# Durable run records

Agent work is no longer minutes long. The valuable runs span hours or days,
outlive the machine that started them, pause for review, and resume elsewhere.
Most platforms make the *process* the unit of survival and keep it alive in a
cloud sandbox. This standard takes the stronger position: **the record is the
run**. An execution is a chain of sealed segments; the sandbox that hosted any
one segment is disposable, and what survives — what can be suspended for a
week, restored on different hardware, and handed to an auditor afterwards — is
the run record.

## The record

A **run record** is an append-only, hash-chained sequence of **segments**
belonging to one unit under one grant set. The genesis head binds both:

```
head₀ = BLAKE3("sandbox.runrecord/1" ‖ unit_id ‖ grants_id)
headₙ = BLAKE3(headₙ₋₁ ‖ segmentₙ)
```

Two records can never be spliced — not across units, and not across grant
sets. A continuation that wants different grants is a **new run**.

Three segment kinds:

- **Executed** — one active interval, recorded by the content address of its
  attestation (§7), which already binds the interval's energy receipt (§6),
  replay-journal root (§8) and outcome. Nothing is re-stated; the record
  points at sealed objects.
- **Suspended** — the run parked. Records a **snapshot reference**: the
  content addresses of the retained filesystem root, the memory image if the
  executor retains resident state (S5 snapshots), and the environment
  manifest the run was created from.
- **Resumed** — the run un-parked. Records the snapshot reference restored
  and the **idle energy** the retained state drew while parked.

## Resumption preconditions

A host **MUST** refuse to resume unless:

1. the offered snapshot is content-identical (by address) to the one recorded
   at suspension — a forked or tampered snapshot breaks the chain rather than
   silently continuing it;
2. the resuming environment satisfies the recorded manifest address — "same
   toolchain" is checked by hash, not by trust;
3. the record verifies from genesis: head recomputation, strict
   execute/suspend/resume phase alternation, and snapshot identity at every
   resume.

A record may be **closed** at any point, including while parked — abandonment
is an honest outcome and leaves an auditable stub.

## Energy honesty across suspends

A parked run is not free. Retained volumes, snapshot storage and warm-pool
residency draw power continuously. Each *Resumed* segment carries `idle_uj` —
the microjoules attributed to the retained state for the parked interval,
under the same provenance discipline as live metering (§6.2): measured where
the host can measure, estimated and labelled where it cannot. The total cost
of a run is the sum over its receipts **plus** its idle energy; a host that
reports only active-interval joules for a week-long run does not conform.

## Relation to the audit chain

The S7 audit chain (§7.7) orders *runs* within a steward's domain; the run
record orders *segments* within one run. They compose: each executed segment's
attestation may itself carry `audit_prev`, and a continuation attestation
SHOULD cite the run record's current head, mirroring that convention.

## Conformance

Class **C6** (§10): chain advance and verification across
execute → suspend → resume → execute; refusal of forked snapshots
(`SnapshotMismatch`); refusal of phase violations (execution while parked);
idle-energy accumulation; tamper-evidence through the wire form (a modified
recorded snapshot must fail verification); refusal of appends after close.

The reference implementation is `sandbox_attest::runrecord`.