@remnic/core 10.0.68 → 10.0.70

package/src/access-observe-stage-timing.test.ts

@@ -0,0 +1,246 @@
+/**
+ * Noncontent stage timing for slow/failed observe requests (25s incident).
+ * A failed request must record which stage blocked it (phase attribution) in
+ * the `access-observe-failed` log line without leaking message content,
+ * session keys, namespaces or principals, and must still throw unchanged.
+ */
+import assert from "node:assert/strict";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import { EngramAccessService, NamespaceNotWritableError } from "./access-service.js";
+import { initLogger, resetLogger, type LoggerBackend } from "./logger.js";
+import { Orchestrator } from "./orchestrator.js";
+import { parseConfig } from "./config.js";
+import type { EngramAccessObserveRequest } from "./access-service.js";
+import type { CodingContext, PluginConfig } from "./types.js";
+
+interface OrchestratorInternals {
+  config: PluginConfig;
+  _codingContextBySession: Map<string, CodingContext>;
+}
+
+function makeService(memoryDir: string): EngramAccessService {
+  // SAFETY: the probe drives only the observe scope path on this orchestrator.
+  const orch = Object.create(Orchestrator.prototype) as Orchestrator;
+  // SAFETY: the probe sets exactly these two internal fields.
+  const internals: OrchestratorInternals = {
+    config: parseConfig({
+      namespacesEnabled: true,
+      defaultNamespace: "default",
+      sharedNamespace: "shared",
+      namespacePolicies: [],
+      codingMode: { projectScope: true },
+      transcriptEnabled: false,
+      memoryDir,
+    }),
+    _codingContextBySession: new Map(),
+  };
+  Object.assign(orch, internals);
+  return new EngramAccessService(orch);
+}
+
+test("a rejected observe logs phase attribution with stage durations and still throws", async () => {
+  const dir = await mkdtemp(path.join(tmpdir(), "remnic-observe-timing-"));
+  const lines: string[] = [];
+  const backend: LoggerBackend = {
+    info(msg) {
+      lines.push(msg);
+    },
+    warn(msg) {
+      lines.push(msg);
+    },
+    error(msg) {
+      lines.push(msg);
+    },
+  };
+  initLogger(backend, false, { timestamps: false });
+  try {
+    const service = makeService(dir);
+    // SAFETY: the literal sets the request fields the scope path reads.
+    const rejectedRequest = {
+      sessionKey: "sess-timing-1",
+      authenticatedPrincipal: "alice",
+      namespace: "victim-secret",
+      messages: [
+        { role: "user", content: "first secret message body" },
+        { role: "assistant", content: "second secret message body" },
+      ],
+    } as EngramAccessObserveRequest;
+    await assert.rejects(
+      service.observe(rejectedRequest),
+      NamespaceNotWritableError
+    );
+
+    const failed = lines.filter((l) => l.includes("access-observe-failed"));
+    assert.equal(failed.length, 1, `expected exactly one access-observe-failed line, got: ${failed}`);
+    const line = failed[0] ?? "";
+    // Phase attribution: the blocked stage (scope) plus total and message count.
+    assert.match(line, /totalMs=\d+/);
+    assert.match(line, /messages=2/);
+    assert.match(line, /scopeMs=\d+/);
+    // Noncontent: no message bodies, session key, namespace or principal.
+    assert.ok(!line.includes("secret"), `leaked content in: ${line}`);
+    assert.ok(!line.includes("sess-timing-1"), `leaked session key in: ${line}`);
+    assert.ok(!line.includes("victim-secret"), `leaked namespace in: ${line}`);
+    assert.ok(!line.includes("alice"), `leaked principal in: ${line}`);
+  } finally {
+    resetLogger();
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+// Plain-object orchestrator for full observe success/failure paths (mirrors
+// the access-service-observe-lcm-parity harness).
+function makeProbe(options: {
+  enqueueObserveMessages: (sessionKey: string, messages: unknown[]) => Promise<void> | void;
+}) {
+  const config = parseConfig({
+    namespacesEnabled: true,
+    defaultNamespace: "default",
+    sharedNamespace: "shared",
+    namespacePolicies: [],
+    defaultRecallNamespaces: ["self", "shared"],
+    codingMode: { projectScope: true },
+    transcriptEnabled: false,
+    memoryDir: "/synthetic/remnic-observe-timing",
+    objectiveStateMemoryEnabled: false,
+    objectiveStateSnapshotWritesEnabled: false,
+    principalFromSessionKeyMode: "prefix",
+    principalFromSessionKeyRules: [],
+    recallCrossNamespaceBudgetEnabled: false,
+    recallCrossNamespaceBudgetWindowMs: 60_000,
+    recallCrossNamespaceBudgetSoftLimit: 10,
+    recallCrossNamespaceBudgetHardLimit: 30,
+  });
+  const contexts = new Map<string, CodingContext>();
+  const extractionCalls: string[][] = [];
+  // SAFETY: the probe exercises the observe surface; the rest of Orchestrator
+  // is unused on this path.
