Track remaining lifecycle extractions from #1754

[jhgaylor]

Finish replacing frozen #1754 with focused, independently reviewable PRs. The small-extraction audit is complete; the remaining changes need working lifecycle paths with their persistence and recovery rules.

Reference: frozen source, audited against main bed264af on 2026-09-10. Parent: #1732; consumer: Review Loop #30.

Already extracted: #1796, #1797, #1818, #1820, #1826, #1827, #1831 and #1840. Reset fencing and its caller-transaction guard belong to #1768. Preserve the earlier #1761–#1764 fixes and #1801's same-identity co-tenant rule. Recheck current main before each extraction.

Suggested sequence; replace each checkbox with its implementing PR links:

• Provider create intent and result. Integrate SandboxOperations with one real provisioning caller. Commit intent before provider I/O; retain physical identity, original owner and capacity through timeout, caller loss and parent deletion. Test confirmed success, definite refusal and uncertain completion. Pair dependency upgrades with their tested consumer.
• Confirmed deletion and reconciliation. Extend that journal through teardown, reaping and account deletion. Release reservations only with sufficient provider evidence; retain uncertain obligations and their accounting. Test crash/retry and name reuse. GET 404 alone must not release the existing uncertain create 53c090d1-fc9e-46e9-b88a-478a4c984f4a.
• Committed holder transfer. Extract the relevant SandboxHolders behavior with conditional binding updates, attachment-clock writes and post-commit notifications. Preserve tenant/environment/vault identity, reject stale transfers and account for unused reservations. Test concurrent wake/rebind. Current notifications precede binding updates; the frozen destination-checked callback requires a committed producer.
• Actor launch ownership and recovery. Integrate claims, launch/startup outcomes and one worker startup/teardown path. Fence stale callbacks by actor incarnation; registry absence must not authorize takeover of unresolved work. Test caller loss, restart, reconnect and delayed callbacks. Add dispatch/watchdog recovery in follow-up PRs with their callers.
• Durable prompt delivery. Persist and claim a prompt through an actual worker, including admission, images, refusal and wake dispatch. Ship HTTP receipt/idempotency outcomes with that behavior. Test duplicate requests, conflicting keys, crash/replay, cancellation and replaced actors; preserve fix: validate opening input before allocating a sandbox #1840's input validation.
• Journaled park/resume/checkpoint. Combine SandboxActivity, locked holder decisions and one SandboxTransitions caller at a time. Test attachment racing idle reclamation and uncertain park/resume/checkpoint responses. Keep unresolved operations fenced and record confirmed outcomes accurately.
• Bounded-execution integration and evidence. Map residual ExecutionGuard/deadline changes to focused replacements for held Journal bounded turn deadlines and remote stop intent #1744–Refuse conversation release while remote execution is unresolved #1752. Preserve admission, startup and prompt fences. Prove bounded stopping, cancellation/restart recovery and physical worker deletion on the integrated revision; link that evidence back to Expose typed runtime execution limits for bounded agent turns #1732 and Review Loop fix(render): drop Burrito wrap from fountain_server release #30.

Keep each PR to one complete behavior, with its schema, caller and meaningful regression tests. Split larger items by caller or provider while preserving the invariants above. Use independent PostgreSQL interleavings for lock claims, validate migration rollback, run full precommit and CI, and regenerate revision-specific evidence. Use one CI watcher per PR at a 60-second interval. Review and merge remain with the merge agent.

Track deployment, runtime/provider recovery activation and SDK publication separately. Keep #1754 frozen until every useful residual hunk has a replacement or an explicitly linked deferral. Close this tracker when the checklist and that residual mapping are complete; publishing schemas or carrying forward historical evidence does not satisfy the lifecycle acceptance criteria.

[jhgaylor]

Activation granularity is the blocker for #1744–#1752

Verified in code on 2026-09-11 while rebasing the held stack onto post-#1744 main. Recording it here because it is the decision that gates the last checkbox, and it is a design gap rather than a bug.

The only lever that makes a turn bounded is global. FOUNTAIN_EXECUTION_LIMITS → :execution_limit_ceiling is one host-wide app env (ExecutionLimits.host_ceiling/0), plus the per-account users.execution_limits. Neither has a per-provider scope.

Setting it stops non-Sprites conversations opening a turn at all. ExecutionGuard._unsafe_register_bounded/3 rolls back :provider_not_supported for any sandbox whose provider is not sprites, and it does so inside the admission transaction. The stack's own test states it:

test "an unsupported provider cannot retain an admitted turn", c do
  c.sandbox |> Ecto.Changeset.change(provider: "runner") |> Repo.update!()
  assert {:error, :provider_not_supported} = Conversations._unsafe_create_turn_on_sandbox(...)
  assert Repo.aggregate(Turn, :count) == 0
end

Production runs E2B, Daytona and self-hosted runners alongside Sprites, so the host ceiling cannot be set at all without breaking those tenants. config/runtime.exs validates only the JSON shape — nothing warns the operator. The per-account ceiling is usable only for an account that never touches another provider, and nothing checks that either.

Consequence: the feature cannot be activated on a mixed-provider deployment. Decided 2026-09-11 that per-provider granularity is follow-up tracked here, not in scope for the journal PRs. ADR 0046 now documents this (#2008), and the PR that adds the granularity deletes that section.

Two smaller items from the same pass

• :execution_fenced had no FallbackController clause, so every fenced API call returned a bare 422 with no body plus a warning log per refusal. Fixed on main in A reset refused by a bounded execution answers 409, not a bare 422 #2008.
• ADR 0046 still described Sprites #33 as an outstanding external dependency; it merged 2026-09-08. Corrected in A reset refused by a bounded execution answers 409, not a bare 422 #2008. That dependency can come off the blocker list.

State of the held stack

#1744 and #1745 are merged. #1746–#1752 are rebased onto post-#1744 main and pushed, with three fixes the rebase forced:

• write_turn_usage's locked re-read refused every stamped turn. It rolled back on is_map(current.usage), but since Platform inference is unbilled when a turn ends without a session/prompt response #1685 a turn carries an inference stamp from the moment it starts — so on platform inference the real end-of-turn figure came back :already_recorded, the turn kept only the stamp, and the conversation's token counters never moved. Caught by main's own Platform inference is unbilled when a turn ends without a session/prompt response #1685 regressions, not by the stack's suite.
• The conversation_server.ex size pins, re-measured post-rebase (2648 / 2642, both still ratchets down from main's 2762).
• The deadline-event migration renumbered to sort after main's head. The turn-execution-guard migration deliberately keeps 20260907214000: it is already on main, and a version recorded in a deployed schema_migrations must not move.

🤖 Generated with Claude Code

https://claude.ai/code/session_01R9reKpmXUUJf4eUMULogie