@remnic/core 9.30.1 → 9.32.0

package/dist/{chunk-4WKA6I65.js → chunk-J3ZGPYXB.js}

@@ -8,16 +8,13 @@ import {
 } from "./chunk-GDB4J2H3.js";
 import {
   importCapsule
-} from "./chunk-ALSGMEJR.js";
+} from "./chunk-65ZPVYTA.js";
+import {
+  CONNECTOR_ID_PATTERN
+} from "./chunk-2QIMTVEJ.js";
 import {
   WriteQuarantineStore
 } from "./chunk-PJSK6OJM.js";
-import {
-  trustResultFor
-} from "./chunk-GNVZQ5JN.js";
-import {
-  renderEpistemicHedge
-} from "./chunk-YN2UN7N3.js";
 import {
   getTrustZoneStoreStatus,
   isTrustZoneName,
@@ -27,22 +24,28 @@ import {
   seedTrustZoneDemoDataset,
   summarizeTrustZonePromotionReadiness
 } from "./chunk-JGSKJHF7.js";
+import {
+  trustResultFor
+} from "./chunk-GNVZQ5JN.js";
+import {
+  renderEpistemicHedge
+} from "./chunk-YN2UN7N3.js";
 import {
   planSessionTranscriptMigration
 } from "./chunk-P5FPO2BR.js";
-import {
-  boundRecallContextComposition,
-  composeRecallContext
-} from "./chunk-AHVEHR6K.js";
 import {
   decideDisclosureEscalation
 } from "./chunk-H7XKCNR6.js";
 import {
   toRecallExplainJson
-} from "./chunk-K5GB36ME.js";
+} from "./chunk-VMZ56EE3.js";
 import {
   estimateRecallTokens
-} from "./chunk-ACXPX4AG.js";
+} from "./chunk-OPBTPRGY.js";
+import {
+  boundRecallContextComposition,
+  composeRecallContext
+} from "./chunk-AHVEHR6K.js";
 import {
   buildProposedActions,
   buildQualityScore,
@@ -50,10 +53,7 @@ import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact,
   runMemoryGovernance
-} from "./chunk-W5EG6LE3.js";
-import {
-  ReplicaDivergenceMonitor
-} from "./chunk-CVILPI77.js";
+} from "./chunk-THCPRMRF.js";
 import {
   recordObjectiveStateSnapshotsFromObservedMessages
 } from "./chunk-ICP53SKG.js";
@@ -62,21 +62,15 @@ import {
 } from "./chunk-6HMYUWXR.js";
 import {
   offlineSyncStorageForSnapshot
-} from "./chunk-WVO4G37W.js";
+} from "./chunk-7TEZUUGM.js";
 import {
-  combineNamespaces,
-  defaultGitInvoker,
-  expandScopeProfileReadNamespaces,
-  lcmSessionKeyForNamespace,
-  projectTagProjectId,
-  resolveCodingNamespaceOverlay,
-  resolveGitContext,
   resolveScopePlan,
-  resolveScopeProfilePlan,
   resolveScopedWritableNamespaceValue,
-  resolveWritableNamespaceValue,
-  sanitizeFragment
-} from "./chunk-IYZ5K7MU.js";
+  resolveWritableNamespaceValue
+} from "./chunk-ULARSG5Z.js";
+import {
+  ReplicaDivergenceMonitor
+} from "./chunk-XOQSEF7X.js";
 import {
   recordMemoryOutcome
 } from "./chunk-EIR5VLIH.js";
@@ -104,34 +98,55 @@ import {
 import {
   CorpusWatermarkCache,
   computeServiceCorpusCensus
-} from "./chunk-GIBMDSJ2.js";
+} from "./chunk-6P7MTSU5.js";
 import {
   namespaceCollectionName
-} from "./chunk-D2ANTDGO.js";
+} from "./chunk-E6BMSH7U.js";
 import {
   CrossNamespaceBudget,
   toBudgetWarning
 } from "./chunk-UFGFMWAD.js";
+import {
+  ExtractionDeadlineError
+} from "./chunk-YPC7W6GA.js";
+import {
+  combineNamespaces,
+  defaultGitInvoker,
+  expandScopeProfileReadNamespaces,
+  lcmSessionKeyForNamespace,
+  projectTagProjectId,
+  resolveCodingNamespaceOverlay,
+  resolveGitContext,
+  resolveScopeProfilePlan,
+  sanitizeFragment
+} from "./chunk-BUE5E2HL.js";
+import {
+  defaultCapsulesDir
+} from "./chunk-ZY2MNJR6.js";
+import {
+  filterTrajectoriesByLookbackDays,
+  readCausalTrajectoryRecords
+} from "./chunk-NRV4Y3PM.js";
 import {
   FileCalendarSource,
   buildBriefing,
   enqueuePassiveCorrectionNotification,
   parseBriefingFocus,
   parseBriefingWindow
-} from "./chunk-CZRYLSSW.js";
+} from "./chunk-AJL6NNX6.js";
 import {
   parseEntityFile,
   qmdCollectionPathParts,
   qmdResultPathCandidates,
   selfDeps
-} from "./chunk-RGIWINDN.js";
+} from "./chunk-FHBITMRY.js";
 import {
   supersessionKeysForFact
 } from "./chunk-DNHVPZOD.js";
 import {
   DEFAULT_RECALL_DISCLOSURE,
   isRecallDisclosure
-} from "./chunk-HUHX2OCX.js";
+} from "./chunk-VVDPPDDF.js";
 import {
   namespaceIdentityFromToken
 } from "./chunk-EGGE52UU.js";
@@ -169,17 +184,27 @@ import {
 } from "./chunk-BT7NVCML.js";
 import {
   createVersion
-} from "./chunk-5VQJBH2G.js";
+} from "./chunk-6TAUHL33.js";
 import {
   computeContentHash
 } from "./chunk-W5H6ZRPT.js";
 import {
-  defaultCapsulesDir
-} from "./chunk-ZY2MNJR6.js";
+  assertOperationAuthorizationAllowed,
+  capabilityAllowsOp,
+  enforceNamespaceAllowList,
+  isNamespaceAllowed,
+  tokenCapabilityStore
+} from "./chunk-MZWSOLMT.js";
 import {
-  filterTrajectoriesByLookbackDays,
-  readCausalTrajectoryRecords
-} from "./chunk-W4FBGYGK.js";
+  meetingsBuild,
+  meetingsGet,
+  meetingsList,
+  wearablesStatus,
+  wearablesSync,
+  wearablesTranscriptDay,
+  wearablesTranscriptMemories,
+  wearablesTranscriptSearch
+} from "./chunk-SYOIVK7K.js";
 import {
   ExtractionLivenessWarnThrottle,
   computeExtractionLivenessStatus
@@ -196,7 +221,7 @@ import {
 } from "./chunk-JAKIDQB2.js";
 import {
   exportCapsule
-} from "./chunk-5W7CTZ2E.js";
+} from "./chunk-KQAFEZQX.js";
 import {
   evaluateActionConfidence
 } from "./chunk-Z2YFLXHU.js";
@@ -212,22 +237,8 @@ import {
   readOfflineSyncFileContentChunk
 } from "./chunk-7XC2HX75.js";
 import {
-  assertOperationAuthorizationAllowed,
-  capabilityAllowsOp,
-  enforceNamespaceAllowList,
-  isNamespaceAllowed,
-  tokenCapabilityStore
-} from "./chunk-MZWSOLMT.js";
-import {
-  meetingsBuild,
-  meetingsGet,
-  meetingsList,
-  wearablesStatus,
-  wearablesSync,
-  wearablesTranscriptDay,
-  wearablesTranscriptMemories,
-  wearablesTranscriptSearch
-} from "./chunk-SYOIVK7K.js";
+  delegateExtractionForceFlush
+} from "./chunk-3QL24R5Y.js";
 import {
   defaultNamespaceAtFlatRoot,
   mergeMemorySearchDefaultFallback,
@@ -257,6 +268,10 @@ import {
   resolveRecallEnhancementCapabilities,
   resolveSecurityCapabilities
 } from "./chunk-2XRE6FLM.js";
+import {
+  PendingObserveExtractionTracker,
+  pendingObserveScopeHint
+} from "./chunk-N5Z4EVOR.js";
 import {
   EngramAccessForbiddenError,
   EngramAccessInputError,
@@ -268,6 +283,7 @@ import {
 } from "./chunk-VFUEZZBS.js";
 import {
   abortError,
+  isAbortError,
   throwIfAborted
 } from "./chunk-PVGDJXVK.js";
 import {
@@ -2853,7 +2869,9 @@ var CorrectionPlanner = class _CorrectionPlanner {
    * Plan a correction. `readableNamespaces` is the AUTHORIZED read scope the
    * service resolved for this caller; the planner never trusts a caller string.
    */
-  async plan(request, readableNamespaces) {
+  async plan(request, readableNamespaces, opts) {
+    const abortSignal = opts?.abortSignal;
+    throwIfAborted(abortSignal, "correction planning aborted");
     const cleaned = validateCorrectionRequest(request);
     if (cleaned.text.length > CORRECTION_TEXT_MAX) {
       throw new CorrectionContractError("CorrectionRequest.text too long.");
@@ -2869,16 +2887,19 @@ var CorrectionPlanner = class _CorrectionPlanner {
         "Correction requires at least one readable namespace \u2014 principal has no read scope."
