@remnic/core 9.69.40 → 9.69.41

package/src/orchestration/recall-section-coordinator.ts

@@ -27,6 +27,13 @@ export interface RecallSectionAppendOptions {
   memoryId?: string;
   memoryPath?: string;
   memoryNamespace?: string;
+  /**
+   * #2928 — state-view packet key (canonical `stateViewPacketKeys` root).
+   * Atomic chunks sharing a packetKey are ONE evidence packet: the final
+   * budget admits or drops them together, so a historical row can never
+   * render without its linked successor. Absent on non-state rows.
+   */
+  packetKey?: string;
 }
 
 export interface RecallSectionChunk {
@@ -35,6 +42,7 @@ export interface RecallSectionChunk {
   memoryId?: string;
   memoryPath?: string;
   memoryNamespace?: string;
+  packetKey?: string;
 }
 
 export type RecallSectionBuckets = Map<
@@ -160,6 +168,7 @@ export class RecallSectionCoordinator {
         ...(options.memoryNamespace
           ? { memoryNamespace: options.memoryNamespace }
           : {}),
+        ...(options.packetKey ? { packetKey: options.packetKey } : {}),
       });
     } else {
       existing.push(finalContent);
@@ -454,15 +463,55 @@ export class RecallSectionCoordinator {
         let includedPostAtomicContent = false;
         const postAtomicContents: string[] = [];
         let includedLeadingContent = false;
+        // #2928 — state-view packets: atomic chunks sharing a packetKey are
+        // ONE evidence packet (a historical row plus its linked successor).
+        // The packet renders as a block at the FIRST member's position,
+        // members in incoming order, and is admitted or dropped together —
+        // the final character/token budget can never emit one side alone.
+        // Chunks without a packetKey keep the pre-#2928 per-row behavior.
+        const packetFirstIndex = new Map<string, number>();
+        const packetMembers = new Map<number, number[]>();
         for (const [index, chunk] of section.chunks.entries()) {
+          if (!chunk.atomic || !chunk.packetKey) continue;
+          const first = packetFirstIndex.get(chunk.packetKey);
+          if (first === undefined) {
+            packetFirstIndex.set(chunk.packetKey, index);
+            packetMembers.set(index, [index]);
+          } else {
+            packetMembers.get(first)!.push(index);
+          }
+        }
+        const admitMemoryRefs = (memberIndexes: readonly number[]): void => {
+          for (const memberIndex of memberIndexes) {
+            const member = section.chunks[memberIndex]!;
+            if (member.memoryId && member.memoryPath) {
+              includedMemories.push(
+                member.memoryNamespace
+                  ? { id: member.memoryId, path: member.memoryPath, namespace: member.memoryNamespace }
+                  : { id: member.memoryId, path: member.memoryPath },
+              );
+            }
+          }
+        };
+        for (const [index, chunk] of section.chunks.entries()) {
+          const members = chunk.atomic ? packetMembers.get(index) : undefined;
+          if (chunk.atomic && chunk.packetKey && members === undefined) {
+            // Non-first packet member: decided with its block at the first
+            // member's position — never admitted alone (#2928).
+            continue;
+          }
+          const memberIndexes = members ?? [index];
+          const content = members
+            ? members.map((memberIndex) => section.chunks[memberIndex]!.content).join("\n\n")
+            : chunk.content;
           if (
             !chunk.atomic &&
             includedAtomicCount === 0 &&
             index < firstAtomicIndex
           ) {
             const candidate = rendered
-              ? `${rendered}\n\n${chunk.content}`
-              : chunk.content;
+              ? `${rendered}\n\n${content}`
+              : content;
             if (
               candidate.length <= allocatedSectionAvailable &&
               estimateTokenCount(candidate) <= allocatedTokenAvailable
@@ -476,8 +525,8 @@ export class RecallSectionCoordinator {
           }
 
