@remnic/core 9.69.39 → 9.69.40

package/src/orchestrator.ts

@@ -213,6 +213,7 @@ export {
   type RecallInvocationOptions,
   type RecallModeDecision,
 } from "./orchestration/orchestrator-helpers.js";
+export { qmdStartupCollectionChecksWithTimeout } from "./orchestration/startup-collection-checks.js";
 export { filterRecallCandidates } from "./orchestration/generic-recall-paths.js";
 
 export { hasIdentityRecoveryIntent, resolveEffectiveIdentityInjectionMode } from "./orchestration/recall-result-formatter.js";
@@ -948,6 +949,11 @@ export class Orchestrator {
       this.deferredInitAbort = null;
     }
   }
+  async disposeSearchBackendIfNeeded(): Promise<void> {
+    await this.namespaceSearchRouter.disableSearchBackends();
+    await (this.qmd as { dispose?: () => void | Promise<void> }).dispose?.();
+  }
+
   /** Track a recall-side write so destroy() can wait for it before teardown. @internal */
   trackRecallBackgroundWrite(promise: Promise<void>, label: string): void {
     trackRecallWrite(this, promise, label);
@@ -958,6 +964,7 @@ export class Orchestrator {
    * commands should call it before returning to let Node exit naturally.
    */
   async destroy(): Promise<void> {
+    this._orchestratorInitCoordinator?.retireStartupEpoch();
     this.abortDeferredInit();
     this.extractionQueueCoordinator.stopAccepting();
     if (this.wearablesAutoSyncHandle) {

package/src/qmd.ts

@@ -1274,8 +1274,10 @@ export class QmdClient implements SearchBackend {
     return env;
   }
 
-  async probe(): Promise<boolean> {
-    const cliOk = await this.probeCli();
+  async probe(execution?: SearchExecutionOptions): Promise<boolean> {
+    if (execution?.signal?.aborted) return false;
+    const cliOk = await this.probeCli({ signal: execution?.signal });
+    if (execution?.signal?.aborted) return false;
     if (this.daemonEnabled) {
       await this.probeDaemon();
     }
@@ -1386,14 +1388,15 @@ export class QmdClient implements SearchBackend {
       qmdPath: string,
       source: typeof this.qmdPathSource
     ): Promise<void> => {
+      if (options.signal?.aborted) return;
       this.available = true;
       this.qmdPath = qmdPath;
       this.qmdPathSource = source;
       this.cliVersion = parseQmdVersionOutput(result.stdout, result.stderr);
       this.qmdCapabilities = resolveQmdCapabilities(this.cliVersion);
       this.lastCliProbeError = null;
-      if (options.allowAutoUpgrade !== false) {
-        await this.maybeAutoUpgradeQmd();
+      if (options.allowAutoUpgrade !== false && !options.signal?.aborted) {
+        await this.maybeAutoUpgradeQmd(options.signal);
       }
     };
 
@@ -1485,8 +1488,8 @@ export class QmdClient implements SearchBackend {
     }
   }
 
-  private async maybeAutoUpgradeQmd(): Promise<void> {
-    if (!this.qmdAutoUpgradeEnabled) return;
+  private async maybeAutoUpgradeQmd(signal?: AbortSignal): Promise<void> {
+    if (signal?.aborted || !this.qmdAutoUpgradeEnabled) return;
     const state = getGlobalQmdState();
     const targetKey = this.autoUpgradeTargetKey();
     const now = Date.now();
@@ -1522,13 +1525,16 @@ export class QmdClient implements SearchBackend {
       return;
     }
 