       );
     }
-    const located = await this.locateCandidates(cleaned, namespaces);
+    const located = await this.locateCandidates(cleaned, namespaces, abortSignal);
+    throwIfAborted(abortSignal, "correction planning aborted");
     if (located.candidates.length === 0) {
       return this.persist(
-        this.emptyPlan(cleaned, namespaces[0], "no matching memories found for the correction text")
+        this.emptyPlan(cleaned, namespaces[0], "no matching memories found for the correction text"),
+        abortSignal
       );
     }
     const llm = await this.deps.classifyAndDraft({
       text: cleaned.text,
       candidates: located.candidates
     });
+    throwIfAborted(abortSignal, "correction planning aborted");
     for (const action of llm.actions) {
       validateCorrectionAction(action);
       if (action.kind === "redaction_rule") {
@@ -2909,6 +2930,7 @@ var CorrectionPlanner = class _CorrectionPlanner {
       }
     }
     const diff = llm.fallback ? "" : await this.deps.renderDiff({ candidates: located.candidates, actions: llm.actions });
+    throwIfAborted(abortSignal, "correction planning aborted");
     const createdAt = this.deps.now().toISOString();
     const expiresAt = new Date(
       this.deps.now().getTime() + this.deps.planTtlHours * 60 * 60 * 1e3
@@ -2934,20 +2956,23 @@ var CorrectionPlanner = class _CorrectionPlanner {
       expiresAt,
       status: "pending"
     };
-    return this.persist(plan);
+    throwIfAborted(abortSignal, "correction planning aborted");
+    return this.persist(plan, abortSignal);
   }
-  async locateCandidates(request, namespaces) {
+  async locateCandidates(request, namespaces, abortSignal) {
     if (request.targetIds && request.targetIds.length > 0) {
       const targets = await this.deps.resolveTargets({
         targetIds: request.targetIds,
         namespaces
       });
+      throwIfAborted(abortSignal, "correction planning aborted");
       const seedIds2 = targets.map((c) => c.memoryId);
       const neighbors2 = await this.deps.expandNeighbors({
         seedIds: seedIds2,
         namespaces,
         limit: this.deps.maxAffected
       });
+      throwIfAborted(abortSignal, "correction planning aborted");
       return { candidates: mergeCandidates(targets, neighbors2).slice(0, this.deps.maxAffected) };
     }
     const searched = await this.deps.searchCorpus({
@@ -2955,6 +2980,7 @@ var CorrectionPlanner = class _CorrectionPlanner {
       namespaces,
       limit: this.deps.maxAffected
     });
+    throwIfAborted(abortSignal, "correction planning aborted");
     if (searched.length === 0) return { candidates: [] };
     const seedIds = searched.slice(0, Math.min(5, searched.length)).map((c) => c.memoryId);
     const neighbors = await this.deps.expandNeighbors({
@@ -2962,6 +2988,7 @@ var CorrectionPlanner = class _CorrectionPlanner {
       namespaces,
       limit: this.deps.maxAffected
     });
+    throwIfAborted(abortSignal, "correction planning aborted");
     return { candidates: mergeCandidates(searched, neighbors).slice(0, this.deps.maxAffected) };
   }
   deriveAffected(candidates, llm) {
@@ -3024,16 +3051,21 @@ var CorrectionPlanner = class _CorrectionPlanner {
   async pendingDir(namespace) {
     return path4.join(await this.deps.storageDir(namespace), "state", "corrections", "pending");
   }
-  async persist(plan) {
+  async persist(plan, abortSignal) {
+    throwIfAborted(abortSignal, "correction planning aborted");
     const dir = await this.pendingDir(plan.namespace);
+    throwIfAborted(abortSignal, "correction planning aborted");
     const target = path4.join(dir, `${plan.planId}.json`);
     const sensitive = plan.classification === "never_store" || plan.actions.some((a) => a.kind === "redaction_rule");
     const persistedPlan = sensitive ? { ...plan, request: { ...plan.request, text: REDACTED_REQUEST_TEXT } } : plan;
     await serializeMutations(`correction-plan:${target}`, async () => {
+      throwIfAborted(abortSignal, "correction planning aborted");
       await mkdir2(dir, { recursive: true });
       const tmp = `${target}.${process.pid}.${Date.now().toString(36)}.tmp`;
+      throwIfAborted(abortSignal, "correction planning aborted");
       await writeFile2(tmp, `${JSON.stringify(persistedPlan)}
 `, "utf-8");
+      throwIfAborted(abortSignal, "correction planning aborted");
       await rename2(tmp, target);
     });
     return plan;
@@ -3106,6 +3138,32 @@ var CorrectionPlanner = class _CorrectionPlanner {
       }
       const tmp = `${file}.${process.pid}.${Date.now().toString(36)}.tmp`;
       await writeFile2(tmp, `${JSON.stringify(plan)}
+`, "utf-8");
+      await rename2(tmp, file);
+    });
+  }
+  /**
+   * Return an applying plan to the pending queue when cancellation arrives
+   * before its first correction mutation.
+   */
+  async resetApplying(namespace, planId) {
+    assertSafePlanId(planId);
+    const file = path4.join(await this.pendingDir(namespace), `${planId}.json`);
+    await serializeMutations(`correction-plan:${file}`, async () => {
+      let raw;
+      try {
+        raw = await readFile4(file, "utf-8");
+      } catch (err) {
+        const code = err?.code;
+        if (code === "ENOENT") return;
+        throw err;
+      }
+      const plan = parsePlan(raw);
+      if (!plan || plan.status !== "applying") return;
+      plan.status = "pending";
+      delete plan.applyingAt;
+      const tmp = `${file}.${process.pid}.${Date.now().toString(36)}.tmp`;
+      await writeFile2(tmp, `${JSON.stringify(plan)}
 `, "utf-8");
       await rename2(tmp, file);
     });
@@ -3234,6 +3292,7 @@ var CorrectionExecutor = class {
    * plan is rejected. Returns the {@link CorrectionOutcome}.
    */
   async apply(namespace, planId, opts) {
+    throwIfAborted(opts.abortSignal, "correction apply aborted");
     if (!opts.confirm) {
       throw new CorrectionContractError(
         "Correction apply requires explicit confirmation (correction.applyRequiresConfirm)."
@@ -3241,11 +3300,13 @@ var CorrectionExecutor = class {
     }
     return serializeMutations(
       `correction-apply:${namespace}:${planId}`,
-      () => this.applyInternal(namespace, planId, opts.canWriteDestination)
+      () => this.applyInternal(namespace, planId, opts.canWriteDestination, opts.abortSignal)
     );
   }
-  async applyInternal(namespace, planId, canWriteDestination) {
+  async applyInternal(namespace, planId, canWriteDestination, abortSignal) {
+    throwIfAborted(abortSignal, "correction apply aborted");
     const plan = await this.planner.loadPlan(namespace, planId);
+    throwIfAborted(abortSignal, "correction apply aborted");
     if (!plan) {
       throw new CorrectionContractError(`Correction plan not found: ${planId}`);
     }
@@ -3274,6 +3335,7 @@ var CorrectionExecutor = class {
         validateRedactionPattern(action.pattern);
       }
     }
+    throwIfAborted(abortSignal, "correction apply aborted");
     try {
       await this.planner.markConsumed(namespace, planId, "applying");
     } catch {
@@ -3281,11 +3343,79 @@ var CorrectionExecutor = class {
         `Correction plan ${planId}: cannot mark in-progress (filesystem unwritable?) \u2014 aborting before any mutation.`
       );
     }
+    const resetApplying = async () => {
+      try {
+        await this.planner.resetApplying(namespace, planId);
+      } catch (resetError) {
+        log.warn(
+          `Correction plan ${planId}: cancellation reset failed; leaving plan applying: ${resetError instanceof Error ? resetError.message : String(resetError)}`
+        );
+      }
+    };
+    try {
+      throwIfAborted(abortSignal, "correction apply aborted");
+    } catch (error) {
+      await resetApplying();
+      throw error;
+    }
     const results = [];
     const appliedTouched = [];
+    const retiredReplacementActions = /* @__PURE__ */ new Set();
+    const removeFailedResultsFor = (action) => {
+      for (let i = results.length - 1; i >= 0; i -= 1) {
+        if (results[i]?.action === action && results[i]?.status === "failed") {
+          results.splice(i, 1);
+        }
+      }
+    };
+    let mutationCommitted = false;
+    let cancellationSafeAfterCommit = false;
+    let cancellationRequestedAfterCommit = false;
+    const throwIfAbortedBeforeCommit = () => {
+      if (!mutationCommitted || !cancellationSafeAfterCommit) {
+        throwIfAborted(abortSignal, "correction apply aborted");
+      }
+    };
+    const stopBeforeNewAction = async () => {
+      if (!abortSignal?.aborted) return false;
+      if (!mutationCommitted) {
+        try {
+          throwIfAborted(abortSignal, "correction apply aborted");
+        } catch (error) {
+          await resetApplying();
+          throw error;
+        }
+      }
+      cancellationRequestedAfterCommit = true;
+      return true;
+    };
+    const throwIfAbortedBeforeCommitAndReset = async () => {
+      try {
+        throwIfAbortedBeforeCommit();
+      } catch (error) {
+        if (!mutationCommitted) await resetApplying();
+        const reason = abortSignal?.reason;
+        if (reason instanceof Error && reason.name !== "AbortError") throw reason;
+        throw error;
+      }
+    };
     for (const action of plan.actions) {
+      if (await stopBeforeNewAction()) break;
       if (action.kind === "supersede" && action.replacement) {
-        const loser = await this.deps.getMemory(namespace, action.loserId);
+        let loser;
+        try {
+          loser = await this.deps.getMemory(namespace, action.loserId, abortSignal);
+        } catch (error) {
+          if (abortSignal?.aborted) {
+            if (!mutationCommitted) {
+              await resetApplying();
+              throwIfAborted(abortSignal, "correction apply aborted");
+            }
+            cancellationRequestedAfterCommit = true;
+            break;
+          }
+          throw error;
+        }
         if (!loser) {
           results.push({
             action,
@@ -3295,20 +3425,42 @@ var CorrectionExecutor = class {
           continue;
         }
         try {
-          const newId = await this.deps.writeReplacement(namespace, {
-            content: action.replacement.content,
-            ...action.replacement.category ? { category: action.replacement.category } : {},
-            ...action.replacement.confidence !== void 0 ? { confidence: action.replacement.confidence } : {},
-            ...action.replacement.tags ? { tags: action.replacement.tags } : {},
-            ...action.replacement.entityRef ? { entityRef: action.replacement.entityRef } : {},
-            ...action.replacement.validAt ? { validAt: action.replacement.validAt } : {},
-            ...action.replacement.observedAt ? { observedAt: action.replacement.observedAt } : {},
-            ...action.replacement.structuredAttributes ? { structuredAttributes: action.replacement.structuredAttributes } : {},
-            supersedes: action.loserId
-          });
+          const newId = await this.deps.writeReplacement(
+            namespace,
+            {
+              content: action.replacement.content,
+              ...action.replacement.category ? { category: action.replacement.category } : {},
+              ...action.replacement.confidence !== void 0 ? { confidence: action.replacement.confidence } : {},
+              ...action.replacement.tags ? { tags: action.replacement.tags } : {},
+              ...action.replacement.entityRef ? { entityRef: action.replacement.entityRef } : {},
+              ...action.replacement.validAt ? { validAt: action.replacement.validAt } : {},
+              ...action.replacement.observedAt ? { observedAt: action.replacement.observedAt } : {},
+              ...action.replacement.structuredAttributes ? { structuredAttributes: action.replacement.structuredAttributes } : {},
+              supersedes: action.loserId
+            },
+            abortSignal
+          );
+          mutationCommitted = true;
           results.push({ action, status: "applied", memoryId: newId });
           appliedTouched.push(newId);
+          const retirementResultBeforePhase2 = results.at(-1);
+          await this.retireAndTombstone(namespace, action, "supersession", results, appliedTouched, {
+            supersededBy: newId
+          });
+          const retirementResult = results.at(-1);
+          if (retirementResult !== retirementResultBeforePhase2 && retirementResult?.action === action && retirementResult.status === "applied") {
+            retiredReplacementActions.add(action);
+            cancellationSafeAfterCommit = true;
+          }
         } catch (err) {
+          if (abortSignal?.aborted) {
+            if (!mutationCommitted) {
+              await resetApplying();
+              throw err;
+            }
+            cancellationRequestedAfterCommit = true;
+            break;
+          }
           results.push({
             action,
             status: "failed",
@@ -3317,67 +3469,152 @@ var CorrectionExecutor = class {
         }
       } else if (action.kind === "edit") {
         try {
