@remnic/core 9.3.754 → 9.3.756

package/dist/{chunk-L4AS7TIG.js → chunk-DWDDQLSZ.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-GDB4J2H3.js";
 import {
   importCapsule
-} from "./chunk-M5QKGHCR.js";
+} from "./chunk-3I2IASNK.js";
 import {
   getTrustZoneStoreStatus,
   isTrustZoneName,
@@ -29,6 +29,9 @@ import {
   normalizeTags,
   parseTagMatch
 } from "./chunk-BT7NVCML.js";
+import {
+  decideDisclosureEscalation
+} from "./chunk-H7XKCNR6.js";
 import {
   toRecallExplainJson
 } from "./chunk-2KK5WNQB.js";
@@ -36,14 +39,8 @@ import {
   estimateRecallTokens
 } from "./chunk-6MMONPHM.js";
 import {
-  decideDisclosureEscalation
-} from "./chunk-H7XKCNR6.js";
-import {
-  recordObjectiveStateSnapshotsFromObservedMessages
-} from "./chunk-ICP53SKG.js";
-import {
-  objectiveStateStoreOverrideForNamespace
-} from "./chunk-6HMYUWXR.js";
+  namespaceCollectionName
+} from "./chunk-PS572XYO.js";
 import {
   combineNamespaces,
   defaultGitInvoker,
@@ -57,9 +54,6 @@ import {
   resolveWritableNamespaceValue,
   sanitizeFragment
 } from "./chunk-W3M34XT4.js";
-import {
-  namespaceCollectionName
-} from "./chunk-24463PIV.js";
 import {
   namespaceIdentityFromToken
 } from "./chunk-ZFXCQPNO.js";
@@ -70,13 +64,24 @@ import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact,
   runMemoryGovernance
-} from "./chunk-KURUULFF.js";
+} from "./chunk-PRX77NPC.js";
+import {
+  recordObjectiveStateSnapshotsFromObservedMessages
+} from "./chunk-ICP53SKG.js";
+import {
+  objectiveStateStoreOverrideForNamespace
+} from "./chunk-6HMYUWXR.js";
 import {
   recordMemoryOutcome
 } from "./chunk-EIR5VLIH.js";
 import {
   buildGraphSnapshot
 } from "./chunk-TQT3USCG.js";
+import {
+  persistExplicitCapture,
+  queueExplicitCaptureForReview,
+  validateExplicitCaptureInput
+} from "./chunk-K5LLP4CY.js";
 import {
   wrapWorkLayerContext
 } from "./chunk-EI6V5UXY.js";
@@ -87,53 +92,20 @@ import {
   buildProcedurePersistBody,
   normalizeProcedureSteps
 } from "./chunk-QDW3E4RD.js";
-import {
-  persistExplicitCapture,
-  queueExplicitCaptureForReview,
-  validateExplicitCaptureInput
-} from "./chunk-K5LLP4CY.js";
 import {
   CrossNamespaceBudget
 } from "./chunk-ODPLEWB6.js";
-import {
-  defaultCapsulesDir
-} from "./chunk-ZY2MNJR6.js";
-import {
-  filterTrajectoriesByLookbackDays,
-  readCausalTrajectoryRecords
-} from "./chunk-V5UV7BOA.js";
-import {
-  canReadNamespace,
-  canWriteNamespace,
-  defaultNamespaceForPrincipal,
-  recallNamespacesForPrincipal,
-  resolvePrincipal
-} from "./chunk-PE6XR4GG.js";
-import {
-  resolveAccessSetupCapabilities,
-  resolveCompressionCapabilities,
-  resolveConsolidationCapabilities,
-  resolveGraphConstructionCapabilities,
-  resolveIdentityContinuityCapabilities,
-  resolveIndexingCapabilities,
-  resolveMemoryLifecycleCapabilities,
-  resolveNamespaceCapabilities,
-  resolveObjectiveStateCapabilities,
-  resolveQmdCapabilities,
-  resolveRecallAuxiliaryCapabilities,
-  resolveRecallEnhancementCapabilities,
-  resolveSecurityCapabilities
-} from "./chunk-VSF7AAGE.js";
 import {
   FileCalendarSource,
   buildBriefing,
   enqueuePassiveCorrectionNotification,
   parseBriefingFocus,
   parseBriefingWindow
-} from "./chunk-TIFF32QK.js";
+} from "./chunk-YMGQXBPS.js";
 import {
-  parseEntityFile
-} from "./chunk-THZ4WR5L.js";
+  parseEntityFile,
+  selfDeps
+} from "./chunk-7APVFQ34.js";
 import {
   supersessionKeysForFact
 } from "./chunk-TKZ3AL5V.js";
@@ -147,6 +119,10 @@ import {
   DEFAULT_RECALL_DISCLOSURE,
   isRecallDisclosure
 } from "./chunk-JS2HKKOK.js";
+import {
+  inferMemoryStatus,
+  toMemoryPathRel
+} from "./chunk-RULE4VG5.js";
 import {
   normalizeProjectionPreview,
   normalizeProjectionTags
@@ -158,15 +134,40 @@ import {
   displayErrorDetail
 } from "./chunk-6KYMPV2O.js";
 import {
-  inferMemoryStatus,
-  toMemoryPathRel
-} from "./chunk-RULE4VG5.js";
+  computeContentHash
+} from "./chunk-W5H6ZRPT.js";
 import {
   createVersion
 } from "./chunk-VF4XKTX3.js";
 import {
-  computeContentHash
-} from "./chunk-W5H6ZRPT.js";
+  defaultCapsulesDir
+} from "./chunk-ZY2MNJR6.js";
+import {
+  filterTrajectoriesByLookbackDays,
+  readCausalTrajectoryRecords
+} from "./chunk-SQNED75R.js";
+import {
+  canReadNamespace,
+  canWriteNamespace,
+  defaultNamespaceForPrincipal,
+  recallNamespacesForPrincipal,
+  resolvePrincipal
+} from "./chunk-PE6XR4GG.js";
+import {
+  resolveAccessSetupCapabilities,
+  resolveCompressionCapabilities,
+  resolveConsolidationCapabilities,
+  resolveGraphConstructionCapabilities,
+  resolveIdentityContinuityCapabilities,
+  resolveIndexingCapabilities,
+  resolveMemoryLifecycleCapabilities,
+  resolveNamespaceCapabilities,
+  resolveObjectiveStateCapabilities,
+  resolveQmdCapabilities,
+  resolveRecallAuxiliaryCapabilities,
+  resolveRecallEnhancementCapabilities,
+  resolveSecurityCapabilities
+} from "./chunk-VSF7AAGE.js";
 import {
   sanitizeMemoryContent
 } from "./chunk-5GKPFL3S.js";
@@ -181,7 +182,7 @@ import {
 } from "./chunk-NU3CSQ4H.js";
 import {
   exportCapsule
-} from "./chunk-FLVL4L3L.js";
+} from "./chunk-TCKP4EHY.js";
 import {
   evaluateActionConfidence
 } from "./chunk-Z2YFLXHU.js";
@@ -207,6 +208,9 @@ import {
   hashAccessIdempotencyPayload
 } from "./chunk-VFUEZZBS.js";
 
+// src/access-observe-write-surface.ts
+import { createHash as createHash6 } from "crypto";
+
 // src/access-service.ts
 import { stat as stat2 } from "fs/promises";
 import * as nodeFs2 from "fs/promises";
@@ -4748,1266 +4752,1574 @@ async function promoteMemory(options) {
 // src/access-service.ts
 import * as nodePath3 from "path";
 
-// src/access-admin-ops-surface.ts
-import * as nodeFs from "fs/promises";
-import * as nodePath from "path";
-var AccessAdminOpsSurface = class {
+// src/access-lcm-surface.ts
+var AccessLcmSurface = class {
   constructor(deps) {
     this.deps = deps;
   }
   deps;
-  async reviewQueue(runId, namespace, principal) {
-    const resolvedNamespace = this.deps.resolveReadableNamespace(namespace, principal);
-    const storage = await this.deps.orchestrator.getStorage(resolvedNamespace);
-    const projected = await storage.getProjectedGovernanceRecord();
-    if (projected && (!runId || projected.runId === runId.trim())) {
-      const projectedAppliedActions = projected.appliedActionRows.map((row) => ({
-        action: row.action,
-        memoryId: row.memoryId,
-        reasonCode: row.reasonCode,
-        beforeStatus: row.beforeStatus,
-        afterStatus: row.afterStatus,
-        originalPath: row.originalPath,
-        currentPath: row.currentPath
-      }));
-      const projectedProposedActions = await buildProjectedGovernanceProposedActions(storage, projected);
-      const projectedArtifact = await (async () => {
-        try {
-          return await readMemoryGovernanceRunArtifact(storage.dir, projected.runId);
-        } catch {
-          return null;
-        }
-      })();
-      const metrics = projected.metrics;
-      const fallbackTransitionReport = {
-        proposed: groupActionsByStatus(projectedProposedActions),
-        applied: groupActionsByStatus(projectedAppliedActions)
+  async lcmSearch(request) {
+    if (!request.query || typeof request.query !== "string" || request.query.trim().length === 0) {
+      throw new EngramAccessInputError("query is required and must be a non-empty string");
+    }
+    const principal = this.deps.resolveRequestPrincipal(request.sessionKey, request.authenticatedPrincipal);
+    const hasExplicitNamespace = typeof request.namespace === "string" && request.namespace.trim().length > 0;
+    const profileLcmReadNamespaces = hasExplicitNamespace ? null : this.deps.resolveScopeProfileLcmReadNamespaces(
+      request.sessionKey,
+      request.authenticatedPrincipal
+    );
+    const namespace = hasExplicitNamespace ? this.deps.resolveReadableNamespace(request.namespace, principal) : profileLcmReadNamespaces !== null ? profileLcmReadNamespaces[0] : this.deps.resolveImplicitLcmReadFallbackNamespace(principal);
+    if (!this.deps.orchestrator.lcmEngine || !this.deps.orchestrator.lcmEngine.enabled) {
+      return {
+        query: request.query,
+        namespace: namespace ?? this.deps.orchestrator.config.defaultNamespace,
+        results: [],
+        count: 0,
+        lcmEnabled: false
       };
-      const transitionReport = projectedArtifact?.transitionReport ? {
-        proposed: hasGroupedGovernanceActions(projectedArtifact.transitionReport.proposed) || projectedProposedActions.length === 0 ? projectedArtifact.transitionReport.proposed : fallbackTransitionReport.proposed,
-        applied: hasGroupedGovernanceActions(projectedArtifact.transitionReport.applied) || projectedAppliedActions.length === 0 ? projectedArtifact.transitionReport.applied : fallbackTransitionReport.applied
-      } : fallbackTransitionReport;
-      const qualityScore = projectedArtifact?.qualityScore ?? metrics?.qualityScore ?? buildQualityScore(metrics?.reviewReasons ?? {
-        exact_duplicate: 0,
-        semantic_duplicate_candidate: 0,
-        disputed_memory: 0,
-        speculative_low_confidence: 0,
-        archive_candidate: 0,
-        explicit_capture_review: 0,
-        malformed_import: 0
-      });
-      const effectiveMetrics = metrics ? { ...metrics, qualityScore: metrics.qualityScore ?? qualityScore } : metrics;
+    }
+    if (profileLcmReadNamespaces !== null && profileLcmReadNamespaces.length === 0) {
       return {
-        found: true,
-        namespace: resolvedNamespace,
-        runId: projected.runId,
-        summary: projected.summary,
-        metrics: effectiveMetrics,
-        qualityScore,
-        reviewQueue: projected.reviewQueueRows.map((row) => ({
-          entryId: row.entryId,
-          memoryId: row.memoryId,
-          path: row.path,
-          reasonCode: row.reasonCode,
-          severity: row.severity,
-          suggestedAction: row.suggestedAction,
-          suggestedStatus: row.suggestedStatus,
-          relatedMemoryIds: row.relatedMemoryIds
-        })),
-        appliedActions: projectedAppliedActions,
-        transitionReport,
-        report: projected.report
+        query: request.query,
+        namespace: this.deps.orchestrator.config.defaultNamespace,
+        results: [],
+        count: 0,
+        lcmEnabled: true
       };
     }
-    const resolvedRunId = runId?.trim() || (await listMemoryGovernanceRuns(storage.dir))[0];
-    if (!resolvedRunId) return { found: false, namespace: resolvedNamespace };
-    const artifact = await readMemoryGovernanceRunArtifact(storage.dir, resolvedRunId);
-    return {
-      found: true,
-      namespace: resolvedNamespace,
-      runId: resolvedRunId,
-      summary: artifact.summary,
-      metrics: artifact.metrics,
-      qualityScore: artifact.qualityScore,
-      reviewQueue: artifact.reviewQueue,
-      appliedActions: artifact.appliedActions,
-      transitionReport: artifact.transitionReport,
-      report: artifact.report
-    };
-  }
-  async governanceRun(request, principal) {
-    const deepSleep = this.deps.orchestrator.config.dreamsPhases.deepSleep;
-    if (deepSleep.enabled === false && deepSleep.enabledExplicitlySet === true) {
-      throw new Error("memory governance is disabled by dreams.phases.deepSleep.enabled=false");
+    if (namespace === void 0) {
+      return {
+        query: request.query,
+        namespace: this.deps.orchestrator.config.defaultNamespace,
+        results: [],
+        count: 0,
+        lcmEnabled: true
+      };
     }
-    const resolvedNamespace = this.deps.writableNamespaceFor(
+    const limit = Math.max(1, Math.min(request.limit ?? 10, 100));
+    const lcmReadNamespace = profileLcmReadNamespaces !== null ? profileLcmReadNamespaces[0] ?? this.deps.orchestrator.config.defaultNamespace : this.deps.resolveLcmReadNamespace(
       request.namespace,
-      void 0,
-      request.authenticatedPrincipal ?? principal
+      namespace,
+      request.sessionKey,
+      request.authenticatedPrincipal
     );
-    const storage = await this.deps.orchestrator.getStorage(resolvedNamespace);
-    const mode = request.mode === "apply" ? "apply" : "shadow";
-    const boundedBatchSize = typeof request.batchSize === "number" && Number.isFinite(request.batchSize) ? Math.max(1, Math.floor(request.batchSize)) : void 0;
-    const result = await runMemoryGovernance({
-      memoryDir: storage.dir,
-      mode,
-      recentDays: typeof request.recentDays === "number" && Number.isFinite(request.recentDays) ? Math.max(1, Math.floor(request.recentDays)) : void 0,
-      maxMemories: typeof request.maxMemories === "number" && Number.isFinite(request.maxMemories) ? Math.max(1, Math.floor(request.maxMemories)) : void 0,
-      batchSize: boundedBatchSize
-    });
-    if (mode === "apply") {
-      try {
-        await this.deps.orchestrator.processEntitySynthesisQueue(
-          resolvedNamespace,
-          Math.min(boundedBatchSize ?? 5, 5)
-        );
-      } catch (error) {
-        log.debug(`governanceRun: entity synthesis refresh failed after governance apply: ${error}`);
-      }
-    }
-    return {
-      namespace: resolvedNamespace,
-      runId: result.runId,
-      traceId: result.traceId,
-      mode: result.mode,
-      reviewQueueCount: result.reviewQueue.length,
-      proposedActionCount: result.proposedActions.length,
