Make Sandbox Epoch a Fencing Token Before Free Compute Vanishes Mid-Write
Here is the event order I use as a paper counterexample when someone treats a free sandbox as durable storage. The planner sends apply_patch , the sandbox answers 200 , and the saga steps forward as if the write were fenced. Then the replica is reclaimed, a retry lands on cold disk, and the file is gone. Did the tool succeed? The HTTP log says yes. The filesystem says no. Would you let the…
When a sandbox is used as a transient repository, it can vanish without warning. In a scenario where a planner sends an apply_patch request, receives a 200 response, and assumes the write is fenced, the replica might be reclaimed, leading to data loss. This highlights the need for a fencing token to ensure data integrity. The common sketch approach, which treats a 200 response as sufficient, fails when the sandbox goes away.
The planner must only commit a step after verifying the write receipt joins a live sandbox epoch, which serves as the fencing token. If the epoch has changed, the system should reject or compensate for the operation. The planner should be the only component committing saga state, and mutating tools require a fenced write. The system's data flow is narrow, with the planner minting a step ID, the sandbox returning the epoch and receipt, and the planner committing only when the values match.
Failure domains include planner crashes, network issues, sandbox preemption, and model loops. The sequence diagram illustrates a late 200 response from a preempted sandbox, causing the planner to reject the operation and restart the process. To test the protocol, a minimal simulator can be built to verify the workflow, starting with minting a step ID, acquiring an epoch, sending the epoch with the write, and checking for stale epochs in heartbeats.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
