Supervision Without Blocking: An Evidence-Driven Redesign of OTP-Style Fault Tolerance for Cooperative Runtimes

arXiv:2610.34521v1 [cs.DC] 25 Oct 2026

Supervision Without Blocking: An Evidence-Driven Redesign of OTP-Style Fault Tolerance for Cooperative Runtimes Sam Uwejan

Erdogan Dogdu

M.S. in Artificial Intelligence Program Department of Computer Science Angelo State University San Angelo, TX, USA suwejan@angelo.edu

Department of Computer Science Angelo State University San Angelo, TX, USA erdogan.dogdu@angelo.edu

Abstract Actor frameworks on mainstream runtimes advertise Erlang/OTPstyle supervision, but OTP’s consistency contracts assume a synchronous, single-threaded supervisor, and ports inherit that assumption’s absence as unexamined risk. We evaluated every supervision guarantee against pinned OTP documentation and source read verbatim, against the source of three further Rust actor frameworks at fixed revisions, and against the actor-model literature, recording the evidence behind each design decision. Blind adversarial audits and the cross-framework study surfaced 24 defect classes, of which eight reduce to one root cause: reconstructing, by explicit mechanism, the atomicity a synchronous supervisor gets implicitly. We introduce a supervision runtime that closes all 24 cataloged classes through supervisor-owned completion values, per-incarnation identity, and a single lifecycle state machine, validated by 241 tests including reverted-fix reproductions. The result holds OTP’s verbatim-verified contracts while adding two properties OTP does not offer: a supervisor that remains responsive throughout group restarts, and message handlers that are never cancelled mid-execution. We delimit the forcing guarantees no cooperative runtime can honor.

I. I NTRODUCTION Fault tolerance in the Erlang/OTP tradition rests on supervision trees [1]. A supervisor process owns the lifecycle of its children and restarts them according to a declared policy. This design has migrated far beyond the BEAM virtual machine. Actor libraries for Rust, the JVM, and .NET advertise supervision as a headline feature, and production systems increasingly depend on those implementations honoring the contracts the original defines. Existing implementations inherit OTP’s semantics wholesale or partially, without evaluating which guarantees deserve keeping and which reflect accidents of the BEAM’s architecture. An OTP supervisor is a single-threaded process that blocks for the duration of each restart and termination step it performs, and its consistency contracts are silent consequences of that blocking. Frameworks on cooperative schedulers such as Tokio, an asynchronous Rust runtime [2], drop the blocking to keep their supervisors responsive. None of the implementations we examined priced what that removal costs or what it makes possible.

We took the opposite route and treated every supervision guarantee as a design decision that must earn its place on evidence. We read the governing OTP documentation and supervisor source verbatim at pinned versions. We examined the source of three further Rust actor frameworks at fixed revisions, drew on the actor-model literature, and subjected our own framework to blind adversarial audits, recording the evidence behind every decision. The audits and the crossframework study surfaced 24 defect classes and one dominant root cause. All four codebases, at the revisions we examined, had independently adopted push-based lifecycle signaling, whose losses and reorderings are the unpaid price of an asynchronous supervisor. The resulting runtime, A NON, pays that price deliberately. The supervisor holds each child’s completion as a value returned by a task set it owns. Every instance carries an identity drawn from a monotonic counter. All liveness bookkeeping collapses into one state machine with a single transition function. Teardown reproduces the documented OTP asymmetry by which a kill delivered over a link arrives trappable while a direct kill does not [3], [4]. Where the evidence favored departing from OTP, we departed. The supervisor never blocks, and a message handler, once begun, is never cancelled. The outcome closes all 24 cataloged classes, validated by 241 tests that include regression reproductions failing with the fixes reverted. The runtime holds OTP’s verbatim-verified contracts alongside two properties OTP does not offer, namely full supervisor responsiveness during group restarts and handlerturn isolation. The guarantee analysis states each kept, added, and traded property with its evidence and its price. • An evidence-driven design method. We evaluate every supervision guarantee against pinned primary sources read verbatim, the source of three competing frameworks at fixed revisions, and blind adversarial audits, and we record the evidence behind each decision, including the decisions to depart from OTP. • A supervision race taxonomy. We catalog 24 defect classes reducing to seven mechanism families with one

