Distillation

Date: Sep 16, 2026

• 🟡 (16:21) Inspected /home/byk/.local/share/opencode/repos/github.com/Effect-TS/effect-smol/packages/effect/src/Effect.ts:2066-2081: Effect.andThen supports both function and effect arguments in pipeable and uncurried forms; its example doubles 100, applies a 5 discount, and outputs 190.
• 🟡 (16:24) Review inputs identified patch /tmp/opencode/session-recovery-final-v8.patch with SHA-256 446412b56ac31b2a60f98765b5f14955a771f6074ebeb9309f603a0ceefad1bc, SEA /home/byk/Code/opencode/packages/opencode/dist/server/opencode-server with SHA-256 f4f0bd585d33bd47114b2d8d54082c2b061380771c808e909223350e62c8c72f, and HEAD ab9408c81cc9916177641ae8e9f08624fc27b5b9.
• 🟡 (16:24) Frozen-tree status contained exactly 33 changed paths: modified packages/core/schema.json, packages/core/src/database/migration.gen.ts, packages/core/src/database/schema.gen.ts, packages/core/src/session.ts, packages/core/src/session/compaction.ts, packages/core/src/session/context-epoch.ts, packages/core/src/session/execution/local.ts, packages/core/src/session/input.ts, packages/core/src/session/message-updater.ts, packages/core/src/session/projector.ts, packages/core/src/session/run-coordinator.ts, packages/core/src/session/runner/index.ts, packages/core/src/session/runner/llm.ts, packages/core/src/session/runner/publish-llm-event.ts, packages/core/src/session/sql.ts, packages/core/test/database-migration.test.ts, packages/core/test/session-projector.test.ts, packages/core/test/session-prompt.test.ts, packages/core/test/session-run-coordinator.test.ts, packages/core/test/session-runner-recorded.test.ts, packages/core/test/session-runner-tool-events.test.ts, packages/core/test/session-runner.test.ts, packages/opencode/src/server/routes/instance/httpapi/server.ts, packages/schema/src/session-event.ts, packages/schema/test/event-manifest.test.ts, packages/sdk/js/src/v2/gen/types.gen.ts, packages/sdk/openapi.json, and packages/server/src/routes.ts; untracked packages/core/src/database/migration/20260914170650_session-recovery.ts, packages/core/src/session/execution/claim.ts, packages/core/src/session/recovery-id.ts, packages/core/src/session/recovery.ts, and packages/core/test/session-execution-local.test.ts.
• 🟡 (16:27) MUST-FIX 1 found a cross-Session recovery collision: session_recovery.execution_id is globally unique in packages/core/src/session/sql.ts:204 and migration line 38, but packages/core/src/session/projector.ts:403-414 checks existing recovery by both execution and Session IDs. A corrupt Session-B row using execution ID E can collide with Session A’s deterministic continuation created at projector.ts:433-441; .onConflictDoNothing() at projector.ts:442-455 silently ignores the recovery-row conflict while committing the event and clearing A’s claim.
• 🟡 (16:27) Cross-Session collision impact: Session A’s continuation lacks a session_recovery row, so isRecoveryInput returns false at packages/core/src/session/input.ts:434-445, public exact retry can arm it through input.ts:62-67 and 112-161, and ordinary queue promotion includes it through the left join at input.ts:539-558. This violates the same-Session, internal-only continuation boundary under corrupt-row and forged-identity threats.
• 🟡 (16:27) Recommended cross-Session collision fix: query execution IDs globally, reject a mismatched existing identity, require the recovery insert to affect exactly one row rather than silently accepting conflicts, and add a regression with a malformed Session-B recovery sharing Session A’s execution ID.
• 🟡 (16:27) MUST-FIX 2 found cancellation-renewal failure can permit recovery while stale finalizers remain active: explicit interruption starts a heartbeat but discards its fiber at packages/core/src/session/execution/local.ts:110-114, then waits for the runner and all finalizers before clearing ownership at execution/local.ts:115-131 and packages/core/src/session/run-coordinator.ts:107-108.
• 🟡 (16:27) Cancellation race mechanism: if the heartbeat loses ownership or dies during a slow finalizer, no code observes the failure; after lease expiry, another node can acquire at packages/core/src/session/recovery.ts:81-96, reconcile, and start successor execution while the stale runner’s finalizer remains active. The eventual clear detects ownership loss only after overlap has occurred.
• 🟡 (16:27) Existing cancellation tests cover a healthy heartbeat and late cleanup failure but do not prevent actual recovery/provider/tool work after heartbeat loss. Recommended alternatives: supervise and join renewal, or clear fenced ownership before cancellation cleanup. Required regression: a takeover test proving successor provider and tool effects never begin while the old finalizer is blocked.
• 🟡 (16:27) MUST-FIX 3 found failed conversion quarantine can silently no-op and permanently starve later claims: after Step recovery projection fails, packages/core/src/session/recovery.ts:184-198 performs quarantine with an unexpired-lease predicate but ignores the affected-row count.
