diff --git a/.env.example b/.env.example
index fa7aeead..d5bbd871 100644
--- a/.env.example
+++ b/.env.example
@@ -70,6 +70,55 @@ PARSAR_AGENT_DAEMON_WS_URL=ws://parsar-server:8080/agent-daemon/ws
 # Bot's own open_id (ou_xxx). Required for group chat @Bot to work.
 PARSAR_FEISHU_DEFAULT_BOT_OPEN_ID=
 
+# -----------------------------------------------------------------------------
+# Cloud sandbox — e2b.app (optional; powers the "Cloud isolation" agent mode)
+# -----------------------------------------------------------------------------
+# Both values are required to enable cloud isolation. With either empty the
+# server logs a warning at boot and cloud-isolation agents fail fast, while
+# local-device agents keep working.
+#
+# Build the template first (writes only gitignored build artifacts):
+#     make e2b-template
+# then paste the template id it reports here. Rebuilding the same template
+# name keeps the id, so this only changes on first creation.
+AGENT_DAEMON_SANDBOX_TEMPLATE=
+PARSAR_E2B_API_KEY=
+
+# Optional larger tier, selected per agent via agents.config.sandbox_size="xl".
+# An agent asking for a size with no template configured degrades to the
+# standard one with a warning rather than failing the acquire.
+AGENT_DAEMON_SANDBOX_TEMPLATE_XL=
+
+# Optional deployment-wide sandbox lifetime. Uses Go duration syntax (for
+# example 30m, 1h, or 24h) and defaults to 1h. An agent may override this with
+# agents.config.sandbox_ttl. Parsar does not impose a provider-specific maximum;
+# configure a value supported by your sandbox provider and account.
+AGENT_DAEMON_SANDBOX_TTL=
+
+# Deployment-wide default for periodic best-effort renewal. An agent may
+# override this with agents.config.sandbox_auto_renew. Renewal requires a TTL
+# longer than the five-minute scan interval. Enabled by default so a
+# continuously-used agent's sandbox is not reaped mid-conversation; set to
+# false to opt out (e.g. for a provider that does not support renewal).
+AGENT_DAEMON_SANDBOX_AUTO_RENEW=true
+
+# Deprecated compatibility setting. Used only when the duration above is
+# empty; prefer AGENT_DAEMON_SANDBOX_TTL for new deployments.
+AGENT_DAEMON_SANDBOX_TTL_HOURS=
+
+# Self-hosted / proxied e2b only. Leave empty for e2b.app.
+PARSAR_E2B_API_BASE_URL=
+PARSAR_E2B_SANDBOX_HOST=
+# PEM of a private CA, when the sandbox gateway serves a non-public cert.
+PARSAR_E2B_CA_CERT=
+
+# IMPORTANT for local testing: the daemon runs INSIDE the cloud sandbox and
+# dials back to PARSAR_PUBLIC_URL, so a loopback URL can never work — the
+# sandbox resolves 127.0.0.1 to itself and pairing times out. Expose the dev
+# server through a tunnel and set PARSAR_PUBLIC_URL to that hostname, e.g.
+#     ngrok http 18080
+#     PARSAR_PUBLIC_URL=https://<subdomain>.ngrok-free.dev
+
 # -----------------------------------------------------------------------------
 # Network proxy (optional — only if your host needs a proxy for internet)
 # -----------------------------------------------------------------------------
diff --git a/.gitignore b/.gitignore
index 7c23b234..1a5f6373 100644
--- a/.gitignore
+++ b/.gitignore
@@ -51,6 +51,7 @@ go.work.sum
 
 # Reviewer / verifier session artifacts (workspace-only, never commit)
 reviewer-report.md
+semantic-review/
 /.fork-point
 
 # Claude Code IDE state (per-developer scratch: plans, worktree pointers,
@@ -72,3 +73,12 @@ reviewer-report.md
 !/parsar-bootstrap/
 /httprunner
 !/httprunner/
+# `cd server && go build ./cmd/server` drops its output here.
+/server/server
+!/server/server/
+
+# Cross-compiled binaries staged for the E2B template build
+# (`make e2b-template`). E2B has no multi-stage build support, so
+# parsar-daemon / parsar are compiled on the host and COPY'd in by
+# infra/sandbox/e2b.Dockerfile. Build artefacts, never committed.
+infra/sandbox/.build/
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 84d458c3..826d96ad 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -248,6 +248,47 @@ description and keep ownership on the side listed here.
 - Eager acquisition must be best-effort. Failure to prewarm a sandbox should
   surface as runtime health/provisioning state, not crash unrelated startup
   paths.
+- Cloud sandbox maintenance runs once at server startup and every five minutes.
+  Automatic renewal requires a TTL longer than that interval; interrupted
+  renewals remain retryable, while a provider rejection disables the policy.
+- A `spawning` sandbox binding holds that agent's only reservation slot
+  (`uk_sandboxes_active_per_agent` is partial on `killed_at is null`), and the
+  loser path waits on `spawning` indefinitely. Any code that reserves a slot
+  must therefore guarantee a terminal transition, and an acquire that finds a
+  reservation older than the cold-start bound must be able to reclaim it —
+  otherwise one crashed cold start wedges the agent permanently.
+
+### Sandbox images
+
+- `infra/sandbox/Dockerfile` (local Docker + generic) and
+  `infra/sandbox/e2b.Dockerfile` (e2b.app) must keep their shared runtime
+  payload, CLI versions, and hooks aligned; provider-specific bootstrap and
+  build mechanics may differ.
+  Agent CLI installs live only in `infra/sandbox/scripts/install-agents.sh`,
+  which both images run; do not inline per-CLI `npm install -g` / download
+  steps in either Dockerfile. That script owns the version pins and the Node
+  force-relink that keeps a base image's bundled Node from shadowing ours.
+- The image must ship the hook scripts at the absolute paths
+  `server/internal/connector/agentdaemon/sandbox_seed.go` seeds into
+  `settings.json` (`/opt/parsar/hooks/claude/...`). The hooks fail open, so a
+  missing script degrades spec/memory injection silently instead of erroring —
+  changing one side means changing the other.
+- e2b's template builder is not BuildKit. It rejects multi-stage builds (hence
+  the prebuilt binaries in `infra/sandbox/.build/`, staged by
+  `make e2b-template`), it does not persist `/tmp` between layers, and it
+  lowers `ARG FOO="bar"` keeping the quotes as literal characters — so version
+  ARGs in `e2b.Dockerfile` must stay unquoted.
+- Build templates with `make e2b-template`. It writes only into
+  `infra/sandbox/.build/` (gitignored), never the repo root.
+
+### Testing cloud isolation locally
+
+- The daemon runs inside the cloud sandbox and dials back to
+  `PARSAR_PUBLIC_URL`, so a loopback URL cannot work: the sandbox resolves
+  `127.0.0.1` to itself and pairing times out. Expose the dev server through a
+  tunnel and set `PARSAR_PUBLIC_URL` to that hostname.
+- `AGENT_DAEMON_SANDBOX_TEMPLATE` + `PARSAR_E2B_API_KEY` are the two required
+  values; see `.env.example` for the full set and their defaults.
 
 ### API, DB, and generated surfaces
 
diff --git a/Makefile b/Makefile
index 87c5e8ad..14e9edbc 100644
--- a/Makefile
+++ b/Makefile
@@ -18,7 +18,7 @@ endif
 PARSAR_IMAGE     ?= parsar
 PARSAR_IMAGE_TAG ?= dev
 
-.PHONY: help setup node-deps dev dev-db check check-setup check-sqlc check-go check-store check-web check-cli check-hygiene test test-fast test-go test-web typecheck-web lint-web-design lint-web test-cli typecheck reset-dev clean-dev paths migrate-dev sqlc-generate server web cli devgateway http-runner-once http-runner-loop dev-all smoke e2e-http-agent e2e-feishu-gateway dev-server-up dev-server-down dev-server-log bootstrap docker-build docker-build-no-cache openapi
+.PHONY: help setup node-deps dev dev-db check check-setup check-sqlc check-go check-store check-web check-cli check-hygiene test test-fast test-go test-web typecheck-web lint-web-design lint-web test-cli typecheck reset-dev clean-dev paths migrate-dev sqlc-generate server web cli devgateway http-runner-once http-runner-loop dev-all smoke e2e-http-agent e2e-feishu-gateway dev-server-up dev-server-down dev-server-log bootstrap docker-build docker-build-no-cache openapi e2b-template e2b-template-binaries
 
 help:
 	@printf '%s\n' \
@@ -43,7 +43,11 @@ help:
 	  '  make check-go         Run sqlc drift check and non-store Go tests' \
 	  '  make check-store      Run migration and store integration tests' \
 	  '  make check-web        Run web typecheck and design lint' \
-	  '  make check-cli        Typecheck CLI/plugin packages'
+	  '  make check-cli        Typecheck CLI/plugin packages' \
+	  '' \
+	  'Cloud sandbox (e2b):' \
+	  '  make e2b-template     Cross-compile binaries and build the e2b sandbox template' \
+	  '  make e2b-template E2B_TEMPLATE_NAME=my-sandbox'
 
 setup:
 	./scripts/setup.sh
@@ -243,12 +247,13 @@ docker-build-no-cache:
 #     go install github.com/swaggo/swag/cmd/swag@v1.16.4
 # The recipe auto-installs on first use.
 SWAG_VERSION ?= v1.16.4
+SWAG ?= $(shell command -v swag 2>/dev/null || printf '%s/bin/swag' "$$(go env GOPATH)")
 
 openapi:
-	@command -v swag >/dev/null 2>&1 || \
+	@command -v $(SWAG) >/dev/null 2>&1 || \
 	    go install github.com/swaggo/swag/cmd/swag@$(SWAG_VERSION)
 	@mkdir -p docs/openapi
-	swag init \
+	$(SWAG) init \
 	    -g server/cmd/server/main.go \
 	    --dir . \
 	    --output docs/openapi/gen \
@@ -260,3 +265,60 @@ openapi:
 	@rmdir docs/openapi/gen 2>/dev/null || true
 	@echo "openapi: wrote docs/openapi/openapi.yaml"
 	@echo "openapi: paths=$$(grep -c '^  /' docs/openapi/openapi.yaml)"
+
+# --- E2B sandbox template ----------------------------------------------
+#
+# Builds the cloud-isolation sandbox template on e2b.app. Collapses the
+# manual sequence (cross-compile two Go binaries, then invoke the e2b
+# CLI from the right directory) into one command.
+#
+# Why the binaries are cross-compiled here rather than in the image:
+# e2b's builder rejects multi-stage Dockerfiles, so infra/sandbox/
+# e2b.Dockerfile cannot compile Go itself and instead COPYs prebuilt
+# binaries out of infra/sandbox/.build/ (gitignored). linux/amd64 is
+# hardcoded because e2b templates are amd64-only.
+#
+# The build context is infra/sandbox/ (not the repo root) so the upload
+# stays small; every COPY source in e2b.Dockerfile lives under it.
+#
+# Requires the e2b CLI and an API key:
+#     npm install -g @e2b/cli
+#     export E2B_API_KEY=e2b_...
+# PARSAR_E2B_API_KEY is accepted as a fallback so the same value already
+# in .env (used by the server) works without being re-exported, and .env
+# is sourced when present.
+#
+# After a successful build, point the server at the template:
+#     AGENT_DAEMON_SANDBOX_TEMPLATE=<template id>
+# Rebuilding an existing template name keeps the same id, so the id only
+# has to be copied into .env on first creation.
+E2B_TEMPLATE_NAME ?= parsar-sandbox
+E2B_TEMPLATE_MEMORY_MB ?= 4096
+E2B_BUILD_DIR := infra/sandbox/.build
+
+e2b-template: e2b-template-binaries
+	@set -euo pipefail; \
+	if [[ -f .env ]]; then set -a; source .env; set +a; fi; \
+	key="$${E2B_API_KEY:-$${PARSAR_E2B_API_KEY:-}}"; \
+	if [[ -z "$$key" ]]; then \
+	  echo "e2b-template: E2B_API_KEY (or PARSAR_E2B_API_KEY) is required" >&2; \
+	  echo "              get one at https://e2b.dev/dashboard" >&2; \
+	  exit 1; \
+	fi; \
+	command -v e2b >/dev/null 2>&1 || { \
+	  echo "e2b-template: e2b CLI not found; install with 'npm install -g @e2b/cli'" >&2; \
+	  exit 1; \
+	}; \
+	cd infra/sandbox && E2B_API_KEY="$$key" e2b template create $(E2B_TEMPLATE_NAME) \
+	    --dockerfile e2b.Dockerfile \
+	    --memory-mb $(E2B_TEMPLATE_MEMORY_MB)
+
+# Cross-compile the two binaries the template image needs. Split out so
+# it can be run on its own when iterating on daemon code.
+e2b-template-binaries:
+	@mkdir -p $(E2B_BUILD_DIR)
+	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-s -w" \
+	    -o $(E2B_BUILD_DIR)/parsar-daemon ./apps/parsar-daemon/cmd/parsar-daemon
+	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-s -w" \
+	    -o $(E2B_BUILD_DIR)/parsar ./apps/parsar/cmd/parsar
+	@echo "e2b-template: staged linux/amd64 binaries in $(E2B_BUILD_DIR)"
diff --git a/apps/parsar-daemon/internal/agent/binpath/binpath.go b/apps/parsar-daemon/internal/agent/binpath/binpath.go
new file mode 100644
index 00000000..77d9f223
--- /dev/null
+++ b/apps/parsar-daemon/internal/agent/binpath/binpath.go
@@ -0,0 +1,61 @@
+// Package binpath resolves which executable each agent adapter should
+// probe and spawn.
+//
+// By default every engine is looked up by bare name on PATH ("claude",
+// "codex", ...). That breaks in images where PATH is not under our
+// control: e2b's base image, for instance, ships its own
+// /usr/local/bin entries that can shadow the ones we install, and a
+// bare-name lookup then resolves to the wrong (or no) binary. The
+// symptom is the worst kind — `parsar-daemon connect` reports
+// "no supported agent CLI available" and the device never dials in,
+// with no indication of which lookup failed.
+//
+// The env overrides below let an image or operator pin an absolute path
+// instead. They are read in ONE place so the version probe
+// (CheckCLIAvailable) and the run-time spawn (sessionConfig) can never
+// disagree: a probe that succeeds against /custom/claude while the run
+// spawns PATH's `claude` would advertise a capability the daemon cannot
+// actually honour.
+package binpath
+
+import (
+	"os"
+	"strings"
+)
+
+// Env var names for the per-engine executable overrides. Empty or unset
+// means "look up the default name on PATH".
+const (
+	EnvClaudeCode = "PARSAR_CLAUDE_BIN"
+	EnvCodex      = "PARSAR_CODEX_BIN"
+	EnvPi         = "PARSAR_PI_BIN"
+	EnvOpenCode   = "PARSAR_OPENCODE_BIN"
+)
+
+// Default executable names, used when the matching env var is unset.
+const (
+	DefaultClaudeCode = "claude"
+	DefaultCodex      = "codex"
+	DefaultPi         = "pi"
+	DefaultOpenCode   = "opencode"
+)
+
+// resolve returns the trimmed env override when set, else fallback.
+func resolve(envVar, fallback string) string {
+	if v := strings.TrimSpace(os.Getenv(envVar)); v != "" {
+		return v
+	}
+	return fallback
+}
+
+// ClaudeCode returns the claude executable to probe and spawn.
+func ClaudeCode() string { return resolve(EnvClaudeCode, DefaultClaudeCode) }
+
+// Codex returns the codex executable to probe and spawn.
+func Codex() string { return resolve(EnvCodex, DefaultCodex) }
+
+// Pi returns the pi executable to probe and spawn.
+func Pi() string { return resolve(EnvPi, DefaultPi) }
+
+// OpenCode returns the opencode executable to probe and spawn.
+func OpenCode() string { return resolve(EnvOpenCode, DefaultOpenCode) }
diff --git a/apps/parsar-daemon/internal/agent/binpath/binpath_test.go b/apps/parsar-daemon/internal/agent/binpath/binpath_test.go
new file mode 100644
index 00000000..f6381f43
--- /dev/null
+++ b/apps/parsar-daemon/internal/agent/binpath/binpath_test.go
@@ -0,0 +1,38 @@
+package binpath
+
+import "testing"
+
+func TestResolvers(t *testing.T) {
+	tests := []struct {
+		name       string
+		envVar     string
+		fallback   string
+		resolve    func() string
+		override   string
+		wantPinned string
+	}{
+		{name: "claude", envVar: EnvClaudeCode, fallback: DefaultClaudeCode, resolve: ClaudeCode, override: "  /opt/agents/claude  ", wantPinned: "/opt/agents/claude"},
+		{name: "codex", envVar: EnvCodex, fallback: DefaultCodex, resolve: Codex, override: "  /opt/agents/codex  ", wantPinned: "/opt/agents/codex"},
+		{name: "pi", envVar: EnvPi, fallback: DefaultPi, resolve: Pi, override: "  /opt/agents/pi  ", wantPinned: "/opt/agents/pi"},
+		{name: "opencode", envVar: EnvOpenCode, fallback: DefaultOpenCode, resolve: OpenCode, override: "  /opt/agents/opencode  ", wantPinned: "/opt/agents/opencode"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Setenv(tt.envVar, "")
+			if got := tt.resolve(); got != tt.fallback {
+				t.Fatalf("unset override: got %q, want %q", got, tt.fallback)
+			}
+
+			t.Setenv(tt.envVar, tt.override)
+			if got := tt.resolve(); got != tt.wantPinned {
+				t.Fatalf("explicit override: got %q, want %q", got, tt.wantPinned)
+			}
+
+			t.Setenv(tt.envVar, " \t ")
+			if got := tt.resolve(); got != tt.fallback {
+				t.Fatalf("blank override: got %q, want %q", got, tt.fallback)
+			}
+		})
+	}
+}
diff --git a/apps/parsar-daemon/internal/agent/claudecode/session.go b/apps/parsar-daemon/internal/agent/claudecode/session.go
index 5d2521e7..a04657b5 100644
--- a/apps/parsar-daemon/internal/agent/claudecode/session.go
+++ b/apps/parsar-daemon/internal/agent/claudecode/session.go
@@ -15,6 +15,7 @@ import (
 	"time"
 
 	"github.com/MiniMax-AI-Dev/parsar/apps/parsar-daemon/internal/agent"
+	"github.com/MiniMax-AI-Dev/parsar/apps/parsar-daemon/internal/agent/binpath"
 	"github.com/MiniMax-AI-Dev/parsar/apps/parsar-daemon/internal/agent/clirunner"
 	"github.com/MiniMax-AI-Dev/parsar/internal/agentdaemon/proto"
 	obslog "github.com/MiniMax-AI-Dev/parsar/internal/obs/log"
@@ -23,7 +24,8 @@ import (
 // sessionConfig customises Factory for tests (alternative binary path,
 // alternative logger, shorter SIGTERM→SIGKILL escalation).
 type sessionConfig struct {
-	// claudeBinary defaults to "claude" so os/exec resolves via PATH.
+	// claudeBinary defaults to binpath.ClaudeCode(): the bare name
+	// "claude" for a PATH lookup, or the PARSAR_CLAUDE_BIN override.
 	claudeBinary string
 
 	// extraArgs are appended after BuildArgs' output. Tests use this
@@ -48,7 +50,7 @@ const defaultAskTimeout = 10 * time.Minute
 
 func defaultConfig() sessionConfig {
 	return sessionConfig{
-		claudeBinary: "claude",
+		claudeBinary: binpath.ClaudeCode(),
 		killTimeout:  3 * time.Second,
 		askTimeout:   defaultAskTimeout,
 		logger:       obslog.Bg(),
@@ -122,7 +124,7 @@ func newSession(parent context.Context, req proto.PromptRequestPayload, out chan
 		cfg.logger = obslog.Bg()
 	}
 	if cfg.claudeBinary == "" {
-		cfg.claudeBinary = "claude"
+		cfg.claudeBinary = binpath.ClaudeCode()
 	}
 	if cfg.killTimeout <= 0 {
 		cfg.killTimeout = 3 * time.Second
diff --git a/apps/parsar-daemon/internal/agent/claudecode/version.go b/apps/parsar-daemon/internal/agent/claudecode/version.go
index 72c9ad2f..0dbcd060 100644
--- a/apps/parsar-daemon/internal/agent/claudecode/version.go
+++ b/apps/parsar-daemon/internal/agent/claudecode/version.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 
+	"github.com/MiniMax-AI-Dev/parsar/apps/parsar-daemon/internal/agent/binpath"
 	"github.com/MiniMax-AI-Dev/parsar/apps/parsar-daemon/internal/agent/versionprobe"
 )
 
@@ -18,13 +19,14 @@ const InstallURL = "https://docs.anthropic.com/claude/docs/claude-code"
 var ErrCLINotFound = errors.New("claude CLI not found")
 
 // CheckCLIAvailable runs `<binary> --version` and returns the trimmed
-// first line. Empty binary defaults to "claude". On missing binary the
-// error wraps ErrCLINotFound; on other failures the wrapped error
-// keeps the raw stderr.
+// first line. Empty binary defaults to binpath.ClaudeCode() — the same
+// resolver the session spawn uses, so probe and spawn always agree. On
+// missing binary the error wraps ErrCLINotFound; on other failures the
+// wrapped error keeps the raw stderr.
 func CheckCLIAvailable(ctx context.Context, binary string) (string, error) {
 	return versionprobe.Check(ctx, binary, versionprobe.Config{
 		Name:          "claude",
-		DefaultBinary: "claude",
+		DefaultBinary: binpath.ClaudeCode(),
 		MissingError:  ErrCLINotFound,
 	})
 }
diff --git a/apps/parsar-daemon/internal/agent/codex/rpc.go b/apps/parsar-daemon/internal/agent/codex/rpc.go
index a9fcd518..72ff16be 100644
--- a/apps/parsar-daemon/internal/agent/codex/rpc.go
+++ b/apps/parsar-daemon/internal/agent/codex/rpc.go
@@ -39,7 +39,9 @@ const rpcStdoutBufferMax = 16 * 1024 * 1024
 // JSONRPCConfig configures a JSONRPCClient. Zero-value fields fall
 // through to sensible defaults.
 type JSONRPCConfig struct {
-	// Binary is the codex executable to spawn. Defaults to "codex" (PATH lookup).
+	// Binary is the codex executable to spawn. Defaults to defaultBinary():
+	// the bare name "codex" for a PATH lookup, or the PARSAR_CODEX_BIN
+	// override.
 	Binary string
 	// Args added before "app-server --stdio". Useful for `-c key=value`
 	// overrides without forcing CODEX_HOME indirection.
@@ -136,7 +138,7 @@ type rpcResponse struct {
 // Start is called.
 func NewJSONRPCClient(cfg JSONRPCConfig) *JSONRPCClient {
 	if cfg.Binary == "" {
-		cfg.Binary = defaultBinary
+		cfg.Binary = defaultBinary()
 	}
 	if cfg.LogTag == "" {
 		cfg.LogTag = "codex-rpc"
diff --git a/apps/parsar-daemon/internal/agent/codex/session.go b/apps/parsar-daemon/internal/agent/codex/session.go
index 7539f65a..115ab146 100644
--- a/apps/parsar-daemon/internal/agent/codex/session.go
+++ b/apps/parsar-daemon/internal/agent/codex/session.go
@@ -32,7 +32,7 @@ type sessionConfig struct {
 
 func defaultSessionConfig() sessionConfig {
 	return sessionConfig{
-		codexBinary: defaultBinary,
+		codexBinary: defaultBinary(),
 		logger:      obslog.Bg(),
 		killTimeout: rpcKillTimeout,
 	}
@@ -100,7 +100,7 @@ func newSession(parent context.Context, req proto.PromptRequestPayload, out chan
 		cfg.logger = obslog.Bg()
 	}
 	if cfg.codexBinary == "" {
-		cfg.codexBinary = defaultBinary
+		cfg.codexBinary = defaultBinary()
 	}
 	if cfg.killTimeout <= 0 {
 		cfg.killTimeout = rpcKillTimeout
diff --git a/apps/parsar-daemon/internal/agent/codex/version.go b/apps/parsar-daemon/internal/agent/codex/version.go
index bfa66525..f36fc527 100644
--- a/apps/parsar-daemon/internal/agent/codex/version.go
+++ b/apps/parsar-daemon/internal/agent/codex/version.go
@@ -7,13 +7,19 @@ import (
 	"fmt"
 	"os/exec"
 	"strings"
+
+	"github.com/MiniMax-AI-Dev/parsar/apps/parsar-daemon/internal/agent/binpath"
 )
 
 // InstallURL points operators at the Codex install instructions when
 // the daemon can see the adapter but not the CLI binary.
 const InstallURL = "https://github.com/openai/codex"
 
-const defaultBinary = "codex"
+// defaultBinary is the executable to probe and spawn: binpath.Codex()
+// honours the PARSAR_CODEX_BIN override so a bare-name PATH lookup can
+// be bypassed in images where PATH is not under our control. A function
+// rather than a const so the env is read at call time.
+func defaultBinary() string { return binpath.Codex() }
 
 // ErrCLINotFound is returned by CheckCLIAvailable when the binary
 // cannot be located on PATH. Callers use errors.Is to distinguish an
@@ -21,12 +27,12 @@ const defaultBinary = "codex"
 var ErrCLINotFound = errors.New("codex CLI not found")
 
 // CheckCLIAvailable runs `<binary> --version` and returns the trimmed
-// first line. The empty binary name defaults to "codex". Matches the
-// CheckCLIAvailable signature of the claudecode and opencode adapters
+// first line. The empty binary name defaults to defaultBinary(). Matches
+// the CheckCLIAvailable signature of the claudecode and opencode adapters
 // so connect.go's preflight loop treats every engine uniformly.
 func CheckCLIAvailable(ctx context.Context, binary string) (string, error) {
 	if strings.TrimSpace(binary) == "" {
-		binary = defaultBinary
+		binary = defaultBinary()
 	}
 	if _, lookErr := exec.LookPath(binary); lookErr != nil {
 		return "", fmt.Errorf("%w: %s", ErrCLINotFound, binary)
diff --git a/apps/parsar-daemon/internal/agent/opencode/session.go b/apps/parsar-daemon/internal/agent/opencode/session.go
index 1a051bc0..d05b12e0 100644
--- a/apps/parsar-daemon/internal/agent/opencode/session.go
+++ b/apps/parsar-daemon/internal/agent/opencode/session.go
@@ -29,7 +29,7 @@ type sessionConfig struct {
 }
 
 func defaultConfig() sessionConfig {
-	return sessionConfig{opencodeBinary: defaultBinary, killTimeout: 3 * time.Second, logger: obslog.Bg()}
+	return sessionConfig{opencodeBinary: defaultBinary(), killTimeout: 3 * time.Second, logger: obslog.Bg()}
 }
 
 // Factory implements agent.Factory for agent_kind="opencode".
@@ -67,7 +67,7 @@ func newSession(parent context.Context, req proto.PromptRequestPayload, out chan
 		cfg.logger = obslog.Bg()
 	}
 	if cfg.opencodeBinary == "" {
-		cfg.opencodeBinary = defaultBinary
+		cfg.opencodeBinary = defaultBinary()
 	}
 	if cfg.killTimeout <= 0 {
 		cfg.killTimeout = 3 * time.Second
diff --git a/apps/parsar-daemon/internal/agent/opencode/version.go b/apps/parsar-daemon/internal/agent/opencode/version.go
index 5f892301..f895c317 100644
--- a/apps/parsar-daemon/internal/agent/opencode/version.go
+++ b/apps/parsar-daemon/internal/agent/opencode/version.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 
+	"github.com/MiniMax-AI-Dev/parsar/apps/parsar-daemon/internal/agent/binpath"
 	"github.com/MiniMax-AI-Dev/parsar/apps/parsar-daemon/internal/agent/versionprobe"
 )
 
@@ -11,7 +12,11 @@ import (
 // daemon can see the adapter but not the CLI binary.
 const InstallURL = "https://opencode.ai/docs"
 
-const defaultBinary = "opencode"
+// defaultBinary is the executable to probe and spawn: binpath.OpenCode()
+// honours the PARSAR_OPENCODE_BIN override so a bare-name PATH lookup can
+// be bypassed in images where PATH is not under our control. A function
+// rather than a const so the env is read at call time.
+func defaultBinary() string { return binpath.OpenCode() }
 
