@remnic/core 9.69.39 → 9.69.41

package/src/orchestration/recall-entry.ts

@@ -20,7 +20,9 @@ import { ProfilingCollector } from "../profiling.js";
 import { trustResultFor, type TrustStageResultItem } from "../trust-score-stage.js";
 import type { RecallResultFormatter } from "./recall-result-formatter.js";
 import type { IdentityInjectionMode, PluginConfig, QmdSearchResult } from "../types.js";
-import { applyRecallStateViews } from "../recall-state-view-wire.js";
+import { stateViewPacketActive } from "../recall-state-view-anchors.js";
+import { resultStateViewKey, stateViewPacketKeys } from "../recall-state-view.js";
+ import { applyRecallStateViews } from "../recall-state-view-wire.js";
 
 export interface RecallEntryDeps {
   appendRecallSection(
@@ -300,6 +302,15 @@ export class RecallEntryCoordinator {
     );
     if (injectable.length === 0) return;
 
+    // #2928 — packet-atomic final budgeting: under packet semantics (state
+    // view active, no historical asOf pin) rows of one supersession packet
+    // share their canonical packet root key, so the section coordinator's
+    // character/token cap admits or drops the packet as a unit.
+    const packetKeys =
+      stateViewPacketActive(options.stateViewActive === true, options.asOfMs)
+        ? stateViewPacketKeys(injectable)
+        : [];
+
     const formatted = this.deps.recallResultFormatter.formatQmdResultEntries(
       options.title,
       injectable,
@@ -324,6 +335,9 @@ export class RecallEntryCoordinator {
           ...(memoryId ? { memoryId } : {}),
           ...(result.path ? { memoryPath: result.path } : {}),
           ...(result.namespace ? { memoryNamespace: result.namespace } : {}),
+          ...(packetKeys[index] && resultStateViewKey(result)
+            ? { packetKey: packetKeys[index] }
+            : {}),
         },
       );
     }

package/src/orchestration/recall-internal.ts

@@ -98,11 +98,8 @@ import {
   type RecallInvocationOptions,
 } from "../orchestrator.js";
 import { isGenericRecallExcludedPath } from "./generic-recall-paths.js";
-import {
-  filterRecentScanMemories,
-  resolveRecallStateViewFlags,
-} from "../recall-state-view-anchors.js";
-import { indexStateViewAnnotatedResults } from "../recall-state-view-admission.js";
+import { filterRecentScanMemories } from "../recall-state-view-anchors.js";
+import { indexStateViewAnnotatedResults, resolveRecallStateViewActive } from "../recall-state-view-admission.js";
 import type { RecallSectionBuckets } from "./recall-section-coordinator.js";
 import {
   reconcileRecallResultPartition,
@@ -248,12 +245,9 @@ export class RecallInternalCoordinator {
     });
     // #1952 state views: config flag OR per-call override, gated on change intent; computed once for all branches.
     const retrievalQuery = queryPolicy.retrievalQuery || prompt;
-    const { stateViewActive, stateViewPacketActive } = resolveRecallStateViewFlags(
-      options.stateView,
-      this.deps.config.recallStateViews,
-      retrievalQuery,
-      asOfMs,
-    );
+    const stateViewActive = resolveRecallStateViewActive(options, this.deps.config, prompt);
+    const stateViewPacketActive =
+      stateViewActive === true && !(typeof asOfMs === "number" && Number.isFinite(asOfMs));
     const retrievalQueryHash = createHash("sha256")
       .update(retrievalQuery)
       .digest("hex");
@@ -5049,6 +5043,7 @@ export class RecallInternalCoordinator {
         // Build a path → QmdSearchResult index so we can pull per-result
         // explain data (e.g. reinforcementBoost) from the result that
         // boostSearchResults annotated before surfacing to xray.
+        // #1952: label the captured branch through the same inject-seam annotator.
         const xrayResultByPath = indexStateViewAnnotatedResults(
           xrayRecalledResults, retrievalQuery, this.deps.config, stateViewActive, asOfMs,
         );

