@remnic/core 9.3.689 → 9.3.691

package/dist/{chunk-JZBFL7RI.js → chunk-TJ5IIQIR.js}

@@ -4,10 +4,7 @@ import {
   loadSyncState,
   syncWearableSource,
   wearableSourceLabel
-} from "./chunk-AGJH5ISO.js";
-import {
-  migrateFromEngram
-} from "./chunk-7HYPN2GC.js";
+} from "./chunk-5KBNNUXS.js";
 import {
   ensureContradictionScanCron,
   ensureDaySummaryCron,
@@ -17,9 +14,12 @@ import {
   ensureProceduralMiningCron,
   graphEdgeDecayCadenceToCronExpr
 } from "./chunk-666A3MOW.js";
+import {
+  migrateFromEngram
+} from "./chunk-7HYPN2GC.js";
 import {
   LcmEngine
-} from "./chunk-2SNKUSQC.js";
+} from "./chunk-X5J3JZR3.js";
 import {
   chunkTranscriptEntries
 } from "./chunk-TECVW3JP.js";
@@ -29,7 +29,7 @@ import {
 import {
   CompoundingEngine,
   defaultTierMigrationCycleBudget
-} from "./chunk-STOEE37X.js";
+} from "./chunk-UOCLRM74.js";
 import {
   SharedContextManager
 } from "./chunk-UFS7OXGL.js";
@@ -38,6 +38,15 @@ import {
   applyUtilityRankingRuntimeDelta,
   loadUtilityRuntimeValues
 } from "./chunk-LXOM6IQU.js";
+import {
+  applyTemporalSupersession,
+  normalizeSupersessionKey,
+  shouldFilterSupersededFromRecall
+} from "./chunk-MRFVMSTR.js";
+import {
+  isValidAsOf,
+  isValidityExpiredNow
+} from "./chunk-IREVVFTM.js";
 import {
   TierMigrationExecutor
 } from "./chunk-VOUOLGIP.js";
@@ -52,19 +61,11 @@ import {
 } from "./chunk-UHGBNIOS.js";
 import {
   HourlySummarizer
-} from "./chunk-A4HH2EWA.js";
+} from "./chunk-QVG4LAQO.js";
 import {
   buildTargetedFactRecallSection,
   shouldRecallTargetedFactEvidence
 } from "./chunk-R5DB26G6.js";
-import {
-  applyTemporalSupersession,
-  normalizeSupersessionKey,
-  shouldFilterSupersededFromRecall
-} from "./chunk-3FC6LW6T.js";
-import {
-  isValidAsOf
-} from "./chunk-MDYG7VI7.js";
 import {
   SessionObserverState
 } from "./chunk-DKTSR7EK.js";
@@ -140,6 +141,18 @@ import {
 import {
   classifyMemoryKind
 } from "./chunk-YAZNBMNF.js";
+import {
+  ExtractionEngine
+} from "./chunk-MXZWKOOR.js";
+import {
+  parseMemoryActionEligibilityContext
+} from "./chunk-ROZJACKP.js";
+import {
+  ModelRegistry
+} from "./chunk-PWFWCGOO.js";
+import {
+  LocalLlmClient
+} from "./chunk-UPTZYUYJ.js";
 import {
   buildFocusedListRecallSection,
   shouldRecallFocusedListEvidence
@@ -160,19 +173,7 @@ import {
   getVerdictKind,
   judgeFactDurability,
   validateProcedureExtraction
-} from "./chunk-OBXTMFZQ.js";
-import {
-  ExtractionEngine
-} from "./chunk-WDXCNJSF.js";
-import {
-  parseMemoryActionEligibilityContext
-} from "./chunk-ROZJACKP.js";
-import {
-  ModelRegistry
-} from "./chunk-PWFWCGOO.js";
-import {
-  LocalLlmClient
-} from "./chunk-UPTZYUYJ.js";
+} from "./chunk-ECZPWSB5.js";
 import {
   tryDirectAnswer
 } from "./chunk-OQH5XUH3.js";
@@ -183,7 +184,7 @@ import {
   buildEntityRecallSection,
   entityRecentTranscriptLookbackHours,
   readRecentEntityTranscriptEntries
-} from "./chunk-B4XVLHJA.js";
+} from "./chunk-U2OBZSGG.js";
 import {
   formatDaySummaryMemories
 } from "./chunk-EO5QWINU.js";
@@ -196,14 +197,14 @@ import {
 import {
   compareVerifiedEpisodeResults,
   searchVerifiedEpisodes
-} from "./chunk-4FE2K57M.js";
+} from "./chunk-3VVH6ZQW.js";
 import {
   ThreadingManager
 } from "./chunk-QRDOSYOR.js";
 import {
   compareVerifiedSemanticRuleResults,
   searchVerifiedSemanticRules
-} from "./chunk-PH3HOKYW.js";
+} from "./chunk-ZLXGFAML.js";
 import {
   searchWorkProductLedgerEntries
 } from "./chunk-ZRWB5D4H.js";
@@ -214,10 +215,15 @@ import {
   PolicyRuntimeManager
 } from "./chunk-33JBK2XP.js";
 import {
-  NamespaceStorageRouter,
-  resolveDefaultNamespaceRoot,
-  resolveNamespaceStorageRoot
-} from "./chunk-WIHPNY65.js";
+  NamespaceCatalog,
+  planNamespaceMaintenance,
+  runNamespaceMaintenanceBatchPlan,
+  runNamespaceMaintenanceFanout,
+  summarizeNamespaceMaintenanceHealth
+} from "./chunk-QNG35H27.js";
+import {
+  NamespaceStorageRouter
+} from "./chunk-W4ELOUNX.js";
 import {
   isAboveImportanceThreshold,
   scoreImportance
@@ -262,7 +268,7 @@ import {
   materializeAfterSemanticConsolidation,
   parseConsolidationResponse,
   parseOperatorAwareConsolidationResponse
-} from "./chunk-GS55WYRL.js";
+} from "./chunk-QFG23CRE.js";
 import {
   buildBehaviorSignalsForMemory,
   dedupeBehaviorSignalsByMemoryAndHash
@@ -289,7 +295,7 @@ import {
   FallbackLlmClient,
   fallbackLlmRuntimeContextFromConfig,
   gatewayTaskChainOptions
-} from "./chunk-FIVDN2SM.js";
+} from "./chunk-4RGWCRIJ.js";
 import {
   compileCorrectionRule,
   correctionsFilePath,
@@ -320,18 +326,18 @@ import {
 } from "./chunk-FF4KLI5W.js";
 import {
   buildXraySnapshot
-} from "./chunk-LLONI6PY.js";
+} from "./chunk-AFWEUTMS.js";
 import {
   objectiveStateStoreOverrideForNamespace,
   searchObjectiveStateSnapshots
 } from "./chunk-6HMYUWXR.js";
 import {
   NamespaceSearchRouter
-} from "./chunk-SAEZIIID.js";
+} from "./chunk-IPJD7WJH.js";
 import {
   createConversationIndexRuntime,
   createSearchBackend
-} from "./chunk-JPETDXED.js";
+} from "./chunk-UUMYB3FR.js";
 import {
   NoopSearchBackend
 } from "./chunk-CYEPCZN5.js";
@@ -346,12 +352,12 @@ import {
 import {
   parseQmdExplain
 } from "./chunk-K43PI6DQ.js";
-import {
-  shouldSkipImplicitExtraction
-} from "./chunk-U33LWTQQ.js";
 import {
   ProfilingCollector
 } from "./chunk-PNLCEFE4.js";
+import {
+  shouldSkipImplicitExtraction
+} from "./chunk-U33LWTQQ.js";
 import {
   buildProcedurePersistBody
 } from "./chunk-QDW3E4RD.js";
@@ -363,16 +369,15 @@ import {
 } from "./chunk-YN4ZT4CW.js";
 import {
   buildChainFollowupGenerator
-} from "./chunk-OV4D5T7V.js";
+} from "./chunk-66HROLW5.js";
 import {
   ContentHashIndex,
   StorageManager,
   compareEntityTimestamps,
   fingerprintEntityStructuredFacts,
   normalizeAttributePairs,
-  parseEntityFile,
-  stripAttributesSuffix
-} from "./chunk-BLIWOONZ.js";
+  parseEntityFile
+} from "./chunk-VFVG4NS2.js";
 import {
   isValidTranscriptDate,
   loadSpeakerRegistry,
@@ -383,6 +388,9 @@ import {
 import {
   assertPathInsideRoot
 } from "./chunk-5GPPACXK.js";
+import {
+  stripAttributesSuffix
+} from "./chunk-SVOZFLIQ.js";
 import {
   attachCitation,
   hasCitationForTemplate,
@@ -390,10 +398,7 @@ import {
 } from "./chunk-J6A3CX5N.js";
 import {
   confidenceTier
-} from "./chunk-NGFEWFNK.js";
-import {
-  displayErrorDetail
-} from "./chunk-6KYMPV2O.js";
+} from "./chunk-DQHZA7Y3.js";
 import {
   buildQmdRecallCacheKey,
   getCachedQmdRecall,
@@ -421,7 +426,6 @@ import {
   parseFlexibleIsoTimestamp
 } from "./chunk-P7FMDTKL.js";
 import {
-  ALL_CATEGORY_DIRS,
   RECALL_FALLBACK_DIRS,
   categoryDirName
 } from "./chunk-VS2IYZRU.js";
@@ -455,19 +459,19 @@ import {
 } from "./chunk-PVGDJXVK.js";
 
 // src/orchestrator.ts
-import path4 from "path";
+import path2 from "path";
 import os from "os";
-import { createHash as createHash2, randomBytes } from "crypto";
+import { createHash, randomBytes } from "crypto";
 import { existsSync, readFileSync } from "fs";
 import {
-  lstat as lstat3,
-  mkdir as mkdir4,
-  readdir as readdir3,
-  readFile as readFile4,
-  realpath as realpath2,
-  stat as stat3,
-  unlink as unlink2,
-  writeFile as writeFile4
+  lstat,
+  mkdir as mkdir2,
+  readdir,
+  readFile as readFile2,
+  realpath,
+  stat,
+  unlink,
+  writeFile as writeFile2
 } from "fs/promises";
 
 // src/procedural/procedure-recall.ts
@@ -1409,2084 +1413,161 @@ Install it alongside Remnic:
    * and/or day. Includes pending_review candidates — the whole point of
    * review mode is seeing what's queued.
    */
-  async transcriptMemories(options = {}) {
-    if (options.date !== void 0 && !isValidTranscriptDate(options.date)) {
-      throw new WearablesInputError(`invalid date '${options.date}' \u2014 expected YYYY-MM-DD`);
-    }
-    if (options.source !== void 0) assertValidSourceId(options.source);
-    const limit = clampLimit(
-      options.limit,
-      MEMORY_LIST_DEFAULT_LIMIT,
-      MEMORY_LIST_MAX_LIMIT,
-      "limit"
-    );
-    const storage = await this.deps.getStorage();
-    const memories = await storage.readAllMemories();
-    const results = [];
-    for (const memory of memories) {
-      const source = memory.frontmatter.source;
-      if (typeof source !== "string" || !source.startsWith(`${WEARABLE_SOURCE_PREFIX}:`)) {
-        continue;
-      }
-      const attrs = memory.frontmatter.structuredAttributes ?? {};
-      const sourceId = attrs.wearableSource;
-      if (options.source !== void 0) {
-        if (sourceId !== options.source && source !== wearableSourceLabel(options.source) && source !== `${wearableSourceLabel(options.source)}:native`) {
-          continue;
-        }
-      }
-      if (options.date !== void 0 && attrs.wearableDate !== options.date) {
-        continue;
-      }
-      results.push({
-        id: memory.frontmatter.id,
-        source: sourceId ?? source,
-        date: attrs.wearableDate,
-        conversationId: attrs.wearableConversationId,
-        status: memory.frontmatter.status,
-        content: memory.content,
-        created: memory.frontmatter.created
-      });
-    }
-    results.sort((a, b) => {
-      if (a.created > b.created) return -1;
-      if (a.created < b.created) return 1;
-      if (a.id < b.id) return -1;
-      if (a.id > b.id) return 1;
-      return 0;
-    });
-    return results.slice(0, limit);
-  }
-  // -- speakers -------------------------------------------------------------
-  async listSpeakers() {
-    const storage = await this.deps.getStorage();
-    return loadSpeakerRegistry(storage.dir);
-  }
-  async setSpeaker(sourceId, speakerKey, name, opts = {}) {
-    if (typeof name !== "string" || name.trim().length === 0) {
-      throw new WearablesInputError("speaker name must be a non-empty string");
-    }
-    if (typeof speakerKey !== "string" || speakerKey.trim().length === 0) {
-      throw new WearablesInputError("speaker key must be a non-empty string");
-    }
-    const storage = await this.deps.getStorage();
-    const registry = await loadSpeakerRegistry(storage.dir);
-    registry.speakers[speakerRegistryKey(sourceId, speakerKey.trim())] = {
-      name: name.trim(),
-      ...opts.isSelf === true ? { isSelf: true } : {},
-      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-    };
-    await saveSpeakerRegistry(storage.dir, registry);
-    return registry;
-  }
-  async setSelfName(name) {
-    if (typeof name !== "string" || name.trim().length === 0) {
-      throw new WearablesInputError("self name must be a non-empty string");
-    }
-    const storage = await this.deps.getStorage();
-    const registry = await loadSpeakerRegistry(storage.dir);
-    registry.selfName = name.trim();
-    await saveSpeakerRegistry(storage.dir, registry);
-    return registry;
-  }
-  async removeSpeaker(sourceId, speakerKey) {
-    const storage = await this.deps.getStorage();
-    const registry = await loadSpeakerRegistry(storage.dir);
-    const key = speakerRegistryKey(sourceId, speakerKey.trim());
-    if (!(key in registry.speakers)) {
-      throw new WearablesInputError(`no speaker override stored for '${key}'`);
-    }
-    delete registry.speakers[key];
-    await saveSpeakerRegistry(storage.dir, registry);
-    return registry;
-  }
-  // -- corrections ----------------------------------------------------------
-  async listCorrections() {
-    const storage = await this.deps.getStorage();
-    return {
-      fromConfig: this.deps.config.corrections,
-      fromState: await loadCorrectionsFile(storage.dir),
-      stateFilePath: correctionsFilePath(storage.dir)
-    };
-  }
-  async addCorrection(rule) {
-    compileCorrectionRule(rule, "correction");
-    const storage = await this.deps.getStorage();
-    const rules = await loadCorrectionsFile(storage.dir);
-    const duplicate = rules.some(
-      (existing) => existing.match === rule.match && existing.replace === rule.replace && existing.regex === true === (rule.regex === true)
-    );
-    if (duplicate) {
-      throw new WearablesInputError(
-        `an identical correction rule already exists (match: ${JSON.stringify(rule.match)})`
-      );
-    }
-    rules.push(rule);
-    await saveCorrectionsFile(storage.dir, rules);
-  }
-  async removeCorrection(index) {
-    if (!Number.isInteger(index) || index < 0) {
-      throw new WearablesInputError(`invalid correction index '${index}'`);
-    }
-    const storage = await this.deps.getStorage();
-    const rules = await loadCorrectionsFile(storage.dir);
-    if (index >= rules.length) {
-      throw new WearablesInputError(
-        `correction index ${index} is out of range (have ${rules.length} state rule${rules.length === 1 ? "" : "s"})`
-      );
-    }
-    const [removed] = rules.splice(index, 1);
-    await saveCorrectionsFile(storage.dir, rules);
-    return removed;
-  }
-};
-function clampLimit(value, fallback, max, label) {
-  if (value === void 0) return fallback;
-  if (!Number.isFinite(value) || !Number.isInteger(value) || value < 1 || value > max) {
-    throw new WearablesInputError(
-      `invalid ${label} '${value}' \u2014 expected an integer between 1 and ${max}`
-    );
-  }
-  return value;
-}
-function locateTranscriptPath(hitPath) {
-  const normalized = hitPath.replace(/\\/g, "/");
-  const match = normalized.match(
-    /(?:^|\/)wearables\/([a-z][a-z0-9-]{0,63})\/(\d{4}-\d{2}-\d{2})\.md$/
-  );
-  if (!match) return null;
-  if (!isValidTranscriptDate(match[2])) return null;
-  return { source: match[1], date: match[2] };
-}
-function extractSnippet(body, index, matchLength) {
-  const start = Math.max(0, index - 80);
-  const end = Math.min(body.length, index + matchLength + 80);
-  const prefix = start > 0 ? "\u2026" : "";
-  const suffix = end < body.length ? "\u2026" : "";
-  return `${prefix}${body.slice(start, end).replace(/\s+/g, " ").trim()}${suffix}`;
-}
-
-// src/namespaces/catalog.ts
-import path2 from "path";
-import { randomUUID } from "crypto";
-import {
-  appendFile,
-  lstat,
-  mkdir as mkdir2,
-  open,
-  readdir,
-  readFile as readFile2,
-  realpath,
-  rename,
-  stat,
-  unlink,
-  utimes,
-  writeFile as writeFile2
-} from "fs/promises";
-var NAMESPACE_KINDS = [
-  "default",
-  "self",
-  "shared",
-  "project",
-  "branch",
-  "team-project",
-  "explicit",
-  "legacy"
-];
-var NAMESPACE_DISCOVERY_SOURCES = [
-  "config",
-  "write",
-  "read",
-  "scan",
-  "migration"
-];
-var CATALOG_FILE = "namespaces.jsonl";
-var STATE_DIR = "state";
-var REBUILD_LOCK_FILE = "namespaces.rebuild.lock";
-var REBUILD_LOCK_STALE_MS = 3e4;
-var REBUILD_LOCK_MAX_WAIT_MS = 5e3;
-var REBUILD_LOCK_POLL_MS = 50;
-var REBUILD_LOCK_HEARTBEAT_MS = 1e4;
-var MEMORY_DATA_CHILDREN = [
-  ...ALL_CATEGORY_DIRS,
-  "entities",
-  "artifacts",
-  "identity",
-  "config",
-  "summaries",
-  "profile.md",
-  "state"
-];
-function isCatalogEnabled(config) {
-  if (config.namespacesEnabled !== true) return false;
-  return config.namespaceCatalogEnabled !== false;
-}
-var FILE_MEMORY_DATA_CHILDREN = /* @__PURE__ */ new Set(["profile.md"]);
-function isNotFoundError(err) {
-  return typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
-}
-async function inspectMemoryDataMarker(rootDir, child) {
-  const childPath = path2.join(rootDir, child);
-  let entry;
-  try {
-    entry = await lstat(childPath);
-  } catch (err) {
-    return isNotFoundError(err) ? { state: "absent" } : { state: "invalid", detail: `${child}: ${err instanceof Error ? err.message : String(err)}` };
-  }
-  if (entry.isSymbolicLink()) return { state: "invalid", detail: `${child}: symlink` };
-  if (FILE_MEMORY_DATA_CHILDREN.has(child)) {
-    return entry.isFile() ? { state: "valid" } : { state: "invalid", detail: `${child}: expected file` };
-  }
-  if (!entry.isDirectory()) return { state: "invalid", detail: `${child}: expected directory` };
-  try {
-    const rootReal = await realpath(rootDir);
-    const childReal = await realpath(childPath);
-    return isPathInside(rootReal, childReal) ? { state: "valid" } : { state: "invalid", detail: `${child}: escapes namespace root` };
-  } catch (err) {
-    return { state: "invalid", detail: `${child}: ${err instanceof Error ? err.message : String(err)}` };
-  }
-}
-async function inspectMemoryDataRoot(rootDir) {
-  let hasData = false;
-  for (const child of MEMORY_DATA_CHILDREN) {
-    const marker = await inspectMemoryDataMarker(rootDir, child);
-    if (marker.state === "invalid") {
-      return { hasData: false, invalidMarker: marker.detail };
-    }
-    if (marker.state === "valid") {
-      hasData = true;
-    }
-  }
-  return { hasData };
-}
-async function hasMemoryData(rootDir) {
-  return (await inspectMemoryDataRoot(rootDir)).hasData;
-}
-function isValidIsoTimestamp(value) {
-  const ms = Date.parse(value);
-  return Number.isFinite(ms);
-}
-function isNamespaceKind(value) {
-  return typeof value === "string" && NAMESPACE_KINDS.includes(value);
-}
-function isNamespaceDiscoverySource(value) {
-  return typeof value === "string" && NAMESPACE_DISCOVERY_SOURCES.includes(value);
-}
-function coerceRecord(value) {
-  if (typeof value !== "object" || value === null) return null;
-  const v = value;
-  if (typeof v.namespace !== "string") return null;
-  const namespace = normalizeNamespaceIdentity(v.namespace);
-  if (namespace.length === 0) return null;
-  if (typeof v.identityToken !== "string" || v.identityToken.length === 0) return null;
-  const expectedIdentityToken = namespaceIdentityToken(namespace);
-  if (v.identityToken !== expectedIdentityToken) return null;
-  if (typeof v.storageDir !== "string" || v.storageDir.length === 0) return null;
-  if (typeof v.createdAt !== "string" || v.createdAt.length === 0) return null;
-  if (!isValidIsoTimestamp(v.createdAt)) return null;
