@remnic/core 9.69.38 → 9.69.40

package/src/orchestrator.ts

@@ -213,6 +213,7 @@ export {
   type RecallInvocationOptions,
   type RecallModeDecision,
 } from "./orchestration/orchestrator-helpers.js";
+export { qmdStartupCollectionChecksWithTimeout } from "./orchestration/startup-collection-checks.js";
 export { filterRecallCandidates } from "./orchestration/generic-recall-paths.js";
 
 export { hasIdentityRecoveryIntent, resolveEffectiveIdentityInjectionMode } from "./orchestration/recall-result-formatter.js";
@@ -948,6 +949,11 @@ export class Orchestrator {
       this.deferredInitAbort = null;
     }
   }
+  async disposeSearchBackendIfNeeded(): Promise<void> {
+    await this.namespaceSearchRouter.disableSearchBackends();
+    await (this.qmd as { dispose?: () => void | Promise<void> }).dispose?.();
+  }
+
   /** Track a recall-side write so destroy() can wait for it before teardown. @internal */
   trackRecallBackgroundWrite(promise: Promise<void>, label: string): void {
     trackRecallWrite(this, promise, label);
@@ -958,6 +964,7 @@ export class Orchestrator {
    * commands should call it before returning to let Node exit naturally.
    */
   async destroy(): Promise<void> {
+    this._orchestratorInitCoordinator?.retireStartupEpoch();
     this.abortDeferredInit();
     this.extractionQueueCoordinator.stopAccepting();
     if (this.wearablesAutoSyncHandle) {

package/src/qmd.ts

@@ -1274,8 +1274,10 @@ export class QmdClient implements SearchBackend {
     return env;
   }
 
-  async probe(): Promise<boolean> {
-    const cliOk = await this.probeCli();
+  async probe(execution?: SearchExecutionOptions): Promise<boolean> {
+    if (execution?.signal?.aborted) return false;
+    const cliOk = await this.probeCli({ signal: execution?.signal });
+    if (execution?.signal?.aborted) return false;
     if (this.daemonEnabled) {
       await this.probeDaemon();
     }
@@ -1386,14 +1388,15 @@ export class QmdClient implements SearchBackend {
       qmdPath: string,
       source: typeof this.qmdPathSource
     ): Promise<void> => {
+      if (options.signal?.aborted) return;
       this.available = true;
       this.qmdPath = qmdPath;
       this.qmdPathSource = source;
       this.cliVersion = parseQmdVersionOutput(result.stdout, result.stderr);
       this.qmdCapabilities = resolveQmdCapabilities(this.cliVersion);
       this.lastCliProbeError = null;
-      if (options.allowAutoUpgrade !== false) {
-        await this.maybeAutoUpgradeQmd();
+      if (options.allowAutoUpgrade !== false && !options.signal?.aborted) {
+        await this.maybeAutoUpgradeQmd(options.signal);
       }
     };
 
@@ -1485,8 +1488,8 @@ export class QmdClient implements SearchBackend {
     }
   }
 
-  private async maybeAutoUpgradeQmd(): Promise<void> {
-    if (!this.qmdAutoUpgradeEnabled) return;
+  private async maybeAutoUpgradeQmd(signal?: AbortSignal): Promise<void> {
+    if (signal?.aborted || !this.qmdAutoUpgradeEnabled) return;
     const state = getGlobalQmdState();
     const targetKey = this.autoUpgradeTargetKey();
     const now = Date.now();
@@ -1522,13 +1525,16 @@ export class QmdClient implements SearchBackend {
       return;
     }
 