package/src/orchestration/recall-section-coordinator.ts

@@ -27,6 +27,13 @@ export interface RecallSectionAppendOptions {
   memoryId?: string;
   memoryPath?: string;
   memoryNamespace?: string;
+  /**
+   * #2928 — state-view packet key (canonical `stateViewPacketKeys` root).
+   * Atomic chunks sharing a packetKey are ONE evidence packet: the final
+   * budget admits or drops them together, so a historical row can never
+   * render without its linked successor. Absent on non-state rows.
+   */
+  packetKey?: string;
 }
 
 export interface RecallSectionChunk {
@@ -35,6 +42,7 @@ export interface RecallSectionChunk {
   memoryId?: string;
   memoryPath?: string;
   memoryNamespace?: string;
+  packetKey?: string;
 }
 
 export type RecallSectionBuckets = Map<
@@ -160,6 +168,7 @@ export class RecallSectionCoordinator {
         ...(options.memoryNamespace
           ? { memoryNamespace: options.memoryNamespace }
           : {}),
+        ...(options.packetKey ? { packetKey: options.packetKey } : {}),
       });
     } else {
       existing.push(finalContent);
@@ -454,15 +463,55 @@ export class RecallSectionCoordinator {
         let includedPostAtomicContent = false;
         const postAtomicContents: string[] = [];
         let includedLeadingContent = false;
+        // #2928 — state-view packets: atomic chunks sharing a packetKey are
+        // ONE evidence packet (a historical row plus its linked successor).
+        // The packet renders as a block at the FIRST member's position,
+        // members in incoming order, and is admitted or dropped together —
+        // the final character/token budget can never emit one side alone.
+        // Chunks without a packetKey keep the pre-#2928 per-row behavior.
+        const packetFirstIndex = new Map<string, number>();
+        const packetMembers = new Map<number, number[]>();
         for (const [index, chunk] of section.chunks.entries()) {
+          if (!chunk.atomic || !chunk.packetKey) continue;
+          const first = packetFirstIndex.get(chunk.packetKey);
+          if (first === undefined) {
+            packetFirstIndex.set(chunk.packetKey, index);
+            packetMembers.set(index, [index]);
+          } else {
+            packetMembers.get(first)!.push(index);
+          }
+        }
+        const admitMemoryRefs = (memberIndexes: readonly number[]): void => {
+          for (const memberIndex of memberIndexes) {
+            const member = section.chunks[memberIndex]!;
+            if (member.memoryId && member.memoryPath) {
+              includedMemories.push(
+                member.memoryNamespace
+                  ? { id: member.memoryId, path: member.memoryPath, namespace: member.memoryNamespace }
+                  : { id: member.memoryId, path: member.memoryPath },
+              );
+            }
+          }
+        };
+        for (const [index, chunk] of section.chunks.entries()) {
+          const members = chunk.atomic ? packetMembers.get(index) : undefined;
+          if (chunk.atomic && chunk.packetKey && members === undefined) {
+            // Non-first packet member: decided with its block at the first
+            // member's position — never admitted alone (#2928).
+            continue;
+          }
+          const memberIndexes = members ?? [index];
+          const content = members
+            ? members.map((memberIndex) => section.chunks[memberIndex]!.content).join("\n\n")
+            : chunk.content;
           if (
             !chunk.atomic &&
             includedAtomicCount === 0 &&
             index < firstAtomicIndex
           ) {
             const candidate = rendered
-              ? `${rendered}\n\n${chunk.content}`
-              : chunk.content;
+              ? `${rendered}\n\n${content}`
+              : content;
             if (
               candidate.length <= allocatedSectionAvailable &&
               estimateTokenCount(candidate) <= allocatedTokenAvailable
@@ -476,8 +525,8 @@ export class RecallSectionCoordinator {
           }
 
