@remnic/core 10.0.48 → 10.0.50

package/dist/who-knows.js

@@ -9,21 +9,21 @@ import {
   loadWhoKnowsEntities,
   tokenizeTopic,
   validateWhoKnowsInput
-} from "./chunk-JGMJZBFV.js";
-import "./chunk-L46MG2GE.js";
+} from "./chunk-HPNXS6W6.js";
+import "./chunk-GQIYL7OD.js";
 import "./chunk-UHVXE24Y.js";
 import "./chunk-DM5QZ3YU.js";
-import "./chunk-VY6BD5KB.js";
+import "./chunk-ZMO2S5RT.js";
 import "./chunk-G6OFEGUR.js";
-import "./chunk-PJBYVJKO.js";
-import "./chunk-2V664H6O.js";
+import "./chunk-LXXIV7Y2.js";
+import "./chunk-JS44PBCM.js";
+import "./chunk-5CWH2LKL.js";
 import "./chunk-XKDQTDXN.js";
 import "./chunk-CYEPCZN5.js";
 import "./chunk-XRFLR3XF.js";
 import "./chunk-7VO6E5UD.js";
-import "./chunk-EXYT52NR.js";
-import "./chunk-5CWH2LKL.js";
 import "./chunk-WNEVEMJ3.js";
+import "./chunk-EXYT52NR.js";
 import "./chunk-Y5NLBXPV.js";
 import "./chunk-TFA6HPOA.js";
 import "./chunk-F4TWWUMP.js";
@@ -32,35 +32,37 @@ import "./chunk-A7Q43EUZ.js";
 import "./chunk-S2V7RUCL.js";
 import "./chunk-PPUNC7UX.js";
 import "./chunk-X3724WL4.js";
-import "./chunk-MRPOZBJC.js";
 import "./chunk-S2HLHAZ4.js";
-import "./chunk-LDXUBPMO.js";
+import "./chunk-MRPOZBJC.js";
 import "./chunk-DM2T26WE.js";
+import "./chunk-LDXUBPMO.js";
 import "./chunk-FF6N7BXC.js";
 import "./chunk-WXPBDEMW.js";
 import "./chunk-AAD2ZS6P.js";
-import "./chunk-MPJDQC4G.js";
+import "./chunk-WJCXUE2J.js";
 import "./chunk-ZIKENA2C.js";
-import "./chunk-3ONXXHQO.js";
-import "./chunk-YXZG5TVN.js";
 import "./chunk-3OUGSOJP.js";
 import "./chunk-SCU65EZI.js";
-import "./chunk-P4GUQSK3.js";
+import "./chunk-3ONXXHQO.js";
+import "./chunk-YXZG5TVN.js";
 import "./chunk-3WU7XOFN.js";
-import "./chunk-G7D6GZ5J.js";
-import "./chunk-2NLCDNGA.js";
+import "./chunk-P4GUQSK3.js";
+import "./chunk-564YP3DW.js";
 import "./chunk-M5GVCJSJ.js";
 import "./chunk-RBOJCG4T.js";
-import "./chunk-LWRIGKFM.js";
+import "./chunk-A5L5KGDI.js";
 import "./chunk-5WITETWU.js";
 import "./chunk-6CIAGZ6X.js";
 import "./chunk-7CT3AI52.js";
-import "./chunk-I3IPXGFQ.js";
+import "./chunk-G7D6GZ5J.js";
+import "./chunk-7VLBZKNB.js";
+import "./chunk-UUZ7KZAO.js";
+import "./chunk-AJJPXUE6.js";
 import "./chunk-G26YNEOC.js";
+import "./chunk-VILPVT4S.js";
 import "./chunk-AF2XMJKD.js";
 import "./chunk-OR42ZI54.js";
 import "./chunk-IUM3VSHI.js";
-import "./chunk-VILPVT4S.js";
 import "./chunk-23G5P7TA.js";
 import "./chunk-C64XATK7.js";
 import "./chunk-42JKGUFJ.js";
@@ -70,7 +72,6 @@ import "./chunk-L2EXJQJP.js";
 import "./chunk-45GF7Y3V.js";
 import "./chunk-YIJECSIX.js";
 import "./chunk-E2AWJ7KQ.js";
-import "./chunk-UUZ7KZAO.js";
 import "./chunk-HADD45AR.js";
 import "./chunk-RNFMFC37.js";
 import "./chunk-YCVB7X56.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remnic/core",
-  "version": "10.0.48",
+  "version": "10.0.50",
   "description": "Framework-agnostic Remnic memory engine — orchestrator, storage, extraction, search, trust zones",
   "type": "module",
   "main": "dist/index.js",
@@ -3347,7 +3347,7 @@
     "core"
   ],
   "peerDependencies": {
-    "@remnic/coding-graph": "^10.0.48"
+    "@remnic/coding-graph": "^10.0.50"
   },
   "peerDependenciesMeta": {
     "@remnic/coding-graph": {

