Distillation

Date: Sep 14, 2026

• 🟡 (08:32) /home/byk/Code/opencode/packages/opencode/src/session/status.ts defines SessionStatus.Interface with get(sessionID), list(), and set(sessionID, status). State is an InstanceState-backed process-local Map<SessionID, Info>; absent sessions read as { type: "idle" }, list() returns a copied Map, and set() publishes Event.Status. Setting idle additionally publishes Event.Idle and deletes the map entry; non-idle status is stored. The LayerNode depends on EventV2Bridge.node.
• 🟡 (08:32) Assistant concluded that V2 does not resume active Session execution after server restart. Durable state includes unpromoted steer and queue prompts, promoted conversation history, partial assistant/tool state, completed tool settlements, and provider metadata. Non-durable state includes active drains, pending wakeups, provider-attempt ownership, whether a provider request was dispatched, whether an external side effect completed, and busy/retrying/recovery status.
• 🟡 (08:32) Assistant explained restart wake behavior: pending prompts remain dormant until a later wake; a new prompt or exact prompt retry normally provides that wake. Core has explicit resume, but the public HTTP API has no standalone resume endpoint.
• 🟡 (08:32) Assistant found durable admission precedes execution: SessionV2.prompt resolves and admits prompts in an uninterruptible region, validates exact retries, and issues only an advisory wake unless resume:false (/home/byk/Code/opencode/packages/core/src/session.ts:360-385, /home/byk/Code/opencode/packages/core/src/session/input.ts:41-80). PromptAdmitted and the session_input projection commit in the durable event transaction (/home/byk/Code/opencode/packages/core/src/session/projector.ts:362-373, /home/byk/Code/opencode/packages/core/src/event.ts:237-353), while the inbox stores admitted_seq, nullable promoted_seq, and delivery mode (/home/byk/Code/opencode/packages/core/src/session/sql.ts:140-165).
• 🟡 (08:32) Assistant cited V2 admission tests: admission before transcript visibility (/home/byk/Code/opencode/packages/core/test/session-prompt.test.ts:143-163); exact retry creates one admission (:252-269); concurrent exact retries create one event/row (:342-359); exact retry can provide a new wake (:272-289); replay reconstructs pending input but deliberately schedules no execution (:403-443).
• 🟡 (08:32) Assistant found both queued and steering prompts survive restart because pending rows are selected by promoted_seq IS NULL and delivery mode (/home/byk/Code/opencode/packages/core/src/session/input.ts:170-189). Steers promote in admission order through a captured sequence cutoff (:245-266), while queues promote one row at a time in FIFO order (:268-288). Interruption tests show durable later explicit resume for queue (/home/byk/Code/opencode/packages/core/test/session-runner.test.ts:1965-2005) and steer (:2008-2048). Conclusion: every unpromoted durable input survives, but neither mode runs automatically after restart.
• 🟡 (08:32) Assistant found execution state is process-local: SessionExecution.active reports execution “owned by this process” (/home/byk/Code/opencode/packages/core/src/session/execution.ts:9-17), and /home/byk/Code/opencode/packages/core/src/session/run-coordinator.ts:17-35 stores ownership in a plain in-memory Map containing a fiber, deferred result, pendingWake, and stopping. A wake mutates that local entry or starts an in-process fiber (:37-64, :81-92); closing the scope interrupts execution and clears the registry, as tested in /home/byk/Code/opencode/packages/core/test/session-run-coordinator.test.ts:122-138.
• 🟡 (08:32) Assistant found server startup creates a fresh local coordinator without a startup scan (/home/byk/Code/opencode/packages/core/src/session/execution/local.ts:10-44, /home/byk/Code/opencode/packages/server/src/routes.ts:26-52, /home/byk/Code/opencode/packages/opencode/src/server/routes/instance/httpapi/server.ts:298-303). Activity non-durability is documented in /home/byk/Code/opencode/specs/v2/session.md:29-33 and /home/byk/Code/opencode/CONTEXT.md:176-177. /home/byk/Code/opencode/packages/core/src/session/sql.ts:22-66 has no execution-status, attempt-identity, lease, or heartbeat fields, and /home/byk/Code/opencode/packages/core/src/session/runner/llm.ts:49-55,80-86 marks durable status and clustered ownership as unfinished.
• 🟡 (08:32) Assistant distinguished wake from resume: a non-forced wake drains durable inbox work and exits when neither pending mode exists, while forced explicit resume may make a fresh provider call without new pending input (/home/byk/Code/opencode/packages/core/src/session/runner/llm.ts:390-413). resume does not continue a known interrupted attempt; it starts a fresh runner attempt from current projected history. The public protocol exposes prompt wake semantics (/home/byk/Code/opencode/packages/protocol/src/groups/session.ts:205-223) and interruption (:345-357) but not standalone resume.