           const candidate = rendered
-            ? `${rendered}\n\n${chunk.content}`
-            : chunk.content;
+            ? `${rendered}\n\n${content}`
+            : content;
           if (
             candidate.length > allocatedSectionAvailable ||
             estimateTokenCount(candidate) > allocatedTokenAvailable
@@ -486,32 +535,26 @@ export class RecallSectionCoordinator {
               chunk.atomic &&
               includedAtomicCount === 0 &&
               includedLeadingContent &&
-              chunk.content.length <= allocatedSectionAvailable &&
-              estimateTokenCount(chunk.content) <= allocatedTokenAvailable
+              content.length <= allocatedSectionAvailable &&
+              estimateTokenCount(content) <= allocatedTokenAvailable
             ) {
-              rendered = chunk.content;
+              rendered = content;
               includedLeadingContent = false;
-              includedAtomicCount = 1;
-              if (chunk.memoryId && chunk.memoryPath) {
-                includedMemories.push(
-                  chunk.memoryNamespace
-                    ? { id: chunk.memoryId, path: chunk.memoryPath, namespace: chunk.memoryNamespace }
-                    : { id: chunk.memoryId, path: chunk.memoryPath },
-                );
-              }
+              includedAtomicCount += memberIndexes.length;
+              admitMemoryRefs(memberIndexes);
               continue;
             }
             if (
               !chunk.atomic &&
               includedAtomicCount === 0 &&
               includedLeadingContent &&
-              chunk.content.length <= allocatedSectionAvailable &&
-              estimateTokenCount(chunk.content) <= allocatedTokenAvailable
+              content.length <= allocatedSectionAvailable &&
+              estimateTokenCount(content) <= allocatedTokenAvailable
             ) {
-              rendered = chunk.content;
+              rendered = content;
               includedLeadingContent = false;
               includedPostAtomicContent = true;
-              postAtomicContents.push(chunk.content);
+              postAtomicContents.push(content);
               continue;
             }
             truncated = true;
@@ -520,17 +563,11 @@ export class RecallSectionCoordinator {
 
           rendered = candidate;
           if (chunk.atomic) {
-            includedAtomicCount += 1;
-            if (chunk.memoryId && chunk.memoryPath) {
-              includedMemories.push(
-                chunk.memoryNamespace
-                  ? { id: chunk.memoryId, path: chunk.memoryPath, namespace: chunk.memoryNamespace }
-                  : { id: chunk.memoryId, path: chunk.memoryPath },
-              );
-            }
+            includedAtomicCount += memberIndexes.length;
+            admitMemoryRefs(memberIndexes);
           } else {
             includedPostAtomicContent = true;
-            postAtomicContents.push(chunk.content);
+            postAtomicContents.push(content);
           }
         }
         if (includedAtomicCount === 0) {

package/src/orchestration/recall-state-view-pipeline.test.ts

@@ -96,8 +96,14 @@ test("default (stateViewActive unset) keeps filtering superseded — zero-diff b
     const explicitOff = coordinator.filterSearchResultsByRecallSafety(results, memories, {
       stateViewActive: false,
     });
-    assert.deepEqual(baseline.map((r) => r.path), [NEW]);
-    assert.deepEqual(explicitOff.map((r) => r.path), [NEW]);
+    assert.deepEqual(
+      baseline.map((r) => r.path),
+      [NEW]
+    );
+    assert.deepEqual(
+      explicitOff.map((r) => r.path),
+      [NEW]
+    );
     // No chain fields leak onto survivors when the view is off.
     assert.equal(baseline[0]?.supersededBy, undefined);
     assert.equal(baseline[0]?.id, undefined);

