@remnic/core 9.45.3 → 9.45.5

package/src/access-service.ts

@@ -39,6 +39,10 @@ import {
   resolveCodingNamespaceOverlay,
   type CodingNamespaceOverlay,
 } from "./coding/coding-namespace.js";
+import {
+  resolveCodingContextFromOptions,
+  type InterruptibleCodingScopeInput,
+} from "./access-coding-context-resolution.js";
 import {
   handleCodingDecision,
   type DecisionSurfaceRequest,
@@ -72,7 +76,7 @@ import {
   type DeltaSurfaceResponse,
   type DeltaSurfaceStorage,
 } from "./coding/session-delta-surfaces.js";
-import { defaultGitInvoker } from "./coding/git-context.js";
+import { defaultGitInvokerSync } from "./coding/git-context.js";
 import {
   createCorrectionService,
   isCorrectionFeatureEnabled,
@@ -180,7 +184,7 @@ import type {
   Orchestrator,
   RecallInvocationOptions,
 } from "./orchestrator.js";
-import { parseEntityFile, StorageManager } from "./storage.js";
+import { parseEntityFile, parseFrontmatter, StorageManager } from "./storage.js";
 import {
   buildGraphSnapshot,
   type GraphSnapshotRequest,
@@ -283,6 +287,7 @@ import {
   buildOfflineSyncSnapshotFromBase,
   buildOfflineSyncSnapshotForPaths,
   iterateOfflineSyncSnapshotFileRecords,
+  filterOfflineSyncDeletionRevisions,
   OFFLINE_SYNC_SNAPSHOT_FORMAT,
   readOfflineSyncFileContentChunk,
   type OfflineSyncApplyFileContentChunkResult,
@@ -293,6 +298,10 @@ import {
   type OfflineSyncSnapshot,
 } from "./offline-sync.js";
 import { offlineSyncStorageForSnapshot } from "./offline-sync-impression-drain.js";
+import {
+  createOfflineSyncManifestStream,
+  type OfflineSyncManifestStreamResponse,
+} from "./access-offline-manifest.js";
 import {
   evaluateActionConfidence,
   type ActionConfidenceInput,
@@ -372,6 +381,8 @@ export interface EngramAccessRecallRequest {
   sessionKey?: string;
   namespace?: string;
   authenticatedPrincipal?: string;
+  /** Trusted connector identity resolved at the transport boundary. */
+  sourceConnector?: string;
   idempotencyKey?: string;
   topK?: number;
   mode?: RecallPlanMode | "auto";
@@ -781,6 +792,12 @@ export interface EngramAccessOfflineSyncSnapshotRequest {
   baseFiles?: OfflineSyncFileState[];
 }
 
+export interface EngramAccessOfflineSyncManifestRequest {
+  namespace?: string;
+  principal?: string;
+  includeTranscripts?: boolean;
+}
+
 export interface EngramAccessOfflineSyncFilesRequest {
   namespace?: string;
   principal?: string;
@@ -924,6 +941,7 @@ export interface CodingScopedWriteInput {
   cwd?: string;
   projectTag?: string;
 }
+
 export type { EngramAccessNamespaceWritableRequest } from "./access-namespace-preflight.js";
 /**
  * Internal, single-resolution plan describing the effective memory scope for a
@@ -1463,38 +1481,6 @@ export class EngramAccessService {
     return result.namespace;
   }
 