-  const kind = v.kind === void 0 ? "explicit" : isNamespaceKind(v.kind) ? v.kind : null;
-  if (!kind) return null;
-  const discoveredBy = v.discoveredBy === void 0 ? "scan" : isNamespaceDiscoverySource(v.discoveredBy) ? v.discoveredBy : null;
-  if (!discoveredBy) return null;
-  const record = {
-    namespace,
-    identityToken: expectedIdentityToken,
-    kind,
-    createdAt: v.createdAt,
-    storageDir: v.storageDir,
-    discoveredBy
-  };
-  if (typeof v.principal === "string") record.principal = v.principal;
-  if (typeof v.projectId === "string") record.projectId = v.projectId;
-  if (typeof v.branch === "string") record.branch = v.branch;
-  if (typeof v.parentNamespace === "string") record.parentNamespace = v.parentNamespace;
-  if (typeof v.lastReadAt === "string" && isValidIsoTimestamp(v.lastReadAt)) {
-    record.lastReadAt = v.lastReadAt;
-  }
-  if (typeof v.lastWriteAt === "string" && isValidIsoTimestamp(v.lastWriteAt)) {
-    record.lastWriteAt = v.lastWriteAt;
-  }
-  if (v.lastMaintenanceAt && typeof v.lastMaintenanceAt === "object") {
-    const out = {};
-    for (const [k, val] of Object.entries(v.lastMaintenanceAt)) {
-      if (typeof val === "string" && isValidIsoTimestamp(val)) out[k] = val;
-    }
-    if (Object.keys(out).length > 0) record.lastMaintenanceAt = out;
-  }
-  return record;
-}
-function laterIso(a, b) {
-  if (!a) return b;
-  if (!b) return a;
-  const am = Date.parse(a);
-  const bm = Date.parse(b);
-  if (!Number.isFinite(am)) return b;
-  if (!Number.isFinite(bm)) return a;
-  return bm > am ? b : a;
-}
-function mergeNewerTouchFields(base, fresh) {
-  const merged = { ...base };
-  const lr = laterIso(base.lastReadAt, fresh.lastReadAt);
-  if (lr) merged.lastReadAt = lr;
-  const lw = laterIso(base.lastWriteAt, fresh.lastWriteAt);
-  if (lw) merged.lastWriteAt = lw;
-  if (base.lastMaintenanceAt || fresh.lastMaintenanceAt) {
-    const jobs = { ...base.lastMaintenanceAt ?? {} };
-    for (const [job, ts] of Object.entries(fresh.lastMaintenanceAt ?? {})) {
-      const latest = laterIso(jobs[job], ts);
-      if (latest) jobs[job] = latest;
-    }
-    if (Object.keys(jobs).length > 0) merged.lastMaintenanceAt = jobs;
-  }
-  return merged;
-}
-function serializeRecord(record) {
-  const ordered = {};
-  const source = record;
-  for (const key of Object.keys(source).sort()) {
-    const value = source[key];
-    if (value === void 0) continue;
-    if (key === "lastMaintenanceAt" && value && typeof value === "object") {
-      const sortedJobs = {};
-      for (const jobKey of Object.keys(value).sort()) {
-        sortedJobs[jobKey] = value[jobKey];
-      }
-      ordered[key] = sortedJobs;
-      continue;
-    }
-    ordered[key] = value;
-  }
-  return JSON.stringify(ordered);
-}
-function inferKind(namespace, config) {
-  if (namespace === normalizeNamespaceIdentity(config.defaultNamespace)) return "default";
-  if (namespace === normalizeNamespaceIdentity(config.sharedNamespace)) return "shared";
-  if (config.namespacePolicies.some((p) => normalizeNamespaceIdentity(p.name) === namespace)) {
-    return "explicit";
-  }
-  if (/-branch-|^project-[^-]+-branch-/.test(namespace) || namespace.includes("-branch-")) {
-    return "branch";
-  }
-  if (/^team-.*-project-/.test(namespace) || /^team-.*project-/.test(namespace)) {
-    return "team-project";
-  }
-  if (/^project-/.test(namespace) || /-project-/.test(namespace)) {
-    return "project";
-  }
-  return "explicit";
-}
-var NamespaceCatalog = class {
-  constructor(config) {
-    this.config = config;
-    this.memoryDir = config.memoryDir;
-    this.stateDir = path2.join(this.memoryDir, STATE_DIR);
-    this.catalogPath = path2.join(this.stateDir, CATALOG_FILE);
-    this.rebuildLockPath = path2.join(this.stateDir, REBUILD_LOCK_FILE);
-    this.defaultNamespaceIdentity = normalizeNamespaceIdentity(config.defaultNamespace);
-  }
-  config;
-  memoryDir;
-  stateDir;
-  catalogPath;
-  rebuildLockPath;
-  // Per-INSTANCE lock owner id (round 6, codex P2 — NBsGP). The rebuild lock
-  // file records this id, not just `process.pid`, so two NamespaceCatalog
-  // instances in the SAME process sharing a memoryDir are NOT mistaken for each
-  // other: a touch on instance B must still wait for instance A's rebuild lock
-  // (different owner id, same PID) instead of skipping as "self-held".
-  lockOwnerId = randomUUID();
-  // Serialized write chain that recovers from rejection (CLAUDE.md rule #40)
-  // so a single failed append cannot permanently poison subsequent writes.
-  writeChain = Promise.resolve();
-  // Test-only seam (round 7 — NEZkA): fires inside a touch's HELD-lock critical
-  // section, after the lock is acquired but BEFORE the read→merge→append. A
-  // deterministic concurrency test installs a hook here to widen the (otherwise
-  // microscopic) window and prove that a cross-process rebuild CANNOT run its
-  // load→rename while a touch holds the lock. Never set in production code.
-  onTouchCriticalSectionForTest;
-  // Test-only seam (round 7 — NEZkA): fires inside a mutating rebuild's HELD-lock
-  // critical section, after the final cross-process re-merge `loadCompacted()` and
-  // BEFORE the atomic `rename()`. This is the EXACT window in which a check-then-
-  // append touch (the old bug) would clobber its append. A deterministic test
-  // installs a hook here to attempt a cross-instance touch in this window and
-  // assert the held mutex blocks it. Never set in production code.
-  onRebuildBeforeRenameForTest;
-  // Test-only seam (NFgCT, codex P2): fires AFTER the lockless disk scan but
-  // BEFORE the rebuild acquires the cross-process file lock for its final
-  // load→merge→rename window. A deterministic test installs a hook here to attempt
-  // a cross-instance touch DURING the scan window and assert it is NOT blocked or
-  // dropped — proving the scan no longer holds the mutex. Never set in production.
-  onRebuildAfterScanForTest;
-  // Test-only seam (NG7Bg, codex P2): fires inside `breakStaleRebuildLock` AFTER it
-  // has judged the lock stale and captured its identity, but BEFORE the final
-  // re-validation+unlink. A deterministic test installs a hook here to REPLACE the
-  // lock file (a fresh holder created a new lock in the race window) and assert the
-  // break is skipped — the replacement's active lock is not deleted. Never set in
-  // production.
-  onBeforeBreakStaleUnlinkForTest;
-  // Normalized (trimmed) default namespace identity (NH-FH, cursor Medium).
-  // Catalog records key namespaces by their NORMALIZED identity
-  // (`normalizeNamespaceIdentity`), but several default-namespace exemptions and
-  // memoryDir-ownership checks compared against the RAW `config.defaultNamespace`.
-  // If the configured default name carries surrounding whitespace the record key
-  // is trimmed while the comparison string is not, so the default row is
-  // misclassified, dropped at read time, or given the wrong storage root. Compare
-  // against this normalized form everywhere instead.
-  defaultNamespaceIdentity;
-  /** Whether the catalog is active (namespaces enabled and catalog not opted out). */
-  get enabled() {
-    return isCatalogEnabled(this.config);
-  }
-  // ── Public enumeration API ──────────────────────────────────────────────
-  /**
-   * Sanitize a record at the enumeration boundary (round 5, cursor Medium + codex
-   * P2; round 6 — NDXHe). Reads return whatever is in `namespaces.jsonl` after
-   * schema checks only, so a tampered or pre-fix row could surface unsafe data to
-   * maintenance/QMD until a rewrite occurs. Two distinct defenses:
-   *
-   *  1. UNSAFE NAMESPACE NAME (NGZqr, codex P2): an unsafe non-default namespace
-   *     (e.g. `../evil`, a name with separators, or >64 chars) is REJECTED outright
-   *     — return `null` so the caller drops it. The disk SCAN and the hot touch
-   *     path both reject such names with the SAME default-exempt `isSafeRouteNamespace`
-   *     gate, so the read boundary MUST agree, or `listNamespaces()`/`getNamespaceRecord()`
-   *     would expose a namespace those paths reject (note `isStorageDirForNamespace`
-   *     can still build a tokenized root even for `../evil`, so storageDir sanitation
-   *     alone does not catch it). The default namespace is exempt (it may be a
-   *     non-route literal), matching every other validation site.
-   *
-   *  2. UNSAFE storageDir: for an otherwise-valid namespace, apply the SAME contract
-   *     as the write path — full containment (`isContainedStorageDir`: lexical +
-   *     symlink/realpath) AND namespace ownership (`isStorageDirForNamespace`). When
-   *     a record fails EITHER check we substitute the trusted resolved-and-safe root
-   *     for that namespace (rule 42: read and write stay symmetric).
-   */
-  async sanitizeRecordForRead(record) {
-    if (record.namespace !== this.defaultNamespaceIdentity && !isSafeRouteNamespace(record.namespace)) {
-      return null;
-    }
-    if (await this.isContainedStorageDir(record.storageDir) && await this.isStorageDirForNamespace(record.namespace, record.storageDir)) {
-      return record;
-    }
-    const safe = await this.resolveSafeStorageDir(record.namespace);
-    return { ...record, storageDir: safe };
-  }
-  storageRootOwnershipRank(record, resolvedStorageDir, configured) {
-    if (resolvedStorageDir === path2.resolve(this.memoryDir)) {
-      return record.namespace === this.defaultNamespaceIdentity ? 0 : 3;
-    }
-    const leaf = path2.basename(resolvedStorageDir);
-    const tokenOwnsRoot = namespaceIdentityToken(record.namespace) === leaf;
-    if (tokenOwnsRoot && configured.has(record.namespace)) {
-      return 0;
-    }
-    if (record.namespace === leaf) return 1;
-    if (tokenOwnsRoot) return 2;
-    return 3;
-  }
-  configuredNamespaceIdentities() {
-    return new Set(
-      [
-        this.config.defaultNamespace,
-        this.config.sharedNamespace,
-        ...this.config.namespacePolicies.map((p) => p.name)
-      ].map((n) => normalizeNamespaceIdentity(n)).filter((n) => n.length > 0)
-    );
-  }
-  preferStorageRootOwner(current, candidate, resolvedStorageDir, configured) {
-    const currentRank = this.storageRootOwnershipRank(current, resolvedStorageDir, configured);
-    const candidateRank = this.storageRootOwnershipRank(candidate, resolvedStorageDir, configured);
-    if (candidateRank < currentRank) return candidate;
-    if (candidateRank > currentRank) return current;
-    const byName = candidate.namespace.localeCompare(current.namespace);
-    if (byName < 0) return candidate;
-    if (byName > 0) return current;
-    return candidate.identityToken.localeCompare(current.identityToken) < 0 ? candidate : current;
-  }
-  dropDuplicateStorageRootAliases(records) {
-    const byStorageDir = /* @__PURE__ */ new Map();
-    const configured = this.configuredNamespaceIdentities();
-    for (const record of records) {
-      const resolvedStorageDir = path2.resolve(record.storageDir);
-      const current = byStorageDir.get(resolvedStorageDir);
-      if (!current) {
-        byStorageDir.set(resolvedStorageDir, record);
-        continue;
-      }
-      const owner = this.preferStorageRootOwner(current, record, resolvedStorageDir, configured);
-      const alias = owner === current ? record : current;
-      byStorageDir.set(resolvedStorageDir, mergeNewerTouchFields(owner, alias));
-    }
-    return [...byStorageDir.values()];
-  }
-  async loadSanitizedRecords() {
-    const records = await this.loadCompacted();
-    const sanitized = await Promise.all(
-      [...records.values()].map((r) => this.sanitizeRecordForRead(r))
-    );
-    return this.dropDuplicateStorageRootAliases(
-      sanitized.filter((r) => r !== null)
-    );
-  }
-  async listNamespaces(filter) {
-    if (!this.enabled) return [];
-    let out = await this.loadSanitizedRecords();
-    if (filter?.kind) out = out.filter((r) => r.kind === filter.kind);
-    if (filter?.discoveredBy) out = out.filter((r) => r.discoveredBy === filter.discoveredBy);
-    if (filter?.writtenSince) {
-      const sinceMs = filter.writtenSince.getTime();
-      out = out.filter((r) => {
-        if (!r.lastWriteAt) return false;
-        const ms = Date.parse(r.lastWriteAt);
-        return Number.isFinite(ms) && ms >= sinceMs;
-      });
-    }
-    return out.sort((a, b) => {
-      const byName = a.namespace.localeCompare(b.namespace);
-      if (byName !== 0) return byName;
-      return a.identityToken.localeCompare(b.identityToken);
-    });
-  }
-  async getNamespaceRecord(namespace) {
-    if (!this.enabled) return null;
-    const ns = normalizeNamespaceIdentity(namespace);
-    return (await this.loadSanitizedRecords()).find((record) => record.namespace === ns) ?? null;
-  }
-  // ── Touch API (cheap, failure-tolerant) ─────────────────────────────────
-  async markRead(namespace, metadata) {
-    await this.touch(namespace, "read", metadata);
-  }
-  async markWrite(namespace, metadata) {
-    await this.touch(namespace, "write", metadata);
-  }
-  async markMaintenance(namespace, jobName, at) {
-    if (typeof jobName !== "string" || jobName.trim().length === 0) {
-      throw new Error("markMaintenance requires a non-empty jobName");
-    }
-    await this.touch(namespace, "maintenance", { at }, jobName.trim());
-  }
-  /**
-   * Register namespaces known purely from config (default, shared, explicit
-   * policies). Source `config`. Cheap and idempotent.
-   */
-  async registerConfiguredNamespaces() {
-    if (!this.enabled) return;
-    const names = /* @__PURE__ */ new Set([
-      this.config.defaultNamespace,
-      this.config.sharedNamespace,
-      ...this.config.namespacePolicies.map((p) => p.name)
-    ]);
-    for (const ns of names) {
-      if (!ns) continue;
-      if (normalizeNamespaceIdentity(ns) !== this.defaultNamespaceIdentity && !isSafeRouteNamespace(ns)) {
-        continue;
-      }
-      try {
-        await this.register(ns, { discoveredBy: "config" });
-      } catch {
-      }
-    }
-  }
-  /**
-   * Register a namespace whose storage was just resolved by the router. Used as
-   * the router's integration hook (`discoveredBy: config`). Storage dir is
-   * provided so we do not re-resolve it. Failure-tolerant. Returns whether the
-   * registration actually APPENDED (round 6, codex P2 — NEFoX), so the router's
-   * resolve-hook dedup only marks a namespace notified when it truly persisted —
-   * a dropped append (disabled catalog or rebuild-lock-timeout drop) returns
-   * `false` and is retried on the next resolve.
-   */
-  async registerResolved(namespace, storageDir) {
-    if (!this.enabled) return false;
-    return this.register(namespace, { discoveredBy: "config", storageDir });
-  }
-  /**
-   * Generic register/touch without changing read/write timestamps unless the
-   * source implies it. Validates the namespace and resolves a storage dir.
-   * Returns whether the touch actually appended.
-   */
-  async register(namespace, metadata) {
-    return this.touch(namespace, "register", metadata);
-  }
-  validateNamespace(namespace) {
-    const ns = normalizeNamespaceIdentity(namespace);
-    if (ns.length === 0) throw new Error("empty namespace");
-    if (ns !== this.defaultNamespaceIdentity && !isSafeRouteNamespace(ns)) {
-      throw new Error(`unsafe namespace: ${ns}`);
-    }
-    return ns;
-  }
-  /**
-   * Resolve the on-disk storage dir for a namespace WITHOUT trusting caller
-   * input. The default namespace may use the legacy memoryDir root; everything
-   * else lives under `<memoryDir>/namespaces/<token>`. Containment is enforced
-   * by rejecting separators/parent-refs in the token.
-   */
-  resolveStorageDir(namespace) {
-    if (normalizeNamespaceIdentity(namespace) === this.defaultNamespaceIdentity) {
-      return this.memoryDir;
-    }
-    const token = namespaceIdentityToken(namespace);
-    return this.namespaceTokenDir(token);
-  }
-  namespaceTokenDir(token) {
-    if (token.length === 0 || token.includes("/") || token.includes("\\") || token.includes("..") || path2.isAbsolute(token)) {
-      throw new Error(`unsafe namespace token: ${token}`);
-    }
-    return path2.join(this.memoryDir, "namespaces", token);
-  }
-  /**
-   * Whether a candidate storage dir is LEXICALLY contained: it is either the
-   * legacy default root (`memoryDir`) or a strict descendant of
-   * `<memoryDir>/namespaces/`. The router legitimately resolves a namespace to
-   * EITHER the tokenized dir or a legacy raw-name dir under `namespaces/`, so we
-   * accept any contained child rather than a single exact token path. This is a
-   * pure string check — symlink escape is checked separately via realpath.
-   */
-  isLexicallyContained(candidate) {
-    const resolved = path2.resolve(candidate);
-    if (resolved === path2.resolve(this.memoryDir)) return true;
-    const nsBase = path2.resolve(path2.join(this.memoryDir, "namespaces"));
-    const rel = path2.relative(nsBase, resolved);
-    return rel.length > 0 && !rel.startsWith("..") && !path2.isAbsolute(rel);
-  }
-  /**
-   * Whether a candidate storage dir satisfies the catalog containment contract,
-   * including SYMLINK-escape rejection (round 5, codex P2). A lexically-contained
-   * path that is actually a symlink to an outside directory would let maintenance
-   * or QMD follow it outside `memoryDir`. We mirror `rebuildFromDisk`'s posture:
-   * the path must be lexically contained AND, if it exists on disk, neither the
-   * path itself a symlink nor its realpath escaping the memory root. Non-existent
-   * paths pass the realpath stage (nothing to follow yet) but still must be
-   * lexically contained.
