@remnic/core 9.7.15 → 9.9.0

package/src/access-http.test.ts

@@ -1636,6 +1636,9 @@ test("HTTP externalRequestHandler runs pre-auth, can end responses, and falls th
         upgradeAvailable: null,
         doctorAvailable: null,
         debugStatus: "disabled",
+        pendingEmbeddings: null,
+        oldestPendingAgeMs: null,
+        embeddingBacklogThreshold: 1000,
       },
       nativeKnowledgeEnabled: false,
       projectionAvailable: false,
@@ -1748,6 +1751,9 @@ test("HTTP authTokenEntriesGetter is authoritative: scope policy binds connector
         upgradeAvailable: null,
         doctorAvailable: null,
         debugStatus: "disabled",
+        pendingEmbeddings: null,
+        oldestPendingAgeMs: null,
+        embeddingBacklogThreshold: 1000,
       },
       nativeKnowledgeEnabled: false,
       projectionAvailable: false,
@@ -2714,3 +2720,87 @@ test("PR #1852: static operator token has no connector provenance under rotation
     await server.stop();
   }
 });
+
+test("HTTP namespace/writable preflight returns the structured writability result", async () => {
+  // Real config through the pure resolver: the default namespace is writable
+  // for any principal; a foreign namespace with no policy is not. A rejection
+  // is a valid 200 answer (read via `ok`), not an HTTP error.
+  const service = {
+    configRef: parseConfig({ memoryDir: "/tmp/remnic-http-preflight-test", defaultNamespace: "default" }),
+  } as unknown as EngramAccessService;
+  const server = new EngramAccessHttpServer({
+    service,
+    port: 0,
+    authToken: "test-token",
+    adminConsoleEnabled: false,
+  });
+
+  const status = await server.start();
+  try {
+    const okRes = await fetch(
+      `http://127.0.0.1:${status.port}/engram/v1/namespace/writable?namespace=default`,
+      { headers: { authorization: "Bearer test-token" } },
+    );
+    assert.equal(okRes.status, 200);
+    assert.deepEqual(await okRes.json(), { ok: true, namespace: "default" });
+
+    const badRes = await fetch(
+      `http://127.0.0.1:${status.port}/engram/v1/namespace/writable?namespace=team-x`,
+      { headers: { authorization: "Bearer test-token" } },
+    );
+    assert.equal(badRes.status, 200);
+    const badBody = (await badRes.json()) as { ok: boolean; namespace: string };
+    assert.equal(badBody.ok, false);
+    assert.equal(badBody.namespace, "team-x");
+  } finally {
+    await server.stop();
+  }
+});
+
+test("HTTP namespace/writable preflight admits write-scoped tokens and rejects read-only ops", async () => {
+  const service = {
+    configRef: parseConfig({ memoryDir: "/tmp/remnic-http-preflight-ops-test", defaultNamespace: "default" }),
+  } as unknown as EngramAccessService;
+  const server = new EngramAccessHttpServer({
+    service,
+    port: 0,
+    authTokenEntriesGetter: () => [
+      { token: "write-scoped", capabilities: { version: 1, ops: ["observe", "memory_store"] } },
+      { token: "store-only", capabilities: { version: 1, ops: ["memory_store"] } },
+      { token: "diagnostic-only", capabilities: { version: 1, ops: ["namespace_writable"] } },
+      { token: "read-only", capabilities: { version: 1, ops: ["recall"] } },
+    ],
+    adminConsoleEnabled: false,
+  });
+  const status = await server.start();
+  const request = (token: string, op?: string) =>
+    fetch(
+      `http://127.0.0.1:${status.port}/engram/v1/namespace/writable?namespace=default${op ? `&op=${op}` : ""}`,
+      { headers: { authorization: `Bearer ${token}` } },
+    );
+  const okOf = async (r: Response) => {
+    const body = (await r.json()) as { ok?: unknown };
+    return body.ok;
+  };
+  try {
+    // A token scoped to write ops but NOT the namespace_writable op (e.g. minted
+    // before this endpoint existed) may still run the preflight.
+    const writeScoped = await request("write-scoped");
+    assert.equal(writeScoped.status, 200);
+    assert.equal(await okOf(writeScoped), true);
+    // Config-aware write op: a memory_store-only token is writable for the
+    // explicit store path (?op=memory_store) but not for the automatic observe
+    // path (default), which it cannot perform.
+    assert.equal(await okOf(await request("store-only", "memory_store")), true);
+    assert.equal(await okOf(await request("store-only")), false);
+    // A token scoped to the diagnostic op ONLY can call the endpoint but cannot
+    // write, so the answer is a definitive not-writable (never a false ok:true).
+    const diag = await request("diagnostic-only");
+    assert.equal(diag.status, 200);
+    assert.equal(await okOf(diag), false);
+    // A read-only token cannot write, so it has nothing to preflight → 403.
+    assert.equal((await request("read-only")).status, 403);
+  } finally {
+    await server.stop();
+  }
+});