+    if (signal?.aborted) return;
     const packageSpec = `${QMD_PACKAGE_NAME}@${this.qmdSupportedVersion}`;
     try {
       log.warn(
         `QMD auto-upgrade: installed=${qmdVersionToString(installed)} supported=${qmdVersionToString(supported)}; running npm install -g ${packageSpec}`
       );
-      await runProcessCommand("npm", ["install", "-g", packageSpec], QMD_AUTO_UPGRADE_TIMEOUT_MS);
-      const postInstall = await this.probePostInstallQmdVersion(supported);
+      await runProcessCommand("npm", ["install", "-g", packageSpec], QMD_AUTO_UPGRADE_TIMEOUT_MS, signal);
+      if (signal?.aborted) return;
+      const postInstall = await this.probePostInstallQmdVersion(supported, signal);
+      if (signal?.aborted) return;
       this.qmdPath = postInstall.qmdPath;
       this.qmdPathSource = postInstall.source;
       this.cliVersion = postInstall.version;
@@ -1551,13 +1557,17 @@ export class QmdClient implements SearchBackend {
         `upgraded: installed=${this.cliVersion ?? "unknown"} target=${this.qmdSupportedVersion}`
       );
     } catch (err) {
+      if (signal?.aborted) return;
       const msg = err instanceof Error ? err.message : String(err);
       recordAutoUpgradeStatus(state, targetKey, `failed: ${msg}`);
       log.warn(`QMD auto-upgrade failed: ${msg}`);
     }
   }
 
-  private async probePostInstallQmdVersion(supported: QmdVersionTuple): Promise<{
+  private async probePostInstallQmdVersion(
+    supported: QmdVersionTuple,
+    signal?: AbortSignal,
+  ): Promise<{
     qmdPath: string;
     source: "auto-path" | "auto-fallback";
     version: string | null;
@@ -1565,12 +1575,13 @@ export class QmdClient implements SearchBackend {
     let lastErr: unknown;
     let lastResult: { qmdPath: string; source: "auto-path" | "auto-fallback"; version: string | null } | null = null;
     for (const candidate of getQmdPostInstallProbeTargets(this.qmdPath, this.qmdPathSource)) {
+      if (signal?.aborted) throw new Error("QMD auto-upgrade post-install probe aborted");
       try {
         const result = await runQmd(
           ["--version"],
           QMD_PROBE_TIMEOUT_MS,
           candidate.qmdPath,
-          undefined,
+          signal,
           this.qmdRuntimeEnv
         );
         const postInstall = {

package/src/recall-state-view-admission.ts

@@ -12,7 +12,17 @@ import { applyRecallStateViews } from "./recall-state-view-wire.js";
 import { shouldFilterSupersededFromRecall } from "./temporal-supersession.js";
 import type { MemoryFile } from "./types.js";
 
-/** Config flag OR per-call override, gated on change intent; computed once for all branches. */
+/**
+ * Config flag OR per-call override, gated on change intent; computed once
+ * for all branches.
+ *
+ * #2893: `query` MUST be the ORIGINAL prompt, not the cron-normalized
+ * retrievalQuery — buildRecallQueryPolicy truncates standard prompts at
+ * maxChars and strips stop-words ("when", "before", "after") from
+ * instruction-heavy ones, either of which can erase the change-intent
+ * signal before retrieval. Only the resulting boolean flows downstream;
+ * retrieval itself keeps using the normalized query.
+ */
 export function resolveRecallStateViewActive(
   options: { stateView?: boolean },
   config: { recallStateViews?: boolean },

