@remnic/core 9.45.3 → 9.45.5

package/src/correction/correction-executor.test.ts

@@ -516,6 +516,69 @@ test("supersede retries loser retirement after a transient failure", async () =>
   });
 });
 
+test("#2206 cancellation terminalizes a plan after a replacement commits but retirement fails", async () => {
+  await withTempDir(async (dir) => {
+    const candidates = new Map<string, PlannerCandidate>([
+      ["mem-old", { memoryId: "mem-old", path: "facts/mem-old.md", content: "old", excerpt: "old", score: 1 }],
+    ]);
+    const state: FakeState = {
+      memories: new Map([["mem-old", fakeMemory({ memoryId: "mem-old", content: "old" })]]),
+      tombstones: [],
+      redactionRules: [],
+      auditRecords: [],
+      propagateCalls: 0,
+      writtenReplacements: [],
+    };
+    const plannerDeps: PlannerDeps = {
+      ...makePlannerDeps(dir, candidates),
+      classifyAndDraft: async () => ({
+        classification: "outdated",
+        confidence: 0.9,
+        actions: [
+          { kind: "supersede", loserId: "mem-old", replacement: { content: "new" } },
+          { kind: "redaction_rule", pattern: "later-action" },
+        ],
+        relevance: [{ memoryId: "mem-old", why: "x" }],
+        warnings: [],
+      }),
+    };
+    const planner = new CorrectionPlanner(plannerDeps);
+    const plan = await planner.plan({ text: "old", targetIds: ["mem-old"] }, ["default"]);
+    const abortController = new AbortController();
+    const deps = makeExecutorDeps(state);
+    let retirementAttempted = false;
+    deps.retireMemory = async () => {
+      retirementAttempted = true;
+      abortController.abort(new Error("correction deadline exceeded"));
+      throw new Error("injected retirement failure");
+    };
+
+    const outcome = await new CorrectionExecutor(deps, planner).apply("default", plan.planId, {
+      confirm: true,
+      abortSignal: abortController.signal,
+    });
+
+    assert.equal(retirementAttempted, true, "the cancellation must be injected from retirement");
+    assert.equal(outcome.status, "partial");
+    assert.equal((await planner.loadPlan("default", plan.planId))?.status, "partial");
+    assert.equal(state.writtenReplacements.length, 1);
+    assert.equal(state.memories.get("mem-old")?.status, "active");
+    assert.deepEqual(state.redactionRules, []);
+    assert.equal(
+      outcome.results.some((result) => result.action.kind === "redaction_rule" && result.status === "skipped"),
+      true,
+    );
+    const supersedeResults = outcome.results.filter((result) => result.action.kind === "supersede");
+    assert.deepEqual(
+      supersedeResults.map((result) => result.status),
+      ["applied", "failed"],
+      "the outcome must expose the committed replacement and failed retirement",
+    );
+    assert.match(supersedeResults[1]?.error ?? "", /injected retirement failure/);
+    assert.equal(state.auditRecords.length, 1);
+  });
+});
+
 test("tombstone emitted per retract; validUntil absent when bi-temporal OFF", async () => {
   await withTempDir(async (dir) => {
     const candidates = new Map<string, PlannerCandidate>([
@@ -934,7 +997,7 @@ test("#2128 cancellation after tombstone commit terminalizes the correction plan
   });
 });
 
-test("#2128 late cancellation before any mutation restores an applying plan to pending", async () => {
+test("#2206 cancellation after audit commit terminalizes an empty correction plan", async () => {
   await withTempDir(async (dir) => {
     const state: FakeState = {
       memories: new Map(),
@@ -950,8 +1013,40 @@ test("#2128 late cancellation before any mutation restores an applying plan to p
     const deps = makeExecutorDeps(state);
     const appendAuditRecord = deps.appendAuditRecord;
     deps.appendAuditRecord = async (namespace, record, signal) => {
+      const auditId = await appendAuditRecord(namespace, record, signal);
       abortController.abort(new Error("caller disconnected"));
-      return appendAuditRecord(namespace, record, signal);
+      return auditId;
+    };
+    const executor = new CorrectionExecutor(deps, planner);
+
+    const outcome = await executor.apply("default", plan.planId, {
+      confirm: true,
+      abortSignal: abortController.signal,
+    });
+    assert.equal(outcome.status, "applied");
+    assert.equal(state.auditRecords.length, 1);
+    assert.equal((await planner.loadPlan("default", plan.planId))?.status, "applied");
+  });
+});
+
+test("#2206 cancellation before audit commit restores an empty correction plan to pending", async () => {
+  await withTempDir(async (dir) => {
+    const state: FakeState = {
+      memories: new Map(),
+      tombstones: [],
+      redactionRules: [],
+      auditRecords: [],
+      propagateCalls: 0,
+      writtenReplacements: [],
+    };
+    const planner = new CorrectionPlanner(makePlannerDeps(dir, new Map()));
+    const plan = await planner.plan({ text: "nothing matches" }, ["default"]);
+    const abortController = new AbortController();
+    const deps = makeExecutorDeps(state);
+    deps.appendAuditRecord = async () => {
+      const reason = new Error("caller disconnected");
+      abortController.abort(reason);
+      throw reason;
     };
     const executor = new CorrectionExecutor(deps, planner);
 
