superlocalmemory 3.8.9 → 3.8.10

package/src/superlocalmemory/mcp/tools_core.py

@@ -105,6 +105,7 @@ def register_core_tools(server, get_engine: Callable) -> None:
         # recall window so a parallel/next agent finds memories saved seconds ago.
         # Falls back to the capability-owned worker only if the daemon is
         # unreachable. Raw pending.db writes are legacy replay input only.
+        daemon_owned = False
         try:
             import asyncio as _asyncio
             from superlocalmemory.cli.daemon import daemon_request, is_daemon_running
@@ -159,6 +160,15 @@ def register_core_tools(server, get_engine: Callable) -> None:
                 }
         except Exception as dexc:
             logger.debug("MCP remember via daemon failed, pending fallback: %s", dexc)
+            if daemon_owned:
+                return {
+                    "success": False,
+                    "code": "DAEMON_UNAVAILABLE",
+                    "retryable": True,
+                    "error": (
+                        "DAEMON_UNAVAILABLE: owned daemon is unavailable; retry later."
+                    ),
+                }
 
         try:
             import asyncio as _asyncio
@@ -174,11 +184,12 @@ def register_core_tools(server, get_engine: Callable) -> None:
                     or "mcp:" + hashlib.sha256(content.encode("utf-8")).hexdigest()
                 ),
             }
-            stored = await _asyncio.to_thread(
-                choose_pool().store,
-                content,
-                worker_meta,
-            )
+
+            def _store_via_daemon_pool():
+                pool = choose_pool()
+                return pool.store(content, worker_meta)
+
+            stored = await _asyncio.to_thread(_store_via_daemon_pool)
             if not isinstance(stored, dict) or not stored.get("ok"):
                 if isinstance(stored, dict) and stored.get("code") == "DAEMON_UNAVAILABLE":
                     return {

package/src/superlocalmemory/optimize/proxy/capture.py

@@ -74,7 +74,7 @@ def _windows_owner_dacl(
     win32api: Any,
     win32con: Any,
     win32security: Any,
-) -> Any:
+) -> tuple[Any, Any]:
     """Build one protected owner-only DACL for a Windows capture file."""
     import ntsecuritycon
 
@@ -95,7 +95,53 @@ def _windows_owner_dacl(
         ntsecuritycon.FILE_ALL_ACCESS,
         owner_sid,
     )
-    return dacl
+    return owner_sid, dacl
+
+
+def _windows_dacl_is_owner_only(
+    security_descriptor: Any,
+    owner_sid: Any,
+    ntsecuritycon: Any,
+    win32security: Any,
+) -> bool:
+    """Return whether a live descriptor already matches the capture policy."""
+    def _same_sid(left: Any, right: Any) -> bool:
+        try:
+            return (
+                win32security.ConvertSidToStringSid(left)
+                == win32security.ConvertSidToStringSid(right)
+            )
+        except Exception:
+            return False
+
+    control, _revision = security_descriptor.GetSecurityDescriptorControl()
+    if not control & win32security.SE_DACL_PROTECTED:
+        return False
+
+    descriptor_owner = security_descriptor.GetSecurityDescriptorOwner()
+    if descriptor_owner is None or not _same_sid(
+        descriptor_owner,
+        owner_sid,
+    ):
+        return False
+
+    dacl = security_descriptor.GetSecurityDescriptorDacl()
+    if dacl is None or dacl.GetAceCount() != 1:
+        return False
+
+    ace = dacl.GetAce(0)
+    if not isinstance(ace, tuple) or len(ace) != 3:
+        return False
+    ace_header, access_mask, ace_sid = ace
+    if (
+        not isinstance(ace_header, tuple)
+        or not ace_header
+        or ace_header[0] != win32security.ACCESS_ALLOWED_ACE_TYPE
+    ):
+        return False
+    if access_mask & ntsecuritycon.FILE_ALL_ACCESS != ntsecuritycon.FILE_ALL_ACCESS:
+        return False
+    return _same_sid(ace_sid, owner_sid)
 
