@remnic/core 9.3.653 → 9.3.654

package/dist/{chunk-SPMZZUEJ.js → chunk-OL2364SB.js}

@@ -29,7 +29,7 @@ import {
 import {
   CompoundingEngine,
   defaultTierMigrationCycleBudget
-} from "./chunk-PRQXUSQV.js";
+} from "./chunk-ZCORQM74.js";
 import {
   SharedContextManager
 } from "./chunk-DRD2Q7HQ.js";
@@ -175,7 +175,7 @@ import {
   buildEntityRecallSection,
   entityRecentTranscriptLookbackHours,
   readRecentEntityTranscriptEntries
-} from "./chunk-XMN6MMTU.js";
+} from "./chunk-NCGWXCSW.js";
 import {
   buildEventOrderRecallSection,
   shouldRecallEventOrderEvidence
@@ -210,7 +210,7 @@ import {
   materializeAfterSemanticConsolidation,
   parseConsolidationResponse,
   parseOperatorAwareConsolidationResponse
-} from "./chunk-CFOCZPIQ.js";
+} from "./chunk-T2C6QJG2.js";
 import {
   normalizeReplaySessionKey
 } from "./chunk-2PRQG7PV.js";
@@ -219,13 +219,13 @@ import {
 } from "./chunk-X6IRLNOO.js";
 import {
   searchVerifiedEpisodes
-} from "./chunk-JF7SFXTG.js";
+} from "./chunk-QKK64Z6M.js";
 import {
   ThreadingManager
 } from "./chunk-W4RVMTHR.js";
 import {
   searchVerifiedSemanticRules
-} from "./chunk-AJE7FJVE.js";
+} from "./chunk-K6X553JB.js";
 import {
   searchWorkProductLedgerEntries
 } from "./chunk-ZRWB5D4H.js";
@@ -236,8 +236,10 @@ import {
   PolicyRuntimeManager
 } from "./chunk-33JBK2XP.js";
 import {
-  NamespaceStorageRouter
-} from "./chunk-ORGWWNJG.js";
+  NamespaceStorageRouter,
+  resolveDefaultNamespaceRoot,
+  resolveNamespaceStorageRoot
+} from "./chunk-3RACUBII.js";
 import {
   isAboveImportanceThreshold,
   scoreImportance
@@ -315,7 +317,7 @@ import {
 } from "./chunk-FF4KLI5W.js";
 import {
   buildXraySnapshot
-} from "./chunk-BEMWL2FZ.js";
+} from "./chunk-FVRBLJP6.js";
 import {
   NamespaceSearchRouter
 } from "./chunk-JVRPJ7D4.js";
@@ -327,7 +329,9 @@ import {
   NoopSearchBackend
 } from "./chunk-CYEPCZN5.js";
 import {
-  namespaceIdentityFromToken
+  namespaceIdentityFromToken,
+  namespaceIdentityToken,
+  normalizeNamespaceIdentity
 } from "./chunk-ZFXCQPNO.js";
 import {
   writeConversationChunks
@@ -347,14 +351,15 @@ import {
 } from "./chunk-QDW3E4RD.js";
 import {
   shouldSkipImplicitExtraction
-} from "./chunk-H3PHZLMF.js";
+} from "./chunk-GKKAXVAJ.js";
 import {
   GraphIndex
 } from "./chunk-Y56J7CXW.js";
 import {
   buildChainFollowupGenerator
-} from "./chunk-BNFRL6QW.js";
+} from "./chunk-Y2RIIF6H.js";
 import {
+  ALL_CATEGORY_DIRS,
   ContentHashIndex,
   StorageManager,
   compareEntityTimestamps,
@@ -363,7 +368,7 @@ import {
   normalizeEntityName,
   parseEntityFile,
   stripAttributesSuffix
-} from "./chunk-Y7NWBBHV.js";
+} from "./chunk-6CVI6BP6.js";
 import {
   isValidTranscriptDate,
   loadSpeakerRegistry,
@@ -378,7 +383,7 @@ import {
 } from "./chunk-J6A3CX5N.js";
 import {
   confidenceTier
-} from "./chunk-C43KEWEV.js";
+} from "./chunk-NE2JBMLN.js";
 import {
   inferMemoryStatus,
   isActiveMemoryStatus
@@ -400,6 +405,7 @@ import {
   resolvePrincipal
 } from "./chunk-UZYLX7M6.js";
 import {
+  isSafeRouteNamespace,
   selectRouteRule
 } from "./chunk-U3PN77QT.js";
 import {
@@ -432,17 +438,17 @@ import {
 } from "./chunk-AC5LO7IU.js";
 
 // src/orchestrator.ts
-import path2 from "path";
+import path3 from "path";
 import os from "os";
 import { createHash, randomBytes } from "crypto";
-import { existsSync } from "fs";
+import { existsSync, readFileSync } from "fs";
 import {
-  mkdir as mkdir2,
-  readdir,
-  readFile as readFile2,
-  stat,
-  unlink,
-  writeFile as writeFile2
+  mkdir as mkdir3,
+  readdir as readdir2,
+  readFile as readFile3,
+  stat as stat2,
+  unlink as unlink2,
+  writeFile as writeFile3
 } from "fs/promises";
 
 // src/procedural/procedure-recall.ts
@@ -1484,61 +1490,1379 @@ Install it alongside Remnic:
       stateFilePath: correctionsFilePath(storage.dir)
     };
   }
-  async addCorrection(rule) {
-    compileCorrectionRule(rule, "correction");
-    const storage = await this.deps.getStorage();
-    const rules = await loadCorrectionsFile(storage.dir);
-    const duplicate = rules.some(
-      (existing) => existing.match === rule.match && existing.replace === rule.replace && existing.regex === true === (rule.regex === true)
-    );
-    if (duplicate) {
-      throw new WearablesInputError(
-        `an identical correction rule already exists (match: ${JSON.stringify(rule.match)})`
-      );
+  async addCorrection(rule) {
+    compileCorrectionRule(rule, "correction");
+    const storage = await this.deps.getStorage();
+    const rules = await loadCorrectionsFile(storage.dir);
+    const duplicate = rules.some(
+      (existing) => existing.match === rule.match && existing.replace === rule.replace && existing.regex === true === (rule.regex === true)
+    );
+    if (duplicate) {
+      throw new WearablesInputError(
+        `an identical correction rule already exists (match: ${JSON.stringify(rule.match)})`
+      );
+    }
+    rules.push(rule);
+    await saveCorrectionsFile(storage.dir, rules);
+  }
+  async removeCorrection(index) {
+    if (!Number.isInteger(index) || index < 0) {
+      throw new WearablesInputError(`invalid correction index '${index}'`);
+    }
+    const storage = await this.deps.getStorage();
+    const rules = await loadCorrectionsFile(storage.dir);
+    if (index >= rules.length) {
+      throw new WearablesInputError(
+        `correction index ${index} is out of range (have ${rules.length} state rule${rules.length === 1 ? "" : "s"})`
+      );
+    }
+    const [removed] = rules.splice(index, 1);
+    await saveCorrectionsFile(storage.dir, rules);
+    return removed;
+  }
+};
+function clampLimit(value, fallback, max, label) {
+  if (value === void 0) return fallback;
+  if (!Number.isFinite(value) || !Number.isInteger(value) || value < 1 || value > max) {
+    throw new WearablesInputError(
+      `invalid ${label} '${value}' \u2014 expected an integer between 1 and ${max}`
+    );
+  }
+  return value;
+}
+function locateTranscriptPath(hitPath) {
+  const normalized = hitPath.replace(/\\/g, "/");
+  const match = normalized.match(
+    /(?:^|\/)wearables\/([a-z][a-z0-9-]{0,63})\/(\d{4}-\d{2}-\d{2})\.md$/
+  );
+  if (!match) return null;
+  if (!isValidTranscriptDate(match[2])) return null;
+  return { source: match[1], date: match[2] };
+}
+function extractSnippet(body, index, matchLength) {
+  const start = Math.max(0, index - 80);
+  const end = Math.min(body.length, index + matchLength + 80);
+  const prefix = start > 0 ? "\u2026" : "";
+  const suffix = end < body.length ? "\u2026" : "";
+  return `${prefix}${body.slice(start, end).replace(/\s+/g, " ").trim()}${suffix}`;
+}
+
+// src/namespaces/catalog.ts
+import path2 from "path";
+import { randomUUID } from "crypto";
+import {
+  appendFile,
+  lstat,
+  mkdir as mkdir2,
+  open,
+  readdir,
+  readFile as readFile2,
+  realpath,
+  rename,
+  stat,
+  unlink,
+  utimes,
+  writeFile as writeFile2
+} from "fs/promises";
+var NAMESPACE_KINDS = [
+  "default",
+  "self",
+  "shared",
+  "project",
+  "branch",
+  "team-project",
+  "explicit",
+  "legacy"
+];
+var NAMESPACE_DISCOVERY_SOURCES = [
+  "config",
+  "write",
+  "read",
+  "scan",
+  "migration"
+];
+var CATALOG_FILE = "namespaces.jsonl";
+var STATE_DIR = "state";
+var REBUILD_LOCK_FILE = "namespaces.rebuild.lock";
+var REBUILD_LOCK_STALE_MS = 3e4;
+var REBUILD_LOCK_MAX_WAIT_MS = 5e3;
+var REBUILD_LOCK_POLL_MS = 50;
+var REBUILD_LOCK_HEARTBEAT_MS = 1e4;
+var MEMORY_DATA_CHILDREN = [
+  ...ALL_CATEGORY_DIRS,
+  "entities",
+  "artifacts",
+  "identity",
+  "config",
+  "summaries",
+  "profile.md",
+  "state"
+];
+function isCatalogEnabled(config) {
+  if (config.namespacesEnabled !== true) return false;
+  return config.namespaceCatalogEnabled !== false;
+}
+var FILE_MEMORY_DATA_CHILDREN = /* @__PURE__ */ new Set(["profile.md"]);
+function isNotFoundError(err) {
+  return typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
+}
+async function inspectMemoryDataMarker(rootDir, child) {
+  const childPath = path2.join(rootDir, child);
+  let entry;
+  try {
+    entry = await lstat(childPath);
+  } catch (err) {
+    return isNotFoundError(err) ? { state: "absent" } : { state: "invalid", detail: `${child}: ${err instanceof Error ? err.message : String(err)}` };
+  }
+  if (entry.isSymbolicLink()) return { state: "invalid", detail: `${child}: symlink` };
+  if (FILE_MEMORY_DATA_CHILDREN.has(child)) {
+    return entry.isFile() ? { state: "valid" } : { state: "invalid", detail: `${child}: expected file` };
+  }
+  if (!entry.isDirectory()) return { state: "invalid", detail: `${child}: expected directory` };
+  try {
+    const rootReal = await realpath(rootDir);
+    const childReal = await realpath(childPath);
+    return isPathInside(rootReal, childReal) ? { state: "valid" } : { state: "invalid", detail: `${child}: escapes namespace root` };
+  } catch (err) {
+    return { state: "invalid", detail: `${child}: ${err instanceof Error ? err.message : String(err)}` };
+  }
+}
+async function inspectMemoryDataRoot(rootDir) {
+  let hasData = false;
+  for (const child of MEMORY_DATA_CHILDREN) {
+    const marker = await inspectMemoryDataMarker(rootDir, child);
+    if (marker.state === "invalid") {
+      return { hasData: false, invalidMarker: marker.detail };
+    }
+    if (marker.state === "valid") {
+      hasData = true;
+    }
+  }
+  return { hasData };
+}
+async function hasMemoryData(rootDir) {
+  return (await inspectMemoryDataRoot(rootDir)).hasData;
+}
+function isValidIsoTimestamp(value) {
+  const ms = Date.parse(value);
+  return Number.isFinite(ms);
+}
+function isNamespaceKind(value) {
+  return typeof value === "string" && NAMESPACE_KINDS.includes(value);
+}
+function isNamespaceDiscoverySource(value) {
+  return typeof value === "string" && NAMESPACE_DISCOVERY_SOURCES.includes(value);
+}
+function coerceRecord(value) {
+  if (typeof value !== "object" || value === null) return null;
+  const v = value;
+  if (typeof v.namespace !== "string") return null;
+  const namespace = normalizeNamespaceIdentity(v.namespace);
+  if (namespace.length === 0) return null;
+  if (typeof v.identityToken !== "string" || v.identityToken.length === 0) return null;
+  const expectedIdentityToken = namespaceIdentityToken(namespace);
+  if (v.identityToken !== expectedIdentityToken) return null;
+  if (typeof v.storageDir !== "string" || v.storageDir.length === 0) return null;
+  if (typeof v.createdAt !== "string" || v.createdAt.length === 0) return null;
+  if (!isValidIsoTimestamp(v.createdAt)) return null;
+  const kind = v.kind === void 0 ? "explicit" : isNamespaceKind(v.kind) ? v.kind : null;
+  if (!kind) return null;
+  const discoveredBy = v.discoveredBy === void 0 ? "scan" : isNamespaceDiscoverySource(v.discoveredBy) ? v.discoveredBy : null;
+  if (!discoveredBy) return null;
+  const record = {
+    namespace,
+    identityToken: expectedIdentityToken,
+    kind,
+    createdAt: v.createdAt,
+    storageDir: v.storageDir,
+    discoveredBy
+  };
+  if (typeof v.principal === "string") record.principal = v.principal;
+  if (typeof v.projectId === "string") record.projectId = v.projectId;
+  if (typeof v.branch === "string") record.branch = v.branch;
+  if (typeof v.parentNamespace === "string") record.parentNamespace = v.parentNamespace;
+  if (typeof v.lastReadAt === "string" && isValidIsoTimestamp(v.lastReadAt)) {
+    record.lastReadAt = v.lastReadAt;
+  }
+  if (typeof v.lastWriteAt === "string" && isValidIsoTimestamp(v.lastWriteAt)) {
+    record.lastWriteAt = v.lastWriteAt;
+  }
+  if (v.lastMaintenanceAt && typeof v.lastMaintenanceAt === "object") {
+    const out = {};
+    for (const [k, val] of Object.entries(v.lastMaintenanceAt)) {
+      if (typeof val === "string" && isValidIsoTimestamp(val)) out[k] = val;
+    }
+    if (Object.keys(out).length > 0) record.lastMaintenanceAt = out;
+  }
+  return record;
+}
+function laterIso(a, b) {
+  if (!a) return b;
+  if (!b) return a;
+  const am = Date.parse(a);
+  const bm = Date.parse(b);
+  if (!Number.isFinite(am)) return b;
+  if (!Number.isFinite(bm)) return a;
+  return bm > am ? b : a;
+}
+function mergeNewerTouchFields(base, fresh) {
+  const merged = { ...base };
+  const lr = laterIso(base.lastReadAt, fresh.lastReadAt);
+  if (lr) merged.lastReadAt = lr;
+  const lw = laterIso(base.lastWriteAt, fresh.lastWriteAt);
+  if (lw) merged.lastWriteAt = lw;
+  if (base.lastMaintenanceAt || fresh.lastMaintenanceAt) {
+    const jobs = { ...base.lastMaintenanceAt ?? {} };
+    for (const [job, ts] of Object.entries(fresh.lastMaintenanceAt ?? {})) {
+      const latest = laterIso(jobs[job], ts);
+      if (latest) jobs[job] = latest;
+    }
+    if (Object.keys(jobs).length > 0) merged.lastMaintenanceAt = jobs;
+  }
+  return merged;
+}
+function serializeRecord(record) {
+  const ordered = {};
+  const source = record;
+  for (const key of Object.keys(source).sort()) {
+    const value = source[key];
+    if (value === void 0) continue;
+    if (key === "lastMaintenanceAt" && value && typeof value === "object") {
+      const sortedJobs = {};
+      for (const jobKey of Object.keys(value).sort()) {
+        sortedJobs[jobKey] = value[jobKey];
+      }
+      ordered[key] = sortedJobs;
+      continue;
+    }
+    ordered[key] = value;
+  }
+  return JSON.stringify(ordered);
+}
+function inferKind(namespace, config) {
+  if (namespace === normalizeNamespaceIdentity(config.defaultNamespace)) return "default";
+  if (namespace === normalizeNamespaceIdentity(config.sharedNamespace)) return "shared";
+  if (config.namespacePolicies.some((p) => normalizeNamespaceIdentity(p.name) === namespace)) {
+    return "explicit";
+  }
+  if (/-branch-|^project-[^-]+-branch-/.test(namespace) || namespace.includes("-branch-")) {
+    return "branch";
+  }
+  if (/^team-.*-project-/.test(namespace) || /^team-.*project-/.test(namespace)) {
+    return "team-project";
+  }
+  if (/^project-/.test(namespace) || /-project-/.test(namespace)) {
+    return "project";
+  }
+  return "explicit";
+}
+var NamespaceCatalog = class {
+  constructor(config) {
+    this.config = config;
+    this.memoryDir = config.memoryDir;
+    this.stateDir = path2.join(this.memoryDir, STATE_DIR);
+    this.catalogPath = path2.join(this.stateDir, CATALOG_FILE);
+    this.rebuildLockPath = path2.join(this.stateDir, REBUILD_LOCK_FILE);
+    this.defaultNamespaceIdentity = normalizeNamespaceIdentity(config.defaultNamespace);
+  }
+  config;
+  memoryDir;
+  stateDir;
+  catalogPath;
+  rebuildLockPath;
+  // Per-INSTANCE lock owner id (round 6, codex P2 — NBsGP). The rebuild lock
+  // file records this id, not just `process.pid`, so two NamespaceCatalog
+  // instances in the SAME process sharing a memoryDir are NOT mistaken for each
+  // other: a touch on instance B must still wait for instance A's rebuild lock
+  // (different owner id, same PID) instead of skipping as "self-held".
+  lockOwnerId = randomUUID();
+  // Serialized write chain that recovers from rejection (CLAUDE.md rule #40)
+  // so a single failed append cannot permanently poison subsequent writes.
+  writeChain = Promise.resolve();
+  // Test-only seam (round 7 — NEZkA): fires inside a touch's HELD-lock critical
+  // section, after the lock is acquired but BEFORE the read→merge→append. A
+  // deterministic concurrency test installs a hook here to widen the (otherwise
+  // microscopic) window and prove that a cross-process rebuild CANNOT run its
+  // load→rename while a touch holds the lock. Never set in production code.
+  onTouchCriticalSectionForTest;
+  // Test-only seam (round 7 — NEZkA): fires inside a mutating rebuild's HELD-lock
+  // critical section, after the final cross-process re-merge `loadCompacted()` and
+  // BEFORE the atomic `rename()`. This is the EXACT window in which a check-then-
+  // append touch (the old bug) would clobber its append. A deterministic test
+  // installs a hook here to attempt a cross-instance touch in this window and
+  // assert the held mutex blocks it. Never set in production code.
+  onRebuildBeforeRenameForTest;
+  // Test-only seam (NFgCT, codex P2): fires AFTER the lockless disk scan but
+  // BEFORE the rebuild acquires the cross-process file lock for its final
+  // load→merge→rename window. A deterministic test installs a hook here to attempt
+  // a cross-instance touch DURING the scan window and assert it is NOT blocked or
+  // dropped — proving the scan no longer holds the mutex. Never set in production.
