@remnic/core 9.69.39 → 9.69.41

package/src/deep-recall-policy-llm.test.ts

@@ -0,0 +1,242 @@
+/**
+ * Deep-recall policy LLM budget/cancellation regressions (issue #2915).
+ *
+ * One `timeoutMs` budget must span the local and fallback legs: the fallback
+ * leg receives only what the local leg left on the clock, and never starts
+ * once the budget is spent. A spent budget also starts neither leg. The
+ * transport cancellation signal reaches both legs and rejects as AbortError
+ * when the signal is already aborted, when abort lands during the local
+ * leg, and when abort lands during the fallback. Deterministic: legs
+ * advance a patched clock instead of sleeping.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { isAbortError } from "./abort-error.js";
+import { parseConfig } from "./config.js";
+import { callDeepRecallPolicyLlm } from "./deep-recall-policy-llm.js";
+import type { FallbackLlmClient } from "./fallback-llm.js";
+import type { LocalLlmClient } from "./local-llm.js";
+
+interface CapturedCall {
+  timeoutMs?: number;
+  signal?: AbortSignal;
+}
+
+function fakeClients(input: {
+  localBehavior?: (call: CapturedCall) => Promise<{ content: string } | null>;
+  fallbackBehavior?: (call: CapturedCall) => Promise<{ content: string } | null>;
+}): {
+  localLlm: LocalLlmClient;
+  fallbackLlm: FallbackLlmClient;
+  localCalls: CapturedCall[];
+  fallbackCalls: CapturedCall[];
+} {
+  const localCalls: CapturedCall[] = [];
+  const fallbackCalls: CapturedCall[] = [];
+  const localLlm = {
+    chatCompletion: async (_messages: unknown, options: { timeoutMs?: number; signal?: AbortSignal }) => {
+      const call = { ...(options.timeoutMs !== undefined ? { timeoutMs: options.timeoutMs } : {}), ...(options.signal ? { signal: options.signal } : {}) };
+      localCalls.push(call);
+      if (input.localBehavior) return input.localBehavior(call);
+      return { content: "local-ok" };
+    },
+  } as unknown as LocalLlmClient;
+  const fallbackLlm = {
+    chatCompletion: async (_messages: unknown, options: { timeoutMs?: number; signal?: AbortSignal }) => {
+      const call = { ...(options.timeoutMs !== undefined ? { timeoutMs: options.timeoutMs } : {}), ...(options.signal ? { signal: options.signal } : {}) };
+      fallbackCalls.push(call);
+      if (input.fallbackBehavior) return input.fallbackBehavior(call);
+      return { content: "fallback-ok" };
+    },
+  } as unknown as FallbackLlmClient;
+  return { localLlm, fallbackLlm, localCalls, fallbackCalls };
+}
+
+test("one step timeout spans both legs: a spent budget never starts the fallback (issue #2915)", async () => {
+  const realNow = Date.now;
+  let clock = 1_000_000;
+  Date.now = () => clock;
+  try {
+    const { localLlm, fallbackLlm, fallbackCalls } = fakeClients({
+      // The local leg burns the whole 50ms budget before failing.
+      localBehavior: () => {
+        clock += 60;
+        return Promise.reject(new Error("local leg failed"));
+      },
+      fallbackBehavior: () => {
+        throw new Error("the fallback must not start once the step budget is spent");
+      },
+    });
+    const result = await callDeepRecallPolicyLlm({
+      statePrompt: "state",
+      config: parseConfig({}),
+      localLlm,
+      fallbackLlm,
+      timeoutMs: 50,
+    });
+    assert.equal(result, null, "both legs failed/spent — the loop treats that as a stop");
+    assert.equal(fallbackCalls.length, 0, "the fallback leg never restarted the step timeout");
+  } finally {
+    Date.now = realNow;
+  }
+});
+
+test("the fallback leg receives only the budget the local leg left (issue #2915)", async () => {
+  const realNow = Date.now;
+  let clock = 1_000_000;
+  Date.now = () => clock;
+  try {
+    const { localLlm, fallbackLlm, fallbackCalls } = fakeClients({
+      localBehavior: () => {
+        clock += 30;
+        return Promise.reject(new Error("local leg failed"));
+      },
+      fallbackBehavior: () => Promise.resolve({ content: "fallback-ok" }),
+    });
+    const result = await callDeepRecallPolicyLlm({
+      statePrompt: "state",
+      config: parseConfig({}),
+      localLlm,
+      fallbackLlm,
+      timeoutMs: 200,
+    });
+    assert.equal(result, "fallback-ok");
+    assert.equal(fallbackCalls.length, 1);
+    const fallbackTimeout = fallbackCalls[0]?.timeoutMs;
+    assert.ok(
+      fallbackTimeout !== undefined && fallbackTimeout > 0 && fallbackTimeout <= 170,
+      `fallback timeout must be the remaining budget (got ${String(fallbackTimeout)}), not a restarted 200`,
+    );
+  } finally {
+    Date.now = realNow;
