Distillation

Date: Sep 15, 2026

• 🟡 (16:52) Code review finding, Critical — rewritten migration leaves existing databases incompatible: /home/byk/Code/opencode/packages/core/src/database/migration/20260914170650_session-recovery.ts:5-48 folds wake_pending, session_execution, execution phases, leases, and recovery-outbox fields into the already tracked migration ID 20260914170650_session-recovery; the dirty diff deletes packages/core/src/database/migration/20260914214636_session-execution.ts and packages/core/src/database/migration/20260914222526_session-execution-phase.ts; /home/byk/Code/opencode/packages/core/src/database/migration.gen.ts:41-44 now lists only the rewritten earlier migration; /home/byk/Code/opencode/packages/core/src/database/migration.ts:96-103 skips migration IDs already recorded in the journal.
• 🟡 (16:52) Critical migration failure sequence: 1. A database applies predecessor migrations and records 20260914170650_session-recovery; 2. the current worktree starts against it; 3. migration application skips the rewritten migration as complete; 4. the database lacks at least session_input.wake_pending, session_execution.expires_at, session_execution.recovery_error, and session_recovery.wake_pending; 5. prompt admission can fail at /home/byk/Code/opencode/packages/core/src/session/input.ts:102-114, or execution acquisition can fail at /home/byk/Code/opencode/packages/core/src/session/execution/local.ts:31-44.
• 🟡 (16:52) Migration coverage gap: /home/byk/Code/opencode/packages/core/test/database-migration.test.ts:166-201 tests a handcrafted pre-recovery schema with no completed migration record rather than upgrading the exact preceding committed schema. The generated fresh schema matches the current Drizzle schema, but exact-predecessor upgrades do not.
• 🟡 (16:52) Code review finding, High — a crash after a successful Step can discard a required continuation: a local tool marks the Step as needing continuation at /home/byk/Code/opencode/packages/core/src/session/runner/llm.ts:307-313; Step.Ended atomically changes execution phase to safe at llm.ts:403-430; the continuation requirement exists only in the local return value and loop state at llm.ts:437-438 and 518-524; recovery clears a safe claim without creating durable continuation work at /home/byk/Code/opencode/packages/core/src/session/recovery.ts:88-94.
• 🟡 (16:52) Post-Step crash failure sequence: 1. Model invokes a local tool; 2. tool result becomes durable; 3. Step.Ended commits and changes the claim to safe; 4. process crashes before the outer loop starts the next Step; 5. recovery clears the expired safe claim; 6. no input or outbox row requests the required Step, leaving the Session idle with an unanswered tool result.
• 🟡 (16:52) Code review finding, High — compaction has the same lost-continuation window: compaction commits safe at /home/byk/Code/opencode/packages/core/src/session/runner/llm.ts:262-273 and 356-371, before the process-local next-Step transition at llm.ts:470-492; a crash after the summary commits but before that transition loses the post-compaction response. The compaction-fencing test at /home/byk/Code/opencode/packages/core/test/session-runner.test.ts:1448-1492 changes ownership before Compaction.Ended commits and does not exercise the post-commit crash window.
• 🟡 (16:52) Code review finding, High — projection replay reconstructs a settled recovery outbox as pending and can permanently block the Session: Step.Recovered projection creates the continuation and sets session_recovery.wake_pending=true at /home/byk/Code/opencode/packages/core/src/session/projector.ts:392-435; live promotion clears the flag only via the local event commit at /home/byk/Code/opencode/packages/core/src/session/runner/llm.ts:206-223; local commits are explicitly excluded from replay at /home/byk/Code/opencode/packages/core/src/event.ts:118-124; the Prompted projector marks input promoted but does not settle its recovery row at /home/byk/Code/opencode/packages/core/src/session/projector.ts:357-369; drains prioritize pending recovery rows at /home/byk/Code/opencode/packages/core/src/session/execution/local.ts:48-57; promoteExact dies when the continuation is already promoted at /home/byk/Code/opencode/packages/core/src/session/input.ts:341-362.
• 🟡 (16:52) Replay/outbox failure sequence: 1. Recovery emits Step.Recovered, and its continuation is promoted normally; 2. a projection rebuild replays Step.Recovered followed by historical Prompted; 3. replay restores session_recovery.wake_pending=true, while Prompted leaves it true; 4. recovery scanner wakes the Session; 5. runner tries to promote the already-promoted continuation and dies; 6. stale outbox remains pending, causing every later drain to repeat the failure and preventing ordinary inputs because recovery work has priority. /home/byk/Code/opencode/packages/core/test/session-projector.test.ts:144-165 replays only through Step.Recovered, not a later continuation Prompted.
• 🟡 (16:52) Code review finding, High — user-declined tools leave an unknown claim that recovery later resumes automatically: tool dispatch changes phase to unknown at /home/byk/Code/opencode/packages/core/src/session/runner/llm.ts:314-343; step-finish marks the assistant inactive at /home/byk/Code/opencode/packages/core/src/session/runner/publish-llm-event.ts:441-445; on decline, the runner records unsettled-tool failure, skips failAssistant when inactive, and self-interrupts at llm.ts:378-385; local execution preserves interrupted claims except through the explicit cleanup path at /home/byk/Code/opencode/packages/core/src/session/execution/local.ts:67-88; recovery turns an expired unknown claim into queued continue work at /home/byk/Code/opencode/packages/core/src/session/recovery.ts:88-109.