package/src/access-http.ts

@@ -7,6 +7,7 @@ import path from "node:path";
 import { fileURLToPath, URL } from "node:url";
 import { gunzipSync } from "node:zlib";
 import { log } from "./logger.js";
+import { WriteRateLimiter } from "./write-rate-limiter.js";
 import { abortError, isAbortError } from "./abort-error.js";
 import { EngramAccessForbiddenError } from "./access-errors.js";
 import {
@@ -36,8 +37,10 @@ import {
 import { expandTildePath } from "./utils/path.js";
 import { projectTagProjectId } from "./coding/coding-namespace.js";
 import { getOperation, type OperationName } from "./access-boundary.js";
+import { resolveNamespacePreflight } from "./scopes/scope-plan.js";
 import {
   assertOperationAllowed,
+  capabilityAllowsOp,
   enforceNamespaceAllowList,
   isCapabilityRestricted,
   tokenCapabilityStore,
@@ -220,10 +223,6 @@ const RELAY_ADMIN_CONSOLE_ASSETS = new Map<string, string>([
   ["replay.json", "application/json; charset=utf-8"],
 ]);
 
-// Defaults for the write rate limit; overridable per instance via
-// `writeRateLimitWindowMs` / `writeRateLimitMaxRequests` (issue #1937).
-const WRITE_RATE_LIMIT_WINDOW_MS = 60_000;
-const WRITE_RATE_LIMIT_MAX_REQUESTS = 30;
 const TRUST_ZONE_RECORD_KINDS = ["memory", "artifact", "state", "trajectory", "external"] as const;
 const TRUST_ZONE_SOURCE_CLASSES = ["tool_output", "web_content", "subagent_trace", "system_memory", "user_input", "manual"] as const;
 