 // ErrCLINotFound is returned by CheckCLIAvailable when the binary
 // cannot be located on PATH. Callers use errors.Is to distinguish an
@@ -19,11 +24,11 @@ const defaultBinary = "opencode"
 var ErrCLINotFound = errors.New("opencode CLI not found")
 
 // CheckCLIAvailable runs `<binary> --version` and returns the trimmed
-// first line. The empty binary name defaults to "opencode".
+// first line. The empty binary name defaults to defaultBinary().
 func CheckCLIAvailable(ctx context.Context, binary string) (string, error) {
 	return versionprobe.Check(ctx, binary, versionprobe.Config{
 		Name:          "opencode",
-		DefaultBinary: defaultBinary,
+		DefaultBinary: defaultBinary(),
 		MissingError:  ErrCLINotFound,
 		TrimBinary:    true,
 	})
diff --git a/apps/parsar-daemon/internal/agent/pi/session.go b/apps/parsar-daemon/internal/agent/pi/session.go
index a70ca3a1..ec652c6c 100644
--- a/apps/parsar-daemon/internal/agent/pi/session.go
+++ b/apps/parsar-daemon/internal/agent/pi/session.go
@@ -29,7 +29,7 @@ type sessionConfig struct {
 }
 
 func defaultConfig() sessionConfig {
-	return sessionConfig{piBinary: defaultBinary, killTimeout: 3 * time.Second, logger: obslog.Bg()}
+	return sessionConfig{piBinary: defaultBinary(), killTimeout: 3 * time.Second, logger: obslog.Bg()}
 }
 
 // Factory implements agent.Factory for agent_kind="pi".
@@ -65,7 +65,7 @@ func newSession(parent context.Context, req proto.PromptRequestPayload, out chan
 		cfg.logger = obslog.Bg()
 	}
 	if cfg.piBinary == "" {
-		cfg.piBinary = defaultBinary
+		cfg.piBinary = defaultBinary()
 	}
 	if cfg.killTimeout <= 0 {
 		cfg.killTimeout = 3 * time.Second
diff --git a/apps/parsar-daemon/internal/agent/pi/version.go b/apps/parsar-daemon/internal/agent/pi/version.go
index 9643f7e2..f217c251 100644
--- a/apps/parsar-daemon/internal/agent/pi/version.go
+++ b/apps/parsar-daemon/internal/agent/pi/version.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 
+	"github.com/MiniMax-AI-Dev/parsar/apps/parsar-daemon/internal/agent/binpath"
 	"github.com/MiniMax-AI-Dev/parsar/apps/parsar-daemon/internal/agent/versionprobe"
 )
 
@@ -11,7 +12,11 @@ import (
 // can see the adapter but not the CLI binary.
 const InstallURL = "https://github.com/earendil-works/pi"
 
-const defaultBinary = "pi"
+// defaultBinary is the executable to probe and spawn: binpath.Pi()
+// honours the PARSAR_PI_BIN override so a bare-name PATH lookup can be
+// bypassed in images where PATH is not under our control. A function
+// rather than a const so the env is read at call time.
+func defaultBinary() string { return binpath.Pi() }
 
 // ErrCLINotFound is returned by CheckCLIAvailable when the binary cannot
 // be located on PATH. Callers use errors.Is to distinguish an install
@@ -19,11 +24,11 @@ const defaultBinary = "pi"
 var ErrCLINotFound = errors.New("pi CLI not found")
 
 // CheckCLIAvailable runs `<binary> --version` and returns the trimmed
-// first line. The empty binary name defaults to "pi".
+// first line. The empty binary name defaults to defaultBinary().
 func CheckCLIAvailable(ctx context.Context, binary string) (string, error) {
 	return versionprobe.Check(ctx, binary, versionprobe.Config{
 		Name:           "pi",
-		DefaultBinary:  defaultBinary,
+		DefaultBinary:  defaultBinary(),
 		MissingError:   ErrCLINotFound,
 		TrimBinary:     true,
 		StderrFallback: true,
diff --git a/apps/web/src/i18n/locales/en-US/admin.json b/apps/web/src/i18n/locales/en-US/admin.json
index 1b3892ea..b7ef6ea9 100644
--- a/apps/web/src/i18n/locales/en-US/admin.json
+++ b/apps/web/src/i18n/locales/en-US/admin.json
@@ -1613,6 +1613,7 @@
         "codexMode": "Codex collaboration mode",
         "device": "Local device",
         "sandboxSize": "Sandbox size",
+        "sandboxAutoRenew": "Auto-renew sandbox",
         "sandboxImage": "Sandbox image",
         "workDir": "Working directory (optional)"
       },
@@ -1644,6 +1645,10 @@
         "standard": "Standard (2 vCPU / 4 GiB)",
         "xl": "Large (4 vCPU / 8 GiB)"
       },
+      "sandboxAutoRenew": {
+        "label": "Renew the sandbox before its lease expires",
+        "hint": "Keeps the sandbox alive during long conversations by extending its lease automatically. Turn off to let it expire at the end of its TTL."
+      },
       "codexMode": {
         "hint": "Plan mode enables Codex to ask structured questions in the conversation. Approval requests work in both modes.",
         "default": "Default",
diff --git a/apps/web/src/i18n/locales/zh-CN/admin.json b/apps/web/src/i18n/locales/zh-CN/admin.json
index c6e813c3..8b1bd91e 100644
--- a/apps/web/src/i18n/locales/zh-CN/admin.json
+++ b/apps/web/src/i18n/locales/zh-CN/admin.json
@@ -1613,6 +1613,7 @@
         "codexMode": "Codex 协作模式",
         "device": "本地设备",
         "sandboxSize": "沙盒规格",
+        "sandboxAutoRenew": "沙盒自动续期",
         "sandboxImage": "沙盒镜像",
         "workDir": "工作目录（可选）"
       },
@@ -1644,6 +1645,10 @@
         "standard": "标准 (2 vCPU / 4 GiB)",
         "xl": "大规格 (4 vCPU / 8 GiB)"
       },
+      "sandboxAutoRenew": {
+        "label": "在租约到期前自动续期沙盒",
+        "hint": "长对话期间自动延长沙盒租约，避免中途被回收。关闭后沙盒会在 TTL 到期时释放。"
+      },
       "codexMode": {
         "hint": "Plan 模式允许 Codex 在对话中发起结构化提问；两种模式都支持权限审批。",
         "default": "Default（默认）",
diff --git a/apps/web/src/pages/admin/CreateAgentDialog.tsx b/apps/web/src/pages/admin/CreateAgentDialog.tsx
index 55bbc727..521a9799 100644
--- a/apps/web/src/pages/admin/CreateAgentDialog.tsx
+++ b/apps/web/src/pages/admin/CreateAgentDialog.tsx
@@ -117,6 +117,13 @@ function sandboxSizeFromAgent(a?: Agent | null): SandboxSize {
   return v === "xl" ? "xl" : "standard"
 }
 
+function sandboxAutoRenewFromAgent(a?: Agent | null): boolean {
+  // Mirrors the daemon's autoRenewFor: agents.config.sandbox_auto_renew
+  // overrides the server default. Absent means "use the server default",
+  // which is on, so only an explicit false disables it.
+  return agentConfig(a).sandbox_auto_renew === false ? false : true
+}
+
 export type AgentDialogMode = "create" | "edit"
 
 export interface AgentDialogValues {
@@ -248,6 +255,9 @@ export function CreateAgentDialog({
   const [agentEngine, setAgentEngine] = useState<AgentEngine>("claude_code")
   const [codexMode, setCodexMode] = useState<CodexCollaborationMode>("default")
   const [sandboxSize, setSandboxSize] = useState<SandboxSize>("standard")
+  // Defaults to on, matching the server-wide default; only an explicit
+  // false in agent config turns it off.
+  const [sandboxAutoRenew, setSandboxAutoRenew] = useState(true)
   const [modelID, setModelID] = useState("")
   const [modelSearch, setModelSearch] = useState("")
   const [modelDropdownOpen, setModelDropdownOpen] = useState(false)
@@ -494,6 +504,7 @@ export function CreateAgentDialog({
       setAgentEngine(cloneSource ? agentEngineFromAgent(cloneSource) : "claude_code")
       setCodexMode(cloneSource ? agentCodexModeOf(cloneSource) : "default")
       setSandboxSize(cloneSource ? sandboxSizeFromAgent(cloneSource) : "standard")
+      setSandboxAutoRenew(cloneSource ? sandboxAutoRenewFromAgent(cloneSource) : true)
       setModelID(cloneSource ? modelIDFromAgent(cloneSource) : "")
       setModelSearch("")
       setModelDropdownOpen(false)
@@ -526,6 +537,7 @@ export function CreateAgentDialog({
       setAgentEngine(agentEngineFromAgent(agent))
       setCodexMode(agentCodexModeOf(agent))
       setSandboxSize(sandboxSizeFromAgent(agent))
+      setSandboxAutoRenew(sandboxAutoRenewFromAgent(agent))
       setModelID(modelIDFromAgent(agent) || firstModelID)
       setModelSearch("")
       setModelDropdownOpen(false)
@@ -808,7 +820,7 @@ export function CreateAgentDialog({
       ...(connector === "agent_daemon" ? {
         agent_kind: agentEngine,
         ...(agentEngine === "codex" ? { mode: codexMode } : {}),
-        ...(executionMode === "sandbox" ? { daemon_mode: "sandbox", sandbox_size: sandboxSize } : {}),
+        ...(executionMode === "sandbox" ? { daemon_mode: "sandbox", sandbox_size: sandboxSize, sandbox_auto_renew: sandboxAutoRenew } : {}),
         ...(executionMode === "local_device" ? { daemon_mode: "local", device_id: deviceID } : {}),
         // Daemon read order is work_dir > workdir > working_directory; emit the
         // canonical key. Empty string omits the field, falling back to the
@@ -826,6 +838,7 @@ export function CreateAgentDialog({
           : {}),
       daemon_mode: executionMode === "sandbox" ? "sandbox" : "local",
       sandbox_size: executionMode === "sandbox" ? sandboxSize : null,
+      sandbox_auto_renew: executionMode === "sandbox" ? sandboxAutoRenew : null,
       device_id: executionMode === "local_device" ? deviceID : null,
       work_dir: trimmedWorkDir || null,
     }
@@ -1136,6 +1149,23 @@ export function CreateAgentDialog({
                           <option value="xl">{t("agents.form.sandboxSize.xl")}</option>
                         </select>
                       </Field>
+                      <Field
+                        label={t("agents.form.fields.sandboxAutoRenew")}
+                        hint={t("agents.form.sandboxAutoRenew.hint")}
+                      >
+                        <label className="flex cursor-pointer items-start gap-3">
+                          <input
+                            type="checkbox"
+                            className="mt-0.5 h-4 w-4 shrink-0"
+                            checked={sandboxAutoRenew}
+                            disabled={pending}
+                            onChange={(e) => setSandboxAutoRenew(e.target.checked)}
+                          />
+                          <span className="min-w-0 flex-1 text-sm leading-4 text-fg">
+                            {t("agents.form.sandboxAutoRenew.label")}
+                          </span>
+                        </label>
+                      </Field>
                       {runtimeStatus.data?.sandbox_image ? (
                         <Field label={t("agents.form.fields.sandboxImage")} hint={t("agents.form.sandboxImage.hint")}>
                           <code className="block break-all rounded-md border border-line bg-surface-subtle px-3 py-2 text-xs text-fg-muted">
diff --git a/deploy/compose/.env.example b/deploy/compose/.env.example
index 141f810e..8697d41c 100644
--- a/deploy/compose/.env.example
+++ b/deploy/compose/.env.example
@@ -120,14 +120,22 @@ PARSAR_AGENT_DAEMON_OWNER_URL=
 # The values below only matter for the sandbox path — leave blank to
 # stay on local-daemon runtimes.
 PARSAR_E2B_API_KEY=
-# Custom template id (defaults to the public parsar-opencode-base
-# template when blank — fork it into your account if you need custom
-# pre-installs).
-PARSAR_E2B_TEMPLATE_ID=
-# Per-sandbox max wall-clock (seconds). Default 3600 in code.
-PARSAR_E2B_TIMEOUT_SECONDS=
+# Template id is required together with the API key to enable managed
+# cloud isolation. The XL template is optional and selected per Agent.
+AGENT_DAEMON_SANDBOX_TEMPLATE=
+AGENT_DAEMON_SANDBOX_TEMPLATE_XL=
+# Provider-neutral Go duration. Empty defaults to 1h.
+AGENT_DAEMON_SANDBOX_TTL=
+# Periodic best-effort renewal; requires a TTL longer than five minutes.
+# Enabled by default so a continuously-used agent's sandbox is not reaped
+# mid-conversation. Individual Agents may override it in config; set to
+# false here to opt the whole deployment out.
+AGENT_DAEMON_SANDBOX_AUTO_RENEW=true
 # Override only when E2B's API base URL is reverse-proxied.
 PARSAR_E2B_API_BASE_URL=
+# Self-hosted/proxied E2B only. Leave empty for e2b.app.
+PARSAR_E2B_SANDBOX_HOST=
+PARSAR_E2B_CA_CERT=
 
 # -----------------------------------------------------------------------------
 # Object storage (Aliyun OSS) — required for Plugin capability uploads
diff --git a/deploy/compose/compose.selfhost.yml b/deploy/compose/compose.selfhost.yml
index 14319fd1..91c31fc2 100644
--- a/deploy/compose/compose.selfhost.yml
+++ b/deploy/compose/compose.selfhost.yml
@@ -141,10 +141,14 @@ services:
       # connector can be backed by a platform-managed sandbox instead
       # of a paired parsar-daemon device. Leave blank to stick to
       # local-daemon runtimes.
-      PARSAR_E2B_API_KEY: ${PARSAR_E2B_API_KEY}
-      PARSAR_E2B_TEMPLATE_ID: ${PARSAR_E2B_TEMPLATE_ID}
-      PARSAR_E2B_TIMEOUT_SECONDS: ${PARSAR_E2B_TIMEOUT_SECONDS}
-      PARSAR_E2B_API_BASE_URL: ${PARSAR_E2B_API_BASE_URL}
+      AGENT_DAEMON_SANDBOX_TEMPLATE: ${AGENT_DAEMON_SANDBOX_TEMPLATE:-}
+      AGENT_DAEMON_SANDBOX_TEMPLATE_XL: ${AGENT_DAEMON_SANDBOX_TEMPLATE_XL:-}
+      AGENT_DAEMON_SANDBOX_TTL: ${AGENT_DAEMON_SANDBOX_TTL:-}
+      AGENT_DAEMON_SANDBOX_AUTO_RENEW: ${AGENT_DAEMON_SANDBOX_AUTO_RENEW:-true}
+      PARSAR_E2B_API_KEY: ${PARSAR_E2B_API_KEY:-}
+      PARSAR_E2B_API_BASE_URL: ${PARSAR_E2B_API_BASE_URL:-}
+      PARSAR_E2B_SANDBOX_HOST: ${PARSAR_E2B_SANDBOX_HOST:-}
+      PARSAR_E2B_CA_CERT: ${PARSAR_E2B_CA_CERT:-}
 
       # ---------- Audit / OTLP fan-out (optional) ----------
       PARSAR_AUDIT_OTLP_ENABLED: ${PARSAR_AUDIT_OTLP_ENABLED}
diff --git a/docker-compose.yml b/docker-compose.yml
index 3fb9d43f..6975deef 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -36,6 +36,15 @@ services:
       PARSAR_MASTER_KEY: "${PARSAR_MASTER_KEY:-0000000000000000000000000000000000000000000000000000000000000000}"
       PARSAR_SHARED_RUNTIME_TOKEN: "${PARSAR_SHARED_RUNTIME_TOKEN:-parsar-local-runtime-token-change-me}"
       PARSAR_AGENT_DAEMON_WS_URL: "ws://parsar-server:8080/agent-daemon/ws"
+      # Optional managed cloud sandbox. Empty template/key keeps it disabled.
+      AGENT_DAEMON_SANDBOX_TEMPLATE: "${AGENT_DAEMON_SANDBOX_TEMPLATE:-}"
+      AGENT_DAEMON_SANDBOX_TEMPLATE_XL: "${AGENT_DAEMON_SANDBOX_TEMPLATE_XL:-}"
+      AGENT_DAEMON_SANDBOX_TTL: "${AGENT_DAEMON_SANDBOX_TTL:-}"
+      AGENT_DAEMON_SANDBOX_AUTO_RENEW: "${AGENT_DAEMON_SANDBOX_AUTO_RENEW:-true}"
+      PARSAR_E2B_API_KEY: "${PARSAR_E2B_API_KEY:-}"
+      PARSAR_E2B_API_BASE_URL: "${PARSAR_E2B_API_BASE_URL:-}"
+      PARSAR_E2B_SANDBOX_HOST: "${PARSAR_E2B_SANDBOX_HOST:-}"
+      PARSAR_E2B_CA_CERT: "${PARSAR_E2B_CA_CERT:-}"
     volumes:
       - ${PARSAR_DATA_DIR:-server-data}:/var/lib/parsar
     healthcheck:
diff --git a/docs/openapi/openapi.yaml b/docs/openapi/openapi.yaml
index 181d5230..956928fa 100644
--- a/docs/openapi/openapi.yaml
+++ b/docs/openapi/openapi.yaml
@@ -908,8 +908,8 @@ definitions:
         type: string
       expires_at:
         description: |-
-          ExpiresAt is fetched live from the e2b control plane. Nil when
-          the binding isn't in this pod's cache or the lookup failed.
+          ExpiresAt is fetched live from the e2b control plane. Nil when the
+          sandbox is still spawning or the provider lookup failed.
         type: string
       killed_at:
         type: string
@@ -5290,6 +5290,12 @@ paths:
             additionalProperties:
               type: string
             type: object
+        "502":
+          description: Provider rejected sandbox release
+          schema:
+            additionalProperties:
+              type: string
+            type: object
         "503":
           description: Sandbox lifecycle store not wired
           schema:
@@ -5343,6 +5349,12 @@ paths:
             additionalProperties:
               type: string
             type: object
+        "502":
+          description: Provider rejected sandbox release
+          schema:
+            additionalProperties:
+              type: string
+            type: object
         "503":
           description: Sandbox lifecycle store not wired
           schema:
@@ -5354,9 +5366,8 @@ paths:
       - sandboxes
   /api/v1/workspaces/{workspaceID}/agents/{agentID}/sandbox/renew:
     post:
-      description: Bumps the e2b TTL on the live sandbox. 409 when this pod's cache
-        doesn't own the binding (a sibling pod cold-started it); 502 on renew failure.
-        Owner/admin only.
+      description: Bumps the provider TTL on the live sandbox, including bindings
+        created by a sibling pod. 502 on renew failure. Owner/admin only.
       operationId: renewDevAgentSandbox
       parameters:
       - description: Workspace UUID
@@ -5396,7 +5407,7 @@ paths:
               type: string
             type: object
         "409":
-          description: Sandbox not owned by this pod
+          description: Binding disappeared during renewal
           schema:
             additionalProperties:
               type: string
diff --git a/docs/spec-memory-module.md b/docs/spec-memory-module.md
index 650405e1..04f1eb5b 100644
--- a/docs/spec-memory-module.md
+++ b/docs/spec-memory-module.md
@@ -412,6 +412,13 @@ ValidateRunnerToken(ctx, token) (RuntimeIdentity, error)
 
