Distillation

Date: Sep 17, 2026

• 🟡 [requested-review] (08:41) User requested a read-only exploratory audit of the CURRENT working-copy cgroup memory/headroom and embedding admission changes in /home/byk/Code/opencode-lore-embedding-runtime at Jujutsu change tmzmtlss.
• 🔴 (08:41) User required the audit to inspect packages/core/src/cgroup-memory.ts, embedding-cap.ts, memory helpers in embedding/local.ts, growth/admission in embedding/pool.ts, and relevant cgroup-memory, embedding-cap, embedding-pool, and embedding-pool-memory tests.
• 🟡 (08:41) User asked the audit to identify concrete correctness defects, fail-open states, races, over/under-counting, stale cgroup discovery, hybrid v1/v2 or multi-mount namespace mistakes, primary-worker invariant violations, invalid configuration behavior, and missing regressions.
• 🔴 [enforced-workflow] (08:41) User required verification of the current candidate rather than reliance on prior reports, exact current file:line evidence, findings ordered by severity, concise fixes/tests, and explicit identification of prior defects that are now closed.
• 🔴 [enforced-workflow] (08:41) User prohibited editing files, mutating VCS, using the network, running services, or accessing production databases during the audit.
• 🔴 (08:41) User directed that the audit must not claim final merge approval because the candidate may change.
• 🟡 (08:41) Assistant stated the required repo-setup skill was unavailable and would proceed read-only under checked-in repository instructions after loading Jujutsu guidance.
• 🔴 (08:42) Repository /home/byk/Code/opencode-lore-embedding-runtime is a colocated Jujutsu/Git repository containing both .jj/ and .git/; mutations must use jj, while Git tools are permitted only for read-only operations or unsupported functionality.
• 🔴 (08:42) User’s Jujutsu convention: never use interactive flags such as -i or --interactive; always pass -m "msg" for describe/commit operations; verify mutations with jj st and jj log; prefer stable letter-based change IDs over hexadecimal commit IDs; never rebase or describe an immutable commit.
• 🔴 (08:42) User stated Jujutsu never fails on conflict: conflicts are recorded in the resulting commit, so after rebase, new, or squash, run jj st, manually resolve conflict markers, and do not use interactive jj resolve.
• 🔴 (08:42) Jujutsu recovery conventions are jj undo, jj op log, jj op restore <op-id>, and jj workspace update-stale; bookmarks do not auto-advance, @ is empty after jj commit, jj new creates an empty change rather than committing, and :: and .. have different revision-set semantics.
• 🔴 (08:42) Project runtime is Node.js >=22.5; the root toolchain pins Node 24.16.0 and pnpm 10.28.0; the codebase is a TypeScript monorepo using pnpm workspaces.
• 🔴 (08:42) Project tests use a temporary SQLite database through packages/core/test/setup.ts, never the production DB.
• 🔴 (08:42) Project release policy: never manually bump versions or edit CHANGELOG.md; Sentry Craft handles both automatically.
• 🔴 (08:42) Release workflow commands are gh workflow run release.yml -f version=auto for conventional-commit-derived semver or gh workflow run release.yml -f version=0.23.0 for an explicit version.
• 🔴 (08:42) Release workflow order: 1. scripts/bump-version.sh updates all package.json versions, 2. changelog is generated from conventional commits, 3. a release/X.Y.Z branch is created and pushed, 4. CI tests and builds npm tarballs, standalone binaries, and delta patches, 5. Craft opens a publish issue, 6. labeling it accepted triggers npm OIDC publishing and a GitHub Release with binaries and patches.
• 🔴 (08:43) Project review policy requires every adversarial-review defect to receive a deterministic regression test in the same PR that fails on the base branch, passes on the fix, and drives the real precondition; a guard test must fail if the guard is deleted.
• 🔴 (08:43) User’s testing principle is: “Never trust the fix without seeing it fail”; bug fixes must follow failing-first TDD.
• 🔴 (08:43) Adversarial test setup must reproduce real ordering: state present before the handling operation, delete-then-recreate across lifecycle boundaries, and modify-while-off behavior.