@@ -401,9 +400,7 @@ export class EngramAccessHttpServer {
     res: ServerResponse,
     ctx: { authorized: boolean },
   ) => Promise<boolean>;
-  private readonly writeRequestSlots: Array<{ readonly recordedAt: number }> = [];
-  private readonly writeRateLimitMaxRequests: number;
-  private readonly writeRateLimitWindowMs: number;
+  private readonly writeLimiter: WriteRateLimiter;
   private readonly mcpServer: EngramMcpServer;
   private server: Server | null = null;
   private boundPort = 0;
@@ -440,20 +437,10 @@ export class EngramAccessHttpServer {
     this.maxBodyBytes = Number.isFinite(options.maxBodyBytes)
       ? Math.max(1, Math.floor(options.maxBodyBytes ?? 131072))
       : 131072;
-    // Defensive inline validation (config parsers reject invalid values
-    // loudly upstream; this only guards direct programmatic constructions).
-    this.writeRateLimitMaxRequests =
-      typeof options.writeRateLimitMaxRequests === "number" &&
-      Number.isInteger(options.writeRateLimitMaxRequests) &&
-      options.writeRateLimitMaxRequests >= 1
-        ? options.writeRateLimitMaxRequests
-        : WRITE_RATE_LIMIT_MAX_REQUESTS;
-    this.writeRateLimitWindowMs =
-      typeof options.writeRateLimitWindowMs === "number" &&
-      Number.isInteger(options.writeRateLimitWindowMs) &&
-      options.writeRateLimitWindowMs >= 1
-        ? options.writeRateLimitWindowMs
-        : WRITE_RATE_LIMIT_WINDOW_MS;
+    this.writeLimiter = new WriteRateLimiter(
+      options.writeRateLimitMaxRequests,
+      options.writeRateLimitWindowMs,
+    );
     this.adminConsoleEnabled = options.adminConsoleEnabled !== false;
     this.adminConsolePublicDir = options.adminConsolePublicDir ?? defaultAdminConsolePublicDir;
     this.adminConsolePrefillToken = options.adminConsolePrefillToken === true ? this.authToken : undefined;
@@ -1098,7 +1085,7 @@ export class EngramAccessHttpServer {
     ) {
       this.enforceTokenOp("capsule_export"); // boundary dispatch (issue #1525)
       const body = await this.readValidatedBody(req, "capsuleExport");
-      this.ensureWriteRateLimitAvailable();
+      this.ensureWriteRateLimitAvailable(req);
       const result = await this.service.capsuleExport({
         name: body.name,
         namespace: this.resolveNamespace(req, body.namespace),
@@ -1109,7 +1096,7 @@ export class EngramAccessHttpServer {
         includeTranscripts: body.includeTranscripts,
         encrypt: body.encrypt,
       });
-      this.recordWriteRateLimitHit();
+      this.recordWriteRateLimitHit(req);
       this.respondJson(res, 200, result);
       return;
     }
@@ -1120,7 +1107,7 @@ export class EngramAccessHttpServer {
     ) {
       this.enforceTokenOp("capsule_import"); // boundary dispatch (issue #1525)
       const body = await this.readValidatedBody(req, "capsuleImport");
-      this.ensureWriteRateLimitAvailable();
+      this.ensureWriteRateLimitAvailable(req);
       const result = await this.service.capsuleImport({
         archivePath: expandTildePath(body.archivePath),
         namespace: this.resolveNamespace(req, body.namespace),
@@ -1128,7 +1115,7 @@ export class EngramAccessHttpServer {
         mode: body.mode,
         passphrase: body.passphrase,
       });
-      this.recordWriteRateLimitHit();
+      this.recordWriteRateLimitHit(req);
       this.respondJson(res, 200, result);
       return;
     }
@@ -1480,6 +1467,23 @@ export class EngramAccessHttpServer {
       return;
     }
 