+  const orch = {
+    config,
+    getCodingContextForSession: (sk: string | undefined) => (sk ? contexts.get(sk) : null) ?? null,
+    setCodingContextForSession: (sk: string, ctx: CodingContext | null) => {
+      if (ctx === null) contexts.delete(sk);
+      else contexts.set(sk, ctx);
+    },
+    applyCodingNamespaceOverlay: (sk: string | undefined, base: string) =>
+      Orchestrator.prototype.applyCodingNamespaceOverlay.call(orch, sk, base),
+    resolvePrincipal: (sk?: string) => Orchestrator.prototype.resolvePrincipal.call(orch, sk),
+    resolveSelfNamespace: (sk?: string) => Orchestrator.prototype.resolveSelfNamespace.call(orch, sk),
+    lcmEngine: {
+      enabled: true,
+      enqueueObserveMessages: options.enqueueObserveMessages,
+    },
+    ingestReplayBatch: async (turns: Array<{ sessionKey: string }>) => {
+      extractionCalls.push(turns.map((t) => t.sessionKey));
+    },
+  } as any;
+  return { orch, extractionCalls };
+}
+
+test("a slow successful observe logs access-observe-slow with per-stage durations", async () => {
+  const lines: string[] = [];
+  const backend: LoggerBackend = {
+    info(msg) {
+      lines.push(msg);
+    },
+    warn(msg) {
+      lines.push(msg);
+    },
+    error(msg) {
+      lines.push(msg);
+    },
+  };
+  initLogger(backend, false, { timestamps: false });
+  // Deterministic monotonic clock: every read advances 6s, so each timed
+  // stage records exactly 6000ms and the total exceeds the slow threshold.
+  let now = 0;
+  const realPerformanceNow = performance.now;
+  performance.now = () => (now += 6000);
+  try {
+    const { orch } = makeProbe({
+      enqueueObserveMessages: (_sessionKey) => {},
+    });
+    const service = new EngramAccessService(orch);
+    // SAFETY: the literal sets the request fields the observe path reads.
+    const slowRequest = {
+      sessionKey: "alice:sess-slow",
+      authenticatedPrincipal: "alice",
+      messages: [
+        { role: "user", content: "slow path message body" },
+        { role: "assistant", content: "reply body" },
+      ],
+    } as EngramAccessObserveRequest;
+    const res = await service.observe(slowRequest);
+    assert.equal(res.accepted, 2);
+
+    const slow = lines.filter((l) => l.includes("access-observe-slow"));
+    assert.equal(slow.length, 1, `expected one access-observe-slow line, got: ${lines}`);
+    const line = slow[0] ?? "";
+    assert.match(line, /totalMs=(\d+)/);
+    const totalMs = Number(/totalMs=(\d+)/.exec(line)?.[1]);
+    assert.ok(totalMs >= 10_000, `slow line must exceed threshold, got totalMs=${totalMs}`);
+    assert.match(line, /messages=2/);
+    // Real stages are attributed, including the durable-buffer terminal stage.
+    assert.match(line, /scopeMs=6000/);
+    assert.match(line, /durable-bufferMs=6000/);
+    assert.ok(!line.includes("sess-slow") && !line.includes("alice") && !line.includes("body"));
+  } finally {
+    performance.now = realPerformanceNow;
+    resetLogger();
+  }
+});
+
+test("a failed awaited LCM archival records the lcm-accept phase and still throws", async () => {
+  const lines: string[] = [];
+  const backend: LoggerBackend = {
+    info(msg) {
+      lines.push(msg);
+    },
+    warn(msg) {
+      lines.push(msg);
+    },
+    error(msg) {
+      lines.push(msg);
+    },
+  };
+  initLogger(backend, false, { timestamps: false });
+  try {
+    const { orch } = makeProbe({
+      enqueueObserveMessages: async () => {
+        throw new Error("lcm archival append failed");
+      },
+    });
+    const service = new EngramAccessService(orch);
+    // SAFETY: the literal sets the request fields the observe path reads.
+    const failedLcmRequest = {
+      sessionKey: "alice:sess-lcmfail",
+      authenticatedPrincipal: "alice",
+      messages: [
+        { role: "user", content: "lcm failure message body" },
+        { role: "assistant", content: "reply body" },
+      ],
+    } as EngramAccessObserveRequest;
+    await assert.rejects(
+      service.observe(failedLcmRequest),
+      /lcm archival append failed/
+    );
+
+    const failed = lines.filter((l) => l.includes("access-observe-failed"));
+    assert.equal(failed.length, 1, `expected exactly one access-observe-failed line, got: ${failed}`);
+    const line = failed[0] ?? "";
+    assert.match(line, /totalMs=\d+/);
+    assert.match(line, /messages=2/);
+    // The rejected LCM accept is attributed with its duration, alongside earlier stages.
+    assert.match(line, /scopeMs=\d+/);
+    assert.match(line, /lcm-acceptMs=\d+/);
+    assert.ok(!line.includes("sess-lcmfail"), `leaked session key in: ${line}`);
+    assert.ok(!line.includes("alice"), `leaked principal in: ${line}`);
+    assert.ok(!line.includes("body"), `leaked content in: ${line}`);
+  } finally {
+    resetLogger();
+  }
+});

