@remnic/core 9.69.39 → 9.69.40

package/src/orchestration/recall-internal.ts

@@ -98,11 +98,8 @@ import {
   type RecallInvocationOptions,
 } from "../orchestrator.js";
 import { isGenericRecallExcludedPath } from "./generic-recall-paths.js";
-import {
-  filterRecentScanMemories,
-  resolveRecallStateViewFlags,
-} from "../recall-state-view-anchors.js";
-import { indexStateViewAnnotatedResults } from "../recall-state-view-admission.js";
+import { filterRecentScanMemories } from "../recall-state-view-anchors.js";
+import { indexStateViewAnnotatedResults, resolveRecallStateViewActive } from "../recall-state-view-admission.js";
 import type { RecallSectionBuckets } from "./recall-section-coordinator.js";
 import {
   reconcileRecallResultPartition,
@@ -248,12 +245,9 @@ export class RecallInternalCoordinator {
     });
     // #1952 state views: config flag OR per-call override, gated on change intent; computed once for all branches.
     const retrievalQuery = queryPolicy.retrievalQuery || prompt;
-    const { stateViewActive, stateViewPacketActive } = resolveRecallStateViewFlags(
-      options.stateView,
-      this.deps.config.recallStateViews,
-      retrievalQuery,
-      asOfMs,
-    );
+    const stateViewActive = resolveRecallStateViewActive(options, this.deps.config, prompt);
+    const stateViewPacketActive =
+      stateViewActive === true && !(typeof asOfMs === "number" && Number.isFinite(asOfMs));
     const retrievalQueryHash = createHash("sha256")
       .update(retrievalQuery)
       .digest("hex");

package/src/orchestration/semantic-merge-promotion-payload.ts

@@ -4,7 +4,9 @@
  * within its file-size ratchet. Everything here derives from the re-read
  * COMMITTED record; nothing reads the incoming extraction.
  */
-
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { canonicalSemanticFileText } from "../storage/cas-revision-store.js";
 import { parseOriginClass } from "../security/origin-authority.js";
 import { log } from "../logger.js";
 import { inferMemoryStatus } from "../memory-lifecycle-ledger-utils.js";
@@ -76,6 +78,15 @@ export interface MergedTargetPromotionPayload {
   committedRevision?: string;
   /** #2813 (P1 B): sha256 hex digest of the durable memory file when committed. */
   committedDigest?: string;
+  /** #2870: canonical SEMANTIC fingerprint of the durable file at
+   * payload-build time — access telemetry (`accessCount`/`lastAccessed`)
+   * excluded, the same exclusion set `invalidationCommitFingerprint`
+   * applies. The final guard re-reads the file and compares THIS, not the
+   * byte digest: an access-tracking flush between build and promotion
+   * leaves it equal (the flush mints no receipt and touches no semantic
+   * line), while any body/confidence/provenance/scope/tags/status change
+   * makes it differ. */
+  committedSemanticFingerprint?: string;
 }
 