-  /**
-   * Resolve a coding context from `cwd`/`projectTag` WITHOUT persisting it to
-   * any session — the read-only half of `maybeAttachCodingContext`. Returns
-   * null when project scoping is off or nothing resolves. `projectTag` takes
-   * priority over `cwd` (matching `maybeAttachCodingContext`).
-   */
-  private async resolveCodingContextFromOptions(
-    options: CodingScopedWriteInput,
-  ): Promise<CodingContext | null> {
-    if (!this.orchestrator.config.codingMode?.projectScope) return null;
-    if (typeof options.projectTag === "string" && options.projectTag.trim().length > 0) {
-      const projectId = projectTagProjectId(options.projectTag);
-      return { projectId, branch: null, rootPath: projectId, defaultBranch: null };
-    }
-    if (typeof options.cwd === "string" && options.cwd.trim().length > 0) {
-      try {
-        const gitCtx = await resolveGitContext(options.cwd);
-        if (gitCtx) {
-          return {
-            projectId: gitCtx.projectId,
-            branch: gitCtx.branch,
-            rootPath: gitCtx.rootPath,
-            defaultBranch: gitCtx.defaultBranch,
-          };
-        }
-      } catch {
-        // resolveGitContext never throws, but stay defensive — not being in a
-        // repo is normal and must not break the write.
-      }
-    }
-    return null;
-  }
 
   /** Shared coding-scope derivation for the read/write resolvers below —
    *  coding context, overlay, principal, scope-profile plan for an IMPLICIT
@@ -1503,7 +1489,7 @@ export class EngramAccessService {
    *  of truth for the namespacesEnabled/projectScope gates (rule 22; keeps the
    *  scattered-config-read ratchet flat). READ-ONLY: never mutates session. */
   private async resolveCodingScopeInputs(
-    request: CodingScopedWriteInput & {
+    request: InterruptibleCodingScopeInput & {
       namespace?: string;
       sessionKey?: string;
       authenticatedPrincipal?: string;
@@ -1526,7 +1512,7 @@ export class EngramAccessService {
       resolveNamespaceCapabilities(this.orchestrator.config).namespaces &&
       this.orchestrator.config.codingMode?.projectScope
         ? this.orchestrator.getCodingContextForSession(request.sessionKey) ??
-          (await this.resolveCodingContextFromOptions(request))
+          (await resolveCodingContextFromOptions(request))
         : null;
     const overlay =
       hasSession &&
@@ -1702,7 +1688,7 @@ export class EngramAccessService {
    * precedence), falling back to the per-call `cwd`/`projectTag`.
    */
   private async resolveMemoryScopePlan(
-    request: CodingScopedWriteInput & {
+    request: InterruptibleCodingScopeInput & {
       namespace?: string;
       sessionKey?: string;
       authenticatedPrincipal?: string;
@@ -2393,15 +2379,24 @@ export class EngramAccessService {
       extractionWatermark,
       caps?.namespaces !== undefined ? undefined : this.extractionLivenessWarn,
     );
+    let scopedDegradedReason: string | null = null;
+    if (extraction.degraded) {
+      if (extraction.degradedReason?.includes("watermark unreadable")) {
+        scopedDegradedReason = "daemon extraction pipeline degraded; extraction watermark unreadable";
+      } else if (extraction.degradedReason?.includes("buffer unreadable")) {
+        scopedDegradedReason = "daemon extraction pipeline degraded; extraction buffer unreadable";
+      } else {
+        scopedDegradedReason =
+          `${extraction.bufferedSessionCount} buffered session(s), ` +
+          `${extraction.pendingTurnCount} turn(s) pending extraction`;
+      }
+    }
     const visibleExtraction =
       caps?.namespaces !== undefined
         ? {
             ...extraction,
             lastExtractionAt: null,
-            bufferedSessionCount: 0,
-            pendingTurnCount: 0,
-            oldestBufferedTurnAgeMs: null,
-            degradedReason: extraction.degraded ? "daemon extraction pipeline degraded" : null,
+            degradedReason: scopedDegradedReason,
           }
         : extraction;
     // ONE call: the corpus array and the flag describing it must not come from
@@ -2844,6 +2839,7 @@ export class EngramAccessService {
     namespace?: string;
     budget?: number;
     authenticatedPrincipal?: string;
+    sourceConnector?: string;
     /**
      * Disclosure depth used to shape per-result payload (issue #677
      * PR 3/4).  When set, each X-ray result is decorated with the
@@ -3229,12 +3225,9 @@ export class EngramAccessService {
         } satisfies DeltaSurfaceStorage;
       },
       gitInvoker: (cwd, args) => {
-        // Reuse the existing defaultGitInvoker (2s timeout, never throws —
-        // the discipline git-context.ts already established). It returns
-        // { stdout, exitCode } so the handler can recover from non-zero
-        // exits without a try/catch.
-        const invoker = defaultGitInvoker();
-        return invoker(cwd, args);
+        // Session-delta remains a synchronous pure calculation; use the
+        // bounded synchronous invoker rather than the abortable scope resolver.
+        return defaultGitInvokerSync()(cwd, args);
       },
       throwInputError: (msg) => { throw new EngramAccessInputError(msg); },
     });
@@ -3318,23 +3311,28 @@ export class EngramAccessService {
     }
   }
 