-   */
-  async isContainedStorageDir(candidate) {
-    if (!this.isLexicallyContained(candidate)) return false;
-    if (path2.resolve(candidate) === path2.resolve(this.memoryDir)) return true;
-    let memoryReal;
-    try {
-      memoryReal = await realpath(this.memoryDir);
-    } catch {
-      memoryReal = path2.resolve(this.memoryDir);
-    }
-    if (await this.hasSymlinkedAncestor(candidate)) return false;
-    try {
-      const stat4 = await lstat(candidate);
-      if (stat4.isSymbolicLink()) return false;
-      if (!stat4.isDirectory()) return false;
-    } catch {
-      return this.isNearestExistingAncestorContained(candidate, memoryReal);
-    }
-    try {
-      const real = await realpath(candidate);
-      return isPathInside(memoryReal, real);
-    } catch {
-      return false;
-    }
-  }
-  /**
-   * Reject a candidate whose path crosses a SYMLINKED ancestor strictly between
-   * memoryDir and the leaf (codex NVuq5). `realpath`-based containment accepts a
-   * symlinked `<memoryDir>/namespaces` that currently resolves back inside
-   * memoryDir, but the disk scanner rejects such a root and a later retarget would
-   * escape the memory tree — so refuse it here too. The leaf itself is
-   * symlink-checked by the caller; this walks only the intermediate ancestors.
-   */
-  async hasSymlinkedAncestor(candidate) {
-    const stopAt = path2.resolve(this.memoryDir);
-    let dir = path2.dirname(path2.resolve(candidate));
-    const root = path2.parse(dir).root;
-    while (dir !== stopAt && dir !== root && dir !== path2.dirname(dir)) {
-      try {
-        if ((await lstat(dir)).isSymbolicLink()) return true;
-      } catch {
-      }
-      dir = path2.dirname(dir);
-    }
-    return false;
-  }
-  /**
-   * Walk up from a not-yet-existing candidate to the nearest ancestor that exists
-   * on disk and verify its realpath stays inside `memoryReal` (round 6, codex P2
-   * — NDo79). Rejects a non-existent leaf whose existing parent chain escapes
-   * memoryDir via a symlink. Stops at memoryDir's resolved root.
-   *
-   * The nearest existing ancestor must also be a DIRECTORY (NHIdt, codex P2): if
-   * an existing parent such as `<memoryDir>/namespaces` is a regular FILE (or
-   * socket/fifo), `realpath(parent)` still succeeds and resolves inside memoryDir,
-   * so a containment-only check would ACCEPT a leaf that can never be created — you
-   * cannot mkdir a child under a file. We `lstat` the nearest existing ancestor and
-   * reject when it is not a directory, mirroring the leaf non-directory rejection
-   * (NF21i) and the disk scan, so every containment consumer agrees.
-   */
-  async isNearestExistingAncestorContained(candidate, memoryReal) {
-    let dir = path2.resolve(candidate);
-    const root = path2.parse(dir).root;
-    for (; ; ) {
-      const parent = path2.dirname(dir);
-      if (parent === dir || dir === root) return false;
-      let real;
-      try {
-        real = await realpath(parent);
-      } catch {
-        dir = parent;
-        continue;
-      }
-      if (!(isPathInside(memoryReal, real) || real === memoryReal)) return false;
-      try {
-        const stat4 = await lstat(real);
-        return stat4.isDirectory();
-      } catch {
-        return false;
-      }
-    }
-  }
-  /**
-   * Resolve the storage dir to persist for a touch, validating any caller-
-   * provided `metadata.storageDir` against the catalog containment contract
-   * (round 4 + round 5, codex P2). `markWrite`/`registerResolved` accept an
-   * explicit storageDir, but persisting it verbatim would let a bad hook or
-   * external consumer write an arbitrary path — including one outside `memoryDir`
-   * or a symlink that escapes it — into the catalog, handing maintenance/QMD an
-   * unsafe root. We accept an explicit (or previously-stored) dir ONLY when it
-   * stays contained under memoryDir (lexically AND via realpath); otherwise we
-   * drop it and fall back to the trusted resolved dir.
-   */
-  async resolveTouchStorageDir(namespace, explicit, existingDir) {
-    if (explicit !== void 0 && await this.isContainedStorageDir(explicit) && await this.isStorageDirForNamespace(namespace, explicit)) {
-      return explicit;
-    }
-    if (existingDir !== void 0 && await this.isContainedStorageDir(existingDir) && await this.isStorageDirForNamespace(namespace, existingDir)) {
-      return existingDir;
-    }
-    return this.resolveSafeStorageDir(namespace);
-  }
-  /**
-   * Whether `candidate` is a legitimate storage root FOR `namespace` (round 6,
-   * codex P2 — NDATT). Accepts the namespace's router-resolved root, its canonical
-   * lexical tokenized dir, and (for the default namespace only) memoryDir. This
-   * prevents a contained-but-CROSS-NAMESPACE path — another namespace's tree, or
-   * memoryDir for a non-default namespace — from being persisted as this
-   * namespace's root. Compared on resolved (absolute) paths.
-   */
-  async isStorageDirForNamespace(namespace, candidate) {
-    const resolvedCandidate = path2.resolve(candidate);
-    const valid = /* @__PURE__ */ new Set();
-    try {
-      valid.add(path2.resolve(this.namespaceTokenDir(namespaceIdentityToken(namespace))));
-    } catch {
-    }
-    try {
-      valid.add(path2.resolve(this.namespaceTokenDir(namespace)));
-    } catch {
-    }
-    try {
-      valid.add(path2.resolve(await resolveNamespaceStorageRoot(this.config, namespace)));
-    } catch {
-    }
-    if (normalizeNamespaceIdentity(namespace) === this.defaultNamespaceIdentity) {
-      valid.add(path2.resolve(this.memoryDir));
-      try {
-        valid.add(path2.resolve(await resolveDefaultNamespaceRoot(this.config)));
-      } catch {
-      }
-    }
-    return valid.has(resolvedCandidate);
-  }
-  /**
-   * Resolve the canonical storage dir for a namespace as the LIVE ROUTER would,
-   * but NEVER return a path that escapes the memory root.
-   *
-   * Router alignment (round 4, cursor Medium): a read/register touch with no
-   * explicit storageDir previously used the lexical `resolveStorageDir`, which
-   * always picks `<memoryDir>/namespaces/<token>` (or `memoryDir` for the
-   * default). That diverges from `NamespaceStorageRouter`, which can route to a
-   * legacy raw-name dir or a migrated default root — so a recall touch could
-   * record a contained-but-WRONG root that maintenance/rebuild then targets. We
-   * now delegate to the shared `resolveNamespaceStorageRoot` (the very helper the
-   * router uses) so the catalog records the same on-disk root the router serves.
-   *
-   * Containment (round 5, codex P2): the resolved path can still be a symlink
-   * escaping memoryDir, so we run the full (lexical + realpath) containment
-   * contract. When it FAILS we fall back to a NAMESPACE-SPECIFIC safe root, NOT
-   * a blanket `memoryDir`. Recording `memoryDir` for a non-default namespace
-   * would point enumeration/maintenance at the DEFAULT namespace's tree (round 5,
-   * cursor/codex Medium/P2) — a cross-namespace fanout error. The correct safe
-   * root is the namespace's own lexical tokenized dir
-   * (`<memoryDir>/namespaces/<token>`), which is always contained and is that
-   * namespace's canonical location (we record the lexical PATH as metadata; we do
-   * not follow the escaping symlink). Only the default namespace — or a token so
-   * unsafe even the lexical dir cannot be built — falls back to `memoryDir`.
-   */
-  async resolveSafeStorageDir(namespace) {
-    let resolved;
-    try {
-      resolved = await resolveNamespaceStorageRoot(this.config, namespace);
-    } catch {
-      return this.safeFallbackStorageDir(namespace);
-    }
-    if (await this.isContainedStorageDir(resolved)) return resolved;
-    return this.safeFallbackStorageDir(namespace);
-  }
-  /**
-   * The namespace-specific contained fallback root, used when the router-resolved
-   * root fails containment (round 5, cursor/codex Medium/P2).
-   *
-   * Preference order:
-   *  1. The namespace's OWN lexical tokenized dir (`namespaces/<token>`) — so a
-   *     non-default namespace is NOT pointed at the DEFAULT namespace's `memoryDir`
-   *     tree (which would misdirect maintenance fanout). Returned only when the
-   *     token dir itself stays CONTAINED (it is not a symlink, and its realpath
-   *     does not escape memoryDir — e.g. via a symlinked `namespaces/` parent).
-   *  2. `memoryDir` as a LAST resort — for the default namespace, an unsafe token
-   *     that cannot build a contained path, OR the irreparable case where the
-   *     token dir's realpath escapes the root (so even its lexical path resolves
-   *     outside). NF21m note (codex P2): we deliberately do NOT record the lexical
-   *     token dir in that irreparable case — its realpath escapes memoryDir, and
-   *     the NDo79 contract REQUIRES that an escaping path is never persisted (a
-   *     later mkdir/maintenance/QMD op would follow it outside the root). Since no
-   *     contained namespace-specific path exists, containment wins: `memoryDir` is
-   *     the only safe root left. A namespace whose token dir's realpath escapes is
-   *     an irreparable on-disk state; recording the contained default root is
-   *     strictly safer than persisting an escaping one. The common case where the
-   *     token dir IS contained is handled by branch 1, so a healthy non-default
-   *     namespace never reaches `memoryDir`.
-   */
-  async safeFallbackStorageDir(namespace) {
-    if (normalizeNamespaceIdentity(namespace) === this.defaultNamespaceIdentity) return this.memoryDir;
-    let tokenDir;
-    try {
-      tokenDir = this.namespaceTokenDir(namespaceIdentityToken(namespace));
-    } catch {
-      return this.memoryDir;
-    }
-    if (await this.isContainedStorageDir(tokenDir)) return tokenDir;
-    return this.memoryDir;
-  }
-  /**
-   * Re-check, NOW, whether a namespace's storage root currently EXISTS on disk
-   * with the SAME safety the directory scan uses (NFJV8, codex P2).
-   *
-   * The rebuild's final re-merge runs under the held lock and folds the freshly
-   * re-read log (`latest`) into the scanned `rebuilt` set. A namespace present in
-   * `latest` (a live touch row) but ABSENT from `rebuilt` is normally PURGED as
-   * deleted (the NATqU "disk scan is authoritative" rule). But there is a TOCTOU
-   * window: a dynamic namespace can be CREATED on disk AFTER `rebuildFromDisk()`
-   * already enumerated `namespaces/` but BEFORE this re-merge. The scan snapshot
-   * missed its new root, yet a gateway `markWrite` already appended a row for it.
-   * Blindly purging that row would rewrite the catalog WITHOUT a live namespace
-   * that now has data on disk, so `writtenSince`/maintenance/QMD consumers miss
-   * it until another touch or rebuild.
-   *
-   * So before purging, we re-resolve the namespace's safe storage root (the same
-   * router-aligned, containment-checked path the scan would have catalogued) and
-   * confirm it is a real, contained, non-symlink directory that actually holds
-   * memory data RIGHT NOW. If so the namespace was created-after-scan and is LIVE
-   * — KEEP its row. This is the precise inverse of NATqU and does NOT reintroduce
-   * it: a touch on a REMOVED root re-checks as ABSENT (no data on disk) and is
-   * still purged; only a root that EXISTS on a fresh re-check is kept.
-   *
-   * Mirrors the per-entry scan checks (symlink rejection + realpath containment +
-   * `hasMemoryData`) so a symlinked/escaping root is never resurrected.
-   */
-  async liveStorageRootExistsForRebuild(namespace, memoryReal) {
-    let root;
-    try {
-      root = await this.resolveSafeStorageDir(namespace);
-    } catch {
-      return false;
-    }
-    if (normalizeNamespaceIdentity(namespace) !== this.defaultNamespaceIdentity && path2.resolve(root) === path2.resolve(this.memoryDir)) {
-      return false;
-    }
-    let stat4;
-    try {
-      stat4 = await lstat(root);
-    } catch {
-      return false;
-    }
-    if (stat4.isSymbolicLink()) return false;
-    if (!stat4.isDirectory()) return false;
-    try {
-      const real = await realpath(root);
-      if (memoryReal && !isPathInside(memoryReal, real)) return false;
-    } catch {
-      return false;
-    }
-    return hasMemoryData(root);
-  }
-  /**
-   * Record a namespace touch. Returns whether the touch actually APPENDED to the
-   * log (round 6, codex P2 — NEFoX): a disabled catalog or a dropped append (the
-   * NAUf7 rebuild-lock-timeout drop) returns `false`, so callers (e.g. the router
-   * resolve-hook dedup) can avoid marking a dropped registration as completed and
-   * suppressing its retry.
-   */
-  async touch(namespace, kind, metadata, jobName) {
-    if (!this.enabled) return false;
-    const ns = this.validateNamespace(namespace);
-    const nowIso = (metadata?.at ?? /* @__PURE__ */ new Date()).toISOString();
-    return this.queueCritical(
-      async () => this.withHeldCatalogLock(async (acquired) => {
-        if (!acquired) return false;
-        if (this.onTouchCriticalSectionForTest) {
-          await this.onTouchCriticalSectionForTest();
-        }
-        const records = await this.loadCompacted();
-        const existing = records.get(ns);
-        const storageDir = await this.resolveTouchStorageDir(
-          ns,
-          metadata?.storageDir,
-          existing?.storageDir
-        );
-        const record = existing ? { ...existing } : {
-          namespace: ns,
-          identityToken: namespaceIdentityToken(ns),
-          kind: metadata?.kind ?? inferKind(ns, this.config),
-          createdAt: nowIso,
-          storageDir,
-          discoveredBy: metadata?.discoveredBy ?? (kind === "register" ? "config" : kind === "maintenance" ? "scan" : kind)
-        };
-        record.storageDir = storageDir;
-        if (metadata?.kind) record.kind = metadata.kind;
-        if (metadata?.principal !== void 0) record.principal = metadata.principal;
-        if (metadata?.projectId !== void 0) record.projectId = metadata.projectId;
-        if (metadata?.branch !== void 0) record.branch = metadata.branch;
-        if (metadata?.parentNamespace !== void 0)
-          record.parentNamespace = metadata.parentNamespace;
-        if (kind === "write" && existing && record.discoveredBy === "config") {
-          record.discoveredBy = "write";
-        }
-        if (kind === "read") record.lastReadAt = nowIso;
-        if (kind === "write") record.lastWriteAt = nowIso;
-        if (kind === "maintenance" && jobName) {
-          record.lastMaintenanceAt = { ...record.lastMaintenanceAt ?? {}, [jobName]: nowIso };
-        }
-        await this.appendUnchained(record);
-        return true;
-      })
-    );
-  }
-  // ── Rebuild from disk ────────────────────────────────────────────────────
-  async rebuildFromDisk(options) {
-    const dryRun = options?.dryRun === true;
-    if (!this.enabled) {
-      return { dryRun, records: [], skipped: [], applied: false };
-    }
-    if (dryRun) {
-      return this.queueCritical(async () => this.rebuildInsideChain(dryRun, false));
-    }
-    return this.queueCritical(async () => this.rebuildInsideChain(dryRun, true));
-  }
-  /**
-   * Body of `rebuildFromDisk`, run inside a single `queueCritical` turn. MUST
-   * only be invoked from within the serialized chain so the load and the
-   * rewrite are atomic with respect to concurrent touches (in-process).
-   *
-   * `wantMutate` is true for an `--apply` (the caller intends to rewrite). The
-   * cross-process file lock is acquired LATE — only around the final
-   * load→merge→rename window (NFgCT, codex P2) — never across the disk scan, so a
-   * long scan does not force concurrent gateway touches to wait (and drop their
-   * append). Whether the rewrite actually happened is reported via the result's
-   * `applied`: true only when `wantMutate` AND the lock was acquired.
-   */
-  async rebuildInsideChain(dryRun, wantMutate) {
-    const existing = await this.loadCompacted();
-    const skipped = [];
-    const rebuilt = /* @__PURE__ */ new Map();
-    const nowIso = (/* @__PURE__ */ new Date()).toISOString();
-    let memoryReal = null;
-    try {
-      memoryReal = await realpath(this.memoryDir);
-    } catch {
-      memoryReal = this.memoryDir;
-    }
-    const defaultNs = normalizeNamespaceIdentity(this.config.defaultNamespace);
-    const configured = new Set(
-      [
-        this.config.defaultNamespace,
-        this.config.sharedNamespace,
-        ...this.config.namespacePolicies.map((p) => p.name)
-      ].map((n) => normalizeNamespaceIdentity(n)).filter((n) => n.length > 0)
-    );
-    const resolvedDefaultRoot = await resolveDefaultNamespaceRoot(this.config);
-    const defaultStorageDir = await this.isContainedStorageDir(resolvedDefaultRoot) ? resolvedDefaultRoot : this.memoryDir;
-    const legacyDefaultHasData = defaultStorageDir === this.memoryDir;
-    for (const ns of configured) {
-      if (!ns) continue;
-      if (ns !== defaultNs && !isSafeRouteNamespace(ns)) {
-        let token;
-        try {
-          token = namespaceIdentityToken(ns);
-        } catch {
-          token = ns;
-        }
-        skipped.push({ token, reason: "unsafe", detail: ns });
-        continue;
-      }
-      let storageDir;
-      if (ns === defaultNs) {
-        storageDir = defaultStorageDir;
-      } else {
-        try {
-          storageDir = await resolveNamespaceStorageRoot(this.config, ns);
-        } catch {
-          storageDir = this.namespaceTokenDir(namespaceIdentityToken(ns));
-        }
-      }
-      if (!await this.isContainedStorageDir(storageDir)) {
-        if (ns === defaultNs) {
-          storageDir = this.memoryDir;
-        } else {
-          skipped.push({ token: namespaceIdentityToken(ns), reason: "escape", detail: storageDir });
-          continue;
-        }
-      }
-      rebuilt.set(
-        ns,
-        this.mergeForRebuild(existing.get(ns), {
-          namespace: ns,
-          identityToken: namespaceIdentityToken(ns),
-          kind: inferKind(ns, this.config),
-          createdAt: existing.get(ns)?.createdAt ?? nowIso,
-          storageDir,
-          discoveredBy: "config"
-        })
-      );
-    }
-    const namespacesDir = path2.join(this.memoryDir, "namespaces");
-    let entries = [];
-    let namespacesDirSafe = true;
-    try {
-      const rootStat = await lstat(namespacesDir);
-      if (rootStat.isSymbolicLink()) {
-        namespacesDirSafe = false;
-      } else {
-        const realNamespacesDir = await realpath(namespacesDir);
-        if (memoryReal && !isPathInside(memoryReal, realNamespacesDir)) {
-          namespacesDirSafe = false;
-        }
-      }
-    } catch {
-      namespacesDirSafe = true;
-    }
-    if (!namespacesDirSafe) {
-      skipped.push({ token: "namespaces", reason: "symlink", detail: namespacesDir });
-    } else {
-      try {
-        entries = await readdir(namespacesDir, { withFileTypes: true });
-      } catch {
-        entries = [];
-      }
-    }
-    const scannedFromTokenized = /* @__PURE__ */ new Set();
-    for (const entry of entries) {
-      const token = entry.name;
-      const fullPath = path2.join(namespacesDir, token);
-      let stat4;
-      try {
-        stat4 = await lstat(fullPath);
-      } catch (err) {
-        skipped.push({ token, reason: "error", detail: err instanceof Error ? err.message : String(err) });
-        continue;
-      }
-      if (stat4.isSymbolicLink()) {
-        skipped.push({ token, reason: "symlink", detail: fullPath });
-        continue;
-      }
-      if (!stat4.isDirectory()) continue;
-      try {
-        const real = await realpath(fullPath);
-        if (memoryReal && !isPathInside(memoryReal, real)) {
-          skipped.push({ token, reason: "escape", detail: real });
-          continue;
-        }
-      } catch (err) {
-        skipped.push({ token, reason: "error", detail: err instanceof Error ? err.message : String(err) });
-        continue;
-      }
-      const literalRecord = existing.get(token);
-      const literalOwnsRoot = configured.has(token) || literalRecord !== void 0 && path2.resolve(literalRecord.storageDir) === path2.resolve(fullPath);
-      const tokenDecoded = literalOwnsRoot ? null : namespaceIdentityFromToken(token);
-      const rawDecoded = tokenDecoded && tokenDecoded.length > 0 ? tokenDecoded : token;
-      const decoded = normalizeNamespaceIdentity(rawDecoded);
-      if (decoded.length === 0 || rawDecoded !== decoded) {
-        skipped.push({ token, reason: "unsafe", detail: rawDecoded });
-        continue;
-      }
-      if (decoded !== defaultNs && !isSafeRouteNamespace(decoded)) {
-        skipped.push({ token, reason: "unsafe", detail: decoded });
-        continue;
-      }
-      const memoryData = await inspectMemoryDataRoot(fullPath);
-      if (memoryData.invalidMarker) {
-        skipped.push({
-          token,
-          reason: "unsafe",
-          detail: `invalid memory marker: ${memoryData.invalidMarker}`
-        });
-        continue;
-      }
-      if (!memoryData.hasData) continue;
-      if (decoded === defaultNs) {
-        const def = rebuilt.get(defaultNs);
-        if (def) {
-          def.storageDir = defaultStorageDir;
-          def.kind = "default";
-        }
-        continue;
-      }
-      const isTokenizedEntry = token === namespaceIdentityToken(decoded);
-      if (rebuilt.has(decoded) && scannedFromTokenized.has(decoded) && !isTokenizedEntry) {
-        continue;
-      }
-      if (isTokenizedEntry) scannedFromTokenized.add(decoded);
-      const prior = existing.get(decoded);
-      rebuilt.set(
-        decoded,
-        this.mergeForRebuild(prior, {
-          namespace: decoded,
-          identityToken: namespaceIdentityToken(decoded),
-          kind: inferKind(decoded, this.config),
-          createdAt: prior?.createdAt ?? nowIso,
-          storageDir: fullPath,
-          // Configured-and-present namespaces keep config provenance; purely
-          // discovered ones are scan.
