Agent Runtime Capacity Control and Safe Reclamation

Short answer

Runtime capacity control is a lifecycle problem, not just a numeric limit. A host that manages multiple agent runtimes needs separate rules for admitting a new process, reclaiming capacity that is demonstrably idle, interrupting occupied work only with explicit authority, preserving durable user state, and proving enough teardown to reuse the released slot safely.

Qwen Code PR #12008, merged on 19 September 2026 as b944f9943c2dd3607f9921cc005d4022f51d7422, completed the first three capacity-control stages after PRs #11911 and #11940: reject excess managed ACP-child starts, reclaim one eligible empty runtime automatically, and let the user choose a specific occupied workspace runtime to stop when automatic reclamation cannot help.

Qwen Code v0.24.4, published 22 September 2026, adds a fourth layer through PR #12353 / 5feb7a4f348322c41f18a76f17ca4cbff4b937f0: experimental opt-in fixed old-space enforcement for managed ACP children. The default remains observe, and off, observe and admit retain their prior heap behavior. This is Qwen host/runtime resource policy, not an ACP, UHP, MCP or A2A wire change and not native UHP adoption by Qwen Code.

Triage a full pool before stopping a workspace

A host can reject a new child while its machine still has free RAM, or run out of RAM despite admitting every child correctly. The first is a reservation-policy problem; the second may include native memory, descendants or allocations outside V8 old space. Diagnose them separately using the Qwen capacity design and fixed-heap implementation.

start rejected → inspect reservations → reclaim proven-empty generation
                                      → otherwise request a specific stop
stop accepted → wait for physical release → reserve again → revalidate draft

1. Record the rejected start, configured mode, modeled slots and all pending/terminating reservations.
2. Check whether an eligible empty runtime exists. A loaded conversation or pending operation disqualifies a victim even if CPU usage is zero.
3. If occupied work must stop, bind the user’s selection to the displayed runtime generation. A replacement process with the same workspace name needs a new decision.
4. Wait for the implementation’s release evidence. On timeout, preserve the reservation and show the unresolved process; do not declare free capacity from an accepted stop request.
5. Re-admit the waiting operation and re-check its workspace/session context before continuing.

A deployment test should hold teardown open and attempt another start: the slot must remain counted. Heap-policy tests need a separate assertion on the child arguments and effective mode. Managed-runtime attestation supplies the complementary identity check when the waiting operation reconnects to a worker.

Capacity needs one authoritative admission boundary

A process limit is only useful if every path that can create a managed runtime passes through the same authority. Counting registered workspaces is insufficient because one workspace can reuse an existing child while preheat, restoration, replacement or another service path can need a new child without creating a new workspace registration.

Qwen PR #11911 introduced opt-in qwen serve --child-heap-mode admit at the shared ACP-child spawn boundary. Reservations and terminating children continue to count until release, while reusing an existing child does not consume another slot. A cold start that would exceed the modeled limit receives a recognizable capacity error instead of silently oversubscribing.

This distinction matters:

Question	Correct authority
May another managed runtime start?	Shared admission/reservation state
Is a workspace registered?	Workspace registry
Is a session loaded?	Session/control-plane state
Has a terminating process actually released capacity?	Physical runtime/process registry
Is the host within real RAM pressure?	Resource measurement/enforcement, if implemented

Qwen’s admit mode is process-count admission derived from its initialized budget model. It is not proof of current RSS, a fixed per-child heap ceiling or complete memory-pressure enforcement. PR #12353 adds one explicit fixed old-space control, but still does not make the modeled partition equivalent to total-process memory enforcement.

Fixed heap enforcement closes the grant-vs-model gap

Before PR #12353, Qwen could report a fixed child-memory partition while managed ACP children still inherited legacy host-derived V8 heap arguments. Those arguments could grant substantially more old space than the modeled pool, and the existing raise-only guard could not enforce a smaller ceiling.

qwen serve --child-heap-mode enforce now applies one boot-resolved old-space ceiling to every managed ACP child while reusing the same shared child-count admission and idle-reclamation policy across the primary workspace, startup-secondary workspaces and dynamically added workspaces. Workspace registration remains independent from child capacity, and multiple sessions in one workspace can still share one child.

The enforcement path is deliberately strict:

• inherited fixed old-space flags are normalized so the child receives one effective fixed ceiling;
• conflicting percentage-based old-space options are rejected instead of silently overriding the fixed partition;
• unrelated Node options remain intact;
• zero-slot or unsupported injected process wiring fails before spawning and must not leak a reservation; and
• limits.memory.enforced reports true only when the managed enforcement wiring is actually active.

The reviewer plan gives a concrete controlled example: with --child-heap-mode enforce --memory-budget-mb 1024, the modeled configuration reports one child slot and a 768 MiB old-space ceiling, and the child must receive exactly one --max-old-space-size=768. That example demonstrates argument propagation and admission behavior for the tested configuration; it is not a universal safe heap value.