dominant root cause, and we document instances of two families recurring in the examined external frameworks. • An ownership-based supervision runtime. We introduce A NON, in which completions are supervisor-owned values, identity is per-incarnation, liveness is a single state machine, and termination follows a signal-first cascade, closing every cataloged class while the supervisor stays responsive. • A three-way guarantee analysis. We state which OTP contracts the runtime reproduces with verbatim-source verification, which properties it provides beyond OTP, and which forcing guarantees no cooperative runtime can honor, each with its evidence and its cost. II. R ELATED W ORK The actor model. Hewitt et al. introduced actors as general primitives of concurrent computation [5], and Agha developed the model into a semantics of isolated state, asynchronous messages, and dynamic topology [6], [7]. We claim no novelty in the actor model itself; every primitive our runtime exposes descends from this lineage. Our delta is an account of what the model’s fault-tolerance layer demands from a host scheduler. Supervision in Erlang/OTP. Armstrong framed reliability as isolation plus supervised restart [1], and the OTP supervisor behaviour implements this contract as a synchronous, singlethreaded process [8], [9]. Prior descriptions of OTP treat the supervisor’s synchronicity as an implementation detail. Our delta is to show it is load-bearing: we trace eight defect classes in ports directly to its absence. Actor frameworks outside the BEAM. Orleans reframed actors as virtual, automatically activated entities [10], and Pony co-designed its type system and runtime around capability-safe, garbage-collected actors [11], [12]. In the Rust ecosystem, actix supervises exactly one actor by polling it inline [13], ractor delegates restart policy entirely to the implementor [14], and the archived bastion attempted full supervision trees over push-based signaling [15]. Our delta is a source-level comparison of the three Rust frameworks’ lifecycle signaling at pinned revisions, showing convergence on a shape none of them chose deliberately. Studies of actor concurrency defects. Bagherzadeh et al. mined and classified real-world actor bugs across several ecosystems [16]. Their taxonomy classifies application-level defects observed in user code. Our delta is a taxonomy one level down: defects in the supervision runtime itself, derived from audits and cross-framework source examination rather than issue mining. Structured concurrency. The structured-concurrency argument holds that a task’s lifetime should be bounded by a scope its parent owns [17], a discipline Tokio exposes through owned task sets [2]. We borrow this discipline rather than invent it. Our delta is applying it to supervision bookkeeping itself: completions become values owned by the supervisor, which removes the lost-signal class by construction.

III. S TUDY M ETHOD AND R ACE TAXONOMY A. Audit Protocol The taxonomy rests on three evidence sources. Each was designed to avoid anchoring on what the framework’s documentation claims. Blind adversarial audits. Independent reviews examined the framework’s full source with a correctness-only brief and no access to its design documents. Each review was required to cite an exact file and line and a concrete failure interleaving for every reported defect. We confirmed every accepted finding by re-tracing the interleaving in the cited code before counting it. Reviews ran in independent pairs with complementary scopes, one over the whole codebase and one over the change under review, so that a defect missed by one scope could still surface in the other. Primary-source semantics verification. Every claim the design makes about OTP behavior was verified against pinned primary sources rather than secondary descriptions. The sources are the Erlang reference manual and erlang module documentation at version 28.5.0.4 [3], [4], and supervisor.erl at tag OTP-28.0 with line-anchored citations [9]. Three designcritical behaviors were confirmed verbatim this way, namely the supervisor’s unlink-and-flush discipline when terminating a child, the escalation of a shutdown timeout to a direct untrappable kill, and the re-inclusion of previously terminated children in group restarts. Cross-framework source examination. We examined three Rust actor frameworks at pinned revisions, namely ractor at commit 1af0aaad [14], actix 0.13.5 [13], and the unmaintained bastion at its final state [15]. Each examination answered fixed questions about restart synchronicity, death signaling, kill delivery, and teardown on abort, citing file and line in the examined revision. B. The Root Cause An OTP supervisor is one sequential process [8]. When a child dies, the supervisor handles the exit message to completion before it dequeues anything else, so a manual command observes either a fully processed death or none at all. The one deliberate exception proves the sensitivity of this discipline. A failed restart attempt requeues its retry through the supervisor’s own mailbox so that other requests can interleave before the retry [9], and OTP accepts the resulting window rather than block indefinitely. A supervisor on a cooperative runtime that refuses to block must interleave death processing, manual commands, and restart completions everywhere, and every piece of shared state those steps touch becomes a race surface. Of the 24 classes we cataloged, eight reduce to exactly this reconstruction burden. C. Mechanism Families The 24 classes reduce to seven families, ordered by the mechanism that fails. Stale liveness classification. A manual stop issued while the same child’s crash notification is still queued reads a stale liveness flag and reclassifies the crash as a manual stop. In the

