@remnic/core 9.3.729 → 9.3.730

package/src/correction/correction-planner.test.ts

@@ -491,3 +491,234 @@ test("#1678: never_store plan redacts the request text in the persisted pending-
     assert.ok(reloaded!.request.text.includes("redacted"));
   });
 });
+
+// ---------------------------------------------------------------------------
+// #1713 Item 2: stale applying plan recovery
+// ---------------------------------------------------------------------------
+
+test("#1713: markConsumed(applying) stamps applyingAt", async () => {
+  await withTempDir(async (dir) => {
+    const state: StubState = {
+      candidatesById: new Map([
+        ["mem-x", makeCandidate({ memoryId: "mem-x", content: "old fact" })],
+      ]),
+      llmResult: {
+        classification: "outdated",
+        confidence: 0.9,
+        actions: [{ kind: "supersede", loserId: "mem-x", replacement: { content: "new fact" } }],
+        relevance: [],
+        warnings: [],
+      },
+      writeReplacementCalls: 0,
+      propagateCalls: 0,
+      retireCalls: 0,
+    };
+    const planner = new CorrectionPlanner(makeDeps(dir, state));
+    const plan = await planner.plan({ text: "correct this" }, ["default"]);
+    await planner.markConsumed("default", plan.planId, "applying");
+    const reloaded = await planner.loadPlan("default", plan.planId);
+    assert.equal(reloaded!.status, "applying");
+    assert.ok(reloaded!.applyingAt, "applyingAt must be stamped when entering applying state");
+  });
+});
+
+test("#1713: markConsumed(applied) clears applyingAt", async () => {
+  await withTempDir(async (dir) => {
+    const state: StubState = {
+      candidatesById: new Map([
+        ["mem-x", makeCandidate({ memoryId: "mem-x", content: "old fact" })],
+      ]),
+      llmResult: {
+        classification: "outdated",
+        confidence: 0.9,
+        actions: [{ kind: "supersede", loserId: "mem-x", replacement: { content: "new fact" } }],
+        relevance: [],
+        warnings: [],
+      },
+      writeReplacementCalls: 0,
+      propagateCalls: 0,
+      retireCalls: 0,
+    };
+    const planner = new CorrectionPlanner(makeDeps(dir, state));
+    const plan = await planner.plan({ text: "correct this" }, ["default"]);
+    await planner.markConsumed("default", plan.planId, "applying");
+    await planner.markConsumed("default", plan.planId, "applied");
+    const reloaded = await planner.loadPlan("default", plan.planId);
+    assert.equal(reloaded!.status, "applied");
+    assert.ok(!reloaded!.applyingAt, "applyingAt must be cleared on terminal status");
+  });
+});
+
+test("#1713: recoverStaleApplyingPlans discards stale applying plans", async () => {
+  await withTempDir(async (dir) => {
+    const state: StubState = {
+      candidatesById: new Map([
+        ["mem-x", makeCandidate({ memoryId: "mem-x", content: "secret-token-1234" })],
+      ]),
+      llmResult: {
+        classification: "never_store",
+        confidence: 0.9,
+        actions: [{ kind: "redaction_rule", pattern: "secret-token-\\d+" }],
+        relevance: [],
+        warnings: [],
+      },
+      writeReplacementCalls: 0,
+      propagateCalls: 0,
+      retireCalls: 0,
+    };
+    const planTime = new Date("2026-03-15T12:00:00Z");
+    const recoveryTime = new Date("2026-03-15T13:00:00Z");
+    const deps = makeDeps(dir, state);
+    deps.now = () => planTime;
+    const planner = new CorrectionPlanner(deps);
+    const plan = await planner.plan({ text: "never store this secret", targetIds: ["mem-x"] }, ["default"]);
+    await planner.markConsumed("default", plan.planId, "applying");
+
+    let reloaded = await planner.loadPlan("default", plan.planId);
+    assert.equal(reloaded!.status, "applying");
+
+    const recovered = await planner.recoverStaleApplyingPlans("default", { now: recoveryTime });
+    assert.equal(recovered.length, 1);
+    assert.equal(recovered[0], plan.planId);
+
+    // Read the raw file (loadPlan/parsePlan rejects the scrubbed pattern by
+    // design — validation rejects placeholder patterns on re-load).
+    const { readFile: rf } = await import("node:fs/promises");
+    const rawPlan = JSON.parse(
+      await rf(dir + "/state/corrections/pending/" + plan.planId + ".json", "utf-8"),
+    );
+    assert.equal(rawPlan.status, "discarded");
+    assert.ok(!rawPlan.applyingAt, "applyingAt cleared on discard");
+    const redactionAction = rawPlan.actions.find(
+      (a: { kind: string }) => a.kind === "redaction_rule",
+    );
+    assert.ok(redactionAction, "redaction_rule action should still exist");
+    assert.match(String(redactionAction.pattern), /redacted/);
+  });
+});
+
+test("#1713: recoverStaleApplyingPlans leaves fresh applying plans alone", async () => {
+  await withTempDir(async (dir) => {
+    const state: StubState = {
+      candidatesById: new Map([
+        ["mem-x", makeCandidate({ memoryId: "mem-x", content: "old fact" })],