-          discoveredBy: configured.has(decoded) ? "config" : prior?.discoveredBy ?? "scan"
-        })
-      );
-    }
-    if (legacyDefaultHasData && defaultStorageDir === this.memoryDir) {
-      const def = rebuilt.get(defaultNs);
-      if (def) def.kind = "default";
-    }
-    if (!wantMutate) {
-      return this.finishRebuild(rebuilt, skipped, dryRun, false, memoryReal, nowIso);
-    }
-    if (this.onRebuildAfterScanForTest) {
-      await this.onRebuildAfterScanForTest();
-    }
-    return this.withHeldCatalogLock(
-      (acquired) => this.finishRebuild(rebuilt, skipped, dryRun, acquired, memoryReal, nowIso)
-    );
-  }
-  /**
-   * Final load→merge→rename window of a rebuild, factored out so the caller can
-   * run it WITHIN the cross-process file lock (NFgCT, codex P2) without holding
-   * that lock across the preceding disk scan. Re-reads the latest on-disk state,
-   * folds concurrent touches, then (when `canMutate`) atomically rewrites the log.
-   *
-   * `canMutate` records that the cross-process lock was actually held. The
-   * re-merge + rewrite run only when it is true — a dry-run, or an unlocked apply
-   * (lock-acquisition timeout), computes records but does NOT rename, so it can
-   * never clobber a concurrent lock holder's window. `applied` mirrors `canMutate`.
-   */
-  async finishRebuild(rebuilt, skipped, dryRun, canMutate, memoryReal, nowIso) {
-    if (canMutate) {
-      const latest = await this.loadCompacted();
-      for (const [ns, fresh] of latest) {
-        const current = rebuilt.get(ns);
-        if (!current) {
-          if (ns !== this.defaultNamespaceIdentity && !isSafeRouteNamespace(ns)) {
-            continue;
-          }
-          if (await this.liveStorageRootExistsForRebuild(ns, memoryReal)) {
-            const safeDir = await this.resolveSafeStorageDir(ns);
-            const resolvedSafe = path2.resolve(safeDir);
-            let owningNamespace = null;
-            for (const [otherNs, otherRec] of rebuilt) {
-              if (otherNs !== ns && path2.resolve(otherRec.storageDir) === resolvedSafe) {
-                owningNamespace = otherNs;
-                break;
-              }
-            }
-            if (owningNamespace) {
-              const owner = rebuilt.get(owningNamespace);
-              if (owner) rebuilt.set(owningNamespace, mergeNewerTouchFields(owner, fresh));
-              continue;
-            }
-            rebuilt.set(ns, {
-              ...fresh,
-              storageDir: safeDir,
-              identityToken: namespaceIdentityToken(ns),
-              kind: fresh.kind ?? inferKind(ns, this.config),
-              createdAt: fresh.createdAt ?? nowIso
-            });
-            continue;
-          }
-          continue;
-        }
-        rebuilt.set(ns, mergeNewerTouchFields(current, fresh));
-      }
-    }
-    const records = [...rebuilt.values()].sort((a, b) => {
-      const byName = a.namespace.localeCompare(b.namespace);
-      if (byName !== 0) return byName;
-      return a.identityToken.localeCompare(b.identityToken);
-    });
-    if (canMutate) {
-      if (this.onRebuildBeforeRenameForTest) {
-        await this.onRebuildBeforeRenameForTest();
-      }
-      await this.rewriteUnchained(records);
-    }
-    return { dryRun, records, skipped, applied: canMutate };
-  }
-  // ── Cross-process catalog write lock (held mutex) ────────────────────────
-  /**
-   * Run `fn` while HOLDING the shared cross-process advisory lock (round 5, codex
-   * P2; generalized round 7 — NEZkA). This is the SINGLE mutex shared by BOTH the
-   * touch read→merge→append window AND the rebuild final load→merge→rename window,
-   * so a touch and a rebuild in different processes are mutually exclusive over
-   * their respective critical sections — closing the check-then-append gap where a
-   * polled-only touch could append into a rebuild's load→rename window.
-   *
-   * Acquisition is atomic via `open(..., "wx")`. A lock older than
-   * `REBUILD_LOCK_STALE_MS` is treated as a crashed holder and broken. After
-   * `REBUILD_LOCK_MAX_WAIT_MS` of contention we proceed best-effort WITHOUT the
-   * lock rather than block forever. The lock is always released in `finally`.
-   *
-   * IN-PROCESS SAFETY: every caller invokes this from inside (or wrapping) the
-   * per-process `queueCritical` chain, which serializes all catalog mutations in
-   * THIS process. So within one process only one logical holder attempts OS-lock
-   * acquisition at a time — the file lock is never self-contended in-process, and
-   * the lock is acquired and released within a single in-process turn. The file
-   * lock adds only the missing CROSS-process exclusion.
-   *
-   * HEARTBEAT (round 5, cursor/codex Medium/P2): while WE hold the lock a timer
-   * refreshes its mtime every `REBUILD_LOCK_HEARTBEAT_MS`, so a legitimately long
-   * holder (> `REBUILD_LOCK_STALE_MS`) is not treated as a crashed holder and
-   * unlinked by another process — which would let overlapping windows lose
-   * appends. Heartbeat failures are swallowed; the timer is always cleared in
-   * `finally`.
-   *
-   * ACQUISITION RESULT (round 6, codex P2 — NBPmY): `fn` receives whether WE
-   * actually hold the lock. When acquisition TIMED OUT (another holder is active),
-   * a MUTATING rebuild must NOT perform its load/rename window unlocked, and a
-   * touch must NOT append unlocked — both would recreate the lost-append race. The
-   * caller uses `acquired` to run compute-only (rebuild) or DROP the append
-   * (touch) when unlocked.
-   */
-  async withHeldCatalogLock(fn) {
-    const acquired = await this.acquireRebuildLock();
-    let heartbeat;
-    if (acquired) {
-      heartbeat = setInterval(() => {
-        const now = /* @__PURE__ */ new Date();
-        utimes(this.rebuildLockPath, now, now).catch(() => void 0);
-      }, REBUILD_LOCK_HEARTBEAT_MS);
-      heartbeat.unref?.();
-    }
-    try {
-      return await fn(acquired);
-    } finally {
-      if (heartbeat) clearInterval(heartbeat);
-      if (acquired) {
-        try {
-          if (await this.rebuildLockHeldBySelf()) {
-            await unlink(this.rebuildLockPath);
-          }
-        } catch {
-        }
-      }
-    }
-  }
-  /** Try to acquire the rebuild lock; returns true if WE created it. */
-  async acquireRebuildLock() {
-    const deadline = Date.now() + REBUILD_LOCK_MAX_WAIT_MS;
-    await mkdir2(this.stateDir, { recursive: true });
-    for (; ; ) {
-      try {
-        const handle = await open(this.rebuildLockPath, "wx");
-        try {
-          await handle.writeFile(
-            `${process.pid} ${this.lockOwnerId} ${(/* @__PURE__ */ new Date()).toISOString()}
-`,
-            "utf8"
-          );
-        } catch {
-        } finally {
-          await handle.close();
-        }
-        return true;
-      } catch (err) {
-        if (err?.code !== "EEXIST") {
-          return false;
-        }
-        await this.breakStaleRebuildLock();
-        if (Date.now() >= deadline) return false;
-        await new Promise((r) => setTimeout(r, REBUILD_LOCK_POLL_MS));
-      }
-    }
-  }
-  /**
-   * Remove the lock file if its mtime is older than the stale threshold.
-   *
-   * REPLACEMENT-SAFE (NG7Bg, codex P2): a plain `stat` → `unlink` has a TOCTOU
-   * window — two processes can both observe the SAME stale lock; one removes it and
-   * creates a FRESH lock, and the other's later `unlink` then deletes that fresh
-   * holder's ACTIVE lock based on the stale identity it read earlier, leaving the
-   * fresh holder running its critical section with no visible lock and reopening the
-   * lost-update race the mutex prevents. We therefore capture the lock's IDENTITY
-   * (its full content line: `<pid> <owner-uuid> <iso>`) when we judge it stale, then
-   * RE-READ immediately before unlinking and only remove it when the content is
-   * byte-identical AND still stale. A replacement lock has a different owner id /
-   * timestamp, so its content differs and we leave it untouched. We never unlink a
-   * lock whose mtime is now fresh (a heartbeat refreshed it) or whose identity
-   * changed (a replacement was created). This is best-effort: any mismatch/vanish
-   * simply skips the break and the caller polls again.
-   */
-  async breakStaleRebuildLock() {
-    let staleIdentity;
-    try {
-      const info = await stat(this.rebuildLockPath);
-      if (Date.now() - info.mtimeMs <= REBUILD_LOCK_STALE_MS) {
-        return;
-      }
-      staleIdentity = await readFile2(this.rebuildLockPath, "utf8");
-    } catch {
-      return;
-    }
-    if (this.onBeforeBreakStaleUnlinkForTest) {
-      await this.onBeforeBreakStaleUnlinkForTest();
-    }
-    try {
-      const current = await readFile2(this.rebuildLockPath, "utf8");
-      if (current !== staleIdentity) return;
-      const recheck = await stat(this.rebuildLockPath);
-      if (Date.now() - recheck.mtimeMs <= REBUILD_LOCK_STALE_MS) return;
-      await unlink(this.rebuildLockPath).catch(() => void 0);
-    } catch {
-    }
-  }
-  /**
-   * Whether the rebuild lock file was written by THIS instance (round 6, codex
-   * P2 — NBsGP). Matches the per-instance owner id, NOT just `process.pid`: two
-   * NamespaceCatalog instances in the same process share a PID, so a PID-only
-   * check would wrongly treat instance A's lock as self-held by instance B and
-   * let B's touch skip the wait and append into A's rebuild window. Falls back to
-   * the legacy PID-only form for lock files written before owner ids existed.
-   */
-  async rebuildLockHeldBySelf() {
-    try {
-      const body = await readFile2(this.rebuildLockPath, "utf8");
-      const parts = body.trim().split(/\s+/);
-      const pid = Number.parseInt(parts[0] ?? "", 10);
-      const ownerId = parts[1];
-      const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-      if (ownerId && UUID_RE.test(ownerId)) {
-        return ownerId === this.lockOwnerId;
-      }
-      return Number.isFinite(pid) && pid === process.pid;
-    } catch {
-      return false;
-    }
-  }
-  /**
-   * Merge a prior record's preserved metadata (timestamps, principal hints)
-   * onto a freshly-discovered record. Disk-derived fields (storageDir, kind)
-   * take precedence from the new record.
-   *
-   * PROVENANCE (round 3, cursor Low): `discoveredBy` and `createdAt` are
-   * CREATION-ONLY — identical to the touch path's invariant. A rebuild must NOT
-   * reset a namespace first seen via a `write`/`read` touch back to `config`
-   * just because it is also listed in policies. So when a prior record exists we
-   * carry its `discoveredBy` forward; only brand-new records keep the fresh
-   * (config/scan) provenance.
-   */
-  mergeForRebuild(prior, fresh) {
-    if (!prior) return fresh;
-    const merged = {
-      ...fresh,
-      createdAt: prior.createdAt ?? fresh.createdAt,
-      discoveredBy: prior.discoveredBy ?? fresh.discoveredBy
-    };
-    if (prior.lastReadAt) merged.lastReadAt = prior.lastReadAt;
-    if (prior.lastWriteAt) merged.lastWriteAt = prior.lastWriteAt;
-    if (prior.lastMaintenanceAt) merged.lastMaintenanceAt = { ...prior.lastMaintenanceAt };
-    if (prior.principal !== void 0) merged.principal = prior.principal;
-    if (prior.projectId !== void 0) merged.projectId = prior.projectId;
-    if (prior.branch !== void 0) merged.branch = prior.branch;
-    if (prior.parentNamespace !== void 0) merged.parentNamespace = prior.parentNamespace;
-    return merged;
-  }
-  // ── Persistence ──────────────────────────────────────────────────────────
-  /** Load the JSONL log and fold it into current state (last-record-wins). */
-  async loadCompacted() {
-    const records = /* @__PURE__ */ new Map();
-    let raw;
-    try {
-      raw = await readFile2(this.catalogPath, "utf8");
-    } catch {
-      return records;
-    }
-    for (const line of raw.split("\n")) {
-      const trimmed = line.trim();
-      if (trimmed.length === 0) continue;
-      let parsed;
-      try {
-        parsed = JSON.parse(trimmed);
-      } catch {
-        continue;
-      }
-      const record = coerceRecord(parsed);
-      if (!record) continue;
-      const prior = records.get(record.namespace);
-      records.set(record.namespace, prior ? mergeNewerTouchFields(record, prior) : record);
-    }
-    return records;
-  }
-  /**
-   * Serialize an arbitrary read-modify-write critical section through the single
-   * write chain. Every catalog mutation (touch read+merge+append, full rewrite)
-   * runs through this so they are mutually exclusive: a touch always reads the
-   * latest persisted state before appending, and a rebuild rewrite cannot
-   * interleave with a touch's append. The chain recovers from rejection
-   * (CLAUDE.md rule #40) — one failed section never poisons subsequent ones —
-   * while still surfacing the error to that section's awaited promise.
-   */
-  queueCritical(fn) {
-    const run = this.writeChain.then(fn);
-    this.writeChain = run.then(
-      () => void 0,
-      () => void 0
-    );
-    return run;
-  }
-  /**
-   * Append a single record to the JSONL log WITHOUT re-serializing through the
-   * write chain. MUST only be called from inside a `queueCritical(...)` section
-   * (which already holds the serialized turn); calling it directly would bypass
-   * the read-before-append ordering that prevents lost-field races.
-   */
-  async appendUnchained(record) {
-    const line = serializeRecord(record) + "\n";
-    await mkdir2(this.stateDir, { recursive: true });
-    await appendFile(this.catalogPath, line, "utf8");
-  }
-  /**
-   * Atomic temp-file + rename rewrite (CLAUDE.md rule #54: write temp, then
-   * rename — never delete-before-write) WITHOUT re-entering the write chain.
-   * MUST only be called from inside a `queueCritical(...)` turn (e.g. the
-   * rebuild critical section, which already holds the serialized turn so its
-   * load and rewrite are atomic against concurrent touches). Re-entering the
-   * chain from within a held turn would deadlock.