package/src/access-observe-stage-timing.ts

@@ -0,0 +1,58 @@
+/**
+ * Noncontent stage timing for the observe surface.
+ *
+ * Durations only — never message content, session keys, namespaces or
+ * principals. A monotonic clock (`performance.now`) keeps phase durations
+ * sane under wall-clock corrections.
+ *
+ * A slow observe logs `access-observe-slow`; a failed observe always logs
+ * `access-observe-failed`, so a 25s-class stall attributes to a phase
+ * instead of a guess.
+ */
+import { log } from "./logger.js";
+
+/** Observes slower than this log `access-observe-slow` with per-stage durations. */
+const OBSERVE_SLOW_LOG_MS = 10_000;
+
+export interface ObserveStageTimer {
+  /** Run one stage, recording its duration even when the stage rejects. */
+  timed<T>(stage: string, fn: () => Promise<T>): Promise<T>;
+  /** Log a slow successful observe with per-stage durations. */
+  logSlow(messages: number): void;
+  /** Log a failed observe with per-stage durations. */
+  logFailed(messages: number): void;
+}
+
+/** Timer for one observe request. */
+export function createObserveStageTimer(): ObserveStageTimer {
+  const startedAtMs = performance.now();
+  const stageMs: Record<string, number> = {};
+
+  const formatStages = (): string =>
+    Object.entries(stageMs)
+      .map(([stage, ms]) => `${stage}Ms=${Math.round(ms)}`)
+      .join(" ");
+
+  return {
+    async timed<T>(stage: string, fn: () => Promise<T>): Promise<T> {
+      const stageStartMs = performance.now();
+      try {
+        return await fn();
+      } finally {
+        stageMs[stage] = (stageMs[stage] ?? 0) + (performance.now() - stageStartMs);
+      }
+    },
+    logSlow(messages: number): void {
+      const totalMs = Math.round(performance.now() - startedAtMs);
+      if (totalMs < OBSERVE_SLOW_LOG_MS) return;
+      log.warn(
+        `access-observe-slow totalMs=${totalMs} messages=${messages} ${formatStages()}`,
+      );
+    },
+    logFailed(messages: number): void {
+      log.warn(
+        `access-observe-failed totalMs=${Math.round(performance.now() - startedAtMs)} messages=${messages} ${formatStages()}`,
+      );
+    },
+  };
+}