+    // Namespace-writability preflight (issue #1888 part 3): would the client's
+    // enabled write (`?op=observe|memory_store`, default observe) to the
+    // requested namespace by THIS token succeed? Out-of-allow-list → 200
+    // {ok:false}; any allowedByOps token may run it (HTTP + batch admit alike).
+    if (req.method === "GET" && pathname === "/engram/v1/namespace/writable") {
+      const preflightOp = getOperation("namespace_writable"); // boundary marker (catalog parity, issue #1888)
+      const caps = tokenCapabilityStore.getStore();
+      if (!(preflightOp?.spec.allowedByOps ?? []).some((op) => capabilityAllowsOp(caps, op))) {
+        throw new EngramAccessForbiddenError("token is not permitted to run the namespace preflight");
+      }
+      const ns = parsed.searchParams.get("namespace") || undefined;
+      const sk = parsed.searchParams.get("session") || undefined;
+      const writeOp = parsed.searchParams.get("op") === "memory_store" ? "memory_store" : "observe";
+      this.respondJson(res, 200, resolveNamespacePreflight(caps, ns, sk, this.resolveRequestPrincipal(req), this.service.configRef, writeOp));
+      return;
+    }
+
     // -- Wearables (Limitless / Bee / Omi transcript ingestion). All
     //    behavior + validation lives in WearablesService; these routes
     //    translate transport shape only. Service validation errors map
@@ -1639,12 +1643,12 @@ export class EngramAccessHttpServer {
         // attempt may have consumed the last quota slot; the retry returns the
         // cached response without requiring another. Matches memory_store's
         // hook-in-the-lock pattern (#1434 invariant).
-        { enforceWriteQuota: () => this.ensureWriteRateLimitAvailable() },
+        { enforceWriteQuota: () => this.ensureWriteRateLimitAvailable(req) },
       );
       // A replayed (deduplicated) observe must not consume a second write-quota
       // slot — same invariant as memory_store/suggestion_submit (#1434).
       if (this.shouldCountWriteRateLimit(response as { dryRun?: boolean; idempotencyReplay?: boolean })) {
-        this.recordWriteRateLimitHit();
+        this.recordWriteRateLimitHit(req);
       }
       this.respondJson(res, 202, response);
       return;
@@ -1671,13 +1675,13 @@ export class EngramAccessHttpServer {
     ) {
       this.enforceTokenOp("lcm_compaction_flush"); // boundary dispatch (issue #1525)
       const body = await this.readValidatedBody(req, "lcmCompactionFlush");
-      this.ensureWriteRateLimitAvailable();
+      this.ensureWriteRateLimitAvailable(req);
       const response = await this.service.lcmCompactionFlush({
         sessionKey: body.sessionKey,
         namespace: this.resolveNamespace(req, body.namespace),
         authenticatedPrincipal: this.resolveRequestPrincipal(req),
       });
-      this.recordWriteRateLimitHit();
+      this.recordWriteRateLimitHit(req);
       this.respondJson(res, 200, response);
       return;
     }
@@ -1688,7 +1692,7 @@ export class EngramAccessHttpServer {
     ) {
       this.enforceTokenOp("lcm_compaction_record"); // boundary dispatch (issue #1525)
       const body = await this.readValidatedBody(req, "lcmCompactionRecord");
-      this.ensureWriteRateLimitAvailable();
+      this.ensureWriteRateLimitAvailable(req);
       const response = await this.service.lcmCompactionRecord({
         sessionKey: body.sessionKey,
         namespace: this.resolveNamespace(req, body.namespace),
@@ -1696,7 +1700,7 @@ export class EngramAccessHttpServer {
         tokensAfter: body.tokensAfter,
         authenticatedPrincipal: this.resolveRequestPrincipal(req),
       });
-      this.recordWriteRateLimitHit();
+      this.recordWriteRateLimitHit(req);