           const candidate = rendered
-            ? `${rendered}\n\n${chunk.content}`
-            : chunk.content;
+            ? `${rendered}\n\n${content}`
+            : content;
           if (
             candidate.length > allocatedSectionAvailable ||
             estimateTokenCount(candidate) > allocatedTokenAvailable
@@ -486,32 +535,26 @@ export class RecallSectionCoordinator {
               chunk.atomic &&
               includedAtomicCount === 0 &&
               includedLeadingContent &&
-              chunk.content.length <= allocatedSectionAvailable &&
-              estimateTokenCount(chunk.content) <= allocatedTokenAvailable
+              content.length <= allocatedSectionAvailable &&
+              estimateTokenCount(content) <= allocatedTokenAvailable
             ) {
-              rendered = chunk.content;
+              rendered = content;
               includedLeadingContent = false;
-              includedAtomicCount = 1;
-              if (chunk.memoryId && chunk.memoryPath) {
-                includedMemories.push(
-                  chunk.memoryNamespace
-                    ? { id: chunk.memoryId, path: chunk.memoryPath, namespace: chunk.memoryNamespace }
-                    : { id: chunk.memoryId, path: chunk.memoryPath },
-                );
-              }
+              includedAtomicCount += memberIndexes.length;
+              admitMemoryRefs(memberIndexes);
               continue;
             }
             if (
               !chunk.atomic &&
               includedAtomicCount === 0 &&
               includedLeadingContent &&
-              chunk.content.length <= allocatedSectionAvailable &&
-              estimateTokenCount(chunk.content) <= allocatedTokenAvailable
+              content.length <= allocatedSectionAvailable &&
+              estimateTokenCount(content) <= allocatedTokenAvailable
             ) {
-              rendered = chunk.content;
+              rendered = content;
               includedLeadingContent = false;
               includedPostAtomicContent = true;
-              postAtomicContents.push(chunk.content);
+              postAtomicContents.push(content);
               continue;
             }
             truncated = true;
@@ -520,17 +563,11 @@ export class RecallSectionCoordinator {
 
           rendered = candidate;
           if (chunk.atomic) {
-            includedAtomicCount += 1;
-            if (chunk.memoryId && chunk.memoryPath) {
-              includedMemories.push(
-                chunk.memoryNamespace
-                  ? { id: chunk.memoryId, path: chunk.memoryPath, namespace: chunk.memoryNamespace }
-                  : { id: chunk.memoryId, path: chunk.memoryPath },
-              );
-            }
+            includedAtomicCount += memberIndexes.length;
+            admitMemoryRefs(memberIndexes);
           } else {
             includedPostAtomicContent = true;
-            postAtomicContents.push(chunk.content);
+            postAtomicContents.push(content);
           }
         }
         if (includedAtomicCount === 0) {

package/src/orchestration/recall-state-view-pipeline.test.ts

@@ -96,8 +96,14 @@ test("default (stateViewActive unset) keeps filtering superseded — zero-diff b
     const explicitOff = coordinator.filterSearchResultsByRecallSafety(results, memories, {
       stateViewActive: false,
     });
-    assert.deepEqual(baseline.map((r) => r.path), [NEW]);
-    assert.deepEqual(explicitOff.map((r) => r.path), [NEW]);
+    assert.deepEqual(
+      baseline.map((r) => r.path),
+      [NEW]
+    );
+    assert.deepEqual(
+      explicitOff.map((r) => r.path),
+      [NEW]
+    );
     // No chain fields leak onto survivors when the view is off.
     assert.equal(baseline[0]?.supersededBy, undefined);
     assert.equal(baseline[0]?.id, undefined);