-          const editedId = await this.deps.applyEdit(namespace, action.memoryId, action.patch);
+          const editedId = await this.deps.applyEdit(
+            namespace,
+            action.memoryId,
+            action.patch,
+            abortSignal
+          );
+          mutationCommitted = true;
+          cancellationSafeAfterCommit = true;
           results.push({ action, status: "applied", memoryId: editedId });
           appliedTouched.push(editedId);
         } catch (err) {
+          if (abortSignal?.aborted) {
+            if (!mutationCommitted) {
+              await resetApplying();
+              throw err;
+            }
+            cancellationRequestedAfterCommit = true;
+            break;
+          }
           results.push({ action, status: "failed", error: errMsg(err) });
         }
       } else if (action.kind === "redaction_rule") {
         try {
-          await this.deps.registerRedactionRule(namespace, action.pattern);
+          await this.deps.registerRedactionRule(
+            namespace,
+            action.pattern,
+            abortSignal
+          );
+          mutationCommitted = true;
+          cancellationSafeAfterCommit = true;
           results.push({ action, status: "applied" });
         } catch (err) {
+          if (abortSignal?.aborted) {
+            if (!mutationCommitted) {
+              await resetApplying();
+              throw err;
+            }
+            cancellationRequestedAfterCommit = true;
+            break;
+          }
           results.push({ action, status: "failed", error: errMsg(err) });
         }
       }
     }
     for (const action of plan.actions) {
-      if (action.kind === "supersede") {
-        const replacementResult = results.find(
-          (r) => r.action === action && r.status === "applied"
-        );
-        if (action.replacement && !replacementResult) {
-          continue;
-        }
-        await this.retireAndTombstone(namespace, action, "supersession", results, appliedTouched, {
-          supersededBy: replacementResult?.memoryId
-        });
-      } else if (action.kind === "retract") {
-        await this.retireAndTombstone(namespace, action, "retraction", results, appliedTouched);
-      } else if (action.kind === "rescope") {
-        try {
-          const allowed = canWriteDestination ? await canWriteDestination(action.toNamespace) : true;
-          if (!allowed) {
-            results.push({
-              action,
-              status: "failed",
-              error: `rescope destination namespace not writable: ${action.toNamespace}`
-            });
+      const needsPhase2Work = action.kind === "retract" || action.kind === "rescope" || action.kind === "supersede" && !retiredReplacementActions.has(action);
+      if (needsPhase2Work && await stopBeforeNewAction()) break;
+      try {
+        if (action.kind === "supersede" && retiredReplacementActions.has(action)) continue;
+        if (action.kind === "supersede") {
+          const replacementResult = results.find((r) => r.action === action && r.status === "applied");
+          if (action.replacement && !replacementResult) {
             continue;
           }
-          const destId = await this.deps.rescopeMemory(namespace, action.memoryId, action.toNamespace);
-          results.push({ action, status: "applied", memoryId: destId });
-          appliedTouched.push(action.memoryId);
+          await this.retireAndTombstone(
+            namespace,
+            action,
+            "supersession",
+            results,
+            appliedTouched,
+            { supersededBy: replacementResult?.memoryId },
+            abortSignal
+          );
+          if (results.at(-1)?.status === "applied") {
+            mutationCommitted = true;
+            cancellationSafeAfterCommit = true;
+          }
+          if (results.at(-1)?.action === action && results.at(-1)?.status === "applied") {
+            removeFailedResultsFor(action);
+          }
+        } else if (action.kind === "retract") {
+          await this.retireAndTombstone(
+            namespace,
+            action,
+            "retraction",
+            results,
+            appliedTouched,
+            {},
+            abortSignal
+          );
+          if (results.at(-1)?.status === "applied") {
+            mutationCommitted = true;
+            cancellationSafeAfterCommit = true;
+          }
+          if (results.at(-1)?.action === action && results.at(-1)?.status === "applied") {
+            removeFailedResultsFor(action);
+          }
+        } else if (action.kind === "rescope") {
           try {
-            await this.deps.propagate(action.toNamespace, [destId]);
-          } catch {
+            const allowed = canWriteDestination ? await canWriteDestination(action.toNamespace) : true;
+            if (!allowed) {
+              results.push({
+                action,
+                status: "failed",
+                error: `rescope destination namespace not writable: ${action.toNamespace}`
+              });
+              continue;
+            }
+            const destId = await this.deps.rescopeMemory(
+              namespace,
+              action.memoryId,
+              action.toNamespace,
+              abortSignal
+            );
+            mutationCommitted = true;
+            cancellationSafeAfterCommit = true;
+            results.push({ action, status: "applied", memoryId: destId });
+            appliedTouched.push(action.memoryId);
+            try {
+              await this.deps.propagate(action.toNamespace, [destId], void 0);
+            } catch {
+            }
+          } catch (err) {
+            if (abortSignal?.aborted) {
+              if (!mutationCommitted) throw err;
+              cancellationRequestedAfterCommit = true;
+              break;
+            }
+            results.push({ action, status: "failed", error: errMsg(err) });
           }
-        } catch (err) {
-          results.push({ action, status: "failed", error: errMsg(err) });
         }
+      } catch (err) {
+        if (abortSignal?.aborted) {
+          if (!mutationCommitted) {
+            await resetApplying();
+            throw err;
+          }
+          cancellationRequestedAfterCommit = true;
+          break;
+        }
+        throw err;
       }
     }
+    await throwIfAbortedBeforeCommitAndReset();
     const propagationWarnings = [];
     if (appliedTouched.length > 0) {
       try {
-        await this.deps.propagate(namespace, appliedTouched);
+        await this.deps.propagate(namespace, appliedTouched, cancellationSafeAfterCommit ? void 0 : abortSignal);
       } catch (err) {
+        if ((!mutationCommitted || !cancellationSafeAfterCommit) && abortSignal?.aborted) throw err;
         propagationWarnings.push(`propagation failed (non-fatal): ${errMsg(err)}`);
       }
     }
+    await throwIfAbortedBeforeCommitAndReset();
     const anyFailed = results.some((r) => r.status === "failed");
-    const status = anyFailed ? "partial" : "applied";
+    const status = anyFailed || cancellationRequestedAfterCommit ? "partial" : "applied";
     const appliedAt = this.deps.now().toISOString();
     const outcome = {
       planId,
@@ -3391,19 +3628,25 @@ var CorrectionExecutor = class {
       outcome.warnings = propagationWarnings;
     }
     try {
-      const auditId = await this.deps.appendAuditRecord(namespace, {
-        planId,
-        classification: plan.classification,
-        outcome,
-        requestText: plan.request.text
-      });
+      const auditId = await this.deps.appendAuditRecord(
+        namespace,
+        {
+          planId,
+          classification: plan.classification,
+          outcome,
+          requestText: plan.request.text
+        },
+        cancellationSafeAfterCommit ? void 0 : abortSignal
+      );
       outcome.auditMemoryId = auditId;
     } catch (err) {
+      if ((!mutationCommitted || !cancellationSafeAfterCommit) && abortSignal?.aborted) throw err;
       outcome.warnings = [
         ...propagationWarnings,
         `audit record write failed (non-fatal): ${errMsg(err)}`
       ];
     }
+    await throwIfAbortedBeforeCommitAndReset();
     try {
       await this.planner.markConsumed(namespace, planId, status);
     } catch (err) {
@@ -3412,11 +3655,11 @@ var CorrectionExecutor = class {
     }
     return outcome;
   }
-  async retireAndTombstone(namespace, action, reason, results, appliedTouched, opts = {}) {
+  async retireAndTombstone(namespace, action, reason, results, appliedTouched, opts = {}, abortSignal) {
     const memoryId = action.kind === "supersede" ? action.loserId : action.kind === "retract" ? action.memoryId : null;
     if (!memoryId) return;
     try {
-      const memory = await this.deps.getMemory(namespace, memoryId);
+      const memory = await this.deps.getMemory(namespace, memoryId, abortSignal);
       if (!memory) {
         results.push({
           action,
@@ -3426,25 +3669,34 @@ var CorrectionExecutor = class {
         return;
       }
       const validUntil = this.deps.biTemporalEnabled ? this.deps.now().toISOString() : void 0;
-      const tombstoneId = await this.deps.appendTombstone(namespace, {
-        reason,
-        sourceMemoryId: memoryId,
-        rawContent: memory.rawContent,
-        ...memory.entityRef ? { entityRef: memory.entityRef } : {},
-        ...memory.supersessionKey ? { supersessionKey: memory.supersessionKey } : {},
-        // #1672 item 4: carry the canonical contentHash (exact tier) and the
-        // full supersession-key set (keyed tier) so paraphrased re-observations
-        // of the same supersession identity are blocked, not just the literal
-        // body. Without these the tombstone projected from a structured fact
-        // dropped both fields and the fact could resurrect.
-        ...memory.contentHash ? { contentHash: memory.contentHash } : {},
-        ...memory.supersessionKeys && memory.supersessionKeys.length > 0 ? { supersessionKeys: memory.supersessionKeys } : {}
-      });
-      await this.deps.retireMemory(namespace, memoryId, {
-        status: reason === "supersession" ? "superseded" : "retracted",
-        ...opts.supersededBy ? { supersededBy: opts.supersededBy } : {},
-        ...validUntil ? { validUntil } : {}
-      });
+      const tombstoneId = await this.deps.appendTombstone(
+        namespace,
+        {
+          reason,
+          sourceMemoryId: memoryId,
+          rawContent: memory.rawContent,
+          ...memory.entityRef ? { entityRef: memory.entityRef } : {},
+          ...memory.supersessionKey ? { supersessionKey: memory.supersessionKey } : {},
+          // #1672 item 4: carry the canonical contentHash (exact tier) and the
+          // full supersession-key set (keyed tier) so paraphrased re-observations
+          // of the same supersession identity are blocked, not just the literal
+          // body. Without these the tombstone projected from a structured fact
+          // dropped both fields and the fact could resurrect.
+          ...memory.contentHash ? { contentHash: memory.contentHash } : {},
+          ...memory.supersessionKeys && memory.supersessionKeys.length > 0 ? { supersessionKeys: memory.supersessionKeys } : {}
+        },
+        abortSignal
+      );
+      await this.deps.retireMemory(
+        namespace,
+        memoryId,
+        {
+          status: reason === "supersession" ? "superseded" : "retracted",
+          ...opts.supersededBy ? { supersededBy: opts.supersededBy } : {},
+          ...validUntil ? { validUntil } : {}
+        },
+        tombstoneId === null ? abortSignal : void 0
+      );
       results.push({
         action,
         status: "applied",
@@ -3453,6 +3705,7 @@ var CorrectionExecutor = class {
       });
       appliedTouched.push(memoryId);
     } catch (err) {
+      if (abortSignal?.aborted) throw err;
       results.push({ action, status: "failed", error: errMsg(err) });
     }
   }
@@ -3490,17 +3743,16 @@ var CorrectionService = class {
    * the principal can write, so reading from a non-writable namespace to
    * draft a correction that can never be applied would be misleading.
    */
-  async plan(request) {
+  async plan(request, opts) {
     this.requireEnabled();
+    throwIfAborted(opts?.abortSignal, "correction planning aborted");
     const authorized = await this.deps.policy.resolveAuthorizedNamespace(request);
-    return this.planner.plan(request, [authorized]);
+    throwIfAborted(opts?.abortSignal, "correction planning aborted");
+    return this.planner.plan(request, [authorized], opts);
   }
-  /**
-   * Apply a persisted plan by id. Requires `confirm: true` (or interactive
-   * yes at the CLI) when `applyRequiresConfirm` is on (default).
-   */
   async apply(planId, opts) {
     this.requireEnabled();
+    throwIfAborted(opts.abortSignal, "correction apply aborted");
     if (this.deps.applyRequiresConfirm() && opts.confirm !== true) {
       throw new CorrectionContractError(
         "Correction apply requires explicit confirmation (pass `confirm: true`)."