• 🔴 (08:43) Skip and early-return branches such as NOT EXISTS, latest <> 'upsert', and content-match guards are considered the highest-risk correctness surface; each needs a regression proving it does not wrongly skip required work.
• 🔴 (08:43) Non-trivial changes require two distinct review passes: 1. adversarial/correctness review covering enumerated cases, apply-then-revert mutants, property stability ×10, hash-equivalence proofs, frozen-array mutation safety, and stale-cache analysis; 2. security/pentest review covering injection, credential leaks, protocol attacks, and privilege escalation.
• 🔴 (08:43) Reviewers must run pnpm test, pnpm run typecheck, pnpm run lint, and pnpm run format:check, verify property tests over 10 runs, hash-verify that the working tree remains unmodified, and report per-point PASS / FAIL / CONCERN / MUST-FIX verdicts with file:line evidence plus an overall MERGE / DO-NOT-MERGE verdict.
• 🔴 (08:44) @loreai/core is version 0.40.0; its typecheck script is tsc --noEmit && tsc --noEmit -p tsconfig.eval.json, and its build script is tsx script/build.ts.
• 🔴 (08:44) Embedding batching policy: use embedInTokenBatches for all embedding paths, including temporal messages, to avoid ONNX padding every input to the longest sequence and causing OOM; batch by token area with MAX_BATCH_TOKEN_AREA 4096, preserve input order, call storeTemporalChunks once, and always admit the first item so the loop progresses.
• 🔴 (08:44) Temporal embedding chunks are capped at 64: chunks 0..62 remain separate, while index 63+ is joined into one final tail so evidence is retained; an oversized tail may occupy its own batch and is truncated downstream.
• 🔴 (08:44) The 64-chunk design chose structural "\n\x1f" boundaries over splitting tool-looking text, dropping overflow, or allowing unlimited vec0 rows because tool output can mimic headers and unbounded fan-out expands storage and KNN widening.
• 🔴 (08:44) Local embedding provider policy uses lazy, container-aware pool growth rather than eagerly loading multiple ONNX workers because each model costs about 680 MB and host freemem() overstates capacity in constrained containers.
• 🔴 (08:44) Local embedding pool invariants: worker 0 remains available; extra workers require concurrent demand and clampFreeToContainerLimit(...) headroom; memDivisor shares the memory budget; upward re-probes must never reach a prior OOM ceiling.
• 🔴 (08:44) nativeIntraOpThreads uses cgroup-aware availableParallelism() only when it is below cpus().length; unconstrained hosts return undefined to preserve ONNX Runtime’s physical-core default rather than raising it to the hyper-thread count.
• 🔴 (08:44) normalEmbed uses a removable FIFO capped at 64 retained normal-embedding waiters rather than a promise-tail chain; the active owner is not counted, canceled waiters are physically removed, release transfers ownership to the oldest live waiter, normal and recall work have finite default provider deadlines, and single-text recall bypasses only FIFO admission.
• 🔴 (08:44) Embedding-pool concurrency and memory-cap fixtures requiring simultaneous provider calls must use single-text "query" embeds; unresolved "document" embeds are unsuitable because normal document work is intentionally serialized and a leaked unresolved request can contaminate later tests.
• 🔴 (08:44) embeddingStatus() must remain side-effect free and report retrying until a real embed succeeds; health checks must not report false ok before recovery.
• 🔴 (08:44) Recall-load admission counts only single-text query embeds through the shared worker predicate; write-time and backfill document embeds are excluded so backfill does not gate against itself; admission reads the live counter, and provider disappearance, OOM, timeout, or rejection must release ownership in finally.
• 🔴 (08:44) ensureEmbeddingReady must re-read provider identity after admission, propagate the readiness guard into the pool request, retire an assigned worker when the finite readiness deadline fires, and map pool cancellation to fixed readiness EmbeddingAbortError without accepting late output; retaining admission behind an unbounded stuck local-worker warmup would wedge readiness and document admission forever.