package/src/access-http-briefing.ts

@@ -9,6 +9,8 @@ export interface BriefingHttpOptions {
   service: EngramAccessService;
   principal: string | undefined;
   respondJson: JsonResponder;
+  /** HTTP request lifetime; aborting it stops the briefing (issue #3139). */
+  abortSignal?: AbortSignal;
 }
 
 /**
@@ -27,9 +29,11 @@ export async function respondBriefingHttp(options: BriefingHttpOptions): Promise
   if (!op) {
     throw new EngramAccessInputError("access-boundary: operation not registered: briefing");
   }
+  // SAFETY: the built-in briefing operation returns { result }; this adapter passes it through unchanged.
   const output = (await op.run(options.gatedBody, {
     service: options.service,
     authenticatedPrincipal: options.principal,
+    abortSignal: options.abortSignal,
   })) as { result: unknown };
   options.respondJson(200, output.result);
 }

package/src/access-http.test.ts

@@ -15,11 +15,13 @@ import {
   EngramAccessInputError,
   type EngramAccessRecallRequest,
   type EngramAccessService,
+  type EngramAccessBriefingRequest,
 } from "./access-service.js";
 import {
   tokenCapabilityStore,
   type TokenCapabilities,
 } from "./access-token-capabilities.js";
+import { BriefingTimeoutError } from "./briefing-deadline.js";
 import { parseConfig } from "./config.js";
 import { readPair, writePair } from "./contradiction/contradiction-review.js";
 import { createChatSession } from "./chat/chat-session.js";
@@ -859,17 +861,23 @@ test("HTTP briefing endpoint dispatches through the briefing operation", async (
     assert.equal(body.format, "markdown");
     assert.equal(body.markdown, "# Briefing");
     assert.deepEqual(body.json.sections.activeThreads, []);
-    assert.deepEqual(calls, [
-      {
-        since: "24h",
-        focus: undefined,
-        includeLocation: undefined,
-        namespace: "team",
-        format: "markdown",
-        maxFollowups: 5,
-        principal: "panel-user",
-      },
-    ]);
+    assert.equal(calls.length, 1);
+    // SAFETY: the registered handler builds this request after validating the HTTP body; assertions below check its values.
+    const captured = calls[0] as EngramAccessBriefingRequest;
+    const { abortSignal, ...briefingRequest } = captured;
+    assert.ok(
+      abortSignal instanceof AbortSignal,
+      "the briefing request carries the HTTP request lifetime signal",
+    );
+    assert.deepEqual(briefingRequest, {
+      since: "24h",
+      focus: undefined,
+      includeLocation: undefined,
+      namespace: "team",
+      format: "markdown",
+      maxFollowups: 5,
+      principal: "panel-user",
+    });
 
     const invalid = await fetch(
       `http://127.0.0.1:${status.port}/engram/v1/briefing`,
@@ -890,6 +898,27 @@ test("HTTP briefing endpoint dispatches through the briefing operation", async (
   }
 });
 
+test("HTTP briefing endpoint answers 504 briefing_timeout when the request budget is exhausted", async () => {
+  const service: EngramAccessService = Object.assign(Object.create(null), {
+    briefing: async () => {
+      throw new BriefingTimeoutError(30_000);
+    },
+  });
+  const server = new EngramAccessHttpServer({ service, port: 0, authToken: "test-token", adminConsoleEnabled: false });
+  const status = await server.start();
+  try {
+    const response = await fetch(`http://127.0.0.1:${status.port}/engram/v1/briefing`, {
+      method: "POST",
+      headers: { authorization: "Bearer test-token", "content-type": "application/json" },
+      body: JSON.stringify({}),
+    });
+    assert.equal(response.status, 504);
+    assert.deepEqual(await response.json(), { error: "briefing timed out after 30000ms", code: "briefing_timeout" });
+  } finally {
+    await server.stop();
+  }
+});
+
 test("HTTP contradiction scan uses writable namespace resolver", async () => {
   const resolverCalls: Array<{
     namespace: string | undefined;