+  onRebuildAfterScanForTest;
+  // Test-only seam (NG7Bg, codex P2): fires inside `breakStaleRebuildLock` AFTER it
+  // has judged the lock stale and captured its identity, but BEFORE the final
+  // re-validation+unlink. A deterministic test installs a hook here to REPLACE the
+  // lock file (a fresh holder created a new lock in the race window) and assert the
+  // break is skipped — the replacement's active lock is not deleted. Never set in
+  // production.
+  onBeforeBreakStaleUnlinkForTest;
+  // Normalized (trimmed) default namespace identity (NH-FH, cursor Medium).
+  // Catalog records key namespaces by their NORMALIZED identity
+  // (`normalizeNamespaceIdentity`), but several default-namespace exemptions and
+  // memoryDir-ownership checks compared against the RAW `config.defaultNamespace`.
+  // If the configured default name carries surrounding whitespace the record key
+  // is trimmed while the comparison string is not, so the default row is
+  // misclassified, dropped at read time, or given the wrong storage root. Compare
+  // against this normalized form everywhere instead.
+  defaultNamespaceIdentity;
+  /** Whether the catalog is active (namespaces enabled and catalog not opted out). */
+  get enabled() {
+    return isCatalogEnabled(this.config);
+  }
+  // ── Public enumeration API ──────────────────────────────────────────────
+  /**
+   * Sanitize a record at the enumeration boundary (round 5, cursor Medium + codex
+   * P2; round 6 — NDXHe). Reads return whatever is in `namespaces.jsonl` after
+   * schema checks only, so a tampered or pre-fix row could surface unsafe data to
+   * maintenance/QMD until a rewrite occurs. Two distinct defenses:
+   *
+   *  1. UNSAFE NAMESPACE NAME (NGZqr, codex P2): an unsafe non-default namespace
+   *     (e.g. `../evil`, a name with separators, or >64 chars) is REJECTED outright
+   *     — return `null` so the caller drops it. The disk SCAN and the hot touch
+   *     path both reject such names with the SAME default-exempt `isSafeRouteNamespace`
+   *     gate, so the read boundary MUST agree, or `listNamespaces()`/`getNamespaceRecord()`
+   *     would expose a namespace those paths reject (note `isStorageDirForNamespace`
+   *     can still build a tokenized root even for `../evil`, so storageDir sanitation
+   *     alone does not catch it). The default namespace is exempt (it may be a
+   *     non-route literal), matching every other validation site.
+   *
+   *  2. UNSAFE storageDir: for an otherwise-valid namespace, apply the SAME contract
+   *     as the write path — full containment (`isContainedStorageDir`: lexical +
+   *     symlink/realpath) AND namespace ownership (`isStorageDirForNamespace`). When
+   *     a record fails EITHER check we substitute the trusted resolved-and-safe root
+   *     for that namespace (rule 42: read and write stay symmetric).
+   */
+  async sanitizeRecordForRead(record) {
+    if (record.namespace !== this.defaultNamespaceIdentity && !isSafeRouteNamespace(record.namespace)) {
+      return null;
+    }
+    if (await this.isContainedStorageDir(record.storageDir) && await this.isStorageDirForNamespace(record.namespace, record.storageDir)) {
+      return record;
+    }
+    const safe = await this.resolveSafeStorageDir(record.namespace);
+    return { ...record, storageDir: safe };
+  }
+  storageRootOwnershipRank(record, resolvedStorageDir, configured) {
+    if (resolvedStorageDir === path2.resolve(this.memoryDir)) {
+      return record.namespace === this.defaultNamespaceIdentity ? 0 : 3;
+    }
+    const leaf = path2.basename(resolvedStorageDir);
+    const tokenOwnsRoot = namespaceIdentityToken(record.namespace) === leaf;
+    if (tokenOwnsRoot && configured.has(record.namespace)) {
+      return 0;
+    }
+    if (record.namespace === leaf) return 1;
+    if (tokenOwnsRoot) return 2;
+    return 3;
+  }
+  configuredNamespaceIdentities() {
+    return new Set(
+      [
+        this.config.defaultNamespace,
+        this.config.sharedNamespace,
+        ...this.config.namespacePolicies.map((p) => p.name)
+      ].map((n) => normalizeNamespaceIdentity(n)).filter((n) => n.length > 0)
+    );
+  }
+  preferStorageRootOwner(current, candidate, resolvedStorageDir, configured) {
+    const currentRank = this.storageRootOwnershipRank(current, resolvedStorageDir, configured);
+    const candidateRank = this.storageRootOwnershipRank(candidate, resolvedStorageDir, configured);
+    if (candidateRank < currentRank) return candidate;
+    if (candidateRank > currentRank) return current;
+    const byName = candidate.namespace.localeCompare(current.namespace);
+    if (byName < 0) return candidate;
+    if (byName > 0) return current;
+    return candidate.identityToken.localeCompare(current.identityToken) < 0 ? candidate : current;
+  }
+  dropDuplicateStorageRootAliases(records) {
+    const byStorageDir = /* @__PURE__ */ new Map();
+    const configured = this.configuredNamespaceIdentities();
+    for (const record of records) {
+      const resolvedStorageDir = path2.resolve(record.storageDir);
+      const current = byStorageDir.get(resolvedStorageDir);
+      if (!current) {
+        byStorageDir.set(resolvedStorageDir, record);
+        continue;
+      }
+      const owner = this.preferStorageRootOwner(current, record, resolvedStorageDir, configured);
+      const alias = owner === current ? record : current;
+      byStorageDir.set(resolvedStorageDir, mergeNewerTouchFields(owner, alias));
+    }
+    return [...byStorageDir.values()];
+  }
+  async loadSanitizedRecords() {
+    const records = await this.loadCompacted();
+    const sanitized = await Promise.all(
+      [...records.values()].map((r) => this.sanitizeRecordForRead(r))
+    );
+    return this.dropDuplicateStorageRootAliases(
+      sanitized.filter((r) => r !== null)
+    );
+  }
+  async listNamespaces(filter) {
+    if (!this.enabled) return [];
+    let out = await this.loadSanitizedRecords();
+    if (filter?.kind) out = out.filter((r) => r.kind === filter.kind);
+    if (filter?.discoveredBy) out = out.filter((r) => r.discoveredBy === filter.discoveredBy);
+    if (filter?.writtenSince) {
+      const sinceMs = filter.writtenSince.getTime();
+      out = out.filter((r) => {
+        if (!r.lastWriteAt) return false;
+        const ms = Date.parse(r.lastWriteAt);
+        return Number.isFinite(ms) && ms >= sinceMs;
+      });
+    }
+    return out.sort((a, b) => {
+      const byName = a.namespace.localeCompare(b.namespace);
+      if (byName !== 0) return byName;
+      return a.identityToken.localeCompare(b.identityToken);
+    });
+  }
+  async getNamespaceRecord(namespace) {
+    if (!this.enabled) return null;
+    const ns = normalizeNamespaceIdentity(namespace);
+    return (await this.loadSanitizedRecords()).find((record) => record.namespace === ns) ?? null;
+  }
+  // ── Touch API (cheap, failure-tolerant) ─────────────────────────────────
+  async markRead(namespace, metadata) {
+    await this.touch(namespace, "read", metadata);
+  }
+  async markWrite(namespace, metadata) {
+    await this.touch(namespace, "write", metadata);
+  }
+  async markMaintenance(namespace, jobName, at) {
+    if (typeof jobName !== "string" || jobName.trim().length === 0) {
+      throw new Error("markMaintenance requires a non-empty jobName");
+    }
+    await this.touch(namespace, "maintenance", { at }, jobName.trim());
+  }
+  /**
+   * Register namespaces known purely from config (default, shared, explicit
+   * policies). Source `config`. Cheap and idempotent.
+   */
+  async registerConfiguredNamespaces() {
+    if (!this.enabled) return;
+    const names = /* @__PURE__ */ new Set([
+      this.config.defaultNamespace,
+      this.config.sharedNamespace,
+      ...this.config.namespacePolicies.map((p) => p.name)
+    ]);
+    for (const ns of names) {
+      if (!ns) continue;
+      if (normalizeNamespaceIdentity(ns) !== this.defaultNamespaceIdentity && !isSafeRouteNamespace(ns)) {
+        continue;
+      }
+      try {
+        await this.register(ns, { discoveredBy: "config" });
+      } catch {
+      }
+    }
+  }
+  /**
+   * Register a namespace whose storage was just resolved by the router. Used as
+   * the router's integration hook (`discoveredBy: config`). Storage dir is
+   * provided so we do not re-resolve it. Failure-tolerant. Returns whether the
+   * registration actually APPENDED (round 6, codex P2 — NEFoX), so the router's
+   * resolve-hook dedup only marks a namespace notified when it truly persisted —
+   * a dropped append (disabled catalog or rebuild-lock-timeout drop) returns
+   * `false` and is retried on the next resolve.
+   */
+  async registerResolved(namespace, storageDir) {
+    if (!this.enabled) return false;
+    return this.register(namespace, { discoveredBy: "config", storageDir });
+  }
+  /**
+   * Generic register/touch without changing read/write timestamps unless the
+   * source implies it. Validates the namespace and resolves a storage dir.
+   * Returns whether the touch actually appended.
+   */
+  async register(namespace, metadata) {
+    return this.touch(namespace, "register", metadata);
+  }
+  validateNamespace(namespace) {
+    const ns = normalizeNamespaceIdentity(namespace);
+    if (ns.length === 0) throw new Error("empty namespace");
+    if (ns !== this.defaultNamespaceIdentity && !isSafeRouteNamespace(ns)) {
+      throw new Error(`unsafe namespace: ${ns}`);
+    }
+    return ns;
+  }
+  /**
+   * Resolve the on-disk storage dir for a namespace WITHOUT trusting caller
+   * input. The default namespace may use the legacy memoryDir root; everything
+   * else lives under `<memoryDir>/namespaces/<token>`. Containment is enforced
+   * by rejecting separators/parent-refs in the token.
+   */
+  resolveStorageDir(namespace) {
+    if (normalizeNamespaceIdentity(namespace) === this.defaultNamespaceIdentity) {
+      return this.memoryDir;
+    }
+    const token = namespaceIdentityToken(namespace);
+    return this.namespaceTokenDir(token);
+  }
+  namespaceTokenDir(token) {
+    if (token.length === 0 || token.includes("/") || token.includes("\\") || token.includes("..") || path2.isAbsolute(token)) {
+      throw new Error(`unsafe namespace token: ${token}`);
+    }
+    return path2.join(this.memoryDir, "namespaces", token);
+  }
+  /**
+   * Whether a candidate storage dir is LEXICALLY contained: it is either the
+   * legacy default root (`memoryDir`) or a strict descendant of
+   * `<memoryDir>/namespaces/`. The router legitimately resolves a namespace to
+   * EITHER the tokenized dir or a legacy raw-name dir under `namespaces/`, so we
+   * accept any contained child rather than a single exact token path. This is a
+   * pure string check — symlink escape is checked separately via realpath.
+   */
+  isLexicallyContained(candidate) {
+    const resolved = path2.resolve(candidate);
+    if (resolved === path2.resolve(this.memoryDir)) return true;
+    const nsBase = path2.resolve(path2.join(this.memoryDir, "namespaces"));
+    const rel = path2.relative(nsBase, resolved);
+    return rel.length > 0 && !rel.startsWith("..") && !path2.isAbsolute(rel);
+  }
+  /**
+   * Whether a candidate storage dir satisfies the catalog containment contract,
+   * including SYMLINK-escape rejection (round 5, codex P2). A lexically-contained
+   * path that is actually a symlink to an outside directory would let maintenance
+   * or QMD follow it outside `memoryDir`. We mirror `rebuildFromDisk`'s posture:
+   * the path must be lexically contained AND, if it exists on disk, neither the
+   * path itself a symlink nor its realpath escaping the memory root. Non-existent
+   * paths pass the realpath stage (nothing to follow yet) but still must be
+   * lexically contained.
+   */
+  async isContainedStorageDir(candidate) {
+    if (!this.isLexicallyContained(candidate)) return false;
+    if (path2.resolve(candidate) === path2.resolve(this.memoryDir)) return true;
+    let memoryReal;
+    try {
+      memoryReal = await realpath(this.memoryDir);
+    } catch {
+      memoryReal = path2.resolve(this.memoryDir);
+    }
+    if (await this.hasSymlinkedAncestor(candidate)) return false;
+    try {
+      const stat3 = await lstat(candidate);
+      if (stat3.isSymbolicLink()) return false;
+      if (!stat3.isDirectory()) return false;
+    } catch {
+      return this.isNearestExistingAncestorContained(candidate, memoryReal);
+    }
+    try {
+      const real = await realpath(candidate);
+      return isPathInside(memoryReal, real);
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * Reject a candidate whose path crosses a SYMLINKED ancestor strictly between
+   * memoryDir and the leaf (codex NVuq5). `realpath`-based containment accepts a
+   * symlinked `<memoryDir>/namespaces` that currently resolves back inside
+   * memoryDir, but the disk scanner rejects such a root and a later retarget would
+   * escape the memory tree — so refuse it here too. The leaf itself is
+   * symlink-checked by the caller; this walks only the intermediate ancestors.
+   */
+  async hasSymlinkedAncestor(candidate) {
+    const stopAt = path2.resolve(this.memoryDir);
+    let dir = path2.dirname(path2.resolve(candidate));
+    const root = path2.parse(dir).root;
+    while (dir !== stopAt && dir !== root && dir !== path2.dirname(dir)) {
+      try {
+        if ((await lstat(dir)).isSymbolicLink()) return true;
+      } catch {
+      }
+      dir = path2.dirname(dir);
+    }
+    return false;
+  }
+  /**
+   * Walk up from a not-yet-existing candidate to the nearest ancestor that exists
+   * on disk and verify its realpath stays inside `memoryReal` (round 6, codex P2
+   * — NDo79). Rejects a non-existent leaf whose existing parent chain escapes
+   * memoryDir via a symlink. Stops at memoryDir's resolved root.
+   *
+   * The nearest existing ancestor must also be a DIRECTORY (NHIdt, codex P2): if
+   * an existing parent such as `<memoryDir>/namespaces` is a regular FILE (or
+   * socket/fifo), `realpath(parent)` still succeeds and resolves inside memoryDir,
+   * so a containment-only check would ACCEPT a leaf that can never be created — you
+   * cannot mkdir a child under a file. We `lstat` the nearest existing ancestor and
+   * reject when it is not a directory, mirroring the leaf non-directory rejection
+   * (NF21i) and the disk scan, so every containment consumer agrees.
+   */
+  async isNearestExistingAncestorContained(candidate, memoryReal) {
+    let dir = path2.resolve(candidate);
+    const root = path2.parse(dir).root;
+    for (; ; ) {
+      const parent = path2.dirname(dir);
+      if (parent === dir || dir === root) return false;
+      let real;
+      try {
+        real = await realpath(parent);
+      } catch {
+        dir = parent;
+        continue;
+      }
+      if (!(isPathInside(memoryReal, real) || real === memoryReal)) return false;
+      try {
+        const stat3 = await lstat(real);
+        return stat3.isDirectory();
+      } catch {
+        return false;
+      }
+    }
+  }
+  /**
+   * Resolve the storage dir to persist for a touch, validating any caller-
+   * provided `metadata.storageDir` against the catalog containment contract
+   * (round 4 + round 5, codex P2). `markWrite`/`registerResolved` accept an
+   * explicit storageDir, but persisting it verbatim would let a bad hook or
+   * external consumer write an arbitrary path — including one outside `memoryDir`
+   * or a symlink that escapes it — into the catalog, handing maintenance/QMD an
+   * unsafe root. We accept an explicit (or previously-stored) dir ONLY when it
+   * stays contained under memoryDir (lexically AND via realpath); otherwise we
+   * drop it and fall back to the trusted resolved dir.
+   */
+  async resolveTouchStorageDir(namespace, explicit, existingDir) {
+    if (explicit !== void 0 && await this.isContainedStorageDir(explicit) && await this.isStorageDirForNamespace(namespace, explicit)) {
+      return explicit;
+    }
+    if (existingDir !== void 0 && await this.isContainedStorageDir(existingDir) && await this.isStorageDirForNamespace(namespace, existingDir)) {
+      return existingDir;
+    }
+    return this.resolveSafeStorageDir(namespace);
+  }
+  /**
+   * Whether `candidate` is a legitimate storage root FOR `namespace` (round 6,
+   * codex P2 — NDATT). Accepts the namespace's router-resolved root, its canonical
+   * lexical tokenized dir, and (for the default namespace only) memoryDir. This
+   * prevents a contained-but-CROSS-NAMESPACE path — another namespace's tree, or
+   * memoryDir for a non-default namespace — from being persisted as this
+   * namespace's root. Compared on resolved (absolute) paths.
+   */
+  async isStorageDirForNamespace(namespace, candidate) {
+    const resolvedCandidate = path2.resolve(candidate);
+    const valid = /* @__PURE__ */ new Set();
+    try {
+      valid.add(path2.resolve(this.namespaceTokenDir(namespaceIdentityToken(namespace))));
+    } catch {
+    }
+    try {
+      valid.add(path2.resolve(this.namespaceTokenDir(namespace)));
+    } catch {
+    }
+    try {
+      valid.add(path2.resolve(await resolveNamespaceStorageRoot(this.config, namespace)));
+    } catch {
+    }
+    if (normalizeNamespaceIdentity(namespace) === this.defaultNamespaceIdentity) {
+      valid.add(path2.resolve(this.memoryDir));
+      try {
+        valid.add(path2.resolve(await resolveDefaultNamespaceRoot(this.config)));
+      } catch {
+      }
+    }
+    return valid.has(resolvedCandidate);
+  }
+  /**
+   * Resolve the canonical storage dir for a namespace as the LIVE ROUTER would,
+   * but NEVER return a path that escapes the memory root.
+   *
+   * Router alignment (round 4, cursor Medium): a read/register touch with no
+   * explicit storageDir previously used the lexical `resolveStorageDir`, which
+   * always picks `<memoryDir>/namespaces/<token>` (or `memoryDir` for the
+   * default). That diverges from `NamespaceStorageRouter`, which can route to a
+   * legacy raw-name dir or a migrated default root — so a recall touch could
+   * record a contained-but-WRONG root that maintenance/rebuild then targets. We
+   * now delegate to the shared `resolveNamespaceStorageRoot` (the very helper the
+   * router uses) so the catalog records the same on-disk root the router serves.
+   *
+   * Containment (round 5, codex P2): the resolved path can still be a symlink
+   * escaping memoryDir, so we run the full (lexical + realpath) containment
+   * contract. When it FAILS we fall back to a NAMESPACE-SPECIFIC safe root, NOT
+   * a blanket `memoryDir`. Recording `memoryDir` for a non-default namespace
+   * would point enumeration/maintenance at the DEFAULT namespace's tree (round 5,
+   * cursor/codex Medium/P2) — a cross-namespace fanout error. The correct safe
+   * root is the namespace's own lexical tokenized dir
+   * (`<memoryDir>/namespaces/<token>`), which is always contained and is that
+   * namespace's canonical location (we record the lexical PATH as metadata; we do
+   * not follow the escaping symlink). Only the default namespace — or a token so
+   * unsafe even the lexical dir cannot be built — falls back to `memoryDir`.
