上限 (ms)',
+    labelEn: 'REPL startup probe limit (ms)',
+    description: 'worker 启动时校验 REPL 契约的等待上限；超时按启动失败结算，不执行任何 cell。worker 创建时读取当前配置。',
+    descriptionEn: 'Bounds the worker startup check of the REPL contract. A timeout settles as a startup failure and no cell executes. Read from the current configuration when a worker is created.',
+  },
+  {
+    key: 'executionSeamTimeoutMs',
+    type: 'integer',
+    default: 30_000,
+    min: 1,
+    max: MAX_TIMER_DELAY_MS,
+    label: '等待宿主执行入口上限 (ms)',
+    labelEn: 'Host execution-seam wait limit (ms)',
+    description: '激活时等待宿主注册执行入口的上限；超时把当前部署报告为不支持。只在插件激活或重载时读取，运行中的修改在下次激活生效。',
+    descriptionEn: 'Bounds the activation wait for the host to register its execution seam. A timeout reports the deployment as unsupported. Read only when the plugin activates or reloads; a live change applies at the next activation.',
+  },
   {
     key: 'maxValueNodes',
     type: 'integer',
@@ -376,7 +483,7 @@ export const CONFIG_GROUPS = Object.freeze([
     key: 'recovery',
     label: '状态与恢复',
     labelEn: 'State and recovery',
-    fields: Object.freeze(['durableReplay', 'officialReplPriority', 'tipsEnabled', 'tipCooldownMessages', 'tipEscalationFailures']),
+    fields: Object.freeze(['durableReplay', 'unmeasuredCellLimit', 'officialReplPriority', 'tipsEnabled', 'tipCooldownMessages', 'tipEscalationFailures']),
   },
   {
     key: 'extensions',
@@ -406,6 +513,10 @@ export const CONFIG_GROUPS = Object.freeze([
       'maxOldGenerationSizeMb',
       'maxNestedRunCodeDepth',
       'maxOutputBytes',
+      'sampleBoundMs',
+      'workerReclaimMs',
+      'startupProbeMs',
+      'executionSeamTimeoutMs',
       'maxValueNodes',
       'maxValueEdges',
       'maxValueArrayLength',
@@ -414,7 +525,7 @@ export const CONFIG_GROUPS = Object.freeze([
   },
   { key: 'capabilities', label: '能力与上下文', labelEn: 'Capabilities and context',
     fields: Object.freeze(['capabilityContextEnabled', 'capabilityManagementEnabled', 'capabilityBaseline', 'capabilityOverrides',
-      'capabilityStatistics', 'capabilityPolicy', 'capabilityRecoveryEnabled', 'modelPreviewEnabled', 'capabilityProfiles', 'capabilityBudgetBytes', 'capabilityDirectoryBytes', 'capabilityRecoveryBytes', 'modelPreviewTokens']) },
+      'capabilityStatistics', 'capabilityPolicy', 'capabilityRecoveryEnabled', 'modelPreviewEnabled', 'capabilityProfiles', 'capabilityBudgetBytes', 'capabilityDirectoryBytes', 'capabilityRecoveryBytes', 'modelPreviewTokens', 'retentionPayloadRuns', 'retentionPayloadBytes', 'retentionClusters', 'capabilityPromptTextEnabled', 'promptText']) },
 ])
 
 /** Functional modules share the same section order across every settings entry. */

package/internal/direct-surface-owner.js

@@ -16,10 +16,8 @@ import {
 import { userBindingsConfiguredContext } from './user-bindings.js'
 import { BINDING_AUTHORING_SDK } from './user-binding-authoring.js'
 import { executionPolicies } from './binding-update-policy.js'
+import { PROMPT_SLOT_IDS, promptAssetText, resolvePromptTextConfig } from './prompt-text.js'
 
