Distillation

Date: Sep 17, 2026

• 🔴 (09:09) User-provided correctness review stated that the Step.Failed projector “never settles pending or running tools” at packages/core/src/session/message-updater.ts:225-230. A provider error can publish Step.Failed while a local tool remains active, after which packages/core/src/session/runner/llm.ts:399-405 waits for that tool; if interrupted, joined finalizers let settleCancellation see a completed assistant, transition the claim to cancelled, and clear ownership at packages/core/src/session/execution/local.ts:146-149, potentially leaving a durable tool permanently running with no recovery row.
• 🔴 (09:09) User-provided review stated the existing regression at packages/core/test/session-runner.test.ts:3952-3997 follows the failed-Step cancellation path but checks only Step and claim rows, not tool state; required fix was to reconcile unresolved tools after all finalizers join and before clearing the claim, even when the Step is already failed.
• 🔴 (09:09) User-provided correctness review stated the claimed publication-failure regression “never exercises publication failure.” The test at packages/core/test/session-runner.test.ts:3906-3949 installed a trigger for session.next.tool.failed.1 at lines 3921-3927, but coordinator cleanup publishes Step.Interrupted at packages/core/src/session/execution/local.ts:151-163; therefore the trigger never fired.
• 🔴 (09:09) User-provided review required the publication-failure regression to deterministically fail session.next.step.interrupted.1 and prove that the claim remains cancelling, no successor starts, and no partial Step/tool settlement commits.
• 🔴 (09:09) User-provided review found the supplied SEA changed during review: its initial SHA-256 was d0c78e881892d4f894fab7f6be00643c133ca21f9d2c88ae0d5ff31215393021, but the final check found aa98d64abb3bf6ac0ef88a940f9c41c6eb14ffeab3c3a7846921ba01ef46643d at /home/byk/Code/opencode/packages/opencode/dist/server/opencode-server; artifact approval was therefore impossible because the reviewed binary was no longer the immutable supplied artifact.
• 🟡 (09:09) V20 review provenance verified detached base/HEAD ab9408c81cc9916177641ae8e9f08624fc27b5b9, patch SHA-256 24352107c74d8245fcba7f8571ba0be4b7fc514e6c73cfbf0498f0c25f29f9ba, exactly 34 patch sections and 34 changed paths, matching preimage/postimage blobs, successful reverse applicability and cached forward applicability, no staged changes, and successful git diff --check.
• 🟡 (09:09) V20 source review otherwise confirmed: coordinator owner and outer finalizers join before cancellation cleanup; failed interruption publication leaves the claim cancelling via transaction rollback; expired cancelled claims clear while expired cancelling claims quarantine; direct SessionRunner interruption remains unknown; ownership checks immediately precede both snapshot captures; explicit resume persists execution intent before advisory execution; recovery scans have matching indexes; and current client, legacy SDK, OpenAPI, migration, and generated schema surfaces include the new contracts.
• 🟡 (09:09) V20 review retained the disclosed final check-to-external-call window, process-local interruption, and bounded clock skew as residual risks rather than new findings; it ran no tests, builds, or services and concluded DO-NOT-MERGE.
• 🟡 (09:09) Assistant rejected v21 despite its prior freeze: artifact provenance from the completed v20 review was stale, but the two source defects remained in v21—completed failed-Step cancellation did not reconcile unresolved tools, and the publication-failure regression targeted an event cleanup never publishes.
• 🟡 (09:09) Revised work queue contained four high-priority items in order: 1. “Reconcile unresolved tools before clearing completed cancellation” (in_progress), 2. “Make interruption publication-failure regression reach real event” (pending), 3. “Run full package validation and isolated artifact restart smoke” (pending), and 4. “Freeze revised candidate and obtain independent correctness and security approval” (pending).
• 🟡 (09:09) Assistant chose a durable per-tool reconciliation rule for coordinator cleanup: publish Tool.Failed for every unresolved tool, retain phase cancelling through intermediate events, atomically set cancelled with the final tool event, then clear the claim. For an already completed failed assistant, preserve its original error and emit no duplicate Step terminal event.
• 🟡 (09:10) packages/core/src/session/execution/local.ts was updated twice to implement completed-cancellation tool reconciliation.
• 🟡 (09:10) Assistant changed the publication-defect regression to abort session.next.step.interrupted.1, the event coordinator cleanup actually publishes for an incomplete assistant. The intended fail-closed contract became: interrupt fails, claim remains cancelling, tool remains running, and no successor can acquire ownership.
• 🟡 (09:10) Assistant extended the completed-Step.Failed regression to require the active tool to become a durable error before the execution claim is removed.
• 🟡 (09:11) packages/core/test/session-runner.test.ts was updated with both revised cancellation regressions.
• 🟡 (09:11) Initial focused validation ran tsgo --noEmit and two filtered tests from packages/core/test/session-runner.test.ts. One test passed and one failed after 10 assertions: the publication-defect path correctly reached the intended event and left the claim in phase cancelling, but Bun’s toMatchObject comparison treated expected finish: undefined as mismatching an actually absent finish property.
• 🟡 (09:11) Assistant ruled out a production-path defect for the focused failure and replaced the problematic toMatchObject assertion with explicit absence-of-finish and running-tool checks.
• 🟡 (09:12) Focused rerun passed both cancellation tests: 2 pass, 108 filtered out, 0 fail, and 13 expect() calls across one file in 1485.00ms; tsgo --noEmit also passed.
• 🟡 (09:12) Complete recovery gate passed: 254 pass, 0 fail, and 779 expect() calls across 8 files in 21.42s.
• 🟡 (09:12) Assistant determined v21 reviews could not approve the revised source because source changed after the v21 freeze; planned sequence was full package validation, rebuild, isolated artifact restart smoke, v22 freeze, then fresh correctness and security reviews.
• 🟡 (09:12) A background v22 source-validation task was launched. At launch, the gate status was: Core typecheck passed, both real cancellation regressions passed, and all 254 recovery tests passed; rebuild, smoke, freeze, and fresh reviews remained pending.