@remnic/core 9.69.40 → 9.69.41

package/src/dedup/merge.test.ts

@@ -49,6 +49,7 @@ import {
 import type { SemanticDedupHit } from "./semantic.js";
 import { invalidationCommitFingerprint, isSemanticFrontmatterChange, markCasCommittedRevision, nextCasRevisionIso } from "../storage/deletion-revision-store.js";
 import type { CasRevisionReadStatus } from "../storage/cas-revision-store.js";
+import { attachCitation } from "../source-attribution.js";
 
 // The merge snapshot trigger must stay a literal union: a widened
 // `VersionTrigger` (e.g. annotated `readonly string[]`) would let an unknown
@@ -3147,6 +3148,288 @@ test("applySemanticMergeAtPersist: mixed default+custom citation markers hash as
   assert.equal(stamped, ContentHashIndex.computeHash(sanitizeMemoryContent(MERGED).text));
 });
 
+// ── #2916: reapply inline attribution to the committed merged body ───────────
+
+test("applySemanticMergeAtPersist: a legacy target with no liftable marker still commits an attributed body (#2916)", async () => {
+  const h = await harness({ topLevelConfig: { inlineSourceAttributionEnabled: true } });
+  const NOW = new Date("2026-08-23T00:00:00.000Z");
+  const CONTEXT = { agent: "agent-a", session: "project/example/s-42" };
+  const outcome = await applySemanticMergeAtPersist(h.deps, {
+    storage: h.storage,
+    content: INCOMING,
+    category: "fact",
+    // No cited body supplied: the target was created before attribution was
+    // enabled, so without the fresh-write fallback nothing in the pipeline
+    // would attribute the merged claims.
+    incomingCitationContext: CONTEXT,
+    now: () => NOW,
+    judgeCall: (options) => acceptingJudge(options),
+  } as ApplySemanticMergeOptions);
+  assert.equal(outcome.action, "merged");
+  // Exactly what a fresh attributed write of the merged body would persist:
+  // the shared attachCitation helper, this write's context, the merge's
+  // commit timestamp.
+  const expected = attachCitation(MERGED, { ...CONTEXT, ts: NOW.toISOString() });
+  const committed = await h.storage.getMemoryByIdIncludingArchived("fact-target");
+  assert.equal(committed?.content, expected);
+  assert.ok(expected.includes("[Source:"), "the reapplied marker must use the configured format");
+  if (outcome.action !== "merged") return;
+  assert.equal(outcome.mergedContent, expected);
+  // Canonical identity survives: the hash stays on the RAW pre-citation body.
+  const stamped = h.calls.frontmatterPatches.at(-1)?.patch.contentHash;
+  assert.equal(stamped, ContentHashIndex.computeHash(sanitizeMemoryContent(MERGED).text));
+  // Promotion parity: the committed attributed record still yields a payload.
+  const { payload } = await buildMergedTargetPromotionPayload(h.storage, outcome);
+  assert.ok(payload, "a fully patched attributed merge must still promote");
+  assert.equal(payload?.sourceMemoryId, "fact-target");
+});
+
+test("applySemanticMergeAtPersist: an already-attributed merged body gains no duplicate marker on retry (#2916)", async () => {
+  const MARKER = "[Source: agent=agent-a, session=s-42, ts=2026-08-23T00:00:00.000Z]";
+  const RETRY_BODY = `${MERGED} ${MARKER}`;
+  const retryJudge = async () => ({
+    decision: "merge" as const,
+    targetId: "fact-target",
+    mergedContent: RETRY_BODY,
+    reason: "retry of an already-attributed merge",
+  });
+  // (a) The incoming marker already trails the judge's body — the N+7 (C)
+  // retry shape, where the previous merge committed the marker into the