+    if (signal?.aborted) return;
     const packageSpec = `${QMD_PACKAGE_NAME}@${this.qmdSupportedVersion}`;
     try {
       log.warn(
         `QMD auto-upgrade: installed=${qmdVersionToString(installed)} supported=${qmdVersionToString(supported)}; running npm install -g ${packageSpec}`
       );
-      await runProcessCommand("npm", ["install", "-g", packageSpec], QMD_AUTO_UPGRADE_TIMEOUT_MS);
-      const postInstall = await this.probePostInstallQmdVersion(supported);
+      await runProcessCommand("npm", ["install", "-g", packageSpec], QMD_AUTO_UPGRADE_TIMEOUT_MS, signal);
+      if (signal?.aborted) return;
+      const postInstall = await this.probePostInstallQmdVersion(supported, signal);
+      if (signal?.aborted) return;
       this.qmdPath = postInstall.qmdPath;
       this.qmdPathSource = postInstall.source;
       this.cliVersion = postInstall.version;
@@ -1551,13 +1557,17 @@ export class QmdClient implements SearchBackend {
         `upgraded: installed=${this.cliVersion ?? "unknown"} target=${this.qmdSupportedVersion}`
       );
     } catch (err) {
+      if (signal?.aborted) return;
       const msg = err instanceof Error ? err.message : String(err);
       recordAutoUpgradeStatus(state, targetKey, `failed: ${msg}`);
       log.warn(`QMD auto-upgrade failed: ${msg}`);
     }
   }
 
-  private async probePostInstallQmdVersion(supported: QmdVersionTuple): Promise<{
+  private async probePostInstallQmdVersion(
+    supported: QmdVersionTuple,
+    signal?: AbortSignal,
+  ): Promise<{
     qmdPath: string;
     source: "auto-path" | "auto-fallback";
     version: string | null;
@@ -1565,12 +1575,13 @@ export class QmdClient implements SearchBackend {
     let lastErr: unknown;
     let lastResult: { qmdPath: string; source: "auto-path" | "auto-fallback"; version: string | null } | null = null;
     for (const candidate of getQmdPostInstallProbeTargets(this.qmdPath, this.qmdPathSource)) {
+      if (signal?.aborted) throw new Error("QMD auto-upgrade post-install probe aborted");
       try {
         const result = await runQmd(
           ["--version"],
           QMD_PROBE_TIMEOUT_MS,
           candidate.qmdPath,
-          undefined,
+          signal,
           this.qmdRuntimeEnv
         );
         const postInstall = {

