@remnic/core 9.69.40 → 9.69.41

package/src/deep-recall.ts

@@ -17,6 +17,7 @@ import { z } from "zod";
 import type { AbstractionNode } from "./abstraction-nodes.js";
 import type { CueAnchor } from "./cue-anchors.js";
 import { compareDeterministicStrings } from "./deterministic-order.js";
+import { abortError, isAbortError, raceAbort, throwIfAborted } from "./abort-error.js";
 import { extractJsonCandidates, stripCodeFences } from "./json-extract.js";
 import { rankDeepRecallFrontier } from "./recall-deep-frontier.js";
 import { selectExpandNodeIds } from "./recall-deep-expand-select.js";
@@ -94,8 +95,19 @@ export interface DeepRecallDeps {
   loadGraph(): Promise<DeepRecallGraphSnapshot>;
   /** Namespace-scoped memory-by-id read; null when absent from the caller's namespace (§30). */
   loadMemory(memoryId: string): Promise<DeepRecallMemoryView | null>;
-  /** Raw policy LLM output (JSON text); null when the call failed. */
+  /**
+   * Raw policy LLM output (JSON text); null when the call failed. The
+   * per-call timeout already spans both LLM legs (issue #2915).
+   */
   callPolicy(statePrompt: string, timeoutMs: number): Promise<string | null>;
+  /**
+   * Cancellation from the transport (MCP tools/call cancelled, HTTP client
+   * disconnected — issue #2915). Checked before every step and raced against
+   * every dependency call; an abort surfaces as a standard AbortError, which
+   * both transports already translate (silently end the dead socket / rethrow
+   * the cancellation) instead of a partial `ok: true` result.
+   */
+  signal?: AbortSignal;
   nowMs?(): number;
 }
 
@@ -121,28 +133,49 @@ class DeepRecallDeadlineExceeded extends Error {
 }
 
 /**
- * Race one dependency call against the SHARED whole-invocation deadline.
+ * Race one dependency call against the SHARED whole-invocation deadline AND
+ * the transport cancellation signal — one helper, never two nested races
+ * (issue #2915: an early abort return that abandons an already-started
+ * deadline timer leaves its eventual rejection unhandled).
  *
  * `deadlineMs` is an absolute instant computed once per invocation, so every
  * await subtracts elapsed time instead of restarting the budget, and a stalled
  * seed search, graph load, or memory read can no longer outlive the documented
  * `totalTimeoutMs` just because the deadline is only *checked* between steps.
- * An infinite deadline (`totalTimeoutMs: 0`, a documented disable value) passes
- * the work through untouched — no timer, no wrapper.
+ * An infinite deadline (`totalTimeoutMs: 0`, a documented disable value) races
+ * only the signal — no timer. The timer stays REFERENCED: it is the only thing
+ * keeping the loop alive when the awaited dependency never settles. Every
+ * arm is cleared in the `finally`, whichever wins.
  */
-async function withDeadline<T>(work: Promise<T>, deadlineMs: number, now: () => number): Promise<T> {
-  if (!Number.isFinite(deadlineMs)) return await work;
+async function guardCall<T>(
+  work: Promise<T>,
+  deadlineMs: number,
+  signal: AbortSignal | undefined,
+  now: () => number,
+): Promise<T> {
+  if (signal?.aborted) throw abortError("deep recall aborted");
+  if (!Number.isFinite(deadlineMs)) {
+    return await raceAbort(work, signal, "deep recall aborted");
+  }
   const remaining = deadlineMs - now();
   if (remaining <= 0) throw new DeepRecallDeadlineExceeded();
-  // The timer stays REFERENCED: it is the only thing keeping the loop alive
-  // when the awaited dependency never settles, which is precisely the case the
-  // deadline exists for. It is always cleared in the `finally`.
   const expiry = Promise.withResolvers<never>();
   const timer = setTimeout(() => expiry.reject(new DeepRecallDeadlineExceeded()), remaining);
+  let onAbort: (() => void) | undefined;
   try {
-    return await Promise.race([work, expiry.promise]);
+    const racers: Promise<T | never>[] = [work, expiry.promise];
+    if (signal) {
+      racers.push(
+        new Promise<never>((_resolve, reject) => {
+          onAbort = () => reject(abortError("deep recall aborted"));
+          signal.addEventListener("abort", onAbort, { once: true });
+        }),
+      );
+    }
+    return await Promise.race(racers);
   } finally {
     clearTimeout(timer);
+    if (signal && onAbort) signal.removeEventListener("abort", onAbort);
   }
 }
 