-const RUN_CODE_TOOL_DESCRIPTION = 'Evaluate the next TypeScript cell in this session-bound persistent REPL, reusing earlier top-level bindings. Use `code` for the cell and `description` for its short UI summary. Successful image-bearing subtool results are attached after the cell.'
-const RUN_CODE_CODE_DESCRIPTION = 'Code for the next PTC TypeScript cell, following the selected language conventions.'
-const RUN_CODE_DESCRIPTION_DESCRIPTION = 'Short active-voice summary of what this cell does, 5-10 words (shown in the UI).'
 const CODE_TRANSPORT_INSTRUCTION = '`run_code` is the only tool callable directly. Call `tools.edit_run_code` and other SDK tools from inside a program. An accepted edit runs after the current cell finishes.'
 const PTC_COLLAPSE_SECTION_NAMES = Object.freeze(['tools:ptc-only', 'tools:code-only'])
 const INVALID_TOOL_JSON_FAILURE = Object.freeze({
@@ -29,7 +27,7 @@ const INVALID_TOOL_JSON_FAILURE = Object.freeze({
 const MALFORMED_TOOL_REJECTION_ID = 'dsh-ptc-plus-malformed-tool-json'
 const MALFORMED_TOOL_REJECTION_ARGUMENTS = '{"dsh_ptc_plus_malformed_tool_json":'
 
-function adaptRunCodeSchema(tool) {
+function adaptRunCodeSchema(tool, promptText) {
   const parameters = tool.parameters
   const properties = isRecord(parameters) ? parameters.properties : undefined
   const code = isRecord(properties) ? properties.code : undefined
@@ -41,13 +39,13 @@ function adaptRunCodeSchema(tool) {
   }
   return {
     ...tool,
-    description: RUN_CODE_TOOL_DESCRIPTION,
+    description: promptAssetText(promptText, PROMPT_SLOT_IDS.runCodeDescription),
     parameters: {
       ...parameters,
       properties: {
         ...properties,
-        code: { ...code, description: RUN_CODE_CODE_DESCRIPTION },
-        description: { ...description, description: RUN_CODE_DESCRIPTION_DESCRIPTION },
+        code: { ...code, description: promptAssetText(promptText, PROMPT_SLOT_IDS.runCodeCodeArg) },
+        description: { ...description, description: promptAssetText(promptText, PROMPT_SLOT_IDS.runCodeDescriptionArg) },
       },
     },
   }
@@ -472,11 +470,13 @@ export function createDirectSurfaceOwner({
   let disposed = false
   let currentCanonicalizeToolCalls = canonicalizeToolCalls
   let currentAutoDescribeRunCode = runtimeConfig.autoDescribeRunCode
+  let currentPromptText = resolvePromptTextConfig(runtimeConfig)
   let currentLanguageSemantics = executionPolicies(runtimeConfig).languageSemantics
   const tipConfig = {
     enabled: runtimeConfig.tipsEnabled,
     cooldownMessages: runtimeConfig.tipCooldownMessages,
     escalationFailures: runtimeConfig.tipEscalationFailures,
+    get prompt() { return currentPromptText },
   }
 
