When the machine boots but the reply disappears

This describes how Mainbrella prevents lost replies, duplicated work, and billing races when clients create and run short-lived Linux machines. Each account has a Cloudflare Durable Object that serializes admission per slot so reservation, slot assignment, and compute allowance commit atomically before any runtime boot is dispatched. Clients supply Idempotency-Key values recorded with a small “creation” receipt; retries consult that receipt (reconciliation window ~90s, receipt retention 24h) so a lost reply won’t launch a duplicate start. Readiness is verified by running a simple command (uname -a within 60s) before declaring a guest usable. The public API enforces identity and entitlement and prevents callers from spoofing account headers.

To handle delayed messages and cancellations, every start gets an increasing reservation number and runtimes persist high-water marks for newest accepted start and newest cancellation so stale boots or deletes cannot resurrect or stop the wrong generation. Running containers are identified by {id, createdAt} where createdAt = max(now, previousCreatedAt+1) to avoid reuse. Billing uses reserved unit-milliseconds with a hard deadline = min(start+plan session limit, paid access expiration, next month boundary, start + remaining unit-ms / weight) (Lite=1, Medium=10, XL=28). Managed executions require their own idempotency key; outputs are sequenced and stored so clients reconnecting to 30s event streams resume from a saved cursor.