package/src/recall-state-view-cron-intent.test.ts

@@ -0,0 +1,268 @@
+/**
+ * recall-state-view-cron-intent.test.ts — issue #2893.
+ *
+ * Cron recall policy (buildRecallQueryPolicy) normalizes the retrieval
+ * query: standard prompts are truncated at maxChars, instruction-heavy
+ * prompts are compacted with stop-word removal ("when", "before",
+ * "after") plus a token cap. Either path can erase the change-intent
+ * signal that gates state views. These regressions pin:
+ *
+ * 1. Change intent is classified from the ORIGINAL prompt at the recall
+ *    entry seam, so a long cron prompt whose intent phrase lies beyond
+ *    the normalization cutoff still activates state views.
+ * 2. Only the validated boolean flows downstream: retrieval keeps the
+ *    normalized query, and the inject seam does not re-classify intent
+ *    against it when the per-request flag is threaded.
+ * 3. Negative controls: non-change prompts, flag-less calls, and the
+ *    legacy config-only path (no threaded flag) keep prior behavior.
+ */
+
+import assert from "node:assert/strict";
+import os from "node:os";
+import path from "node:path";
+import { mkdtemp, mkdir, writeFile, rm } from "node:fs/promises";
+import test from "node:test";
+
+import { parseConfig } from "./config.js";
+import { buildRecallQueryPolicy, type RecallQueryPolicyConfig } from "./recall-query-policy.js";
+import { resolveRecallStateViewActive } from "./recall-state-view-admission.js";
+import { annotateStateView, isChangeOrientedQuery, type StateViewResult } from "./recall-state-view.js";
+import { widenRecallStateViews } from "./recall-state-view-widen.js";
+import { applyRecallStateViews } from "./recall-state-view-wire.js";
+import { Orchestrator } from "./orchestrator.js";
+import type { PluginConfig } from "./types.js";
+
+// No change-intent tokens; comfortably longer than the 120-char cutoff.
+const FILLER =
+  "daily ops digest for platform delivery covering deploy notes on-call handoffs release cadence sprint board columns quota dashboards vendor invoices and rotating shift owners";
+const LONG_CHANGE = `${FILLER} plus tell me when did the job title change`;
+const LONG_NON_CHANGE = `${FILLER} plus confirm the current job title roster`;
+const CRON_KEY = "sess:cron:nightly-digest";
+const POLICY_CFG: RecallQueryPolicyConfig = {
+  cronRecallPolicyEnabled: true,
+  cronRecallNormalizedQueryMaxChars: 120,
+  cronRecallInstructionHeavyTokenCap: 8,
+  cronConversationRecallMode: "auto",
+};
+
+test("fixtures: filler carries no intent and outruns the cutoff", () => {
+  assert.ok(FILLER.length >= 120, `filler must exceed maxChars, got ${FILLER.length}`);
+  assert.equal(isChangeOrientedQuery(FILLER), false);
+  assert.equal(isChangeOrientedQuery(LONG_CHANGE), true);
+  assert.equal(isChangeOrientedQuery(LONG_NON_CHANGE), false);
+});
+
+test("standard cron truncation erases intent from the normalized query", () => {
+  const policy = buildRecallQueryPolicy(LONG_CHANGE, CRON_KEY, POLICY_CFG);
+  assert.equal(policy.promptShape, "standard");
+  assert.equal(isChangeOrientedQuery(policy.retrievalQuery), false);
+  assert.ok(!policy.retrievalQuery.includes("when did"));
+});
+
+test("instruction-heavy compaction erases intent from the normalized query", () => {
+  const lines = [
+    "GOAL: nightly infrastructure digest",
+    "OUTPUT FORMAT: markdown summary",
+    "TONE RULES: concise operator voice",
+    "GROUNDING RULES: cite memory ids",
+  ];
+  for (let i = 0; i < 10; i += 1) lines.push(`- item-${i} inventory cluster-${i}`);
+  for (let i = 0; i < 14; i += 1) lines.push(`vendor ledger panel review segment ${i}`);
+  lines.push("finally answer when did the job title change");
+  const prompt = lines.join("\n");
+
+  const policy = buildRecallQueryPolicy(prompt, CRON_KEY, POLICY_CFG);
+  assert.equal(policy.promptShape, "instruction_heavy");
+  assert.equal(isChangeOrientedQuery(prompt), true);
+  assert.equal(isChangeOrientedQuery(policy.retrievalQuery), false);
+  assert.ok(!policy.retrievalQuery.includes("change"));
+});
+
+test("entry seam classifies the ORIGINAL prompt, not the normalized query (#2893)", () => {
+  const policy = buildRecallQueryPolicy(LONG_CHANGE, CRON_KEY, POLICY_CFG);
+  // Pre-fix shape: classifying the normalized query disables the view.
+  assert.equal(resolveRecallStateViewActive({ stateView: true }, {}, policy.retrievalQuery), false);
+  // Post-fix contract: the original prompt carries the signal.
+  assert.equal(resolveRecallStateViewActive({ stateView: true }, { recallStateViews: false }, LONG_CHANGE), true);
+  assert.equal(resolveRecallStateViewActive({}, { recallStateViews: true }, LONG_CHANGE), true);
+});
+
+test("negative controls: non-change prompts and flag-less calls stay inactive", () => {
+  assert.equal(
+    resolveRecallStateViewActive({ stateView: true }, { recallStateViews: true }, LONG_NON_CHANGE),
+    false,
+  );
+  assert.equal(resolveRecallStateViewActive({}, {}, LONG_CHANGE), false);
+  assert.equal(
+    resolveRecallStateViewActive({ stateView: false }, { recallStateViews: false }, LONG_CHANGE),
+    false,
+  );
+});
+
+test("non-cron sessions keep the original prompt as the retrieval query", () => {
+  const policy = buildRecallQueryPolicy(LONG_CHANGE, "sess-interactive", POLICY_CFG);
+  assert.equal(policy.retrievalQuery, LONG_CHANGE);
+});
+
+function fact(id: string, extra: Partial<StateViewResult> = {}): StateViewResult {
+  return { id, ...extra };
+}
+
+const CURRENT = fact("new-job", { status: "active" });
+const HISTORICAL = fact("old-job", {
+  status: "superseded",
