Distillation

Date: Sep 16, 2026

• 🔴 [requested-review] (22:45) User asked to resume the interrupted read-only native-runtime correctness review in the same session and workspace, preserving the prior scope and evidence.
• 🔴 [enforced-workflow] (22:45) User required no recall, network service, file edits, or Jujutsu/Git mutations during the resumed review.
• 🔴 (22:45) User required first reporting the exact current Jujutsu change/commit and whether it still matched the prior target; if different, the reviewed candidate must not be silently redefined, and the mismatch must be stated as an exact blocker or the already-complete prior-candidate findings returned.
• 🔴 (22:45) User required a concise, evidence-based PASS/CONCERN/MUST-FIX report with exact file:line references, ending exactly MERGE or DO-NOT-MERGE.
• 🔴 (22:45) User stated: “Never return an empty result or a progress-only/context-warning response.”
• 🔴 (22:46) User stated that Jujutsu operations “never fails on conflict”; conflicts are recorded in the resulting commit and must be checked with jj st and resolved manually rather than through interactive jj resolve.
• 🟡 (22:47) Current Jujutsu candidate retained change ID tmzmtlsspstnppsrlpmuulsywurmlnqu and description fix(core): correct embedding runtime selection and admission, but advanced from prior commit aee4651c96b009c28f9e79f40f019fd2c7c49a0a to commit 1a05f4ab33e9ef541ddcb5a9bf62be6b60d85610. Its parent remained change pxrvwsvvkmpoxnsqmrkwrnlqvvkoltwz, commit 2cbf40060c67df229731cf1b9e34d5bf22ec2145, description feat(cch): add seeds for Claude Code up to 2.1.272 (#1780).
• 🟡 (22:47) Current candidate had no file conflicts. The unrelated conflicted bookmark fix/responses-private-references remained. Current jj diff --git -r @ SHA-256 was e0b19388dc7503fe3953af260d915172af8307413c1038ec97024142ab5c5670, replacing prior hash f0b8e99bf067fc02503826cb13843a0baf725f9ae83276de21c6da0ba3c5c1.
• 🟡 (22:47) Current candidate changed 20 paths: added packages/core/src/cgroup-memory.ts; modified packages/core/src/embedding/local.ts, packages/core/src/embedding/pool.ts, packages/core/src/embedding-cap.ts, packages/core/src/embedding-worker-types.ts, packages/core/src/embedding-worker.ts, packages/core/src/embedding.ts, packages/core/src/ort-native.ts; added packages/core/test/cgroup-memory.test.ts; modified packages/core/test/embedding-cap.test.ts, packages/core/test/embedding-pool-memory.test.ts, packages/core/test/embedding-pool.test.ts, packages/core/test/embedding-wasm-fallback.test.ts, packages/core/test/embedding-worker-stdio.test.ts, packages/core/test/embedding-worker-types.test.ts, packages/core/test/ort-native.test.ts, packages/gateway/script/bundle.ts, packages/gateway/script/ort-platform-package.ts, packages/gateway/test/bundle-exports.test.ts, and packages/gateway/test/ort-platform-package.test.ts. Compared with the prior 17-path snapshot, the added scoped modifications were packages/core/test/embedding-pool-memory.test.ts, packages/core/test/embedding-wasm-fallback.test.ts, and packages/core/test/embedding-worker-stdio.test.ts.
• 🟡 (22:47) Scoped hashes showed three previously reviewed files had advanced: packages/core/src/embedding-worker.ts → 478726a4f708e3bc0895fdd1b2d87a80b2ed04e988e6907be9037394543b0da6; packages/core/src/embedding-worker-types.ts → 2d39540b20111a965f358c0a73c242de25b8068a9b8cc2e6dacaf543cbfb85ed; packages/gateway/test/bundle-exports.test.ts → 7413531f62be1cf2f05be6bee2aafa524261766e5e1f12277c9a09149ac1bc5f.
• 🟡 (22:47) Six scoped files retained their prior hashes: packages/core/src/ort-native.ts → 784f55f936ab766188d43382d1aee06fcc3fd45c03aee9baa762fd6424376f36; packages/core/test/ort-native.test.ts → 774575a632e380ba5d06aa43ad8a283ad1629252d8beba8324a30dc32236a1bf; packages/core/test/embedding-worker-types.test.ts → 0d09dc266eb2d11b3738cec05dab7ee993826864e06772fd9d38153f816863d0; packages/gateway/script/bundle.ts → 02fd0231a4374de3e859c9168a65608e1227409de5aeea4b9d4ee4ffb420f50f; packages/gateway/script/ort-platform-package.ts → d5b67bf3fe2f5b7f1cb7e8c610fbe54031b1cca6602f3d5a2f76228eda121888; packages/gateway/test/ort-platform-package.test.ts → 71a3be381ef07ac967653e7aa4104a59d11691402a5b645a4d6d1111ee645449.
• 🔴 (22:47) User stated that WASM linear memory “never shrinks: once the first oversized allocation grows the heap,” smaller retries in the same worker also fail; recovery is to respawn with a fresh heap and a lower token cap via EMBED_OOM_EXIT_CODE.
• 🔴 (22:47) User stated optional-stack classification requires both a module-not-found signal and reference to @huggingface/transformers, onnxruntime, or sharp, so unrelated resolution errors are “never misclassified.”