+  // target the judge then re-merged.
+  const a = await harness({ topLevelConfig: { inlineSourceAttributionEnabled: true } });
+  const outcomeA = await applySemanticMergeAtPersist(a.deps, {
+    storage: a.storage,
+    content: INCOMING,
+    category: "fact",
+    incomingCitedContent: `${INCOMING} ${MARKER}`,
+    judgeCall: retryJudge,
+  } as ApplySemanticMergeOptions);
+  assert.equal(outcomeA.action, "merged");
+  // (b) No cited body; the body already carries a marker — the #2916
+  // fallback must be a no-op, not a second attachment.
+  const b = await harness({ topLevelConfig: { inlineSourceAttributionEnabled: true } });
+  const outcomeB = await applySemanticMergeAtPersist(b.deps, {
+    storage: b.storage,
+    content: INCOMING,
+    category: "fact",
+    incomingCitationContext: { agent: "agent-a", session: "project:s-42" },
+    judgeCall: retryJudge,
+  } as ApplySemanticMergeOptions);
+  assert.equal(outcomeB.action, "merged");
+  const cases = [
+    ["lifted-marker retry", a, outcomeA],
+    ["attached-marker retry", b, outcomeB],
+  ] as const;
+  for (const [label, h, outcome] of cases) {
+    const committed = await h.storage.getMemoryByIdIncludingArchived("fact-target");
+    assert.equal(committed?.content, RETRY_BODY, label);
+    assert.equal(
+      committed?.content.split("[Source:").length - 1,
+      1,
+      `${label}: exactly one marker, never a duplicate`,
+    );
+    if (outcome.action === "merged") {
+      assert.equal(outcome.mergedContent, RETRY_BODY, label);
+    }
+  }
+});
+
+test("applySemanticMergeAtPersist: the reapplied citation honors a custom template (#2916)", async () => {
+  const CUSTOM_TEMPLATE = "[src:{agent}/{sessionId}@{ts}]";
+  const h = await harness({
+    topLevelConfig: {
+      inlineSourceAttributionEnabled: true,
+      inlineSourceAttributionFormat: CUSTOM_TEMPLATE,
+    },
+  });
+  const NOW = new Date("2026-08-23T00:00:00.000Z");
+  const CONTEXT = { agent: "agent-a", session: "project:s-42" };
+  const outcome = await applySemanticMergeAtPersist(h.deps, {
+    storage: h.storage,
+    content: INCOMING,
+    category: "fact",
+    incomingCitationContext: CONTEXT,
+    now: () => NOW,
+    judgeCall: (options) => acceptingJudge(options),
+  } as ApplySemanticMergeOptions);
+  assert.equal(outcome.action, "merged");
+  const expected = attachCitation(MERGED, { ...CONTEXT, ts: NOW.toISOString() }, CUSTOM_TEMPLATE);
+  assert.ok(expected.includes("[src:agent-a/s-42@"), "the custom template must format the marker");
+  const committed = await h.storage.getMemoryByIdIncludingArchived("fact-target");
+  assert.equal(committed?.content, expected);
+  // Identity stays on the raw body — the custom marker strips before hashing.
+  const stamped = h.calls.frontmatterPatches.at(-1)?.patch.contentHash;
+  assert.equal(stamped, ContentHashIndex.computeHash(sanitizeMemoryContent(MERGED).text));
+});
+
+test("applySemanticMergeAtPersist: attribution disabled commits the judge's body unchanged (#2916)", async () => {
+  const h = await harness();
+  const outcome = await applySemanticMergeAtPersist(h.deps, {
+    storage: h.storage,
+    content: INCOMING,
+    category: "fact",
+    // The context is present but the feature flag is off — no marker.
+    incomingCitationContext: { agent: "agent-a", session: "project:s-42" },
+    now: () => new Date("2026-08-23T00:00:00.000Z"),
+    judgeCall: (options) => acceptingJudge(options),
+  } as ApplySemanticMergeOptions);
+  assert.equal(outcome.action, "merged");
