Saga & Compensation

Long machine procedures cannot hold a single lock; sagas break them into steps each paired with a compensating action that undoes it safely.

No global transaction on a tokamak

A breeder shot touches vacuum, magnets, fuelling, and heating across seconds; a burner startup spans minutes. You cannot wrap that in one database transaction. The saga pattern instead sequences local, individually-committed steps and pairs each with a compensation that returns the machine toward safety if a later step fails.

Forward and compensating steps

saga = [
  step(pumpdown,     compensate=vent_to_holding),
  step(field_ramp,   compensate=field_deenergize),
  step(fuelling,     compensate=stop_gas_and_pump),
  step(heating,      compensate=heating_off),
]
# on failure at step k: run compensations k-1..0 in REVERSE order
# each compensation is idempotent and itself safety-bounded

Compensation is not naive rollback

A compensation is a forward action chosen for safety, not a literal undo. You cannot un-inject neutrons or un-heat a plasma; the compensating action for heating is a controlled ramp-down, and for field it is a rate-limited de-energize that respects magnet slew limits. Every compensation is itself checked against the safety envelope and is idempotent so a retried rollback does not overshoot.

Ordering and partial failure

• Compensations run in strict reverse order of the committed forward steps.
• A compensation that itself fails escalates to the interlock layer, never leaves the machine hanging.
• Steps already compensated are marked so a resumed saga does not double-compensate.

Burner long procedures

The burner (Aegis / MetroVolt) targets steady state, so its sagas are long-lived: a plug-field establishment saga may run for minutes with compensations that gracefully bleed the 26.49 T plug field back down if throat confinement at 17 T is not achieved. The saga state is persisted continuously so a supervisor restart resumes mid-procedure; see checkpointing.

Sagas coordinate with the two-phase action commit for the small number of steps that must be all-or-nothing across two coupled actuators.