   const sessionOwner = (id) => {
@@ -561,6 +561,7 @@ export function createDirectSurfaceOwner({
       currentLanguageSemantics = executionPolicies(nextConfig).languageSemantics
       currentCanonicalizeToolCalls = nextConfig.canonicalizeToolCalls
       currentAutoDescribeRunCode = nextConfig.autoDescribeRunCode
+      currentPromptText = resolvePromptTextConfig(nextConfig)
       cordisRecovery.reconfigure(nextConfig.cordisToolsEnabled)
       tipConfig.enabled = nextConfig.tipsEnabled
       tipConfig.cooldownMessages = nextConfig.tipCooldownMessages
@@ -628,10 +629,11 @@ export function createDirectSurfaceOwner({
       const userBindings = sessionPtc ? await userBindingsForAgent(agent) : undefined
       if (!isCurrent()) return assembly
       const runCode = tools.find(tool => tool?.name === RUN_CODE)
+      const promptText = currentPromptText
       let directTools = sessionPtc ? capabilityEnvironment?.visibleSchemas(agent, tools) ?? tools : tools
       if (sessionPtcProjection) {
         editTransport.ensureInstalled(agent)
-        directTools = [adaptRunCodeSchema(runCode)]
+        directTools = [adaptRunCodeSchema(runCode, promptText)]
       }
       const runtimeContexts = sessionPtc
         ? sessionRuntimeContexts(agent, tipConfig, {
@@ -641,7 +643,9 @@ export function createDirectSurfaceOwner({
           },
         })
         : { contexts: [] }
-      const bindingDefaults = userBindings === undefined ? undefined : userBindingsConfiguredContext(userBindings)
+      const bindingDefaults = userBindings === undefined ? undefined : userBindingsConfiguredContext(userBindings, {
+        entryLabel: promptAssetText(promptText, PROMPT_SLOT_IDS.userBindingsEntryLabel),
+      })
       const contexts = [
         ...runtimeContexts.contexts,
         ...(bindingDefaults === undefined ? [] : [bindingDefaults]),
@@ -684,7 +688,7 @@ export function createDirectSurfaceOwner({
         tools: sessionPtcProjection
           ? directTools
           : directTools.map(tool => tool?.name === RUN_CODE
-            ? adaptRunCodeSchema(tool)
+            ? adaptRunCodeSchema(tool, promptText)
             : tool),
         sections,
       }

package/internal/edit-transport-owner.js

@@ -7,10 +7,12 @@ import {
   REWRITES_KEY,
   isCanonicalSequence,
   liveToolCallSeq,
+  normalizeDeferredEditSettlement,
   normalizeJournal,
   normalizeRecoveryBoundaries,
   normalizeRewrites,
   validatedRewrites,
+  withDiagnosticWording,
 } from './session-journal.js'
 import {
   EXPECTED_TARGET_CALL_SEQ,
@@ -18,6 +20,11 @@ import {
   editRunCodeSchema,
 } from './rejected-cell-editor.js'
 import { projectSessionLog } from './session-log-view.js'
+import { refoldEditableSettlement } from './session-journal-recovery.js'
+import {
+  PRUNED_EDIT, PRUNED_EDIT_EN, PRUNED_SUMMARY_MISMATCH, PRUNED_SUMMARY_MISMATCH_EN,
+} from './projection-retention.js'
+import { PROMPT_SLOT_IDS, promptAssetText } from './prompt-text.js'
 import { sessionEvents } from './session-events.js'
 import { deepEqualJson, snapshotJsonValue } from '@deepseek-ai/dsh-util-values'
 import { scopeTarget } from '@deepseek-ai/dsh-scope'
@@ -72,8 +79,35 @@ function nestedEditStart(sessionLog, exec) {
     || event.data.rootCallId !== exec.rootCallId
     || event.data.parentCallId !== exec.rootCallId
     || !deepEqualJson(event.data.arguments, exec.arguments)) return undefined
-  const target = projectSessionLog({ session: { events: events.slice(0, index + 1) } }).editableRun
-  return { startSeq: event.seq, rootCallSeq, target }
+  const slice = { session: { events: events.slice(0, index + 1) } }
+  const view = projectSessionLog(slice)
+  let target = view.editableRun
+  // A dropped cluster is not gone for good: the log still holds the events, so the
+  // edit path refolds that slice with pruning disabled and reads the cell from
+  // there. Only when the log itself cannot supply it does the edit report that the
+  // retention window cut it.
+  if (target === undefined && view.retentionSummary !== undefined) {
+    const refolded = refoldEditableSettlement(events.slice(0, index + 1), view.retentionSummary)
+    target = refolded.run
+    // The summary is the checkpoint's only record of a dropped cluster; the log is
+    // the authority. When the two disagree the edit must not proceed on either.
+    //
+    // This call site cannot produce that disagreement: the summary and the refold
+    // come from the same fold of the same event slice, and the run the refold reads
+    // is the one the pruned fold pins, so `refoldEditableSettlement` never finds a
+    // summary record for it. The comparison stays for the exported contract, which
+    // covers both outcomes in test/projection-retention.test.js.
+    /* c8 ignore start -- same-fold determinism: the call site cannot disagree with itself (see above) */
+    if (refolded.mismatch) {
+      return { startSeq: event.seq, rootCallSeq, target: undefined, retentionSummary: view.retentionSummary,
+        summaryMismatch: true }
+    }
+    /* c8 ignore stop */
+  }
+  // The summary travels with the target so an unavailable edit can say why it is
+  // unavailable: the cell fell outside the retention window instead of never
+  // existing.
+  return { startSeq: event.seq, rootCallSeq, target, retentionSummary: view.retentionSummary }
 }
 
