sandbox §13.1–13.2: what a park retains, and what an interval proves about waiting #582

Merged

dcharlot merged 2 commits from sandbox/transcript-continuation into main 2026-11-02 18:42:36 -05:00

Conversation 0 Commits 2 Files changed 8 +908 -57

2026-11-02

Transaction Science

sandbox §13.2: what an executed interval proves about waiting ...

§13 prices the wait a run spends parked. It says nothing about the wait a run
spends *running*, which is usually the larger number. An interval that dispatches
an outward call and then sits until the result arrives holds its sandbox, and its
receipt charges the sitting as computation. A twenty-minute build, a review that
comes back the next morning, an approval that never comes — each is, in a
blocking runtime, an interval whose receipt is mostly waiting. Two runs doing
identical work bill hours apart, and the record reported both the same way.

So an executed segment may now carry a `CallAccount`: the calls it dispatched
and the results it resolved, each by call id.

A run is **non-blocking** when every executed interval accounts, and every
interval resolves only calls that were outstanding before it began. An interval
that resolves a call it dispatched itself did not hand off and return — it
waited, and the wait is inside its receipt. `RunRecord::wait_proof()` walks the
segments in order holding the outstanding set and returns one of:

- `NonBlocking` — no receipt in the run contains a wait for an outward call, so
  the run's whole cost of waiting is the idle energy §13 already records, and
  which §13.1 makes small for a transcript park. This is the condition under
  which "waiting costs no computation" is a statement about the record rather
  than about the runtime that produced it.
- `Blocked { segment }` — that interval consumed its own dispatch.
- `Malformed { segment }` — the account does not add up: a result answering a
  call never dispatched, a call resolved twice, or one id dispatched twice. A
  record that cannot be read is a different problem from a run that waited, and
  is reported separately.
- `Unproved` — some interval did not account, or the run has no accounted
  interval at all.

Two deliberate pieces of honesty

**An absent account is not an empty one.** Not accounting and accounting for no
calls are different statements, and they do not fold to the same bytes — a test
and a conformance check both hold that, so the marker is not merely a comment.

**A property of no intervals is not a property.** A run with nothing accounted
returns `Unproved`, not `NonBlocking`. Without that, every empty record would
certify the strongest claim in the section.

Backwards compatibility, checked rather than asserted

`calls` is `Option`, `serde(default, skip_serializing_if)`, and folded into the
chain only when present, so an interval recorded by `record_execution` hashes
exactly as it did before — pinned by a test against bytes written out by hand.
The committed vector confirms it: `durable.json` diffs as one added line and no
changed line, so `expect_runrecord_head` and `expect_transcript_head` are
unchanged, and the accounted trace gets its own address at
`b3:FINebhSRpv_1ncmpE3PaRG85MR8Ri1fDy4lmR1yI2DA`. That trace is the transcript
one with the account added and nothing else changed, so an implementation that
dropped the account would produce the transcript head where this one is
expected. Each id set is length-prefixed, so no id boundary is ambiguous.

Conformance class C15, and the pack's deliberate class count moves 14 → 15.

Evidence, on the build host: clippy `-D warnings` clean over the workspace, the
workspace's tests pass, and the full pack reports all 15 classes passed with no
skips. `cargo fmt` was not run: these workspaces are not rustfmt-clean.

Co-Authored-By: Claude Opus 5 <[email protected]>

48372367aa

• View at this point in history

2026-11-02 13:37:56 -05:00

Transaction Science

sandbox §13.1: a park retains host state or a transcript, and says which ...

§13 has always let a run be suspended and resumed, recording what it retained
as a filesystem root and an optional memory image. That shape assumes the
resumable state lives on the host. For a whole class of unit it does not: where
the resumable state is the record of what the unit has already done, that record
*is* the continuation — restore it and the unit is where it left off, with no
process to revive. Such a run was being made to describe itself in terms of a
filesystem it did not need.

So a snapshot reference now carries one of two forms, and exactly one.

- **An image park** retains host state: `fs_root`, and `memory` where the
  executor suspends resident state. Unchanged.
- **A transcript park** retains nothing on the host, naming only the content
  address of the run's transcript.

Neither form, both, or a transcript beside a resident memory image is refused
with `MalformedSnapshot` before anything is hashed, and leaves no segment
behind. The third case is the interesting one: a park claiming to retain nothing
on the host while holding an image on it. Admitting any of them would put an
ambiguity inside a chain whose whole purpose is to remove one.

What the second form buys, and what it does not

- **It resumes anywhere.** §13's content-identity precondition is satisfiable by
  any host that can fetch the transcript, so such a park is portable across
  hardware by construction; an image park also needs a host able to restore its
  image. The record now says not merely that a run can resume but where.
- **Its park is small, and still priced.** Nothing runs and nothing is resident,
  and it is tempting to call that free. What it holds is bytes in storage, and
  storage draws power for every hour of the wait, so a host **MUST NOT** record
  its `idle_uj` as zero on the grounds that no computation happened. The claim
  this form supports is that *waiting costs no computation*. It does not support
  the claim that waiting costs nothing, and a record that says zero for a week
  of storage is not a cheaper run, only a less honest one. §13's total stands
  for both forms.

Backwards compatibility, checked rather than asserted

`fs_root` became `Option` with `serde(default, skip_serializing_if)`, so an
image snapshot serializes to the same JSON it always did, and `push_snapshot`
emits exactly the former byte layout for that form — `fs_root ‖ (1 ‖ memory |
0) ‖ manifest`. Two things hold me to it:

- a unit test pins the image layout against bytes written out by hand, so it is
  checked without reference to the code that produced it;
- the committed vector's image-form head is unchanged. `durable.json` diffs as
  one added line and no changed line: `expect_runrecord_head` is still
  `b3:mk3hGn1kCXPuMQNPGQxHsqu8TxsnGVPBTBcgcxrHYlA`, and the transcript form
  gets its own pinned address at `b3:XKKBf5hYdrSZoJN-GHLdZ_Bbg7CjN6P4DCRVD17GyUs`.
  The two traces are identical but for the form parked, so an implementation
  that confused them would produce one address where the other is expected.

Hashing is now total rather than partial: `Segment::chain_bytes` returns
`Option`, `fold` returns `Result`, and a malformed reference edited into a
record through the wire form makes `verify()` false instead of hashing to
something. One latent bug went with it — `resume` used to add to the run's idle
total before folding the segment, so a refused resume left energy attributed to
a park that was never recorded. It now folds first.

Conformance class C14, and the pack's deliberate class count moves 13 → 14.

Evidence, all on the build host (nothing built on the dev Mac): clippy
`-D warnings` clean over the workspace, the workspace's tests pass, and the full
pack reports all 14 classes passed with no skips. `check-comparative-prose.sh`
and `check-no-vanity-metrics.sh` are clean.

Co-Authored-By: Claude Opus 5 <[email protected]>

15b79aba7b

• View at this point in history

2026-11-02 13:17:32 -05:00