The tool nobody used this quarter should never be the tool nobody can get back.
Durations use integer units such as 15s, 60m, 72h, or 30d, with tighter units enforced per field.
​
duration
Idle time before the microVM is paused.
​
duration
Idle time before the app is recommended for archiving. If both are set, it must be longer than sleepAfter.
​
duration
Requires archiveAfterUnused.
​
duration
default:"72h"
May not exceed the default organization maximum of 168 hours.

​
Sleep and wake

An app nobody has opened for a while steps aside. The next request to the gateway wakes it before proxying — the user waits, but the link never breaks. sleep pauses the VM and wake resumes it without changing its provider identity.
Pausing retains guest memory, so it is isolation-preserving but not yet true scale-to-zero. Snapshot/restore should replace pause/resume before idle sleep is used as a cost-control promise in production.

​
Rollback

Traffic repoints to that deployment. Because artifacts are content-addressed, a rollback returns to the exact bytes that were served, and the URL never changes. A superseded deployment’s workload token stops working the moment the route moves, so the old VM cannot keep writing to the database.

​
Archive and restore

Archive snapshots resources first, then stops the environments. SQLite uses VACUUM INTO; Postgres uses pg_dump, which needs postgresql-client on the control-plane host.
Restore does not deploy a worker. It restores the app and its snapshots — deploy again to resume serving traffic.

​
Deletion is deliberate

The --confirm value must be the exact slug, and deletion is then scheduled after a seven-day grace window. Nothing vanishes because someone typed quickly.

​
Recommendations

The control plane computes idle/archive/delete recommendations rather than acting on them unprompted:

​
Background work

The server reconciles deployment jobs every 250 ms, drains webhooks every second, expires previews every minute, and scans residual resources hourly. Work and leases are durable, so a restarted process resumes queued jobs.

​
Failure behavior

Reconciliation is idempotent under the deployment operation key and adopts a live jailer process after an agent restart. destroy terminates the VMM, removes its TAP/nftables policy, deletes the jail, and reports any residual paths for the leak scanner.