+   */
+  async resolveSafeStorageDir(namespace) {
+    let resolved;
+    try {
+      resolved = await resolveNamespaceStorageRoot(this.config, namespace);
+    } catch {
+      return this.safeFallbackStorageDir(namespace);
+    }
+    if (await this.isContainedStorageDir(resolved)) return resolved;
+    return this.safeFallbackStorageDir(namespace);
+  }
+  /**
+   * The namespace-specific contained fallback root, used when the router-resolved
+   * root fails containment (round 5, cursor/codex Medium/P2).
+   *
+   * Preference order:
+   *  1. The namespace's OWN lexical tokenized dir (`namespaces/<token>`) — so a
+   *     non-default namespace is NOT pointed at the DEFAULT namespace's `memoryDir`
+   *     tree (which would misdirect maintenance fanout). Returned only when the
+   *     token dir itself stays CONTAINED (it is not a symlink, and its realpath
+   *     does not escape memoryDir — e.g. via a symlinked `namespaces/` parent).
+   *  2. `memoryDir` as a LAST resort — for the default namespace, an unsafe token
+   *     that cannot build a contained path, OR the irreparable case where the
+   *     token dir's realpath escapes the root (so even its lexical path resolves
+   *     outside). NF21m note (codex P2): we deliberately do NOT record the lexical
+   *     token dir in that irreparable case — its realpath escapes memoryDir, and
+   *     the NDo79 contract REQUIRES that an escaping path is never persisted (a
+   *     later mkdir/maintenance/QMD op would follow it outside the root). Since no
+   *     contained namespace-specific path exists, containment wins: `memoryDir` is
+   *     the only safe root left. A namespace whose token dir's realpath escapes is
+   *     an irreparable on-disk state; recording the contained default root is
+   *     strictly safer than persisting an escaping one. The common case where the
+   *     token dir IS contained is handled by branch 1, so a healthy non-default
+   *     namespace never reaches `memoryDir`.
+   */
+  async safeFallbackStorageDir(namespace) {
+    if (normalizeNamespaceIdentity(namespace) === this.defaultNamespaceIdentity) return this.memoryDir;
+    let tokenDir;
+    try {
+      tokenDir = this.namespaceTokenDir(namespaceIdentityToken(namespace));
+    } catch {
+      return this.memoryDir;
+    }
+    if (await this.isContainedStorageDir(tokenDir)) return tokenDir;
+    return this.memoryDir;
+  }
+  /**
+   * Re-check, NOW, whether a namespace's storage root currently EXISTS on disk
+   * with the SAME safety the directory scan uses (NFJV8, codex P2).
+   *
+   * The rebuild's final re-merge runs under the held lock and folds the freshly
+   * re-read log (`latest`) into the scanned `rebuilt` set. A namespace present in
+   * `latest` (a live touch row) but ABSENT from `rebuilt` is normally PURGED as
+   * deleted (the NATqU "disk scan is authoritative" rule). But there is a TOCTOU
+   * window: a dynamic namespace can be CREATED on disk AFTER `rebuildFromDisk()`
+   * already enumerated `namespaces/` but BEFORE this re-merge. The scan snapshot
+   * missed its new root, yet a gateway `markWrite` already appended a row for it.
+   * Blindly purging that row would rewrite the catalog WITHOUT a live namespace
+   * that now has data on disk, so `writtenSince`/maintenance/QMD consumers miss
+   * it until another touch or rebuild.
+   *
+   * So before purging, we re-resolve the namespace's safe storage root (the same
+   * router-aligned, containment-checked path the scan would have catalogued) and
+   * confirm it is a real, contained, non-symlink directory that actually holds
+   * memory data RIGHT NOW. If so the namespace was created-after-scan and is LIVE
+   * — KEEP its row. This is the precise inverse of NATqU and does NOT reintroduce
+   * it: a touch on a REMOVED root re-checks as ABSENT (no data on disk) and is
+   * still purged; only a root that EXISTS on a fresh re-check is kept.
+   *
+   * Mirrors the per-entry scan checks (symlink rejection + realpath containment +
+   * `hasMemoryData`) so a symlinked/escaping root is never resurrected.
+   */
+  async liveStorageRootExistsForRebuild(namespace, memoryReal) {
+    let root;
+    try {
+      root = await this.resolveSafeStorageDir(namespace);
+    } catch {
+      return false;
+    }
+    if (normalizeNamespaceIdentity(namespace) !== this.defaultNamespaceIdentity && path2.resolve(root) === path2.resolve(this.memoryDir)) {
+      return false;
+    }
+    let stat3;
+    try {
+      stat3 = await lstat(root);
+    } catch {
+      return false;
+    }
+    if (stat3.isSymbolicLink()) return false;
+    if (!stat3.isDirectory()) return false;
+    try {
+      const real = await realpath(root);
+      if (memoryReal && !isPathInside(memoryReal, real)) return false;
+    } catch {
+      return false;
+    }
+    return hasMemoryData(root);
+  }
+  /**
+   * Record a namespace touch. Returns whether the touch actually APPENDED to the
+   * log (round 6, codex P2 — NEFoX): a disabled catalog or a dropped append (the
+   * NAUf7 rebuild-lock-timeout drop) returns `false`, so callers (e.g. the router
+   * resolve-hook dedup) can avoid marking a dropped registration as completed and
+   * suppressing its retry.
+   */
+  async touch(namespace, kind, metadata, jobName) {
+    if (!this.enabled) return false;
+    const ns = this.validateNamespace(namespace);
+    const nowIso = (metadata?.at ?? /* @__PURE__ */ new Date()).toISOString();
+    return this.queueCritical(
+      async () => this.withHeldCatalogLock(async (acquired) => {
+        if (!acquired) return false;
+        if (this.onTouchCriticalSectionForTest) {
+          await this.onTouchCriticalSectionForTest();
+        }
+        const records = await this.loadCompacted();
+        const existing = records.get(ns);
+        const storageDir = await this.resolveTouchStorageDir(
+          ns,
+          metadata?.storageDir,
+          existing?.storageDir
+        );
+        const record = existing ? { ...existing } : {
+          namespace: ns,
+          identityToken: namespaceIdentityToken(ns),
+          kind: metadata?.kind ?? inferKind(ns, this.config),
+          createdAt: nowIso,
+          storageDir,
+          discoveredBy: metadata?.discoveredBy ?? (kind === "register" ? "config" : kind === "maintenance" ? "scan" : kind)
+        };
+        record.storageDir = storageDir;
+        if (metadata?.kind) record.kind = metadata.kind;
+        if (metadata?.principal !== void 0) record.principal = metadata.principal;
+        if (metadata?.projectId !== void 0) record.projectId = metadata.projectId;
+        if (metadata?.branch !== void 0) record.branch = metadata.branch;
+        if (metadata?.parentNamespace !== void 0)
+          record.parentNamespace = metadata.parentNamespace;
+        if (kind === "write" && existing && record.discoveredBy === "config") {
+          record.discoveredBy = "write";
+        }
+        if (kind === "read") record.lastReadAt = nowIso;
+        if (kind === "write") record.lastWriteAt = nowIso;
+        if (kind === "maintenance" && jobName) {
+          record.lastMaintenanceAt = { ...record.lastMaintenanceAt ?? {}, [jobName]: nowIso };
+        }
+        await this.appendUnchained(record);
+        return true;
+      })
+    );
+  }
+  // ── Rebuild from disk ────────────────────────────────────────────────────
+  async rebuildFromDisk(options) {
+    const dryRun = options?.dryRun === true;
+    if (!this.enabled) {
+      return { dryRun, records: [], skipped: [], applied: false };
+    }
+    if (dryRun) {
+      return this.queueCritical(async () => this.rebuildInsideChain(dryRun, false));
+    }
+    return this.queueCritical(async () => this.rebuildInsideChain(dryRun, true));
+  }
+  /**
+   * Body of `rebuildFromDisk`, run inside a single `queueCritical` turn. MUST
+   * only be invoked from within the serialized chain so the load and the
+   * rewrite are atomic with respect to concurrent touches (in-process).
+   *
+   * `wantMutate` is true for an `--apply` (the caller intends to rewrite). The
+   * cross-process file lock is acquired LATE — only around the final
+   * load→merge→rename window (NFgCT, codex P2) — never across the disk scan, so a
+   * long scan does not force concurrent gateway touches to wait (and drop their
+   * append). Whether the rewrite actually happened is reported via the result's
+   * `applied`: true only when `wantMutate` AND the lock was acquired.
+   */
+  async rebuildInsideChain(dryRun, wantMutate) {
+    const existing = await this.loadCompacted();
+    const skipped = [];
+    const rebuilt = /* @__PURE__ */ new Map();
+    const nowIso = (/* @__PURE__ */ new Date()).toISOString();
+    let memoryReal = null;
+    try {
+      memoryReal = await realpath(this.memoryDir);
+    } catch {
+      memoryReal = this.memoryDir;
+    }
+    const defaultNs = normalizeNamespaceIdentity(this.config.defaultNamespace);
+    const configured = new Set(
+      [
+        this.config.defaultNamespace,
+        this.config.sharedNamespace,
+        ...this.config.namespacePolicies.map((p) => p.name)
+      ].map((n) => normalizeNamespaceIdentity(n)).filter((n) => n.length > 0)
+    );
+    const resolvedDefaultRoot = await resolveDefaultNamespaceRoot(this.config);
+    const defaultStorageDir = await this.isContainedStorageDir(resolvedDefaultRoot) ? resolvedDefaultRoot : this.memoryDir;
+    const legacyDefaultHasData = defaultStorageDir === this.memoryDir;
+    for (const ns of configured) {
+      if (!ns) continue;
+      if (ns !== defaultNs && !isSafeRouteNamespace(ns)) {
+        let token;
+        try {
+          token = namespaceIdentityToken(ns);
+        } catch {
+          token = ns;
+        }
+        skipped.push({ token, reason: "unsafe", detail: ns });
+        continue;
+      }
+      let storageDir;
+      if (ns === defaultNs) {
+        storageDir = defaultStorageDir;
+      } else {
+        try {
+          storageDir = await resolveNamespaceStorageRoot(this.config, ns);
+        } catch {
+          storageDir = this.namespaceTokenDir(namespaceIdentityToken(ns));
+        }
+      }
+      if (!await this.isContainedStorageDir(storageDir)) {
+        if (ns === defaultNs) {
+          storageDir = this.memoryDir;
+        } else {
+          skipped.push({ token: namespaceIdentityToken(ns), reason: "escape", detail: storageDir });
+          continue;
+        }
+      }
+      rebuilt.set(
+        ns,
+        this.mergeForRebuild(existing.get(ns), {
+          namespace: ns,
+          identityToken: namespaceIdentityToken(ns),
+          kind: inferKind(ns, this.config),
+          createdAt: existing.get(ns)?.createdAt ?? nowIso,
+          storageDir,
+          discoveredBy: "config"
+        })
+      );
+    }
+    const namespacesDir = path2.join(this.memoryDir, "namespaces");
+    let entries = [];
+    let namespacesDirSafe = true;
+    try {
+      const rootStat = await lstat(namespacesDir);
+      if (rootStat.isSymbolicLink()) {
+        namespacesDirSafe = false;
+      } else {
+        const realNamespacesDir = await realpath(namespacesDir);
+        if (memoryReal && !isPathInside(memoryReal, realNamespacesDir)) {
+          namespacesDirSafe = false;
+        }
+      }
+    } catch {
+      namespacesDirSafe = true;
+    }
+    if (!namespacesDirSafe) {
+      skipped.push({ token: "namespaces", reason: "symlink", detail: namespacesDir });
+    } else {
+      try {
+        entries = await readdir(namespacesDir, { withFileTypes: true });
+      } catch {
+        entries = [];
+      }
+    }
+    const scannedFromTokenized = /* @__PURE__ */ new Set();
+    for (const entry of entries) {
+      const token = entry.name;
+      const fullPath = path2.join(namespacesDir, token);
+      let stat3;
+      try {
+        stat3 = await lstat(fullPath);
+      } catch (err) {
+        skipped.push({ token, reason: "error", detail: err instanceof Error ? err.message : String(err) });
+        continue;
+      }
+      if (stat3.isSymbolicLink()) {
+        skipped.push({ token, reason: "symlink", detail: fullPath });
+        continue;
+      }
+      if (!stat3.isDirectory()) continue;
+      try {
+        const real = await realpath(fullPath);
+        if (memoryReal && !isPathInside(memoryReal, real)) {
+          skipped.push({ token, reason: "escape", detail: real });
+          continue;
+        }
+      } catch (err) {
+        skipped.push({ token, reason: "error", detail: err instanceof Error ? err.message : String(err) });
+        continue;
+      }
+      const literalRecord = existing.get(token);
+      const literalOwnsRoot = configured.has(token) || literalRecord !== void 0 && path2.resolve(literalRecord.storageDir) === path2.resolve(fullPath);
+      const tokenDecoded = literalOwnsRoot ? null : namespaceIdentityFromToken(token);
+      const rawDecoded = tokenDecoded && tokenDecoded.length > 0 ? tokenDecoded : token;
+      const decoded = normalizeNamespaceIdentity(rawDecoded);
+      if (decoded.length === 0 || rawDecoded !== decoded) {
+        skipped.push({ token, reason: "unsafe", detail: rawDecoded });
+        continue;
+      }
+      if (decoded !== defaultNs && !isSafeRouteNamespace(decoded)) {
+        skipped.push({ token, reason: "unsafe", detail: decoded });
+        continue;
+      }
+      const memoryData = await inspectMemoryDataRoot(fullPath);
+      if (memoryData.invalidMarker) {
+        skipped.push({
+          token,
+          reason: "unsafe",
+          detail: `invalid memory marker: ${memoryData.invalidMarker}`
+        });
+        continue;
+      }
+      if (!memoryData.hasData) continue;
+      if (decoded === defaultNs) {
+        const def = rebuilt.get(defaultNs);
+        if (def) {
+          def.storageDir = defaultStorageDir;
+          def.kind = "default";
+        }
+        continue;
+      }
+      const isTokenizedEntry = token === namespaceIdentityToken(decoded);
+      if (rebuilt.has(decoded) && scannedFromTokenized.has(decoded) && !isTokenizedEntry) {
+        continue;
+      }
+      if (isTokenizedEntry) scannedFromTokenized.add(decoded);
+      const prior = existing.get(decoded);
+      rebuilt.set(
+        decoded,
+        this.mergeForRebuild(prior, {
+          namespace: decoded,
+          identityToken: namespaceIdentityToken(decoded),
+          kind: inferKind(decoded, this.config),
+          createdAt: prior?.createdAt ?? nowIso,
+          storageDir: fullPath,
+          // Configured-and-present namespaces keep config provenance; purely
+          // discovered ones are scan.
+          discoveredBy: configured.has(decoded) ? "config" : prior?.discoveredBy ?? "scan"
+        })
+      );
+    }
+    if (legacyDefaultHasData && defaultStorageDir === this.memoryDir) {
+      const def = rebuilt.get(defaultNs);
+      if (def) def.kind = "default";
+    }
+    if (!wantMutate) {
+      return this.finishRebuild(rebuilt, skipped, dryRun, false, memoryReal, nowIso);
+    }
+    if (this.onRebuildAfterScanForTest) {
+      await this.onRebuildAfterScanForTest();
+    }
+    return this.withHeldCatalogLock(
+      (acquired) => this.finishRebuild(rebuilt, skipped, dryRun, acquired, memoryReal, nowIso)
+    );
+  }
+  /**
+   * Final load→merge→rename window of a rebuild, factored out so the caller can
+   * run it WITHIN the cross-process file lock (NFgCT, codex P2) without holding
+   * that lock across the preceding disk scan. Re-reads the latest on-disk state,
+   * folds concurrent touches, then (when `canMutate`) atomically rewrites the log.
+   *
+   * `canMutate` records that the cross-process lock was actually held. The
+   * re-merge + rewrite run only when it is true — a dry-run, or an unlocked apply
+   * (lock-acquisition timeout), computes records but does NOT rename, so it can
+   * never clobber a concurrent lock holder's window. `applied` mirrors `canMutate`.
+   */
+  async finishRebuild(rebuilt, skipped, dryRun, canMutate, memoryReal, nowIso) {
+    if (canMutate) {
+      const latest = await this.loadCompacted();
+      for (const [ns, fresh] of latest) {
+        const current = rebuilt.get(ns);
+        if (!current) {
+          if (ns !== this.defaultNamespaceIdentity && !isSafeRouteNamespace(ns)) {
+            continue;
+          }
+          if (await this.liveStorageRootExistsForRebuild(ns, memoryReal)) {
+            const safeDir = await this.resolveSafeStorageDir(ns);
+            const resolvedSafe = path2.resolve(safeDir);
+            let owningNamespace = null;
+            for (const [otherNs, otherRec] of rebuilt) {
+              if (otherNs !== ns && path2.resolve(otherRec.storageDir) === resolvedSafe) {
+                owningNamespace = otherNs;
+                break;
+              }
+            }
+            if (owningNamespace) {
+              const owner = rebuilt.get(owningNamespace);
+              if (owner) rebuilt.set(owningNamespace, mergeNewerTouchFields(owner, fresh));
+              continue;
+            }
+            rebuilt.set(ns, {
+              ...fresh,
+              storageDir: safeDir,
+              identityToken: namespaceIdentityToken(ns),
+              kind: fresh.kind ?? inferKind(ns, this.config),
+              createdAt: fresh.createdAt ?? nowIso
+            });
+            continue;
+          }
+          continue;
+        }
+        rebuilt.set(ns, mergeNewerTouchFields(current, fresh));
+      }
+    }
+    const records = [...rebuilt.values()].sort((a, b) => {
+      const byName = a.namespace.localeCompare(b.namespace);
+      if (byName !== 0) return byName;
+      return a.identityToken.localeCompare(b.identityToken);
+    });
+    if (canMutate) {
+      if (this.onRebuildBeforeRenameForTest) {
+        await this.onRebuildBeforeRenameForTest();
+      }
+      await this.rewriteUnchained(records);
+    }
+    return { dryRun, records, skipped, applied: canMutate };
+  }
+  // ── Cross-process catalog write lock (held mutex) ────────────────────────
+  /**
+   * Run `fn` while HOLDING the shared cross-process advisory lock (round 5, codex
+   * P2; generalized round 7 — NEZkA). This is the SINGLE mutex shared by BOTH the
+   * touch read→merge→append window AND the rebuild final load→merge→rename window,
+   * so a touch and a rebuild in different processes are mutually exclusive over
+   * their respective critical sections — closing the check-then-append gap where a
+   * polled-only touch could append into a rebuild's load→rename window.
+   *
+   * Acquisition is atomic via `open(..., "wx")`. A lock older than
+   * `REBUILD_LOCK_STALE_MS` is treated as a crashed holder and broken. After
+   * `REBUILD_LOCK_MAX_WAIT_MS` of contention we proceed best-effort WITHOUT the
+   * lock rather than block forever. The lock is always released in `finally`.
