Distillation

Date: Sep 16, 2026

• 🟡 (10:10) Audit task status changed: 1. Frozen base/patch hash/SEA hash/33-file scope/applicability verification completed; 2. Repository/package instruction review completed; 3. Disposable exact base+patch inspection tree construction and fingerprinting completed; 4. Audit of all 33 files and end-to-end recovery security invariants remained in progress; 5. Severity-ordered findings and exact verdict remained pending.
• 🟡 (10:10) Assistant applied the patch cleanly to an archive of exactly commit ab9408c81cc9916177641ae8e9f08624fc27b5b9 only inside disposable tree /tmp/opencode/session-recovery-review-c2c8afb0, which contained no VCS metadata.
• 🟡 (10:10) Assistant’s audit sequence was to trace the production state machine first, then cross-check every generated artifact and test file for claimed security invariants and missing adversarial coverage.
• 🔴 (10:10) User requires that an expired session execution claim never renew itself.
• 🔴 (10:10) User-provided packages/core/src/session/execution/claim.ts specifies wall-clock leases: the lease interval must exceed the deployment’s maximum clock skew plus one renewal interval, and execution IDs immediately fence a node after takeover.
• 🟡 (10:10) In packages/core/src/session/execution/claim.ts, claim ownership is fenced by session_id, execution id, owner_id, and expires_at > now; SessionExecutionClaim.update() renews to now + SESSION_EXECUTION_LEASE_MS only when all predicates match and dies with SessionExecutionClaim.Lost otherwise. SessionExecutionClaim.clear() uses the same live-claim predicates, while transaction() performs update(db, claim) before the supplied effect in an immediate database transaction.
• 🟡 (10:10) In packages/core/src/session/execution/local.ts, each local executor receives a random ownerID; each drain creates a random executionID, inserts one SessionExecutionTable row with phase "ready" and expiry now + SESSION_EXECUTION_LEASE_MS, and aborts if onConflictDoNothing() does not return a claim. Active claims are tracked by sessionID.
• 🟡 (10:10) packages/core/src/session/execution/local.ts races input.run(claim, force, recovery?.continuationMessageID) against repeated SessionExecutionClaim.update(db, claim) heartbeats scheduled every leaseDuration / 3. On successful exit it clears the claim; on non-interrupt failure it clears only when the stored phase is neither "unknown" nor "continue". interrupt(sessionID) clears the active claim and suppresses only SessionExecutionClaim.Lost.
• 🟡 (10:10) Recovery selection in packages/core/src/session/execution/local.ts chooses the earliest SessionRecoveryTable row for the session where wake_pending = true and recovery_error IS NULL, ordered by time_created then execution_id, and passes its continuation_message_id to the runner.
• 🟡 (10:10) packages/core/src/session/run-coordinator.ts serializes execution per key while allowing different keys concurrently. run() starts with force = true when idle or joins active work; wake() coalesces one follow-up using pendingWake; successful settlement launches a successor when pending; and interrupt() marks the entry stopping, clears the existing pending wake, interrupts its owner, runs cleanup, then starts work that arrived during stopping.
• 🟡 (10:10) packages/core/src/session/input.ts excludes recovery continuation inputs from ordinary promotion: promoteSteers() and promoteNextQueued() left-join SessionRecoveryTable on continuation_message_id and require SessionRecoveryTable.execution_id IS NULL.
• 🟡 (10:10) SessionInput.promoteExact() in packages/core/src/session/input.ts requires the exact message ID, matching session ID, unpromoted state, and "queue" delivery. A missing row dies with Pending recovery input not found: ${messageID}. If publishing raises RecoveryConflict, it stores recovery_error = defect.reason only for the matching execution where wake_pending = true and recovery_error IS NULL, then re-dies with the conflict.