-  async correctionPlan(request: CorrectionRequest): Promise<CorrectionPlan> {
-    // Issue #1582 — resolve any `[m:xxxx]` handle in targetIds to its memory
-    // id against the caller's session BEFORE planning, so the planner only ever
-    // sees concrete ids. One shared resolve path (rule 22); a handle that
-    // misses or collides is an explicit input error, never silent (rule 34/51).
+  async correctionPlan(
+    request: CorrectionRequest,
+    opts?: { abortSignal?: AbortSignal },
+  ): Promise<CorrectionPlan> {
     if (request.targetIds?.some((id) => isHandleToken(id))) {
       const targetIds = request.targetIds.map((id) =>
         this.resolveMemoryIdOrHandleInput(id, request.sessionKey),
       );
-      return this.correctionService().plan({ ...request, targetIds });
+      return this.correctionService().plan({ ...request, targetIds }, opts);
     }
-    return this.correctionService().plan(request);
+    return this.correctionService().plan(request, opts);
   }
 
   async correctionApply(
     planId: string,
-    opts: { confirm?: boolean; namespace?: string; sessionKey?: string; principal?: string },
+    opts: {
+      confirm?: boolean;
+      namespace?: string;
+      sessionKey?: string;
+      principal?: string;
+      abortSignal?: AbortSignal;
+    },
   ): Promise<CorrectionOutcome> {
     return this.correctionService().apply(planId, opts);
   }
@@ -4019,12 +4017,9 @@ export class EngramAccessService {
       // Explicit namespace pins the scope (resolveMemoryScopePlan returns early),
       // so the coding context is irrelevant — skip it to avoid false conflicts
       // when the session context changes under a namespace-pinned observe.
-      // resolveCodingContextFromOptions self-gates on projectScope (no scattered
-      // config read here).
-      effectiveCodingContext =
-        (typeof this.orchestrator.getCodingContextForSession === "function"
-          ? this.orchestrator.getCodingContextForSession(request.sessionKey)
-          : null) ?? (await this.resolveCodingContextFromOptions(request));
+      // Reuse the write resolver's namespace/projectScope gates so context
+      // ignored by runObserve cannot change the retry fingerprint.
+      effectiveCodingContext = (await this.resolveCodingScopeInputs(request)).codingContext;
     }
     return this.handleIdempotentWrite<EngramAccessObserveResponse>({
       operation: "observe",
@@ -4330,6 +4325,10 @@ export class EngramAccessService {
   async extractionForceFlush(request: EngramAccessExtractionForceFlushRequest): Promise<EngramAccessExtractionForceFlushResponse> {
     return delegateExtractionForceFlush(this.accessObserveWriteSurface, request);
   }
+  cancelPendingObservePreparations(sessionKey: string, scopeHint?: string): void {
+    this.accessObserveWriteSurface.cancelPendingObservePreparations(sessionKey, scopeHint);
+  }
+
   cancelPendingObserveExtractions(
     sessionKey: string,
     principal?: string,
@@ -5469,6 +5468,8 @@ export class EngramAccessService {
     const resolvedNamespace = this.resolveReadableNamespace(options.namespace, options.principal);
     const storage = await offlineSyncStorageForSnapshot(this.orchestrator, resolvedNamespace);