package/src/access-http.ts

@@ -10,6 +10,7 @@ import { log } from "./logger.js";
 import { resolveNamespaceCapabilities } from "./capabilities.js";
 import { WriteRateLimiter, type WriteRateLimitReservation } from "./write-rate-limiter.js";
 import { abortError, isAbortError } from "./abort-error.js";
+import { BriefingTimeoutError } from "./briefing-deadline.js";
 import { EngramAccessForbiddenError } from "./access-errors.js";
 import {
   EngramAccessInputError,
@@ -500,6 +501,10 @@ export class EngramAccessHttpServer extends ReviewDeckAccessHttpBase {
       res.once("close", abortDisconnectedRequest);
       correlationIdStore.run(correlationId, () => {
         void this.handle(req, res, correlationId, abortController.signal).catch((err) => {
+          if (err instanceof BriefingTimeoutError) {
+            this.respondJson(res, 504, { error: err.message, code: "briefing_timeout" });
+            return;
+          }
           if (isAbortError(err)) {
             if (!res.destroyed && !res.writableEnded) {
               res.end();
@@ -1979,6 +1984,7 @@ export class EngramAccessHttpServer extends ReviewDeckAccessHttpBase {
         service: this.service,
         principal: this.resolveRequestPrincipal(req),
         respondJson: (status, payload) => this.respondJson(res, status, payload),
+        abortSignal,
       });
       return;
     }

package/src/access-observe-write-category.ts

@@ -15,7 +15,7 @@ import {
 } from "./access-schema.js";
 
 export { reapplyCategoryCoercion };
-export { applyBriefingLocationContext } from "./location/tagging.js";
+export { buildWithBriefingLocation } from "./location/tagging.js";
 
 export function splitCanonicalWriteRequest<T extends { rawCategory?: string; category?: string }>(
   request: T,

package/src/access-observe-write-surface.ts

@@ -29,8 +29,9 @@ import {
   type MemoryScopePlan,
   NamespaceNotWritableError,
 } from "./access-service.js";
-import { applyBriefingLocationContext, reapplyCategoryCoercion, splitCanonicalWriteRequest } from "./access-observe-write-category.js";
+import { buildWithBriefingLocation, reapplyCategoryCoercion, splitCanonicalWriteRequest } from "./access-observe-write-category.js";
 import { abortError } from "./abort-error.js";
+import { withBriefingDeadline } from "./briefing-deadline.js";
 import { extractionForceFlush } from "./access-extraction-force-flush.js";
 import { ObserveTranscriptPersister, observeTranscriptSessionKey } from "./access-observe-transcript.js";
 import { FileCalendarSource, buildBriefing, parseBriefingFocus, parseBriefingWindow } from "./briefing.js";
@@ -410,7 +411,6 @@ export class AccessObserveWriteSurface {
     }
 
     const namespace = this.deps.resolveReadableNamespace(request.namespace, request.principal);
-    const storage = await this.deps.orchestrator.getStorage(namespace);
 
     const token =
       typeof request.since === "string" && request.since.trim().length > 0
@@ -457,23 +457,28 @@ export class AccessObserveWriteSurface {
       ? new FileCalendarSource(config.briefing.calendarSource)
       : undefined;
 
-    const result = await applyBriefingLocationContext(await buildBriefing({
-      storage,
-      namespace,
-      window,
-      focus,
-      calendarSource,
-      maxFollowups,
-      allowLlm: config.briefing.llmFollowups,
-      openaiApiKey: config.openaiApiKey,
-      openaiBaseUrl: config.openaiBaseUrl,
-      model: config.model,
-      // Without a direct OpenAI key, route follow-ups through the configured
-      // LLM chain (gateway model source or local LLM) — same fallback every
-      // other LLM feature uses. A configured key keeps its precedence so
-      // existing deployments are unchanged.
-      followupGenerator: config.openaiApiKey ? undefined : this.deps.orchestrator.briefingChainFollowupGenerator,
-    }), request.includeLocation, storage.dir, window.from.toISOString(), config.location);
+    // Storage acquisition and the briefing body share one request budget.
+    const result = await withBriefingDeadline(async (signal) => {
+      const storage = await this.deps.orchestrator.getStorage(namespace);
+      return buildWithBriefingLocation(request.includeLocation, storage.dir, window.from.toISOString(), config.location, () => buildBriefing({
+        storage,
+        namespace,
+        window,
+        focus,
+        calendarSource,
+        maxFollowups,
+        allowLlm: config.briefing.llmFollowups,
+        openaiApiKey: config.openaiApiKey,
+        openaiBaseUrl: config.openaiBaseUrl,
+        model: config.model,
+        // Without a direct OpenAI key, route follow-ups through the configured
+        // LLM chain (gateway model source or local LLM) — same fallback every
+        // other LLM feature uses. A configured key keeps its precedence so
+        // existing deployments are unchanged.
+        followupGenerator: config.openaiApiKey ? undefined : this.deps.orchestrator.briefingChainFollowupGenerator,
+        abortSignal: signal,
+      }));
+    }, request.abortSignal);
 
