Distillation

Date: Sep 16, 2026

• 🟡 (16:08) In packages/core/schema.json, session_execution_pk is an explicit primary key on session_execution.id; session_recovery_pk is an explicit primary key on session_recovery.execution_id.
• 🟡 (16:08) packages/core/schema.json defines session_execution_phase_check as "phase" IN ('ready', 'safe', 'unknown', 'continue').
• 🟡 (16:08) packages/core/schema.json defines both session_recovery_wake_attempts_check and session_wake_attempts_check as "wake_attempts" >= 0 AND "wake_attempts" <= 9007199254740991.
• 🟡 (16:08) /tmp/opencode/session-recovery-final-v8.patch contains diffs for 32 repository files: 1. packages/core/schema.json, 2. packages/core/src/database/migration.gen.ts, 3. packages/core/src/database/migration/20260914170650_session-recovery.ts, 4. packages/core/src/database/schema.gen.ts, 5. packages/core/src/session.ts, 6. packages/core/src/session/compaction.ts, 7. packages/core/src/session/context-epoch.ts, 8. packages/core/src/session/execution/local.ts, 9. packages/core/src/session/input.ts, 10. packages/core/src/session/message-updater.ts, 11. packages/core/src/session/projector.ts, 12. packages/core/src/session/recovery.ts, 13. packages/core/src/session/run-coordinator.ts, 14. packages/core/src/session/runner/index.ts, 15. packages/core/src/session/runner/llm.ts, 16. packages/core/src/session/runner/publish-llm-event.ts, 17. packages/core/src/session/sql.ts, 18. packages/core/test/database-migration.test.ts, 19. packages/core/test/session-execution-local.test.ts, 20. packages/core/test/session-projector.test.ts, 21. packages/core/test/session-prompt.test.ts, 22. packages/core/test/session-run-coordinator.test.ts, 23. packages/core/test/session-runner-recorded.test.ts, 24. packages/core/test/session-runner-tool-events.test.ts, 25. packages/core/test/session-runner.test.ts, 26. packages/opencode/src/server/routes/instance/httpapi/server.ts, 27. packages/schema/src/session-event.ts, 28. packages/schema/test/event-manifest.test.ts, 29. packages/sdk/js/src/v2/gen/types.gen.ts, 30. packages/sdk/openapi.json, 31. packages/server/src/routes.ts, and 32. packages/core/src/session/execution/claim.ts; it also adds packages/core/src/session/recovery-id.ts.
• 🔴 (16:09) User requires local session execution to never start a second owner while the lease is live.
• 🔴 (16:09) User requires local session execution to never overwrite an expired lease.
• 🔴 (16:09) User requires local session execution to never re-enter its own uncertain live lease.
• 🔴 (16:09) User requires an expired execution claim never to be revived by heartbeat.
• 🟡 (16:09) packages/core/test/session-execution-local.test.ts also tests: clearing the claim after a successful drain; clearing the claim after explicit interruption; failing cancellation when cleanup loses execution ownership; and lease/heartbeat timing using TestClock.adjust("10 seconds") and TestClock.adjust("40 seconds").
• 🔴 (16:10) User requires recovery never to recover a live execution lease.
• 🟡 (16:10) packages/core/test/session-projector.test.ts contains 29 session-recovery tests in this order: 1. atomically reconciles one abandoned execution into one continuation; 2. records a recovery continuation without forging an assistant identity; 3. recovers each abandoned execution once across repeated startup scans; 4. never recovers a live execution lease; 5. never recovers an execution superseded by a newer assistant; 6. redrives a durable recovery wake after admission; 7. quarantines a malformed recovery row without blocking a valid wake; 8. quarantines a full batch of poison recovery rows before redriving valid work; 9. fairly redrives recovery and ordinary work beyond a full bounded batch; 10. rejects invalid persisted wake attempt counters; 11. never wakes work settled between selection and redrive CAS; 12. quarantines a continuation that belongs to another Session; 13. redrives durable ordinary input execution intent after a lost advisory wake; 14. redrives ordinary input without recovering a claim that crashed before promotion; 15. redrives one existing recovery after its replacement claim crashes before promotion; 16. never recovers a pre-promotion claim when input commits at the recovery boundary; 17. rejects a recovered assistant from another Session; 18. quarantines a recovery wake behind a newer assistant; 19. never promotes a recovery superseded before scanner validation; 20. quarantines an assistant-less recovery superseded before scanner validation; 21. never promotes a quarantined recovery continuation as an ordinary steer; 22. quarantines a malformed claim without blocking a valid claim; 23. quarantines failed execution conversion before scanning later claims; 24. rotates maximum wake attempt counters before issuing wakes; 25. bounds each deterministic recovery scan; 26. rolls back promotion and Context Epoch mutation after ownership loss; 27. never advances the Context Epoch after ownership changes; 28. rolls back claim renewal when Context Epoch advance fails; 29. fences a paused owner after expiry, reconciliation, and takeover.