package/src/access-observe-write-surface.ts

@@ -34,6 +34,9 @@ import { abortError } from "./abort-error.js";
 import { withBriefingDeadline } from "./briefing-deadline.js";
 import { extractionForceFlush } from "./access-extraction-force-flush.js";
 import { ObserveTranscriptPersister, observeTranscriptSessionKey } from "./access-observe-transcript.js";
+import { createObserveStageTimer } from "./access-observe-stage-timing.js";
+import { archiveObservedTurns } from "./access-observe-lcm-archive.js";
+import { recordObserveObjectiveState } from "./access-observe-objective-state.js";
 import { FileCalendarSource, buildBriefing, parseBriefingFocus, parseBriefingWindow } from "./briefing.js";
 import {
   resolveCompressionCapabilities,
@@ -708,10 +711,16 @@ export class AccessObserveWriteSurface {
       request.sessionKey,
       pendingObserveScopeHint(request)
     );
+    // Noncontent stage timing for slow/failed observes: durations only, logged
+    // in the `access-observe-failed` line (always) and `access-observe-slow`
+    // (successes at or above the slow threshold). Never message content,
+    // session keys, namespaces or principals.
+    const stageTimer = createObserveStageTimer();
+    const timed = stageTimer.timed.bind(stageTimer);
     try {
       let scope: MemoryScopePlan;
       try {
-        scope = await this.deps.resolveMemoryScopePlan(request);
+        scope = await timed("scope", () => this.deps.resolveMemoryScopePlan(request));
       } catch (err) {
         // A replay re-submit sets suppressQuarantine so a still-unwritable target
         // propagates instead of re-parking (#1888); observe has no dryRun path.
@@ -749,10 +758,12 @@ export class AccessObserveWriteSurface {
       //    on the same session is project-scoped (rule 42: same namespace layer as
       //    recall). Done AFTER the scope plan authorized the write, so a rejected
       //    request never leaves orphaned context on the session.
-      await this.deps.maybeAttachCodingContext(request.sessionKey, {
-        cwd: request.cwd,
-        projectTag: request.projectTag,
-      });
+      await timed("context", () =>
+        this.deps.maybeAttachCodingContext(request.sessionKey, {
+          cwd: request.cwd,
+          projectTag: request.projectTag,
+        })
+      );
 
       // Prefix sessionKey with the EFFECTIVE write namespace for LCM archival so
       // observed turns are scoped to the same namespace project-scoped recall
@@ -771,51 +782,35 @@ export class AccessObserveWriteSurface {
       //    (#928 contract, already auth-checked inside the scope plan), not the
       //    general default-store write namespace.
       if (shouldWriteObjectiveState) {
-        try {
-          const objectiveStateLocation = await this.deps.objectiveStateStoreLocationForNamespace(
-            scope.objectiveStateNamespace
-          );
-          await recordObjectiveStateSnapshotsFromObservedMessages({
-            memoryDir: objectiveStateLocation.memoryDir,
-            objectiveStateStoreDir: objectiveStateLocation.objectiveStateStoreDir,
-            objectiveStateMemoryEnabled: resolveObjectiveStateCapabilities(this.deps.orchestrator.config)
-              .objectiveStateMemory,
-            objectiveStateSnapshotWritesEnabled: resolveObjectiveStateCapabilities(this.deps.orchestrator.config)
-              .objectiveStateSnapshotWrites,
-            sessionKey: request.sessionKey,
-            recordedAt: new Date().toISOString(),
-            messages: request.messages,
-          });
-        } catch (err) {
-          log.error(`access-observe objective-state snapshot write failed: ${err}`);
-        }
+        await timed("objective", () =>
+          recordObserveObjectiveState(
+            this.deps.orchestrator,
+            this.deps.objectiveStateStoreLocationForNamespace,
+            scope,
+            request,
+          ),
+        );
       }
 
