Distillation

Date: Sep 16, 2026

• 🔴 [enforced-invariant] (16:45) User requires recall-aware streaming to never commit when an abort-ignoring recall callback resolves late; cancellation must ultimately invoke rollback exactly once, with committed remaining 0 and rolledBack becoming 1.
• 🔴 [enforced-invariant] (16:45) User requires cancellation to never wait for a non-settling recall callback; reader.cancel() must resolve as "cancelled" before the next setImmediate, even when onRecall returns new Promise<never>(() => {}).
• 🔴 [enforced-invariant] (16:45) User requires cancellation to never wait for non-settling follow-up setup; reader.cancel() must resolve as "cancelled" before the next setImmediate, even when runFollowUp returns new Promise<never>(() => {}).
• 🔴 [enforced-invariant] (16:45) User requires recall-only handling to never convert a failed continuation into completed; a follow-up response.failed must remain a failure rather than become a successful completion.
• 🔴 [enforced-invariant] (16:45) User requires recall-continuation diagnostics to never alter the fixed public failure; failures in private telemetry, including a setRecallContinuationFailureHook() callback throwing "private telemetry failure", must not change the public error response.
• 🟡 (16:45) A deferred-persistence test verifies that after the client output contains "answer", invoking transaction?.commit() can throw "recall persistence failed" and must leave persisted at 0 while invoking rollback once (rolledBack === 1).
• 🟡 (16:45) The test suite includes "rolls back deferred persistence when a recall-only continuation fails"; its runFollowUp throws "follow-up failed", and persistence exposes separate commit and rollback callbacks.
• 🟡 (16:46) The high-cardinality identity-validation test uses visibleItemCount = 1_500, maxRetainedStateBytes = 64 * 1024 * 1024, a frame-count ceiling of 100_000, and a 60_000 ms test timeout. It proxies accumulated items and counts reads of id and call_id, requiring identityReads <= visibleItemCount * 40.
• 🟡 (16:46) The normalized omitted-continuation-index boundary test uses maxSparseIndex = 32, principalRecallIndex = maxSparseIndex - 2 (30), and maxSSEFrames: maxSparseIndex. With extraRecall=false, it expects success and a shifted continuation output_index of maxSparseIndex - 1 (31); with extraRecall=true, it expects exactly one public response.failed, PUBLIC_RECALL_ERROR, no leaked "call_omitted_first_invalid", and only one recall and one follow-up.
• 🟡 (16:46) The suite includes "accounts for terminal Codex continuation usage once when candidate flush exceeds the transaction limit": principal usage is { input_tokens: 2, output_tokens: 3, total_tokens: 5 }, continuation usage is { input_tokens: 5, output_tokens: 7, total_tokens: 12 }, and private function-call arguments contain private-terminal-flush- followed by 4,096 "x" characters.