• 🟡 (08:32) Assistant analyzed provider-call guarantees: within one in-memory runner Step attempt, one request is built and llm.stream(request) is called once (/home/byk/Code/opencode/packages/core/src/session/runner/llm.ts:173-239); continuation reloads projected history before the next request (:179-221, :390-413); concurrent same-process resumes join one active drain (/home/byk/Code/opencode/packages/core/src/session/run-coordinator.ts:67-79), covered by /home/byk/Code/opencode/packages/core/test/session-runner.test.ts:1836-1871.
• 🟡 (08:32) Assistant found no durable provider-attempt record distinguishes 1. request prepared, 2. request dispatched, 3. response partially received, and 4. response settled; this is deferred in /home/byk/Code/opencode/specs/v2/todo.md:56-74 and /home/byk/Code/opencode/specs/v2/session.md:101-109. A crash after dispatch but before durable output leaves an unknown outcome; forced resume may send another provider request; partial durable output does not prove remote completion; and no durable idempotency key or provider-result reconciliation prevents duplicate billing or hosted side effects.
• 🟡 (08:32) Assistant noted that one llm.stream invocation does not imply one network request because transport execution retries retryable failures up to twice (/home/byk/Code/opencode/packages/llm/src/route/executor.ts:35-38,345-379). Overall guarantee is single-process coalescing, not exactly-once provider execution.
• 🟡 (08:32) Assistant found strong write-ahead ordering for local tools: durable Tool.Called is published before execution (/home/byk/Code/opencode/packages/core/src/session/runner/publish-llm-event.ts:313-335), and only afterward does settlement launch (/home/byk/Code/opencode/packages/core/src/session/runner/llm.ts:249-278). /home/byk/Code/opencode/packages/core/test/session-runner.test.ts:1687-1745 observes all tools durably running while execution is blocked; completed and failed settlements are durable events defined in /home/byk/Code/opencode/packages/schema/src/session-event.ts:312-372.
• 🟡 (08:32) Assistant found later runs convert every projected pending/running tool to an interrupted failure (/home/byk/Code/opencode/packages/core/src/session/runner/llm.ts:119-139) before new provider work (:394-398). Coverage includes local running tools (/home/byk/Code/opencode/packages/core/test/session-runner.test.ts:2262-2320), provider-hosted running tools (:2322-2380), and incomplete tool input (:2382-2418). Recorded old local calls are not silently re-executed; the model sees their interrupted state as error output.
• 🟡 (08:32) Assistant identified the local tool ambiguity window as Tool.Called committed → side effect starts or completes → process dies before Tool.Success/Tool.Failed commits. Recovery marks the call failed but cannot determine whether the side effect occurred, roll it back, or reconcile it; a later model Step may repeat the operation and duplicate the semantic side effect. /home/byk/Code/opencode/packages/core/src/file-mutation.ts:198-207 states this gap directly.
• 🟡 (08:32) Assistant found provider-hosted tools have a larger ambiguity window because the provider may execute them before OpenCode receives and persists Tool.Called. Provider metadata helps continuation after a recorded settlement but does not prove exactly-once execution; relevant replay lowering is /home/byk/Code/opencode/packages/core/src/session/runner/to-llm-message.ts:70-112, with coverage in /home/byk/Code/opencode/packages/core/test/session-runner.test.ts:1632-1684.
• 🟡 (08:32) Assistant identified a restart-recovery test gap: no test 1. starts a real V2 server, 2. dispatches provider or tool work, 3. terminates that server, 4. starts a fresh server against the same database, and 5. verifies automatic recovery. Existing tests instead synthesize prior-process tool projections and manually call session.resume; coordinator scope-close tests establish loss of active ownership, not startup recovery.
• 🟡 (08:32) Assistant compared legacy v1: its runners and status are also in-memory and cleared with instance scope (/home/byk/Code/opencode/packages/opencode/src/session/run-state.ts:35-49, /home/byk/Code/opencode/packages/opencode/src/session/status.ts:26-48).
• 🟡 (08:32) Assistant proposed 8 ordered V2 concepts to port to legacy v1: 1. Durable inbox before execution — accept a stable message ID, commit input, then issue an advisory wake; 2. Atomic promotion — mark inbox input consumed and append its visible user message in one transaction; 3. Exact admission retry — repeated IDs reconcile only the same Session, payload, and delivery contract; 4. Process-local drain coordinator — join same-Session resumes and coalesce wakes without pretending the drain is durable; 5. Write-ahead tool calls — persist call identity and normalized input before local side effects; 6. Explicit unknown outcomes — classify abandoned provider attempts and tools as unknown after restart and never retry blindly; 7. Recovery facts, not a durable “run” wrapper — add durable provider-attempt prepared/dispatched/settled facts, retry budget, and explicit retry/abandon decisions without inventing a durable drain identity; 8. Startup discovery and fencing — scan recoverable facts at startup and, when multiple hosts share storage, add leases and stale-owner fencing before automatic execution.
• 🟡 (08:32) Assistant’s final safety conclusion: V2 durably queues work and records progress, but restart continuation is deliberately unimplemented. It avoids automatic replay of recorded local tool calls yet cannot guarantee exactly-once provider calls or exactly-once external side effects.