Spatiotemporal Composability: Why Changing One Line of Code Requires Restarting the Entire Software

"Why does changing one line of code require restarting the whole software?" The question is so everyday that nobody treats it as theoretical. A paper from Peking University and DeepSeek, *A Programming Paradigm for Spatiotemporal Composability* (arXiv:2608.25512, 92 pages, submitted 2026-08-26), gives a blunt answer: dynamic composition has never had a formal foundation. Static composition has sixty years of theory (type systems, lambda calculus, module systems); "components installed, removed, and reconfigured at runtime" has almost none. Industry has coped with two coarse-grained substitutes: operating systems offer process-granularity undo (restarts), and container orchestrators offer service-granularity dependency management (rolling rebuilds plus redundant replicas). The paper calls these coarse-grained substitutes.

The empirical portrait: among VSCode Marketplace's top-100 extensions by installs, 87 contain executable code — removing any one restarts the entire host process along with every loaded extension. The extensionDependencies mechanism is effectively dead: only 7 of the top 100 use it (Marketplace data, 2026-06-09). VSCode's deactivate hook is just a graceful-shutdown callback at host exit, splitting cleanup from creation and violating locality of concern — full cleanup is structurally unverifiable. A restart is not an undo; it is mutually assured destruction. The paper's project: pull "undo" and "dependencies" from process/service granularity down to component granularity, with the full formalization.

Key points

1. Two orthogonal dimensions of dynamic composition

• Temporal composability: when a component unloads, everything it did can be completely undone. Restarts are the only "universal inverse function" because no mechanism tracks which state was changed by whom and how to revert it.
• Spatial composability: components declare dependencies; the runtime manages them reactively — activate when satisfied, deactivate when an upstream disappears, with always-safe install/uninstall order.

OSes gave the former (process granularity), Kubernetes the latter (service granularity), but both are too coarse. The problem is not that nobody solved it — the granularity of the solution has been wrong for sixty years.

2. Theoretical core: three conceptual upgrades

The methodology in one line: promote the classic effects/coeffects pair from static type annotations to runtime mechanisms.

1. Revertible effects → temporal dimension. Classical effect systems (Moggi's monadic semantics, Plotkin–Power algebraic effects, handlers in Koka/Eff/OCaml 5) check "what can happen" at compile time. Cordis makes each effect a runtime object carrying its own inverse: the effect function 𝔈Γ ≔ Γ → Γ × (Γ→Γ) returns a new context δ plus an inverse g held by the runtime and executed in LIFO order on unload. Undo becomes "playing backwards." Notably, the witness obligation only requires g to be an inverse at the state where it is applied (g(δ)=γ), not globally — partial reversibility is honestly modeled. 2. Reactive coeffects → spatial dimension. Coeffects (context requirements, the comonad lineage) become runtime subscriptions: every context change is classified as activate / deactivate / neutral against declared specs, driving component start/stop, with realm isolation and interception layers. VSCode's extensionDependencies fails because declarations carry no runtime semantics; here the declaration *is* the execution semantics. 3. Context paradigm → unification. Effect and coeffect contexts merge into a single context type mediating all effects, inducing observational equivalence: effects of different components interleave without interference. A component is the combination of both mechanisms, forming a dynamic composition calculus (fibers + inertial state machines) with a five-part metatheory: type preservation (Th 68), temporal composability (Cor 69), spatial composability (Th 70), termination (Th 73), and configuration determinism (Th 80) — the final state depends only on the final configuration, not the install/uninstall path. This path-independence is the theoretical guarantee behind declarative configuration.

Two engineering highlights: a three-phase HMR (module-classification fixed point, stale-entry detection, transactional reload with rollback) that requires no developer-annotated accept boundaries (the Webpack/Vite pain point); and a system boundary theory splitting operations into acquisition (open/close, malloc/free, fork/kill — reversible within the boundary) and emission (write/send — bytes past the NIC are honestly irreversible). Coeffects can move the boundary via "re-materialization" of external locations, but the paper states this is a trade-off, not a free lunch.

