@remnic/core 10.0.68 → 10.0.69

package/dist/index.js

@@ -181,7 +181,7 @@ import {
   writeManifest,
   writeMeetingEpisodeMemory,
   writeTimelineState
-} from "./chunk-FAF4A76Q.js";
+} from "./chunk-DDBB55L2.js";
 import {
   WEARABLE_SOURCE_PREFIX,
   buildExtractionTurns,

package/dist/orchestration/buffer-drain-runner.js

@@ -1,6 +1,6 @@
 import {
   TurnIngestionCoordinator
-} from "../chunk-FAF4A76Q.js";
+} from "../chunk-DDBB55L2.js";
 import "../chunk-5QV6CE6K.js";
 import "../chunk-GGD2YDS6.js";
 import "../chunk-5PHOU5QI.js";

package/dist/orchestration/extraction-persist.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extraction-persist.d.ts","sourceRoot":"","sources":["../../src/orchestration/extraction-persist.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,KAAK,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAgBxG,OAAO,EAA6C,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAM7F,OAAO,EAUgE,KAAK,8BAA8B,EACxG,KAAK,4BAA4B,EAClC,MAAM,oBAAoB,CAAC;AAqD5B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAGhF,OAAO,KAAK,EAEV,gBAAgB,EAQjB,MAAM,aAAa,CAAC;AAWrB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAmB1E,6FAA6F;AAC7F,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,4EAA4E;IAC5E,aAAa,EAAE,MAAM,CAAC;IACtB,kFAAkF;IAClF,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,qBAAa,4BAA4B;IAErC,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,qBAAqB;IAE9C,OAAO,KAAK,MAAM,GAEjB;IACD,OAAO,KAAK,6BAA6B,GAGxC;IAEK,iBAAiB,CACrB,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,cAAc,EACvB,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI,EACrC,aAAa,CAAC,EAAE,uBAAuB,EACvC,aAAa,CAAC,EAAE,MAAM,EACtB,qBAAqB,CAAC,EAAE,wBAAwB,GAAG,IAAI,EACvD,UAAU,CAAC,EAAE,MAAM,EACnB,SAAS,GAAE,8BAAuF,EAClG,aAAa,GAAE,4BAAmF,GACjG,OAAO,CAAC,uBAAuB,CAAC;CA0wFpC"}
+{"version":3,"file":"extraction-persist.d.ts","sourceRoot":"","sources":["../../src/orchestration/extraction-persist.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,KAAK,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAiBxG,OAAO,EAA6C,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAM7F,OAAO,EAUgE,KAAK,8BAA8B,EACxG,KAAK,4BAA4B,EAClC,MAAM,oBAAoB,CAAC;AAqD5B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAGhF,OAAO,KAAK,EAEV,gBAAgB,EAQjB,MAAM,aAAa,CAAC;AAWrB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAmB1E,6FAA6F;AAC7F,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,4EAA4E;IAC5E,aAAa,EAAE,MAAM,CAAC;IACtB,kFAAkF;IAClF,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,qBAAa,4BAA4B;IAErC,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,qBAAqB;IAE9C,OAAO,KAAK,MAAM,GAEjB;IACD,OAAO,KAAK,6BAA6B,GAGxC;IAEK,iBAAiB,CACrB,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,cAAc,EACvB,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI,EACrC,aAAa,CAAC,EAAE,uBAAuB,EACvC,aAAa,CAAC,EAAE,MAAM,EACtB,qBAAqB,CAAC,EAAE,wBAAwB,GAAG,IAAI,EACvD,UAAU,CAAC,EAAE,MAAM,EACnB,SAAS,GAAE,8BAAuF,EAClG,aAAa,GAAE,4BAAmF,GACjG,OAAO,CAAC,uBAAuB,CAAC;CA8wFpC"}