+      ]),
+      llmResult: {
+        classification: "outdated",
+        confidence: 0.9,
+        actions: [{ kind: "supersede", loserId: "mem-x", replacement: { content: "new fact" } }],
+        relevance: [],
+        warnings: [],
+      },
+      writeReplacementCalls: 0,
+      propagateCalls: 0,
+      retireCalls: 0,
+    };
+    const fixedNow = new Date("2026-03-15T12:00:00Z");
+    const deps = makeDeps(dir, state);
+    const planner = new CorrectionPlanner(deps);
+    const plan = await planner.plan({ text: "correct this" }, ["default"]);
+    await planner.markConsumed("default", plan.planId, "applying");
+
+    const recovered = await planner.recoverStaleApplyingPlans("default", {
+      now: new Date(fixedNow.getTime() + 2 * 60 * 1000),
+    });
+    assert.equal(recovered.length, 0);
+
+    const reloaded = await planner.loadPlan("default", plan.planId);
+    assert.equal(reloaded!.status, "applying");
+  });
+});
+
+test("#1713: recoverStaleApplyingPlans returns empty for namespace with no plans", async () => {
+  await withTempDir(async (dir) => {
+    const state: StubState = {
+      candidatesById: new Map(),
+      llmResult: { classification: "outdated", confidence: 0.5, actions: [], relevance: [], warnings: [] },
+      writeReplacementCalls: 0,
+      propagateCalls: 0,
+      retireCalls: 0,
+    };
+    const planner = new CorrectionPlanner(makeDeps(dir, state));
+    const recovered = await planner.recoverStaleApplyingPlans("default");
+    assert.deepEqual(recovered, []);
+  });
+});
+
+test("#1713: recoverStaleApplyingPlans recovers pre-fix plans via expiresAt fallback", async () => {
+  await withTempDir(async (dir) => {
+    const state: StubState = {
+      candidatesById: new Map([
+        ["mem-x", makeCandidate({ memoryId: "mem-x", content: "old fact" })],
+      ]),
+      llmResult: {
+        classification: "outdated",
+        confidence: 0.9,
+        actions: [{ kind: "supersede", loserId: "mem-x", replacement: { content: "new fact" } }],
+        relevance: [],
+        warnings: [],
+      },
+      writeReplacementCalls: 0,
+      propagateCalls: 0,
+      retireCalls: 0,
+    };
+    const fixedNow = new Date("2026-03-15T12:00:00Z");
+    const deps = makeDeps(dir, state);
+    const planner = new CorrectionPlanner(deps);
+    const plan = await planner.plan({ text: "correct this" }, ["default"]);
+
+    await planner.markConsumed("default", plan.planId, "applying");
+    // Simulate a pre-fix plan: manually strip applyingAt from the file
+    const { readFile: rf, writeFile: wf } = await import("node:fs/promises");
+    const planFile = dir + "/state/corrections/pending/" + plan.planId + ".json";
+    const planJson = JSON.parse(await rf(planFile, "utf-8"));
+    delete planJson.applyingAt;
+    await wf(planFile, JSON.stringify(planJson) + "\n", "utf-8");
+
+    // Recovery 25h later (past the 24h expiry, no applyingAt → falls back to expiresAt)
+    const recovered = await planner.recoverStaleApplyingPlans("default", {
+      now: new Date(fixedNow.getTime() + 25 * 60 * 60 * 1000),
+    });
+    assert.equal(recovered.length, 1);
+    assert.equal(recovered[0], plan.planId);
+  });
+});
+
+test("#1713: recoverStaleApplyingPlans recovers pre-fix plans immediately at expiry (no extra TTL wait)", async () => {
+  await withTempDir(async (dir) => {
+    const state: StubState = {
+      candidatesById: new Map([
+        ["mem-x", makeCandidate({ memoryId: "mem-x", content: "old fact" })],
+      ]),
+      llmResult: {
+        classification: "outdated",
+        confidence: 0.9,
+        actions: [{ kind: "supersede", loserId: "mem-x", replacement: { content: "new fact" } }],
+        relevance: [],
+        warnings: [],
+      },
+      writeReplacementCalls: 0,
+      propagateCalls: 0,
+      retireCalls: 0,
+    };
+    const fixedNow = new Date("2026-03-15T12:00:00Z");
+    const deps = makeDeps(dir, state);
+    const planner = new CorrectionPlanner(deps);
+    const plan = await planner.plan({ text: "correct this" }, ["default"]);
+
+    await planner.markConsumed("default", plan.planId, "applying");
+    // Simulate a pre-fix plan: manually strip applyingAt from the file
+    const { readFile: rf, writeFile: wf } = await import("node:fs/promises");
+    const planFile = dir + "/state/corrections/pending/" + plan.planId + ".json";
+    const planJson = JSON.parse(await rf(planFile, "utf-8"));
+    delete planJson.applyingAt;
+    await wf(planFile, JSON.stringify(planJson) + "\n", "utf-8");
+
+    // Recovery at exactly expiresAt: plan is already expired -> recover now
+    // (review thread ff034716: no extra TTL wait for pre-fix plans)
+    const recovered = await planner.recoverStaleApplyingPlans("default", {
+      now: new Date(planJson.expiresAt),
+    });
+    assert.equal(recovered.length, 1, "pre-fix plan at expiry must be recovered immediately");
+  });
+});