3. Comparison of dynamic composition approaches

| Approach | Temporal undo | Spatial deps | Granularity | Cost/obligation | |---|---|---|---|---| | Process restart | Full discard | ✘ | Process | Total state loss + interruption | | VSCode extensions | ✘ (host restart) | Nominal (7/100 use it) | Extension | activate/deactivate split | | Webpack/Vite HMR | Partial, manual accept | ✘ | Module | Boundary annotation on developer | | K8s rolling update | Replica rebuild | ✔ Service discovery | Service | Redundant replicas + seconds-to-minutes latency | | Cordis | ✔ Effect-level LIFO reversal | ✔ Declarative, reactive start/stop | Component (fiber) | Declare effects/deps + witness obligation |

4. From Koishi to dsh: practice preceded theory by seven years

The paper's most unusual feature is the inverted direction: a seven-year community project retroactively formalized. First author Yifan Shi (PKU & DeepSeek, aka Shigma, author of Koishi/Cordis) built the cross-platform chatbot framework Koishi (6,100+ stars) from 2019, extracted the plugin kernel as the Cordis meta-framework in 2022 (7,800+ stars), validated across 4,000+ community plugins and four years of production — though that is v3; the paper formalizes the redesigned v4, which Koishi itself does not yet use.

Timeline: on August 13, DeepSeek released the open-source agent harness dsh (deepseek-ai/deepseek-harness, MIT, Node.js; 747 points topping Hacker News), and the paper repo cordiverse/paper went up the same day (2,900+ stars); the paper hit arXiv on August 26. dsh's radical move is everything-is-a-plugin: model adapters, tool registries, session logs, sandboxes, the agent loop, and UI are all unloadable Cordis plugins. Configuration is not a settings panel bolted onto a static system but the interface of the composition engine itself. Openness is upgraded: an open license makes code inspectable; a plugin kernel makes code *transformable* — swapping sandbox, model backend, or UI is mounting a plugin, not maintaining a fork.

5. Independent observations

• Interfaces losing structure. The restart curse exists because the process interface discards which state belongs to which component, forcing total discard. The context paradigm lets ownership structure survive the interface; when it does, "undo" collapses from an architectural problem into a mechanical operation.
• Runtime layer for agent self-improvement. Prior self-improvement work operated at the weight level (Ornith-1.5), experience level (Chain-of-Experience), and code level (Metan) — the harness itself was a gap. The paper names self-evolving agent harnesses as the most attractive future validation scenario, and reversibility is the physical precondition for trusting an agent that reconfigures its own stack mid-task.
• Reversibility economics. When every attempt is reversible, expected experiment cost ≈ single forward cost; auditing is replaced by rollback, shifting validation from pre-hoc review to post-hoc trial. Honest boundary: inverse correctness is the *author's obligation* — the runtime guarantees structure (LIFO order, path independence), not semantics. A wrong inverse will be faithfully executed.
• Structural theory of forgetting. Clean forgetting requires remembering how to undo; the dispose accumulator is an undo menu. Uninstalling is not deleting — it is playing backwards. There is no clean forgetting without a traceable write path.
• Honest limits, noisy reception. Emission is irreversible, and the paper does not pretend otherwise. Meanwhile, HN mockery ("reads like word salad / general relativity?") coexists with its 747-point popularity: the jargon is real, and so is the pain every developer who has been hit by a VSCode restart understands.

Things to watch

1. Growth and quality of the dsh-plugin ecosystem (the moat of an open harness is its plugin ecosystem). 2. The paper is marked *under active revision* — the arXiv version is always the latest; any metatheory changes are worth tracking. 3. The most anticipated item is the paper's own suggested empirical demonstration: a public case of an agent rewriting its own harness with full rollback would be software's GPT-3 moment — the defined cost of change collapsing to "mount a plugin."

--- Sources: arXiv:2608.25512 (92 pages, incl. VSCode Marketplace 2026-06-09 measurements); github.com/cordiverse/paper, cordiverse/cordis, koishijs/koishi, deepseek-ai/deepseek-harness; HN #49285244 (747 points).