Conformance group: what a mechanism must provide for reconciliation to be possible at all (003 T022, FR-015, SC-008, quickstart Scenario 6).

Both directions, and the one that gets left out

Reconciliation compares the host's registry against reality, and there are two ways they can disagree:

• recorded running, actually gone — a sandbox died while the host was down. This is the direction everyone implements, because it is the one the registry can find by iterating its own rows.

• actually running, not recorded — a sandbox the registry has no row for. Nothing in the registry can find this, because the registry is what is missing. Reaching it requires enumerating the mechanism's own view, which is list_running/0.

A reconciler covering only the first direction passes every casual test and leaves unrecorded sandboxes running forever. They are the worse kind of leak: unattributable, and therefore unbillable and unauditable — nobody is charged for them and no audit can say whose code is running.

SC-008 is what makes this measurable — recorded status matches reality within 60 seconds — and it is unsatisfiable by construction without list_running/0.

Why this group tests list_running/0 rather than a reconciler

The reconciler is host code (003 T027, an Oban job). A mechanism cannot be held to it. What a mechanism can be held to is the property the reconciler depends on: list_running/0 enumerates reality, not the mechanism's own bookkeeping.

That distinction is the whole check. A mechanism that returns the sandboxes it believes it started is trivially consistent with itself and useless for reconciliation — the case it must catch is precisely the one where its beliefs and reality have diverged, which is when the sandbox died without telling it.