Distillation

Date: Sep 16, 2026

• 🟡 (13:31) packages/core/src/embedding/local.ts:1145-1235 defines embed(texts, inputType, signal?, onExecutionStart?): it rejects an already-aborted signal with EmbeddingRequestAbortedError, awaits ensureWorker(), and throws LocalProviderUnavailableError("embedding worker closed during initialization") if closing or workerless. It calls maybeReprobeCap(), applies safeLocalTruncate, prepends "search_document: " or "search_query: ", gives single query recalls "high" priority and all others "normal", and sends maxTokens: this.effectiveMaxTokens(). Pending requests use abort cleanup and settled guards; a postMessage() race calls handleInitError("embedding worker terminated before request could be sent").
• 🟡 (13:31) packages/core/src/embedding/local.ts:1237-1278 shutdown(timeoutMs = WORKER_SHUTDOWN_TIMEOUT_MS) is idempotent via shutdownPromise, marks the worker closing/not ready, rejects all pending requests with LocalProviderUnavailableError("embedding worker shut down"), awaits initialization, clears worker/init state, calls worker.unref(), and concurrently runs awaitWorkerShutdown(worker, timeoutMs) plus settleRetiredWorkers(timeoutMs). One termination failure is rethrown directly; multiple failures become AggregateError(..., "embedding worker termination was not confirmed").
• 🔴 (13:32) User specified that reprobeEmbedCap() “never re-probes up to or past a known-bad cap”: reprobeEmbedCap(2000, 64 * GB, 2400) must return 2399, while reprobeEmbedCap(1000, 64 * GB, 5000) remains Math.round(1000 / 0.7).
• 🔴 (13:32) User specified that reprobeEmbedCap() “never re-OOMs the same cap”: when already at ceiling minus one, reprobeEmbedCap(2399, 64 * GB, 2400) must remain 2399.
• 🔴 (13:32) User specified that desiredEmbedPoolSize() “never returns below 1, even for absurd/invalid inputs”: Number.NaN, -100, and (0, 8) must each produce 1.
• 🔴 (13:32) User specified that backfillThrottleSleepMs() “never throttles at full duty or for a non-positive elapsed”: (100, 1), (100, 1.5), (0, 0.5), and (-5, 0.5) must each return 0.
• 🟡 (13:32) packages/core/test/embedding-cap.test.ts:392-433 specifies desiredEmbedPoolSize(): free memory through 2 * PER_WORKER_MEM_BUDGET_BYTES - 1 permits only 1; exactly two budgets or 64 * GB reaches DEFAULT_MAX_EMBED_POOL (2); explicit ceiling 4 is honored with ample memory; fractional 3.9 floors to 3; configured 100 caps at EMBED_POOL_ABS_MAX; three budgets with ceiling 4 yields 3; one budget with ceiling 4 yields 1; configured 1 forces one worker even with 1024 * GB.
• 🟡 (13:32) packages/core/test/embedding-cap.test.ts:436-467 specifies resolveBackfillCpuDuty(): explicit duty wins over core count and is clamped to [0.1, 1]; 0.5 stays 0.5 on 2 or 64 cores, 2 clamps to 1, and 0.01 clamps to 0.1. Unconfigured auto duty is 1 for 8 or 16 cores, 0.5 for 4, and 0.75 for 6; 1 or 2 cores floor at BACKFILL_MIN_AUTO_DUTY; zero/NaN cores also fail safe to that floor; configured NaN is ignored, so NaN with 8 cores yields 1.
• 🟡 (13:32) packages/core/test/embedding-cap.test.ts:470-489 specifies backfillThrottleSleepMs() using sleep = elapsed·(1−d)/d: (100, 0.5) → 100, (100, 0.8) → 25, and (300, 0.75) → 100. A 10 * 60_000 ms embed at duty 0.1 is capped at BACKFILL_THROTTLE_MAX_SLEEP_MS.
• 🟡 (13:33) A cgroup resolver probe returned {"hybrid":{"version":2,"directory":"/run/unified/unified","mountPoint":"/run/unified","root":"/"},"multipleDirectHeadroom":1400}.
