Distillation

Date: Sep 17, 2026

• 🟡 (09:30) Completed V21 correctness review found a source race still applicable to V22: packages/core/src/session/execution/local.ts:179 waited for the durable phase update before coordinator.interrupt(...) at lines 180-197; a wake during that gap set pendingWake=true in packages/core/src/session/run-coordinator.ts:87-92, but interruption then unconditionally cleared it at lines 108-109, preventing the successor at lines 117-123. A concurrent explicit resume could also join the not-yet-stopping entry and receive its interrupted result instead of retrying. Review verdict: DO-NOT-MERGE.
• 🟡 (09:30) Assistant rejected V22 because of the cancellation-setup wake race and decided to make the coordinator enter interruption mode before the durable phase transition, while preserving cleanup authority and concurrent-interrupt single-flight behavior.
• 🟡 (09:31) High-priority work plan was: 1. Preserve wakes during cancellation setup—in progress; 2. Run full package validation and isolated artifact restart smoke—pending; 3. Freeze revised candidate and obtain independent correctness and security approval—pending.
• 🟡 (09:31) Assistant defined a deterministic regression for the cancellation-setup race: gate the durable cancelling write, issue a wake while the coordinator entry is still running, release cancellation setup, and require exactly one successor to run after cleanup.
• 🟡 (09:32) Chosen cancellation boundary was inside SessionRunCoordinator: mark the entry stopping first, preserve any already coalesced wake, run a new pre-interrupt effect that durably writes cancelling, then interrupt the owner and perform cleanup. This also causes concurrent run() calls to wait and retry rather than join the soon-to-be-interrupted owner.
• 🟡 (09:33) Cancellation-race implementation modified packages/core/src/session/run-coordinator.ts and packages/core/src/session/execution/local.ts.
• 🟡 (09:33) Assistant identified a required failure path: if the pre-interrupt write loses ownership, the coordinator must still interrupt and finalize the old owner rather than leave an entry permanently marked stopping. The fail-closed path was implemented in packages/core/src/session/run-coordinator.ts, with tests added in packages/core/test/session-run-coordinator.test.ts.
• 🟡 (09:34) Deterministic setup-gap regression and targeted validation covered wake preservation, resume preservation, concurrent interruption, cancellation ownership loss, queued-successor ordering, and finalizer ordering. tsgo --noEmit succeeded; one targeted test run reported 4 pass, 15 filtered out, 0 fail, 9 expect() calls across 1 file in 243.00ms; another reported 4 pass, 9 filtered out, 0 fail, 12 expect() calls across 1 file in 771.00ms.
• 🟡 (09:35) Completed V22 correctness review found a MUST-FIX interruptible claim handoff in packages/core/src/session/execution/local.ts:40-73: the execution claim commits before registration in activeClaims, while cleanup only wraps the later race at lines 90-125. An interrupt during commit-to-registration can take the fallback at lines 217-223, leaving a durable ready claim with no owner or heartbeat, blocking successors until lease expiry and potentially causing false recovery. Required fix: make acquisition, registration, and cleanup ownership one uninterruptible handoff and add a deterministic commit/registration-boundary regression.
• 🔴 (09:35) User stated recovery scans always take the oldest 100 rows in packages/core/src/session/recovery.ts:72-79.
• 🔴 (09:35) User stated recovery uses a 30-second lease and repeats every 10 seconds, referenced at packages/core/src/session/recovery.ts:547-552 and packages/core/src/session/sql.ts:253.
• 🟡 (09:35) Completed V22 correctness review found a second MUST-FIX: malformed assistant projection decoding at packages/core/src/session/recovery.ts:169-177 becomes a defect, while the outer handler at lines 316-323 only logs it and leaves recovery_error unset. With oldest-100 scanning, a 30-second lease, and 10-second repeats, 300 older corrupt rows can continually recycle and starve later valid claims. Required fix: quarantine the exact live claim under its execution and owner fence.
• 🟡 (09:35) V22 correctness review otherwise verified by inspection that Step-failure cancellation, atomic interrupted-Step rollback, cleanup joining, continuation promotion, generated contracts, and package layering matched the stated invariants. Accepted residual risks remained final check-call behavior, process-local routing, and bounded clock skew. The review performed no file changes, VCS mutations, tests, builds, or service operations and issued DO-NOT-MERGE.
• 🟡 (09:35) Assistant recognized that the existing test interrupts active execution and clears its pending wake in packages/core/test/session-run-coordinator.test.ts:218 contradicted the corrected invariant. Planned change: a wake registered before or during interruption must survive, and the test should assert exactly one successor rather than runs=1 with no active successor.
• 🟡 (09:35) Assistant rejected V22 due to the two new correctness blockers and planned deterministic regressions plus fixes at both boundaries: uninterruptible claim acquisition-to-registration and exact-fence quarantine of malformed assistant projections.
• 🟡 (09:35) Revised high-priority work plan was: 1. Preserve wakes during cancellation setup—in progress; 2. Make claim acquisition-to-registration uninterruptible—pending; 3. Quarantine malformed assistant projections under exact fence—pending; 4. Run full package validation and isolated artifact restart smoke—pending; 5. Freeze revised candidate and obtain independent correctness and security approval—pending.