How must an instance handle cold storage retrieval that exceeds its operational timeout?

**Date of Record:** 2026 October 27 **Scope:** Applies when an agentic session retrieves data from cold storage (deep archive, tape backup, or S3 Glacier), where retrieval latency can be 12-24 hours, and the session's operational timeout is minutes or hours. Does not apply to sessions retrieving only from hot storage with sub-second latencies.

Core Distinction

The separation between **data availability** (the data exists in cold storage and can be retrieved) and **data retrievability within timeout** (the data can be retrieved before the session's operational timeout). Relying on availability creates the **Archive Retrieval Timeout**: the session requests data from cold storage, waits for retrieval, exceeds its timeout, and fails the operation, unaware that the data would have arrived 12 hours later.

What Was Observed

In cold-storage agent architectures, failing to handle retrieval latency produces three primary failure modes:

  1. **Silent Timeout:** The session requests cold storage data, waits, times out, and fails. The retrieval may still complete later, but no one receives it because the session has terminated.
  2. **Cascade Failure:** Multiple sessions request the same cold-storage data, each timing out, and the storage system is exhausted by duplicate retrieval requests.
  3. **Business Process Disruption:** A critical operation requires cold-storage data within an SLA of minutes, and the session's design did not account for retrieval latency, causing SLA breach.

Recorded Elements

  1. **`retrieval_latency_estimate_receipt`:** The exact storage tier's retrieval latency estimate (from the provider or prior observations), allowing the session to predict how long the data will take.
  2. **`retrieval_request_tracking_signature`:** When a retrieval request is issued, the cryptographic proof of the request's ID and expected completion epoch, so the session can monitor asynchronously rather than blocking.
  3. **`async_notification_receipt`:** A cryptographic proof that the session will be notified when the retrieval completes, allowing the session to terminate and be reactivated later.
  4. **`sla_miss_directive_receipt`:** For operations with strict SLAs, the fail-closed proof that the SLA will be missed due to retrieval latency, triggering alternative paths.

Condition of Validity

* **Applies when:** The session retrieves data from cold storage, retrieval latency can exceed the session's operational timeout, and the operation cannot proceed without the data. * **Does not apply when:** The session's timeout is longer than retrieval latency (e.g., sessions designed to run for 24+ hours), or the data retrieval is strictly optional (not on the critical path).

Decision Boundary

  1. **Does the session need cold storage data?** If no, standard data retrieval applies. If yes, proceed.
  2. **Does the `retrieval_latency_estimate_receipt` show the estimate fits within the session's operational timeout?** If yes, blocking retrieval is fine. If no, the session must use async retrieval and terminate, expecting reactivation.
  3. **Has the session issued a `retrieval_request_tracking_signature`?** If no, the retrieval cannot be monitored asynchronously. The session must issue one before blocking or terminating.
  4. **Conversely, when can a session accept a cold-storage retrieval that will time out?** Only when the operation has alternative paths (e.g., degrade to a cached approximation, escalate to human), or the timeout is acceptable because the operation has no strict SLA.

Operational Effect

  1. **Timeout Prevention:** Sessions avoid wasting time blocking on retrievals that will not complete.
  2. **Async Retrieval Pattern:** Sessions issue retrievals and terminate, with successors picking up the completed retrieval.
  3. **SLA Awareness:** Sessions with strict SLAs fail fast, allowing escalation rather than silent SLA breach.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class RetrievalVerdict(Enum):
    HOT_STORAGE = auto()
    BLOCKING_RETRIEVAL_OK = auto()
    ASYNC_RETRIEVAL_REQUIRED = auto()
    SLA_WILL_BE_MISSED = auto()

@dataclass(frozen=True)
class StorageRequest:
    data_id: str
    storage_tier: str
    estimated_retrieval_sec: float
    session_operational_timeout_sec: float
    operation_has_strict_sla: bool
    async_notification_available: bool

@dataclass(frozen=True)
class RetrievalPolicy:
    sla_buffer_sec: float

@dataclass(frozen=True)
class RetrievalManifest:
    verdict: RetrievalVerdict
    directive: str
    manifest_digest: str

class ColdStorageRetrievalGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_request(
        cls, request: StorageRequest, policy: RetrievalPolicy
    ) -> RetrievalManifest:
        
        # Gate 1: Hot storage
        if request.storage_tier == "HOT":
            digest = cls._hash(json.dumps({
                "data": request.data_id,
                "tier": "HOT"
            }, sort_keys=True))
            return RetrievalManifest(
                verdict=RetrievalVerdict.HOT_STORAGE,
                directive=f"PROCEED: Hot storage retrieval for {request.data_id}.",
                manifest_digest=digest
            )

        # Gate 2: Blocking OK
        if request.estimated_retrieval_sec <= request.session_operational_timeout_sec:
            digest = cls._hash(json.dumps({
                "data": request.data_id,
                "tier": request.storage_tier,
                "retrieval": f"{request.estimated_retrieval_sec:.0f}",
                "timeout": f"{request.session_operational_timeout_sec:.0f}"
            }, sort_keys=True))
            return RetrievalManifest(
                verdict=RetrievalVerdict.BLOCKING_RETRIEVAL_OK,
                directive=f"PROCEED: Retrieval {request.estimated_retrieval_sec:.0f}s within timeout {request.session_operational_timeout_sec:.0f}s.",
                manifest_digest=digest
            )

        # Gate 3: SLA will be missed
        if request.operation_has_strict_sla:
            sla_deadline = request.session_operational_timeout_sec - policy.sla_buffer_sec
            if request.estimated_retrieval_sec > sla_deadline:
                return RetrievalManifest(
                    verdict=RetrievalVerdict.SLA_WILL_BE_MISSED,
                    directive=f"HALT: Retrieval {request.estimated_retrieval_sec:.0f}s > SLA deadline {sla_deadline:.0f}s. Escalate or use alternative.",
                    manifest_digest=cls._hash(f"SLA_MISS:{request.data_id}")
                )

        # Gate 4: Async required
        if request.async_notification_available:
            digest = cls._hash(json.dumps({
                "data": request.data_id,
                "tier": request.storage_tier,
                "mode": "ASYNC",
                "retrieval": f"{request.estimated_retrieval_sec:.0f}"
            }, sort_keys=True))
            return RetrievalManifest(
                verdict=RetrievalVerdict.ASYNC_RETRIEVAL_REQUIRED,
                directive=f"ACTION: Issue async retrieval, terminate. Successor picks up after {request.estimated_retrieval_sec:.0f}s.",
                manifest_digest=digest
            )

        return RetrievalManifest(
            verdict=RetrievalVerdict.SLA_WILL_BE_MISSED,
            directive=f"HALT: Retrieval {request.estimated_retrieval_sec:.0f}s > timeout, no async notification available.",
            manifest_digest=cls._hash(f"NO_ASYNC:{request.data_id}")
        )