 /**
@@ -151,13 +162,22 @@ export async function buildMergedTargetPromotionPayload(
     return { payload: null, readFailed: false };
   }
   const fm = committed.frontmatter;
-  // #2813 (P1 B): promotion reads record metadata and digest, then receipt.
-  // Compare record snapshot digest to receipt's committed digest to catch
-  // interleaving metadata writers with same body/new metadata.
+  // #2870: bind to the record's SEMANTIC identity, not its bytes. The
+  // receipt's committed semantic fingerprint — the durable file with the
+  // access-telemetry keys (`accessCount:`, `lastAccessed:`) stripped, the
+  // same exclusion set `invalidationCommitFingerprint` applies — stays
+  // equal across an access-tracking flush (which rewrites exactly those
+  // two lines without minting a receipt), so a flush between the merge
+  // commit and this reread no longer blocks a valid promotion. Any other
+  // frontmatter or body change still refuses. Shards recorded before
+  // #2870 carry no stored semantic fingerprint; those keep the stricter
+  // full-digest comparison until the next semantic write re-records the
+  // shard.
   const snapshotDigest =
     typeof storage.readDurableFileDigest === "function"
       ? await storage.readDurableFileDigest(committed.path).catch(() => null)
       : null;
+  const snapshotSemanticFingerprint = await readDurableSemanticFingerprint(committed.path);
   const receipt = await readPromotionReceiptStatus(storage, committed.path);
   if (!receipt.available) {
     log.warn(
@@ -165,7 +185,22 @@ export async function buildMergedTargetPromotionPayload(
     );
     return { payload: null, readFailed: true };
   }
-  if (receipt.committedDigest !== undefined && snapshotDigest !== receipt.committedDigest) {
+  if (
+    receipt.committedSemanticFingerprint !== undefined &&
+    snapshotSemanticFingerprint !== receipt.committedSemanticFingerprint
+  ) {
+    log.warn(
+      snapshotSemanticFingerprint == null
+        ? `semantic-merge: merged-target promotion refused for ${merge.targetId} — the semantic snapshot fingerprint is unavailable while the CAS receipt carries ${receipt.committedSemanticFingerprint}; promotion and reconciliation retry on the next merge`
+        : `semantic-merge: merged-target promotion refused for ${merge.targetId} — record semantic fingerprint (${snapshotSemanticFingerprint}) does not match committed receipt fingerprint (${receipt.committedSemanticFingerprint}); record metadata was mutated concurrently`,
+    );
+    return { payload: null, readFailed: true };
+  }
+  if (
+    receipt.committedSemanticFingerprint === undefined &&
+    receipt.committedDigest !== undefined &&
+    snapshotDigest !== receipt.committedDigest
+  ) {
     log.warn(
       snapshotDigest == null
         ? `semantic-merge: merged-target promotion refused for ${merge.targetId} — the record snapshot digest is unavailable while the CAS receipt carries committed digest ${receipt.committedDigest}; promotion and reconciliation retry on the next merge`
@@ -210,11 +245,30 @@ export async function buildMergedTargetPromotionPayload(
         : snapshotDigest !== null
           ? { committedDigest: snapshotDigest }
           : {}),
+      ...(receipt.committedSemanticFingerprint !== undefined
+        ? { committedSemanticFingerprint: receipt.committedSemanticFingerprint }
+        : snapshotSemanticFingerprint !== null
+          ? { committedSemanticFingerprint: snapshotSemanticFingerprint }
+          : {}),
     },
     readFailed: false,
   };
 }
 
+/** #2870: canonical SEMANTIC fingerprint of a durable file's CURRENT
+ * bytes — the file text with access telemetry stripped
+ * ({@link canonicalSemanticFileText}), hashed exactly the way the CAS
+ * receipt records it at commit time. Null when the file cannot be read
+ * (fail-open, like readDurableFileDigest). */
+export async function readDurableSemanticFingerprint(filePath: string): Promise<string | null> {
+  try {
+    return createHash("sha256")
+      .update(canonicalSemanticFileText(await readFile(filePath, "utf8")))
+      .digest("hex");
+  } catch {
+    return null;
+  }
+}
 /** #2813 (P1 A): read the standing receipt as a three-way truth for the
  * promotion path. Present and absent are usable identities (absent = the
  * target predates the sidecar); unavailable is not. A storage whose status
@@ -223,7 +277,7 @@ export async function readPromotionReceiptStatus(
   storage: Pick<StorageManager, "readCasRevisionStatus">,
   filePath: string,
 ): Promise<
-  | { available: true; revision: string | undefined; committedDigest?: string }
+  | { available: true; revision: string | undefined; committedDigest?: string; committedSemanticFingerprint?: string }
   | { available: false; reason: string }
 > {
   try {
@@ -233,6 +287,8 @@ export async function readPromotionReceiptStatus(
       available: true,
       revision: status.status === "present" ? status.revision : undefined,
       committedDigest: status.status === "present" ? status.committedDigest : undefined,
+      committedSemanticFingerprint:
+        status.status === "present" ? status.committedSemanticFingerprint : undefined,
     };
   } catch (err) {
     return { available: false, reason: err instanceof Error ? err.message : String(err) };