package/src/correction/correction-planner.ts

@@ -478,6 +478,15 @@ export class CorrectionPlanner {
       const plan = parsePlan(raw);
       if (!plan) return;
       plan.status = status;
+      // #1713 Item 2: stamp applyingAt when entering the applying state so
+      // startup recovery can detect plans stuck mid-apply (process death).
+      // Cleared on terminal transitions; harmless residue on non-applying
+      // plans is ignored by the recovery scan.
+      if (status === "applying") {
+        plan.applyingAt = this.deps.now().toISOString();
+      } else {
+        delete plan.applyingAt;
+      }
       // #1669 thread P1: scrub redaction_rule patterns from consumed plans so
       // a never-store pattern does not persist on disk after apply/discard.
       // The executor reloads via loadPlan only between "applying" (step 1) and
@@ -508,6 +517,70 @@ export class CorrectionPlanner {
       }
     });
   }
+
+  /**
+   * Stale-applying TTL: a plan in `applying` state longer than this is
+   * assumed to be from a crashed process and is recovered on startup
+   * (#1713 Item 2). 10 minutes is generous for an apply that normally
+   * completes in seconds, yet short enough to avoid leaving stale state.
+   */
+  static readonly STALE_APPLYING_TTL_MS = 10 * 60 * 1000;
+
+  /**
+   * Recover stale `applying` plans past the stale-applying TTL (#1713 Item 2).
+   *
+   * A plan stuck in `applying` means the process died mid-apply. Re-applying
+   * wholesale would duplicate succeeded actions (replacements, tombstones,
+   * audits), so recovery discards + scrubs the plan instead. The operator
+   * inspects the outcome and files a NEW plan for any actions that did not
+   * complete. Plans without `applyingAt` (predating this fix) are recovered
+   * when they are past their `expiresAt` timestamp.
+   *
+   * @returns the ids of recovered (discarded) plans.
+   */
+  async recoverStaleApplyingPlans(
+    namespace: string,
+    opts?: { ttlMs?: number; now?: Date },
+  ): Promise<string[]> {
+    const ttl = opts?.ttlMs ?? CorrectionPlanner.STALE_APPLYING_TTL_MS;
+    const now = (opts?.now ?? this.deps.now()).getTime();
+    const dir = await this.pendingDir(namespace);
+    let files: string[];
+    try {
+      files = await readdir(dir);
+    } catch (err) {
+      const code = (err as NodeJS.ErrnoException)?.code;
+      if (code === "ENOENT") return [];
+      throw err;
+    }
+    const recovered: string[] = [];
+    for (const f of files) {
+      if (!f.endsWith(".json")) continue;
+      const planId = f.replace(/\.json$/, "");
+      let plan: CorrectionPlan | null;
+      try {
+        plan = await this.loadPlan(namespace, planId);
+      } catch {
+        continue; // malformed — skip (rule 34).
+      }
+      if (!plan || plan.status !== "applying") continue;
+      // Post-fix plans (with applyingAt): stale if the applying timestamp is
+      // past the TTL (process died mid-apply). Pre-fix plans (no applyingAt):
+      // stale as soon as they have expired — no additional TTL wait, since the
+      // plan is already past its intended lifetime (review thread ff034716).
+      const stale = plan.applyingAt
+        ? now - new Date(plan.applyingAt).getTime() >= ttl
+        : now >= new Date(plan.expiresAt).getTime();
+      if (!stale) continue;
+      try {
+        await this.markConsumed(namespace, planId, "discarded");
+        recovered.push(planId);
+      } catch {
+        // Best-effort: a single failed discard must not abort the scan.
+      }
+    }
+    return recovered;
+  }
 }
 