+  }
+});
+
+test("the cancellation signal reaches both legs and stops the fallback after abort (issue #2915)", async () => {
+  // Part A — a live signal is forwarded to both legs' options.
+  const live = fakeClients({
+    localBehavior: () => Promise.reject(new Error("local leg failed")),
+  });
+  const liveController = new AbortController();
+  const forwarded = await callDeepRecallPolicyLlm({
+    statePrompt: "state",
+    config: parseConfig({}),
+    localLlm: live.localLlm,
+    fallbackLlm: live.fallbackLlm,
+    timeoutMs: 0,
+    signal: liveController.signal,
+  });
+  assert.equal(forwarded, "fallback-ok");
+  assert.equal(live.localCalls[0]?.signal, liveController.signal, "the local leg received the transport signal");
+  assert.equal(live.fallbackCalls[0]?.signal, liveController.signal, "the fallback leg received the transport signal");
+
+  // Part B — cancellation during the local leg stops before the fallback.
+  const cancelled = fakeClients({
+    localBehavior: () => {
+      liveController.abort();
+      return Promise.reject(new Error("local leg failed"));
+    },
+    fallbackBehavior: () => {
+      throw new Error("the fallback must not run after cancellation");
+    },
+  });
+  await assert.rejects(
+    callDeepRecallPolicyLlm({
+      statePrompt: "state",
+      config: parseConfig({}),
+      localLlm: cancelled.localLlm,
+      fallbackLlm: cancelled.fallbackLlm,
+      timeoutMs: 0,
+      signal: liveController.signal,
+    }),
+    (err: unknown) => isAbortError(err),
+    "cancellation after the local leg surfaces as a standard AbortError",
+  );
+  assert.equal(cancelled.fallbackCalls.length, 0);
+});
+
+test("a pre-aborted signal rejects before either policy leg (issue #2915)", async () => {
+  const controller = new AbortController();
+  controller.abort();
+  const clients = fakeClients({
+    localBehavior: () => {
+      throw new Error("the local leg must not start after pre-abort");
+    },
+    fallbackBehavior: () => {
+      throw new Error("the fallback leg must not start after pre-abort");
+    },
+  });
+  await assert.rejects(
+    callDeepRecallPolicyLlm({
+      statePrompt: "state",
+      config: parseConfig({}),
+      localLlm: clients.localLlm,
+      fallbackLlm: clients.fallbackLlm,
+      timeoutMs: 0,
+      signal: controller.signal,
+    }),
+    (err: unknown) => isAbortError(err),
+    "pre-aborted policy call surfaces as a standard AbortError",
+  );
+  assert.equal(clients.localCalls.length, 0, "the local leg never started");
+  assert.equal(clients.fallbackCalls.length, 0, "the fallback leg never started");
+});
+
+test("abort during the fallback leg rejects as AbortError instead of null (issue #2915)", async () => {
+  const controller = new AbortController();
+  const clients = fakeClients({
+    localBehavior: () => Promise.reject(new Error("local leg failed")),
+    fallbackBehavior: () => {
+      controller.abort();
+      return Promise.reject(new Error("fallback failed after abort"));
+    },
+  });
+  await assert.rejects(
+    callDeepRecallPolicyLlm({
+      statePrompt: "state",
+      config: parseConfig({}),
+      localLlm: clients.localLlm,
+      fallbackLlm: clients.fallbackLlm,
+      timeoutMs: 0,
+      signal: controller.signal,
+    }),
+    (err: unknown) => isAbortError(err),
+    "cancellation during the fallback leg is not converted to null",
+  );
+  assert.equal(clients.fallbackCalls.length, 1, "the fallback leg started before abort");
+});
+
+test("a spent shared budget starts neither local nor fallback (issue #2915)", async () => {
+  const realNow = Date.now;
+  const config = parseConfig({});
+  let clock = 1_000_000;
+  Date.now = () => {
+    const now = clock;
+    clock += 100;
+    return now;
+  };
+  try {
+    const { localLlm, fallbackLlm, localCalls, fallbackCalls } = fakeClients({
+      localBehavior: () => {
+        throw new Error("the local leg must not start once the step budget is spent");
+      },
+      fallbackBehavior: () => {
+        throw new Error("the fallback leg must not start once the step budget is spent");
+      },
+    });
+    const result = await callDeepRecallPolicyLlm({
+      statePrompt: "state",
+      config,
+      localLlm,
+      fallbackLlm,
+      timeoutMs: 50,
+    });
+    assert.equal(result, null, "exhausted budget is a stop, not an unbounded call");
+    assert.equal(localCalls.length, 0, "the local leg never started without a timeout");
+    assert.equal(fallbackCalls.length, 0, "the fallback leg never started");
+  } finally {
+    Date.now = realNow;
+  }
+});