+  const committed = await h.storage.getMemoryByIdIncludingArchived("fact-target");
+  assert.equal(committed?.content, MERGED, "the committed body carries no citation marker");
+});
+
+test("applySemanticMergeAtPersist: a degraded merge registers the RAW identity of a freshly attributed body (#2916)", async () => {
+  // Patch fails AND rollback fails: the target holds the attributed merged
+  // body with its pre-merge metadata. The degraded repair must register the
+  // RAW pre-citation identity, and the degraded promotion refusal must hold.
+  const h = await harness({
+    frontmatterFails: true,
+    rollbackFails: true,
+    topLevelConfig: { inlineSourceAttributionEnabled: true },
+  });
+  const degraded = await applySemanticMergeAtPersist(h.deps, {
+    storage: h.storage,
+    content: INCOMING,
+    category: "fact",
+    incomingCitationContext: { agent: "agent-a", session: "project:s-42" },
+    now: () => new Date("2026-08-23T00:00:00.000Z"),
+    judgeCall: (options) => acceptingJudge(options),
+  } as ApplySemanticMergeOptions);
+  assert.equal(degraded.action, "merged");
+  if (degraded.action !== "merged") return;
+  assert.equal(degraded.provenancePatched, false);
+  assert.ok(
+    degraded.mergedContent.includes("[Source:"),
+    "the degraded body still carries the freshly attached marker",
+  );
+  assert.deepEqual(h.calls.hashRegistrations, [
+    { id: "fact-target", hash: ContentHashIndex.computeHash(sanitizeMemoryContent(MERGED).text) },
+  ]);
+  assert.equal(
+    (await buildMergedTargetPromotionPayload(h.storage, degraded)).payload,
+    null,
+    "a degraded merge never yields a promotion payload",
+  );
+});
+
+test("applySemanticMergeAtPersist: a rolled-back merge restores the marker-free pre-merge body (#2916)", async () => {
+  const h = await harness({
+    frontmatterFails: true,
+    topLevelConfig: { inlineSourceAttributionEnabled: true },
+  });
+  const outcome = await applySemanticMergeAtPersist(h.deps, {
+    storage: h.storage,
+    content: INCOMING,
+    category: "fact",
+    incomingCitationContext: { agent: "agent-a", session: "project:s-42" },
+    now: () => new Date("2026-08-23T00:00:00.000Z"),
+    judgeCall: (options) => acceptingJudge(options),
+  } as ApplySemanticMergeOptions);
+  assert.deepEqual(outcome, { action: "created", reason: "update_failed" });
+  const committed = await h.storage.getMemoryByIdIncludingArchived("fact-target");
+  assert.equal(committed?.content, EXISTING, "rollback restores the exact pre-merge body");
+});
+
+test("applySemanticMergeAtPersist: an all-placeholder template does not attach or hash a citation", async () => {
+  const TEMPLATE = "{agent}{sessionId}";
+  const CONTEXT = { agent: "agent-a", session: "project:s-42" };
+  const h = await harness({
+    topLevelConfig: {
+      inlineSourceAttributionEnabled: true,
+      inlineSourceAttributionFormat: TEMPLATE,
+    },
+  });
+  const first = await applySemanticMergeAtPersist(h.deps, {
+    storage: h.storage,
+    content: INCOMING,
+    category: "fact",
+    incomingCitationContext: CONTEXT,
+    now: () => new Date("2026-08-23T00:00:00.000Z"),
+    judgeCall: (options) => acceptingJudge(options),
+  } as ApplySemanticMergeOptions);
+  assert.equal(first.action, "merged");
+  const committed = await h.storage.getMemoryByIdIncludingArchived("fact-target");
+  assert.equal(committed?.content, MERGED, "unmatchable templates must not attach a marker");
+  assert.equal(