studied framework this bypassed the restart budget for a crashlooping child. In one configuration it permanently deleted a restartable worker’s specification. Lossy completion signaling. Death and restart notifications sent over bounded channels can be dropped at capacity or deferred behind unrelated work. The studied framework’s watcher acknowledgments and restart completions both carried this exposure. Among the examined frameworks, bastion discards lifecycle send results outright on its restart path, while ractor and actix avoid this specific exposure only by making the equivalent step inline in the supervisor, at the cost of blocking it. Termination-order violations. Observers could see a child’s terminal state before its registry name was released. A restart racing that window failed on a name collision, and a caller acting on a completed termination could still be refused. Incarnation identity confusion. Fresh spawns reused a constant incarnation identity. A straggling death report from a previous instance could therefore mark its live successor dead once termination became fast enough to expose the window. Group-restart interleavings. Group restarts interleaved with solo restarts and manual stops in ways a sequential supervisor cannot express. A restart attempt failing during an unrelated group stop wedged the group permanently, and a manual termination during a group stop violated the caller’s completion contract. Teardown orphaning. A force-aborted supervisor never ran its own teardown, orphaning its subtree. The examined frameworks carried instances of the same family, namely ractor’s abort path before its 2026 lifecycle-guard fix and bastion’s task handles, which detach rather than cancel on drop. Auxiliary forwarder tasks for timers and streams also outlived their registrations or died silently on panic. Escalation capacity coupling. Stop and kill signals traveled paths that could await mailbox capacity, so the staged escalation intended to bound a shutdown could itself block without a deadline. IV. A N OWNERSHIP -BASED S UPERVISION RUNTIME The redesign replaces notification with ownership across every lifecycle mechanism. This section presents the six mechanisms and maps each to the families of Section III-C. A. A Monotone Stop Lane Each actor owns a stop lane, a single-value watch cell holding the highest-severity pending stop request. A generation counter increments on every accepted raise. Raising the lane is synchronous and infallible, severity never decreases, and the run loop observes the lane with the highest priority in its event selection. This removes the escalation capacity coupling family. No stop or kill signal can await mailbox capacity, which mirrors the OTP treatment of exit signals as a class apart from ordinary messages [3]. Signals are still delivered only at turn boundaries, so an in-flight message handler is never cancelled mid-execution. Section V develops this deliberate divergence from BEAM preemption.