@@ -3511,8 +3763,10 @@ var CorrectionService = class {
       ...opts.sessionKey ? { sessionKey: opts.sessionKey } : {},
       ...opts.principal ? { principal: opts.principal } : {}
     });
+    throwIfAborted(opts.abortSignal, "correction apply aborted");
     return this.executor.apply(namespace, planId, {
       confirm: true,
+      abortSignal: opts.abortSignal,
       // Authorize rescope destinations through the namespace policy bound to
       // THIS caller's principal (review thread: authorize-rescope-destination).
       canWriteDestination: (dest) => this.deps.policy.canWriteNamespace({
@@ -3809,27 +4063,32 @@ function describeAfterState(action) {
 }
 function makeExecutorDeps(wiring, opts) {
   return {
-    getMemory: async (namespace, memoryId) => getExecutorMemory(wiring, namespace, memoryId),
-    writeReplacement: async (namespace, draft) => writeReplacementMemory(wiring, namespace, draft),
-    applyEdit: async (namespace, memoryId, patch) => applyEditMemory(wiring, namespace, memoryId, patch),
-    retireMemory: async (namespace, memoryId, retireOpts) => retireMemoryFn(wiring, namespace, memoryId, retireOpts),
-    rescopeMemory: async (namespace, memoryId, toNamespace) => rescopeMemoryFn(wiring, namespace, memoryId, toNamespace),
-    appendTombstone: async (namespace, input) => appendTombstoneFn(wiring, namespace, input),
-    registerRedactionRule: async (namespace, pattern) => registerRedactionRuleFn(wiring, namespace, pattern),
-    appendAuditRecord: async (namespace, record) => appendAuditRecordFn(wiring, namespace, record),
-    propagate: async (namespace, touchedMemoryIds) => propagateFn(wiring, namespace, touchedMemoryIds),
+    getMemory: async (namespace, memoryId, abortSignal) => getExecutorMemory(wiring, namespace, memoryId, abortSignal),
+    writeReplacement: async (namespace, draft, abortSignal) => writeReplacementMemory(wiring, namespace, draft, abortSignal),
+    applyEdit: async (namespace, memoryId, patch, abortSignal) => applyEditMemory(wiring, namespace, memoryId, patch, abortSignal),
+    retireMemory: async (namespace, memoryId, retireOpts, abortSignal) => retireMemoryFn(wiring, namespace, memoryId, retireOpts, abortSignal),
+    rescopeMemory: async (namespace, memoryId, toNamespace, abortSignal) => rescopeMemoryFn(wiring, namespace, memoryId, toNamespace, abortSignal),
+    appendTombstone: async (namespace, input, abortSignal) => appendTombstoneFn(wiring, namespace, input, abortSignal),
+    registerRedactionRule: async (namespace, pattern, abortSignal) => registerRedactionRuleFn(wiring, namespace, pattern, abortSignal),
+    appendAuditRecord: async (namespace, record, abortSignal) => appendAuditRecordFn(wiring, namespace, record, abortSignal),
+    propagate: async (namespace, touchedMemoryIds, abortSignal) => propagateFn(wiring, namespace, touchedMemoryIds, abortSignal),
     biTemporalEnabled: opts.biTemporalEnabled,
     now: () => /* @__PURE__ */ new Date()
   };
 }
-async function getExecutorMemory(wiring, namespace, memoryId) {
+async function getExecutorMemory(wiring, namespace, memoryId, abortSignal) {
+  throwIfAborted(abortSignal, "correction apply aborted");
   const storage = await wiring.orchestrator.getStorage(namespace);
+  throwIfAborted(abortSignal, "correction apply aborted");
   const m = await storage.getMemoryById(memoryId);
+  throwIfAborted(abortSignal, "correction apply aborted");
   if (!m) return null;
   return toExecutorMemory(m);
 }
-async function writeReplacementMemory(wiring, namespace, draft) {
+async function writeReplacementMemory(wiring, namespace, draft, abortSignal) {
+  throwIfAborted(abortSignal, "correction apply aborted");
   const storage = await wiring.orchestrator.getStorage(namespace);
+  throwIfAborted(abortSignal, "correction apply aborted");
   if (draft.category !== void 0 && !isMemoryCategory(draft.category)) {
     throw new CorrectionContractError(
       `correction draft carries unrecognized category ${JSON.stringify(draft.category)} \u2014 expected a valid memory category`
@@ -3852,6 +4111,7 @@ async function writeReplacementMemory(wiring, namespace, draft) {
   if (draftEnvelope.salvageNotes.length > 0) {
     log.warn(`correction write salvaged invalid fields: ${draftEnvelope.salvageNotes.join("; ")}`);
   }
+  throwIfAborted(abortSignal, "correction apply aborted");
   const { id, tombstoneBlocked } = await storage.writeSealedMemory(draftEnvelope, {
     ...draft.observedAt ? { observedAt: draft.observedAt } : {},
     ...draft.supersedes ? { supersedes: draft.supersedes } : {}
@@ -3863,11 +4123,15 @@ async function writeReplacementMemory(wiring, namespace, draft) {
   }
   return id;
 }
-async function applyEditMemory(wiring, namespace, memoryId, patch) {
+async function applyEditMemory(wiring, namespace, memoryId, patch, abortSignal) {
+  throwIfAborted(abortSignal, "correction apply aborted");
   const storage = await wiring.orchestrator.getStorage(namespace);
+  throwIfAborted(abortSignal, "correction apply aborted");
   const existing = await storage.getMemoryById(memoryId);
+  throwIfAborted(abortSignal, "correction apply aborted");
   if (!existing) throw new CorrectionContractError(`memory not found for edit: ${memoryId}`);
   const contentHashForPatch = existing.frontmatter.category === "fact" ? computeContentHash(sanitizeMemoryContent(patch).text) : void 0;
+  throwIfAborted(abortSignal, "correction apply aborted");
   await storage.writeMemoryFrontmatter(
     { ...existing, content: patch },
     {
@@ -3877,29 +4141,37 @@ async function applyEditMemory(wiring, namespace, memoryId, patch) {
   );
   return memoryId;
 }
-async function retireMemoryFn(wiring, namespace, memoryId, opts) {
+async function retireMemoryFn(wiring, namespace, memoryId, opts, abortSignal) {
+  throwIfAborted(abortSignal, "correction apply aborted");
   const storage = await wiring.orchestrator.getStorage(namespace);
+  throwIfAborted(abortSignal, "correction apply aborted");
   const memory = await storage.getMemoryById(memoryId);
+  throwIfAborted(abortSignal, "correction apply aborted");
   if (!memory) throw new CorrectionContractError(`memory not found for retire: ${memoryId}`);
   const storageStatus = opts.status === "retracted" ? "forgotten" : "superseded";
+  throwIfAborted(abortSignal, "correction apply aborted");
   await storage.writeMemoryFrontmatter(memory, {
     status: storageStatus,
     ...opts.supersededBy ? { supersededBy: opts.supersededBy } : {},
     ...opts.status === "superseded" ? { supersededAt: (/* @__PURE__ */ new Date()).toISOString() } : {},
-    // validUntil is the bi-temporal end; absent when the gate is off.
     ...opts.validUntil ? { invalid_at: opts.validUntil } : {}
   });
 }
-async function rescopeMemoryFn(wiring, namespace, memoryId, toNamespace) {
+async function rescopeMemoryFn(wiring, namespace, memoryId, toNamespace, abortSignal) {
+  throwIfAborted(abortSignal, "correction apply aborted");
   const sourceStorage = await wiring.orchestrator.getStorage(namespace);
+  throwIfAborted(abortSignal, "correction apply aborted");
   const memory = await sourceStorage.getMemoryById(memoryId);
+  throwIfAborted(abortSignal, "correction apply aborted");
   if (!memory) throw new CorrectionContractError(`memory not found for rescope: ${memoryId}`);
   if (memory.frontmatter.status && memory.frontmatter.status !== "active") {
     throw new CorrectionContractError(
       `cannot rescope memory ${memoryId}: source is ${memory.frontmatter.status}, not active`
     );
   }
+  throwIfAborted(abortSignal, "correction apply aborted");
   const destStorage = await wiring.orchestrator.getStorage(toNamespace);
+  throwIfAborted(abortSignal, "correction apply aborted");
   const fm = memory.frontmatter;
   const destContent = fm.structuredAttributes ? stripAttributesSuffix(memory.content) : memory.content;
   const rescopeEnvelope = composeMemoryEnvelope(
@@ -3918,6 +4190,7 @@ async function rescopeMemoryFn(wiring, namespace, memoryId, toNamespace) {
   if (rescopeEnvelope.salvageNotes.length > 0) {
     log.warn(`rescope write salvaged invalid fields: ${rescopeEnvelope.salvageNotes.join("; ")}`);
   }
+  throwIfAborted(abortSignal, "correction apply aborted");
   const { id: destId, tombstoneBlocked: destBlocked } = await destStorage.writeSealedMemory(rescopeEnvelope, {
     ...fm.observedAt ? { observedAt: fm.observedAt } : {},
     ...fm.memoryKind ? { memoryKind: fm.memoryKind } : {},
@@ -3949,13 +4222,17 @@ async function rescopeMemoryFn(wiring, namespace, memoryId, toNamespace) {
   }
   return destId;
 }
-async function appendTombstoneFn(wiring, namespace, input) {
+async function appendTombstoneFn(wiring, namespace, input, abortSignal) {
+  throwIfAborted(abortSignal, "correction apply aborted");
   const storage = await wiring.orchestrator.getStorage(namespace);
+  throwIfAborted(abortSignal, "correction apply aborted");
   const enabled = typeof storage.isTombstonesEnabled === "function" ? storage.isTombstonesEnabled() : true;
   const keys = input.supersessionKeys && input.supersessionKeys.length > 0 ? input.supersessionKeys : input.supersessionKey ? [input.supersessionKey] : [void 0];
   const writtenIds = [];
   let firstId = null;
+  let committed = false;
   for (const key of keys) {
+    if (!committed) throwIfAborted(abortSignal, "correction apply aborted");
     const result = await storage.appendTombstone({
       reason: input.reason,
       createdBy: "user_correction",
@@ -3977,26 +4254,37 @@ async function appendTombstoneFn(wiring, namespace, input) {
       );
     }
     if (firstId === null) firstId = result;
-    if (result) writtenIds.push(result);
+    if (result) {
+      writtenIds.push(result);
+      committed = true;
+    }
   }
   return firstId;
 }
-async function registerRedactionRuleFn(wiring, namespace, pattern) {
+async function registerRedactionRuleFn(wiring, namespace, pattern, abortSignal) {
+  throwIfAborted(abortSignal, "correction apply aborted");
   const storage = await wiring.orchestrator.getStorage(namespace);
+  throwIfAborted(abortSignal, "correction apply aborted");
   const dir = path5.join(storage.dir, "state", "corrections", "redaction-rules");
   await mkdir3(dir, { recursive: true });
+  throwIfAborted(abortSignal, "correction apply aborted");
   const slugBase = pattern.replace(/[^a-zA-Z0-9]+/g, "-").slice(0, 48) || "rule";
   const patternHash = createHash2("sha256").update(pattern).digest("hex").slice(0, 16);
   const slug = `${slugBase}-${patternHash}`;
+  throwIfAborted(abortSignal, "correction apply aborted");
   await writeFile3(
     path5.join(dir, `${slug}.json`),
     `${JSON.stringify({ pattern, namespace, createdAt: (/* @__PURE__ */ new Date()).toISOString() })}
 `,
     "utf-8"
   );
+  throwIfAborted(abortSignal, "correction apply aborted");
 }
-async function appendAuditRecordFn(wiring, namespace, record) {
+async function appendAuditRecordFn(wiring, namespace, record, abortSignal) {
+  throwIfAborted(abortSignal, "correction apply aborted");
   const storage = await wiring.orchestrator.getStorage(namespace);
+  throwIfAborted(abortSignal, "correction apply aborted");
+  throwIfAborted(abortSignal, "correction apply aborted");
   const { id } = await storage.writeSealedMemory(
     composeMemoryEnvelope(
       {
@@ -4009,6 +4297,7 @@ async function appendAuditRecordFn(wiring, namespace, record) {
     ),
     {}
   );
+  throwIfAborted(abortSignal, "correction apply aborted");
   return id;
 }
 function buildAuditBody(record) {
