Distillation

Date: Sep 17, 2026

• 🔴 (00:11) Frozen-v17 correctness review independently verified base ab9408c81cc9916177641ae8e9f08624fc27b5b9, patch SHA-256 0eb85245c71fb55fa2a8e169a1cd1de5579059d77aaca30b6ac254482e255a2e, SEA SHA-256 308e9e562a3473b66bac430166db9d6cdd29f5f071d5695c1c35f28b99f26bf4, exactly 34 paths, matching base/postimage blobs, and successful reverse-apply validation; all 34 paths were inspected read-only.
• 🔴 (00:11) V17 correctness review found a merge-blocking post-commit/pre-return race: failAssistant in packages/core/src/session/runner/publish-llm-event.ts:222-240 set assistantFailed only after events.publish(...) returned, while packages/core/src/event.ts:237-363,379-390 durably committed Step.Failed before interruptible notification completed. Cancellation during that notification could leave durable Step.Failed with assistantFailed=false, causing packages/core/src/session/runner/llm.ts:429-443 to publish duplicate Step.Interrupted.
• 🔴 [requested-regression] (00:11) V17 correctness review required a gated-listener or equivalent deterministic regression that pauses between durable Step.Failed commit and publish() return; terminal-state selection must use state established at the durable commit boundary. Existing regression at packages/core/test/session-runner.test.ts:3965-3976 only polled for the committed event and did not hold publication in that window. Verdict: DO-NOT-MERGE.
• 🔴 (00:11) V17 correctness review passed exact ownership and phase fencing, runner/finalizer cleanup ordering, recovery takeover and supersession checks, commit-time revalidation, quarantine, bounded scanning, ordinary-input isolation, synchronized migration/runtime/generated schemas and event/OpenAPI/SDK contracts, and dependency/authentication boundaries. It specifically asserted expired claims never renew in packages/core/src/session/execution/claim.ts:27-109.
• 🔴 (00:11) V17 correctness review retained accepted residuals: lease safety depends on bounded wall-clock skew; owner loss during cancellation is quarantined rather than automatically resumed; supplied tests and smoke evidence were not rerun because the review was read-only.
• 🟡 (00:11) Assistant diagnosed the v17 blocker as a commit-to-return publication window rather than an ownership flaw and chose to replace cancellation’s in-memory assistantFailed decision with durable projected terminal state after interruption, plus a deterministic publication-notification gate.
• 🔴 (00:12) packages/core/src/session/message-updater.ts:23-35 establishes that a newer turn supersedes stale incomplete rows and must “never resume an older assistant projection”; getCurrentAssistant() selects only the latest assistant and returns it only when incomplete.
• 🟡 (00:13) Assistant determined that session_message already stores terminal assistant state in the same event transaction. The chosen fix makes cancellation, after tool reconciliation, read the claimed assistant projection and settle ownership directly if any terminal Step has committed; this covers Step.Failed, Step.Ended, or Step.Interrupted committed before notification interruption. The lagging in-memory flag was removed from cancellation decisions in packages/core/src/session/runner/llm.ts and packages/core/src/session/runner/publish-llm-event.ts.
• 🟡 (00:14) Initial durable-projection implementation failed tsgo --noEmit in src/session/runner/llm.ts:452: SessionMessageData lacked property type (TS2339), assistant was possibly undefined (TS18048), and the union’s time could lack completed (TS2339). The query’s union narrowing was then corrected in packages/core/src/session/runner/llm.ts.
• 🔴 (00:14) Frozen-v17 security review independently verified base ab9408c81cc9916177641ae8e9f08624fc27b5b9, patch SHA-256 0eb85245c71fb55fa2a8e169a1cd1de5579059d77aaca30b6ac254482e255a2e, SEA SHA-256 308e9e562a3473b66bac430166db9d6cdd29f5f071d5695c1c35f28b99f26bf4, exactly 34 paths, matching blobs and all hunks, while excluding unrelated .lore.md, AGENTS.md, and perf.data* worktree changes. It performed no mutations, tests, builds, or service operations.
• 🔴 (00:14) V17 security review independently found the same merge blocker and six-step race: 1. local tool remains active; 2. Step.Failed commits; 3. publication blocks or is interrupted during notification; 4. assistantFailed=true never executes; 5. tool reconciliation completes; 6. cancellation sees false and publishes Step.Interrupted. It required a listener blocked after observing Step.Failed, followed by interruption and assertions of exactly one Step.Failed, no Step.Interrupted, no claim, and no recovery. Verdict: DO-NOT-MERGE.
• 🔴 (00:14) V17 security review raised an operational resource-exhaustion concern: persistent recovery placement/start failures remain eligible every 10 seconds forever; counters reach Number.MAX_SAFE_INTEGER then rotate to 1; each pass can schedule up to 100 recovery wakes plus 100 ordinary wakes without global concurrency control or backoff. It classified this as operational rather than an authorization bypass.
• 🔴 (00:14) V17 security review passed exact Session/execution/owner/unexpired-lease fencing, monotonic cancellation transitions, renewal that changes only expiry and cannot revive expired claims, durable fences around provider dispatch/stream publication/local-tool startup/context mutation/continuation commits, finalizer-aware cleanup, recovery identity and stale-race rejection, deterministic continuation instead of physical abandoned-tool replay, durable execution intent before explicit resume, synchronized schemas/contracts/clients, retained authentication middleware, and runtime dependency direction. Accepted residuals remained final check-to-call races, process-local coordination, and wall-clock skew.
• 🔴 (00:15) Existing regression at packages/core/test/session-runner.test.ts:805 asserts the invariant never starts a local tool after ownership changes; it transfers SessionExecutionTable ownership when SessionEvent.Tool.Called is observed, then verifies executions remains empty and no Tool Success or Tool Failed event is emitted.
• 🟡 (00:15) Deterministic failed-Step cancellation regression in packages/core/test/session-runner.test.ts was revised to use EventV2.listen, whose callback executes after the durable event transaction commits but before publish() returns. The callback blocks notification for Step.Failed; interruption occurs at that exact boundary; the test proves cancellation consults durable assistant completion, emits no second terminal event, removes the exact claim, and leaves no SessionRecoveryTable row.
• 🟡 (00:16) Final ordering-fix typecheck and targeted regressions passed: tsgo --noEmit succeeded; targeted run had 3 pass, 106 filtered out, 0 fail, and 14 expect() calls across one file in 2.47s.
• 🟡 (00:16) Complete recovery-focused suite passed after the ordering fix: 229 pass, 0 fail, and 685 expect() calls across 7 files in 18.70s.