 
 def _open_windows_capture_append(path: Path) -> int:
@@ -117,7 +163,11 @@ def _open_windows_capture_append(path: Path) -> int:
         # ever inheriting a broader parent DACL. For an existing file Windows
         # ignores this descriptor; _enforce_owner_only_permissions replaces
         # that DACL through the same WRITE_DAC-capable handle before writing.
-        dacl = _windows_owner_dacl(win32api, win32con, win32security)
+        owner_sid, dacl = _windows_owner_dacl(
+            win32api,
+            win32con,
+            win32security,
+        )
         security_attributes = win32security.SECURITY_ATTRIBUTES()
         security_attributes.bInheritHandle = False
         security_attributes.SECURITY_DESCRIPTOR.SetSecurityDescriptorDacl(
@@ -129,21 +179,57 @@ def _open_windows_capture_append(path: Path) -> int:
             win32security.SE_DACL_PROTECTED,
             win32security.SE_DACL_PROTECTED,
         )
-        handle = win32file.CreateFile(
-            os.fspath(path),
-            ntsecuritycon.FILE_APPEND_DATA | ntsecuritycon.WRITE_DAC,
+        desired_access = (
+            ntsecuritycon.FILE_APPEND_DATA
+            | ntsecuritycon.WRITE_DAC
+            | ntsecuritycon.READ_CONTROL
+        )
+        share_mode = (
             win32con.FILE_SHARE_READ
             | win32con.FILE_SHARE_WRITE
-            | win32con.FILE_SHARE_DELETE,
-            security_attributes,
-            win32con.OPEN_ALWAYS,
+            | win32con.FILE_SHARE_DELETE
+        )
+        file_flags = (
             win32con.FILE_ATTRIBUTE_NORMAL
             # pywin32 does not export this SDK constant from win32con on
             # every supported Python build. Keep the Microsoft-defined value
             # as a named fallback rather than silently following a reparse.
-            | getattr(win32con, "FILE_FLAG_OPEN_REPARSE_POINT", 0x00200000),
-            None,
+            | getattr(win32con, "FILE_FLAG_OPEN_REPARSE_POINT", 0x00200000)
         )
+        try:
+            # CREATE_NEW is the only race-safe proof that the protected
+            # SECURITY_ATTRIBUTES were applied to this exact file.  OPEN_ALWAYS
+            # would require trusting GetLastError after the pywin32 wrapper has
+            # returned, which is not a documented preservation boundary.
+            handle = win32file.CreateFile(
+                os.fspath(path),
+                desired_access,
+                share_mode,
+                security_attributes,
+                getattr(win32con, "CREATE_NEW", 1),
+                file_flags,
+                None,
+            )
+            created_new = True
+        except Exception as exc:
+            winerror = getattr(exc, "winerror", None)
+            if winerror is None and exc.args:
+                winerror = exc.args[0]
+            if winerror != getattr(win32con, "ERROR_FILE_EXISTS", 80):
+                raise
+            # The creation descriptor is ignored for existing files. Reopen
+            # the exact path without following a reparse point, then replace
+            # its DACL through this WRITE_DAC-capable handle before appending.
+            handle = win32file.CreateFile(
+                os.fspath(path),
+                desired_access,
+                share_mode,
+                None,
+                getattr(win32con, "OPEN_EXISTING", 3),
+                file_flags,
+                None,
+            )
+            created_new = False
         file_info = win32file.GetFileInformationByHandle(handle)
         if file_info[0] & win32con.FILE_ATTRIBUTE_REPARSE_POINT:
             raise OSError(
@@ -151,25 +237,57 @@ def _open_windows_capture_append(path: Path) -> int:
                 "capture path is a Windows reparse point",
                 path,
             )
-        try:
-            # Enforce the DACL while this is still the original CreateFile
-            # handle carrying WRITE_DAC. Transferring it into Python's CRT
-            # first can lose the authority SetSecurityInfo needs on Windows.
-            win32security.SetSecurityInfo(
-                handle,
-                win32security.SE_FILE_OBJECT,
-                win32security.DACL_SECURITY_INFORMATION
-                | win32security.PROTECTED_DACL_SECURITY_INFORMATION,
-                None,
-                None,
-                dacl,
-                None,
-            )
-        except Exception as exc:
-            raise OSError(
-                "Windows capture ACL could not be enforced "
-                f"({type(exc).__name__}: {exc})"
-            ) from exc
+        if not created_new:
+            try:
+                query_flags = (
+                    win32security.OWNER_SECURITY_INFORMATION
+                    | win32security.DACL_SECURITY_INFORMATION
+                )
+                descriptor = win32security.GetSecurityInfo(
+                    handle,
+                    win32security.SE_FILE_OBJECT,
+                    query_flags,
+                )
+                if not _windows_dacl_is_owner_only(
+                    descriptor,
+                    owner_sid,
+                    ntsecuritycon,
+                    win32security,
+                ):
+                    # Existing files ignore the creation security descriptor,
+                    # so repair an unsafe DACL while this is still the original
+                    # CreateFile handle carrying WRITE_DAC. Avoid rewriting an
+                    # already-protected DACL: Windows may correctly deny that
+                    # redundant mutation even though append access is allowed.
+                    win32security.SetSecurityInfo(
+                        handle,
+                        win32security.SE_FILE_OBJECT,
+                        win32security.DACL_SECURITY_INFORMATION
+                        | win32security.PROTECTED_DACL_SECURITY_INFORMATION,
+                        None,
+                        None,
+                        dacl,
+                        None,
+                    )
+                    descriptor = win32security.GetSecurityInfo(
+                        handle,
+                        win32security.SE_FILE_OBJECT,
+                        query_flags,
+                    )
+                    if not _windows_dacl_is_owner_only(
+                        descriptor,
+                        owner_sid,
+                        ntsecuritycon,
+                        win32security,
+                    ):
+                        raise OSError(
+                            "Windows capture ACL verification failed after repair"
+                        )
+            except Exception as exc:
+                raise OSError(
+                    "Windows capture ACL could not be enforced "
+                    f"({type(exc).__name__}: {exc})"
+                ) from exc
 