@@ -4030,15 +4319,19 @@ function buildAuditBody(record) {
   }
   return lines.join("\n");
 }
-async function propagateFn(wiring, namespace, touchedMemoryIds) {
+async function propagateFn(wiring, namespace, touchedMemoryIds, abortSignal) {
   for (const id of touchedMemoryIds) {
+    throwIfAborted(abortSignal, "correction apply aborted");
     try {
       const storage = await wiring.orchestrator.getStorage(namespace);
+      throwIfAborted(abortSignal, "correction apply aborted");
       const orchestrator = wiring.orchestrator;
       if (typeof orchestrator.indexPersistedMemory === "function") {
         await orchestrator.indexPersistedMemory(storage, id);
+        throwIfAborted(abortSignal, "correction apply aborted");
       }
-    } catch {
+    } catch (err) {
+      if (abortSignal?.aborted) throw err;
     }
   }
 }
@@ -4387,6 +4680,7 @@ async function capturePassiveCorrections(corrections, ctx, config, deps, dedupSt
   const plans = [];
   telemetry.detected = corrections.length;
   for (const correction of corrections) {
+    if (ctx.abortSignal?.aborted) return { telemetry, plans };
     const fp = correctionFingerprint(ctx.bufferKey, correction);
     if (dedupState.has(fp)) {
       continue;
@@ -4409,13 +4703,14 @@ async function capturePassiveCorrections(corrections, ctx, config, deps, dedupSt
     };
     let plan;
     try {
-      plan = await deps.planCorrection(request);
+      plan = await deps.planCorrection(request, { abortSignal: ctx.abortSignal });
     } catch (err) {
       log.warn(
         `passive-correction: planning failed for "${correction.targetHint.slice(0, 60)}": ${err instanceof Error ? err.message : String(err)}`
       );
       continue;
     }
+    if (ctx.abortSignal?.aborted) return { telemetry, plans };
     plans.push(plan);
     dedupState.add(fp);
     if (config.mode === "queue") {
@@ -4433,7 +4728,8 @@ async function capturePassiveCorrections(corrections, ctx, config, deps, dedupSt
         confirm: true,
         namespace: ctx.namespace,
         ...ctx.sessionKey ? { sessionKey: ctx.sessionKey } : {},
-        ...ctx.principal ? { principal: ctx.principal } : {}
+        ...ctx.principal ? { principal: ctx.principal } : {},
+        abortSignal: ctx.abortSignal
       });
       if (outcome.status !== "applied") {
         log.warn(
@@ -4878,6 +5174,7 @@ var OPERATION_NAMES = [
   "observe",
   "lcm_search",
   "lcm_compaction_flush",
+  "extraction_force_flush",
   "lcm_compaction_record",
   "continuity_audit_generate",
   "continuity_incident_open",
@@ -5581,12 +5878,524 @@ import * as nodePath3 from "path";
 
 // src/access-observe-write-surface.ts
 import { createHash as createHash4 } from "crypto";
+
+// src/orchestration/session-context.ts
+var SessionOwnershipError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SessionOwnershipError";
+  }
+};
+var MAX_SET_TIMEOUT_MS = 2147483647;
+async function awaitSessionFlushPhase(task, options) {
+  const abortMessage = options.reason === "access_force_flush" ? "extraction force-flush aborted" : "session flush aborted";
+  throwIfAborted(options.abortSignal, abortMessage);
+  const deadline = options.extractionDeadlineMs;
+  if (typeof deadline === "number" && Date.now() >= deadline) {
+    options.onDeadline?.();
+    throw new ExtractionDeadlineError(options.deadlineStage ?? "before_buffer_flush");
+  }
+  const taskPromise = Promise.resolve().then(task);
+  if (!options.abortSignal && typeof deadline !== "number") return taskPromise;
+  let abortHandler;
+  let deadlineTimer;
+  const abortPromise = options.abortSignal === void 0 ? void 0 : new Promise((_resolve, reject) => {
+    abortHandler = () => reject(abortError(abortMessage));
+    options.abortSignal?.addEventListener("abort", abortHandler, { once: true });
+  });
+  const deadlinePromise = typeof deadline !== "number" ? void 0 : new Promise((_resolve, reject) => {
+    const schedule = () => {
+      const remainingMs = deadline - Date.now();
+      if (remainingMs <= 0) {
+        options.onDeadline?.();
+        reject(new ExtractionDeadlineError(options.deadlineStage ?? "before_buffer_flush"));
+        return;
+      }
+      deadlineTimer = setTimeout(schedule, Math.min(remainingMs, MAX_SET_TIMEOUT_MS));
+      deadlineTimer.unref?.();
+    };
+    schedule();
+  });
+  const races = [taskPromise];
+  if (abortPromise) races.push(abortPromise);
+  if (deadlinePromise) races.push(deadlinePromise);
+  try {
+    return await Promise.race(races);
+  } finally {
+    if (abortHandler && options.abortSignal) {
+      options.abortSignal.removeEventListener("abort", abortHandler);
+    }
+    if (deadlineTimer) clearTimeout(deadlineTimer);
+  }
+}
+var SessionContextCoordinator = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  deps;
+  /**
+   * Effective namespace a same-session LCM/structured-history READER must use
+   * to find what the access `observe` surface WROTE (#1495 thread 2).
+   *
+   * This MUST mirror the `observe` scope plan's write-namespace resolution, NOT
+   * `resolveSelfNamespace`: when no coding overlay applies, `observe` archives
+   * under `config.defaultNamespace` (an unqualified observed turn is NOT moved
+   * to the principal self namespace — identical to
+   * `resolveCodingScopedWriteNamespace`/`memory_store`, rule 39). Only when a
+   * coding overlay actually changes the namespace does the writer (and so the
+   * reader) use the overlaid `project-*` namespace. Returning the self base for
+   * the no-overlay case would prefix the read key with a namespace the writer
+   * never used, so the reader would miss its own evidence.
+   *
+   * Honours the access-surface `principalOverride` (#1505 thread 2, codex): when
+   * a recall supplies an authenticated principal NOT encoded in the raw
+   * `sessionKey`, `observe` archived LCM under THAT principal's base namespace.
+   * Deriving the base from `resolvePrincipal(sessionKey)` alone could fall back
+   * to `default`, so principal `alice` observing `sess-1` would write under
+   * `alice` but READ under `default`. Threading the override here keeps the read
+   * base identical to the write base.
+   *
+   * READ-AUTHORIZATION gate (#1505 round 3, codex P2 "Gate LCM recall keys by
+   * readable namespaces"): the overlay LCM read key is a `<principal>-project-*`
+   * sub-namespace of the principal SELF base. The normal recall namespace set
+   * below only substitutes the coding overlay when the principal SELF base is
+   * actually in the readable recall set (`recallNamespacesForPrincipal` — gated
+   * by `defaultRecallNamespaces.includes("self")` AND `canReadNamespace`). If a
+   * principal can WRITE but not READ its self namespace (or `defaultRecall-
+   * Namespaces` omits `self`), QMD/file recall never touches those overlay rows,
+   * so neither may the LCM read key. When the self base is NOT readable, fall
+   * back to the default store — exactly what an unqualified, unauthorized recall
+   * resolves to — rather than injecting overlay rows the rest of recall excludes
+   * (rule 42 read/write parity; rule 48 least-privilege).
+   */
+  lcmReadNamespaceForSession(sessionKey, principalOverride) {
+    const principal = typeof principalOverride === "string" && principalOverride.length > 0 ? principalOverride : this.deps.resolvePrincipal(sessionKey);
+    const base = defaultNamespaceForPrincipal(principal, this.deps.config);
+    const overlaid = this.deps.applyCodingNamespaceOverlay(sessionKey, base);
+    if (overlaid === base) return this.deps.config.defaultNamespace;
+    const selfReadableInRecall = recallNamespacesForPrincipal(
+      principal,
+      this.deps.config
+    ).includes(base);
+    return selfReadableInRecall ? overlaid : this.deps.config.defaultNamespace;
+  }
+  /**
+   * Attach a coding-agent context to a session (issue #569). Called by the
+   * Claude Code / Codex / Cursor connectors at session start after
+   * `resolveGitContext(cwd)`. The context is consulted by the recall path
+   * and the write path so that memories route to a project- (and optionally
+   * branch-) scoped namespace.
+   *
+   * Pass `null` to clear.
+   */
+  setCodingContextForSession(sessionKey, codingContext) {
+    if (typeof sessionKey !== "string" || sessionKey.length === 0) return;
+    this.deps.ensureSessionBindingMaps();
+    if (codingContext === null) {
+      this.deps._codingContextBySession.delete(sessionKey);
+      return;
+    }
+    this.deps._codingContextBySession.set(sessionKey, codingContext);
+  }
+  /**
+   * Read-only accessor for the coding context attached to a session. Returns
+   * `null` when none is set. Used by `remnic doctor` and by tests.
+   *
+   * Defensive `_codingContextBySession` lookup — legacy orchestrator-flush
+   * tests use `Object.create(Orchestrator.prototype)` which does not run
+   * class-field initializers, so the Map may be undefined on stubs.
+   */
+  getCodingContextForSession(sessionKey) {
+    if (typeof sessionKey !== "string" || sessionKey.length === 0) return null;
+    return this.deps._codingContextBySession?.get(sessionKey) ?? null;
+  }
+  /**
+   * Shared helper used by both the recall path and the write path (rule 42).
+   *
+   * Given a base namespace computed from the principal, returns the overlaid
+   * coding namespace when the session has a coding context AND
+   * `codingMode.projectScope` is true AND `namespacesEnabled` is true.
+   * Otherwise returns `baseNamespace` unchanged — CLAUDE.md #30 escape hatch.
+   *
+   * Principal isolation (CLAUDE.md rule 42): the overlay is COMBINED with
+   * the principal-derived `baseNamespace` rather than replacing it, so two
+   * principals working in the same repository do not share memories through
+   * a common `project-*` namespace.
+   *
+   * Namespaces-disabled gate: when `namespacesEnabled` is false, the
+   * storage router maps every namespace to the same `memoryDir`. Returning
+   * `project-*` in that mode would create apparent route separation with
+   * no actual storage isolation — a false-isolation trap. In that mode we
+   * return `baseNamespace` unchanged so coding mode degrades to the existing
+   * unscoped behavior.
+   *
+   * @internal
+   */
+  applyCodingNamespaceOverlay(sessionKey, baseNamespace) {
+    if (!resolveNamespaceCapabilities(this.deps.config).namespaces) return baseNamespace;
+    const codingContext = this.deps.getCodingContextForSession(sessionKey);
+    const overlay = resolveCodingNamespaceOverlay(codingContext, this.deps.config.codingMode, this.deps.config.defaultNamespace);
+    if (!overlay) return baseNamespace;
+    return combineNamespaces(baseNamespace, overlay.namespace);
+  }
+  /**
+   * Register a peer ID for a session so recall can inject the peer's
+   * profile into context (issue #679 PR 3/5). Pass `null` to clear.
+   *
+   * Connectors and the `before_agent_start` hook call this when the
+   * session's counter-party is known. The ID is validated against
+   * `PEER_ID_PATTERN` before storing.
+   *
+   * Fail-closed (Codex P1 review): an invalid peerId clears any
+   * previously registered mapping for the session rather than silently
+   * keeping stale data. This prevents a malformed metadata update from
+   * mixing one peer's profile context into another session.
+   *
+   * Defensive init (Cursor review + rule 16): `Object.create(
+   * Orchestrator.prototype)` stubs in legacy tests skip class-field
+   * initializers, so `_peerIdBySession` may be undefined. Mirror the
+   * same guard used by `setCodingContextForSession`.
