Distillation

Date: Sep 16, 2026

• 🔴 (10:17) User asserted the session recovery invariant: “never promotes a recovery superseded before scanner validation”.
• 🔴 (10:17) User asserted the session recovery invariant: “never promotes a quarantined recovery continuation as an ordinary steer”.
• 🟡 (10:17) Search of packages/core/test/session-projector.test.ts found 14 recovery-continuation references, including tests that record a recovery continuation without forging an assistant identity, quarantine cross-session or otherwise invalid continuations with recovery_error: "Invalid recovery continuation input", and quarantine a recovery wake behind a newer assistant.
• 🟡 (10:17) packages/core/test/session-projector.test.ts:835-945 tests the input-commit/recovery-boundary race and expects no residual rows in SessionInputTable; packages/core/test/session-projector.test.ts:1064 covers scanner validation after supersession; packages/core/test/session-projector.test.ts:1128 covers preventing a quarantined recovery continuation from being promoted as an ordinary "steer".
• 🔴 (10:18) User asserted the execution invariant: “never commits continuation before unresolved hosted tools are reconciled”.
• 🟡 (10:18) packages/core/test/session-runner.test.ts:598-664 verifies SessionRecovery.recover() redrives only the synthetic recovery continuation: queued unrelated input msg_recovery_unrelated remains unpromoted with promoted_seq: null; the provider receives ["Session execution interrupted by server restart", "continue"]; SessionRecoveryTable.wake_pending becomes and remains false after projection replay; later ordinary work "ordinary work after replayed recovery" can be resumed normally.
• 🟡 (10:18) packages/core/test/session-runner.test.ts:667-691 verifies promoting ordinary input clears durable execution intent by changing its SessionInputTable.wake_pending from true to false.
• 🟡 (10:18) packages/core/test/session-runner.test.ts:1954-2003 tests unresolved hosted-tool reconciliation using local tool call-local (echo, input { text: "mixed-local" }) and provider-executed hosted tool call-hosted-pending (web_search, input { query: "pending" }). SQLite trigger fail_hosted_tool_reconciliation aborts insertion of event type session.next.tool.failed.1 with "crash before hosted tool reconciliation"; the resume fails, SessionExecutionTable.phase remains "unknown", the hosted tool remains "running", and no session.next.step.ended.1 event is committed.
• 🟡 (10:18) packages/core/test/session-runner.test.ts:2006-2068 verifies recovery of a continuation atomically committed with a settled tool step: prompt "Recover settled tool continuation" invokes call-recovery via echo with { text: "settled" }; after a simulated crash when execution reaches phase "continue", the completed tool remains in context; expiring the claim and running SessionRecovery.recover() produces provider user texts ["Recover settled tool continuation", "continue"], executes "settled" exactly once, preserves the first two context messages, and leaves exactly 1 row in SessionRecoveryTable.
• 🟡 (10:18) packages/core/test/session-runner.test.ts additionally includes recovery/hosted-tool coverage for: automatic compaction remaining unknown until SessionEvent.Compaction.Ended commits; recovery of a continuation committed with Compaction.Ended; persistence of a second context overflow after one recovery; publication of the original overflow when recovery summarization fails; interruption while the summary provider runs; replaying durable provider-executed tool results inline on a second turn; durably failing hosted tools left running by a prior process; and durably failing hosted tools on provider error, normal provider EOF, or raw provider-stream failure.
• 🟡 (10:18) packages/core/test/session-execution-local.test.ts defines SessionExecutionLocal lease behavior: 1. successful drain clears the claim; 2. scope closure preserves the claim; 3. explicit interruption clears the claim; 4. a second owner never starts while the lease is live; 5. a second owner never overwrites an expired lease; 6. an owner never re-enters its own uncertain live lease; 7. heartbeat renewal uses the current clock; 8. heartbeat never revives an expired claim; 9. cancellation settles before a pending successor starts.
• 🟡 (10:18) Heartbeat coverage in packages/core/test/session-execution-local.test.ts:159-197 expects lease expiry values of exactly 30_000, 40_000, and 50_000 as TestClock advances twice by "10 seconds"; manually setting expires_at: 0 prevents heartbeat revival.
• 🟡 (10:18) Successor-ordering coverage in packages/core/test/session-execution-local.test.ts:200-237 blocks the first run’s finalizer, queues another wake during interruption, releases the finalizer, then expects exactly 2 runs and no remaining execution claims.