• 🟡 (16:27) Quarantine starvation mechanism: if projection or database contention extends beyond lease expiry, the update changes zero rows without raising an error and leaves the claim eligible. Because claim scans repeatedly select the oldest 100 rows at recovery.ts:69-75, 100 such rows can permanently starve claim 101.
• 🟡 (16:27) Recommended poison-claim handling alternatives: quarantine the exact currently owned claim successfully, transfer responsibility to a confirmed successor, or durably advance scanning past the failed row. Required regression: conversion crosses lease expiry before failing.
• 🟡 (16:27) CONCERN found assistant-start state mutates before durable publication: startAssistant assigns assistantMessageID and assistantActive before Step.Started commits at packages/core/src/session/runner/publish-llm-event.ts:87-105. Failed publication leaves in-memory state claiming an assistant started; the durable claim remains unknown, preventing physical-provider replay, but publication ordering is violated. Recommended fix: assign both fields only after publishEvent succeeds and add a failure-injection test.
• 🟡 (16:27) PASS — immutable inputs: patch SHA-256 446412b56ac31b2a60f98765b5f14955a771f6074ebeb9309f603a0ceefad1bc; SEA SHA-256 f4f0bd585d33bd47114b2d8d54082c2b061380771c808e909223350e62c8c72f.
• 🟡 (16:27) PASS — frozen tree: HEAD exactly ab9408c81cc9916177641ae8e9f08624fc27b5b9; reverse-application checks succeeded; in-memory reconstruction reported EXACT_DELTA_OK base=HEAD changed_paths=33; final status still listed exactly those 33 paths.
• 🟡 (16:27) PASS — ordinary ownership acquisition: packages/core/src/session/execution/local.ts:29-45 uses insert-only acquisition and never overwrites or re-enters a live or expired claim.
• 🟡 (16:27) PASS — recovery acquisition: packages/core/src/session/recovery.ts:81-97 requires exact Session, execution, former owner, expired lease, and null recovery error.
• 🟡 (16:27) PASS — normal claim fencing: packages/core/src/session/execution/claim.ts:25-31 and 38-62 fence update and clear by exact Session, execution, owner, and strictly unexpired lease.
• 🟡 (16:27) PASS — wake reservations: recovery and ordinary reservations change the counter before waking and use compare-and-set predicates at packages/core/src/session/recovery.ts:311-324 and 394-425; maximum counter values rotate to 1, avoiding numeric saturation.
• 🟡 (16:27) PASS — scanner bounds: execution claims, recovery wakes, and ordinary wakes are each capped at 100 rows; fresh work reserves capacity while one retry always advances.
• 🟡 (16:27) PASS — stream settlement: empty streams create no assistant; started but unsettled assistants receive durable Step.Interrupted at packages/core/src/session/runner/llm.ts:434-444.
• 🟡 (16:27) PASS — tool publication failure: tool-settlement flags change only after publication; failed Tool.Success remains unsettled, receives durable failure reconciliation, or leaves an unknown execution claim; physical local tools are never replayed.
• 🟡 (16:27) PASS — Step ending: a failed stream returns before Step.Ended; hosted tools are reconciled and local fibers settle before Step.Ended at packages/core/src/session/runner/llm.ts:395-475.
• 🟡 (16:27) PASS — recovery validation: packages/core/src/session/input.ts:321-397 checks canonical continuation ID, same-Session input, queue delivery, exact prompt, assistant relationship, newest assistant, phase, and synthetic identity.
• 🟡 (16:27) PASS — prompt-intent replay: missing historical requestExecution defaults to false at packages/core/src/session/projector.ts:371-383; exact retries add one deterministic PromptExecutionRequested event only after identity equivalence succeeds at packages/core/src/session/input.ts:62-67 and 112-161.
• 🟡 (16:27) PASS — schema and layering: incremental and full schemas use the same named bounded wake-attempt constraints; Schema remains browser-safe; Core depends on Schema; Server depends on Core and Protocol.
• 🟡 (16:27) PASS — accepted residual: provider dispatch is preceded by renewal at packages/core/src/session/runner/llm.ts:304; local tools are renewed immediately before settlement at runner/llm.ts:323-335. The documented pause after renewal remains; uncertain outcomes stay unknown and are never physically replayed.
• 🟡 (16:27) PASS — wall-clock assumption: the lease/skew condition is documented at packages/core/src/session/execution/claim.ts:33-36.
• 🟡 (16:27) Review inspected all 33 changed files but did not build, run tests, execute the SEA, or modify any file, ref, index, service, artifact, or database. The required repo-setup skill was unavailable, so applicable AGENTS.md, CONTRIBUTING.md, and package manifests were read directly.
• 🟡 (16:27) Final review verdict: DO-NOT-MERGE.