     const storageHash = createHash("sha256").update(storage.dir).digest("hex").slice(0, 16);
+    const deletions = [...await storage.readDeletionRevisions()]
+      .map(([path, mtimeMs]) => ({ path, mtimeMs }));
     const snapshotBuilder = options.includeContent === false && options.baseFiles && options.baseFiles.length > 0
       ? buildOfflineSyncSnapshotFromBase
       : buildOfflineSyncSnapshot;
@@ -5482,6 +5483,7 @@ export class EngramAccessService {
       readFileDigest: async ({ filePath }) => storage.digestOfflineSyncFile(filePath),
       signal: options.signal,
       userExcludeRegexps: this.offlineSyncUserExcludes,
+      deletions,
     });
     return {
       namespace: resolvedNamespace,
@@ -5495,6 +5497,13 @@ export class EngramAccessService {
     const resolvedNamespace = this.resolveReadableNamespace(options.namespace, options.principal);
     const storage = await offlineSyncStorageForSnapshot(this.orchestrator, resolvedNamespace);
     const storageHash = createHash("sha256").update(storage.dir).digest("hex").slice(0, 16);
+    const deletions = await filterOfflineSyncDeletionRevisions({
+      root: storage.dir,
+      deletions: [...await storage.readDeletionRevisions()]
+        .map(([path, mtimeMs]) => ({ path, mtimeMs })),
+      includeTranscripts: options.includeTranscripts !== false,
+      userExcludeRegexps: this.offlineSyncUserExcludes,
+    });
     return {
       namespace: resolvedNamespace,
       format: OFFLINE_SYNC_SNAPSHOT_FORMAT,
@@ -5502,6 +5511,7 @@ export class EngramAccessService {
       createdAt: new Date().toISOString(),
       sourceId: `remnic:${resolvedNamespace}:${storageHash}`,
       includeTranscripts: options.includeTranscripts !== false,
+      deletions,
       files: iterateOfflineSyncSnapshotFileRecords({
         root: storage.dir,
         includeContent: options.includeContent === true,
@@ -5513,6 +5523,19 @@ export class EngramAccessService {
       }),
     };
   }
+  async offlineSyncManifestStream(
+    options: EngramAccessOfflineSyncManifestRequest & { signal?: AbortSignal } = {},
+  ): Promise<OfflineSyncManifestStreamResponse> {
+    const namespace = this.resolveReadableNamespace(options.namespace, options.principal);
+    return createOfflineSyncManifestStream(
+      this.orchestrator,
+      namespace,
+      this.offlineSyncUserExcludes,
+      options,
+      parseFrontmatter,
+    );
+  }
+
 
   async offlineSyncFiles(
     options: EngramAccessOfflineSyncFilesRequest,
@@ -5672,7 +5695,10 @@ export class EngramAccessService {
         readFile: async ({ filePath }) => storage.readOfflineSyncFile(filePath),
         readFileDigest: async ({ filePath }) => storage.digestOfflineSyncFile(filePath),
         writeFile: async ({ filePath, content }) => storage.writeOfflineSyncFile(filePath, content),
-        deleteFile: async ({ filePath }) => storage.deleteOfflineSyncFile(filePath),
+        deleteFile: async ({ filePath, mtimeMs }) =>
+          storage.deleteOfflineSyncFile(filePath, mtimeMs ?? null),
+        recordDeletionRevision: async ({ filePath, mtimeMs }) =>
+          storage.recordReplicatedDeletionRevision(filePath, mtimeMs),
       });
       return {
         namespace: resolvedNamespace,