package/src/orchestration/startup-collection-checks.ts

@@ -0,0 +1,85 @@
+import { log } from "../logger.js";
+import {
+  qmdStartupCollectionCheckTimeoutMs,
+  type SearchCollectionState,
+} from "./orchestrator-helpers.js";
+
+export interface QmdStartupCollectionCheckResult {
+  namespace: string;
+  state: SearchCollectionState;
+}
+
+export interface StartupDiscovery<T> {
+  value: T;
+  complete: boolean;
+}
+
+/**
+ * Bound any startup discovery that must not hold a readiness gate forever.
+ * Discovery APIs such as the namespace catalog do not accept an AbortSignal,
+ * so a late result is deliberately ignored after the configured fallback wins.
+ */
+export async function startupDiscoveryWithTimeout<T>(
+  discover: () => Promise<T>,
+  configuredFallback: T,
+  timeoutMs = qmdStartupCollectionCheckTimeoutMs(),
+): Promise<StartupDiscovery<T>> {
+  let timer: NodeJS.Timeout | undefined;
+  const fallback: StartupDiscovery<T> = {
+    value: configuredFallback,
+    complete: false,
+  };
+  const timeoutPromise = new Promise<StartupDiscovery<T>>((resolve) => {
+    timer = setTimeout(() => {
+      log.warn(
+        `startup discovery timed out after ${timeoutMs}ms; using configured fallback fail-open`,
+      );
+      resolve(fallback);
+    }, timeoutMs);
+  });
+  try {
+    return await Promise.race([
+      Promise.resolve()
+        .then(discover)
+        .then((value) => ({ value, complete: true })),
+      timeoutPromise,
+    ]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+
+/**
+ * Bound the complete startup collection-check batch, not just each individual
+ * check. This preserves service availability when a backend ignores an abort
+ * signal or a check promise never settles: startup continues with fail-open
+ * `unknown` states and the normal background retry path can repair search.
+ */
+export async function qmdStartupCollectionChecksWithTimeout(
+  checks: readonly Promise<QmdStartupCollectionCheckResult>[],
+  namespaces: readonly string[],
+  timeoutMs = qmdStartupCollectionCheckTimeoutMs() + 1_000,
+): Promise<QmdStartupCollectionCheckResult[]> {
+  if (checks.length === 0) return [];
+  const settled = new Map<string, QmdStartupCollectionCheckResult>();
+  const trackedChecks = checks.map((check) => check.then((result) => {
+    settled.set(result.namespace, result);
+    return result;
+  }));
+  let timer: NodeJS.Timeout | undefined;
+  const timeoutPromise = new Promise<QmdStartupCollectionCheckResult[]>((resolve) => {
+    timer = setTimeout(() => {
+      log.warn(
+        `QMD startup collection check batch timed out after ${timeoutMs}ms; keeping search enabled fail-open`,
+      );
+      resolve(namespaces.map((namespace) =>
+        settled.get(namespace) ?? { namespace, state: "unknown" as const },
+      ));
+    }, timeoutMs);
+  });
+  try {
+    return await Promise.race([Promise.all(trackedChecks), timeoutPromise]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}

package/src/orchestrator-flush.test.ts

@@ -2770,6 +2770,11 @@ test("deferredInitialize startup sync covers cataloged dynamic namespaces (NHZEV
   const orchestrator = Object.create(Orchestrator.prototype) as any;
   let updateArg: string[] | undefined;
   const abortController = new AbortController();
+  // #2980 fences startup work by lifecycle epoch: deferredInitialize() now
+  // begins an epoch that resets the gate fields the selfDeps seam fail-fasts
+  // on (PR #1801 set-trap contract). Prototype fakes must declare them.
+  orchestrator.deferredInitAbort = null;
+  orchestrator.deferredSyncSucceeded = false;
   const memoryDir = path.join(os.tmpdir(), "remnic-startup-maintenance-nhzev");
   const dynamicNamespace = "project-origin-dynamic";
   const dynamicStorageDir = path.join(
@@ -2838,6 +2843,8 @@ test("deferredInitialize startup sync falls back to configured set on catalog re
   const orchestrator = Object.create(Orchestrator.prototype) as any;
   let updateArg: string[] | undefined;
   const abortController = new AbortController();
+  orchestrator.deferredInitAbort = null;
+  orchestrator.deferredSyncSucceeded = false;
 
   orchestrator.config = {
     namespacesEnabled: true,