@remnic/core 10.0.84 → 10.0.86

package/src/namespaces/search.ts

@@ -7,6 +7,7 @@ import type {
   SearchExecutionOptions,
   SearchQueryOptions,
 } from "../search/port.js";
+import { reportSearchDegradation } from "../search/port.js";
 import { createSearchBackend } from "../search/factory.js";
 import { namespaceIdentityToken, normalizeNamespaceIdentity } from "./identity.js";
 import { ALL_CATEGORY_DIRS } from "../utils/category-dir.js";
@@ -14,6 +15,13 @@ import { ALL_CATEGORY_DIRS } from "../utils/category-dir.js";
 const NESTED_NAMESPACE_FILTER_OVERFETCH_FACTOR = 4;
 const NESTED_NAMESPACE_FILTER_OVERFETCH_MIN = 50;
 
+// Short TTL so repeated health polls skip a full QMD re-probe (~1.5s).
+const HEALTH_RESULT_CACHE_TTL_MS = 10_000;
+
+// Each cross-namespace search leg gets this budget; a stalled backend leg
+// degrades its own namespace instead of holding the whole search (#3139).
+export const NAMESPACE_SEARCH_LEG_TIMEOUT_MS = 25_000;
+
 export function namespaceCollectionName(
   baseCollection: string,
   namespace: string,
@@ -72,6 +80,27 @@ export interface NamespaceSearchHealth {
   embeddingBacklogThreshold: number;
 }
 
+/** True when the pending-embedding count is above a positive backlog threshold. */
+export function embeddingBacklogExceeds(pending: number | null, threshold: number): boolean {
+  return threshold > 0 && pending !== null && pending > threshold;
+}
+
+/**
+ * The one definition of a degraded search answer. The readiness consumer
+ * reports it, and `healthForNamespace` refuses to cache it.
+ */
+export function isSearchHealthDegraded(
+  health: Pick<NamespaceSearchHealth, "available" | "collectionState" | "pendingEmbeddings">,
+  backlogThreshold: number,
+): boolean {
+  const active = health.available && health.collectionState !== "missing";
+  return (
+    !active ||
+    health.collectionState === "unknown" ||
+    embeddingBacklogExceeds(health.pendingEmbeddings, backlogThreshold)
+  );
+}
+
 type NamespaceScopedSearchConfig = PluginConfig & {
   hostEmbeddingProviderScope?: string;
 };
@@ -84,6 +113,11 @@ type BackendRecordOptions = {
 
 export class NamespaceSearchRouter {
   private readonly cache = new Map<string, Promise<NamespaceBackendRecord>>();
+  private readonly healthResultCache = new Map<
+    string,
+    { expiresAt: number; value: NamespaceSearchHealth }
+  >();
+
   private readonly pendingDisposals = new Set<Promise<void>>();
 