 function unavailableDerivedResult(inner) {
@@ -118,6 +152,7 @@ export function createEditTransportOwner(ctx, {
   sessionId,
   toolSchemasForAgent,
   readSessionLog,
+  promptText,
 }) {
   const editClaims = new Map()
   const pendingAcceptances = new Map()
@@ -137,7 +172,7 @@ export function createEditTransportOwner(ctx, {
     }
   }
 
-  const definition = editRunCodeSchema()
+  const definition = editRunCodeSchema(promptAssetText(promptText, PROMPT_SLOT_IDS.editRunCodeDescription))
   const derivedMetadata = (derived) => {
     const meta = {
       [JOURNAL_KEY]: normalizeJournal(derived.journal),
@@ -164,9 +199,12 @@ export function createEditTransportOwner(ctx, {
           derived.draftCapability,
           presentationGeneration,
         )
+    // The derived settlement records its own diagnostic wording, so a replay reads
+    // the same pairing the root path publishes.
+    const withWording = withDiagnosticWording(withDraft, withDraft[JOURNAL_KEY])
     return derived.replMemory === undefined
-      ? withDraft
-      : withReplMemorySnapshot(withDraft, derived.replMemory, presentationGeneration)
+      ? withWording
+      : withReplMemorySnapshot(withWording, derived.replMemory, presentationGeneration)
   }
   definition.output = {
     schema: {
@@ -193,8 +231,17 @@ export function createEditTransportOwner(ctx, {
       throw new Error('ptc-plus: edit_run_code requires a unique persisted PTC sub-call start')
     }
     const target = start.target
+    /* c8 ignore start -- reachable only through `nestedEditStart`'s mismatch, which cannot disagree with itself (see there) */
+    if (start.summaryMismatch === true) {
+      return { accepted: false, scheduled: false,
+        reason: `${PRUNED_SUMMARY_MISMATCH} / ${PRUNED_SUMMARY_MISMATCH_EN}` }
+    }
+    /* c8 ignore stop */
     if (target?.source === undefined || target.callSeq === undefined) {
-      return { accepted: false, scheduled: false, reason: 'no run_code cell is currently eligible for safe editing' }
+      return { accepted: false, scheduled: false,
+        reason: start.retentionSummary === undefined
+          ? 'no run_code cell is currently eligible for safe editing'
+          : `${PRUNED_EDIT} / ${PRUNED_EDIT_EN}` }
     }
     const edited = editRejectedCell(args, target.source)
     if (!edited.edited) {
@@ -292,7 +339,7 @@ export function createEditTransportOwner(ctx, {
         const journalValue = isRecord(metadata) && Object.hasOwn(metadata, JOURNAL_KEY)
           ? metadata[JOURNAL_KEY] : undefined
         const journal = journalValue === undefined ? undefined : normalizeJournal(journalValue)
-        if (journal === undefined || journal.status === 'noop'
+        if (journal === undefined
           || inner.isError !== (journal.completion?.kind === 'throw' || journal.status === 'discarded')) {
           this.finish(false)
           return { outcome: unavailableDerivedResult(inner), presentation: derivedPresentation(inner) }
@@ -310,16 +357,34 @@ export function createEditTransportOwner(ctx, {
           code: edited.code,
           description: edited.description,
         }
+        const metaValue = derivedMetadata(derived)
+        let settlement
+        try {
+          settlement = normalizeDeferredEditSettlement(metaValue, target.callSeq)
+        } catch {
+          // Metadata this relation cannot prove must not reach the root result.
+          this.finish(false)
+          return { outcome: unavailableDerivedResult(inner), presentation: derivedPresentation(inner) }
+        }
+        const provenance = {
+          startSeq: start.startSeq,
+          executionStartSeq: executionStart.seq,
+          rootCallSeq: start.rootCallSeq,
+          subCallId: exec.callId,
+          meta: metaValue,
+        }
+        if (settlement.unexecuted === true) {
+          // The accepted edit is proved by a settlement that never ran. Publishing
+          // the relation keeps the root cell provable, while the outcome and the
+          // unexecuted journal keep the revision from executing, from publishing a
+          // binding and from becoming the next edit target.
+          this.finish(false)
+          return { outcome: unavailableDerivedResult(inner), presentation: derivedPresentation(inner), provenance }
+        }
         return {
           outcome: derivedEditResult(inner),
           presentation: derivedPresentation(inner),
-          provenance: {
-            startSeq: start.startSeq,
-            executionStartSeq: executionStart.seq,
-            rootCallSeq: start.rootCallSeq,
-            subCallId: exec.callId,
-            meta: derivedMetadata(derived),
-          },
+          provenance,
         }
       },
     }

