fix(code-execution): separate script execution from bounded observation

[Meganeuridae]

Problem

A Python await currently holds the model-facing tool call open until the whole script exits. The runner also accepts overlapping cold starts, and an outstanding tool response from a killed interpreter can satisfy a replacement interpreter's reused call ID. Background wake requests can exceed the configured rate/cap when concurrent and falsely acknowledge a context delivery failure.

Changes

• Reserve startup before awaiting readiness; make startup cancellation settle promptly; bind tool replies and wake acknowledgements to their originating interpreter/execution; preserve sub-second tool timeouts.
• Separate script execution from bounded observation. Foreground calls return a running script_id after 10 seconds by default (wait_ms, maximum 60 seconds); action=wait retrieves or rejoins the same run. Persistent Python state stays serial and busy responses identify the active run.
• on_timeout=end_turn arms completion delivery before returning an end-turn result. An active observer consumes completion directly; otherwise a yielded execution sends a bounded completion notice and wake. The five most recently settled results remain retrievable per owner.
• Preserve independent background interpreters and existing silent-clean-exit watcher behavior. Serialize explicit wakes, acknowledge delivery failures honestly, and scope inner-tool end-turn effects to their originating execution.
• Add releaseCodeExecutionWait(agentName, scriptId?) for the host's admin-only command. This resolves observations through the normal tool-result boundary without killing Python. It is not an agent tool and is not exposed on the generic framework socket API.

The agent-facing description and docs/code-execution-lifecycle.md describe the exact behavior and the further design work. A breaking-change fragment calls out the new foreground return contract.

Tests

• Baseline 8b612f5: build passes; npm test: 786 pass / 0 fail / 4 skipped (790 total).
• This branch: build passes; npm test: 802 pass / 0 fail / 4 skipped (806 total).
• Focused real-Python/framework/observation tests: 42 pass / 0 fail.
• Replayed three new regressions against an isolated original-source snapshot: 0 pass / 3 fail, covering cold-start reservation, fractional tool timeout, and stale-response contamination.
• Scheduler tests exercise both agent-selected end-turn and operator release, then verify a separate inference receives the completed Python output. Paired smoke with the host command verifies admin denial, authorized release, continued Python execution, and result retrieval.

Not verified / limits

No live provider, resident deployment, host restart recovery, or cross-platform run was performed. Scripts/results remain process-local. Cancelling Python does not cancel an already dispatched inner tool. Completion notices use the existing scheduler; consuming a notice mid-turn can still leave a follow-up wake queued. Durable outcomes, paged journals, and delivery receipts are explicitly deferred in the design note.

Companion PRs

Companion: anima-research/connectome-host#130. It adds admin-only /release-wait [script_id] and recipe validation. Publish/install a framework release containing this primitive before expecting that command to work; the companion fails explicitly on older framework versions. No merge, package publication, dependency rollout, or deployment is included here.

Generated with OpenAI Codex.