+   *
+   * IN-PROCESS SAFETY: every caller invokes this from inside (or wrapping) the
+   * per-process `queueCritical` chain, which serializes all catalog mutations in
+   * THIS process. So within one process only one logical holder attempts OS-lock
+   * acquisition at a time — the file lock is never self-contended in-process, and
+   * the lock is acquired and released within a single in-process turn. The file
+   * lock adds only the missing CROSS-process exclusion.
+   *
+   * HEARTBEAT (round 5, cursor/codex Medium/P2): while WE hold the lock a timer
+   * refreshes its mtime every `REBUILD_LOCK_HEARTBEAT_MS`, so a legitimately long
+   * holder (> `REBUILD_LOCK_STALE_MS`) is not treated as a crashed holder and
+   * unlinked by another process — which would let overlapping windows lose
+   * appends. Heartbeat failures are swallowed; the timer is always cleared in
+   * `finally`.
+   *
+   * ACQUISITION RESULT (round 6, codex P2 — NBPmY): `fn` receives whether WE
+   * actually hold the lock. When acquisition TIMED OUT (another holder is active),
+   * a MUTATING rebuild must NOT perform its load/rename window unlocked, and a
+   * touch must NOT append unlocked — both would recreate the lost-append race. The
+   * caller uses `acquired` to run compute-only (rebuild) or DROP the append
+   * (touch) when unlocked.
+   */
+  async withHeldCatalogLock(fn) {
+    const acquired = await this.acquireRebuildLock();
+    let heartbeat;
+    if (acquired) {
+      heartbeat = setInterval(() => {
+        const now = /* @__PURE__ */ new Date();
+        utimes(this.rebuildLockPath, now, now).catch(() => void 0);
+      }, REBUILD_LOCK_HEARTBEAT_MS);
+      heartbeat.unref?.();
+    }
+    try {
+      return await fn(acquired);
+    } finally {
+      if (heartbeat) clearInterval(heartbeat);
+      if (acquired) {
+        try {
+          if (await this.rebuildLockHeldBySelf()) {
+            await unlink(this.rebuildLockPath);
+          }
+        } catch {
+        }
+      }
+    }
+  }
+  /** Try to acquire the rebuild lock; returns true if WE created it. */
+  async acquireRebuildLock() {
+    const deadline = Date.now() + REBUILD_LOCK_MAX_WAIT_MS;
+    await mkdir2(this.stateDir, { recursive: true });
+    for (; ; ) {
+      try {
+        const handle = await open(this.rebuildLockPath, "wx");
+        try {
+          await handle.writeFile(
+            `${process.pid} ${this.lockOwnerId} ${(/* @__PURE__ */ new Date()).toISOString()}
+`,
+            "utf8"
+          );
+        } catch {
+        } finally {
+          await handle.close();
+        }
+        return true;
+      } catch (err) {
+        if (err?.code !== "EEXIST") {
+          return false;
+        }
+        await this.breakStaleRebuildLock();
+        if (Date.now() >= deadline) return false;
+        await new Promise((r) => setTimeout(r, REBUILD_LOCK_POLL_MS));
+      }
+    }
+  }
+  /**
+   * Remove the lock file if its mtime is older than the stale threshold.
+   *
+   * REPLACEMENT-SAFE (NG7Bg, codex P2): a plain `stat` → `unlink` has a TOCTOU
+   * window — two processes can both observe the SAME stale lock; one removes it and
+   * creates a FRESH lock, and the other's later `unlink` then deletes that fresh
+   * holder's ACTIVE lock based on the stale identity it read earlier, leaving the
+   * fresh holder running its critical section with no visible lock and reopening the
+   * lost-update race the mutex prevents. We therefore capture the lock's IDENTITY
+   * (its full content line: `<pid> <owner-uuid> <iso>`) when we judge it stale, then
+   * RE-READ immediately before unlinking and only remove it when the content is
+   * byte-identical AND still stale. A replacement lock has a different owner id /
+   * timestamp, so its content differs and we leave it untouched. We never unlink a
+   * lock whose mtime is now fresh (a heartbeat refreshed it) or whose identity
+   * changed (a replacement was created). This is best-effort: any mismatch/vanish
+   * simply skips the break and the caller polls again.
+   */
+  async breakStaleRebuildLock() {
+    let staleIdentity;
+    try {
+      const info = await stat(this.rebuildLockPath);
+      if (Date.now() - info.mtimeMs <= REBUILD_LOCK_STALE_MS) {
+        return;
+      }
+      staleIdentity = await readFile2(this.rebuildLockPath, "utf8");
+    } catch {
+      return;
+    }
+    if (this.onBeforeBreakStaleUnlinkForTest) {
+      await this.onBeforeBreakStaleUnlinkForTest();
+    }
+    try {
+      const current = await readFile2(this.rebuildLockPath, "utf8");
+      if (current !== staleIdentity) return;
+      const recheck = await stat(this.rebuildLockPath);
+      if (Date.now() - recheck.mtimeMs <= REBUILD_LOCK_STALE_MS) return;
+      await unlink(this.rebuildLockPath).catch(() => void 0);
+    } catch {
+    }
+  }
+  /**
+   * Whether the rebuild lock file was written by THIS instance (round 6, codex
+   * P2 — NBsGP). Matches the per-instance owner id, NOT just `process.pid`: two
+   * NamespaceCatalog instances in the same process share a PID, so a PID-only
+   * check would wrongly treat instance A's lock as self-held by instance B and
+   * let B's touch skip the wait and append into A's rebuild window. Falls back to
+   * the legacy PID-only form for lock files written before owner ids existed.
+   */
+  async rebuildLockHeldBySelf() {
+    try {
+      const body = await readFile2(this.rebuildLockPath, "utf8");
+      const parts = body.trim().split(/\s+/);
+      const pid = Number.parseInt(parts[0] ?? "", 10);
+      const ownerId = parts[1];
+      const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+      if (ownerId && UUID_RE.test(ownerId)) {
+        return ownerId === this.lockOwnerId;
+      }
+      return Number.isFinite(pid) && pid === process.pid;
+    } catch {
+      return false;
     }
-    rules.push(rule);
-    await saveCorrectionsFile(storage.dir, rules);
   }
-  async removeCorrection(index) {
-    if (!Number.isInteger(index) || index < 0) {
-      throw new WearablesInputError(`invalid correction index '${index}'`);
+  /**
+   * Merge a prior record's preserved metadata (timestamps, principal hints)
+   * onto a freshly-discovered record. Disk-derived fields (storageDir, kind)
+   * take precedence from the new record.
+   *
+   * PROVENANCE (round 3, cursor Low): `discoveredBy` and `createdAt` are
+   * CREATION-ONLY — identical to the touch path's invariant. A rebuild must NOT
+   * reset a namespace first seen via a `write`/`read` touch back to `config`
+   * just because it is also listed in policies. So when a prior record exists we
+   * carry its `discoveredBy` forward; only brand-new records keep the fresh
+   * (config/scan) provenance.
+   */
+  mergeForRebuild(prior, fresh) {
+    if (!prior) return fresh;
+    const merged = {
+      ...fresh,
+      createdAt: prior.createdAt ?? fresh.createdAt,
+      discoveredBy: prior.discoveredBy ?? fresh.discoveredBy
+    };
+    if (prior.lastReadAt) merged.lastReadAt = prior.lastReadAt;
+    if (prior.lastWriteAt) merged.lastWriteAt = prior.lastWriteAt;
+    if (prior.lastMaintenanceAt) merged.lastMaintenanceAt = { ...prior.lastMaintenanceAt };
+    if (prior.principal !== void 0) merged.principal = prior.principal;
+    if (prior.projectId !== void 0) merged.projectId = prior.projectId;
+    if (prior.branch !== void 0) merged.branch = prior.branch;
+    if (prior.parentNamespace !== void 0) merged.parentNamespace = prior.parentNamespace;
+    return merged;
+  }
+  // ── Persistence ──────────────────────────────────────────────────────────
+  /** Load the JSONL log and fold it into current state (last-record-wins). */
+  async loadCompacted() {
+    const records = /* @__PURE__ */ new Map();
+    let raw;
+    try {
+      raw = await readFile2(this.catalogPath, "utf8");
+    } catch {
+      return records;
     }
-    const storage = await this.deps.getStorage();
-    const rules = await loadCorrectionsFile(storage.dir);
-    if (index >= rules.length) {
-      throw new WearablesInputError(
-        `correction index ${index} is out of range (have ${rules.length} state rule${rules.length === 1 ? "" : "s"})`
-      );
+    for (const line of raw.split("\n")) {
+      const trimmed = line.trim();
+      if (trimmed.length === 0) continue;
+      let parsed;
+      try {
+        parsed = JSON.parse(trimmed);
+      } catch {
+        continue;
+      }
+      const record = coerceRecord(parsed);
+      if (!record) continue;
+      const prior = records.get(record.namespace);
+      records.set(record.namespace, prior ? mergeNewerTouchFields(record, prior) : record);
     }
-    const [removed] = rules.splice(index, 1);
-    await saveCorrectionsFile(storage.dir, rules);
-    return removed;
+    return records;
   }
-};
-function clampLimit(value, fallback, max, label) {
-  if (value === void 0) return fallback;
-  if (!Number.isFinite(value) || !Number.isInteger(value) || value < 1 || value > max) {
-    throw new WearablesInputError(
-      `invalid ${label} '${value}' \u2014 expected an integer between 1 and ${max}`
+  /**
+   * Serialize an arbitrary read-modify-write critical section through the single
+   * write chain. Every catalog mutation (touch read+merge+append, full rewrite)
+   * runs through this so they are mutually exclusive: a touch always reads the
+   * latest persisted state before appending, and a rebuild rewrite cannot
+   * interleave with a touch's append. The chain recovers from rejection
+   * (CLAUDE.md rule #40) — one failed section never poisons subsequent ones —
+   * while still surfacing the error to that section's awaited promise.
+   */
+  queueCritical(fn) {
+    const run = this.writeChain.then(fn);
+    this.writeChain = run.then(
+      () => void 0,
+      () => void 0
     );
+    return run;
   }
-  return value;
-}
-function locateTranscriptPath(hitPath) {
-  const normalized = hitPath.replace(/\\/g, "/");
-  const match = normalized.match(
-    /(?:^|\/)wearables\/([a-z][a-z0-9-]{0,63})\/(\d{4}-\d{2}-\d{2})\.md$/
-  );
-  if (!match) return null;
-  if (!isValidTranscriptDate(match[2])) return null;
-  return { source: match[1], date: match[2] };
-}
-function extractSnippet(body, index, matchLength) {
-  const start = Math.max(0, index - 80);
-  const end = Math.min(body.length, index + matchLength + 80);
-  const prefix = start > 0 ? "\u2026" : "";
-  const suffix = end < body.length ? "\u2026" : "";
-  return `${prefix}${body.slice(start, end).replace(/\s+/g, " ").trim()}${suffix}`;
+  /**
+   * Append a single record to the JSONL log WITHOUT re-serializing through the
+   * write chain. MUST only be called from inside a `queueCritical(...)` section
+   * (which already holds the serialized turn); calling it directly would bypass
+   * the read-before-append ordering that prevents lost-field races.
+   */
+  async appendUnchained(record) {
+    const line = serializeRecord(record) + "\n";
+    await mkdir2(this.stateDir, { recursive: true });
+    await appendFile(this.catalogPath, line, "utf8");
+  }
+  /**
+   * Atomic temp-file + rename rewrite (CLAUDE.md rule #54: write temp, then
+   * rename — never delete-before-write) WITHOUT re-entering the write chain.
+   * MUST only be called from inside a `queueCritical(...)` turn (e.g. the
+   * rebuild critical section, which already holds the serialized turn so its
+   * load and rewrite are atomic against concurrent touches). Re-entering the
+   * chain from within a held turn would deadlock.
+   */
+  async rewriteUnchained(records) {
+    const body = records.map((r) => serializeRecord(r)).join("\n") + (records.length > 0 ? "\n" : "");
+    await mkdir2(this.stateDir, { recursive: true });
+    const tmp = `${this.catalogPath}.${process.pid}.${Date.now()}.tmp`;
+    await writeFile2(tmp, body, "utf8");
+    await rename(tmp, this.catalogPath);
+  }
+};
+function isPathInside(root, child) {
+  const relative = path2.relative(root, child);
+  return relative === "" || !relative.startsWith("..") && !path2.isAbsolute(relative);
 }
 
 // src/orchestrator.ts
@@ -1652,7 +2976,7 @@ async function raceRecallAbort(promise, signal, message = "recall aborted") {
   }
 }
 function qmdCollectionPathParts(resultPath) {
-  if (!resultPath || path2.isAbsolute(resultPath)) return null;
+  if (!resultPath || path3.isAbsolute(resultPath)) return null;
   const normalized = resultPath.replace(/\\/g, "/").replace(/^\/+/, "");
   const slashIndex = normalized.indexOf("/");
   if (slashIndex <= 0 || slashIndex >= normalized.length - 1) return null;
@@ -1665,9 +2989,9 @@ function qmdCollectionPathParts(resultPath) {
 }
 function qmdResultPathCandidates(storageDir, resultPath) {
   const candidates = /* @__PURE__ */ new Set();
-  const storageRoot = path2.resolve(storageDir);
+  const storageRoot = path3.resolve(storageDir);
   const addCandidate = (candidate) => {
-    const resolved = path2.resolve(candidate);
+    const resolved = path3.resolve(candidate);
     if (isPathInsideStorageRoot(storageRoot, resolved)) {
       candidates.add(resolved);
     }
@@ -1675,12 +2999,12 @@ function qmdResultPathCandidates(storageDir, resultPath) {
   const addRelativeCandidates = (relativePath) => {
     const normalized = relativePath.replace(/\\/g, "/").replace(/^\/+/, "");
     if (!normalized) return;
-    addCandidate(path2.join(storageRoot, normalized));
+    addCandidate(path3.join(storageRoot, normalized));
     if (/^\d{4}-\d{2}-\d{2}\//.test(normalized)) {
-      addCandidate(path2.join(storageRoot, "facts", normalized));
+      addCandidate(path3.join(storageRoot, "facts", normalized));
     }
   };
-  if (path2.isAbsolute(resultPath)) {
+  if (path3.isAbsolute(resultPath)) {
     addCandidate(resultPath);
   } else {
     addRelativeCandidates(resultPath);
@@ -1797,7 +3121,7 @@ async function qmdStartupCollectionCheckWithTimeout(promise, controller, label)
   return await Promise.race([checkedPromise, timeoutPromise]);
 }
 function defaultWorkspaceDir() {
-  return path2.join(os.homedir(), ".openclaw", "workspace");
+  return path3.join(os.homedir(), ".openclaw", "workspace");
 }
 function sanitizeSessionKeyForFilename(sessionKey) {
   const readable = sessionKey.replace(/[^a-zA-Z0-9._-]/g, "_");
@@ -2102,11 +3426,11 @@ function mergeGraphExpandedResults(primary, expanded) {
   return Array.from(mergedByPath.values());
 }
 function graphPathRelativeToStorage(storageDir, candidatePath) {
-  const absolutePath = path2.isAbsolute(candidatePath) ? candidatePath : path2.resolve(storageDir, candidatePath);
-  const rel = path2.relative(storageDir, absolutePath);
+  const absolutePath = path3.isAbsolute(candidatePath) ? candidatePath : path3.resolve(storageDir, candidatePath);
+  const rel = path3.relative(storageDir, absolutePath);
   if (!rel || rel === ".") return null;
   if (rel.startsWith("..")) return null;
-  return rel.split(path2.sep).join("/");
+  return rel.split(path3.sep).join("/");
 }
 function normalizeGraphActivationScore(score) {
   const bounded = Number.isFinite(score) && score > 0 ? score : 0;
@@ -2248,7 +3572,7 @@ function buildMemoryPathById(allMemsForGraph, storageDir) {
   for (const mem of allMemsForGraph ?? []) {
     const id = mem.frontmatter.id;
     if (!id) continue;
-    pathById.set(id, path2.relative(storageDir, mem.path));
+    pathById.set(id, path3.relative(storageDir, mem.path));
   }
   return pathById;
 }
@@ -2256,7 +3580,7 @@ function appendMemoryToGraphContext(options) {
   if (!Array.isArray(options.allMemsForGraph)) return;
   const nowIso = (/* @__PURE__ */ new Date()).toISOString();
   options.allMemsForGraph.push({
-    path: path2.join(options.storageDir, options.memoryRelPath),
+    path: path3.join(options.storageDir, options.memoryRelPath),
     content: options.content,
     frontmatter: {
       id: options.memoryId,
@@ -2276,20 +3600,24 @@ function resolvePersistedMemoryRelativePath(options) {
   const persisted = options.pathById.get(options.memoryId);
   if (persisted) return persisted;
   if (options.category === "correction") {
-    return path2.join("corrections", `${options.memoryId}.md`);
+    return path3.join("corrections", `${options.memoryId}.md`);
   }
   const subtree = options.category === "procedure" ? "procedures" : options.category === "reasoning_trace" ? "reasoning-traces" : "facts";
   const idParts = options.memoryId.split("-");
   const maybeTimestamp = Number(idParts[1]);
   if (Number.isFinite(maybeTimestamp) && maybeTimestamp > 0) {
     const day = new Date(maybeTimestamp).toISOString().slice(0, 10);
-    return path2.join(subtree, day, `${options.memoryId}.md`);
+    return path3.join(subtree, day, `${options.memoryId}.md`);
   }
-  return path2.join(subtree, `${options.memoryId}.md`);
+  return path3.join(subtree, `${options.memoryId}.md`);
 }
 var Orchestrator = class _Orchestrator {
   storage;
   storageRouter;
+  /** Rebuildable namespace catalog (issue #1499). Inert unless namespaces enabled. */
+  namespaceCatalog;
+  namespaceStorageDirHints = /* @__PURE__ */ new Map();
+  namespaceStorageDirHintsLoaded = false;
   namespaceSearchRouter;
   qmd;
   conversationQmd;
@@ -2703,6 +4031,172 @@ var Orchestrator = class _Orchestrator {
       )
     );
   }
+  rememberNamespaceStorageDirHint(namespace, storageDir) {
+    if (!this.config.namespacesEnabled || !storageDir) return;
+    const ns = normalizeNamespaceIdentity(namespace);
+    if (!ns) return;
+    const defaultNs = normalizeNamespaceIdentity(this.config.defaultNamespace);
+    if (ns !== defaultNs && !isSafeRouteNamespace(ns)) return;
+    if (!this.storageDirMatchesNamespaceHint(ns, storageDir)) return;
+    const resolvedStorageDir = path3.resolve(storageDir);
+    let hints = this.namespaceStorageDirHints.get(resolvedStorageDir);
+    if (!hints) {
+      hints = /* @__PURE__ */ new Set();
+      this.namespaceStorageDirHints.set(resolvedStorageDir, hints);
+    }
+    hints.add(ns);
+  }
+  storageDirMatchesNamespaceHint(namespace, storageDir) {
+    const ns = normalizeNamespaceIdentity(namespace);
+    if (!ns) return false;
+    const resolvedStorageDir = path3.resolve(storageDir);
+    const resolvedMemoryDir = path3.resolve(this.config.memoryDir);
+    const defaultNs = normalizeNamespaceIdentity(this.config.defaultNamespace);
+    if (resolvedStorageDir === resolvedMemoryDir) return ns === defaultNs;
+    const resolvedNamespacesDir = path3.join(resolvedMemoryDir, "namespaces");
+    if (!isPathInsideStorageRoot(resolvedNamespacesDir, resolvedStorageDir)) return false;
+    const rawRoot = path3.resolve(resolvedNamespacesDir, ns);
+    const tokenRoot = path3.resolve(resolvedNamespacesDir, namespaceIdentityToken(ns));
+    return resolvedStorageDir === rawRoot || resolvedStorageDir === tokenRoot;
+  }
+  namespaceStorageDirHintOwnershipRank(record, resolvedStorageDir, configured) {
+    if (resolvedStorageDir === path3.resolve(this.config.memoryDir)) {
+      return record.namespace === normalizeNamespaceIdentity(this.config.defaultNamespace) ? 0 : 3;
+    }
+    const leaf = path3.basename(resolvedStorageDir);
+    const tokenOwnsRoot = namespaceIdentityToken(record.namespace) === leaf;
+    if (tokenOwnsRoot && configured.has(record.namespace)) return 0;
+    if (record.namespace === leaf) return 1;
+    if (tokenOwnsRoot) return 2;
+    return 3;
+  }
+  preferNamespaceStorageDirHintOwner(current, candidate, resolvedStorageDir, configured) {
+    const currentRank = this.namespaceStorageDirHintOwnershipRank(
+      current,
+      resolvedStorageDir,
+      configured
+    );
+    const candidateRank = this.namespaceStorageDirHintOwnershipRank(
+      candidate,
+      resolvedStorageDir,
+      configured
+    );
+    if (candidateRank < currentRank) return candidate;
+    if (candidateRank > currentRank) return current;
+    const byName = candidate.namespace.localeCompare(current.namespace);
+    if (byName < 0) return candidate;
+    if (byName > 0) return current;
+    return candidate.identityToken.localeCompare(current.identityToken) < 0 ? candidate : current;
+  }
+  loadNamespaceStorageDirHintsFromCatalog() {
+    if (this.namespaceStorageDirHintsLoaded || !this.namespaceCatalog.enabled) return;
+    this.namespaceStorageDirHintsLoaded = true;
+    const catalogPath = path3.join(this.config.memoryDir, "state", "namespaces.jsonl");
+    if (!existsSync(catalogPath)) return;
+    let body;
+    try {
+      body = readFileSync(catalogPath, "utf8");
+    } catch {
+      return;
+    }
+    const compactedByNamespace = /* @__PURE__ */ new Map();
+    for (const line of body.split(/\r?\n/)) {
+      const trimmed = line.trim();
+      if (!trimmed) continue;
+      try {
+        const parsed = JSON.parse(trimmed);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) continue;
+        const record = parsed;
+        if (typeof record.namespace !== "string" || typeof record.storageDir !== "string" || typeof record.identityToken !== "string") {
+          continue;
+        }
+        const namespace = normalizeNamespaceIdentity(record.namespace);
+        if (!namespace || record.identityToken !== namespaceIdentityToken(namespace)) continue;
+        compactedByNamespace.set(namespace, {
+          namespace,
+          identityToken: record.identityToken,
+          storageDir: record.storageDir
+        });
+      } catch {
+      }
+    }
+    const configured = new Set(
+      this.configuredNamespaces().map((namespace) => normalizeNamespaceIdentity(namespace))
+    );
+    const preferredByStorageDir = /* @__PURE__ */ new Map();
+    for (const record of compactedByNamespace.values()) {
+      if (!this.storageDirMatchesNamespaceHint(record.namespace, record.storageDir)) {
+        continue;
+      }
+      const resolvedStorageDir = path3.resolve(record.storageDir);
+      const current = preferredByStorageDir.get(resolvedStorageDir);
+      preferredByStorageDir.set(
+        resolvedStorageDir,
+        current ? this.preferNamespaceStorageDirHintOwner(
+          current,
+          record,
+          resolvedStorageDir,
+          configured
+        ) : record
+      );
+    }
+    for (const record of preferredByStorageDir.values()) {
+      this.rememberNamespaceStorageDirHint(record.namespace, record.storageDir);
+    }
+  }
+  /**
+   * Namespaces that QMD maintenance (update/embed) must cover: the CONFIGURED set
+   * PLUS every dynamic namespace recorded in the catalog (NGnei, codex P2). An
+   * extraction that writes to a coding-scoped/dynamic namespace (not in
+   * defaultNamespace/sharedNamespace/namespacePolicies) is only made discoverable
+   * via the catalog; if maintenance embeds only `configuredNamespaces()`, that
+   * namespace's QMD collection is never updated/embedded after writes and
+   * recall/search stays stale or empty until it is manually configured. We union in
+   * the catalog's namespaces so maintenance keeps dynamic namespaces fresh.