 File: `infra/sandbox/Dockerfile`
 
+> There are now two sandbox images — `infra/sandbox/Dockerfile` and
+> `infra/sandbox/e2b.Dockerfile` — and **both** must ship these hook scripts,
+> because the hooks fail open: an image missing them degrades spec/memory
+> injection silently rather than erroring. See
+> [`CONTRIBUTING.md#sandbox-images`](../CONTRIBUTING.md#sandbox-images) for the
+> canonical rule.
+
 New content (after the existing parsar-daemon install section):
 ```dockerfile
 # parsar CLI
diff --git a/infra/sandbox/Dockerfile b/infra/sandbox/Dockerfile
index a34dded1..05504e7c 100644
--- a/infra/sandbox/Dockerfile
+++ b/infra/sandbox/Dockerfile
@@ -1,5 +1,7 @@
-# Parsar sandbox image — one Dockerfile, two deployment targets selected
-# by BASE_IMAGE:
+# Parsar sandbox image for the local Docker backend and generic OCI runtimes.
+# e2b.app uses infra/sandbox/e2b.Dockerfile because its template builder does
+# not support the same multi-stage build flow. Keep the shared install script,
+# CLI payload, and runtime hooks aligned between the two images.
 #
 #   docker build -f infra/sandbox/Dockerfile -t parsar-sandbox:local .
 #     Local docker sandbox (default). For AGENT_DAEMON_SANDBOX_BACKEND=docker,
@@ -9,11 +11,6 @@
 #     e2b API — just needs the agent CLIs + parsar-daemon on PATH + a
 #     shell. Multi-arch: add --platform linux/arm64 to cross-build.
 #
-#   docker build -f infra/sandbox/Dockerfile \
-#     --build-arg BASE_IMAGE=e2bdev/base:latest -t parsar-sandbox-e2b .
-#     e2b.app SaaS template. amd64 only. After build, the SandboxProvider
-#     only needs to: Sandbox.Create("parsar-sandbox-e2b", {timeout})
-#     → RunCommand: parsar-daemon connect --device-name <deviceId> -b
 #     (URL/token via env) → wait for the gateway to see deviceId dial in.
 #
 # Everything below this point is identical for both targets — swapping
diff --git a/infra/sandbox/e2b.Dockerfile b/infra/sandbox/e2b.Dockerfile
new file mode 100644
index 00000000..67eb9141
--- /dev/null
+++ b/infra/sandbox/e2b.Dockerfile
@@ -0,0 +1,130 @@
+# Parsar sandbox image — e2b.app template variant.
+#
+# Why this file exists separately from infra/sandbox/Dockerfile:
+# e2b's template builder rejects multi-stage Dockerfiles ("Multi-stage
+# Dockerfiles are not supported"), so the two Go binaries cannot be
+# compiled in-image. They are cross-compiled on the host into .build/
+# and COPY'd in here. Everything else MUST stay behaviourally identical
+# to infra/sandbox/Dockerfile.
+#
+# Agent CLI installs are NOT written inline here on purpose — they are
+# delegated to scripts/install-agents.sh, the same script the main
+# Dockerfile runs. That script owns the Node 22 force-relink that this
+# base image specifically needs (e2bdev/base ships its own
+# /usr/local/bin/node v20.9.0 which otherwise shadows the Node 22 we
+# install and silently breaks every npm-installed CLI at runtime).
+# Do not reintroduce per-CLI `npm install -g` lines here; edit
+# scripts/install-agents.sh so both images move together.
+#
+# Build context is infra/sandbox/ (NOT the repo root) so the upload
+# stays small; every COPY source below lives inside this directory.
+#
+# Build:
+#   make e2b-template
+# or manually, from repo root:
+#   CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-s -w" \
+#     -o infra/sandbox/.build/parsar-daemon ./apps/parsar-daemon/cmd/parsar-daemon
+#   CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-s -w" \
+#     -o infra/sandbox/.build/parsar ./apps/parsar/cmd/parsar
+#   cd infra/sandbox && e2b template create parsar-sandbox \
+#     --dockerfile e2b.Dockerfile --memory-mb 4096
+
+FROM e2bdev/base:latest
+
+# e2bdev/base declares `USER user`. The seed step writes Claude config to
+# /root/.claude/settings.json and install-agents.sh installs into
+# /root/.local/bin, so the whole image — and the daemon the server later
+# execs — has to be root with HOME=/root.
+USER root
+ENV HOME=/root
+
+# e2b templates are amd64-only; there is no BuildKit multi-platform
+# graph here to auto-populate TARGETARCH, so it is a plain default.
+ARG TARGETARCH=amd64
+
+# --- Base tools ---
+# curl/ca-certificates for downloads, jq for JSON, git for repo ops,
+# ripgrep for Claude Code's code search.
+RUN apt-get update -y \
+ && apt-get install -y --no-install-recommends \
+      curl ca-certificates jq git ripgrep \
+ && rm -rf /var/lib/apt/lists/*
+
+# --- Agent CLIs (Node 22 + Claude Code + Codex + Pi) ---
+# Single source of truth shared with infra/sandbox/Dockerfile. The script
+# is fail-loud: each install is followed by a --version check, so a broken
+# CLI fails the template build instead of surfacing as "command not found"
+# when a user first creates an Agent of that agent_kind.
+# Version pins are deliberately UNQUOTED. e2b's builder lowers
+# `ARG FOO="bar"` to `ENV FOO "bar"` and keeps the quotes as literal
+# characters, so a quoted default arrives in the script as `"bar"` and
+# corrupts every URL built from it:
+#   ARG CODEX_VERSION="0.141.0"  ->  .../rust-v"0.141.0"/...        (404)
+#   ARG CLAUDE_CODE_VERSION=""   ->  VERSION='""', which is NOT empty,
+#                                    so install-agents.sh skips its
+#                                    "resolve latest" branch and requests
+#                                    .../claude-code-releases/""/linux-x64/claude
+#                                    -> 400 Bad Request.
+# CLAUDE_CODE_VERSION is therefore not declared or forwarded at all:
+# install-agents.sh treats it as unset and resolves the latest release,
+# which is the behaviour we want here anyway.
+ARG CODEX_VERSION=0.141.0
+ARG PI_VERSION=0.80.6
+# Staged under /opt, NOT /tmp: e2b's builder does not persist /tmp across
+# layers, so `COPY ... /tmp/x` followed by `RUN /tmp/x` in the next layer
+# fails with "No such file or directory". The main Dockerfile can use /tmp
+# because BuildKit keeps it; this one cannot.
+COPY scripts/install-agents.sh /opt/parsar/bin/install-agents.sh
+RUN chmod +x /opt/parsar/bin/install-agents.sh \
+ && CODEX_VERSION="$CODEX_VERSION" PI_VERSION="$PI_VERSION" \
+    /opt/parsar/bin/install-agents.sh "$TARGETARCH" \
+ && rm -f /opt/parsar/bin/install-agents.sh
+
+# --- Python 3 + uv (MCP server runtimes) ---
+# Community MCP servers launch via `npx <pkg>` or `uvx <pkg>`; without
+# these preinstalled they fail with `spawn npx/uvx ENOENT` *after*
+# capability resolution already reported success — a silent runtime
+# failure with no UI signal. npx comes from install-agents.sh's Node.
+RUN apt-get update -y \
+ && apt-get install -y --no-install-recommends python3 \
+ && rm -rf /var/lib/apt/lists/* \
+ && curl -LsSf https://astral.sh/uv/install.sh | sh \
+ && ln -sf /root/.local/bin/uv /usr/local/bin/uv \
+ && ln -sf /root/.local/bin/uvx /usr/local/bin/uvx \
+ && python3 --version \
+ && uvx --version
+
+# --- parsar-daemon + parsar CLI (cross-compiled on the host) ---
+# The parsar CLI is what the hook scripts below shell out to for
+# `parsar inject snapshot`; without it the hooks fail open and the agent
+# boots with no spec/memory context.
+COPY .build/parsar-daemon /usr/local/bin/parsar-daemon
+COPY .build/parsar /usr/local/bin/parsar
+RUN chmod +x /usr/local/bin/parsar-daemon /usr/local/bin/parsar \
+ && /usr/local/bin/parsar-daemon version \
+ && /usr/local/bin/parsar --version
+
+# --- Hook scripts (Claude Code) ---
+# server/internal/connector/agentdaemon/sandbox_seed.go seeds a
+# settings.json pointing at these absolute paths
+# (/opt/parsar/hooks/claude/{session-start,user-prompt-submit}.py).
+# If they are missing the hooks fail open, so spec/memory injection
+# degrades silently — the image MUST carry them.
+COPY hooks/claude /opt/parsar/hooks/claude
+RUN chmod -R a+rx /opt/parsar/hooks
+
+# scripts/runtime-entrypoint.sh is deliberately NOT copied: it is the
+# compose-resident runtime's self-pairing loop (shared-token based). On
+# the e2b path the server drives `parsar-daemon connect` through envd
+# RunCommand instead, so shipping it would be dead weight.
+
+# --- Sandbox environment ---
+ENV IS_SANDBOX=1
+ENV DISABLE_TELEMETRY=1
+ENV CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1
+
+# /workspace exists for agents whose configured working directory points
+# at it; /root/.parsar is the daemon's state root. The connect step falls
+# back to /root when an agent has no work_dir configured.
+RUN mkdir -p /workspace /root/.parsar
+WORKDIR /root
diff --git a/scripts/dev-server-up.sh b/scripts/dev-server-up.sh
index 16066ff3..bfcb9112 100755
--- a/scripts/dev-server-up.sh
+++ b/scripts/dev-server-up.sh
@@ -153,6 +153,24 @@ fi
 pkill -f "${BIN_PATH}" 2>/dev/null || true
 sleep 1
 
+# ── load .env (project-local secrets, gitignored) ────────────────────
+# Source the repo-root .env if present so operators can keep E2B keys,
+# sandbox templates, and other per-machine secrets there without
+# polluting the launch command.
+#
+# Precedence: .env WINS over an already-exported shell variable, because
+# `set -a; source` performs a plain assignment. To override a value from
+# .env for one run, edit the file or pass the var on the make/script line
+# after this point rather than exporting it beforehand.
+DOT_ENV="${REPO_ROOT}/.env"
+if [[ -f "${DOT_ENV}" ]]; then
+  set -a
+  # shellcheck source=/dev/null
+  source "${DOT_ENV}"
+  set +a
+  echo "[dev-server-up] loaded ${DOT_ENV}"
+fi
+
 # ── start under tmux (survives sandbox bash exit) ────────────────────
 # The server refuses to boot without either real Feishu creds or mock
 # mode, and without a resolvable agent_daemon owner URL. Supply dev
@@ -170,8 +188,24 @@ OWNER_URL="${PARSAR_AGENT_DAEMON_OWNER_URL:-http://127.0.0.1:${PORT}}"
 FEISHU_WEBSOCKET="${PARSAR_FEISHU_WEBSOCKET:-true}"
 FEISHU_OUTBOUND="${PARSAR_FEISHU_OUTBOUND:-true}"
 MASTER_KEY="${PARSAR_MASTER_KEY:-parsar-dev-master-key-2026}"
+
+# Build the env string for the tmux command. Start with the required
+# core vars, then append any E2B / sandbox vars that are set.
+TMUX_ENV="PARSAR_ADDR=:${PORT} DATABASE_URL='${DATABASE_URL}' PARSAR_DEV_AUTH=${PARSAR_DEV_AUTH} PARSAR_FEISHU_MOCK=${FEISHU_MOCK} PARSAR_FEISHU_WEBSOCKET=${FEISHU_WEBSOCKET} PARSAR_FEISHU_OUTBOUND=${FEISHU_OUTBOUND} PARSAR_MASTER_KEY='${MASTER_KEY}' PARSAR_AGENT_DAEMON_OWNER_URL='${OWNER_URL}'"
+
+# E2B sandbox vars (from .env or pre-exported).
+[[ -n "${AGENT_DAEMON_SANDBOX_TEMPLATE:-}" ]] && TMUX_ENV+=" AGENT_DAEMON_SANDBOX_TEMPLATE='${AGENT_DAEMON_SANDBOX_TEMPLATE}'"
+[[ -n "${PARSAR_E2B_API_KEY:-}" ]] && TMUX_ENV+=" PARSAR_E2B_API_KEY='${PARSAR_E2B_API_KEY}'"
+[[ -n "${PARSAR_E2B_API_BASE_URL:-}" ]] && TMUX_ENV+=" PARSAR_E2B_API_BASE_URL='${PARSAR_E2B_API_BASE_URL}'"
+[[ -n "${PARSAR_E2B_SANDBOX_HOST:-}" ]] && TMUX_ENV+=" PARSAR_E2B_SANDBOX_HOST='${PARSAR_E2B_SANDBOX_HOST}'"
+[[ -n "${PARSAR_E2B_CA_CERT:-}" ]] && TMUX_ENV+=" PARSAR_E2B_CA_CERT='${PARSAR_E2B_CA_CERT}'"
+[[ -n "${AGENT_DAEMON_SANDBOX_TEMPLATE_XL:-}" ]] && TMUX_ENV+=" AGENT_DAEMON_SANDBOX_TEMPLATE_XL='${AGENT_DAEMON_SANDBOX_TEMPLATE_XL}'"
+[[ -n "${AGENT_DAEMON_SANDBOX_TTL:-}" ]] && TMUX_ENV+=" AGENT_DAEMON_SANDBOX_TTL='${AGENT_DAEMON_SANDBOX_TTL}'"
+[[ -n "${AGENT_DAEMON_SANDBOX_AUTO_RENEW:-}" ]] && TMUX_ENV+=" AGENT_DAEMON_SANDBOX_AUTO_RENEW='${AGENT_DAEMON_SANDBOX_AUTO_RENEW}'"
+[[ -n "${AGENT_DAEMON_SANDBOX_TTL_HOURS:-}" ]] && TMUX_ENV+=" AGENT_DAEMON_SANDBOX_TTL_HOURS='${AGENT_DAEMON_SANDBOX_TTL_HOURS}'"
+
 tmux new-session -d -s "${TMUX_SESSION}" \
-  "PARSAR_ADDR=:${PORT} DATABASE_URL='${DATABASE_URL}' PARSAR_DEV_AUTH=${PARSAR_DEV_AUTH} PARSAR_FEISHU_MOCK=${FEISHU_MOCK} PARSAR_FEISHU_WEBSOCKET=${FEISHU_WEBSOCKET} PARSAR_FEISHU_OUTBOUND=${FEISHU_OUTBOUND} PARSAR_MASTER_KEY='${MASTER_KEY}' PARSAR_AGENT_DAEMON_OWNER_URL='${OWNER_URL}' '${BIN_PATH}' 2>&1 | tee '${LOG_PATH}'"
+  "${TMUX_ENV} '${BIN_PATH}' 2>&1 | tee '${LOG_PATH}'"
 
 # ── readiness probe ──────────────────────────────────────────────────
 echo -n "[dev-server-up] waiting for :${PORT} "
diff --git a/server/cmd/server/main.go b/server/cmd/server/main.go
index f518823a..2a4465ee 100644
--- a/server/cmd/server/main.go
+++ b/server/cmd/server/main.go
@@ -506,24 +506,36 @@ func main() {
 			opts = append(opts, dev.WithAgentDaemonSandbox(agentDaemonSandbox))
 			opts = append(opts, dev.WithSandboxLifecycle(dbStore, agentDaemonSandbox))
 
-			// Reap ticker: evict idle agent_daemon sandboxes so they
-			// don't leak E2B resources. 5-minute interval mirrors the
-			// opencode idle sweeper cadence.
+			// Run once at startup, then periodically renew due provider leases
+			// and evict idle agent_daemon sandboxes.
 			go func() {
-				ticker := time.NewTicker(5 * time.Minute)
+				runLifecycle := func() {
+					maintainCtx, maintainCancel := context.WithTimeout(context.Background(), 30*time.Second)
+					if n, maintainErr := agentDaemonSandbox.Maintain(maintainCtx); maintainErr != nil {
+						log.Bg().Warn("agent_daemon sandbox maintenance failed", "err", maintainErr)
+					} else if n > 0 {
+						log.Bg().Info("agent_daemon sandbox auto-renew", "renewed", n)
+					}
+					maintainCancel()
+
+					reapCtx, reapCancel := context.WithTimeout(context.Background(), 30*time.Second)
+					if n, reapErr := agentDaemonSandbox.Reap(reapCtx); reapErr != nil {
+						log.Bg().Warn("agent_daemon sandbox reap failed", "err", reapErr)
+					} else if n > 0 {
+						log.Bg().Info("agent_daemon sandbox reap", "evicted", n)
+					}
+					reapCancel()
+				}
+
+				runLifecycle()
+				ticker := time.NewTicker(connagentdaemon.SandboxMaintenanceInterval)
 				defer ticker.Stop()
 				for {
 					select {
 					case <-serverRootCtx.Done():
 						return
 					case <-ticker.C:
-						reapCtx, reapCancel := context.WithTimeout(context.Background(), 30*time.Second)
-						if n, reapErr := agentDaemonSandbox.Reap(reapCtx); reapErr != nil {
-							log.Bg().Warn("agent_daemon sandbox reap failed", "err", reapErr)
-						} else if n > 0 {
-							log.Bg().Info("agent_daemon sandbox reap", "evicted", n)
-						}
-						reapCancel()
+						runLifecycle()
 					}
 				}
 			}()
@@ -1515,6 +1527,8 @@ func buildAgentDaemonSandboxProvider(
 			log.Bg().Info("agent_daemon sandbox: pod IP resolver using in-cluster SA token")
 		}
 	}
+	sandboxTTL := resolveAgentDaemonSandboxTTL(env)
+	sandboxAutoRenew := resolveAgentDaemonSandboxAutoRenew(env)
 	provider, err := connagentdaemon.NewE2BSandboxProvider(connagentdaemon.E2BProviderConfig{
 		Client:        client,
 		Store:         dbStore,
@@ -1528,6 +1542,8 @@ func buildAgentDaemonSandboxProvider(
 		PodIPResolver: podIPResolver,
 		OwnerChecker:  dbStore,
 		SelfPodID:     selfPodID,
+		TTL:           sandboxTTL,
+		AutoRenew:     sandboxAutoRenew,
 		Log:           log.Bg(),
 	})
 	if err != nil {
@@ -1535,13 +1551,71 @@ func buildAgentDaemonSandboxProvider(
 			"error", err)
 		return nil
 	}
+	// Log the effective lifetime, not the raw override: a bare "0" here
+	// would leave an operator guessing what the sandbox TTL actually is.
+	effectiveTTL := sandboxTTL
+	if effectiveTTL <= 0 {
+		effectiveTTL = connagentdaemon.SandboxDefaultTTL
+	}
 	log.Bg().Info("agent_daemon sandbox provider wired",
 		"template", template,
 		"template_xl", templateXL,
-		"server_url", publicURL)
+		"server_url", publicURL,
+		"sandbox_ttl", effectiveTTL,
+		"sandbox_ttl_overridden", sandboxTTL > 0,
+		"sandbox_auto_renew", sandboxAutoRenew)
 	return provider
 }
 
+func resolveAgentDaemonSandboxAutoRenew(env func(string) string) bool {
+	raw := strings.TrimSpace(env("AGENT_DAEMON_SANDBOX_AUTO_RENEW"))
+	if raw == "" {
+		// Default ON: the default TTL is short (an hour), so without
+		// renewal a continuously-used agent's sandbox would be reaped
+		// mid-conversation and lose its in-sandbox CLI session state.
+		// Set AGENT_DAEMON_SANDBOX_AUTO_RENEW=false to opt out.
+		return true
+	}
+	enabled, err := strconv.ParseBool(raw)
+	if err != nil {
+		log.Bg().Warn("AGENT_DAEMON_SANDBOX_AUTO_RENEW ignored: want true or false; defaulting to enabled",
+			"value", raw)
+		return true
+	}
+	return enabled
+}
+
+// resolveAgentDaemonSandboxTTL reads the optional provider-neutral duration
+// override. The legacy integer-hours setting remains supported so existing
+// deployments do not change behaviour during an upgrade. The backing sandbox
+// provider is authoritative about any maximum lifetime it accepts.
+func resolveAgentDaemonSandboxTTL(env func(string) string) time.Duration {
+	if raw := strings.TrimSpace(env("AGENT_DAEMON_SANDBOX_TTL")); raw != "" {
+		ttl, err := time.ParseDuration(raw)
+		normalizedTTL, ok := connagentdaemon.NormalizeSandboxTTL(ttl)
+		if err != nil || !ok {
+			log.Bg().Warn("AGENT_DAEMON_SANDBOX_TTL ignored: want a duration of at least one second such as 30m, 1h, or 24h",
+				"value", raw)
+			return 0
+		}
+		return normalizedTTL
+	}
+
+	raw := strings.TrimSpace(env("AGENT_DAEMON_SANDBOX_TTL_HOURS"))
+	if raw == "" {
+		return 0
+	}
+	hours, err := strconv.Atoi(raw)
+	if err != nil || hours <= 0 || hours > (1<<31-1)/3600 {
+		log.Bg().Warn("AGENT_DAEMON_SANDBOX_TTL_HOURS ignored: want a positive integer number of hours",
+			"value", raw)
+		return 0
+	}
+	log.Bg().Warn("AGENT_DAEMON_SANDBOX_TTL_HOURS is deprecated; use AGENT_DAEMON_SANDBOX_TTL instead",
+		"value", raw)
+	return time.Duration(hours) * time.Hour
+}
+
 // openPool opens the shared pgxpool used by both the audit ingester and
 // the store. Returns nil when databaseURL is empty so dev environments
 // without a database can still bring up the health endpoint.
diff --git a/server/cmd/server/sandbox_runtime_test.go b/server/cmd/server/sandbox_runtime_test.go
index 6d9ee654..0cb9b1c2 100644
--- a/server/cmd/server/sandbox_runtime_test.go
+++ b/server/cmd/server/sandbox_runtime_test.go
@@ -2,10 +2,63 @@ package main
 
 import (
 	"testing"
+	"time"
 
 	"github.com/MiniMax-AI-Dev/parsar/server/internal/config"
 )
 
+func TestResolveAgentDaemonSandboxTTL(t *testing.T) {
+	tests := []struct {
+		name string
+		env  map[string]string
+		want time.Duration
+	}{
+		{name: "unset uses provider default", env: nil, want: 0},
+		{name: "duration", env: map[string]string{"AGENT_DAEMON_SANDBOX_TTL": "90m"}, want: 90 * time.Minute},
+		{name: "duration takes precedence", env: map[string]string{
+			"AGENT_DAEMON_SANDBOX_TTL":       "45m",
+			"AGENT_DAEMON_SANDBOX_TTL_HOURS": "23",
+		}, want: 45 * time.Minute},
+		{name: "legacy hours", env: map[string]string{"AGENT_DAEMON_SANDBOX_TTL_HOURS": "6"}, want: 6 * time.Hour},
+		{name: "provider specific maximum is not imposed", env: map[string]string{"AGENT_DAEMON_SANDBOX_TTL": "720h"}, want: 720 * time.Hour},
+		{name: "invalid duration", env: map[string]string{"AGENT_DAEMON_SANDBOX_TTL": "tomorrow"}, want: 0},
+		{name: "non-positive duration", env: map[string]string{"AGENT_DAEMON_SANDBOX_TTL": "0s"}, want: 0},
+		{name: "sub-second duration", env: map[string]string{"AGENT_DAEMON_SANDBOX_TTL": "500ms"}, want: 0},
+		{name: "fractional second is normalized", env: map[string]string{"AGENT_DAEMON_SANDBOX_TTL": "1500ms"}, want: time.Second},
+		{name: "legacy hours overflow", env: map[string]string{"AGENT_DAEMON_SANDBOX_TTL_HOURS": "596524"}, want: 0},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := resolveAgentDaemonSandboxTTL(envMap(tt.env)); got != tt.want {
+				t.Fatalf("resolveAgentDaemonSandboxTTL() = %s, want %s", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestResolveAgentDaemonSandboxAutoRenew(t *testing.T) {
+	for _, tt := range []struct {
+		name string
+		raw  string
+		want bool
+	}{
+		{name: "unset defaults on", want: true},
+		{name: "enabled", raw: "true", want: true},
+		{name: "disabled", raw: "false", want: false},
+		{name: "invalid defaults on", raw: "sometimes", want: true},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			got := resolveAgentDaemonSandboxAutoRenew(envMap(map[string]string{
+				"AGENT_DAEMON_SANDBOX_AUTO_RENEW": tt.raw,
+			}))
+			if got != tt.want {
+				t.Fatalf("resolveAgentDaemonSandboxAutoRenew() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
 // envMap turns a Go map into the `func(string) string` shape that
 // buildAgentDaemonSandboxProvider etc. expect.
 func envMap(m map[string]string) func(string) string {
@@ -23,7 +76,7 @@ func TestResolveAgentDaemonOwnerURLPrefersExplicitValue(t *testing.T) {
 	cfg.Server.PublicURL = "https://public.example.com"
 	got, err := resolveAgentDaemonOwnerURL(envMap(map[string]string{
 		"PARSAR_AGENT_DAEMON_OWNER_URL": "http://explicit-owner:8080/",
-		"POD_IP":                          "10.1.2.3",
+		"POD_IP":                        "10.1.2.3",
 	}), cfg)
 	if err != nil {
 		t.Fatalf("unexpected err: %v", err)
diff --git a/server/internal/connector/agentdaemon/connector.go b/server/internal/connector/agentdaemon/connector.go
index 14af6f9e..7a743897 100644
--- a/server/internal/connector/agentdaemon/connector.go
+++ b/server/internal/connector/agentdaemon/connector.go
@@ -357,8 +357,20 @@ func (c *Connector) streamPrompt(ctx context.Context, in connector.PromptInput,
 		return errorChannel(in.RunID, err.Error()), nil
 	}
 
-	bind, err := c.binder.Resolve(ctx, in.ConversationID, in.AgentID, agentKind)
-	if err != nil {
+	var bind binding.Binding
+	if isSandboxMode(in) {
+		// Every run, including scheduled-task runs, ensures the provider
+		// sandbox exists before dispatch. Acquire is cheap on a warm entry and
+		// performs the cross-pod reservation dance on a cold start.
+		bind, err = c.acquireSandboxBinding(ctx, in)
+		if err != nil {
+			c.log.Warn("agent_daemon: ensure sandbox failed", "run_id", in.RunID, "err", err)
+			return errorChannel(in.RunID, err.Error()), nil
+		}
+	} else {
+		bind, err = c.binder.Resolve(ctx, in.ConversationID, in.AgentID, agentKind)
+	}
+	if !isSandboxMode(in) && err != nil {
 		if errors.Is(err, binding.ErrNotBound) {
 			// Lazy-bind: pick up the runtime the user picked in the
 			// agent settings page. AgentConfig.device_id is fed
@@ -394,7 +406,7 @@ func (c *Connector) streamPrompt(ctx context.Context, in connector.PromptInput,
 			c.log.Error("agent_daemon: binder.Resolve failed", "run_id", in.RunID, "err", err.Error())
 			return nil, fmt.Errorf("agent_daemon: resolve binding: %w", err)
 		}
-	} else {
+	} else if !isSandboxMode(in) {
 		c.log.Info("agent_daemon: binding resolved",
 			"run_id", in.RunID,
 			"conversation_id", in.ConversationID,
@@ -419,33 +431,69 @@ func (c *Connector) streamPrompt(ctx context.Context, in connector.PromptInput,
 	if err != nil {
 		c.log.Warn("agent_daemon: device offline (registry LookupDevice failed)",
 			"run_id", in.RunID, "device_id", bind.DeviceID, "err", err.Error())
-		// Sandbox mode: surface a system message so the user
-		// understands why the run failed and what their recovery
-		// options are. We DO NOT auto-acquire a fresh sandbox — the
-		// existing one may carry installed config / Claude session
-		// state, and silently replacing it would discard that without
-		// consent. Recovery is explicit (delete + recreate the Agent
-		// in the web UI).
-		if isSandboxMode(in) && c.systemMessages != nil {
-			notice := fmt.Sprintf(
-				"⚠️ Sandbox %s is unavailable — likely reclaimed after idle timeout or a network issue. "+
-					"Wait a few minutes for it to recover, or delete and recreate the Agent in its settings to reset immediately.",
-				bind.DeviceID,
-			)
-			if _, sysErr := c.systemMessages.CreateSandboxOfflineNotice(ctx, store.CreateSandboxOfflineNoticeInput{
-				WorkspaceID:    in.WorkspaceID,
-				AgentID:        in.AgentID,
-				RunID:          in.RunID,
-				ConversationID: in.ConversationID,
-				DeviceID:       bind.DeviceID,
-				Content:        notice,
-			}); sysErr != nil {
-				c.log.Warn("agent_daemon: insert sandbox offline notice",
-					"err", sysErr, "run_id", in.RunID, "device_id", bind.DeviceID)
+		if isSandboxMode(in) {
+			// A registry miss can be a transient daemon reconnect or a request
+			// routed to the wrong pod. Rebuild only when the provider explicitly
+			// confirms that the backing sandbox no longer exists.
+			exists, confirmed, probeErr := c.sandbox.SandboxExists(ctx, in.AgentID)
+			if probeErr != nil || !confirmed || exists {
+				if probeErr != nil {
+					c.log.Warn("agent_daemon: sandbox existence probe failed",
+						"run_id", in.RunID, "agent_id", in.AgentID, "err", probeErr)
+				}
+				return errorChannel(in.RunID, "agent_daemon: sandbox runtime is temporarily unavailable; retry shortly"), nil
 			}
-			return errorChannel(in.RunID, "agent_daemon sandbox offline (deviceID="+bind.DeviceID+"); see system message for recovery"), nil
+
+			deviceID, rebuildErr := c.sandbox.Recreate(ctx, in)
+			if rebuildErr == nil {
+				_ = c.binder.InvalidateConversation(ctx, in.ConversationID)
+				bind = binding.Binding{
+					ConversationID: in.ConversationID,
+					AgentID:        in.AgentID,
+					DeviceID:       deviceID,
+					AgentKind:      agentKind,
+					AgentStateKey:  agentStateKey(in.ConversationID, in.AgentID, agentKind),
+				}