B. Owned Death and Restart Completions The supervisor owns a task set of watcher tasks, perchild monitors that observe a child task’s completion, one per child incarnation. An incarnation is a monotonically numbered instance of a child identity, minted at each spawn or restart. Each watcher writes the child’s real termination reason into a per-incarnation fate cell, a write-once slot holding that instance’s terminal outcome, after the child’s task fully completes. Restart attempts run in a second supervisor-owned task set whose results are returned values, not messages. Both push-notification paths of the original design are deleted rather than hardened, which removes the lossy completion signaling family by construction. A completion the supervisor owns cannot be dropped at capacity, and an attempt abandoned for any reason resolves through the drop of its owned handle. Because the fate cell is written only after the child’s task has run all of its destructors, a recorded fate also proves the child’s registry name is free, which removes the termination-order family. C. A Single Lifecycle Ledger All per-child liveness bookkeeping collapses into one state machine, the ledger, over four states, namely running, stopping, restarting, and down. One transition function rejects every undeclared transition, and the scattered boolean flags whose staleness produced the misclassification family are deleted. Manual stops commit synchronously, with zero suspension points between recording the intent and raising the signal. Classification of the completed stop uses the fate cell’s real termination reason. A crash that races a manual termination is absorbed into it, matching the supervisor’s verbatim unlink-and-flush discipline [9]. A crash racing a restart-eligible stop is charged to the restart budget. D. Per-Incarnation Identity Every registration, fresh spawns included, draws its incarnation from one monotonic counter. Every fate, watcher, and adoption decision is keyed by the pair of child identity and incarnation, so a straggling death report from a superseded instance no longer matches its successor. This removes the identity confusion family. The BEAM enforces the analogous property at the virtual-machine level, stating that a process identifier cannot be released for reuse until everything regarding the process has been released [3]. E. A Signal-First Termination Cascade Teardown semantics follow the OTP documentation read verbatim. A direct kill is untrappable and immediate, and the runtime rewrites the dying process’s exit reason from kill to killed before it reaches the process’s links, so linked processes receive a trappable killed signal rather than the untrappable kill [4]. The redesign reproduces this asymmetry structurally. A killed supervisor does not walk its subtree. It drops its supervision state, and each child’s guard, a destructordriven handle firing when the child’s supervision state is dropped, raises kill on that child’s stop lane. A cooperative

child observes the signal at its next turn boundary and runs its own teardown one level down. A child that fails to exit within a bounded grace window is force-aborted by the persystem reaper, a single background task that aborts children exceeding their grace deadline. Escalated kills arising from an exhausted shutdown timeout take the same path, matching the supervisor source, which escalates a shutdown timeout to a direct untrappable kill [9]. This removes the teardown orphaning family, together with a guard rule that every perincarnation resource is reconstructed when a restarted instance is adopted. F. Group Restarts over the Ledger Group restart phases are expressed against the ledger rather than against ad hoc flags. A member whose restart attempt fails during an unrelated group stop is settled to the down state, from which the group’s restart chain legally revives it. A previously terminated member re-enters the chain in its original slot order, matching the supervisor source’s treatment of terminated children in group restarts [9]. A manual termination during a group stop settles the ledger synchronously, so the caller’s completion contract holds even within a single message handler. These rules remove the group interleaving family. V. G UARANTEE A NALYSIS A runtime that claims OTP-style supervision owes its users a precise account of its guarantees. We state them in three categories, namely the OTP contracts the runtime reproduces with verbatim-source verification, the properties it provides that OTP does not, and the guarantees no cooperative runtime can honor. Table I summarizes the analysis, and the text states the reasoning for every entry involving a decision. Reproduced contracts. Each entry in the first group was verified against the pinned primary source before the mechanism reproducing it was designed, and Section IV names the mechanism per contract. The termination truth contract deserves emphasis. When a termination call returns, the child is fully gone and its name is free, so a delete and same-name respawn succeed immediately, even inside the same message handler. OTP provides this contract by blocking its supervisor for the duration of the termination. The redesign provides it while the supervisor keeps processing every other event. Properties beyond OTP. OTP buys consistency within each restart attempt by blocking the supervisor for that attempt’s duration, and a failed attempt requeues its retry so that other messages can interleave before it [9]. The redesigned supervisor never blocks at all. It answers status queries and manual commands throughout group restarts, terminations, and escalations. Section III-B states the price, since eight defect classes exist only because the blocking supervisor’s implicit atomicity must be reconstructed by explicit mechanism. The taxonomy and the ledger are that reconstruction, and we report the property as a paid-for trade rather than a free improvement. The second added property is handler-turn

TABLE I OTP PROCESS AND SUPERVISION GUARANTEES RELEVANT TO CHILD LIFECYCLE MANAGEMENT, NOT AN EXHAUSTIVE ACCOUNT OF OTP SEMANTICS ; STATUS REFLECTS THE REDESIGNED RUNTIME . V ERBATIM - SOURCE ENTRIES CITE THE PINNED DOCUMENT STATING THE GUARANTEE .