   constructor(
@@ -148,42 +182,67 @@ export class NamespaceSearchRouter {
           return { namespace, results: [] as QmdSearchResult[] };
         }
         const backendLimit = backendSearchLimit(record, maxResults);
-        let results: QmdSearchResult[];
+        // One stalled backend leg must not hold the whole cross-namespace
+        // search (#3139). The backend gets the deadline signal so it cancels
+        // its own work, and the await is raced against the same budget. A leg
+        // that outlives its budget degrades only its own namespace; real
+        // backend errors and caller aborts propagate as before.
+        const legAbort = new AbortController();
+        const legTimer = setTimeout(() => legAbort.abort(), NAMESPACE_SEARCH_LEG_TIMEOUT_MS);
+        const legSignal = options.execution?.signal
+          ? AbortSignal.any([options.execution.signal, legAbort.signal])
+          : legAbort.signal;
+        const legExecution: SearchExecutionOptions = { ...options.execution, signal: legSignal };
+        let leg: Promise<QmdSearchResult[]>;
         switch (method) {
           case "hybrid":
-            results = await record.backend.hybridSearch(
+            leg = record.backend.hybridSearch(
               query,
               record.collection,
               backendLimit,
-              options.execution,
+              legExecution,
             );
             break;
           case "bm25":
-            results = await record.backend.bm25Search(
+            leg = record.backend.bm25Search(
               query,
               record.collection,
               backendLimit,
-              options.execution,
+              legExecution,
             );
             break;
           case "vector":
-            results = await record.backend.vectorSearch(
+            leg = record.backend.vectorSearch(
               query,
               record.collection,
               backendLimit,
-              options.execution,
+              legExecution,
             );
             break;
           default:
-            results = await record.backend.search(
+            leg = record.backend.search(
               query,
               record.collection,
               backendLimit,
               options.searchOptions,
-              options.execution,
+              legExecution,
             );
             break;
         }
+        let results: QmdSearchResult[];
+        try {
+          results = await awaitWithAbort(leg, legSignal);
+        } catch (error) {
+          if (options.execution?.signal?.aborted || !legAbort.signal.aborted) throw error;
+          reportSearchDegradation(options.execution, {
+            backend: "qmd",
+            code: "deadline_exceeded",
+            detail: `namespace search deadline exceeded: ${namespace}`,
+          });
+          return { namespace, results: [] };
+        } finally {
+          clearTimeout(legTimer);
+        }
         results = filterNamespaceSubtreeResults(record, results)
           .map((result) => ({
             ...result,
@@ -279,6 +338,11 @@ export class NamespaceSearchRouter {
     execution?: SearchExecutionOptions,
   ): Promise<NamespaceSearchHealth> {
     const key = namespace.trim() || this.config.defaultNamespace;
+    const cached = this.healthResultCache.get(key);
+    if (cached && cached.expiresAt > Date.now()) {
+      return { ...cached.value };
+    }
+
     const record = await this.createBackendRecordFor(
       key,
       execution,
@@ -310,7 +374,7 @@ export class NamespaceSearchRouter {
           ? "missing"
           : record.collectionState;
 
-      return {
+      const health: NamespaceSearchHealth = {
         collection: record.collection,
         memoryDir: record.memoryDir,
         available: liveRecord?.available ?? record.available,
@@ -326,6 +390,22 @@ export class NamespaceSearchRouter {
         oldestPendingAgeMs: backendStatus?.oldestPendingAgeMs ?? null,
         embeddingBacklogThreshold: this.config.qmdEmbeddingBacklogThreshold,
       };
+
+      // Cache only a healthy answer that carries backlog data when the backend
+      // reports status. A degraded or incomplete answer must re-probe so a
+      // readiness poll sees recovery on the next call, not one TTL late.
+      const statusMissing = backendStatus === null && "status" in diagnosticBackend;
+      if (
+        execution?.signal?.aborted !== true &&
+        !statusMissing &&
+        !isSearchHealthDegraded(health, health.embeddingBacklogThreshold)
+      ) {
+        this.healthResultCache.set(key, {
+          expiresAt: Date.now() + HEALTH_RESULT_CACHE_TTL_MS,
+          value: { ...health },
+        });
+      }
+      return { ...health };
     } finally {
       const dispose = (record.backend as { dispose?: () => void | Promise<void> }).dispose;
       await dispose?.call(record.backend);
@@ -358,6 +438,7 @@ export class NamespaceSearchRouter {
 
   /** Clear cached backend records so the next access re-probes availability. */
   clearCache(): void {
+    this.healthResultCache.clear();
     const pendingRecords = Array.from(this.cache.values());
     this.cache.clear();
     const disposal = Promise.allSettled(pendingRecords).then(async (settled) => {
@@ -379,6 +460,7 @@ export class NamespaceSearchRouter {
   /** Release any per-namespace backend handles held by cached records. */
   async dispose(): Promise<void> {
     await this.drainPendingDisposals();
+    this.healthResultCache.clear();
     const pendingRecords = Array.from(this.cache.values());
     this.cache.clear();
     const settled = await Promise.allSettled(pendingRecords);
@@ -395,6 +477,7 @@ export class NamespaceSearchRouter {
    * has been switched to NoopSearchBackend for a missing collection.
    */
   async disableSearchBackends(): Promise<void> {
+    this.healthResultCache.clear();
     const settled = await Promise.allSettled(this.cache.values());
     await Promise.allSettled(
       settled.flatMap((entry) => {

package/src/orchestration/backlog-scheduler.ts

@@ -25,6 +25,7 @@
  * every claim retryable; a restarted daemon's scheduler adopts them.
  */
 