 // ---------------------------------------------------------------------------

package/src/correction/correction-service.ts

@@ -170,6 +170,35 @@ export class CorrectionService {
     await this.planner.deletePlan(namespace, planId);
   }
 
+  /**
+   * Recover stale `applying` plans across the given namespaces (#1713 Item 2).
+   *
+   * Startup maintenance: scans each namespace for plans stuck in `applying`
+   * past the stale-applying TTL (process died mid-apply) and discards+scrubs
+   * them. Unlike plan/apply/listPending, this is NOT a per-caller request —
+   * it operates on all supplied namespaces directly because it is an
+   * internal maintenance operation invoked by the orchestrator at init.
+   *
+   * @returns the total count of recovered plans across all namespaces.
+   */
+  async recoverStaleApplyingPlans(namespaces: readonly string[]): Promise<number> {
+    // Intentionally NOT gated on isEnabled(): stale-applying recovery is a
+    // maintenance/cleanup operation, not a user-facing correction. Plans left
+    // in 'applying' after a mid-apply crash hold unscrubbed redaction_rule
+    // patterns on disk; they must be discarded+scrubbed even if the correction
+    // feature is currently disabled (review thread 9e1f07f0).
+    let recovered = 0;
+    for (const namespace of namespaces) {
+      try {
+        const ids = await this.planner.recoverStaleApplyingPlans(namespace);
+        recovered += ids.length;
+      } catch {
+        // Best-effort: a single namespace failure must not abort the sweep.
+      }
+    }
+    return recovered;
+  }
+
   private requireEnabled(): void {
     if (!this.deps.isEnabled()) {
       throw new CorrectionContractError(

package/src/correction/correction-storage-integration.test.ts

@@ -86,7 +86,7 @@ test("#1672 item 3: applyEditMemory recomputes contentHash from the patched body
   const { storage, cleanup } = await makeStorage();
   try {
     const wiring = { orchestrator: { getStorage: async () => storage } } as any;
-    const id = await storage.writeMemory("fact", "the database is MySQL", { source: "test" });
+    const { id: id } = await storage.writeMemory("fact", "the database is MySQL", { source: "test" });
     const before = await storage.getMemoryById(id);
     assert.ok(before?.frontmatter.contentHash, "writeMemory must set an initial contentHash");
     const oldHash = before!.frontmatter.contentHash!;
@@ -110,7 +110,7 @@ test("#1672 item 3: applyEditMemory leaves non-fact contentHash untouched (only
   const { storage, cleanup } = await makeStorage();
   try {
     const wiring = { orchestrator: { getStorage: async () => storage } } as any;
-    const id = await storage.writeMemory("preference", "likes dark mode", { source: "test" });
+    const { id: id } = await storage.writeMemory("preference", "likes dark mode", { source: "test" });
     await applyEditMemory(wiring, "default", id, "likes light mode");
     const after = await storage.getMemoryById(id);
     assert.equal(after!.content, "likes light mode");

package/src/dedup/semantic.test.ts

@@ -901,7 +901,7 @@ test("round 6: chunked parent writeMemory carries supersedes in frontmatter", as
     const storage = new StorageManager(memDir);
     const OLD_ID = "fact-old-abc-123";
 