package/src/access-surface-catalog.ts

@@ -130,6 +130,7 @@ export const MCP_TOOLS: readonly McpToolEntry[] = [
   { tool: "compression_guidelines_optimize", operation: "compression_guidelines_optimize" },
   { tool: "compression_guidelines_activate", operation: "compression_guidelines_activate" },
   { tool: "memory_search", operation: "memory_search" },
+  { tool: "external_wiki_search", operation: "external_wiki_search" },
   { tool: "memory_profile", operation: "memory_profile" },
   { tool: "memory_entities_list", operation: "memory_entities_list" },
   { tool: "memory_questions", operation: "memory_questions" },
@@ -175,10 +176,12 @@ export const MCP_TOOLS: readonly McpToolEntry[] = [
 export const HTTP_ROUTES: readonly HttpRouteEntry[] = [
   { method: "GET", pathname: "/engram/v1/adapters", operation: "adapters_status" },
   { method: "POST", pathname: "/engram/v1/recall", operation: "recall" },
+  { method: "POST", pathname: "/engram/v1/external-wikis/search", operation: "external_wiki_search" },
   { method: "POST", pathname: "/engram/v1/coding-context", operation: "set_coding_context" },
   { method: "POST", pathname: "/engram/v1/capsules/export", operation: "capsule_export" },
   { method: "POST", pathname: "/engram/v1/capsules/import", operation: "capsule_import" },
   { method: "GET", pathname: "/engram/v1/offline-sync/snapshot", operation: "offline_sync_snapshot" },
+  { method: "GET", pathname: "/engram/v1/offline-sync/capabilities", operation: "offline_sync_snapshot" },
     { method: "POST", pathname: "/engram/v1/offline-sync/snapshot", operation: "offline_sync_snapshot" },
   { method: "POST", pathname: "/engram/v1/offline-sync/files", operation: "offline_sync_files" },
   { method: "POST", pathname: "/engram/v1/offline-sync/file-content", operation: "offline_sync_file_content" },
@@ -252,6 +255,7 @@ export const HTTP_ROUTES: readonly HttpRouteEntry[] = [
   // The operation registration makes them visible to the boundary; the
   // streaming lifecycle is owned by the HTTP transport (handleGraphEventsSSE).
   { method: "GET", pathname: "/engram/v1/offline-sync/snapshot-stream", operation: "offline_sync_snapshot_stream" },
+  { method: "GET", pathname: "/engram/v1/offline-sync/manifest-stream", operation: "offline_sync_snapshot_stream" },
   { method: "GET", pathname: "/engram/v1/graph/events", operation: "graph_events" },
   { method: "POST", pathname: "/engram/v1/chat/message", operation: "chat_message" },
   { method: "GET", pathname: "/engram/v1/chat/events/:id", operation: "chat_events" },

package/src/admin/admin-surfaces.ts

@@ -783,6 +783,7 @@ export interface PromotionStorageProvider {
        */
       lineage: string[];
       sourceConnector?: string;
+      toolScoped?: true;
     }
   ): Promise<string>;
 }
@@ -920,6 +921,7 @@ export async function promoteMemory(options: PromoteMemoryOptions): Promise<Memo
         validAt: sourceMemory.frontmatter.valid_at,
         lineage: [options.sourceMemoryId],
         ...(sourceMemory.frontmatter.sourceConnector ? { sourceConnector: sourceMemory.frontmatter.sourceConnector } : {}),
+        ...(sourceMemory.frontmatter.toolScoped ? { toolScoped: true as const } : {}),
       });
       target.promoted = true;
       target.promotedMemoryId = promotedId;

package/src/binary-lifecycle/pipeline.test.ts

@@ -7,8 +7,9 @@ import test from "node:test";
 
 import { runBinaryLifecyclePipeline } from "./pipeline.js";
 import { manifestPath, writeManifest } from "./manifest.js";
-import type { BinaryLifecycleConfig } from "./types.js";
+import type { BinaryLifecycleConfig, PipelineResult } from "./types.js";
 import type { BinaryStorageBackend } from "./backend.js";
+import { withEntityCanonicalMutationLock } from "../storage/entity-canonical-id-lock.js";
 
 const baseConfig: BinaryLifecycleConfig = {
   enabled: true,
@@ -666,6 +667,110 @@ test("binary lifecycle fails closed without overwriting an invalid manifest", as
   }
 });
 