@@ -959,6 +1054,7 @@ test("#2128 late cancellation before any mutation restores an applying plan to p
       () => executor.apply("default", plan.planId, { confirm: true, abortSignal: abortController.signal }),
       /caller disconnected/,
     );
+    assert.equal(state.auditRecords.length, 0);
     assert.equal((await planner.loadPlan("default", plan.planId))?.status, "pending");
   });
 });
@@ -1140,9 +1236,117 @@ test("#2128 cancellation skips unstarted actions after a committed edit", async
     assert.equal(state.memories.get("mem-edit")?.content, "edited");
     assert.deepEqual(state.redactionRules, [], "the cancelled plan must not start its second action");
     assert.equal(state.auditRecords.length, 1);
+    const skipped = outcome.results.filter((result) => result.status === "skipped");
+    assert.deepEqual(skipped.map((result) => result.action), [
+      { kind: "redaction_rule", pattern: "secret-token-\\d+" },
+    ]);
+    assert.deepEqual(state.auditRecords[0]?.outcome.results, outcome.results);
   });
 });
 
+test("#2206 cancellation interrupts rescope authorization before any destination write", async () => {
+  for (const priorEditCommitted of [false, true]) {
+    await withTempDir(async (dir) => {
+      const candidates = new Map<string, PlannerCandidate>([
+        ["mem-rescope", {
+          memoryId: "mem-rescope",
+          path: "facts/mem-rescope.md",
+          content: "move me",
+          excerpt: "move me",
+          score: 1,
+        }],
+      ]);
+      if (priorEditCommitted) {
+        candidates.set("mem-edit", {
+          memoryId: "mem-edit",
+          path: "facts/mem-edit.md",
+          content: "edit me",
+          excerpt: "edit me",
+          score: 1,
+        });
+      }
+      const state: FakeState = {
+        memories: new Map([
+          ["mem-rescope", fakeMemory({ memoryId: "mem-rescope", content: "move me" })],
+          ...(priorEditCommitted
+            ? [["mem-edit", fakeMemory({ memoryId: "mem-edit", content: "edit me" })] as const]
+            : []),
+        ]),
+        tombstones: [],
+        redactionRules: [],
+        auditRecords: [],
+        propagateCalls: 0,
+        writtenReplacements: [],
+      };
+      const actions: CorrectionAction[] = [
+        ...(priorEditCommitted
+          ? [{ kind: "edit", memoryId: "mem-edit", patch: "edited" } as const]
+          : []),
+        { kind: "rescope", memoryId: "mem-rescope", toNamespace: "destination" },
+      ];
+      const plannerDeps: PlannerDeps = {
+        ...makePlannerDeps(dir, candidates),
+        classifyAndDraft: async () => ({
+          classification: "outdated",
+          confidence: 0.9,
+          actions,
+          relevance: [...candidates.values()].map((candidate) => ({
+            memoryId: candidate.memoryId,
+            why: "test",
+          })),
+          warnings: [],
+        }),
+      };
+      const planner = new CorrectionPlanner(plannerDeps);
+      const plan = await planner.plan(
+        { text: "move memory", targetIds: [...candidates.keys()] },
+        ["default"],
+      );
+      const abortController = new AbortController();
+      const started = Promise.withResolvers<void>();
+      const authorization = Promise.withResolvers<boolean>();
+      let forwardedSignal: AbortSignal | undefined;
+      const applyResult = new CorrectionExecutor(makeExecutorDeps(state), planner)
+        .apply("default", plan.planId, {
+          confirm: true,
+          abortSignal: abortController.signal,
+          canWriteDestination: async (_namespace, abortSignal) => {
+            forwardedSignal = abortSignal;
+            started.resolve();
+            return authorization.promise;
+          },
+        })
+        .then(
+          (outcome) => ({ ok: true as const, outcome }),
+          (error: unknown) => ({ ok: false as const, error }),
+        );
+
+      await started.promise;
+      abortController.abort(new Error("correction deadline exceeded"));
+      assert.equal(forwardedSignal, abortController.signal);
+      assert.equal(forwardedSignal?.aborted, true);
+      authorization.resolve(true);
+      const result = await applyResult;
+      assert.equal(state.memories.get("mem-rescope")?.status, "active");
+      if (priorEditCommitted) {
+        assert.equal(result.ok, true);
+        assert.equal(result.outcome?.status, "partial");
+        assert.equal(
+          result.outcome?.results.some(
+            (entry) => entry.action.kind === "rescope" && entry.status === "skipped",
+          ),
+          true,
+        );
+        assert.equal((await planner.loadPlan("default", plan.planId))?.status, "partial");
+      } else {
+        assert.equal(result.ok, false);
+        assert.match(String(result.error), /correction deadline exceeded|correction apply aborted/);
+        assert.equal((await planner.loadPlan("default", plan.planId))?.status, "pending");
+      }
+    });
+  }
+});
+
 test("Of0pz: supersede with a missing loser writes NO replacement (preflight before write)", async () => {
   await withTempDir(async (dir) => {
     const candidates = new Map<string, PlannerCandidate>([