+    h.calls.frontmatterPatches.at(-1)?.patch.contentHash,
+    ContentHashIndex.computeHash(sanitizeMemoryContent(MERGED).text),
+  );
+
+  const retry = await applySemanticMergeAtPersist(h.deps, {
+    storage: h.storage,
+    content: INCOMING,
+    category: "fact",
+    incomingCitationContext: CONTEXT,
+    now: () => new Date("2026-08-23T00:00:01.000Z"),
+    judgeCall: (options) => acceptingJudge(options),
+  } as ApplySemanticMergeOptions);
+  assert.equal(retry.action, "merged");
+  const retried = await h.storage.getMemoryByIdIncludingArchived("fact-target");
+  assert.equal(retried?.content, MERGED, "retry must not accumulate an unmatchable marker");
+});
+
+test("applySemanticMergeAtPersist: a prior-template marker is preserved and stripped from the hash", async () => {
+  const PRIOR = "[src:{agent}/{sessionId}@{date}]";
+  const PRIOR_CIT = "[src:agent-a/s-old@2026-08-19]";
+  const CURRENT = "[via:{agent}]";
+  const MERGED_WITH_PRIOR = `${MERGED} ${PRIOR_CIT}`;
+  const h = await harness({
+    topLevelConfig: {
+      inlineSourceAttributionEnabled: true,
+      inlineSourceAttributionFormat: CURRENT,
+      inlineSourceAttributionFormatHistory: [PRIOR],
+    },
+  });
+  await h.setTargetContent(`${EXISTING} ${PRIOR_CIT}`);
+  const outcome = await applySemanticMergeAtPersist(h.deps, {
+    storage: h.storage,
+    content: INCOMING,
+    category: "fact",
+    incomingCitationContext: { agent: "agent-a", session: "project:s-42" },
+    now: () => new Date("2026-08-23T00:00:00.000Z"),
+    judgeCall: async () => ({
+      decision: "merge" as const,
+      targetId: "fact-target",
+      mergedContent: MERGED_WITH_PRIOR,
+      reason: "template migration keeps the prior marker",
+    }),
+  } as ApplySemanticMergeOptions);
+  assert.equal(outcome.action, "merged");
+  const committed = await h.storage.getMemoryByIdIncludingArchived("fact-target");
+  assert.equal(committed?.content, MERGED_WITH_PRIOR, "the prior marker stays and is not duplicated");
+  assert.equal(committed?.content.includes("[via:"), false);
+  assert.equal(
+    h.calls.frontmatterPatches.at(-1)?.patch.contentHash,
+    ContentHashIndex.computeHash(sanitizeMemoryContent(MERGED).text),
+    "the prior marker is stripped before hashing",
+  );
+});
+
+test("applySemanticMergeAtPersist: a lost CAS race does not hash an all-placeholder citation", async () => {
+  const RACED = "Billing service deploys happen on Tuesdays, except during a freeze.";
+  const h = await harness({
+    mutateOnWrite: RACED,
+    topLevelConfig: {
+      inlineSourceAttributionEnabled: true,
+      inlineSourceAttributionFormat: "{agent}{sessionId}",
+    },
+  });
+  const outcome = await applySemanticMergeAtPersist(h.deps, {
+    storage: h.storage,
+    content: INCOMING,
+    category: "fact",
+    incomingCitationContext: { agent: "agent-a", session: "project:s-42" },
+    now: () => new Date("2026-08-23T00:00:00.000Z"),
+    judgeCall: (options) => acceptingJudge(options),
+  } as ApplySemanticMergeOptions);
+  assert.deepEqual(outcome, { action: "created", reason: "target_changed" });
+  assert.deepEqual(h.calls.contentUpdates, []);
+  assert.deepEqual(h.calls.hashRegistrations, []);
+  const onDisk = await readFile(h.target.path, "utf8");
+  assert.equal(onDisk.includes(RACED), true);
+  assert.equal(onDisk.includes("agent-a"), false);
+});
+
 /** Minimal real-dir harness for the merged-target post-effects executor. */
 async function postEffectsHarness(options: {
   graphEdgeThrows?: boolean;