-    const newId = await storage.writeMemory("fact", "the user prefers dark mode", {
+    const { id: newId } = await storage.writeMemory("fact", "the user prefers dark mode", {
       confidence: 0.9,
       tags: ["chunked", "preference"],
       supersedes: OLD_ID,

package/src/explicit-capture.ts

@@ -418,7 +418,7 @@ export async function persistExplicitCapture(
   orchestrator: Orchestrator,
   candidate: ValidExplicitCapture,
   source: ExplicitCaptureSource,
-): Promise<{ id: string; duplicateOf?: string }> {
+): Promise<{ id: string; duplicateOf?: string; tombstoneBlocked?: boolean }> {
   const resolvedNamespace = candidate.namespacePreResolved
     ? asTrimmed(candidate.namespace)
     : resolveExplicitCaptureNamespace(orchestrator, candidate.namespace);
@@ -428,7 +428,10 @@ export async function persistExplicitCapture(
   }
 
   const storage = await orchestrator.getStorage(resolvedNamespace);
-  const id = await storage.writeMemory(candidate.category, candidate.content, {
+  // #1645 (review thread yG-): surface the tombstone block so callers
+  // (memory_store tool, access-service HTTP/MCP) can report the capture as
+  // queued for review instead of a successfully stored active memory.
+  const { id, tombstoneBlocked } = await storage.writeMemory(candidate.category, candidate.content, {
     confidence: candidate.confidence,
     tags: candidate.tags,
     entityRef: candidate.entityRef,
@@ -450,7 +453,7 @@ export async function persistExplicitCapture(
   };
   await storage.appendMemoryLifecycleEvents([event]);
 
-  return { id };
+  return { id, tombstoneBlocked };
 }
 
 function buildExplicitCaptureReviewContent(input: ExplicitCaptureInput, reason: string): string {
@@ -527,7 +530,7 @@ export async function queueExplicitCaptureForReview(
     : "fact";
   const requestedTags = sanitizeReviewTags(input.tags);
   const storage = await orchestrator.getStorage(queueNamespace);
-  const id = await storage.writeMemory(reviewCategory, content, {
+  const { id: id } = await storage.writeMemory(reviewCategory, content, {
     confidence: 0.2,
     tags: Array.from(new Set([...EXPLICIT_CAPTURE_REVIEW_TAGS, ...requestedTags])),
     entityRef: sanitizeReviewMetadata(input.entityRef),

package/src/extraction-eventtime-wiring.test.ts

@@ -153,7 +153,7 @@ test("storage: invalid_at round-trips through writeMemoryFrontmatter → readAll
     const storage = new StorageManager(dir);
     await storage.ensureDirectories();
 
-    const id = await storage.writeMemory("fact", "Old stack was Node 18.", {
+    const { id: id } = await storage.writeMemory("fact", "Old stack was Node 18.", {
       validAt: "2025-01-01T00:00:00.000Z",
       observedAt: "2025-06-01T00:00:00.000Z",
       eventTimeSource: "extracted",
@@ -188,7 +188,7 @@ test("storage: writeMemory accepts invalidAt directly (end-bound at extraction w
   try {
     const storage = new StorageManager(dir);
     await storage.ensureDirectories();
-    const id = await storage.writeMemory("fact", "We used MongoDB until June 2025.", {
+    const { id: id } = await storage.writeMemory("fact", "We used MongoDB until June 2025.", {
       validAt: "2024-01-01T00:00:00.000Z",
       invalidAt: "2025-06-01T00:00:00.000Z",
       observedAt: "2025-06-20T00:00:00.000Z",
@@ -222,7 +222,7 @@ test("storage: writeChunk propagates invalidAt/observedAt/eventTimeSource from t
   try {
     const storage = new StorageManager(dir);
     await storage.ensureDirectories();
-    const parentId = await storage.writeMemory("fact", "We used MongoDB until June 2025.", {
+    const { id: parentId } = await storage.writeMemory("fact", "We used MongoDB until June 2025.", {
       validAt: "2024-01-01T00:00:00.000Z",
       invalidAt: "2025-06-01T00:00:00.000Z",
       observedAt: "2025-06-20T00:00:00.000Z",

package/src/extraction-redaction-rules.test.ts

@@ -16,6 +16,7 @@ import {
   compileRedactionPattern,
   contentMatchesRedactionRules,
   loadRedactionRules,
+  type CompiledRedactionRule,
 } from "./extraction-redaction-rules.js";
 import { validateRedactionPattern } from "./correction/correction-contract.js";
 