-      appliedActionCount: result.appliedActions.length,
-      summaryPath: result.summaryPath,
-      reportPath: result.reportPath
-    };
-  }
-  async conversationIndexUpdate(request = {}) {
-    if (!resolveIndexingCapabilities(this.deps.orchestrator.config).conversationIndex) {
-      return {
-        enabled: false,
-        sessions: 0,
-        chunks: 0,
-        skipped: 0,
-        skippedSessionKeys: [],
-        embeddedRuns: 0,
-        reason: "disabled"
-      };
-    }
-    const hours = typeof request.hours === "number" && Number.isFinite(request.hours) ? Math.max(1, Math.floor(request.hours)) : 24;
-    let sessionKey;
-    if (request.sessionKey !== void 0) {
-      if (typeof request.sessionKey !== "string" || request.sessionKey.trim().length === 0) {
-        throw new EngramAccessInputError("sessionKey must be a non-empty string when provided");
-      }
-      sessionKey = request.sessionKey.trim();
-    }
-    if (sessionKey) {
-      const result = await this.deps.orchestrator.updateConversationIndex(
-        sessionKey,
-        hours,
-        { embed: request.embed }
-      );
+    const lcmSessionKeyIds = request.sessionKey ? profileLcmReadNamespaces !== null ? this.deps.lcmSessionIdsForNamespaces(
+      profileLcmReadNamespaces,
+      request.sessionKey
+    ) : this.deps.resolveLcmReadSessionIds(
+      request.namespace,
+      namespace,
+      request.sessionKey,
+      request.authenticatedPrincipal
+    ) : [void 0];
+    const lcmSessionPrefixes = request.sessionPrefix ? profileLcmReadNamespaces !== null && !request.sessionKey ? this.deps.lcmSessionIdsForNamespaces(
+      profileLcmReadNamespaces,
+      request.sessionPrefix
+    ) : [
+      lcmSessionKeyForNamespace(
+        lcmReadNamespace,
+        request.sessionPrefix,
+        this.deps.orchestrator.config.defaultNamespace
+      ) ?? request.sessionPrefix
+    ] : [void 0];
+    const hasScopedSession = typeof request.sessionKey === "string" && request.sessionKey.length > 0 || lcmSessionPrefixes.some((prefix) => typeof prefix === "string" && prefix.length > 0);
+    if (!hasScopedSession && resolveNamespaceCapabilities(this.deps.orchestrator.config).namespaces === true) {
       return {
-        enabled: true,
-        sessionKey,
-        sessions: 1,
-        chunks: result.chunks,
-        skipped: result.skipped ? 1 : 0,
-        skippedSessionKeys: result.skipped ? [sessionKey] : [],
-        embeddedRuns: result.embedded ? 1 : 0,
-        reason: result.reason,
-        retryAfterMs: result.retryAfterMs
+        query: request.query,
+        namespace,
+        results: [],
+        count: 0,
+        lcmEnabled: true
       };
     }
-    const sessionKeys = await this.deps.orchestrator.transcript.listSessionKeys();
-    let chunks = 0;
-    let skipped = 0;
-    const skippedSessionKeys = [];
-    let embeddedRuns = 0;
-    for (const sessionKey2 of sessionKeys) {
-      const result = await this.deps.orchestrator.updateConversationIndex(
-        sessionKey2,
-        hours,
-        { embed: request.embed }
-      );
-      chunks += result.chunks;
-      if (result.skipped) {
-        skipped += 1;
-        skippedSessionKeys.push(sessionKey2);
-      }
-      if (result.embedded) {
-        embeddedRuns += 1;
+    const seenRows = /* @__PURE__ */ new Set();
+    const results = [];
+    const lcmSearches = [];
+    for (const lcmSessionKey of lcmSessionKeyIds) {
+      for (const lcmSessionPrefix of lcmSessionPrefixes) {
+        lcmSearches.push({
+          key: lcmSessionKey,
+          prefix: lcmSessionPrefix,
+          promise: this.deps.orchestrator.lcmEngine.searchContextFull(
+            request.query,
+            limit,
+            lcmSessionKey,
+            lcmSessionPrefix
+          )
+        });
       }
     }
-    return {
-      enabled: true,
-      sessions: sessionKeys.length,
-      chunks,
-      skipped,
-      skippedSessionKeys,
-      embeddedRuns
-    };
-  }
-  async profilingReport(request = {}) {
-    const profiler = this.deps.orchestrator.profiler;
-    if (!profiler.isEnabled) {
-      return {
-        enabled: false,
-        reason: "disabled",
-        message: "Profiling is disabled. Set profilingEnabled: true in your plugin config to enable."
-      };
-    }
-    const format = request.format ?? "ascii";
-    if (format !== "ascii" && format !== "json") {
-      throw new EngramAccessInputError("format must be one of: ascii, json");
-    }
-    const limit = request.limit ?? 5;
-    if (!Number.isInteger(limit) || limit < 1 || limit > 20) {
-      throw new EngramAccessInputError("limit must be an integer between 1 and 20");
-    }
-    const traces = profiler.getRecentTraces(limit);
-    const stats = profiler.getStats();
-    const bottleneck = profiler.identifyBottleneck();
-    if (format === "json") {
-      return {
-        enabled: true,
-        format,
-        traces,
-        stats,
-        bottleneck
-      };
-    }
-    const lines = [];
-    lines.push("Engram Profiling Report");
-    lines.push("=".repeat(60));
-    lines.push("");
-    const allBuckets = [
-      ["byKind", stats.byKind],
-      ["bySpan", stats.bySpan]
-    ];
-    const hasStats = allBuckets.some(([, entries]) => Object.keys(entries).length > 0);
-    if (hasStats) {
-      lines.push("Aggregate Stats (all retained traces):");
-      for (const [bucket, entries] of allBuckets) {
-        for (const [key, summary] of Object.entries(entries)) {
-          lines.push(
-            `  ${bucket}/${key}: avg=${summary.avgMs}ms p50=${summary.p50Ms}ms p95=${summary.p95Ms}ms max=${summary.maxMs}ms (n=${summary.count})`
-          );
-        }
+    const settledSearches = await Promise.allSettled(
+      lcmSearches.map((search) => search.promise)
+    );
+    for (let i = 0; i < settledSearches.length; i += 1) {
+      if (results.length >= limit) break;
+      const settled = settledSearches[i];
+      if (!settled || settled.status === "rejected") {
+        const failed = lcmSearches[i];
+        log.warn(
+          `lcmSearch: failed for key=${failed?.key ?? "<none>"} prefix=${failed?.prefix ?? "<none>"}: ${settled?.status === "rejected" ? settled.reason : "missing result"}`
+        );
+        continue;
       }
-      lines.push("");
-    }
-    if (bottleneck) {
-      lines.push(`Bottleneck: ${bottleneck}`);
-      lines.push("");
-    }
-    if (traces.length === 0) {
-      lines.push("No traces recorded yet. Trigger a recall or extraction to see timing data.");
-    } else {
-      for (const trace of traces) {
-        lines.push(formatProfileTraceAscii(trace));
-        lines.push("");
+      for (const r of settled.value) {
+        const dedupeKey = `${r.session_id}\0${r.turn_index}`;
+        if (seenRows.has(dedupeKey)) continue;
+        seenRows.add(dedupeKey);
+        results.push({
+          sessionId: r.session_id,
+          content: r.content,
+          turnIndex: r.turn_index
+        });
+        if (results.length >= limit) break;
       }
     }
     return {
-      enabled: true,
-      format,
-      report: lines.join("\n")
+      query: request.query,
+      namespace,
+      results,
+      count: results.length,
+      lcmEnabled: true
     };
   }
   /**
-   * Read-only graph snapshot for the admin pane (issue #691 PR 2/5).
+   * Resolve the effective LCM NAMESPACE a same-session operation must prefix
+   * with (the namespace half of {@link resolveLcmReadSessionKey}). Split out so
+   * `lcmSearch` can apply ONE namespace to BOTH its `sessionKey` and its
+   * `sessionPrefix` — the prefix is a search fragment, not a real session, so its
+   * own coding context can't be looked up; it must inherit the namespace resolved
+   * from the real session (`sessionKeyForOverlay`).
    *
-   * Reads adjacency from the JSONL edge store written by `GraphIndex` and
-   * resolves node metadata via the namespaced storage manager.  Namespace
-   * resolution mirrors the read-side path used by `recall` /
-   * `procedureStats`, so multi-principal deployments can't leak edges from
-   * a peer namespace (CLAUDE.md rule 42).
+   * `purpose` selects the AUTHORIZATION gate applied before honouring the
+   * coding overlay (#1505 round 3 + round 4, codex P2):
+   *
+   *  - `"read"` (`lcmSearch` / raw-excerpt recall): the overlay rows are only
+   *    visible when the principal SELF base is in the READABLE RECALL SET — the
+   *    same gate the orchestrator's `lcmReadNamespaceForSession` and the recall
+   *    namespace set use (`recallNamespacesForPrincipal`, gated by both
+   *    `defaultRecallNamespaces.includes("self")` AND `canReadNamespace`). A
+   *    caller that passed the default read check must NOT receive
+   *    `<principal>-project-*` rows the policy never granted (cross-tenant read
+   *    leak). When the self base is not readable, keep the just-authorized
+   *    namespace (collapses to the raw key on the default store).
+   *
+   *  - `"write"` (`lcmCompactionFlush` / `lcmCompactionRecord`): these are
+   *    write/maintenance operations on the SAME queue `observe` just wrote, so
+   *    the gate must mirror observe's WRITE authorization (`canWriteNamespace`
+   *    on the self base), NOT readability. A principal that can WRITE but not
+   *    READ its self namespace (or whose `defaultRecallNamespaces` omits `self`)
+   *    archived under the overlay key via `observe`; gating compaction by
+   *    readability would fall back to the default/raw key and leave that queue
+   *    never flushed/recorded (round-4 codex P2). Write-authorized ⇒ overlay
+   *    key, matching the observe write key (rule 42 read/write parity; rule 39
+   *    identical gates across paths).
    */
-  async graphSnapshot(request, authenticatedPrincipal) {
-    const namespace = this.deps.resolveReadableNamespace(
-      request.namespace,
+  resolveLcmReadNamespace(explicitNamespace, resolvedNamespace, sessionKeyForOverlay, authenticatedPrincipal, purpose = "read") {
+    const hasExplicitNamespace = typeof explicitNamespace === "string" && explicitNamespace.trim().length > 0;
+    if (hasExplicitNamespace) return resolvedNamespace;
+    const principal = this.deps.resolveRequestPrincipal(
+      sessionKeyForOverlay,
       authenticatedPrincipal
     );
-    const storage = await this.deps.orchestrator.getStorage(namespace);
-    const cfg = this.deps.orchestrator.config;
-    const graphCaps = resolveGraphConstructionCapabilities(cfg);
-    let namespaceRootReal;
-    try {
-      namespaceRootReal = await nodeFs.realpath(storage.dir);
-    } catch {
-      namespaceRootReal = nodePath.resolve(storage.dir);
-    }
-    const namespaceRootWithSep = namespaceRootReal.endsWith(nodePath.sep) ? namespaceRootReal : namespaceRootReal + nodePath.sep;
-    const loadNode = async (relPath) => {
-      if (nodePath.isAbsolute(relPath)) {
-        log.warn(
-          `graphSnapshot: rejected absolute edge endpoint (len=${relPath.length}) outside namespace root`
-        );
-        return null;
-      }
-      const candidate = nodePath.resolve(namespaceRootReal, relPath);
-      if (candidate !== namespaceRootReal && !candidate.startsWith(namespaceRootWithSep)) {
-        log.warn(
-          `graphSnapshot: rejected traversing edge endpoint (len=${relPath.length}) outside namespace root`
-        );
-        return null;
-      }
-      let canonical;
-      try {
-        canonical = await nodeFs.realpath(candidate);
-      } catch {
-        canonical = candidate;
-      }
-      if (canonical !== namespaceRootReal && !canonical.startsWith(namespaceRootWithSep)) {
-        log.warn(
-          `graphSnapshot: rejected symlinked edge endpoint (len=${relPath.length}) that resolved outside namespace root`
-        );
-        return null;
-      }
-      const memory = await storage.readMemoryByPath(canonical);
-      if (!memory) return null;
-      const fm = memory.frontmatter;
-      return {
-        category: fm.category ?? "unknown",
-        label: fm.id ?? nodePath.basename(canonical, nodePath.extname(canonical)),
-        updated: fm.updated
-      };
-    };
-    return buildGraphSnapshot({
-      memoryDir: namespaceRootReal,
-      graphConfig: {
-        entityGraph: graphCaps.entityGraph,
-        timeGraph: graphCaps.timeGraph,
-        causalGraph: graphCaps.causalGraph
-      },
-      request: {
-        limit: request.limit,
-        since: request.since,
-        focusNodeId: request.focusNodeId,
-        categories: request.categories
-      },
-      loadNode
-    });
+    const base = defaultNamespaceForPrincipal(principal, this.deps.orchestrator.config);
+    const overlaid = this.deps.orchestrator.applyCodingNamespaceOverlay(
+      sessionKeyForOverlay,
+      base
+    );
+    if (overlaid === base) return this.deps.orchestrator.config.defaultNamespace;
+    const authorized = purpose === "write" ? canWriteNamespace(principal, base, this.deps.orchestrator.config) : recallNamespacesForPrincipal(
+      principal,
+      this.deps.orchestrator.config
+    ).includes(base);
+    if (authorized) return overlaid;
+    if (purpose === "read") return this.deps.orchestrator.config.defaultNamespace;
+    return resolvedNamespace;
   }
   /**
-   * List capsule archives in the namespace-scoped capsule store.