+   * `updateNamespaces`/`embedNamespaces` already trim, dedup, and skip
+   * unavailable/missing collections, so extra names are filtered safely. A catalog
+   * read failure must never break maintenance — fall back to the configured set.
+   */
+  async maintenanceNamespaces() {
+    const configured = this.configuredNamespaces();
+    if (!this.namespaceCatalog.enabled) return configured;
+    const configuredSet = new Set(configured);
+    let cataloged = [];
+    try {
+      const records = await this.namespaceCatalog.listNamespaces();
+      const safeRecords = await Promise.all(
+        records.map(async (record) => {
+          const namespace = record.namespace.trim();
+          if (!namespace || configuredSet.has(namespace)) return null;
+          return await this.isCatalogedMaintenanceRootLive(record) ? namespace : null;
+        })
+      );
+      cataloged = safeRecords.filter(
+        (namespace) => namespace !== null
+      );
+    } catch {
+      cataloged = [];
+    }
+    return Array.from(
+      new Set(
+        [...configured, ...cataloged].map((value) => value.trim()).filter(Boolean)
+      )
+    );
+  }
+  async isCatalogedMaintenanceRootLive(record) {
+    if (typeof record.storageDir !== "string" || record.storageDir.length === 0) {
+      return false;
+    }
+    try {
+      const liveRoot = await resolveNamespaceStorageRoot(this.config, record.namespace);
+      if (path3.resolve(liveRoot) !== path3.resolve(record.storageDir)) {
+        return false;
+      }
+      return hasMemoryData(liveRoot);
+    } catch {
+      return false;
+    }
+  }
   buildConfiguredQmdSearchOptions(queryText) {
     const intentHint = this.config.qmdIntentHintsEnabled ? buildQmdIntentHint(inferIntentFromText(queryText)) : void 0;
     const explain = this.config.qmdExplainEnabled === true;
@@ -2777,10 +4271,20 @@ var Orchestrator = class _Orchestrator {
     this.config = config;
     this.profiler = new ProfilingCollector({
       enabled: config.profilingEnabled,
-      storageDir: config.profilingStorageDir || path2.join(config.memoryDir, "profiling"),
+      storageDir: config.profilingStorageDir || path3.join(config.memoryDir, "profiling"),
       maxTraces: config.profilingMaxTraces
     });
-    this.storageRouter = new NamespaceStorageRouter(config);
+    this.namespaceCatalog = new NamespaceCatalog(config);
+    this.storageRouter = new NamespaceStorageRouter(config, {
+      // Return the registration promise (round 6, codex P2 — NEFoX) so the
+      // router's resolve-hook dedup only marks a namespace notified when the
+      // catalog actually APPENDED. A dropped append (rebuild-lock timeout) or a
+      // failure resolves to `false`/rejects, so the next `storageFor` retries.
+      onResolve: (namespace, storageDir) => {
+        this.rememberNamespaceStorageDirHint(namespace, storageDir);
+        return this.namespaceCatalog.registerResolved(namespace, storageDir);
+      }
+    });
     this.namespaceSearchRouter = new NamespaceSearchRouter(
       config,
       this.storageRouter
@@ -2812,7 +4316,7 @@ var Orchestrator = class _Orchestrator {
     this.compounding = config.compoundingEnabled ? new CompoundingEngine(config, this.storage) : void 0;
     this.buffer = new SmartBuffer(config, this.storage);
     this.transcript = new TranscriptManager(config);
-    this.conversationIndexDir = path2.join(
+    this.conversationIndexDir = path3.join(
       config.memoryDir,
       "conversation-index",
       "chunks"
@@ -2869,7 +4373,7 @@ var Orchestrator = class _Orchestrator {
       this.modelRegistry
     );
     this.threading = new ThreadingManager(
-      path2.join(config.memoryDir, "threads"),
+      path3.join(config.memoryDir, "threads"),
       config.threadingGapMinutes
     );
     this.tmtBuilder = new TmtBuilder(config.memoryDir, {
@@ -3129,6 +4633,7 @@ var Orchestrator = class _Orchestrator {
           await sm.ensureDirectories();
           await sm.loadAliases().catch(() => void 0);
         }
+        await this.namespaceCatalog.registerConfiguredNamespaces().catch(() => void 0);
       }
       await this.relevance.load();
       await this.negatives.load();
@@ -3167,13 +4672,13 @@ var Orchestrator = class _Orchestrator {
       if (this.config.compactionResetEnabled) {
         try {
           const wsDir = this.config.workspaceDir || defaultWorkspaceDir();
-          const files = await readdir(wsDir).catch(() => []);
+          const files = await readdir2(wsDir).catch(() => []);
           for (const f of files) {
             if (!f.startsWith(".compaction-reset-signal-")) continue;
-            const fp = path2.join(wsDir, f);
-            const s = await stat(fp).catch(() => null);
+            const fp = path3.join(wsDir, f);
+            const s = await stat2(fp).catch(() => null);
             if (s && Date.now() - s.mtimeMs >= COMPACTION_SIGNAL_MAX_AGE_MS) {
-              await unlink(fp).catch(() => {
+              await unlink2(fp).catch(() => {
               });
               log.debug(`initialize: removed stale compaction signal ${f}`);
             }
@@ -3186,7 +4691,7 @@ var Orchestrator = class _Orchestrator {
         const available = await this.qmd.probe();
         if (available) {
           log.info(`Search backend: available ${this.qmd.debugStatus()}`);
-          const namespaces = this.config.namespacesEnabled ? this.configuredNamespaces() : [this.config.defaultNamespace];
+          const namespaces = this.config.namespacesEnabled ? await this.maintenanceNamespaces() : [this.config.defaultNamespace];
           const states = await Promise.all(
             namespaces.map(async (namespace) => {
               const collectionCheckAbort = new AbortController();
@@ -3270,7 +4775,7 @@ var Orchestrator = class _Orchestrator {
         log.info("QMD startup sync: updating index to match current disk state");
         if (this.config.namespacesEnabled) {
           await this.namespaceSearchRouter.updateNamespaces(
-            this.configuredNamespaces(),
+            await this.maintenanceNamespaces(),
             { signal }
           );
         } else {
@@ -3482,7 +4987,7 @@ var Orchestrator = class _Orchestrator {
     if (this.config.namespacesEnabled) {
       this.namespaceSearchRouter.clearCache();
     }
-    const namespaces = this.config.namespacesEnabled ? this.configuredNamespaces() : [this.config.defaultNamespace];
+    const namespaces = this.config.namespacesEnabled ? await this.maintenanceNamespaces() : [this.config.defaultNamespace];
     const states = await Promise.all(
       namespaces.map(async (namespace) => ({
         namespace,
@@ -3564,7 +5069,7 @@ var Orchestrator = class _Orchestrator {
    */
   async autoRegisterDaySummaryCron() {
     const home = resolveHomeDir();
-    const jobsPath = path2.join(home, ".openclaw", "cron", "jobs.json");
+    const jobsPath = path3.join(home, ".openclaw", "cron", "jobs.json");
     try {
       if (!existsSync(jobsPath)) {
         log.debug(
@@ -3617,7 +5122,7 @@ var Orchestrator = class _Orchestrator {
   }
   async autoRegisterNightlyGovernanceCron() {
     const home = resolveHomeDir();
-    const jobsPath = path2.join(home, ".openclaw", "cron", "jobs.json");
+    const jobsPath = path3.join(home, ".openclaw", "cron", "jobs.json");
     try {
       if (!existsSync(jobsPath)) {
         log.debug("nightly governance cron: jobs.json not found, skipping auto-register");
@@ -3639,7 +5144,7 @@ var Orchestrator = class _Orchestrator {
   }
   async autoRegisterProceduralMiningCron() {
     const home = resolveHomeDir();
-    const jobsPath = path2.join(home, ".openclaw", "cron", "jobs.json");
+    const jobsPath = path3.join(home, ".openclaw", "cron", "jobs.json");
     try {
       if (!existsSync(jobsPath)) {
         log.debug("procedural mining cron: jobs.json not found, skipping auto-register");
@@ -3659,7 +5164,7 @@ var Orchestrator = class _Orchestrator {
   }
   async autoRegisterContradictionScanCron() {
     const home = resolveHomeDir();
-    const jobsPath = path2.join(home, ".openclaw", "cron", "jobs.json");
+    const jobsPath = path3.join(home, ".openclaw", "cron", "jobs.json");
     try {
       if (!existsSync(jobsPath)) {
         log.debug("contradiction scan cron: jobs.json not found, skipping auto-register");
@@ -3679,7 +5184,7 @@ var Orchestrator = class _Orchestrator {
   }
   async autoRegisterPatternReinforcementCron() {
     const home = resolveHomeDir();
-    const jobsPath = path2.join(home, ".openclaw", "cron", "jobs.json");
+    const jobsPath = path3.join(home, ".openclaw", "cron", "jobs.json");
     try {
       if (!existsSync(jobsPath)) {
         log.debug("pattern reinforcement cron: jobs.json not found, skipping auto-register");
@@ -3741,7 +5246,7 @@ var Orchestrator = class _Orchestrator {
   }
   async autoRegisterGraphEdgeDecayCron() {
     const home = resolveHomeDir();
-    const jobsPath = path2.join(home, ".openclaw", "cron", "jobs.json");
+    const jobsPath = path3.join(home, ".openclaw", "cron", "jobs.json");
     try {
       if (!existsSync(jobsPath)) {
         log.debug("graph edge decay cron: jobs.json not found, skipping auto-register");
@@ -3798,15 +5303,15 @@ ${doc.content}` : doc.content,
     this.lastFileHygieneRunAtMs = now;
     if (hygiene.rotateEnabled) {
       for (const rel of hygiene.rotatePaths) {
-        const abs = path2.isAbsolute(rel) ? rel : path2.join(this.config.workspaceDir, rel);
+        const abs = path3.isAbsolute(rel) ? rel : path3.join(this.config.workspaceDir, rel);
         try {
-          const raw = await readFile2(abs, "utf-8");
+          const raw = await readFile3(abs, "utf-8");
           if (raw.length > hygiene.rotateMaxBytes) {
-            const archiveDir = path2.join(
+            const archiveDir = path3.join(
               this.config.workspaceDir,
               hygiene.archiveDir
             );
-            const base = path2.basename(abs);
+            const base = path3.basename(abs);
             const prefix = base.toUpperCase().replace(/\.MD$/i, "").replace(/[^A-Z0-9]+/g, "-") || "FILE";
             const { newContent } = await rotateMarkdownFileToArchive({
               filePath: abs,
@@ -3814,7 +5319,7 @@ ${doc.content}` : doc.content,
               archivePrefix: prefix,
               keepTailChars: hygiene.rotateKeepTailChars
             });
-            await writeFile2(abs, newContent, "utf-8");
+            await writeFile3(abs, newContent, "utf-8");
           }
         } catch {
         }
@@ -3831,8 +5336,8 @@ ${doc.content}` : doc.content,
         log.warn(w.message);
       }
       if (hygiene.warningsLogEnabled && warnings.length > 0) {
-        const fp = path2.join(this.config.memoryDir, hygiene.warningsLogPath);
-        await mkdir2(path2.dirname(fp), { recursive: true });
+        const fp = path3.join(this.config.memoryDir, hygiene.warningsLogPath);
+        await mkdir3(path3.dirname(fp), { recursive: true });
         const stamp = (/* @__PURE__ */ new Date()).toISOString();
         const block = `
 
@@ -3841,11 +5346,11 @@ ${doc.content}` : doc.content,
 ` + warnings.map((w) => `- ${w.message}`).join("\n") + "\n";
         let existing = "";
         try {
-          existing = await readFile2(fp, "utf-8");
+          existing = await readFile3(fp, "utf-8");
         } catch {
           existing = "# Engram File Hygiene Warnings\n";
         }
-        await writeFile2(fp, existing + block, "utf-8");
+        await writeFile3(fp, existing + block, "utf-8");
       }
     }
   }
@@ -3952,6 +5457,7 @@ ${doc.content}` : doc.content,
       log.warn(`[semantic-consolidation] extension discovery failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
     }
     for (const cluster of clusters) {
+      let canonicalWriteCompleted = false;
       try {
         const operatorAwareEnabled = this.config.operatorAwareConsolidationEnabled === true;
         let prompt = operatorAwareEnabled ? buildOperatorAwareConsolidationPrompt(cluster) : buildConsolidationPrompt(cluster);
@@ -4030,6 +5536,7 @@ ${doc.content}` : doc.content,
             derivedVia: operator
           }
         );
+        canonicalWriteCompleted = true;
         result.memoriesConsolidated++;
         for (const m of cluster.memories) {
           const archiveResult = await targetStorage.archiveMemory(m, {
@@ -4048,13 +5555,19 @@ ${doc.content}` : doc.content,
                 this.contentHashIndex.remove(m.content);
               }
             }
-            await this.embeddingFallback.removeFromIndex(m.frontmatter.id);
-            if (this.config.queryAwareIndexingEnabled && m.path && m.frontmatter?.created) {
-              deindexMemory(
-                targetStorage.dir,
-                m.path,
-                m.frontmatter.created,
-                m.frontmatter.tags ?? []
+            try {
+              await this.embeddingFallback.removeFromIndex(m.frontmatter.id);
+              if (this.config.queryAwareIndexingEnabled && m.path && m.frontmatter?.created) {
+                deindexMemory(
+                  targetStorage.dir,
+                  m.path,
+                  m.frontmatter.created,
+                  m.frontmatter.tags ?? []
+                );
+              }
+            } catch (cleanupErr) {
+              log.warn(
+                `[semantic-consolidation] index cleanup failed (non-fatal): ${cleanupErr}`
               );
             }
             result.memoriesArchived++;
@@ -4068,6 +5581,13 @@ ${doc.content}` : doc.content,
           `[semantic-consolidation] cluster processing failed: ${err instanceof Error ? err.message : String(err)}`
         );
         result.errors++;
+      } finally {
+        if (canonicalWriteCompleted) {
+          this.markCatalogWrite(
+            this.namespaceFromStorageDir(targetStorage.dir),
+            targetStorage.dir
+          );
+        }
       }
     }
     if (result.memoriesArchived > 0 && this.contentHashIndex) {
@@ -4300,18 +5820,18 @@ ${evidenceText}`
     const now = options.now instanceof Date && Number.isFinite(options.now.getTime()) ? options.now : /* @__PURE__ */ new Date();
     const targetLocalDate = formatDateInTimeZone(now, timeZone);
     const datesToScan = utcDateKeysForLocalDay(now, timeZone);
-    const factsBaseDir = path2.join(storage.dir, "facts");
+    const factsBaseDir = path3.join(storage.dir, "facts");
     const MAX_CHARS = 1e5;
     const facts = [];
     for (const date of datesToScan) {
-      const factsDir = path2.join(factsBaseDir, date);
+      const factsDir = path3.join(factsBaseDir, date);
       try {
-        const entries = await readdir(factsDir, { withFileTypes: true });
+        const entries = await readdir2(factsDir, { withFileTypes: true });
         for (const entry of entries) {
           if (!entry.name.endsWith(".md")) continue;
-          const fullPath = path2.join(factsDir, entry.name);
+          const fullPath = path3.join(factsDir, entry.name);
           try {
-            const raw = await readFile2(fullPath, "utf-8");
+            const raw = await readFile3(fullPath, "utf-8");
             const fmMatch = raw.match(/^---\n([\s\S]*?)\n---\n?([\s\S]*)$/);
             if (!fmMatch) continue;
             const fmBlock = fmMatch[1];
@@ -4330,7 +5850,7 @@ ${evidenceText}`
             facts.push({
               path: fullPath,
               frontmatter: {
-                id: fm.id || path2.basename(entry.name, ".md"),
+                id: fm.id || path3.basename(entry.name, ".md"),
                 category: fm.category || "fact",
                 created,
                 updated: fm.updated || created,
@@ -4352,15 +5872,15 @@ ${evidenceText}`
       return a.frontmatter.created < b.frontmatter.created ? -1 : 1;
     });
     const hourlySummaries = [];
-    const hourlyBaseDir = path2.join(storage.dir, "summaries", "hourly");
+    const hourlyBaseDir = path3.join(storage.dir, "summaries", "hourly");
     try {
-      const sessionKeys = await readdir(hourlyBaseDir, { withFileTypes: true });
+      const sessionKeys = await readdir2(hourlyBaseDir, { withFileTypes: true });
       for (const sk of sessionKeys) {
         if (!sk.isDirectory()) continue;
         for (const date of datesToScan) {
-          const summaryFile = path2.join(hourlyBaseDir, sk.name, `${date}.md`);
+          const summaryFile = path3.join(hourlyBaseDir, sk.name, `${date}.md`);
           try {
-            const raw = await readFile2(summaryFile, "utf-8");
+            const raw = await readFile3(summaryFile, "utf-8");
             const filtered = filterHourlySummaryMarkdownForLocalDay(
               raw,
               date,
@@ -4462,13 +5982,13 @@ ${evidenceText}`
   }
   async getLastGraphRecallSnapshot(namespace) {
     const storage = await this.getStorage(namespace);
-    const snapshotPath = path2.join(
+    const snapshotPath = path3.join(
       storage.dir,
       "state",
       "last_graph_recall.json"
     );
     try {
-      const raw = await readFile2(snapshotPath, "utf-8");
