Recovery

Pulse restores the continuation that committed. It does not replay the finished part of the Program.

When a process stops, its lease expires. Another process with the same artifact and handler digest can claim the execution and continue. A claim that loses the fence cannot commit.

An effect whose result is in the committed journal is not dispatched again. An external call can run again when the journal entry for that attempt did not commit. The callback should tolerate that.

Timers, events, and child results wake the execution after the claim. Waiting does not require a connected process, and waiting time is not billed. The checkpoint bytes still occupy storage while the execution is suspended.

Crash and resume

The container proof uses the two-effect Program. Effect a writes a 1 and commits. The execution then waits for continue. Effect b has not run.

1. Start the host and the application with PULSE_EXECUTION_ID set. Wait until the effect log contains a 1. Effect b has not run.
2. Stop both containers. The lease expires. The execution stays on the pinned artifact.
3. Start a new host and a new application with the same artifact. Do not set PULSE_EXECUTION_ID or PULSE_RESUME_EXECUTION_ID.
4. The replacement discovers the execution. Effect a is not written again. When continue is satisfied, effect b writes b 2 once. The log is a 1 followed by b 2.

A host running a different artifact does not claim that execution and does not run either effect.

Discovery is not deployment. A compatible host can find eligible work after its lease wait. Trigora does not provision that host, replace a container, or schedule a Pod. You start the replacement.