package/src/correction/correction-executor.ts

@@ -24,7 +24,7 @@
  * (`markConsumed`) under `serializeMutations` keyed by plan id (rule 40).
  */
 
-import { throwIfAborted } from "../abort-error.js";
+import { raceAbort, throwIfAborted } from "../abort-error.js";
 import { log } from "../logger.js";
 import { serializeMutations } from "../utils/serialize-mutations.js";
 import {
@@ -201,7 +201,7 @@ export class CorrectionExecutor {
        * thread: authorize-rescope-destination). Defaults to allow when the
        * source namespace already resolves to a writable scope (single-tenant).
        */
-      canWriteDestination?: (namespace: string) => Promise<boolean>;
+      canWriteDestination?: (namespace: string, abortSignal?: AbortSignal) => Promise<boolean>;
     }
   ): Promise<CorrectionOutcome> {
     throwIfAborted(opts.abortSignal, "correction apply aborted");
@@ -220,7 +220,7 @@ export class CorrectionExecutor {
   private async applyInternal(
     namespace: string,
     planId: string,
-    canWriteDestination?: (namespace: string) => Promise<boolean>,
+    canWriteDestination?: (namespace: string, abortSignal?: AbortSignal) => Promise<boolean>,
     abortSignal?: AbortSignal
   ): Promise<CorrectionOutcome> {
     throwIfAborted(abortSignal, "correction apply aborted");
@@ -307,10 +307,9 @@ export class CorrectionExecutor {
       }
     };
     let mutationCommitted = false;
-    let cancellationSafeAfterCommit = false;
     let cancellationRequestedAfterCommit = false;
     const throwIfAbortedBeforeCommit = (): void => {
-      if (!mutationCommitted || !cancellationSafeAfterCommit) {
+      if (!mutationCommitted) {
         throwIfAborted(abortSignal, "correction apply aborted");
       }
     };
@@ -409,7 +408,6 @@ export class CorrectionExecutor {
             retirementResult.status === "applied"
           ) {
             retiredReplacementActions.add(action);
-            cancellationSafeAfterCommit = true;
           }
         } catch (err) {
           if (abortSignal?.aborted) {
@@ -435,7 +433,6 @@ export class CorrectionExecutor {
             abortSignal
           );
           mutationCommitted = true;
-          cancellationSafeAfterCommit = true;
           results.push({ action, status: "applied", memoryId: editedId });
           appliedTouched.push(editedId);
         } catch (err) {
@@ -457,7 +454,6 @@ export class CorrectionExecutor {
             abortSignal
           );
           mutationCommitted = true;
-          cancellationSafeAfterCommit = true;
           results.push({ action, status: "applied" });
         } catch (err) {
           if (abortSignal?.aborted) {
@@ -501,7 +497,6 @@ export class CorrectionExecutor {
         );
         if (results.at(-1)?.status === "applied") {
           mutationCommitted = true;
-          cancellationSafeAfterCommit = true;
         }
         if (results.at(-1)?.action === action && results.at(-1)?.status === "applied") {
           removeFailedResultsFor(action);
@@ -518,7 +513,6 @@ export class CorrectionExecutor {
         );
         if (results.at(-1)?.status === "applied") {
           mutationCommitted = true;
-          cancellationSafeAfterCommit = true;
         }
         if (results.at(-1)?.action === action && results.at(-1)?.status === "applied") {
           removeFailedResultsFor(action);
@@ -530,7 +524,13 @@ export class CorrectionExecutor {
           // the write ACL (review thread: authorize-rescope-destination).
           // canWriteDestination defaults to allow when absent (single-tenant,
           // where the source namespace already resolved to a writable scope).
-          const allowed = canWriteDestination ? await canWriteDestination(action.toNamespace) : true;
+          const allowed = canWriteDestination
+            ? await raceAbort(
+                canWriteDestination(action.toNamespace, abortSignal),
+                abortSignal,
+                "correction apply aborted",
+              )
+            : true;
           if (!allowed) {
             results.push({
               action,
@@ -546,7 +546,6 @@ export class CorrectionExecutor {
             abortSignal
           );
           mutationCommitted = true;
-          cancellationSafeAfterCommit = true;
           // #1678 (thread OiiV6): report the DESTINATION memory id, not the
           // source. The source is archived by the move; callers that re-fetch
           // the reported id need the live (destination) memory, otherwise they
@@ -589,14 +588,25 @@ export class CorrectionExecutor {
     const propagationWarnings: string[] = [];
     if (appliedTouched.length > 0) {
       try {
-        await this.deps.propagate(namespace, appliedTouched, cancellationSafeAfterCommit ? undefined : abortSignal);
+        await this.deps.propagate(namespace, appliedTouched, mutationCommitted ? undefined : abortSignal);
       } catch (err) {
-        if ((!mutationCommitted || !cancellationSafeAfterCommit) && abortSignal?.aborted) throw err;
+        if (!mutationCommitted && abortSignal?.aborted) throw err;
         propagationWarnings.push(`propagation failed (non-fatal): ${errMsg(err)}`);
       }
     }
 