package/src/deep-recall-policy-llm.ts

@@ -6,11 +6,20 @@
  * fallback client with the shared background-task chain options. Never a
  * raw OpenAI client. Returns null when both legs fail — the loop treats
  * that as a stop, never a crash.
+ *
+ * One `timeoutMs` budget spans BOTH legs (issue #2915): the fallback leg
+ * receives only what the local leg left on the clock, so a single policy
+ * step can no longer outlive `stepTimeoutMs` by failing slowly locally and
+ * restarting the full timeout remotely. A spent budget starts neither leg.
+ * The transport cancellation signal is forwarded to both legs and checked
+ * before each start and after each caught failure so an abort is never
+ * converted to null.
  */
 
 import { gatewayTaskChainOptions, type FallbackLlmClient } from "./fallback-llm.js";
 import type { LocalLlmClient } from "./local-llm.js";
 import type { PluginConfig } from "./types.js";
+import { isAbortError, throwIfAborted } from "./abort-error.js";
 
 export const DEEP_RECALL_POLICY_SYSTEM_PROMPT =
   "You are the retrieval policy for a long-term memory system. Given the question, the current working set of retrieved memories, and the frontier of anchor-linked candidates, choose exactly one action: REFINE (rewrite the query), EXPAND (follow named frontier nodes), or STOP. Respond with JSON only.";
@@ -21,30 +30,48 @@ export async function callDeepRecallPolicyLlm(input: {
   localLlm: LocalLlmClient | null;
   fallbackLlm: FallbackLlmClient | null;
   timeoutMs: number;
+  /** Transport cancellation (issue #2915); forwarded to both LLM legs. */
+  signal?: AbortSignal;
 }): Promise<string | null> {
   const messages: Array<{ role: "system" | "user"; content: string }> = [
     { role: "system", content: DEEP_RECALL_POLICY_SYSTEM_PROMPT },
     { role: "user", content: input.statePrompt },
   ];
-  const timeout = input.timeoutMs > 0 ? input.timeoutMs : undefined;
+  const startedAtMs = Date.now();
+  const remainingMs = (): number | undefined =>
+    input.timeoutMs > 0 ? input.timeoutMs - (Date.now() - startedAtMs) : undefined;
   const skipLocal = input.config.modelSource === "gateway";
   const gatewayChain = gatewayTaskChainOptions(input.config);
+  const abortMessage = "deep recall policy call aborted";
+
+  throwIfAborted(input.signal, abortMessage);
 
   if (input.localLlm && !skipLocal) {
+    const timeout = remainingMs();
+    if (timeout !== undefined && timeout <= 0) {
+      return null;
+    }
     try {
       const result = await input.localLlm.chatCompletion(messages, {
         temperature: 0.1,
         maxTokens: 1024,
-        ...(timeout ? { timeoutMs: timeout } : {}),
+        ...(timeout !== undefined ? { timeoutMs: timeout } : {}),
         responseFormat: { type: "json_object" },
         operation: "deep-recall-policy",
+        ...(input.signal ? { signal: input.signal } : {}),
       });
       if (result?.content) return result.content;
-    } catch {
-      // fall through to the gateway leg
+    } catch (err) {
+      if (isAbortError(err)) throw err;
+      throwIfAborted(input.signal, abortMessage);
     }
   }
 
