Distillation

Date: Sep 17, 2026

• 🟡 (09:36) Updated packages/core/test/session-run-coordinator.test.ts so coordinator tests consistently enforce that every wake already recorded when interruption begins survives into exactly one successor.
• 🟡 (09:36) Claim-handoff design for packages/core/src/session/execution/local.ts: use Effect.uninterruptibleMask only around transaction commit, local activeClaims registration, and finalizer installation; restore interruptibility for the runner, heartbeat, database reads, and cleanup under the installed finalizer.
• 🟡 (09:36) Planned deterministic claim-boundary regression: gate acquisition at the database transaction boundary, make interruption pending before commit, then verify the committed claim is either cleaned or intentionally retained by policy and is never orphaned before registration.
• 🟡 (09:37) Malformed assistant projection design for packages/core/src/session/recovery.ts: stop converting Schema.decodeUnknownEffect(SessionMessage.Message) failures to defects; quarantine the acquired claim using the exact execution/session/recovery-owner/live-lease/null-prior-error fence. If ownership has transferred, zero updated rows stops the pass without claiming success or mutating the successor’s claim.
• 🟡 (09:38) Implemented malformed-projection quarantine in packages/core/src/session/recovery.ts, turning poison rows into durable recovery_error quarantine records rather than indefinitely retrying defects.
• 🟡 (09:39) Implemented the initial uninterruptible acquisition-to-registration handoff in packages/core/src/session/execution/local.ts.
• 🟡 (09:39) tsgo --noEmit passed after the production changes.
• 🟡 (09:39) Planned two deterministic regressions: 1. interrupt while claim insertion remains inside an immediate transaction; 2. use more than 100 malformed assistant projections to prove quarantine frees the bounded recovery scan for later valid work.
• 🔴 (09:40) User asserted the recovery invariant: never recover an expired cancellation claim.
• 🟡 (09:40) Investigation of deterministic transaction gating: existing SQLite trigger tests can force failures but cannot pause a transaction; no registered SQLite function hook was found in the test database adapter. Chosen alternative: add a narrow optional acquisition hook to exported SessionExecutionLocal.make so tests can pause immediately after commit; production leaves the hook absent.
• 🟡 (09:42) Added the optional acquisition test hook to packages/core/src/session/execution/local.ts and a commit-boundary interruption regression to packages/core/test/session-execution-local.test.ts. The test holds the owner immediately after commit, requests interruption, then releases it to prove pending interruption cannot escape registration/finalization.
• 🟡 (09:43) The new regression exposed that merely delaying interruption was insufficient because the interrupt path could not identify a claim committed but not yet registered. Root cause: exact claim identity was unavailable during the commit-to-registration gap, allowing the no-claim fallback.
• 🟡 (09:43) Revised claim-handoff fix in packages/core/src/session/execution/local.ts: register the prospective exact claim in activeClaims before acquisition begins, retain that registration through the complete drain finalizer, and let the pre-interrupt fenced update serialize behind the immediate transaction. This replaces the initial design that registered only after commit and prevents commit-boundary interruption from taking the no-claim fallback.
• 🔴 (09:44) User asserted the recovery invariant: never recover an execution superseded by a newer assistant.
• 🟡 (09:44) Defined the malformed-projection starvation regression to match the reviewer’s scenario exactly: create 300 older malformed projections, quarantine them across three bounded scans of SessionRecovery.BATCH_SIZE = 100, advance one scan interval, then require valid claim 301 to progress on the fourth pass. Without quarantine, the oldest 100 poison claims would recycle ahead of claim 301.