Hot-Swapping a Composition Whose Components Run on Different Runtimes

Pitch

A running composition can move one component into its own process on another runtime with the cutover verified on the py tier today, and every py seam re-admits the successor against the receiver's own manifest instead of trusting the sender. No service gap has been measured.

Abstract

Dynamic software updating work moves code between versions of one runtime. Real systems are polyglot: a hot worker wants a native tier while the control plane stays on a scripting tier. We describe a composition model in which each component is placed on one of five runtime tiers (py, node, rust, java, go; wasm placement is refused by design), cross-tier calls ride a Unix-socket or mutual-TLS seam with a canonical wire encoding, and the compile-time guarantees on provision disjointness, acyclicity and inverse-or-emit (G2 to G4; teardown order is G7) are checked once over the whole manifest before the split. A live swap boots a successor in its own process, re-admits it against the running manifest so every consumer call site is re-checked, re-points each consumer proxy under a generation counter so a planned cutover is not read as a provider death, drains in-flight calls against the old provider, and tears the old process down in LIFO order with a printed residue proof. Each py seam re-admits against the receiver's own recomputed state and treats the wire only as a selector, never as a manifest. A swap that fails admission leaves the running composition untouched. The swap is tested py to py; the same operation to other tiers is documented and smoke-covered, not swap-tested. We report the mechanism, the refusals it makes by design (shared processes, network providers, sandboxed components, managed model roles), an adversarial audit that found three unjudged inputs at the seam, and the executed test suites. We do not yet report latency, gap-time or cross-tier state transfer measurements: none exist today.

Problem and claim

Existing live-update systems assume one runtime and one trust domain. Rolling updates in orchestrators replace whole processes and lose in-memory state; sidecars and RPC bridges move calls across languages but do not re-check the interface of the new provider against every running consumer, and they trust whoever produced the wire message.

Claim: for a statically checked reactive composition, a swap across a process seam can be made a verified operation. The successor is admitted against the running manifest before any consumer is touched, a failed swap is a no-op, and a py seam never accepts a repoint or wiring on the sender's word. On main this is shown py to py. The same operation to another tier is designed on the same seam and is not yet swap-tested. The claim is about the cutover protocol and the admission discipline, not about moving mutable state between tiers (see limits).

Contributions

1. Per-component tier placement: a [tiers] table plus default_tier expands to one synthesized process per tier; emission narrows to a placement slice and a plan-time capability gate names the component and tier on refusal; never auto-selected (src/revl/placement.py:457-510, src/revl/placement.py:2823, src/revl/placement.py:3066; tests/test_tier_placement.py 18 tests, tests/test_tier_placement_hardening.py 13 tests).
2. A live swap protocol: boot, admit against the running manifest, re-point under a generation counter, drain, LIFO teardown with residue proof (docs/swap.md:30-52, docs/swap.md:112-135). Tested py to py; other tiers use the same seam but have no swap test.
3. A spec-carrying rule: a spec key that carries a security property is carried across the swap or the swap refuses (correlation guard, host-module pins, E-Stop latch), guarded by a test that diffs the two spec literals (docs/swap.md:60-110, tests/test_swap_ref_pins.py).
4. An admission mesh whose py seams re-admit against receiver-held state, with the audit that the first landed version judged only the selector (docs/design/337-polyglot-admission-mesh.md:121-160, tests in tests/test_swap.py:852-1361). Non-py seams are designed, not wired.
5. A process-level cycle check: a quotient of an acyclic component DAG by a placement partition can contain a cycle, and the conductor refuses it (src/revl/placement.py:3265-3340).

Related work

Evidence on main

Numbers that exist

• Test counts by function name: 18 (tests/test_tier_placement.py), 13 (tests/test_tier_placement_hardening.py), 32 (tests/test_swap.py, def test count, parametrization not counted), 9 (tests/test_swap_transactional_1446.py), 42 (tests/test_admit_two_phase.py). These are counts of test functions, not pass rates; no test was run for this draft.
• No latency, cutover-gap, throughput or memory measurements anywhere in the cited docs.
• Five placeable tiers exist plus wasm, which is refused for placement. The docs say every tier is at 0 conformance gaps (docs/backends-roadmap.md:8-14); the generated sweep in docs/conformance.md was not opened.

Paper outline

1. Introduction: polyglot compositions and why live update stops at the language boundary.
2. Model: components, providers, tiers, the G2 to G4 checks done once.
3. Placement: the [tiers] surface, slicing, capability gate, process-quotient cycles.
4. The swap protocol: boot, admit, re-point with generations, drain, residue proof.
5. Seam admission: selector not manifest, the three unjudged inputs found by audit.
6. What a swap carries or refuses.
7. Evaluation (to be built): gap, latency, failure injection.
8. Related work and limits.

Threats to validity and limits

• The mesh doc says: "The design does not pretend the polyglot mesh is buildable end-to-end now" (docs/design/337-polyglot-admission-mesh.md:448-450). Admission at a seam runs on py today.
• The swapped component must be alone in its process and not a network provider (docs/swap.md:139-175). Mid-stream handoff of in-flight calls is deferred; calls drain against the old provider.
• Shadow verification before cutover is deferred (docs/swap.md:230-238).
• Probes are not re-run on the successor by design.
• The mesh re-admits, it does not confine: a tier that owns its host can corrupt its own gate (docs/design/337-polyglot-admission-mesh.md:592-594).
• State transfer across tiers is not documented as built, and cross-tier swap is not tested. Any reading of "state migration" or "hot swap on six tiers" beyond the within-runtime mechanism overstates what the swap docs show.

Fact-check

Claims in this draft were checked against revl main at commit 45bec431f: 60 checked, 11 corrected.

Cite this draft

@misc{revlp29,
  author       = {Thomas Moussajee},
  title        = {Hot-Swapping a Composition Whose Components Run on Different Runtimes},
  year         = {2026},
  howpublished = {\url{https://inso1337.github.io/revl/research/P29.html}},
  note         = {Research draft, not peer reviewed. Written against revl commit 45bec431f. Licensed CC BY 4.0.}
}

Text licensed CC BY 4.0, author Thomas Moussajee.