Durable workspaces

The run owns /workspace. A sandbox is replaceable compute that can be recreated without discarding the run's files.

Continuity model

durable run + durable workspace + immutable deployment + replaceable sandbox

After a successful turn

Before a turn is marked completed, Salambo:

1. Captures the mutable workspace.
2. Saves it through a run-scoped transfer capability.
3. Verifies that the recovery point is ready.
4. Makes that recovery point authoritative for the run.

If the required checkpoint fails, the turn fails instead of claiming that its output and workspace are durable.

Missing sandbox recovery

When a run's sandbox no longer exists:

1. Salambo resolves the applied deployment.
2. It creates a replacement sandbox.
3. It restores the latest ready checkpoint.
4. It validates the runtime and workspace.
5. It resumes execution on the same run.

Deployment upgrades

With workspaceUpgradePolicy: automatic, an existing run moves lazily before its next turn.

The old sandbox remains authoritative until the switch commits. Failed provisioning or restore leaves the old runtime available for a safe retry.

Retention

Salambo currently retains the latest ready checkpoint for recovery. This is continuity infrastructure, not a user-facing checkpoint history or point-in-time restore product.

What is checkpointed