Distillation

Date: Sep 16, 2026

• 🔴 (13:35) User stated cgroup membership can change while a process lives; /proc/self/cgroup and /proc/self/mountinfo must be re-read so a worker is never admitted from a stale cgroup directory or a cached discovery miss.
• 🔴 (13:35) User stated every descendant cgroup boundary must be readable so sibling usage is never subtracted from the wrong scope; only the cgroup v2 global root may omit memory.current, memory.high, and memory.max.
• 🔴 (13:35) User stated the primary embedding worker must always be present; its own OOM backoff, rather than pool sizing, governs it.
• 🔴 (13:35) User stated invalid embedding pool environment/config values must fall through to undefined, never NaN, and this behavior must be testable without spinning up workers via configuredEmbedPoolSize.
• 🟡 (13:35) packages/core/src/cgroup-memory.ts defines cgroup discovery/accounting: decodeProcPath() decodes octal escapes and rejects non-absolute paths, NUL, and ..; parseCgroupMemberships() currently orders explicit cgroup v1 memory membership before v2; resolveLinuxCgroupMemoryFiles() prefers direct mounts sorted by descending root length and accepts exactly one namespaced candidate; readLinuxCgroupMemoryHeadroomBytes() walks from the resolved directory to the mount point and returns the tightest finite limit-minus-usage value.
• 🟡 (13:36) Background cgroup audit concluded the workspace did not fully close the three reports and retained two concrete fail-open paths.
• 🟡 (13:36) Hybrid v1-memory/v2 investigation: initial implementation orders v1 before v2 in parseCgroupMemberships() (packages/core/src/cgroup-memory.ts:31-53) but resolveLinuxCgroupMemoryFiles() (:82-123) falls through to v2 if authoritative v1 memory control cannot be resolved. A probe with explicit v1 memory membership and only a v2 mount incorrectly returned {"version":2,"directory":"/run/unified/unified","mountPoint":"/run/unified","root":"/"}. Required behavior: if explicit v1 memory membership exists, use only it and return null when its path is malformed or its mount is absent; use v2 only when no v1 memory entry exists.
• 🟡 (13:36) Missing hybrid regressions identified, preserving order: 1. Explicit v1 memory membership + absent v1 mount + valid-looking v2 mount must return null; 2. malformed v1 memory path + valid v2 path must fail closed; 3. end-to-end hybrid fixture with tight v1 and roomy v2 values must return v1 headroom. Existing happy-path coverage at packages/core/test/cgroup-memory.test.ts:55-70 does not detect fallback.
• 🟡 (13:36) Multiple-mount investigation found packages/core/src/cgroup-memory.ts:115-117 sorts direct mounts by descending root length and picks the narrowest view, while accounting at :164-201 stops at that mount point. A narrow bind mount can therefore hide tighter limits exposed by a broader mount. A probe with broad root / exposing /tenant, narrow root /tenant/job, leaf headroom 1400, and inherited /tenant headroom 50 incorrectly returned 1400 rather than 50.
• 🟡 (13:36) Two fixes were considered for multiple direct mounts: 1. choose the broadest direct mount—the shortest containing root—so ancestor limits remain visible; 2. more robustly, evaluate every compatible direct mount and return the tightest result.
• 🟡 (13:36) Cgroup behaviors already substantially addressed: unique namespaced-root mapping at packages/core/src/cgroup-memory.ts:65-73,119-121; restricted global-root omission handling at :181-192; fresh /proc/self/cgroup and /proc/self/mountinfo discovery on every call at :126-132; live membership-move regression at packages/core/test/cgroup-memory.test.ts:246-272.
• 🟡 (13:36) Missing cgroup mount/refresh regressions identified, preserving order: 1. broad and narrow direct mounts in both mountinfo orders must include the tight parent; 2. multiple namespaced candidates must fail closed; 3. an initial discovery miss followed by valid discovery must prove misses are never cached; 4. mountinfo-only relocation must be tested, not only membership movement; 5. membership changing during a single accounting call must be tested. The audit noted the absolute freshness claim at packages/core/src/cgroup-memory.ts:126-128 is too strong because membership is read only once per call, allowing a mid-read move to return stale roomy headroom.
• 🟡 (13:36) Primary sizing audit found the finite-hard-limit path fixed: availableMemoryHeadroom() at packages/core/src/embedding/local.ts:99-127; primary clamp at local.ts:130-136; unknown headroom under a finite limit becomes zero at packages/core/src/embedding-cap.ts:165-173; initial/live cap sizing at local.ts:160-170,570-572,615-618,1183-1188; and the primary starts at the token floor per packages/core/test/embedding-pool-memory.test.ts:149-162. Node and Linux headroom are combined using the tighter value at embedding-cap.ts:180-205.
