Distillation

Date: Sep 16, 2026

• 🔴 (22:10) User required recovery-accounting overflow to route synchronously through fixed recall failure, preserve only previously validated accounting, and never convert failure into completion.
• 🔴 (22:10) User required native-load, OOM, and corruption failures to be classified narrowly from the leading error string so unrelated missing files are never misclassified.
• 🔴 [requested-fail-first-evidence] (22:10) User stated they never accept a fix without fail-first evidence: every proposed bug regression must fail on the base revision and pass with the fix.
• 🔴 (22:10) User required RECALL_FAILURE_WARNING never to be the sole successful answer; it may only accompany genuine model-generated output.
• 🔴 (22:10) User directed recovery output to be “Never empty/context-warning/progress-only.”
• 🟡 (22:11) Tests in packages/gateway/test/codex-usage-metadata.test.ts were changed to import MAX_CODEX_RATE_LIMIT_BYTES and MAX_CODEX_RATE_LIMIT_EVENTS from ../src/codex-rate-limits instead of duplicating local constants.
• 🟡 (22:11) packages/gateway/test/codex-usage-metadata.test.ts added maximalQuota(index), producing maximum-sized canonical codex.rate_limits metadata with 64-character plan_type, metered_limit_name, and limit_name; primary/secondary limits use window_minutes: 5_256_000, reset_at up to 253_402_300_799, and credits use balance "999999999999999999999999.999999999999".
• 🟡 (22:11) The buffered quota regression now proves the canonical input exceeds MAX_CODEX_RATE_LIMIT_BYTES, emitted metadata stays at or below that byte limit, fewer than MAX_CODEX_RATE_LIMIT_EVENTS fit, and retained events are the exact input prefix.
• 🟡 (22:11) packages/gateway/test/openai-responses-recall-aware-stream.test.ts added malformedQuotaEvent(sentinel) and regressions proving malformed non-JSON codex.rate_limits events from both principal and continuation streams are suppressed: safe answer text remains, while the private sentinel and event: codex.rate_limits do not reach output.
• 🟡 (22:11) The recall-aware stream byte-bound regression creates exactly MAX_CODEX_RATE_LIMIT_EVENTS maximal quota events, assigns the first 20 to the principal and the remainder to the continuation, verifies total canonical input exceeds MAX_CODEX_RATE_LIMIT_BYTES, then requires emitted bytes to remain within the limit, emitted count to be below MAX_CODEX_RATE_LIMIT_EVENTS, and output events to equal the canonical prefix; it also requires exactly 1 recall, exactly 1 follow-up, "Completed answer" present, and no "response.failed".
• 🟡 (22:11) The prior quota test based on 40 duplicated principal events plus 40 duplicated continuation events and an expected total of 64 emitted buckets was replaced by the stronger canonical-byte-limit test.
• 🟡 (22:11) The provided jj-guide requires using jj rather than git for mutations when .jj/ exists; forbids interactive flags; requires -m "msg" for describe/commit operations; requires checking jj st and jj log after mutations; prefers stable change IDs over commit IDs; and identifies jj undo/jj op restore <op-id> as recovery mechanisms.
• 🟡 (22:14) Change pqvltmkrxpyntnnppwzkwwqzuuyumout, commit ac80b275f2876c741a4225b9b8a28b9a055ff8ae, is titled fix(recall): harden quota metadata; author and committer are Burak Yigit Kaya <ben@byk.im>. Its displayed test diff changes 2 files with 166 insertions and 37 deletions.
• 🟡 (22:14) packages/gateway/src/codex-rate-limits.ts defines MAX_CODEX_RATE_LIMIT_EVENTS = 64 and MAX_CODEX_RATE_LIMIT_BYTES = 16 * 1024.
• 🟡 (22:14) packages/gateway/src/codex-rate-limits.ts validates quota category fields with CATEGORY = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/ and decimal-string credit balances with DECIMAL = /^(?:0|[1-9][0-9]{0,23})(?:\.[0-9]{1,12})?$/.
• 🟡 (22:14) rateLimit() accepts finite used_percent from 0 through 100, safe-integer window_minutes from 1 through 5_256_000, and safe-integer reset_at from 0 through 253_402_300_799; invalid individual fields are omitted, and an empty normalized limit is rejected.
• 🟡 (22:14) credits() accepts boolean has_credits, boolean unlimited, and a nonnegative finite numeric balance or decimal string matching DECIMAL; invalid fields are omitted, and empty normalized credits are rejected.
• 🟡 (22:14) sanitizeCodexRateLimitEvent() only accepts object values with type === "codex.rate_limits"; allowlisted output fields are plan_type, metered_limit_name, limit_name, rate_limits.primary, rate_limits.secondary, and credits. Events containing no valid field beyond type are rejected.
• 🟡 (22:14) appendCodexRateLimitEvent() sanitizes before retention, suppresses an event when its canonical JSON is identical to the immediately preceding event, caps retained metadata at 64 events, and rejects additions that would make cumulative UTF-8 canonical JSON exceed 16 KiB; accepted normalized events are appended in order.
• 🟡 (22:14) sanitizeCodexRateLimitEvents(values) processes values sequentially through appendCodexRateLimitEvent(), preserving the accepted canonical prefix subject to validation, adjacent deduplication, event-count, and byte limits.