ADR-0002: The reference runtime runs inside the TTT process, one worker thread per execution

Status: accepted (2026-10-09)

Context#

The GUI thread must never run a script, a backtest or a network call (TTT's frame loop is synchronous, App::ui). TTT has no async runtime and uses std::thread + polled snapshots everywhere. Options: in-process worker thread, a worker process, remote execution, or a mix.

Decision#

• An execution (one run of one compiled program) runs on its own std::thread inside the TTT process, driven by the reference interpreter (t0-runtime).
• The interpreter is memory-safe Rust with no ambient authority: it has no file, network, process or clock access of its own. Everything outside pure computation is a host call checked against the declared capabilities and the session's grants.
• Resource limits are enforced by the interpreter: fuel (evaluation steps), call depth, collection sizes, total wall time; cancellation is a shared flag checked at step boundaries and inside host operations.
• Long work requested by a script (backtests) runs on the script's thread or on threads the host owns; progress is published to the session, which the UI polls once per frame.

Alternatives#

• Worker process. Real isolation (a crash or runaway allocation cannot take the terminal down) at the cost of IPC, serialisation of every host call, and lifecycle management. The reference interpreter cannot execute arbitrary machine code, so the threat it guards against is mostly memory exhaustion, which the interpreter's collection limits address. Native code (Phase 7) changes this: generated machine code is not covered by Rust's guarantees and must run in a separate process.
• Remote only. Makes the editor depend on a server for print(1 + 1).

Consequences#

• A panic in the interpreter is caught at the thread boundary (catch_unwind) and reported as E-RT-INTERNAL; it does not take down the GUI.
• Memory is bounded by limits, not by the OS; a hostile program can still allocate up to its limits inside the terminal's address space.

Revisit when#

Native compilation lands, or when untrusted third-party programs (a marketplace) are run: both require the worker-process mode.