The run owns /workspace. A sandbox is replaceable compute that can be recreated without discarding the run’s files.

Continuity model

durable run + durable workspace + immutable deployment + replaceable sandbox

After a successful turn

Before a response is marked completed, Salambo:
  1. Captures the mutable workspace.
  2. Saves it through a run-scoped transfer capability.
  3. Verifies that the recovery point is ready.
  4. Makes that recovery point authoritative for the run.
If the required checkpoint fails, the response fails instead of claiming that the turn and workspace are durable.

Missing sandbox recovery

When a run’s sandbox no longer exists:
  1. Salambo resolves the applied deployment.
  2. It creates a replacement sandbox.
  3. It restores the latest ready checkpoint.
  4. It validates the runtime and workspace.
  5. It resumes execution on the same run.

Deployment upgrades

With workspaceUpgradePolicy: automatic, an existing run moves lazily before its next turn. The old sandbox remains authoritative until the switch commits. Failed provisioning or restore leaves the old runtime available for a safe retry.

Retention

Salambo currently retains the latest ready checkpoint for recovery. This is continuity infrastructure, not a user-facing checkpoint history or point-in-time restore product.

What is checkpointed

DataIncluded
/workspaceYes
Deployment skills and agent sourceNo; restored from the immutable deployment
Temporary and platform runtime dataNo
Credentials and control tokensNo