+				if bindErr := c.binder.Bind(ctx, bind); bindErr != nil {
+					rebuildErr = fmt.Errorf("persist rebuilt sandbox binding: %w", bindErr)
+				}
+			}
+			if rebuildErr == nil {
+				if ch, routed, routeErr := c.routeRemoteIfNeeded(ctx, bind, in, true); routed || routeErr != nil {
+					return ch, routeErr
+				}
+				sess, err = c.registry.LookupDevice(bind.DeviceID)
+			}
+			if rebuildErr != nil || err != nil {
+				if rebuildErr != nil {
+					err = rebuildErr
+				}
+				c.log.Warn("agent_daemon: sandbox rebuild failed",
+					"run_id", in.RunID, "agent_id", in.AgentID, "err", err)
+				if c.systemMessages != nil {
+					notice := fmt.Sprintf(
+						"⚠️ Sandbox %s is unavailable — likely reclaimed after idle timeout or a network issue. "+
+							"Wait a few minutes for it to recover, or delete and recreate the Agent in its settings to reset immediately.",
+						bind.DeviceID,
+					)
+					if _, sysErr := c.systemMessages.CreateSandboxOfflineNotice(ctx, store.CreateSandboxOfflineNoticeInput{
+						WorkspaceID:    in.WorkspaceID,
+						AgentID:        in.AgentID,
+						RunID:          in.RunID,
+						ConversationID: in.ConversationID,
+						DeviceID:       bind.DeviceID,
+						Content:        notice,
+					}); sysErr != nil {
+						c.log.Warn("agent_daemon: insert sandbox offline notice",
+							"err", sysErr, "run_id", in.RunID, "device_id", bind.DeviceID)
+					}
+				}
+				return errorChannel(in.RunID, "This Agent's sandbox was unavailable and could not be rebuilt: "+err.Error()), nil
+			}
+		}
+		if err != nil {
+			return errorChannel(in.RunID, "agent_daemon device offline (deviceID="+bind.DeviceID+"); waiting for daemon to reconnect"), nil
 		}
-		return errorChannel(in.RunID, "agent_daemon device offline (deviceID="+bind.DeviceID+"); waiting for daemon to reconnect"), nil
 	}
 	if err := c.validateAgentKindForSession(sess, agentKind); err != nil {
 		c.log.Warn("agent_daemon: unsupported agent_kind for device",
@@ -1074,15 +1122,11 @@ func agentStateKey(conversationID, agentID, agentKind string) string {
 	return strings.TrimSpace(conversationID) + "/" + strings.TrimSpace(agentID) + "/" + strings.TrimSpace(agentKind)
 }
 
-// acquireSandboxBinding is the cold-start path: ErrNotBound and the
-// agent is configured for sandbox mode. The provider blocks
+// acquireSandboxBinding ensures the sandbox exists for every sandbox-mode
+// prompt. The provider blocks
 // until the daemon's WS upgrade lands in gateway.Registry (it owns
 // WaitForDevice internally), so by the time this returns the deviceID
 // is guaranteed to resolve via registry.LookupDevice.
-//
-// Per agent_must_bind_runtime memory: this is no longer called by the
-// default dispatch path. Kept for a future conversation-scoped
-// ephemeral sandbox feature.
 func (c *Connector) acquireSandboxBinding(ctx context.Context, in connector.PromptInput) (binding.Binding, error) {
 	deviceID, err := c.sandbox.Acquire(ctx, in)
 	if err != nil {
@@ -1106,6 +1150,17 @@ func (c *Connector) acquireSandboxBinding(ctx context.Context, in connector.Prom
 		// installs and the subprocess cwd so they stay on the same
 		// tree regardless of the sandbox image's WORKDIR.
 	}
+	existing, resolveErr := c.binder.Resolve(ctx, in.ConversationID, in.AgentID, b.AgentKind)
+	if resolveErr == nil && existing.DeviceID == deviceID {
+		// Engine session ids are valid only while the same sandbox (and its
+		// local CLI state) remains alive.
+		b.AgentSessionID = existing.AgentSessionID
+		b.AgentSessionType = existing.AgentSessionType
+		b.AgentStateKey = existing.AgentStateKey
+		b.Metadata = existing.Metadata
+	} else if resolveErr != nil && !errors.Is(resolveErr, binding.ErrNotBound) {
+		return binding.Binding{}, fmt.Errorf("resolve existing sandbox binding: %w", resolveErr)
+	}
 	if err := c.binder.Bind(ctx, b); err != nil {
 		// Don't tear down the sandbox: the next prompt's Acquire will
 		// return the cached entry, and Bind may succeed once the DB
diff --git a/server/internal/connector/agentdaemon/connector_test.go b/server/internal/connector/agentdaemon/connector_test.go
index 22c06369..7a32d30f 100644
--- a/server/internal/connector/agentdaemon/connector_test.go
+++ b/server/internal/connector/agentdaemon/connector_test.go
@@ -1029,11 +1029,25 @@ func contains(s, substr string) bool {
 // assertions can check that Acquire fired (and only fired when the
 // agent was sandbox-mode).
 type stubSandboxProvider struct {
-	mu           sync.Mutex
-	acquireCalls int
-	releaseCalls int
-	deviceID     string
-	acquireErr   error
+	mu              sync.Mutex
+	acquireCalls    int
+	recreateCalls   int
+	releaseCalls    int
+	deviceID        string
+	acquireErr      error
+	probeExists     bool
+	probeConfirmed  bool
+	probeConfigured bool
+	probeErr        error
+}
+
+func (s *stubSandboxProvider) SandboxExists(_ context.Context, _ string) (bool, bool, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if !s.probeConfigured {
+		return false, true, nil
+	}
+	return s.probeExists, s.probeConfirmed, s.probeErr
 }
 
 func (s *stubSandboxProvider) Acquire(_ context.Context, _ connector.PromptInput) (string, error) {
@@ -1065,7 +1079,17 @@ func (s *stubSandboxProvider) SandboxRuntimeInfo(_ context.Context, _ string) (t
 	return time.Time{}, nil
 }
 
-func (s *stubSandboxProvider) Reap(_ context.Context) (int, error) { return 0, nil }
+func (s *stubSandboxProvider) Reap(_ context.Context) (int, error)     { return 0, nil }
+func (s *stubSandboxProvider) Maintain(_ context.Context) (int, error) { return 0, nil }
+func (s *stubSandboxProvider) Recreate(ctx context.Context, in connector.PromptInput) (string, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.recreateCalls++
+	if s.acquireErr != nil {
+		return "", s.acquireErr
+	}
+	return s.deviceID, nil
+}
 
 // TestStreamPrompt_LocalModeNoBindingFallsThroughToErrorChannel: when
 // the agent has no binding and no configured device, the
@@ -1231,25 +1255,16 @@ func TestStreamPrompt_LocalModeConfiguredDeviceBindsWithWorkdirKey(t *testing.T)
 	}
 }
 
-// TestStreamPrompt_SandboxModeIsNoLongerAutoAcquired pins the
-// contract: even when AgentConfig.daemon_mode == "sandbox",
-// the connector does NOT auto-acquire a sandbox. The default dispatch
-// path requires an explicit runtime binding
-// (agents.runtime_id) surfaced via AgentConfig.device_id.
-// The sandbox provider stays compiled for a future conversation-scoped
-// ephemeral path but is disconnected from the default first-prompt flow.
-//
-// Sandbox-mode agents that hit dispatch before runtime_id is written
-// see a sandbox-aware hint ("sandbox is preparing") instead of the generic
-// "no Runtime bound" copy.
-func TestStreamPrompt_SandboxModeIsNoLongerAutoAcquired(t *testing.T) {
+// Sandbox runs ensure the provider runtime before dispatch and attempt one
+// rebuild when the returned daemon is confirmed offline.
+func TestStreamPrompt_SandboxModeEnsuresAndRebuildsOnce(t *testing.T) {
 	reg := gateway.NewRegistry()
 	sb := &stubSandboxProvider{deviceID: "dev-sbx-abc"}
 	binder := binding.NewInMemoryBinder()
-	c := New(Config{Registry: reg, Binder: binder, Sandbox: sb})
+	sm := &fakeSystemMessageStore{}
+	c := New(Config{Registry: reg, Binder: binder, Sandbox: sb, SystemMessages: sm})
 
 	in := basicInput()
-	// daemon_mode=sandbox alone is no longer a free pass to auto-Acquire.
 	in.AgentConfig = map[string]any{"daemon_mode": "sandbox"}
 
 	ch, err := c.StreamPrompt(context.Background(), in)
@@ -1260,27 +1275,73 @@ func TestStreamPrompt_SandboxModeIsNoLongerAutoAcquired(t *testing.T) {
 	if gotErr == nil || gotDone == nil {
 		t.Fatalf("expected EventError + EventDone, got err=%v done=%v", gotErr, gotDone)
 	}
-	if sb.acquireCalls != 0 {
-		t.Fatalf("sandbox Acquire MUST NOT fire on the default path; saw %d calls", sb.acquireCalls)
+	if sb.acquireCalls != 1 {
+		t.Fatalf("sandbox Acquire calls = %d, want 1", sb.acquireCalls)
+	}
+	if sb.recreateCalls != 1 {
+		t.Fatalf("sandbox Recreate calls = %d, want 1", sb.recreateCalls)
 	}
-	// Sandbox-mode unbound surfaces a sandbox-preparation hint — the
-	// createAgent goroutine is racing to write runtime_id back, and a
-	// user retry in ~10s should land on a healthy binding.
-	if !contains(gotErr.Error, "sandbox is preparing") {
-		t.Fatalf("expected sandbox-preparation hint, got %q", gotErr.Error)
+	if !contains(gotErr.Error, "could not be rebuilt") {
+		t.Fatalf("expected one-shot rebuild failure, got %q", gotErr.Error)
+	}
+	if len(sm.sandboxOfflines) != 1 {
+		t.Fatalf("sandbox offline notices = %d, want 1", len(sm.sandboxOfflines))
+	}
+}
+
+func TestAcquireSandboxBindingPreservesSessionOnSameDevice(t *testing.T) {
+	binder := binding.NewInMemoryBinder()
+	existing := binding.Binding{
+		ConversationID:   "conv-1",
+		AgentID:          "pa-1",
+		DeviceID:         "dev-sbx",
+		AgentKind:        "claude_code",
+		AgentSessionID:   "session-1",
+		AgentSessionType: binding.SessionTypeClaude,
+		AgentStateKey:    "state-1",
+		Metadata:         map[string]any{"key": "value"},
+	}
+	if err := binder.Bind(context.Background(), existing); err != nil {
+		t.Fatal(err)
+	}
+	c := New(Config{Registry: gateway.NewRegistry(), Binder: binder, Sandbox: &stubSandboxProvider{deviceID: "dev-sbx"}})
+	in := basicInput()
+	in.AgentConfig = map[string]any{"daemon_mode": "sandbox", "agent_kind": "claude_code"}
+
+	got, err := c.acquireSandboxBinding(context.Background(), in)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.AgentSessionID != existing.AgentSessionID || got.AgentSessionType != existing.AgentSessionType || got.AgentStateKey != existing.AgentStateKey {
+		t.Fatalf("session state was not preserved: %+v", got)
+	}
+}
+
+func TestStreamPrompt_SandboxRegistryMissDoesNotRebuildLiveProviderSandbox(t *testing.T) {
+	sb := &stubSandboxProvider{
+		deviceID:        "dev-sbx",
+		probeConfigured: true,
+		probeExists:     true,
+		probeConfirmed:  true,
+	}
+	c := New(Config{Registry: gateway.NewRegistry(), Binder: binding.NewInMemoryBinder(), Sandbox: sb})
+	in := basicInput()
+	in.AgentConfig = map[string]any{"daemon_mode": "sandbox"}
+
+	ch, err := c.StreamPrompt(context.Background(), in)
+	if err != nil {
+		t.Fatal(err)
+	}
+	gotErr, _ := drainEvents(ch, t)
+	if gotErr == nil || !contains(gotErr.Error, "temporarily unavailable") {
+		t.Fatalf("unexpected error event: %+v", gotErr)
 	}
-	// And nothing got bound.
-	if _, err := binder.Resolve(context.Background(), "conv-1", "pa-1", "claude_code"); err == nil {
-		t.Fatalf("expected no binding after refusing auto-acquire; one was persisted")
+	if sb.recreateCalls != 0 {
+		t.Fatalf("live provider sandbox was rebuilt %d times", sb.recreateCalls)
 	}
 }
 
-// TestStreamPrompt_SandboxModeProviderDisabled_StillRefusesAutoAcquire:
-// no sandbox provider wired + sandbox mode requested → user still sees
-// a sandbox-aware hint. Both routes converge on SandboxBindingReader's
-// nil-reader fallback which only knows about bindings, not provider
-// wiring.
-func TestStreamPrompt_SandboxModeProviderDisabled_StillRefusesAutoAcquire(t *testing.T) {
+func TestStreamPrompt_SandboxModeProviderDisabledFailsClearly(t *testing.T) {
 	reg := gateway.NewRegistry()
 	// No Sandbox in Config → New defaults to NoopSandboxProvider
 	c := New(Config{Registry: reg, Binder: binding.NewInMemoryBinder()})
@@ -1296,8 +1357,8 @@ func TestStreamPrompt_SandboxModeProviderDisabled_StillRefusesAutoAcquire(t *tes
 	if gotErr == nil || gotDone == nil {
 		t.Fatalf("expected EventError + EventDone, got err=%v done=%v", gotErr, gotDone)
 	}
-	if !contains(gotErr.Error, "sandbox is preparing") {
-		t.Fatalf("expected sandbox-preparation hint, got %q", gotErr.Error)
+	if !contains(gotErr.Error, "does not have a sandbox template configured") {
+		t.Fatalf("expected provider-disabled hint, got %q", gotErr.Error)
 	}
 }
 
diff --git a/server/internal/connector/agentdaemon/sandbox_provider.go b/server/internal/connector/agentdaemon/sandbox_provider.go
index fd43e668..fc601730 100644
--- a/server/internal/connector/agentdaemon/sandbox_provider.go
+++ b/server/internal/connector/agentdaemon/sandbox_provider.go
@@ -23,8 +23,8 @@
 //	                  4. Registry.WaitForDevice(deviceID, 45s)     -> blocks until WS upgrade lands
 //	                  5. Binder.Bind(conversation -> deviceID)     -> persist for next turn
 //	                  6. return deviceID
-//	          subsequent prompts in same conversation -> binder hit, no sandbox work
-//	          new conversation against same agent -> Acquire reuses the cached sandbox
+//	          every sandbox prompt -> Acquire verifies/reuses the active sandbox
+//	          new conversation against same agent -> Acquire reuses the same sandbox
 //	          long idle period -> Reap() kills the sandbox + evicts cache; next Acquire cold-starts again
 //	          conversation archived / agent deleted -> Release() kills + evicts immediately
 package agentdaemon
@@ -58,22 +58,50 @@ var SandboxAcquireTimeout = 45 * time.Second
 // DNS + TLS + WS handshake.
 var SandboxConnectTimeout = 30 * time.Second
 
-// SandboxDefaultTTL is the e2b sandbox TTL requested on Create.
-// Long-lived by design: an agent_daemon sandbox carries user-installed
-// config and claude session state across conversations and must NOT
-// be silently recycled while in use. SANDBOX_TIMEOUT_MS defaults to
-// 30d so an agent stays usable through normal
-// conversational gaps without depending on a per-prompt renew loop.
-var SandboxDefaultTTL = 30 * 24 * time.Hour
+// SandboxDefaultTTL is the fallback e2b sandbox TTL requested on Create
+// when E2BProviderConfig.TTL is unset.
+//
+// The default is deliberately provider-neutral. Deployments that need a
+// different lifetime can override it with AGENT_DAEMON_SANDBOX_TTL; the
+// backing provider remains authoritative about the limits it accepts.
+var SandboxDefaultTTL = time.Hour
 
-// SandboxIdleReapThreshold is the lastUsed cutoff Reap honours.
+// SandboxIdleReapThreshold is the fallback lastUsed cutoff Reap honours
+// when E2BProviderConfig.TTL is unset.
+//
+// Kept >= the effective TTL so Reap does not preempt the provider lease.
+// Every run refreshes lastUsed through Acquire; Reap is a defence-in-depth
+// sweep for inactive entries whose automatic renewal is disabled.
+var SandboxIdleReapThreshold = time.Hour
+
+// SandboxSpawnAbandonedAfter is how old a `spawning` sandbox binding
+// must be before another acquire may declare it abandoned and take its
+// reservation slot (see reclaimAbandonedSpawn).
 //
-// Kept >= SandboxDefaultTTL so Reap can never preempt e2b's own TTL
-// expiry: lastUsed is only refreshed on Acquire fast-path hits, and
-// already-bound conversations skip Acquire entirely after cold start
-// (binder.Resolve takes over). Reap is effectively a defence-in-depth
-// sweep for cache entries whose sandbox was killed out-of-band.
-var SandboxIdleReapThreshold = 30 * 24 * time.Hour
+// Must stay comfortably above SandboxAcquireTimeout so a merely slow
+// cold start is never stolen mid-flight; 5m leaves ~6x headroom while
+// still self-healing long before a human would notice. Package-level so
+// tests can lower it.
+var SandboxSpawnAbandonedAfter = 5 * time.Minute
+
+// SandboxMaintenanceInterval controls how often persisted leases and idle
+// cache entries are scanned. Auto-renew requires a TTL longer than this interval.
+var SandboxMaintenanceInterval = 5 * time.Minute
+
+const (
+	maxSandboxTTLSeconds int64 = 1<<31 - 1
+	// sandboxMaintenanceBatchSize caps how many due leases one maintenance
+	// scan claims. Renewals run serially (each with a 10s per-call
+	// timeout) inside the caller's ~30s Maintain context, so under
+	// provider slowness a scan may only finish a few before the context
+	// expires; the rest stay claimed and are retried next tick, and the
+	// claim query returns soonest-to-expire first so the most urgent win.
+	// In the healthy case renewals are sub-second and the whole batch
+	// completes. Move to parallel renewals before the number of
+	// simultaneously-due agents makes the serial-under-30s cap the
+	// bottleneck.
+	sandboxMaintenanceBatchSize = 50
+)
 
 // ErrSandboxAcquireFailed is the sentinel a caller can branch on
 // when the daemon failed to come up in time. Used by tests; in
@@ -100,6 +128,10 @@ type SandboxProvider interface {
 	// context with enough headroom.
 	Acquire(ctx context.Context, in connector.PromptInput) (deviceID string, err error)
 
+	// SandboxExists probes the provider when local dispatch cannot find the
+	// daemon. confirmed is false when no durable sandbox is known.
+	SandboxExists(ctx context.Context, agentID string) (exists, confirmed bool, err error)
+
 	// SandboxStatus returns the cached sandbox info for a
 	// agent. (zero, false, nil) when not cached.
 	//
@@ -112,9 +144,9 @@ type SandboxProvider interface {
 	// Idempotent: releasing an unknown agent is a no-op.
 	Release(ctx context.Context, agentID string) error
 
-	// Renew bumps the e2b-side TTL to SandboxDefaultTTL. Returns the
-	// refreshed expires_at. (zero, false, nil) when no live cache
-	// entry exists — the admin handler maps this to 404.
+	// Renew bumps the e2b-side TTL back to its persisted or configured
+	// lifetime. It falls back to the durable binding on a cache miss so any
+	// pod can renew. (zero, false, nil) means no active binding exists.
 	Renew(ctx context.Context, agentID string) (expiresAt time.Time, found bool, err error)
 
 	// SandboxRuntimeInfo queries e2b directly for live expiry by
@@ -125,6 +157,14 @@ type SandboxProvider interface {
 	// Reap evicts sandboxes whose lastUsed is older than the
 	// configured idle threshold. Returns the count evicted.
 	Reap(ctx context.Context) (evicted int, err error)
+
+	// Maintain claims and renews provider leases that are due according to
+	// their persisted auto-renew policy.
+	Maintain(ctx context.Context) (renewed int, err error)
+
+	// Recreate terminates the current sandbox binding, if any, and performs
+	// one fresh Acquire. Used only after dispatch confirms the runtime is gone.
+	Recreate(ctx context.Context, in connector.PromptInput) (deviceID string, err error)
 }
 
 // ErrSandboxProviderDisabled is returned by NoopSandboxProvider when
@@ -140,6 +180,10 @@ func (NoopSandboxProvider) Acquire(_ context.Context, _ connector.PromptInput) (
 	return "", ErrSandboxProviderDisabled
 }
 
+func (NoopSandboxProvider) SandboxExists(_ context.Context, _ string) (bool, bool, error) {
+	return false, false, nil
+}
+
 func (NoopSandboxProvider) Release(_ context.Context, _ string) error { return nil }
 
 func (NoopSandboxProvider) SandboxStatus(_ context.Context, _ string) (connector.SandboxInfo, bool, error) {
@@ -154,7 +198,11 @@ func (NoopSandboxProvider) SandboxRuntimeInfo(_ context.Context, _ string) (time
 	return time.Time{}, nil
 }
 
-func (NoopSandboxProvider) Reap(_ context.Context) (int, error) { return 0, nil }
+func (NoopSandboxProvider) Reap(_ context.Context) (int, error)     { return 0, nil }
+func (NoopSandboxProvider) Maintain(_ context.Context) (int, error) { return 0, nil }
+func (NoopSandboxProvider) Recreate(ctx context.Context, in connector.PromptInput) (string, error) {
+	return NoopSandboxProvider{}.Acquire(ctx, in)
+}
 
 // ----------------------------------------------------------------------
 // E2B-backed implementation
@@ -169,10 +217,17 @@ func (NoopSandboxProvider) Reap(_ context.Context) (int, error) { return 0, nil
 type SandboxBindingPersister interface {
 	CreateSandboxBinding(ctx context.Context, input store.CreateSandboxBindingInput) (store.SandboxBindingRead, error)
 	ReserveSandboxBindingSlot(ctx context.Context, input store.ReserveSandboxBindingSlotInput) (store.SandboxBindingRead, bool, error)
+	SetSpawningSandboxBindingSandboxID(ctx context.Context, bindingID, sandboxID string) error
 	FinalizeSandboxBindingSpawning(ctx context.Context, input store.FinalizeSandboxBindingSpawningInput) error
 	WaitForSandboxBindingActive(ctx context.Context, workspaceID, agentID string, pollInterval time.Duration) (store.SandboxBindingRead, error)
 	TouchSandboxBinding(ctx context.Context, bindingID string) error
 	MarkSandboxBindingKilled(ctx context.Context, bindingID, status string) error
+	ReclaimAbandonedSandboxBinding(ctx context.Context, bindingID string, createdBefore time.Time) (bool, error)
+	ConfigureSandboxBindingLease(ctx context.Context, bindingID string, timeoutSeconds, thresholdSeconds int32, expiresAt time.Time) error
+	ClaimSandboxBindingsDueForAutoRenew(ctx context.Context, now time.Time, limit int32) ([]store.SandboxAutoRenewClaim, error)
+	CompleteSandboxBindingRenew(ctx context.Context, bindingID string, expiresAt time.Time) error
+	FailSandboxBindingRenew(ctx context.Context, bindingID string) error
+	GetActiveSandboxBindingByAgentID(ctx context.Context, agentID string) (store.SandboxBindingRead, bool, error)
 }
 
 // E2BClient is the slice of e2b.Client the provider actually uses.
@@ -243,9 +298,109 @@ type E2BProviderConfig struct {
 	// deviceID is registered locally (Registry) or remotely (OwnerChecker).
 	// Empty in single-pod / local-dev mode.
 	SelfPodID string
+	// TTL is the sandbox lifetime requested on Create and restored by
+	// Renew. Zero falls back to SandboxDefaultTTL. Carried per-provider
+	// (rather than by reassigning the package var) so the value is
+	// explicit at the construction site and two providers in one process
+	// — or two parallel tests — cannot clobber each other.
+	//
+	TTL time.Duration
+	// AutoRenew enables periodic best-effort lease refresh. The server
+	// wires this ON by default (see resolveAgentDaemonSandboxAutoRenew);
+	// the Go zero value is off for tests and library callers. Disabled by
+	// default because provider support and limits vary.
+	AutoRenew bool
 	Log       *slog.Logger
 }
 
+// ttl is the effective sandbox lifetime for this provider: the
+// configured TTL, or SandboxDefaultTTL when unset.
+func (p *E2BSandboxProvider) ttl() time.Duration {
+	if ttl, ok := NormalizeSandboxTTL(p.cfg.TTL); ok {
+		return ttl
+	}
+	return SandboxDefaultTTL
+}
+
+// NormalizeSandboxTTL converts a provider lease to whole seconds within the database range.
+func NormalizeSandboxTTL(ttl time.Duration) (time.Duration, bool) {
+	if ttl < time.Second {
+		return 0, false
+	}
+	seconds := int64(ttl / time.Second)
+	if seconds > maxSandboxTTLSeconds {
+		return 0, false
+	}
+	return time.Duration(seconds) * time.Second, true
+}
+
+func (p *E2BSandboxProvider) ttlFor(in connector.PromptInput) time.Duration {
+	if raw, _ := in.AgentConfig["sandbox_ttl"].(string); strings.TrimSpace(raw) != "" {
+		if parsed, err := time.ParseDuration(strings.TrimSpace(raw)); err == nil {
+			if ttl, ok := NormalizeSandboxTTL(parsed); ok {
+				return ttl
+			}
+		}
+		p.cfg.Log.Warn("agent sandbox_ttl ignored: want a duration of at least one second",
+			"agent_id", in.AgentID, "value", raw)
+	}
+	return p.ttl()
+}
+
+func (p *E2BSandboxProvider) autoRenewFor(in connector.PromptInput) bool {
+	if enabled, ok := in.AgentConfig["sandbox_auto_renew"].(bool); ok {
+		return enabled
+	}
+	return p.cfg.AutoRenew
+}
+
+func (p *E2BSandboxProvider) leasePolicyFor(in connector.PromptInput) (time.Duration, bool) {
+	ttl := p.ttlFor(in)
+	autoRenew := p.autoRenewFor(in)
+	if autoRenew && ttl <= SandboxMaintenanceInterval {
+		p.cfg.Log.Warn("agent sandbox_auto_renew ignored: sandbox_ttl must exceed the maintenance interval",
+			"agent_id", in.AgentID,
+			"sandbox_ttl", ttl,
+			"maintenance_interval", SandboxMaintenanceInterval)
+		autoRenew = false
+	}
+	return ttl, autoRenew
+}
+
+func autoRenewThreshold(ttl time.Duration, enabled bool) int32 {
+	if !enabled {
+		return 0
+	}
+	ttl, ok := NormalizeSandboxTTL(ttl)
+	if !ok {
+		return 0
+	}
+	if ttl <= SandboxMaintenanceInterval {
+		return 0
+	}
+	threshold := ttl / 4
+	if threshold < SandboxMaintenanceInterval {
+		threshold = SandboxMaintenanceInterval
+	}
+	if threshold >= ttl {
+		threshold = ttl / 2
+	}
+	if threshold < time.Second {
+		threshold = time.Second
+	}
+	return int32(threshold / time.Second)
+}
+
+// idleReapCutoff is the lastUsed age past which Reap evicts a cache
+// entry. Tracks the effective TTL so Reap can never preempt e2b's own
+// expiry; falls back to SandboxIdleReapThreshold when TTL is unset.
+func (p *E2BSandboxProvider) idleReapCutoff() time.Duration {
+	if p.cfg.TTL > 0 {
+		return p.cfg.TTL
+	}
+	return SandboxIdleReapThreshold
+}
+
 // sandboxEntry is the per-agent cached sandbox handle.
 type sandboxEntry struct {
 	deviceID    string
@@ -259,6 +414,9 @@ type sandboxEntry struct {
 	ownerPodID string
 	createdAt  time.Time
 	lastUsed   time.Time
+	timeout    time.Duration
+	expiresAt  time.Time
+	autoRenew  bool
 }
 
 // E2BSandboxProvider is the e2b-backed SandboxProvider implementation.
@@ -362,7 +520,7 @@ func (p *E2BSandboxProvider) resolveTemplate(in connector.PromptInput) (size, te
 
 // Acquire returns a deviceID for the agent's sandbox. Cold