• 🔴 (22:47) User stated that native-runtime incompatibility recovery must “switch to WASM” by respawning a fresh worker with WorkerInitData.forceWasm=true, because backend choice is committed on the first require("onnxruntime-node").
• 🟡 (22:47) The advanced packages/core/src/embedding-worker.ts:231-240 now emits only fixed diagnostic text ([embedding-worker] requesting WASM respawn) and posts { type: "init-needs-wasm" } without raw error text when isNativeOrtLoadError(msg) matches. However, it still reduces the exception to err.message at :232 before classification, so an actual error.code: "ERR_DLOPEN_FAILED" remains unavailable to isNativeOrtLoadError().
• 🟡 (22:47) packages/core/src/embedding-worker.ts:270-282 similarly posts only { type: "init-needs-wasm" } with fixed debug output for intact-model native parse failures, removing raw diagnostics from that fallback message.
• 🟡 (22:47) Raw diagnostics still remain in other worker paths: intact-model retry logs interpolate ${msg} at packages/core/src/embedding-worker.ts:293-295; purge-and-redownload logs interpolate ${msg} at :309-311; final failure stores raw err.message in initError at :322-325 and posts it through { type: "init-error", error: initError } at :327.
• 🟡 (22:47) packages/core/src/embedding-worker-types.ts:100-109 changed InitNeedsWasm to contain only type: "init-needs-wasm" with no diagnostic field, while InitError at :76-80 still exposes a human-readable error: string.
• 🟡 (22:47) isNativeOrtLoadError(msg) remained string-only at packages/core/src/embedding-worker-types.ts:224-234. It requires a native-runtime token plus loader-language such as ERR_DLOPEN_FAILED, invalid ELF/Mach-O/Win32, file too short, missing shared object, image not found, missing module, undefined/symbol-not-found, or dlopen; real loader messages whose code exists only on error.code can still bypass WASM fallback.
• 🟡 (22:48) packages/gateway/test/bundle-exports.test.ts:196-290 added a native-addon failure probe for both embedding-worker.cjs and embedding-worker.js: it intercepts process.dlopen, throws onnxruntime_binding.node: file too short native-loader-private-value-should-never-reach-logs, expects exactly { type: "init-needs-wasm" }, verifies the hostile diagnostic is absent from stdout/stderr, and confirms the native addon was selected. The test still injects Bun-like globals via a CJS preload while running Node’s Worker, rather than executing embedding-worker.js under Bun.
• 🟡 (22:48) The worker probe supports linux-x64, linux-arm64, darwin-arm64, win32-x64, and win32-arm64, but silently returns on unsupported hosts at packages/gateway/test/bundle-exports.test.ts:199-207.
• 🟡 (22:48) Bundle freshness remained incomplete: isBundleFresh() at packages/gateway/test/bundle-exports.test.ts:114-123 still checks only dist/index.cjs and dist/index.bun.js, despite asserting and executing dist/embedding-worker.cjs and dist/embedding-worker.js beginning at :185.
• 🟡 (22:49) Native-binding validation remained unchanged at packages/core/src/ort-native.ts:150-183: it validates only package containment, regular-file status, and 4-byte ELF/Mach-O or 2-byte MZ magic. It still does not validate ELF class/machine, Mach-O CPU type, PE signature/machine, minimum binary size, or N-API runtime compatibility.
• 🟡 (22:49) Package resolution remained ancestor-walking via createRequire(fromPath).resolve() at packages/core/src/ort-native.ts:136-148, contrary to the physical-ownership claim at :193-196 that workspace fallback never selects an arbitrary ancestor runtime.
• 🟡 (22:49) packages/core/src/ort-native.ts:271-285 still accepts exactly one directory matching napi-v\d+ without verifying that its N-API version is supported by the current runtime.
• 🟡 (22:51) packages/core/test/embedding-worker-types.test.ts:82-100 remained unchanged: native-loader coverage uses hand-written strings, including "Error [ERR_DLOPEN_FAILED]: onnxruntime_binding.node: invalid ELF header", but no real error object carrying code: "ERR_DLOPEN_FAILED" and no representative Linux wrong ELF class/GLIBC_*, Windows %1 is not a valid Win32 application, or Darwin Library not loaded: @rpath/... cases.
• 🟡 (22:53) Final read-only verification showed candidate identity, parent, lack of conflicts, diff SHA-256 e0b19388dc7503fe3953af260d915172af8307413c1038ec97024142ab5c5670, and all nine scoped file hashes remained stable during the resumed inspection.
• 🟡 (22:54) packages/gateway/test/bundle-exports.test.ts:9-32 documents that direct Vitest/IDE/watch launches rebuild stale or missing bundle artifacts in beforeAll; rebuilding wipes and recreates dist/, while source aliases and the forks pool are claimed to prevent races with other tests.
• 🟡 (22:56) packages/core/test/ort-native.test.ts:35-43 still creates nominal native binaries using only 4 magic bytes: ELF [0x7f,0x45,0x4c,0x46], Mach-O [0xcf,0xfa,0xed,0xfe], or PE-like [0x4d,0x5a,0x90,0x00], preserving the test gap for architecture and complete-header validation.