+   */
+  setPeerIdForSession(sessionKey, peerId) {
+    if (typeof sessionKey !== "string" || sessionKey.length === 0) return;
+    this.deps.ensureSessionBindingMaps();
+    if (peerId === null) {
+      this.deps._peerIdBySession.delete(sessionKey);
+      return;
+    }
+    if (typeof peerId !== "string" || peerId.length === 0 || peerId.length > 64 || !/^[A-Za-z0-9]+(?:[._-][A-Za-z0-9]+)*$/.test(peerId)) {
+      log.warn(`setPeerIdForSession: invalid peerId \u2014 clearing session mapping`);
+      this.deps._peerIdBySession.delete(sessionKey);
+      return;
+    }
+    this.deps._peerIdBySession.set(sessionKey, peerId);
+  }
+  /**
+   * Return the peer ID registered for a session, or `null` when none
+   * is set. Used by `recallInternal` to inject the peer profile section.
+   * Defensive `_peerIdBySession` lookup — legacy orchestrator-flush tests
+   * use `Object.create(Orchestrator.prototype)` which skips class-field
+   * initializers, so the Map may be undefined on stubs.
+   */
+  getPeerIdForSession(sessionKey) {
+    if (typeof sessionKey !== "string" || sessionKey.length === 0) return null;
+    return this.deps._peerIdBySession?.get(sessionKey) ?? null;
+  }
+  async runDeepSleepGovernanceNow(options) {
+    const targetStorage = options?.storage ?? this.deps.storage;
+    const { runMemoryGovernance: runMemoryGovernance3 } = await import("./maintenance/memory-governance.js");
+    const { summarizeGovernanceResultForDreams } = await import("./dreams-ledger-567VKVOU.js");
+    const govResult = await runMemoryGovernance3({
+      memoryDir: targetStorage.dir,
+      mode: options?.dryRun === true ? "shadow" : "apply"
+    });
+    if (options?.dryRun !== true) {
+      try {
+        await this.deps.entitySynthesisCoordinator.processQueue(
+          this.deps.storageDirNamespace(targetStorage.dir),
+          5
+        );
+      } catch (error) {
+        log.debug(`deep-sleep governance: entity synthesis refresh failed after apply: ${error}`);
+      }
+    }
+    return summarizeGovernanceResultForDreams(govResult, options?.dryRun === true);
+  }
+  async generateDaySummary(memories) {
+    if (this.deps.initPromise) {
+      let initGateTimeoutHandle;
+      try {
+        await Promise.race([
+          this.deps.initPromise.catch(() => void 0),
+          new Promise((resolve4) => {
+            initGateTimeoutHandle = setTimeout(
+              resolve4,
+              this.deps.config.initGateTimeoutMs
+            );
+          })
+        ]);
+      } finally {
+        if (initGateTimeoutHandle) clearTimeout(initGateTimeoutHandle);
+      }
+    }
+    return this.deps.extraction.generateDaySummary(memories);
+  }
+  async flushSession(sessionKey, options) {
+    if (typeof this.deps.buffer.flushPendingSave === "function") {
+      await awaitSessionFlushPhase(
+        () => this.deps.buffer.flushPendingSave({ throwOnFailure: true }),
+        options
+      );
+    } else {
+      throwIfAborted(
+        options.abortSignal,
+        options.reason === "access_force_flush" ? "extraction force-flush aborted" : "session flush aborted"
+      );
+      if (typeof options.extractionDeadlineMs === "number" && Date.now() >= options.extractionDeadlineMs) {
+        throw new ExtractionDeadlineError("before_buffer_flush");
+      }
+    }
+    const explicitBufferKey = typeof options.bufferKey === "string" && options.bufferKey.length > 0 ? options.bufferKey : null;
+    const discoveredBufferKeys = explicitBufferKey || typeof sessionKey !== "string" || sessionKey.length === 0 || typeof this.deps.buffer.findBufferKeysForSession !== "function" ? [] : await awaitSessionFlushPhase(
+      () => this.deps.buffer.findBufferKeysForSession(sessionKey),
+      options
+    );
+    const bufferKeys = explicitBufferKey ? [explicitBufferKey] : discoveredBufferKeys.length > 0 ? discoveredBufferKeys : typeof sessionKey === "string" && sessionKey.length > 0 ? [sessionKey] : ["default"];
+    const namespacesEnabled = this.deps.config === void 0 || resolveNamespaceCapabilities(this.deps.config).namespaces === true;
+    const scopedRequest = typeof options.writeNamespaceOverride === "string" || typeof options.principalOverride === "string";
+    const ownershipEnforced = namespacesEnabled && scopedRequest;
+    const ownerPrincipal = typeof options.principalOverride === "string" && options.principalOverride.trim().length > 0 ? options.principalOverride.trim() : void 0;
+    const resolvedSessionPrincipal = ownershipEnforced && ownerPrincipal !== void 0 && this.deps.config ? resolvePrincipal(sessionKey, this.deps.config) : void 0;
+    const opaqueScopedSession = ownershipEnforced && ownerPrincipal !== void 0 && (resolvedSessionPrincipal === void 0 || resolvedSessionPrincipal === "default");
+    const belongsToSession = (turn) => {
+      if (turn.sessionKey !== sessionKey) return false;
+      if (!ownershipEnforced || ownerPrincipal === void 0) return true;
+      if (turn.sessionOwnerPrincipal === ownerPrincipal) return true;
+      return turn.sessionOwnerPrincipal === void 0 && this.deps.config !== void 0 && resolvePrincipal(turn.sessionKey, this.deps.config) === ownerPrincipal;
+    };
+    if (opaqueScopedSession && bufferKeys.some(
+      (bufferKey) => this.deps.buffer.getTurns(bufferKey).some((turn) => turn.sessionKey === sessionKey && turn.sessionOwnerPrincipal === void 0)
+    )) {
+      throw new SessionOwnershipError(
+        `session ${sessionKey} has buffered turns without trusted ownership`
+      );
+    }
+    for (const bufferKey of bufferKeys) {
+      const turns = this.deps.buffer.getTurns(bufferKey);
+      const turnsForSession = scopedRequest ? turns.filter(belongsToSession) : turns;
+      if (turnsForSession.length === 0) continue;
+      const retainedTurnsForOtherSessions = scopedRequest && typeof this.deps.buffer.getRetainedDeferredTurns === "function" ? this.deps.buffer.getRetainedDeferredTurns(bufferKey).filter((turn) => !belongsToSession(turn)) : [];
+      try {
+        await new Promise((resolve4, reject) => {
+          void this.deps.queueBufferedExtraction(turnsForSession, "trigger_mode", {
+            bufferKey,
+            clearBufferAfterExtraction: true,
+            skipDedupeCheck: true,
+            skipCharThreshold: true,
+            skipUserTurnThreshold: true,
+            failOnExtractionFailure: options.failOnExtractionFailure === true,
+            forceExtractionAttempt: true,
+            abortSignal: options.abortSignal,
+            extractionDeadlineMs: options.extractionDeadlineMs,
+            writeNamespaceOverride: options.writeNamespaceOverride,
+            principalOverride: options.principalOverride,
+            scopeProfileWritePlan: options.scopeProfileWritePlan,
+            clearMatchingTurns: options.clearMatchingTurns ?? scopedRequest,
+            onDurableCommit: options.onCommitted,
+            onTaskSettled: (error) => error ? reject(error) : resolve4()
+          }).catch(reject);
+        });
+      } finally {
+        if (retainedTurnsForOtherSessions.length > 0 && typeof this.deps.buffer.retainDeferredTurns === "function") {
+          const retainedAfterExtraction = this.deps.buffer.getRetainedDeferredTurns(bufferKey);
+          await this.deps.buffer.retainDeferredTurns(
+            bufferKey,
+            [
+              ...retainedAfterExtraction.filter((turn) => belongsToSession(turn)),
+              ...retainedTurnsForOtherSessions
+            ],
+            10
+          ).catch((error) => {
+            log.warn(
+              `session flush could not restore retained turns for other sessions in ${bufferKey}`,
+              error
+            );
+          });
+        }
+      }
+    }
+  }
+  /** Lazily construct the CorrectionService for passive capture. Stateless
+   *  across requests (per #1580 design); cached for the orchestrator's life. */
+  passiveCorrectionService() {
+    if (this.deps._passiveCorrectionService) return this.deps._passiveCorrectionService;
+    this.deps._passiveCorrectionService = createCorrectionService({
+      orchestrator: this.deps.orchestratorSelf,
+      // Session-scoped write ACL (review: "passive capture bypasses write
+      // ACL"). A correction detected in session S plans only against S readable
+      // namespaces and applies only to writable ones (rule 42) — passive
+      // capture never becomes a cross-tenant mutation vector. Mirrors the
+      // access-service createCorrectionService wiring rather than bypassing it.