package/src/orchestration/semantic-merge-commit-effects.ts

@@ -17,8 +17,12 @@ import type { GraphEdge, GraphType } from "../graph.js";
 import { readFile } from "node:fs/promises";
 import { removeNodeEdgesForRewrite, rollbackNodeEdgeRewrite } from "../graph-jsonl.js";
 import {
-  hasCitationForTemplate,
-  stripCitationForTemplate,
+  attachCitation,
+  citationTemplateIsDetectable,
+  citationTemplatesForMerge,
+  lastRecognizedCitationMarker,
+  stripRecognizedCitations,
+  type CitationContext,
 } from "../source-attribution.js";
 import { resolvePipelineProcessingCapabilities } from "../capabilities.js";
 import { inferMemoryStatus } from "../memory-lifecycle-ledger-utils.js";
@@ -328,27 +332,52 @@ export async function rewriteMergedTargetGraphEdges(
   }
 }
 
+/**
+ * Round N+7 (C) + #2916: the citation form of the committed merged body.
+ * A liftable incoming marker still wins. The fallback attaches only when
+ * the current template can be re-matched later. An already-recognized
+ * marker — current, default, or a prior configured format still in
+ * history — is left in place so a template change does not duplicate it.
+ * All-placeholder templates cannot be stripped, so they are not attached.
+ */
+export function committedMergedBody(
+  deps: ExtractionPersistDeps,
+  mergedContent: string,
+  incomingCitedContent: string | undefined,
+  incomingCitationContext: Omit<CitationContext, "ts"> | undefined,
+  nowIso: string,
+): string {
+  if (resolvePipelineProcessingCapabilities(deps.config).inlineSourceAttribution !== true) {
+    return mergedContent;
+  }
+  const template = deps.config.inlineSourceAttributionFormat;
+  const templates = citationTemplatesForMerge(deps.config);
+  if (incomingCitedContent !== undefined) {
+    const marker = lastRecognizedCitationMarker(incomingCitedContent, templates);
+    if (marker) {
+      return mergedContent.endsWith(marker) ? mergedContent : `${mergedContent} ${marker}`;
+    }
+  }
+  if (!citationTemplateIsDetectable(template)) return mergedContent;
+  if (lastRecognizedCitationMarker(mergedContent, templates)) return mergedContent;
+  return attachCitation(
+    mergedContent,
+    { ...incomingCitationContext, ts: nowIso },
+    template,
+  );
+}
+
 /**
  * Round N+2 (C) — the canonical RAW pre-citation merged body for hashing.
- * The judge composes mergedContent from the stored target body, which
- * carries an appended citation marker when inline source attribution is
- * enabled; the ordinary write path hashes `contentHashSource` — the raw
- * fact text BEFORE any citation is attached. Hashing the cited body would
- * give the merged record a different identity than the equivalent raw
- * write (checklist #13), so the configured citation form is stripped
- * first, exactly like the write path's `rawChunkedContent`
- * canonicalization. Lives in this sibling (extracted from
- * semantic-merge-persist.ts) so that file stays within its file-size
- * ratchet cap.
+ * Strips every recognized citation form (current, default, and any prior
+ * configured template still in history). All-placeholder templates are
+ * not attached on the merge path, so they never reach this hash input.
  */
 export function rawPreCitationMergedBody(deps: ExtractionPersistDeps, mergedContent: string): string {
   if (resolvePipelineProcessingCapabilities(deps.config).inlineSourceAttribution !== true) {
     return mergedContent;
   }
-  const template = deps.config.inlineSourceAttributionFormat;
-  return hasCitationForTemplate(mergedContent, template)
-    ? stripCitationForTemplate(mergedContent, template)
-    : mergedContent;
+  return stripRecognizedCitations(mergedContent, citationTemplatesForMerge(deps.config));
 }
 
