{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp09_archetype_breadth150_20260804","cell_id":"failover__computer_science","arm":"BREADTH_PROBE_ONE_SHOT","candidate_id":"failover__computer_science__P1","proposal_index":1,"version":0,"title":"Epoch-Fenced Shadow Kernel Takeover for Stateful Computational Notebooks","problem":"A long-running computational notebook depends on one live kernel that holds variables, imported modules, random-generator state, open computational resources, and cell-execution history. If that kernel process or its host fails, the notebook document remains visible but its executable state disappears; rebuilding by rerunning cells may be slow, nondeterministic, or unsafe when cells have external side effects.","actors":["Notebook user","Notebook session orchestrator","Primary notebook kernel","Prepared shadow kernel","Workspace administrator"],"observable_state":"The primary kernel misses a configured sequence of health checks or its host reports terminal loss, while the shadow kernel remains reachable, has a recent state checkpoint, matches the primary's recorded execution epoch, and reports sufficient capacity. The orchestrator can also observe the status and side-effect classification of the cell that was in flight.","consequence":"The user cannot reliably continue computation from the notebook's displayed state; recovery may require a complete replay, lose expensive intermediate results, or duplicate external writes if an uncertain in-flight cell is rerun.","affected_objective":"Preserve continuity and state integrity for an interactive notebook session after loss of its primary kernel, with bounded interruption and no ambiguous execution authority.","intervention":"Run an opt-in warm shadow kernel on a separate host failure domain. Synchronize serializable kernel state and an execution ledger after each committed cell. When auditable health checks declare the primary unavailable, fence its execution epoch, activate the shadow as the sole authoritative kernel, and apply an explicit in-flight policy: retry only cells classified as replay-safe, otherwise pause for user reconciliation. Do not fail back until states and effect records have been reconciled.","structural_mapping":[{"archetype_element":"Protected function","domain_realization":"Execution of notebook cells against the session's accumulated computational state."},{"archetype_element":"Vulnerable primary path","domain_realization":"The primary notebook kernel and its host."},{"archetype_element":"Prepared alternate path or capacity","domain_realization":"A warm shadow kernel on an independently scheduled host with compatible runtime and synchronized checkpoints."},{"archetype_element":"Observability and health check","domain_realization":"Kernel heartbeats, host-loss signals, checkpoint age, state-hash comparison, and shadow-capacity checks."},{"archetype_element":"Switching rule","domain_realization":"Promote only after the primary crosses the failure threshold and the shadow satisfies freshness, compatibility, and capacity gates."},{"archetype_element":"State synchronization","domain_realization":"Committed-cell checkpoints plus an ordered execution and external-effect ledger copied to the shadow."},{"archetype_element":"Unambiguous ownership","domain_realization":"A monotonically increasing execution epoch fences the former primary; clients accept outputs only from the current epoch."},{"archetype_element":"Safe handling of in-flight work","domain_realization":"Replay-safe cells may be retried from the last commit; cells with possible external effects remain unresolved until the user reviews them."},{"archetype_element":"Recovery policy and controlled reentry","domain_realization":"The recovered kernel can rejoin only as a non-authoritative shadow after state and ledger reconciliation; automatic immediate failback is prohibited."}],"mechanism_mapping":[{"mechanism_slug":"health_check","role":"Makes primary failure and alternate readiness observable using independent signals and explicit thresholds.","counterfactual_removal":"Without it, takeover would be delayed indefinitely or triggered by transient latency, increasing outage or false-failover risk."},{"mechanism_slug":"state_synchronization","role":"Keeps the shadow's committed notebook state and execution context sufficiently current for takeover.","counterfactual_removal":"Without it, the alternate would be merely spare compute capacity and could not continue the existing session safely."},{"mechanism_slug":"standby_activation","role":"Promotes the prepared shadow from passive synchronization to authoritative cell execution after the switching rule fires.","counterfactual_removal":"Without activation, redundancy would exist but the protected function would remain interrupted."},{"mechanism_slug":"controlled_reentry","role":"Prevents the recovered primary from resuming authority until its state is reconciled and it is assigned a non-primary epoch.","counterfactual_removal":"Without controlled reentry, two kernels could accept cells or later overwrite divergent session state."