-   */
-  async rewriteUnchained(records) {
-    const body = records.map((r) => serializeRecord(r)).join("\n") + (records.length > 0 ? "\n" : "");
-    await mkdir2(this.stateDir, { recursive: true });
-    const tmp = `${this.catalogPath}.${process.pid}.${Date.now()}.tmp`;
-    await writeFile2(tmp, body, "utf8");
-    await rename(tmp, this.catalogPath);
-  }
-};
-function isPathInside(root, child) {
-  const relative = path2.relative(root, child);
-  return relative === "" || !relative.startsWith("..") && !path2.isAbsolute(relative);
-}
-
-// src/maintenance/namespace-planner.ts
-import { createHash, randomUUID as randomUUID2 } from "crypto";
-import { lstat as lstat2, mkdir as mkdir3, open as open2, readFile as readFile3, readdir as readdir2, rename as rename2, rm, rmdir, utimes as utimes2, writeFile as writeFile3 } from "fs/promises";
-import path3 from "path";
-var DEFAULT_MAX_NAMESPACES_PER_CYCLE = 20;
-var DEFAULT_LOCK_STALE_MS = 10 * 6e4;
-var LOCK_BASE = "maintenance-locks";
-var STATUS_BASE = "namespace-maintenance-status";
-var namespaceMaintenanceFs = { open: open2, rm };
-function configuredNamespaces(config) {
-  return Array.from(
-    new Set(
-      [config.defaultNamespace, config.sharedNamespace, ...config.namespacePolicies.map((policy) => policy.name)].map((value) => value.trim()).filter(Boolean)
-    )
-  );
-}
-function inferConfiguredKind(config, namespace) {
-  if (namespace === config.defaultNamespace.trim()) return "default";
-  if (namespace === config.sharedNamespace.trim()) return "shared";
-  return "explicit";
-}
-function maxNamespacesPerCycle(config) {
-  return Math.max(
-    1,
-    Math.floor(
-      typeof config.maintenanceMaxNamespacesPerCycle === "number" && Number.isFinite(config.maintenanceMaxNamespacesPerCycle) ? config.maintenanceMaxNamespacesPerCycle : DEFAULT_MAX_NAMESPACES_PER_CYCLE
-    )
-  );
-}
-function namespaceKindAllowed(config, kind) {
-  switch (kind) {
-    case "branch":
-      return config.maintenanceIncludeBranchNamespaces === true;
-    case "project":
-      return config.maintenanceIncludeProjectNamespaces !== false;
-    case "team-project":
-      return config.maintenanceIncludeTeamProjectNamespaces !== false;
-    default:
-      return true;
-  }
-}
-function disabledReasonForKind(kind) {
-  if (kind === "branch") return "branch_disabled";
-  if (kind === "project") return "project_disabled";
-  if (kind === "team-project") return "team_project_disabled";
-  return "fanout_disabled";
-}
-async function catalogRootIsLive(config, record) {
-  if (typeof record.storageDir !== "string" || record.storageDir.length === 0) {
-    return false;
-  }
-  try {
-    const liveRoot = await resolveNamespaceStorageRoot(config, record.namespace);
-    if (path3.resolve(liveRoot) !== path3.resolve(record.storageDir)) return false;
-    return hasMemoryData(liveRoot);
-  } catch {
-    return false;
-  }
-}
-function candidateSortKey(candidate) {
-  const write = candidate.lastWriteAt ?? "";
-  return `${write}\0${candidate.namespace}`;
-}
-function candidatePriority(candidate) {
-  if (candidate.kind === "default") return 0;
-  if (candidate.kind === "shared") return 1;
-  if (candidate.source === "configured") return 2;
-  if (candidate.kind === "team-project") return 3;
-  if (candidate.kind === "project") return 4;
-  if (candidate.kind === "self") return 5;
-  if (candidate.kind === "legacy") return 6;
-  if (candidate.kind === "branch") return 8;
-  return 7;
-}
-function sortCandidates(a, b) {
-  const priority = candidatePriority(a) - candidatePriority(b);
-  if (priority !== 0) return priority;
-  const am = Date.parse(a.lastMaintenanceAt ?? "");
-  const bm = Date.parse(b.lastMaintenanceAt ?? "");
-  const aMaintained = Number.isFinite(am);
-  const bMaintained = Number.isFinite(bm);
-  if (aMaintained && bMaintained && am !== bm) return am - bm;
-  if (aMaintained !== bMaintained) return aMaintained ? 1 : -1;
-  const aw = Date.parse(a.lastWriteAt ?? "");
-  const bw = Date.parse(b.lastWriteAt ?? "");
-  const aValid = Number.isFinite(aw);
-  const bValid = Number.isFinite(bw);
-  if (aValid && bValid && aw !== bw) return bw - aw;
-  if (aValid !== bValid) return aValid ? -1 : 1;
-  const byKey = candidateSortKey(a).localeCompare(candidateSortKey(b));
-  if (byKey !== 0) return byKey;
-  return a.namespace.localeCompare(b.namespace);
-}
-async function planNamespaceMaintenance(config, options) {
-  const generatedAt = (options.now ?? /* @__PURE__ */ new Date()).toISOString();
-  const configured = configuredNamespaces(config);
-  const byNamespace = /* @__PURE__ */ new Map();
-  const skipped = [];
-  for (const namespace of configured) {
-    const kind = inferConfiguredKind(config, namespace);
-    byNamespace.set(namespace, {
-      namespace,
-      kind,
-      source: "configured"
-    });
-  }
-  if (config.namespacesEnabled && config.maintenanceNamespaceFanoutEnabled !== false) {
-    const configuredSet = new Set(configured);
-    try {
-      const records = options.catalog?.enabled ? await options.catalog.listNamespaces() : [];
-      for (const record of records) {
-        const namespace = record.namespace.trim();
-        if (!namespace) continue;
-        const isConfigured = configuredSet.has(namespace);
-        const kind = isConfigured ? inferConfiguredKind(config, namespace) : record.kind;
-        if (!namespaceKindAllowed(config, kind)) {
-          skipped.push({
-            namespace,
-            kind,
-            reason: disabledReasonForKind(kind)
-          });
-          continue;
-        }
-        if (!isConfigured && !await catalogRootIsLive(config, record)) {
-          skipped.push({
-            namespace,
-            kind,
-            reason: "unsafe_or_stale_root"
-          });
-          continue;
-        }
-        byNamespace.set(namespace, {
-          namespace,
-          kind,
-          storageDir: record.storageDir,
-          source: isConfigured ? "configured" : "catalog",
-          lastWriteAt: record.lastWriteAt,
-          lastMaintenanceAt: record.lastMaintenanceAt?.[options.jobName]
-        });
-      }
-    } catch (error) {
-      skipped.push({
-        namespace: "*",
-        reason: "catalog_read_failed",
-        detail: error instanceof Error ? error.message : String(error)
-      });
-    }
-  } else if (config.namespacesEnabled) {
-    skipped.push({
-      namespace: "*",
-      reason: "fanout_disabled"
-    });
-  }
-  if (options.budgetMode !== "unbounded") {
-    const latestStatusAtByNamespace = await readLatestStatusAtByNamespace(config, options.jobName);
-    for (const candidate of byNamespace.values()) {
-      if (!candidate.lastMaintenanceAt) {
-        candidate.lastMaintenanceAt = latestStatusAtByNamespace.get(candidate.namespace);
-      }
-    }
-  }
-  const candidates = [...byNamespace.values()].filter((candidate) => namespaceKindAllowed(config, candidate.kind)).sort(sortCandidates);
-  const max = maxNamespacesPerCycle(config);
-  const applyCycleBudget = options.budgetMode !== "unbounded";
-  const selected = applyCycleBudget ? candidates.slice(0, max) : candidates;
-  if (applyCycleBudget) {
-    for (const candidate of candidates.slice(max)) {
-      skipped.push({
-        namespace: candidate.namespace,
-        kind: candidate.kind,
-        reason: "budget_exhausted"
-      });
-    }
-  }
-  return {
-    jobName: options.jobName,
-    generatedAt,
-    namespaces: selected,
-    skipped,
-    budget: {
-      maxNamespacesPerCycle: max,
-      selected: selected.length
-    }
-  };
-}
-function stablePathSegment(value) {
-  const sanitized = value.replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 128) || "unnamed";
-  if (sanitized.length <= 128 && sanitized === value) return sanitized;
-  return `${sanitized.slice(0, 80)}-${createHash("sha256").update(value).digest("hex").slice(0, 16)}`;
-}
-function namespacePathSegment(namespace) {
-  const token = namespaceIdentityToken(namespace);
-  if (token.length <= 160) return token;
-  return `ns-${createHash("sha256").update(namespace).digest("hex")}`;
-}
-function lockPath(config, jobName, namespace) {
-  return path3.join(
-    config.memoryDir,
-    "state",
-    LOCK_BASE,
-    stablePathSegment(jobName),
-    `${namespacePathSegment(namespace)}.lock`
-  );
-}
-function namespaceMaintenanceLockStaleMs(config) {
-  if (typeof config.maintenanceNamespaceLockStaleMs === "number" && Number.isFinite(config.maintenanceNamespaceLockStaleMs) && config.maintenanceNamespaceLockStaleMs > 0) {
-    return Math.floor(config.maintenanceNamespaceLockStaleMs);
-  }
-  return DEFAULT_LOCK_STALE_MS;
-}
-function namespaceMaintenanceLockHeartbeatMs(config) {
-  const staleMs = namespaceMaintenanceLockStaleMs(config);
-  return Math.max(1, Math.min(3e4, Math.floor(staleMs / 3) || 1));
-}
-function errorCode(error) {
-  return typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
-}
-async function withNamespaceMaintenanceLockHeartbeat(config, locks, task) {
-  const activeLocks = Array.isArray(locks) ? locks : [locks];
-  const interval = setInterval(() => {
-    for (const lock of activeLocks) {
-      void lock.touch().catch(() => void 0);
-    }
-  }, namespaceMaintenanceLockHeartbeatMs(config));
-  interval.unref?.();
-  try {
-    return await task();
-  } finally {
-    clearInterval(interval);
-  }
-}
-async function removeStaleLockDirectory(filePath) {
-  let entries;
-  try {
-    entries = await readdir2(filePath, { withFileTypes: true });
-  } catch (error) {
-    if (errorCode(error) === "ENOENT") return;
-    throw error;
-  }
-  for (const entry of entries) {
-    if (!entry.isFile()) continue;
-    await namespaceMaintenanceFs.rm(path3.join(filePath, entry.name), { force: true });
-  }
-  try {
-    await rmdir(filePath);
-  } catch (error) {
-    if (errorCode(error) === "ENOENT") return;
-    throw error;
-  }
-}
-async function tryAcquireNamespaceMaintenanceLock(config, jobName, namespace) {
-  const filePath = lockPath(config, jobName, namespace);
-  await mkdir3(path3.dirname(filePath), { recursive: true });
-  try {
-    const lockId = randomUUID2();
-    await mkdir3(filePath);
-    const ownerPath = path3.join(filePath, `${lockId}.json`);
-    let handle;
-    try {
-      handle = await namespaceMaintenanceFs.open(ownerPath, "wx");
-      await handle.writeFile(
-        `${JSON.stringify({
-          lockId,
-          pid: process.pid,
-          jobName,
-          namespace,
-          acquiredAt: (/* @__PURE__ */ new Date()).toISOString()
-        })}
-`,
-        "utf8"
-      );
-      await handle.close();
-    } catch (setupError) {
-      await handle?.close().catch(() => void 0);
-      await namespaceMaintenanceFs.rm(ownerPath, { force: true }).catch(() => void 0);
-      await rmdir(filePath).catch(() => void 0);
-      throw setupError;
-    }
-    return {
-      path: filePath,
-      async touch() {
-        try {
-          const parsed = JSON.parse(await readFile3(ownerPath, "utf8"));
-          if (parsed.lockId === lockId) {
-            const now = /* @__PURE__ */ new Date();
-            await utimes2(ownerPath, now, now);
-            await utimes2(filePath, now, now);
-          }
-        } catch {
-        }
-      },
-      async release() {
-        try {
-          const parsed = JSON.parse(await readFile3(ownerPath, "utf8"));
-          if (parsed.lockId === lockId) {
-            await namespaceMaintenanceFs.rm(ownerPath, { force: true });
-            await rmdir(filePath).catch(() => void 0);
-          }
-        } catch {
-        }
+  async transcriptMemories(options = {}) {
+    if (options.date !== void 0 && !isValidTranscriptDate(options.date)) {
+      throw new WearablesInputError(`invalid date '${options.date}' \u2014 expected YYYY-MM-DD`);
+    }
+    if (options.source !== void 0) assertValidSourceId(options.source);
+    const limit = clampLimit(
+      options.limit,
+      MEMORY_LIST_DEFAULT_LIMIT,
+      MEMORY_LIST_MAX_LIMIT,
+      "limit"
+    );
+    const storage = await this.deps.getStorage();
+    const memories = await storage.readAllMemories();
+    const results = [];
+    for (const memory of memories) {
+      const source = memory.frontmatter.source;
+      if (typeof source !== "string" || !source.startsWith(`${WEARABLE_SOURCE_PREFIX}:`)) {
+        continue;
       }
-    };
-  } catch (error) {
-    if (errorCode(error) === "EEXIST") {
-      const staleMs = namespaceMaintenanceLockStaleMs(config);
-      try {
-        const s = await lstat2(filePath);
-        if (s.isSymbolicLink()) {
-          return null;
-        }
-        if ((s.isFile() || s.isDirectory()) && Date.now() - s.mtimeMs > staleMs) {
-          try {
-            if (s.isDirectory()) {
-              await removeStaleLockDirectory(filePath);
-            } else {
-              await namespaceMaintenanceFs.rm(filePath, { force: true });
-            }
-          } catch (removeError) {
-            if (errorCode(removeError) === "ENOENT") {
-              return tryAcquireNamespaceMaintenanceLock(config, jobName, namespace);
-            }
-            if (errorCode(removeError) === "ENOTEMPTY") {
-              return null;
-            }
-            throw removeError;
-          }
-          return tryAcquireNamespaceMaintenanceLock(config, jobName, namespace);
-        }
-      } catch (statError) {
-        if (errorCode(statError) === "ENOENT") {
-          return tryAcquireNamespaceMaintenanceLock(config, jobName, namespace);
+      const attrs = memory.frontmatter.structuredAttributes ?? {};
+      const sourceId = attrs.wearableSource;
+      if (options.source !== void 0) {
+        if (sourceId !== options.source && source !== wearableSourceLabel(options.source) && source !== `${wearableSourceLabel(options.source)}:native`) {
+          continue;
         }
-        throw statError;
       }
-      return null;
+      if (options.date !== void 0 && attrs.wearableDate !== options.date) {
+        continue;
+      }
+      results.push({
+        id: memory.frontmatter.id,
+        source: sourceId ?? source,
+        date: attrs.wearableDate,
+        conversationId: attrs.wearableConversationId,
+        status: memory.frontmatter.status,
+        content: memory.content,
+        created: memory.frontmatter.created
+      });
     }
-    throw error;
-  }
-}
-function statusBasePath(config) {
-  return path3.join(config.memoryDir, "state", STATUS_BASE);
-}
-function statusPath(config, jobName, namespace) {
-  return path3.join(statusBasePath(config), stablePathSegment(jobName), `${namespacePathSegment(namespace)}.json`);
-}
-function lastRanStatusPath(config, jobName, namespace) {
-  return path3.join(statusBasePath(config), stablePathSegment(jobName), `${namespacePathSegment(namespace)}.last-ran.json`);
-}
-function parseStatus(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
-  const v = value;
-  if (typeof v.namespace === "string" && typeof v.jobName === "string" && (v.state === "ran" || v.state === "skipped" || v.state === "failed") && typeof v.startedAt === "string" && typeof v.completedAt === "string") {
-    return v;
-  }
-  return null;
-}
-async function readLatestStatusAtByNamespace(config, jobName) {
-  const latest = /* @__PURE__ */ new Map();
-  const latestMs = /* @__PURE__ */ new Map();
-  for (const status of [...await readStatusFiles(config), ...await readLastRanStatusFiles(config)]) {
-    if (status.state !== "ran") continue;
-    if (status.jobName !== jobName) continue;
-    const completedAtMs = Date.parse(status.completedAt);
-    if (!Number.isFinite(completedAtMs)) continue;
-    const previousMs = latestMs.get(status.namespace);
-    if (previousMs !== void 0 && previousMs >= completedAtMs) continue;
-    latestMs.set(status.namespace, completedAtMs);
-    latest.set(status.namespace, status.completedAt);
-  }
-  return latest;
-}
-async function readStatusFile(filePath) {
-  try {
-    const parsed = JSON.parse(await readFile3(filePath, "utf8"));
-    return parseStatus(parsed);
-  } catch {
-    return null;
-  }
-}
-async function readStatusFiles(config) {
-  if (typeof config.memoryDir !== "string" || config.memoryDir.length === 0) {
-    return [];
+    results.sort((a, b) => {
+      if (a.created > b.created) return -1;
+      if (a.created < b.created) return 1;
+      if (a.id < b.id) return -1;
+      if (a.id > b.id) return 1;
+      return 0;
+    });
+    return results.slice(0, limit);
   }
-  const root = statusBasePath(config);
-  const statuses = [];
-  let jobDirs;
-  try {
-    jobDirs = await readdir2(root, { withFileTypes: true });
-  } catch {
-    return statuses;
+  // -- speakers -------------------------------------------------------------
+  async listSpeakers() {
+    const storage = await this.deps.getStorage();
+    return loadSpeakerRegistry(storage.dir);
   }
-  for (const jobDir of jobDirs) {
-    if (!jobDir.isDirectory()) continue;
-    let files;
-    try {
-      files = await readdir2(path3.join(root, jobDir.name), { withFileTypes: true });
-    } catch {
-      continue;
+  async setSpeaker(sourceId, speakerKey, name, opts = {}) {
+    if (typeof name !== "string" || name.trim().length === 0) {
+      throw new WearablesInputError("speaker name must be a non-empty string");
     }
-    for (const file of files) {
-      if (!file.isFile() || !file.name.endsWith(".json")) continue;
-      if (file.name.endsWith(".last-ran.json")) continue;
-      const status = await readStatusFile(path3.join(root, jobDir.name, file.name));
-      if (status) statuses.push(status);
+    if (typeof speakerKey !== "string" || speakerKey.trim().length === 0) {
+      throw new WearablesInputError("speaker key must be a non-empty string");
     }
+    const storage = await this.deps.getStorage();
+    const registry = await loadSpeakerRegistry(storage.dir);
+    registry.speakers[speakerRegistryKey(sourceId, speakerKey.trim())] = {
+      name: name.trim(),
+      ...opts.isSelf === true ? { isSelf: true } : {},
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    await saveSpeakerRegistry(storage.dir, registry);
+    return registry;
   }
-  return statuses;
-}
-async function readLastRanStatusFiles(config) {
-  if (typeof config.memoryDir !== "string" || config.memoryDir.length === 0) {
-    return [];
-  }
-  const root = statusBasePath(config);
-  const statuses = [];
-  let jobDirs;
-  try {
-    jobDirs = await readdir2(root, { withFileTypes: true });
-  } catch {
-    return statuses;
-  }
-  for (const jobDir of jobDirs) {
-    if (!jobDir.isDirectory()) continue;
-    let files;
-    try {
-      files = await readdir2(path3.join(root, jobDir.name), { withFileTypes: true });
-    } catch {
-      continue;
-    }
-    for (const file of files) {
-      if (!file.isFile() || !file.name.endsWith(".last-ran.json")) continue;
-      const status = await readStatusFile(path3.join(root, jobDir.name, file.name));
-      if (status) statuses.push(status);
+  async setSelfName(name) {
+    if (typeof name !== "string" || name.trim().length === 0) {
+      throw new WearablesInputError("self name must be a non-empty string");
     }
+    const storage = await this.deps.getStorage();
+    const registry = await loadSpeakerRegistry(storage.dir);
+    registry.selfName = name.trim();
+    await saveSpeakerRegistry(storage.dir, registry);
+    return registry;
   }
-  return statuses;
-}
-async function writeStatusPayload(target, status) {
-  const dir = path3.dirname(target);
-  await mkdir3(dir, { recursive: true });
-  const temp = `${target}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
-  const payload = {
-    version: 1,
-    ...status
-  };
-  await writeFile3(temp, `${JSON.stringify(payload, null, 2)}
-`, "utf8");
-  await rename2(temp, target);
-}
-async function writeStatusFile(config, status) {
-  await writeStatusPayload(statusPath(config, status.jobName, status.namespace), status);
-  if (status.state === "ran") {
-    await writeStatusPayload(lastRanStatusPath(config, status.jobName, status.namespace), status);
-  }
-}
-async function recordNamespaceMaintenanceStatusSafely(config, status) {
-  try {
-    await writeStatusFile(config, status);
-  } catch {
-  }
-}
-function maintenanceErrorDetail(error) {
-  return displayErrorDetail(error) || "Error";
-}
-async function runNamespaceMaintenanceBatchPlan(config, plan, runner, catalog, options = {}) {
-  const statuses = [];
-  for (const skipped of plan.skipped) {
-    if (skipped.namespace === "*") continue;
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const status = {
-      namespace: skipped.namespace,
-      jobName: plan.jobName,
-      state: "skipped",
-      reason: skipped.reason,
-      startedAt: now,
-      completedAt: now
-    };
-    statuses.push(status);
-    await recordNamespaceMaintenanceStatusSafely(config, status);
-  }
-  const acquired = [];
-  try {
-    for (const candidate of plan.namespaces) {
-      const startedAt = (/* @__PURE__ */ new Date()).toISOString();
-      const lock = await tryAcquireNamespaceMaintenanceLock(config, plan.jobName, candidate.namespace);
-      if (!lock) {
-        const completedAt = (/* @__PURE__ */ new Date()).toISOString();
-        const status = {
-          namespace: candidate.namespace,
-          jobName: plan.jobName,
-          state: "skipped",
-          reason: "lock_held",
-          startedAt,
-          completedAt
-        };
-        statuses.push(status);
-        await recordNamespaceMaintenanceStatusSafely(config, status);
-        continue;
-      }
-      acquired.push({ candidate, lock, startedAt });
-    }
-  } catch (error) {
-    await Promise.all(acquired.map(({ lock }) => lock.release().catch(() => void 0)));
-    throw error;
-  }
-  if (options.requireAllLocks && acquired.length > 0 && acquired.length < plan.namespaces.length) {
-    for (const { candidate, startedAt } of acquired) {
-      const completedAt = (/* @__PURE__ */ new Date()).toISOString();
-      const status = {
-        namespace: candidate.namespace,
-        jobName: plan.jobName,
-        state: "skipped",
-        reason: "batch_lock_incomplete",
-        startedAt,
-        completedAt
-      };
-      statuses.push(status);
-      await recordNamespaceMaintenanceStatusSafely(config, status);
+  async removeSpeaker(sourceId, speakerKey) {
+    const storage = await this.deps.getStorage();
+    const registry = await loadSpeakerRegistry(storage.dir);
+    const key = speakerRegistryKey(sourceId, speakerKey.trim());
+    if (!(key in registry.speakers)) {
