Make Sandbox Epoch: Use Fencing Tokens Before Free Compute Fails
An architectural review on why HTTP 200 isn't enough when free sandboxes vanish mid-write and how fencing tokens prevent lost updates.
Stock photo for illustration only, not from the actual event
- Free sandboxes carry a high risk of being reclaimed or vanishing mid-write.
- Treating an HTTP 200 as a durable write receipt can lead to silent data loss.
- Planners must join write receipts with a live sandbox epoch as a fencing token.
- Injecting specific failure classes is critical before deploying remote replicas.
Here is the event order used as a paper counterexample when someone treats a free sandbox as durable storage. The planner sends apply_patch, the sandbox answers 200, and the saga steps forward as if the write were fenced. Then the replica is reclaimed, a retry lands on a cold disk, and the file is gone. Did the tool succeed? The HTTP log says yes. The filesystem says no.
Would you let the planner commit that step? I would not, not on a replica that can vanish without a fencing token. Free compute is useful, but it is a preemptable replica, not a disk you own. This article serves as an architecture review of that constraint, rather than a production war story or a benchmark.
Stock photo for illustration only, not from the actual event
The common sketch stores tool_status = success as soon as the sandbox returns a 200. That sketch assumes the replica that accepted the write is the replica that will still exist on the next tick. Free servers break that assumption in the most ordinary way: they go away.
From a distributed systems perspective, trusting an HTTP 200 response from uncommitted or preemptable infrastructure introduces severe race conditions. Implementing an epoch or fencing token ensures that stale execution contexts cannot overwrite or commit transactions on revived instances, maintaining strict transactional integrity.
This invariant requires that data flow remains narrow: the planner mints a step ID, the sandbox returns an epoch and receipt, and commits only occur upon a strict join of those values.
The core invariant states that a planner must not commit a mutating tool step until a write receipt joins a live sandbox epoch, and that epoch remains the fencing token for the replica. If the epoch has moved, the system must reject or compensate. Replaying without a new fence is how duplicate writes are minted.
"Are you measuring liveness of the replica, or are you hoping the next tool call will notice the disk is empty? Hope is not a fence."
Robin
The system splits into four domains because they fail independently, and mixing them hides counterexamples. The interesting collision involves replica preemption plus a late 200 response. The planner sees success from a generation that no longer exists, resulting in a lost update behind a green dashboard.
Source: Dev.to
Found something wrong in this article? Report an issue with this article
Comments
Leave a Comment