}],"causal_chain":["A notebook session concentrates executable state and execution authority in one primary kernel.","A shadow kernel in a separate host failure domain receives committed state and execution-ledger updates before failure.","Health checks make terminal primary loss distinguishable from acceptable transient delay according to a configured threshold.","The orchestrator increments the session epoch, rejects outputs from older epochs, and activates the ready shadow.","The shadow resumes from the latest verified commit while the in-flight policy either safely retries or exposes uncertain work for reconciliation.","The user continues the session with one authoritative kernel and an auditable recovery boundary.","Any recovered primary is reconciled and admitted only as a shadow, avoiding split-brain and failback corruption."],"baseline":"On kernel loss, mark the session dead, start a fresh kernel, and ask the user to rerun notebook cells or restore a periodic checkpoint manually. This restores computation only after reconstruction and leaves the user to reason about nondeterminism and external side effects.","nearest_rivals":["Periodic checkpoint-and-restart, which reconstructs a kernel after failure rather than activating an already prepared alternate.","Ordinary notebook-server replication or load balancing, which keeps front-end capacity available but does not transfer the state and sole execution authority of one live kernel session.","Full notebook replay from the first cell, which recomputes state but can be slow and can repeat nondeterministic or externally visible actions.","Manual migration to another kernel, which depends on operator intervention and lacks a predefined health trigger, fencing rule, and in-flight-work policy."],"remaining_contrastive_claim":"The candidate's distinguishing claim is structural: continuity comes from promoting a state-synchronized warm kernel under an epoch-fenced ownership transfer, with cell-level treatment of uncertain in-flight effects. Merely restarting, replaying, replicating front ends, or provisioning spare compute does not perform that prepared transfer of the existing session's state and authority.","authority_safety":{"decision_authority":"The notebook owner or workspace administrator must opt the session into shadowing and set its recovery policy; the session orchestrator may execute only the predefined promotion and fencing rules.","authorized_first_step":"Build and exercise an isolated prototype using synthetic notebooks and disposable local services; it may inject primary-process failure and promote a shadow only inside the test environment.","excluded_actions":["Do not enable automatic promotion for production notebooks.","Do not replay cells classified as having external side effects without explicit user approval.","Do not promote a shadow whose checkpoint age, runtime compatibility, state hash, or capacity violates the configured gate.","Do not allow the old and new kernel epochs to accept concurrent cell submissions.","Do not automatically fail back or overwrite either divergent state copy.","Do not represent open sockets, device handles, credentials, or other unserializable resources as safely transferred."],"halt_rollback":"Halt promotion if fencing cannot be confirmed, state hashes diverge, the shadow misses readiness checks, or the in-flight cell's effect status is unknown. Keep both state copies read-only, preserve the execution ledger, and return control to manual recovery. In the prototype, rollback means terminating the promoted shadow and restoring the pre-test snapshot."},"negative_tests":{"strongest_counterevidence":"Injected primary loss repeatedly yields a shadow that is reachable but cannot reproduce the last committed observable notebook state, or the fencing mechanism permits an old-epoch output or side effect to be accepted.","problem_falsifier":"Representative kernel-loss incidents can already be recovered within the tolerated interruption window by ordinary restart or checkpoint restore, without material loss of intermediate state, unsafe replay, or user reconstruction effort.","intervention_falsifier":"Under fault injection, the shadow fails any prespecified invariant: single execution authority, equality of committed serializable state, explicit disposition of the in-flight cell, bounded checkpoint age, or noncorrupt reentry of the recovered primary.","risks":["False failover caused by transient heartbeat loss","Split-brain execution if epoch fencing is incomplete","Stale or partially serialized shadow state","Duplicate external effects from retrying an uncertain cell","Loss of unserializable resources such as sockets or accelerator contexts","Shadow capacity exhaustion on memory-intensive notebooks","Shared failure of both kernels through common storage, credentials, or control plane","Synchronization overhead that degrades interactive execution","Exposure of sensitive in-memory state through the additional replica","Failover loops or corrupt failback after unstable recovery"]},"next_evidence_step":"In a disposable single-user harness, run one synthetic notebook containing deterministic state updates, a seeded random computation, a long-running replay-safe cell, and a mocked non-idempotent external write. Maintain a warm shadow on a separate process, kill the primary at four predefined execution points, and record whether promotion preserves the last committed state hash, rejects old-epoch outputs, retries only the replay-safe cell, leaves the external write explicitly unresolved, and admits the recovered primary only as a shadow. Stop after the four fault cases; any invariant violation rejects the intervention configuration rather than expanding the trial.","prior_art_status":"UNSEARCHED","diversity_from_prior_proposals":"No comparison with prior proposals was made because runtime isolation forbids inspecting them; this candidate was generated solely from the supplied failover archetype and computer-science domain card.","revision_record":{"parent_version":null,"progress_targets_addressed":["Initial one-shot candidate only"],"conceptual_changes":[],"operational_changes":[],"evidence_changes":[],"claim_changes":[]}}