         # Transfer the native handle to Python's CRT descriptor exactly once.
         raw_handle = handle.Detach()

package/src/superlocalmemory/optimize/storage/db.py

@@ -212,8 +212,12 @@ class CacheDB:
             try:
                 import sqlite3 as _sq
                 test_conn = _sq.connect(str(self._db_path))
-                test_conn.execute("PRAGMA schema_version")
-                test_conn.close()
+                try:
+                    test_conn.execute("PRAGMA schema_version")
+                finally:
+                    # Windows will not rename an open SQLite file. Always
+                    # release the probe before corrupt-file recovery runs.
+                    test_conn.close()
             except Exception as exc:
                 corrupt_sidecar = self._db_path.with_suffix(
                     self._db_path.suffix + ".corrupt"

package/src/superlocalmemory/server/unified_daemon.py

@@ -1244,6 +1244,7 @@ async def lifespan(application: FastAPI):
     engine = None
     config = None
     canonical_remember_runtime = None
+    profile_runtime = None
 
     # The local dashboard obtains its short-lived browser credential from
     # ``/internal/token`` before its first write or token-gated read.  A
@@ -1916,11 +1917,17 @@ async def lifespan(application: FastAPI):
 
     except Exception:
         logger.exception("Engine init failed")  # auto-includes traceback
-        _release_canonical_remember_runtime(
+        writer_released = _release_canonical_remember_runtime(
             application, canonical_remember_runtime,
         )
         application.state.engine = None
         application.state.config = None
+        if engine is not None and writer_released:
+            try:
+                engine.close()
+            except Exception:
+                logger.debug("partially initialized engine cleanup failed", exc_info=True)
+        raise
 
     application.state.observe_buffer = _observe_buffer
 

package/src/superlocalmemory/storage/admission_codec.py

@@ -74,6 +74,16 @@ def _load_or_create_key(path: Path) -> bytes:
         )
     except FileExistsError:
         fd = -1
+    except OSError as exc:
+        try:
+            info = path.lstat()
+        except OSError:
+            raise AdmissionKeyError("admission key cannot be created") from exc
+        if stat.S_ISLNK(info.st_mode) or not stat.S_ISREG(info.st_mode):
+            raise AdmissionKeyError(
+                "admission key path must be a regular file"
+            ) from exc
+        raise AdmissionKeyError("admission key cannot be created") from exc
     else:
         try:
             key = os.urandom(_KEY_BYTES)

package/src/superlocalmemory/storage/admission_journal.py

@@ -2,10 +2,12 @@
 # Licensed under AGPL-3.0-or-later - see LICENSE file
 # Part of SuperLocalMemory V3 | https://qualixar.com
 
-"""Separate FULL-synchronous journal for durable remember admission.
+"""Separate journal for durable remember admission.
 
