Distillation

Date: Sep 16, 2026

• 🟡 (13:40) packages/core/src/embedding/pool.ts:262-278 permits lazy pool growth only when at least one slot is healthy, the best slot has inflight > 0, this.slots.length + this.retiredWorkers.size < this.ceiling, and this.liveFreemem() can cover (unhealthy slot count + 1) * PER_WORKER_MEM_BUDGET_BYTES. An expired localEmbeddingState.initRetryAt admits one spawnSlot(true) recovery probe and resets initRetryAt to 0; ordinary spawnSlot(false) growth requires localEmbeddingState.initFailures === 0.
• 🟡 (13:40) liveFreemem() in packages/core/src/embedding/pool.ts:282-288 uses testPoolFreememBytes when set, otherwise freemem(); reads constrainedMemoryLimit() and availableMemoryHeadroom(); returns 0 when a positive constrained limit exists but headroom is undefined; otherwise calls clampFreeToContainerLimit(raw, constrained, headroom). Because availableMemoryHeadroom() independently reads constrainedMemoryLimit(), this path also samples constrained memory twice.
• 🟡 (13:40) spawnSlot() in packages/core/src/embedding/pool.ts:290-304 constructs LocalProvider with this.ceiling as the memory divisor and a callback to this.retireSlot(slot). Each worker therefore sizes its token cap from free / ceiling; the ceiling is memory-gated by desiredEmbedPoolSize so provisioned workers collectively stay within one EMBED_MEM_FRACTION share of free memory.
• 🟡 (13:41) Additional packages/core/test/cgroup-memory.test.ts:105-297 regressions: 1. inherited cgroup v2 boundaries use the tightest finite limit—child /tenant/job is unlimited at usage 600, parent /tenant has usage 900 and memory.max=1000, root has usage 1400 and memory.max=2000, producing 100 bytes headroom; 2. memory.high takes precedence before memory.max triggers reclaim—child usage 950, memory.high=1000, and memory.max=2000 produce 50; 3. all-visible limits set to "max" return undefined; 4. an unreadable inherited boundary fails closed with undefined; 5. absent cgroup v2 root control files are allowed—/system.slice/opencode.service usage 600, memory.high=1000, memory.max=2000, with an unlimited readable parent, produces 400; 6. an unreadable constrained mount root (mount root=/tenant, membership /tenant/job) fails closed with undefined; 7. membership is re-resolved on every read after a live cgroup move, changing headroom from 400 for /tenant/roomy to 50 for /tenant/tight; 8. cgroup v1 headroom treats oversized unlimited sentinel 9223372036854771712 as max, yielding 400 from child usage 600 and limit 1000.