package/internal/isolated-worker.js

@@ -5,14 +5,46 @@ import { PassThrough } from 'node:stream'
 import { pathToFileURL } from 'node:url'
 import { helperProcessEnvironment, isElectronHost } from './worker-environment.js'
 
+/**
+ * Bound on the wait for one on-demand utilization answer.
+ *
+ * The helper answers by reading the inner worker's counters synchronously, so
+ * this bound covers delivery rather than helper work. It is deliberately not
+ * the shutdown release grace below: how long a stopping helper may keep running
+ * must not decide how long a cell waits for its measurement.
+ */
+export const ISOLATED_SAMPLE_MS = 1000
+/**
+ * Sampling failure code for a sample whose answer this transport could not
+ * observe. The transport reports only that fact: whether the worker stays usable
+ * belongs to the caller, which alone knows how many consecutive measurements it
+ * may lose before the worker has to be replaced.
+ */
+export const UNANSWERED_SAMPLE_CODE = 'ptc-sample-unanswered'
+/**
+ * Helper messages one sample may read out before it gives up on the answer.
+ *
+ * Reading stops at the first event-loop turn that delivers nothing, so this
+ * bound only ends a backlog larger than the bound itself, where the answer
+ * cannot be reached by reading until the channel empties.
+ */
+const SAMPLE_DRAIN_TURNS = 4096
 /**
  * Fallback bound for a helper that answers the stop request and then keeps the
  * process alive with unrelated work of its own.
  */
 const ISOLATED_RELEASE_MS = 1000
-/** Absolute bound after which an unresponsive helper is killed. */
+/**
+ * Default bound for each close stage of one helper and the transport default.
+ *
+ * Exit confirmation and the output close that follows are each bounded by it;
+ * the fixed release grace is capped so the bound still leaves a confirmation
+ * window for the kill. A transport instance carries a configurable
+ * `reclaimBoundMs`, and the close path reads that instance bound instead of
+ * this default.
+ */
 const ISOLATED_STOP_MS = 5000
-/** Bound on the helper's output pipes really ending after its process exited. */
+/** Default bound on the helper's output pipes really ending after its process exited. */
 const ISOLATED_OUTPUT_MS = 5000
 