package/src/deep-recall-boundary.test.ts

@@ -0,0 +1,66 @@
+/**
+ * Deep-recall MCP operation boundary regressions (issue #2915).
+ *
+ * `deep_recall` runs through the shared operation registry (the dispatch the
+ * MCP server uses). At this boundary a malformed `maxSteps` must be REJECTED
+ * — `"abc"` previously fell back to the configured default and `""` coerced
+ * to 0 (§39) — and the request's cancellation signal must reach the service.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { getOperation, type OperationContext } from "./access-boundary.js";
+import { EngramAccessInputError, type EngramAccessService } from "./access-service.js";
+import "./access-operations.js";
+
+interface CapturedRequest {
+  query?: string;
+  maxSteps?: number;
+  namespace?: string;
+  sessionKey?: string;
+  authenticatedPrincipal?: string;
+  abortSignal?: AbortSignal;
+}
+
+function serviceCapturing(captured: CapturedRequest): EngramAccessService {
+  return {
+    async deepRecall(request: CapturedRequest) {
+      Object.assign(captured, request);
+      return { ok: true, entries: [], trace: [], rendered: "synthetic" };
+    },
+  } as unknown as EngramAccessService;
+}
+
+function ctx(service: EngramAccessService, abortSignal?: AbortSignal): OperationContext {
+  return { service, authenticatedPrincipal: "operator", ...(abortSignal ? { abortSignal } : {}) };
+}
+
+test("deep_recall operation rejects malformed maxSteps instead of silently defaulting (issue #2915)", async () => {
+  const operation = getOperation("deep_recall");
+  assert.ok(operation, "the deep_recall operation is registered");
+  for (const maxSteps of ["abc", "", "1.5", -1]) {
+    const captured: CapturedRequest = {};
+    await assert.rejects(
+      operation.run({ query: "payments routing", maxSteps }, ctx(serviceCapturing(captured))),
+      (err: unknown) => err instanceof EngramAccessInputError && /maxSteps/.test(err.message),
+      `must reject maxSteps ${JSON.stringify(maxSteps)}`,
+    );
+    assert.equal(captured.maxSteps, undefined, "the service is never reached with invalid input");
+  }
+});
+
+test("deep_recall operation forwards parsed maxSteps and the cancellation signal (issue #2915)", async () => {
+  const operation = getOperation("deep_recall");
+  assert.ok(operation);
+  const captured: CapturedRequest = {};
+  const controller = new AbortController();
+  await operation.run(
+    { query: "payments routing", maxSteps: "2", namespace: "ns_x" },
+    ctx(serviceCapturing(captured), controller.signal),
+  );
+  assert.equal(captured.maxSteps, 2, "a digit-string maxSteps parses to the integer it names");
+  assert.equal(captured.namespace, "ns_x");
+  assert.equal(captured.authenticatedPrincipal, "operator");
+  assert.equal(captured.abortSignal, controller.signal, "the transport signal reaches the service call");
+});

package/src/deep-recall-cli.test.ts

@@ -0,0 +1,82 @@
+/**
+ * Deep-recall CLI identity regression (issue #2915).
+ *
+ * With namespaces enabled the read path refuses an unauthenticated caller,
+ * and the standalone CLI has no transport to authenticate one — so the CLI
+ * must carry the SAME identity options the access CLI uses
+ * (`--principal` / `--session-key`) into the service call. This drives the
+ * registered commander action against a minimal orchestrator double and
+ * asserts the authenticated principal reaches namespace resolution.
+ */
+
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { parseConfig } from "./config.js";
+import type { CliCommand } from "./cli.js";
+import { registerDeepRecallCommands } from "./cli/deep-recall-commands.js";
+import type { Orchestrator } from "./orchestrator.js";
+
+interface RegisteredAction {
+  run: (...args: unknown[]) => Promise<void>;
+}
+
+function captureRegisteredAction(orchestrator: Orchestrator): RegisteredAction {
+  let action: RegisteredAction | undefined;
+  const chain = {
+    command: () => chain,
+    description: () => chain,
+    option: () => chain,
+    action: (fn: (...args: unknown[]) => Promise<void>) => {
+      action = { run: fn };
+      return chain;
+    },
+  };
+  registerDeepRecallCommands(chain as unknown as CliCommand, orchestrator);
+  assert.ok(action, "the deep-recall command registered an action");
+  return action;
+}
+
+test("deep-recall CLI passes the operator's identity into the namespaced read (issue #2915)", async () => {
+  const config = parseConfig({
+    memoryDir: "/synthetic/cli-identity",
+    namespacesEnabled: true,
+    defaultNamespace: "default",
+    namespacePolicies: [{ name: "ns_alice", readPrincipals: ["alice"], writePrincipals: ["alice"] }],
+    deepRecall: { enabled: true, maxSteps: 0 },
+  });
+  const storageNamespaces: string[] = [];
+  const orchestrator = {
+    config,
+    async getStorage(namespace: string) {
+      storageNamespaces.push(namespace);
+      return {
+        dir: "/synthetic/cli-identity",
+        async getMemoryById() {
+          return null;
+        },
+      };
+    },
+    async searchAcrossNamespaces() {
+      return [];
+    },
+    localLlm: null,
+    fastGatewayLlm: null,
+  } as unknown as Orchestrator;
+
+  const registered = captureRegisteredAction(orchestrator);
+  const exitCodeBefore = process.exitCode;
+  const consoleLog = console.log;
+  console.log = () => {};
+  try {
+    await registered.run("payments routing", { principal: "alice", namespace: "ns_alice", json: true });
+    assert.deepEqual(
+      storageNamespaces,
+      ["ns_alice"],
+      "the authenticated principal's namespace was resolved and read",
+    );
+  } finally {
+    console.log = consoleLog;
+    process.exitCode = exitCodeBefore;
+  }
+});

