Supervisor design ensures fault tolerance without blocking message handling
Supervision Without Blocking: An Evidence-Driven Redesign of OTP-Style Fault Tolerance for Cooperative Runtimes
Distributed, Parallel, and Cluster Computing
Summary
Actors are components in computer programs that send messages to each other, and supervisors make sure these actors keep working correctly. The paper looks at how existing supervision designs assume supervisors work synchronously and in a single thread, which doesn't hold true in newer, cooperative runtimes. The authors studied and tested existing designs, finding many flaws caused by trying to recreate a synchronous system in an asynchronous one. They designed a new supervision runtime that fixes these issues, ensuring supervisors stay responsive and message handlers are never interrupted midway.
What this means in practice
- •For software engineers: Build fault-tolerant actor-based applications on cooperative runtimes that keep supervisors responsive during failures and never interrupt message processing.
- •For distributed system developers: Improve reliability of distributed systems using actor models by employing a supervision runtime that avoids message handler cancellation and blocking during restarts.
Authors
Sam Uwejan, Erdogan Dogdu
Abstract
Actor frameworks on mainstream runtimes advertise Erlang/OTP-style supervision, but OTP's consistency contracts assume a synchronous, single-threaded supervisor, and ports inherit that assumption's absence as unexamined risk. We evaluated every supervision guarantee against pinned OTP documentation and source read verbatim, against the source of three further Rust actor frameworks at fixed revisions, and against the actor-model literature, recording the evidence behind each design decision. Blind adversarial audits and the cross-framework study surfaced 24 defect classes, of which eight reduce to one root cause: reconstructing, by explicit mechanism, the atomicity a synchronous supervisor gets implicitly. We introduce a supervision runtime that closes all 24 cataloged classes through supervisor-owned completion values, per-incarnation identity, and a single lifecycle state machine, validated by 241 tests including reverted-fix reproductions. The result holds OTP's verbatim-verified contracts while adding two properties OTP does not offer: a supervisor that remains responsive throughout group restarts, and message handlers that are never cancelled mid-execution. We delimit the forcing guarantees no cooperative runtime can honor.