+   * Resolve the namespace the raw-disclosure excerpt lookup
+   * ({@link fetchRawExcerpts}) must prefix its LCM `session_id` with (#1505
+   * thread 2f7). Raw disclosure reads the SAME LCM archive `lcmSearch` and the
+   * in-prompt LCM sections read, so it MUST pass through the identical
+   * read-authorization gate — NOT `snapshot.namespace`, which records the
+   * effective WRITE/overlay namespace (`<principal>-project-*`) even when the
+   * principal can WRITE but not READ its self base (or `defaultRecallNamespaces`
+   * omits `self`). Routing through `resolveLcmReadNamespace(..., "read")` makes
+   * raw disclosure fall back to the default store exactly like normal recall +
+   * `lcmSearch`, so it never attaches overlay transcript rows the read gate
+   * excludes (cross-tenant read leak). Collapses to the default store / raw
+   * sessionKey for single-store / no-overlay / explicit-default flows, so
+   * single-user recall is byte-for-byte unchanged.
    *
-   * MCP uses this access-layer method instead of reading arbitrary paths so
-   * capsule discovery remains bound to the same namespace ACLs as export and
-   * import.
-   */
-  async capsuleList(options) {
-    const resolvedNamespace = this.deps.resolveReadableNamespace(options?.namespace, options?.principal);
-    const storage = await this.deps.orchestrator.getStorage(resolvedNamespace);
-    const capsulesDir = defaultCapsulesDir(storage.dir);
-    let dirEntries;
-    try {
-      const capsulesDirStat = await nodeFs.lstat(capsulesDir);
-      if (capsulesDirStat.isSymbolicLink()) {
-        throw new EngramAccessInputError("capsule list failed: capsule store directory must not be a symlink");
-      }
-      if (!capsulesDirStat.isDirectory()) {
-        throw new EngramAccessInputError("capsule list failed: capsule store path must be a directory");
-      }
-      dirEntries = await nodeFs.readdir(capsulesDir, { withFileTypes: true });
-    } catch (err) {
-      const code = typeof err === "object" && err !== null && "code" in err ? err.code : void 0;
-      if (code === "ENOENT") {
-        return { namespace: resolvedNamespace, capsulesDir, capsules: [] };
-      }
-      throw err;
-    }
-    const archiveNames = dirEntries.filter(
-      (entry) => entry.isFile() && (entry.name.endsWith(".capsule.json.gz") || entry.name.endsWith(".capsule.json.gz.enc"))
-    ).map((entry) => entry.name).sort();
-    const capsules = [];
-    for (const archiveName of archiveNames) {
-      const archivePath = nodePath.join(capsulesDir, archiveName);
-      const id = archiveName.replace(/\.capsule\.json\.gz\.enc$/, "").replace(/\.capsule\.json\.gz$/, "");
-      const manifestPath = nodePath.join(capsulesDir, `${id}.manifest.json`);
-      let createdAt = null;
-      let pluginVersion = null;
-      let fileCount = null;
-      let description = null;
-      let manifestPathOrNull = manifestPath;
-      try {
-        const manifestStat = await nodeFs.lstat(manifestPath);
-        if (manifestStat.isSymbolicLink() || !manifestStat.isFile()) {
-          capsules.push({
-            id,
-            archivePath,
-            manifestPath: manifestPathOrNull,
-            createdAt,
-            pluginVersion,
-            fileCount,
-            description
-          });
-          continue;
-        }
-        const raw = await nodeFs.readFile(manifestPath, "utf-8");
-        const sidecar = JSON.parse(raw);
-        createdAt = typeof sidecar.createdAt === "string" ? sidecar.createdAt : null;
-        pluginVersion = typeof sidecar.pluginVersion === "string" ? sidecar.pluginVersion : null;
-        fileCount = Array.isArray(sidecar.files) ? sidecar.files.length : null;
-        const capsule = sidecar.capsule;
-        description = capsule && typeof capsule.description === "string" ? capsule.description : null;
-      } catch (err) {
-        const code = typeof err === "object" && err !== null && "code" in err ? err.code : void 0;
-        if (code === "ENOENT") {
-          manifestPathOrNull = null;
-        }
-      }
-      capsules.push({
-        id,
-        archivePath,
-        manifestPath: manifestPathOrNull,
-        createdAt,
-        pluginVersion,
-        fileCount,
-        description
-      });
-    }
-    return { namespace: resolvedNamespace, capsulesDir, capsules };
-  }
-  /**
-   * Manually invoke a single Dreams phase pass (PR 4/4).
+   * Returns `undefined` when NO readable LCM namespace exists for an IMPLICIT
+   * (no explicit `namespace`) raw recall — i.e. a restrictive `default` READ
+   * policy denies the principal `default` AND no overlay/self namespace is
+   * readable. In that case the caller emits NO excerpts rather than throwing
+   * `namespace is not readable: default` (#1505 thread NBHWz): normal recall
+   * still succeeds via `recallNamespacesForPrincipal`, so `disclosure: "raw"`
+   * must degrade gracefully (empty excerpts), never pre-authorize `default`.
    *
-   * Deep-sleep delegates to memory governance (shadow → dry-run, apply → live).
-   * Light-sleep and REM scan the observation ledger and memory corpus
-   * respectively, returning the same telemetry shape as a scheduled run.
+   * IMPLICIT-namespace fallback selection derives from the ALREADY
+   * read-authorized recall namespace set (`recallNamespacesForPrincipal` +
+   * `canReadNamespace`) — the principal's self base when it is in the readable
+   * recall set, else `config.defaultNamespace` ONLY when the principal may read
+   * it. It NEVER pre-authorizes `default`. An EXPLICIT `namespace` is still
+   * authorized strictly via `resolveReadableNamespace` (explicit reads must pass
+   * the ACL — no behavior change).
    */
-  async dreamsRun(options) {
-    const { runDreamsPhase } = await import("./dreams-ledger-6UODQOX6.js");
-    const validPhases = ["lightSleep", "rem", "deepSleep"];
-    if (!validPhases.includes(options.phase)) {
-      throw new EngramAccessInputError(
-        `Invalid phase: ${String(options.phase)}. Must be one of: ${validPhases.join(", ")}`
+  resolveRawExcerptReadNamespace(explicitNamespace, sessionKey, authenticatedPrincipal) {
+    const principal = this.deps.resolveRequestPrincipal(
+      sessionKey,
+      authenticatedPrincipal
+    );
+    const hasExplicitNamespace = typeof explicitNamespace === "string" && explicitNamespace.trim().length > 0;
+    if (hasExplicitNamespace) {
+      const resolvedNamespace = this.deps.resolveReadableNamespace(
+        explicitNamespace,
+        principal
       );
-    }
-    const deepSleep = this.deps.orchestrator.config.dreamsPhases.deepSleep;
-    if (options.phase === "deepSleep" && deepSleep.enabled === false && deepSleep.enabledExplicitlySet === true) {
-      throw new EngramAccessInputError(
-        "memory governance is disabled by dreams.phases.deepSleep.enabled=false"
+      return this.deps.resolveLcmReadNamespace(
+        explicitNamespace,
+        resolvedNamespace,
+        sessionKey,
+        authenticatedPrincipal,
+        "read"
       );
     }
-    const dryRun = options.dryRun === true;
-    const resolvedNamespace = this.deps.writableNamespaceFor(
-      options.namespace,
-      void 0,
-      options.authenticatedPrincipal
+    const profileReadNamespaces = this.deps.resolveScopeProfileLcmReadNamespaces(
+      sessionKey,
+      authenticatedPrincipal
     );
-    const storage = await this.deps.orchestrator.getStorage(resolvedNamespace);
-    const memoryDir = storage.dir;
-    const phaseRunner = dryRun || options.phase === "deepSleep" ? void 0 : async (_opts) => {
-      if (_opts.phase === "lightSleep") {
-        const result3 = await this.deps.orchestrator.runLifecyclePolicyNow(storage);
-        return {
-          itemsProcessed: result3.memoriesAssessed,
-          notes: `scored ${result3.memoriesAssessed} memories`
-        };
-      }
-      const result2 = await this.deps.orchestrator.runSemanticConsolidationNow({
-        dryRun: false,
-        storage
-      });
-      const itemsProcessed = result2.clusters.reduce(
-        (sum, cluster) => sum + cluster.memories.length,
-        0
-      );
-      return {
-        itemsProcessed,
-        notes: `REM consolidation found ${result2.clustersFound} clusters`
-      };
-    };
-    const governanceRunner = options.phase === "deepSleep" ? async (_opts) => {
-      return this.deps.orchestrator.runDeepSleepGovernanceNow({
-        storage,
-        dryRun: _opts.dryRun
-      });
-    } : void 0;
-    const result = await runDreamsPhase(
-      { memoryDir, phase: options.phase, dryRun },
-      governanceRunner,
-      phaseRunner
+    if (profileReadNamespaces !== null) return profileReadNamespaces[0];
+    const fallbackNamespace = this.deps.resolveImplicitLcmReadFallbackNamespace(principal);
+    if (fallbackNamespace === void 0) return void 0;
+    return this.deps.resolveLcmReadNamespace(
+      explicitNamespace,
+      fallbackNamespace,
+      sessionKey,
+      authenticatedPrincipal,
+      "read"
     );
-    return {
-      phase: result.phase,
-      dryRun: result.dryRun,
-      durationMs: result.durationMs,
-      itemsProcessed: result.itemsProcessed,
-      notes: result.notes
-    };
   }
-  /**
-   * Manually promote a memory into one or more authorized targets. Requires
-   * a non-empty reason (audit-logged). Reuses the scope-profile promotion
-   * resolution and `canWriteNamespace` gate — there is no dashboard-only
-   * write path.