 /**

package/src/orchestration/semantic-merge-persist.ts

@@ -28,6 +28,7 @@ import { sanitizeMemoryContent } from "../sanitize.js";
 import { ContentHashIndex } from "../storage/content-hash-index.js";
 import type { VersioningConfig } from "../page-versioning.js";
 import {
+  committedMergedBody,
   committedMergedFactHash,
   discardMergedTargetSnapshot,
   finalizeMergedVersionPrune,
@@ -57,13 +58,10 @@ import { REFUSED_MERGE_CATEGORIES } from "../dedup/merge-on-write.js";
 import { inferMemoryStatus } from "../memory-lifecycle-ledger-utils.js";
 import { inferIntentFromText } from "../intent.js";
 import {
-  hasCitationForTemplate,
-  lastCitationMarkerForTemplate,
-  stripCitationForTemplate,
+  type CitationContext,
 } from "../source-attribution.js";
 import {
   resolveConversationContextCapabilities,
-  resolvePipelineProcessingCapabilities,
   resolvePresentationCapabilities,
   resolveRecallAuxiliaryCapabilities,
   type GraphConstructionCapabilitySet,
@@ -225,6 +223,14 @@ export interface ApplySemanticMergeOptions {
    * Absent (or citation-free) commits the judge's merged body unchanged.
    */
   incomingCitedContent?: string;
+  /**
+   * #2916: the citation context of THIS write (agent/session) — the same
+   * base a fresh attributed write stamps. When no incoming citation marker
+   * is liftable, the committed merged body still receives the configured
+   * inline-attribution transform exactly as a fresh attributed write would,
+   * stamped with this context and the merge's commit timestamp.
+   */
+  incomingCitationContext?: Omit<CitationContext, "ts">;
   /**
    * Finding C: async probe run after a merge verdict but before any
    * mutation. True when the would-be target already has promoted
@@ -470,33 +476,6 @@ export function createPathMergeParity(input: {
   };
 }
 
-/**
- * Round N+7 (C): the committed merged body carries the incoming extraction's
- * citation marker (lifted from the caller's cited body for this write)
- * appended after the judge's merged text, so incoming claims stay attributed
- * even when the merged text embeds the target's older citation — quoted
- * excerpts travel without frontmatter, so `sources` alone is not enough.
- * Idempotent; a no-op when attribution is off or no marker exists.
- */
-function committedMergedBody(
-  deps: ExtractionPersistDeps,
-  mergedContent: string,
-  incomingCitedContent: string | undefined,
-): string {
-  if (
-    resolvePipelineProcessingCapabilities(deps.config).inlineSourceAttribution !== true ||
-    incomingCitedContent === undefined
-  ) {
-    return mergedContent;
-  }
-  const marker = lastCitationMarkerForTemplate(
-    incomingCitedContent,
-    deps.config.inlineSourceAttributionFormat,
-  );
-  if (!marker || mergedContent.endsWith(marker)) return mergedContent;
-  return `${mergedContent} ${marker}`;
-}
-
 function versioningConfigFrom(deps: ExtractionPersistDeps): VersioningConfig {
   return {
     enabled: resolveRecallAuxiliaryCapabilities(deps.config).versioning,
@@ -611,10 +590,19 @@ export async function applySemanticMergeAtPersist(
   if (target.content !== decision.targetContent) {
     return { action: "created", reason: "target_changed" };
   }
-  // Round N+7 (C): every mutation below commits THIS body — the judge's
-  // merged text plus the incoming citation marker — and the outcome reports
-  // it, so caller comparisons describe what storage actually holds.
-  const committedContent = committedMergedBody(deps, decision.mergedContent, options.incomingCitedContent);
+  // Round N+7 (C) + #2916: every mutation below commits THIS body — the
+  // judge's merged text in its cited form (the incoming marker when one is
+  // liftable, else the configured transform as a fresh attributed write
+  // applies it) — and the outcome reports it, so caller comparisons
+  // describe what storage actually holds.
+  const nowIso = (options.now ? options.now() : new Date()).toISOString();
+  const committedContent = committedMergedBody(
+    deps,
+    decision.mergedContent,
+    options.incomingCitedContent,
+    options.incomingCitationContext,
+    nowIso,
+  );
 