 The journal is intentionally not a memory store.  Its only mutable state is a
 small encrypted replay command and the canonical receipt associated with it.
+Durable prepare and terminal transitions are FULL-synchronous; the advisory
+dispatched marker may use NORMAL because both replay states are equivalent.
 Canonical facts, FTS, graph, vectors, and model work stay outside this module.
 """
 
@@ -31,6 +33,7 @@ from cryptography.exceptions import InvalidTag
 _MAX_COMMAND_BYTES = 256 * 1024
 _MAX_RECEIPT_BYTES = 16 * 1024
 _MAX_METADATA_DEPTH = 8
+_MAX_PREOPENED_WRITE_CONNECTIONS = 8
 _IDEMPOTENCY_KEY = re.compile(r"^[A-Za-z0-9._:-]{1,256}$")
 _STATES = frozenset({"prepared", "dispatched", "committed", "rejected"})
 
@@ -213,10 +216,13 @@ class AdmissionJournal:
         self._codec = codec
         # The daemon is the sole journal owner, but many HTTP/MCP request
         # threads can prepare and transition entries concurrently. SQLite has
-        # one writer, so admit those tiny FULL-synchronous transactions through
-        # one process-local lock instead of letting BEGIN IMMEDIATE race and
-        # leak SQLITE_BUSY to remember callers.
+        # one writer, so admit those tiny journal transactions through one
+        # process-local lock instead of letting BEGIN IMMEDIATE race and leak
+        # SQLITE_BUSY to remember callers.
         self._write_lock = threading.RLock()
+        self._write_connection_slots = threading.BoundedSemaphore(
+            _MAX_PREOPENED_WRITE_CONNECTIONS
+        )
         self._initialize()
 
     def prepare(
@@ -248,36 +254,59 @@ class AdmissionJournal:
         now = _now_ms()
         journal_id = uuid.uuid4().hex
 
-        with self._write_transaction(deadline=deadline) as conn:
+        # Keep existing retries read-only and outside mutation admission. A
+        # miss closes this short-lived reader before entering the bounded
+        # write lane, where the key is rechecked transactionally.
+        with self._read_connection(deadline=deadline) as conn:
             existing = conn.execute(
                 "SELECT * FROM admission_journal "
                 "WHERE profile_id=? AND idempotency_key=?",
                 (request.profile_id, request.idempotency_key),
             ).fetchone()
-            if existing is not None:
-                entry = self._entry_from_row(existing)
-                if entry.request_hash != request_hash:
-                    raise IdempotencyConflict(
-                        "idempotency key belongs to a different immutable request"
-                    )
-                return entry
-            conn.execute(
-                "INSERT INTO admission_journal "
-                "(journal_id, idempotency_key, request_hash, profile_id, command_json, state, "
-                "created_at_ms, updated_at_ms) VALUES (?, ?, ?, ?, ?, 'prepared', ?, ?)",
-                (
-                    journal_id,
-                    request.idempotency_key,
-                    request_hash,
-                    request.profile_id,
-                    command_json,
-                    now,
-                    now,
-                ),
-            )
-            row = conn.execute(
-                "SELECT * FROM admission_journal WHERE journal_id=?", (journal_id,)
-            ).fetchone()
+        if existing is not None:
+            entry = self._entry_from_row(existing)
+            if entry.request_hash != request_hash:
+                raise IdempotencyConflict(
+                    "idempotency key belongs to a different immutable request"
+                )
+            return entry
+
+        with self._write_connection_slot(deadline=deadline):
+            remaining = _remaining_seconds(deadline)
+            with self._connection(timeout=remaining) as conn:
+                with self._write_slot(deadline=deadline):
+                    with self._sqlite_transaction(conn, deadline=deadline):
+                        existing = conn.execute(
+                            "SELECT * FROM admission_journal "
+                            "WHERE profile_id=? AND idempotency_key=?",
+                            (request.profile_id, request.idempotency_key),
+                        ).fetchone()
+                        if existing is not None:
+                            entry = self._entry_from_row(existing)
+                            if entry.request_hash != request_hash:
+                                raise IdempotencyConflict(
+                                    "idempotency key belongs to a different immutable request"
+                                )
+                            return entry
+                        conn.execute(
+                            "INSERT INTO admission_journal "
+                            "(journal_id, idempotency_key, request_hash, profile_id, "
+                            "command_json, state, created_at_ms, updated_at_ms) "
+                            "VALUES (?, ?, ?, ?, ?, 'prepared', ?, ?)",
+                            (
+                                journal_id,
+                                request.idempotency_key,
+                                request_hash,
+                                request.profile_id,
+                                command_json,
+                                now,
+                                now,
+                            ),
+                        )
+                        row = conn.execute(
+                            "SELECT * FROM admission_journal WHERE journal_id=?",
+                            (journal_id,),
+                        ).fetchone()
         assert row is not None
         return self._entry_from_row(row)
 
