Distillation

Date: Sep 15, 2026

• 🔴 (16:25) User asserted the recovery path never recovers a live execution lease.
• 🔴 (16:25) User asserted the recovery path never recovers an execution superseded by a newer assistant.
• 🔴 (16:25) User asserted the Context Epoch never advances after execution ownership changes.
• 🟡 (16:25) packages/core/src/session/context-epoch.ts was changed so SessionContextEpoch.initialize() and SessionContextEpoch.prepare() accept a SessionExecutionClaim.Claim; the claim is propagated through initializeOnce() and prepareOnce() to fence Context Epoch writes.
• 🟡 (16:25) packages/core/test/session-projector.test.ts added ownership-fencing regressions, including "never recovers a live execution lease", "never recovers an execution superseded by a newer assistant", and "never advances the Context Epoch after ownership changes".
• 🟡 (16:25) Initial focused run of test/session-projector.test.ts had exactly 21 passing and 1 failing test with 67 expect() calls across 22 tests in 2.14 seconds. Failure: "rolls back claim renewal when Context Epoch advance fails" expected expiresAt: 60_000 but received expiresAt: 30_000 at packages/core/test/session-projector.test.ts:779.
• 🟡 (16:26) The rollback regression in packages/core/test/session-projector.test.ts was corrected to capture the pre-operation lease as leaseBefore and compare the final SessionExecutionTable.expires_at value against it rather than hard-coding 60_000.
• 🟡 (16:27) Focused test/session-projector.test.ts run passed exactly 22 tests with 0 failures and 67 expect() calls in 2.27 seconds.
• 🟡 (16:27) Assistant explained that the takeover regression reaches the real SessionContextEpoch.prepare() path and verifies stale ownership cannot change the Context Epoch snapshot.
• 🟡 (16:27) Assistant explained that the transaction-boundary regression forces a real Context Epoch update to fail and verifies claim renewal rolls back with the failed update.
• 🟡 (16:27) A preliminary mutation run after restoring the original split-statement behavior still passed exactly 22 tests with 0 failures and 67 expect() calls in 2.39 seconds, revealing that the rollback regression did not yet make lease renewal observably change the expiry.
• 🟡 (16:28) Investigation searched for existing TestClock usage and found 12 matches: packages/core/test/session-execution-local.test.ts lines 3, 173, 176, and 197; packages/core/test/tool-webfetch.test.ts line 276; packages/core/test/integration.test.ts line 282; and packages/core/test/system-context/builtins.test.ts lines 60, 82, 86, 98, 102, and 109.
• 🟡 (16:28) packages/core/test/session-projector.test.ts was updated to advance test time before the forced Context Epoch failure, making a leaked claim renewal observable.
• 🟡 (16:28) Mutation check against the original split implementation failed as intended: "rolls back claim renewal when Context Epoch advance fails" expected the unchanged expiresAt: 30_000 but received expiresAt: 31_000; run result was exactly 21 passing, 1 failing, and 67 expect() calls across 22 tests in 1.78 seconds. This demonstrated that claim renewal persisted when performed outside the failed Context Epoch transaction.
• 🟡 (16:28) Restored the transactional fix in packages/core/src/session/context-epoch.ts after the mutation check.
• 🟡 (16:29) Final focused Bun 1.3.14 (0d9b296a) run across test/session-projector.test.ts and test/session-runner.test.ts completed with exactly 117 passing, 0 failing, and 354 expect() calls across 2 files in 11.89 seconds.
• 🟡 (16:29) tsgo --noEmit completed without reported errors.
• 🟡 (16:29) Final working-tree changes were limited to packages/core/src/session/context-epoch.ts and packages/core/test/session-projector.test.ts.
• 🟡 (16:29) Final implementation in packages/core/src/session/context-epoch.ts places claim renewal and the Context Epoch snapshot update inside one immediate SessionExecutionClaim.transaction(...), fixing the durable check-then-write gap where renewal could commit even if the epoch update failed.
• 🟡 (16:29) Final tests in packages/core/test/session-projector.test.ts include: 1. a deterministic takeover regression through the real SessionContextEpoch.prepare() path; 2. a rollback regression proving a failed epoch update also rolls back claim renewal; 3. a mutation check that fails under the original split implementation.
• 🟡 (16:29) Adjacent audit reported no equivalent durable gaps: Context Epoch insert and replace already use SessionExecutionClaim.transaction; event publication, prompt promotion, recovery wake settlement, and execution-state changes run inside EventV2’s immediate transaction; recovery claim changes use fenced single statements or transactional event commits.
• 🟡 (16:29) Validation reported from packages/core: bun test --printConsoleTrace test/session-projector.test.ts test/session-runner.test.ts passed 117 tests with 0 failures and 354 assertions; bun typecheck passed; git diff --check passed.
• 🟡 (16:29) No full test suite, build, live service operation, or commit occurred.
• 🟡 (16:29) Remaining documented risk: external provider and tool calls retain an instruction-level race after their immediate ownership check; the adjacent audit found no remaining durable claim-guarded check-then-write gap.