@@ -234,8 +267,11 @@ function nodeAddsNothing(node: AbstractionNode, workingSet: ReadonlyMap<string,
 /**
  * Frontier refresh (after every working-set change): for each working-set
  * memory, anchors whose nodeRefs include a node listing that memory make
- * every OTHER referenced node a frontier candidate. Ranked by the shared
- * pure helper (shared-anchor count desc, nodeId asc — total comparator).
+ * every OTHER referenced node a frontier candidate. `sharedAnchorCount`
+ * counts DISTINCT anchors (issue #2915): one anchor adds one no matter how
+ * many working-set memories or nodes reach the candidate through it. Ranked
+ * by the shared pure helper (shared-anchor count desc, nodeId asc — total
+ * comparator).
  *
  * Nodes in `expandedNodeIds` are dropped: a node EXPAND already followed is
  * not an unretrieved candidate, even when some of its source memories never
@@ -251,7 +287,10 @@ function refreshFrontier(
   const index = graph.index;
   interface Candidate {
     nodeId: string;
-    sharedAnchorCount: number;
+    // Distinct shared anchors ONLY (issue #2915): one anchor counts once no
+    // matter how many working-set memories reach the candidate through it,
+    // so a candidate sharing one anchor can never outrank one sharing two.
+    sharedAnchorIds: Set<string>;
     parentMemoryId: string;
     parentScore: number;
     anchorValue: string;
@@ -268,22 +307,32 @@ function refreshFrontier(
           const otherNode = index.nodeIdToNode.get(otherNodeRef);
           if (!otherNode || nodeAddsNothing(otherNode, workingSet)) continue;
           const current = byNodeId.get(otherNodeRef);
-          if (current === undefined || entry.score > current.parentScore) {
+          if (current === undefined) {
             byNodeId.set(otherNodeRef, {
               nodeId: otherNodeRef,
-              sharedAnchorCount: (current?.sharedAnchorCount ?? 0) + 1,
+              sharedAnchorIds: new Set([anchorId]),
               parentMemoryId: memoryId,
               parentScore: entry.score,
               anchorValue: anchor.anchorValue,
             });
           } else {
-            current.sharedAnchorCount += 1;
+            current.sharedAnchorIds.add(anchorId);
+            if (entry.score > current.parentScore) {
+              current.parentMemoryId = memoryId;
+              current.parentScore = entry.score;
+              current.anchorValue = anchor.anchorValue;
+            }
           }
         }
       }
     }
   }
-  const ranked = rankDeepRecallFrontier([...byNodeId.values()]);
+  const ranked = rankDeepRecallFrontier(
+    [...byNodeId.values()].map((candidate) => ({
+      nodeId: candidate.nodeId,
+      sharedAnchorCount: candidate.sharedAnchorIds.size,
+    })),
+  );
   return ranked.flatMap((rankedCandidate) => {
     const candidate = byNodeId.get(rankedCandidate.nodeId);
     const node = index.nodeIdToNode.get(rankedCandidate.nodeId);
@@ -363,6 +412,14 @@ export async function runBudgetedDeepRecall(deps: DeepRecallDeps, query: string)
   const now = deps.nowMs ?? Date.now;
   const startedMs = now();
   const deadlineMs = cfg.totalTimeoutMs > 0 ? startedMs + cfg.totalTimeoutMs : Number.POSITIVE_INFINITY;
+  // Every dependency await races BOTH bounds: the shared whole-invocation
+  // deadline and the transport cancellation signal (issue #2915). An abort
+  // propagates as a standard AbortError — never as ok:false backend failure
+  // and never as a partial result — so each transport applies its own
+  // cancelled-response semantics.
+  const guarded = <T>(work: Promise<T>): Promise<T> =>
+    guardCall(work, deadlineMs, deps.signal, now);
+
 