+test("binary lifecycle entity redirects wait for the canonical mutation lock", async () => {
+  const targetDir = await mkdtemp(path.join(os.tmpdir(), "remnic-binary-entity-lock-"));
+  const controlDir = await mkdtemp(path.join(os.tmpdir(), "remnic-binary-control-"));
+  const entityPath = path.join(targetDir, "entities", "binary-lock-target.md");
+  const originalEntity = "entity before redirect\n\n![img](../image.png)\n";
+  const redirectedEntity = "entity before redirect\n\n![img](remote/image.png)\n";
+  let targetPromise: Promise<PipelineResult> | undefined;
+
+  try {
+    await Promise.all([
+      mkdir(path.dirname(entityPath), { recursive: true }),
+      mkdir(path.join(targetDir, "state"), { recursive: true }),
+    ]);
+    await Promise.all([
+      writeFile(path.join(targetDir, "image.png"), "image", "utf8"),
+      writeFile(entityPath, originalEntity, "utf8"),
+      writeFile(path.join(controlDir, "image.png"), "image", "utf8"),
+      writeFile(path.join(controlDir, "note.md"), "![img](image.png)\n", "utf8"),
+    ]);
+    const manifest = {
+      version: 1 as const,
+      assets: [
+        {
+          originalPath: "image.png",
+          mirroredPath: "remote/image.png",
+          contentHash: sha256("image"),
+          sizeBytes: "image".length,
+          mimeType: "image/png",
+          mirroredAt: "2026-01-01T00:00:00.000Z",
+          status: "mirrored" as const,
+        },
+      ],
+    };
+    await Promise.all([
+      writeManifest(targetDir, manifest),
+      writeManifest(controlDir, manifest),
+    ]);
+
+    const redirectPrepared = Promise.withResolvers<void>();
+    const continueRedirect = Promise.withResolvers<void>();
+    let targetFinished = false;
+
+    await withEntityCanonicalMutationLock(path.join(targetDir, "state"), async () => {
+      targetPromise = runBinaryLifecyclePipeline(
+        targetDir,
+        baseConfig,
+        nestedRemoteBackend,
+        noopLogger,
+        {
+          readMarkdownFile: async (filePath) => {
+            const content = await readFile(filePath, "utf8");
+            if (filePath === entityPath) {
+              redirectPrepared.resolve();
+              await continueRedirect.promise;
+            }
+            return content;
+          },
+        },
+      );
+      void targetPromise.then(
+        () => {
+          targetFinished = true;
+        },
+        () => undefined,
+      );
+
+      await redirectPrepared.promise;
+      continueRedirect.resolve();
+      const controlResult = await runBinaryLifecyclePipeline(
+        controlDir,
+        baseConfig,
+        nestedRemoteBackend,
+        noopLogger,
+      );
+      assert.equal(controlResult.redirected, 1);
+      assert.equal(
+        await readFile(path.join(controlDir, "note.md"), "utf8"),
+        "![img](remote/image.png)\n",
+      );
+      assert.equal(
+        targetFinished,
+        false,
+        "the target redirect must not finish while its entity mutation lock is held",
+      );
+      assert.equal(
+        await readFile(entityPath, "utf8"),
+        originalEntity,
+        "the entity redirect write must not enter while the canonical mutation lock is held",
+      );
+    });
+
+    assert.ok(targetPromise);
+    const targetResult = await targetPromise;
+    assert.equal(targetResult.redirected, 1);
+    assert.equal(await readFile(entityPath, "utf8"), redirectedEntity);
+  } finally {
+    await targetPromise?.catch(() => undefined);
+    await Promise.all([
+      rm(targetDir, { recursive: true, force: true }),
+      rm(controlDir, { recursive: true, force: true }),
+    ]);
+  }
+});
+
 const noopLogger = {
   info: () => {},
   warn: () => {},