package/src/recall-rerank-coordinator.test.ts

@@ -567,3 +567,156 @@ test("trust rerank preserves duplicate paths owned by different namespaces (#202
   );
   assert.equal(outcome.trustByPath?.size, 2, "trust metadata must have one entry per namespaced result");
 });
+
+test("#2859 state-view cap: pairs reconcile before cap/MMR and count as one evidence packet", () => {
+  // MMR off so the ordered pool equals the input order — the packet
+  // semantics under test are then fully deterministic.
+  const config = parseConfig({ recallMmrEnabled: false });
+  const corpus = makeFakes([]);
+  const coordinator = new RecallRerankCoordinator({
+    getConfig: () => config,
+    getStorage: corpus.getStorage,
+    readQmdResultMemory: async () => null,
+  });
+  const sv = (
+    id: string,
+    score: number,
+    chain: Partial<QmdSearchResult> = {},
+  ): QmdSearchResult => ({ ...result(id, score), id, status: "active", ...chain });
+  const rows: QmdSearchResult[] = [
+    sv("p1", 0.95, { status: "superseded", supersededBy: "s1" }),
+    sv("orphan", 0.9, { status: "superseded", supersededBy: "absent" }),
+    sv("s1", 0.85),
+    sv("f1", 0.8),
+    sv("f2", 0.75),
+  ];
+  const caps = resolveCapabilities(config);
+
+  // Packet view: [p1+s1], [f1], [f2] — the orphan is reconciled away
+  // BEFORE the cap, and the admitted pair consumes a single slot.
+  const partition = coordinator.diversifyRecallResultsWithHeadroom(
+    "memories",
+    rows,
+    2,
+    undefined,
+    caps,
+    true,
+  );
+  assert.deepEqual(
+    partition.appliedResults.map((r) => r.id),
+    ["p1", "s1", "f1"],
+    "a complete pair is one packet: pred+succ plus one filler for limit 2",
+  );
+  assert.deepEqual(
+    partition.headroomResults.map((r) => r.id),
+    ["f2"],
+    "headroom is the remainder of the reconciled pool",
+  );
+
+  // The slice never splits a packet at the boundary: even with the
+  // successor ranked LAST, the pair is admitted together.
+  const splitRisk: QmdSearchResult[] = [
+    sv("p1", 0.95, { status: "superseded", supersededBy: "s1" }),
+    sv("f1", 0.9),
+    sv("f2", 0.85),
+    sv("s1", 0.8),
+  ];
+  const applied = coordinator.diversifyAndLimitRecallResults(
+    "memories",
+    splitRisk,
+    2,
+    undefined,
+    caps,
+    true,
+  );
+  assert.deepEqual(
+    applied.map((r) => r.id),
+    ["p1", "f1", "s1"],
+    "no underfill: the boundary keeps the evidence packet complete",
+  );
+
+  // Flag absent → the legacy row slice, byte-identical (zero-diff default).
+  const legacy = coordinator.diversifyAndLimitRecallResults(
+    "memories",
+    rows,
+    2,
+    undefined,
+    caps,
+  );
+  assert.deepEqual(
+    legacy.map((r) => r.id),
+    ["p1", "orphan"],
+    "without the state view the cap stays the plain top-N row slice",
+  );
+});
+
+test("#2859 packet cap after filter: a quarantined successor does not consume budget", () => {
+  const config = parseConfig({ recallMmrEnabled: false });
+  const corpus = makeFakes([]);
+  const coordinator = new RecallRerankCoordinator({
+    getConfig: () => config,
+    getStorage: corpus.getStorage,
+    readQmdResultMemory: async () => null,
+  });
+  const sv = (
+    id: string,
+    score: number,
+    chain: Partial<QmdSearchResult> = {},
+  ): QmdSearchResult => ({ ...result(id, score), id, status: "active", ...chain });
+  // Trust already removed s1. Cap-after-filter must drop the orphaned
+  // predecessor and promote the next live packet instead of returning empty.
+  const afterTrust: QmdSearchResult[] = [
+    sv("p1", 0.95, { status: "superseded", supersededBy: "s1" }),
+    sv("f1", 0.8),
+    sv("f2", 0.75),
+  ];
+  const partition = coordinator.diversifyRecallResultsWithHeadroom(
+    "memories",
+    afterTrust,
+    1,
+    undefined,
+    resolveCapabilities(config),
+    true,
+  );
+  assert.deepEqual(
+    partition.appliedResults.map((row) => row.id),
+    ["f1"],
+    "disallowed pair must not occupy the only packet slot",
+  );
+  assert.deepEqual(
+    partition.headroomResults.map((row) => row.id),
+    ["f2"],
+  );
+});
+
+test("#2859 linkless superseded status does not consume a packet slot", () => {
+  const config = parseConfig({ recallMmrEnabled: false });
+  const corpus = makeFakes([]);
+  const coordinator = new RecallRerankCoordinator({
+    getConfig: () => config,
+    getStorage: corpus.getStorage,
+    readQmdResultMemory: async () => null,
+  });
+  const sv = (
+    id: string,
+    score: number,
+    chain: Partial<QmdSearchResult> = {},
+  ): QmdSearchResult => ({ ...result(id, score), id, status: "active", ...chain });
+  const rows: QmdSearchResult[] = [
+    sv("legacy", 0.99, { status: "superseded" }),
+    sv("live", 0.5),
+  ];
+  const applied = coordinator.diversifyAndLimitRecallResults(
+    "memories",
+    rows,
+    1,
+    undefined,
+    resolveCapabilities(config),
+    true,
+  );
+  assert.deepEqual(
+    applied.map((row) => row.id),
+    ["live"],
+    "status-only superseded rows are rejected before the packet cap",
+  );
+});

package/src/recall-state-view-admission.ts

@@ -12,7 +12,17 @@ import { applyRecallStateViews } from "./recall-state-view-wire.js";
 import { shouldFilterSupersededFromRecall } from "./temporal-supersession.js";
 import type { MemoryFile } from "./types.js";
 