     return {
       format,

package/src/access-operations-batch.ts

@@ -23,7 +23,7 @@ import {
   retainedCategoryAlias,
   suggestionSubmitRequestSchema,
 } from "./access-schema.js";
-import { EngramAccessInputError, type EngramAccessService } from "./access-service.js";
+import { EngramAccessInputError, type EngramAccessService, type EngramAccessBriefingRequest } from "./access-service.js";
 import { enforceNamespaceAllowList, tokenCapabilityStore } from "./access-token-capabilities.js";
 import { projectTagProjectId } from "./coding/coding-namespace.js";
 import {
@@ -381,7 +381,23 @@ defineOperation({ name: "memory_promote", description: "Promote memory.", schema
 defineOperation({ name: "memory_outcome", description: "Record outcome.", schema: strictSchema({ memoryId: S.str, outcome: S.str, namespace: S.str, sessionKey: S.str, timestamp: S.str }), handler: async (input, ctx) => { const o = optStr(input.outcome); if (o !== "success" && o !== "failure") throw new EngramAccessInputError("memory_outcome: outcome must be \"success\" or \"failure\"; got " + JSON.stringify(o)); return { result: await ctx.service.memoryOutcome({ memoryId: optStr(input.memoryId) ?? "", outcome: o, namespace: optStr(input.namespace), sessionKey: optStr(input.sessionKey), timestamp: optStr(input.timestamp), principal: ctx.authenticatedPrincipal }) }; } });
 defineOperation({ name: "memory_action_apply", description: "Apply action.", schema: strictSchema({ action: S.str, outcome: S.str, reason: S.str, memoryId: S.str, namespace: S.str, sessionKey: S.str, content: S.str, category: S.str, linkTargetId: S.str, linkType: S.str, linkStrength: S.num, artifactType: S.str, execute: S.bool, sourcePrompt: S.str, dryRun: S.bool }), handler: async (input, ctx) => ({ result: await ctx.service.memoryActionApply({ action: optStr(input.action) ?? "", outcome: optStr(input.outcome), reason: optStr(input.reason), memoryId: optStr(input.memoryId) ?? "", namespace: optStr(input.namespace), sessionKey: optStr(input.sessionKey), content: optStr(input.content), category: optStr(input.category), linkTargetId: optStr(input.linkTargetId), linkType: optStr(input.linkType), linkStrength: optNum(input.linkStrength), artifactType: optStr(input.artifactType), execute: optBool(input.execute), sourcePrompt: optStr(input.sourcePrompt), dryRun: input.dryRun === true, principal: ctx.authenticatedPrincipal }) }) });
 defineOperation({ name: "context_checkpoint", description: "Context checkpoint.", schema: strictSchema({ sessionKey: S.str, context: S.str, namespace: S.str }), handler: async (input, ctx) => ({ result: await ctx.service.contextCheckpoint({ sessionKey: optStr(input.sessionKey) ?? "", context: optStr(input.context) ?? "", namespace: optStr(input.namespace), principal: ctx.authenticatedPrincipal }) }) });
-defineOperation({ name: "briefing", description: "Daily briefing.", schema: strictSchema({ since: S.str, focus: S.str, namespace: S.str, includeLocation: S.bool, format: S.str, maxFollowups: S.num }), handler: async (input, ctx) => { const rf = optStr(input.format); const fe = validateBriefingFormat(rf); if (fe) throw new EngramAccessInputError(fe); return { result: await ctx.service.briefing({ since: optStr(input.since), focus: optStr(input.focus), namespace: optStr(input.namespace), includeLocation: optBool(input.includeLocation), format: rf as "json" | "markdown" | undefined, maxFollowups: optNum(input.maxFollowups), principal: ctx.authenticatedPrincipal }) }; } });
+defineOperation({
+  name: "briefing", description: "Daily briefing.",
+  schema: strictSchema({ since: S.str, focus: S.str, namespace: S.str, includeLocation: S.bool, format: S.str, maxFollowups: S.num }),
+  handler: async (input, ctx) => {
+    const rf = optStr(input.format);
+    const fe = validateBriefingFormat(rf);
+    if (fe) throw new EngramAccessInputError(fe);
+    // SAFETY: validateBriefingFormat rejects every format except json, markdown, or undefined.
+    const request: EngramAccessBriefingRequest = {
+      since: optStr(input.since), focus: optStr(input.focus), namespace: optStr(input.namespace),
+      includeLocation: optBool(input.includeLocation), format: rf as "json" | "markdown" | undefined,
+      maxFollowups: optNum(input.maxFollowups), principal: ctx.authenticatedPrincipal,
+    };
+    if (ctx.abortSignal) request.abortSignal = ctx.abortSignal;
+    return { result: await ctx.service.briefing(request) };
+  },
+});
 
