Distillation

Date: Sep 16, 2026

• 🔴 (13:01) User specified that the primary embedding worker in packages/core/src/embedding/pool.ts is always present; its own OOM backoff, rather than pool sizing, protects constrained hosts and preserves existing single-worker behavior.
• 🟡 (13:01) EmbeddingPool.pickSlot() throws LocalProviderUnavailableError while closing or when local embedding is terminally unavailable; when no slots exist, an active localEmbeddingState.initRetryAt causes EmbeddingWorkerRetryCooldownError, while an expired cooldown admits exactly one recovery probe and clears initRetryAt.
• 🟡 (13:01) During transient initialization failure debt, EmbeddingPool.pickSlot() routes new work only to healthy siblings. Pool growth requires at least one healthy slot, all eligible slots busy, total active plus retired workers below ceiling, and enough liveFreemem() for all unproven slots plus one additional worker at PER_WORKER_MEM_BUDGET_BYTES.
• 🟡 (13:01) EmbeddingPool.spawnSlot() passes the pool ceiling to LocalProvider as the memory divisor so each worker sizes its token cap from free / ceiling; this keeps provisioned workers collectively within one EMBED_MEM_FRACTION share instead of each independently claiming half of free memory.
• 🟡 (13:01) EmbeddingPool.liveFreemem() uses clampFreeToContainerLimit(raw, constrained, headroom) and returns 0 when a constrained memory limit exists but available headroom is unknown.
• 🟡 (13:01) EmbeddingPool.preserveHealthyServiceAfterExhaustion() retains exhausted retry debt to prevent replacement storms but calls clearLocalProviderLatch() and resets localEmbeddingState.errorLogged when failureCause === "transient-init-exhausted" and a healthy sibling remains.
• 🟡 (13:02) Working copy tmzmtlss / commit e6d0f1ed on fix/embedding-runtime-admission had description fix(core): correct embedding runtime selection and admission, based on pxrvwsvv / 2cbf4006 from main (feat(cch): add seeds for Claude Code up to 2.1.272 (#1780)).
• 🟡 (13:02) Working-copy changes comprised added files packages/core/src/cgroup-memory.ts and packages/core/test/cgroup-memory.test.ts; modified files packages/core/src/embedding/local.ts, packages/core/src/embedding/pool.ts, packages/core/src/embedding-cap.ts, packages/core/src/embedding-worker-types.ts, packages/core/src/embedding-worker.ts, packages/core/src/embedding.ts, packages/core/src/ort-native.ts, packages/core/test/embedding-cap.test.ts, packages/core/test/embedding-pool-memory.test.ts, packages/core/test/embedding-pool.test.ts, packages/core/test/embedding-worker-types.test.ts, packages/core/test/ort-native.test.ts, packages/gateway/script/bundle.ts, packages/gateway/script/ort-platform-package.ts, packages/gateway/test/bundle-exports.test.ts, and packages/gateway/test/ort-platform-package.test.ts.
• 🟡 (13:02) jj warned that unrelated bookmark fix/responses-private-references had conflicts. A custom template failed because keyword conflicts does not exist; suggested alternatives were conflict and conflicted_files.
• 🔴 (13:02) User specified that tests use a temporary SQLite database through packages/core/test/setup.ts and never the production database.
• 🔴 (13:02) User specified that releases use Sentry Craft through GitHub Actions and versions or CHANGELOG.md must never be manually bumped or edited; Craft handles both automatically.
• 🟡 (13:02) Release workflow commands are gh workflow run release.yml -f version=auto for conventional-commit-derived semver or gh workflow run release.yml -f version=0.23.0 for an explicit version. The workflow runs scripts/bump-version.sh, generates the changelog, creates release/X.Y.Z, runs CI artifacts, opens a Craft publish issue, and publishes after the issue is labeled accepted.
• 🔴 (13:03) User requires deterministic regression tests for every adversarial-review defect: each test must fail on the base branch, pass on the fix, exercise the real precondition, and fail when the tested guard is deleted.
• 🔴 (13:03) User’s TDD rule is: “Never trust the fix without seeing it fail.” Bug fixes must be driven by a regression test written first, confirmed failing on the base branch, then confirmed passing with the fix.
• 🔴 (13:03) User requires two separate review passes for non-trivial changes: 1. adversarial/correctness review covering enumerated break states, apply-then-revert mutants, property-test stability ×10, hash-equivalence proofs, frozen-array mutation safety, and stale-cache analysis; 2. security/pentest review covering injection, credential leaks, protocol attacks, and privilege escalation.
• 🔴 (13:03) User requires reviewers to run pnpm test, pnpm run typecheck, pnpm run lint, and pnpm run format:check, verify exit codes, run property tests ×10, hash-verify that the working tree is unmodified afterward, and report per-point PASS / FAIL / CONCERN / MUST-FIX verdicts with file:line evidence plus an overall MERGE / DO-NOT-MERGE verdict.
• 🔴 (13:03) User requires adversarial review before merge for correctness-critical paths including the sync engine, hashing, lifecycle, and migrations; mechanical or test-only PRs may skip it at reviewer discretion.
• 🟡 (13:03) Assistant reported that the candidate was conflict-free and the bookmark warning was unrelated, and narrowed remaining work to the native loader boundary plus the three previously identified admission defects without touching the live service.
• 🔴 (13:03) User specified that native ONNX Runtime resolution is fail-closed and must never interrupt WASM fallback.
• 🟡 (13:03) Root package.json pins packageManager to pnpm@10.28.0 and Volta to Node 24.16.0 plus pnpm 10.28.0; onnxruntime-node is overridden to 1.27.0 and included in pnpm.onlyBuiltDependencies.
• 🟡 (13:04) packages/core/src/embedding/local.ts defines constrainedMemoryLimit() using process.constrainedMemory(), returning 0 for unknown, unsupported, unconstrained, non-finite, or non-positive results; test override is _setConstrainedMemoryForTest(bytes).
• 🟡 (13:04) availableMemoryHeadroom() combines readLinuxCgroupMemoryHeadroomBytes() with runtime memory information. For Bun it avoids trusting Bun’s host-level freemem() behavior and calls resolveMemoryHeadroom(constrained, linuxHeadroom); for Node it additionally uses process.availableMemory() when available and falls back safely if the call throws.
• 🟡 (13:04) containerFreeBytes() clamps host freemem() through clampFreeToContainerLimit(raw, constrainedMemoryLimit(), availableMemoryHeadroom()). computeInitialEmbedCap() divides that free memory by Math.max(1, memDivisor) and reconciles it with persisted cap data, memoryModelEmbedCap(free), and knownBadCap.
• 🟡 (13:04) Existing native-runtime tests include glibc compatibility cases in packages/core/test/ort-native.test.ts, native-to-WASM respawn and no-loop protocol cases in packages/core/test/embedding-wasm-fallback.test.ts, transient-download classification in packages/core/test/embedding-worker-types.test.ts, and malformed-addon/WASM-fallback bundle coverage in packages/gateway/test/bundle-exports.test.ts.