+      resolveAuthorizedNamespace: async (req) => {
+        const principal = req.principal || resolvePrincipal(req.sessionKey, this.deps.config);
+        const ns = req.namespace ?? defaultNamespaceForPrincipal(principal, this.deps.config);
+        if (!canWriteNamespace(principal, ns, this.deps.config)) {
+          throw new Error(
+            `passive correction: namespace "${ns}" is not writable for principal ${principal ?? "(none)"}`
+          );
+        }
+        return ns;
+      },
+      resolveReadableNamespaces: (req) => {
+        const principal = req.principal || resolvePrincipal(req.sessionKey, this.deps.config);
+        return recallNamespacesForPrincipal(principal, this.deps.config);
+      },
+      canWriteNamespace: async (req) => {
+        const principal = req.principal || resolvePrincipal(req.sessionKey, this.deps.config);
+        return canWriteNamespace(principal, req.namespace, this.deps.config);
+      },
+      llmComplete: async ({ system, user }) => {
+        const llmResult = await this.deps.localLlm.chatCompletion(
+          [
+            { role: "system", content: system },
+            { role: "user", content: user }
+          ],
+          { operation: "correction-classify", priority: "background" }
+        );
+        if (!llmResult) {
+          throw new Error(
+            "passive correction classify+draft: local LLM unavailable (disabled or in cooldown)"
+          );
+        }
+        return llmResult.content;
+      }
+    });
+    return this.deps._passiveCorrectionService;
+  }
+};
+
+// src/access-extraction-force-flush.ts
+async function extractionForceFlush(deps, request, waitForPendingObserveExtraction) {
+  if (!request.sessionKey || typeof request.sessionKey !== "string" || request.sessionKey.trim().length === 0) {
+    throw new EngramAccessInputError("sessionKey is required and must be a non-empty string");
+  }
+  if (request.deadlineMs !== void 0 && (!Number.isFinite(request.deadlineMs) || request.deadlineMs < 0)) {
+    throw new EngramAccessInputError("deadlineMs must be a finite non-negative number");
+  }
+  const authenticatedPrincipal = request.authenticatedPrincipal?.trim();
+  throwIfAborted(request.abortSignal, "extraction force-flush aborted");
+  const namespacesEnabled = resolveNamespaceCapabilities(deps.orchestrator.config).namespaces === true;
+  const sessionPrincipal = namespacesEnabled ? resolvePrincipal(request.sessionKey, deps.orchestrator.config) : void 0;
+  if (namespacesEnabled) {
+    if (!authenticatedPrincipal || sessionPrincipal !== void 0 && sessionPrincipal !== "default" && sessionPrincipal !== authenticatedPrincipal) {
+      throw new EngramAccessInputError("sessionKey is not owned by authenticated principal");
+    }
+  }
+  let committed = false;
+  const markCommitted = () => {
+    if (committed) return;
+    committed = true;
+    request.onCommitted?.();
+  };
+  let abortHandler;
+  try {
+    const scope = await deps.resolveMemoryScopePlan(request);
+    const reservationScopeHint = pendingObserveScopeHint(request);
+    const cancelScopedPendingObserveExtractions = () => {
+      deps.cancelPendingObserveExtractions?.(
+        request.sessionKey,
+        scope.principal,
+        scope.writeNamespace,
+        reservationScopeHint
+      );
+    };
+    if (request.abortSignal?.aborted) cancelScopedPendingObserveExtractions();
+    throwIfAborted(request.abortSignal, "extraction force-flush aborted");
+    if (typeof request.deadlineMs === "number" && request.deadlineMs <= Date.now()) {
+      cancelScopedPendingObserveExtractions();
+      throw new EngramAccessInputError("extraction force-flush deadline exceeded before buffer drain");
+    }
+    abortHandler = cancelScopedPendingObserveExtractions;
+    request.abortSignal?.addEventListener("abort", abortHandler, { once: true });
+    await awaitSessionFlushPhase(
+      () => deps.orchestrator.flushSession(request.sessionKey, {
+        reason: "access_force_flush",
+        abortSignal: request.abortSignal,
+        failOnExtractionFailure: true,
+        extractionDeadlineMs: request.deadlineMs,
+        writeNamespaceOverride: scope.writeNamespace,
+        principalOverride: typeof scope.principal === "string" && scope.principal.length > 0 ? scope.principal : void 0,
+        scopeProfileWritePlan: scope.scopeProfilePlan,
+        onCommitted: markCommitted
+      }),
+      {
+        abortSignal: request.abortSignal,
+        extractionDeadlineMs: request.deadlineMs,
+        reason: "access_force_flush",
+        deadlineStage: "buffer_drain",
+        onDeadline: cancelScopedPendingObserveExtractions
+      }
+    );
+    markCommitted();
+    if (waitForPendingObserveExtraction) {
+      let cancelPendingObserveExtraction;
+      await awaitSessionFlushPhase(
+        () => waitForPendingObserveExtraction(
+          request.sessionKey,
+          scope.principal,
+          scope.writeNamespace,
+          request.abortSignal,
+          (cancel) => {
+            cancelPendingObserveExtraction = cancel;
+          },
+          reservationScopeHint
+        ),
+        {
+          abortSignal: request.abortSignal,
+          extractionDeadlineMs: request.deadlineMs,
+          reason: "access_force_flush",
+          deadlineStage: "pending_observe_extraction",
+          onDeadline: () => {
+            cancelScopedPendingObserveExtractions();
+            cancelPendingObserveExtraction?.();
+          }
+        }
+      );
+    }
+    const buffer = deps.orchestrator.buffer;
+    if (buffer && typeof buffer.clearRetainedTurnsForSession === "function") {
+      try {
+        await awaitSessionFlushPhase(
+          () => buffer.clearRetainedTurnsForSession(request.sessionKey, namespacesEnabled ? scope.principal : void 0, {
+            abortSignal: request.abortSignal,
+            deadlineMs: request.deadlineMs
+          }),
+          {
+            abortSignal: request.abortSignal,
+            extractionDeadlineMs: request.deadlineMs,
+            reason: "access_force_flush",
+            deadlineStage: "retained_turn_cleanup"
+          }
+        );
+      } catch (cleanupError) {
+        if (isAbortError(cleanupError) || cleanupError instanceof ExtractionDeadlineError) {
+          throw cleanupError;
+        }
+        log.warn(
+          `extractionForceFlush: retained-turn cleanup failed after a successful flush, continuing: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`
+        );
+      }
+    }
+    return {
+      flushed: true,
+      sessionKey: request.sessionKey,
+      namespace: deps.legacyResponseNamespaceForScope(scope),
+      effectiveNamespace: scope.writeNamespace
+    };
+  } catch (error) {
+    if (error instanceof SessionOwnershipError) {
+      throw new EngramAccessForbiddenError(error.message);
+    }
+    if (error instanceof ExtractionDeadlineError) {
+      throw new EngramAccessInputError(error.message);
+    }
+    throw error;
+  } finally {
+    if (abortHandler) request.abortSignal?.removeEventListener("abort", abortHandler);
+  }
+}
+
+// src/access-observe-write-surface.ts
 var AccessObserveWriteSurface = class {
   constructor(deps) {
     this.deps = deps;
   }
   deps;
   quarantineStoreInstance;
+  pendingObserveExtractions = new PendingObserveExtractionTracker();
+  cancelPendingObserveExtractions(sessionKey, principal, namespace, scopeHint) {
+    this.pendingObserveExtractions.cancel(sessionKey, principal, namespace, scopeHint);
+  }
   quarantineStore() {
     if (!this.quarantineStoreInstance) {
       this.quarantineStoreInstance = new WriteQuarantineStore(
@@ -5991,111 +6800,144 @@ var AccessObserveWriteSurface = class {
         throw new EngramAccessInputError(`invalid message role: ${msg.role} (expected 'user' or 'assistant')`);
       }
     }
-    let scope;
+    const observePreparation = this.pendingObserveExtractions.reserve(
+      request.sessionKey,
+      pendingObserveScopeHint(request)
+    );
     try {
-      scope = await this.deps.resolveMemoryScopePlan(request);
-    } catch (err) {
-      if (request.suppressQuarantine !== true) {
-        await this.parkRejectedWrite(err, "observe", request);
-      }
-      throw err;
-    }
-    const writeNamespace = scope.writeNamespace;
-    const namespace = this.deps.legacyResponseNamespaceForScope(scope);
-    const shouldWriteObjectiveState = resolveObjectiveStateCapabilities(this.deps.orchestrator.config).objectiveStateMemory === true && resolveObjectiveStateCapabilities(this.deps.orchestrator.config).objectiveStateSnapshotWrites === true;
-    await this.deps.maybeAttachCodingContext(request.sessionKey, {
-      cwd: request.cwd,
-      projectTag: request.projectTag
-    });
-    const lcmSessionKey = lcmSessionKeyForNamespace(writeNamespace, request.sessionKey, this.deps.orchestrator.config.defaultNamespace) ?? request.sessionKey;
-    if (shouldWriteObjectiveState) {
+      let scope;
       try {
-        const objectiveStateLocation = await this.deps.objectiveStateStoreLocationForNamespace(
-          scope.objectiveStateNamespace
-        );
-        await recordObjectiveStateSnapshotsFromObservedMessages({
-          memoryDir: objectiveStateLocation.memoryDir,
-          objectiveStateStoreDir: objectiveStateLocation.objectiveStateStoreDir,
-          objectiveStateMemoryEnabled: resolveObjectiveStateCapabilities(this.deps.orchestrator.config).objectiveStateMemory,
-          objectiveStateSnapshotWritesEnabled: resolveObjectiveStateCapabilities(this.deps.orchestrator.config).objectiveStateSnapshotWrites,
-          sessionKey: request.sessionKey,
-          recordedAt: (/* @__PURE__ */ new Date()).toISOString(),
-          messages: request.messages
-        });
+        scope = await this.deps.resolveMemoryScopePlan(request);
       } catch (err) {
-        log.error(`access-observe objective-state snapshot write failed: ${err}`);
+        if (request.suppressQuarantine !== true) {
+          await this.parkRejectedWrite(err, "observe", request);
+        }
+        throw err;
       }
-    }
-    let lcmArchived = false;
-    if (this.deps.orchestrator.lcmEngine && this.deps.orchestrator.lcmEngine.enabled) {
-      try {
-        this.deps.orchestrator.lcmEngine.enqueueObserveMessages(lcmSessionKey, request.messages);
-        lcmArchived = true;
-      } catch (err) {
-        log.error(`access-observe LCM enqueue failed: ${err}`);
-      }
-    }
-    let extractionQueued = false;
-    if (request.skipExtraction !== true) {
-      const turns = request.messages.map((m) => ({
-        source: "openclaw",
-        // Identity-vs-routing separation (#1505 thread 1, cursor): extraction
-        // derives the provenance principal via `resolvePrincipal(turn.sessionKey)`
-        // and threads `turn.sessionKey` into conversation threading. Feeding the
-        // namespace-PREFIXED `lcmSessionKey` here mis-derived the principal to
-        // `default` (a `<ns>:<key>` string matches no prefix/map rule and fails
-        // the `agent:` heuristic). Pass the ORIGINAL sessionKey so identity is
-        // correct; storage routing is pinned separately via
-        // writeNamespaceOverride below, and the authenticated principal is pinned
-        // via principalOverride.
-        sessionKey: request.sessionKey,
-        role: m.role,
-        content: m.content,
-        parts: m.parts,
-        rawContent: m.rawContent,
-        sourceFormat: m.sourceFormat,
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        ...request.sourceConnector ? { sourceConnector: request.sourceConnector } : {}
-      }));
-      const writeNamespaceOverride = resolveNamespaceCapabilities(this.deps.orchestrator.config).namespaces === true ? writeNamespace : void 0;
-      const principalOverride = typeof scope.principal === "string" && scope.principal.length > 0 ? scope.principal : void 0;
-      try {
-        const extractionPromise = this.deps.orchestrator.ingestReplayBatch(turns, {
-          archiveLcm: false,
-          writeNamespaceOverride,
-          principalOverride
-        });
-        extractionPromise.catch((err) => {
-          log.error(`access-observe background extraction failed: ${err}`);
-        });
-        extractionQueued = true;
-      } catch (err) {
-        log.error(`access-observe extraction enqueue failed: ${err}`);
+      const writeNamespace = scope.writeNamespace;
+      observePreparation.setScope(scope.principal, writeNamespace);
+      const namespace = this.deps.legacyResponseNamespaceForScope(scope);
+      const shouldWriteObjectiveState = resolveObjectiveStateCapabilities(this.deps.orchestrator.config).objectiveStateMemory === true && resolveObjectiveStateCapabilities(this.deps.orchestrator.config).objectiveStateSnapshotWrites === true;
+      await this.deps.maybeAttachCodingContext(request.sessionKey, {
+        cwd: request.cwd,
+        projectTag: request.projectTag
+      });
+      const lcmSessionKey = lcmSessionKeyForNamespace(writeNamespace, request.sessionKey, this.deps.orchestrator.config.defaultNamespace) ?? request.sessionKey;
+      if (shouldWriteObjectiveState) {
+        try {
+          const objectiveStateLocation = await this.deps.objectiveStateStoreLocationForNamespace(
+            scope.objectiveStateNamespace
+          );
+          await recordObjectiveStateSnapshotsFromObservedMessages({
+            memoryDir: objectiveStateLocation.memoryDir,
+            objectiveStateStoreDir: objectiveStateLocation.objectiveStateStoreDir,
+            objectiveStateMemoryEnabled: resolveObjectiveStateCapabilities(this.deps.orchestrator.config).objectiveStateMemory,
+            objectiveStateSnapshotWritesEnabled: resolveObjectiveStateCapabilities(this.deps.orchestrator.config).objectiveStateSnapshotWrites,
+            sessionKey: request.sessionKey,
+            recordedAt: (/* @__PURE__ */ new Date()).toISOString(),
+            messages: request.messages
+          });
+        } catch (err) {
+          log.error(`access-observe objective-state snapshot write failed: ${err}`);
+        }
       }
+      let lcmArchived = false;
+      if (this.deps.orchestrator.lcmEngine && this.deps.orchestrator.lcmEngine.enabled) {
+        try {
+          this.deps.orchestrator.lcmEngine.enqueueObserveMessages(lcmSessionKey, request.messages);
+          lcmArchived = true;
+        } catch (err) {
+          log.error(`access-observe LCM enqueue failed: ${err}`);
+        }
+      }
+      let extractionQueued = false;
+      if (request.skipExtraction !== true) {
+        const turns = request.messages.map((m) => ({
+          source: "openclaw",
+          // Identity-vs-routing separation (#1505 thread 1, cursor): extraction
+          // derives the provenance principal via `resolvePrincipal(turn.sessionKey)`
+          // and threads `turn.sessionKey` into conversation threading. Feeding the
+          // namespace-PREFIXED `lcmSessionKey` here mis-derived the principal to
+          // `default` (a `<ns>:<key>` string matches no prefix/map rule and fails
+          // the `agent:` heuristic). Pass the ORIGINAL sessionKey so identity is
+          // correct; storage routing is pinned separately via
+          // writeNamespaceOverride below, and the authenticated principal is pinned
+          // via principalOverride.