+  throwIfAborted(input.signal, abortMessage);
+  const remaining = remainingMs();
+  if (remaining !== undefined && remaining <= 0) {
+    return null;
+  }
   if (input.fallbackLlm) {
     try {
       const result = await input.fallbackLlm.chatCompletion(
@@ -52,14 +79,17 @@ export async function callDeepRecallPolicyLlm(input: {
         {
           temperature: 0.1,
           maxTokens: 1024,
-          ...(timeout ? { timeoutMs: timeout } : {}),
+          ...(remaining !== undefined ? { timeoutMs: remaining } : {}),
           ...gatewayChain,
+          ...(input.signal ? { signal: input.signal } : {}),
         },
       );
       if (result?.content) return result.content;
-    } catch {
-      // both legs failed — caller treats null as a stop
+    } catch (err) {
+      if (isAbortError(err)) throw err;
+      throwIfAborted(input.signal, abortMessage);
     }
   }
+  throwIfAborted(input.signal, abortMessage);
   return null;
 }

package/src/deep-recall-seeds.test.ts

@@ -0,0 +1,53 @@
+/**
+ * Deep-recall seed-search wiring regressions (issue #2915).
+ *
+ * The seed search must forward the transport cancellation signal into the
+ * namespace search router, and keep asking the router for exactly the capped
+ * candidate set (`maxResults`), resolving each returned hit per hit — never
+ * pre-scanning the namespace corpus.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { createDeepRecallSeedSearch } from "./deep-recall-seeds.js";
+import type { DeepRecallSeedRouter } from "./deep-recall-seeds.js";
+
+test("seed search forwards the cancellation signal and the capped limit to the router (issue #2915)", async () => {
+  const controller = new AbortController();
+  type RouterCall = Parameters<DeepRecallSeedRouter["searchAcrossNamespaces"]>[0];
+  let captured: RouterCall | undefined;
+  let resolverCalls = 0;
+  const router: DeepRecallSeedRouter = {
+    async searchAcrossNamespaces(options) {
+      captured = options;
+      return [
+        { path: "facts/2026-08-23/fact-one.md", docid: "doc-1", score: 0.9 },
+        { path: "facts/2026-08-23/fact-two.md", docid: "doc-2", score: 0.8 },
+      ];
+    },
+  };
+  const searchSeed = createDeepRecallSeedSearch({
+    namespace: "ns_signals",
+    storage: { dir: "/synthetic/ns_signals", readMemoryByPath: async () => null },
+    router,
+    resolver: {
+      async readQmdResultMemory() {
+        resolverCalls += 1;
+        return { frontmatter: { id: `fact-${resolverCalls}` } };
+      },
+    },
+    signal: controller.signal,
+  });
+
+  const seeds = await searchSeed("payments routing", 2);
+
+  assert.deepEqual(seeds, [
+    { memoryId: "fact-1", score: 0.9 },
+    { memoryId: "fact-2", score: 0.8 },
+  ]);
+  assert.equal(captured?.namespaces?.[0], "ns_signals");
+  assert.equal(captured?.maxResults, 2, "the router is asked for the capped candidate set, not the corpus");
+  assert.equal(captured?.execution?.signal, controller.signal, "the transport signal reaches the search router");
+  assert.equal(resolverCalls, 2, "each returned hit is resolved per hit");
+});

package/src/deep-recall-seeds.ts

@@ -33,7 +33,10 @@ export interface DeepRecallSeedRouter {
     query: string;
     namespaces: string[];
     maxResults?: number;
-    execution?: { onDegradation?: (degradation: SearchDegradation) => void };
+    execution?: {
+      signal?: AbortSignal;
+      onDegradation?: (degradation: SearchDegradation) => void;
+    };
   }): Promise<ReadonlyArray<{ path?: string; docid?: string; score?: number }>>;
 }
 
@@ -97,6 +100,8 @@ export function createDeepRecallSeedSearch(deps: {
   storage: DeepRecallSeedStorage;
   router: DeepRecallSeedRouter;
   resolver: DeepRecallSeedResultResolver;
+  /** Transport cancellation (issue #2915); forwarded to the search router. */
+  signal?: AbortSignal;
 }): (query: string, limit: number) => Promise<DeepRecallSeedHit[]> {
   return async (query, limit) => {
     if (limit <= 0) return [];
@@ -106,6 +111,7 @@ export function createDeepRecallSeedSearch(deps: {
       namespaces: [deps.namespace],
       maxResults: limit,
       execution: {
+        ...(deps.signal ? { signal: deps.signal } : {}),
         onDegradation: (degradation) => {
           if (degradation.code === "backend_unavailable") unavailable.push(degradation);
         },