 // starts go through the full mint-create-login-connect dance; warm
-// hits return the cached deviceID after a touch + Renew.
+// hits return the cached deviceID after a liveness check and touch.
 //
 // Concurrency: two Acquire calls for the same agent serialise
 // on inflight[agentID] so we never create more than one sandbox
@@ -378,11 +536,19 @@ func (p *E2BSandboxProvider) Acquire(ctx context.Context, in connector.PromptInp
 	// Fast path: warm cache hit.
 	p.cacheMu.Lock()
 	if entry, ok := p.cache[in.AgentID]; ok {
-		entry.lastUsed = time.Now().UTC()
+		now := time.Now().UTC()
+		entry.lastUsed = now
+		desiredTTL, desiredAutoRenew := p.leasePolicyFor(in)
+		policyChanged := entry.timeout != desiredTTL || entry.autoRenew != desiredAutoRenew
+		cachePolicyChanged := policyChanged || entry.expiresAt.IsZero()
 		deviceID := entry.deviceID
 		sandboxID := entry.sandbox.SandboxID
 		bindingID := entry.bindingID
 		ownerPodID := entry.ownerPodID
+		expiresAt := entry.expiresAt
+		if expiresAt.IsZero() {
+			expiresAt = now.Add(desiredTTL)
+		}
 		p.cacheMu.Unlock()
 		// Best-effort: confirm the device session is still alive
 		// somewhere in the fleet. ownerPodID disambiguates:
@@ -409,14 +575,22 @@ func (p *E2BSandboxProvider) Acquire(ctx context.Context, in connector.PromptInp
 			p.evict(in.AgentID, sandboxID, bindingID)
 			// fall through to cold start
 		} else {
-			// Renew the sandbox TTL on every cache hit so an active
-			// conversation doesn't get evicted mid-thread.
-			renewCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
-			if err := p.cfg.Client.Renew(renewCtx, sandboxID, int(SandboxDefaultTTL.Seconds())); err != nil {
-				p.cfg.Log.Warn("agent_daemon sandbox renew failed (continuing)",
-					"sandbox_id", sandboxID, "err", err)
+			if policyChanged && bindingID != "" && p.cfg.Bindings != nil {
+				if leaseErr := p.cfg.Bindings.ConfigureSandboxBindingLease(
+					ctx,
+					bindingID,
+					int32(desiredTTL/time.Second),
+					autoRenewThreshold(desiredTTL, desiredAutoRenew),
+					expiresAt,
+				); leaseErr != nil {
+					p.cfg.Log.Warn("agent_daemon sandbox lease policy sync failed",
+						"binding_id", bindingID, "err", leaseErr)
+				} else {
+					p.commitCachedLeasePolicy(in.AgentID, entry, desiredTTL, desiredAutoRenew, expiresAt)
+				}
+			} else if cachePolicyChanged {
+				p.commitCachedLeasePolicy(in.AgentID, entry, desiredTTL, desiredAutoRenew, expiresAt)
 			}
-			cancel()
 			// Best-effort: touch the DB binding so idle sweep sees
 			// recent activity.
 			if bindingID != "" && p.cfg.Bindings != nil {
@@ -494,6 +668,16 @@ func (p *E2BSandboxProvider) Acquire(ctx context.Context, in connector.PromptInp
 	return deviceID, coldStartErr
 }
 
+func (p *E2BSandboxProvider) commitCachedLeasePolicy(agentID string, expected *sandboxEntry, ttl time.Duration, autoRenew bool, expiresAt time.Time) {
+	p.cacheMu.Lock()
+	defer p.cacheMu.Unlock()
+	if current := p.cache[agentID]; current == expected {
+		current.timeout = ttl
+		current.autoRenew = autoRenew
+		current.expiresAt = expiresAt
+	}
+}
+
 // acquireCrossPod runs the cross-pod Reserve/Wait dance against the
 // sandboxes table. Returns:
 //
@@ -527,6 +711,22 @@ func (p *E2BSandboxProvider) acquireCrossPod(ctx context.Context, in connector.P
 			"binding_id", row.ID)
 		return row.ID, "", nil
 	}
+	// The slot is held by someone else. If that holder is an abandoned
+	// cold start, clear it and take the slot ourselves — otherwise this
+	// agent is wedged permanently (see reclaimAbandonedSpawn).
+	if reclaimed, retryRow, retryWon, retryErr := p.reclaimAbandonedSpawn(ctx, in, cacheKey, templateID, row); reclaimed {
+		if retryErr != nil {
+			return "", "", retryErr
+		}
+		if retryWon {
+			p.cfg.Log.Info("sandbox slot reserved after reclaiming abandoned cold-start",
+				"agent_id", in.AgentID,
+				"binding_id", retryRow.ID)
+			return retryRow.ID, "", nil
+		}
+		// Someone else won the freed slot; fall through and wait on them.
+		row = retryRow
+	}
 	// Loser: wait for the winner.
 	p.cfg.Log.Info("sandbox slot already held; waiting for winner to finish cold-start",
 		"agent_id", in.AgentID,
@@ -542,10 +742,13 @@ func (p *E2BSandboxProvider) acquireCrossPod(ctx context.Context, in connector.P
 	if deviceID == "" {
 		return "", "", fmt.Errorf("%w: winner row has no device_id in metadata", ErrSandboxAcquireFailed)
 	}
-	// We don't seed p.cache here: this pod never created the sandbox,
-	// has no envd token, and can't Renew/Touch it. The next Acquire
-	// will Reserve, see the existing binding (still running), and
-	// Wait again — cheap.
+	p.syncPersistedLeasePolicy(ctx, in, finalRow)
+	if touchErr := p.cfg.Bindings.TouchSandboxBinding(ctx, finalRow.ID); touchErr != nil {
+		p.cfg.Log.Warn("agent_daemon cross-pod sandbox touch failed",
+			"binding_id", finalRow.ID, "err", touchErr)
+	}
+	// We don't seed p.cache here because this pod never received the envd
+	// token. Durable lease operations remain available from any pod.
 	p.cfg.Log.Info("sandbox slot resolved via cross-pod wait",
 		"agent_id", in.AgentID,
 		"binding_id", finalRow.ID,
@@ -553,6 +756,125 @@ func (p *E2BSandboxProvider) acquireCrossPod(ctx context.Context, in connector.P
 	return "", deviceID, nil
 }
 
+func (p *E2BSandboxProvider) syncPersistedLeasePolicy(ctx context.Context, in connector.PromptInput, row store.SandboxBindingRead) {
+	persisted, found, err := p.cfg.Bindings.GetActiveSandboxBindingByAgentID(ctx, in.AgentID)
+	if err != nil || !found || persisted.ID != row.ID {
+		p.cfg.Log.Warn("agent_daemon cross-pod sandbox lease lookup failed",
+			"binding_id", row.ID, "found", found, "err", err)
+		return
+	}
+	row = persisted
+	ttl, autoRenew := p.leasePolicyFor(in)
+	threshold := autoRenewThreshold(ttl, autoRenew)
+	if row.TimeoutSeconds == int32(ttl/time.Second) && row.AutoRenewThresholdSeconds == threshold {
+		return
+	}
+	expiresAt := time.Now().UTC().Add(ttl)
+	if row.ExpiresAt != nil && !row.ExpiresAt.IsZero() {
+		expiresAt = *row.ExpiresAt
+	}
+	if err := p.cfg.Bindings.ConfigureSandboxBindingLease(ctx, row.ID, int32(ttl/time.Second), threshold, expiresAt); err != nil {
+		p.cfg.Log.Warn("agent_daemon cross-pod sandbox lease policy sync failed",
+			"binding_id", row.ID, "err", err)
+	}
+}
+
+// reclaimAbandonedSpawn frees the reservation slot when it is held by a
+// cold start that can no longer be in flight, then retries the
+// reservation once.
+//
+// Why this is needed: uk_sandboxes_active_per_agent keys on
+// (workspace_id, agent_id) WHERE killed_at IS NULL, so a `spawning` row
+// holds the agent's only slot until something marks it terminal. The
+// loser path (WaitForSandboxBindingActive) treats `spawning` as
+// "keep waiting" and only exits on a terminal status or ctx timeout. So
+// if the winning process dies between Reserve and
+// Finalize/MarkKilled — crash, redeploy, OOM, pod eviction — the row
+// stays `spawning` forever and EVERY later prompt for that agent burns
+// the full acquire timeout and fails. The agent is wedged with no
+// self-healing path short of manual DB surgery.
+//
+// A cold start is bounded by SandboxAcquireTimeout, so a `spawning` row
+// older than SandboxSpawnAbandonedAfter is definitively dead rather than
+// slow.
+//
+// created_at is written from the reserving pod's Go clock, so skew would
+// have to approach the generous threshold to matter. The actual reclaim is
+// nevertheless a database CAS guarded by both state and creation cutoff.
+//
+// Returns reclaimed=false when the holder is healthy (caller should wait
+// on it as usual). When reclaimed=true the caller must use the returned
+// row/won/err instead of the original reservation result.
+func (p *E2BSandboxProvider) reclaimAbandonedSpawn(
+	ctx context.Context,
+	in connector.PromptInput,
+	cacheKey, templateID string,
+	held store.SandboxBindingRead,
+) (reclaimed bool, row store.SandboxBindingRead, won bool, err error) {
+	if held.Status != store.SandboxBindingStatusSpawning {
+		return false, store.SandboxBindingRead{}, false, nil
+	}
+	// A zero CreatedAt means "age unknown", not "infinitely old". Fail
+	// safe: never steal a slot we cannot prove is stale, otherwise an
+	// unset timestamp would let us kill a cold start that is actively
+	// in flight.
+	if held.CreatedAt.IsZero() {
+		return false, store.SandboxBindingRead{}, false, nil
+	}
+	age := time.Since(held.CreatedAt)
+	if age < SandboxSpawnAbandonedAfter {
+		return false, store.SandboxBindingRead{}, false, nil
+	}
+
+	p.cfg.Log.Warn("reclaiming abandoned sandbox cold-start; its owner never finalized the binding",
+		"agent_id", in.AgentID,
+		"binding_id", held.ID,
+		"sandbox_id", held.SandboxID,
+		"age", age,
+		"abandoned_after", SandboxSpawnAbandonedAfter)
+	reclaimed, reclaimErr := p.cfg.Bindings.ReclaimAbandonedSandboxBinding(
+		ctx, held.ID, time.Now().UTC().Add(-SandboxSpawnAbandonedAfter),
+	)
+	if reclaimErr != nil {
+		return true, store.SandboxBindingRead{}, false,
+			fmt.Errorf("%w: reclaim abandoned binding %s: %v", ErrSandboxAcquireFailed, held.ID, reclaimErr)
+	}
+	if !reclaimed {
+		// The original owner finalized or another contender reclaimed the
+		// row after our read. Do not kill its provider sandbox.
+		return false, store.SandboxBindingRead{}, false, nil
+	}
+
+	// Best-effort kill of the half-built sandbox after winning the CAS. Skipped for a
+	// reservation placeholder, which is not a real e2b id. A leaked
+	// sandbox also self-expires via the provider TTL, so a failure here
+	// must not block reclaiming the slot.
+	if sandboxID := strings.TrimSpace(held.SandboxID); sandboxID != "" && !store.IsPendingSandboxID(sandboxID) {
+		killCtx, cancel := context.WithTimeout(ctx, 10*time.Second)
+		if killErr := p.cfg.Client.Kill(killCtx, sandboxID); killErr != nil {
+			p.cfg.Log.Warn("abandoned sandbox kill failed (continuing; TTL will expire it)",
+				"sandbox_id", sandboxID, "err", killErr)
+		}
+		cancel()
+	}
+
+	row, won, err = p.cfg.Bindings.ReserveSandboxBindingSlot(ctx, store.ReserveSandboxBindingSlotInput{
+		WorkspaceID: in.WorkspaceID,
+		AgentID:     in.AgentID,
+		CacheKey:    cacheKey,
+		TemplateID:  templateID,
+		Metadata: map[string]any{
+			"sandbox_kind": "agent_daemon",
+			"connector":    string(p.cfg.Connector),
+		},
+	})
+	if err != nil {
+		return true, store.SandboxBindingRead{}, false,
+			fmt.Errorf("%w: re-reserve binding slot after reclaim: %v", ErrSandboxAcquireFailed, err)
+	}
+	return true, row, won, nil
+}
+
 // coldStart owns the full mint + create + login + connect + wait
 // sequence. On failure best-efforts to kill the half-built sandbox.
 //
@@ -622,9 +944,10 @@ func (p *E2BSandboxProvider) coldStart(ctx context.Context, in connector.PromptI
 	deviceID := pair.Runtime.ID
 
 	// 2. Create the e2b sandbox.
+	ttl, autoRenew := p.leasePolicyFor(in)
 	sandbox, err := p.cfg.Client.Create(bootCtx, e2b.CreateInput{
 		TemplateID:     templateID,
-		TimeoutSeconds: int(SandboxDefaultTTL.Seconds()),
+		TimeoutSeconds: int(ttl.Seconds()),
 		Metadata: map[string]string{
 			"parsar.workspace_id": in.WorkspaceID,
 			"parsar.agent_id":     in.AgentID,
@@ -645,6 +968,20 @@ func (p *E2BSandboxProvider) coldStart(ctx context.Context, in connector.PromptI
 		"sandbox_size", resolvedSize,
 		"template_id", templateID)
 
+	// Record the real sandbox id on the reservation immediately, before
+	// the rest of cold start (seed → connect → wait → finalize). If this
+	// pod crashes mid-cold-start, the durable row then carries a killable
+	// id instead of the pending- placeholder, so reclaimAbandonedSpawn can
+	// terminate the sandbox instead of leaving it to bill until its TTL.
+	// Best-effort: a failure here only widens the pre-existing leak window,
+	// so log and continue rather than aborting a working cold start.
+	if reservedBindingID != "" && p.cfg.Bindings != nil {
+		if idErr := p.cfg.Bindings.SetSpawningSandboxBindingSandboxID(bootCtx, reservedBindingID, sandbox.SandboxID); idErr != nil {
+			p.cfg.Log.Warn("agent_daemon sandbox: early sandbox_id persist failed (crash before finalize would orphan it until TTL)",
+				"binding_id", reservedBindingID, "sandbox_id", sandbox.SandboxID, "err", idErr)
+		}
+	}
+
 	// Resolve pod IP for direct envd access (bypasses external gateway).
 	var envdURL string
 	if p.cfg.PodIPResolver != nil {
@@ -729,10 +1066,21 @@ func (p *E2BSandboxProvider) coldStart(ctx context.Context, in connector.PromptI
 	if in.ConversationID != "" {
 		connectEnv["PARSAR_CONVERSATION_ID"] = in.ConversationID
 	}
+	// No CWD: both sandbox clients treat an empty value as "leave it to the
+	// runtime", which resolves to the image's own WORKDIR and therefore
+	// always exists.
+	//
+	// Deliberately NOT the agent's work_dir. This is only where the
+	// short-lived `parsar-daemon connect` process starts; the directory the
+	// agent actually works in travels separately as
+	// prompt_request.WorkDir. Passing work_dir here would abort cold start
+	// for any agent configured with a host path (a local device's
+	// /Users/... does not exist inside the sandbox). Hardcoding a path is
+	// no better — a custom template without that directory fails the same
+	// way.
 	connectRes, err := p.cfg.Client.RunCommand(bootCtx, e2b.RunCommandInput{
 		Sandbox: sandbox,
 		Command: connectCmd,
-		CWD:     "/workspace",
 		Env:     connectEnv,
 		Timeout: 20 * time.Second,
 		EnvdURL: envdURL,
@@ -809,6 +1157,9 @@ func (p *E2BSandboxProvider) coldStart(ctx context.Context, in connector.PromptI
 		ownerPodID:  resolvedOwnerPodID,
 		createdAt:   now,
 		lastUsed:    now,
+		timeout:     ttl,
+		expiresAt:   now.Add(ttl),
+		autoRenew:   autoRenew,
 	}
 
 	// 5b. Persist to sandboxes table so admin endpoints, multi-pod
@@ -861,6 +1212,19 @@ func (p *E2BSandboxProvider) coldStart(ctx context.Context, in connector.PromptI
 				entry.bindingID = binding.ID
 			}
 		}
+		if entry.bindingID != "" {
+			threshold := autoRenewThreshold(ttl, autoRenew)
+			if leaseErr := p.cfg.Bindings.ConfigureSandboxBindingLease(
+				bootCtx,
+				entry.bindingID,
+				int32(ttl/time.Second),
+				threshold,
+				entry.expiresAt,
+			); leaseErr != nil {
+				p.cfg.Log.Warn("sandbox binding lease persist failed",
+					"binding_id", entry.bindingID, "err", leaseErr)
+			}
+		}
 	}
 
 	p.cacheMu.Lock()
@@ -904,10 +1268,9 @@ func (p *E2BSandboxProvider) SandboxStatus(ctx context.Context, agentID string)
 	return info, true, nil
 }
 
-// Renew bumps the e2b TTL for the agent's sandbox to
-// SandboxDefaultTTL. (zero, false, nil) when no live cache entry exists
-// (admin panel renders "no sandbox"). Touches lastUsed so the cache
-// survives the next Reap window.
+// Renew bumps the e2b TTL for the agent's sandbox back to its cached or
+// persisted lifetime. Durable lookup lets any pod service the request.
+// (zero, false, nil) means no active sandbox exists.
 func (p *E2BSandboxProvider) Renew(ctx context.Context, agentID string) (time.Time, bool, error) {
 	if strings.TrimSpace(agentID) == "" {
 		return time.Time{}, false, nil
@@ -918,17 +1281,37 @@ func (p *E2BSandboxProvider) Renew(ctx context.Context, agentID string) (time.Ti
 		entry.lastUsed = time.Now().UTC()
 	}
 	sandboxID := ""
+	bindingID := ""
+	timeout := p.ttl()
 	if ok {
 		sandboxID = entry.sandbox.SandboxID
+		bindingID = entry.bindingID
+		if entry.timeout > 0 {
+			timeout = entry.timeout
+		}
 	}
 	p.cacheMu.Unlock()
 	if !ok {
-		return time.Time{}, false, nil
+		if p.cfg.Bindings == nil {
+			return time.Time{}, false, nil
+		}
+		bindingRow, found, lookupErr := p.cfg.Bindings.GetActiveSandboxBindingByAgentID(ctx, agentID)
+		if lookupErr != nil {
+			return time.Time{}, false, lookupErr
+		}
+		if !found || store.IsPendingSandboxID(bindingRow.SandboxID) {
+			return time.Time{}, false, nil
+		}
+		sandboxID = bindingRow.SandboxID
+		bindingID = bindingRow.ID
+		if bindingRow.TimeoutSeconds > 0 {
+			timeout = time.Duration(bindingRow.TimeoutSeconds) * time.Second
+		}
 	}
 
 	renewCtx, cancel := context.WithTimeout(ctx, 10*time.Second)
 	defer cancel()
-	if err := p.cfg.Client.Renew(renewCtx, sandboxID, int(SandboxDefaultTTL.Seconds())); err != nil {
+	if err := p.cfg.Client.Renew(renewCtx, sandboxID, int(timeout.Seconds())); err != nil {
 		return time.Time{}, true, fmt.Errorf("e2b renew sandbox %s: %w", sandboxID, err)
 	}
 
@@ -939,16 +1322,207 @@ func (p *E2BSandboxProvider) Renew(ctx context.Context, agentID string) (time.Ti
 	getCtx, cancelGet := context.WithTimeout(ctx, 3*time.Second)
 	defer cancelGet()
 	runtime, err := p.cfg.Client.GetInfo(getCtx, sandboxID)
+	expiresAt := time.Now().UTC().Add(timeout)
 	if err != nil {
 		p.cfg.Log.Warn("agent_daemon sandbox renew: e2b GetInfo after Renew failed (renew itself succeeded)",
 			"sandbox_id", sandboxID, "err", err)
-		return time.Time{}, true, nil
+	} else {
+		expiresAt = runtime.EndAt
+	}
+	if bindingID != "" && p.cfg.Bindings != nil {
+		if persistErr := p.cfg.Bindings.CompleteSandboxBindingRenew(ctx, bindingID, expiresAt); persistErr != nil {
+			p.cfg.Log.Warn("agent_daemon sandbox renew: persist expiry failed",
+				"binding_id", bindingID, "err", persistErr)
+		}
 	}
+	p.cacheMu.Lock()
+	if cached, exists := p.cache[agentID]; exists {
+		cached.expiresAt = expiresAt
+	}
+	p.cacheMu.Unlock()
 	p.cfg.Log.Info("agent_daemon sandbox renewed",
 		"agent_id", agentID,
 		"sandbox_id", sandboxID,
-		"expires_at", runtime.EndAt)
-	return runtime.EndAt, true, nil
+		"expires_at", expiresAt)
+	return expiresAt, true, nil
+}
+
+// Maintain renews due bound sandboxes claimed atomically from Postgres. It is
+// safe to run on every server pod; only the pod that wins the renewing state
+// transition calls the provider.
+func (p *E2BSandboxProvider) Maintain(ctx context.Context) (int, error) {
+	if p.cfg.Bindings == nil {
+		return 0, nil
+	}
+	claims, err := p.cfg.Bindings.ClaimSandboxBindingsDueForAutoRenew(ctx, time.Now().UTC(), sandboxMaintenanceBatchSize)
+	if err != nil {
+		return 0, err
+	}
+	renewed := 0
+	for _, claim := range claims {
+		if err := ctx.Err(); err != nil {
+			return renewed, err
+		}
+		if store.IsPendingSandboxID(claim.SandboxID) {
+			_ = p.cfg.Bindings.FailSandboxBindingRenew(ctx, claim.BindingID)
+			continue
+		}
+		timeout := time.Duration(claim.TimeoutSeconds) * time.Second
+		renewCtx, cancel := context.WithTimeout(ctx, 10*time.Second)
+		renewErr := p.cfg.Client.Renew(renewCtx, claim.SandboxID, int(claim.TimeoutSeconds))
+		cancel()
+		if renewErr != nil {
+			if errors.Is(renewErr, context.Canceled) || errors.Is(renewErr, context.DeadlineExceeded) {
+				p.cfg.Log.Warn("agent_daemon scheduled sandbox renew interrupted; claim will be retried",
+					"sandbox_id", claim.SandboxID, "agent_id", claim.AgentID, "err", renewErr)
+				if err := ctx.Err(); err != nil {
+					return renewed, err
+				}
+				continue
+			}
+			if e2b.IsNotFound(renewErr) {
+				// The sandbox is already gone (expired or killed out of
+				// band); renewing is impossible. Free the slot so the next
+				// prompt cold-starts a fresh one instead of retrying a dead
+				// sandbox forever.
+				if markErr := p.cfg.Bindings.MarkSandboxBindingKilled(ctx, claim.BindingID, store.SandboxBindingStatusKilledOrphaned); markErr != nil {
+					p.cfg.Log.Warn("agent_daemon scheduled renew: mark gone sandbox killed failed",
+						"binding_id", claim.BindingID, "err", markErr)
+				}
+				p.cacheMu.Lock()
+				delete(p.cache, claim.AgentID)
+				p.cacheMu.Unlock()
+				p.cfg.Log.Warn("agent_daemon scheduled sandbox renew: sandbox gone, freed slot",
+					"sandbox_id", claim.SandboxID, "agent_id", claim.AgentID)
+				continue
+			}
+			if e2b.IsUnsupported(renewErr) {
+				// The provider cannot renew at all. Disable auto-renew for
+				// this binding so we stop hammering it; the sandbox still
+				// lives out its original TTL.
+				_ = p.cfg.Bindings.FailSandboxBindingRenew(ctx, claim.BindingID)
+				p.cacheMu.Lock()
+				if cached, ok := p.cache[claim.AgentID]; ok {
+					cached.autoRenew = false
+				}
+				p.cacheMu.Unlock()
+				p.cfg.Log.Warn("agent_daemon scheduled sandbox renew not supported by provider; auto-renew disabled for this binding",
+					"sandbox_id", claim.SandboxID, "agent_id", claim.AgentID, "err", renewErr)
+				continue
+			}
+			// Transient provider failure (5xx, rate limit, network). Leave
+			// the row in 'renewing' so the maintenance recovery branch
+			// re-claims it (~2 min) and keeps trying. A one-off hiccup must
+			// never permanently disable renewal — that would let the
+			// sandbox expire silently mid-conversation.
+			p.cfg.Log.Warn("agent_daemon scheduled sandbox renew failed; will retry",
+				"sandbox_id", claim.SandboxID, "agent_id", claim.AgentID, "err", renewErr)
+			continue
+		}
+		expiresAt := time.Now().UTC().Add(timeout)
+		getCtx, getCancel := context.WithTimeout(ctx, 3*time.Second)
+		if runtime, infoErr := p.cfg.Client.GetInfo(getCtx, claim.SandboxID); infoErr == nil && !runtime.EndAt.IsZero() {
+			expiresAt = runtime.EndAt
+		}
+		getCancel()
+		if err := p.cfg.Bindings.CompleteSandboxBindingRenew(ctx, claim.BindingID, expiresAt); err != nil {
+			p.cfg.Log.Warn("agent_daemon scheduled sandbox renew persist failed",
+				"binding_id", claim.BindingID, "err", err)
+			continue
+		}
+		p.cacheMu.Lock()
+		if cached, ok := p.cache[claim.AgentID]; ok {
+			cached.expiresAt = expiresAt
+		}
+		p.cacheMu.Unlock()
+		renewed++
+	}
+	return renewed, nil
+}
+
+// SandboxExists distinguishes an explicitly deleted provider sandbox from a
+// transient registry or provider failure. Only an E2B 404 confirms absence.
+func (p *E2BSandboxProvider) SandboxExists(ctx context.Context, agentID string) (bool, bool, error) {
+	var sandboxID string
+	p.cacheMu.Lock()
+	if entry := p.cache[agentID]; entry != nil {
+		sandboxID = entry.sandbox.SandboxID
+	}
+	p.cacheMu.Unlock()
+	if sandboxID == "" && p.cfg.Bindings != nil {
+		row, found, err := p.cfg.Bindings.GetActiveSandboxBindingByAgentID(ctx, agentID)
+		if err != nil {
+			return false, false, err
+		}
+		if !found || store.IsPendingSandboxID(row.SandboxID) {
+			return false, false, nil
+		}
+		sandboxID = row.SandboxID
+	}
+	if strings.TrimSpace(sandboxID) == "" || store.IsPendingSandboxID(sandboxID) {
+		return false, false, nil
+	}
+	probeCtx, cancel := context.WithTimeout(ctx, 3*time.Second)
+	defer cancel()
+	if _, err := p.cfg.Client.GetInfo(probeCtx, sandboxID); err != nil {
+		if e2b.IsNotFound(err) {
+			return false, true, nil
+		}
+		return false, true, err
+	}
+	return true, true, nil
+}
+
+// Recreate clears a confirmed-dead binding and performs exactly one fresh
+// Acquire. It works even when the sandbox was created by a different pod.
+func (p *E2BSandboxProvider) Recreate(ctx context.Context, in connector.PromptInput) (string, error) {
+	p.cacheMu.Lock()
+	entry := p.cache[in.AgentID]
+	delete(p.cache, in.AgentID)
+	p.cacheMu.Unlock()
+
+	var row store.SandboxBindingRead
+	found := false
+	if p.cfg.Bindings != nil {
+		var err error
+		row, found, err = p.cfg.Bindings.GetActiveSandboxBindingByAgentID(ctx, in.AgentID)
+		if err != nil {
+			if entry != nil {
+				p.restoreReapCandidate(in.AgentID, entry)
+			}
+			return "", fmt.Errorf("sandbox recreate: lookup binding: %w", err)
+		}
+	}
+	if entry != nil {
+		if !found {
+			row.ID = entry.bindingID
+			row.SandboxID = entry.sandbox.SandboxID
+			row.Metadata = map[string]any{"device_id": entry.deviceID}
+			found = true
+		}
+	}
+	if found {
+		if sandboxID := strings.TrimSpace(row.SandboxID); sandboxID != "" && !store.IsPendingSandboxID(sandboxID) {
+			killCtx, cancel := context.WithTimeout(ctx, 10*time.Second)
+			killErr := p.cfg.Client.Kill(killCtx, sandboxID)
+			cancel()
+			if killErr != nil && !e2b.IsNotFound(killErr) {
+				if entry != nil {
+					p.restoreReapCandidate(in.AgentID, entry)
+				}
+				return "", fmt.Errorf("sandbox recreate: kill old sandbox %s: %w", sandboxID, killErr)
+			}
+		}
+		if deviceID, _ := row.Metadata["device_id"].(string); deviceID != "" {
+			_ = p.cfg.Binder.InvalidateDevice(ctx, deviceID)
+		}
+		if row.ID != "" && p.cfg.Bindings != nil {
+			if err := p.cfg.Bindings.MarkSandboxBindingKilled(ctx, row.ID, store.SandboxBindingStatusKilledError); err != nil {
+				return "", fmt.Errorf("sandbox recreate: release old binding: %w", err)
+			}
+		}
+	}
+	return p.Acquire(ctx, in)
 }
 
 // SandboxRuntimeInfo queries e2b for a sandbox's live expiry, bypassing
@@ -967,6 +1541,14 @@ func (p *E2BSandboxProvider) SandboxRuntimeInfo(ctx context.Context, sandboxID s
 	if sandboxID == "" {
 		return time.Time{}, nil
 	}
+	// A binding that is still cold-starting carries a reservation
+	// placeholder, not a real sandbox id. The admin status poller reads
+	// sandbox_id straight off the row, so without this guard every poll
+	// (~2.5s) sends a malformed id to e2b and logs a 400 WARN until the
+	// sandbox finishes spawning. There is no expiry to report yet.