@@ -211,3 +212,174 @@ test("#1669 P2: compileRedactionPattern empty body never matches", () => {
   assert.equal(rule.matcher("anything"), false);
   assert.equal(rule.matcher(""), false);
 });
+
+// ---------------------------------------------------------------------------
+// #1713 Item 1: pre-judge redaction filter consults target namespace rules.
+// The orchestrator's pre-judge filter builds a combined rule set from source +
+// shared + routed target namespace dirs. This test verifies that loadRedactionRules
+// correctly returns rules from each dir and that contentMatchesRedactionRules
+// catches patterns from ANY of the combined dirs (not just the source).
+// ---------------------------------------------------------------------------
+
+test("#1713 Item 1: combined rules from source + target dirs catch cross-namespace patterns", async () => {
+  await withTempDir(async (sourceDir) => {
+    await withTempDir(async (targetDir) => {
+      // Source namespace has a rule for "source-secret"
+      await writeRule(sourceDir, "source-secret");
+      // Target namespace has a rule for "target-secret"
+      await writeRule(targetDir, "target-confidential");
+
+      // Simulate what the orchestrator's redactionRulesFor(...dirs) does:
+      // load from each dir and combine.
+      const sourceRules = await loadRedactionRules(sourceDir);
+      const targetRules = await loadRedactionRules(targetDir);
+      const combined = [...sourceRules, ...targetRules];
+
+      assert.equal(combined.length, 2);
+      // Source-namespace rule catches source content
+      assert.ok(
+        contentMatchesRedactionRules("leaked source-secret here", combined),
+        "source-namespace rule must catch matching content",
+      );
+      // Target-namespace rule catches target content (the #1713 fix)
+      assert.ok(
+        contentMatchesRedactionRules("leaked target-confidential here", combined),
+        "target-namespace rule must catch matching content when dirs are combined",
+      );
+      // Clean content passes
+      assert.ok(
+        !contentMatchesRedactionRules("clean content", combined),
+        "non-matching content must not be redacted",
+      );
+    });
+  });
+});
+
+test("#1713 Item 1: source-only rules miss target-namespace patterns (the bug this fixes)", async () => {
+  await withTempDir(async (sourceDir) => {
+    await withTempDir(async (targetDir) => {
+      // Only the TARGET namespace has the redaction rule
+      await writeRule(targetDir, "cross-ns-secret");
+
+      // The OLD behavior (pre-fix): only source rules loaded at pre-judge point
+      const sourceOnlyRules = await loadRedactionRules(sourceDir);
+      assert.equal(sourceOnlyRules.length, 0);
+      assert.ok(
+        !contentMatchesRedactionRules("cross-ns-secret in content", sourceOnlyRules),
+        "source-only rules miss the target-namespace pattern (the pre-fix gap)",
+      );
+
+      // The NEW behavior: source + target rules combined
+      const combined = [
+        ...(await loadRedactionRules(sourceDir)),
+        ...(await loadRedactionRules(targetDir)),
+      ];
+      assert.equal(combined.length, 1);
+      assert.ok(
+        contentMatchesRedactionRules("cross-ns-secret in content", combined),
+        "combined rules catch the target-namespace pattern (the fix)",
+      );
+    });
+  });
+});
+
+test("#1713 (codex PRRT_kwDORJXyws6PBj5X): scope-classification routed shared target rules consulted at pre-judge", async () => {
+  // Scope classification routes a scope=global fact to the shared namespace
+  // independent of routing rules. The pre-judge redaction filter must consult
+  // the SHARED namespace's rules for such a fact, or a never-store pattern
+  // registered only under shared is missed until the write gate and the content
+  // reaches the extraction judge/training path. This test mirrors the
+  // orchestrator's per-fact scope-routing decision + rule combining.
+  await withTempDir(async (sourceDir) => {
+    await withTempDir(async (sharedDir) => {
+      // Only the SHARED namespace carries the never-store rule.
+      await writeRule(sharedDir, "shared-only-secret");