-   */
-  async adminPromoteMemory(request) {
-    const config = this.deps.orchestrator.config;
-    const namespacesEnabled = resolveNamespaceCapabilities(config).namespaces === true;
-    let sourceNamespace;
-    if (request.namespace) {
-      sourceNamespace = this.deps.resolveReadableNamespace(
-        request.namespace,
-        request.principal
-      );
-    } else {
-      const codingContext2 = request.sessionKey ? this.deps.orchestrator.getCodingContextForSession(request.sessionKey) ?? null : null;
-      const plan = resolveScopePlan({
-        config,
-        sessionKey: request.sessionKey,
-        principalOverride: request.principal,
-        codingContext: codingContext2,
-        namespacesEnabled
-      });
-      sourceNamespace = this.deps.resolveReadableNamespace(
-        plan.baseNamespace,
-        request.principal
-      );
+  resolveLcmReadSessionIds(explicitNamespace, resolvedNamespace, sessionKey, authenticatedPrincipal) {
+    const primary = this.deps.resolveLcmReadSessionKey(
+      explicitNamespace,
+      resolvedNamespace,
+      sessionKey,
+      authenticatedPrincipal,
+      "read"
+    );
+    const hasExplicitNamespace = typeof explicitNamespace === "string" && explicitNamespace.trim().length > 0;
+    if (hasExplicitNamespace) return [primary];
+    const profileReadNamespaces = this.deps.resolveScopeProfileLcmReadNamespaces(
+      sessionKey,
+      authenticatedPrincipal
+    );
+    if (profileReadNamespaces !== null) {
+      return this.deps.lcmSessionIdsForNamespaces(profileReadNamespaces, sessionKey);
     }
-    const codingContext = request.sessionKey ? this.deps.orchestrator.getCodingContextForSession(request.sessionKey) ?? null : null;
-    const codingOverlay = codingContext ? resolveCodingNamespaceOverlay(
-      codingContext,
-      config.codingMode,
-      config.defaultNamespace
-    ) : null;
-    const scopeProfilePlan = resolveScopeProfilePlan({
-      config,
-      principal: request.principal,
-      codingContext,
-      codingOverlay
-    });
-    const storage = {
-      readMemory: async (namespace, memoryId) => {
-        const resolved = await this.deps.orchestrator.getStorage(namespace);
-        const memory = await resolved.getMemoryById(memoryId);
-        if (!memory) return null;
-        return {
-          category: memory.frontmatter.category,
-          content: memory.content,
-          frontmatter: memory.frontmatter
-        };
-      },
-      writePromotedMemory: async (namespace, memory) => {
-        const resolved = await this.deps.orchestrator.getStorage(namespace);
-        const { id, tombstoneBlocked } = await resolved.writeMemory(
-          memory.category,
-          memory.content,
-          {
-            confidence: memory.confidence,
-            tags: memory.tags,
-            entityRef: memory.entityRef,
-            source: `admin-promotion:${memory.sourceNamespace}:${memory.reason.slice(0, 120)}`,
-            lineage: memory.lineage,
-            sourceMemoryId: memory.sourceMemoryId,
-            actor: memory.actor,
-            validAt: memory.validAt
-          }
-        );
-        if (tombstoneBlocked) {
-          throw new Error(
-            "target namespace tombstone-blocked the promoted content (pending_review)"
-          );
-        }
-        return id;
-      }
-    };
-    try {
-      return await promoteMemory({
-        config,
-        sourceMemoryId: request.sourceMemoryId,
-        sourceNamespace,
-        principal: request.principal,
-        targets: request.targets,
-        reason: request.reason,
-        actor: request.principal ?? "admin-console",
-        storage,
-        scopeProfilePlan
-      });
-    } catch (err) {
-      if (err instanceof AdminPromotionError) {
-        throw new EngramAccessInputError(err.message);
+    const principal = this.deps.resolveRequestPrincipal(
+      sessionKey,
+      authenticatedPrincipal
+    );
+    const base = defaultNamespaceForPrincipal(
+      principal,
+      this.deps.orchestrator.config
+    );
+    const overlaid = this.deps.orchestrator.applyCodingNamespaceOverlay(
+      sessionKey,
+      base
+    );
+    if (overlaid === base) return [primary];
+    const selfReadableInRecall = recallNamespacesForPrincipal(
+      principal,
+      this.deps.orchestrator.config
+    ).includes(base);
+    if (!selfReadableInRecall) return [primary];
+    const overlay = resolveCodingNamespaceOverlay(
+      this.deps.orchestrator.getCodingContextForSession(sessionKey),
+      this.deps.orchestrator.config.codingMode,
+      this.deps.orchestrator.config.defaultNamespace
+    );
+    const fallbackNamespaces = (overlay?.readFallbacks ?? []).map(
+      (fallback) => combineNamespaces(base, fallback)
+    );
+    const out = [primary];
+    const seen = /* @__PURE__ */ new Set([primary]);
+    for (const ns of fallbackNamespaces) {
+      const key = lcmSessionKeyForNamespace(
+        ns,
+        sessionKey,
+        this.deps.orchestrator.config.defaultNamespace
+      ) ?? sessionKey;
+      if (!seen.has(key)) {
+        seen.add(key);
+        out.push(key);
       }
-      throw err;
     }
+    return out;
   }
 };
 
-// src/access-recall-surface.ts
-import { createHash as createHash4 } from "crypto";
-import * as nodePath2 from "path";
-
-// src/orchestration/qmd-result-resolver.ts
-import path8 from "path";
-function qmdCollectionPathParts(resultPath) {
-  if (!resultPath || path8.isAbsolute(resultPath)) return null;
-  const normalized = resultPath.replace(/\\/g, "/").replace(/^\/+/, "");
-  const slashIndex = normalized.indexOf("/");
-  if (slashIndex <= 0 || slashIndex >= normalized.length - 1) return null;
-  const collection = normalized.slice(0, slashIndex);
-  if (/^\d{4}-\d{2}-\d{2}$/.test(collection)) return null;
-  return {
-    collection,
-    relativePath: normalized.slice(slashIndex + 1)
-  };
-}
-function qmdResultPathCandidates(storageDir, resultPath) {
-  const candidates = /* @__PURE__ */ new Set();
-  const storageRoot = path8.resolve(storageDir);
-  const addCandidate = (candidate) => {
-    const resolved = path8.resolve(candidate);
-    if (isPathInsideStorageRoot(storageRoot, resolved)) {
-      candidates.add(resolved);
-    }
-  };
-  const addRelativeCandidates = (relativePath) => {
-    const normalized = relativePath.replace(/\\/g, "/").replace(/^\/+/, "");
-    if (!normalized) return;
-    addCandidate(path8.join(storageRoot, normalized));
-    if (/^\d{4}-\d{2}-\d{2}\//.test(normalized)) {
-      addCandidate(path8.join(storageRoot, "facts", normalized));
-    }
-  };
-  if (path8.isAbsolute(resultPath)) {
-    addCandidate(resultPath);
-  } else {
-    addRelativeCandidates(resultPath);
-  }
-  return [...candidates];
-}
-function storageDirOrNull(storage) {
-  const dir = storage.dir;
-  return typeof dir === "string" && dir.length > 0 ? dir : null;
-}
-var QmdResultResolver = class {
-  getConfig;
-  storageFor;
-  storageDirNamespace;
-  qmdCollectionNamespaceFromPrefix;
-  namespaceFromPath;
-  constructor(options) {
-    this.getConfig = options.getConfig;
-    this.storageFor = options.storageFor;
-    this.storageDirNamespace = options.storageDirNamespace;
-    this.qmdCollectionNamespaceFromPrefix = options.qmdCollectionNamespaceFromPrefix;
-    this.namespaceFromPath = options.namespaceFromPath;
+// src/access-admin-ops-surface.ts
+import * as nodeFs from "fs/promises";
+import * as nodePath from "path";
+var AccessAdminOpsSurface = class {
+  constructor(deps) {
+    this.deps = deps;
   }
-  async readQmdResultMemory(resultPath, fallbackStorage, recallNamespaces = []) {
-    const parts = qmdCollectionPathParts(resultPath);
-    const fallbackStorageDir = storageDirOrNull(fallbackStorage);
-    const config = this.getConfig();
-    const coldCollection = config.qmdColdCollection ?? "openclaw-engram-cold";
-    if (parts && parts.collection === coldCollection) {
-      const storages = [];
-      const seenStorageDirs = /* @__PURE__ */ new Set();
-      const addStorage = (storage) => {
-        const storageDir = storageDirOrNull(storage);
-        const storageKey = storageDir ? path8.resolve(storageDir) : `storage-without-dir-${storages.length}`;
-        if (seenStorageDirs.has(storageKey)) return;
-        seenStorageDirs.add(storageKey);
-        storages.push(storage);
-      };
-      const fallbackNamespace = fallbackStorageDir !== null ? this.storageDirNamespace(fallbackStorageDir) : config.defaultNamespace;
-      if (recallNamespaces.length === 0 || !resolveNamespaceCapabilities(config).namespaces || recallNamespaces.includes(fallbackNamespace)) {
-        addStorage(fallbackStorage);
-      }
-      if (recallNamespaces.length > 0) {
-        for (const namespace of recallNamespaces) {
-          try {
-            addStorage(await this.storageFor(namespace));
-          } catch (err) {
-            log.debug("qmd cold result namespace storage lookup skipped", {
-              path: resultPath,
-              namespace,
-              error: err.message
-            });
-          }
-        }
-      }
-      for (const storage of storages) {
-        const storageDir = storageDirOrNull(storage);
-        if (!storageDir) {
-          const memory = await storage.readMemoryByPath(resultPath);
-          if (memory) return memory;
-          continue;
-        }
+  deps;
+  async reviewQueue(runId, namespace, principal) {
+    const resolvedNamespace = this.deps.resolveReadableNamespace(namespace, principal);
+    const storage = await this.deps.orchestrator.getStorage(resolvedNamespace);
+    const projected = await storage.getProjectedGovernanceRecord();
+    if (projected && (!runId || projected.runId === runId.trim())) {
+      const projectedAppliedActions = projected.appliedActionRows.map((row) => ({
+        action: row.action,
+        memoryId: row.memoryId,
+        reasonCode: row.reasonCode,
+        beforeStatus: row.beforeStatus,
+        afterStatus: row.afterStatus,
+        originalPath: row.originalPath,
+        currentPath: row.currentPath
+      }));
+      const projectedProposedActions = await buildProjectedGovernanceProposedActions(storage, projected);
+      const projectedArtifact = await (async () => {
         try {
-          const coldRoot = path8.join(storageDir, "cold");
-          for (const candidate of qmdResultPathCandidates(
-            coldRoot,
-            parts.relativePath
-          )) {
-            const memory = await storage.readMemoryByPath(candidate);
-            if (memory) return memory;
-          }
-        } catch (err) {
-          if (err instanceof SecureStoreLockedError) throw err;
-          log.debug("qmd cold result path lookup failed open", {
-            path: resultPath,
-            collection: coldCollection,
-            error: err.message
-          });
+          return await readMemoryGovernanceRunArtifact(storage.dir, projected.runId);
+        } catch {
+          return null;
         }
-      }
-      return null;
+      })();
+      const metrics = projected.metrics;
+      const fallbackTransitionReport = {
+        proposed: groupActionsByStatus(projectedProposedActions),
+        applied: groupActionsByStatus(projectedAppliedActions)
+      };
+      const transitionReport = projectedArtifact?.transitionReport ? {
+        proposed: hasGroupedGovernanceActions(projectedArtifact.transitionReport.proposed) || projectedProposedActions.length === 0 ? projectedArtifact.transitionReport.proposed : fallbackTransitionReport.proposed,
+        applied: hasGroupedGovernanceActions(projectedArtifact.transitionReport.applied) || projectedAppliedActions.length === 0 ? projectedArtifact.transitionReport.applied : fallbackTransitionReport.applied
+      } : fallbackTransitionReport;
+      const qualityScore = projectedArtifact?.qualityScore ?? metrics?.qualityScore ?? buildQualityScore(metrics?.reviewReasons ?? {
+        exact_duplicate: 0,
+        semantic_duplicate_candidate: 0,
+        disputed_memory: 0,
+        speculative_low_confidence: 0,
+        archive_candidate: 0,
+        explicit_capture_review: 0,
+        malformed_import: 0
+      });
+      const effectiveMetrics = metrics ? { ...metrics, qualityScore: metrics.qualityScore ?? qualityScore } : metrics;
+      return {
+        found: true,
+        namespace: resolvedNamespace,
+        runId: projected.runId,
+        summary: projected.summary,
+        metrics: effectiveMetrics,
+        qualityScore,
+        reviewQueue: projected.reviewQueueRows.map((row) => ({
+          entryId: row.entryId,
+          memoryId: row.memoryId,
+          path: row.path,
+          reasonCode: row.reasonCode,
+          severity: row.severity,
+          suggestedAction: row.suggestedAction,
+          suggestedStatus: row.suggestedStatus,
+          relatedMemoryIds: row.relatedMemoryIds
+        })),
+        appliedActions: projectedAppliedActions,
+        transitionReport,
+        report: projected.report
+      };
     }
-    const collectionNamespace = parts ? this.qmdCollectionNamespaceFromPrefix(parts.collection) : null;
-    if (parts && collectionNamespace) {
-      try {
-        const collectionStorage = await this.storageFor(collectionNamespace);
-        for (const candidate of qmdResultPathCandidates(
-          collectionStorage.dir,
-          parts.relativePath
-        )) {
-          const memory = await collectionStorage.readMemoryByPath(candidate);
-          if (memory) return memory;
-        }
-        return null;
-      } catch (err) {
-        if (err instanceof SecureStoreLockedError) throw err;
-        log.debug("qmd result namespace path lookup failed open", {
-          path: resultPath,
-          namespace: collectionNamespace,
-          error: err.message
-        });
-        return null;
-      }
+    const resolvedRunId = runId?.trim() || (await listMemoryGovernanceRuns(storage.dir))[0];
+    if (!resolvedRunId) return { found: false, namespace: resolvedNamespace };
+    const artifact = await readMemoryGovernanceRunArtifact(storage.dir, resolvedRunId);
+    return {
+      found: true,
+      namespace: resolvedNamespace,
+      runId: resolvedRunId,
+      summary: artifact.summary,
+      metrics: artifact.metrics,
+      qualityScore: artifact.qualityScore,
+      reviewQueue: artifact.reviewQueue,
+      appliedActions: artifact.appliedActions,
+      transitionReport: artifact.transitionReport,
+      report: artifact.report
+    };
+  }
+  async governanceRun(request, principal) {