+      const raw = await readFile3(snapshotPath, "utf-8");
       const parsed = JSON.parse(raw);
       if (!parsed || typeof parsed !== "object") return null;
       return {
@@ -4501,9 +6021,9 @@ ${evidenceText}`
   }
   async getLastIntentSnapshot(namespace) {
     const storage = await this.getStorage(namespace);
-    const snapshotPath = path2.join(storage.dir, "state", "last_intent.json");
+    const snapshotPath = path3.join(storage.dir, "state", "last_intent.json");
     try {
-      const raw = await readFile2(snapshotPath, "utf-8");
+      const raw = await readFile3(snapshotPath, "utf-8");
       const parsed = JSON.parse(raw);
       if (!parsed || typeof parsed !== "object") return null;
       const graphDecision = parsed.graphDecision && typeof parsed.graphDecision === "object" ? parsed.graphDecision : void 0;
@@ -4534,13 +6054,13 @@ ${evidenceText}`
   }
   async getLastQmdRecallSnapshot(namespace) {
     const storage = await this.getStorage(namespace);
-    const snapshotPath = path2.join(
+    const snapshotPath = path3.join(
       storage.dir,
       "state",
       "last_qmd_recall.json"
     );
     try {
-      const raw = await readFile2(snapshotPath, "utf-8");
+      const raw = await readFile3(snapshotPath, "utf-8");
       const parsed = JSON.parse(raw);
       if (!parsed || typeof parsed !== "object") return null;
       return {
@@ -4684,10 +6204,10 @@ ${r.snippet.trim()}
   }
   async countConversationChunkDocs(dir) {
     try {
-      const entries = await readdir(dir, { withFileTypes: true });
+      const entries = await readdir2(dir, { withFileTypes: true });
       let total = 0;
       for (const entry of entries) {
-        const fullPath = path2.join(dir, entry.name);
+        const fullPath = path3.join(dir, entry.name);
         if (entry.isDirectory()) {
           total += await this.countConversationChunkDocs(fullPath);
           continue;
@@ -5586,7 +7106,7 @@ ${r.snippet.trim()}
         resolvedPath = resolvedCold.result.path;
         resolvedResult = resolvedCold.result;
       }
-      if (!path2.isAbsolute(resolvedPath)) {
+      if (!path3.isAbsolute(resolvedPath)) {
         resolvedAmbiguousSeeds.set(result.path, null);
         return null;
       }
@@ -5611,7 +7131,7 @@ ${r.snippet.trim()}
         }
         continue;
       }
-      if (path2.isAbsolute(result.path)) {
+      if (path3.isAbsolute(result.path)) {
         const resolved = await resolveAmbiguousSeedOwner(result, null);
         if (resolved) {
           addResultForNamespace(resolved.namespace, resolved.result);
@@ -5654,7 +7174,7 @@ ${r.snippet.trim()}
         0
       );
       seedPaths.push(
-        ...seedRelativePaths.map((rel) => path2.join(storage.dir, rel))
+        ...seedRelativePaths.map((rel) => path3.join(storage.dir, rel))
       );
       const seedSet = new Set(seedRelativePaths);
       const expanded = await this.graphIndexFor(storage).spreadingActivation(
@@ -5670,7 +7190,7 @@ ${r.snippet.trim()}
       for (const candidate of expanded.slice(0, perNamespaceExpandedCap)) {
         if (deadlineExpired()) break;
         if (seedSet.has(candidate.path)) continue;
-        const memoryPath = path2.resolve(storage.dir, candidate.path);
+        const memoryPath = path3.resolve(storage.dir, candidate.path);
         const memory = await storage.readMemoryByPath(memoryPath);
         if (deadlineExpired()) break;
         if (!memory) continue;
@@ -5695,7 +7215,7 @@ ${r.snippet.trim()}
           path: memory.path,
           score,
           namespace,
-          seed: path2.resolve(storage.dir, candidate.seed),
+          seed: path3.resolve(storage.dir, candidate.seed),
           hopDepth: candidate.hopDepth,
           decayedWeight: candidate.decayedWeight,
           graphType: candidate.graphType,
@@ -5716,12 +7236,12 @@ ${r.snippet.trim()}
   }
   async recordLastGraphRecallSnapshot(options) {
     try {
-      const snapshotPath = path2.join(
+      const snapshotPath = path3.join(
         options.storage.dir,
         "state",
         "last_graph_recall.json"
       );
-      await mkdir2(path2.dirname(snapshotPath), { recursive: true });
+      await mkdir3(path3.dirname(snapshotPath), { recursive: true });
       const now = (/* @__PURE__ */ new Date()).toISOString();
       const totalSeedCount = options.seedPaths.length;
       const totalExpandedCount = options.expandedPaths.length;
@@ -5748,20 +7268,20 @@ ${r.snippet.trim()}
         finalResults: (options.finalResults ?? []).slice(0, 64),
         shadowComparison: options.shadowComparison
       };
-      await writeFile2(snapshotPath, JSON.stringify(payload, null, 2), "utf-8");
+      await writeFile3(snapshotPath, JSON.stringify(payload, null, 2), "utf-8");
     } catch (err) {
       log.debug(`last graph recall write failed: ${err}`);
     }
   }
   async recordLastIntentSnapshot(options) {
     try {
-      const snapshotPath = path2.join(
+      const snapshotPath = path3.join(
         options.storage.dir,
         "state",
         "last_intent.json"
       );
-      await mkdir2(path2.dirname(snapshotPath), { recursive: true });
-      await writeFile2(
+      await mkdir3(path3.dirname(snapshotPath), { recursive: true });
+      await writeFile3(
         snapshotPath,
         JSON.stringify(options.snapshot, null, 2),
         "utf-8"
@@ -5772,13 +7292,13 @@ ${r.snippet.trim()}
   }
   async recordLastQmdRecallSnapshot(options) {
     try {
-      const snapshotPath = path2.join(
+      const snapshotPath = path3.join(
         options.storage.dir,
         "state",
         "last_qmd_recall.json"
       );
-      await mkdir2(path2.dirname(snapshotPath), { recursive: true });
-      await writeFile2(
+      await mkdir3(path3.dirname(snapshotPath), { recursive: true });
+      await writeFile3(
         snapshotPath,
         JSON.stringify(options.snapshot, null, 2),
         "utf-8"
@@ -5792,9 +7312,9 @@ ${r.snippet.trim()}
       const stateDir = await this.resolveStateDirForNamespace(
         options.namespace
       );
-      const snapshotPath = path2.join(stateDir, "last_intent.json");
-      await mkdir2(path2.dirname(snapshotPath), { recursive: true });
-      await writeFile2(
+      const snapshotPath = path3.join(stateDir, "last_intent.json");
+      await mkdir3(path3.dirname(snapshotPath), { recursive: true });
+      await writeFile3(
         snapshotPath,
         JSON.stringify(options.snapshot, null, 2),
         "utf-8"
@@ -5805,24 +7325,24 @@ ${r.snippet.trim()}
   }
   async resolveStateDirForNamespace(namespace) {
     if (!this.config.namespacesEnabled) {
-      return path2.join(this.config.memoryDir, "state");
+      return path3.join(this.config.memoryDir, "state");
     }
     if (namespace !== this.config.defaultNamespace) {
-      return path2.join(this.config.memoryDir, "namespaces", namespace, "state");
+      return path3.join(this.config.memoryDir, "namespaces", namespace, "state");
     }
-    const candidate = path2.join(
+    const candidate = path3.join(
       this.config.memoryDir,
       "namespaces",
       this.config.defaultNamespace
     );
     try {
-      const candidateStat = await stat(candidate);
+      const candidateStat = await stat2(candidate);
       if (candidateStat.isDirectory()) {
-        return path2.join(candidate, "state");
+        return path3.join(candidate, "state");
       }
     } catch {
     }
-    return path2.join(this.config.memoryDir, "state");
+    return path3.join(this.config.memoryDir, "state");
   }
   buildGraphRecallRankedResults(results, sourceLabelResolver, limit = 64) {
     return results.slice(0, limit).map((result) => ({
@@ -6232,7 +7752,7 @@ ${r.snippet.trim()}
       const graphExpandedResultPaths = /* @__PURE__ */ new Set();
       const graphSourceLabelsForPath = (resultPath) => {
         const labels = [];
-        const normalizedPath = resultPath.split(path2.sep).join("/");
+        const normalizedPath = resultPath.split(path3.sep).join("/");
         const isEntityPath = normalizedPath.startsWith("entities/") || normalizedPath.includes("/entities/");
         if (graphBaselinePaths.has(resultPath)) labels.push("baseline");
         if (graphExpandedResultPaths.has(resultPath))
@@ -6379,6 +7899,9 @@ ${r.snippet.trim()}
       }
       const profileStorage = await this.storageRouter.storageFor(selfNamespace);
       throwIfRecallAborted(options.abortSignal);
+      if (this.namespaceCatalog.enabled && recallResultLimit > 0 && !options.abortSignal?.aborted) {
+        for (const ns of recallNamespaces) this.markCatalogRead(ns);
+      }
       const sharedContextPromise = (async () => {
         if (!this.isRecallSectionEnabled(
           "shared-context",
@@ -7547,16 +9070,16 @@ ${formatted}`;
         if (!this.config.compactionResetEnabled) return null;
         const workspaceDir = compactionWorkspaceDir || this.config.workspaceDir || defaultWorkspaceDir();
         const safeSessionKey = sanitizeSessionKeyForFilename(effectiveSessionKey);
-        const signalPath = path2.join(
+        const signalPath = path3.join(
           workspaceDir,
           `.compaction-reset-signal-${safeSessionKey}`
         );
-        const bootPath = path2.join(workspaceDir, "BOOT.md");
+        const bootPath = path3.join(workspaceDir, "BOOT.md");
         try {
-          const signalStat = await stat(signalPath).catch(() => null);
+          const signalStat = await stat2(signalPath).catch(() => null);
           if (!signalStat) return null;
           const signalAge = Date.now() - signalStat.mtimeMs;
-          const signalData = JSON.parse(await readFile2(signalPath, "utf-8"));
+          const signalData = JSON.parse(await readFile3(signalPath, "utf-8"));
           if (signalData.sessionKey !== effectiveSessionKey) {
             log.debug(
               `recall: compaction signal is for ${signalData.sessionKey}, not ${effectiveSessionKey} \u2014 skipping`
@@ -7567,7 +9090,7 @@ ${formatted}`;
             log.debug(
               `recall: stale compaction signal (${Math.round(signalAge / 1e3)}s old), skipping`
             );
-            await unlink(signalPath).catch(() => {
+            await unlink2(signalPath).catch(() => {
             });
             return null;
           }
@@ -7576,7 +9099,7 @@ ${formatted}`;
 
 `;
           try {
-            const bootContent = await readFile2(bootPath, "utf-8");
+            const bootContent = await readFile3(bootPath, "utf-8");
             section += "### BOOT.md (working state before compaction)\n\n";
             section += bootContent + "\n";
           } catch {
@@ -7587,12 +9110,12 @@ ${formatted}`;
           log.info(
             `recall: injected compaction reset context for ${effectiveSessionKey}`
           );
-          await unlink(signalPath).catch(() => {
+          await unlink2(signalPath).catch(() => {
           });
           return section;
         } catch (err) {
           log.debug("recall: compaction signal check failed:", err);
-          await unlink(signalPath).catch(() => {
+          await unlink2(signalPath).catch(() => {
           });
           return null;
         }
@@ -10211,7 +11734,10 @@ ${normalized}`).digest("hex");
       result,
       storage,
       threadIdForExtraction,
-      { sessionKey, principal, validAt: sourceValidAt }
+      { sessionKey, principal, validAt: sourceValidAt },
+      // Pass the KNOWN base namespace (NHIdx) so the catalog write touch records the
+      // real namespace rather than a guess decoded from the storage dir.
+      selfNamespace
     );
     let postPersistMetadataFailed = false;
     meta ??= await storage.loadMeta();
@@ -10425,7 +11951,7 @@ ${normalized}`).digest("hex");
     );
     this.tierMigrationInFlight = true;
     try {
-      const coldStorage = new StorageManager(path2.join(storage.dir, "cold"));
+      const coldStorage = new StorageManager(path3.join(storage.dir, "cold"));
       const [hotMemories, coldMemories] = await Promise.all([
         storage.readAllMemories(),
         coldStorage.readAllMemories()
@@ -10569,22 +12095,20 @@ ${normalized}`).digest("hex");
     this.qmdMaintenancePending = false;
     try {
       if (this.config.namespacesEnabled) {
-        await this.namespaceSearchRouter.updateNamespaces(
-          this.configuredNamespaces()
-        );
+        const maintenanceNamespaces = await this.maintenanceNamespaces();
+        await this.namespaceSearchRouter.updateNamespaces(maintenanceNamespaces);
+        const now = Date.now();
+        if (this.config.qmdAutoEmbedEnabled && now - this.lastQmdEmbedAtMs >= this.config.qmdEmbedMinIntervalMs) {
+          await this.namespaceSearchRouter.embedNamespaces(maintenanceNamespaces);
+          this.lastQmdEmbedAtMs = now;
+        }
       } else {
         await this.qmd.update();
-      }
-      const now = Date.now();
-      if (this.config.qmdAutoEmbedEnabled && now - this.lastQmdEmbedAtMs >= this.config.qmdEmbedMinIntervalMs) {
-        if (this.config.namespacesEnabled) {
-          await this.namespaceSearchRouter.embedNamespaces(
-            this.configuredNamespaces()
-          );
-        } else {
+        const now = Date.now();
+        if (this.config.qmdAutoEmbedEnabled && now - this.lastQmdEmbedAtMs >= this.config.qmdEmbedMinIntervalMs) {
           await this.qmd.embed();
+          this.lastQmdEmbedAtMs = now;
         }
-        this.lastQmdEmbedAtMs = now;
       }
     } finally {
       this.qmdMaintenanceInFlight = false;
@@ -10593,7 +12117,7 @@ ${normalized}`).digest("hex");
       }
     }
   }
-  async persistExtraction(result, storage, threadIdForExtraction, sourceContext) {
+  async persistExtraction(result, storage, threadIdForExtraction, sourceContext, baseNamespace) {
     const citationEnabled = this.config.inlineSourceAttributionEnabled === true;
     const citationTemplate = this.config.inlineSourceAttributionFormat;
     const citationContextBase = citationEnabled ? {
@@ -10700,7 +12224,7 @@ ${normalized}`).digest("hex");
               });
               hashDedupLookupComplete = true;
               if (hashDedupMatchingFact) {
-                await applyTemporalSupersession({
+                const hashDedupSupersession = await applyTemporalSupersession({
                   storage: sharedStorage,
                   newMemoryId: hashDedupMatchingFact.frontmatter.id,
                   entityRef: options.entityRef,
@@ -10709,6 +12233,9 @@ ${normalized}`).digest("hex");
                   enabled: true,
                   useCallerTimestamp: true
                 });
+                if (hashDedupSupersession.supersededIds.length > 0) {
+                  this.markCatalogWrite(this.config.sharedNamespace, sharedStorage.dir);
+                }
                 return;
               }
               log.debug(
@@ -10769,6 +12296,7 @@ ${normalized}`).digest("hex");
             );
           }
         }
+        this.markCatalogWrite(this.config.sharedNamespace, sharedStorage.dir);
         trackPersistedId(sharedStorage, promotedId, {
           includeReturnedIds: false
         });
@@ -10995,6 +12523,7 @@ ${normalized}`).digest("hex");
       fact.confidence = typeof fact.confidence === "number" ? fact.confidence : 0.7;
       let writeCategory = fact.category;
       let targetStorage = storage;
+      let targetNamespaceName = baseNamespace && baseNamespace.length > 0 ? baseNamespace : this.namespaceFromStorageDir(targetStorage.dir);
       let routedRuleId;
       let routedNamespaceExplicit = false;
       if (routeRules.length > 0) {
@@ -11011,6 +12540,7 @@ ${normalized}`).digest("hex");
               targetStorage = await this.storageRouter.storageFor(
                 selected.target.namespace
               );
+              targetNamespaceName = selected.target.namespace;
             }
           }
         } catch (err) {
@@ -11026,6 +12556,7 @@ ${normalized}`).digest("hex");
             targetStorage = await this.storageRouter.storageFor(
               this.config.sharedNamespace
             );
+            targetNamespaceName = this.config.sharedNamespace;
             log.debug(
               `scope-routing: fact "${fact.content.slice(0, 60)}\u2026" routed to shared namespace (scope=global)`
             );
@@ -11227,34 +12758,38 @@ ${normalized}`).digest("hex");
               contentHashSource: rawChunkedContent
             }
           );
-          for (const chunk of chunkResult.chunks) {
-            const chunkImportance = scoreImportance(
-              chunk.content,
-              writeCategory,
-              fact.tags
-            );
-            const chunkWriteSource = fact.source === "proactive" ? "chunking-proactive" : "chunking";
-            await targetStorage.writeChunk(
-              parentId,
-              chunk.index,
-              chunkResult.chunks.length,
-              writeCategory,
-              // Each chunk carries its own inline citation so provenance
-              // survives when a single chunk is quoted in isolation.