+  supersededBy: "new-job",
+  supersededAt: "2026-03-01",
+});
+
+test("threaded flag carries the decision past the normalized query at the inject seam (#2893)", () => {
+  const policy = buildRecallQueryPolicy(LONG_CHANGE, CRON_KEY, POLICY_CFG);
+  assert.equal(isChangeOrientedQuery(policy.retrievalQuery), false);
+
+  const labeled = widenRecallStateViews([CURRENT], policy.retrievalQuery, { recallStateViews: false }, [HISTORICAL], true);
+  assert.deepEqual(
+    labeled.map((row) => [row.id, row.stateLabel]),
+    [
+      ["new-job", "current"],
+      ["old-job", "historical"],
+    ],
+  );
+  assert.deepEqual(
+    applyRecallStateViews([CURRENT, HISTORICAL], policy.retrievalQuery, { recallStateViews: false }, true).map(
+      (row) => row.stateLabel,
+    ),
+    ["current", "historical"],
+  );
+  assert.deepEqual(
+    annotateStateView([CURRENT, HISTORICAL], policy.retrievalQuery, [], {
+      enabled: true,
+      changeIntent: true,
+    }).map((row) => row.stateLabel),
+    ["current", "historical"],
+  );
+});
+
+test("legacy config-only path still re-checks intent against the given query", () => {
+  const policy = buildRecallQueryPolicy(LONG_CHANGE, CRON_KEY, POLICY_CFG);
+  const input = [CURRENT, HISTORICAL];
+  // No threaded flag: config-on alone must not label a non-change query.
+  assert.equal(widenRecallStateViews(input, policy.retrievalQuery, { recallStateViews: true }), input);
+  assert.equal(applyRecallStateViews(input, policy.retrievalQuery, { recallStateViews: true }), input);
+  assert.equal(annotateStateView(input, policy.retrievalQuery, [], { enabled: true }), input);
+  assert.equal(input[0]?.stateLabel, undefined);
+});
+
+async function makeOrchestrator(
+  overrides: Partial<PluginConfig> = {},
+): Promise<{ orchestrator: Orchestrator; memoryDir: string }> {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-sv-cron-"));
+  const config = parseConfig({
+    openaiApiKey: "sk-test",
+    memoryDir,
+    workspaceDir: path.join(memoryDir, "workspace"),
+    qmdEnabled: false,
+    embeddingFallbackEnabled: false,
+    multiGraphMemoryEnabled: false,
+    entityGraphEnabled: false,
+    timeGraphEnabled: false,
+    causalGraphEnabled: false,
+    extractionJudgeEnabled: false,
+    temporalSupersessionEnabled: true,
+    temporalSupersessionIncludeInRecall: false,
+    contradictionDetectionEnabled: false,
+    chunkingEnabled: false,
+    extractionMinChars: 0,
+    extractionMinImportanceLevel: "trivial",
+    inlineSourceAttributionEnabled: false,
+    initGateTimeoutMs: 200,
+    ...overrides,
+  });
+  return { orchestrator: new Orchestrator(config), memoryDir };
+}
+
+async function writePair(memoryDir: string): Promise<void> {
+  const today = new Date().toISOString().slice(0, 10);
+  const factsDir = path.join(memoryDir, "facts", today);
+  await mkdir(factsDir, { recursive: true });
+  const now = new Date().toISOString();
+  const successor = [
+    "---",
+    "id: sv-new",
+    "category: fact",
+    `created: ${now}`,
+    `updated: ${now}`,
+    "source: extraction",
+    "confidence: 0.8",
+    "confidenceTier: high",
+    "tags: []",
+    "status: active",
+    "---",
+    "",
+    "Current job title: Staff Engineer.",
+    "",
+  ];
+  const predecessor = [
+    "---",
+    "id: sv-old",
+    "category: fact",
+    `created: ${now}`,
+    `updated: ${now}`,
+    "source: extraction",
+    "confidence: 0.8",
+    "confidenceTier: high",
+    "tags: []",
+    "status: superseded",
+    "supersededBy: sv-new",
+    "supersededAt: 2026-08-01",
+    "---",
+    "",
+    "Job title history: the job title used to be Senior Engineer.",
+    "",
+  ];
+  await writeFile(path.join(factsDir, "sv-new.md"), `${successor.join("\n")}\n`, "utf-8");
+  await writeFile(path.join(factsDir, "sv-old.md"), `${predecessor.join("\n")}\n`, "utf-8");
+}
+
+const CRON_E2E_CONFIG: Partial<PluginConfig> = {
+  cronRecallPolicyEnabled: true,
+  cronRecallNormalizedQueryMaxChars: 120,
+};
+
+test("long cron prompt keeps per-call stateView labels when truncation erases intent (#2893)", async () => {
+  const { orchestrator, memoryDir } = await makeOrchestrator(CRON_E2E_CONFIG);
+  try {
+    await writePair(memoryDir);
+    const out = await orchestrator.recall(LONG_CHANGE, CRON_KEY, { stateView: true });
+    assert.ok(
+      out.includes("[superseded 2026-08-01 by sv-new]"),
+      `cron truncation must not erase the classified intent, got:\n${out}`,
+    );
+  } finally {
+    await orchestrator.destroy();
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});
+
+test("e2e negative: long cron prompt without intent stays unlabeled even with the flag", async () => {
+  const { orchestrator, memoryDir } = await makeOrchestrator(CRON_E2E_CONFIG);
+  try {
+    await writePair(memoryDir);
+    const out = await orchestrator.recall(LONG_NON_CHANGE, CRON_KEY, { stateView: true });
+    assert.ok(!out.includes("[superseded "), `non-change prompt must stay filtered, got:\n${out}`);
+  } finally {
+    await orchestrator.destroy();
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});
+
+test("e2e negative: long cron prompt with intent stays zero-diff without flags", async () => {
+  const { orchestrator, memoryDir } = await makeOrchestrator(CRON_E2E_CONFIG);
+  try {
+    await writePair(memoryDir);
+    const out = await orchestrator.recall(LONG_CHANGE, CRON_KEY);
+    assert.ok(!out.includes("[superseded "), `no flags must keep the injection byte-identical, got:\n${out}`);
+  } finally {
+    await orchestrator.destroy();
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});