+	if store.IsPendingSandboxID(sandboxID) {
+		return time.Time{}, nil
+	}
 	getCtx, cancel := context.WithTimeout(ctx, 3*time.Second)
 	defer cancel()
 	runtime, err := p.cfg.Client.GetInfo(getCtx, sandboxID)
@@ -978,8 +1560,8 @@ func (p *E2BSandboxProvider) SandboxRuntimeInfo(ctx context.Context, sandboxID s
 	return runtime.EndAt, nil
 }
 
-// Release tears down the sandbox associated with a agent:
-// lookup → evict cache → kill → drop binder rows pointing at the device.
+// Release tears down the sandbox associated with an agent. It falls back to
+// the durable binding when the request lands on a pod without the cache entry.
 func (p *E2BSandboxProvider) Release(ctx context.Context, agentID string) error {
 	if agentID == "" {
 		return nil
@@ -990,40 +1572,65 @@ func (p *E2BSandboxProvider) Release(ctx context.Context, agentID string) error
 		delete(p.cache, agentID)
 	}
 	p.cacheMu.Unlock()
-	if !ok {
+
+	var sandboxID, bindingID, deviceID string
+	if ok {
+		sandboxID = entry.sandbox.SandboxID
+		bindingID = entry.bindingID
+		deviceID = entry.deviceID
+	} else if p.cfg.Bindings != nil {
+		row, found, err := p.cfg.Bindings.GetActiveSandboxBindingByAgentID(ctx, agentID)
+		if err != nil {
+			return fmt.Errorf("agent_daemon sandbox release: lookup binding: %w", err)
+		}
+		if !found {
+			return nil
+		}
+		sandboxID = row.SandboxID
+		bindingID = row.ID
+		deviceID, _ = row.Metadata["device_id"].(string)
+	}
+	if bindingID == "" && !ok {
 		return nil
 	}
-	// Best-effort device invalidation in binder so a stale binding
-	// row doesn't keep pointing at the dead device.
-	if err := p.cfg.Binder.InvalidateDevice(ctx, entry.deviceID); err != nil {
-		p.cfg.Log.Warn("agent_daemon sandbox release: invalidate device binding failed",
-			"device_id", entry.deviceID, "err", err)
+	if sandboxID != "" && !store.IsPendingSandboxID(sandboxID) {
+		if err := p.cfg.Client.Kill(ctx, sandboxID); err != nil && !e2b.IsNotFound(err) {
+			if entry != nil {
+				p.restoreReapCandidate(agentID, entry)
+			}
+			return fmt.Errorf("agent_daemon sandbox release: kill %s: %w", sandboxID, err)
+		}
 	}
-	if err := p.cfg.Client.Kill(ctx, entry.sandbox.SandboxID); err != nil {
-		return fmt.Errorf("agent_daemon sandbox release: kill %s: %w", entry.sandbox.SandboxID, err)
+	// Invalidate session bindings only after the provider accepted the kill.
+	if deviceID != "" {
+		if err := p.cfg.Binder.InvalidateDevice(ctx, deviceID); err != nil {
+			p.cfg.Log.Warn("agent_daemon sandbox release: invalidate device binding failed",
+				"device_id", deviceID, "err", err)
+		}
 	}
 	// Best-effort: mark the DB binding killed so admin queries
 	// reflect the state change immediately.
-	if entry.bindingID != "" && p.cfg.Bindings != nil {
+	if bindingID != "" && p.cfg.Bindings != nil {
 		markCtx, markCancel := context.WithTimeout(context.Background(), 5*time.Second)
 		defer markCancel()
-		if markErr := p.cfg.Bindings.MarkSandboxBindingKilled(markCtx, entry.bindingID, store.SandboxBindingStatusKilled); markErr != nil {
+		if markErr := p.cfg.Bindings.MarkSandboxBindingKilled(markCtx, bindingID, store.SandboxBindingStatusKilled); markErr != nil {
 			p.cfg.Log.Warn("agent_daemon sandbox release: mark binding killed failed",
-				"binding_id", entry.bindingID, "err", markErr)
+				"binding_id", bindingID, "err", markErr)
 		}
 	}
 	p.cfg.Log.Info("agent_daemon sandbox released",
 		"agent_id", agentID,
-		"sandbox_id", entry.sandbox.SandboxID,
-		"device_id", entry.deviceID)
+		"sandbox_id", sandboxID,
+		"device_id", deviceID)
 	return nil
 }
 
 // Reap walks the cache and evicts entries whose lastUsed is older than
-// SandboxIdleReapThreshold. Returns the count evicted. Failures on
-// individual kills are logged but never abort the rest of the sweep.
+// the provider's idle cutoff (see idleReapCutoff). Returns the count
+// evicted. Failures on individual kills are logged but never abort the
+// rest of the sweep.
 func (p *E2BSandboxProvider) Reap(ctx context.Context) (int, error) {
-	cutoff := time.Now().UTC().Add(-SandboxIdleReapThreshold)
+	now := time.Now().UTC()
 	type victim struct {
 		agentID string
 		entry   *sandboxEntry
@@ -1031,7 +1638,13 @@ func (p *E2BSandboxProvider) Reap(ctx context.Context) (int, error) {
 	var victims []victim
 	p.cacheMu.Lock()
 	for pid, entry := range p.cache {
-		if entry.lastUsed.Before(cutoff) {
+		idleCutoff := entry.timeout
+		if idleCutoff <= 0 {
+			idleCutoff = p.idleReapCutoff()
+		}
+		// Auto-renew is an explicit request to keep the sandbox lease alive
+		// across conversational gaps, so the idle reaper must not defeat it.
+		if !entry.autoRenew && entry.lastUsed.Before(now.Add(-idleCutoff)) {
 			victims = append(victims, victim{agentID: pid, entry: entry})
 			delete(p.cache, pid)
 		}
@@ -1040,15 +1653,56 @@ func (p *E2BSandboxProvider) Reap(ctx context.Context) (int, error) {
 	if len(victims) == 0 {
 		return 0, nil
 	}
+	evicted := 0
 	for _, v := range victims {
+		if p.cfg.Bindings != nil {
+			row, found, lookupErr := p.cfg.Bindings.GetActiveSandboxBindingByAgentID(ctx, v.agentID)
+			if lookupErr != nil {
+				p.restoreReapCandidate(v.agentID, v.entry)
+				p.cfg.Log.Warn("agent_daemon reap: binding lookup failed; deferring eviction",
+					"agent_id", v.agentID, "err", lookupErr)
+				continue
+			}
+			if found {
+				if row.SandboxID != "" && row.SandboxID != v.entry.sandbox.SandboxID {
+					p.cfg.Log.Info("agent_daemon reap: dropped stale cache entry after cross-pod replacement",
+						"agent_id", v.agentID,
+						"cached_sandbox_id", v.entry.sandbox.SandboxID,
+						"active_sandbox_id", row.SandboxID)
+					evicted++
+					continue
+				}
+				if row.TimeoutSeconds > 0 {
+					v.entry.timeout = time.Duration(row.TimeoutSeconds) * time.Second
+				}
+				v.entry.autoRenew = row.AutoRenewThresholdSeconds > 0
+				if row.LastActiveAt.After(v.entry.lastUsed) {
+					v.entry.lastUsed = row.LastActiveAt
+				}
+				if row.ID != "" {
+					v.entry.bindingID = row.ID
+				}
+				idleCutoff := v.entry.timeout
+				if idleCutoff <= 0 {
+					idleCutoff = p.idleReapCutoff()
+				}
+				if v.entry.autoRenew || !v.entry.lastUsed.Before(now.Add(-idleCutoff)) {
+					p.restoreReapCandidate(v.agentID, v.entry)
+					continue
+				}
+			}
+		}
 		if err := p.cfg.Binder.InvalidateDevice(ctx, v.entry.deviceID); err != nil {
 			p.cfg.Log.Warn("agent_daemon reap: invalidate device binding failed",
 				"device_id", v.entry.deviceID, "err", err)
 		}
 		killCtx, cancel := context.WithTimeout(ctx, 10*time.Second)
 		if err := p.cfg.Client.Kill(killCtx, v.entry.sandbox.SandboxID); err != nil {
-			p.cfg.Log.Warn("agent_daemon reap: kill sandbox failed (already evicted from cache)",
+			cancel()
+			p.restoreReapCandidate(v.agentID, v.entry)
+			p.cfg.Log.Warn("agent_daemon reap: kill sandbox failed; eviction will be retried",
 				"sandbox_id", v.entry.sandbox.SandboxID, "err", err)
+			continue
 		}
 		cancel()
 		// Best-effort: mark the DB binding killed.
@@ -1065,8 +1719,17 @@ func (p *E2BSandboxProvider) Reap(ctx context.Context) (int, error) {
 			"sandbox_id", v.entry.sandbox.SandboxID,
 			"device_id", v.entry.deviceID,
 			"idle_for", time.Since(v.entry.lastUsed))
+		evicted++
+	}
+	return evicted, nil
+}
+
+func (p *E2BSandboxProvider) restoreReapCandidate(agentID string, entry *sandboxEntry) {
+	p.cacheMu.Lock()
+	defer p.cacheMu.Unlock()
+	if _, exists := p.cache[agentID]; !exists {
+		p.cache[agentID] = entry
 	}
-	return len(victims), nil
 }
 
 // checkDeviceAlive verifies that a cached deviceID still has a live WS
diff --git a/server/internal/connector/agentdaemon/sandbox_provider_test.go b/server/internal/connector/agentdaemon/sandbox_provider_test.go
index 8570cfc7..80351d1f 100644
--- a/server/internal/connector/agentdaemon/sandbox_provider_test.go
+++ b/server/internal/connector/agentdaemon/sandbox_provider_test.go
@@ -3,6 +3,7 @@ package agentdaemon
 import (
 	"context"
 	"errors"
+	"net/http"
 	"strings"
 	"sync"
 	"testing"
@@ -337,9 +338,8 @@ func TestE2BSandboxProvider_AcquireColdStart(t *testing.T) {
 	}
 }
 
-// TestE2BSandboxProvider_AcquireWarmCacheHit: second Acquire for the
-// same agent must skip Create and return the cached
-// deviceID. Also verifies Renew is called to bump the sandbox TTL.
+// A warm Acquire only verifies and touches the runtime. Renewal is driven by
+// the scheduled lifecycle scan, even when AutoRenew is enabled.
 func TestE2BSandboxProvider_AcquireWarmCacheHit(t *testing.T) {
 	reg, _ := newTestRegistryWithDevice(t, "dev-runtime-01")
 	e2bClient := newFakeE2BClient()
@@ -350,6 +350,7 @@ func TestE2BSandboxProvider_AcquireWarmCacheHit(t *testing.T) {
 		Binder:    binding.NewInMemoryBinder(),
 		Template:  "parsar-sandbox-e2b",
 		ServerURL: "https://parsar.example.com",
+		AutoRenew: true,
 	})
 	// Pre-seed cache as if a prior cold start had populated it.
 	p.cache["pa-1"] = &sandboxEntry{
@@ -370,8 +371,131 @@ func TestE2BSandboxProvider_AcquireWarmCacheHit(t *testing.T) {
 	if e2bClient.createCalls != 0 {
 		t.Fatalf("warm cache hit should NOT call e2b Create; saw %d", e2bClient.createCalls)
 	}
-	if e2bClient.renewCalls != 1 {
-		t.Fatalf("warm cache hit should Renew sandbox TTL; saw %d calls", e2bClient.renewCalls)
+	if e2bClient.renewCalls != 0 {
+		t.Fatalf("warm cache hit should not renew directly; saw %d calls", e2bClient.renewCalls)
+	}
+}
+
+func TestE2BSandboxProvider_AcquireWarmCacheHitDoesNotRenewByDefault(t *testing.T) {
+	reg, _ := newTestRegistryWithDevice(t, "dev-runtime-01")
+	e2bClient := newFakeE2BClient()
+	p, _ := NewE2BSandboxProvider(E2BProviderConfig{
+		Client:    e2bClient,
+		Store:     &fakeMinter{},
+		Registry:  reg,
+		Binder:    binding.NewInMemoryBinder(),
+		Template:  "parsar-sandbox-e2b",
+		ServerURL: "https://parsar.example.com",
+	})
+	p.cache["pa-1"] = &sandboxEntry{
+		deviceID: "dev-runtime-01",
+		sandbox:  e2b.Sandbox{SandboxID: "sbx-warm"},
+		lastUsed: time.Now().Add(-time.Minute),
+	}
+
+	if _, err := p.Acquire(context.Background(), connector.PromptInput{
+		AgentID: "pa-1", WorkspaceID: "wks-1",
+	}); err != nil {
+		t.Fatalf("Acquire (warm): %v", err)
+	}
+	if e2bClient.renewCalls != 0 {
+		t.Fatalf("warm cache hit renewed without AutoRenew enabled; saw %d calls", e2bClient.renewCalls)
+	}
+}
+
+func TestE2BSandboxProvider_AcquireWarmCacheHitSyncsLeasePolicy(t *testing.T) {
+	reg, _ := newTestRegistryWithDevice(t, "dev-runtime-01")
+	bindings := newFakeBindings()
+	p, _ := NewE2BSandboxProvider(E2BProviderConfig{
+		Client: newFakeE2BClient(), Store: &fakeMinter{}, Registry: reg,
+		Binder: binding.NewInMemoryBinder(), Bindings: bindings,
+		Template: "parsar-sandbox-e2b", ServerURL: "https://parsar.example.com",
+	})
+	p.cache["pa-1"] = &sandboxEntry{
+		deviceID: "dev-runtime-01", sandbox: e2b.Sandbox{SandboxID: "sbx-warm"},
+		bindingID: "binding-1", lastUsed: time.Now(), timeout: time.Hour,
+		expiresAt: time.Now().Add(30 * time.Minute), autoRenew: true,
+	}
+
+	if _, err := p.Acquire(context.Background(), connector.PromptInput{
+		AgentID: "pa-1", WorkspaceID: "wks-1",
+		AgentConfig: map[string]any{"sandbox_ttl": "30m", "sandbox_auto_renew": false},
+	}); err != nil {
+		t.Fatalf("Acquire (warm): %v", err)
+	}
+	bindings.mu.Lock()
+	leaseCalls := append([]leaseConfigCall(nil), bindings.leaseConfigCalls...)
+	bindings.mu.Unlock()
+	if len(leaseCalls) != 1 || leaseCalls[0].timeoutSeconds != 1800 || leaseCalls[0].thresholdSeconds != 0 {
+		t.Fatalf("lease policy calls = %+v, want one 1800s/disabled call", leaseCalls)
+	}
+	if got := p.cache["pa-1"]; got.timeout != 30*time.Minute || got.autoRenew {
+		t.Fatalf("cached policy = timeout %s autoRenew %v", got.timeout, got.autoRenew)
+	}
+}
+
+func TestE2BSandboxProvider_AcquireWarmCacheRetriesLeasePolicySync(t *testing.T) {
+	reg, _ := newTestRegistryWithDevice(t, "dev-runtime-01")
+	bindings := newFakeBindings()
+	bindings.leaseConfigErr = errors.New("database unavailable")
+	p, _ := NewE2BSandboxProvider(E2BProviderConfig{
+		Client: newFakeE2BClient(), Store: &fakeMinter{}, Registry: reg,
+		Binder: binding.NewInMemoryBinder(), Bindings: bindings,
+		Template: "parsar-sandbox-e2b", ServerURL: "https://parsar.example.com",
+	})
+	p.cache["pa-1"] = &sandboxEntry{
+		deviceID: "dev-runtime-01", sandbox: e2b.Sandbox{SandboxID: "sbx-warm"},
+		bindingID: "binding-1", lastUsed: time.Now(), timeout: time.Hour,
+		expiresAt: time.Now().Add(time.Hour), autoRenew: true,
+	}
+	in := connector.PromptInput{
+		AgentID: "pa-1", WorkspaceID: "wks-1",
+		AgentConfig: map[string]any{"sandbox_ttl": "30m", "sandbox_auto_renew": false},
+	}
+	if _, err := p.Acquire(context.Background(), in); err != nil {
+		t.Fatalf("first Acquire: %v", err)
+	}
+	if got := p.cache["pa-1"]; got.timeout != time.Hour || !got.autoRenew {
+		t.Fatalf("failed DB sync must keep old cached policy: timeout=%s autoRenew=%v", got.timeout, got.autoRenew)
+	}
+	bindings.mu.Lock()
+	bindings.leaseConfigErr = nil
+	bindings.mu.Unlock()
+	if _, err := p.Acquire(context.Background(), in); err != nil {
+		t.Fatalf("second Acquire: %v", err)
+	}
+	if got := p.cache["pa-1"]; got.timeout != 30*time.Minute || got.autoRenew {
+		t.Fatalf("retried policy was not committed: timeout=%s autoRenew=%v", got.timeout, got.autoRenew)
+	}
+	if len(bindings.leaseConfigCalls) != 2 {
+		t.Fatalf("lease sync calls=%d, want 2", len(bindings.leaseConfigCalls))
+	}
+}
+
+func TestNormalizeSandboxTTL(t *testing.T) {
+	for _, tt := range []struct {
+		input time.Duration
+		want  time.Duration
+		ok    bool
+	}{
+		{input: 500 * time.Millisecond},
+		{input: 1500 * time.Millisecond, want: time.Second, ok: true},
+		{input: time.Hour, want: time.Hour, ok: true},
+		{input: time.Duration(maxSandboxTTLSeconds)*time.Second + time.Second},
+	} {
+		got, ok := NormalizeSandboxTTL(tt.input)
+		if got != tt.want || ok != tt.ok {
+			t.Fatalf("NormalizeSandboxTTL(%s) = %s, %v; want %s, %v", tt.input, got, ok, tt.want, tt.ok)
+		}
+	}
+}
+
+func TestAutoRenewThresholdRequiresLongerThanMaintenanceInterval(t *testing.T) {
+	if got := autoRenewThreshold(SandboxMaintenanceInterval, true); got != 0 {
+		t.Fatalf("threshold at scan interval = %d, want disabled", got)
+	}
+	if got := autoRenewThreshold(30*time.Minute, true); got != 450 {
+		t.Fatalf("threshold for 30m TTL = %d, want 450", got)
 	}
 }
 
@@ -566,6 +690,36 @@ func TestE2BSandboxProvider_Release(t *testing.T) {
 	}
 }
 
+func TestE2BSandboxProvider_ReleaseUsesDurableBindingOnCacheMiss(t *testing.T) {
+	e2bClient := newFakeE2BClient()
+	bindings := newFakeBindings()
+	bindings.activeFound = true
+	bindings.activeBinding = store.SandboxBindingRead{
+		ID: "binding-remote", SandboxID: "sbx-remote",
+		Metadata: map[string]any{"device_id": "dev-remote"},
+	}
+	binder := binding.NewInMemoryBinder()
+	_ = binder.Bind(context.Background(), binding.Binding{
+		ConversationID: "conv-remote", AgentID: "pa-remote", DeviceID: "dev-remote",
+	})
+	p, _ := NewE2BSandboxProvider(E2BProviderConfig{
+		Client: e2bClient, Store: &fakeMinter{}, Registry: gateway.NewRegistry(), Binder: binder,
+		Bindings: bindings, Template: "parsar-sandbox-e2b", ServerURL: "https://parsar.example.com",
+	})
+	if err := p.Release(context.Background(), "pa-remote"); err != nil {
+		t.Fatalf("Release: %v", err)
+	}
+	if e2bClient.killCalls != 1 {
+		t.Fatalf("cache-miss Release should kill durable sandbox; got %d calls", e2bClient.killCalls)
+	}
+	if len(bindings.markKilled) != 1 || bindings.markKilled[0] != "binding-remote" {
+		t.Fatalf("marked bindings=%v, want [binding-remote]", bindings.markKilled)
+	}
+	if _, err := binder.Resolve(context.Background(), "conv-remote", "pa-remote", "claude_code"); !errors.Is(err, binding.ErrNotBound) {
+		t.Fatalf("Release should invalidate remote binder entry; got %v", err)
+	}
+}
+
 // TestE2BSandboxProvider_Reap: entries older than the threshold are
 // evicted + killed; fresh entries survive.
 func TestE2BSandboxProvider_Reap(t *testing.T) {
@@ -589,6 +743,14 @@ func TestE2BSandboxProvider_Reap(t *testing.T) {
 		deviceID: "dev-fresh", sandbox: e2b.Sandbox{SandboxID: "sbx-fresh"},
 		lastUsed: now.Add(-10 * time.Second),
 	}
+	p.cache["pa-auto-renew"] = &sandboxEntry{
+		deviceID: "dev-auto-renew", sandbox: e2b.Sandbox{SandboxID: "sbx-auto-renew"},
+		lastUsed: now.Add(-5 * time.Minute), autoRenew: true,
+	}
+	p.cache["pa-long-ttl"] = &sandboxEntry{
+		deviceID: "dev-long-ttl", sandbox: e2b.Sandbox{SandboxID: "sbx-long-ttl"},
+		lastUsed: now.Add(-5 * time.Minute), timeout: 10 * time.Minute,
+	}
 
 	n, err := p.Reap(context.Background())
 	if err != nil {
@@ -603,11 +765,140 @@ func TestE2BSandboxProvider_Reap(t *testing.T) {
 	if _, ok := p.cache["pa-fresh"]; !ok {
 		t.Fatalf("fresh entry should survive")
 	}
+	if _, ok := p.cache["pa-auto-renew"]; !ok {
+		t.Fatalf("auto-renew entry should survive idle reap")
+	}
+	if _, ok := p.cache["pa-long-ttl"]; !ok {
+		t.Fatalf("entry-specific TTL should control idle reap")
+	}
 	if e2bClient.killCalls != 1 {
 		t.Fatalf("Reap should Kill exactly one sandbox; got %d", e2bClient.killCalls)
 	}
 }
 
+func TestE2BSandboxProvider_ReapHonorsLatestDurablePolicy(t *testing.T) {
+	bindings := newFakeBindings()
+	bindings.activeFound = true
+	bindings.activeBinding = store.SandboxBindingRead{
+		ID: "binding-1", SandboxID: "sbx-1",
+		TimeoutSeconds: 3600, AutoRenewThresholdSeconds: 900,
+		LastActiveAt: time.Now().UTC(),
+	}
+	client := newFakeE2BClient()
+	p, _ := NewE2BSandboxProvider(E2BProviderConfig{
+		Client: client, Store: &fakeMinter{}, Registry: gateway.NewRegistry(),
+		Binder: binding.NewInMemoryBinder(), Bindings: bindings,
+		Template: "parsar-sandbox-e2b", ServerURL: "https://parsar.example.com",
+	})
+	p.cache["pa-1"] = &sandboxEntry{
+		deviceID: "dev-1", sandbox: e2b.Sandbox{SandboxID: "sbx-1"},
+		lastUsed: time.Now().UTC().Add(-2 * time.Hour), timeout: time.Hour,
+	}
+
+	if n, err := p.Reap(context.Background()); err != nil || n != 0 {
+		t.Fatalf("Reap = %d, %v; want 0, nil", n, err)
+	}
+	if _, ok := p.cache["pa-1"]; !ok {
+		t.Fatal("durable auto-renew policy should restore the cache entry")
+	}
+	if client.killCalls != 0 {
+		t.Fatalf("durable auto-renew sandbox should not be killed; got %d calls", client.killCalls)
+	}
+}
+
+func TestE2BSandboxProvider_ReapRetriesProviderKillFailure(t *testing.T) {
+	client := newFakeE2BClient()
+	client.killErr = errors.New("provider unavailable")
+	p, _ := NewE2BSandboxProvider(E2BProviderConfig{
+		Client: client, Store: &fakeMinter{}, Registry: gateway.NewRegistry(),
+		Binder: binding.NewInMemoryBinder(), Template: "parsar-sandbox-e2b",
+		ServerURL: "https://parsar.example.com",
+	})
+	p.cache["pa-1"] = &sandboxEntry{
+		deviceID: "dev-1", sandbox: e2b.Sandbox{SandboxID: "sbx-1"},
+		lastUsed: time.Now().UTC().Add(-2 * time.Hour), timeout: time.Hour,
+	}
+	if n, err := p.Reap(context.Background()); err != nil || n != 0 {
+		t.Fatalf("Reap = %d, %v; want 0, nil", n, err)
+	}
+	if _, ok := p.cache["pa-1"]; !ok {
+		t.Fatal("failed provider kill should restore the cache entry for retry")
+	}
+}
+
+func TestE2BSandboxProvider_SandboxExistsRequiresExplicitNotFound(t *testing.T) {
+	client := newFakeE2BClient()
+	p := &E2BSandboxProvider{
+		cfg: E2BProviderConfig{Client: client},
+		cache: map[string]*sandboxEntry{
+			"pa-1": {sandbox: e2b.Sandbox{SandboxID: "sbx-1"}},
+		},
+	}
+
+	exists, confirmed, err := p.SandboxExists(context.Background(), "pa-1")
+	if err != nil || !exists || !confirmed {
+		t.Fatalf("live probe = (%v, %v, %v), want (true, true, nil)", exists, confirmed, err)
+	}
+	client.getInfoErr = errors.New("provider unavailable")
+	if _, _, err := p.SandboxExists(context.Background(), "pa-1"); err == nil {
+		t.Fatal("transient provider failure must not confirm deletion")
+	}
+	client.getInfoErr = &e2b.HTTPError{StatusCode: http.StatusNotFound, Message: "missing"}
+	exists, confirmed, err = p.SandboxExists(context.Background(), "pa-1")
+	if err != nil || exists || !confirmed {
+		t.Fatalf("404 probe = (%v, %v, %v), want (false, true, nil)", exists, confirmed, err)
+	}
+}
+
+func TestE2BSandboxProvider_RecreateStopsWhenKillFails(t *testing.T) {
+	client := newFakeE2BClient()
+	client.killErr = errors.New("provider unavailable")
+	p := &E2BSandboxProvider{
+		cfg: E2BProviderConfig{Client: client, Binder: binding.NewInMemoryBinder()},
+		cache: map[string]*sandboxEntry{
+			"pa-1": {
+				bindingID: "binding-1", deviceID: "dev-1",
+				sandbox: e2b.Sandbox{SandboxID: "sbx-1"},
+			},
+		},
+		inflight: map[string]*acquirePromise{},
+	}
+
+	if _, err := p.Recreate(context.Background(), connector.PromptInput{AgentID: "pa-1"}); err == nil {
+		t.Fatal("Recreate should fail when the old sandbox cannot be killed")
+	}
+	if client.createCalls != 0 {
+		t.Fatalf("replacement sandbox created after kill failure: %d", client.createCalls)
+	}
+	if _, ok := p.cache["pa-1"]; !ok {
+		t.Fatal("kill failure should restore the cache entry")
+	}
+}
+
+func TestE2BSandboxProvider_ReapDoesNotKillCrossPodReplacement(t *testing.T) {
+	bindings := newFakeBindings()
+	bindings.activeFound = true
+	bindings.activeBinding = store.SandboxBindingRead{
+		ID: "binding-new", SandboxID: "sbx-new", TimeoutSeconds: 3600,
+	}
+	client := newFakeE2BClient()
+	p, _ := NewE2BSandboxProvider(E2BProviderConfig{
+		Client: client, Store: &fakeMinter{}, Registry: gateway.NewRegistry(),
+		Binder: binding.NewInMemoryBinder(), Bindings: bindings,
+		Template: "parsar-sandbox-e2b", ServerURL: "https://parsar.example.com",
+	})
+	p.cache["pa-1"] = &sandboxEntry{
+		deviceID: "dev-old", sandbox: e2b.Sandbox{SandboxID: "sbx-old"},
+		bindingID: "binding-old", lastUsed: time.Now().UTC().Add(-2 * time.Hour), timeout: time.Hour,
+	}
+	if n, err := p.Reap(context.Background()); err != nil || n != 1 {
+		t.Fatalf("Reap = %d, %v; want 1 stale cache eviction", n, err)
+	}
+	if client.killCalls != 0 || len(bindings.markKilled) != 0 {
+		t.Fatalf("replacement must remain untouched: kills=%d marked=%v", client.killCalls, bindings.markKilled)
+	}
+}
+
 // TestShellSingleQuote covers the bash-quoting helper. Three classes:
 // safe alnum (no quoting), shell-metas (single-quote wrapped),
 // embedded single quote (broken-out via '\”).
@@ -821,14 +1112,34 @@ type fakeBindings struct {
 	waitFn func(workspaceID, agentID string) (store.SandboxBindingRead, error)
 
 	// Recorded invocations — tests assert on these.
-	createCalls   int
-	reserveCalls  int
-	finalizeCalls int
-	markKilled    []string // binding IDs
-	waitCalls     int
+	createCalls      int
+	reserveCalls     int
+	finalizeCalls    int
+	markKilled       []string // binding IDs
+	waitCalls        int
+	claims           []store.SandboxAutoRenewClaim
+	completedRenew   []string
+	failedRenew      []string
+	reclaimCalls     int
+	reclaimResult    bool
+	reclaimErr       error
+	leaseConfigCalls []leaseConfigCall
+	leaseConfigErr   error
+	activeBinding    store.SandboxBindingRead
+	activeFound      bool
+	activeErr        error
 
 	// Latest Finalize input for content asserts.
 	lastFinalize store.FinalizeSandboxBindingSpawningInput
+
+	// Latest sandbox id recorded via SetSpawningSandboxBindingSandboxID,
+	// keyed by binding id, for early-persist asserts.
+	setSandboxIDs map[string]string
+}
+
+type leaseConfigCall struct {
+	timeoutSeconds   int32
+	thresholdSeconds int32
 }
 
 func newFakeBindings() *fakeBindings { return &fakeBindings{} }
@@ -857,6 +1168,16 @@ func (f *fakeBindings) ReserveSandboxBindingSlot(_ context.Context, in store.Res
 	}, true, nil
 }
 
+func (f *fakeBindings) SetSpawningSandboxBindingSandboxID(_ context.Context, bindingID, sandboxID string) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.setSandboxIDs == nil {
+		f.setSandboxIDs = map[string]string{}
+	}
+	f.setSandboxIDs[bindingID] = sandboxID
+	return nil
+}
+
 func (f *fakeBindings) FinalizeSandboxBindingSpawning(_ context.Context, in store.FinalizeSandboxBindingSpawningInput) error {
 	f.mu.Lock()
 	defer f.mu.Unlock()
@@ -878,13 +1199,207 @@ func (f *fakeBindings) WaitForSandboxBindingActive(_ context.Context, workspaceI
 
 func (f *fakeBindings) TouchSandboxBinding(_ context.Context, _ string) error { return nil }
 
+func (f *fakeBindings) ConfigureSandboxBindingLease(_ context.Context, _ string, timeoutSeconds, thresholdSeconds int32, _ time.Time) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.leaseConfigCalls = append(f.leaseConfigCalls, leaseConfigCall{timeoutSeconds: timeoutSeconds, thresholdSeconds: thresholdSeconds})
+	return f.leaseConfigErr
+}
+
+func (f *fakeBindings) ClaimSandboxBindingsDueForAutoRenew(_ context.Context, _ time.Time, _ int32) ([]store.SandboxAutoRenewClaim, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return append([]store.SandboxAutoRenewClaim(nil), f.claims...), nil
+}
+
+func (f *fakeBindings) CompleteSandboxBindingRenew(_ context.Context, bindingID string, _ time.Time) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.completedRenew = append(f.completedRenew, bindingID)