+import { randomUUID } from "node:crypto";
 import { hostname } from "node:os";
 import { log } from "../logger.js";
 import type { Orchestrator } from "../orchestrator.js";
@@ -44,8 +45,8 @@ export interface BacklogSchedulerDeps {
   liveBufferCounts():
     | Map<string, { turns: number; retainedTurns: number }>
     | Promise<Map<string, { turns: number; retainedTurns: number }>>;
-  /** A fresh lease for claims this scheduler takes. */
-  lease(): DrainLease;
+  /** Create a fresh lease for a unique owner token. */
+  lease(ownerId: string): DrainLease;
   /** Drain one key to quiescence (BufferDrainRunner.drainSession). */
   drainKey(
     key: string,
@@ -63,6 +64,7 @@ export interface BacklogSchedulerDeps {
 }
 
 export interface BacklogSchedulerOptions {
+  /** Optional label prefix; each scheduler instance adds a unique token. */
   ownerId?: string;
   /** Scan cadence in ms (startup + new-work + retry checks). */
   pollMs?: number;
@@ -135,7 +137,7 @@ export class BacklogScheduler {
   constructor(deps: BacklogSchedulerDeps, options: BacklogSchedulerOptions = {}) {
     this.deps = deps;
     this.options = {
-      ownerId: options.ownerId ?? `daemon-drain-${process.pid}`,
+      ownerId: `${options.ownerId ?? "daemon-drain"}-${randomUUID()}`,
       pollMs: options.pollMs ?? DEFAULT_POLL_MS,
       retryBaseMs: options.retryBaseMs ?? DEFAULT_RETRY_BASE_MS,
       retryMaxMs: options.retryMaxMs ?? DEFAULT_RETRY_MAX_MS,
@@ -333,11 +335,11 @@ export class BacklogScheduler {
     const { promise: settled, resolve: settle } = Promise.withResolvers<void>();
     this.inFlight.set(key, { controller, settled });
     try {
-      if (!(await this.claimForSubmit(key, needsClaim))) return;
+      if (!(await this.claimForSubmit(key, needsClaim, this.options.ownerId))) return;
       // Stopped between the claim decision and the task: leave the claim
       // with its lease (it expires; the next start adopts) — never drain.
       if (this.stopped) return;
-      await this.drainClaimedKey(key, controller.signal);
+      await this.drainClaimedKey(key, controller.signal, this.options.ownerId);
     } catch (err) {
       // Claim/drain failures are scheduler-level: the claim content is
       // untouched — count failed and back off (never an unhandled rejection
@@ -357,10 +359,10 @@ export class BacklogScheduler {
   }
 
   /** after all — the key goes quiet without a task. "claimed": ours. */
-  private async claimForSubmit(key: string, needsClaim: boolean): Promise<boolean> {
+  private async claimForSubmit(key: string, needsClaim: boolean, ownerId: string): Promise<boolean> {
     if (!needsClaim) return true;
     try {
-      const outcome = await this.deps.claims.claimFromSessionFile(key, this.deps.lease());
+      const outcome = await this.deps.claims.claimFromSessionFile(key, this.deps.lease(ownerId));
       if (outcome === "empty") {
         this.keys.delete(key);
         return false;
@@ -375,11 +377,11 @@ export class BacklogScheduler {
   /** Drain one claimed key. drainKey reports failures as outcomes; a thrown
    *  error still means the claim content is intact — count it failed and
    *  back off. */
-  private async drainClaimedKey(key: string, signal: AbortSignal): Promise<void> {
+  private async drainClaimedKey(key: string, signal: AbortSignal, ownerId: string): Promise<void> {
     this.counters.claimed += 1;
     try {
       const outcome = await this.deps.drainKey(key, {
-        ownerId: this.options.ownerId,
+        ownerId,
         signal,
       });
       this.applyOutcome(key, outcome);
@@ -480,7 +482,6 @@ export function wireBacklogScheduler(
   orchestrator: Orchestrator,
   options: BacklogSchedulerOptions = {}
 ): BacklogScheduler {
-  const ownerId = options.ownerId ?? `daemon-drain-${process.pid}`;
   const runner = new BufferDrainRunner(orchestrator);
   return new BacklogScheduler(
     {
@@ -492,7 +493,7 @@ export function wireBacklogScheduler(
         await orchestrator.buffer.load();
         return orchestrator.buffer.entryCounts();
       },
-      lease: () => {
+      lease: (ownerId) => {
         const now = new Date().toISOString();
         return {
           ownerId,
@@ -508,6 +509,6 @@ export function wireBacklogScheduler(
       // claim-backed drain accumulate toward the same threshold).
       breakerSnapshot: () => orchestrator.getExtractionResilienceStatus().breaker,
     },
-    { ...options, ownerId }
+    options
   );
 }