package/src/orchestration/semantic-merge-commit-effects.ts

@@ -17,8 +17,12 @@ import type { GraphEdge, GraphType } from "../graph.js";
 import { readFile } from "node:fs/promises";
 import { removeNodeEdgesForRewrite, rollbackNodeEdgeRewrite } from "../graph-jsonl.js";
 import {
-  hasCitationForTemplate,
-  stripCitationForTemplate,
+  attachCitation,
+  citationTemplateIsDetectable,
+  citationTemplatesForMerge,
+  lastRecognizedCitationMarker,
+  stripRecognizedCitations,
+  type CitationContext,
 } from "../source-attribution.js";
 import { resolvePipelineProcessingCapabilities } from "../capabilities.js";
 import { inferMemoryStatus } from "../memory-lifecycle-ledger-utils.js";
@@ -328,27 +332,52 @@ export async function rewriteMergedTargetGraphEdges(
   }
 }
 
+/**
+ * Round N+7 (C) + #2916: the citation form of the committed merged body.
+ * A liftable incoming marker still wins. The fallback attaches only when
+ * the current template can be re-matched later. An already-recognized
+ * marker — current, default, or a prior configured format still in
+ * history — is left in place so a template change does not duplicate it.
+ * All-placeholder templates cannot be stripped, so they are not attached.
+ */
+export function committedMergedBody(
+  deps: ExtractionPersistDeps,
+  mergedContent: string,
+  incomingCitedContent: string | undefined,
+  incomingCitationContext: Omit<CitationContext, "ts"> | undefined,
+  nowIso: string,
+): string {
+  if (resolvePipelineProcessingCapabilities(deps.config).inlineSourceAttribution !== true) {
+    return mergedContent;
+  }
+  const template = deps.config.inlineSourceAttributionFormat;
+  const templates = citationTemplatesForMerge(deps.config);
+  if (incomingCitedContent !== undefined) {
+    const marker = lastRecognizedCitationMarker(incomingCitedContent, templates);
+    if (marker) {
+      return mergedContent.endsWith(marker) ? mergedContent : `${mergedContent} ${marker}`;
+    }
+  }
+  if (!citationTemplateIsDetectable(template)) return mergedContent;
+  if (lastRecognizedCitationMarker(mergedContent, templates)) return mergedContent;
+  return attachCitation(
+    mergedContent,
+    { ...incomingCitationContext, ts: nowIso },
+    template,
+  );
+}
+
 /**
  * Round N+2 (C) — the canonical RAW pre-citation merged body for hashing.
- * The judge composes mergedContent from the stored target body, which
- * carries an appended citation marker when inline source attribution is
- * enabled; the ordinary write path hashes `contentHashSource` — the raw
- * fact text BEFORE any citation is attached. Hashing the cited body would
- * give the merged record a different identity than the equivalent raw
- * write (checklist #13), so the configured citation form is stripped
- * first, exactly like the write path's `rawChunkedContent`
- * canonicalization. Lives in this sibling (extracted from
- * semantic-merge-persist.ts) so that file stays within its file-size
- * ratchet cap.
+ * Strips every recognized citation form (current, default, and any prior
+ * configured template still in history). All-placeholder templates are
+ * not attached on the merge path, so they never reach this hash input.
  */
 export function rawPreCitationMergedBody(deps: ExtractionPersistDeps, mergedContent: string): string {
   if (resolvePipelineProcessingCapabilities(deps.config).inlineSourceAttribution !== true) {
     return mergedContent;
   }
-  const template = deps.config.inlineSourceAttributionFormat;
-  return hasCitationForTemplate(mergedContent, template)
-    ? stripCitationForTemplate(mergedContent, template)
-    : mergedContent;
+  return stripRecognizedCitations(mergedContent, citationTemplatesForMerge(deps.config));
 }
 