package/dist/orchestration/promotion-dedup-window.d.ts

@@ -0,0 +1,118 @@
+/**
+ * Promotion destination writes under the fact-dedup commit window (codex P2,
+ * PRRT_kwDORJXyws6zzdG4 / #3311). The persist-time promotion gates run
+ * OUTSIDE the window that serializes source writes, so with
+ * extractionQueueConcurrency > 1 two sessions promoting the same fact from
+ * different source namespaces can both gate-miss and both write the shared
+ * destination — duplicate active copies, because writeMemory mints a fresh id
+ * per write and does not coalesce active duplicates. This module wraps each
+ * promotion destination write in `persistUnderFactDedupWindow` keyed on the
+ * DESTINATION storage dir and rechecks with the same connector/content
+ * predicate the promotion gates confirm with, so a twin promotion committed
+ * between the gate and the write is suppressed instead of duplicated.
+ *
+ * Split out of extraction-persist.ts for the structural ratchet (#1995);
+ * behavior is a verbatim move of the wrapped writes the persist closure
+ * previously inlined.
+ */
+import { type StorageManager } from "../index.js";
+import type { ImportanceScore, MemoryFrontmatter, ProvenanceSource } from "../types.js";
+import type { SealedMemoryEnvelope } from "../write-envelope.js";
+import type { DependencyPropagationDeliveryPort } from "./dependency-propagation-delivery.js";
+import { type FactDedupWindowOutcome } from "./fact-dedup-window.js";
+/**
+ * The promotion fields the windowed write and its suppression-path bounds
+ * backfill read. Structurally satisfied by both promotion closures' options
+ * objects in extraction-persist.ts (profile-target and shared).
+ */
+export interface PromotionDedupWriteFields {
+    category: string;
+    sourceMemoryId: string;
+    importance?: ImportanceScore;
+    intentGoal?: string;
+    intentActionType?: string;
+    intentEntityTypes?: string[];
+    memoryKind?: MemoryFrontmatter["memoryKind"];
+    validAt?: string;
+    invalidAt?: string;
+    observedAt?: string;
+    eventTimeSource?: "extracted" | "assumed";
+    sources?: ProvenanceSource[];
+    provenance?: "verified" | "unverified" | "none";
+    toolScoped?: true;
+}
+export interface PromotionDedupWriteArgs {
+    /** Promotion DESTINATION storage — the commit window is keyed on its dir. */
+    destination: StorageManager;
+    /** Composed sealed envelope for the promoted copy. */
+    envelope: SealedMemoryEnvelope;
+    /** The promotion closure's options (read structurally). */
+    promotion: PromotionDedupWriteFields;
+    /** Fact hash-key content (attrs-suffixed); pre-citation raw for others. */
+    dedupContent: string;
+    rawContent: string;
+    /** promotionWithholdsToolScope() result (shared) / forwarded marker (profile). */
+    toolScoped: boolean;
+    /** Raw source connector: trimmed for the recheck, raw for bounds backfill. */
+    connector: string | undefined;
+    citationEnabled: boolean;
+    citationTemplate: string;
+    /** lifecycleCaps.temporalSupersession on the shared path; false on the