 export function isolatedWorkerEntry(entry) {
@@ -36,7 +68,7 @@ export function isolatedWorkerEntry(entry) {
  * so a kernel that never answers is reclaimed without ending the host.
  */
 export class IsolatedWorker extends EventEmitter {
-  constructor({ helper, entry, workerData, resourceLimits, env, protocol = 'kernel' }) {
+  constructor({ helper, entry, workerData, resourceLimits, env, protocol = 'kernel', reclaimBoundMs = ISOLATED_STOP_MS }) {
     super()
     // The entry follows the worker constructor's contract: a URL or a string
     // filename. Anything else fails here, before a helper process exists.
@@ -58,6 +90,29 @@ export class IsolatedWorker extends EventEmitter {
     this.utilization = { idle: 0, active: 0 }
     this.utilizationSequence = 0
     this.utilizationRequests = new Map()
+    /**
+     * Count of messages this helper has produced.
+     *
+     * Reading a sample uses it to tell one event-loop turn that delivered
+     * something from one that delivered nothing; the count says nothing about
+     * when the helper wrote a message.
+     */
+    this.helperMessages = 0
+    /**
+     * Bound this instance waits for one utilization answer.
+     *
+     * It is read per request, so a transport user may shorten or extend the wait
+     * for its own environment without changing the shutdown release grace.
+     */
+    this.sampleBoundMs = ISOLATED_SAMPLE_MS
+    /**
+     * Bound this instance's close path waits for the killed helper to be
+     * confirmed gone and for its output pipes to end.
+     *
+     * It is read when the close starts, so a transport user may widen the wait
+     * for its own platform without changing the release grace.
+     */
+    this.reclaimBoundMs = reclaimBoundMs
     this.pendingErrors = []
     this.performance = {
       /** Utilization reported by the helper, in the shape callers already use. */
@@ -124,6 +179,7 @@ export class IsolatedWorker extends EventEmitter {
       }
     })
     this.child.on('message', message => {
+      this.helperMessages += 1
       if (message?.type === 'child-error') {
         const error = new Error(message.message)
         if (message.name !== undefined) error.name = message.name
@@ -139,11 +195,14 @@ export class IsolatedWorker extends EventEmitter {
       }
       if (message?.type === 'inner-worker-exit') { this.emit('inner-worker-exit', message.code); return }
       if (message?.type === 'utilization-sample') {
+        // An answer for a request this transport already concluded is still the
+        // helper doing its work: keep the freshest value it reported.
+        this.utilization = message.utilization
         const pending = this.utilizationRequests.get(message.id)
         if (pending !== undefined) {
           this.utilizationRequests.delete(message.id)
           clearTimeout(pending.timer)
-          this.utilization = message.utilization
+          if (pending.decision !== undefined) clearImmediate(pending.decision)
           pending.resolve(message.utilization)
         }
         return
@@ -225,25 +284,81 @@ export class IsolatedWorker extends EventEmitter {
     }
     const id = ++this.utilizationSequence
     return new Promise((resolve, reject) => {
-      const timer = setTimeout(() => {
-        this.utilizationRequests.delete(id)
-        reject(new Error('kernel helper did not answer utilization sampling before its deadline'))
-      }, ISOLATED_RELEASE_MS)
-      this.utilizationRequests.set(id, { resolve, reject, timer })
+      const pending = { resolve, reject, timer: undefined, decision: undefined }
+      pending.timer = setTimeout(() => {
+        // A blocked host runs its expired timers before it reads its IPC pipe, so
+        // the answer may be waiting unread here. Read the channel out first and
+        // only then conclude that no answer exists.
+        pending.decision = setImmediate(() => this.#readOutSample(id, pending))
+      }, this.sampleBoundMs)
+      this.utilizationRequests.set(id, pending)
       try {
         this.child.send({ type: 'sample-utilization', id })
       } catch (error) {
-        clearTimeout(timer)
+        clearTimeout(pending.timer)
         this.utilizationRequests.delete(id)
         reject(error)
       }
     })
   }
 