-/** Config flag OR per-call override, gated on change intent; computed once for all branches. */
+/**
+ * Config flag OR per-call override, gated on change intent; computed once
+ * for all branches.
+ *
+ * #2893: `query` MUST be the ORIGINAL prompt, not the cron-normalized
+ * retrievalQuery — buildRecallQueryPolicy truncates standard prompts at
+ * maxChars and strips stop-words ("when", "before", "after") from
+ * instruction-heavy ones, either of which can erase the change-intent
+ * signal before retrieval. Only the resulting boolean flows downstream;
+ * retrieval itself keeps using the normalized query.
+ */
 export function resolveRecallStateViewActive(
   options: { stateView?: boolean },
   config: { recallStateViews?: boolean },

package/src/recall-state-view-anchors.ts

@@ -0,0 +1,163 @@
+import { isChangeOrientedQuery, stateViewKey } from "./recall-state-view.js";
+/**
+ * State-view anchor admission (#2859).
+ *
+ * Shared namespace-qualified admission tracker for the recall safety
+ * filter (QMD/embedding/cold paths) and the recent-scan path. A deferred
+ * superseded row is admitted only when an in-set successor anchors it —
+ * through the row's own `supersededBy` or through an admitted successor's
+ * `supersedes` back-pointer. Identities are `namespace\0id`, so identical
+ * ids across namespace fanout never cross-anchor.
+ */
+import { shouldFilterSupersededFromRecall } from "./temporal-supersession.js";
+import type { MemoryFile } from "./types.js";
+
+export interface StateViewAnchorFrontmatter {
+  id?: string;
+  supersedes?: string;
+  supersededBy?: string;
+}
+
+/**
+ * #2859 — pair reconciliation and packet-counting caps apply only WITHOUT
+ * a historical pin: under asOf the validity filter legitimately orphans
+ * predecessors (see annotateStateView's asOf mode).
+ */
+export function stateViewPacketActive(stateViewActive: boolean | undefined, asOfMs: number | undefined): boolean {
+  return stateViewActive === true && !(typeof asOfMs === "number" && Number.isFinite(asOfMs));
+}
+
+/**
+ * #1952/#2859 — config flag OR per-call override, gated on change intent.
+ * Packet semantics are off under a historical asOf pin (see stateViewPacketActive).
+ */
+export function resolveRecallStateViewFlags(
+  optionFlag: boolean | undefined,
+  configFlag: boolean | undefined,
+  retrievalQuery: string,
+  asOfMs: number | undefined,
+): { stateViewActive: boolean; stateViewPacketActive: boolean } {
+  const stateViewActive =
+    (optionFlag === true || configFlag === true) && isChangeOrientedQuery(retrievalQuery);
+  return { stateViewActive, stateViewPacketActive: stateViewPacketActive(stateViewActive, asOfMs) };
+}
+
+export class StateViewAnchorTracker {
+  private readonly admitted = new Set<string>();
+  private readonly supersedesAnchors = new Set<string>();
+
+  has(namespace: string | undefined, frontmatter: StateViewAnchorFrontmatter): boolean {
+    const id = frontmatter.id;
+    return typeof id === "string" && id.length > 0 ? this.admitted.has(stateViewKey(namespace, id)) : false;
+  }
+
+  /**
+   * Register a row as admitted (a survivor of every gate, or a deferred
+   * row whose successor anchored it). The row's `supersedes` back-pointer
+   * then anchors its own predecessor.
+   */
+  admit(namespace: string | undefined, frontmatter: StateViewAnchorFrontmatter): void {
+    const id = frontmatter.id;
+    if (typeof id !== "string" || id.length === 0) return;
+    this.admitted.add(stateViewKey(namespace, id));
+    if (frontmatter.supersedes) {
+      this.supersedesAnchors.add(stateViewKey(namespace, frontmatter.supersedes));
+    }
+  }
+
+  /** True when an admitted successor anchors this superseded row. */
+  anchored(namespace: string | undefined, frontmatter: StateViewAnchorFrontmatter): boolean {