package/src/orchestration/buffer-drain-runner.ts

@@ -74,27 +74,35 @@ const DEFAULT_LEASE_MS = 120_000;
  * A `BufferStorage` view of one drain claim: the claim file IS the buffer.
  * Writes are the drain's progress (what is left to extract), so every
  * successfully extracted chunk is durably removed before the next one runs.
+ *
+ * `seen` is the drainer's own view of the claim: the entry it loaded, then the
+ * entry it last wrote. Each progress write is diffed against it, so a write
+ * records only the turns extracted since the previous one.
  */
 export class ClaimBufferStorage implements BufferStorage {
+  private seen: BufferEntryState;
+
   constructor(
     private readonly claims: BufferDrainClaims,
     private readonly key: string,
     private readonly ownerId: string,
-    private readonly entry: BufferEntryState
-  ) {}
+    entry: BufferEntryState
+  ) {
+    this.seen = entry;
+  }
 
   async loadBuffer(): Promise<BufferState> {
     const entries: NonNullable<BufferState["entries"]> = Object.create(null);
     entries[this.key] = {
-      turns: this.entry.turns,
-      retainedTurns: this.entry.retainedTurns,
-      lastExtractionAt: this.entry.lastExtractionAt,
-      extractionCount: this.entry.extractionCount,
+      turns: this.seen.turns,
+      retainedTurns: this.seen.retainedTurns,
+      lastExtractionAt: this.seen.lastExtractionAt,
+      extractionCount: this.seen.extractionCount,
     };
     return {
-      turns: this.entry.turns,
-      lastExtractionAt: this.entry.lastExtractionAt,
-      extractionCount: this.entry.extractionCount,
+      turns: this.seen.turns,
+      lastExtractionAt: this.seen.lastExtractionAt,
+      extractionCount: this.seen.extractionCount,
       entries,
     };
   }
@@ -102,16 +110,21 @@ export class ClaimBufferStorage implements BufferStorage {
   async saveBuffer(state: BufferState): Promise<void> {
     // Whole-state fallback (the claim covers one session): persist the entry.
     const entry = state.entries?.[this.key];
-    await this.claims.writeEntry(
-      this.key,
-      this.ownerId,
-      entry ?? { turns: [], lastExtractionAt: null, extractionCount: 0 },
-      this.entry
-    );
+    await this.writeProgress(entry ?? { turns: [], lastExtractionAt: null, extractionCount: 0 });
   }
 
   async saveBufferSession(key: string, entry: BufferEntryState): Promise<void> {
-    await this.claims.writeEntry(key, this.ownerId, entry, key === this.key ? this.entry : undefined);
+    if (key !== this.key) {
+      await this.claims.writeEntry(key, this.ownerId, entry, undefined);
+      return;
+    }
+    await this.writeProgress(entry);
+  }
+
+  private async writeProgress(entry: BufferEntryState): Promise<void> {
+    await this.claims.writeEntry(this.key, this.ownerId, entry, this.seen);
+    // Copy the lists: the buffer keeps mutating its own arrays after a save.
+    this.seen = { ...entry, turns: [...entry.turns], retainedTurns: entry.retainedTurns ? [...entry.retainedTurns] : undefined };
   }
 