   const trace: DeepRecallTraceStep[] = [];
   const contentCache = new Map<string, string>();
@@ -378,7 +435,7 @@ export async function runBudgetedDeepRecall(deps: DeepRecallDeps, query: string)
    * would surface content the active-set check excluded.
    */
   const hydrateOrDrop = async (memoryId: string): Promise<void> => {
-    const memory = await withDeadline(deps.loadMemory(memoryId), deadlineMs, now);
+    const memory = await guarded(deps.loadMemory(memoryId));
     if (!memory || !memory.active) {
       workingSet.delete(memoryId);
       contentCache.delete(memoryId);
@@ -393,9 +450,11 @@ export async function runBudgetedDeepRecall(deps: DeepRecallDeps, query: string)
   // working set rather than blocking the later check from ever running.
   let exhaustedDetail: string | null = null;
   try {
-    const seedHits = await withDeadline(deps.searchSeed(query, cfg.maxResults), deadlineMs, now);
+    throwIfAborted(deps.signal, "deep recall aborted");
+    const seedHits = await guarded(deps.searchSeed(query, cfg.maxResults));
     mergeIntoWorkingSet(workingSet, seedHits, "seed", contentFor);
   } catch (err) {
+    if (isAbortError(err)) throw err;
     if (!(err instanceof DeepRecallDeadlineExceeded)) {
       // Seed backend failure is the only ok:false path (§22: an empty index
       // proceeds; a thrown search does not).
@@ -405,13 +464,14 @@ export async function runBudgetedDeepRecall(deps: DeepRecallDeps, query: string)
   }
   if (exhaustedDetail === null) {
     try {
-      graph = { index: buildFrontierIndex(await withDeadline(deps.loadGraph(), deadlineMs, now)) };
+      graph = { index: buildFrontierIndex(await guarded(deps.loadGraph())) };
       // Seed hydration also enforces the active set: a stale or non-active
       // QMD hit leaves the working set instead of being hydrated in place.
       for (const memoryId of [...workingSet.keys()]) {
         await hydrateOrDrop(memoryId);
       }
     } catch (err) {
+      if (isAbortError(err)) throw err;
       if (!(err instanceof DeepRecallDeadlineExceeded)) throw err;
       exhaustedDetail = "total timeout reached loading the graph or hydrating seeds";
     }
@@ -447,6 +507,7 @@ export async function runBudgetedDeepRecall(deps: DeepRecallDeps, query: string)
   try {
     while (exhaustedDetail === null && cfg.maxSteps > 0 && step < cfg.maxSteps) {
       const stepStartMs = now();
+      throwIfAborted(deps.signal, "deep recall aborted");
       if (now() >= deadlineMs) {
         pushStep(step, "BUDGET_EXHAUSTED", "total timeout reached before policy call", stepStartMs);
         break;
@@ -459,13 +520,11 @@ export async function runBudgetedDeepRecall(deps: DeepRecallDeps, query: string)
       const stepBudgetMs = cfg.stepTimeoutMs > 0 ? cfg.stepTimeoutMs : Number.POSITIVE_INFINITY;
       const effectiveBudgetMs = Math.min(stepBudgetMs, deadlineMs - now());
       const timeoutMs = Number.isFinite(effectiveBudgetMs) ? Math.max(1, effectiveBudgetMs) : 0;
-      const raw = await withDeadline(
+      const raw = await guarded(
         deps.callPolicy(
           renderStatePrompt({ query: currentQuery, workingSet, frontier, stepsRemaining: cfg.maxSteps - step }),
           timeoutMs
-        ),
-        deadlineMs,
-        now
+        )
       );
       const parsed = parsePolicyOutput(raw);
       if (parsed === null) {
@@ -489,7 +548,7 @@ export async function runBudgetedDeepRecall(deps: DeepRecallDeps, query: string)
         currentQuery = rewrite.refinedQuery;
         refinesUsed += 1;
         try {
-          const refinedHits = await withDeadline(deps.searchSeed(currentQuery, cfg.maxResults), deadlineMs, now);
+          const refinedHits = await guarded(deps.searchSeed(currentQuery, cfg.maxResults));
           mergeIntoWorkingSet(workingSet, refinedHits, "refine", contentFor);
           for (const hit of refinedHits) {
             if (workingSet.has(hit.memoryId) && !contentCache.has(hit.memoryId)) {
@@ -499,8 +558,9 @@ export async function runBudgetedDeepRecall(deps: DeepRecallDeps, query: string)
         } catch (err) {
           // Re-search failure mid-loop is partial, not fatal (§22): the loop
           // keeps what it has and the policy decides the next move. Deadline
-          // expiry is NOT a partial failure — it ends the invocation.
-          if (err instanceof DeepRecallDeadlineExceeded) throw err;
+          // expiry and cancellation are NOT partial failures — they end the
+          // invocation.
+          if (err instanceof DeepRecallDeadlineExceeded || isAbortError(err)) throw err;
         }
         frontier = refreshFrontier(workingSet, graph, expandedNodeIds);
         pushStep(step, "REFINE", currentQuery, stepStartMs);
@@ -528,7 +588,7 @@ export async function runBudgetedDeepRecall(deps: DeepRecallDeps, query: string)
         if (!item || !node) continue;
         for (const memoryId of (node.sourceMemoryIds ?? []).slice(0, MAX_SOURCE_MEMORY_IDS_PER_NODE)) {
           if (workingSet.has(memoryId)) continue;
-          const memory = await withDeadline(deps.loadMemory(memoryId), deadlineMs, now);
+          const memory = await guarded(deps.loadMemory(memoryId));
           // Only active memories enter the working set (§41); a null read
           // (foreign namespace, §30) skips the same way.
           if (!memory || !memory.active) continue;