   // Create-path parity gate (final round) — ONE place enumerates every
   // trust/scope/verdict field the normal write stamps and bypasses the
@@ -714,7 +702,6 @@ export async function applySemanticMergeAtPersist(
   // snapshot just read: a writer landing between the read and the write must
   // win rather than be overwritten from a stale body. The active-target check
   // above makes a tombstone block structurally impossible here.
-  const nowIso = (options.now ? options.now() : new Date()).toISOString();
   let casRevision: string | undefined; // #2813 (P1): OUR content CAS's receipt — feeds the patch stamp below and the catch's rollback comparison
   let mergePatch: MergeFrontmatterUpdate | undefined;
   try {

package/src/orchestration/semantic-merge-promotion-payload.ts

@@ -4,7 +4,9 @@
  * within its file-size ratchet. Everything here derives from the re-read
  * COMMITTED record; nothing reads the incoming extraction.
  */
-
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { canonicalSemanticFileText } from "../storage/cas-revision-store.js";
 import { parseOriginClass } from "../security/origin-authority.js";
 import { log } from "../logger.js";
 import { inferMemoryStatus } from "../memory-lifecycle-ledger-utils.js";
@@ -76,6 +78,15 @@ export interface MergedTargetPromotionPayload {
   committedRevision?: string;
   /** #2813 (P1 B): sha256 hex digest of the durable memory file when committed. */
   committedDigest?: string;
+  /** #2870: canonical SEMANTIC fingerprint of the durable file at
+   * payload-build time — access telemetry (`accessCount`/`lastAccessed`)
+   * excluded, the same exclusion set `invalidationCommitFingerprint`
+   * applies. The final guard re-reads the file and compares THIS, not the
+   * byte digest: an access-tracking flush between build and promotion
+   * leaves it equal (the flush mints no receipt and touches no semantic
+   * line), while any body/confidence/provenance/scope/tags/status change
+   * makes it differ. */
+  committedSemanticFingerprint?: string;
 }
 
 /**
@@ -151,13 +162,22 @@ export async function buildMergedTargetPromotionPayload(
     return { payload: null, readFailed: false };
   }
   const fm = committed.frontmatter;
-  // #2813 (P1 B): promotion reads record metadata and digest, then receipt.
-  // Compare record snapshot digest to receipt's committed digest to catch
-  // interleaving metadata writers with same body/new metadata.
+  // #2870: bind to the record's SEMANTIC identity, not its bytes. The
+  // receipt's committed semantic fingerprint — the durable file with the
+  // access-telemetry keys (`accessCount:`, `lastAccessed:`) stripped, the
+  // same exclusion set `invalidationCommitFingerprint` applies — stays
+  // equal across an access-tracking flush (which rewrites exactly those
+  // two lines without minting a receipt), so a flush between the merge
+  // commit and this reread no longer blocks a valid promotion. Any other
+  // frontmatter or body change still refuses. Shards recorded before
+  // #2870 carry no stored semantic fingerprint; those keep the stricter
+  // full-digest comparison until the next semantic write re-records the
+  // shard.
   const snapshotDigest =
     typeof storage.readDurableFileDigest === "function"
       ? await storage.readDurableFileDigest(committed.path).catch(() => null)
       : null;
+  const snapshotSemanticFingerprint = await readDurableSemanticFingerprint(committed.path);
   const receipt = await readPromotionReceiptStatus(storage, committed.path);
   if (!receipt.available) {
     log.warn(
@@ -165,7 +185,22 @@ export async function buildMergedTargetPromotionPayload(
     );
     return { payload: null, readFailed: true };
   }
-  if (receipt.committedDigest !== undefined && snapshotDigest !== receipt.committedDigest) {
+  if (
+    receipt.committedSemanticFingerprint !== undefined &&
+    snapshotSemanticFingerprint !== receipt.committedSemanticFingerprint
+  ) {
+    log.warn(
+      snapshotSemanticFingerprint == null
+        ? `semantic-merge: merged-target promotion refused for ${merge.targetId} — the semantic snapshot fingerprint is unavailable while the CAS receipt carries ${receipt.committedSemanticFingerprint}; promotion and reconciliation retry on the next merge`
+        : `semantic-merge: merged-target promotion refused for ${merge.targetId} — record semantic fingerprint (${snapshotSemanticFingerprint}) does not match committed receipt fingerprint (${receipt.committedSemanticFingerprint}); record metadata was mutated concurrently`,
+    );
+    return { payload: null, readFailed: true };
+  }
+  if (
+    receipt.committedSemanticFingerprint === undefined &&
+    receipt.committedDigest !== undefined &&
+    snapshotDigest !== receipt.committedDigest
+  ) {
     log.warn(
       snapshotDigest == null
         ? `semantic-merge: merged-target promotion refused for ${merge.targetId} — the record snapshot digest is unavailable while the CAS receipt carries committed digest ${receipt.committedDigest}; promotion and reconciliation retry on the next merge`
@@ -210,11 +245,30 @@ export async function buildMergedTargetPromotionPayload(
         : snapshotDigest !== null
           ? { committedDigest: snapshotDigest }
           : {}),
+      ...(receipt.committedSemanticFingerprint !== undefined
+        ? { committedSemanticFingerprint: receipt.committedSemanticFingerprint }
+        : snapshotSemanticFingerprint !== null
+          ? { committedSemanticFingerprint: snapshotSemanticFingerprint }
+          : {}),
     },
     readFailed: false,
   };
 }
 