   async deleteBufferSession(): Promise<void> {
@@ -554,14 +567,25 @@ async function runClaimDrain(
   options: BufferDrainRunnerOptions,
   heartbeat: NodeJS.Timeout
 ): Promise<DrainSessionOutcome> {
+  // Reconcile only identities recorded as durably extracted under this
+  // owner's claim lease. The claim lock is released before entering the live
+  // buffer mutation queue, preserving the buffer→claim lock order used by
+  // concurrent ingress saves.
+  const reconcileDrainedTurns = async (): Promise<void> => {
+    const drained = await ctx.claims.drainedTurnsForOwner(ctx.key, ctx.ownerId);
+    if (drained !== null) await ctx.orchestrator.buffer.save({ key: ctx.key, drained });
+  };
+
   // An emptied claim acks here: the ack verdict is the truth (drained), or
   // live ingress merged between the read and the ack — deferred, source kept.
   if (ctx.turns.length === 0) {
+    await reconcileDrainedTurns();
     const outcome = await ackEmptyClaim(ctx.claims, ctx.key, ctx.ownerId, ctx.turnsAtStart);
     options.onEvent?.({ type: "session_finished", key: ctx.key, outcome });
     return outcome;
   }
   const { groupOutcomes, groupError } = await drainScopeGroups(ctx);
+  await reconcileDrainedTurns();
   // Heartbeat cleared on EVERY exit path: a rejected drain must not keep
   // renewing the lease forever (cleared in the caller's finally).
   const remaining = await ctx.claims.load(ctx.key);

package/src/orchestration/extraction-persist.ts

@@ -1694,11 +1694,7 @@ export class ExtractionPersistCoordinator {
       // confirmation, so a disabled deployment never suppresses a write via
       // dedup (PR #2016 thread SD-nH).
       if (factDedupEnabled) {
-        exactDuplicate = await confirmActiveFactDuplicate(
-          { hasContentHashDedup: (storage, key) => this.deps.hasContentHashDedup(storage, key) },
-          targetStorage,
-          raceDedupOpts(contentHashDedupKey),
-        );
+        exactDuplicate = await confirmActiveFactDuplicate(targetStorage, raceDedupOpts(contentHashDedupKey));
       }
       // PR #2016/#3231: finalize committed writes before a fail-closed
       // window throw propagates (PRRT_kwDORJXyws6zxG6H).
@@ -1711,11 +1707,7 @@ export class ExtractionPersistCoordinator {
       const raceRecheck = (storage: StorageManager, key: string) => () => {
         // Gates mirror the persist-time suppression gates (PR #2016 SD-nH; #1645 quarantine).
         if (!factDedupEnabled || injectionScreenStatus === "pending_review") return Promise.resolve(false);
-        return confirmActiveFactDuplicate(
-          { hasContentHashDedup: (s, k) => this.deps.hasContentHashDedup(s, k) },
-          storage,
-          raceDedupOpts(key),
-        );
+        return confirmActiveFactDuplicate(storage, raceDedupOpts(key));
       };
       // #1671/#1707 — backfill bi-temporal bounds onto the surviving copy
       // when a duplicate short-circuits: persist-time hit OR raced duplicate

package/src/orchestration/fact-dedup-window.ts

@@ -19,9 +19,6 @@ import { log } from "../logger.js";
  * OUTSIDE the window exactly like the consolidation LLM call stays outside
  * commitConsolidatedProfile.
  */
-export interface FactDedupProbe {
-  hasContentHashDedup(storage: StorageManager, key: string): Promise<boolean>;
-}
 
