Distillation

Date: Sep 17, 2026

• 🟡 (09:46) Claim-handoff investigation found an additional race in packages/core/src/session/execution/local.ts: pre-registering a prospective claim lets interruption identify it, but cleanup or heartbeat must not mutate it until acquisition resolves. Planned fix: add an acquisition latch to every local registration so interrupt setup serializes with claim commit whether interruption arrives before, during, or after the transaction.
• 🟡 (09:46) v22 security review MUST-FIX: a wake or explicit resume can be lost while interruption enters cancelling. SessionExecutionLocal.interrupt persists cancelling before invoking the coordinator (packages/core/src/session/execution/local.ts:218-248); during that write, wake sets pendingWake and run joins the doomed owner (packages/core/src/session/run-coordinator.ts:73-98), after which coordinator interruption unconditionally resets pendingWake (packages/core/src/session/run-coordinator.ts:100-110). Existing tests only register work after coordinator interruption begins and do not cover this window.
• 🟡 (09:46) v22 security review MUST-FIX confirmed malformed assistant projections can indefinitely starve later recovery claims: recovery repeatedly scans only the oldest 100 expired claims (packages/core/src/session/recovery.ts:71-79), malformed latest-assistant decoding fails (packages/core/src/session/recovery.ts:169-177), and the outer handler merely logs the failure (packages/core/src/session/recovery.ts:316-323). With a 30-second lease (packages/core/src/session/sql.ts:253) and 10-second scans (packages/core/src/session/recovery.ts:547-551), three or more corrupt cohorts can recycle forever; required fix is quarantine under the exact live execution/owner fence.
• 🟡 (09:46) v22 security review CONCERN: completed cancellation does not delete its claim in the final event transaction. For a completed failed Step with unresolved tools, the final Tool.Failed commit changes the claim to cancelled and clears assistant_message_id atomically (packages/core/src/session/execution/local.ts:161-190), but deletion occurs afterward in a separate statement (packages/core/src/session/execution/local.ts:192). A crash between those operations leaves a renewed cancelled claim blocking execution until lease expiry and startup recovery.
• 🟡 (09:46) v22 immutable-input verification: review tree HEAD and base were both ab9408c81cc9916177641ae8e9f08624fc27b5b9; patch SHA-256 was 5af96209cef23e735f09dbf2f4b2f5b0f51b208ece9e5b325e4e217b46003643; SEA SHA-256 was 10a3698a5e3b009f811a1b27eefab9e1083b560e24efee5f537f003d7edd7384.
• 🟡 (09:46) v22 immutable-input verification found the patch contains 34 paths; its path set and every per-path binary diff exactly match the frozen review tree; reverse applicability succeeded.
• 🟡 (09:46) v22 schema verification found new prevIds includes predecessor ID f14a9b18-8207-487e-a3d3-227e629ba9ad in packages/core/schema.json:4-7; generated client, legacy SDK, and OpenAPI surfaces consistently include the new prompt-execution, interrupted-Step, and recovered-Step contracts.
• 🟡 (09:46) v22 behavior verification: the real trigger aborts session.next.step.interrupted.1; regression coverage in packages/core/test/session-runner.test.ts:3906-3948 proves the claim remains cancelling and the tool remains running.
• 🟡 (09:46) v22 behavior verification: completed Step.Failed cancellation waits for runner settlement, emits no Step.Interrupted, publishes Tool.Failed, and retains the original provider failure; covered by packages/core/test/session-runner.test.ts:3952-4012, subject to the unresolved claim-clear atomicity concern.
• 🟡 (09:46) v22 behavior verification: startup recovery for a completed failed Step publishes tool failure and returns without creating a continuation (packages/core/src/session/recovery.ts:179-218; regression in packages/core/test/session-projector.test.ts:222-322).
• 🟡 (09:46) v22 behavior verification: explicit resume durably requests pending execution before invoking the coordinator (packages/core/src/session.ts:426-429), with crash-redrive coverage in packages/core/test/session-projector.test.ts:1348-1414.
• 🟡 (09:46) v22 behavior verification: publication and claim mutations share durable event transactions through commit hooks (packages/core/src/event.ts:237-353); stale-owner operations require session, execution, owner, and a live lease (packages/core/src/session/execution/claim.ts:27-33).
• 🟡 (09:46) v22 security review found no new authentication bypass or forbidden runtime-layer dependency. Final check-call exposure, process-local routing, and bounded clock skew remain accepted disclosed residuals. The review performed no tests, builds, service operations, or VCS mutations and concluded DO-NOT-MERGE.
• 🟡 (09:46) Planned cancellation atomicity fix in packages/core/src/session/execution/local.ts: fold claim deletion into the final Tool.Failed or Step.Interrupted commit transaction instead of first marking cancelled and deleting afterward; publication failure must roll back both the projection mutation and claim deletion.