Replace sandbox maintenance with durable reset and explicit Web controls

[SaladDay]

Changing a hosted backend previously required manual maintenance and draining. Replace that flow with an explicit durable reset: auto archives idle, queued and suspended hosted Sessions while waiting for started work, then escalates at a persisted deadline; force requests cancellation and archive. Cancellation resumes admission while already archived Sessions stay archived. Completion waits for actual resource cleanup, preserves history and persisted Files/Artifacts, retires old node identities and returns the deployment to setup at a new generation. Self-hosted execution and model defaults remain independent.

Core owns reset state, remaining resources and offline-node blockers. The shared client and Web expose confirmation, progress, cancellation and recovery without replaying uncertain writes. Retire the maintenance route/status, support audited per-Session archive, and update installer setup/conversion, generated Core contracts and English operator documentation. Public Agent API and machine schemas remain unchanged. E2B conversion is refused before mutation and remains a final-release blocker.

Deployment drains now fence lifecycle cancellation between exclusive leased database operations and close admission synchronously if retirement fails. For forced archive, a causal device marker permits only the exact existing cancellation delivery to settle for at most 20 seconds from its original durable cancellation request. Credentials remain revoked for new work/connections; ordinary revocation clears the exception. Both cleanup paths wait for an actual terminal result or bounded fallback. Native confirmation still determines cancellation; incomplete receipts remain failures. Migration 80 has no historical backfill and refuses unsettled downgrade.

Validation: installer 195 passing plus one existing host skip; unchanged Web source 414 unit tests and 63 fixture browser cases; actual H0/H1/H2 browser states passed on the prior e205 artifact. That artifact passed auto/cancel, natural completion, real 300-second escalation, actual pending-placement cleanup, offline/restart recovery, fresh execution, history/Artifact preservation and self-hosted continuity. Two forced waiting Turns failed with event_stream_incomplete: the original evidence remains partial and is not qualification of this correction. Independent lease/retirement re-review is clean, with real PostgreSQL and race tests. Cancellation regressions cover 13 real-database/authenticated-WebSocket scenarios and both cleanup paths; these controlled protocol peers are not real native/model qualification. The previous candidate 8aefd passed local and CI checks, but dependent G CI exposed a second shared lease-close cause: fresh-database snapshot estimates incurred expensive JIT inside the existing bounded reset page. Current candidate 9e37aa0 explicitly bounds the schema-enforced singleton in snapshot SQL while preserving one observation time, result types and every existing timeout. Real PostgreSQL plan, populated result-equivalence, controlled deadline and race checks passed. A separate two-line test readiness correction waits for an unrelated node to be registered before exercising slow callbacks; original RPC bounds remain unchanged. Fresh independent review is clean. The exact current local server gate passed (store 408.567 seconds, execution 14.653 seconds, 661 client and 414 Web unit tests plus typechecks/build; approved browser gate separate). All CI passed: sessions 36358802529, complete check 36358802559 and native 36358802594. A new source-bound private artifact build is now authorized; installation and real acceptance await independent artifact verification. Real native cancellation/recovery qualification remains required before delivery.

No intermediate release or live-demo/rehearsal mutation. Online generations, node updates, later diagnostics, safe E2B conversion and final release qualification remain separate approved work.