package/src/deep-recall-config.test.ts

@@ -0,0 +1,56 @@
+/**
+ * Strict `maxSteps` request parsing (issue #2915) — the one parser MCP,
+ * HTTP, and CLI share. Absent means absent; everything else must be a
+ * non-negative safe integer. Malformed (`"abc"`), empty (`""`), fractional
+ * (`"1.5"` / `1.5`), negative, unsafe, and non-number values throw instead of
+ * silently falling back to the configured default (§39).
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { parseDeepRecallMaxSteps } from "./deep-recall-config.js";
+
+test("parseDeepRecallMaxSteps: absence stays absent", () => {
+  assert.equal(parseDeepRecallMaxSteps(undefined), undefined);
+  assert.equal(parseDeepRecallMaxSteps(null), undefined);
+});
+
+test("parseDeepRecallMaxSteps: accepts non-negative integers in number and digit-string form", () => {
+  assert.equal(parseDeepRecallMaxSteps(0), 0);
+  assert.equal(parseDeepRecallMaxSteps(4), 4);
+  assert.equal(parseDeepRecallMaxSteps("0"), 0);
+  assert.equal(parseDeepRecallMaxSteps("3"), 3);
+  assert.equal(parseDeepRecallMaxSteps(" 3 "), 3);
+  assert.equal(parseDeepRecallMaxSteps(Number.MAX_SAFE_INTEGER), Number.MAX_SAFE_INTEGER);
+  assert.equal(parseDeepRecallMaxSteps(String(Number.MAX_SAFE_INTEGER)), Number.MAX_SAFE_INTEGER);
+});
+
+test("parseDeepRecallMaxSteps: rejects malformed, empty, fractional, negative, and non-number input", () => {
+  const invalid: unknown[] = ["abc", "", " ", "1.5", "1e2", "0x3", "-1", "-1", 1.5, -0.5, -1, true, {}, [], Number.NaN];
+  for (const raw of invalid) {
+    assert.throws(
+      () => parseDeepRecallMaxSteps(raw),
+      /maxSteps must be a non-negative integer/,
+      `must reject ${JSON.stringify(raw)}`,
+    );
+  }
+});
+
+test("parseDeepRecallMaxSteps: rejects unsafe integers and precision-losing digit strings", () => {
+  const overflowString = "9007199254740993";
+  const unsafe: unknown[] = [
+    Number.MAX_SAFE_INTEGER + 1,
+    String(Number.MAX_SAFE_INTEGER + 1),
+    overflowString,
+    "99999999999999999999",
+  ];
+  for (const raw of unsafe) {
+    assert.throws(
+      () => parseDeepRecallMaxSteps(raw),
+      /maxSteps must be a non-negative integer/,
+      `must reject ${String(raw)}`,
+    );
+  }
+  assert.notEqual(String(Number(overflowString)), overflowString, "Number() rounds this string; the parser must not");
+});

