> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orcapods.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Runtime

> Inspect the sandbox workers leased to an organization.

The **Runtime** screen lists the sandbox workers leased to the active
organization. A sandbox worker is the per-session agent-worker process a
`workerMode: "sandbox"` profile boots. It binds no port and never registers with
the sidecar registry, so it is invisible to fleet-level topology, and this screen
is the only place it appears.

It reads `GET /api/worker/leases`, which is scoped to the caller's tenant and
paginated. The table lists each worker's session, runtime, substrate, lease
state, age, and worker ID. Select a row to open its detail tray.

<Note>
  The runner table that used to lead this page has been removed. It was built on
  `GET /api/topology`, which reports the fleet rather than one tenant's slice of
  it, and a tenant has no action to take on a runner. The `/api/topology`
  endpoint itself is unchanged and still serves the SDKs.
</Note>

## Lease state

Lease state is read live from the substrate, so it reflects a sandbox stopped or
deleted outside Orca. It answers what the next message to that session will do:

* **Running** serves it immediately.
* **Paused** resumes first, and the conversation survives. This is where an idle
  session normally rests, so it is not a fault.
* **Gone** launches a replacement worker, which starts without the earlier
  conversation.
* **Starting** is still booting. **Unknown** means the substrate could not be
  reached, which is not the same as gone.

State describes the substrate lease, not the worker process inside it: a
substrate keeps the sandbox up after a worker crashes so its log survives.

## Reading the page

* The **Sandbox workers** headline figure comes from the `X-Total-Count` header,
  which counts every lease this tenant holds on the runners that answered within
  the conductor's fan-out window. On a multi-runner deployment a runner that does
  not answer in time is omitted, so the total is a floor rather than a census.
  Single-runner deployments never hit that path.
* **Ready to serve**, **Runtimes**, and **Substrates** are computed from the rows
  currently on screen. When the workspace has more workers than one page holds,
  those figures are labelled `on this page` rather than presented as workspace
  totals.
* The state chips beside the table header tally the visible page for the same
  reason.
* `--` means the backend returned nothing for that value. It is not a measured
  zero.
* Session and worker IDs are truncated in the table; hover for the full value.
  Substrate worker IDs are useless without credentials for the substrate that
  issued them, which is why they are shown at all.

## Detail tray

Selecting a row opens a tray that re-reads that session through
`GET /api/sessions/{id}/worker` rather than echoing the row. The list refreshes
underneath an open tray, so a worker whose session has since ended reports **No
worker leased** instead of leaving a stale snapshot on screen.

There are no controls in the tray. A worker's lifecycle follows its session:
the session's first run launches it, and shutdown closes it. Idle pausing is
what keeps an unused worker from being billed.

## Refresh behavior

The lease list refreshes every 10 seconds, and the tray refreshes on the same
interval. This reads runner lease state, which costs one liveness check per
worker (a `docker inspect` on the docker substrate). **Refresh** forces a read
immediately.

Because workers disappear on their own when their session ends, the page clamps
to the last page that still has rows rather than leaving an empty table under a
footer offering a page that no longer exists.