Distillation

Date: Sep 15, 2026

• 🟡 (20:14) Inspection of /home/byk/Code/opencode/packages/core/test/database-migration.test.ts:169-236 showed upgrades populated recovery ownership tables to the final schema: after applying sessionRecoveryMigration, sessionExecutionMigration, and sessionExecutionPhaseMigration, then inserting execution "execution" and its recovery row, sessionRecoveryFencingMigration preserves session, session_message, and session_input rows but clears both session_execution and session_recovery.
• 🟡 (20:14) The final recovery schema migration test expects session_execution.id to be required, session_input.wake_pending to default to "false", and session_recovery.execution_id to be a required primary key. It also expects session_recovery.assistant_message_id and recovery_error to be nullable, phase to be required, and insertion of execution phase "invalid" to fail.
• 🟡 (20:14) /home/byk/Code/opencode/packages/core/test/database-migration.test.ts:238-247 verifies a non-empty database containing table unrelated but no session table is rejected with "Database is not empty and has no session table".
• 🟡 (20:15) Additional migration coverage in /home/byk/Code/opencode/packages/core/test/database-migration.test.ts includes: defaulting a missing legacy workspace name to "" while preserving branch: "main", directory: "/repo", and extra: "{}"; mapping legacy Drizzle timestamp Date.UTC(2026, 3, 10, 17, 45, 13) to migration ID "20260410174513_workspace-name"; rejecting unknown timestamp 1234567890000 with "does not match any known migration"; serializing two concurrent Database.layerFromPath(filename) initializations; and on Linux running bun .../script/migration.ts --check, requiring exit code 0 and "No schema changes, nothing to migrate".
• 🟡 (20:15) Empty-database migration coverage expects tables session, session_input, and session_context_epoch; confirms transitional session_context_epoch columns agent, replacement_seq, and revision are absent; expects exactly migrations.length migration rows; and verifies generated indexes including event_aggregate_seq_idx, event_aggregate_type_seq_idx, session_input_session_admitted_seq_idx, session_input_session_pending_delivery_seq_idx, session_input_session_promoted_seq_idx, session_message_session_seq_idx, session_message_session_time_created_id_idx, and session_message_session_type_seq_idx.
• 🟡 (20:15) Inspection of /home/byk/Code/opencode/packages/core/src/session/input.ts:23-37 showed fromRow() reconstructs Admitted with admittedSeq, id, sessionID, decoded prompt, delivery, timeCreated, and optional promotedSeq; find() selects by SessionInputTable.id and returns undefined when absent.
• 🟡 (20:15) Inspection of /home/byk/Code/opencode/packages/core/src/session/compaction.ts:182-257 showed compactAfterOverflow() only proceeds with a positive model context, selects entries using config.tokens, incorporates a previous compaction’s summary and recent content, caps summary output at SUMMARY_OUTPUT_TOKENS, and refuses compaction when the estimated summary prompt exceeds context - summaryOutput.
• 🟡 (20:15) Automatic compaction publishes SessionEvent.Compaction.Started before streaming, calls optional beforeStream, sends one user summary prompt with no tools and generation.maxTokens: summaryOutput, accumulates LLMEvent text deltas, and returns false on LLM.Error, a provider-error event, failed streaming, or blank output. Successful output publishes SessionEvent.Compaction.Ended with the generated text, selected.recent, reason: "auto", and { commit: input.commit }.
• 🟡 (20:15) compactIfNeeded() returns false when config.auto is disabled or context is non-positive; it compacts only when estimated system/messages/tools usage exceeds context - Math.max(output, config.buffer), where output comes from input.request.generation?.maxTokens, then model output limits, then 0.
• 🔴 [required-lease-invariant] (20:16) User established the requirement: "never starts a second owner while the lease is live".
• 🟡 (20:16) The live-lease test in /home/byk/Code/opencode/packages/core/test/session-execution-local.test.ts:82-103 starts a first owner whose run never completes, calls second.resume(sessionID), and expects secondRuns to remain 0 with exactly 1 execution claim.
• 🔴 [required-lease-invariant] (20:16) User established the requirement: "never overwrites an expired lease".
• 🟡 (20:16) The expired-lease overwrite test manually changes the first active owner’s SessionExecutionTable.expires_at to 0, invokes a second owner’s resume(sessionID), and expects secondRuns === 0 while retaining the stale claim’s exact id and owner_id.
• 🔴 [required-lease-invariant] (20:16) User established the requirement: "never re-enters its own uncertain live lease".
• 🟡 (20:16) The uncertain-lease test changes the running claim’s phase to "unknown" and dies with "simulated failure"; a second resume(sessionID) does not rerun it, leaving runs === 1 and exactly 1 claim.
• 🟡 (20:16) Heartbeat coverage in /home/byk/Code/opencode/packages/core/test/session-execution-local.test.ts:163-183 verifies expiry is renewed from the current clock: initial expires_at is 30_000, then becomes 40_000 after 10 seconds and 50_000 after another 10 seconds.
• 🔴 [required-lease-invariant] (20:16) User established the requirement: "never revives an expired claim on heartbeat".
• 🟡 (20:16) The expired-heartbeat test starts a live execution, manually sets expires_at: 0, advances TestClock by 10 seconds, and expects the claim’s expiry to remain exactly 0.
• 🟡 (20:16) Other SessionExecutionLocal lifecycle coverage verifies: successful drain clears the claim; scope closure preserves an in-flight claim; explicit interruption clears it; and a pending successor starts only after cancellation finalization settles. In the finalizer-ordering test, the first run blocks in a finalizer until releaseFinalizer, the queued wake then starts the successor, total runs is exactly 2, and claims end empty.
• 🔴 [required-recovery-invariant] (20:16) User established the requirement: "never recovers a live execution lease".
• 🟡 (20:16) Inspection of /home/byk/Code/opencode/packages/core/test/session-projector.test.ts:1102-1175 showed expiry/reconciliation/takeover fencing: stale execution "stale-execution" owned by "stale-owner" is expired in phase "unknown"; recovery reconciles it, successor "successor-execution" owned by "successor-owner" is inserted live in phase "ready", and the paused stale owner’s later SessionExecutionClaim.update() fails before any side effect or SessionEvent.Synthetic publication. sideEffects remains 0, event count is unchanged, and the successor claim remains.
• 🟡 (20:16) /home/byk/Code/opencode/packages/schema/src/session-event.ts defines SessionEvent.Step.Interrupted as "session.next.step.interrupted" with assistantMessageID and error; SessionEvent.Step.Recovered as "session.next.step.recovered" with executionID, optional assistantMessageID, and phase restricted to "ready" | "unknown" | "continue"; and documents text deltas as live-only while Text.Ended is the replayable full-value boundary.
• 🟡 (20:17) Inspection of /home/byk/Code/opencode/packages/core/src/event.ts:118-148 showed PublishOptions.commit is a local operational projection committed atomically with a new durable event and is neither replayed nor serialized. EventV2.Interface.replay() and replayAll() accept ownership controls { ownerID?: string, strictOwner?: boolean }; the service also exposes claim(aggregateID, ownerID).