package/src/fallback-llm-codex-subscription.ts

@@ -47,15 +47,29 @@ export function isTerminalCodexSubscriptionError(error: unknown): boolean {
   );
 }
 
+/**
+ * Single bounded headroom shared by both sides of the Codex deadline
+ * (issue #2890): the provider gets it as SIGTERM lead time
+ * (`timeoutMs - headroom`) and the outer race as settle grace, so the hard
+ * outer bound stays `timeoutMs + headroom` (<= 25 ms past the deadline).
+ */
+export function codexDeadlineHeadroomMs(timeoutMs: number): number {
+  return Math.min(25, Math.max(1, Math.floor(timeoutMs / 10)));
+}
+
 /**
  * Settle a fallback-LLM chain at the caller deadline. Abort the in-flight
- * work, return immediately, and observe the abandoned promise so a late
- * rejection cannot become unhandled.
+ * work, then wait a bounded settle grace for the chain to surface a typed
+ * provider timeout (default: one event-loop turn). A chain that settles
+ * within the grace wins with its own result or error; one that never
+ * settles still cannot exceed `timeoutMs + settleGraceMs`. The abandoned
+ * promise is observed so a late rejection cannot become unhandled.
  */
 export async function raceFallbackLlmDeadline<T>(
   work: Promise<T>,
   timeoutMs: number,
   abortOnTimeout: () => void,
+  settleGraceMs = 0,
 ): Promise<{ timedOut: true } | { timedOut: false; value: T }> {
   const deadline = new AbortController();
   const timer = setTimeout(() => deadline.abort(), timeoutMs);
@@ -69,15 +83,21 @@ export async function raceFallbackLlmDeadline<T>(
     return { timedOut: false, value };
   } catch (error) {
     if (!deadline.signal.aborted) throw error;
+    let graceTimer: NodeJS.Timeout | undefined;
     const afterAbort = await Promise.race([
       work.then(
         (value) => ({ state: "value" as const, value }),
         (lateError) => ({ state: "error" as const, error: lateError }),
       ),
       new Promise<{ state: "pending" }>((resolve) => {
-        setImmediate(() => resolve({ state: "pending" }));
+        if (settleGraceMs > 0) {
+          graceTimer = setTimeout(() => resolve({ state: "pending" }), settleGraceMs);
+        } else {
+          setImmediate(() => resolve({ state: "pending" }));
+        }
       }),
     ]);
+    clearTimeout(graceTimer);
     if (afterAbort.state === "value") return { timedOut: false, value: afterAbort.value };
     if (afterAbort.state === "error") throw afterAbort.error;
     void work.then(
@@ -132,11 +152,13 @@ export async function tryCodexSubscriptionProvider(
     ...(resolvedApiKey ? { apiKey: resolvedApiKey } : {}),
   };
 