+/** #2870: canonical SEMANTIC fingerprint of a durable file's CURRENT
+ * bytes — the file text with access telemetry stripped
+ * ({@link canonicalSemanticFileText}), hashed exactly the way the CAS
+ * receipt records it at commit time. Null when the file cannot be read
+ * (fail-open, like readDurableFileDigest). */
+export async function readDurableSemanticFingerprint(filePath: string): Promise<string | null> {
+  try {
+    return createHash("sha256")
+      .update(canonicalSemanticFileText(await readFile(filePath, "utf8")))
+      .digest("hex");
+  } catch {
+    return null;
+  }
+}
 /** #2813 (P1 A): read the standing receipt as a three-way truth for the
  * promotion path. Present and absent are usable identities (absent = the
  * target predates the sidecar); unavailable is not. A storage whose status
@@ -223,7 +277,7 @@ export async function readPromotionReceiptStatus(
   storage: Pick<StorageManager, "readCasRevisionStatus">,
   filePath: string,
 ): Promise<
-  | { available: true; revision: string | undefined; committedDigest?: string }
+  | { available: true; revision: string | undefined; committedDigest?: string; committedSemanticFingerprint?: string }
   | { available: false; reason: string }
 > {
   try {
@@ -233,6 +287,8 @@ export async function readPromotionReceiptStatus(
       available: true,
       revision: status.status === "present" ? status.revision : undefined,
       committedDigest: status.status === "present" ? status.committedDigest : undefined,
+      committedSemanticFingerprint:
+        status.status === "present" ? status.committedSemanticFingerprint : undefined,
     };
   } catch (err) {
     return { available: false, reason: err instanceof Error ? err.message : String(err) };

