Distillation

Date: Sep 15, 2026

• 🔴 (01:39) User specified the session-execution invariant: “never starts a second owner while the lease is live.”
• 🔴 (01:39) User specified the session-execution invariant: “never re-enters its own uncertain live lease.”
• 🔴 (01:39) User specified the recovery invariant: “never recovers a live execution lease.”
• 🔴 (01:39) User specified the recovery invariant: “never recovers an execution superseded by a newer assistant.”
• 🟡 (01:39) Tests added in packages/core/test/session-execution.test.ts include exact cases never starts a second owner while the lease is live and never re-enters its own uncertain live lease.
• 🟡 (01:39) Tests added in packages/core/test/session-projector.test.ts include exact cases never recovers a live execution lease and never recovers an execution superseded by a newer assistant.
• 🟡 (01:39) Migration file introduced at packages/core/src/database/migration/20260914235657_session-execution-lease.ts.
• 🟡 (01:40) packages/core/src/session/execution/local.ts creates a process-level ownerID with crypto.randomUUID() and computes leaseDuration using Duration.toMillis(SESSION_EXECUTION_LEASE_MS).
• 🟡 (01:40) packages/core/src/session/execution/local.ts function clear(sessionID, executionID?) deletes only SessionExecutionTable rows matching both session_id and the current process’s owner_id, optionally also matching id; database errors are converted to defects with Effect.orDie.
• 🟡 (01:40) packages/core/src/session/execution/local.ts function renew(executionID) updates expires_at only when both execution id and owner_id match; failure to return a claim dies with exact message Session execution claim lost: ${executionID}.
• 🟡 (01:40) packages/core/src/session/execution/local.ts acquires a session claim by inserting a generated execution ID with phase: "ready", assistant_message_id initially absent, time_created: Date.now(), and expires_at: Date.now() + leaseDuration.
• 🟡 (01:40) On SessionExecutionTable.session_id conflict, packages/core/src/session/execution/local.ts replaces the execution only if either: (1) the row belongs to the same ownerID and its phase is "ready" or "safe", or (2) its expires_at is earlier than Date.now(). Replacement resets phase: "ready" and assistant_message_id: null.
• 🟡 (01:40) If session claim acquisition returns no row, SessionRunCoordinator’s drain returns without invoking input.run, preventing another live owner from starting.
• 🟡 (01:40) After claiming, packages/core/src/session/execution/local.ts races input.run(sessionID, force, executionID) against lease renewal repeated with Schedule.spaced("10 seconds").
• 🟡 (01:40) packages/core/src/session/execution/local.ts logs non-interruption drain failures as Failed to drain Session with sessionID; interruption-only causes are not logged.
• 🟡 (01:40) packages/core/src/session/execution/local.ts clears the exact execution claim only on successful drain exit; unsuccessful or interrupted execution leaves the claim for lease-based handling.
• 🟡 (01:40) SessionExecution.Service in packages/core/src/session/execution/local.ts exposes active, resume, and wake through SessionRunCoordinator; interrupt(sessionID) interrupts the coordinator and then clears claims for that session owned by the current ownerID.
• 🟡 (01:40) The packages/core/src/session/execution/local.ts layer loads the session through SessionStore.Service, dies with exact message Session not found: ${sessionID} if absent, and invokes runner.run({ sessionID, force, executionID }) under locations.get(session.location).
• 🟡 (01:40) packages/core/src/session/recovery.ts selects only expired execution claims using lt(SessionExecutionTable.expires_at, Date.now()).
• 🟡 (01:40) For each expired claim, packages/core/src/session/recovery.ts queries the latest assistant message for that session by filtering type = "assistant" and ordering SessionMessageTable.seq descending.
• 🟡 (01:40) Recovery deletes an expired claim without publishing recovery when claim.phase === "safe" or when claim.assistant_message_id !== null and the latest assistant message ID differs from the claimed assistant message ID; the delete rechecks that the lease remains expired.
• 🟡 (01:40) For recoverable claims, packages/core/src/session/recovery.ts publishes SessionEvent.Step.Recovered with sessionID, timestamp, executionID, recoveryMessageID, optional assistantMessageID, continuationMessageID, and the claim’s phase.
• 🟡 (01:40) Recovery reuses the claimed latest assistant message ID as recoveryMessageID when available; otherwise it creates a new SessionMessage.ID. It always creates a new continuationMessageID.
• 🟡 (01:40) The recovery event commit atomically deletes the execution claim only if id, session_id, phase, expired expires_at, and the nullable/non-null assistant_message_id still match; a changed claim dies with exact message Recovery execution claim changed: ${claim.id}.
• 🟡 (01:40) Duplicate recovery publication defects are treated as already recovered when SessionRecoveryTable contains a row matching both session_id and execution_id; other defects are rethrown.
• 🟡 (01:40) After newly publishing a recovery event, packages/core/src/session/recovery.ts calls execution.wake(claim.session_id); an already-recorded duplicate does not trigger that wake path.
• 🟡 (01:40) The session-recovery node runs recover() repeatedly with Schedule.spaced("10 seconds"), logs failures as Failed to recover Sessions, forks the process scoped, and depends on Database.node, EventV2.node, SessionProjector.node, and SessionExecution.node.
• 🟢 (01:40) Attempt to access /home/byk/Code/opencode/packages/core/src/event/index.ts returned File not found.