+    const deepSleep = this.deps.orchestrator.config.dreamsPhases.deepSleep;
+    if (deepSleep.enabled === false && deepSleep.enabledExplicitlySet === true) {
+      throw new Error("memory governance is disabled by dreams.phases.deepSleep.enabled=false");
     }
-    if (path8.isAbsolute(resultPath)) {
-      if (!fallbackStorageDir) {
-        return await fallbackStorage.readMemoryByPath(resultPath);
-      }
-      const ownerStorage = await this.storageForAbsoluteQmdResultPath(
-        resultPath,
-        fallbackStorage,
-        recallNamespaces
-      );
-      if (!ownerStorage) return null;
-      for (const candidate of qmdResultPathCandidates(
-        ownerStorage.dir,
-        resultPath
-      )) {
-        const memory = await ownerStorage.storage.readMemoryByPath(candidate);
-        if (memory) return memory;
+    const resolvedNamespace = this.deps.writableNamespaceFor(
+      request.namespace,
+      void 0,
+      request.authenticatedPrincipal ?? principal
+    );
+    const storage = await this.deps.orchestrator.getStorage(resolvedNamespace);
+    const mode = request.mode === "apply" ? "apply" : "shadow";
+    const boundedBatchSize = typeof request.batchSize === "number" && Number.isFinite(request.batchSize) ? Math.max(1, Math.floor(request.batchSize)) : void 0;
+    const result = await runMemoryGovernance({
+      memoryDir: storage.dir,
+      mode,
+      recentDays: typeof request.recentDays === "number" && Number.isFinite(request.recentDays) ? Math.max(1, Math.floor(request.recentDays)) : void 0,
+      maxMemories: typeof request.maxMemories === "number" && Number.isFinite(request.maxMemories) ? Math.max(1, Math.floor(request.maxMemories)) : void 0,
+      batchSize: boundedBatchSize
+    });
+    if (mode === "apply") {
+      try {
+        await this.deps.orchestrator.processEntitySynthesisQueue(
+          resolvedNamespace,
+          Math.min(boundedBatchSize ?? 5, 5)
+        );
+      } catch (error) {
+        log.debug(`governanceRun: entity synthesis refresh failed after governance apply: ${error}`);
       }
-      return null;
     }
-    if (!fallbackStorageDir) {
-      return await fallbackStorage.readMemoryByPath(resultPath);
+    return {
+      namespace: resolvedNamespace,
+      runId: result.runId,
+      traceId: result.traceId,
+      mode: result.mode,
+      reviewQueueCount: result.reviewQueue.length,
+      proposedActionCount: result.proposedActions.length,
+      appliedActionCount: result.appliedActions.length,
+      summaryPath: result.summaryPath,
+      reportPath: result.reportPath
+    };
+  }
+  async conversationIndexUpdate(request = {}) {
+    if (!resolveIndexingCapabilities(this.deps.orchestrator.config).conversationIndex) {
+      return {
+        enabled: false,
+        sessions: 0,
+        chunks: 0,
+        skipped: 0,
+        skippedSessionKeys: [],
+        embeddedRuns: 0,
+        reason: "disabled"
+      };
     }
-    for (const candidate of qmdResultPathCandidates(
-      fallbackStorageDir,
-      resultPath
-    )) {
-      const memory = await fallbackStorage.readMemoryByPath(candidate);
-      if (memory) return memory;
+    const hours = typeof request.hours === "number" && Number.isFinite(request.hours) ? Math.max(1, Math.floor(request.hours)) : 24;
+    let sessionKey;
+    if (request.sessionKey !== void 0) {
+      if (typeof request.sessionKey !== "string" || request.sessionKey.trim().length === 0) {
+        throw new EngramAccessInputError("sessionKey must be a non-empty string when provided");
+      }
+      sessionKey = request.sessionKey.trim();
     }
-    return null;
-  }
-  async resolveColdQmdResultForRecall(result, fallbackStorage, recallNamespaces = []) {
-    const memory = await this.readQmdResultMemory(
-      result.path,
-      fallbackStorage,
-      recallNamespaces
-    );
-    if (!memory) return null;
-    let ownerNamespace = null;
-    if (path8.isAbsolute(memory.path)) {
-      const ownerStorage = await this.storageForAbsoluteQmdResultPath(
-        memory.path,
-        fallbackStorage,
-        recallNamespaces
+    if (sessionKey) {
+      const result = await this.deps.orchestrator.updateConversationIndex(
+        sessionKey,
+        hours,
+        { embed: request.embed }
       );
-      ownerNamespace = ownerStorage?.namespace ?? null;
-      if (!ownerNamespace && resolveNamespaceCapabilities(this.getConfig()).namespaces) return null;
+      return {
+        enabled: true,
+        sessionKey,
+        sessions: 1,
+        chunks: result.chunks,
+        skipped: result.skipped ? 1 : 0,
+        skippedSessionKeys: result.skipped ? [sessionKey] : [],
+        embeddedRuns: result.embedded ? 1 : 0,
+        reason: result.reason,
+        retryAfterMs: result.retryAfterMs
+      };
     }
-    ownerNamespace ??= this.namespaceFromPath(memory.path);
-    if (recallNamespaces.length > 0 && !recallNamespaces.includes(ownerNamespace)) {
-      return null;
+    const sessionKeys = await this.deps.orchestrator.transcript.listSessionKeys();
+    let chunks = 0;
+    let skipped = 0;
+    const skippedSessionKeys = [];
+    let embeddedRuns = 0;
+    for (const sessionKey2 of sessionKeys) {
+      const result = await this.deps.orchestrator.updateConversationIndex(
+        sessionKey2,
+        hours,
+        { embed: request.embed }
+      );
+      chunks += result.chunks;
+      if (result.skipped) {
+        skipped += 1;
+        skippedSessionKeys.push(sessionKey2);
+      }
+      if (result.embedded) {
+        embeddedRuns += 1;
+      }
     }
     return {
-      namespace: ownerNamespace,
-      result: {
-        ...result,
-        docid: result.docid || memory.frontmatter.id,
-        path: memory.path,
-        snippet: result.snippet || memory.content.slice(0, 400)
-      }
+      enabled: true,
+      sessions: sessionKeys.length,
+      chunks,
+      skipped,
+      skippedSessionKeys,
+      embeddedRuns
     };
   }
-  async storageForAbsoluteQmdResultPath(resultPath, fallbackStorage, recallNamespaces = []) {
-    const resolvedPath = path8.resolve(resultPath);
-    const config = this.getConfig();
-    const memoryRoot = path8.resolve(config.memoryDir);
-    const namespacesRoot = path8.join(memoryRoot, "namespaces");
-    const fallbackStorageDir = storageDirOrNull(fallbackStorage);
-    const matches = [];
-    const seenDirs = /* @__PURE__ */ new Set();
-    const maybeAddStorage = (storage, namespace) => {
-      const storageDir = storageDirOrNull(storage);
-      if (!storageDir) return;
-      const candidateRoot = path8.resolve(storageDir);
-      if (seenDirs.has(candidateRoot)) return;
-      if (!isPathInsideStorageRoot(candidateRoot, resolvedPath)) return;
-      if (candidateRoot === memoryRoot && isPathInsideStorageRoot(namespacesRoot, resolvedPath)) {
-        return;
-      }
-      seenDirs.add(candidateRoot);
-      matches.push({ storage, dir: candidateRoot, namespace });
-    };
-    const fallbackNamespace = fallbackStorageDir !== null ? this.storageDirNamespace(fallbackStorageDir) : config.defaultNamespace;
-    maybeAddStorage(fallbackStorage, fallbackNamespace);
-    const candidateNamespaces = /* @__PURE__ */ new Set();
-    candidateNamespaces.add(config.defaultNamespace);
-    candidateNamespaces.add(config.sharedNamespace);
-    for (const ns of recallNamespaces) {
-      candidateNamespaces.add(ns);
+  async profilingReport(request = {}) {
+    const profiler = this.deps.orchestrator.profiler;
+    if (!profiler.isEnabled) {
+      return {
+        enabled: false,
+        reason: "disabled",
+        message: "Profiling is disabled. Set profilingEnabled: true in your plugin config to enable."
+      };
     }
-    if (isPathInsideStorageRoot(namespacesRoot, resolvedPath)) {
-      const relativeToNamespaces = path8.relative(namespacesRoot, resolvedPath);
-      const [namespaceSegment] = relativeToNamespaces.split(/[\\/]/);
-      if (namespaceSegment) {
-        candidateNamespaces.add(
-          namespaceIdentityFromToken(namespaceSegment) ?? namespaceSegment
-        );
-      }
+    const format = request.format ?? "ascii";
+    if (format !== "ascii" && format !== "json") {
+      throw new EngramAccessInputError("format must be one of: ascii, json");
     }
-    for (const policy of config.namespacePolicies ?? []) {
-      candidateNamespaces.add(policy.name);
+    const limit = request.limit ?? 5;
+    if (!Number.isInteger(limit) || limit < 1 || limit > 20) {
+      throw new EngramAccessInputError("limit must be an integer between 1 and 20");
     }
-    for (const ns of candidateNamespaces) {
-      if (!ns) continue;
-      try {
-        maybeAddStorage(await this.storageFor(ns), ns);
-      } catch {
-        continue;
+    const traces = profiler.getRecentTraces(limit);
+    const stats = profiler.getStats();
+    const bottleneck = profiler.identifyBottleneck();
+    if (format === "json") {
+      return {
+        enabled: true,
+        format,
+        traces,
+        stats,
+        bottleneck
+      };
+    }
+    const lines = [];
+    lines.push("Engram Profiling Report");
+    lines.push("=".repeat(60));
+    lines.push("");
+    const allBuckets = [
+      ["byKind", stats.byKind],
+      ["bySpan", stats.bySpan]
+    ];
+    const hasStats = allBuckets.some(([, entries]) => Object.keys(entries).length > 0);
+    if (hasStats) {
+      lines.push("Aggregate Stats (all retained traces):");
+      for (const [bucket, entries] of allBuckets) {
+        for (const [key, summary] of Object.entries(entries)) {
+          lines.push(
+            `  ${bucket}/${key}: avg=${summary.avgMs}ms p50=${summary.p50Ms}ms p95=${summary.p95Ms}ms max=${summary.maxMs}ms (n=${summary.count})`
+          );
+        }
       }
+      lines.push("");
     }
-    matches.sort((a, b) => b.dir.length - a.dir.length);
-    return matches[0] ?? null;
-  }
-};
-
-// src/access-recall-surface.ts
-var AccessRecallSurface = class {
-  constructor(deps) {
-    this.deps = deps;
-  }
-  deps;
-  async buildRecallResponseFromXraySnapshot(options) {
-    const memoryIds = options.snapshot.results.map((result) => result.memoryId);
-    const resultPaths = options.snapshot.results.map((result) => result.path);
-    const namespace = options.snapshot.namespace ? this.deps.resolveNamespace(options.snapshot.namespace) : this.deps.orchestrator.config.defaultNamespace;
-    const sourcesUsed = Array.from(
-      new Set(options.snapshot.results.map((result) => result.servedBy))
-    );
-    const snapshotForSerialization = {
-      sessionKey: options.sessionKey ?? "",
-      recordedAt: new Date(options.snapshot.capturedAt).toISOString(),
-      queryHash: createHash4("sha256").update(options.query).digest("hex"),
-      queryLen: options.query.length,
-      memoryIds,
-      namespace,
-      recallNamespaces: [namespace],
-      traceId: options.snapshot.traceId,
-      plannerMode: options.normalizedMode,
-      requestedMode: options.requestedMode && options.requestedMode !== "auto" ? options.requestedMode : void 0,
-      sourcesUsed,
-      budgetsApplied: {
-        appliedTopK: memoryIds.length,
-        recallBudgetChars: options.snapshot.budget.chars,
-        maxMemoryTokens: this.deps.orchestrator.config.maxMemoryTokens,
-        finalContextChars: options.snapshot.budget.used
-      },
-      latencyMs: Date.now() - options.startedAt,
-      resultPaths
-    };
-    const results = await this.deps.serializeRecallResults(
-      snapshotForSerialization,
-      options.disclosure,
-      {
-        query: options.query,
-        ...options.sessionKey ? { sessionKey: options.sessionKey } : {},
-        ...options.rawExcerptNamespace ? { rawExcerptNamespace: options.rawExcerptNamespace } : {},
-        ...options.rawExcerptSessionIds !== void 0 ? { rawExcerptSessionIds: options.rawExcerptSessionIds } : {},
-        ...options.rawExcerptsSuppressed ? { rawExcerptsSuppressed: options.rawExcerptsSuppressed } : {}
+    if (bottleneck) {
+      lines.push(`Bottleneck: ${bottleneck}`);
+      lines.push("");
+    }
+    if (traces.length === 0) {
+      lines.push("No traces recorded yet. Trigger a recall or extraction to see timing data.");
+    } else {
+      for (const trace of traces) {
+        lines.push(formatProfileTraceAscii(trace));
+        lines.push("");
       }
-    );
-    const context = results.map((result) => {
-      const content = typeof result.content === "string" && result.content.length > 0 ? result.content : "";
-      return content || result.preview;
-    }).filter((text) => text.length > 0).join("\n\n");
+    }
     return {
-      query: options.query,
-      ...options.sessionKey ? { sessionKey: options.sessionKey } : {},
-      namespace,
-      context,
-      count: memoryIds.length,
-      memoryIds,
-      results,
-      recordedAt: snapshotForSerialization.recordedAt,
-      traceId: options.snapshot.traceId,
-      plannerMode: options.normalizedMode,
-      fallbackUsed: sourcesUsed.some((source) => source !== "hybrid"),
-      sourcesUsed,
-      disclosure: options.disclosure,
-      budgetsApplied: snapshotForSerialization.budgetsApplied,
-      latencyMs: snapshotForSerialization.latencyMs
+      enabled: true,
+      format,
+      report: lines.join("\n")
     };
   }
-  async serializeRecallResults(snapshot, disclosure, rawContext = null) {
-    if (!snapshot) return [];
-    const namespace = snapshot.namespace ? this.deps.resolveNamespace(snapshot.namespace) : this.deps.orchestrator.config.defaultNamespace;
-    const storage = await this.deps.orchestrator.getStorage(namespace);
-    const storageDir = storage.dir;
-    const recallNamespaces = Array.from(
-      new Set(
-        [
-          namespace,
-          ...Array.isArray(snapshot.recallNamespaces) ? snapshot.recallNamespaces.map((ns) => this.deps.resolveNamespace(ns)) : [],
-          this.deps.orchestrator.config.defaultNamespace,
-          this.deps.orchestrator.config.sharedNamespace,
-          ...(this.deps.orchestrator.config.namespacePolicies ?? []).map((p) => p.name)
-        ].filter((ns) => typeof ns === "string" && ns.length > 0)
-      )
+  /**
+   * Read-only graph snapshot for the admin pane (issue #691 PR 2/5).
+   *
+   * Reads adjacency from the JSONL edge store written by `GraphIndex` and
+   * resolves node metadata via the namespaced storage manager.  Namespace
+   * resolution mirrors the read-side path used by `recall` /
+   * `procedureStats`, so multi-principal deployments can't leak edges from
+   * a peer namespace (CLAUDE.md rule 42).