       // 5. LCM archival → effective write namespace.
-      // lcmArchived in the response means "LCM archival was queued" (not
-      // "completed"), matching extractionQueued semantics.  Both run async.
-      let lcmArchived = false;
-      if (this.deps.orchestrator.lcmEngine && this.deps.orchestrator.lcmEngine.enabled) {
-        // Fire-and-forget: LCM archival writes to SQLite and builds summary
-        // DAGs, which can take tens of seconds for large sessions.  Don't
-        // block the HTTP response — the caller only needs acknowledgment.
-        try {
-          this.deps.orchestrator.lcmEngine.enqueueObserveMessages(lcmSessionKey, request.messages);
-          lcmArchived = true;
-        } catch (err) {
-          log.error(`access-observe LCM enqueue failed: ${err}`);
-        }
-      }
+      // The archival append is durable before this returns: the queue holds
+      // only a session reference, and summary DAGs are built in the
+      // background, so the caller is never blocked on inference.
+      const lcmArchived = await timed("lcm-accept", () =>
+        archiveObservedTurns(this.deps.orchestrator.lcmEngine, lcmSessionKey, request.messages),
+      );
 
       // 5b. Transcript persistence → the per-session transcript store the
-      // hourly summarizer reads (issue #2783). Best-effort like the LCM
-      // enqueue above: a transcript failure must not fail the observe.
+      // hourly summarizer reads (issue #2783). Best-effort: a transcript
+      // failure must not fail the observe.
       const transcriptPersisted = resolvePresentationCapabilities(this.deps.orchestrator.config).transcript
-        ? await this.observeTranscriptPersister.persist(
-            this.deps.orchestrator,
-            observeTranscriptSessionKey(request.sessionKey, writeNamespace, this.deps.orchestrator.config),
-            request.messages,
-            request.sessionKey
+        ? await timed("transcript", () =>
+            this.observeTranscriptPersister.persist(
+              this.deps.orchestrator,
+              observeTranscriptSessionKey(request.sessionKey, writeNamespace, this.deps.orchestrator.config),
+              request.messages,
+              request.sessionKey
+            )
           )
         : false;
 
@@ -895,10 +890,11 @@ export class AccessObserveWriteSurface {
             extractionQueued = true;
           };
         }
-        await this.deps.orchestrator.ingestReplayBatch(turns, ingestOptions);
+        await timed("durable-buffer", () => this.deps.orchestrator.ingestReplayBatch(turns, ingestOptions));
         // A native trigger may leave the durable capture pending rather than queued.
       }
 
+      stageTimer.logSlow(request.messages.length);
       log.info(
         `access-observe namespace=${namespace} effectiveNamespace=${writeNamespace} sessionKey=${request.sessionKey} messages=${request.messages.length} lcm=${lcmArchived} extraction=${extractionQueued} transcript=${transcriptPersisted}`
       );
@@ -924,6 +920,10 @@ export class AccessObserveWriteSurface {
         extractionQueued,
         transcriptPersisted,
       };
+    } catch (err) {
+      // Failed requests always get phase attribution (noncontent), regardless of duration.
+      stageTimer.logFailed(request.messages.length);
+      throw err;
     } finally {
       observePreparation.release();
     }

package/src/access-service.ts

@@ -1079,6 +1079,7 @@ export interface EngramAccessObserveResponse {
   effectiveNamespace: string;
   /** Additive diagnostic view of the resolved scope plan (#1495). */
   scopeDebug?: EngramAccessScopeDebug;
+  /** True when the observed turns are durably archived in LCM — the archive append completed before the response was produced. */
   lcmArchived: boolean;
   extractionQueued: boolean;
   /** True when at least one observe-derived turn was appended to the transcript store (issue #2783). False when the transcript capability is off, every message was filtered/deduped, or every append failed. */

