DEV Community

Robin
Robin

Posted on

"Lease Disposable Workspaces Without Letting Crashes Defeat Garbage Collection"

#distributed #architecture #cloud #testing

A creator can crash after allocating a workspace but before recording its ID. A collector can crash after requesting deletion but before saving success. Disposable infrastructure needs a convergent protocol: leases expire, stale owners lose authority, and garbage collection remains safe to repeat.

Model the workspace record independently from the provider resource:

{
  "workspace_id": "ws_01",
  "provider_ref": "opaque-ref",
  "owner": "trial-17",
  "lease_until": "replace-with-server-time",
  "fence": 8,
  "state": "ACTIVE",
  "cleanup_attempt": 0,
  "last_event_seq": 31
}
Enter fullscreen mode Exit fullscreen mode

Lease invariants

  1. At most one unexpired owner may mutate a workspace under the current fence.
  2. Renewal compares-and-swaps both fence and prior lease deadline.
  3. A worker with an old fence cannot build, preview, renew, or cancel deletion.
  4. Expiry makes the resource collectible; it does not itself prove deletion.
  5. Deletion is idempotent, monotonic, and eventually reconciled against provider inventory.
  6. No database row may be forgotten while its provider reference can still exist. 
ALLOCATING -> ACTIVE -> EXPIRING -> DELETING -> DELETED
     |          |           |           |
     +-------> ORPHANED <----+-------> RETRYABLE
Enter fullscreen mode Exit fullscreen mode

The allocator first persists an intent with a unique request key, then allocates, then attaches the provider reference. A reconciler searches both incomplete intents and provider resources carrying the request label. The collector claims an expired record by incrementing its fence, checks for active child operations, revokes previews/temporary identities, requests deletion, and later confirms absence.

Crash permutation Recovery requirement
before allocation intent expires with no provider resource
after allocation, before attach label-based reconciliation finds orphan
after attach, before ACTIVE reconciler completes or deletes
during renewal exactly one fence wins
after expiry, before GC claim old owner is rejected
after delete request, before save repeat request; reconcile absence
provider says not found verify identity, then mark deleted
late ACTIVE event after delete sequence/fence rejects resurrection

A property test can permute these events with duplicate and delayed delivery. Assert that no stale fence mutates, no deleted state returns to active, each provider resource has a durable record or discoverable intent, and every expired nonrenewed resource eventually reaches confirmed deletion under a fair collector. Store random seeds and minimal counterexamples. This is an unexecuted model, not observed reliability evidence.

Success is a normal lease, bounded work, explicit release, child cleanup, deletion confirmation, and tombstone retention long enough to reject late messages. Failure is any unknown provider reference, non-idempotent delete, renewal after fencing, or inventory disagreement. Freeze new allocation when reconciliation lag exceeds its limit; preserve IDs/events, revoke authority, and run the collector rather than manually erasing rows.

Limitations: eventual consistency can make absence ambiguous; provider labels may be weak; clock skew requires server-side time; partitions can delay both renewal and collection; and garbage collection cannot repair leaked resources it cannot enumerate. Choose retention, retry, and escalation bounds from current service behavior, not placeholders.

Use a real hosted lifecycle carefully

Current official information describes MonkeyCode’s overseas hosted option as “Free to start,” with integrated models and managed server-side cloud development environments supporting build, test, and preview. Those resources motivate lease discipline but do not imply every model or server is free. Availability, cloud quotas, regions, duration, future pricing, and terms may evolve; resolve them in the current console before choosing lease bounds.

A disposable protocol experiment may enter through this official campaign route: https://ly.cyberserval.tech/iIETXiF

Release ownership, revoke child capabilities, delete previews, submit idempotent workspace deletion, and retain a tombstone until late events are harmless. Inventory disagreement freezes allocation and activates reconciliation rather than a second trial.

Disclosure: This article promotes MonkeyCode using an official campaign link. I’m a MonkeyCode user, not affiliated with the project, and I receive no commission from this link.

AI assistance disclosure: This article was drafted with AI assistance and reviewed against the cited project materials.

Top comments (0)