Safety margin subtracted from a lease’s expiry when computing a command’s
execution budget. Stopping this far before the lease actually expires
guarantees the runtime finishes (or abandons) the command while the lease
is still held, so an expired lease is never redelivered by the manager
while a duplicate is still in flight. Used by the app-owned pull
Receiver; twin of the TypeScript receiver’s LEASE_SAFETY_MARGIN_MS.
Per-command execution budget: min(envelope.deadline, lease_expiry − [LEASE_SAFETY_MARGIN]). The LEASE bound is clamped to now; an
already-past deadline is not — it yields a zero budget and an immediate
HANDLER_TIMEOUT, which is the correct outcome for a command delivered
after its deadline. There is
no lease-renew call in the protocol, so the safety-margined lease expiry
always bounds the budget. Twin of the TypeScript receiver’s
commandBudget.