package/src/extraction-shared-promotion-parallel-dedup.test.ts

@@ -0,0 +1,212 @@
+/**
+ * Codex P2 PRRT_kwDORJXyws6zzdG4 (#3311) — promotion-target writes must share
+ * the fact-dedup commit window.
+ *
+ * With extractionQueueConcurrency > 1 and shared auto-promotion enabled, two
+ * sessions extracting the same fact into DIFFERENT source namespaces can both
+ * pass the shared-namespace dedup gate (`hasFactContentHash`) before either
+ * promotion writes: the persist-time gate runs outside the commit window that
+ * protects the source writes, and the promotion destination write ran without
+ * any window at all. writeMemory mints a fresh id per write, so both
+ * promotions land distinct active shared copies — exactly the duplicate class
+ * `persistUnderFactDedupWindow` exists to prevent for source writes.
+ *
+ * The fix wraps each promotion destination write in
+ * `persistUnderFactDedupWindow` keyed on the DESTINATION storage dir, so the
+ * second promotion's in-window recheck observes the first promotion's
+ * committed hash and suppresses instead of duplicating. The invariant these
+ * tests assert — exactly one active shared copy survives a concurrent
+ * same-fact promotion pair — holds for every interleaving once the window is
+ * in place, because recheck+write are atomic per destination dir; before the
+ * fix the duplicate depends on the interleaving (two symmetric pipelines in
+ * lockstep both gate-miss before either write commits).
+ *
+ * These tests drive the real persistExtraction path (no LLM network; every
+ * gate that would call one is off) with two real source namespaces and the
+ * real shared destination, and assert the durable outcome.
+ */
+
+import assert from "node:assert/strict";
+import os from "node:os";
+import path from "node:path";
+import { mkdtemp, rm } from "node:fs/promises";
+import test from "node:test";
+
+import { parseConfig } from "./config.js";
+import { Orchestrator } from "./orchestrator.js";
+import type { ExtractionResult, PluginConfig } from "./types.js";
+import type { LocalLlmClient } from "./local-llm.js";
+import type { PersistExtractionFn } from "./testing/orchestrator-lite.js";
+import type { StorageManager } from "./storage.js";
+
+// Fixture contract for the private Orchestrator surface this suite drives.
+interface OrchestratorFixture {
+  localLlm?: unknown;
+  chatCompletion?: unknown;
+  getStorage?: unknown;
+  persistExtraction?: unknown;
+}
+
+// Named owner contract for the private internals this suite drives.
+interface OrchestratorInternals {
+  localLlm: LocalLlmClient;
+  getStorage: (ns: string) => Promise<StorageManager>;
+  persistExtraction: PersistExtractionFn;
+}
+
+function asInternals<T extends object>(value: OrchestratorFixture): T {
+  // SAFETY: the fixture provides the members the persist path reads; the
+  // remaining contract members are unused by these tests.
+  return value as T;
+}
+
+async function makeHarness(): Promise<{
+  orchestrator: Orchestrator;
+  persist: OrchestratorInternals;
+  memoryDir: string;
+  shared: StorageManager;
+  teamA: StorageManager;
+  teamB: StorageManager;
+}> {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-promotion-dedup-"));
+  const config: PluginConfig = parseConfig({
+    openaiApiKey: "sk-test",
+    memoryDir,
+    workspaceDir: path.join(memoryDir, "workspace"),
+    // Minimize every gate that needs a model or corpus-scale machinery so the
+    // fact reaches the normal (non-chunked) write path.
+    extractionJudgeEnabled: false,
+    temporalSupersessionEnabled: false,
+    contradictionDetectionEnabled: false,
+    chunkingEnabled: false,
+    embeddingFallbackEnabled: false,
+    qmdEnabled: false,
+    extractionMinChars: 0,
+    extractionMinImportanceLevel: "trivial",
+    inlineSourceAttributionEnabled: false,
+    // Shared auto-promotion from every source namespace into the default
+    // "shared" namespace (both default off — the deployment profile this
+    // finding targets).
+    namespacesEnabled: true,
+    autoPromoteToSharedEnabled: true,
+  });
+  const orchestrator = new Orchestrator(config);
+  const internals = asInternals<OrchestratorInternals>(orchestrator);
+  internals.localLlm = asInternals<LocalLlmClient>({ chatCompletion: async () => null });
+  const shared = await internals.getStorage("shared");