• 🟡 (16:52) Declined-tool failure sequence: 1. Provider emits a tool call and step-finish; 2. user declines permission; 3. runner self-interrupts and leaves the claim unknown; 4. after lease expiry, recovery treats the Step as interrupted and admits continue; 5. Session resumes despite the user’s decision to stop it. /home/byk/Code/opencode/packages/core/test/session-runner.test.ts:3106-3147 checks the immediate interruption and projected messages only, without inspecting the retained claim, advancing beyond lease expiry, or running recovery.
• 🟡 (16:52) Code review finding, Medium — a rejected conflicting retry can arm the original admit-only prompt for execution: for an existing input, SessionInput.admit invokes requestWake before checking equivalence at /home/byk/Code/opencode/packages/core/src/session/input.ts:52-55; requestWake sets the original row’s wake_pending=true at input.ts:98-115; the outer API detects mismatched content only afterward at /home/byk/Code/opencode/packages/core/src/session.ts:367-383; the conflict test at /home/byk/Code/opencode/packages/core/test/session-prompt.test.ts:339-360 uses resume:false for the conflicting call and therefore avoids the faulty branch.
• 🟡 (16:52) Conflicting-retry failure sequence: 1. Prompt P, ID M, is admitted with resume:false; 2. caller retries ID M with different content and default resume behavior; 3. requestWake makes original prompt P pending; 4. API returns PromptConflictError; 5. ordinary recovery scanning at /home/byk/Code/opencode/packages/core/src/session/recovery.ts:166-185 later executes P, although its only execution request arose from the rejected conflicting operation.
• 🟡 (16:52) Code review finding, Medium — recovery-row relationships permit cross-Session poison rows, and bounded scans do not quarantine them: /home/byk/Code/opencode/packages/core/src/session/sql.ts:176-199 defines recovery references as independent foreign keys by global ID, with no constraint requiring assistant and continuation rows to belong to session_id; /home/byk/Code/opencode/packages/core/src/database/migration/20260914170650_session-recovery.ts:25-36 has the same shape; recovery checks only deterministic continuation ID at /home/byk/Code/opencode/packages/core/src/session/recovery.ts:138-164, not the input’s Session, and never settles invalid rows; promoteExact enforces Session identity at /home/byk/Code/opencode/packages/core/src/session/input.ts:348-361; pending recovery scans are limited to 100 rows at recovery.ts:138-148.
• 🟡 (16:52) Cross-Session poison-row failure sequence: 1. Recovery row for Session A points to a correctly named continuation input stored under Session B; 2. all declared foreign keys and deterministic-ID validation pass; 3. recovery wakes A; 4. promoteExact rejects the continuation because it belongs to B; 5. recovery row remains pending and blocks every drain for A; 6. if the first 100 ordered recovery rows are malformed or poisoned, every scan repeatedly selects them and valid later rows are never redriven.
• 🟡 (16:52) Poison-row coverage gaps: /home/byk/Code/opencode/packages/core/test/session-projector.test.ts:400-445 tests event-time assistant validation rather than persisted recovery-row integrity; session-projector.test.ts:499-541 tests a batch containing only valid safe execution claims, not poisoned recovery-outbox rows.
• 🟡 (16:52) Review checks that held: lease renewal at /home/byk/Code/opencode/packages/core/src/session/execution/claim.ts:25-52 uses the current Effect clock and never renews an expired claim; ordinary acquisition at /home/byk/Code/opencode/packages/core/src/session/execution/local.ts:29-45 replaces neither live nor expired claims; recovery takeover at /home/byk/Code/opencode/packages/core/src/session/recovery.ts:42-58 compare-and-swaps on execution ID, Session ID, old owner, expiry, and quarantine state.
• 🟡 (16:52) Additional checks that held: provider, tool, event, promotion, and Context Epoch boundaries generally use the claim fence; newest-assistant supersession is checked both before publication and inside projection at /home/byk/Code/opencode/packages/core/src/session/recovery.ts:80-94 and /home/byk/Code/opencode/packages/core/src/session/projector.ts:397-413; malformed phases are isolated per row and quarantined, although the affected Session remains deliberately unusable.
• 🟡 (16:52) End-to-end fencing coverage gap: no test pauses a real stale runner, expires its lease, performs actual recovery/takeover, resumes the stale fiber, and jointly asserts provider, tool, publication, promotion, and context boundaries; current tests split those conditions or directly rewrite claim IDs.
• 🟡 (16:52) Effect API review result: Effect v4 Effect.repeat, scoped background-loop, and scheduling usage matched the inspected Effect source; no Effect API misuse was found in the reviewed slice.
• 🟡 (16:52) Review methodology: required repo-setup skill was unavailable, so the assistant directly inspected applicable AGENTS.md, CONTRIBUTING.md, package manifests, current source, tests, generated schema, migration registry, and dirty diff. The assistant did not run tests or builds, edit files, or touch services.