+          sessionKey: request.sessionKey,
+          role: m.role,
+          content: m.content,
+          parts: m.parts,
+          rawContent: m.rawContent,
+          sourceFormat: m.sourceFormat,
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          ...request.sourceConnector ? { sourceConnector: request.sourceConnector } : {}
+        }));
+        const writeNamespaceOverride = resolveNamespaceCapabilities(this.deps.orchestrator.config).namespaces === true ? writeNamespace : void 0;
+        const principalOverride = typeof scope.principal === "string" && scope.principal.length > 0 ? scope.principal : void 0;
+        if (!observePreparation.isCancelled()) {
+          try {
+            const observeAbortController = new AbortController();
+            const extractionPromise = this.deps.orchestrator.ingestReplayBatch(turns, {
+              archiveLcm: false,
+              writeNamespaceOverride,
+              principalOverride,
+              abortSignal: observeAbortController.signal,
+              ...typeof request.authenticatedPrincipal === "string" && request.authenticatedPrincipal.trim().length > 0 ? { sessionOwnerPrincipal: request.authenticatedPrincipal.trim() } : {}
+            });
+            extractionPromise.catch((err) => {
+              log.error(`access-observe background extraction failed: ${err}`);
+            });
+            this.pendingObserveExtractions.track(
+              this.pendingObserveExtractions.key(request.sessionKey, scope.principal, writeNamespace),
+              extractionPromise,
+              observeAbortController
+            );
+            extractionQueued = true;
+          } catch (err) {
+            log.error(`access-observe extraction enqueue failed: ${err}`);
+          }
+        }
+      }
+      log.info(
+        `access-observe namespace=${namespace} effectiveNamespace=${writeNamespace} sessionKey=${request.sessionKey} messages=${request.messages.length} lcm=${lcmArchived} extraction=${extractionQueued}`
+      );
+      return {
+        accepted: request.messages.length,
+        sessionKey: request.sessionKey,
+        namespace,
+        effectiveNamespace: writeNamespace,
+        scopeDebug: {
+          principal: scope.principal,
+          explicitNamespace: scope.explicitNamespace,
+          baseNamespace: scope.baseNamespace,
+          writeNamespace: scope.writeNamespace,
+          codingOverlayApplied: scope.codingOverlayApplied,
+          readNamespaces: scope.readNamespaces,
+          scopeProfile: scope.scopeProfile,
+          writeLayer: scope.writeLayer,
+          layers: scope.layers,
+          promotionTargets: scope.promotionTargets
+        },
+        lcmArchived,
+        extractionQueued
+      };
+    } finally {
+      observePreparation.release();
     }
-    log.info(
-      `access-observe namespace=${namespace} effectiveNamespace=${writeNamespace} sessionKey=${request.sessionKey} messages=${request.messages.length} lcm=${lcmArchived} extraction=${extractionQueued}`
+  }
+  async extractionForceFlush(request) {
+    return extractionForceFlush(
+      this.deps,
+      request,
+      (sessionKey, principal, namespace, abortSignal, registerCancellation, scopeHint) => this.pendingObserveExtractions.wait(
+        sessionKey,
+        principal,
+        namespace,
+        abortSignal,
+        registerCancellation,
+        scopeHint
+      )
     );
-    return {
-      accepted: request.messages.length,
-      sessionKey: request.sessionKey,
-      namespace,
-      effectiveNamespace: writeNamespace,
-      scopeDebug: {
-        principal: scope.principal,
-        explicitNamespace: scope.explicitNamespace,
-        baseNamespace: scope.baseNamespace,
-        writeNamespace: scope.writeNamespace,
-        codingOverlayApplied: scope.codingOverlayApplied,
-        readNamespaces: scope.readNamespaces,
-        scopeProfile: scope.scopeProfile,
-        writeLayer: scope.writeLayer,
-        layers: scope.layers,
-        promotionTargets: scope.promotionTargets
-      },
-      lcmArchived,
-      extractionQueued
-    };
   }
   async workTask(request) {
     const STATUSES = /* @__PURE__ */ new Set(["todo", "in_progress", "blocked", "done", "cancelled"]);
@@ -7222,6 +8064,15 @@ import * as nodePath2 from "path";
 
 // src/orchestration/recall-result-formatter.ts
 import path8 from "path";
+
+// src/connectors/label.ts
+var CONNECTOR_LABEL_MAX_LENGTH = 64;
+
+// src/orchestration/recall-result-formatter.ts
+function renderConnectorLabel(connector) {
+  if (!connector || !CONNECTOR_ID_PATTERN.test(connector)) return null;
+  return connector.length <= CONNECTOR_LABEL_MAX_LENGTH ? connector : `${connector.slice(0, CONNECTOR_LABEL_MAX_LENGTH - 1)}\u2026`;
+}
 function hasIdentityRecoveryIntent(prompt) {
   const text = typeof prompt === "string" ? prompt.toLowerCase() : "";
   if (!text) return false;
@@ -7306,14 +8157,16 @@ var RecallResultFormatter = class {
 ${snippet}`;
       const handle = handleByIndex.get(i);
       const withHandle = handle ? `${head.trimEnd()} ${handle}` : head.trimEnd();
+      const connectorLabel = renderConnectorLabel(r.sourceConnector);
+      const withConnector = connectorLabel ? `${withHandle} [agent: ${connectorLabel}]` : withHandle;
       if (hedgeMap) {
         const item = trustResultFor(hedgeMap, r);
         if (item) {
           const hedge = renderEpistemicHedge(item.trust);
-          if (hedge.length > 0) return `${withHandle} ${hedge}`;
+          if (hedge.length > 0) return `${withConnector} ${hedge}`;
         }
       }
-      return withHandle;
+      return withConnector;
     });
     return { heading: `## ${title}`, entries };
   }
@@ -9189,54 +10042,19 @@ var EngramAccessService = class {
       principal,
       this.orchestrator.config
     );
-    const hasSession = typeof request.sessionKey === "string" && request.sessionKey.length > 0;
-    const overlayEligible = hasSession && resolveNamespaceCapabilities(this.orchestrator.config).namespaces === true && this.orchestrator.config.codingMode?.projectScope === true;
-    let attachedContext = hasSession ? this.orchestrator.getCodingContextForSession(request.sessionKey) : null;
-    let seededContext = false;
-    if (overlayEligible && !attachedContext) {
-      attachedContext = await this.resolveCodingContextFromOptions(request);
-      if (attachedContext) {
-        this.orchestrator.setCodingContextForSession(
-          request.sessionKey,
-          attachedContext
-        );
-        seededContext = true;
-      }
-    }
-    const clearSeededContext = () => {
-      if (seededContext && hasSession) {
-        this.orchestrator.setCodingContextForSession(request.sessionKey, null);
-      }
-    };
+    const {
+      overlay: codingOverlay,
+      profilePlan
+    } = await this.resolveCodingScopeInputs(request);
+    const overlaidBase = codingOverlay ? combineNamespaces(baseNamespace, codingOverlay.namespace) : baseNamespace;
+    const codingOverlayApplied = overlaidBase !== baseNamespace;
     const assertWriteNamespaceAllowed = (namespace) => {
-      try {
-        this.assertTokenCanWriteNamespace(namespace);
-      } catch (error) {
-        clearSeededContext();
-        throw error;
-      }
+      this.assertTokenCanWriteNamespace(namespace);
     };
-    const overlaidBase = this.orchestrator.applyCodingNamespaceOverlay(
-      request.sessionKey,
-      baseNamespace
-    );
-    const codingOverlayApplied = overlaidBase !== baseNamespace;
-    const codingOverlay = overlayEligible ? resolveCodingNamespaceOverlay(
-      attachedContext,
-      this.orchestrator.config.codingMode,
-      this.orchestrator.config.defaultNamespace
-    ) : null;
-    const profilePlan = resolveScopeProfilePlan({
-      config: this.orchestrator.config,
-      principal,
-      codingContext: attachedContext,
-      codingOverlay
-    });
     if (profilePlan) {
       const selectedLayer = profilePlan.layers.find((layer) => layer.id === profilePlan.writeLayer);
       const writeNamespaceReadable = profilePlan.writeNamespace.length > 0 && profilePlan.readNamespaces.includes(profilePlan.writeNamespace);
       if (!selectedLayer?.writable || !writeNamespaceReadable) {
-        clearSeededContext();
         throw new NamespaceNotWritableError(
           profilePlan.writeNamespace,
           principal,
@@ -9266,6 +10084,7 @@ var EngramAccessService = class {
         objectiveStateNamespace: profilePlan.writeNamespace,
         readNamespaces: readNamespaces2,
         scopeProfile: profilePlan.profileId,
+        scopeProfilePlan: profilePlan,
         writeLayer: profilePlan.writeLayer,
         layers: profilePlan.layers,
         promotionTargets: profilePlan.promotionTargets,
@@ -9281,7 +10100,6 @@ var EngramAccessService = class {
       );
       const willWriteObjectiveState = resolveObjectiveStateCapabilities(this.orchestrator.config).objectiveStateMemory === true && resolveObjectiveStateCapabilities(this.orchestrator.config).objectiveStateSnapshotWrites === true;
       if (willWriteObjectiveState && resolveNamespaceCapabilities(this.orchestrator.config).namespaces === true && !canWriteNamespace(principal, baseNamespace, this.orchestrator.config)) {
-        clearSeededContext();
         throw new NamespaceNotWritableError(baseNamespace, principal);
       }
       assertWriteNamespaceAllowed(writeNamespace2);
@@ -9304,7 +10122,6 @@ var EngramAccessService = class {
       };
     }
     if (!canWriteNamespace(principal, baseNamespace, this.orchestrator.config)) {
-      clearSeededContext();
       throw new NamespaceNotWritableError(baseNamespace, principal);
     }
     const writeNamespace = overlaidBase;
@@ -11055,6 +11872,12 @@ var EngramAccessService = class {
       namespace
     };
   }
+  async extractionForceFlush(request) {
+    return delegateExtractionForceFlush(this.accessObserveWriteSurface, request);
+  }
+  cancelPendingObserveExtractions(sessionKey, principal, namespace, scopeHint) {
+    this.accessObserveWriteSurface.cancelPendingObserveExtractions(sessionKey, principal, namespace, scopeHint);
+  }
   async lcmCompactionRecord(request) {
     if (!request.sessionKey || typeof request.sessionKey !== "string" || request.sessionKey.trim().length === 0) {
       throw new EngramAccessInputError("sessionKey is required and must be a non-empty string");
@@ -12464,7 +13287,6 @@ export {
   isCodegraphToolName,
   DELTA_SUBCOMMANDS,
   CorrectionContractError,
-  createCorrectionService,
   detectPassiveCorrections,
   capturePassiveCorrections,
   clusterByKey,
@@ -12486,6 +13308,8 @@ export {
   resolveNamespaceWritablePreflight,
   resolveAuthorizedNamespaceWritablePreflight,
   resolveQueryNamespaceWritablePreflight,
+  SessionContextCoordinator,
+  extractionForceFlush,
   AccessObserveWriteSurface,
   AccessLcmSurface,
   hasIdentityRecoveryIntent,
@@ -12501,4 +13325,4 @@ export {
   EngramAccessService,
   AccessAdminOpsSurface
 };
-//# sourceMappingURL=chunk-4WKA6I65.js.map
+//# sourceMappingURL=chunk-J3ZGPYXB.js.map