 // === CONTRADICTION/REVIEW ===
 defineOperation({ name: "review_list", description: "List review pairs.", schema: strictSchema({ filter: S.str, namespace: S.str, limit: S.num }),

package/src/access-service-peer-capture-backoff.test.ts

@@ -0,0 +1,236 @@
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import { EngramAccessService } from "./access-service.js";
+import { CAPTURE_WRITE_LOCK_BUSY_MESSAGE } from "./capture-write-lock-backoff.js";
+import { buildCapturePathLockIdentity, TombstoneBlockedCaptureWriteLock } from "./capture-write-lock.js";
+import { parseConfig } from "./config.js";
+import { Orchestrator } from "./orchestrator.js";
+import { buildExplicitCaptureDedupKey } from "./storage/tombstone-blocked-capture-index.js";
+import { OFFLINE_SYNC_CHANGESET_FORMAT } from "./offline-sync.js";
+
+// Real contention exceeds the legacy deadline but fits inside the configured peer budget.
+
+/** Longer than the legacy 3s capture-lock deadline, shorter than the converge deadline. */
+const CONTENTION_HOLD_MS = 3_600;
+/** The converge deadline a peer apply is scoped to. */
+const CONVERGE_DEADLINE_MS = 8_000;
+/** An ordinary capture must still give up near the legacy 3s bound. */
+const LEGACY_BOUND_MS = 4_500;
+
+const PEER_REL_PATH = "facts/2026-08-13/peer-apply-target.md";
+const ORDINARY_CONTENT = "ordinary capture body";
+
+function peerContent(): Buffer {
+  return Buffer.from(
+    [
+      "---",
+      "id: peer-apply-target",
+      "category: fact",
+      "created: 2026-08-13T00:00:00.000Z",
+      "---",
+      "",
+      "Peer applied body",
+      "",
+    ].join("\n")
+  );
+}
+
+async function createPeerService(root: string) {
+  const orchestrator = new Orchestrator(
+    parseConfig({
+      memoryDir: root,
+      namespacesEnabled: false,
+      defaultNamespace: "global",
+      converge: {
+        conflictPolicy: "newest-wins",
+        captureWriteLockInitialDelayMs: 20,
+        captureWriteLockMaxDelayMs: 50,
+        captureWriteLockDeadlineMs: CONVERGE_DEADLINE_MS,
+      },
+    })
+  );
+  const storage = await orchestrator.getStorage();
+  await storage.ensureDirectories();
+  assert.equal(storage.dir, root, "the fixture uses one cached flat-root storage");
+  return { storage, service: new EngramAccessService(orchestrator) };
+}
+
+/** Hold a capture lock and release it after `holdMs`. */
+function holdCaptureLock(stateDir: string, identity: string, holdMs: number) {
+  const holder = new TombstoneBlockedCaptureWriteLock({ stateDir });
+  const released = Promise.withResolvers<void>();
+  const acquired = Promise.withResolvers<void>();
+  let timer: NodeJS.Timeout | undefined;
+  const holding = holder.withCaptureWriteLock(async () => {
+    acquired.resolve();
+    timer = setTimeout(() => released.resolve(), holdMs);
+    await released.promise;
+  }, identity);
+  return {
+    acquired: acquired.promise,
+    release: (): void => {
+      clearTimeout(timer);
+      released.resolve();
+    },
+    done: holding,
+  };
+}
+
+function peerApplyRequest(content: Buffer) {
+  return {
+    sourceId: "remnic-converge",
+    path: PEER_REL_PATH,
+    sha256: createHash("sha256").update(content).digest("hex"),
+    bytes: content.length,
+    mtimeMs: 1_700_000_000_000,
+    offset: 0,
+    content,
+  };
+}
+
+for (const kind of ["chunk", "changeset"] as const) {
+  test(
+    `peer ${kind} apply waits out a busy capture lock instead of the legacy deadline`,
+    { timeout: 30_000 },
+    async () => {
+      const root = await mkdtemp(path.join(os.tmpdir(), "remnic-peer-capture-backoff-"));
+      const { service } = await createPeerService(root);
+      const content = peerContent();
+      const holder = holdCaptureLock(
+        path.join(root, "state"),
+        buildCapturePathLockIdentity(path.resolve(root, PEER_REL_PATH)),
+        CONTENTION_HOLD_MS
+      );
+      try {
+        await holder.acquired;
+        const startedAt = Date.now();
+        const apply =
+          kind === "chunk"
+            ? service.offlineSyncApplyFileContent(peerApplyRequest(content))
+            : service.offlineSyncApply({
+                returnCurrentFiles: false,
+                changeset: {
+                  format: OFFLINE_SYNC_CHANGESET_FORMAT,
+                  schemaVersion: 1,
+                  createdAt: "2026-08-13T00:00:00.000Z",
+                  sourceId: "remnic-converge",
+                  includeTranscripts: false,
+                  changes: [
+                    {