package/src/recall-state-view-widen.test.ts

@@ -96,11 +96,20 @@ test("#1952 precedence is OR: per-call false never disables a global true", () =
   assert.equal(labeled[1]?.stateLabel, "historical");
 });
 
-test("#1952 override true on a non-change query stays identity (change gate applies)", () => {
-  const input = [CURRENT, HISTORICAL];
-  assert.equal(widenRecallStateViews(input, NON_CHANGE, { recallStateViews: false }, [], true), input);
-  assert.equal(applyRecallStateViews(input, NON_CHANGE, { recallStateViews: false }, true), input);
-  assert.equal(input[0]?.stateLabel, undefined);
+test("#2893 threaded stateViewActive is trusted: no intent re-check at the seam", () => {
+  // The threaded flag means change intent was already classified on the
+  // ORIGINAL prompt at recall entry (resolveRecallStateViewActive); the
+  // query reaching this seam is the cron-normalized retrievalQuery and
+  // can lack the intent signal. Non-change ORIGINAL prompts never thread
+  // a true flag — pinned in recall-state-view-cron-intent.test.ts.
+  const labeled = widenRecallStateViews([CURRENT], NON_CHANGE, { recallStateViews: false }, [HISTORICAL], true);
+  assert.deepEqual(
+    labeled.map((row) => [row.id, row.stateLabel]),
+    [
+      ["new-job", "current"],
+      ["old-job", "historical"],
+    ],
+  );
 });
 
 test("asOf mode keeps a pin-filtered predecessor and never widens the pool (#1952)", () => {