+     *  profile path (its gate predicate has no entity filter). When true AND the
+     *  envelope carries an entityRef with non-empty surviving attrs, the recheck
+     *  additionally requires the same entity (PR #402 Uybg guard parity). */
+    sameEntityGuardEnabled: boolean;
+    /** Envelope-surviving structured attributes (PR #402 Uybg guard input). */
+    survivingAttrs?: Record<string, string> | null;
+    /** When set, the suppression path runs the post-write supersession pass
+     *  against the winning copy (PRRT_kwDORJXyws6z18qb): a suppressed
+     *  later-dated promotion must still retire a conflicting shared fact dated
+     *  between the events, mirroring the gate's hash-dedup-hit pass. */
+    supersession?: {
+        /** Caller's lifecycleCaps.temporalSupersession — without it the pass
+         *  must not run even though the event-time `enabled` gate passes
+         *  (PRRT_kwDORJXyws6z2o1t). */
+        supersessionEnabled: boolean;
+        dependencyPropagationDelivery?: DependencyPropagationDeliveryPort;
+        namespaceScope?: string;
+    };
+    backfillTemporalBoundsOnDedupHit: ExtractionPersistDeps["backfillTemporalBoundsOnDedupHit"];
+}
+type ExtractionPersistDeps = {
+    backfillTemporalBoundsOnDedupHit: (targetStorage: StorageManager, dedupContent: string, bounds: {
+        invalidAt?: string;
+        validFrom?: string;
+        observedAt?: string;
+        eventTimeSource?: "extracted" | "assumed";
+    }, entityRef?: string, sourceConnector?: string) => Promise<void>;
+};
+/**
+ * In-window race confirm for a promotion destination. Authoritative index +
+ * miss is a clean NOT-duplicate answered WITHOUT the corpus scan, mirroring
+ * `confirmActiveFactDuplicate` and the window contract (one corpus confirm +
+ * one write, not a scan-length lock) — PRRT_kwDORJXyws6z18qS. On a hit, a
+ * non-authoritative index, or a probe failure, confirm against the corpus
+ * with the gates' predicate.
+ */
+export declare function confirmPromotionRaceDuplicate(args: {
+    storage: StorageManager;
+    dedupContent: string;
+    category: string;
+    connector: string | undefined;
+    citationEnabled: boolean;
+    citationTemplate: string;
+    entityKeyNorm?: string;
+}): Promise<boolean>;
+/**
+ * Run one promotion destination write inside the destination-dir fact-dedup
+ * commit window: recheck (facts only; the same confirm the persist-time gate
+ * used, now under the lock) and suppress as a duplicate when a concurrent
+ * promotion committed the same content first. A suppressed promotion backfills
+ * temporal bounds onto the winning copy (#1671 parity with the gates' skip
+ * paths) and reports `{ suppressed: true }`. Lock contention throws
+ * fail-closed to the caller — never an unlocked write; the durable source
+ * fact is unaffected.
+ */
+export declare function writePromotionUnderFactDedupWindow(args: PromotionDedupWriteArgs): Promise<FactDedupWindowOutcome<Awaited<ReturnType<StorageManager["writeSealedMemory"]>>>>;
+export {};
+//# sourceMappingURL=promotion-dedup-window.d.ts.map