package/src/binary-lifecycle/pipeline.ts

@@ -27,6 +27,7 @@ import {
   repairContentAfterJournalMove,
   requestEntityCanonicalIdReconcile,
 } from "../storage/entity-canonical-id-references.js";
+import { withRawEntityPageMutation } from "../storage/entity-canonical-id-lock.js";
 
 // Write-boundary journal cache for redirect rewrites (issue #2213).
 const historicalIdCache = new HistoricalEntityCanonicalIdCache();
@@ -338,6 +339,7 @@ async function stageRedirect(
         // keep their bytes (plus the redirect) untouched, and entities/ pages
         // get the bounded reconcile marker instead — their migrated surface
         // is relationship targets, not an entityRef frontmatter field.
+        await withRawEntityPageMutation(memoryDir, update.mdPath, async () => {
         const stateDir = path.join(memoryDir, "state");
         const kind = classifyEntityRefWritePath(memoryDir, update.mdPath);
         if (kind === "memory") {
@@ -371,6 +373,7 @@ async function stageRedirect(
             await requestEntityCanonicalIdReconcile(stateDir);
           }
         }
+        });
         // The redirect rewrote an on-disk memory file out-of-band (not through a
         // StorageManager mutation). Bump the corpus sentinel per write so a warm
         // hot-memories cache rescans — mid-batch too, never serving pre-redirect

package/src/coding/git-context.test.ts

@@ -331,6 +331,53 @@ test("resolveGitContext: custom invoker throwing on a later call → returns nul
   assert.equal(ctx, null);
 });
 
+test("#2206 resolveGitContext forwards caller cancellation to an active git probe", async () => {
+  const abortController = new AbortController();
+  let forwardedSignal: AbortSignal | undefined;
+  const pendingProbe = Promise.withResolvers<{ stdout: string; exitCode: number }>();
+  const invoker: GitInvoker = (_cwd, _args, options) => {
+    forwardedSignal = options?.abortSignal;
+    options?.abortSignal?.addEventListener(
+      "abort",
+      () => pendingProbe.reject(options.abortSignal?.reason),
+      { once: true },
+    );
+    return pendingProbe.promise;
+  };
+
+  const resolving = resolveGitContext("/work/repo", {
+    invoker,
+    abortSignal: abortController.signal,
+  });
+  await Promise.resolve();
+  abortController.abort(new Error("caller cancelled"));
+
+  await assert.rejects(resolving, /caller cancelled/);
+  assert.equal(forwardedSignal, abortController.signal);
+});
+
+test("#2206 resolveGitContext gives each probe only the remaining deadline budget", async () => {
+  const timeouts: number[] = [];
+  let now = 1_000;
+  const invoker: GitInvoker = (cwd, args, options) => {
+    timeouts.push(options?.timeoutMs ?? -1);
+    now += 100;
+    const command = args.join(" ");
+    if (command === "rev-parse --show-toplevel") return { stdout: cwd, exitCode: 0 };
+    if (command === "rev-parse --abbrev-ref HEAD") return { stdout: "main", exitCode: 0 };
+    return { stdout: "", exitCode: 1 };
+  };
+
+  const context = await resolveGitContext("/work/repo", {
+    invoker,
+    deadlineMs: 1_400,
+    now: () => now,
+  });
+
+  assert.ok(context);
+  assert.deepEqual(timeouts, [400, 300, 200, 100]);
+});
+
 // ──────────────────────────────────────────────────────────────────────────
 // resolveGitContext — happy path (origin, branch, default branch)
 // ──────────────────────────────────────────────────────────────────────────