+  const teamA = await internals.getStorage("team-a");
+  const teamB = await internals.getStorage("team-b");
+  await Promise.all([shared, teamA, teamB].map((s) => s.ensureDirectories()));
+  return { orchestrator, persist: internals, memoryDir, shared, teamA, teamB };
+}
+
+function factResult(content: string): ExtractionResult {
+  const result = {
+    facts: [
+      {
+        content,
+        category: "fact",
+        // confidenceTier(0.96) === "explicit", which the default
+        // autoPromoteMinConfidenceTier ("explicit") admits.
+        confidence: 0.96,
+        tags: [],
+      },
+    ],
+    entities: [],
+    relationships: [],
+    questions: [],
+    profileUpdates: [],
+  };
+  // SAFETY: literal carries the full extraction-result shape persistExtraction
+  // consumes for a single fact candidate.
+  return result as ExtractionResult;
+}
+
+async function activeFactCopies(storage: StorageManager): Promise<number> {
+  const memories = await storage.readAllMemories();
+  return memories.filter(
+    (m) => m.frontmatter.category === "fact" && (m.frontmatter.status ?? "active") === "active",
+  ).length;
+}
+
+const FACT = "Deployment rollbacks complete within five minutes.";
+
+test("the same fact promoted from two namespaces lands once in shared (serial baseline)", async () => {
+  const { persist, memoryDir, shared, teamA, teamB } = await makeHarness();
+  try {
+    const first = await persist.persistExtraction(
+      factResult(FACT),
+      teamA,
+      null,
+      { sessionKey: "agent:test:a", principal: "test" },
+      undefined,
+      null,
+      "User mentioned that deployment rollbacks complete within five minutes.",
+    );
+    const second = await persist.persistExtraction(
+      factResult(FACT),
+      teamB,
+      null,
+      { sessionKey: "agent:test:b", principal: "test" },
+      undefined,
+      null,
+      "User mentioned that deployment rollbacks complete within five minutes.",
+    );
+
+    // Each source namespace keeps its own copy (cross-namespace source writes
+    // never dedup), and the second promotion dedups through the shared gate.
+    assert.equal(first.persistedIds.length, 1, "first source write persists");
+    assert.equal(second.persistedIds.length, 1, "second source write persists in its own namespace");
+    assert.equal(await activeFactCopies(teamA), 1);
+    assert.equal(await activeFactCopies(teamB), 1);
+    assert.equal(await activeFactCopies(shared), 1, "shared namespace holds exactly one promoted copy");
+  } finally {
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});
+
+test("concurrent same-fact promotions from different namespaces leave exactly one active shared copy", async () => {
+  const { persist, memoryDir, shared, teamA, teamB } = await makeHarness();
+  try {
+    const sourceText = "User mentioned that deployment rollbacks complete within five minutes.";
+    // Two real sessions, different source namespaces, same fact, one shared
+    // destination. Before the fix this interleaving (both pipelines gate-miss
+    // in lockstep before either promotion writes) landed two distinct active
+    // shared copies; after the fix the destination window serializes the
+    // promotions and the invariant holds for every interleaving.
+    const [a, b] = await Promise.all([
+      persist.persistExtraction(
+        factResult(FACT),
+        teamA,
+        null,
+        { sessionKey: "agent:test:a", principal: "test" },
+        undefined,
+        null,
+        sourceText,
+      ),
+      persist.persistExtraction(
+        factResult(FACT),
+        teamB,
+        null,
+        { sessionKey: "agent:test:b", principal: "test" },
+        undefined,
+        null,
+        sourceText,
+      ),
+    ]);
+
+    // Each source namespace still persists its own copy — the window only
+    // serializes the shared DESTINATION.
+    assert.equal(await activeFactCopies(teamA), 1, "team-a keeps its source copy");
+    assert.equal(await activeFactCopies(teamB), 1, "team-b keeps its source copy");
+    assert.equal(a.persistedIds.length, 1);
+    assert.equal(b.persistedIds.length, 1);
+    assert.equal(
+      await activeFactCopies(shared),
+      1,
+      "exactly one active shared copy survives the concurrent promotion pair",
+    );
+  } finally {
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});