+  /**
+   * Read the helper's channel out before one unanswered sample is concluded.
+   *
+   * Node delivers one helper message per event-loop turn, and the answer this
+   * request waits for is written after everything the helper wrote before it, so
+   * it can sit behind queued messages. Each turn therefore either delivers the
+   * answer or another message the helper wrote; only a turn that delivers no
+   * message shows that the channel holds nothing more this read could observe.
+   *
+   * A message the parser still holds in parts is not delivered on any of those
+   * turns, so a partially received message ahead of the answer delays it past
+   * this read-out; the sample then reports no answer, which is all this
+   * transport can prove about it.
+   */
+  #readOutSample(id, pending) {
+    let delivered = this.helperMessages
+    let turns = 0
+    const turn = () => {
+      if (this.utilizationRequests.get(id) !== pending) return
+      if (turns >= SAMPLE_DRAIN_TURNS) {
+        this.utilizationRequests.delete(id)
+        pending.decision = undefined
+        pending.reject(this.#unansweredSample('backlog'))
+        return
+      }
+      if (this.helperMessages === delivered) {
+        this.utilizationRequests.delete(id)
+        pending.decision = undefined
+        pending.reject(this.#unansweredSample('silent-channel'))
+        return
+      }
+      delivered = this.helperMessages
+      turns += 1
+      pending.decision = setImmediate(turn)
+    }
+    pending.decision = setImmediate(turn)
+  }
+
+  /**
+   * Report one sample whose answer this transport could not observe.
+   *
+   * The transport states the observation only. Whether the caller keeps its
+   * worker is decided where the consecutive measurement failures are counted.
+   */
+  #unansweredSample(reason) {
+    const error = new Error(reason === 'backlog'
+      ? `kernel helper wrote at least ${SAMPLE_DRAIN_TURNS} messages ahead of this utilization sample, so its answer could not be reached before the read-out bound`
+      : 'kernel helper did not answer utilization sampling before its deadline')
+    error.code = UNANSWERED_SAMPLE_CODE
+    return error
+  }
+
   /** Fail every request that still needs the helper's utilization answer. */
   #rejectUtilizationRequests(error) {
     for (const pending of this.utilizationRequests.values()) {
       clearTimeout(pending.timer)
+      if (pending.decision !== undefined) clearImmediate(pending.decision)
       pending.reject(error)
     }
     this.utilizationRequests.clear()
@@ -268,12 +383,14 @@ export class IsolatedWorker extends EventEmitter {
 
   async #stop() {
     if (this.exited) return
-    // Both cutoffs are anchored at the moment the close starts: an acknowledgement
-    // never postpones the kill, and a kill still leaves a positive bounded window
-    // for the helper's real exit to arrive.
+    // The configured bound is this close's exit-confirmation deadline, anchored
+    // at the close start so an acknowledgement never postpones the kill. The
+    // fixed release grace is capped to leave a grace-sized confirmation window
+    // for the kill, so a bound at or just above the grace is never consumed
+    // before the kill; the output pipes then get the same bound from their exit.
     const started = Date.now()
-    const killAt = started + ISOLATED_RELEASE_MS
-    const confirmBy = started + ISOLATED_STOP_MS
+    const confirmBy = started + this.reclaimBoundMs
+    const releaseAt = started + Math.min(ISOLATED_RELEASE_MS, Math.max(0, this.reclaimBoundMs - ISOLATED_RELEASE_MS))
     const exited = this.exitedPromise
     const onReleased = message => {
       if (message?.type === 'worker-message' && message.value?.type === 'shutdown-released') this.released = true
@@ -287,7 +404,7 @@ export class IsolatedWorker extends EventEmitter {
       } catch {
         // The channel is closed; the kill path below owns the instance.
       }
-      if (!await leftWithin(this, remaining(killAt))) {
+      if (!await leftWithin(this, remaining(releaseAt))) {
         let killFailure
         if (!this.exited) {
           try {
@@ -410,7 +527,7 @@ export class IsolatedOwner {
     // synchronously finish or throw and clear the marker for a later retry.
     const settling = Promise.resolve().then(async () => {
       if (record.neverStarted !== true && record.transport !== undefined) {
-        const closed = await outputClosed(record.transport, ISOLATED_OUTPUT_MS)
+        const closed = await outputClosed(record.transport, record.transport?.reclaimBoundMs ?? ISOLATED_OUTPUT_MS)
         if (!closed) {
           // Output never drained: keep the instance and say so instead of
           // pretending the pipes ended naturally.