Cloud Development Environment Platform · View 13 of 21 · Runtime
Decisions
- The connection itself triggers the resume. The gateway authorises, asks the control plane once, then holds the client with progress while the host agent restores (ADR-09).
- Blocks are fetched lazily: the workspace is usable after the memory image and the block map, with the remainder streaming in the background, so resume latency does not scale with disk size (ADR-02).
- Clock, network topology and brokered credentials are all refreshed on resume, because a restored memory image is a machine that believes it is still yesterday.
Assumptions
- Resume p95 ≤ 2.5 s with memory state; placement decision p99 ≤ 150 ms; snapshot restore ≥ 1.2 GB/s per host.
- Credentials are re-brokered on every resume rather than restored from the image.
Risks
- Message 16 — the lost interval since the last snapshot — is the honest consequence of a 5-minute RPO. Suppressing it would be the single worst change anyone could make to this design.
- A snapshot-store stall converts every resume into a retryable error; the failure must never present an empty filesystem as a successful resume.