The earlier Node 24 calibration in PR #12265 is similarly bounded. It records eight accepted runs, 184 real-model turns and 360 exact tool calls across long-session, multi-MCP and four-child-concurrent profiles. A 544 MiB old-space ceiling completed those measured workloads with at least 434.03 MiB of observed old-generation headroom. Upstream explicitly does not treat that as proof of a universal safe ceiling, total RSS bound, maximum deployment concurrency, multi-hour stability or acceptable GC/latency thresholds.

Operationally, this means enforce is a controlled validation mode, not a new production default. There is no automatic fallback, live heap resizing, per-workspace heap setting or divisor based on registered workspace count. Rolling back fixed heap enforcement means restarting with admit, which preserves count admission while restoring the prior heap behavior.

Reclaim empty capacity before interrupting work

Rejecting every cold start at capacity wastes a slot when the last resident runtime is warm but has no live session or pending work. Qwen PR #11940 adds a deliberately conservative second stage:

1. cancel the rejected reservation;
2. choose one least-recently-used eligible empty ACP child;
3. wait for its tracked teardown;
4. attempt admission once more; and
5. start the requested child only if that fresh admission succeeds.

The old workspace registration, files, saved history and runtime services remain available for a later cold recovery. A loaded session, active ACP connection or pending workspace work protects the runtime from this automatic reclamation path.

The architectural rule is automatic reclamation should target capacity that can be proven disposable, not work that merely looks quiet. An idle conversation can still be durable user state. Recent token activity is also not a substitute for authoritative session and pending-work state.

Occupied-runtime recovery requires explicit authority

When capacity remains full because the resident runtimes carry real sessions, policy has to change from reclamation to interruption. PR #12008 makes that transition explicit rather than silently extending the automatic reaper.

The user can inspect affected sessions, choose a specific workspace runtime to stop, or cancel and keep the initiating draft. A confirmed stop preserves workspace registration, files and saved conversations. Connected pages transition to a stopped state and require an explicit Resume before that workspace runtime is restored.

The stop operation is fenced by runtime identity rather than only by workspace name. If the candidate session set or runtime identity changes after preview, an old confirmation is rejected rather than applied to a replacement runtime. Independently connected ACP clients and enabled scheduled work can also make a candidate ineligible for the stop flow.

This gives a reusable safety invariant:

A destructive capacity action should authorize one identified runtime generation, not a mutable logical workspace name.

Without that fence, a slow confirmation can stop a newer runtime that did not exist when the user reviewed the interruption.

Stop acceptance is not release finality

A capacity-recovery API needs more than success: true|false. Starting teardown, observing the root process exit, releasing a registry slot and proving an entire process tree is gone are different facts.

The reviewed #12008 merge preserves those distinctions. Its stop-budget handling separates an in-flight timeout — HTTP 503, failed while cleanup continues — from a timeout between close phases — HTTP 409, incomplete, cleanup ended and a fresh preview is required. Partial or unknown outcomes remain visible, and the system does not automatically issue a second stop operation.

The merge also documents a platform limit: on Windows, Qwen’s registry does not track descendant process groups the same way as POSIX. A released: true result there establishes the tracked root’s settled exit, not proof that every descendant process in a tree is gone.

That is an important general lesson for agent hosts: name exactly what release evidence proves. A logical slot may be reusable under one implementation contract even when stronger whole-tree cleanup proof requires another mechanism.

Guard continuation after capacity release

Stopping a runtime does not reserve its slot for the request that motivated the stop. Another contender can win admission after capacity is released. Qwen therefore treats the original continuation as one guarded attempt rather than a guaranteed transaction.

The Web Shell preserves the exact draft across capacity failure and stop/cancel flows, but continuation is invalidated when its owning context changes. The merged review also fences queued prompts and deferred /plan continuation while the selected runtime is stopped, preventing retained intent from auto-running against a dead or replacement runtime.

This separates four facts that are easy to collapse incorrectly:

• the user authorized a stop;
• teardown released capacity;
• the original draft is still valid for its original context; and
• a fresh admission is currently available.

Only when the required facts still hold should the host continue the initiating action.

Control plane and physical harness should stay distinct

Qwen PR #11916 provides the internal ownership boundary that #12008 and #12353 build on. Session policy remains in the ACP control plane: registration, admission/FIFO behavior, terminal deduplication, artifact forwarding and worktree policy. The physical harness owns channel construction, liveness, idle scheduling, reservations, execution, teardown and the managed child process arguments that implement the fixed old-space ceiling.

Capacity recovery crosses that boundary but should not erase it. A session controller can decide which runtime may be interrupted and preserve durable conversation state; the physical harness remains responsible for actually retiring or spawning the process and producing release/enforcement evidence.