• 🔴 (13:36) User stated the sizing logic must always accept a finite Node process.availableMemory() value; Bun already excludes its untrustworthy host-wide value at packages/core/src/embedding/local.ts:114-118.
• 🟡 (13:36) Soft-only memory sizing remains fail-open because resolveMemoryHeadroom() at packages/core/src/embedding-cap.ts:204-205 discards valid Node headroom whenever both Linux headroom and the hard limit are absent; packages/core/test/embedding-cap.test.ts:101-105 currently enshrines this behavior. Failure scenario: memory.max is unlimited so process.constrainedMemory() returns zero, memory.high is finite, custom Linux accounting fails, and Node reports less available memory than os.freemem(); the code then incorrectly uses host-wide freemem().
• 🟡 (13:36) Required memory-sizing changes: 1. always accept finite Node process.availableMemory(); 2. distinguish successfully read unlimited cgroup limits from cgroup discovery/accounting failure, since readLinuxCgroupMemoryHeadroomBytes() currently returns undefined for both at packages/core/src/cgroup-memory.ts:157-203, and force floor sizing on accounting failure even when the hard limit is zero; 3. sample constrainedMemory() once per sizing decision rather than separately in containerFreeBytes() and availableMemoryHeadroom().
• 🟡 (13:36) Missing memory-sizing regressions identified, preserving order: 1. hard limit zero + Linux unavailable + Node headroom below host free must use Node headroom; 2. soft-only memory.high + unreadable accounting must floor the primary; 3. throwing or missing Node availableMemory() under a finite constraint must floor; 4. Bun’s host-wide runtime value must never rescue failed cgroup accounting.
• 🟡 (13:36) Security/path audit found no direct lexical traversal: decodeProcPath() at packages/core/src/cgroup-memory.ts:22-29 rejects non-absolute paths, NUL, and .. after octal decoding, and the derived relative path cannot escape the mount point. Remaining scope-confusion risk: :119-121 accepts a sole root-mismatched mount merely because it is the unique namespaced candidate, potentially selecting an unrelated subtree and overstating headroom. Required tests cover encoded traversal in membership, mount root, and mount point, plus an unrelated-single-mount case.
• 🟡 (13:36) Audit inspected Jujutsu change tmzmtlss / e6d0f1edc850; jj status was unchanged before and after, no files or VCS state were modified, and Vitest was not run. The required repo-setup skill was unavailable, so AGENTS.md, quality/REVIEW.md, and package.json were read directly.
• 🟡 (13:36) Assistant planned fail-first counterexamples for the two fail-open paths, then intended to make cgroup resolution fail closed and preserve valid Node headroom when Linux accounting is unavailable.
• 🟡 (13:37) Jujutsu working copy remained change tmzmtlss at commit e6d0f1ed, description fix(core): correct embedding runtime selection and admission, on bookmark fix/embedding-runtime-admission; parent was pxrvwsvv / 2cbf4006 on main, feat(cch): add seeds for Claude Code up to 2.1.272 (#1780).
• 🟡 (13:37) Working-copy diff contained 18 files with exactly 1818 insertions(+), 90 deletions(-): added packages/core/src/cgroup-memory.ts and packages/core/test/cgroup-memory.test.ts; modified packages/core/src/embedding/local.ts, packages/core/src/embedding/pool.ts, packages/core/src/embedding-cap.ts, packages/core/src/embedding-worker-types.ts, packages/core/src/embedding-worker.ts, packages/core/src/embedding.ts, packages/core/src/ort-native.ts, packages/core/test/embedding-cap.test.ts, packages/core/test/embedding-pool-memory.test.ts, packages/core/test/embedding-pool.test.ts, packages/core/test/embedding-worker-types.test.ts, packages/core/test/ort-native.test.ts, packages/gateway/script/bundle.ts, packages/gateway/script/ort-platform-package.ts, packages/gateway/test/bundle-exports.test.ts, and packages/gateway/test/ort-platform-package.test.ts.
• 🟡 (13:37) Exact per-file diff sizes included packages/core/src/cgroup-memory.ts 205 added lines, packages/core/test/cgroup-memory.test.ts 297 added lines, packages/core/src/ort-native.ts 256 lines heavily expanded, packages/core/test/ort-native.test.ts 478 lines heavily expanded, and packages/gateway/test/bundle-exports.test.ts 246 lines heavily expanded.
• 🟡 (13:37) Jujutsu warned that bookmark fix/responses-private-references has conflicts and suggested inspecting with jj bookmark list and resolving via jj bookmark set <name> -r <rev>.