Distillation

Date: Sep 16, 2026

• 🔴 (12:29) User stated native ONNX Runtime has no fixed memory wall, so a cgroup OOM-killer can SIGKILL the process and the ×0.7 OOM backoff never fires; the WASM path self-limits against its fixed 4 GiB heap.
• 🔴 (12:29) User stated clampFreeToContainerLimit() is monotonic: it can only lower the free-memory figure, never raise it, and therefore never increases memory use.
• 🔴 (12:29) User stated validNativeBinding() in packages/core/src/ort-native.ts:150-172 checks only 4 magic bytes and never checks file size or CPU architecture.
• 🔴 (12:29) User stated log.info always writes to the persistent log via packages/core/src/log.ts:464-470.
• 🔴 (12:29) User stated a native load failure from a source/core worker without WASM siblings must emit exactly 1 terminal init error and never request a WASM respawn.
• 🟡 (12:29) Native-fallback audit verdict was MUST-FIX, with 3 release blockers: 1. weak native-binary validation, 2. a false WASM retry when no WASM artifact exists, and 3. raw native-loader text entering persistent logs.
• 🟡 (12:29) Native validation finding: malformed files with valid magic bytes can pass validNativeBinding(); packages/core/test/ort-native.test.ts:35-44,169-175 codifies this weakness by accepting 4-byte “native” files. Missing regressions were valid-magic truncated files and wrong-CPU headers for every target.
• 🟡 (12:29) Native loader-error classification finding: packages/core/src/embedding-worker.ts:135-145,231-240 classifies only err.message using incomplete text patterns and discards structured ERR_DLOPEN_FAILED. Standard Windows messages such as not a valid Win32 application and DLL initialization routine failed return false, causing initialization retries and eventual unavailable-state latching instead of WASM fallback. Missing regressions were structured loader error codes and real Windows/macOS loader messages.
• 🟡 (12:29) False-respawn root cause: usedNativeBinding only means WASM paths were not set (packages/core/src/embedding-worker.ts:410-416), so the catch can emit init-needs-wasm even when bundled WASM does not exist (packages/core/src/embedding-worker.ts:231-240). forceWasm does nothing in dev/core mode (packages/core/src/embedding-worker-types.ts:484-490), and the core build ships no WASM siblings (packages/core/script/build.ts:88-95); the parent consequently performs 1 misleading “WASM” respawn in packages/core/src/embedding/local.ts:754-778 that loads native again.
• 🟡 (12:29) Persistent-log leakage root cause: the worker sends raw native-loader exception text from packages/core/src/embedding-worker.ts:232-239, and the parent interpolates it into log.info at packages/core/src/embedding/local.ts:768-771. Loader errors can contain absolute paths or hostile path-derived free-form text/newlines. Required regression: pass a path/newline-bearing loader error through fallback and assert the sink receives only a fixed categorical message.
• 🟡 (12:29) Artifact/PnP audit concern: the freshness gate checks only index.cjs and index.bun.js, not the worker or WASM artifacts later exercised by packages/gateway/test/bundle-exports.test.ts:114-123,185-413; ESM worker tests run under Node rather than Bun. Hoisting and ordinary symlinks are covered, but Yarn PnP/unplugged and final packed-tarball installation are not tested.
• 🟡 (12:29) Native audit verified package hoisting, package identity/version/OS/CPU checks, libc fail-closed behavior, and realpath containment as sound in packages/core/src/ort-native.ts:206-285.
• 🟡 (12:29) Focused native-audit tests passed: exactly 4 files and 118 tests with --printConsoleTrace.
• 🟡 (12:29) Read-only probes passed for Node CJS, Node ESM, and actual Bun ESM artifacts: native selection emitted exactly 1 fallback request, while forceWasm caused 0 native loads.
• 🟡 (12:29) Audit did not rebuild the stale bundle because rebuilding would modify dist/.
• 🟡 (12:29) Jujutsu recorded concurrent snapshots during the audit and moved @ from 27ba2e5f to e6d0f1ed; only pool/cgroup files differed, while all audited resolver, worker, and bundle-test hashes remained unchanged.
• 🟡 (12:29) The repo-setup skill was unavailable during the audit, so the audit followed AGENTS.md, quality/REVIEW.md, and package manifests directly.
• 🟡 (12:29) Assistant began adding boundary-level regressions for weak native-binary validation, source/core false WASM respawn, and persistent leakage of raw loader text, with the planned implementation change of narrowing fallback signaling to a fixed categorical event.
• 🟡 (12:30) Current isNativeOrtLoadError(msg) in packages/core/src/embedding-worker.ts:135-145 requires both a native-runtime identifier—onnxruntime_binding.node, an ONNX Runtime .so/.dylib/.dll, or OrtGetApiBase—and one of several textual loader-failure patterns, including ERR_DLOPEN_FAILED, invalid ELF/Mach-O/Win32, file too short, missing shared object/image/module, undefined/missing symbol, or dlopen.
• 🟡 (12:30) Current ensurePipeline() behavior in packages/core/src/embedding-worker.ts:227-345: a non-vendored worker using native that encounters a classified native loader failure logs the raw message, posts { type: "init-needs-wasm", error: msg }, sets wasmRespawnRequested=true, and later throws embedding worker awaiting WASM respawn; final failures instead post { type: "init-error", error: initError }.
• 🟡 (12:30) loadPipeline() detects an npm bundle only when sibling files ort-wasm-simd-threaded.mjs and ort-wasm-simd-threaded.wasm both exist. In that mode, forceWasm skips resolveNativeOrtBindingPath(__filename) and sets globalThis.__LORE_NPM_WASM_PATHS__; otherwise a resolved native path sets globalThis.__LORE_ORT_BINDING_PATH__.
• 🟡 (12:31) InitNeedsWasm in packages/core/src/embedding-worker-types.ts:100-104 currently carries type: "init-needs-wasm" plus a human-readable error containing the underlying native model-load error; WorkerOutbound includes EmbedStarted, EmbedResult, EmbedError, InitError, and InitNeedsWasm.