+   */
+  async graphSnapshot(request, authenticatedPrincipal) {
+    const namespace = this.deps.resolveReadableNamespace(
+      request.namespace,
+      authenticatedPrincipal
     );
-    const results = [];
-    const seen = /* @__PURE__ */ new Set();
-    const collectionNamespaceFromPrefix = (collectionPrefix) => {
-      const baseCollection = this.deps.orchestrator.config.qmdCollection;
-      if (collectionPrefix === baseCollection) return this.deps.orchestrator.config.defaultNamespace;
-      const namespaceSuffix = collectionPrefix.startsWith(`${baseCollection}--`) ? collectionPrefix.slice(baseCollection.length + 2) : "";
-      if (!namespaceSuffix) return null;
-      const decoded = namespaceIdentityFromToken(namespaceSuffix);
-      if (decoded !== null) return decoded || this.deps.orchestrator.config.defaultNamespace;
-      if (namespaceSuffix.startsWith("ns--")) {
-        const legacyNamespace = namespaceSuffix.slice("ns--".length).trim();
-        return legacyNamespace || null;
+    const storage = await this.deps.orchestrator.getStorage(namespace);
+    const cfg = this.deps.orchestrator.config;
+    const graphCaps = resolveGraphConstructionCapabilities(cfg);
+    let namespaceRootReal;
+    try {
+      namespaceRootReal = await nodeFs.realpath(storage.dir);
+    } catch {
+      namespaceRootReal = nodePath.resolve(storage.dir);
+    }
+    const namespaceRootWithSep = namespaceRootReal.endsWith(nodePath.sep) ? namespaceRootReal : namespaceRootReal + nodePath.sep;
+    const loadNode = async (relPath) => {
+      if (nodePath.isAbsolute(relPath)) {
+        log.warn(
+          `graphSnapshot: rejected absolute edge endpoint (len=${relPath.length}) outside namespace root`
+        );
+        return null;
       }
-      return null;
-    };
-    const readResultPath = async (memoryPath) => {
-      const parts = qmdCollectionPathParts(memoryPath);
-      const coldCollection = this.deps.orchestrator.config.qmdColdCollection ?? "openclaw-engram-cold";
-      if (parts && parts.collection === coldCollection) {
-        const storages = [];
-        const seenStorageDirs = /* @__PURE__ */ new Set();
-        const addStorage = (candidateStorage) => {
-          const candidateDir = nodePath2.resolve(candidateStorage.dir);
-          if (seenStorageDirs.has(candidateDir)) return;
-          seenStorageDirs.add(candidateDir);
-          storages.push({ storage: candidateStorage, dir: candidateDir });
-        };
-        addStorage(storage);
-        for (const recallNamespace of recallNamespaces) {
-          try {
-            addStorage(await this.deps.orchestrator.getStorage(recallNamespace));
-          } catch {
-            continue;
-          }
-        }
-        for (const candidateStorage of storages) {
-          try {
-            const coldRoot = nodePath2.join(candidateStorage.dir, "cold");
-            for (const candidatePath of qmdResultPathCandidates(
-              coldRoot,
-              parts.relativePath
-            )) {
-              const memory = await candidateStorage.storage.readMemoryByPath(candidatePath);
-              if (memory) return { memory, baseDir: candidateStorage.dir };
-            }
-          } catch (err) {
-            if (err instanceof SecureStoreLockedError) throw err;
-            continue;
-          }
-        }
+      const candidate = nodePath.resolve(namespaceRootReal, relPath);
+      if (candidate !== namespaceRootReal && !candidate.startsWith(namespaceRootWithSep)) {
+        log.warn(
+          `graphSnapshot: rejected traversing edge endpoint (len=${relPath.length}) outside namespace root`
+        );
         return null;
       }
-      const collectionNamespace = parts ? collectionNamespaceFromPrefix(parts.collection) : null;
-      if (parts && collectionNamespace) {
-        try {
-          const collectionStorage = await this.deps.orchestrator.getStorage(collectionNamespace);
-          for (const candidate of qmdResultPathCandidates(
-            collectionStorage.dir,
-            parts.relativePath
-          )) {
-            const memory = await collectionStorage.readMemoryByPath(candidate);
-            if (memory) return { memory, baseDir: collectionStorage.dir };
-          }
-          return null;
-        } catch (err) {
-          if (err instanceof SecureStoreLockedError) throw err;
-          return null;
-        }
+      let canonical;
+      try {
+        canonical = await nodeFs.realpath(candidate);
+      } catch {
+        canonical = candidate;
       }
-      if (nodePath2.isAbsolute(memoryPath)) {
-        const ownerStorage = await this.deps.storageForAbsoluteRecallPath(
-          memoryPath,
-          namespace,
-          recallNamespaces
+      if (canonical !== namespaceRootReal && !canonical.startsWith(namespaceRootWithSep)) {
+        log.warn(
+          `graphSnapshot: rejected symlinked edge endpoint (len=${relPath.length}) that resolved outside namespace root`
         );
-        if (!ownerStorage) return null;
-        for (const candidate of qmdResultPathCandidates(
-          ownerStorage.dir,
-          memoryPath
-        )) {
-          const memory = await ownerStorage.storage.readMemoryByPath(candidate);
-          if (memory) return { memory, baseDir: ownerStorage.dir };
-        }
         return null;
       }
-      for (const candidate of qmdResultPathCandidates(storageDir, memoryPath)) {
-        const memory = await storage.readMemoryByPath(candidate);
-        if (memory) return { memory, baseDir: storageDir };
-      }
-      return null;
+      const memory = await storage.readMemoryByPath(canonical);
+      if (!memory) return null;
+      const fm = memory.frontmatter;
+      return {
+        category: fm.category ?? "unknown",
+        label: fm.id ?? nodePath.basename(canonical, nodePath.extname(canonical)),
+        updated: fm.updated
+      };
     };
-    const rawExcerptsResult = rawContext?.rawExcerptsSuppressed === true ? (
-      // Implicit raw recall with NO readable LCM namespace (#1505 thread
-      // NBHWz): emit empty excerpts rather than falling back to the
-      // write/overlay `namespace` the read gate excludes.
-      []
-    ) : await this.deps.fetchRawExcerpts(
-      disclosure,
-      rawContext ? {
-        query: rawContext.query,
-        ...rawContext.sessionKey ? { sessionKey: rawContext.sessionKey } : {},
-        namespace: rawContext.rawExcerptNamespace ?? namespace,
-        ...rawContext.rawExcerptSessionIds !== void 0 ? { lcmSessionIds: rawContext.rawExcerptSessionIds } : {}
-      } : null
-    );
-    const rawExcerpts = rawExcerptsResult ?? void 0;
-    for (const memoryPath of snapshot.resultPaths ?? []) {
-      if (!memoryPath || seen.has(memoryPath)) continue;
-      const resolved = await readResultPath(memoryPath);
-      if (!resolved) continue;
-      const { memory, baseDir } = resolved;
-      seen.add(memoryPath);
-      results.push(
-        this.deps.serializeMemorySummary(
-          memory,
-          baseDir,
-          disclosure,
-          // Attach the (possibly empty) raw excerpts to the first raw
-          // result; subsequent results do not duplicate the array.
-          results.length === 0 ? rawExcerpts : void 0
-        )
-      );
-    }
-    if (results.length > 0) return results;
-    for (const memoryId of snapshot.memoryIds) {
-      const memory = await storage.getMemoryById(memoryId);
-      if (!memory || seen.has(memory.path)) continue;
-      seen.add(memory.path);
-      results.push(
-        this.deps.serializeMemorySummary(
-          memory,
-          storageDir,
-          disclosure,
-          results.length === 0 ? rawExcerpts : void 0
-        )
-      );
-    }
-    return results;
+    return buildGraphSnapshot({
+      memoryDir: namespaceRootReal,
+      graphConfig: {
+        entityGraph: graphCaps.entityGraph,
+        timeGraph: graphCaps.timeGraph,
+        causalGraph: graphCaps.causalGraph
+      },
+      request: {
+        limit: request.limit,
+        since: request.since,
+        focusNodeId: request.focusNodeId,
+        categories: request.categories
+      },
+      loadNode
+    });
   }
   /**
-   * Fetch raw transcript excerpts from the LCM archive for `disclosure ===
-   * "raw"` recalls (issue #677 PR 2/4).  Returns `null` for non-raw recall
-   * depths, an empty array when LCM is disabled / not initialized / has no
-   * matches, and an array of LCM-side excerpts otherwise.  Errors are
-   * swallowed and treated as "no excerpts" so a failing LCM never breaks
-   * the recall response.
+   * List capsule archives in the namespace-scoped capsule store.
    *
-   * Namespace handling: LCM archival prefixes non-default-namespace
-   * sessions with `${namespace}:${sessionKey}` (see `observe()` around
-   * line 2498), so the lookup must mirror that prefix or raw recalls in
-   * non-default namespaces miss their own excerpts.
+   * MCP uses this access-layer method instead of reading arbitrary paths so
+   * capsule discovery remains bound to the same namespace ACLs as export and
+   * import.
    */
-  async fetchRawExcerpts(disclosure, context) {
-    if (disclosure !== "raw") return null;
-    if (!context || !context.query) return [];
-    if (!context.sessionKey) return [];
-    const lcm = this.deps.orchestrator.lcmEngine;
-    if (!lcm || !lcm.enabled) return [];
+  async capsuleList(options) {
+    const resolvedNamespace = this.deps.resolveReadableNamespace(options?.namespace, options?.principal);
+    const storage = await this.deps.orchestrator.getStorage(resolvedNamespace);
+    const capsulesDir = defaultCapsulesDir(storage.dir);
+    let dirEntries;
     try {
-      const legacyKey = context.namespace && context.namespace !== this.deps.orchestrator.config.defaultNamespace ? `${context.namespace}:${context.sessionKey}` : context.sessionKey;
-      const lcmSessionIds = context.lcmSessionIds !== void 0 ? context.lcmSessionIds : [legacyKey];
-      const limit = 5;
-      const seenRows = /* @__PURE__ */ new Set();
-      const excerpts = [];
-      const settledRows = await Promise.allSettled(
-        lcmSessionIds.map(
-          async (lcmSessionKey) => lcm.searchContextFull(context.query, limit, lcmSessionKey)
-        )
-      );
-      for (const result of settledRows) {
-        if (excerpts.length >= limit) break;
-        if (result.status !== "fulfilled") continue;
-        for (const r of result.value) {
-          const dedupeKey = `${r.session_id} ${r.turn_index}`;
-          if (seenRows.has(dedupeKey)) continue;
-          seenRows.add(dedupeKey);
-          excerpts.push({
-            turnIndex: r.turn_index,
-            role: r.role,
-            content: r.content,
-            sessionId: r.session_id
-          });
-          if (excerpts.length >= limit) break;
-        }
+      const capsulesDirStat = await nodeFs.lstat(capsulesDir);
+      if (capsulesDirStat.isSymbolicLink()) {
+        throw new EngramAccessInputError("capsule list failed: capsule store directory must not be a symlink");
       }
-      return excerpts;
-    } catch {
-      return [];
-    }
-  }
-  async executeRecall(request) {
-    const query = request.query;
-    const callerProvidedDisclosure = request.disclosure !== void 0 && request.disclosure !== null;
-    const requestedDisclosure = (() => {
-      if (!callerProvidedDisclosure) {
-        return DEFAULT_RECALL_DISCLOSURE;
+      if (!capsulesDirStat.isDirectory()) {
+        throw new EngramAccessInputError("capsule list failed: capsule store path must be a directory");
       }
-      if (!isRecallDisclosure(request.disclosure)) {
-        throw new EngramAccessInputError(
-          `disclosure must be one of: chunk, section, raw (got: ${String(request.disclosure)})`
-        );
+      dirEntries = await nodeFs.readdir(capsulesDir, { withFileTypes: true });
+    } catch (err) {
+      const code = typeof err === "object" && err !== null && "code" in err ? err.code : void 0;
+      if (code === "ENOENT") {
+        return { namespace: resolvedNamespace, capsulesDir, capsules: [] };
       }
-      return request.disclosure;
-    })();
-    if (request.codingContext !== void 0 && request.sessionKey) {
-      this.deps.setCodingContext({
-        sessionKey: request.sessionKey,
-        codingContext: request.codingContext
-      });
+      throw err;
     }
-    if (request.codingContext === void 0 && request.sessionKey) {
-      await this.deps.maybeAttachCodingContext(request.sessionKey, {
-        cwd: request.cwd,
-        projectTag: request.projectTag
+    const archiveNames = dirEntries.filter(
+      (entry) => entry.isFile() && (entry.name.endsWith(".capsule.json.gz") || entry.name.endsWith(".capsule.json.gz.enc"))
+    ).map((entry) => entry.name).sort();
+    const capsules = [];
+    for (const archiveName of archiveNames) {
+      const archivePath = nodePath.join(capsulesDir, archiveName);
+      const id = archiveName.replace(/\.capsule\.json\.gz\.enc$/, "").replace(/\.capsule\.json\.gz$/, "");
+      const manifestPath = nodePath.join(capsulesDir, `${id}.manifest.json`);
+      let createdAt = null;
+      let pluginVersion = null;
+      let fileCount = null;
+      let description = null;
+      let manifestPathOrNull = manifestPath;
+      try {
+        const manifestStat = await nodeFs.lstat(manifestPath);
+        if (manifestStat.isSymbolicLink() || !manifestStat.isFile()) {
+          capsules.push({
+            id,
+            archivePath,
+            manifestPath: manifestPathOrNull,
+            createdAt,
+            pluginVersion,
+            fileCount,
+            description
+          });
+          continue;
+        }
+        const raw = await nodeFs.readFile(manifestPath, "utf-8");
+        const sidecar = JSON.parse(raw);
+        createdAt = typeof sidecar.createdAt === "string" ? sidecar.createdAt : null;
+        pluginVersion = typeof sidecar.pluginVersion === "string" ? sidecar.pluginVersion : null;
+        fileCount = Array.isArray(sidecar.files) ? sidecar.files.length : null;
+        const capsule = sidecar.capsule;
+        description = capsule && typeof capsule.description === "string" ? capsule.description : null;
+      } catch (err) {
+        const code = typeof err === "object" && err !== null && "code" in err ? err.code : void 0;
+        if (code === "ENOENT") {
+          manifestPathOrNull = null;
+        }
+      }
+      capsules.push({
+        id,
+        archivePath,
+        manifestPath: manifestPathOrNull,
+        createdAt,
+        pluginVersion,
+        fileCount,
+        description
       });
     }
-    const authenticatedPrincipal = request.authenticatedPrincipal?.trim();
-    const namespaceOverride = this.deps.resolveRecallNamespace(
-      request.namespace,
-      request.sessionKey,
-      authenticatedPrincipal
-    );
-    const namespace = namespaceOverride ?? this.deps.orchestrator.config.defaultNamespace;
-    const mode = this.deps.normalizeRecallMode(request.mode);
-    const maybePrincipal = this.deps.resolveRequestPrincipal(request.sessionKey, authenticatedPrincipal);
-    if (resolveNamespaceCapabilities(this.deps.orchestrator.config).namespaces && !maybePrincipal) {
+    return { namespace: resolvedNamespace, capsulesDir, capsules };
+  }
+  /**
+   * Manually invoke a single Dreams phase pass (PR 4/4).