 interface FactDedupMatchOptions {
   readonly category: string;
@@ -55,22 +52,18 @@ function matchesActiveConnectorDuplicate(memory: MemoryFile, opts: FactDedupMatc
  * silently drop content.
  */
 export async function confirmActiveFactDuplicate(
-  probe: FactDedupProbe,
   storage: StorageManager,
   opts: FactDedupMatchOptions,
 ): Promise<boolean> {
-  let needsCorpusConfirm: boolean;
   try {
-    if (!(await probe.hasContentHashDedup(storage, opts.contentHashDedupKey))) {
-      if (await storage.isFactContentHashAuthoritative()) return false;
-      needsCorpusConfirm = true;
-    } else {
-      needsCorpusConfirm = true;
-    }
+    // One lookup returns the MISS together with the authority behind it, so a
+    // stale MISS is never paired with authority from another moment: any
+    // second read of authority can rebuild the index and bless it (#3312).
+    const lookup = await storage.lookupContentHash(opts.contentHashDedupKey);
+    if (!lookup.present && lookup.authoritative) return false;
   } catch {
     // Dedup lookup failed (e.g. the authoritative rebuild could not run). Do
     // NOT fail-open into a possible duplicate — confirm against the corpus.
-    needsCorpusConfirm = true;
   }
   try {
     // #2016 cold-tier finding: the authoritative content-hash rebuild unions

package/src/orchestration/turn-ingestion.ts

@@ -18,7 +18,7 @@
 
 import { createHash, randomBytes } from "node:crypto";
 import { abortError, isPreemptedExtraction } from "../abort-error.js";
-import { SmartBuffer } from "../buffer.js";
+import { SmartBuffer, type AddTurnOutcome } from "../buffer.js";
 import type { ImportTurn } from "../bulk-import/types.js";
 import { resolveNamespaceCapabilities, resolvePipelineProcessingCapabilities, resolveRecallAuxiliaryCapabilities } from "../capabilities.js";
 import type { CorrectionService } from "../correction/correction-service.js";
@@ -57,18 +57,10 @@ import {
   type BulkImportBatchIngestResult,
 } from "../orchestrator.js";
 
-/**
- * #3251: raised by the buffered observe capture path when bounded admission
- * refuses a NEW session entry because the extraction buffer is at its entry
- * cap. The request was never accepted — no durable capture exists and no
- * previously accepted capture was evicted to make room.
- */
-export class ReplayAdmissionRefusedError extends Error {
-  constructor(message: string) {
-    super(message);
-    this.name = "ReplayAdmissionRefusedError";
-  }
-}
+// The class lives in ../buffer-admission.js next to BufferAdmissionRefusedError;
+// re-exported here so existing importers keep their import path.
+import { ReplayAdmissionRefusedError } from "../buffer-admission.js";
+export { ReplayAdmissionRefusedError };
 
