Distillation

Date: Sep 17, 2026

• 🟡 (09:08) /tmp/opencode/session-recovery-v21-review/packages/core/src/session/context-epoch.ts defines claim-fenced context-epoch initialization and preparation. initialize() delegates to initializeOnce(); prepare() delegates to prepareOnce(); both receive a SessionExecutionClaim.Claim.
• 🟡 (09:08) SessionContextEpoch.prepareOnce() concurrently loads the current SystemContext.SystemContext, stored SessionContextEpochTable row, and SessionHistory.latestCompaction(db, sessionID) with { concurrency: "unbounded" }. With no stored epoch, it calls SystemContext.initialize(value), inserts the generation, and returns { baseline, baselineSeq }.
• 🟡 (09:08) For an existing context epoch, prepareOnce() decodes stored.snapshot through Schema.decodeUnknownEffect(SystemContext.Snapshot) and maps failure to ContextSnapshotDecodeError({ sessionID, details: String(error) }). A completed compaction newer than stored.baseline_seq supplies replacementSeq; this selects SystemContext.replace(value, snapshot) rather than SystemContext.reconcile(value, snapshot).
• 🟡 (09:08) prepareOnce() handles context results as follows: Unchanged and ReplacementBlocked retain stored.baseline and stored.baseline_seq; ReplacementReady writes a replacement baseline using replacementSeq or EventV2.latestSequence(db, sessionID); an incremental update publishes SessionEvent.ContextUpdated with a new SessionMessage.ID, current timestamp, and result.text, and its commit callback calls advance(db, sessionID, result.snapshot, claim).pipe(Effect.orDie).
• 🟡 (09:08) Context-epoch writes in /tmp/opencode/session-recovery-v21-review/packages/core/src/session/context-epoch.ts are fenced by SessionExecutionClaim.transaction(): insert() stores session_id, baseline, snapshot, and baseline_seq; replace() updates all baseline fields; advance() updates only snapshot. replace() and advance() die with "Context Epoch not found" if their update returns no row. reset() directly deletes the session’s epoch row.
• 🟡 (09:09) /tmp/opencode/session-recovery-v21-review/packages/core/src/session/event.ts re-exports both named exports and the SessionEvent namespace from @opencode-ai/schema/session-event.
• 🟡 (09:09) /tmp/opencode/session-recovery-v21-review/packages/schema/src/session-event.ts defines Compaction.Ended as durable event type "session.next.compaction.ended" with messageID, reason, text, and recent. Compaction.Delta is present in Definitions but omitted from DurableDefinitions; Compaction.Started and Compaction.Ended are in both inventories.
• 🟡 (09:09) Server wiring diff changes packages/opencode/src/server/routes/instance/httpapi/server.ts from AppNodeBuilderV1.build(SessionV2.node, ...) to AppNodeBuilderV1.build(LayerNode.group([SessionV2.node, SessionRecovery.node]), ...), while retaining dependencies [LocationServiceMap.node, locationServiceMapV2] and [SessionExecution.node, SessionExecutionLocal.node]; this adds session recovery to the instance HTTP API application graph.
• 🔴 (09:09) User directed that clustered session execution must never start a second owner while the lease is live.
• 🔴 (09:09) User directed that clustered session execution must never overwrite an expired lease.
• 🔴 (09:09) User directed that an owner must never re-enter its own uncertain live lease.
• 🔴 (09:09) User directed that heartbeat handling must never revive an expired claim.
• 🔴 (09:09) User directed that runner settlement must never overwrite cancellation.
• 🟡 (09:09) SessionExecutionLocal tests use sessionID = SessionSchema.ID.make("ses_execution_local") and cover the ownership invariants "never starts a second owner while the lease is live", "never overwrites an expired lease", "never re-enters its own uncertain live lease", "never revives an expired claim on heartbeat", and "never lets runner settlement overwrite cancellation".
• 🟡 (09:10) packages/core/test/session-run-coordinator.test.ts adds "finalizes interruption when cleanup dies": the first run is interrupted with cleanup that waits on cleanupGate and then dies with new Error("cleanup defect"); a wake registered during cleanup must still start the second run, the interruption exit must contain a defect, coordinator.active must end empty, and runs must equal 2.
• 🟡 (09:10) packages/core/test/session-run-coordinator.test.ts adds "joins concurrent interruption behind one cleanup barrier": two concurrent interrupt("session", ...) calls must share the first cleanup barrier, keep both interrupt callers pending until cleanupGate opens, execute cleanup exactly once (cleanups === 1), and then run exactly one queued follow-up (runs === 2).
• 🟡 (09:10) Existing SessionRunCoordinator interruption tests shown verify: interrupting while idle is a no-op; interrupting active execution clears its pending wake and leaves active empty; a wake registered during cleanup runs afterward; a forced run() registered during cleanup resumes with force sequence [false, true]; a wake racing with failure starts one follow-up; interrupting a joined waiter does not cancel the underlying execution; and different keys execute concurrently.
• 🟡 (09:10) packages/core/test/session-run-coordinator.test.ts includes "trampolines synchronous self-waking execution" with limit = 20_000, exercising stack-safe repeated synchronous wake behavior.
• 🟡 (09:10) Search results in /tmp/opencode/session-recovery-v21-review/packages/core/test/session-runner.test.ts show recovery and ownership-fencing coverage. Recovery tests include "redrives only the synthetic recovery continuation", "redrives an ordinary prompt after its advisory wake is lost", "recovers the continuation committed with Compaction.Ended", and durable wake_pending state checks in SessionRecoveryTable and SessionInputTable.
• 🟡 (09:10) packages/core/test/session-runner.test.ts ownership tests include "never dispatches a provider after ownership changes", "never publishes streamed output after ownership changes", "never starts a local tool after ownership changes", and "never fails interrupted tools after ownership changes". The fenced local-tool fixture uses call ID "call-fenced", tool "echo", input { text: "must not run" }, and successor claim values including id: "tool-successor", owner_id: "successor", and expires_at: 60_000.
• 🟡 (09:10) Additional packages/core/test/session-runner.test.ts coverage found includes global application-tool advertisement/execution for "application_context" with query "hello" and structured result { answer: "HELLO" }; graceful failure for an undecodable stored snapshot { invalid: { value: "bad" } }; direct baseline rebuilding after completed compaction; automatic compaction into a completed summary plus retained recent turn; and keeping automatic compaction ownership phase "unknown" until Compaction.Ended commits.
• 🟡 (09:10) The compaction-recovery fixture in packages/core/test/session-runner.test.ts uses summary "## Objective\n- Preserve recovery", deliberately dies with "crash after Compaction.Ended" when execution phase is "continue", expects SessionExecutionTable.phase to remain "continue", then switches to recoveryModel and continues with streamed text "Continued".