 /**

package/src/orchestration/semantic-merge-persist.ts

@@ -28,6 +28,7 @@ import { sanitizeMemoryContent } from "../sanitize.js";
 import { ContentHashIndex } from "../storage/content-hash-index.js";
 import type { VersioningConfig } from "../page-versioning.js";
 import {
+  committedMergedBody,
   committedMergedFactHash,
   discardMergedTargetSnapshot,
   finalizeMergedVersionPrune,
@@ -57,13 +58,10 @@ import { REFUSED_MERGE_CATEGORIES } from "../dedup/merge-on-write.js";
 import { inferMemoryStatus } from "../memory-lifecycle-ledger-utils.js";
 import { inferIntentFromText } from "../intent.js";
 import {
-  hasCitationForTemplate,
-  lastCitationMarkerForTemplate,
-  stripCitationForTemplate,
+  type CitationContext,
 } from "../source-attribution.js";
 import {
   resolveConversationContextCapabilities,
-  resolvePipelineProcessingCapabilities,
   resolvePresentationCapabilities,
   resolveRecallAuxiliaryCapabilities,
   type GraphConstructionCapabilitySet,
@@ -225,6 +223,14 @@ export interface ApplySemanticMergeOptions {
    * Absent (or citation-free) commits the judge's merged body unchanged.
    */
   incomingCitedContent?: string;
+  /**
+   * #2916: the citation context of THIS write (agent/session) — the same
+   * base a fresh attributed write stamps. When no incoming citation marker
+   * is liftable, the committed merged body still receives the configured
+   * inline-attribution transform exactly as a fresh attributed write would,
+   * stamped with this context and the merge's commit timestamp.
+   */
+  incomingCitationContext?: Omit<CitationContext, "ts">;
   /**
    * Finding C: async probe run after a merge verdict but before any
    * mutation. True when the would-be target already has promoted
@@ -470,33 +476,6 @@ export function createPathMergeParity(input: {
   };
 }
 
-/**
- * Round N+7 (C): the committed merged body carries the incoming extraction's
- * citation marker (lifted from the caller's cited body for this write)
- * appended after the judge's merged text, so incoming claims stay attributed
- * even when the merged text embeds the target's older citation — quoted
- * excerpts travel without frontmatter, so `sources` alone is not enough.
- * Idempotent; a no-op when attribution is off or no marker exists.
- */
-function committedMergedBody(
-  deps: ExtractionPersistDeps,
-  mergedContent: string,
-  incomingCitedContent: string | undefined,
-): string {
-  if (
-    resolvePipelineProcessingCapabilities(deps.config).inlineSourceAttribution !== true ||
-    incomingCitedContent === undefined
-  ) {
-    return mergedContent;
-  }
-  const marker = lastCitationMarkerForTemplate(
-    incomingCitedContent,
-    deps.config.inlineSourceAttributionFormat,
-  );
-  if (!marker || mergedContent.endsWith(marker)) return mergedContent;
-  return `${mergedContent} ${marker}`;
-}
-
 function versioningConfigFrom(deps: ExtractionPersistDeps): VersioningConfig {
   return {
     enabled: resolveRecallAuxiliaryCapabilities(deps.config).versioning,
@@ -611,10 +590,19 @@ export async function applySemanticMergeAtPersist(
   if (target.content !== decision.targetContent) {
     return { action: "created", reason: "target_changed" };
   }
-  // Round N+7 (C): every mutation below commits THIS body — the judge's
-  // merged text plus the incoming citation marker — and the outcome reports
-  // it, so caller comparisons describe what storage actually holds.
-  const committedContent = committedMergedBody(deps, decision.mergedContent, options.incomingCitedContent);
+  // Round N+7 (C) + #2916: every mutation below commits THIS body — the
+  // judge's merged text in its cited form (the incoming marker when one is
+  // liftable, else the configured transform as a fresh attributed write
+  // applies it) — and the outcome reports it, so caller comparisons
+  // describe what storage actually holds.
+  const nowIso = (options.now ? options.now() : new Date()).toISOString();
+  const committedContent = committedMergedBody(
+    deps,
+    decision.mergedContent,
+    options.incomingCitedContent,
+    options.incomingCitationContext,
+    nowIso,
+  );
 