       this.respondJson(res, 200, response);
       return;
     }
@@ -1754,7 +1758,7 @@ export class EngramAccessHttpServer {
             authenticatedPrincipal: this.resolveRequestPrincipal(req),
             hooks: {
               enforceWriteQuota: () => {
-                releaseWriteQuota ??= this.reserveWriteRateLimitSlot();
+                releaseWriteQuota ??= this.reserveWriteRateLimitSlot(req);
               },
             },
           },
@@ -1836,14 +1840,14 @@ export class EngramAccessHttpServer {
       const output = (await op.run(envelope, {
         service: this.service,
         authenticatedPrincipal: this.resolveRequestPrincipal(req),
-        hooks: { enforceWriteQuota: () => this.ensureWriteRateLimitAvailable() },
+        hooks: { enforceWriteQuota: () => this.ensureWriteRateLimitAvailable(req) },
         // Phase 1 provenance: server-resolved connector identity from the
         // bearer token (REST path, mirroring the MCP tools/call dispatch).
         sourceConnector: this.resolveConnector(req),
       })) as { result: EngramAccessWriteResponse };
       const response = output.result;
       if (this.shouldCountWriteRateLimit(response as { dryRun?: boolean; idempotencyReplay?: boolean })) {
-        this.recordWriteRateLimitHit();
+        this.recordWriteRateLimitHit(req);
       }
       this.respondJson(res, this.writeResponseStatus(response), response);
       return;
@@ -1861,7 +1865,7 @@ export class EngramAccessHttpServer {
       const isWriteSubcommand =
         body.subcommand === "record" || body.subcommand === "supersede";
       if (isWriteSubcommand) {
-        this.ensureWriteRateLimitAvailable();
+        this.ensureWriteRateLimitAvailable(req);
       }
       const op = getOperation("coding_decision");
       if (!op) {
@@ -1873,7 +1877,7 @@ export class EngramAccessHttpServer {
         sourceConnector: this.resolveConnector(req),
       })) as { result: unknown };
       if (isWriteSubcommand) {
-        this.recordWriteRateLimitHit();
+        this.recordWriteRateLimitHit(req);
       }
       this.respondJson(res, 200, output.result);
       return;
@@ -1886,7 +1890,7 @@ export class EngramAccessHttpServer {
       const body = await this.readJsonBody(req);
       const isWriteSubcommand = body.subcommand === "refresh";
       if (isWriteSubcommand) {
-        this.ensureWriteRateLimitAvailable();
+        this.ensureWriteRateLimitAvailable(req);
       }
       const op = getOperation("coding_architecture");
       if (!op) {
@@ -1898,7 +1902,7 @@ export class EngramAccessHttpServer {
         sourceConnector: this.resolveConnector(req),
       })) as { result: unknown };
       if (isWriteSubcommand) {
-        this.recordWriteRateLimitHit();
+        this.recordWriteRateLimitHit(req);
       }
       this.respondJson(res, 200, output.result);
       return;
@@ -1932,7 +1936,7 @@ export class EngramAccessHttpServer {
       // mirror the apply route's precheck + accounting to bound files under
       // state/corrections/pending instead of letting an HTTP client create
       // unbounded plan files without consuming write quota.
-      this.ensureWriteRateLimitAvailable();
+      this.ensureWriteRateLimitAvailable(req);
       const body = await this.readJsonBody(req);
       const op = getOperation("memory_correct_plan");
       if (!op) {
@@ -1942,13 +1946,13 @@ export class EngramAccessHttpServer {
         service: this.service,
         authenticatedPrincipal: this.resolveRequestPrincipal(req),
       })) as { result: unknown };
-      this.recordWriteRateLimitHit();
+      this.recordWriteRateLimitHit(req);
       this.respondJson(res, 200, output.result);
       return;
     }
 