+      throw new WearablesInputError(`no speaker override stored for '${key}'`);
     }
-    await Promise.all(acquired.map(({ lock }) => lock.release().catch(() => void 0)));
-    return {
-      jobName: plan.jobName,
-      generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      ran: statuses.filter((s) => s.state === "ran").length,
-      skipped: statuses.filter((s) => s.state === "skipped").length,
-      failed: statuses.filter((s) => s.state === "failed").length,
-      statuses
-    };
+    delete registry.speakers[key];
+    await saveSpeakerRegistry(storage.dir, registry);
+    return registry;
   }
-  if (acquired.length === 0) {
+  // -- corrections ----------------------------------------------------------
+  async listCorrections() {
+    const storage = await this.deps.getStorage();
     return {
-      jobName: plan.jobName,
-      generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      ran: statuses.filter((s) => s.state === "ran").length,
-      skipped: statuses.filter((s) => s.state === "skipped").length,
-      failed: statuses.filter((s) => s.state === "failed").length,
-      statuses
+      fromConfig: this.deps.config.corrections,
+      fromState: await loadCorrectionsFile(storage.dir),
+      stateFilePath: correctionsFilePath(storage.dir)
     };
   }
-  try {
-    const result = await withNamespaceMaintenanceLockHeartbeat(
-      config,
-      acquired.map(({ lock }) => lock),
-      () => runner(acquired.map(({ candidate }) => candidate))
+  async addCorrection(rule) {
+    compileCorrectionRule(rule, "correction");
+    const storage = await this.deps.getStorage();
+    const rules = await loadCorrectionsFile(storage.dir);
+    const duplicate = rules.some(
+      (existing) => existing.match === rule.match && existing.replace === rule.replace && existing.regex === true === (rule.regex === true)
     );
-    for (const { candidate, startedAt } of acquired) {
-      const completedAt = (/* @__PURE__ */ new Date()).toISOString();
-      const status = {
-        namespace: candidate.namespace,
-        jobName: plan.jobName,
-        state: "ran",
-        startedAt,
-        completedAt,
-        itemCount: itemCountForNamespace(result, candidate.namespace)
-      };
-      statuses.push(status);
-      await recordNamespaceMaintenanceStatusSafely(config, status);
-      try {
-        await catalog?.markMaintenance(candidate.namespace, plan.jobName, new Date(completedAt));
-      } catch {
-      }
+    if (duplicate) {
+      throw new WearablesInputError(
+        `an identical correction rule already exists (match: ${JSON.stringify(rule.match)})`
+      );
     }
-  } catch (error) {
-    const skipReason = options.skipReasonForError?.(error);
-    for (const { candidate, startedAt } of acquired) {
-      const completedAt = (/* @__PURE__ */ new Date()).toISOString();
-      const status = skipReason ? {
-        namespace: candidate.namespace,
-        jobName: plan.jobName,
-        state: "skipped",
-        reason: skipReason,
-        startedAt,
-        completedAt
-      } : {
-        namespace: candidate.namespace,
-        jobName: plan.jobName,
-        state: "failed",
-        reason: "job_failed",
-        startedAt,
-        completedAt,
-        error: maintenanceErrorDetail(error)
-      };
-      statuses.push(status);
-      await recordNamespaceMaintenanceStatusSafely(config, status);
+    rules.push(rule);
+    await saveCorrectionsFile(storage.dir, rules);
+  }
+  async removeCorrection(index) {
+    if (!Number.isInteger(index) || index < 0) {
+      throw new WearablesInputError(`invalid correction index '${index}'`);
     }
-  } finally {
-    await Promise.all(acquired.map(({ lock }) => lock.release().catch(() => void 0)));
+    const storage = await this.deps.getStorage();
+    const rules = await loadCorrectionsFile(storage.dir);
+    if (index >= rules.length) {
+      throw new WearablesInputError(
+        `correction index ${index} is out of range (have ${rules.length} state rule${rules.length === 1 ? "" : "s"})`
+      );
+    }
+    const [removed] = rules.splice(index, 1);
+    await saveCorrectionsFile(storage.dir, rules);
+    return removed;
   }
-  return {
-    jobName: plan.jobName,
-    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    ran: statuses.filter((s) => s.state === "ran").length,
-    skipped: statuses.filter((s) => s.state === "skipped").length,
-    failed: statuses.filter((s) => s.state === "failed").length,
-    statuses
-  };
-}
-function itemCountForNamespace(result, namespace) {
-  const itemCounts = result?.itemCounts;
-  if (itemCounts instanceof Map) return itemCounts.get(namespace);
-  if (itemCounts && Object.prototype.hasOwnProperty.call(itemCounts, namespace)) {
-    return itemCounts[namespace];
+};
+function clampLimit(value, fallback, max, label) {
+  if (value === void 0) return fallback;
+  if (!Number.isFinite(value) || !Number.isInteger(value) || value < 1 || value > max) {
+    throw new WearablesInputError(
+      `invalid ${label} '${value}' \u2014 expected an integer between 1 and ${max}`
+    );
   }
-  return result?.itemCount;
+  return value;
+}
+function locateTranscriptPath(hitPath) {
+  const normalized = hitPath.replace(/\\/g, "/");
+  const match = normalized.match(
+    /(?:^|\/)wearables\/([a-z][a-z0-9-]{0,63})\/(\d{4}-\d{2}-\d{2})\.md$/
+  );
+  if (!match) return null;
+  if (!isValidTranscriptDate(match[2])) return null;
+  return { source: match[1], date: match[2] };
+}
+function extractSnippet(body, index, matchLength) {
+  const start = Math.max(0, index - 80);
+  const end = Math.min(body.length, index + matchLength + 80);
+  const prefix = start > 0 ? "\u2026" : "";
+  const suffix = end < body.length ? "\u2026" : "";
+  return `${prefix}${body.slice(start, end).replace(/\s+/g, " ").trim()}${suffix}`;
 }
 
 // src/scopes/scope-plan.ts
@@ -3625,7 +1706,7 @@ function flattenStructuredSectionEvidence(sections) {
   );
 }
 function fingerprintEntitySynthesisEvidence(entity) {
-  const fingerprint = createHash2("sha256");
+  const fingerprint = createHash("sha256");
   const timelineEntries = entity.timeline.map((entry) => [
     entry.timestamp,
     entry.source ?? "",
@@ -3675,7 +1756,7 @@ async function raceRecallAbort(promise, signal, message = "recall aborted") {
   }
 }
 function qmdCollectionPathParts(resultPath) {
-  if (!resultPath || path4.isAbsolute(resultPath)) return null;
+  if (!resultPath || path2.isAbsolute(resultPath)) return null;
   const normalized = resultPath.replace(/\\/g, "/").replace(/^\/+/, "");
   const slashIndex = normalized.indexOf("/");
   if (slashIndex <= 0 || slashIndex >= normalized.length - 1) return null;
@@ -3688,9 +1769,9 @@ function qmdCollectionPathParts(resultPath) {
 }
 function qmdResultPathCandidates(storageDir, resultPath) {
   const candidates = /* @__PURE__ */ new Set();
-  const storageRoot = path4.resolve(storageDir);
+  const storageRoot = path2.resolve(storageDir);
   const addCandidate = (candidate) => {
-    const resolved = path4.resolve(candidate);
+    const resolved = path2.resolve(candidate);
     if (isPathInsideStorageRoot(storageRoot, resolved)) {
       candidates.add(resolved);
     }
@@ -3698,12 +1779,12 @@ function qmdResultPathCandidates(storageDir, resultPath) {
   const addRelativeCandidates = (relativePath) => {
     const normalized = relativePath.replace(/\\/g, "/").replace(/^\/+/, "");
     if (!normalized) return;
-    addCandidate(path4.join(storageRoot, normalized));
+    addCandidate(path2.join(storageRoot, normalized));
     if (/^\d{4}-\d{2}-\d{2}\//.test(normalized)) {
-      addCandidate(path4.join(storageRoot, "facts", normalized));
+      addCandidate(path2.join(storageRoot, "facts", normalized));
     }
   };
-  if (path4.isAbsolute(resultPath)) {
+  if (path2.isAbsolute(resultPath)) {
     addCandidate(resultPath);
   } else {
     addRelativeCandidates(resultPath);
@@ -3820,11 +1901,11 @@ async function qmdStartupCollectionCheckWithTimeout(promise, controller, label)
   return await Promise.race([checkedPromise, timeoutPromise]);
 }
 function defaultWorkspaceDir() {
-  return path4.join(os.homedir(), ".openclaw", "workspace");
+  return path2.join(os.homedir(), ".openclaw", "workspace");
 }
 function sanitizeSessionKeyForFilename(sessionKey) {
   const readable = sessionKey.replace(/[^a-zA-Z0-9._-]/g, "_");
-  const hash = createHash2("sha256").update(sessionKey).digest("hex").slice(0, 12);
+  const hash = createHash("sha256").update(sessionKey).digest("hex").slice(0, 12);
   return `${readable}-${hash}`;
 }
 function latestSourceValidAtFromTurns(turns) {
@@ -4127,11 +2208,11 @@ function mergeGraphExpandedResults(primary, expanded) {
   return Array.from(mergedByPath.values());
 }
 function graphPathRelativeToStorage(storageDir, candidatePath) {
-  const absolutePath = path4.isAbsolute(candidatePath) ? candidatePath : path4.resolve(storageDir, candidatePath);
-  const rel = path4.relative(storageDir, absolutePath);
+  const absolutePath = path2.isAbsolute(candidatePath) ? candidatePath : path2.resolve(storageDir, candidatePath);
+  const rel = path2.relative(storageDir, absolutePath);
   if (!rel || rel === ".") return null;
   if (rel.startsWith("..")) return null;
-  return rel.split(path4.sep).join("/");
+  return rel.split(path2.sep).join("/");
 }
 function normalizeGraphActivationScore(score) {
   const bounded = Number.isFinite(score) && score > 0 ? score : 0;
@@ -4273,7 +2354,7 @@ function buildMemoryPathById(allMemsForGraph, storageDir) {
   for (const mem of allMemsForGraph ?? []) {
     const id = mem.frontmatter.id;
     if (!id) continue;
-    pathById.set(id, path4.relative(storageDir, mem.path));
+    pathById.set(id, path2.relative(storageDir, mem.path));
   }
   return pathById;
 }
@@ -4281,7 +2362,7 @@ function appendMemoryToGraphContext(options) {
   if (!Array.isArray(options.allMemsForGraph)) return;
   const nowIso = (/* @__PURE__ */ new Date()).toISOString();
   options.allMemsForGraph.push({
-    path: path4.join(options.storageDir, options.memoryRelPath),
+    path: path2.join(options.storageDir, options.memoryRelPath),
     content: options.content,
     frontmatter: {
       id: options.memoryId,
@@ -4301,16 +2382,16 @@ function resolvePersistedMemoryRelativePath(options) {
   const persisted = options.pathById.get(options.memoryId);
   if (persisted) return persisted;
   if (options.category === "correction") {
-    return path4.join("corrections", `${options.memoryId}.md`);
+    return path2.join("corrections", `${options.memoryId}.md`);
   }
   const subtree = categoryDirName(options.category);
   const idParts = options.memoryId.split("-");
   const maybeTimestamp = Number(idParts[1]);
   if (Number.isFinite(maybeTimestamp) && maybeTimestamp > 0) {
     const day = new Date(maybeTimestamp).toISOString().slice(0, 10);
-    return path4.join(subtree, day, `${options.memoryId}.md`);
+    return path2.join(subtree, day, `${options.memoryId}.md`);
   }
-  return path4.join(subtree, `${options.memoryId}.md`);
+  return path2.join(subtree, `${options.memoryId}.md`);
 }
 function qmdMaintenanceSkipReasonForError(error) {
   const message = error instanceof Error ? error.message : String(error);
@@ -4745,7 +2826,7 @@ var Orchestrator = class _Orchestrator {
     const defaultNs = normalizeNamespaceIdentity(this.config.defaultNamespace);
     if (ns !== defaultNs && !isSafeRouteNamespace(ns)) return;
     if (!this.storageDirMatchesNamespaceHint(ns, storageDir)) return;
-    const resolvedStorageDir = path4.resolve(storageDir);
+    const resolvedStorageDir = path2.resolve(storageDir);
     let hints = this.namespaceStorageDirHints.get(resolvedStorageDir);
     if (!hints) {
       hints = /* @__PURE__ */ new Set();
@@ -4756,21 +2837,21 @@ var Orchestrator = class _Orchestrator {
   storageDirMatchesNamespaceHint(namespace, storageDir) {
     const ns = normalizeNamespaceIdentity(namespace);
     if (!ns) return false;
-    const resolvedStorageDir = path4.resolve(storageDir);
-    const resolvedMemoryDir = path4.resolve(this.config.memoryDir);
+    const resolvedStorageDir = path2.resolve(storageDir);
+    const resolvedMemoryDir = path2.resolve(this.config.memoryDir);
     const defaultNs = normalizeNamespaceIdentity(this.config.defaultNamespace);
     if (resolvedStorageDir === resolvedMemoryDir) return ns === defaultNs;
-    const resolvedNamespacesDir = path4.join(resolvedMemoryDir, "namespaces");
+    const resolvedNamespacesDir = path2.join(resolvedMemoryDir, "namespaces");
     if (!isPathInsideStorageRoot(resolvedNamespacesDir, resolvedStorageDir)) return false;
-    const rawRoot = path4.resolve(resolvedNamespacesDir, ns);
-    const tokenRoot = path4.resolve(resolvedNamespacesDir, namespaceIdentityToken(ns));
+    const rawRoot = path2.resolve(resolvedNamespacesDir, ns);
+    const tokenRoot = path2.resolve(resolvedNamespacesDir, namespaceIdentityToken(ns));
     return resolvedStorageDir === rawRoot || resolvedStorageDir === tokenRoot;
   }
   namespaceStorageDirHintOwnershipRank(record, resolvedStorageDir, configured) {
-    if (resolvedStorageDir === path4.resolve(this.config.memoryDir)) {
+    if (resolvedStorageDir === path2.resolve(this.config.memoryDir)) {
       return record.namespace === normalizeNamespaceIdentity(this.config.defaultNamespace) ? 0 : 3;
     }
-    const leaf = path4.basename(resolvedStorageDir);
+    const leaf = path2.basename(resolvedStorageDir);
     const tokenOwnsRoot = namespaceIdentityToken(record.namespace) === leaf;
     if (tokenOwnsRoot && configured.has(record.namespace)) return 0;
     if (record.namespace === leaf) return 1;
@@ -4798,7 +2879,7 @@ var Orchestrator = class _Orchestrator {
   loadNamespaceStorageDirHintsFromCatalog() {
     if (this.namespaceStorageDirHintsLoaded || !this.namespaceCatalog.enabled) return;
     this.namespaceStorageDirHintsLoaded = true;
-    const catalogPath = path4.join(this.config.memoryDir, "state", "namespaces.jsonl");
+    const catalogPath = path2.join(this.config.memoryDir, "state", "namespaces.jsonl");
     if (!existsSync(catalogPath)) return;
     let body;
     try {
@@ -4835,7 +2916,7 @@ var Orchestrator = class _Orchestrator {
       if (!this.storageDirMatchesNamespaceHint(record.namespace, record.storageDir)) {
         continue;
       }
-      const resolvedStorageDir = path4.resolve(record.storageDir);
+      const resolvedStorageDir = path2.resolve(record.storageDir);
       const current = preferredByStorageDir.get(resolvedStorageDir);
       preferredByStorageDir.set(
         resolvedStorageDir,
@@ -4874,6 +2955,36 @@ var Orchestrator = class _Orchestrator {
     });
     return plan.namespaces.map((candidate) => candidate.namespace);
   }
+  /**
+   * Fan out a maintenance job across all maintained namespaces (issue #1500).
+   *
+   * Delegates to the namespace-maintenance-fanout coordinator, which plans
+   * namespace discovery (configured + catalog), applies the cycle budget,
+   * acquires per-job+namespace locks, records status files, and touches the
+   * catalog's `lastMaintenanceAt`. The runner receives a per-namespace
+   * candidate and a storage resolver wired to `this.getStorage(namespace)`.
+   *
+   * When namespaces are disabled the planner returns only the default
+   * namespace, so the job runs exactly once — preserving single-user behavior.
+   */
+  async runNamespaceMaintenanceFanoutForJob(jobName, runner, options = {}) {
+    return runNamespaceMaintenanceFanout({
+      config: this.config,
+      catalog: this.namespaceCatalog,
+      jobName,
+      runner,
+      resolveStorage: (namespace) => this.getStorage(namespace),
+      enabled: options.enabled
+    });
+  }
+  /**
+   * Read-only namespace maintenance health summary for doctor / dashboard /
+   * CLI (issue #1500). Aggregates all per-namespace maintenance status files
+   * into one report without running any maintenance.
+   */
+  async readNamespaceMaintenanceHealth() {
+    return summarizeNamespaceMaintenanceHealth(this.config);
+  }
   buildConfiguredQmdSearchOptions(queryText) {
     const intentHint = this.config.qmdIntentHintsEnabled ? buildQmdIntentHint(inferIntentFromText(queryText)) : void 0;
     const explain = this.config.qmdExplainEnabled === true;
@@ -5002,7 +3113,7 @@ var Orchestrator = class _Orchestrator {
     this.config = config;
     this.profiler = new ProfilingCollector({
       enabled: config.profilingEnabled,
-      storageDir: config.profilingStorageDir || path4.join(config.memoryDir, "profiling"),
+      storageDir: config.profilingStorageDir || path2.join(config.memoryDir, "profiling"),
       maxTraces: config.profilingMaxTraces
     });
     this.namespaceCatalog = new NamespaceCatalog(config);
@@ -5048,7 +3159,7 @@ var Orchestrator = class _Orchestrator {
     this.compounding = config.compoundingEnabled ? new CompoundingEngine(config, this.storage) : void 0;
     this.buffer = new SmartBuffer(config, this.storage);
     this.transcript = new TranscriptManager(config);
-    this.conversationIndexDir = path4.join(
+    this.conversationIndexDir = path2.join(
       config.memoryDir,
       "conversation-index",
       "chunks"
@@ -5105,7 +3216,7 @@ var Orchestrator = class _Orchestrator {
       this.modelRegistry
     );
     this.threading = new ThreadingManager(
-      path4.join(config.memoryDir, "threads"),
+      path2.join(config.memoryDir, "threads"),
       config.threadingGapMinutes
     );
     this.tmtBuilder = new TmtBuilder(config.memoryDir, {
@@ -5184,7 +3295,7 @@ var Orchestrator = class _Orchestrator {
       utilityPromoteThresholdDelta: this.utilityRuntimeValues?.promoteThresholdDelta ?? 0,
       utilityDemoteThresholdDelta: this.utilityRuntimeValues?.demoteThresholdDelta ?? 0
     };
-    return createHash2("sha256").update(JSON.stringify(payload)).digest("hex").slice(0, 12);
+    return createHash("sha256").update(JSON.stringify(payload)).digest("hex").slice(0, 12);
   }
   effectiveLifecycleThresholds() {
     const archiveDecayThreshold = this.config.lifecycleArchiveDecayThreshold;
@@ -5404,13 +3515,13 @@ var Orchestrator = class _Orchestrator {
       if (this.config.compactionResetEnabled) {
         try {
           const wsDir = this.config.workspaceDir || defaultWorkspaceDir();
-          const files = await readdir3(wsDir).catch(() => []);
+          const files = await readdir(wsDir).catch(() => []);
           for (const f of files) {
             if (!f.startsWith(".compaction-reset-signal-")) continue;
-            const fp = path4.join(wsDir, f);
-            const s = await stat3(fp).catch(() => null);
+            const fp = path2.join(wsDir, f);
+            const s = await stat(fp).catch(() => null);
             if (s && Date.now() - s.mtimeMs >= COMPACTION_SIGNAL_MAX_AGE_MS) {
-              await unlink2(fp).catch(() => {
+              await unlink(fp).catch(() => {
               });
               log.debug(`initialize: removed stale compaction signal ${f}`);
             }
@@ -5665,7 +3776,7 @@ var Orchestrator = class _Orchestrator {
     if (signal.aborted) return;
     if (!this.wearablesAutoSyncHandle && this.config.wearables.enabled && this.config.wearables.autoSyncEnabled && Object.values(this.config.wearables.sources).some((source) => source.enabled)) {
       try {
-        const { startWearablesAutoSync } = await import("./auto-sync-NUQWSFQD.js");
+        const { startWearablesAutoSync } = await import("./auto-sync-RWXT6P5M.js");
         if (signal.aborted) return;
         this.wearablesAutoSyncHandle = startWearablesAutoSync(
           {
@@ -5686,9 +3797,9 @@ var Orchestrator = class _Orchestrator {
           `wearables auto-sync started: every ${this.config.wearables.autoSyncIntervalMinutes}m over ${this.config.wearables.autoSyncDays}d (deep ${this.config.wearables.autoSyncDeepDays}d daily)`
         );
       } catch (err) {
-        const { displayErrorDetail: displayErrorDetail2 } = await import("./runtime/better-sqlite.js");
+        const { displayErrorDetail } = await import("./runtime/better-sqlite.js");
         log.warn(
-          `wearables auto-sync failed to start (non-fatal): ${displayErrorDetail2(err)}`
+          `wearables auto-sync failed to start (non-fatal): ${displayErrorDetail(err)}`
         );
       }
     }
@@ -5801,7 +3912,7 @@ var Orchestrator = class _Orchestrator {
    */
   async autoRegisterDaySummaryCron() {
     const home = resolveHomeDir();
-    const jobsPath = path4.join(home, ".openclaw", "cron", "jobs.json");
+    const jobsPath = path2.join(home, ".openclaw", "cron", "jobs.json");
     try {
       if (!existsSync(jobsPath)) {
         log.debug(
@@ -5854,7 +3965,7 @@ var Orchestrator = class _Orchestrator {
   }
   async autoRegisterNightlyGovernanceCron() {
     const home = resolveHomeDir();
-    const jobsPath = path4.join(home, ".openclaw", "cron", "jobs.json");
+    const jobsPath = path2.join(home, ".openclaw", "cron", "jobs.json");
     try {
       if (!existsSync(jobsPath)) {
         log.debug("nightly governance cron: jobs.json not found, skipping auto-register");
@@ -5876,7 +3987,7 @@ var Orchestrator = class _Orchestrator {
   }
   async autoRegisterProceduralMiningCron() {
     const home = resolveHomeDir();
-    const jobsPath = path4.join(home, ".openclaw", "cron", "jobs.json");
+    const jobsPath = path2.join(home, ".openclaw", "cron", "jobs.json");
     try {
       if (!existsSync(jobsPath)) {
         log.debug("procedural mining cron: jobs.json not found, skipping auto-register");
@@ -5896,7 +4007,7 @@ var Orchestrator = class _Orchestrator {
   }
   async autoRegisterContradictionScanCron() {
     const home = resolveHomeDir();
-    const jobsPath = path4.join(home, ".openclaw", "cron", "jobs.json");
+    const jobsPath = path2.join(home, ".openclaw", "cron", "jobs.json");
     try {
       if (!existsSync(jobsPath)) {
         log.debug("contradiction scan cron: jobs.json not found, skipping auto-register");
@@ -5916,7 +4027,7 @@ var Orchestrator = class _Orchestrator {
   }
   async autoRegisterPatternReinforcementCron() {
     const home = resolveHomeDir();
-    const jobsPath = path4.join(home, ".openclaw", "cron", "jobs.json");
+    const jobsPath = path2.join(home, ".openclaw", "cron", "jobs.json");
     try {
       if (!existsSync(jobsPath)) {
         log.debug("pattern reinforcement cron: jobs.json not found, skipping auto-register");
@@ -5976,9 +4087,92 @@ var Orchestrator = class _Orchestrator {
     );
     return { ran: true, result, namespace: cadenceKey };
   }
+  /**
+   * Fan out pattern reinforcement across all maintained namespaces (issue #1500).