• 🟡 (13:34) Recorded SHA-256 hashes: packages/core/src/cgroup-memory.ts → dd2f98daaa44045bd67adf4d8f28ebb5bd28f488109795b4ffc48bd3b3dababf; packages/core/src/embedding/local.ts → 3b14b32d6ca6c9b76a0ac4a7586cea674fc6e6b841aa7d7fcc1870e2be497593; packages/core/src/embedding/pool.ts → c032d9990b6b7cc62d4fb41a5ce907d8988d846fc14393e2b287fcd16fb3c9bf; packages/core/src/embedding-cap.ts → 5935754a015c253946e8bd46a7ce0907cd324cba863236770b2685fa2e36b20b.
• 🟡 (13:34) Recorded SHA-256 hashes: packages/core/test/cgroup-memory.test.ts → f2f2efe2bf18841247174c7107594d1e73c55cd16f90b06ac3efd3621f54933e; packages/core/test/embedding-cap.test.ts → dd3ceed23b7967634d047a60dd47bcab0c3f0ea759c12d703422a40e3e2af3d5; packages/core/test/embedding-pool-memory.test.ts → c511e60ed46f4fd248b229b36a39099508dfe4129fadeb05beefa72e0c7e891d; packages/core/test/embedding-pool.test.ts → 00fd39baf0c0a8545f3e42cb8edb8a80842556b0b8d4b5c209e991a748f88dd6.
• 🟡 (13:36) JJ working copy tmzmtlss / commit e6d0f1ed, bookmark fix/embedding-runtime-admission, description fix(core): correct embedding runtime selection and admission, is based on parent pxrvwsvv / 2cbf4006 on main, description feat(cch): add seeds for Claude Code up to 2.1.272 (#1780). Bookmark fix/responses-private-references has conflicts.
• 🟡 (13:36) Working-copy additions were packages/core/src/cgroup-memory.ts and packages/core/test/cgroup-memory.test.ts.
• 🟡 (13:36) Working-copy modifications were packages/core/src/embedding/local.ts, packages/core/src/embedding/pool.ts, packages/core/src/embedding-cap.ts, packages/core/src/embedding-worker-types.ts, packages/core/src/embedding-worker.ts, packages/core/src/embedding.ts, packages/core/src/ort-native.ts, packages/core/test/embedding-cap.test.ts, packages/core/test/embedding-pool-memory.test.ts, packages/core/test/embedding-pool.test.ts, packages/core/test/embedding-worker-types.test.ts, packages/core/test/ort-native.test.ts, packages/gateway/script/bundle.ts, packages/gateway/script/ort-platform-package.ts, packages/gateway/test/bundle-exports.test.ts, and packages/gateway/test/ort-platform-package.test.ts.
• 🟡 (13:36) Assistant review concluded the workspace did not fully close the three reports and retained two concrete fail-open cases.
• 🟡 (13:36) Review finding 1, hybrid v1-memory/v2 selection: parseCgroupMemberships() at packages/core/src/cgroup-memory.ts:31-53 returns both memberships with v1 merely ordered first; resolver code at :82-123 incorrectly falls through to v2 if the authoritative v1 memory mount cannot be resolved. The probe with explicit v1 memory membership but only a v2 mount returned v2 /run/unified/unified, which should instead fail closed with null.
• 🟡 (13:36) Assistant’s minimal fix for hybrid selection: track whether an explicit v1 memory entry exists; if present, return only that membership; malformed v1 paths or missing matching mounts must fail closed; use v2 only when no v1 memory entry exists.
• 🟡 (13:36) Assistant identified missing hybrid regressions in exact order: 1. explicit v1 memory membership + absent v1 mount + valid-looking v2 mount must return null; 2. malformed v1 memory path + valid v2 path must fail closed; 3. end-to-end hybrid fixture with tight v1 and roomy v2 values must return v1 headroom. Existing happy-path coverage at packages/core/test/cgroup-memory.test.ts:55-70 does not detect fallback.
• 🟡 (13:36) Review finding 2, multiple mounts/namespaces/refresh: resolver code at packages/core/src/cgroup-memory.ts:115-117 sorts direct mounts by descending root length and chooses the narrowest view, while accounting at :164-201 stops at that mount point. In a probe with broad root / exposing /tenant, narrow root /tenant/job, leaf headroom 1400, and inherited /tenant headroom 50, the resolver incorrectly returned 1400 rather than 50.