     if (req.method === "POST" && pathname === "/engram/v1/correction/apply") {
-      this.ensureWriteRateLimitAvailable();
+      this.ensureWriteRateLimitAvailable(req);
       const body = await this.readJsonBody(req);
       const op = getOperation("memory_correct_apply");
       if (!op) {
@@ -1958,7 +1962,7 @@ export class EngramAccessHttpServer {
         service: this.service,
         authenticatedPrincipal: this.resolveRequestPrincipal(req),
       })) as { result: unknown };
-      this.recordWriteRateLimitHit();
+      this.recordWriteRateLimitHit(req);
       this.respondJson(res, 200, output.result);
       return;
     }
@@ -2011,10 +2015,10 @@ export class EngramAccessHttpServer {
       // (enforceWriteQuota), atomic with the real miss and never on a replay; no
       // HTTP pre-check, so a stale peek can't 429 a safe replay (#1434 Codex review).
       const response = await this.service.suggestionSubmit(request, {
-        enforceWriteQuota: () => this.ensureWriteRateLimitAvailable(),
+        enforceWriteQuota: () => this.ensureWriteRateLimitAvailable(req),
       });
       if (this.shouldCountWriteRateLimit(response as { dryRun?: boolean; idempotencyReplay?: boolean })) {
-        this.recordWriteRateLimitHit();
+        this.recordWriteRateLimitHit(req);
       }
       this.respondJson(res, this.writeResponseStatus(response), response);
       return;
@@ -2203,7 +2207,7 @@ export class EngramAccessHttpServer {
     if (req.method === "POST" && pathname === "/engram/v1/review-disposition") {
       this.enforceTokenOp("review_disposition"); // boundary dispatch (issue #1525)
       const body = await this.readValidatedBody(req, "reviewDisposition");
-      this.ensureWriteRateLimitAvailable();
+      this.ensureWriteRateLimitAvailable(req);
       const response = await this.service.reviewDisposition({
         memoryId: body.memoryId,
         status: body.status,
@@ -2212,7 +2216,7 @@ export class EngramAccessHttpServer {
         authenticatedPrincipal: this.resolveRequestPrincipal(req),
       });
       if (this.shouldCountWriteRateLimit(response as unknown as { dryRun?: boolean; idempotencyReplay?: boolean })) {
-        this.recordWriteRateLimitHit();
+        this.recordWriteRateLimitHit(req);
       }
       this.respondJson(res, 200, response);
       return;
@@ -2223,7 +2227,7 @@ export class EngramAccessHttpServer {
       const body = await this.readValidatedBody(req, "trustZonePromote");
       const dryRun = body.dryRun === true;
       if (!dryRun) {
-        this.ensureWriteRateLimitAvailable();
+        this.ensureWriteRateLimitAvailable(req);
       }
       const response = await this.service.trustZonePromote({
         recordId: body.recordId,
@@ -2236,7 +2240,7 @@ export class EngramAccessHttpServer {
         authenticatedPrincipal: this.resolveRequestPrincipal(req),
       });
       if (this.shouldCountWriteRateLimit(response as unknown as { dryRun?: boolean; idempotencyReplay?: boolean })) {
-        this.recordWriteRateLimitHit();
+        this.recordWriteRateLimitHit(req);
       }
       this.respondJson(res, response.dryRun ? 200 : 201, response);
       return;
@@ -2247,7 +2251,7 @@ export class EngramAccessHttpServer {
       const body = await this.readValidatedBody(req, "trustZoneDemoSeed");
       const dryRun = body.dryRun === true;
       if (!dryRun) {
-        this.ensureWriteRateLimitAvailable();
+        this.ensureWriteRateLimitAvailable(req);
       }
       const response = await this.service.trustZoneDemoSeed({
         scenario: body.scenario,
@@ -2257,7 +2261,7 @@ export class EngramAccessHttpServer {
         authenticatedPrincipal: this.resolveRequestPrincipal(req),
       });
       if (this.shouldCountWriteRateLimit(response as unknown as { dryRun?: boolean; idempotencyReplay?: boolean })) {
-        this.recordWriteRateLimitHit();
+        this.recordWriteRateLimitHit(req);
       }
       this.respondJson(res, response.dryRun ? 200 : 201, response);
       return;
@@ -2832,7 +2836,7 @@ export class EngramAccessHttpServer {
       const dryRun = body.dryRun === true;
       const namespace = this.resolveNamespace(req, typeof body.namespace === "string" ? body.namespace : undefined);
       if (!dryRun) {
-        this.ensureWriteRateLimitAvailable();
+        this.ensureWriteRateLimitAvailable(req);
       }
       const result = await this.service.dreamsRun({
         phase: phase as import("./types.js").DreamsPhase,
@@ -2841,7 +2845,7 @@ export class EngramAccessHttpServer {
         authenticatedPrincipal: this.resolveRequestPrincipal(req),
       });
       if (this.shouldCountWriteRateLimit(result as { dryRun?: boolean; idempotencyReplay?: boolean })) {
-        this.recordWriteRateLimitHit();
+        this.recordWriteRateLimitHit(req);
       }
       this.respondJson(res, 200, result);
       return;
@@ -2984,7 +2988,7 @@ export class EngramAccessHttpServer {
         // Rate-limit the promotion write, matching every other write route
         // (observe, trust-zone promotion, etc.). The check throws on limit
         // exceeded; the hit is recorded after the write succeeds.
-        this.ensureWriteRateLimitAvailable();
+        this.ensureWriteRateLimitAvailable(req);
         const result = await this.service.adminPromoteMemory({
           sourceMemoryId: body.sourceMemoryId,
           namespace: typeof body.namespace === "string" ? body.namespace : undefined,
@@ -2994,7 +2998,7 @@ export class EngramAccessHttpServer {
           reason: body.reason,
         });
         // actor is derived from the authenticated principal inside adminPromoteMemory;
-        this.recordWriteRateLimitHit();
+        this.recordWriteRateLimitHit(req);
         this.respondJson(res, 200, result);
       } catch (err) {
         if (err instanceof EngramAccessInputError) {
@@ -3251,7 +3255,7 @@ export class EngramAccessHttpServer {
     const observeSelfEnforcesQuota =
       toolName === "engram.observe" || toolName === "remnic.observe";
     if (isMcpWrite && !observeSelfEnforcesQuota) {
-      this.ensureWriteRateLimitAvailable();
+      this.ensureWriteRateLimitAvailable(req);
     }
 