-  // Let the provider surface its typed timeout before the generic outer deadline.
+  // Let the provider surface its typed timeout before the generic outer
+  // deadline: the shared bounded headroom is SIGTERM lead time here and
+  // settle grace in raceFallbackLlmDeadline (issue #2890).
   const callOptions = {
     timeoutMs: options.timeoutMs === undefined
       ? undefined
-      : Math.max(1, options.timeoutMs - Math.min(100, Math.max(5, Math.floor(options.timeoutMs / 5)))),
+      : Math.max(1, options.timeoutMs - codexDeadlineHeadroomMs(options.timeoutMs)),
     signal: options.signal,
   };
   // A host/benchmark runner on the process seam still wins. The core

package/src/fallback-llm.test.ts

@@ -12,6 +12,7 @@ import {
   __setGatewayResolverForTest,
   clearSecretCache,
 } from "./resolve-provider-secret.js";
+import { CodexSubscriptionTimeoutError } from "./providers/codex-subscription.js";
 
 test("fallback llm sends native JSON schema to chat completions", { concurrency: false }, async () => {
   clearModelsJsonCache();
@@ -986,6 +987,125 @@ test("fallback llm timeout is a hard deadline when the provider never settles",
   }
 });
 
+test("codex typed timeout wins past the outer deadline within the settle grace", { concurrency: false }, async () => {
+  clearModelsJsonCache();
+  clearSecretCache();
+
+  const restoreRunner = __codexCliFallbackTestHooks.setRunCodexCliForTest(
+    (request) => {
+      const { promise, reject } = Promise.withResolvers<never>();
+      const onAbort = (): void => {
+        // Real timer by design: the settle grace itself is wall-clock
+        // behavior under test. Lands inside the grace (T=250 -> 25ms).
+        setTimeout(() => reject(new CodexSubscriptionTimeoutError(250)), 5);
+      };
+      if (request.options.signal?.aborted) {
+        onAbort();
+      } else {
+        request.options.signal?.addEventListener("abort", onAbort, { once: true });
+      }
+      return promise;
+    },
+  );
+
+  const llm = new FallbackLlmClient({
+    agents: {
+      defaults: {
+        model: {
+          primary: "codex-cli/gpt-custom",
+        },
+      },
+    },
+    models: {
+      providers: {
+        "codex-cli": {
+          baseUrl: "",
+          api: "codex-cli",
+          apiKey: "codex-test-key",
+          models: [],
+        },
+      },
+    },
+  });
+
+  try {
+    await assert.rejects(
+      llm.chatCompletion(
+        [{ role: "user", content: "Say OK" }],
+        { temperature: 0, maxTokens: 16, timeoutMs: 250 },
+      ),
+      (error: unknown) => {
+        assert.ok(error instanceof CodexSubscriptionTimeoutError, `expected typed timeout, got: ${error}`);
+        assert.equal(error.name, "TimeoutError");
+        return true;
+      },
+    );
+  } finally {
+    restoreRunner();
+    clearModelsJsonCache();
+    clearSecretCache();
+  }
+});
+
+test("outer deadline stays the hard bound when the runner settles after the grace", { concurrency: false }, async () => {
+  clearModelsJsonCache();
+  clearSecretCache();
+
+  const lateSettled = Promise.withResolvers<void>();
+  const restoreRunner = __codexCliFallbackTestHooks.setRunCodexCliForTest(
+    (request) => {
+      const { promise, reject } = Promise.withResolvers<never>();
+      const onAbort = (): void => {
+        // Real timer by design: the hard bound must hold against a provider
+        // that outlives the grace. Lands past it (T=250 -> 25ms grace).
+        setTimeout(() => {
+          reject(new CodexSubscriptionTimeoutError(250));