+   * Delegates per-namespace execution to {@link runPatternReinforcement} while
+   * the planner handles discovery, budgeting, locking, and status recording.
+   * When namespaces are disabled, runs once against default storage.
+   */
+  async runPatternReinforcementFanout(options = {}) {
+    return this.runNamespaceMaintenanceFanoutForJob(
+      "pattern-reinforcement",
+      async (ctx) => {
+        const result = await this.runPatternReinforcement({
+          namespace: ctx.candidate.namespace,
+          force: options.force
+        });
+        if (!result.ran) {
+          return {
+            skipped: true,
+            skipReason: result.skippedReason ?? "throttled"
+          };
+        }
+        return result.result ? { itemCount: result.result.clustersFound } : { itemCount: 0 };
+      },
+      { enabled: this.config.patternReinforcementEnabled }
+    );
+  }
+  /**
+   * Fan out lifecycle/governance policy across all maintained namespaces
+   * (issue #1500). Each namespace gets its own lifecycle pass against its
+   * namespace-scoped storage. When namespaces are disabled, runs once against
+   * default storage.
+   */
+  async runLifecyclePolicyFanout() {
+    return this.runNamespaceMaintenanceFanoutForJob(
+      "lifecycle",
+      async (ctx) => {
+        const storage = await this.getStorage(ctx.candidate.namespace);
+        const corpus = await storage.readAllMemories();
+        const assessed = await this.runLifecyclePolicyPass(corpus, storage);
+        return { itemCount: assessed };
+      },
+      { enabled: this.config.lifecyclePolicyEnabled }
+    );
+  }
+  /**
+   * Fan out semantic consolidation across all maintained namespaces (issue #1500).
+   * Each namespace gets its own consolidation pass against its namespace-scoped
+   * storage. When namespaces are disabled, runs once against default storage.
+   */
+  async runSemanticConsolidationFanout(options = {}) {
+    return this.runNamespaceMaintenanceFanoutForJob(
+      "semantic-consolidation",
+      async (ctx) => {
+        const storage = await this.getStorage(ctx.candidate.namespace);
+        const result = await this.runSemanticConsolidation({
+          dryRun: options.dryRun,
+          thresholdOverride: void 0,
+          force: true,
+          storage
+        });
+        return { itemCount: result.clustersFound };
+      },
+      { enabled: this.config.semanticConsolidationEnabled }
+    );
+  }
+  /**
+   * Fan out deep-sleep governance across all maintained namespaces (issue #1500).
+   * Each namespace gets its own governance scan against its namespace-scoped
+   * storage. When namespaces are disabled, runs once against default storage.
+   */
+  async runDeepSleepGovernanceFanout(options = {}) {
+    return this.runNamespaceMaintenanceFanoutForJob(
+      "governance",
+      async (ctx) => {
+        const storage = await this.getStorage(ctx.candidate.namespace);
+        const result = await this.runDeepSleepGovernanceNow({
+          dryRun: options.dryRun,
+          storage
+        });
+        return { itemCount: result.scannedMemories };
+      },
+      { enabled: this.config.dreamsPhases.deepSleep.enabled }
+    );
+  }
   async autoRegisterGraphEdgeDecayCron() {
     const home = resolveHomeDir();
-    const jobsPath = path4.join(home, ".openclaw", "cron", "jobs.json");
+    const jobsPath = path2.join(home, ".openclaw", "cron", "jobs.json");
     try {
       if (!existsSync(jobsPath)) {
         log.debug("graph edge decay cron: jobs.json not found, skipping auto-register");
@@ -6035,15 +4229,15 @@ ${doc.content}` : doc.content,
     this.lastFileHygieneRunAtMs = now;
     if (hygiene.rotateEnabled) {
       for (const rel of hygiene.rotatePaths) {
-        const abs = path4.isAbsolute(rel) ? rel : path4.join(this.config.workspaceDir, rel);
+        const abs = path2.isAbsolute(rel) ? rel : path2.join(this.config.workspaceDir, rel);
         try {
-          const raw = await readFile4(abs, "utf-8");
+          const raw = await readFile2(abs, "utf-8");
           if (raw.length > hygiene.rotateMaxBytes) {
-            const archiveDir = path4.join(
+            const archiveDir = path2.join(
               this.config.workspaceDir,
               hygiene.archiveDir
             );
-            const base = path4.basename(abs);
+            const base = path2.basename(abs);
             const prefix = base.toUpperCase().replace(/\.MD$/i, "").replace(/[^A-Z0-9]+/g, "-") || "FILE";
             const { newContent } = await rotateMarkdownFileToArchive({
               filePath: abs,
@@ -6051,7 +4245,7 @@ ${doc.content}` : doc.content,
               archivePrefix: prefix,
               keepTailChars: hygiene.rotateKeepTailChars
             });
-            await writeFile4(abs, newContent, "utf-8");
+            await writeFile2(abs, newContent, "utf-8");
           }
         } catch {
         }
@@ -6068,8 +4262,8 @@ ${doc.content}` : doc.content,
         log.warn(w.message);
       }
       if (hygiene.warningsLogEnabled && warnings.length > 0) {
-        const fp = path4.join(this.config.memoryDir, hygiene.warningsLogPath);
-        await mkdir4(path4.dirname(fp), { recursive: true });
+        const fp = path2.join(this.config.memoryDir, hygiene.warningsLogPath);
+        await mkdir2(path2.dirname(fp), { recursive: true });
         const stamp = (/* @__PURE__ */ new Date()).toISOString();
         const block = `
 
@@ -6078,11 +4272,11 @@ ${doc.content}` : doc.content,
 ` + warnings.map((w) => `- ${w.message}`).join("\n") + "\n";
         let existing = "";
         try {
-          existing = await readFile4(fp, "utf-8");
+          existing = await readFile2(fp, "utf-8");
         } catch {
           existing = "# Engram File Hygiene Warnings\n";
         }
-        await writeFile4(fp, existing + block, "utf-8");
+        await writeFile2(fp, existing + block, "utf-8");
       }
     }
   }
@@ -6547,26 +4741,26 @@ ${evidenceText}`
     const facts = [];
     let memoryRootReal = null;
     try {
-      memoryRootReal = await realpath2(storage.dir);
+      memoryRootReal = await realpath(storage.dir);
     } catch {
       memoryRootReal = null;
     }
     for (const categoryDir of RECALL_FALLBACK_DIRS) {
       if (memoryRootReal === null) break;
       for (const date of datesToScan) {
-        const dateDir = path4.join(storage.dir, categoryDir, date);
+        const dateDir = path2.join(storage.dir, categoryDir, date);
         try {
-          const dirStat = await lstat3(dateDir);
+          const dirStat = await lstat(dateDir);
           if (dirStat.isSymbolicLink() || !dirStat.isDirectory()) continue;
-          assertPathInsideRoot(memoryRootReal, await realpath2(dateDir), dateDir);
-          const entries = await readdir3(dateDir, { withFileTypes: true });
+          assertPathInsideRoot(memoryRootReal, await realpath(dateDir), dateDir);
+          const entries = await readdir(dateDir, { withFileTypes: true });
           for (const entry of entries) {
             if (entry.isSymbolicLink()) continue;
             if (!entry.name.endsWith(".md")) continue;
-            const fullPath = path4.join(dateDir, entry.name);
+            const fullPath = path2.join(dateDir, entry.name);
             try {
-              assertPathInsideRoot(memoryRootReal, await realpath2(fullPath), fullPath);
-              const raw = await readFile4(fullPath, "utf-8");
+              assertPathInsideRoot(memoryRootReal, await realpath(fullPath), fullPath);
+              const raw = await readFile2(fullPath, "utf-8");
               const fmMatch = raw.match(/^---\n([\s\S]*?)\n---\n?([\s\S]*)$/);
               if (!fmMatch) continue;
               const fmBlock = fmMatch[1];
@@ -6585,7 +4779,7 @@ ${evidenceText}`
               facts.push({
                 path: fullPath,
                 frontmatter: {
-                  id: fm.id || path4.basename(entry.name, ".md"),
+                  id: fm.id || path2.basename(entry.name, ".md"),
                   category: fm.category || "fact",
                   created,
                   updated: fm.updated || created,
@@ -6608,15 +4802,15 @@ ${evidenceText}`
       return a.frontmatter.created < b.frontmatter.created ? -1 : 1;
     });
     const hourlySummaries = [];
-    const hourlyBaseDir = path4.join(storage.dir, "summaries", "hourly");
+    const hourlyBaseDir = path2.join(storage.dir, "summaries", "hourly");
     try {
-      const sessionKeys = await readdir3(hourlyBaseDir, { withFileTypes: true });
+      const sessionKeys = await readdir(hourlyBaseDir, { withFileTypes: true });
       for (const sk of sessionKeys) {
         if (!sk.isDirectory()) continue;
         for (const date of datesToScan) {
-          const summaryFile = path4.join(hourlyBaseDir, sk.name, `${date}.md`);
+          const summaryFile = path2.join(hourlyBaseDir, sk.name, `${date}.md`);
           try {
-            const raw = await readFile4(summaryFile, "utf-8");
+            const raw = await readFile2(summaryFile, "utf-8");
             const filtered = filterHourlySummaryMarkdownForLocalDay(
               raw,
               date,
@@ -6718,13 +4912,13 @@ ${evidenceText}`
   }
   async getLastGraphRecallSnapshot(namespace) {
     const storage = await this.getStorage(namespace);
-    const snapshotPath = path4.join(
+    const snapshotPath = path2.join(
       storage.dir,
       "state",
       "last_graph_recall.json"
     );
     try {
-      const raw = await readFile4(snapshotPath, "utf-8");
+      const raw = await readFile2(snapshotPath, "utf-8");
       const parsed = JSON.parse(raw);
       if (!parsed || typeof parsed !== "object") return null;
       return {
@@ -6757,9 +4951,9 @@ ${evidenceText}`
   }
   async getLastIntentSnapshot(namespace) {
     const storage = await this.getStorage(namespace);
-    const snapshotPath = path4.join(storage.dir, "state", "last_intent.json");
+    const snapshotPath = path2.join(storage.dir, "state", "last_intent.json");
     try {
-      const raw = await readFile4(snapshotPath, "utf-8");
+      const raw = await readFile2(snapshotPath, "utf-8");
       const parsed = JSON.parse(raw);
       if (!parsed || typeof parsed !== "object") return null;
       const graphDecision = parsed.graphDecision && typeof parsed.graphDecision === "object" ? parsed.graphDecision : void 0;
@@ -6790,13 +4984,13 @@ ${evidenceText}`
   }
   async getLastQmdRecallSnapshot(namespace) {
     const storage = await this.getStorage(namespace);
-    const snapshotPath = path4.join(
+    const snapshotPath = path2.join(
       storage.dir,
       "state",
       "last_qmd_recall.json"
     );
     try {
-      const raw = await readFile4(snapshotPath, "utf-8");
+      const raw = await readFile2(snapshotPath, "utf-8");
       const parsed = JSON.parse(raw);
       if (!parsed || typeof parsed !== "object") return null;
       return {
@@ -6940,10 +5134,10 @@ ${r.snippet.trim()}
   }
   async countConversationChunkDocs(dir) {
     try {
-      const entries = await readdir3(dir, { withFileTypes: true });
+      const entries = await readdir(dir, { withFileTypes: true });
       let total = 0;
       for (const entry of entries) {
-        const fullPath = path4.join(dir, entry.name);
+        const fullPath = path2.join(dir, entry.name);
         if (entry.isDirectory()) {
           total += await this.countConversationChunkDocs(fullPath);
           continue;
@@ -7667,7 +5861,7 @@ ${r.snippet.trim()}
       if (!options.onDebugSnapshot) return;
       await options.onDebugSnapshot({
         recordedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        queryHash: createHash2("sha256").update(prompt).digest("hex"),
+        queryHash: createHash("sha256").update(prompt).digest("hex"),
         queryLength: prompt.length,
         collection: options.collection,
         namespaces: options.recallNamespaces,
@@ -7849,7 +6043,7 @@ ${r.snippet.trim()}
         resolvedPath = resolvedCold.result.path;
         resolvedResult = resolvedCold.result;
       }
-      if (!path4.isAbsolute(resolvedPath)) {
+      if (!path2.isAbsolute(resolvedPath)) {
         resolvedAmbiguousSeeds.set(result.path, null);
         return null;
       }
@@ -7874,7 +6068,7 @@ ${r.snippet.trim()}
         }
         continue;
       }
-      if (path4.isAbsolute(result.path)) {
+      if (path2.isAbsolute(result.path)) {
         const resolved = await resolveAmbiguousSeedOwner(result, null);
         if (resolved) {
           addResultForNamespace(resolved.namespace, resolved.result);
@@ -7917,7 +6111,7 @@ ${r.snippet.trim()}
         0
       );
       seedPaths.push(
-        ...seedRelativePaths.map((rel) => path4.join(storage.dir, rel))
+        ...seedRelativePaths.map((rel) => path2.join(storage.dir, rel))
       );
       const seedSet = new Set(seedRelativePaths);
       const expanded = await this.graphIndexFor(storage).spreadingActivation(
@@ -7933,7 +6127,7 @@ ${r.snippet.trim()}
       for (const candidate of expanded.slice(0, perNamespaceExpandedCap)) {
         if (deadlineExpired()) break;
         if (seedSet.has(candidate.path)) continue;
-        const memoryPath = path4.resolve(storage.dir, candidate.path);
+        const memoryPath = path2.resolve(storage.dir, candidate.path);
         const memory = await storage.readMemoryByPath(memoryPath);
         if (deadlineExpired()) break;
         if (!memory) continue;
@@ -7958,7 +6152,7 @@ ${r.snippet.trim()}
           path: memory.path,
           score,
           namespace,
-          seed: path4.resolve(storage.dir, candidate.seed),
+          seed: path2.resolve(storage.dir, candidate.seed),
           hopDepth: candidate.hopDepth,
           decayedWeight: candidate.decayedWeight,
           graphType: candidate.graphType,
@@ -7979,12 +6173,12 @@ ${r.snippet.trim()}
   }
   async recordLastGraphRecallSnapshot(options) {
     try {
-      const snapshotPath = path4.join(
+      const snapshotPath = path2.join(
         options.storage.dir,
         "state",
         "last_graph_recall.json"
       );
-      await mkdir4(path4.dirname(snapshotPath), { recursive: true });
+      await mkdir2(path2.dirname(snapshotPath), { recursive: true });
       const now = (/* @__PURE__ */ new Date()).toISOString();
       const totalSeedCount = options.seedPaths.length;
       const totalExpandedCount = options.expandedPaths.length;
@@ -7996,7 +6190,7 @@ ${r.snippet.trim()}
       const payload = {
         recordedAt: now,
         mode: options.recallMode,
-        queryHash: createHash2("sha256").update(options.prompt).digest("hex"),
+        queryHash: createHash("sha256").update(options.prompt).digest("hex"),
         queryLength: options.prompt.length,
         namespaces: options.recallNamespaces,
         seedCount: totalSeedCount,
@@ -8011,20 +6205,20 @@ ${r.snippet.trim()}
         finalResults: (options.finalResults ?? []).slice(0, 64),
         shadowComparison: options.shadowComparison
       };
-      await writeFile4(snapshotPath, JSON.stringify(payload, null, 2), "utf-8");
+      await writeFile2(snapshotPath, JSON.stringify(payload, null, 2), "utf-8");
     } catch (err) {
       log.debug(`last graph recall write failed: ${err}`);
     }
   }
   async recordLastIntentSnapshot(options) {
     try {
-      const snapshotPath = path4.join(
+      const snapshotPath = path2.join(
         options.storage.dir,
         "state",
         "last_intent.json"
       );
-      await mkdir4(path4.dirname(snapshotPath), { recursive: true });
-      await writeFile4(
+      await mkdir2(path2.dirname(snapshotPath), { recursive: true });
+      await writeFile2(
         snapshotPath,
         JSON.stringify(options.snapshot, null, 2),
         "utf-8"
@@ -8035,13 +6229,13 @@ ${r.snippet.trim()}
   }
   async recordLastQmdRecallSnapshot(options) {
     try {
-      const snapshotPath = path4.join(
+      const snapshotPath = path2.join(
         options.storage.dir,
         "state",
         "last_qmd_recall.json"
       );
-      await mkdir4(path4.dirname(snapshotPath), { recursive: true });
-      await writeFile4(
+      await mkdir2(path2.dirname(snapshotPath), { recursive: true });
+      await writeFile2(
         snapshotPath,
         JSON.stringify(options.snapshot, null, 2),
         "utf-8"
@@ -8055,9 +6249,9 @@ ${r.snippet.trim()}
       const stateDir = await this.resolveStateDirForNamespace(
         options.namespace
       );
-      const snapshotPath = path4.join(stateDir, "last_intent.json");
-      await mkdir4(path4.dirname(snapshotPath), { recursive: true });
-      await writeFile4(
+      const snapshotPath = path2.join(stateDir, "last_intent.json");
+      await mkdir2(path2.dirname(snapshotPath), { recursive: true });
+      await writeFile2(
         snapshotPath,
         JSON.stringify(options.snapshot, null, 2),
         "utf-8"
@@ -8068,24 +6262,24 @@ ${r.snippet.trim()}
   }
   async resolveStateDirForNamespace(namespace) {
     if (!this.config.namespacesEnabled) {
-      return path4.join(this.config.memoryDir, "state");
+      return path2.join(this.config.memoryDir, "state");
     }
     if (namespace !== this.config.defaultNamespace) {
-      return path4.join(this.config.memoryDir, "namespaces", namespace, "state");
+      return path2.join(this.config.memoryDir, "namespaces", namespace, "state");
     }
-    const candidate = path4.join(
+    const candidate = path2.join(
       this.config.memoryDir,
       "namespaces",
       this.config.defaultNamespace
     );
     try {
-      const candidateStat = await stat3(candidate);
+      const candidateStat = await stat(candidate);
       if (candidateStat.isDirectory()) {
-        return path4.join(candidate, "state");
