Module budgets 

Teardown budgets shared by every session host (values copied from agent-tui/src/tui/signals.rs; signals.rs re-exports these on day 2).

• SAVE_TIMEOUT_SECS — session save + index end record (data safety first)
• HOOKS_TIMEOUT_SECS — on_session_end hook emit (concurrent, fail-open)
• TEARDOWN_TIMEOUT_SECS = their sum.

Constants

CANCEL_DRAIN_TIMEOUT

CANCEL_DRAIN_TIMEOUT_MS

SessionActor::cancel_turn: how long a cancelled turn’s stream is drained for the engine’s cancel-path history, final Usage and any in-flight context-head checkpoint. The engine’s provider/tool awaits are cancellation-first, so the tail normally arrives in milliseconds; on expiry the actor keeps its last adopted (valid) history. Also the grace a driver-revoked turn gets (revoked_turn_deadline).

CANCEL_DRAIN_TIMEOUT_SECS

Whole-second ceiling of the drain, for the budget sums below/elsewhere.

CANCEL_TURN_TIMEOUT_SECS

Worst case of cancel_turn: the drain, then the bounded wait for the interrupted turn’s save before it announces Idle (announce_idle).

EXTENSIONS_READY_TIMEOUT

EXTENSIONS_READY_TIMEOUT_SECS

SessionActor::create bound on EngineHost::extensions_ready(): the loader guard should make this unreachable; it exists so a session can never hang on a loader that never reports (warns, then proceeds).

HOOKS_TIMEOUT

HOOKS_TIMEOUT_SECS

OBSERVABILITY_FLUSH_TIMEOUT_SECS

Session end’s bounded observability flush (finish STEP 3).

RELOAD_ABORT_SEND_SECS

Delivering ReloadAborted to a session whose command queue is full.

RELOAD_ANNOUNCE_WAIT_SECS

Other connections’ Bye{Reloading} writers, after the announce.

RELOAD_BYE_FLUSH_SECS

The requesting connection flushes its own Bye before the exec.

RELOAD_CHECKPOINT_BUDGET_SECS

Per-session Checkpoint{Reload} wait: cancel_turn (the drain + its bounded save) + stopping the session’s workers + the checkpoint’s own bounded save + 1 s margin. Sessions checkpoint concurrently.

RELOAD_EXT_REDISCOVERY_SECS

A failed exec re-discovers the extensions before the sessions resume.

RELOAD_EXT_SHUTDOWN_SECS

Extension sidecars shut down for the exec.

RELOAD_FENCE_TIMEOUT

RELOAD_FENCE_TIMEOUT_SECS

Longest a reload checkpoint fences its session (no queue-wake turns, keep-warm pings, driver ticks or parking) waiting for the execv or for the daemon to report it failed (ReloadAborted). Both normally come within seconds; this only bounds a reload that never reports back (a daemon bug: clients cannot send a reload checkpoint).

RELOAD_FENCE_WORST_CASE_SECS

Longest a session stays fenced before its process is replaced or it is told the exec failed: the slowest other session’s checkpoint, the announce, the flush, the sidecar shutdown, then (failed exec) the re-discovery and the abort delivery.

SAVE_TIMEOUT

SAVE_TIMEOUT_SECS

SESSION_END_TIMEOUT_SECS

Worst case of SessionActor::finish: cancel a running turn, one bounded save, the on_session_end hooks, the observability flush.

TEARDOWN_TIMEOUT_SECS

UNPARK_TIMEOUT

UNPARK_TIMEOUT_SECS

SessionActor::unpark bound (B3): journal load + runtime rebuild. Transports wait ATTACH_TIMEOUT_PARKED (25 s) for a parked attach.

WORKER_RELOAD_STOP_TIMEOUT

WORKER_RELOAD_STOP_TIMEOUT_SECS

SessionActor::checkpoint for a daemon reload: how long the workers it stopped get to finish stopping (cancel → the runtime’s cancel-path history → the finalizer’s resume archive) before the exec destroys them. Cancellation is cooperative and normally takes milliseconds; a worker blocked in a tool that ignores cancellation is abandoned with whatever archive it already had.