     await throwIfAbortedBeforeCommitAndReset();
+    if (cancellationRequestedAfterCommit) {
+      const recordedActions = new Set(results.map((result) => result.action));
+      for (const action of plan.actions) {
+        if (recordedActions.has(action)) continue;
+        results.push({
+          action,
+          status: "skipped",
+          error: "correction apply cancelled before action started",
+        });
+      }
+    }
     // ── Phase 4: audit record ─────────────────────────────────────────────
     const anyFailed = results.some((r) => r.status === "failed");
     const status: CorrectionOutcome["status"] =
@@ -621,20 +631,19 @@ export class CorrectionExecutor {
           outcome,
           requestText: plan.request.text,
         },
-        cancellationSafeAfterCommit ? undefined : abortSignal
+        mutationCommitted ? undefined : abortSignal
       );
       outcome.auditMemoryId = auditId;
     } catch (err) {
-      if ((!mutationCommitted || !cancellationSafeAfterCommit) && abortSignal?.aborted) throw err;
-      // The audit record is part of the contract but a failure to write it
-      // must NOT propagate — applied corrections are already durable. Record
-      // as a warning instead.
+      if (!mutationCommitted && abortSignal?.aborted) {
+        await resetApplying();
+        throw err;
+      }
       (outcome as CorrectionOutcome & { warnings?: string[] }).warnings = [
         ...propagationWarnings,
         `audit record write failed (non-fatal): ${errMsg(err)}`,
       ];
     }
-    await throwIfAbortedBeforeCommitAndReset();
 
     // ── Phase 5: mark plan consumed ───────────────────────────────────────
     // Corrections are already applied (phases 1-4 succeeded). A markConsumed

package/src/correction/correction-planner.test.ts

@@ -17,6 +17,7 @@ import path from "node:path";
 import { test } from "node:test";
 
 import { withTempDir as managedWithTempDir } from "../testing/tmp-dir.js";
+import { writeFileAtomically } from "../maintenance/atomic-file.js";
 import {
   CorrectionContractError,
   MEMORY_CATEGORIES,
@@ -301,6 +302,41 @@ test("plan persists atomically to state/corrections/pending/<planId>.json and ro
   });
 });
 