Guarantee

Status

Exit signals outrank ordinary messages [3] Direct kill untrappable; linked processes receive trappable killed [4] Shutdown timeout escalates to direct kill [9] Termination call returns with the child fully gone [9] Terminated members rejoin group restarts [9] Restart intensity accounting [8]

Reproduced: stop lane at highest selection priority Reproduced structurally: cascade inversion plus signalfirst guards Reproduced on the same path as configured kills Reproduced: fate cell implies name release Reproduced in slot order

Supervisor responsive throughout group restarts Handler-turn isolation: a begun handler always completes Completion contracts held without blocking the supervisor Preemptive kill of a running handler Kill overrides a non-yielding computation Process death survives hostprocess kill

Reproduced; crash-race reclassification closed Provided beyond OTP, whose supervisor blocks per attempt Provided beyond OTP, which cancels mid-reduction Provided beyond OTP: termination truth plus responsiveness Not reproduced: turnboundary delivery by decision Not reproducible: cooperative scheduling bounds all forcing Out of scope for any inprocess runtime

isolation. The BEAM delivers an untrappable kill preemptively, without waiting for the target to reach a user-code safe point, and one examined framework imitates this by racing a cancellation against the handler’s next suspension point [14]. We decline the imitation on recorded evidence. Cancelling a handler mid-execution drops its local state at an arbitrary await point and exports a cancellation-safety obligation into every user handler. The redesign therefore guarantees the stronger per-handler property that a begun handler always completes, at the cost of kill latency bounded by one handler turn rather than one scheduling step. The forcing boundary. Erlang’s kill is guaranteed by a virtual machine the language owns. An in-process runtime on a host language owns neither the scheduler nor the process. Its strongest primitive is task abort at a yield point, a handler that never yields defeats both the signal and the abort backstop, and an operating-system kill of the host runs no teardown at all. Every stronger claim in any implementation’s documentation overstates what the substrate permits. VI. E VALUATION We ask whether the redesign closes the cataloged defect classes in the studied framework. We answer with executable evidence and state the boundary of that evidence directly.

A. Setup All evidence comes from the framework’s test suite at version 0.10.0, running on Tokio [2] under its multi-threaded scheduler. The suite comprises 241 passing tests across unit, integration, and documentation tests. Race regression tests were additionally run 10 consecutive times each to expose scheduling-dependent flakiness, and the full suite was run three consecutive times per change batch. B. Per-Family Regression Evidence Each mechanism family of Section III-C is covered by integration tests that drive the real failure path rather than asserting on types or constructors. The misclassification family is exercised by racing a genuine crash against a manual stop in both intent directions and asserting the budget charge. The signaling family is exercised by mass simultaneous deaths far exceeding any prior channel capacity, with zero lost fates. The ordering family is exercised by a same-handler terminate, delete, and same-name respawn sequence asserted inside one message dispatch. The identity family is exercised by that same sequence looped under a deliberately delayed straggler fate from the previous incarnation. The group family is exercised by the wedge interleaving, the manual-override contract, and slot-order revival of a terminated member. The orphaning family is exercised by killing supervisors midrestart across every attempt phase and asserting name release, and by cascade tests asserting that no descendant remains observably running. The escalation family is exercised by kill delivery under a mailbox saturated at its default capacity of 64 messages. two classes carry the strongest form of evidence. Their regression tests were verified to fail against the pre-fix code by temporarily reverting the fix, then re-applied and observed to pass across 10 runs. The remaining classes are closed by construction, in the sense that the mechanism they exploited no longer exists, and their tests pin the replacement behavior. C. What This Evaluation Does Not Show The evaluation demonstrates correctness properties, not performance. Throughput, latency, and memory comparisons against other frameworks are a recorded follow-up, not a claim of this paper, and no number in this paper is a performance number. Test-based evidence also cannot demonstrate the absence of further defect classes, a limit Section VII develops. VII. T HREATS TO VALIDITY Single primary subject. The taxonomy’s depth comes from one framework we control, and the cross-framework evidence covers three further codebases at single pinned revisions. Classes that require mechanisms none of these four frameworks implement would not surface, so the taxonomy is a lower bound, not a census. Evidence standard. All closure claims rest on tests, including adversarially constructed interleavings, but tests cannot prove the absence of unexplored schedules. We mitigated this with repeated runs, revert verification for two classes, and