This pattern scales beyond Qwen: policy can move independently of executor mechanics only if the contract keeps logical session ownership and physical process ownership explicit.

Verification boundary

Upstream #12008 reports 2,863 focused unit tests plus 176 HTTP/ACP/browser assertions after integration, and a visible Chromium recovery flow whose regression set passed 28 assertions. The PR records direct macOS validation with Node.js 22.22.3 and local daemon/ACP/Web Shell builds using deterministic loopback model responses.

For #12353, upstream reports local build, typecheck, bundle, changed-file lint/format and focused tests; the built-daemon lifecycle harness passed 164 assertions, followed by 38 independent checks of recorded evidence. A complete HTTP run with IPv4 test-transport isolation passed 1,315 tests. The PR records direct macOS testing and independent Linux x64 verification of the real daemon lifecycle, concurrent admission and child V8 limits; Windows runtime verification was not performed.

The sources are explicit about what remains unproven. Fixed old-space enforcement bounds the granted V8 old-space ceiling, not total RSS, native allocations or MCP descendant processes. PR #12353 adds no new real-model calibration, GC/latency acceptance threshold, multi-hour stability result or universal deployment ceiling. PR #12008 likewise does not certify Windows/Linux process-tree behavior or real memory-pressure admission. Treat these as implementation evidence, not cross-platform certification or production sizing advice.

Relation to recovery, ACP and UHP

Session recovery asks whether persisted work is live, interrupted or terminal after history/restart ambiguity. Runtime capacity control asks a different question: when the host cannot admit another executor, which running capacity may be reclaimed or explicitly interrupted without corrupting ownership and durable state, and what resource grant is actually enforced on a newly admitted child? The two areas meet at liveness, identity and finality, but they solve different failure classes.

ACP provides the client↔agent interaction surface used by Qwen’s daemon architecture, but these admission, reclamation, selected-runtime stop and fixed child-heap semantics are Qwen host behavior, not an ACP v1 or draft-v2 protocol rule. UHP similarly does not standardize this private daemon resource policy. A UHP server or HarnessRouter adapter may front a harness that implements such controls without making them UHP semantics.

HarnessRouter stable remains v0.23.10 / 2545a54ec63151355150d0318245bcbaa7dea1db at this verification cutoff. Nothing in Qwen #12353 changes the HarnessRouter Qwen adapter or creates a fresh Qwen-specific UHP conformance result.

See UHP vs ACP, Lifecycle, Remote harness execution and Qwen Code for the surrounding external boundaries.

Practical review checklist

When reviewing runtime-capacity behavior in an agent host, verify:

1. One admission authority: all managed-runtime starts reserve against the same limit.
2. Reservations count until release: failed, pending and terminating starts cannot transiently oversubscribe the host.
3. Automatic victims are provably safe: loaded sessions, active clients and pending work protect a runtime from silent reclamation.
4. Interruption is explicit: occupied-runtime eviction requires deliberate authority rather than an idle heuristic.
5. Confirmation is identity-fenced: stale previews cannot stop a replacement runtime.
6. Durable state survives runtime retirement: stopping a process is not deleting the workspace or conversation.
7. Partial outcomes are represented: timeout, refusal, cleanup-in-progress and confirmed release are not collapsed into one boolean.
8. Release evidence is scoped: root exit, registry release and descendant-tree cleanup are distinguished by platform.
9. No blind stop retry: uncertain teardown does not trigger an automatic second destructive action.
10. Continuation is revalidated: a preserved draft runs only if its context is still valid and fresh admission succeeds.
11. Resource claims match the mechanism: process-count admission and fixed V8 old-space enforcement are not described as live RSS enforcement.
12. Heap enforcement is explicit and fail-closed: conflicting percentage flags or unsupported wiring cannot silently weaken the fixed ceiling.
13. Rollback semantics are operationally clear: reverting enforce requires a restart into a supported mode; no automatic fallback is inferred.
14. Protocol boundaries remain honest: internal host capacity policy is not relabeled as ACP, UHP, MCP or A2A semantics.

Primary sources

• Qwen Code PR #12353 — opt-in fixed ACP child heap enforcement
• Qwen merge commit 5feb7a4f
• Qwen Code PR #12265 — ACP child heap calibration evidence
• Qwen Code PR #12008 — user-directed ACP runtime stop when capacity is full
• Qwen merge commit b944f994
• Qwen Code PR #11911 — budget-based ACP child admission
• Qwen Code PR #11940 — reclaim idle ACP children when admission is full
• Qwen Code PR #11916 — ACP control-plane / harness boundary
• Qwen Code v0.24.4
• Qwen Code v0.24.4 tag 9674d6ef
• HarnessRouter v0.23.10