+    const id = frontmatter.id;
+    if (typeof id !== "string" || id.length === 0) return false;
+    const successorId = frontmatter.supersededBy;
+    return (
+      (typeof successorId === "string" && this.admitted.has(stateViewKey(namespace, successorId))) ||
+      this.supersedesAnchors.has(stateViewKey(namespace, id))
+    );
+  }
+}
+
+export interface StateViewRecentAdmissionDeps {
+  namespaceOf: (path: string) => string;
+  isExcluded: (path: string) => boolean;
+  supersessionOptions: { enabled: boolean; includeInRecall: boolean };
+}
+
+/**
+ * #2859 — recent-scan admission: seed the tracker with every memory that
+ * survives the supersession gate, then admit superseded rows anchored by
+ * an in-set successor (fixpoint — an admitted link anchors the next).
+ */
+export function admitStateViewRecentMemories(
+  memories: readonly MemoryFile[],
+  deps: StateViewRecentAdmissionDeps
+): StateViewAnchorTracker {
+  const tracker = new StateViewAnchorTracker();
+  for (const m of memories) {
+    if (deps.isExcluded(m.path)) continue;
+    if (m.frontmatter.status === "superseded") continue;
+    if (shouldFilterSupersededFromRecall(m.frontmatter, deps.supersessionOptions)) continue;
+    tracker.admit(deps.namespaceOf(m.path), m.frontmatter);
+  }
+  for (let progress = true; progress; ) {
+    progress = false;
+    for (const m of memories) {
+      const namespace = deps.namespaceOf(m.path);
+      if (tracker.has(namespace, m.frontmatter)) continue;
+      if (deps.isExcluded(m.path)) continue;
+      if (m.frontmatter.status !== "superseded") continue;
+      if (!shouldFilterSupersededFromRecall(m.frontmatter, deps.supersessionOptions)) continue;
+      if (tracker.anchored(namespace, m.frontmatter)) {
+        tracker.admit(namespace, m.frontmatter);
+        progress = true;
+      }
+    }
+  }
+  return tracker;
+}
+
+export interface RecentScanMemoryFilterDeps extends StateViewRecentAdmissionDeps {
+  stateViewActive: boolean;
+  asOfMs: number | undefined;
+}
+
+/**
+ * Recent-scan admission for the fallback path.
+ *
+ * Superseded-status filtering delegates to
+ * shouldFilterSupersededFromRecall so recent-scan and the QMD
+ * safety filter share semantics (kill switch, audit mode, PR #402).
+ * #1952: an active state view admits a superseded memory whose
+ * successor ALSO survives this admission filter (fixpoint below).
+ * PR #713: when `as_of` is active, pass superseded candidates
+ * through here — boostSearchResults's `[valid_at, invalid_at)`
+ * evaluation is the authoritative historical gate. Other
+ * non-active statuses stay excluded.
+ * #2859: namespace-qualified anchors with the supersedes
+ * back-pointer — mirrors the safety-filter fixpoint.
+ */
+export function filterRecentScanMemories(
+  memories: readonly MemoryFile[],
+  deps: RecentScanMemoryFilterDeps,
+): MemoryFile[] {
+  const asOfActive = typeof deps.asOfMs === "number" && Number.isFinite(deps.asOfMs);
+  const stateViewAnchors =
+    deps.stateViewActive && !asOfActive ? admitStateViewRecentMemories(memories, deps) : null;
+  return memories.filter((m) => {
+    if (deps.isExcluded(m.path)) return false;
+    const status = m.frontmatter.status;
+    if (!status || status === "active") return true;
+    if (status === "superseded") {
+      if (asOfActive) return true;
+      if (stateViewAnchors?.has(deps.namespaceOf(m.path), m.frontmatter)) {
+        return true;
+      }
+      // Include superseded memory only if the canonical gate says
+      // NOT to filter it (kill switch off or audit mode on).
+      return !shouldFilterSupersededFromRecall(m.frontmatter, deps.supersessionOptions);
+    }
+    // Other non-active statuses (archived, retired, etc.) are
+    // excluded from the recent-scan path by default.
+    return false;
+  });
+}