-              applyInlineCitation(chunk.content),
-              {
-                confidence: fact.confidence,
-                tags: fact.tags,
-                entityRef: fact.entityRef,
-                source: chunkWriteSource,
-                importance: chunkImportance,
-                intentGoal: inferredIntent?.goal,
-                intentActionType: inferredIntent?.actionType,
-                intentEntityTypes: inferredIntent?.entityTypes,
-                memoryKind: memoryKind2,
-                validAt: sourceContext?.validAt
-              }
-            );
+          try {
+            for (const chunk of chunkResult.chunks) {
+              const chunkImportance = scoreImportance(
+                chunk.content,
+                writeCategory,
+                fact.tags
+              );
+              const chunkWriteSource = fact.source === "proactive" ? "chunking-proactive" : "chunking";
+              await targetStorage.writeChunk(
+                parentId,
+                chunk.index,
+                chunkResult.chunks.length,
+                writeCategory,
+                // Each chunk carries its own inline citation so provenance
+                // survives when a single chunk is quoted in isolation.
+                applyInlineCitation(chunk.content),
+                {
+                  confidence: fact.confidence,
+                  tags: fact.tags,
+                  entityRef: fact.entityRef,
+                  source: chunkWriteSource,
+                  importance: chunkImportance,
+                  intentGoal: inferredIntent?.goal,
+                  intentActionType: inferredIntent?.actionType,
+                  intentEntityTypes: inferredIntent?.entityTypes,
+                  memoryKind: memoryKind2,
+                  validAt: sourceContext?.validAt
+                }
+              );
+            }
+          } finally {
+            this.markCatalogWrite(targetNamespaceName, targetStorage.dir);
           }
           if (routedRuleId) {
             log.debug(
@@ -11307,51 +12842,55 @@ ${normalized}`).digest("hex");
             const chunkId = `${parentId}-chunk-${chunk.index}`;
             await this.indexPersistedMemory(targetStorage, chunkId);
           }
-          if (this.config.verbatimArtifactsEnabled && this.config.verbatimArtifactCategories.includes(writeCategory) && fact.confidence >= this.config.verbatimArtifactsMinConfidence) {
-            await targetStorage.writeArtifact(citedChunkedContent, {
-              confidence: fact.confidence,
-              tags: [...fact.tags, "artifact", "chunked-parent"],
-              artifactType: this.artifactTypeForCategory(writeCategory),
-              sourceMemoryId: parentId,
-              intentGoal: inferredIntent?.goal,
-              intentActionType: inferredIntent?.actionType,
-              intentEntityTypes: inferredIntent?.entityTypes
-            });
-          }
-          if (this.config.multiGraphMemoryEnabled) {
-            try {
-              const graphContext = await ensureGraphContext(targetStorage);
-              const entityRef = typeof fact.entityRef === "string" ? fact.entityRef : void 0;
-              const parentRelPath = resolvePersistedMemoryRelativePath({
-                memoryId: parentId,
-                pathById: graphContext.memoryPathById,
-                category: writeCategory
-              });
-              graphContext.memoryPathById.set(parentId, parentRelPath);
-              appendMemoryToGraphContext({
-                allMemsForGraph: graphContext.allMemsForGraph,
-                storageDir: targetStorage.dir,
-                memoryRelPath: parentRelPath,
-                memoryId: parentId,
-                category: writeCategory,
-                content: fact.content ?? "",
-                entityRef
+          try {
+            if (this.config.verbatimArtifactsEnabled && this.config.verbatimArtifactCategories.includes(writeCategory) && fact.confidence >= this.config.verbatimArtifactsMinConfidence) {
+              await targetStorage.writeArtifact(citedChunkedContent, {
+                confidence: fact.confidence,
+                tags: [...fact.tags, "artifact", "chunked-parent"],
+                artifactType: this.artifactTypeForCategory(writeCategory),
+                sourceMemoryId: parentId,
+                intentGoal: inferredIntent?.goal,
+                intentActionType: inferredIntent?.actionType,
+                intentEntityTypes: inferredIntent?.entityTypes
               });
-              await this.buildGraphEdge(
-                targetStorage,
-                parentRelPath,
-                entityRef,
-                parentId,
-                fact.content ?? "",
-                graphContext.allMemsForGraph,
-                graphContext.memoryPathById,
-                threadIdForExtraction ?? void 0,
-                threadEpisodeIdsForGraph,
-                graphContext.previousPersistedRelPath
-              );
-              graphContext.previousPersistedRelPath = parentRelPath;
-            } catch {
             }
+            if (this.config.multiGraphMemoryEnabled) {
+              try {
+                const graphContext = await ensureGraphContext(targetStorage);
+                const entityRef = typeof fact.entityRef === "string" ? fact.entityRef : void 0;
+                const parentRelPath = resolvePersistedMemoryRelativePath({
+                  memoryId: parentId,
+                  pathById: graphContext.memoryPathById,
+                  category: writeCategory
+                });
+                graphContext.memoryPathById.set(parentId, parentRelPath);
+                appendMemoryToGraphContext({
+                  allMemsForGraph: graphContext.allMemsForGraph,
+                  storageDir: targetStorage.dir,
+                  memoryRelPath: parentRelPath,
+                  memoryId: parentId,
+                  category: writeCategory,
+                  content: fact.content ?? "",
+                  entityRef
+                });
+                await this.buildGraphEdge(
+                  targetStorage,
+                  parentRelPath,
+                  entityRef,
+                  parentId,
+                  fact.content ?? "",
+                  graphContext.allMemsForGraph,
+                  graphContext.memoryPathById,
+                  threadIdForExtraction ?? void 0,
+                  threadEpisodeIdsForGraph,
+                  graphContext.previousPersistedRelPath
+                );
+                graphContext.previousPersistedRelPath = parentRelPath;
+              } catch {
+              }
+            }
+          } finally {
+            this.markCatalogWrite(targetNamespaceName, targetStorage.dir);
           }
           trackBehaviorSignals(
             targetStorage,
@@ -11419,91 +12958,107 @@ ${normalized}`).digest("hex");
       } catch (err) {
         log.warn(`temporal-supersession: unexpected error: ${err}`);
       }
-      trackBehaviorSignals(
-        targetStorage,
-        buildBehaviorSignalsForMemory({
-          memoryId,
-          category: writeCategory,
-          content: fact.content,
-          namespace: this.namespaceFromStorageDir(targetStorage.dir),
-          confidence: fact.confidence,
-          source: "extraction"
-        })
-      );
-      trackPersistedId(targetStorage, memoryId);
-      if (threadEpisodeIdsForGraph && !threadEpisodeIdsForGraph.includes(memoryId)) {
-        threadEpisodeIdsForGraph.push(memoryId);
-      }
-      await this.indexPersistedMemory(targetStorage, memoryId);
-      await promoteMemoryToShared({
-        sourceStorage: targetStorage,
-        category: writeCategory,
-        content: fact.content,
-        confidence: fact.confidence,
-        tags: fact.tags,
-        entityRef: typeof fact.entityRef === "string" ? fact.entityRef : void 0,
-        structuredAttributes: fact.structuredAttributes,
-        sourceMemoryId: memoryId,
-        importance,
-        intentGoal: inferredIntent?.goal,
-        intentActionType: inferredIntent?.actionType,
-        intentEntityTypes: inferredIntent?.entityTypes,
-        memoryKind,
-        validAt: sourceContext?.validAt,
-        source: extractionWriteSource
-      });
-      if (this.config.multiGraphMemoryEnabled) {
-        try {
-          const graphContext = await ensureGraphContext(targetStorage);
-          const entityRef = typeof fact.entityRef === "string" ? fact.entityRef : void 0;
-          const memoryRelPath = resolvePersistedMemoryRelativePath({
-            memoryId,
-            pathById: graphContext.memoryPathById,
-            category: writeCategory
-          });
-          graphContext.memoryPathById.set(memoryId, memoryRelPath);
-          appendMemoryToGraphContext({
-            allMemsForGraph: graphContext.allMemsForGraph,
-            storageDir: targetStorage.dir,
-            memoryRelPath,
+      try {
+        trackBehaviorSignals(
+          targetStorage,
+          buildBehaviorSignalsForMemory({
             memoryId,
             category: writeCategory,
-            content: fact.content ?? "",
-            entityRef
-          });
-          await this.buildGraphEdge(
-            targetStorage,
-            memoryRelPath,
-            entityRef,
-            memoryId,
-            fact.content ?? "",
-            graphContext.allMemsForGraph,
-            graphContext.memoryPathById,
-            threadIdForExtraction ?? void 0,
-            threadEpisodeIdsForGraph,
-            graphContext.previousPersistedRelPath
-          );
-          graphContext.previousPersistedRelPath = memoryRelPath;
-        } catch {
+            content: fact.content,
+            namespace: this.namespaceFromStorageDir(targetStorage.dir),
+            confidence: fact.confidence,
+            source: "extraction"
+          })
+        );
+        trackPersistedId(targetStorage, memoryId);
+        if (threadEpisodeIdsForGraph && !threadEpisodeIdsForGraph.includes(memoryId)) {
+          threadEpisodeIdsForGraph.push(memoryId);
         }
-      }
-      if (this.config.verbatimArtifactsEnabled && this.config.verbatimArtifactCategories.includes(writeCategory) && fact.confidence >= this.config.verbatimArtifactsMinConfidence) {
-        await targetStorage.writeArtifact(citedFactContent, {
+        await this.indexPersistedMemory(targetStorage, memoryId);
+        await promoteMemoryToShared({
+          sourceStorage: targetStorage,
+          category: writeCategory,
+          content: fact.content,
           confidence: fact.confidence,
-          tags: [...fact.tags, "artifact"],
-          artifactType: this.artifactTypeForCategory(writeCategory),
+          tags: fact.tags,
+          entityRef: typeof fact.entityRef === "string" ? fact.entityRef : void 0,
+          structuredAttributes: fact.structuredAttributes,
           sourceMemoryId: memoryId,
+          importance,
           intentGoal: inferredIntent?.goal,
           intentActionType: inferredIntent?.actionType,
-          intentEntityTypes: inferredIntent?.entityTypes
+          intentEntityTypes: inferredIntent?.entityTypes,
+          memoryKind,
+          validAt: sourceContext?.validAt,
+          source: extractionWriteSource
         });
-      }
-      if (this.contentHashIndex) {
-        const canonicalFactContent = citationEnabled && hasCitationForTemplate(fact.content, citationTemplate) ? stripCitationForTemplate(fact.content, citationTemplate) : fact.content;
-        const hashRegisterKey = writeCategory === "procedure" ? buildProcedurePersistBody(fact.content, fact.procedureSteps) : canonicalFactContent;
-        this.contentHashIndex.add(hashRegisterKey);
+        if (this.config.multiGraphMemoryEnabled) {
+          try {
+            const graphContext = await ensureGraphContext(targetStorage);
+            const entityRef = typeof fact.entityRef === "string" ? fact.entityRef : void 0;
+            const memoryRelPath = resolvePersistedMemoryRelativePath({
+              memoryId,
+              pathById: graphContext.memoryPathById,
+              category: writeCategory
+            });
+            graphContext.memoryPathById.set(memoryId, memoryRelPath);
+            appendMemoryToGraphContext({
+              allMemsForGraph: graphContext.allMemsForGraph,
+              storageDir: targetStorage.dir,
+              memoryRelPath,
+              memoryId,
+              category: writeCategory,
+              content: fact.content ?? "",
+              entityRef
+            });
+            await this.buildGraphEdge(
+              targetStorage,
+              memoryRelPath,
+              entityRef,
+              memoryId,
+              fact.content ?? "",
+              graphContext.allMemsForGraph,
+              graphContext.memoryPathById,
+              threadIdForExtraction ?? void 0,
+              threadEpisodeIdsForGraph,
+              graphContext.previousPersistedRelPath
+            );
+            graphContext.previousPersistedRelPath = memoryRelPath;
+          } catch {
+          }
+        }
+        if (this.config.verbatimArtifactsEnabled && this.config.verbatimArtifactCategories.includes(writeCategory) && fact.confidence >= this.config.verbatimArtifactsMinConfidence) {
+          await targetStorage.writeArtifact(citedFactContent, {
+            confidence: fact.confidence,
+            tags: [...fact.tags, "artifact"],
+            artifactType: this.artifactTypeForCategory(writeCategory),
+            sourceMemoryId: memoryId,
+            intentGoal: inferredIntent?.goal,
+            intentActionType: inferredIntent?.actionType,
+            intentEntityTypes: inferredIntent?.entityTypes
+          });
+        }
+        if (this.contentHashIndex) {
+          const canonicalFactContent = citationEnabled && hasCitationForTemplate(fact.content, citationTemplate) ? stripCitationForTemplate(fact.content, citationTemplate) : fact.content;
+          const hashRegisterKey = writeCategory === "procedure" ? buildProcedurePersistBody(fact.content, fact.procedureSteps) : canonicalFactContent;
+          this.contentHashIndex.add(hashRegisterKey);
+        }
+      } finally {
+        this.markCatalogWrite(targetNamespaceName, targetStorage.dir);
       }
     }
+    let durableNonFactWritten = false;
+    let durableNonFactTouchRecorded = false;
+    const touchBaseNonFactNamespace = () => {
+      const baseTouchNamespace = baseNamespace && baseNamespace.length > 0 ? baseNamespace : this.namespaceFromStorageDir(storage.dir);
+      this.markCatalogWrite(baseTouchNamespace, storage.dir);
+    };
+    const recordDurableNonFactWrite = () => {
+      durableNonFactWritten = true;
+      if (durableNonFactTouchRecorded) return;
+      durableNonFactTouchRecorded = true;
+      touchBaseNonFactNamespace();
+    };
     for (const entity of entities) {
       try {
         const name = entity?.name;
@@ -11519,7 +13074,10 @@ ${normalized}`).digest("hex");
           principal: sourceContext?.principal,
           structuredSections: Array.isArray(entity?.structuredSections) ? entity.structuredSections : void 0
         });
-        if (id) trackPersistedId(storage, id);
+        if (id) {
+          trackPersistedId(storage, id);
+          recordDurableNonFactWrite();
+        }
       } catch (err) {
         log.warn(`persistExtraction: entity write failed: ${err}`);
       }
@@ -11532,10 +13090,12 @@ ${normalized}`).digest("hex");
             target: rel.target,
             label: rel.label
           });
+          recordDurableNonFactWrite();
           await storage.addEntityRelationship(rel.target, {
             target: rel.source,
             label: `${rel.label} (reverse)`
           });
+          recordDurableNonFactWrite();
         } catch (err) {
           log.debug(`relationship persist failed: ${err}`);
         }
@@ -11561,18 +13121,26 @@ ${normalized}`).digest("hex");
     }
     if (profileUpdates.length > 0) {
       await storage.appendToProfile(profileUpdates);
+      recordDurableNonFactWrite();
     }
     for (const q of questions) {
       const id = await storage.writeQuestion(q.question, q.context, q.priority);
-      if (id) trackPersistedId(storage, id);
+      if (id) {
+        trackPersistedId(storage, id);
+        recordDurableNonFactWrite();
+      }
     }
     if (this.config.identityEnabled && result.identityReflection) {
       try {
         await storage.appendIdentityReflection(result.identityReflection);
+        recordDurableNonFactWrite();
       } catch (err) {
         log.debug(`identity reflection write failed: ${err}`);
       }
     }
+    if (durableNonFactWritten) {
+      touchBaseNonFactNamespace();
+    }
     if (this.contentHashIndex) {
       await this.contentHashIndex.save().catch((err) => log.warn(`content-hash index save failed: ${err}`));
     }
@@ -11628,7 +13196,7 @@ ${normalized}`).digest("hex");
         const allMems = allMemsForGraph ?? [];
         for (const m of allMems) {
           if (m.frontmatter.entityRef === entityRef) {
-            const rel = path2.relative(storage.dir, m.path);
+            const rel = path3.relative(storage.dir, m.path);
             if (rel !== memoryRelPath) entitySiblings.push(rel);
           }
         }
@@ -11730,6 +13298,7 @@ ${normalized}`).digest("hex");
     log.info("running consolidation pass");
     let merged = 0;
     let invalidated = 0;
+    let memoryItemMutated = false;
     if (this.accessTrackingBuffer.size > 0) {
       await this.flushAccessTracking();
     }
@@ -11752,6 +13321,7 @@ ${normalized}`).digest("hex");
           const toInvalidate = this.config.queryAwareIndexingEnabled ? memoryLookup?.get(item.existingId) ?? null : null;
           if (await this.storage.invalidateMemory(item.existingId)) {
             invalidated += 1;
+            memoryItemMutated = true;
             await this.embeddingFallback.removeFromIndex(item.existingId);
             if (toInvalidate?.path && toInvalidate.frontmatter?.created) {
               deindexMemory(
@@ -11773,6 +13343,7 @@ ${normalized}`).digest("hex");
                 lineage: [item.existingId]
               }
             );
+            memoryItemMutated = true;
             await this.indexPersistedMemory(this.storage, item.existingId);
           }
           break;
@@ -11786,6 +13357,7 @@ ${normalized}`).digest("hex");
                 lineage: [item.existingId, item.mergeWith]
               }
             );
+            memoryItemMutated = true;
             await this.indexPersistedMemory(this.storage, item.existingId);
             const toMergeInvalidate = this.config.queryAwareIndexingEnabled ? memoryLookup?.get(item.mergeWith) ?? null : null;
             if (await this.storage.invalidateMemory(item.mergeWith)) {
@@ -11815,8 +13387,12 @@ ${normalized}`).digest("hex");
