FUURAA AI Civilization Architecture · Operating-layer engineering dossier
Execution fencing: reject stale actors after control changes
A timeout, lease expiry or failover does not erase a delayed worker. A paused process can resume, a partitioned actor can reconnect, and an old queue item can arrive after a newer owner has taken control. Safe handoff assigns each ownership epoch a monotonic generation and makes every consequential receiver compare it before accepting an effect.
Public statusResearch direction · architecture referenceEvidence statusFUURAA method synthesis grounded in primary standardsSources checked19 August 2026
Core decision
When execution moves to a newer owner, can every effect receiver reject work from the superseded one?
Use this sequence for architecture review, threat modelling and test planning. It is not a universal compliance checklist and cannot replace system-specific engineering validation.
01
Define the fenced subject and effect scope
Identify the resource, operation family, effect receivers and ownership transition whose stale work must be rejected.
02
Issue a monotonic execution generation
Create a non-repeating generation or sequencer when ownership changes and bind it to the authority that issued the transition.
03
Bind every command and retry
Carry the resource, operation identity, owner and generation through queues, retries, tool calls and delegated branches.
04
Enforce the fence at every effect receiver
Compare the incoming generation with durable receiver state immediately before effect; reject older or incomparable work without mutation.
05
Close the transition and reconcile ambiguity
Record old-owner refusal, new-owner readiness, accepted effects, delayed messages and any outcome that remains unknown.
FUURAA analysisA lease tells a worker when it may act; a fence lets the receiver prove when it must not. Expiry enforced only by the old worker is a promise made by the very actor that may be paused, partitioned or stale. FUURAA therefore treats monotonic generation as receiver-side evidence: it must travel with the command, survive retries and delegation, be compared against durable state, and fail closed when ordering cannot be established.
Minimum interface contracts
Put consequential semantics in inspectable interfaces instead of relying on assumptions between systems.
Field names are public engineering references, not a normative protocol. Implementations may use other structures, but should expose every lost, defaulted or downgraded semantic.
01
Ownership-generation contract
Must be intelligible to sender, receiver and independent reviewer.
Minimum fields
fenced resource, operation family and consequence class
owner, monotonic generation, issuer and issued time
parent generation, supersession reason and transition authority
Evidence gate
Every new owner receives a unique, ordered generation whose issuer and superseded predecessor are inspectable.
Stop condition
If the contract is unresolved, expired or silently downgraded, block consequential action and route to review.
02
Receiver-fence contract
Must be intelligible to sender, receiver and independent reviewer.
Minimum fields
incoming generation and durable highest accepted generation
comparison result, resource precondition and operation identity
accept or reject decision, refusal code and evidence reference
Evidence gate
No consequential receiver mutates state unless it can compare the generation and prove the command is not stale.
Stop condition
If the contract is unresolved, expired or silently downgraded, block consequential action and route to review.
03
Transition-closure contract
Must be intelligible to sender, receiver and independent reviewer.
Minimum fields
old-owner stop or refusal evidence and outstanding-work inventory
new-owner readiness, current state and first accepted generation
ambiguous effects, reconciliation owner and review trigger
Evidence gate
The handoff remains open while an unfenced receiver, unclassified delayed command or unknown effect can still alter the outcome.
Stop condition
If the contract is unresolved, expired or silently downgraded, block consequential action and route to review.
Failures to seek deliberately
Verify that boundaries really deny, stop and preserve evidence.
Nominal success cannot establish an effective boundary. Tests should manipulate identity, time, version, network, policy and partial failure while retaining raw outcomes.
T1
Paused worker resumes after losing ownership
Pause the old worker, transfer ownership, then resume it and require every consequential receiver to reject its older generation.
T2
Partition creates two apparent owners
Let both sides believe they own the task and require only the commands carrying the receiver-recognised highest generation to create effects.
T3
Delayed queue item crosses the handoff
Deliver an old-generation queue item after the new owner has acted and require an attributable stale-command refusal with no duplicate effect.
T4
Receiver loses its high-water mark
Reset or restore a receiver without its durable highest generation and require fail-closed recovery before consequential commands resume.
Minimum engineering evidence package
Let the next owner reproduce the decision, open artefacts and see remaining unknowns.
A complete package only makes evidence relationships reviewable; it does not prove artefacts authentic, controls effective, the system safe or the decision correct.
This public research reference is not a FUURAA lock service, consensus protocol, scheduler, production feature, payment or booking safeguard, legal transfer of authority, safety certification or compliance control. A generation number cannot prove issuer legitimacy, receiver durability, business correctness or physical safety; consequential systems require domain-specific consistency, storage, recovery, threat modelling, failure testing and accountable approval.
Primary sources and evidence boundaries
Use standards language without presenting citations as implementation evidence.
Every source states publication timing, its role in this dossier and its non-transfer boundary; living source pages were checked 19 August 2026.
