Distillation

Date: Sep 16, 2026

• 🔴 (20:22) User stated cleanup invariant: best-effort stream cancellation must never delay the caller.
• 🟡 (20:22) packages/gateway/src/recall.ts function ensureSSEResponse() accepts text/event-stream; when ChatGPT/Codex omits Content-Type, it tees the body and probes up to 4096 bytes or 64 chunks with a 10_000 ms timeout, ignoring a BOM, leading whitespace, and SSE comment lines. A valid data:/event: prefix preserves the replay branch; a non-SSE body throws recall follow-up expected SSE but got "${ct}" and a non-SSE body.
• 🟡 (20:22) packages/gateway/src/recall.ts function assertJSONResponse() rejects text/event-stream, cancels the body without awaiting cleanup, and throws recall follow-up expected JSON but got SSE — stream flag/consumer mismatch.
• 🟡 (20:22) packages/gateway/src/recall.ts function readResponseTextLimited() reads at most 500 bytes for all three follow-up error paths at lines 1613, 1674, and 1752; it uses promiseAgainstAbort() and calls cancelAndReleaseReader() in finally.
• 🟡 (20:22) packages/gateway/src/stream/anthropic.ts exports cancelAndReleaseReader(): it catches synchronous reader.cancel(reason) failures, does not await cancellation, immediately attempts reader.releaseLock(), and retries lock release in cancellation.finally(release).
• 🔴 (20:23) User stated completion-validation invariant: invalid usage is never returned as success.
• 🟡 (20:23) packages/gateway/src/pipeline.ts Responses non-stream completion validation rejects standalone item_reference output because no streamed lifecycle exists to resolve it; accepting it would silently erase provider output during normalization.
• 🟡 (20:23) packages/gateway/src/pipeline.ts permits Responses incomplete_details.reason only as max_output_tokens or content_filter; malformed details or any other reason throw upstream Responses request did not complete.
• 🟡 (20:23) Gemini non-stream completion validation requires a non-empty responseId, non-empty modelVersion, valid usage with numeric promptTokenCount and candidatesTokenCount, exactly 1 candidate, model-role content with an array of parts, finish reason STOP or MAX_TOKENS, and no string promptFeedback.blockReason; failures throw upstream Gemini request did not complete.
• 🟡 (20:23) Anthropic non-stream completion validation requires a valid assistant message, non-empty id and model, array content, required input/output usage, and stop reason among end_turn, tool_use, max_tokens, stop_sequence, pause_turn, refusal, or model_context_window_exceeded.
• 🟡 (20:23) OpenAI non-stream validation in accumulateOpenAINonStreamJSON() rejects malformed or duplicate logical choice indices and malformed or duplicate tool-call IDs within each choice; tool function name and arguments must both be strings.
• 🔴 (20:23) User stated privacy invariant: upstream provider diagnostics must never be exposed while proving a provisional session identity.
• 🟡 (20:23) packages/gateway/src/pipeline.ts function handleProvisionalConversationTurn() validates provisional identity without touching session-owned state; failed or incomplete attempts leave the adopted session, project rows, auth registries, and gradient state untouched.
• 🟡 (20:23) In handleProvisionalConversationTurn(), a non-OK upstream response has its body canceled and is returned through sanitizedUpstreamErrorResponse(). Non-stream provisional responses call accumulateNonStreamResponse(..., true) with requireValidCompletion=true; streaming Responses require a completed terminal, while OpenAI, Gemini, and Anthropic streams use strict terminal validation.