Distillation

Date: Sep 16, 2026

• 🟡 (12:56) Work plan status: 1. “Address native resolver review findings with deterministic regressions” — in_progress, high priority; 2. “Finish cgroup headroom parsing and admission wiring” — pending, high priority; 3. “Run fail-first and mutation proofs for every critical guard” — pending, high priority; 4. “Run complete repository validation and freeze exact candidate” — pending, high priority; 5. “Obtain independent correctness and security reviews” — pending, high priority; 6. “Commit completed Jujutsu change and report findings” — pending, medium priority.
• 🔴 (12:57) User stated the embedding worker sends a request-start signal after model initialization so the main thread can switch from its init watchdog to the request/inference watchdog.
• 🔴 (12:57) User stated an in-process retry cannot switch to WASM after the native onnxruntime-node NAPI addon fails; the main thread must respawn a fresh worker that uses the bundled, Bun-hardened WASM runtime.
• 🔴 (12:57) User stated WASM linear memory never shrinks: once the first oversized allocation grows the heap, every later in-process attempt retains that enlarged heap; lowering the cap therefore requires a fresh-heap worker respawn, while only upward cap nudges can reuse the worker.
• 🔴 (12:57) User stated native-addon resolution classification must ensure an unrelated resolution error, such as a missing model file, is never misclassified.
• 🔴 (12:57) User stated native failure handling should switch to WASM rather than purge and retry when the native runtime was used and the on-disk model appears structurally intact.
• 🔴 (12:57) User stated the console-error matcher targets the two leading strings passed by transformers.js sessionRun(); non-string arguments such as the formatted-inputs object never match—only the leading string does.
• 🟡 (12:57) The worker error logic described OOM detection via /out.of.memory|alloc.*fail|oom/i, native-load signatures including ERR_DLOPEN_FAILED, invalid ELF/Mach-O/Win32, file too short, missing shared libraries/images/modules, undefined or missing symbols, and dlopen; WASM fatal errors match /WASM fatal error/i.
• 🟡 (12:57) The worker protocol distinguishes init-needs-wasm from init-error, and avoids posting a per-request error when a failure should instead trigger a fresh WASM respawn; posted OOM errors are classified as fatal so the main thread can apply the ×0.7 cap backoff and fresh-heap respawn.