A cartridge that is busy with a long request keeps answering the host’s heartbeat. The reply
used to wait on the same threads the request was running on, so a cartridge in the middle of
correct work — rendering a long document, hashing a large download — was declared
CARTRIDGE_UNHEALTHY after about forty seconds and its work was lost. A heartbeat now says the
cartridge’s process is alive and reading its input; whether a request is progressing is still
what the request’s own activity timeout says.
The proved model
Every function the libraries take from the proved model now has a stated claim and the theorem
that proves it: 58 functions, covering cap matching and ranking, routing, queries, execution and
the bifaci protocol’s laws.
Each library’s formal package carries an assurance.json listing those claims, the
specifications they are about and what they assume. It can be read from the library, and it
agrees with tagged-urn’s document on every record the two share.