+	return nil
+}
+
+func (f *fakeBindings) FailSandboxBindingRenew(_ context.Context, bindingID string) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.failedRenew = append(f.failedRenew, bindingID)
+	return nil
+}
+
+func (f *fakeBindings) GetActiveSandboxBindingByAgentID(_ context.Context, _ string) (store.SandboxBindingRead, bool, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return f.activeBinding, f.activeFound, f.activeErr
+}
+
 func (f *fakeBindings) MarkSandboxBindingKilled(_ context.Context, bindingID, _ string) error {
 	f.mu.Lock()
 	defer f.mu.Unlock()
 	f.markKilled = append(f.markKilled, bindingID)
+	if f.activeBinding.ID == bindingID {
+		f.activeFound = false
+	}
 	return nil
 }
 
+func (f *fakeBindings) ReclaimAbandonedSandboxBinding(_ context.Context, _ string, _ time.Time) (bool, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.reclaimCalls++
+	return f.reclaimResult, f.reclaimErr
+}
+
+func TestE2BSandboxProvider_MaintainRenewsClaimedBindings(t *testing.T) {
+	bindings := newFakeBindings()
+	bindings.claims = []store.SandboxAutoRenewClaim{{
+		BindingID: "binding-1", SandboxID: "sbx-1", AgentID: "pa-1", TimeoutSeconds: 3600,
+	}}
+	client := newFakeE2BClient()
+	client.getInfoEndAt = time.Now().UTC().Add(time.Hour)
+	p, err := NewE2BSandboxProvider(E2BProviderConfig{
+		Client: client, Store: &fakeMinter{}, Registry: gateway.NewRegistry(),
+		Binder: binding.NewInMemoryBinder(), Bindings: bindings,
+		Template: "template", ServerURL: "https://parsar.example.com",
+	})
+	if err != nil {
+		t.Fatalf("NewE2BSandboxProvider: %v", err)
+	}
+	renewed, err := p.Maintain(context.Background())
+	if err != nil {
+		t.Fatalf("Maintain: %v", err)
+	}
+	if renewed != 1 || client.renewCalls != 1 {
+		t.Fatalf("Maintain renewed=%d provider calls=%d, want 1/1", renewed, client.renewCalls)
+	}
+	if len(bindings.completedRenew) != 1 || bindings.completedRenew[0] != "binding-1" {
+		t.Fatalf("completed renewals = %v, want [binding-1]", bindings.completedRenew)
+	}
+}
+
+// A transient renew failure (generic 5xx / network) must NOT permanently
+// disable auto-renew: the claim stays retryable and the cached policy is
+// left intact so the next maintenance scan tries again.
+func TestE2BSandboxProvider_MaintainKeepsRetryingOnTransientRenewError(t *testing.T) {
+	bindings := newFakeBindings()
+	bindings.claims = []store.SandboxAutoRenewClaim{{
+		BindingID: "binding-1", SandboxID: "sbx-1", AgentID: "pa-1", TimeoutSeconds: 3600,
+	}}
+	client := newFakeE2BClient()
+	client.renewErr = errors.New("e2b 503 service unavailable")
+	p, err := NewE2BSandboxProvider(E2BProviderConfig{
+		Client: client, Store: &fakeMinter{}, Registry: gateway.NewRegistry(),
+		Binder: binding.NewInMemoryBinder(), Bindings: bindings,
+		Template: "template", ServerURL: "https://parsar.example.com",
+	})
+	if err != nil {
+		t.Fatalf("NewE2BSandboxProvider: %v", err)
+	}
+	p.cache["pa-1"] = &sandboxEntry{autoRenew: true}
+	renewed, err := p.Maintain(context.Background())
+	if err != nil {
+		t.Fatalf("Maintain: %v", err)
+	}
+	if renewed != 0 {
+		t.Fatalf("renewed=%d, want 0", renewed)
+	}
+	if len(bindings.failedRenew) != 0 {
+		t.Fatalf("transient error must not disable renewal; failed=%v", bindings.failedRenew)
+	}
+	if len(bindings.markKilled) != 0 {
+		t.Fatalf("transient error must not free the slot; markKilled=%v", bindings.markKilled)
+	}
+	if !p.cache["pa-1"].autoRenew {
+		t.Fatal("transient renew error must leave cached auto-renew enabled")
+	}
+}
+
+// A provider that signals the renew operation is unsupported (405/501)
+// disables auto-renew for that binding so the scan stops hammering it.
+func TestE2BSandboxProvider_MaintainDisablesRenewWhenUnsupported(t *testing.T) {
+	bindings := newFakeBindings()
+	bindings.claims = []store.SandboxAutoRenewClaim{{
+		BindingID: "binding-1", SandboxID: "sbx-1", AgentID: "pa-1", TimeoutSeconds: 3600,
+	}}
+	client := newFakeE2BClient()
+	client.renewErr = &e2b.HTTPError{StatusCode: http.StatusNotImplemented, Message: "renew not implemented"}
+	p, err := NewE2BSandboxProvider(E2BProviderConfig{
+		Client: client, Store: &fakeMinter{}, Registry: gateway.NewRegistry(),
+		Binder: binding.NewInMemoryBinder(), Bindings: bindings,
+		Template: "template", ServerURL: "https://parsar.example.com",
+	})
+	if err != nil {
+		t.Fatalf("NewE2BSandboxProvider: %v", err)
+	}
+	p.cache["pa-1"] = &sandboxEntry{autoRenew: true}
+	renewed, err := p.Maintain(context.Background())
+	if err != nil {
+		t.Fatalf("Maintain: %v", err)
+	}
+	if renewed != 0 || len(bindings.failedRenew) != 1 || bindings.failedRenew[0] != "binding-1" {
+		t.Fatalf("renewed=%d failed=%v, want 0/[binding-1]", renewed, bindings.failedRenew)
+	}
+	if p.cache["pa-1"].autoRenew {
+		t.Fatal("unsupported renewal should disable cached auto-renew")
+	}
+}
+
+// A renew against a sandbox e2b reports gone (404) frees the reservation
+// slot so the next prompt cold-starts a fresh one instead of retrying a
+// dead sandbox forever.
+func TestE2BSandboxProvider_MaintainFreesSlotWhenSandboxGone(t *testing.T) {
+	bindings := newFakeBindings()
+	bindings.claims = []store.SandboxAutoRenewClaim{{
+		BindingID: "binding-1", SandboxID: "sbx-1", AgentID: "pa-1", TimeoutSeconds: 3600,
+	}}
+	client := newFakeE2BClient()
+	client.renewErr = &e2b.HTTPError{StatusCode: http.StatusNotFound, Message: "sandbox not found"}
+	p, err := NewE2BSandboxProvider(E2BProviderConfig{
+		Client: client, Store: &fakeMinter{}, Registry: gateway.NewRegistry(),
+		Binder: binding.NewInMemoryBinder(), Bindings: bindings,
+		Template: "template", ServerURL: "https://parsar.example.com",
+	})
+	if err != nil {
+		t.Fatalf("NewE2BSandboxProvider: %v", err)
+	}
+	p.cache["pa-1"] = &sandboxEntry{autoRenew: true}
+	renewed, err := p.Maintain(context.Background())
+	if err != nil {
+		t.Fatalf("Maintain: %v", err)
+	}
+	if renewed != 0 {
+		t.Fatalf("renewed=%d, want 0", renewed)
+	}
+	if len(bindings.markKilled) != 1 || bindings.markKilled[0] != "binding-1" {
+		t.Fatalf("gone sandbox should free the slot; markKilled=%v", bindings.markKilled)
+	}
+	if _, ok := p.cache["pa-1"]; ok {
+		t.Fatal("gone sandbox should evict the cache entry")
+	}
+}
+
+func TestE2BSandboxProvider_MaintainLeavesInterruptedClaimRetryable(t *testing.T) {
+	bindings := newFakeBindings()
+	bindings.claims = []store.SandboxAutoRenewClaim{{
+		BindingID: "binding-1", SandboxID: "sbx-1", AgentID: "pa-1", TimeoutSeconds: 3600,
+	}}
+	client := newFakeE2BClient()
+	client.renewErr = context.DeadlineExceeded
+	p, err := NewE2BSandboxProvider(E2BProviderConfig{
+		Client: client, Store: &fakeMinter{}, Registry: gateway.NewRegistry(),
+		Binder: binding.NewInMemoryBinder(), Bindings: bindings,
+		Template: "template", ServerURL: "https://parsar.example.com",
+	})
+	if err != nil {
+		t.Fatalf("NewE2BSandboxProvider: %v", err)
+	}
+	if renewed, err := p.Maintain(context.Background()); err != nil || renewed != 0 {
+		t.Fatalf("Maintain = %d, %v; want 0, nil", renewed, err)
+	}
+	if len(bindings.failedRenew) != 0 {
+		t.Fatalf("interrupted claim must remain retryable; failed=%v", bindings.failedRenew)
+	}
+}
+
 // TestE2BSandboxProvider_AcquireWinnerFinalizesReservation drives the
 // happy winner path: Reserve wins, cold-start completes, Finalize is
 // called with the real sandbox_id (not the placeholder), and
@@ -956,6 +1471,15 @@ func TestE2BSandboxProvider_AcquireLoserReusesWinnerDevice(t *testing.T) {
 	minter := &fakeMinter{}
 	e2bClient := newFakeE2BClient()
 	bindings := newFakeBindings()
+	expiresAt := time.Now().UTC().Add(40 * time.Minute)
+	bindings.activeFound = true
+	bindings.activeBinding = store.SandboxBindingRead{
+		ID:                        "binding-winner",
+		SandboxID:                 "sb-winner",
+		TimeoutSeconds:            3600,
+		AutoRenewThresholdSeconds: 0,
+		ExpiresAt:                 &expiresAt,
+	}
 	bindings.reserveFn = func(in store.ReserveSandboxBindingSlotInput) (store.SandboxBindingRead, bool, error) {
 		// Another pod won the slot first.
 		return store.SandboxBindingRead{
@@ -992,6 +1516,7 @@ func TestE2BSandboxProvider_AcquireLoserReusesWinnerDevice(t *testing.T) {
 	deviceID, err := p.Acquire(context.Background(), connector.PromptInput{
 		AgentID:     "pa-1",
 		WorkspaceID: "wks-1",
+		AgentConfig: map[string]any{"sandbox_ttl": "30m", "sandbox_auto_renew": true},
 	})
 	if err != nil {
 		t.Fatalf("Acquire: %v", err)
@@ -1017,6 +1542,59 @@ func TestE2BSandboxProvider_AcquireLoserReusesWinnerDevice(t *testing.T) {
 	if bindings.finalizeCalls != 0 {
 		t.Fatalf("loser must not Finalize; got %d", bindings.finalizeCalls)
 	}
+	if len(bindings.leaseConfigCalls) != 1 || bindings.leaseConfigCalls[0].timeoutSeconds != 1800 || bindings.leaseConfigCalls[0].thresholdSeconds != 450 {
+		t.Fatalf("loser lease sync calls=%+v, want one 1800s/450s call", bindings.leaseConfigCalls)
+	}
+}
+
+func TestE2BSandboxProvider_ReclaimAbandonedSpawnCASLostDoesNotKill(t *testing.T) {
+	bindings := newFakeBindings()
+	bindings.reclaimResult = false
+	client := newFakeE2BClient()
+	p := &E2BSandboxProvider{cfg: E2BProviderConfig{
+		Client: client, Bindings: bindings, Log: discardLogger(),
+	}}
+
+	reclaimed, _, _, err := p.reclaimAbandonedSpawn(
+		context.Background(),
+		connector.PromptInput{AgentID: "pa-1", WorkspaceID: "wks-1"},
+		"agent_daemon:pa-1", "template",
+		store.SandboxBindingRead{
+			ID: "binding-old", Status: store.SandboxBindingStatusSpawning,
+			SandboxID: "sbx-old", CreatedAt: time.Now().UTC().Add(-10 * time.Minute),
+		},
+	)
+	if err != nil || reclaimed {
+		t.Fatalf("CAS-lost reclaim = %v, err=%v; want false, nil", reclaimed, err)
+	}
+	if client.killCalls != 0 || bindings.reserveCalls != 0 {
+		t.Fatalf("CAS loser must not kill or reserve: kill=%d reserve=%d", client.killCalls, bindings.reserveCalls)
+	}
+}
+
+func TestE2BSandboxProvider_ReclaimAbandonedSpawnCASWinnerKillsThenReserves(t *testing.T) {
+	bindings := newFakeBindings()
+	bindings.reclaimResult = true
+	client := newFakeE2BClient()
+	p := &E2BSandboxProvider{cfg: E2BProviderConfig{
+		Client: client, Bindings: bindings, Log: discardLogger(),
+	}}
+
+	reclaimed, row, won, err := p.reclaimAbandonedSpawn(
+		context.Background(),
+		connector.PromptInput{AgentID: "pa-1", WorkspaceID: "wks-1"},
+		"agent_daemon:pa-1", "template",
+		store.SandboxBindingRead{
+			ID: "binding-old", Status: store.SandboxBindingStatusSpawning,
+			SandboxID: "sbx-old", CreatedAt: time.Now().UTC().Add(-10 * time.Minute),
+		},
+	)
+	if err != nil || !reclaimed || !won || row.ID == "" {
+		t.Fatalf("CAS-winner reclaim=%v won=%v row=%+v err=%v", reclaimed, won, row, err)
+	}
+	if client.killCalls != 1 || bindings.reserveCalls != 1 {
+		t.Fatalf("CAS winner should kill then reserve once: kill=%d reserve=%d", client.killCalls, bindings.reserveCalls)
+	}
 }
 
 // TestE2BSandboxProvider_AcquireWinnerFailureReleasesReservation
diff --git a/server/internal/dev/sandbox_admin.go b/server/internal/dev/sandbox_admin.go
index 994d16f9..40ba50ec 100644
--- a/server/internal/dev/sandbox_admin.go
+++ b/server/internal/dev/sandbox_admin.go
@@ -56,8 +56,8 @@ type sandboxStatusResponse struct {
 	CreatedAt    time.Time  `json:"created_at"`
 	LastActiveAt time.Time  `json:"last_active_at"`
 	KilledAt     *time.Time `json:"killed_at,omitempty"`
-	// ExpiresAt is fetched live from the e2b control plane. Nil when
-	// the binding isn't in this pod's cache or the lookup failed.
+	// ExpiresAt is fetched live from the e2b control plane. Nil when the
+	// sandbox is still spawning or the provider lookup failed.
 	ExpiresAt *time.Time     `json:"expires_at,omitempty"`
 	Metadata  map[string]any `json:"metadata"`
 }
@@ -201,6 +201,7 @@ func getSandboxStatus(deps sandboxAdminDeps, daemonMgr AgentDaemonSandboxManager
 //	@Failure		400			{object}	map[string]string		"workspace_id and agent_id must be UUIDs"
 //	@Failure		403			{object}	map[string]string		"Caller is not workspace owner/admin"
 //	@Failure		404			{object}	map[string]string		"No active sandbox binding to act on"
+//	@Failure		502			{object}	map[string]string		"Provider rejected sandbox release"
 //	@Failure		503			{object}	map[string]string		"Sandbox lifecycle store not wired"
 //	@Router			/api/v1/workspaces/{workspaceID}/agents/{agentID}/sandbox/kill [post]
 func killSandbox(deps sandboxAdminDeps, runtimeStore RuntimeStore, daemonMgr AgentDaemonSandboxManager) http.HandlerFunc {
@@ -222,6 +223,7 @@ func killSandbox(deps sandboxAdminDeps, runtimeStore RuntimeStore, daemonMgr Age
 //	@Failure		400			{object}	map[string]string		"workspace_id and agent_id must be UUIDs"
 //	@Failure		403			{object}	map[string]string		"Caller is not workspace owner/admin"
 //	@Failure		404			{object}	map[string]string		"No active sandbox binding to rebuild"
+//	@Failure		502			{object}	map[string]string		"Provider rejected sandbox release"
 //	@Failure		503			{object}	map[string]string		"Sandbox lifecycle store not wired"
 //	@Router			/api/v1/workspaces/{workspaceID}/agents/{agentID}/sandbox/rebuild [post]
 func rebuildSandbox(deps sandboxAdminDeps, runtimeStore RuntimeStore, daemonMgr AgentDaemonSandboxManager) http.HandlerFunc {
@@ -250,11 +252,15 @@ func rebuildSandbox(deps sandboxAdminDeps, runtimeStore RuntimeStore, daemonMgr
 			return
 		}
 
-		if daemonMgr != nil {
-			if releaseErr := daemonMgr.Release(r.Context(), agentID); releaseErr != nil {
-				log.Bg().Warn("sandbox rebuild: release failed",
-					"agent_id", agentID, "err", releaseErr)
-			}
+		if daemonMgr == nil {
+			writeJSON(w, http.StatusServiceUnavailable, map[string]string{"error": "sandbox provider not wired"})
+			return
+		}
+		if releaseErr := daemonMgr.Release(r.Context(), agentID); releaseErr != nil {
+			log.Bg().Warn("sandbox rebuild: release failed",
+				"agent_id", agentID, "err", releaseErr)
+			writeJSON(w, http.StatusBadGateway, map[string]string{"error": "sandbox release failed: " + releaseErr.Error()})
+			return
 		}
 		// Safety net for the case where Release didn't (or couldn't)
 		// mark the DB row.
@@ -264,52 +270,50 @@ func rebuildSandbox(deps sandboxAdminDeps, runtimeStore RuntimeStore, daemonMgr
 
 		// On successful re-Acquire, persist the new deviceID to
 		// agents.runtime_id so dispatch picks up the new sandbox.
-		if daemonMgr != nil {
-			// Load the agent's current config snapshot BEFORE the goroutine
-			// because the goroutine builds its own context — we want the
-			// caller's request context for the lookup so RBAC / cancellation
-			// still apply. The config is what feeds resolveTemplate inside
-			// E2BSandboxProvider.Acquire (sandbox_size=xl etc.); without it
-			// the new sandbox would silently fall back to the standard
-			// template even when the agent is configured for XL.
-			var agentConfig map[string]any
-			if detail, detailErr := deps.store.GetAgentDetail(r.Context(), agentID); detailErr == nil {
-				agentConfig = detail.Config
-			} else {
-				log.Bg().Warn("sandbox rebuild: load agent config failed; re-acquire will use default template",
-					"agent_id", agentID, "err", detailErr)
-			}
+		// Load the agent's current config snapshot BEFORE the goroutine
+		// because the goroutine builds its own context — we want the
+		// caller's request context for the lookup so RBAC / cancellation
+		// still apply. The config is what feeds resolveTemplate inside
+		// E2BSandboxProvider.Acquire (sandbox_size=xl etc.); without it
+		// the new sandbox would silently fall back to the standard
+		// template even when the agent is configured for XL.
+		var agentConfig map[string]any
+		if detail, detailErr := deps.store.GetAgentDetail(r.Context(), agentID); detailErr == nil {
+			agentConfig = detail.Config
+		} else {
+			log.Bg().Warn("sandbox rebuild: load agent config failed; re-acquire will use default template",
+				"agent_id", agentID, "err", detailErr)
+		}
 
-			go func() {
-				ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
-				defer cancel()
-				deviceID, acquireErr := daemonMgr.Acquire(ctx, connector.PromptInput{
-					AgentID:     agentID,
+		go func() {
+			ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
+			defer cancel()
+			deviceID, acquireErr := daemonMgr.Acquire(ctx, connector.PromptInput{
+				AgentID:     agentID,
+				WorkspaceID: workspaceID,
+				AgentConfig: agentConfig,
+			})
+			if acquireErr != nil {
+				log.Bg().Warn("sandbox rebuild re-acquire failed",
+					"agent_id", agentID, "err", acquireErr)
+				return
+			}
+			if runtimeStore != nil {
+				if _, bindErr := runtimeStore.SetAgentRuntime(ctx, store.SetAgentRuntimeInput{
 					WorkspaceID: workspaceID,
-					AgentConfig: agentConfig,
-				})
-				if acquireErr != nil {
-					log.Bg().Warn("sandbox rebuild re-acquire failed",
-						"agent_id", agentID, "err", acquireErr)
+					AgentID:     agentID,
+					RuntimeID:   deviceID,
+				}); bindErr != nil {
+					log.Bg().Error("sandbox rebuild: re-acquired but runtime_id persist failed",
+						"agent_id", agentID,
+						"device_id", deviceID,
+						"err", bindErr)
 					return
 				}
-				if runtimeStore != nil {
-					if _, bindErr := runtimeStore.SetAgentRuntime(ctx, store.SetAgentRuntimeInput{
-						WorkspaceID: workspaceID,
-						AgentID:     agentID,
-						RuntimeID:   deviceID,
-					}); bindErr != nil {
-						log.Bg().Error("sandbox rebuild: re-acquired but runtime_id persist failed",
-							"agent_id", agentID,
-							"device_id", deviceID,
-							"err", bindErr)
-						return
-					}
-				}
-				log.Bg().Info("sandbox rebuild re-acquire succeeded",
-					"agent_id", agentID, "device_id", deviceID)
-			}()
-		}
+			}
+			log.Bg().Info("sandbox rebuild re-acquire succeeded",
+				"agent_id", agentID, "device_id", deviceID)
+		}()
 
 		writeJSON(w, http.StatusOK, map[string]any{
 			"binding_id": binding.ID,
@@ -320,12 +324,11 @@ func rebuildSandbox(deps sandboxAdminDeps, runtimeStore RuntimeStore, daemonMgr
 	}
 }
 
-// renewSandbox bumps the e2b TTL on the live sandbox. 503 if daemonMgr
-// isn't wired. 409 when this pod's cache doesn't own the binding (sibling
-// pod cold-started it).
+// renewSandbox bumps the provider TTL on the live sandbox. The provider
+// resolves persisted bindings across pods; 503 means the manager is not wired.
 //
 //	@Summary		Renew an agent's sandbox TTL
-//	@Description	Bumps the e2b TTL on the live sandbox. 409 when this pod's cache doesn't own the binding (a sibling pod cold-started it); 502 on renew failure. Owner/admin only.
+//	@Description	Bumps the provider TTL on the live sandbox, including bindings created by a sibling pod. 502 on renew failure. Owner/admin only.
 //	@Tags			sandboxes
 //	@ID				renewDevAgentSandbox
 //	@Produce		json
@@ -335,7 +338,7 @@ func rebuildSandbox(deps sandboxAdminDeps, runtimeStore RuntimeStore, daemonMgr
 //	@Failure		400			{object}	map[string]string		"workspace_id and agent_id must be UUIDs"
 //	@Failure		403			{object}	map[string]string		"Caller is not workspace owner/admin"
 //	@Failure		404			{object}	map[string]string		"No active sandbox binding to renew"
-//	@Failure		409			{object}	map[string]string		"Sandbox not owned by this pod"
+//	@Failure		409			{object}	map[string]string		"Binding disappeared during renewal"
 //	@Failure		502			{object}	map[string]string		"Renew failed at provider"
 //	@Failure		503			{object}	map[string]string		"Sandbox lifecycle store or manager not wired"
 //	@Router			/api/v1/workspaces/{workspaceID}/agents/{agentID}/sandbox/renew [post]
@@ -378,10 +381,10 @@ func renewSandbox(deps sandboxAdminDeps, daemonMgr AgentDaemonSandboxManager) ht
 			return
 		}
 		if !ok {
-			// This pod's cache doesn't own the binding; UI poll will
-			// pick up the new owner within ~15s.
+			// The binding disappeared between the workspace-scoped lookup
+			// and the provider's cross-pod lifecycle lookup.
 			writeJSON(w, http.StatusConflict, map[string]string{
-				"error":        "sandbox not owned by this pod; refresh and retry",
+				"error":        "sandbox binding changed during renewal; refresh and retry",
 				"workspace_id": workspaceID,
 				"agent_id":     agentID,
 			})
@@ -516,11 +519,15 @@ func performLifecycleAction(w http.ResponseWriter, r *http.Request, deps sandbox
 		return
 	}
 
-	if daemonMgr != nil {
-		if releaseErr := daemonMgr.Release(r.Context(), agentID); releaseErr != nil {
-			log.Bg().Warn("sandbox kill: release failed (continuing to mark DB)",
-				"agent_id", agentID, "err", releaseErr)
-		}
+	if daemonMgr == nil {
+		writeJSON(w, http.StatusServiceUnavailable, map[string]string{"error": "sandbox provider not wired"})
+		return
+	}
+	if releaseErr := daemonMgr.Release(r.Context(), agentID); releaseErr != nil {
+		log.Bg().Warn("sandbox kill: release failed",
+			"agent_id", agentID, "err", releaseErr)
+		writeJSON(w, http.StatusBadGateway, map[string]string{"error": "sandbox release failed: " + releaseErr.Error()})
+		return
 	}
 	// Safety net for the case where Release didn't (or couldn't) mark
 	// the DB row.
diff --git a/server/internal/sandbox/e2b/client.go b/server/internal/sandbox/e2b/client.go
index 4da1bede..7be7370e 100644
--- a/server/internal/sandbox/e2b/client.go
+++ b/server/internal/sandbox/e2b/client.go
@@ -74,11 +74,37 @@ type CommandResult struct {
 	Exited bool   `json:"exited"`
 }
 
-type apiError struct {
+type apiErrorPayload struct {
 	Code    int    `json:"code"`
 	Message string `json:"message"`
 }
 
+// HTTPError is returned when E2B responds with an unexpected HTTP status.
+// Message is redacted before it is stored here.
+type HTTPError struct {
+	StatusCode int
+	Message    string
+}
+
+func (e *HTTPError) Error() string { return e.Message }
+
+// IsNotFound reports whether E2B explicitly confirmed that a resource is gone.
+func IsNotFound(err error) bool {
+	var httpErr *HTTPError
+	return errors.As(err, &httpErr) && httpErr.StatusCode == http.StatusNotFound
+}
+
+// IsUnsupported reports whether the provider signalled that the operation
+// itself is not available (405 Method Not Allowed / 501 Not Implemented),
+// as opposed to a transient failure. Callers use this to stop retrying an
+// operation the backend fundamentally cannot perform (e.g. renew).
+func IsUnsupported(err error) bool {
+	var httpErr *HTTPError
+	return errors.As(err, &httpErr) &&
+		(httpErr.StatusCode == http.StatusMethodNotAllowed ||
+			httpErr.StatusCode == http.StatusNotImplemented)
+}
+
 func (c *Client) Create(ctx context.Context, input CreateInput) (Sandbox, error) {
 	if strings.TrimSpace(c.APIKey) == "" {
 		return Sandbox{}, ErrAPIKeyRequired
@@ -275,17 +301,13 @@ func (c *Client) doJSON(ctx context.Context, method, path string, body any, want
 	defer res.Body.Close()
 	if res.StatusCode != wantStatus {
 		b, _ := io.ReadAll(io.LimitReader(res.Body, 4096))
-		var apiErr apiError
+		var apiErr apiErrorPayload
 		if err := json.Unmarshal(b, &apiErr); err == nil && apiErr.Message != "" {
-			return errors.New(RedactSecret(
-				fmt.Sprintf("e2b api %s %s failed: status=%d message=%s", method, path, res.StatusCode, apiErr.Message),
-				c.APIKey,
-			))
+			return &HTTPError{StatusCode: res.StatusCode, Message: RedactSecret(
+				fmt.Sprintf("e2b api %s %s failed: status=%d message=%s", method, path, res.StatusCode, apiErr.Message), c.APIKey)}
 		}
-		return errors.New(RedactSecret(
-			fmt.Sprintf("e2b api %s %s failed: status=%d body=%s", method, path, res.StatusCode, strings.TrimSpace(string(b))),
-			c.APIKey,
-		))
+		return &HTTPError{StatusCode: res.StatusCode, Message: RedactSecret(
+			fmt.Sprintf("e2b api %s %s failed: status=%d body=%s", method, path, res.StatusCode, strings.TrimSpace(string(b))), c.APIKey)}
 	}
 	if out == nil || res.StatusCode == http.StatusNoContent {
 		return nil
diff --git a/server/internal/sandbox/e2b/client_test.go b/server/internal/sandbox/e2b/client_test.go
index 9bc61ffc..5bb1fc8e 100644
--- a/server/internal/sandbox/e2b/client_test.go
+++ b/server/internal/sandbox/e2b/client_test.go
@@ -117,6 +117,20 @@ func TestRedactsAPIKeyFromAPIErrorMessage(t *testing.T) {
 	}
 }
 
+func TestIsNotFoundUsesHTTPStatus(t *testing.T) {
+	api := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusNotFound)
+		_ = json.NewEncoder(w).Encode(map[string]any{"message": "sandbox missing"})
+	}))
+	defer api.Close()
+
+	client := &Client{HTTPClient: api.Client(), APIBaseURL: api.URL, APIKey: "test-key"}
+	_, err := client.GetInfo(context.Background(), "sbx-missing")
+	if !IsNotFound(err) {
+		t.Fatalf("GetInfo error = %v, want typed 404", err)
+	}
+}
+
 func readConnectEnvelope(r io.Reader, out any) error {
 	var header [5]byte
 	if _, err := io.ReadFull(r, header[:]); err != nil {
diff --git a/server/internal/store/agent_config.go b/server/internal/store/agent_config.go
index ef03bf8d..c7f0ff3e 100644
--- a/server/internal/store/agent_config.go
+++ b/server/internal/store/agent_config.go
@@ -18,7 +18,7 @@ func mergeAgentProfileOwnedConfig(current, requested map[string]any) (map[string
 			config["profile"] = cloneAnyMap(profile)
