TASK GRID
—
LEASE HANDOVERS (FENCED)
0
FENCE ADVANCED
—
e0→e0
a second worker took the lease over; every write from the
worker that died is now rejected on sight — lease_epoch is the fencing token
IDEMPOTENCY KEY
—
IDENTICAL
minted by the worker that died, recovered from the receipt and
re-sent by the worker that took over — not regenerated. The provider recognised
it and replayed the original refund instead of creating a second one.
sshard aattempt elease_epoch
EXTERNAL PROVIDER LEDGER
separate database · no shared transaction · the only source of truth about the real worldREAL PROVIDER · STRIPE
test mode · moves no real money · the same crash, at the same instant · check it without a Stripe account at /stripe-receipt
REPLAYS > 0 means the provider was asked twice under one key and
acted once. That row is the crash actually happening, not a claim that it cannot.
MEMORY DECIDES
same task · same receipt · same fence · same policy · same amount
Memory is allowed to override the default in one direction only —
toward escalation. Recalled evidence can stop an act; it can never talk the
system into one.
FOUR MEMORY CLASSES — THEY DO NOT HAVE EQUAL AUTHORITY
vector memory tells the agent what it could do; transactional execution state decides what it may do
EPISODICADVISES
what happened the last time an agent stood at this exact state and transition
SEMANTICADVISES
what is generally true of this exception kind — recalled by vector similarity
PROCEDURALAUTHORIZES
the pinned policy version that permits the act, or stops it and asks a human
EXECUTIONCONSTRAINS
receipt · lease · fence — committed with the state change, in one transaction
MEMORY STORE
APPROVALS INBOX
execution is blocked at AWAITING_APPROVAL until a human decidesBEYOND REFUNDS
authority is denominated in the action's own units
A measurement in a unit the policy does not grant is a REFUSAL, not a
warning: a refund policy shown comms.recipients has no opinion about email,
and no opinion must never read as yes.
Crash windows
Every instant at which this system can die, and the defined outcome of dying there. The guarantee is effectively-once via idempotency receipts — never exactly-once execution, which is not obtainable against a remote provider.
claimtask leaves READY under a lease and a fencing token
W1no receipt exists — no effect is possible
prepare()COMMITtask is now ACTION_PREPARED
W2receipt is durable — nothing has been sent yet
provider.create_refund(idempotency_key=…)
W3in flight — outcome unknown to us
the provider mutates its ledgerTHE IRREVERSIBLE INSTANT
W4the effect is real and we have not recorded it — the only window this demo needs
settle()COMMITreceipt settled + outcome memory written, one transaction
W5, W6 and W7 are concurrency and identity windows rather than points on this line.