@@ -319,16 +348,22 @@ class AdmissionJournal:
         journal_id: str,
         *,
         deadline: float | None = None,
+        known_prepared: bool = False,
     ) -> AdmissionEntry:
         # A concurrent retry may observe ``prepared`` and then lose the race to
         # another caller that commits the same idempotent command.  Treat that
         # terminal state as a successful no-op so the retry can return the
         # canonical receipt instead of surfacing a false transition failure.
+        if not known_prepared:
+            existing = self._get_entry(journal_id, deadline=deadline)
+            if existing.state in {"dispatched", "committed"}:
+                return existing
         return self._transition(
             journal_id,
             target="dispatched",
             allowed={"prepared", "dispatched", "committed"},
             deadline=deadline,
+            full_sync=False,
         )
 
     def mark_rejected(
@@ -363,6 +398,9 @@ class AdmissionJournal:
             raise ValueError("receipt operation_id must be a string")
         if commit_sequence is not None and not isinstance(commit_sequence, int):
             raise ValueError("receipt commit_sequence must be an integer")
+        existing = self._get_entry(journal_id, deadline=deadline)
+        if existing.state == "committed":
+            return existing
         return self._transition(
             journal_id,
             target="committed",
@@ -374,24 +412,13 @@ class AdmissionJournal:
         )
 
     def get(self, journal_id: str) -> AdmissionEntry:
-        with self._read_connection() as conn:
-            row = conn.execute(
-                "SELECT * FROM admission_journal WHERE journal_id=?", (journal_id,)
-            ).fetchone()
-        if row is None:
-            raise KeyError(journal_id)
-        return self._entry_from_row(row)
+        return self._get_entry(journal_id)
 
     def get_by_idempotency_key(
         self, profile_id: str, idempotency_key: str
     ) -> AdmissionEntry | None:
         """Return a profile-scoped retry record, never a cross-profile match."""
-        with self._read_connection() as conn:
-            row = conn.execute(
-                "SELECT * FROM admission_journal WHERE profile_id=? AND idempotency_key=?",
-                (profile_id, idempotency_key),
-            ).fetchone()
-        return self._entry_from_row(row) if row is not None else None
+        return self._get_by_idempotency_key(profile_id, idempotency_key)
 
     def count(self) -> int:
         with self._read_connection() as conn:
@@ -451,8 +478,9 @@ class AdmissionJournal:
         operation_id: str | None = None,
         commit_sequence: int | None = None,
         deadline: float | None = None,
+        full_sync: bool = True,
     ) -> AdmissionEntry:
-        with self._write_transaction(deadline=deadline) as conn:
+        with self._write_transaction(deadline=deadline, full_sync=full_sync) as conn:
             row = conn.execute(
                 "SELECT * FROM admission_journal WHERE journal_id=?", (journal_id,)
             ).fetchone()
@@ -490,6 +518,34 @@ class AdmissionJournal:
         assert updated is not None
         return self._entry_from_row(updated)
 