package/src/recall-state-view-widen.ts

@@ -43,7 +43,13 @@ export function widenRecallStateViews<T extends StateViewResult>(
       ? config.recallStateViews
       : undefined;
   const enabled = stateViewActive === true || parseRecallStateViews(raw);
-  if (!enabled || !isChangeOrientedQuery(query)) return results;
+  if (!enabled) return results;
+  // #2893 — a threaded stateViewActive was gated on change intent
+  // classified from the ORIGINAL prompt at recall entry; `query` here is
+  // the cron-normalized retrievalQuery and may have lost the intent
+  // signal (truncation / stop-word compaction), so do not re-check it.
+  // Only the legacy config-only path re-checks intent against this query.
+  if (stateViewActive !== true && !isChangeOrientedQuery(query)) return results;
   const asOfActive = typeof asOfMs === "number" && Number.isFinite(asOfMs);
 
   // #2859: matches are namespace-qualified, and a successor's `supersedes`
@@ -79,6 +85,7 @@ export function widenRecallStateViews<T extends StateViewResult>(
 
   return annotateStateView(extra.length > 0 ? results.concat(extra) : results, query, [], {
     enabled: true,
+    ...(stateViewActive === true ? { changeIntent: true } : {}),
     ...(asOfActive ? { asOfMs } : {}),
   });
 }

package/src/recall-state-view.ts

@@ -205,10 +205,13 @@ export function annotateStateView<T extends StateViewResult>(
   results: T[],
   query: string,
   chains: readonly StateViewChain[],
-  options: { enabled?: boolean; asOfMs?: number } = {},
+  options: { enabled?: boolean; asOfMs?: number; changeIntent?: boolean } = {},
 ): T[] {
   const enabled = options.enabled === true;
-  if (!enabled || !isChangeOrientedQuery(query)) return results;
+  // #2893 — changeIntent:true marks intent as already classified from the
+  // ORIGINAL prompt; `query` may be cron-normalized (intent signal
+  // truncated or stop-worded away) and must not be re-checked then.
+  if (!enabled || (options.changeIntent !== true && !isChangeOrientedQuery(query))) return results;
   // #1952 asOf mode: under a historical pin the pipeline's isValidAsOf
   // gate already decided validity at the pinned instant, so a predecessor
   // must not be discarded merely because its successor is absent under

package/src/reconcile-identity-cache.test.ts

@@ -3,9 +3,15 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import test from "node:test";
+import * as fsp from "node:fs/promises";
 
 import { createHash } from "node:crypto";
-import { type ServerIdentityCacheEntry, planServerIdentityCacheWrite } from "./access-offline-manifest.js";
+import {
+  type ServerIdentityCacheEntry,
+  mergeServerIdentityCacheEntries,
+  planServerIdentityCacheWrite,
+  retainExcludedClassifications,
+} from "./access-offline-manifest.js";
 import { isInternalRemnicStatePath } from "./offline-sync.js";
 import { convergeIdentityCachePath } from "./reconcile/cursor.js";
 import {
@@ -375,4 +381,79 @@ test("a thrown memory-file read is not cached as a reusable negative", async ()
   assert.equal(reads, 1, "a failed read must not become a warm negative hit");
 });
 