   // Create-path parity gate (final round) — ONE place enumerates every
   // trust/scope/verdict field the normal write stamps and bypasses the
@@ -714,7 +702,6 @@ export async function applySemanticMergeAtPersist(
   // snapshot just read: a writer landing between the read and the write must
   // win rather than be overwritten from a stale body. The active-target check
   // above makes a tombstone block structurally impossible here.
-  const nowIso = (options.now ? options.now() : new Date()).toISOString();
   let casRevision: string | undefined; // #2813 (P1): OUR content CAS's receipt — feeds the patch stamp below and the catch's rollback comparison
   let mergePatch: MergeFrontmatterUpdate | undefined;
   try {

package/src/providers/codex-subscription.test.ts

@@ -14,6 +14,7 @@ import {
   CodexSubscriptionConfigError,
   CodexSubscriptionTimeoutError,
   type CodexSubscriptionExecRequest,
+  type CodexSubscriptionExecResult,
   __codexSubscriptionTestHooks,
   createCodexSubscriptionRunner,
   ensureCodexSubscriptionRunnerRegistered,
@@ -781,6 +782,63 @@ test("caller abort reaches the cold login check: no spawn when pre-aborted, wait
   await assert.rejects(fresh, (error: unknown) => error === freshReason);
 });
 
+test("last waiter out aborts the shared login subprocess; earlier leavers do not", async () => {
+  __codexSubscriptionTestHooks.resetLoginStatusCache();
+  let loginCalls = 0;
+  const loginSignals: AbortSignal[] = [];
+  let resolveSecondLogin:
+    | ((value: { status: number | null; stdout: string; stderr: string }) => void)
+    | undefined;
+  const runner = createCodexSubscriptionRunner({
+    env: { HOME: "/home/alice", PATH: "/usr/bin:/bin" },
+    now: () => 0,
+    runLoginStatus: (_executable, _env, _timeoutMs, signal) => {
+      loginCalls++;
+      loginSignals.push(signal!);
+      const pending = Promise.withResolvers<{ status: number | null; stdout: string; stderr: string }>();
+      if (loginCalls === 2) resolveSecondLogin = pending.resolve;
+      signal?.addEventListener("abort", () =>
+        pending.resolve({ status: 1, stdout: "", stderr: "terminated" })
+      );
+      return pending.promise;
+    },
+    runCodexExec: async () => ({ status: 0, stdout: "", stderr: "", outputText: "ok" }),
+  });
+  const call = (signal?: AbortSignal) =>
+    runner({
+      config: { executable: "codex-fake" },
+      modelId: "gpt-5.6-luna",
+      messages: [{ role: "user", content: "hi" }],
+      options: { timeoutMs: 60_000, ...(signal ? { signal } : {}) },
+    });
+
+  const a = new AbortController();
+  const b = new AbortController();
+  const aReason = new Error("A left first");
+  const bReason = new Error("B left last");
+  const first = call(a.signal);
+  await flushLoop();
+  assert.equal(loginCalls, 1);
+  const second = call(b.signal);
+  await flushLoop();
+  assert.equal(loginCalls, 1, "second caller shares the in-flight check");
+
+  a.abort(aReason);
+  await assert.rejects(first, (error: unknown) => error === aReason);
+  assert.equal(loginSignals[0].aborted, false, "one waiter leaving must not cancel the shared check");
+
+  b.abort(bReason);
+  await assert.rejects(second, (error: unknown) => error === bReason);
+  await flushLoop();
+  assert.ok(loginSignals[0].aborted, "the last waiter leaving aborts the login subprocess");
+
+  // The aborted entry is dropped: the next caller starts a fresh check.
+  const fresh = call();
+  await flushLoop();
+  assert.equal(loginCalls, 2);
+  resolveSecondLogin?.({ status: 0, stdout: "Logged in using ChatGPT\n", stderr: "" });
+  assert.equal((await fresh).content, "ok");
+});
 test("codex-subscription apiKey and SecretRef are rejected before secret resolution", { concurrency: false }, async () => {
   clearModelsJsonCache();
   clearSecretCache();
@@ -1184,6 +1242,75 @@ test(
   }
 );
 