+          lateSettled.resolve();
+        }, 80);
+      };
+      if (request.options.signal?.aborted) {
+        onAbort();
+      } else {
+        request.options.signal?.addEventListener("abort", onAbort, { once: true });
+      }
+      return promise;
+    },
+  );
+
+  const llm = new FallbackLlmClient({
+    agents: {
+      defaults: {
+        model: {
+          primary: "codex-cli/gpt-custom",
+        },
+      },
+    },
+    models: {
+      providers: {
+        "codex-cli": {
+          baseUrl: "",
+          api: "codex-cli",
+          apiKey: "codex-test-key",
+          models: [],
+        },
+      },
+    },
+  });
+
+  try {
+    const started = Date.now();
+    const response = await llm.chatCompletion(
+      [{ role: "user", content: "Say OK" }],
+      { temperature: 0, maxTokens: 16, timeoutMs: 250 },
+    );
+    // Await the runner's actual late rejection — observed, never unhandled.
+    await lateSettled.promise;
+  } finally {
+    restoreRunner();
+    clearModelsJsonCache();
+    clearSecretCache();
+  }
+});
 test("fallback llm can call Ollama native chat and suppress thinking", { concurrency: false }, async () => {
   clearModelsJsonCache();
   clearSecretCache();

package/src/fallback-llm.ts

@@ -18,6 +18,7 @@ import { loadModelsJsonProviders } from "./models-json.js";
 import {
   abortReason,
   classifyThrownProviderError,
+  codexDeadlineHeadroomMs,
   defaultOpenClawWorkspaceDir,
   extractResponsesOutputText,
   fallbackLlmRuntimeContextFromConfig,
@@ -379,29 +380,29 @@ export class FallbackLlmClient {
         controller.abort(abortReason(options.signal));
       };
       options.signal?.addEventListener("abort", onCallerAbort, { once: true });
-      if (options.signal?.aborted) {
-        onCallerAbort();
-      }
+      if (options.signal?.aborted) onCallerAbort();
       const timedOptions = { ...options, signal: controller.signal };
       const chain = runChain(timedOptions);
-      const guarded = chain.then(
-        (value) => value,
-        (err) => {
-          if (isTerminalCodexSubscriptionError(err)) throw err;
-          return null;
-        },
-      );
+      const guarded = chain.catch((err) => {
+        if (isTerminalCodexSubscriptionError(err)) throw err;
+        return null;
+      });
       try {
         const timeoutError = Object.assign(
           new Error(`task LLM timed out after ${options.timeoutMs}ms`),
           { name: "TimeoutError" },
         );
-        const outcome = await raceFallbackLlmDeadline(guarded, options.timeoutMs, () => {
-          log.warn(`task LLM: timed out after ${options.timeoutMs}ms`);
-          recordFailure({ failureReason: "timeout", errorClass: "timeout" });
-          controller.abort(timeoutError);
-          if (options.failureDiag) options.failureDiag.lastError = timeoutError;
-        });
+        const outcome = await raceFallbackLlmDeadline(
+          guarded,
+          options.timeoutMs,
+          () => {
+            log.warn(`task LLM: timed out after ${options.timeoutMs}ms`);
+            recordFailure({ failureReason: "timeout", errorClass: "timeout" });
+            controller.abort(timeoutError);
+            if (options.failureDiag) options.failureDiag.lastError = timeoutError;
+          },
+          models.some((m) => m.providerConfig.api === "codex-cli") ? codexDeadlineHeadroomMs(options.timeoutMs) : 0,
+        );
         if (outcome.timedOut) {
           return { ok: false, failure: { failureReason: "timeout", errorClass: "timeout" } };
         }