+        return path2.join(candidate, "state");
       }
     } catch {
     }
-    return path4.join(this.config.memoryDir, "state");
+    return path2.join(this.config.memoryDir, "state");
   }
   buildGraphRecallRankedResults(results, sourceLabelResolver, limit = 64) {
     return results.slice(0, limit).map((result) => ({
@@ -8338,8 +6532,8 @@ ${r.snippet.trim()}
         timings,
         logger: log
       });
-      const promptHash = createHash2("sha256").update(prompt).digest("hex");
-      const traceId = createHash2("sha256").update(`${sessionKey ?? "default"}:${recallStart}:${promptHash}`).digest("hex").slice(0, 16);
+      const promptHash = createHash("sha256").update(prompt).digest("hex");
+      const traceId = createHash("sha256").update(`${sessionKey ?? "default"}:${recallStart}:${promptHash}`).digest("hex").slice(0, 16);
       const sectionBuckets = /* @__PURE__ */ new Map();
       const queryPolicy = buildRecallQueryPolicy(prompt, sessionKey, {
         cronRecallPolicyEnabled: this.config.cronRecallPolicyEnabled,
@@ -8348,7 +6542,7 @@ ${r.snippet.trim()}
         cronConversationRecallMode: this.config.cronConversationRecallMode
       });
       const retrievalQuery = queryPolicy.retrievalQuery || prompt;
-      const retrievalQueryHash = createHash2("sha256").update(retrievalQuery).digest("hex");
+      const retrievalQueryHash = createHash("sha256").update(retrievalQuery).digest("hex");
       const policyVersion = this.currentPolicyVersion();
       let impressionRecorded = false;
       let recallSource = "none";
@@ -8483,7 +6677,7 @@ ${r.snippet.trim()}
       const graphExpandedResultPaths = /* @__PURE__ */ new Set();
       const graphSourceLabelsForPath = (resultPath) => {
         const labels = [];
-        const normalizedPath = resultPath.split(path4.sep).join("/");
+        const normalizedPath = resultPath.split(path2.sep).join("/");
         const isEntityPath = normalizedPath.startsWith("entities/") || normalizedPath.includes("/entities/");
         if (graphBaselinePaths.has(resultPath)) labels.push("baseline");
         if (graphExpandedResultPaths.has(resultPath))
@@ -8633,7 +6827,7 @@ ${r.snippet.trim()}
         profileStorageNamespaces.map((namespace) => this.storageRouter.storageFor(namespace))
       );
       const emptyProfileStorage = new Proxy(
-        { dir: path4.join(this.config.memoryDir, ".empty-scope-profile") },
+        { dir: path2.join(this.config.memoryDir, ".empty-scope-profile") },
         {
           get(target, prop) {
             if (prop in target) return target[prop];
@@ -10109,16 +8303,16 @@ ${formatted}`;
         if (!this.config.compactionResetEnabled) return null;
         const workspaceDir = compactionWorkspaceDir || this.config.workspaceDir || defaultWorkspaceDir();
         const safeSessionKey = sanitizeSessionKeyForFilename(effectiveSessionKey);
-        const signalPath = path4.join(
+        const signalPath = path2.join(
           workspaceDir,
           `.compaction-reset-signal-${safeSessionKey}`
         );
-        const bootPath = path4.join(workspaceDir, "BOOT.md");
+        const bootPath = path2.join(workspaceDir, "BOOT.md");
         try {
-          const signalStat = await stat3(signalPath).catch(() => null);
+          const signalStat = await stat(signalPath).catch(() => null);
           if (!signalStat) return null;
           const signalAge = Date.now() - signalStat.mtimeMs;
-          const signalData = JSON.parse(await readFile4(signalPath, "utf-8"));
+          const signalData = JSON.parse(await readFile2(signalPath, "utf-8"));
           if (signalData.sessionKey !== effectiveSessionKey) {
             log.debug(
               `recall: compaction signal is for ${signalData.sessionKey}, not ${effectiveSessionKey} \u2014 skipping`
@@ -10129,7 +8323,7 @@ ${formatted}`;
             log.debug(
               `recall: stale compaction signal (${Math.round(signalAge / 1e3)}s old), skipping`
             );
-            await unlink2(signalPath).catch(() => {
+            await unlink(signalPath).catch(() => {
             });
             return null;
           }
@@ -10138,7 +8332,7 @@ ${formatted}`;
 
 `;
           try {
-            const bootContent = await readFile4(bootPath, "utf-8");
+            const bootContent = await readFile2(bootPath, "utf-8");
             section += "### BOOT.md (working state before compaction)\n\n";
             section += bootContent + "\n";
           } catch {
@@ -10149,12 +8343,12 @@ ${formatted}`;
           log.info(
             `recall: injected compaction reset context for ${effectiveSessionKey}`
           );
-          await unlink2(signalPath).catch(() => {
+          await unlink(signalPath).catch(() => {
           });
           return section;
         } catch (err) {
           log.debug("recall: compaction signal check failed:", err);
-          await unlink2(signalPath).catch(() => {
+          await unlink(signalPath).catch(() => {
           });
           return null;
         }
@@ -12293,7 +10487,7 @@ _Context: ${topQuestion.context}_`
     const shouldUseStableBatchKey = turns.some(
       (turn) => turn.persistProcessedFingerprint === true || typeof turn.turnFingerprint === "string" && turn.turnFingerprint.length > 0
     );
-    const stableBatchFingerprint = shouldUseStableBatchKey ? createHash2("sha256").update(
+    const stableBatchFingerprint = shouldUseStableBatchKey ? createHash("sha256").update(
       turns.map(
         (turn) => [
           turn.role,
@@ -12550,7 +10744,7 @@ _Context: ${topQuestion.context}_`
   buildExtractionFingerprint(turns, bufferKey) {
     const normalized = this.normalizeExtractionFingerprintTurns(turns).join("\n");
     if (!normalized) return null;
-    return createHash2("sha256").update(`${bufferKey}
+    return createHash("sha256").update(`${bufferKey}
 ${normalized}`).digest("hex");
   }
   shouldQueueExtraction(turns, options = {}) {
@@ -13075,7 +11269,7 @@ ${normalized}`).digest("hex");
     );
     this.tierMigrationInFlight = true;
     try {
-      const coldStorage = new StorageManager(path4.join(storage.dir, "cold"));
+      const coldStorage = new StorageManager(path2.join(storage.dir, "cold"));
       const [hotMemories, coldMemories] = await Promise.all([
         storage.readAllMemories(),
         coldStorage.readAllMemories()
@@ -14491,7 +12685,7 @@ ${normalized}`).digest("hex");
         const allMems = allMemsForGraph ?? [];
         for (const m of allMems) {
           if (m.frontmatter.entityRef === entityRef) {
-            const rel = path4.relative(storage.dir, m.path);
+            const rel = path2.relative(storage.dir, m.path);
             if (rel !== memoryRelPath) entitySiblings.push(rel);
           }
         }
@@ -14813,14 +13007,14 @@ ${normalized}`).digest("hex");
     }
     if (this.config.semanticConsolidationEnabled) {
       try {
-        const stateFilePath = path4.join(
+        const stateFilePath = path2.join(
           this.config.memoryDir,
           "state",
           "semantic-consolidation-last-run.json"
         );
         let shouldRun = true;
         try {
-          const stateRaw = await readFile4(stateFilePath, "utf-8");
+          const stateRaw = await readFile2(stateFilePath, "utf-8");
           const stateData = JSON.parse(stateRaw);
           if (stateData.lastRunAt) {
             const lastRunMs = new Date(stateData.lastRunAt).getTime();
@@ -14861,9 +13055,9 @@ ${normalized}`).digest("hex");
             );
           }
           if (semResult.errors === 0 || semResult.memoriesArchived > 0) {
-            const stateDir = path4.join(this.config.memoryDir, "state");
-            await mkdir4(stateDir, { recursive: true });
-            await writeFile4(
+            const stateDir = path2.join(this.config.memoryDir, "state");
+            await mkdir2(stateDir, { recursive: true });
+            await writeFile2(
               stateFilePath,
               JSON.stringify({ lastRunAt: (/* @__PURE__ */ new Date()).toISOString() }),
               "utf-8"
@@ -15059,7 +13253,7 @@ ${texts.map((t, i) => `[${i + 1}] ${t}`).join("\n\n")}`;
       }
     });
     const content = renderCompressionGuidelinesMarkdown(refinedCandidate);
-    const contentHash = createHash2("sha256").update(content).digest("hex");
+    const contentHash = createHash("sha256").update(content).digest("hex");
     const semanticRefinementApplied = JSON.stringify(refinedCandidate.ruleUpdates) !== JSON.stringify(candidate.ruleUpdates);
     const changedRules = refinedCandidate.ruleUpdates.filter(
       (rule) => rule.delta !== 0
@@ -15361,13 +13555,13 @@ ${texts.map((t, i) => `[${i + 1}] ${t}`).join("\n\n")}`;
         protectedCategories: this.config.lifecycleProtectedCategories
       }
     };
-    const metricsPath = path4.join(
+    const metricsPath = path2.join(
       storage.dir,
       "state",
       "lifecycle-metrics.json"
     );
-    await mkdir4(path4.dirname(metricsPath), { recursive: true });
-    await writeFile4(metricsPath, JSON.stringify(metrics, null, 2), "utf-8");
+    await mkdir2(path2.dirname(metricsPath), { recursive: true });
+    await writeFile2(metricsPath, JSON.stringify(metrics, null, 2), "utf-8");
     return updatedCount;
   }
   /**
@@ -15890,7 +14084,7 @@ ${lines.join("\n\n")}`;
       const seenStorageDirs = /* @__PURE__ */ new Set();
       const addStorage = (storage) => {
         const storageDir = storageDirFor(storage);
-        const storageKey = storageDir ? path4.resolve(storageDir) : `storage-without-dir-${storages.length}`;
+        const storageKey = storageDir ? path2.resolve(storageDir) : `storage-without-dir-${storages.length}`;
         if (seenStorageDirs.has(storageKey)) return;
         seenStorageDirs.add(storageKey);
         storages.push(storage);
@@ -15920,7 +14114,7 @@ ${lines.join("\n\n")}`;
           continue;
         }
         try {
-          const coldRoot = path4.join(storageDir, "cold");
+          const coldRoot = path2.join(storageDir, "cold");
           for (const candidate of qmdResultPathCandidates(
             coldRoot,
             parts.relativePath
@@ -15961,7 +14155,7 @@ ${lines.join("\n\n")}`;
         return null;
       }
     }
-    if (path4.isAbsolute(resultPath)) {
+    if (path2.isAbsolute(resultPath)) {
       if (!fallbackStorageDir) {
         return await fallbackStorage.readMemoryByPath(resultPath);
       }
@@ -16000,7 +14194,7 @@ ${lines.join("\n\n")}`;
     );
     if (!memory) return null;
     let ownerNamespace = null;
-    if (path4.isAbsolute(memory.path)) {
+    if (path2.isAbsolute(memory.path)) {
       const ownerStorage = await this.storageForAbsoluteQmdResultPath(
         memory.path,
         fallbackStorage,
@@ -16024,16 +14218,16 @@ ${lines.join("\n\n")}`;
     };
   }
   async storageForAbsoluteQmdResultPath(resultPath, fallbackStorage, recallNamespaces = []) {
-    const resolvedPath = path4.resolve(resultPath);
-    const memoryRoot = path4.resolve(this.config.memoryDir);
-    const namespacesRoot = path4.join(memoryRoot, "namespaces");
+    const resolvedPath = path2.resolve(resultPath);
+    const memoryRoot = path2.resolve(this.config.memoryDir);
+    const namespacesRoot = path2.join(memoryRoot, "namespaces");
     const fallbackStorageDir = typeof fallbackStorage.dir === "string" && fallbackStorage.dir ? fallbackStorage.dir : null;
     const matches = [];
     const seenDirs = /* @__PURE__ */ new Set();
     const maybeAddStorage = (storage, namespace) => {
       const storageDir = typeof storage.dir === "string" && storage.dir ? storage.dir : null;
       if (!storageDir) return;
-      const candidateRoot = path4.resolve(storageDir);
+      const candidateRoot = path2.resolve(storageDir);
       if (seenDirs.has(candidateRoot)) return;
       if (!isPathInsideStorageRoot(candidateRoot, resolvedPath)) return;
       if (candidateRoot === memoryRoot && isPathInsideStorageRoot(namespacesRoot, resolvedPath)) {
@@ -16051,7 +14245,7 @@ ${lines.join("\n\n")}`;
       candidateNamespaces.add(ns);
     }
     if (isPathInsideStorageRoot(namespacesRoot, resolvedPath)) {
-      const relativeToNamespaces = path4.relative(namespacesRoot, resolvedPath);
+      const relativeToNamespaces = path2.relative(namespacesRoot, resolvedPath);
       const [namespaceSegment] = relativeToNamespaces.split(/[\\/]/);
       if (namespaceSegment) {
         candidateNamespaces.add(
@@ -16096,7 +14290,7 @@ ${lines.join("\n\n")}`;
           nsMap = buildMemoryWorthCounterMap(memories);
           this.memoryWorthCounterCache.set(ns, { at: nowMs, counters: nsMap });
         }
-        for (const [path5, c] of nsMap) counters.set(path5, c);
+        for (const [path3, c] of nsMap) counters.set(path3, c);
       } catch (err) {
         log.debug("memory-worth: failed to read namespace, skipping", {
           namespace: ns,
@@ -16267,12 +14461,12 @@ ${lines.join("\n\n")}`;
    */
   semanticDedupScopeFor(targetStorage) {
     if (!this.config.namespacesEnabled) return {};
-    const memoryDir = path4.resolve(this.config.memoryDir);
-    const storageDir = path4.resolve(targetStorage.dir);
+    const memoryDir = path2.resolve(this.config.memoryDir);
+    const storageDir = path2.resolve(targetStorage.dir);
     if (storageDir === memoryDir) {
       return { pathExcludePrefixes: ["namespaces/"] };
     }
-    let rel = path4.relative(memoryDir, storageDir);
+    let rel = path2.relative(memoryDir, storageDir);
     if (!rel || rel.startsWith("..")) {
       log.debug(
         `semantic dedup: target storage dir ${storageDir} is outside memoryDir ${memoryDir}; scoping lookup to absolute path prefix`
@@ -16291,7 +14485,7 @@ ${lines.join("\n\n")}`;
     if (hits.length === 0) return [];
     const results = [];
     for (const hit of hits) {
-      const fullPath = path4.isAbsolute(hit.path) ? hit.path : path4.join(this.config.memoryDir, hit.path);
+      const fullPath = path2.isAbsolute(hit.path) ? hit.path : path2.join(this.config.memoryDir, hit.path);
       const memory = await this.storage.readMemoryByPath(fullPath);
       if (!memory) continue;
       results.push({
@@ -16495,7 +14689,7 @@ ${lines.join("\n\n")}`;
           const storage = await this.storageRouter.storageFor(namespace);
           const storageDir = typeof storage.dir === "string" && storage.dir ? storage.dir : null;
           if (!storageDir) continue;
-          const recallRoot = path4.resolve(storageDir);
+          const recallRoot = path2.resolve(storageDir);
           if (seenRecallRoots.has(recallRoot)) continue;
           seenRecallRoots.add(recallRoot);
           recallRoots.push(recallRoot);
@@ -16519,8 +14713,8 @@ ${lines.join("\n\n")}`;
           if (resolvedCold) scopedResults.push(resolvedCold.result);
           continue;
         }
-        if (path4.isAbsolute(result.path)) {
-          const resolvedPath = path4.resolve(result.path);
+        if (path2.isAbsolute(result.path)) {
+          const resolvedPath = path2.resolve(result.path);
           if (recallRoots.some(
             (recallRoot) => isPathInsideStorageRoot(recallRoot, resolvedPath)
           )) {
@@ -16807,6 +15001,7 @@ ${lines.join("\n\n")}`;
   filterSearchResultsByRecallSafety(results, memoryByPath, options) {
     let lifecycleFilteredCount = 0;
     let temporalSupersededFilteredCount = 0;
+    let biTemporalExpiredFilteredCount = 0;
     let dedicatedSurfaceFilteredCount = 0;
     let forgottenFilteredCount = 0;
     let blockedPathFilteredCount = 0;
@@ -16854,6 +15049,10 @@ ${lines.join("\n\n")}`;
           temporalSupersededFilteredCount += 1;
           continue;
         }
+        if (!asOfActive && this.config.temporalBiTemporal && !this.config.temporalExpiredInInjection && isValidityExpiredNow(memory.frontmatter, Date.now())) {
+          biTemporalExpiredFilteredCount += 1;
+          continue;
+        }
         if (options?.allowDedicatedSurface !== true && (memory.frontmatter.memoryKind === "dream" || memory.frontmatter.memoryKind === "procedural")) {
           dedicatedSurfaceFilteredCount += 1;
           continue;
@@ -16871,6 +15070,11 @@ ${lines.join("\n\n")}`;
         `temporal supersession filter removed ${temporalSupersededFilteredCount} superseded candidates`
       );
     }
+    if (biTemporalExpiredFilteredCount > 0) {
+      log.debug(
+        `bi-temporal validity filter removed ${biTemporalExpiredFilteredCount} expired-validity candidates from injection (temporal.biTemporal on)`
+      );
+    }
     if (dedicatedSurfaceFilteredCount > 0) {
       log.debug(
         `dedicated surface filter removed ${dedicatedSurfaceFilteredCount} dream/procedural candidates from generic recall`
@@ -17262,8 +15466,8 @@ ${lines.join("\n\n")}`;
   }
   namespaceFromStorageDir(storageDir) {
     if (!this.config.namespacesEnabled) return this.config.defaultNamespace;
-    const resolvedStorageDir = path4.resolve(storageDir);
-    const resolvedMemoryDir = path4.resolve(this.config.memoryDir);
+    const resolvedStorageDir = path2.resolve(storageDir);
+    const resolvedMemoryDir = path2.resolve(this.config.memoryDir);
     if (resolvedStorageDir === resolvedMemoryDir)
       return this.config.defaultNamespace;
     const m = resolvedStorageDir.match(/[\\/]namespaces[\\/]([^\\/]+)$/);
@@ -17343,7 +15547,6 @@ export {
   ensureBuiltInWearableConnectors,
   WearablesService,
   locateTranscriptPath,
-  NamespaceCatalog,
   BulkImportBatchPartialFailureError,
   dedupeEntitySynthesisEvidenceEntries,
   defaultWorkspaceDir,
@@ -17374,4 +15577,4 @@ export {
   resolvePersistedMemoryRelativePath,
   Orchestrator
 };
-//# sourceMappingURL=chunk-JZBFL7RI.js.map
+//# sourceMappingURL=chunk-TJ5IIQIR.js.map