+   *
+   * Deep-sleep delegates to memory governance (shadow → dry-run, apply → live).
+   * Light-sleep and REM scan the observation ledger and memory corpus
+   * respectively, returning the same telemetry shape as a scheduled run.
+   */
+  async dreamsRun(options) {
+    const { runDreamsPhase } = await import("./dreams-ledger-6UODQOX6.js");
+    const validPhases = ["lightSleep", "rem", "deepSleep"];
+    if (!validPhases.includes(options.phase)) {
       throw new EngramAccessInputError(
-        "authentication required: namespaces are enabled and no principal was supplied"
+        `Invalid phase: ${String(options.phase)}. Must be one of: ${validPhases.join(", ")}`
       );
     }
-    const principal = maybePrincipal ?? "default";
-    const principalNamespace = defaultNamespaceForPrincipal(principal, this.deps.orchestrator.config);
-    const profileCodingContext = request.sessionKey && typeof this.deps.orchestrator.getCodingContextForSession === "function" ? this.deps.orchestrator.getCodingContextForSession(request.sessionKey) : null;
-    const profileCodingOverlay = !namespaceOverride && profileCodingContext && resolveNamespaceCapabilities(this.deps.orchestrator.config).namespaces && this.deps.orchestrator.config.codingMode?.projectScope ? resolveCodingNamespaceOverlay(
-      profileCodingContext,
-      this.deps.orchestrator.config.codingMode,
-      this.deps.orchestrator.config.defaultNamespace
-    ) : null;
-    const profilePlan = namespaceOverride ? null : resolveScopeProfilePlan({
-      config: this.deps.orchestrator.config,
-      principal,
-      codingContext: profileCodingContext,
-      codingOverlay: profileCodingOverlay
-    });
-    const modeSkipsBudget = mode === "no_recall";
-    const legacyRecallNamespaces = Array.isArray(this.deps.orchestrator.config.defaultRecallNamespaces) ? recallNamespacesForPrincipal(principal, this.deps.orchestrator.config) : [];
-    const effectiveNamespaces = namespaceOverride ? [namespaceOverride] : profilePlan ? expandScopeProfileReadNamespaces({
-      profilePlan,
-      principalSelfNamespace: profilePlan.baseNamespace,
-      config: this.deps.orchestrator.config,
-      principal,
-      codingOverlay: profileCodingOverlay,
-      legacyRecallNamespaces
-    }) : legacyRecallNamespaces;
-    const budgetPrincipalNamespace = profilePlan?.baseNamespace ?? principalNamespace;
-    let budgetDecision;
-    let recordBudgetAfterSuccess = false;
-    if (modeSkipsBudget) {
-      budgetDecision = {
-        allowed: true,
-        reason: "allowed-same-namespace",
-        count: 0,
-        limit: {
-          softLimit: this.deps.orchestrator.config.recallCrossNamespaceBudgetSoftLimit ?? 10,
-          hardLimit: this.deps.orchestrator.config.recallCrossNamespaceBudgetHardLimit ?? 30,
-          windowMs: this.deps.orchestrator.config.recallCrossNamespaceBudgetWindowMs ?? 6e4
-        }
+    const deepSleep = this.deps.orchestrator.config.dreamsPhases.deepSleep;
+    if (options.phase === "deepSleep" && deepSleep.enabled === false && deepSleep.enabledExplicitlySet === true) {
+      throw new EngramAccessInputError(
+        "memory governance is disabled by dreams.phases.deepSleep.enabled=false"
+      );
+    }
+    const dryRun = options.dryRun === true;
+    const resolvedNamespace = this.deps.writableNamespaceFor(
+      options.namespace,
+      void 0,
+      options.authenticatedPrincipal
+    );
+    const storage = await this.deps.orchestrator.getStorage(resolvedNamespace);
+    const memoryDir = storage.dir;
+    const phaseRunner = dryRun || options.phase === "deepSleep" ? void 0 : async (_opts) => {
+      if (_opts.phase === "lightSleep") {
+        const result3 = await this.deps.orchestrator.runLifecyclePolicyNow(storage);
+        return {
+          itemsProcessed: result3.memoriesAssessed,
+          notes: `scored ${result3.memoriesAssessed} memories`
+        };
+      }
+      const result2 = await this.deps.orchestrator.runSemanticConsolidationNow({
+        dryRun: false,
+        storage
+      });
+      const itemsProcessed = result2.clusters.reduce(
+        (sum, cluster) => sum + cluster.memories.length,
+        0
+      );
+      return {
+        itemsProcessed,
+        notes: `REM consolidation found ${result2.clustersFound} clusters`
       };
+    };
+    const governanceRunner = options.phase === "deepSleep" ? async (_opts) => {
+      return this.deps.orchestrator.runDeepSleepGovernanceNow({
+        storage,
+        dryRun: _opts.dryRun
+      });
+    } : void 0;
+    const result = await runDreamsPhase(
+      { memoryDir, phase: options.phase, dryRun },
+      governanceRunner,
+      phaseRunner
+    );
+    return {
+      phase: result.phase,
+      dryRun: result.dryRun,
+      durationMs: result.durationMs,
+      itemsProcessed: result.itemsProcessed,
+      notes: result.notes
+    };
+  }
+  /**
+   * Manually promote a memory into one or more authorized targets. Requires
+   * a non-empty reason (audit-logged). Reuses the scope-profile promotion
+   * resolution and `canWriteNamespace` gate — there is no dashboard-only
+   * write path.
+   */
+  async adminPromoteMemory(request) {
+    const config = this.deps.orchestrator.config;
+    const namespacesEnabled = resolveNamespaceCapabilities(config).namespaces === true;
+    let sourceNamespace;
+    if (request.namespace) {
+      sourceNamespace = this.deps.resolveReadableNamespace(
+        request.namespace,
+        request.principal
+      );
     } else {
-      let anyCrossNamespace = false;
-      let denied = null;
-      let crossNamespaceDecision = null;
-      for (const ns of effectiveNamespaces) {
-        const peek = this.deps.budget.peek({
-          principal,
-          principalNamespace: budgetPrincipalNamespace,
-          queryNamespace: ns
-        });
-        if (peek.reason !== "allowed-same-namespace") {
-          anyCrossNamespace = true;
-          crossNamespaceDecision ??= peek;
-        }
-        if (!peek.allowed) {
-          denied = peek;
-          break;
-        }
-      }
-      if (denied) {
-        budgetDecision = denied;
-      } else if (anyCrossNamespace) {
-        budgetDecision = crossNamespaceDecision ?? {
-          allowed: true,
-          reason: "allowed-under-soft",
-          count: 0,
-          limit: {
-            softLimit: this.deps.orchestrator.config.recallCrossNamespaceBudgetSoftLimit ?? 10,
-            hardLimit: this.deps.orchestrator.config.recallCrossNamespaceBudgetHardLimit ?? 30,
-            windowMs: this.deps.orchestrator.config.recallCrossNamespaceBudgetWindowMs ?? 6e4
-          }
+      const codingContext2 = request.sessionKey ? this.deps.orchestrator.getCodingContextForSession(request.sessionKey) ?? null : null;
+      const plan = resolveScopePlan({
+        config,
+        sessionKey: request.sessionKey,
+        principalOverride: request.principal,
+        codingContext: codingContext2,
+        namespacesEnabled
+      });
+      sourceNamespace = this.deps.resolveReadableNamespace(
+        plan.baseNamespace,
+        request.principal
+      );
+    }
+    const codingContext = request.sessionKey ? this.deps.orchestrator.getCodingContextForSession(request.sessionKey) ?? null : null;
+    const codingOverlay = codingContext ? resolveCodingNamespaceOverlay(
+      codingContext,
+      config.codingMode,
+      config.defaultNamespace
+    ) : null;
+    const scopeProfilePlan = resolveScopeProfilePlan({
+      config,
+      principal: request.principal,
+      codingContext,
+      codingOverlay
+    });
+    const storage = {
+      readMemory: async (namespace, memoryId) => {
+        const resolved = await this.deps.orchestrator.getStorage(namespace);
+        const memory = await resolved.getMemoryById(memoryId);
+        if (!memory) return null;
+        return {
+          category: memory.frontmatter.category,
+          content: memory.content,
+          frontmatter: memory.frontmatter
         };
-        recordBudgetAfterSuccess = true;
-      } else {
-        budgetDecision = {
-          allowed: true,
-          reason: "allowed-same-namespace",
-          count: 0,
-          limit: {
-            softLimit: this.deps.orchestrator.config.recallCrossNamespaceBudgetSoftLimit ?? 10,
-            hardLimit: this.deps.orchestrator.config.recallCrossNamespaceBudgetHardLimit ?? 30,
-            windowMs: this.deps.orchestrator.config.recallCrossNamespaceBudgetWindowMs ?? 6e4
+      },
+      writePromotedMemory: async (namespace, memory) => {
+        const resolved = await this.deps.orchestrator.getStorage(namespace);
+        const { id, tombstoneBlocked } = await resolved.writeMemory(
+          memory.category,
+          memory.content,
+          {
+            confidence: memory.confidence,
+            tags: memory.tags,
+            entityRef: memory.entityRef,
+            source: `admin-promotion:${memory.sourceNamespace}:${memory.reason.slice(0, 120)}`,
+            lineage: memory.lineage,
+            sourceMemoryId: memory.sourceMemoryId,
+            actor: memory.actor,
+            validAt: memory.validAt
           }
-        };
-      }
-      if (!budgetDecision.allowed) {
-        throw new EngramAccessInputError(
-          `recall denied: cross-namespace budget exceeded (${budgetDecision.count}/${budgetDecision.limit.hardLimit} in ${budgetDecision.limit.windowMs}ms window)`
-        );
-      }
-      this.deps.budget.gc();
-    }
-    const topK = Number.isFinite(request.topK) ? Math.max(0, Math.floor(request.topK ?? 0)) : void 0;
-    let asOf;
-    if (request.asOf !== void 0 && request.asOf !== null) {
-      if (typeof request.asOf !== "string" || request.asOf.trim().length === 0) {
-        throw new EngramAccessInputError(
-          "asOf must be a non-empty ISO 8601 timestamp string"
         );
+        if (tombstoneBlocked) {
+          throw new Error(
+            "target namespace tombstone-blocked the promoted content (pending_review)"
+          );
+        }
+        return id;
       }
-      const parsed = Date.parse(request.asOf);
-      if (!Number.isFinite(parsed)) {
-        throw new EngramAccessInputError(
-          `asOf must be a parseable ISO 8601 timestamp (got: "${request.asOf}")`
-        );
+    };
+    try {
+      return await promoteMemory({
+        config,
+        sourceMemoryId: request.sourceMemoryId,
+        sourceNamespace,
+        principal: request.principal,
+        targets: request.targets,
+        reason: request.reason,
+        actor: request.principal ?? "admin-console",
+        storage,
+        scopeProfilePlan
+      });
+    } catch (err) {
+      if (err instanceof AdminPromotionError) {
+        throw new EngramAccessInputError(err.message);
       }
-      asOf = request.asOf;
+      throw err;
     }
-    const recallOptions = {
-      namespace: namespaceOverride,
+  }
+};
+
+// src/access-recall-surface.ts
+import { createHash as createHash4 } from "crypto";
+import * as nodePath2 from "path";
+
+// src/orchestration/qmd-result-resolver.ts
+import path8 from "path";
+function qmdCollectionPathParts(resultPath) {
+  if (!resultPath || path8.isAbsolute(resultPath)) return null;
+  const normalized = resultPath.replace(/\\/g, "/").replace(/^\/+/, "");
+  const slashIndex = normalized.indexOf("/");
+  if (slashIndex <= 0 || slashIndex >= normalized.length - 1) return null;
+  const collection = normalized.slice(0, slashIndex);
+  if (/^\d{4}-\d{2}-\d{2}$/.test(collection)) return null;
+  return {
+    collection,
+    relativePath: normalized.slice(slashIndex + 1)
+  };
+}
+function qmdResultPathCandidates(storageDir, resultPath) {
+  const candidates = /* @__PURE__ */ new Set();
+  const storageRoot = path8.resolve(storageDir);
+  const addCandidate = (candidate) => {
+    const resolved = path8.resolve(candidate);
+    if (isPathInsideStorageRoot(storageRoot, resolved)) {
+      candidates.add(resolved);
+    }
+  };
+  const addRelativeCandidates = (relativePath) => {
+    const normalized = relativePath.replace(/\\/g, "/").replace(/^\/+/, "");
+    if (!normalized) return;
+    addCandidate(path8.join(storageRoot, normalized));
+    if (/^\d{4}-\d{2}-\d{2}\//.test(normalized)) {
+      addCandidate(path8.join(storageRoot, "facts", normalized));
+    }
+  };
+  if (path8.isAbsolute(resultPath)) {
+    addCandidate(resultPath);
+  } else {
+    addRelativeCandidates(resultPath);
+  }
+  return [...candidates];
+}
+function storageDirOrNull(storage) {
+  const dir = storage.dir;
+  return typeof dir === "string" && dir.length > 0 ? dir : null;
+}
+var QmdResultResolver = class {
+  getConfig;
+  storageFor;
+  storageDirNamespace;
+  qmdCollectionNamespaceFromPrefix;