+test("#2206 cancellation after atomic plan commit returns the persisted plan without temp files", async () => {
+  await withTempDir(async (dir) => {
+    const state: StubState = {
+      candidatesById: new Map([["mem-x", makeCandidate({ memoryId: "mem-x", content: "old fact" })]]),
+      llmResult: {
+        classification: "outdated",
+        confidence: 0.9,
+        actions: [{ kind: "edit", memoryId: "mem-x", patch: "new fact" }],
+        relevance: [{ memoryId: "mem-x", why: "outdated" }],
+        warnings: [],
+      },
+      writeReplacementCalls: 0,
+      propagateCalls: 0,
+      retireCalls: 0,
+    };
+    const abortController = new AbortController();
+    const deps = makeDeps(dir, state);
+    deps.writePlanFile = async (outputPath, content) => {
+      await writeFileAtomically(outputPath, content);
+      abortController.abort(new Error("correction deadline exceeded"));
+    };
+    const planner = new CorrectionPlanner(deps);
+
+    const plan = await planner.plan(
+      { text: "old fact", targetIds: ["mem-x"] },
+      ["default"],
+      { abortSignal: abortController.signal },
+    );
+    const pendingDir = path.join(dir, "state", "corrections", "pending");
+    assert.equal(abortController.signal.aborted, true);
+    assert.equal((await planner.loadPlan("default", plan.planId))?.planId, plan.planId);
+    assert.equal((await readdir(pendingDir)).some((name) => name.endsWith(".tmp")), false);
+  });
+});
+
 test("plan expires after TTL — apply-time rejection is tested in executor; here we verify the timestamp", async () => {
   await withTempDir(async (dir) => {
     const state: StubState = {

package/src/correction/correction-planner.ts

@@ -20,9 +20,10 @@
  * only thing it persists is the plan document itself.
  */
 
-import { throwIfAborted } from "../abort-error.js";
-import { mkdir, readFile, rename, unlink, readdir, writeFile } from "node:fs/promises";
+import { readFile, readdir, unlink } from "node:fs/promises";
 import path from "node:path";
+import { throwIfAborted } from "../abort-error.js";
+import { writeFileAtomically } from "../maintenance/atomic-file.js";
 import { serializeMutations } from "../utils/serialize-mutations.js";
 import {
   CORRECTION_TEXT_MAX,
@@ -109,6 +110,8 @@ export interface PlannerDeps {
   }): Promise<string>;
   /** Per-namespace storage dir root (so the plan lands in the right state/). */
   storageDir(namespace: string): Promise<string>;
+  /** Atomic persistence seam used by focused lifecycle tests. */
+  writePlanFile?: (outputPath: string, content: string) => Promise<unknown>;
   /** Max affected memories per plan (issue config: default 10). */
   readonly maxAffected: number;
   /** Plan TTL in hours (issue config: default 24). */
@@ -431,13 +434,8 @@ export class CorrectionPlanner {
       : plan;
     await serializeMutations(`correction-plan:${target}`, async () => {
       throwIfAborted(abortSignal, "correction planning aborted");
-      await mkdir(dir, { recursive: true });
-      const tmp = `${target}.${process.pid}.${Date.now().toString(36)}.tmp`;
-      throwIfAborted(abortSignal, "correction planning aborted");
-      await writeFile(tmp, `${JSON.stringify(persistedPlan)}\n`, "utf-8");
-      throwIfAborted(abortSignal, "correction planning aborted");
-      // rename() is atomic on POSIX for same-filesystem renames (rule 54).
-      await rename(tmp, target);
+      const writePlanFile = this.deps.writePlanFile ?? writeFileAtomically;
+      await writePlanFile(target, `${JSON.stringify(persistedPlan)}\n`);
     });
     return plan;
   }
@@ -520,9 +518,7 @@ export class CorrectionPlanner {
             : a,
         );
       }
-      const tmp = `${file}.${process.pid}.${Date.now().toString(36)}.tmp`;
-      await writeFile(tmp, `${JSON.stringify(plan)}\n`, "utf-8");
-      await rename(tmp, file);
+      await writeFileAtomically(file, `${JSON.stringify(plan)}\n`);
     });
   }
   /**
@@ -545,9 +541,7 @@ export class CorrectionPlanner {
       if (!plan || plan.status !== "applying") return;
       plan.status = "pending";
       delete plan.applyingAt;
-      const tmp = `${file}.${process.pid}.${Date.now().toString(36)}.tmp`;
-      await writeFile(tmp, `${JSON.stringify(plan)}\n`, "utf-8");
-      await rename(tmp, file);
+      await writeFileAtomically(file, `${JSON.stringify(plan)}\n`);
     });
   }
 