package/dist/orchestration/promotion-dedup-window.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"promotion-dedup-window.d.ts","sourceRoot":"","sources":["../../src/orchestration/promotion-dedup-window.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAoB,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAEpE,OAAO,KAAK,EAAE,eAAe,EAAc,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAKjE,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,sCAAsC,CAAC;AAC9F,OAAO,EAA+B,KAAK,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAElG;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,UAAU,CAAC,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAC1C,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC7B,UAAU,CAAC,EAAE,UAAU,GAAG,YAAY,GAAG,MAAM,CAAC;IAChD,UAAU,CAAC,EAAE,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACtC,6EAA6E;IAC7E,WAAW,EAAE,cAAc,CAAC;IAC5B,sDAAsD;IACtD,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,2DAA2D;IAC3D,SAAS,EAAE,yBAAyB,CAAC;IACrC,2EAA2E;IAC3E,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,UAAU,EAAE,OAAO,CAAC;IACpB,8EAA8E;IAC9E,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,eAAe,EAAE,OAAO,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;6EAGyE;IACzE,sBAAsB,EAAE,OAAO,CAAC;IAChC,2EAA2E;IAC3E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAC/C;;;wEAGoE;IACpE,YAAY,CAAC,EAAE;QACb;;uCAE+B;QAC/B,mBAAmB,EAAE,OAAO,CAAC;QAC7B,6BAA6B,CAAC,EAAE,iCAAiC,CAAC;QAClE,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,gCAAgC,EAAE,qBAAqB,CAAC,kCAAkC,CAAC,CAAC;CAC7F;AAED,KAAK,qBAAqB,GAAG;IAC3B,gCAAgC,EAAE,CAChC,aAAa,EAAE,cAAc,EAC7B,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE;QACN,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,eAAe,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;KAC3C,EACD,SAAS,CAAC,EAAE,MAAM,EAClB,eAAe,CAAC,EAAE,MAAM,KACrB,OAAO,CAAC,IAAI,CAAC,CAAC;CACpB,CAAC;AA8CF;;;;;;;GAOG;AACH,wBAAsB,6BAA6B,CAAC,IAAI,EAAE;IACxD,OAAO,EAAE,cAAc,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,eAAe,EAAE,OAAO,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GAAG,OAAO,CAAC,OAAO,CAAC,CAWnB;AA4BD;;;;;;;;;GASG;AACH,wBAAsB,kCAAkC,CACtD,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,sBAAsB,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAuG3F"}

