# Durable workspaces

Understand checkpointing, sandbox recreation, deployment upgrades, and workspace recovery.

The run owns `/workspace`. A sandbox is replaceable compute that can be recreated without discarding the run's files.

## Continuity model

```text
durable run + durable workspace + immutable deployment + replaceable sandbox
```

## After a successful turn

Before a turn is marked completed, Salambo:

1. Captures the mutable workspace.
2. Saves it through a run-scoped transfer capability.
3. Verifies that the recovery point is ready.
4. Makes that recovery point authoritative for the run.

If the required checkpoint fails, the turn fails instead of claiming that its
output and workspace are durable.

## Missing sandbox recovery

When a run's sandbox no longer exists:

1. Salambo resolves the applied deployment.
2. It creates a replacement sandbox.
3. It restores the latest ready checkpoint.
4. It validates the runtime and workspace.
5. It resumes execution on the same run.

## Deployment upgrades

With `workspaceUpgradePolicy: automatic`, an existing run moves lazily before its next turn.

```mermaid
sequenceDiagram
  participant Client
  participant Runtime as Hosted runtime
  participant Old as Current sandbox
  participant Durable as Durable workspace
  participant New as Replacement sandbox

  Client->>Runtime: Follow-up turn
  Runtime->>Old: Save workspace
  Old->>Durable: Scoped transfer
  Runtime->>New: Create from active deployment
  Durable->>New: Restore workspace
  Runtime->>New: Validate
  Runtime->>Runtime: Commit switch
  Runtime->>New: Execute follow-up
```

The old sandbox remains authoritative until the switch commits. Failed provisioning or restore leaves the old runtime available for a safe retry.

## Retention

Salambo currently retains the latest ready checkpoint for recovery. This is continuity infrastructure, not a user-facing checkpoint history or point-in-time restore product.

## What is checkpointed

| Data                                | Included                                   |
| ----------------------------------- | ------------------------------------------ |
| `/workspace`                        | Yes                                        |
| Deployment skills and agent source  | No; restored from the immutable deployment |
| Temporary and platform runtime data | No                                         |
| Credentials and control tokens      | No                                         |