+                      type: "upsert",
+                      path: PEER_REL_PATH,
+                      file: {
+                        path: PEER_REL_PATH,
+                        sha256: createHash("sha256").update(content).digest("hex"),
+                        bytes: content.length,
+                        mtimeMs: 1_700_000_000_000,
+                        contentBase64: content.toString("base64"),
+                      },
+                    },
+                  ],
+                },
+              });
+        const outcome = await apply.then(
+          () => ({ ok: true as const }),
+          (error) => ({ ok: false as const, error })
+        );
+        assert.equal(
+          outcome.ok,
+          true,
+          outcome.ok
+            ? ""
+            : `peer apply failed: ${outcome.error instanceof Error ? outcome.error.message : String(outcome.error)}`
+        );
+        assert.ok(Date.now() - startedAt >= 2_500, "peer apply must wait out the capture-lock contention");
+        assert.equal(await readFile(path.join(root, PEER_REL_PATH), "utf8"), content.toString("utf8"));
+      } finally {
+        holder.release();
+        await holder.done.catch(() => undefined);
+        await rm(root, { recursive: true, force: true });
+      }
+    }
+  );
+}
+
+test(
+  "an ordinary capture keeps the legacy capture-lock bound while a peer apply is in flight",
+  { timeout: 30_000 },
+  async () => {
+    const root = await mkdtemp(path.join(os.tmpdir(), "remnic-peer-capture-isolation-"));
+    const { storage, service } = await createPeerService(root);
+    const content = peerContent();
+    const stateDir = path.join(root, "state");
+    const peerHolder = holdCaptureLock(
+      stateDir,
+      buildCapturePathLockIdentity(path.resolve(root, PEER_REL_PATH)),
+      CONTENTION_HOLD_MS
+    );
+    const ordinaryHolder = holdCaptureLock(
+      stateDir,
+      buildExplicitCaptureDedupKey(ORDINARY_CONTENT, "fact", undefined),
+      CONTENTION_HOLD_MS
+    );
+    let peerApply: Promise<{ ok: true; value: unknown } | { ok: false; error: unknown }> | undefined;
+    try {
+      await Promise.all([peerHolder.acquired, ordinaryHolder.acquired]);
+      peerApply = service.offlineSyncApplyFileContent(peerApplyRequest(content)).then(
+        (value) => ({ ok: true as const, value }),
+        (error) => ({ ok: false as const, error })
+      );
+      const startedAt = Date.now();
+      const outcome = await storage.writeMemory("fact", ORDINARY_CONTENT).then(
+        () => ({ ok: true as const }),
+        (error) => ({ ok: false as const, error })
+      );
+      assert.equal(outcome.ok, false, "ordinary capture must not succeed while the capture lock is held");
+      assert.equal(
+        outcome.ok ? "" : outcome.error instanceof Error ? outcome.error.message : String(outcome.error),
+        CAPTURE_WRITE_LOCK_BUSY_MESSAGE
+      );
+      assert.ok(
+        Date.now() - startedAt < LEGACY_BOUND_MS,
+        "ordinary capture must keep the legacy capture-lock bound, not the converge deadline"
+      );
+    } finally {
+      peerHolder.release();
+      ordinaryHolder.release();
+      await Promise.all([peerHolder.done.catch(() => undefined), ordinaryHolder.done.catch(() => undefined)]);
+      await peerApply;
+      await rm(root, { recursive: true, force: true });
+    }
+  }
+);
+test("a failed peer apply does not leak converge capture-lock limits", { timeout: 30_000 }, async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), "remnic-peer-capture-error-scope-"));
+  const { storage, service } = await createPeerService(root);
+  const content = peerContent();
+  const holder = holdCaptureLock(
+    path.join(root, "state"),
+    buildExplicitCaptureDedupKey(ORDINARY_CONTENT, "fact", undefined),
+    CONTENTION_HOLD_MS
+  );
+  try {
+    await assert.rejects(
+      service.offlineSyncApplyFileContent({
+        ...peerApplyRequest(content),
+        sha256: "0".repeat(64),
+      })
+    );
+    await holder.acquired;
+    const startedAt = Date.now();
+    await assert.rejects(storage.writeMemory("fact", ORDINARY_CONTENT), new RegExp(CAPTURE_WRITE_LOCK_BUSY_MESSAGE));
+    assert.ok(
+      Date.now() - startedAt < LEGACY_BOUND_MS,
+      "ordinary capture after a failed peer apply must keep the legacy lock bound"
+    );
+  } finally {
+    holder.release();
+    await holder.done.catch(() => undefined);
+    await rm(root, { recursive: true, force: true });
+  }
+});