+test("the write plan retains never-yielded excluded paths on a completed walk", () => {
+  const persisted = new Map<string, ServerIdentityCacheEntry>([
+    ["facts/gone.md", { path: "facts/gone.md", sha256: "aa" }],
+    ["facts/private.md", { path: "facts/private.md", sha256: "", statIdentity: "s", excluded: true }],
+  ]);
+  const plan = planServerIdentityCacheWrite({
+    persisted,
+    yieldedPaths: new Set([]),
+    retainedPaths: new Set(["facts/private.md"]),
+    streamCompleted: true,
+    cacheDirty: false,
+  });
+  assert.ok(plan.shouldWrite, "the vanished path still forces a write");
+  assert.deepEqual(
+    plan.entries.map((entry) => entry.path),
+    ["facts/private.md"],
+    "an excluded file's entry survives the deleted-path prune; a vanished path's does not"
+  );
+});
+
+test("excluded classifications persist for never-yielded paths without retaining unseen ones", () => {
+  const persisted = new Map<string, ServerIdentityCacheEntry>([
+    ["facts/deleted.md", { path: "facts/deleted.md", sha256: "aa" }],
+  ]);
+  const classifications = new Map([
+    ["facts/private.md", { statIdentity: "1:1:1:1:1", excluded: true }],
+    ["facts/yielded.md", { statIdentity: "2:2:2:2:2", excluded: false }],
+  ]);
+  const { retained, changed } = retainExcludedClassifications({
+    persisted,
+    classifications,
+    yieldedPaths: new Set(["facts/yielded.md"]),
+  });
+  assert.deepEqual([...retained], ["facts/private.md"]);
+  assert.equal(changed, true);
+  assert.equal(persisted.get("facts/private.md")?.excluded, true);
+  assert.equal(typeof persisted.get("facts/private.md")?.statIdentity, "string");
+  assert.ok(!retained.has("facts/deleted.md"), "a path the walk never saw must not be retained");
+});
+
+test("a concurrent server merge preserves the other writer's classification", async () => {
+  const dir = await fs.promises.mkdtemp(path.join(os.tmpdir(), "server-identity-merge-"));
+  try {
+    const cachePath = path.join(dir, "identity.json");
+    await fs.promises.writeFile(
+      cachePath,
+      JSON.stringify({
+        citationTemplate: citationTemplateFingerprint(undefined),
+        files: [
+          { path: "facts/a.md", sha256: "aa", statIdentity: "1:2:3:4:5", excluded: false },
+          { path: "facts/dropped.md", sha256: "dd", statIdentity: "9:9:9:9:9", excluded: true },
+        ],
+      })
+    );
+    const merged = await mergeServerIdentityCacheEntries(
+      fsp,
+      cachePath,
+      [{ path: "facts/b.md", sha256: "bb" }],
+      undefined,
+      new Set(["facts/dropped.md"])
+    );
+    const byPath = new Map(merged.map((entry) => [entry.path, entry]));
+    assert.equal(
+      byPath.get("facts/a.md")?.statIdentity,
+      "1:2:3:4:5",
+      "the other writer's classification survives the merge"
+    );
+    assert.equal(byPath.get("facts/a.md")?.excluded, false);
+    assert.ok(byPath.has("facts/b.md"), "this writer's entry survives too");
+    assert.equal(byPath.has("facts/dropped.md"), false, "a dropped path is still not resurrected");
+  } finally {
+    await fs.promises.rm(dir, { recursive: true, force: true });
+  }
+});
+
 

package/src/search/port.ts

@@ -91,7 +91,7 @@ export interface SearchBackendStatus {
  */
 export interface SearchBackend {
   // ── Lifecycle ──
-  probe(): Promise<boolean>;
+  probe(execution?: SearchExecutionOptions): Promise<boolean>;
   /**
    * Optional non-mutating availability probe for health/readiness checks.
    * Implementations must avoid auto-upgrades, collection creation, daemon

package/src/storage/cas-revision-store.test.ts

@@ -226,6 +226,7 @@ test("an evidenced gated recovery defers a reserve-only marker to the path-locke
       status: "present",
       revision: b.pendingRevision,
       committedDigest: store.digestContent("landed bytes"),
+      committedSemanticFingerprint: store.digestContent("landed bytes"),
     });
   });
 });
@@ -258,6 +259,7 @@ test("recoverPendingRevision publishes a crashed reservation whose write landed
       status: "present",
       revision: b.pendingRevision,
       committedDigest: store.digestContent("new durable bytes"),
+      committedSemanticFingerprint: store.digestContent("new durable bytes"),
     });
     assert.equal(await store.recoverPendingRevision(target), "committed", "idempotent");
   });
@@ -361,6 +363,7 @@ test("beginRevisionTransaction with expectedContent persists expectedDigest in p
       status: "present",
       revision: txn2.pendingRevision,
       committedDigest: store.digestContent(expectedContent),
+      committedSemanticFingerprint: store.digestContent(expectedContent),
     });
   });
 });
@@ -425,6 +428,7 @@ test("legacy pending shards without writeLanded treat expectedDigest as already
       status: "present",
       revision: "2026-08-01T00:00:00.000Z",
       committedDigest: expectedDigest,
+      committedSemanticFingerprint: expectedDigest,
     });
   });
 });