package/src/deep-recall-surface.test.ts

@@ -900,3 +900,96 @@ test("deep recall seeds resolve collection-qualified paths when namespaces are d
     await rm(memoryDir, { recursive: true, force: true });
   }
 });
+
+test("HTTP deep recall rejects malformed, empty, and fractional maxSteps instead of defaulting (issue #2915)", async () => {
+  // `""` previously coerced to 0 (a documented DISABLE value) and `"abc"`
+  // fell back to the configured default: both silently reinterpreted what
+  // the caller explicitly sent (§39).
+  const memoryDir = await mkdtemp(path.join(tmpdir(), "remnic-deep-recall-maxsteps-"));
+  try {
+    const config = parseConfig({
+      memoryDir,
+      deepRecall: { enabled: true, maxSteps: 0 },
+    });
+    const service = Object.create(EngramAccessService.prototype) as EngramAccessService;
+    const host = service as unknown as { orchestrator: unknown };
+    let deepRecallCalls = 0;
+    host.orchestrator = {
+      config,
+      async getStorage() {
+        throw new Error("the service must not be reached with invalid maxSteps");
+      },
+      async searchAcrossNamespaces() {
+        deepRecallCalls += 1;
+        return [];
+      },
+      localLlm: null,
+      fastGatewayLlm: null,
+    };
+    const server = new EngramAccessHttpServer({
+      service,
+      port: 0,
+      trustPrincipalHeader: true,
+      adminConsoleEnabled: false,
+      authTokenEntriesGetter: () => [{ token: "operator-token", capabilities: { version: 1 } }],
+    });
+    const status = await server.start();
+    try {
+      for (const maxSteps of ["", "abc", "1.5", -1]) {
+        const response = await fetch(`http://127.0.0.1:${status.port}/engram/v1/recall/deep`, {
+          method: "POST",
+          headers: { "content-type": "application/json", authorization: "Bearer operator-token" },
+          body: JSON.stringify({ query: "payments routing", maxSteps }),
+        });
+        assert.equal(response.status, 400, `maxSteps ${JSON.stringify(maxSteps)} must be rejected`);
+        const body = await response.text();
+        assert.match(body, /maxSteps/, "the rejection names the rejected field");
+      }
+      assert.equal(deepRecallCalls, 0, "no search ran for rejected input");
+    } finally {
+      await server.stop();
+    }
+  } finally {
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});
+
+test("service deepRecall propagates a pre-aborted transport signal before any seed search (issue #2915)", async () => {
+  const memoryDir = await mkdtemp(path.join(tmpdir(), "remnic-deep-recall-abort-"));
+  try {
+    const config = parseConfig({
+      memoryDir,
+      namespacesEnabled: false,
+      deepRecall: { enabled: true, maxSteps: 2 },
+    });
+    const service = Object.create(EngramAccessService.prototype) as EngramAccessService;
+    const host = service as unknown as { orchestrator: unknown };
+    let seedSearches = 0;
+    host.orchestrator = {
+      config,
+      async getStorage() {
+        return { dir: memoryDir, async readMemoryByPath() {
+          return null;
+        }, async getMemoryById() {
+          return null;
+        } };
+      },
+      async searchAcrossNamespaces() {
+        seedSearches += 1;
+        return [];
+      },
+      localLlm: null,
+      fastGatewayLlm: null,
+    };
+    const controller = new AbortController();
+    controller.abort();
+    await assert.rejects(
+      service.deepRecall({ query: "payments routing", abortSignal: controller.signal }),
+      (err: unknown) => err instanceof Error && err.name === "AbortError",
+      "cancellation reaches the engine through the service and surfaces as AbortError",
+    );
+    assert.equal(seedSearches, 0, "a cancelled invocation performs no seed search");
+  } finally {
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});