 export interface TurnIngestionDeps {
   readonly buffer: SmartBuffer;
@@ -440,10 +432,29 @@ export class TurnIngestionCoordinator {
         "accepted capture requires an explicit storage target (writeNamespaceOverride or scopeProfileWritePlan.writeNamespace)",
       );
     }
-    for (const [bufferKey, sessionTurns] of bySession) {
-      // No top-level abort check: cancellation applies to the background
-      // extraction, never to the durable capture or save barrier (#3251).
-      if (options.archiveLcm !== false && this.deps.lcmEngine?.enabled) {
+    const pin = (turn: BufferTurn): BufferTurn => {
+      const pinned: BufferTurn = { ...turn, acceptedCapture: true, writeNamespaceOverride: resolvedWriteTarget };
+      if (options.codingContext) pinned.codingContext = options.codingContext;
+      if (options.principalOverride) pinned.principalOverride = options.principalOverride;
+      if (options.scopeProfileWritePlan) pinned.scopeProfileWritePlan = options.scopeProfileWritePlan;
+      return pinned;
+    };
+    const batches = [...bySession].map(([bufferKey, sessionTurns]) => ({ bufferKey, turns: sessionTurns.map(pin) }));
+    const outcomes = await this.deps.buffer.addTurnsBounded(batches);
+    if (outcomes === null) {
+      const refusedKey = batches.find((batch) => batch.turns.length > 0)?.bufferKey ?? "unknown";
+      throw new ReplayAdmissionRefusedError(
+        `durable observe capture refused: extraction buffer at entry capacity for batch containing ${refusedKey}`,
+      );
+    }
+
+    // All requested session keys were capacity-admitted together before any
+    // turn was saved. There is no retry identity: a repeat after a crash that
+    // persisted only a prefix duplicates that prefix, as on main.
+    await this.deps.buffer.flushPendingSave({ throwOnFailure: true });
+
+    if (options.archiveLcm !== false && this.deps.lcmEngine?.enabled) {
+      for (const [bufferKey, sessionTurns] of bySession) {
         await this.deps.lcmEngine.observeMessages(
           bufferKey,
           sessionTurns.map((turn) => ({
@@ -455,29 +466,17 @@ export class TurnIngestionCoordinator {
           })),
         );
       }
-      for (const turn of sessionTurns) {
-        const pinned: BufferTurn = { ...turn, acceptedCapture: true, writeNamespaceOverride: resolvedWriteTarget };
-        if (options.codingContext) pinned.codingContext = options.codingContext;
-        if (options.principalOverride) pinned.principalOverride = options.principalOverride;
-        if (options.scopeProfileWritePlan) pinned.scopeProfileWritePlan = options.scopeProfileWritePlan;
-        const outcome = await this.deps.buffer.addTurnBounded(bufferKey, pinned);
-        if (outcome === null) {
-          throw new ReplayAdmissionRefusedError(
-            `durable observe capture refused: extraction buffer at entry capacity for ${bufferKey}`,
-          );
-        }
-        if (outcome.decision !== "keep_buffering" && outcome.extractionTurns) {
-          queueBufferedCaptureScopeGroups(
-            this.deps.queueBufferedExtraction,
-            outcome.extractionTurns,
-            bufferKey,
-            options,
-          );
-        }
+    }
+
+    for (const { bufferKey, outcome } of outcomes) {
+      if (outcome.decision !== "keep_buffering" && outcome.extractionTurns) {
+        queueBufferedCaptureScopeGroups(
+          this.deps.queueBufferedExtraction,
+          outcome.extractionTurns,
+          bufferKey,
+          options,
+        );
       }
-      // Acceptance durability barrier (#1909 seam): surfaces storage failures
-      // BEFORE the caller can report acceptance. Not abort-gated.
-      await this.deps.buffer.flushPendingSave({ throwOnFailure: true });
     }
   }
 

package/src/recall-navigation-operations.ts

@@ -11,13 +11,20 @@
 import { z } from "zod";
 
 import { defineOperation } from "./access-boundary.js";
-import { EngramAccessInputError } from "./access-errors.js";
+import { EngramAccessInputError, rejectReservedArgumentKey } from "./access-errors.js";
 
+/**
+ * Null-prototype accumulator for cleaned request arguments, matching the
+ * batch preprocessors (issue #3225 B1): a copied own `__proto__` member on a
+ * plain `{}` switches the accumulator's prototype and an inherited field then
+ * reaches the zod parse.
+ */
 function stripNulls(data: unknown): unknown {
   if (data !== null && typeof data === "object" && !Array.isArray(data)) {
     const obj = data as Record<string, unknown>;
-    const cleaned: Record<string, unknown> = {};
+    const cleaned = Object.create(null);
     for (const [key, value] of Object.entries(obj)) {
+      rejectReservedArgumentKey(key);
       if (value !== null) cleaned[key] = value;
     }
     return cleaned;

package/src/source-agent-qualifier.ts

@@ -52,6 +52,8 @@ export interface ExtractionGroundingContext {
    *  second pass reads it so its prompts carry the same media warning. */
   ambientCapture?: boolean;
   scopeClassificationEnabled?: boolean;
+  /** Contents of the turns assertionSource was joined from, so quote anchors cut at real turn boundaries. */
+  turns?: readonly string[];
 }
 
 export function applyGroundingWithConnector(
@@ -64,6 +66,7 @@ export function applyGroundingWithConnector(
     sourceGrounding: caps.sourceGrounding,
     anchorTemporalExpressions: caps.delinearize,
     spanMode: config.extraction?.spanMode ?? "off",
+    turns: ctx.turns,
   };
   const known = buildKnownConnectors(ctx.sourceConnector);
   // Scope-forcing is decoupled from strip/restore (runs without a trusted