+
+      // A scope=global fact the orchestrator will route to shared.
+      const fact = { scope: "global" as string, content: "leaked shared-only-secret here" };
+      const sharedNamespace: string = "shared";
+      const sourceNamespace: string = "default"; // source !== shared
+
+      // Mirror of the orchestrator's scope-routing condition (persistExtraction
+      // pre-judge per-fact block): a fact is scope-routed to shared when no
+      // routing rule set an explicit namespace, scope classification is on, the
+      // fact is global, shared writes are allowed, and the source is not already
+      // shared.
+      const preRoutedNamespaceByFact: string | undefined = undefined;
+      const scopeClassificationEnabled = true;
+      const namespacesEnabled = true;
+      const profileAllowsSharedWrites = true;
+      let factNs: string | undefined = preRoutedNamespaceByFact;
+      if (
+        !factNs &&
+        scopeClassificationEnabled &&
+        namespacesEnabled &&
+        fact.scope === "global" &&
+        profileAllowsSharedWrites &&
+        sourceNamespace !== sharedNamespace
+      ) {
+        factNs = sharedNamespace;
+      }
+      assert.equal(factNs, sharedNamespace, "global fact must be scope-routed to shared");
+
+      // Base (source-only) rules + routed target (shared) rules combined — what
+      // the orchestrator builds for this fact.
+      const baseRules: CompiledRedactionRule[] = await loadRedactionRules(sourceDir);
+      const targetRules: CompiledRedactionRule[] =
+        factNs === sharedNamespace ? await loadRedactionRules(sharedDir) : [];
+      const factRedactionRules: CompiledRedactionRule[] = [...baseRules, ...targetRules];
+
+      assert.equal(baseRules.length, 0, "source namespace has no rules");
+      assert.equal(targetRules.length, 1, "shared namespace carries the never-store rule");
+
+      // Pre-fix (source-only) behavior: the shared-only pattern is missed at
+      // pre-judge — the gap the codex thread flags.
+      assert.ok(
+        !contentMatchesRedactionRules(fact.content, baseRules),
+        "source-only rules miss the shared-namespace never-store pattern (the gap)",
+      );
+      // Post-fix: combined source+shared rules catch it before the judge.
+      assert.ok(
+        contentMatchesRedactionRules(fact.content, factRedactionRules),
+        "combined source+shared rules catch the shared never-store at pre-judge (the fix)",
+      );
+    });
+  });
+});
+
+test("#1713 (codex): non-global fact is NOT scope-routed to shared", async () => {
+  // A scope-local fact must not consult shared rules at pre-judge — only
+  // routing-rule targets and scope=global facts do. Guards against over-redacting
+  // unrelated facts with shared-only never-store patterns (codex sibling threads).
+  await withTempDir(async (sourceDir) => {
+    await withTempDir(async (sharedDir) => {
+      await writeRule(sharedDir, "shared-only-secret");
+
+      const fact = { scope: "local" as string, content: "leaked shared-only-secret here" };
+      const sharedNamespace: string = "shared";
+      const sourceNamespace: string = "default";
+
+      const preRoutedNamespaceByFact: string | undefined = undefined;
+      const scopeClassificationEnabled = true;
+      const namespacesEnabled = true;
+      const profileAllowsSharedWrites = true;
+      let factNs: string | undefined = preRoutedNamespaceByFact;
+      if (
+        !factNs &&
+        scopeClassificationEnabled &&
+        namespacesEnabled &&
+        fact.scope === "global" &&
+        profileAllowsSharedWrites &&
+        sourceNamespace !== sharedNamespace
+      ) {
+        factNs = sharedNamespace;
+      }
+      assert.equal(factNs, undefined, "non-global fact must not be scope-routed to shared");
+
+      const baseRules: CompiledRedactionRule[] = await loadRedactionRules(sourceDir);
+      const targetRules: CompiledRedactionRule[] = [];
+      const factRedactionRules: CompiledRedactionRule[] = [...baseRules, ...targetRules];
+      assert.equal(factRedactionRules.length, 0, "no rules consulted for a scope-local fact");
+    });
+  });
+});