package/src/access-service.ts

@@ -136,6 +136,8 @@ import {
   applySupportPassportOfflineSyncChangeset,
   applySupportPassportOfflineSyncFileContent,
 } from "./support-passport/offline-sync-guard.js";
+import { withCaptureWriteLockBackoff } from "./capture-write-lock-scope.js";
+import { resolveConvergeCaptureWriteLockBackoff } from "./converge-config.js";
 import type { WearablesService } from "./wearables/service.js";
 import { exportWorkBoardMarkdown, exportWorkBoardSnapshot, importWorkBoardSnapshot } from "./work/board.js";
 import { wrapWorkLayerContext } from "./work/boundary.js";
@@ -505,6 +507,11 @@ export interface EngramAccessBriefingRequest extends LocationContextRequestOptio
   maxFollowups?: number;
   /** Caller principal for namespace access checks. Transport-bound — never from untrusted payloads. */
   principal?: string;
+  /**
+   * Transport request lifetime. When it aborts, the briefing stops and
+   * rejects with that AbortError instead of running on (issue #3139).
+   */
+  abortSignal?: AbortSignal;
 }
 
 /** Response for `remnic_briefing`. */
@@ -5623,7 +5630,8 @@ export class EngramAccessService extends SupportPassportAccessServiceBase {
     const resolvedNamespace = this.writableNamespaceFor(options.namespace, undefined, options.principal);
     const storage = await this.orchestrator.getStorage(resolvedNamespace);
     try {
-      const result = await applySupportPassportOfflineSyncFileContent(storage, options);
+      const result = await withCaptureWriteLockBackoff(storage, resolveConvergeCaptureWriteLockBackoff(this.orchestrator.config.converge),
+        () => applySupportPassportOfflineSyncFileContent(storage, options));
       return {
         namespace: resolvedNamespace,
         ...result,
@@ -5671,7 +5679,8 @@ export class EngramAccessService extends SupportPassportAccessServiceBase {
     const resolvedNamespace = this.writableNamespaceFor(options.namespace, undefined, options.principal);
     const storage = await this.orchestrator.getStorage(resolvedNamespace);
     try {
-      const result = await applySupportPassportOfflineSyncChangeset(storage, options);
+      const result = await withCaptureWriteLockBackoff(storage, resolveConvergeCaptureWriteLockBackoff(this.orchestrator.config.converge),
+        () => applySupportPassportOfflineSyncChangeset(storage, options));
       return {
         namespace: resolvedNamespace,
         ...result,