 		}
 	}
-	for _, key := range []string{"agent_kind", "daemon_mode", "sandbox_size", "device_id"} {
+	for _, key := range []string{"agent_kind", "daemon_mode", "sandbox_size", "sandbox_ttl", "device_id"} {
 		raw, ok := profileConfig[key]
 		if !ok {
 			continue
@@ -30,6 +30,15 @@ func mergeAgentProfileOwnedConfig(current, requested map[string]any) (map[string
 			config[key] = value
 		}
 	}
+	if raw, ok := profileConfig["sandbox_auto_renew"]; ok {
+		if raw == nil {
+			delete(config, "sandbox_auto_renew")
+		} else if enabled, valid := raw.(bool); valid {
+			config["sandbox_auto_renew"] = enabled
+		} else {
+			return nil, fmt.Errorf("%w: sandbox_auto_renew must be a boolean", ErrInvalidInput)
+		}
+	}
 
 	var profileWorkdir any
 	var profileWorkdirSet bool
@@ -81,13 +90,20 @@ func mergeAgentProfileOwnedConfig(current, requested map[string]any) (map[string
 }
 
 func foldAgentDaemonConfig(config, input map[string]any) error {
-	for _, key := range []string{"device_id", "daemon_mode", "agent_kind", "work_dir"} {
+	for _, key := range []string{"device_id", "daemon_mode", "agent_kind", "work_dir", "sandbox_ttl"} {
 		if value, ok := input[key].(string); ok {
 			if value = strings.TrimSpace(value); value != "" {
 				config[key] = value
 			}
 		}
 	}
+	if raw, ok := input["sandbox_auto_renew"]; ok {
+		enabled, valid := raw.(bool)
+		if !valid {
+			return fmt.Errorf("%w: sandbox_auto_renew must be a boolean", ErrInvalidInput)
+		}
+		config["sandbox_auto_renew"] = enabled
+	}
 
 	rawMode, modeSet := input["mode"]
 	if !modeSet {
diff --git a/server/internal/store/agent_config_test.go b/server/internal/store/agent_config_test.go
index 2767c673..3ea6f969 100644
--- a/server/internal/store/agent_config_test.go
+++ b/server/internal/store/agent_config_test.go
@@ -57,3 +57,33 @@ func TestMergeAgentProfileOwnedConfigCodexMode(t *testing.T) {
 		}
 	})
 }
+
+func TestMergeAgentProfileOwnedConfigSandboxLease(t *testing.T) {
+	config, err := mergeAgentProfileOwnedConfig(map[string]any{}, map[string]any{
+		"sandbox_ttl":        "2h",
+		"sandbox_auto_renew": true,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if config["sandbox_ttl"] != "2h" || config["sandbox_auto_renew"] != true {
+		t.Fatalf("sandbox lease config not persisted: %#v", config)
+	}
+
+	if _, err := mergeAgentProfileOwnedConfig(config, map[string]any{"sandbox_auto_renew": "yes"}); !errors.Is(err, ErrInvalidInput) {
+		t.Fatalf("invalid sandbox_auto_renew returned %v, want ErrInvalidInput", err)
+	}
+}
+
+func TestFoldAgentDaemonConfigSandboxLease(t *testing.T) {
+	config := map[string]any{}
+	if err := foldAgentDaemonConfig(config, map[string]any{
+		"sandbox_ttl":        "90m",
+		"sandbox_auto_renew": false,
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if config["sandbox_ttl"] != "90m" || config["sandbox_auto_renew"] != false {
+		t.Fatalf("sandbox lease config not folded: %#v", config)
+	}
+}
diff --git a/server/internal/store/sandbox_bindings.go b/server/internal/store/sandbox_bindings.go
index 2a13833a..9ea33d43 100644
--- a/server/internal/store/sandbox_bindings.go
+++ b/server/internal/store/sandbox_bindings.go
@@ -8,16 +8,17 @@ import (
 	"strings"
 	"time"
 
+	sqlc "github.com/MiniMax-AI-Dev/parsar/server/internal/db/sqlc"
 	guuid "github.com/google/uuid"
 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgtype"
-	sqlc "github.com/MiniMax-AI-Dev/parsar/server/internal/db/sqlc"
 )
 
 // Values must match the CHECK constraint in migration 000008.
 const (
 	SandboxBindingStatusSpawning       = "spawning"
 	SandboxBindingStatusActive         = "running"
+	SandboxBindingStatusRenewing       = "renewing"
 	SandboxBindingStatusKilling        = "killing"
 	SandboxBindingStatusKilled         = "killed"
 	SandboxBindingStatusKilledOrphaned = "killed_orphaned"
@@ -25,18 +26,172 @@ const (
 )
 
 type SandboxBindingRead struct {
-	ID           string
-	WorkspaceID  string
-	AgentID      *string
-	Name         *string
-	CacheKey       string
+	ID                        string
+	WorkspaceID               string
+	AgentID                   *string
+	Name                      *string
+	CacheKey                  string
+	SandboxID                 string
+	TemplateID                string
+	Status                    string
+	CreatedAt                 time.Time
+	LastActiveAt              time.Time
+	KilledAt                  *time.Time
+	TimeoutSeconds            int32
+	AutoRenewThresholdSeconds int32
+	ExpiresAt                 *time.Time
+	Metadata                  map[string]any
+}
+
+type SandboxAutoRenewClaim struct {
+	BindingID      string
 	SandboxID      string
-	TemplateID     string
-	Status         string
-	CreatedAt      time.Time
-	LastActiveAt   time.Time
-	KilledAt       *time.Time
-	Metadata       map[string]any
+	AgentID        string
+	TimeoutSeconds int32
+}
+
+// ConfigureSandboxBindingLease persists the provider lease requested for a
+// newly-created bound sandbox. A zero threshold disables automatic renewal.
+func (s *Store) ConfigureSandboxBindingLease(ctx context.Context, bindingID string, timeoutSeconds, thresholdSeconds int32, expiresAt time.Time) error {
+	id, err := uuid(bindingID)
+	if err != nil {
+		return fmt.Errorf("sandbox binding lease: id: %w", err)
+	}
+	if timeoutSeconds <= 0 {
+		return fmt.Errorf("sandbox binding lease: timeout_seconds must be > 0")
+	}
+	if thresholdSeconds < 0 {
+		return fmt.Errorf("sandbox binding lease: threshold_seconds must be >= 0")
+	}
+	_, err = s.db.Exec(ctx, `
+update sandboxes
+set timeout_seconds = $2,
+    auto_renew_threshold_seconds = $3,
+    expires_at = $4,
+    last_renewed_at = $5
+where id = $1
+  and allocation_status = 'bound'
+  and killed_at is null`, id, timeoutSeconds, thresholdSeconds, timestamptz(expiresAt.UTC()), timestamptz(time.Now().UTC()))
+	return err
+}
+
+// ClaimSandboxBindingsDueForAutoRenew atomically moves due bound sandboxes to
+// renewing. FOR UPDATE SKIP LOCKED plus the state transition prevents two
+// server pods from renewing the same provider sandbox in one scan. A claim
+// abandoned by a crashed worker becomes eligible again after two minutes.
+func (s *Store) ClaimSandboxBindingsDueForAutoRenew(ctx context.Context, now time.Time, limit int32) ([]SandboxAutoRenewClaim, error) {
+	if limit <= 0 {
+		limit = 100
+	}
+	rows, err := s.db.Query(ctx, `
+with due as (
+  select id
+  from sandboxes
+  where allocation_status = 'bound'
+    and killed_at is null
+    and metadata->>'sandbox_kind' = 'agent_daemon'
+    and expires_at is not null
+    and auto_renew_threshold_seconds > 0
+	    and (
+	      (lifecycle_status = 'running'
+	       and expires_at <= $1::timestamptz + auto_renew_threshold_seconds * interval '1 second')
+	      or
+	      (lifecycle_status = 'renewing'
+	       and coalesce(last_renewed_at, created_at) < $1::timestamptz - interval '2 minutes')
+    )
+  order by expires_at asc
+  for update skip locked
+  limit $2
+)
+update sandboxes s
+set lifecycle_status = 'renewing',
+    last_renewed_at = $1
+from due
+where s.id = due.id
+returning s.id::text, s.sandbox_id, s.agent_id::text, s.timeout_seconds`, timestamptz(now.UTC()), limit)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	claims := make([]SandboxAutoRenewClaim, 0)
+	for rows.Next() {
+		var claim SandboxAutoRenewClaim
+		if err := rows.Scan(&claim.BindingID, &claim.SandboxID, &claim.AgentID, &claim.TimeoutSeconds); err != nil {
+			return nil, err
+		}
+		claims = append(claims, claim)
+	}
+	return claims, rows.Err()
+}
+
+func (s *Store) CompleteSandboxBindingRenew(ctx context.Context, bindingID string, expiresAt time.Time) error {
+	id, err := uuid(bindingID)
+	if err != nil {
+		return fmt.Errorf("complete sandbox renew: id: %w", err)
+	}
+	_, err = s.db.Exec(ctx, `
+update sandboxes
+set lifecycle_status = 'running',
+    expires_at = $2,
+    last_renewed_at = $3
+where id = $1
+  and lifecycle_status in ('running', 'renewing')
+  and killed_at is null`, id, timestamptz(expiresAt.UTC()), timestamptz(time.Now().UTC()))
+	return err
+}
+
+func (s *Store) FailSandboxBindingRenew(ctx context.Context, bindingID string) error {
+	id, err := uuid(bindingID)
+	if err != nil {
+		return fmt.Errorf("fail sandbox renew: id: %w", err)
+	}
+	_, err = s.db.Exec(ctx, `
+update sandboxes
+set lifecycle_status = 'running',
+    auto_renew_threshold_seconds = 0
+where id = $1
+  and lifecycle_status = 'renewing'
+  and killed_at is null`, id)
+	return err
+}
+
+// GetActiveSandboxBindingByAgentID is the cross-pod lifecycle lookup used by
+// manual renew and automatic recovery. Agent IDs are globally unique.
+func (s *Store) GetActiveSandboxBindingByAgentID(ctx context.Context, agentID string) (SandboxBindingRead, bool, error) {
+	agentUUID, err := uuid(agentID)
+	if err != nil {
+		return SandboxBindingRead{}, false, fmt.Errorf("sandbox binding: agent_id: %w", err)
+	}
+	row := s.db.QueryRow(ctx, `
+select id::text, workspace_id::text, agent_id, name, cache_key, sandbox_id,
+       template_id, lifecycle_status, created_at, last_active_at, killed_at,
+       timeout_seconds, auto_renew_threshold_seconds, expires_at, metadata
+from sandboxes
+where agent_id = $1
+  and allocation_status = 'bound'
+  and killed_at is null
+limit 1`, agentUUID)
+	var out SandboxBindingRead
+	var agent pgtype.UUID
+	var name, cacheKey pgtype.Text
+	var killedAt, expiresAt pgtype.Timestamptz
+	var metadata []byte
+	if err := row.Scan(&out.ID, &out.WorkspaceID, &agent, &name, &cacheKey,
+		&out.SandboxID, &out.TemplateID, &out.Status, &out.CreatedAt,
+		&out.LastActiveAt, &killedAt, &out.TimeoutSeconds,
+		&out.AutoRenewThresholdSeconds, &expiresAt, &metadata); err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return SandboxBindingRead{}, false, nil
+		}
+		return SandboxBindingRead{}, false, err
+	}
+	out.AgentID = nullableUUIDString(agent)
+	out.Name = nullableText(name)
+	out.CacheKey = cacheKey.String
+	out.KilledAt = nullableTime(killedAt)
+	out.ExpiresAt = nullableTime(expiresAt)
+	out.Metadata = unmarshalJSONOrEmpty(metadata)
+	return out, true, nil
 }
 
 type CreateSandboxBindingInput struct {
@@ -75,15 +230,15 @@ func (s *Store) CreateSandboxBinding(ctx context.Context, input CreateSandboxBin
 		return SandboxBindingRead{}, fmt.Errorf("sandbox binding: marshal metadata: %w", err)
 	}
 	row, err := sqlc.New(s.db).CreateSandboxBinding(ctx, sqlc.CreateSandboxBindingParams{
-		ID:             mustUUID(newID()),
-		WorkspaceID:    workspaceUUID,
-		AgentID: agentUUID,
-		CacheKey:       pgtype.Text{String: strings.TrimSpace(input.CacheKey), Valid: true},
-		SandboxID:      strings.TrimSpace(input.SandboxID),
-		TemplateID:     strings.TrimSpace(input.TemplateID),
-		Status:         status,
-		Now:            timestamptz(time.Now().UTC()),
-		Metadata:       metadataJSON,
+		ID:          mustUUID(newID()),
+		WorkspaceID: workspaceUUID,
+		AgentID:     agentUUID,
+		CacheKey:    pgtype.Text{String: strings.TrimSpace(input.CacheKey), Valid: true},
+		SandboxID:   strings.TrimSpace(input.SandboxID),
+		TemplateID:  strings.TrimSpace(input.TemplateID),
+		Status:      status,
+		Now:         timestamptz(time.Now().UTC()),
+		Metadata:    metadataJSON,
 	})
 	if err != nil {
 		return SandboxBindingRead{}, err
@@ -92,11 +247,27 @@ func (s *Store) CreateSandboxBinding(ctx context.Context, input CreateSandboxBin
 }
 
 type ReserveSandboxBindingSlotInput struct {
-	WorkspaceID    string
-	AgentID string
-	CacheKey       string
-	TemplateID     string
-	Metadata       map[string]any
+	WorkspaceID string
+	AgentID     string
+	CacheKey    string
+	TemplateID  string
+	Metadata    map[string]any
+}
+
+// PendingSandboxIDPrefix marks a sandboxes.sandbox_id that is a
+// reservation placeholder rather than a real provider-issued id.
+// ReserveSandboxBindingSlot has to write *something* unique to claim the
+// slot before the provider has created the sandbox, so it writes
+// "pending-<id>"; FinalizeSandboxBindingSpawning overwrites it.
+//
+// Callers that forward sandbox_id to a provider API must skip placeholder
+// values — the provider will reject them as malformed.
+const PendingSandboxIDPrefix = "pending-"
+
+// IsPendingSandboxID reports whether id is a ReserveSandboxBindingSlot
+// placeholder (see PendingSandboxIDPrefix) rather than a real sandbox id.
+func IsPendingSandboxID(id string) bool {
+	return strings.HasPrefix(strings.TrimSpace(id), PendingSandboxIDPrefix)
 }
 
 // ReserveSandboxBindingSlot is the cluster-wide cold-start coordinator: exactly
@@ -104,7 +275,7 @@ type ReserveSandboxBindingSlotInput struct {
 // index and drives cold-start; losers must call WaitForSandboxBindingActive.
 // Returns (row, true, nil) on win, (existing row, false, nil) on conflict,
 // (zero, false, err) on unrelated DB errors. sandbox_id is a placeholder
-// ("pending-<id>") until FinalizeSandboxBindingSpawning lands.
+// (PendingSandboxIDPrefix + id) until FinalizeSandboxBindingSpawning lands.
 func (s *Store) ReserveSandboxBindingSlot(ctx context.Context, input ReserveSandboxBindingSlotInput) (SandboxBindingRead, bool, error) {
 	workspaceUUID, err := uuid(input.WorkspaceID)
 	if err != nil {
@@ -122,11 +293,11 @@ func (s *Store) ReserveSandboxBindingSlot(ctx context.Context, input ReserveSand
 	if err != nil {
 		return SandboxBindingRead{}, false, fmt.Errorf("sandbox binding: marshal metadata: %w", err)
 	}
-	placeholder := "pending-" + newID()
+	placeholder := PendingSandboxIDPrefix + newID()
 	row, err := sqlc.New(s.db).ReserveSandboxBindingSlot(ctx, sqlc.ReserveSandboxBindingSlotParams{
 		ID:                   mustUUID(newID()),
 		WorkspaceID:          workspaceUUID,
-		AgentID:       agentUUID,
+		AgentID:              agentUUID,
 		CacheKey:             pgtype.Text{String: strings.TrimSpace(input.CacheKey), Valid: true},
 		PlaceholderSandboxID: placeholder,
 		TemplateID:           strings.TrimSpace(input.TemplateID),
@@ -159,6 +330,29 @@ type FinalizeSandboxBindingSpawningInput struct {
 // FinalizeSandboxBindingSpawning flips a reserved row from spawning → running
 // and writes the real sandbox_id + final metadata. Idempotent: matches no rows
 // once already finalised or killed, returning nil.
+// SetSpawningSandboxBindingSandboxID records the real provider sandbox id
+// on a still-spawning reservation, as soon as the sandbox is created and
+// before the rest of cold start runs. Until this lands the row carries a
+// pending- placeholder, so a crash between Create and Finalize would orphan
+// a real, billing sandbox that reclaim cannot identify or kill. Writing the
+// id early closes that window: reclaimAbandonedSpawn can then kill it.
+//
+// Scoped to lifecycle_status='spawning' so it never disturbs a row that has
+// already been finalized, killed, or reclaimed by another pod.
+func (s *Store) SetSpawningSandboxBindingSandboxID(ctx context.Context, bindingID, sandboxID string) error {
+	id, err := uuid(bindingID)
+	if err != nil {
+		return fmt.Errorf("set spawning sandbox id: id: %w", err)
+	}
+	_, err = s.db.Exec(ctx, `
+update sandboxes
+set sandbox_id = $2
+where id = $1
+  and lifecycle_status = 'spawning'
+  and killed_at is null`, id, strings.TrimSpace(sandboxID))
+	return err
+}
+
 func (s *Store) FinalizeSandboxBindingSpawning(ctx context.Context, input FinalizeSandboxBindingSpawningInput) error {
 	id, err := uuid(input.BindingID)
 	if err != nil {
@@ -207,7 +401,9 @@ func (s *Store) WaitForSandboxBindingActive(
 			return SandboxBindingRead{}, ErrSandboxBindingVanished
 		}
 		switch row.Status {
-		case SandboxBindingStatusActive:
+		case SandboxBindingStatusActive, SandboxBindingStatusRenewing:
+			// Provider lease renewal does not interrupt the running daemon;
+			// dispatch may keep using the sandbox while the renew call is in flight.
 			return row, nil
 		case SandboxBindingStatusSpawning, SandboxBindingStatusKilling:
 		default:
@@ -233,8 +429,8 @@ func (s *Store) getActiveSandboxBindingForAgentAnyStatus(ctx context.Context, wo
 		return SandboxBindingRead{}, false, fmt.Errorf("sandbox binding: agent_id: %w", err)
 	}
 	row, err := sqlc.New(s.db).GetActiveSandboxBindingByAgentForWait(ctx, sqlc.GetActiveSandboxBindingByAgentForWaitParams{
-		WorkspaceID:    workspaceUUID,
-		AgentID: agentUUID,
+		WorkspaceID: workspaceUUID,
+		AgentID:     agentUUID,
 	})
 	if err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
@@ -264,8 +460,8 @@ func (s *Store) GetActiveSandboxBindingForAgent(ctx context.Context, workspaceID
 		return SandboxBindingRead{}, false, fmt.Errorf("sandbox binding: agent_id: %w", err)
 	}
 	row, err := sqlc.New(s.db).GetActiveSandboxBindingForAgent(ctx, sqlc.GetActiveSandboxBindingForAgentParams{
-		WorkspaceID:    workspaceUUID,
-		AgentID: agentUUID,
+		WorkspaceID: workspaceUUID,
+		AgentID:     agentUUID,
 	})
 	if err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
@@ -366,6 +562,32 @@ func (s *Store) MarkSandboxBindingKilled(ctx context.Context, bindingID, status
 	})
 }
 
+// ReclaimAbandonedSandboxBinding atomically retires a spawning reservation
+// only when it is still spawning and was created before the caller's cutoff.
+// The guarded UPDATE closes the read-then-write race with a concurrent
+// FinalizeSandboxBindingSpawning: exactly one state transition can win.
+func (s *Store) ReclaimAbandonedSandboxBinding(ctx context.Context, bindingID string, createdBefore time.Time) (bool, error) {
+	id, err := uuid(bindingID)
+	if err != nil {
+		return false, fmt.Errorf("reclaim abandoned sandbox binding: id: %w", err)
+	}
+	now := time.Now().UTC()
+	result, err := s.db.Exec(ctx, `
+update sandboxes
+set lifecycle_status  = 'killed_error',
+    allocation_status = 'released',
+    killed_at         = $3,
+    last_active_at    = $3
+where id = $1
+  and lifecycle_status = 'spawning'
+  and created_at <= $2
+  and killed_at is null`, id, timestamptz(createdBefore.UTC()), timestamptz(now))
+	if err != nil {
+		return false, err
+	}
+	return result.RowsAffected() == 1, nil
+}
+
 // SweepOrphanedSandboxBindings marks every non-terminal binding at startup as
 // killed_orphaned — the in-memory cache that held their envd tokens is gone.
 // Returns the row count for startup logging.
@@ -377,18 +599,18 @@ type sandboxBindingRow sqlc.CreateSandboxBindingRow
 
 func sandboxBindingReadFromRow(r sandboxBindingRow) SandboxBindingRead {
 	return SandboxBindingRead{
-		ID:             r.ID,
-		WorkspaceID:    r.WorkspaceID,
-		AgentID: nullableUUIDString(r.AgentID),
-		Name:           nullableText(r.Name),
-		CacheKey:       nullableTextValue(r.CacheKey),
-		SandboxID:      r.SandboxID,
-		TemplateID:     r.TemplateID,
-		Status:         r.Status,
-		CreatedAt:      r.CreatedAt.Time,
-		LastActiveAt:   r.LastActiveAt.Time,
-		KilledAt:       nullableTime(r.KilledAt),
-		Metadata:       unmarshalJSONOrEmpty(r.Metadata),
+		ID:           r.ID,
+		WorkspaceID:  r.WorkspaceID,
+		AgentID:      nullableUUIDString(r.AgentID),
+		Name:         nullableText(r.Name),
+		CacheKey:     nullableTextValue(r.CacheKey),
+		SandboxID:    r.SandboxID,
+		TemplateID:   r.TemplateID,
+		Status:       r.Status,
+		CreatedAt:    r.CreatedAt.Time,
+		LastActiveAt: r.LastActiveAt.Time,
+		KilledAt:     nullableTime(r.KilledAt),
+		Metadata:     unmarshalJSONOrEmpty(r.Metadata),
 	}
 }
 
diff --git a/server/internal/store/sandbox_bindings_idle_test.go b/server/internal/store/sandbox_bindings_idle_test.go
index 872716d8..a922f4df 100644
--- a/server/internal/store/sandbox_bindings_idle_test.go
+++ b/server/internal/store/sandbox_bindings_idle_test.go
@@ -144,6 +144,114 @@ func TestTouchSandboxBinding_UnknownIDIsNoOp(t *testing.T) {
 	}
 }
 
+func TestSandboxBindingAutoRenewClaimLifecycle(t *testing.T) {
+	db := openTestDB(t)
+	ctx := context.Background()
+	ids := DefaultDevFixtureIDs()
+	if _, err := New(db).InsertDevFixture(ctx, ids); err != nil {
+		t.Fatalf("InsertDevFixture: %v", err)
+	}
+	s := New(db)
+	row := mustCreateBindingWithLastActive(t, ctx, s, ids.WorkspaceID, ids.ProductAgentID, "sbx-auto-renew", time.Now().UTC())
+	now := time.Now().UTC()
+	if err := s.ConfigureSandboxBindingLease(ctx, row.ID, 3600, 600, now.Add(5*time.Minute)); err != nil {
+		t.Fatalf("ConfigureSandboxBindingLease: %v", err)
+	}
+	claims, err := s.ClaimSandboxBindingsDueForAutoRenew(ctx, now, 10)
+	if err != nil {
+		t.Fatalf("ClaimSandboxBindingsDueForAutoRenew: %v", err)
+	}
+	if len(claims) != 1 || claims[0].BindingID != row.ID || claims[0].TimeoutSeconds != 3600 {
+		t.Fatalf("claims = %+v, want binding %s", claims, row.ID)
+	}
+	claimsAgain, err := s.ClaimSandboxBindingsDueForAutoRenew(ctx, now, 10)
+	if err != nil {
+		t.Fatalf("second claim: %v", err)
+	}
+	if len(claimsAgain) != 0 {
+		t.Fatalf("renewing binding was claimed twice: %+v", claimsAgain)
+	}
+	if _, err := s.db.Exec(ctx, `update sandboxes set last_renewed_at = $1 where id = $2::uuid`, now.Add(-3*time.Minute), row.ID); err != nil {
+		t.Fatalf("backdate abandoned renewal claim: %v", err)
+	}
+	reclaimed, err := s.ClaimSandboxBindingsDueForAutoRenew(ctx, now, 10)
+	if err != nil {
+		t.Fatalf("reclaim abandoned renewal: %v", err)
+	}
+	if len(reclaimed) != 1 || reclaimed[0].BindingID != row.ID {
+		t.Fatalf("abandoned renewal claim was not reclaimed: %+v", reclaimed)
+	}
+	newExpiry := now.Add(time.Hour)
+	if err := s.CompleteSandboxBindingRenew(ctx, row.ID, newExpiry); err != nil {
+		t.Fatalf("CompleteSandboxBindingRenew: %v", err)
+	}
+	got, found, err := s.GetActiveSandboxBindingByAgentID(ctx, ids.ProductAgentID)
+	if err != nil || !found {
+		t.Fatalf("GetActiveSandboxBindingByAgentID found=%v err=%v", found, err)
+	}
+	if got.Status != SandboxBindingStatusActive || got.ExpiresAt == nil || got.ExpiresAt.Before(newExpiry.Add(-time.Second)) {
+		t.Fatalf("renewed binding = %+v", got)
+	}
+	if err := s.ConfigureSandboxBindingLease(ctx, row.ID, 3600, 600, now.Add(5*time.Minute)); err != nil {
+		t.Fatalf("reconfigure lease: %v", err)
+	}
+	claims, err = s.ClaimSandboxBindingsDueForAutoRenew(ctx, now, 10)
+	if err != nil || len(claims) != 1 {
+		t.Fatalf("claim before failure = %+v, err=%v", claims, err)
+	}
+	if err := s.FailSandboxBindingRenew(ctx, row.ID); err != nil {
+		t.Fatalf("FailSandboxBindingRenew: %v", err)
+	}
+	claims, err = s.ClaimSandboxBindingsDueForAutoRenew(ctx, now.Add(time.Hour), 10)
+	if err != nil || len(claims) != 0 {
+		t.Fatalf("failed renewal should be disabled, claims=%+v err=%v", claims, err)
+	}
+}
+
+func TestReclaimAbandonedSandboxBindingCAS(t *testing.T) {
+	db := openTestDB(t)
+	ctx := context.Background()
+	ids := DefaultDevFixtureIDs()
+	if _, err := New(db).InsertDevFixture(ctx, ids); err != nil {
+		t.Fatalf("InsertDevFixture: %v", err)
+	}
+	s := New(db)
+
+	stale, won, err := s.ReserveSandboxBindingSlot(ctx, ReserveSandboxBindingSlotInput{
+		WorkspaceID: ids.WorkspaceID, AgentID: ids.ProductAgentID,
+		CacheKey: "agent_daemon:" + ids.ProductAgentID, TemplateID: "tpl_test",
+	})
+	if err != nil || !won {
+		t.Fatalf("reserve stale row: won=%v err=%v", won, err)
+	}
+	reclaimed, err := s.ReclaimAbandonedSandboxBinding(ctx, stale.ID, time.Now().UTC().Add(time.Minute))
+	if err != nil || !reclaimed {
+		t.Fatalf("reclaim stale spawning row: reclaimed=%v err=%v", reclaimed, err)
+	}
+	reclaimedAgain, err := s.ReclaimAbandonedSandboxBinding(ctx, stale.ID, time.Now().UTC().Add(time.Minute))
+	if err != nil || reclaimedAgain {
+		t.Fatalf("second CAS must lose: reclaimed=%v err=%v", reclaimedAgain, err)
+	}
+
+	finalized, won, err := s.ReserveSandboxBindingSlot(ctx, ReserveSandboxBindingSlotInput{
+		WorkspaceID: ids.WorkspaceID, AgentID: ids.BackendAgentID,
+		CacheKey: "agent_daemon:" + ids.BackendAgentID, TemplateID: "tpl_test",
+	})
+	if err != nil || !won {
+		t.Fatalf("reserve finalized row: won=%v err=%v", won, err)
+	}
+	if err := s.FinalizeSandboxBindingSpawning(ctx, FinalizeSandboxBindingSpawningInput{
+		BindingID: finalized.ID, SandboxID: "sbx-finalized-cas",
+		Metadata: map[string]any{"sandbox_kind": "agent_daemon", "device_id": "dev-finalized"},
+	}); err != nil {
+		t.Fatalf("finalize row: %v", err)
+	}
+	reclaimedFinalized, err := s.ReclaimAbandonedSandboxBinding(ctx, finalized.ID, time.Now().UTC().Add(time.Minute))
+	if err != nil || reclaimedFinalized {
+		t.Fatalf("CAS must not retire finalized row: reclaimed=%v err=%v", reclaimedFinalized, err)
+	}
+}
+
 // mustCreateBindingWithLastActive seeds an active binding then directly
 // UPDATEs last_active_at via raw SQL so tests can simulate aged rows.
 func mustCreateBindingWithLastActive(t *testing.T, ctx context.Context, s *Store, workspaceID, agentID, sandboxID string, lastActive time.Time) SandboxBindingRead {
@@ -155,6 +263,7 @@ func mustCreateBindingWithLastActive(t *testing.T, ctx context.Context, s *Store
 		SandboxID:   sandboxID,
 		TemplateID:  "tpl_test",
 		Status:      SandboxBindingStatusActive,
+		Metadata:    map[string]any{"sandbox_kind": "agent_daemon"},
 	})
 	if err != nil {
 		t.Fatalf("CreateSandboxBinding %s: %v", sandboxID, err)