audits that were blind to the design documents, and we scope every closure claim to the cataloged classes. Audit reproducibility. The adversarial audits followed a fixed brief and citation discipline, but independent auditors examining the same code could catalog a different class set or draw family boundaries differently. The per-class code citations and failure interleavings are recorded, so the findings are checkable even where the categorization is judgment. Author position. We audit and redesign our own framework, which risks favorable framing. The mitigations are structural: findings were only counted with a confirmed code-level trace, the cross-framework examinations quote the examined revisions, and the fidelity analysis names what the redesign does not achieve with the same prominence as what it does. VIII. D ISCUSSION AND L IMITATIONS Why the convergence happened. Four independently developed frameworks arrived at push-based lifecycle signaling, and we attribute this convergence to shared constraints of the async substrate rather than to coincidence. Channels are the idiomatic communication primitive on an async runtime, so announcing a death over a channel requires the least additional code. The ownership alternative requires the supervisor to hold and poll task sets, which the ecosystem’s structuredconcurrency primitives made ergonomic only recently [2], [17]. The taxonomy indicates that the idiomatic choice and the correct choice diverge exactly where lifecycle events carry obligations rather than data. Generality of the taxonomy. The mechanism families are stated in framework-neutral terms, and the cross-framework examination found instances of two families outside our own code, namely lossy completion signaling and teardown orphaning. We expect the families to apply to any never-blocking supervisor over push signaling on any cooperative runtime, but our evidence covers only four Rust codebases. Limitations. The redesign’s guarantees are scoped by the guarantee analysis. Turn-boundary delivery bounds kill latency by one handler turn, a never-yielding handler defeats all forcing, and a host-process kill runs no teardown. The evaluation is correctness-only, so the runtime cost of ownership bookkeeping relative to push signaling is unmeasured. Peerto-peer monitoring between actors, as opposed to vertical supervision, is not yet designed. Extending the ownership discipline to an observation plane in which no observer may extend any actor’s lifetime is open. IX. C ONCLUSION OTP’s supervision guarantees depend on a synchronous supervisor, and implementations on cooperative runtimes must reconstruct that atomicity themselves through explicit mechanism. We treated every guarantee as a design decision to be earned on evidence from pinned primary sources, competing framework source, and blind adversarial audits. We cataloged 24 defect classes from those audits and three source examinations, and reduced them to seven mechanism families with one dominant root cause. We closed every cataloged