package/src/deep-recall-config.ts

@@ -81,3 +81,35 @@ export function parseDeepRecallConfig(raw: unknown): DeepRecallConfig {
     totalTimeoutMs: parseCount(src, "totalTimeoutMs", DEEP_RECALL_CONFIG_DEFAULTS.totalTimeoutMs),
   };
 }
+
+/**
+ * Strict request-surface parse of an optional `maxSteps` override
+ * (issue #2915). Shared by MCP, HTTP, and CLI so every boundary rejects the
+ * same way instead of silently defaulting: absent/null is `undefined`;
+ * anything else must be a non-negative safe integer — a JS safe integer, or a
+ * string whose trimmed form is bare digits that parse without overflow.
+ * Malformed (`"abc"`), empty (`""`), fractional (`"1.5"` / `1.5`), negative,
+ * unsafe (`Number.MAX_SAFE_INTEGER + 1`), and non-number values throw instead
+ * of falling back to the configured default (§39).
+ */
+export function parseDeepRecallMaxSteps(raw: unknown): number | undefined {
+  if (raw === undefined || raw === null) return undefined;
+  if (typeof raw === "number") {
+    if (!Number.isSafeInteger(raw) || raw < 0) {
+      throw new Error(`maxSteps must be a non-negative integer; got ${JSON.stringify(raw)}`);
+    }
+    return raw;
+  }
+  if (typeof raw === "string") {
+    const trimmed = raw.trim();
+    if (!/^[0-9]+$/.test(trimmed)) {
+      throw new Error(`maxSteps must be a non-negative integer; got ${JSON.stringify(raw)}`);
+    }
+    const parsed = Number(trimmed);
+    if (!Number.isSafeInteger(parsed)) {
+      throw new Error(`maxSteps must be a non-negative integer; got ${JSON.stringify(raw)}`);
+    }
+    return parsed;
+  }
+  throw new Error(`maxSteps must be a non-negative integer; got ${JSON.stringify(raw)}`);
+}

package/src/deep-recall-http-glue.ts

@@ -12,19 +12,11 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import { deepRecallRequestSchema } from "./access-schema.js";
 import { EngramAccessInputError } from "./access-errors.js";
 import type { EngramAccessService } from "./access-service.js";
+import { parseDeepRecallMaxSteps } from "./deep-recall-config.js";
 
 type RespondJson = (res: ServerResponse, status: number, payload: unknown) => void;
 type ReadJsonBody = (req: IncomingMessage) => Promise<unknown>;
 
-function coerceMaxSteps(raw: unknown): number | undefined {
-  if (raw === undefined || raw === null) return undefined;
-  const value = typeof raw === "string" ? Number(raw) : raw;
-  if (typeof value !== "number" || !Number.isFinite(value) || !Number.isInteger(value) || value < 0) {
-    throw new EngramAccessInputError("maxSteps must be a non-negative integer");
-  }
-  return value;
-}
-
 export async function respondDeepRecall(
   req: IncomingMessage,
   res: ServerResponse,
@@ -52,6 +44,8 @@ export async function respondDeepRecall(
     bodyNamespace?: string,
     bodySessionKey?: string,
   ) => { namespace?: string; sessionKey?: string; authenticatedPrincipal?: string },
+  /** Transport cancellation (issue #2915): aborts seed search, graph reads, policy calls. */
+  abortSignal?: AbortSignal,
 ): Promise<void> {
   const parsed = deepRecallRequestSchema.safeParse(await readJsonBody(req));
   if (!parsed.success) {
@@ -62,7 +56,12 @@ export async function respondDeepRecall(
     );
     return;
   }
-  const maxSteps = coerceMaxSteps(parsed.data.maxSteps);
+  let maxSteps: number | undefined;
+  try {
+    maxSteps = parseDeepRecallMaxSteps(parsed.data.maxSteps);
+  } catch (err) {
+    throw new EngramAccessInputError(err instanceof Error ? err.message : String(err));
+  }
   const scope = scopeFor(parsed.data.namespace, parsed.data.sessionKey);
   const result = await service.deepRecall({
     query: parsed.data.query,
@@ -70,6 +69,7 @@ export async function respondDeepRecall(
     namespace: scope.namespace,
     sessionKey: scope.sessionKey,
     authenticatedPrincipal: scope.authenticatedPrincipal,
+    ...(abortSignal ? { abortSignal } : {}),
   });
   respondJson(res, 200, result);
 }