Dashboard › opencode-lore › Distillation
7b3e9aa7-41ec-46d5-8334-bbc87a2a6c03["lore_tm_v1_y-PZEjxH4EklfXEvluuUijO_Hj9y7AJ85hTZDssRkfs","lore_tm_v1_sRpB9JzU-MLV5ibIRxN9odwRX5M-tj3CoR3pcPL7Hyc","lore_tm_v1_BjC45Wq6rAo8Z0SIEXYYnb9KrcKXr83jQ41ZS01M_Ng"]
Date: Sep 16, 2026
packages/core/src/embedding-cap.ts documents that native ONNX workers can be SIGKILLed by the cgroup OOM killer when cgroup-blind os.freemem() permits over-allocation; this is uncatchable, so the ×0.7 OOM backoff never fires. The WASM path instead self-limits against its fixed 4 GiB heap.clampFreeToContainerLimit(hostFree, constrained, available?) treats a finite positive constrained value as the process limit, accepts only finite nonnegative available headroom, returns 0 when a finite limit exists but trustworthy headroom is unavailable, and otherwise returns Math.min(hostFree, limit, headroom).clampFreeToContainerLimit() is monotonic: it can only lower the memory figure, never raise it, so it never increases memory use.resolveMemoryHeadroom(constrained, linuxHeadroom?, runtimeAvailable?) rejects invalid or negative readings; when Linux cgroup and runtime-scoped values are both available, it returns the minimum of Linux headroom, runtime availability, and any finite process limit. Without Linux headroom, both a finite process limit and runtime availability are required, otherwise it returns undefined.availableMemory() on Linux; non-Linux runtime availability is trusted only when a finite process limit is known.clampEmbedCap(n) in packages/core/src/embedding-cap.ts maps non-finite values to MIN_EMBED_TOKENS; finite values are rounded and clamped into [MIN_EMBED_TOKENS, MODEL_MAX_TOKENS].EMBED_WASM_HEAP_MAX_BYTES is 4 * 1024 * 1024 * 1024, derived from the bundled ort-wasm-simd-threaded memory declaration Memory({ initial: 256, maximum: 65536, shared: true }): 65,536 pages × 64 KiB = 4 GiB.EMBED_WASM_HEAP_USABLE_FRACTION is 0.85; the reserved headroom covers WASM heap fragmentation and ONNX Runtime non-attention intermediates. Combined with the measured baseline/K, it gives an approximately 4,950-token safe convergence and observed ≤4962 behavior.sqrt((MAX·fraction − baseline) / K) ≈ 4962; every freemem-derived cap is bounded by it because the npm/WASM onnxruntime-web path’s fixed 4 GiB heap is the binding constraint.packages/core/test/embedding-cap.test.ts, packages/core/test/embedding-oom-recovery.test.ts, packages/core/test/embedding-pool-memory.test.ts, and packages/core/test/embedding-pool.test.ts; notable cases include constrained-host fail-closed behavior, Burak’s 12 GiB cgroup environment, Onur’s approximately 2.7 GB-free environment, learned-cap reconciliation, and the Railway container OOM regression.packages/core/test/embedding-pool-memory.test.ts is the regression suite for Onur’s report where the gateway was SIGKILLed after the pool grew to N workers and every worker independently sized its token cap against roughly half of total free memory, causing aggregate host-RAM exhaustion.×0.7 backoff never fires; the only defense is never over-allocating in the first place.free / ceiling; 2. the cap is re-clamped to current free memory on every request rather than only at construction.CapturingWorker in packages/core/test/embedding-pool-memory.test.ts snapshots exact EmbedMsg payloads with { type, id, maxTokens }, intentionally leaves embed promises pending unless completeNext() emits a result, and implements ref(), unref(), and terminate() for the Worker stand-in.installCapturingWorkers() injects CapturingWorker instances through _setTestWorkerFactory; settle() immediately attaches fulfillment and rejection handlers so pending embed promises do not become unhandled rejections during provider teardown.VOYAGE_API_KEY and OPENAI_API_KEY, neutralizes the real CI cgroup with _setConstrainedMemoryForTest(0), resets the local-provider probe, and saves/clears the provider. Teardown restores worker factory, pool size, pool free memory, container free memory, available memory, constrained memory, provider-probe state, provider, and both API-key environment variables.sizes each pool worker's cap from free / ceiling, not full free memory persists a learned cap of 8192, sets _setEmbedPoolSizeForTest(2), sets container free memory to 6 * GB, and verifies the posted cap equals memoryModelEmbedCap((6 * GB) / 2) and is strictly below memoryModelEmbedCap(6 * GB).uses the token floor when constrained primary-worker headroom is unknown persists 8192, sets pool size 1, container free memory 64 * GB, constrained memory 12 * GB, and available memory Number.NaN; it expects exactly 1 fake worker and maxTokens === MIN_EMBED_TOKENS.re-clamps the cap to CURRENT free memory when it drops after construction persists 8192, uses ceiling 1, embeds first at 6 * GB, then drops current container-free memory to 2 * GB; it expects the same worker because the pool never grew—ceiling 1—and verifies the cap falls from memoryModelEmbedCap(6 * GB) to memoryModelEmbedCap(2 * GB).clamps the OOM-respawn resubmit to current free memory, not just the ×0.7 backoff targets the direct OOM-respawn payload, which has no later effectiveMaxTokens guard; it persists 8192, uses pool-size divisor 1, begins at 16 * GB, then tests that a native-SIGKILL retry is clamped to memory available after the drop rather than merely applying ×0.7 to the larger earlier cap.