package/dist/orchestrator.js

@@ -4,7 +4,7 @@ import {
   graphPathRelativeToStorage,
   mergeGraphExpandedResults,
   qmdStartupCollectionChecksWithTimeout
-} from "./chunk-FAF4A76Q.js";
+} from "./chunk-DDBB55L2.js";
 import "./chunk-5QV6CE6K.js";
 import "./chunk-GGD2YDS6.js";
 import {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remnic/core",
-  "version": "10.0.68",
+  "version": "10.0.69",
   "description": "Framework-agnostic Remnic memory engine — orchestrator, storage, extraction, search, trust zones",
   "type": "module",
   "main": "dist/index.js",
@@ -3376,7 +3376,7 @@
     "core"
   ],
   "peerDependencies": {
-    "@remnic/coding-graph": "^10.0.68"
+    "@remnic/coding-graph": "^10.0.69"
   },
   "peerDependenciesMeta": {
     "@remnic/coding-graph": {

package/src/extraction-shared-promotion-parallel-dedup.test.ts

@@ -0,0 +1,212 @@
+/**
+ * Codex P2 PRRT_kwDORJXyws6zzdG4 (#3311) — promotion-target writes must share
+ * the fact-dedup commit window.
+ *
+ * With extractionQueueConcurrency > 1 and shared auto-promotion enabled, two
+ * sessions extracting the same fact into DIFFERENT source namespaces can both
+ * pass the shared-namespace dedup gate (`hasFactContentHash`) before either
+ * promotion writes: the persist-time gate runs outside the commit window that
+ * protects the source writes, and the promotion destination write ran without
+ * any window at all. writeMemory mints a fresh id per write, so both
+ * promotions land distinct active shared copies — exactly the duplicate class
+ * `persistUnderFactDedupWindow` exists to prevent for source writes.
+ *
+ * The fix wraps each promotion destination write in
+ * `persistUnderFactDedupWindow` keyed on the DESTINATION storage dir, so the
+ * second promotion's in-window recheck observes the first promotion's
+ * committed hash and suppresses instead of duplicating. The invariant these
+ * tests assert — exactly one active shared copy survives a concurrent
+ * same-fact promotion pair — holds for every interleaving once the window is
+ * in place, because recheck+write are atomic per destination dir; before the
+ * fix the duplicate depends on the interleaving (two symmetric pipelines in
+ * lockstep both gate-miss before either write commits).
+ *
+ * These tests drive the real persistExtraction path (no LLM network; every
+ * gate that would call one is off) with two real source namespaces and the
+ * real shared destination, and assert the durable outcome.
+ */
+
+import assert from "node:assert/strict";
+import os from "node:os";
+import path from "node:path";
+import { mkdtemp, rm } from "node:fs/promises";
+import test from "node:test";
+
+import { parseConfig } from "./config.js";
+import { Orchestrator } from "./orchestrator.js";
+import type { ExtractionResult, PluginConfig } from "./types.js";
+import type { LocalLlmClient } from "./local-llm.js";
+import type { PersistExtractionFn } from "./testing/orchestrator-lite.js";
+import type { StorageManager } from "./storage.js";
+
+// Fixture contract for the private Orchestrator surface this suite drives.
+interface OrchestratorFixture {
+  localLlm?: unknown;
+  chatCompletion?: unknown;
+  getStorage?: unknown;
+  persistExtraction?: unknown;
+}
+
+// Named owner contract for the private internals this suite drives.
+interface OrchestratorInternals {
+  localLlm: LocalLlmClient;
+  getStorage: (ns: string) => Promise<StorageManager>;
+  persistExtraction: PersistExtractionFn;
+}
+
+function asInternals<T extends object>(value: OrchestratorFixture): T {
+  // SAFETY: the fixture provides the members the persist path reads; the
+  // remaining contract members are unused by these tests.
+  return value as T;
+}
+
+async function makeHarness(): Promise<{
+  orchestrator: Orchestrator;
+  persist: OrchestratorInternals;
+  memoryDir: string;
+  shared: StorageManager;
+  teamA: StorageManager;
+  teamB: StorageManager;
+}> {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-promotion-dedup-"));
+  const config: PluginConfig = parseConfig({
+    openaiApiKey: "sk-test",
+    memoryDir,
+    workspaceDir: path.join(memoryDir, "workspace"),
+    // Minimize every gate that needs a model or corpus-scale machinery so the
+    // fact reaches the normal (non-chunked) write path.
+    extractionJudgeEnabled: false,
+    temporalSupersessionEnabled: false,
+    contradictionDetectionEnabled: false,
+    chunkingEnabled: false,
+    embeddingFallbackEnabled: false,
+    qmdEnabled: false,
+    extractionMinChars: 0,
+    extractionMinImportanceLevel: "trivial",
+    inlineSourceAttributionEnabled: false,
+    // Shared auto-promotion from every source namespace into the default
+    // "shared" namespace (both default off — the deployment profile this