+    def _get_entry(
+        self,
+        journal_id: str,
+        *,
+        deadline: float | None = None,
+    ) -> AdmissionEntry:
+        with self._read_connection(deadline=deadline) as conn:
+            row = conn.execute(
+                "SELECT * FROM admission_journal WHERE journal_id=?", (journal_id,)
+            ).fetchone()
+        if row is None:
+            raise KeyError(journal_id)
+        return self._entry_from_row(row)
+
+    def _get_by_idempotency_key(
+        self,
+        profile_id: str,
+        idempotency_key: str,
+        *,
+        deadline: float | None = None,
+    ) -> AdmissionEntry | None:
+        with self._read_connection(deadline=deadline) as conn:
+            row = conn.execute(
+                "SELECT * FROM admission_journal WHERE profile_id=? AND idempotency_key=?",
+                (profile_id, idempotency_key),
+            ).fetchone()
+        return self._entry_from_row(row) if row is not None else None
+
     def _initialize(self) -> None:
         with self._connection() as conn:
             conn.execute("PRAGMA journal_mode=WAL")
@@ -503,8 +559,52 @@ class AdmissionJournal:
         self,
         *,
         deadline: float | None = None,
+        full_sync: bool = True,
     ) -> Generator[sqlite3.Connection, None, None]:
         """Serialize and atomically commit one deadline-bounded mutation."""
+        with self._write_connection_slot(deadline=deadline):
+            remaining = _remaining_seconds(deadline)
+            with self._connection(timeout=remaining) as conn:
+                with self._write_slot(deadline=deadline):
+                    if not full_sync:
+                        # ``dispatched`` is advisory: both prepared and dispatched
+                        # entries replay through the same idempotent coordinator.
+                        # NORMAL avoids a second foreground fsync after the durable
+                        # FULL-synchronous prepare; a power loss can at worst
+                        # restore the safe prepared state.
+                        conn.execute("PRAGMA synchronous=NORMAL")
+                    with self._sqlite_transaction(conn, deadline=deadline):
+                        yield conn
+
+    @contextmanager
+    def _write_connection_slot(
+        self,
+        *,
+        deadline: float | None = None,
+    ) -> Generator[None, None, None]:
+        """Bound SQLite handles retained by mutations queued for the writer."""
+        if deadline is None:
+            acquired = self._write_connection_slots.acquire()
+        else:
+            acquired = self._write_connection_slots.acquire(
+                timeout=max(0.0, deadline - time.monotonic())
+            )
+        if not acquired:
+            raise AdmissionJournalUnavailable(
+                "admission journal deadline expired waiting for a connection"
+            )
+        try:
+            yield
+        finally:
+            self._write_connection_slots.release()
+
+    @contextmanager
+    def _write_slot(
+        self,
+        *,
+        deadline: float | None = None,
+    ) -> Generator[None, None, None]:
+        """Acquire the process-local SQLite writer slot within the caller budget."""
         if deadline is None:
             acquired = self._write_lock.acquire()
         else:
@@ -516,33 +616,48 @@ class AdmissionJournal:
                 "admission journal deadline expired waiting for its writer"
             )
         try:
-            remaining = _remaining_seconds(deadline)
-            with self._connection(timeout=remaining) as conn:
-                try:
-                    conn.execute("BEGIN IMMEDIATE")
-                    if deadline is not None and time.monotonic() >= deadline:
-                        raise AdmissionJournalUnavailable(
-                            "admission journal deadline expired before its mutation"
-                        )
-                    yield conn
-                    if deadline is not None and time.monotonic() >= deadline:
-                        raise AdmissionJournalUnavailable(
-                            "admission journal deadline expired during its mutation"
-                        )
-                    conn.commit()
-                except sqlite3.OperationalError as exc:
-                    conn.rollback()
-                    if _is_sqlite_busy(exc):
-                        raise AdmissionJournalUnavailable(
-                            "admission journal is busy beyond its caller deadline"
-                        ) from exc
-                    raise
-                except BaseException:
-                    conn.rollback()
-                    raise
+            yield
         finally:
             self._write_lock.release()
 
+    @contextmanager
+    def _sqlite_transaction(
+        self,
+        conn: sqlite3.Connection,
+        *,
+        deadline: float | None = None,
+    ) -> Generator[None, None, None]:
+        """Commit or roll back one SQLite mutation on an already-open connection."""
+        try:
+            # A reused prepare connection may have waited for the local writer
+            # slot after its optimistic read. Refresh SQLite's own wait budget
+            # immediately before BEGIN so combined local and external
+            # contention cannot exceed the caller's original deadline.
+            remaining = _remaining_seconds(deadline)
+            busy_timeout_ms = max(1, int(remaining * 1_000))
+            conn.execute(f"PRAGMA busy_timeout={busy_timeout_ms}")
+            conn.execute("BEGIN IMMEDIATE")
+            if deadline is not None and time.monotonic() >= deadline:
+                raise AdmissionJournalUnavailable(
+                    "admission journal deadline expired before its mutation"
+                )
+            yield
+            if deadline is not None and time.monotonic() >= deadline:
+                raise AdmissionJournalUnavailable(
+                    "admission journal deadline expired during its mutation"
+                )
+            conn.commit()
+        except sqlite3.OperationalError as exc:
+            conn.rollback()
+            if _is_sqlite_busy(exc):
+                raise AdmissionJournalUnavailable(
+                    "admission journal is busy beyond its caller deadline"
+                ) from exc
+            raise
+        except BaseException:
+            conn.rollback()
+            raise
+
     @contextmanager
     def _read_connection(
         self,