Modal durable resume redundantly revalidates and reseals execution snapshots

Summary

On v0.1.0, a same-generation Modal node resume redundantly verifies, reseals, and verifies again an execution snapshot that the first attempt already sealed. For large generated dependency closures on a filesystem-v2 Volume, this can consume the entire node callback timeout before the durable inner workflow is resumed.

Minimal generic reproduction

1. Launch the default topology in documented Modal cloud-node mode with a generic external Solidity target and [execution.resources] timeout_seconds = 1800.
2. Use a generated execution dependency closure with roughly 46,000 files / 700 MB (a synthetic tree is sufficient).
3. Let one node write durable prepared and running checkpoints, then time out before its inner workflow finalizes.
4. Run the documented ultrafuzz resume <run-id> --retry-failed command without resetting the node.
5. Observe that initializeDurableNodeWorkspace takes the existing-workspace branch but still runs:
   • unsealed closure verification;
   • the recursive seal/chmod walk;
   • sealed closure verification;
     before it appends the resumed prepared checkpoint.

Stable-file verification reads every file twice. In a live generic reproduction, the resumed worker spent nearly the complete 1,800-second callback window in this pre-resume phase, appended prepared/running only near the deadline, and started no inner model process.

Expected behavior

For an existing same-generation durable workspace, verify the already sealed closure once with sealed-permission enforcement. Preserve the full verify/seal/verify sequence for a freshly extracted workspace. A snapshot file modified between attempts must continue to fail closed.

Suggested regression checks

• Reinitializing the same durable workspace does not call the recursive sealing/chmod walk again.
• Resume still rejects a sealed module modified between attempts.
• Fresh initialization still performs the existing seal sequence.

Release: v0.1.0 / 9b0bc8cab2e681bbffeee385c1f80f85a47087d3.

Start at initializeDurableNodeWorkspace and trace the existing-workspace and freshly extracted workspace branches using the documented ultrafuzz resume --retry-failed flow. Add regression coverage for avoiding repeated sealing on same-generation resumes, rejecting a modified sealed module, and preserving the fresh-initialization sequence.