+    // finding targets).
+    namespacesEnabled: true,
+    autoPromoteToSharedEnabled: true,
+  });
+  const orchestrator = new Orchestrator(config);
+  const internals = asInternals<OrchestratorInternals>(orchestrator);
+  internals.localLlm = asInternals<LocalLlmClient>({ chatCompletion: async () => null });
+  const shared = await internals.getStorage("shared");
+  const teamA = await internals.getStorage("team-a");
+  const teamB = await internals.getStorage("team-b");
+  await Promise.all([shared, teamA, teamB].map((s) => s.ensureDirectories()));
+  return { orchestrator, persist: internals, memoryDir, shared, teamA, teamB };
+}
+
+function factResult(content: string): ExtractionResult {
+  const result = {
+    facts: [
+      {
+        content,
+        category: "fact",
+        // confidenceTier(0.96) === "explicit", which the default
+        // autoPromoteMinConfidenceTier ("explicit") admits.
+        confidence: 0.96,
+        tags: [],
+      },
+    ],
+    entities: [],
+    relationships: [],
+    questions: [],
+    profileUpdates: [],
+  };
+  // SAFETY: literal carries the full extraction-result shape persistExtraction
+  // consumes for a single fact candidate.
+  return result as ExtractionResult;
+}
+
+async function activeFactCopies(storage: StorageManager): Promise<number> {
+  const memories = await storage.readAllMemories();
+  return memories.filter(
+    (m) => m.frontmatter.category === "fact" && (m.frontmatter.status ?? "active") === "active",
+  ).length;
+}
+
+const FACT = "Deployment rollbacks complete within five minutes.";
+
+test("the same fact promoted from two namespaces lands once in shared (serial baseline)", async () => {
+  const { persist, memoryDir, shared, teamA, teamB } = await makeHarness();
+  try {
+    const first = await persist.persistExtraction(
+      factResult(FACT),
+      teamA,
+      null,
+      { sessionKey: "agent:test:a", principal: "test" },
+      undefined,
+      null,
+      "User mentioned that deployment rollbacks complete within five minutes.",
+    );
+    const second = await persist.persistExtraction(
+      factResult(FACT),
+      teamB,
+      null,
+      { sessionKey: "agent:test:b", principal: "test" },
+      undefined,
+      null,
+      "User mentioned that deployment rollbacks complete within five minutes.",
+    );
+
+    // Each source namespace keeps its own copy (cross-namespace source writes
+    // never dedup), and the second promotion dedups through the shared gate.
+    assert.equal(first.persistedIds.length, 1, "first source write persists");
+    assert.equal(second.persistedIds.length, 1, "second source write persists in its own namespace");
+    assert.equal(await activeFactCopies(teamA), 1);
+    assert.equal(await activeFactCopies(teamB), 1);
+    assert.equal(await activeFactCopies(shared), 1, "shared namespace holds exactly one promoted copy");
+  } finally {
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});
+
+test("concurrent same-fact promotions from different namespaces leave exactly one active shared copy", async () => {
+  const { persist, memoryDir, shared, teamA, teamB } = await makeHarness();
+  try {
+    const sourceText = "User mentioned that deployment rollbacks complete within five minutes.";
+    // Two real sessions, different source namespaces, same fact, one shared
+    // destination. Before the fix this interleaving (both pipelines gate-miss
+    // in lockstep before either promotion writes) landed two distinct active
+    // shared copies; after the fix the destination window serializes the
+    // promotions and the invariant holds for every interleaving.
+    const [a, b] = await Promise.all([
+      persist.persistExtraction(
+        factResult(FACT),
+        teamA,
+        null,
+        { sessionKey: "agent:test:a", principal: "test" },
+        undefined,
+        null,
+        sourceText,
+      ),
+      persist.persistExtraction(
+        factResult(FACT),
+        teamB,
+        null,
+        { sessionKey: "agent:test:b", principal: "test" },
+        undefined,
+        null,
+        sourceText,
+      ),
+    ]);
+
+    // Each source namespace still persists its own copy — the window only
+    // serializes the shared DESTINATION.
+    assert.equal(await activeFactCopies(teamA), 1, "team-a keeps its source copy");
+    assert.equal(await activeFactCopies(teamB), 1, "team-b keeps its source copy");
+    assert.equal(a.persistedIds.length, 1);
+    assert.equal(b.persistedIds.length, 1);
+    assert.equal(
+      await activeFactCopies(shared),
+      1,
+      "exactly one active shared copy survives the concurrent promotion pair",
+    );
+  } finally {
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});