• 🟡 (13:36) Assistant evaluated two fixes for multiple direct mounts: choose the broadest direct mount—the shortest containing root—so all available ancestors are visible; more robustly, evaluate every compatible direct mount and use the tightest result.
• 🟡 (13:36) Assistant found these portions of report 2 substantially addressed: unique namespaced-root mapping at cgroup-memory.ts:65-73,119-121; restricted global-root omission exception at :181-192; fresh /proc/self/cgroup and mountinfo discovery per call at :126-132; live-move regression at packages/core/test/cgroup-memory.test.ts:246-272.
• 🟡 (13:36) Assistant identified missing multiple-mount/refresh regressions in exact order: 1. broad and narrow direct mounts in both mountinfo orders must include the tight parent; 2. multiple namespaced candidates must fail closed; 3. an initial discovery miss followed by valid discovery must prove misses are never cached; 4. mountinfo-only relocation must be covered, not only membership movement; 5. membership changing during a single accounting call must be tested. The absolute claim at cgroup-memory.ts:126-128 was judged too strong because membership is read only once and a mid-read move can return stale roomy headroom.
• 🟡 (13:36) Review finding 3, primary sizing and tighter Node headroom: the finite-hard-limit path was judged fixed by availableMemoryHeadroom() at packages/core/src/embedding/local.ts:99-127, primary clamp at local.ts:130-136, unknown-headroom-to-zero behavior under a finite limit at packages/core/src/embedding-cap.ts:165-173, initial/live cap sizing at local.ts:160-170,570-572,615-618,1183-1188, and the token-floor primary test at packages/core/test/embedding-pool-memory.test.ts:149-162. Node and Linux values are combined using the tighter value at embedding-cap.ts:180-205.
• 🟡 (13:36) Assistant found the soft-only case still open: resolveMemoryHeadroom() at embedding-cap.ts:204-205 discards valid Node headroom when Linux headroom and the hard limit are both absent, behavior currently enshrined by embedding-cap.test.ts:101-105. If memory.max is unlimited (process.constrainedMemory() returns zero), memory.high is finite, custom Linux accounting fails, and Node reports less available memory than os.freemem(), code incorrectly falls back to host-wide free memory.
• 🟡 (13:36) Assistant proposed three primary-sizing changes: 1. always accept a finite Node process.availableMemory() value, while retaining Bun’s omission of its untrustworthy value at local.ts:114-118; 2. distinguish successfully read unlimited limits from cgroup discovery/accounting failure because readLinuxCgroupMemoryHeadroomBytes() at cgroup-memory.ts:157-203 currently returns undefined for both, and force floor sizing on accounting failure even when hard limit is zero; 3. sample constrainedMemory() once per sizing decision rather than separately in containerFreeBytes() and availableMemoryHeadroom().
• 🟡 (13:36) Assistant identified missing primary-sizing regressions in exact order: 1. hard limit zero + Linux unavailable + Node headroom below host free must use Node headroom; 2. soft-only memory.high + unreadable accounting must floor the primary; 3. throwing or missing Node availableMemory() under a finite constraint must floor; 4. Bun’s host-wide runtime value must never rescue failed cgroup accounting.
• 🟡 (13:36) Security/path review found no direct lexical traversal: decodeProcPath() at cgroup-memory.ts:22-29 rejects non-absolute paths, NUL, and .. after octal decoding, and derived relative paths cannot escape the mount point.
• 🟡 (13:36) Security review found a remaining scope-confusion concern: cgroup-memory.ts:119-121 accepts a sole root-mismatched mount as namespaced merely because it is unique, potentially selecting an unrelated cgroup subtree with valid-looking control files and overstating headroom. Recommended tests cover encoded traversal in membership, mount root, and mount point, plus an unrelated-single-mount case.
• 🟡 (13:36) Assistant inspected change tmzmtlss / e6d0f1edc850; JJ status was unchanged before and after, and no files or VCS state were modified. Vitest was not run. Because the required repo-setup skill was unavailable, the assistant directly read AGENTS.md, quality/REVIEW.md, and package.json.