package/src/correction/correction-service.ts

@@ -52,6 +52,7 @@ export interface CorrectionNamespacePolicy {
     namespace: string;
     sessionKey?: string;
     principal?: string;
+    abortSignal?: AbortSignal;
   }): Promise<boolean>;
   /** Namespaces the caller may read — scopes the planner's search. */
   readableNamespaces(request: {
@@ -144,11 +145,12 @@ export class CorrectionService {
       abortSignal: opts.abortSignal,
       // Authorize rescope destinations through the namespace policy bound to
       // THIS caller's principal (review thread: authorize-rescope-destination).
-      canWriteDestination: (dest) =>
+      canWriteDestination: (dest, abortSignal) =>
         this.deps.policy.canWriteNamespace({
           namespace: dest,
           ...(opts.sessionKey ? { sessionKey: opts.sessionKey } : {}),
           ...(opts.principal ? { principal: opts.principal } : {}),
+          ...(abortSignal ? { abortSignal } : {}),
         }),
     });
   }

package/src/correction/correction-storage-integration.test.ts

@@ -16,12 +16,17 @@ import type { MemoryFile } from "../types.js";
 
 import { StorageManager, ContentHashIndex } from "../storage.js";
 import { sanitizeMemoryContent } from "../sanitize.js";
+import { loadRedactionRules } from "../extraction-redaction-rules.js";
+import { writeFileAtomically } from "../maintenance/atomic-file.js";
 import {
+  type CorrectionAccessWiring,
   isEligibleCorrectionCandidate,
   applyEditMemory,
   appendTombstoneFn,
+  appendAuditRecordFn,
   retireMemoryFn,
   rescopeMemoryFn,
+  registerRedactionRuleFn,
   writeReplacementMemory,
 } from "./correction-access-wiring.js";
 
@@ -292,6 +297,78 @@ test("#2128 tombstone append returns its committed id after cancellation", async
   }
 });
 
+test("#2206 redaction adapter returns after a committed rule write despite cancellation", async () => {
+  const { storage, cleanup } = await makeStorage("remnic-corr-redaction-abort-");
+  try {
+    const abortController = new AbortController();
+    let commitCompleted = false;
+    const wiring = {
+      orchestrator: { getStorage: async () => storage },
+    } as unknown as CorrectionAccessWiring;
+
+    await registerRedactionRuleFn(
+      wiring,
+      "default",
+      "do-not-store-this",
+      abortController.signal,
+      async (outputPath, content) => {
+        await writeFileAtomically(outputPath, content);
+        commitCompleted = true;
+        abortController.abort(new Error("correction deadline exceeded"));
+      },
+    );
+
+    assert.equal(commitCompleted, true);
+    assert.deepEqual(
+      (await loadRedactionRules(storage.dir)).map((rule) => rule.pattern),
+      ["do-not-store-this"],
+    );
+  } finally {
+    await cleanup();
+  }
+});
+
+test("#2206 audit adapter returns its committed id despite cancellation", async () => {
+  const { storage, cleanup } = await makeStorage("remnic-corr-audit-abort-");
+  try {
+    const originalWriteSealedMemory = storage.writeSealedMemory.bind(storage);
+    const abortController = new AbortController();
+    let committed = false;
+    storage.writeSealedMemory = async (...args: Parameters<typeof storage.writeSealedMemory>) => {
+      const result = await originalWriteSealedMemory(...args);
+      committed = true;
+      abortController.abort(new Error("correction deadline exceeded"));
+      return result;
+    };
+    const wiring = {
+      orchestrator: { getStorage: async () => storage },
+    } as unknown as CorrectionAccessWiring;
+
+    const auditId = await appendAuditRecordFn(
+      wiring,
+      "default",
+      {
+        planId: "plan-2206",
+        classification: "outdated",
+        outcome: {
+          planId: "plan-2206",
+          status: "partial",
+          results: [],
+          auditMemoryId: "",
+          appliedAt: "2026-07-30T00:00:00.000Z",
+        },
+        requestText: "update the stored fact",
+      },
+      abortController.signal,
+    );
+
+    assert.equal(committed, true);
+    assert.equal((await storage.getMemoryById(auditId))?.frontmatter.category, "correction");
+  } finally {
+    await cleanup();
+  }
+});
+
 // ---------------------------------------------------------------------------
 // item 4: per-key tombstone emission
 // ---------------------------------------------------------------------------