Distillation

Date: Sep 16, 2026

• 🔴 [requested-review] (11:10) User requested a complete independent read-only correctness/adversarial review of frozen interrupted-session recovery candidate v5, covering the complete lifecycle, replay, migration, concurrency, liveness, dependency, and exactly-once safety.
• 🔴 [enforced-workflow] (11:10) User required inspection exclusively from immutable base ab9408c81cc9916177641ae8e9f08624fc27b5b9 plus /tmp/opencode/session-recovery-final-v5.patch, never from the mutable worktree.
• 🔴 (11:10) User required verification that explicit cancellation renews its exact claim throughout runner interruption, finalizers, and cleanup—even beyond the 30s lease—never permits recovery/successor duplication, and fails closed if renewal is lost.
• 🔴 (11:10) User required verification that any provider-stream failure, including a typed LLMError or defect after StepFinished, never commits Step.Ended/continue and never appends Step.Ended after Step.Failed.
• 🔴 (11:10) User required verification that unresolved hosted tools reconcile before successful Step.Ended.
• 🔴 (11:10) User required verification that assistant and assistant-less recoveries are revalidated before wake and exact promotion.
• 🔴 (11:10) User required verification that durable wake_attempts keep each scan bounded to 100 and prevent failed/no-op first-page rows from starving later Sessions across reconstructed service/process boundaries; CAS must never wake settled rows.
• 🔴 (11:10) User required verification that coordinator cleanup failure always finalizes state, starts the successor, and then propagates.
• 🔴 (11:10) User required verification that the schema snapshot prevIds directly names immutable base snapshot f14a9b18-8207-487e-a3d3-227e629ba9ad.
• 🔴 (11:10) Additional required review areas: claim fencing, compaction, pre-promotion crashes, recovery-input reservation, retry/replay/queue/steer/redrive, historical PromptAdmitted v1 compatibility, quarantine, cross-Session identity, generated API artifacts, and test relevance/fail-first evidence.
• 🔴 (11:10) User accepted only two residual risks: the documented final-instruction dispatch race and the bounded clock-skew assumption.
• 🔴 (11:10) User required applicable immutable AGENTS.md, CONTRIBUTING.md, and package scripts to be read directly because the required repo-setup skill was unavailable.
• 🟡 (11:10) Assistant acknowledged that the required repo-setup skill was unavailable and stated it would read immutable repository instructions/package scripts, verify supplied hashes, and reconstruct the candidate from the exact base plus patch in a disposable read-only review tree without touching the mutable worktree, repository state, services, or build/test tooling.