Distillation

Date: Sep 17, 2026

• 🔴 (09:26) User specified that local session execution must never start a second owner while the lease is live.
• 🔴 (09:26) User specified that local session execution must never overwrite an expired lease.
• 🔴 (09:26) User specified that local session execution must never re-enter its own uncertain live lease.
• 🔴 (09:26) User specified that a heartbeat must never revive an expired claim.
• 🔴 (09:26) User specified that runner settlement must never overwrite cancellation.
• 🟡 (09:26) Local session-execution tests use SessionExecutionLocal.make(...), wake(sessionID), interrupt(sessionID), Scope.close(child, Exit.void), TestClock.adjust("10 seconds"), Deferred, and Fiber.join(...) to exercise lease ownership, expiration, heartbeat, interruption, cancellation, finalization, and settlement races. The test session ID is SessionSchema.ID.make("ses_execution_local").
• 🟡 (09:26) packages/core/test/session-projector.test.ts contains recovery-isolation tests: "quarantines a malformed recovery row without blocking a valid wake" at line 709 and "quarantines a full batch of poison recovery rows before redriving valid work" at line 763.
• 🟡 (09:26) The malformed-row recovery test corrupts the continuation "malformed-recovery-row" with UPDATE session_input SET prompt = '{}' and expects { error: "Invalid recovery continuation input" }, while allowing the valid session ses_recovery_row_valid to wake.
• 🟡 (09:26) The full poison-batch test sets poisonCount = SessionRecovery.BATCH_SIZE + 1, creates IDs ses_recovery_poison_${index.toString().padStart(3, "0")} and execution IDs poison-${index.toString().padStart(3, "0")}, corrupts rows using UPDATE session_input SET prompt = '{}' WHERE time_created < ${poisonCount}, expects the first scan to process SessionRecovery.BATCH_SIZE poison rows, subsequently wake sessions[poisonCount], and ultimately mark poisonCount rows with recovery_error = "Invalid recovery continuation input".
• 🟡 (09:26) packages/core/test/session-projector.test.ts includes "fairly redrives recovery and ordinary work beyond a full bounded batch" at line 828. It uses failedCount = SessionRecovery.BATCH_SIZE + 1, expects SessionRecovery.BATCH_SIZE * 2 first wakes, and adds SessionRecovery.BATCH_SIZE fresh recovery sessions plus SessionRecovery.BATCH_SIZE fresh ordinary sessions to verify bounded-batch fairness.
• 🟡 (09:26) Additional recovery quarantine tests in packages/core/test/session-projector.test.ts cover: a continuation belonging to another Session (line 1197, execution ID "cross-session-continuation"); an execution claim blocked by a conflicting recovery identity (line 1638); a recovery wake behind a newer assistant (line 1687); an assistant-less recovery superseded before scanner validation (line 1955); a quarantined recovery continuation not being promoted as an ordinary steer (line 2013, execution ID "quarantined-steer"); a malformed claim not blocking a valid claim (line 2069); and failed execution conversion being quarantined before later claims are scanned (line 2458).
• 🟡 (09:26) Recovery ownership race tests in packages/core/test/session-projector.test.ts require: exact recovery conflicts are never quarantined after ownership transfer (line 1866); cancellation is never quarantined after recovery ownership expires (line 2220) or transfers (line 2272); and projection failure is never quarantined after recovery ownership expires (line 2324) or transfers (line 2389). Projection-failure fixtures use SQLite SELECT RAISE(ABORT, 'poison recovery projection');.
• 🟡 (09:26) Recovery batching tests use arrays of SessionRecovery.BATCH_SIZE + 50 and SessionRecovery.BATCH_SIZE + 1; batch IDs follow ses_recovery_batch_${index.toString().padStart(3, "0")}, with expected execution IDs such as execution-${SessionRecovery.BATCH_SIZE.toString().padStart(3, "0")}.