     const sessionId = (() => {
@@ -3290,7 +3294,7 @@ export class EngramAccessHttpServer {
       sessionId,
       correlationId: mcpCorrelationId,
       enforceWriteQuota: observeSelfEnforcesQuota
-        ? () => this.ensureWriteRateLimitAvailable()
+        ? () => this.ensureWriteRateLimitAvailable(req)
         : undefined,
       sourceConnector: this.resolveConnector(req),
       abortSignal,
@@ -3314,7 +3318,7 @@ export class EngramAccessHttpServer {
       // dryRun/idempotencyReplay guards.
       const counts = structured ? this.shouldCountWriteRateLimit(structured) : true;
       if (!isError && !isRejectedCodegraph && counts) {
-        this.recordWriteRateLimitHit();
+        this.recordWriteRateLimitHit(req);
       }
     }
     // A mutating tool may have committed just before the client disconnected.
@@ -3874,34 +3878,30 @@ export class EngramAccessHttpServer {
     return 200;
   }
 
-  private ensureWriteRateLimitAvailable(): void {
-    const now = Date.now();
-    while (
-      this.writeRequestSlots.length > 0 &&
-      now - (this.writeRequestSlots[0]?.recordedAt ?? 0) > this.writeRateLimitWindowMs
-    ) {
-      this.writeRequestSlots.shift();
-    }
-    if (this.writeRequestSlots.length >= this.writeRateLimitMaxRequests) {
+  private ensureWriteRateLimitAvailable(req?: IncomingMessage): void {
+    if (!this.writeLimiter.hasCapacity(this.principalForRateLimit(req))) {
       throw new HttpError(429, "write_rate_limited", "write_rate_limited");
     }
   }
 
-  private recordWriteRateLimitHit(): void {
-    this.writeRequestSlots.push({ recordedAt: Date.now() });
+  private recordWriteRateLimitHit(req?: IncomingMessage): void {
+    this.writeLimiter.record(this.principalForRateLimit(req));
   }
 