package/src/deep-recall.test.ts

@@ -346,3 +346,124 @@ test("deep recall retires an expanded node from the frontier", async () => {
   );
   assert.equal(result.trace.length, 2, "the loop stops rather than looping on the same node");
 });
+
+test("deep recall ranks by distinct shared anchors, not working-set memory count (issue #2915)", async () => {
+  // "node-candidate-c" shares ONE anchor with a node holding TWO working-set
+  // memories; "node-candidate-d" shares TWO distinct anchors with one
+  // working-set memory. Counting per memory (the old bug) scored both 2 and
+  // the nodeId tiebreak expanded C first; distinct anchors must rank D first.
+  const node = (nodeId: string, ...sourceMemoryIds: string[]): DeepRecallGraphSnapshot["nodes"][number] => ({
+    schemaVersion: 1,
+    nodeId,
+    recordedAt: "2026-08-01T00:00:00.000Z",
+    sessionKey: "test-session",
+    kind: "topic",
+    abstractionLevel: "meso",
+    title: `Synthetic ${nodeId}`,
+    summary: `Synthetic ${nodeId} summary`,
+    sourceMemoryIds,
+  });
+  const anchor = (anchorId: string, anchorValue: string, ...nodeRefs: string[]): DeepRecallGraphSnapshot["anchors"][number] => ({
+    schemaVersion: 1,
+    anchorId,
+    anchorType: "entity",
+    anchorValue,
+    normalizedCue: anchorValue,
+    recordedAt: "2026-08-01T00:00:00.000Z",
+    sessionKey: "test-session",
+    nodeRefs,
+  });
+  const graph: DeepRecallGraphSnapshot = {
+    nodes: [
+      node("node-holder", "mem-w1", "mem-w2"),
+      node("node-holder2", "mem-w3"),
+      node("node-candidate-c", "mem-c1"),
+      node("node-candidate-d", "mem-d1"),
+    ],
+    anchors: [
+      anchor("anchor-one", "shared+one", "node-holder", "node-candidate-c"),
+      anchor("anchor-two", "shared+two", "node-holder2", "node-candidate-d"),
+      anchor("anchor-three", "shared+three", "node-holder2", "node-candidate-d"),
+    ],
+  };
+  const result = await runBudgetedDeepRecall(
+    {
+      config: makeConfig({ maxSteps: 3 }),
+      searchSeed: async () => [
+        { memoryId: "mem-w1", score: 0.9 },
+        { memoryId: "mem-w2", score: 0.8 },
+        { memoryId: "mem-w3", score: 0.7 },
+      ],
+      loadGraph: async () => graph,
+      loadMemory: async (memoryId) => ({ memoryId, content: `Content of ${memoryId}.`, active: true }),
+      callPolicy: async (statePrompt) => {
+        const first = /FRONTIER \(anchor-linked candidates not yet retrieved\):\n- ([^:]+):/.exec(statePrompt)?.[1];
+        return first
+          ? JSON.stringify({ action: "EXPAND", expandNodeIds: [first], reason: "follow the top candidate" })
+          : JSON.stringify({ action: "STOP", reason: "frontier empty" });
+      },
+    },
+    "shared anchors",
+  );
+  assert.equal(result.trace[0]?.action, "EXPAND");
+  assert.equal(
+    result.trace[0]?.detail,
+    "node-candidate-d",
+    "two distinct shared anchors outrank one anchor reached through two memories",
+  );
+  assert.ok(result.entries.some((entry) => entry.memoryId === "mem-d1"), "the top-ranked candidate was expanded");
+});
+
+test("deep recall aborts before any dependency call when the signal is already aborted (issue #2915)", async () => {
+  const controller = new AbortController();
+  controller.abort();
+  let seedCalls = 0;
+  await assert.rejects(
+    runBudgetedDeepRecall(
+      {
+        config: makeConfig(),
+        searchSeed: async () => {
+          seedCalls += 1;
+          return [];
+        },
+        loadGraph: async () => {
+          throw new Error("must not load the graph after abort");
+        },
+        loadMemory: async () => null,
+        callPolicy: async () => {
+          throw new Error("must not call the policy after abort");
+        },
+        signal: controller.signal,
+      },
+      "anything",
+    ),
+    (err: unknown) => err instanceof Error && err.name === "AbortError",
+    "cancellation must surface as a standard AbortError",
+  );
+  assert.equal(seedCalls, 0, "no seed search runs after cancellation");
+});
+
+test("deep recall propagates cancellation from a stalled policy call instead of waiting for the deadline (issue #2915)", async () => {
+  const controller = new AbortController();
+  // The policy leg aborts the transport mid-call and then never settles:
+  // without signal racing the invocation would hang until totalTimeoutMs.
+  const resultPromise = runBudgetedDeepRecall(
+    {
+      config: makeConfig({ totalTimeoutMs: 10_000 }),
+      searchSeed: async () => [{ memoryId: "mem-1", score: 0.9 }],
+      loadGraph: async () => ({ nodes: [], anchors: [] }),
+      loadMemory: async (memoryId) => ({ memoryId, content: "one", active: true }),
+      callPolicy: () => {
+        controller.abort();
+        return new Promise<string | null>(() => {});
+      },
+      signal: controller.signal,
+    },
+    "stalled policy",
+  );
+  await assert.rejects(
+    resultPromise,
+    (err: unknown) => err instanceof Error && err.name === "AbortError",
+    "a cancelled call must stop at cancellation time, not at totalTimeoutMs",
+  );
+});