package/src/meetings/config.test.ts

@@ -2,6 +2,7 @@ import assert from "node:assert/strict";
 import { test } from "node:test";
 
 import { DEFAULT_MEETING_APP_PATTERNS } from "./detect.js";
+import { parseConfig } from "../config.js";
 import { DEFAULT_MEETINGS_CONFIG, parseMeetingsConfig } from "./config.js";
 
 test("absent config is the disabled default with shipped app patterns", () => {
@@ -70,3 +71,60 @@ test("finding 5 — inverted trust thresholds (autoApprove < review) are rejecte
   // still caught (the override interacts with the default).
   assert.throws(() => parseMeetingsConfig({ autoApproveTrust: 0.3 }), /must be >= meetings\.reviewTrust/);
 });
+
+test("fully-specified valid config round-trips unchanged through the canonical parser (#2936)", () => {
+  const full = {
+    enabled: true,
+    appPatterns: ["CustomConf App"],
+    minOverlapMinutes: 5,
+    audioOnlyMinMinutes: 30,
+    mergeGapMinutes: 7,
+    contextDwellSeconds: 60,
+    maxContextChars: 12_000,
+    summaryMode: "review",
+    sourceTrust: 0.9,
+    autoApproveTrust: 0.8,
+    reviewTrust: 0.6,
+  };
+  const cfg = parseMeetingsConfig(full);
+  // Every knob must come back exactly as supplied — no re-normalization,
+  // no silent defaulting of valid values.
+  assert.equal(cfg.enabled, true);
+  assert.deepEqual(cfg.appPatterns, [...DEFAULT_MEETING_APP_PATTERNS, "CustomConf App"]);
+  assert.equal(cfg.minOverlapMinutes, 5);
+  assert.equal(cfg.audioOnlyMinMinutes, 30);
+  assert.equal(cfg.mergeGapMinutes, 7);
+  assert.equal(cfg.contextDwellSeconds, 60);
+  assert.equal(cfg.maxContextChars, 12_000);
+  assert.equal(cfg.summaryMode, "review");
+  assert.equal(cfg.sourceTrust, 0.9);
+  assert.equal(cfg.autoApproveTrust, 0.8);
+  assert.equal(cfg.reviewTrust, 0.6);
+});
+
+test("parseConfig routes meetings through exactly one canonical path — no silent aliases (#2936)", () => {
+  const full = {
+    enabled: true,
+    minOverlapMinutes: 9,
+    summaryMode: "off",
+    sourceTrust: 0.5,
+    autoApproveTrust: 0.5,
+    reviewTrust: 0.5,
+  };
+
+  // The one canonical entrypoint: a top-level `meetings` block.
+  const viaRoot = parseConfig({ meetings: full }).meetings;
+  assert.deepEqual(viaRoot, parseMeetingsConfig(full));
+
+  // No legacy-alias shapes feed the meetings block: anything other than the
+  // top-level `meetings` key must leave the subsystem at its defaults. A new
+  // alias would be a second parsed surface for the same runtime keys and
+  // must not land silently (it would also need schema + docs + snapshot
+  // updates and would flip this assertion).
+  const viaAliasShapes = parseConfig({
+    meeting: full,
+    desktopCapture: { meetings: full },
+    captureCompanions: { meetings: full },
+  }).meetings;
+  assert.deepEqual(viaAliasShapes, parseMeetingsConfig(undefined));
+});