-  private reserveWriteRateLimitSlot(): () => void {
-    this.ensureWriteRateLimitAvailable();
-    const slot = { recordedAt: Date.now() };
-    this.writeRequestSlots.push(slot);
-    let active = true;
-    return () => {
-      if (!active) return;
-      active = false;
-      const index = this.writeRequestSlots.indexOf(slot);
-      if (index >= 0) this.writeRequestSlots.splice(index, 1);
-    };
+  private reserveWriteRateLimitSlot(req?: IncomingMessage): () => void {
+    const release = this.writeLimiter.reserve(this.principalForRateLimit(req));
+    if (!release) {
+      throw new HttpError(429, "write_rate_limited", "write_rate_limited");
+    }
+    return release;
+  }
+
+  private principalForRateLimit(req?: IncomingMessage): string | undefined {
+    if (!req) return undefined;
+    // Fall back to the authenticated connector identity when no principal is
+    // resolved, so per-connector bearer tokens are isolated from each other
+    // even without a principal header/server principal (issue #2029 review).
+    return this.resolveRequestPrincipal(req) ?? this.resolveConnector(req);
   }
 
   private shouldCountWriteRateLimit(response: { dryRun?: boolean; idempotencyReplay?: boolean }): boolean {

package/src/access-mcp-cancellation.test.ts

@@ -6,6 +6,10 @@ import { abortError } from "./abort-error.js";
 import { EngramAccessHttpServer } from "./access-http.js";
 import { EngramMcpServer } from "./access-mcp.js";
 import { EngramAccessService, type EngramAccessRecallRequest } from "./access-service.js";
+import {
+  type RecallCoordinatorHost,
+  withRecallConcurrency,
+} from "./access-recall-concurrency.js";
 
 function deferred<T = void>(): {
   promise: Promise<T>;
@@ -282,7 +286,7 @@ test("MCP write quota is recorded after commit even when the client disconnects
   });
   const serverHost = server as unknown as {
     mcpServer: EngramMcpServer;
-    writeRequestSlots: Array<{ readonly recordedAt: number }>;
+    writeLimiter: { totalSlots(): number };
   };
   const originalHandleRequest = serverHost.mcpServer.handleRequest.bind(serverHost.mcpServer);
   serverHost.mcpServer.handleRequest = async (request, options) => {
@@ -318,7 +322,7 @@ test("MCP write quota is recorded after commit even when the client disconnects
 
     await waitFor(operationSettled.promise);
     await new Promise<void>((resolve) => setImmediate(resolve));
-    assert.equal(serverHost.writeRequestSlots.length, 1);
+    assert.equal(serverHost.writeLimiter.totalSlots(), 1);
     assert.equal(responseStarted, false, "the disconnected client must not receive the committed write response");
   } finally {
     releaseOperation.resolve();
@@ -338,14 +342,19 @@ test("a disconnected MCP recall queued on the budget lock never starts and does
 
   const lockService = Object.create(EngramAccessService.prototype) as EngramAccessService;
   const lockHost = lockService as unknown as {
-    budgetLocks: Map<string, Promise<void>>;
-    withBudgetLock<T>(
+    recallSemaphores: Map<string, unknown>;
+    orchestrator: { config: Record<string, unknown> };
+    withRecallConcurrency<T>(
       principal: string,
       abortSignal: AbortSignal | undefined,
-      operation: () => Promise<T>,
+      operation: (queueWaitMs: number) => Promise<T>,
     ): Promise<T>;
   };
-  lockHost.budgetLocks = new Map();
+  lockHost.recallSemaphores = new Map();
+  // limit=1 preserves the exact pre-#1906 serialization this test exercises:
+  // the second recall queues behind the first, and an abort while queued now
+  // rejects it immediately (before the holder releases).
+  lockHost.orchestrator = { config: { recallMaxConcurrentPerPrincipal: 1 } };
 
   const service = {
     recall: async (input: EngramAccessRecallRequest) => {
@@ -356,7 +365,7 @@ test("a disconnected MCP recall queued on the budget lock never starts and does
         secondQueued.resolve();
       }
       try {
-        return await lockHost.withBudgetLock("principal", input.abortSignal, async () => {
+        return await withRecallConcurrency(lockHost as unknown as RecallCoordinatorHost, "principal", input.abortSignal, async () => {
           if (call === 1) {
             firstStarted.resolve();
             await releaseFirst.promise;