         structuredSections: Array.isArray(entity?.structuredSections) ? entity.structuredSections : void 0
       });
     }
+    if (result.profileUpdates.length > 0 || result.entityUpdates.length > 0) {
+      memoryItemMutated = true;
+    }
     const entitiesMerged = await this.storage.mergeFragmentedEntities();
     if (entitiesMerged > 0) {
+      memoryItemMutated = true;
       log.info(`merged ${entitiesMerged} fragmented entity files`);
     }
     if (this.config.entitySummaryEnabled) {
@@ -11826,6 +13402,7 @@ ${normalized}`).digest("hex");
           5
         );
         if (synthesized > 0) {
+          memoryItemMutated = true;
           log.info(`refreshed ${synthesized} entity syntheses`);
         }
       } catch (err) {
@@ -11836,6 +13413,7 @@ ${normalized}`).digest("hex");
       this.config.commitmentDecayDays
     );
     if (deletedCommitments.length > 0) {
+      memoryItemMutated = true;
       log.info(`cleaned ${deletedCommitments.length} expired commitments`);
       if (this.config.queryAwareIndexingEnabled) {
         for (const m of deletedCommitments) {
@@ -11857,6 +13435,7 @@ ${normalized}`).digest("hex");
           decayDays: this.config.commitmentDecayDays
         });
         if (lifecycle.transitionedToExpired.length > 0 || lifecycle.deletedResolved.length > 0) {
+          memoryItemMutated = true;
           log.info(
             `commitment ledger lifecycle: expired ${lifecycle.transitionedToExpired.length}, cleaned ${lifecycle.deletedResolved.length}`
           );
@@ -11867,6 +13446,7 @@ ${normalized}`).digest("hex");
     }
     const deletedTTL = await this.storage.cleanExpiredTTL();
     if (deletedTTL.length > 0) {
+      memoryItemMutated = true;
       log.info(`cleaned ${deletedTTL.length} TTL-expired memories`);
       if (this.config.queryAwareIndexingEnabled) {
         for (const m of deletedTTL) {
@@ -11883,7 +13463,9 @@ ${normalized}`).digest("hex");
       try {
         const lightSleepStartedAt = (/* @__PURE__ */ new Date()).toISOString();
         const lifecycleCorpus = await this.storage.readAllMemories();
-        await this.runLifecyclePolicyPass(lifecycleCorpus);
+        if (await this.runLifecyclePolicyPass(lifecycleCorpus) > 0) {
+          memoryItemMutated = true;
+        }
         await this.recordScheduledDreamsPhaseRun(
           "lightSleep",
           lifecycleCorpus.length,
@@ -11900,11 +13482,13 @@ ${normalized}`).digest("hex");
     await this.runCompressionGuidelineLearningPass();
     try {
       const deepSleepStartedAt = (/* @__PURE__ */ new Date()).toISOString();
-      await this.runTierMigrationCycle(this.storage, "maintenance");
+      const tierMigration = await this.runTierMigrationCycle(this.storage, "maintenance");
+      if (tierMigration.migrated > 0) memoryItemMutated = true;
       allMemories = await this.storage.readAllMemories();
       if (this.config.factArchivalEnabled) {
         const archived = await this.runFactArchival(allMemories);
         if (archived > 0) {
+          memoryItemMutated = true;
           log.info(`archived ${archived} old low-importance facts`);
         }
       }
@@ -11928,14 +13512,14 @@ ${normalized}`).digest("hex");
     }
     if (this.config.semanticConsolidationEnabled) {
       try {
-        const stateFilePath = path2.join(
+        const stateFilePath = path3.join(
           this.config.memoryDir,
           "state",
           "semantic-consolidation-last-run.json"
         );
         let shouldRun = true;
         try {
-          const stateRaw = await readFile2(stateFilePath, "utf-8");
+          const stateRaw = await readFile3(stateFilePath, "utf-8");
           const stateData = JSON.parse(stateRaw);
           if (stateData.lastRunAt) {
             const lastRunMs = new Date(stateData.lastRunAt).getTime();
@@ -11976,9 +13560,9 @@ ${normalized}`).digest("hex");
             );
           }
           if (semResult.errors === 0 || semResult.memoriesArchived > 0) {
-            const stateDir = path2.join(this.config.memoryDir, "state");
-            await mkdir2(stateDir, { recursive: true });
-            await writeFile2(
+            const stateDir = path3.join(this.config.memoryDir, "state");
+            await mkdir3(stateDir, { recursive: true });
+            await writeFile3(
               stateFilePath,
               JSON.stringify({ lastRunAt: (/* @__PURE__ */ new Date()).toISOString() }),
               "utf-8"
@@ -12009,6 +13593,7 @@ ${normalized}`).digest("hex");
         );
         if (profileResult) {
           await this.storage.writeProfile(profileResult.consolidatedProfile);
+          memoryItemMutated = true;
           log.info(
             `profile.md consolidated: removed ${profileResult.removedCount} items \u2014 ${profileResult.summary}`
           );
@@ -12080,6 +13665,12 @@ ${texts.map((t, i) => `[${i + 1}] ${t}`).join("\n\n")}`;
         }
       }
     }
+    if (memoryItemMutated) {
+      this.markCatalogWrite(
+        this.namespaceFromStorageDir(this.storage.dir),
+        this.storage.dir
+      );
+    }
     log.info("consolidation complete");
     return { memoriesProcessed: allMemories.length, merged, invalidated };
   }
@@ -12398,7 +13989,9 @@ ${texts.map((t, i) => `[${i + 1}] ${t}`).join("\n\n")}`;
   }
   async runLifecyclePolicyNow(storage = this.storage) {
     const lifecycleCorpus = await storage.readAllMemories();
-    await this.runLifecyclePolicyPass(lifecycleCorpus, storage);
+    if (await this.runLifecyclePolicyPass(lifecycleCorpus, storage) > 0) {
+      this.markCatalogWrite(this.namespaceFromStorageDir(storage.dir), storage.dir);
+    }
     return { memoriesAssessed: lifecycleCorpus.length };
   }
   async runLifecyclePolicyPass(allMemories, storage = this.storage) {
@@ -12454,7 +14047,7 @@ ${texts.map((t, i) => `[${i + 1}] ${t}`).join("\n\n")}`;
       });
       if (wrote) updatedCount += 1;
     }
-    if (!this.config.lifecycleMetricsEnabled) return;
+    if (!this.config.lifecycleMetricsEnabled) return updatedCount;
     const total = evaluatedCount;
     const metrics = {
       generatedAt: nowIso,
@@ -12471,13 +14064,14 @@ ${texts.map((t, i) => `[${i + 1}] ${t}`).join("\n\n")}`;
         protectedCategories: this.config.lifecycleProtectedCategories
       }
     };
-    const metricsPath = path2.join(
+    const metricsPath = path3.join(
       storage.dir,
       "state",
       "lifecycle-metrics.json"
     );
-    await mkdir2(path2.dirname(metricsPath), { recursive: true });
-    await writeFile2(metricsPath, JSON.stringify(metrics, null, 2), "utf-8");
+    await mkdir3(path3.dirname(metricsPath), { recursive: true });
+    await writeFile3(metricsPath, JSON.stringify(metrics, null, 2), "utf-8");
+    return updatedCount;
   }
   /**
    * Archive old, low-importance, rarely-accessed facts (v6.0).
@@ -12549,8 +14143,8 @@ ${texts.map((t, i) => `[${i + 1}] ${t}`).join("\n\n")}`;
     const sorted = activeMemories.sort(
       (a, b) => new Date(a.frontmatter.created).getTime() - new Date(b.frontmatter.created).getTime()
     );
-    const toKeep = sorted.slice(-this.config.summarizationRecentToKeep);
-    const toSummarize = sorted.slice(0, -this.config.summarizationRecentToKeep);
+    const recentToKeep = Math.max(0, this.config.summarizationRecentToKeep);
+    const toSummarize = recentToKeep > 0 ? sorted.slice(0, -recentToKeep) : sorted;
     const candidates = toSummarize.filter((m) => {
       if (m.frontmatter.entityRef) return false;
       const protectedTags = this.config.summarizationProtectedTags;
@@ -12593,6 +14187,10 @@ ${texts.map((t, i) => `[${i + 1}] ${t}`).join("\n\n")}`;
         batch.map((m) => m.frontmatter.id),
         summary.id
       );
+      this.markCatalogWrite(
+        this.namespaceFromStorageDir(this.storage.dir),
+        this.storage.dir
+      );
       log.info(
         `created summary ${summary.id} from ${batch.length} memories, archived ${archived}`
       );
@@ -12618,7 +14216,7 @@ ${texts.map((t, i) => `[${i + 1}] ${t}`).join("\n\n")}`;
   /** Threshold (bytes) at which IDENTITY.md reflections get auto-consolidated */
   static IDENTITY_CONSOLIDATE_THRESHOLD = 8e3;
   async autoConsolidateIdentity() {
-    const namespaces = this.config.namespacesEnabled ? this.configuredNamespaces() : [this.config.defaultNamespace];
+    const namespaces = this.config.namespacesEnabled ? await this.maintenanceNamespaces() : [this.config.defaultNamespace];
     for (const namespace of namespaces) {
       const storage = await this.storageRouter.storageFor(namespace);
       const identityNamespace = this.config.namespacesEnabled && namespace !== this.config.defaultNamespace ? namespace : void 0;
@@ -12661,6 +14259,7 @@ ${reflectionsContent.trim()}
         identityNamespace
       );
       await storage.writeIdentityReflections("");
+      this.markCatalogWrite(namespace, storage.dir);
       log.info(
         `IDENTITY(${namespace}) consolidated: ${identityContent.length} \u2192 ${newContent.length} chars, ${result.learnedPatterns.length} patterns`
       );
@@ -13004,7 +14603,7 @@ ${lines.join("\n\n")}`;
       const seenStorageDirs = /* @__PURE__ */ new Set();
       const addStorage = (storage) => {
         const storageDir = storageDirFor(storage);
-        const storageKey = storageDir ? path2.resolve(storageDir) : `storage-without-dir-${storages.length}`;
+        const storageKey = storageDir ? path3.resolve(storageDir) : `storage-without-dir-${storages.length}`;
         if (seenStorageDirs.has(storageKey)) return;
         seenStorageDirs.add(storageKey);
         storages.push(storage);
@@ -13034,7 +14633,7 @@ ${lines.join("\n\n")}`;
           continue;
         }
         try {
-          const coldRoot = path2.join(storageDir, "cold");
+          const coldRoot = path3.join(storageDir, "cold");
           for (const candidate of qmdResultPathCandidates(
             coldRoot,
             parts.relativePath
@@ -13075,7 +14674,7 @@ ${lines.join("\n\n")}`;
         return null;
       }
     }
-    if (path2.isAbsolute(resultPath)) {
+    if (path3.isAbsolute(resultPath)) {
       if (!fallbackStorageDir) {
         return await fallbackStorage.readMemoryByPath(resultPath);
       }
@@ -13114,7 +14713,7 @@ ${lines.join("\n\n")}`;
     );
     if (!memory) return null;
     let ownerNamespace = null;
-    if (path2.isAbsolute(memory.path)) {
+    if (path3.isAbsolute(memory.path)) {
       const ownerStorage = await this.storageForAbsoluteQmdResultPath(
         memory.path,
         fallbackStorage,
@@ -13138,16 +14737,16 @@ ${lines.join("\n\n")}`;
     };
   }
   async storageForAbsoluteQmdResultPath(resultPath, fallbackStorage, recallNamespaces = []) {
-    const resolvedPath = path2.resolve(resultPath);
-    const memoryRoot = path2.resolve(this.config.memoryDir);
-    const namespacesRoot = path2.join(memoryRoot, "namespaces");
+    const resolvedPath = path3.resolve(resultPath);
+    const memoryRoot = path3.resolve(this.config.memoryDir);
+    const namespacesRoot = path3.join(memoryRoot, "namespaces");
     const fallbackStorageDir = typeof fallbackStorage.dir === "string" && fallbackStorage.dir ? fallbackStorage.dir : null;
     const matches = [];
     const seenDirs = /* @__PURE__ */ new Set();
     const maybeAddStorage = (storage, namespace) => {
       const storageDir = typeof storage.dir === "string" && storage.dir ? storage.dir : null;
       if (!storageDir) return;
-      const candidateRoot = path2.resolve(storageDir);
+      const candidateRoot = path3.resolve(storageDir);
       if (seenDirs.has(candidateRoot)) return;
       if (!isPathInsideStorageRoot(candidateRoot, resolvedPath)) return;
       if (candidateRoot === memoryRoot && isPathInsideStorageRoot(namespacesRoot, resolvedPath)) {
@@ -13165,7 +14764,7 @@ ${lines.join("\n\n")}`;
       candidateNamespaces.add(ns);
     }
     if (isPathInsideStorageRoot(namespacesRoot, resolvedPath)) {
-      const relativeToNamespaces = path2.relative(namespacesRoot, resolvedPath);
+      const relativeToNamespaces = path3.relative(namespacesRoot, resolvedPath);
       const [namespaceSegment] = relativeToNamespaces.split(/[\\/]/);
       if (namespaceSegment) {
         candidateNamespaces.add(
@@ -13210,7 +14809,7 @@ ${lines.join("\n\n")}`;
           nsMap = buildMemoryWorthCounterMap(memories);
           this.memoryWorthCounterCache.set(ns, { at: nowMs, counters: nsMap });
         }
-        for (const [path3, c] of nsMap) counters.set(path3, c);
+        for (const [path4, c] of nsMap) counters.set(path4, c);
       } catch (err) {
         log.debug("memory-worth: failed to read namespace, skipping", {
           namespace: ns,
@@ -13381,12 +14980,12 @@ ${lines.join("\n\n")}`;
    */
   semanticDedupScopeFor(targetStorage) {
     if (!this.config.namespacesEnabled) return {};
-    const memoryDir = path2.resolve(this.config.memoryDir);
-    const storageDir = path2.resolve(targetStorage.dir);
+    const memoryDir = path3.resolve(this.config.memoryDir);
+    const storageDir = path3.resolve(targetStorage.dir);
     if (storageDir === memoryDir) {
       return { pathExcludePrefixes: ["namespaces/"] };
     }
-    let rel = path2.relative(memoryDir, storageDir);
+    let rel = path3.relative(memoryDir, storageDir);
     if (!rel || rel.startsWith("..")) {
       log.debug(
         `semantic dedup: target storage dir ${storageDir} is outside memoryDir ${memoryDir}; scoping lookup to absolute path prefix`
@@ -13405,7 +15004,7 @@ ${lines.join("\n\n")}`;
     if (hits.length === 0) return [];
     const results = [];
     for (const hit of hits) {
-      const fullPath = path2.isAbsolute(hit.path) ? hit.path : path2.join(this.config.memoryDir, hit.path);
+      const fullPath = path3.isAbsolute(hit.path) ? hit.path : path3.join(this.config.memoryDir, hit.path);
       const memory = await this.storage.readMemoryByPath(fullPath);
       if (!memory) continue;
       results.push({
@@ -13580,7 +15179,7 @@ ${lines.join("\n\n")}`;
           const storage = await this.storageRouter.storageFor(namespace);
           const storageDir = typeof storage.dir === "string" && storage.dir ? storage.dir : null;
           if (!storageDir) continue;
-          const recallRoot = path2.resolve(storageDir);
+          const recallRoot = path3.resolve(storageDir);
           if (seenRecallRoots.has(recallRoot)) continue;
           seenRecallRoots.add(recallRoot);
           recallRoots.push(recallRoot);
@@ -13604,8 +15203,8 @@ ${lines.join("\n\n")}`;
           if (resolvedCold) scopedResults.push(resolvedCold.result);
           continue;
         }
-        if (path2.isAbsolute(result.path)) {
-          const resolvedPath = path2.resolve(result.path);
+        if (path3.isAbsolute(result.path)) {
+          const resolvedPath = path3.resolve(result.path);
           if (recallRoots.some(
             (recallRoot) => isPathInsideStorageRoot(recallRoot, resolvedPath)
           )) {
@@ -14346,13 +15945,65 @@ ${lines.join("\n\n")}`;
   }
   namespaceFromStorageDir(storageDir) {
     if (!this.config.namespacesEnabled) return this.config.defaultNamespace;
-    const resolvedStorageDir = path2.resolve(storageDir);
-    const resolvedMemoryDir = path2.resolve(this.config.memoryDir);
+    const resolvedStorageDir = path3.resolve(storageDir);
+    const resolvedMemoryDir = path3.resolve(this.config.memoryDir);
     if (resolvedStorageDir === resolvedMemoryDir)
       return this.config.defaultNamespace;
     const m = resolvedStorageDir.match(/[\\/]namespaces[\\/]([^\\/]+)$/);
     if (!m?.[1]) return this.config.defaultNamespace;
-    return namespaceIdentityFromToken(m[1]) ?? m[1];
+    const dirName = m[1];
+    if (this.configuredNamespaces().includes(dirName)) {
+      return dirName;
+    }
+    this.loadNamespaceStorageDirHintsFromCatalog();
+    const hintedNamespaces = this.namespaceStorageDirHints.get(resolvedStorageDir);
+    if (hintedNamespaces?.has(dirName)) {
+      return dirName;
+    }
+    if (hintedNamespaces?.size === 1) {
+      const [hintedNamespace] = hintedNamespaces;
+      if (hintedNamespace) return hintedNamespace;
+    }
+    const decoded = namespaceIdentityFromToken(dirName);
+    if (decoded && namespaceIdentityToken(decoded) === dirName) {
+      return decoded;
+    }
+    return dirName;
+  }
+  /**
+   * Record a namespace write in the catalog (issue #1499). Best-effort and
+   * failure-tolerant: a catalog write error MUST NOT crash the primary memory
+   * write (CLAUDE.md gotcha #13, rule #40). Fire-and-forget by design.
+   */
+  markCatalogWrite(namespace, storageDir) {
+    if (!this.namespaceCatalog.enabled) return;
+    this.rememberNamespaceStorageDirHint(namespace, storageDir);
+    void this.namespaceCatalog.markWrite(namespace, { discoveredBy: "write", storageDir }).catch(() => void 0);
+  }
+  /**
+   * Public best-effort catalog write touch (issue #1499). User-facing explicit
+   * captures (`memory_store`) and review-queue approvals persist via
+   * `persistExplicitCapture()` → `storage.writeMemory()`, which bypasses the
+   * extraction write path that calls `markCatalogWrite`. Without this their
+   * namespaces never record `lastWriteAt`, so the catalog under-reports write
+   * recency (round 5, codex P2). Fire-and-forget and failure-tolerant — a
+   * catalog error must never affect the explicit write (gotcha #13, rule #40).
+   *
+   * An undefined/empty `namespace` means the write targeted the DEFAULT namespace
+   * (`getStorage(undefined)` routes there), so we record it under the configured
+   * default rather than skipping it (round 6, codex P2 — default `memory_store`
+   * and inline-note writes were missing from `writtenSince`/maintenance).
+   */
+  recordCatalogWrite(namespace, storageDir) {
+    const ns = namespace && namespace.trim().length > 0 ? namespace : this.config.defaultNamespace;
+    if (!ns) return;
+    this.markCatalogWrite(ns, storageDir);
+  }
+  /** Record a namespace read in the catalog. Best-effort, failure-tolerant. */
+  markCatalogRead(namespace, storageDir) {
+    if (!this.namespaceCatalog.enabled) return;
+    this.rememberNamespaceStorageDirHint(namespace, storageDir);
+    void this.namespaceCatalog.markRead(namespace, { discoveredBy: "read", storageDir }).catch(() => void 0);
   }
   async readAllMemoriesForNamespaces(namespaces) {
     const uniq = Array.from(new Set(namespaces.filter(Boolean)));
@@ -14394,6 +16045,7 @@ export {
   ensureBuiltInWearableConnectors,
   WearablesService,
   locateTranscriptPath,
+  NamespaceCatalog,
   BulkImportBatchPartialFailureError,
   dedupeEntitySynthesisEvidenceEntries,
   defaultWorkspaceDir,
@@ -14424,4 +16076,4 @@ export {
   resolvePersistedMemoryRelativePath,
   Orchestrator
 };
-//# sourceMappingURL=chunk-SPMZZUEJ.js.map
+//# sourceMappingURL=chunk-OL2364SB.js.map