package/src/orchestration/extraction-persist.ts

@@ -2545,7 +2545,7 @@ export class ExtractionPersistCoordinator {
       const semanticMerge = await applySemanticMergeAtPersist(this.deps, {
         storage: targetStorage, content: fact.content, category: writeCategory, sources: fact.sources, sourceConnector: extractionSourceConnector,
         incomingMetadata: { tags: [...fact.tags, ...injectionScreenTags], entityRef: fact.entityRef, structuredAttributes: fact.structuredAttributes, validAt: biTemporal ? biTemporal.validFrom : sourceContext?.validAt, biTemporal: biTemporal !== undefined, importanceScore: importance.score, confidence: fact.confidence, provenanceStrength: fact.provenance, toolScoped: factToolScoped, subject: factSubject, origin, faithfulness: faithfulnessFm, memoryKind }, skip: contradictionDetected || faithfulnessEnforceStatus === "pending_review" || batchBackendUnavailable || novelty.decision === "add",
-        incomingLinks: links.length > 0 ? links : undefined, incomingCitedContent: citedFactContent,
+        incomingLinks: links.length > 0 ? links : undefined, incomingCitedContent: citedFactContent, incomingCitationContext: citationContextBase,
         targetHasPromotedCopies: (targetId) => promotedCopyProbe.check(targetStorage, targetId),
       });
       if (semanticMerge.action === "created" && semanticMerge.reason === "backend_unavailable") batchBackendUnavailable = true; // arms the batch short circuit for the remaining facts

package/src/orchestration/recall-entry.ts

@@ -20,7 +20,9 @@ import { ProfilingCollector } from "../profiling.js";
 import { trustResultFor, type TrustStageResultItem } from "../trust-score-stage.js";
 import type { RecallResultFormatter } from "./recall-result-formatter.js";
 import type { IdentityInjectionMode, PluginConfig, QmdSearchResult } from "../types.js";
-import { applyRecallStateViews } from "../recall-state-view-wire.js";
+import { stateViewPacketActive } from "../recall-state-view-anchors.js";
+import { resultStateViewKey, stateViewPacketKeys } from "../recall-state-view.js";
+ import { applyRecallStateViews } from "../recall-state-view-wire.js";
 
 export interface RecallEntryDeps {
   appendRecallSection(
@@ -300,6 +302,15 @@ export class RecallEntryCoordinator {
     );
     if (injectable.length === 0) return;
 
+    // #2928 — packet-atomic final budgeting: under packet semantics (state
+    // view active, no historical asOf pin) rows of one supersession packet
+    // share their canonical packet root key, so the section coordinator's
+    // character/token cap admits or drops the packet as a unit.
+    const packetKeys =
+      stateViewPacketActive(options.stateViewActive === true, options.asOfMs)
+        ? stateViewPacketKeys(injectable)
+        : [];
+
     const formatted = this.deps.recallResultFormatter.formatQmdResultEntries(
       options.title,
       injectable,
@@ -324,6 +335,9 @@ export class RecallEntryCoordinator {
           ...(memoryId ? { memoryId } : {}),
           ...(result.path ? { memoryPath: result.path } : {}),
           ...(result.namespace ? { memoryNamespace: result.namespace } : {}),
+          ...(packetKeys[index] && resultStateViewKey(result)
+            ? { packetKey: packetKeys[index] }
+            : {}),
         },
       );
     }

package/src/orchestration/recall-internal.ts

@@ -5043,6 +5043,7 @@ export class RecallInternalCoordinator {
         // Build a path → QmdSearchResult index so we can pull per-result
         // explain data (e.g. reinforcementBoost) from the result that
         // boostSearchResults annotated before surfacing to xray.
+        // #1952: label the captured branch through the same inject-seam annotator.
         const xrayResultByPath = indexStateViewAnnotatedResults(
           xrayRecalledResults, retrievalQuery, this.deps.config, stateViewActive, asOfMs,
         );