package/src/orchestration/extraction-persist.ts

@@ -1,5 +1,6 @@
 import { classifyExtractionOrigin, type ExtractionSourceContext } from "./extraction-origin-context.js";
 import { confirmActiveFactDuplicate, persistUnderFactDedupWindow } from "./fact-dedup-window.js";
+import { writePromotionUnderFactDedupWindow } from "./promotion-dedup-window.js";
 import { evaluateInjectionScreen, screenEntityForIndex, screenPersistStrings } from "./extraction-injection-gate.js";
 /**
  * Extraction persistence coordinator (issue #1526, seam 16).
@@ -464,25 +465,26 @@ export class ExtractionPersistCoordinator {
             continue;
             }
           }
-          // Sealed-envelope write (issue #1989 PR2): cross-cutting fields ride
-          // the composed envelope (built above, before the dedup gate).
-          const targetPromotion = await targetStorage.writeSealedMemory(targetPromotionEnvelope, {
-            importance: options.importance,
-            lineage: [options.sourceMemoryId],
-            sourceMemoryId: options.sourceMemoryId,
-            intentGoal: options.intentGoal,
-            intentActionType: options.intentActionType,
-            intentEntityTypes: options.intentEntityTypes,
-            memoryKind: options.memoryKind,
-            // #1578 — forward bi-temporal bounds + ingestion provenance.
-            ...(options.invalidAt ? { invalidAt: options.invalidAt } : {}),
-            ...(options.observedAt ? { observedAt: options.observedAt } : {}),
-            ...(options.eventTimeSource ? { eventTimeSource: options.eventTimeSource } : {}),
-            contentHashSource: options.category === "fact" ? dedupContent : rawContent,
-            ...(options.sources && options.sources.length > 0 ? { sources: options.sources } : {}),
-            ...(options.provenance ? { provenance: options.provenance } : {}),
-            ...(options.toolScoped ? { toolScoped: true as const } : {}),
+          // Windowed destination write (PRRT_kwDORJXyws6zzdG4): the gate above
+          // ran outside the window; a twin committing meanwhile is suppressed
+          // by the in-window recheck. Contention throws fail-closed below.
+          const promotionWrite = await writePromotionUnderFactDedupWindow({
+            destination: targetStorage,
+            envelope: targetPromotionEnvelope,
+            promotion: options,
+            dedupContent,
+            rawContent,
+            toolScoped: options.toolScoped === true,
+            connector: sourceContext?.sourceConnector,
+            citationEnabled,
+            citationTemplate,
+            sameEntityGuardEnabled: false,
+            survivingAttrs: targetSurvivingAttrs,
+            supersession: { supersessionEnabled: lifecycleCaps.temporalSupersession, dependencyPropagationDelivery: this.dependencyPropagationDelivery, namespaceScope: this.deps.storageDirNamespace(targetStorage.dir) },
+            backfillTemporalBoundsOnDedupHit: this.deps.backfillTemporalBoundsOnDedupHit,
           });
+          if (promotionWrite.suppressed) continue;
+          const targetPromotion = promotionWrite.result;
           const promotedId = targetPromotion.id;
           // #1645: if the TARGET namespace's own tombstone blocked this promotion,
           // the row lands pending_review — do NOT supersede active target memories.
@@ -860,24 +862,27 @@ export class ExtractionPersistCoordinator {
             // No same-connector active shared fact — fall through to write.
           }
         }
-        const sharedPromotion = await sharedStorage.writeSealedMemory(sharedPromotionEnvelope, {
-          importance: options.importance,
-          lineage: [options.sourceMemoryId],
-          sourceMemoryId: options.sourceMemoryId,
-          intentGoal: options.intentGoal,
-          intentActionType: options.intentActionType,
-          intentEntityTypes: options.intentEntityTypes,
-          memoryKind: options.memoryKind,
-          // #1578 — forward bi-temporal bounds + ingestion provenance.
-          ...(options.invalidAt ? { invalidAt: options.invalidAt } : {}),
-          ...(options.observedAt ? { observedAt: options.observedAt } : {}),
-          ...(options.eventTimeSource ? { eventTimeSource: options.eventTimeSource } : {}),
-          contentHashSource: options.category === "fact" ? dedupContent : rawContent,
-          // Claim-level provenance spans (issue #1575 PR 2).
-          ...(options.sources && options.sources.length > 0 ? { sources: options.sources } : {}),
-          ...(options.provenance ? { provenance: options.provenance } : {}),
-          ...(toolScoped ? { toolScoped: true as const } : {}),
+        // Windowed destination write (PRRT_kwDORJXyws6zzdG4): the shared gate
+        // ran outside the window; a twin committing meanwhile is suppressed by
+        // the in-window recheck; contention throws fail-closed to the outer
+        // catch. Supersession rides along for the suppressed branch.
+        const sharedWrite = await writePromotionUnderFactDedupWindow({
+          destination: sharedStorage,
+          envelope: sharedPromotionEnvelope,
+          promotion: options,
+          dedupContent,
+          rawContent,
+          toolScoped,
+          connector: sourceContext?.sourceConnector,
+          citationEnabled,
+          citationTemplate,
+          sameEntityGuardEnabled: lifecycleCaps.temporalSupersession,
+          survivingAttrs: sharedSurvivingAttrs,
+          supersession: { supersessionEnabled: lifecycleCaps.temporalSupersession, dependencyPropagationDelivery: this.dependencyPropagationDelivery, namespaceScope: this.deps.storageDirNamespace(sharedStorage.dir) },
+          backfillTemporalBoundsOnDedupHit: this.deps.backfillTemporalBoundsOnDedupHit,
         });
+        if (sharedWrite.suppressed) return promotedCopyId;
+        const sharedPromotion = sharedWrite.result;
         const promotedId = sharedPromotion.id;
         // #1645: if the shared namespace's own tombstone blocked this promotion,
         // leave the row pending_review but do NOT supersede active shared memories.