+test(
+  "typed provider timeout still wins when the provider settles just past the outer deadline",
+  { concurrency: false },
+  async () => {
+    clearModelsJsonCache();
+    clearSecretCache();
+    __codexSubscriptionTestHooks.resetLoginStatusCache();
+    __codexSubscriptionTestHooks.resetCoreRunnerRegistered();
+    const runner = createCodexSubscriptionRunner({
+      env: { HOME: "/home/alice", PATH: "/usr/bin:/bin" },
+      now: () => 0,
+      runLoginStatus: async () => ({ status: 0, stdout: "Logged in using ChatGPT\n", stderr: "" }),
+      // Real timer by design: the deadline race is wall-clock behavior. The
+      // exec "child" ignores the abort signal (like one already mid-close)
+      // and settles 35ms after its own 475ms budget — past the caller's
+      // 500ms deadline but inside the 25ms settle grace (T=500 -> 25 headroom).
+      runCodexExec: (request) => {
+        const execTimeoutMs = request.timeoutMs;
+        if (execTimeoutMs === undefined) {
+          throw new Error("expected timeoutMs");
+        }
+        const { promise, resolve } = Promise.withResolvers<CodexSubscriptionExecResult>();
+        setTimeout(
+          () =>
+            resolve({
+              status: 124,
+              stdout: "",
+              stderr: `codex-subscription: exec timed out after ${execTimeoutMs}ms.\n`,
+              outputText: "",
+            }),
+          execTimeoutMs + 35,
+        );
+        return promise;
+      },
+    });
+    const restore = setCodexCliFallbackRunnerForProcess(runner);
+    try {
+      const llm = new FallbackLlmClient({
+        agents: { defaults: { model: { primary: `${CODEX_SUBSCRIPTION_PROVIDER_ID}/gpt-5.6-luna` } } },
+        models: {
+          providers: {
+            [CODEX_SUBSCRIPTION_PROVIDER_ID]: {
+              baseUrl: "codex-cli://subscription",
+              api: "codex-cli",
+              models: [],
+            },
+          },
+        },
+      });
+      const startedAt = Date.now();
+      await assert.rejects(
+        llm.chatCompletion([{ role: "user", content: "hi" }], { timeoutMs: 500 }),
+        (error: unknown) => {
+          assert.ok(error instanceof CodexSubscriptionTimeoutError, `expected timeout, got: ${error}`);
+          assert.equal(error.name, "TimeoutError");
+          return true;
+        }
+      );
+      assert.ok(
+        Date.now() - startedAt < 1_400,
+        "typed timeout must surface within the settle grace, not wait for the provider forever"
+      );
+    } finally {
+      restore();
+      clearModelsJsonCache();
+      clearSecretCache();
+    }
+  }
+);
 test("concurrent callers share one in-flight login when auth.json already exists", async () => {
   __codexSubscriptionTestHooks.resetLoginStatusCache();
   const home = await mkdtemp(path.join(os.tmpdir(), "remnic-codex-home-"));

package/src/providers/codex-subscription.ts

@@ -284,7 +284,6 @@ export function isDefaultRegisteredCodexSubscriptionRunner(): boolean {
   return defaultRegisteredRunner !== undefined
     && getCodexCliFallbackRunnerForProcess() === defaultRegisteredRunner;
 }
-
 /** Host shutdown hook: terminate this runtime's detached Codex children. Does not exit. */
 export function terminateActiveCodexSubscriptionChildren(
   signal: NodeJS.Signals = "SIGTERM",
@@ -491,6 +490,7 @@ async function assertSubscriptionLogin(
       await waitForLoginEntry(cached, cacheKey, ctx, now);
       return;
     }
+
   }
   loginStatusCache.delete(cacheKey);
   if (ctx.signal?.aborted) {