class in the studied framework by replacing push signaling with supervisor-owned completions, per-incarnation identity, one lifecycle state machine, and a signal-first cascade derived verbatim from pinned OTP sources. The result is validated by 241 tests, including two revert-verified reproductions, and holds OTP’s verbatim-verified contracts alongside supervisor responsiveness during group restarts and handler-turn isolation, two properties OTP does not offer. The guarantee analysis states each kept, added, and traded property at its earned strength. Performance measurement and a peer-observation plane under the same ownership discipline remain recorded follow-ups. R EFERENCES [1] J. Armstrong, “Making reliable distributed systems in the presence of software errors,” Ph.D. dissertation, Royal Institute of Technology (KTH), Stockholm, 2003. [2] Tokio Contributors, “Tokio: An asynchronous runtime for rust,” https://tokio.rs, 2026, version 1.53.1 as pinned by the studied framework. [3] Ericsson AB, “Processes: Erlang system documentation, erlang reference manual,” Erlang/OTP 28 official documentation, doc version 28.5.0.4, 2026, companion function reference: erlang module, erts 16.4.0.4. Accessed 2026-08-30. [Online]. Available: https: //www.erlang.org/docs/28/system/ref man processes.html [4] ——, “erlang module reference,” Erlang/OTP 28 official documentation, erts 16.4.0.4, 2026, anchors exit/1, exit/2, is process alive/1. Accessed 2026-08-30. [Online]. Available: https://www.erlang.org/docs/28/apps/ erts/erlang.html [5] C. Hewitt, P. B. Bishop, and R. Steiger, “A universal modular ACTOR formalism for artificial intelligence,” in Proceedings of the 3rd International Joint Conference on Artificial Intelligence (IJCAI), 1973, pp. 235–245. [6] G. Agha, Actors: A Model of Concurrent Computation in Distributed Systems. MIT Press, 1986. [7] G. Agha, I. A. Mason, S. F. Smith, and C. L. Talcott, “A foundation for actor computation,” Journal of Functional Programming, vol. 7, no. 1, pp. 1–72, 1997. [8] Ericsson AB, “Supervisor behaviour: OTP design principles,” Erlang/OTP 28 official documentation, 2026, accessed 2026-08-30. [Online]. Available: https://www.erlang.org/docs/28/system/sup princ.html [9] ——, “supervisor.erl,” Erlang/OTP source tree at tag OTP-28.0, lib/stdlib/src/supervisor.erl, 2025, all line citations refer to this tag. [Online]. Available: https://github.com/erlang/otp/blob/OTP-28.0/ lib/stdlib/src/supervisor.erl [10] S. Bykov, A. Geller, G. Kliot, J. R. Larus, R. Pandya, and J. Thelin, “Orleans: Cloud computing for everyone,” in Proceedings of the 2nd ACM Symposium on Cloud Computing (SoCC), 2011, p. 16. [11] S. Clebsch, S. Drossopoulou, S. Blessing, and A. McNeil, “Deny capabilities for safe, fast actors,” in Proceedings of the 5th International Workshop on Programming Based on Actors, Agents, and Decentralized Control (AGERE!), 2015, pp. 1–12. [12] S. Clebsch, J. Franco, S. Drossopoulou, A. M. Yang, T. Wrigstad, and J. Vitek, “Orca: GC and type system co-design for actor languages,” Proceedings of the ACM on Programming Languages, vol. 1, no. OOPSLA, pp. 72:1–72:28, 2017. [13] Actix Contributors, “actix: An actor framework for rust,” https://github.com/actix/actix, 2026, version 0.13.5, source examined 2026-08. [14] S. Lawlor and ractor Contributors, “ractor: A pure-rust actor framework,” https://github.com/slawlor/ractor, 2026, source examined at commit 1af0aaad, 2026-08. [15] Bastion Contributors, “bastion: A highly-available distributed faulttolerant runtime for rust,” https://github.com/bastion-rs/bastion, 2023, unmaintained repository, no commits since April 2023; source examined at master HEAD, 2026-08. [16] M. Bagherzadeh, N. Fireman, A. Shawesh, and R. Khatchadourian, “Actor concurrency bugs: A comprehensive study on symptoms, root causes, API usages, and differences,” Proceedings of the ACM on Programming Languages, vol. 4, no. OOPSLA, pp. 214:1–214:32, 2020.

[17] N. J. Smith, “Notes on structured concurrency, or: Go statement considered harmful,” https://vorpus.org/blog/notes-on-structured-concurrencyor-go-statement-considered-harmful/, 2018, accessed 2026-08-30.

Related documents

• Supervision Without Blocking: An Evidence-Driven Redesign of OTP-Style Fault Tolerance for Cooperative Runtimes#1457675
• Supporting fidelity of implementation: Evidence from Pathways-to-Success replications#376439
• The Stack - Layered Constraint Architectures, Validator Diversity, and the Prevention of Recursive Drift#693520
• TwinCheck: Evidence-Grounded Negative-Twin Verification for Stateful Tool Agents#1063122
• LaVGuard: Selective Decoding for Contextual Value Drift#1413376