Rollout. One attempt at one task by an agent in one environment, from reset to final state: a sequence of observations (screenshots, accessibility trees) and actions (clicks, keys), ending when the task finishes, the step cap is reached, or something fails.
Valid rollout. A rollout that counts. In the Drums definition: the reset was verified (work tree matches the golden manifest, pasteboard empty, no leftover app processes); every action ran under the correct generation; nothing timed out; the verifier ran and returned a result; every isolation check active during the rollout was clean. A verifier fail is a task fail, not an infrastructure fail. Environment failures get their own line and are never scored as reward 0.
Attempt. Any rollout that was started, valid or not. Cost is attributed over attempts; the denominator of the headline metric is valid rollouts.
Verifier (judge, checker, reward script). Code that inspects the final state (files, database rows, app state) and returns a reward. Trustworthy verifiers are a known bottleneck: OSWorld 2.0 tags 30.6% to 42.6% of runs "scoring/environment mismatch"; ScaleCUA's generated judges agree with humans 82.5% of the time (both author-reported).
Reset. Returning an environment to its starting state before the next rollout. Can be a VM snapshot restore (tens of seconds), a container restart, a database drop-and-clone, or a directory swap. "Reset time" in MAI-Gym includes queueing and task preparation.
Checkpoint and restore. Saving an environment's state (disk, and sometimes memory) so it can be restored or forked later. Disk-only checkpoints (hosted sandboxes, APFS clones, VM clones) restore files; running processes and memory do not carry over.
CRIU. Checkpoint/Restore In Userspace, the Linux tool that freezes a running process tree to disk and restores it. macOS has no equivalent; forking a live Cocoa or GUI process is unsupported, and the L1 prototype found five concrete breakages when forking a live GUI or server process on Linux.
CoW (copy-on-write). Sharing data between copies until one of them writes; only the changed blocks or pages are duplicated. Examples: APFS clonefile, XFS cp --reflink, Postgres template databases, qcow2 overlay disks, forked process memory. Disk CoW (files) and process CoW (live memory) are different operations and must not be conflated.
State capsule. CUA-Sandbox's term for one environment's private state over a shared runtime: authoritative state (database branch, user files) as a CoW delta over an immutable base; derived state (caches, indexes) in private namespaces, rebuilt not copied; ephemeral state (IPC endpoints, display resources) recreated on activation. Identified by (environment, site, branch, generation).
Generation. A monotonic counter per environment that increases on every reset or fork. Every action carries the generation it was issued under; an action from an older generation is rejected (CUA-Sandbox: 0 of 100 mixed-generation events with the protocol, 100 of 100 without; Drums envd: HTTP 409).
Fast user switching. The macOS feature that keeps one user's session alive, off console, while another logs in. Each session has its own launchd domain, pasteboard, privacy daemon and event stream, but shares the kernel and the WindowServer. The Drums macOS design runs one such session per environment.
Positive control. A run where the protection is deliberately removed so the leak detector must fire. If it does not fire, the detector is broken and no "zero contamination" may be published. In experiment 1: two Writers in one macOS session driven by per-process input; two Linux users on one display.
Canary. An environment (or the parked console) that receives no actions during a run and is checked continuously; any change to its document, pasteboard or window hash is a contamination event.
Contamination (cross-talk, cross-delivery). One environment's input, pasteboard contents, files, preferences or screen pixels reaching another environment. Measured per isolation test and summed over environment-hours; reported as 0 of X next to the positive control's Y of X.
Arm. One configuration under comparison: for example qemu-kvm-warm-snapshot, oci-runc-criu, drums-rootfs-criu, macos-sessions. Every number on this site names its arm. An ordinary OCI container is a control arm, not the Drums runtime.
Operating point. A system's numbers at one specific configuration (host, concurrency, cap, workload). Comparisons are valid only operating point to operating point.
Burst vs sustained. A burst is a short run on pre-warmed resources (OSGym's 121 seconds); sustained means hour-scale windows with resets, failures and idle time included.
TCC. macOS's privacy permission system (Transparency, Consent and Control). Screen Recording and Accessibility grants are needed for capture and input; a human clicks them; device management can deny but not grant Screen Recording.
Xvfb. A virtual X11 display on Linux; one per environment is the ordinary way to run many GUI sessions on one Linux kernel without a VM.
envd. The per-session agent in the Drums experiment: screenshot, click, type, key, scroll, pasteboard, launch, reset, with a generation on every mutating call. A Swift binary on macOS, a Python service on Linux, the same HTTP API.
Status words. verified: a measurement file exists on named hardware with the run recorded (software-test passes are verified software evidence, never a benchmark result). preliminary: a real observation that needs more runs, a positive control or an independent check; also an author-claimed live result with no artifact. failed: it ran and missed a correctness, isolation, reset or pre-registered bar, or failed to run at its preconditions. planned: source or protocol exists, nothing ran, no numbers.
Number labels. measured: we ran it or read it. author-reported: a paper says so. author-claimed: text on a branch with no artifact. vendor claim: a pricing or documentation page. design value: a threshold or setting chosen before measurement. estimate: arithmetic from other numbers.