package/src/orchestration/startup-collection-checks.ts

@@ -0,0 +1,85 @@
+import { log } from "../logger.js";
+import {
+  qmdStartupCollectionCheckTimeoutMs,
+  type SearchCollectionState,
+} from "./orchestrator-helpers.js";
+
+export interface QmdStartupCollectionCheckResult {
+  namespace: string;
+  state: SearchCollectionState;
+}
+
+export interface StartupDiscovery<T> {
+  value: T;
+  complete: boolean;
+}
+
+/**
+ * Bound any startup discovery that must not hold a readiness gate forever.
+ * Discovery APIs such as the namespace catalog do not accept an AbortSignal,
+ * so a late result is deliberately ignored after the configured fallback wins.
+ */
+export async function startupDiscoveryWithTimeout<T>(
+  discover: () => Promise<T>,
+  configuredFallback: T,
+  timeoutMs = qmdStartupCollectionCheckTimeoutMs(),
+): Promise<StartupDiscovery<T>> {
+  let timer: NodeJS.Timeout | undefined;
+  const fallback: StartupDiscovery<T> = {
+    value: configuredFallback,
+    complete: false,
+  };
+  const timeoutPromise = new Promise<StartupDiscovery<T>>((resolve) => {
+    timer = setTimeout(() => {
+      log.warn(
+        `startup discovery timed out after ${timeoutMs}ms; using configured fallback fail-open`,
+      );
+      resolve(fallback);
+    }, timeoutMs);
+  });
+  try {
+    return await Promise.race([
+      Promise.resolve()
+        .then(discover)
+        .then((value) => ({ value, complete: true })),
+      timeoutPromise,
+    ]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+
+/**
+ * Bound the complete startup collection-check batch, not just each individual
+ * check. This preserves service availability when a backend ignores an abort
+ * signal or a check promise never settles: startup continues with fail-open
+ * `unknown` states and the normal background retry path can repair search.
+ */
+export async function qmdStartupCollectionChecksWithTimeout(
+  checks: readonly Promise<QmdStartupCollectionCheckResult>[],
+  namespaces: readonly string[],
+  timeoutMs = qmdStartupCollectionCheckTimeoutMs() + 1_000,
+): Promise<QmdStartupCollectionCheckResult[]> {
+  if (checks.length === 0) return [];
+  const settled = new Map<string, QmdStartupCollectionCheckResult>();
+  const trackedChecks = checks.map((check) => check.then((result) => {
+    settled.set(result.namespace, result);
+    return result;
+  }));
+  let timer: NodeJS.Timeout | undefined;
+  const timeoutPromise = new Promise<QmdStartupCollectionCheckResult[]>((resolve) => {
+    timer = setTimeout(() => {
+      log.warn(
+        `QMD startup collection check batch timed out after ${timeoutMs}ms; keeping search enabled fail-open`,
+      );
+      resolve(namespaces.map((namespace) =>
+        settled.get(namespace) ?? { namespace, state: "unknown" as const },
+      ));
+    }, timeoutMs);
+  });
+  try {
+    return await Promise.race([Promise.all(trackedChecks), timeoutPromise]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}

package/src/orchestrator-flush.test.ts

@@ -2770,6 +2770,11 @@ test("deferredInitialize startup sync covers cataloged dynamic namespaces (NHZEV
   const orchestrator = Object.create(Orchestrator.prototype) as any;
   let updateArg: string[] | undefined;
   const abortController = new AbortController();
+  // #2980 fences startup work by lifecycle epoch: deferredInitialize() now
+  // begins an epoch that resets the gate fields the selfDeps seam fail-fasts
+  // on (PR #1801 set-trap contract). Prototype fakes must declare them.
+  orchestrator.deferredInitAbort = null;
+  orchestrator.deferredSyncSucceeded = false;
   const memoryDir = path.join(os.tmpdir(), "remnic-startup-maintenance-nhzev");
   const dynamicNamespace = "project-origin-dynamic";
   const dynamicStorageDir = path.join(
@@ -2838,6 +2843,8 @@ test("deferredInitialize startup sync falls back to configured set on catalog re
   const orchestrator = Object.create(Orchestrator.prototype) as any;
   let updateArg: string[] | undefined;
   const abortController = new AbortController();
+  orchestrator.deferredInitAbort = null;
+  orchestrator.deferredSyncSucceeded = false;
 
   orchestrator.config = {
     namespacesEnabled: true,