+  namespaceFromPath;
+  constructor(options) {
+    this.getConfig = options.getConfig;
+    this.storageFor = options.storageFor;
+    this.storageDirNamespace = options.storageDirNamespace;
+    this.qmdCollectionNamespaceFromPrefix = options.qmdCollectionNamespaceFromPrefix;
+    this.namespaceFromPath = options.namespaceFromPath;
+  }
+  async readQmdResultMemory(resultPath, fallbackStorage, recallNamespaces = []) {
+    const parts = qmdCollectionPathParts(resultPath);
+    const fallbackStorageDir = storageDirOrNull(fallbackStorage);
+    const config = this.getConfig();
+    const coldCollection = config.qmdColdCollection ?? "openclaw-engram-cold";
+    if (parts && parts.collection === coldCollection) {
+      const storages = [];
+      const seenStorageDirs = /* @__PURE__ */ new Set();
+      const addStorage = (storage) => {
+        const storageDir = storageDirOrNull(storage);
+        const storageKey = storageDir ? path8.resolve(storageDir) : `storage-without-dir-${storages.length}`;
+        if (seenStorageDirs.has(storageKey)) return;
+        seenStorageDirs.add(storageKey);
+        storages.push(storage);
+      };
+      const fallbackNamespace = fallbackStorageDir !== null ? this.storageDirNamespace(fallbackStorageDir) : config.defaultNamespace;
+      if (recallNamespaces.length === 0 || !resolveNamespaceCapabilities(config).namespaces || recallNamespaces.includes(fallbackNamespace)) {
+        addStorage(fallbackStorage);
+      }
+      if (recallNamespaces.length > 0) {
+        for (const namespace of recallNamespaces) {
+          try {
+            addStorage(await this.storageFor(namespace));
+          } catch (err) {
+            log.debug("qmd cold result namespace storage lookup skipped", {
+              path: resultPath,
+              namespace,
+              error: err.message
+            });
+          }
+        }
+      }
+      for (const storage of storages) {
+        const storageDir = storageDirOrNull(storage);
+        if (!storageDir) {
+          const memory = await storage.readMemoryByPath(resultPath);
+          if (memory) return memory;
+          continue;
+        }
+        try {
+          const coldRoot = path8.join(storageDir, "cold");
+          for (const candidate of qmdResultPathCandidates(
+            coldRoot,
+            parts.relativePath
+          )) {
+            const memory = await storage.readMemoryByPath(candidate);
+            if (memory) return memory;
+          }
+        } catch (err) {
+          if (err instanceof SecureStoreLockedError) throw err;
+          log.debug("qmd cold result path lookup failed open", {
+            path: resultPath,
+            collection: coldCollection,
+            error: err.message
+          });
+        }
+      }
+      return null;
+    }
+    const collectionNamespace = parts ? this.qmdCollectionNamespaceFromPrefix(parts.collection) : null;
+    if (parts && collectionNamespace) {
+      try {
+        const collectionStorage = await this.storageFor(collectionNamespace);
+        for (const candidate of qmdResultPathCandidates(
+          collectionStorage.dir,
+          parts.relativePath
+        )) {
+          const memory = await collectionStorage.readMemoryByPath(candidate);
+          if (memory) return memory;
+        }
+        return null;
+      } catch (err) {
+        if (err instanceof SecureStoreLockedError) throw err;
+        log.debug("qmd result namespace path lookup failed open", {
+          path: resultPath,
+          namespace: collectionNamespace,
+          error: err.message
+        });
+        return null;
+      }
+    }
+    if (path8.isAbsolute(resultPath)) {
+      if (!fallbackStorageDir) {
+        return await fallbackStorage.readMemoryByPath(resultPath);
+      }
+      const ownerStorage = await this.storageForAbsoluteQmdResultPath(
+        resultPath,
+        fallbackStorage,
+        recallNamespaces
+      );
+      if (!ownerStorage) return null;
+      for (const candidate of qmdResultPathCandidates(
+        ownerStorage.dir,
+        resultPath
+      )) {
+        const memory = await ownerStorage.storage.readMemoryByPath(candidate);
+        if (memory) return memory;
+      }
+      return null;
+    }
+    if (!fallbackStorageDir) {
+      return await fallbackStorage.readMemoryByPath(resultPath);
+    }
+    for (const candidate of qmdResultPathCandidates(
+      fallbackStorageDir,
+      resultPath
+    )) {
+      const memory = await fallbackStorage.readMemoryByPath(candidate);
+      if (memory) return memory;
+    }
+    return null;
+  }
+  async resolveColdQmdResultForRecall(result, fallbackStorage, recallNamespaces = []) {
+    const memory = await this.readQmdResultMemory(
+      result.path,
+      fallbackStorage,
+      recallNamespaces
+    );
+    if (!memory) return null;
+    let ownerNamespace = null;
+    if (path8.isAbsolute(memory.path)) {
+      const ownerStorage = await this.storageForAbsoluteQmdResultPath(
+        memory.path,
+        fallbackStorage,
+        recallNamespaces
+      );
+      ownerNamespace = ownerStorage?.namespace ?? null;
+      if (!ownerNamespace && resolveNamespaceCapabilities(this.getConfig()).namespaces) return null;
+    }
+    ownerNamespace ??= this.namespaceFromPath(memory.path);
+    if (recallNamespaces.length > 0 && !recallNamespaces.includes(ownerNamespace)) {
+      return null;
+    }
+    return {
+      namespace: ownerNamespace,
+      result: {
+        ...result,
+        docid: result.docid || memory.frontmatter.id,
+        path: memory.path,
+        snippet: result.snippet || memory.content.slice(0, 400)
+      }
+    };
+  }
+  async storageForAbsoluteQmdResultPath(resultPath, fallbackStorage, recallNamespaces = []) {
+    const resolvedPath = path8.resolve(resultPath);
+    const config = this.getConfig();
+    const memoryRoot = path8.resolve(config.memoryDir);
+    const namespacesRoot = path8.join(memoryRoot, "namespaces");
+    const fallbackStorageDir = storageDirOrNull(fallbackStorage);
+    const matches = [];
+    const seenDirs = /* @__PURE__ */ new Set();
+    const maybeAddStorage = (storage, namespace) => {
+      const storageDir = storageDirOrNull(storage);
+      if (!storageDir) return;
+      const candidateRoot = path8.resolve(storageDir);
+      if (seenDirs.has(candidateRoot)) return;
+      if (!isPathInsideStorageRoot(candidateRoot, resolvedPath)) return;
+      if (candidateRoot === memoryRoot && isPathInsideStorageRoot(namespacesRoot, resolvedPath)) {
+        return;
+      }
+      seenDirs.add(candidateRoot);
+      matches.push({ storage, dir: candidateRoot, namespace });
+    };
+    const fallbackNamespace = fallbackStorageDir !== null ? this.storageDirNamespace(fallbackStorageDir) : config.defaultNamespace;
+    maybeAddStorage(fallbackStorage, fallbackNamespace);
+    const candidateNamespaces = /* @__PURE__ */ new Set();
+    candidateNamespaces.add(config.defaultNamespace);
+    candidateNamespaces.add(config.sharedNamespace);
+    for (const ns of recallNamespaces) {
+      candidateNamespaces.add(ns);
+    }
+    if (isPathInsideStorageRoot(namespacesRoot, resolvedPath)) {
+      const relativeToNamespaces = path8.relative(namespacesRoot, resolvedPath);
+      const [namespaceSegment] = relativeToNamespaces.split(/[\\/]/);
+      if (namespaceSegment) {
+        candidateNamespaces.add(
+          namespaceIdentityFromToken(namespaceSegment) ?? namespaceSegment
+        );
+      }
+    }
+    for (const policy of config.namespacePolicies ?? []) {
+      candidateNamespaces.add(policy.name);
+    }
+    for (const ns of candidateNamespaces) {
+      if (!ns) continue;
+      try {
+        maybeAddStorage(await this.storageFor(ns), ns);
+      } catch {
+        continue;
+      }
+    }
+    matches.sort((a, b) => b.dir.length - a.dir.length);
+    return matches[0] ?? null;
+  }
+};
+
+// src/access-recall-surface.ts
+var AccessRecallSurface = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  deps;
+  async buildRecallResponseFromXraySnapshot(options) {
+    const memoryIds = options.snapshot.results.map((result) => result.memoryId);
+    const resultPaths = options.snapshot.results.map((result) => result.path);
+    const namespace = options.snapshot.namespace ? this.deps.resolveNamespace(options.snapshot.namespace) : this.deps.orchestrator.config.defaultNamespace;
+    const sourcesUsed = Array.from(
+      new Set(options.snapshot.results.map((result) => result.servedBy))
+    );
+    const snapshotForSerialization = {
+      sessionKey: options.sessionKey ?? "",
+      recordedAt: new Date(options.snapshot.capturedAt).toISOString(),
+      queryHash: createHash4("sha256").update(options.query).digest("hex"),
+      queryLen: options.query.length,
+      memoryIds,
+      namespace,
+      recallNamespaces: [namespace],
+      traceId: options.snapshot.traceId,
+      plannerMode: options.normalizedMode,
+      requestedMode: options.requestedMode && options.requestedMode !== "auto" ? options.requestedMode : void 0,
+      sourcesUsed,
+      budgetsApplied: {
+        appliedTopK: memoryIds.length,
+        recallBudgetChars: options.snapshot.budget.chars,
+        maxMemoryTokens: this.deps.orchestrator.config.maxMemoryTokens,
+        finalContextChars: options.snapshot.budget.used
+      },
+      latencyMs: Date.now() - options.startedAt,
+      resultPaths
+    };
+    const results = await this.deps.serializeRecallResults(
+      snapshotForSerialization,
+      options.disclosure,
+      {
+        query: options.query,
+        ...options.sessionKey ? { sessionKey: options.sessionKey } : {},
+        ...options.rawExcerptNamespace ? { rawExcerptNamespace: options.rawExcerptNamespace } : {},
+        ...options.rawExcerptSessionIds !== void 0 ? { rawExcerptSessionIds: options.rawExcerptSessionIds } : {},
+        ...options.rawExcerptsSuppressed ? { rawExcerptsSuppressed: options.rawExcerptsSuppressed } : {}
+      }
+    );
+    const context = results.map((result) => {
+      const content = typeof result.content === "string" && result.content.length > 0 ? result.content : "";
+      return content || result.preview;
+    }).filter((text) => text.length > 0).join("\n\n");
+    return {
+      query: options.query,
+      ...options.sessionKey ? { sessionKey: options.sessionKey } : {},
+      namespace,
+      context,
+      count: memoryIds.length,
+      memoryIds,
+      results,
+      recordedAt: snapshotForSerialization.recordedAt,
+      traceId: options.snapshot.traceId,
+      plannerMode: options.normalizedMode,
+      fallbackUsed: sourcesUsed.some((source) => source !== "hybrid"),
+      sourcesUsed,
+      disclosure: options.disclosure,
+      budgetsApplied: snapshotForSerialization.budgetsApplied,
+      latencyMs: snapshotForSerialization.latencyMs
+    };
+  }
+  async serializeRecallResults(snapshot, disclosure, rawContext = null) {
+    if (!snapshot) return [];
+    const namespace = snapshot.namespace ? this.deps.resolveNamespace(snapshot.namespace) : this.deps.orchestrator.config.defaultNamespace;
+    const storage = await this.deps.orchestrator.getStorage(namespace);
+    const storageDir = storage.dir;
+    const recallNamespaces = Array.from(
+      new Set(
+        [
+          namespace,
+          ...Array.isArray(snapshot.recallNamespaces) ? snapshot.recallNamespaces.map((ns) => this.deps.resolveNamespace(ns)) : [],
+          this.deps.orchestrator.config.defaultNamespace,
+          this.deps.orchestrator.config.sharedNamespace,
+          ...(this.deps.orchestrator.config.namespacePolicies ?? []).map((p) => p.name)
+        ].filter((ns) => typeof ns === "string" && ns.length > 0)
+      )
+    );
+    const results = [];
+    const seen = /* @__PURE__ */ new Set();
+    const collectionNamespaceFromPrefix = (collectionPrefix) => {
+      const baseCollection = this.deps.orchestrator.config.qmdCollection;
+      if (collectionPrefix === baseCollection) return this.deps.orchestrator.config.defaultNamespace;
+      const namespaceSuffix = collectionPrefix.startsWith(`${baseCollection}--`) ? collectionPrefix.slice(baseCollection.length + 2) : "";
+      if (!namespaceSuffix) return null;
+      const decoded = namespaceIdentityFromToken(namespaceSuffix);
+      if (decoded !== null) return decoded || this.deps.orchestrator.config.defaultNamespace;
+      if (namespaceSuffix.startsWith("ns--")) {
+        const legacyNamespace = namespaceSuffix.slice("ns--".length).trim();
+        return legacyNamespace || null;
+      }
+      return null;
+    };
+    const readResultPath = async (memoryPath) => {
+      const parts = qmdCollectionPathParts(memoryPath);
+      const coldCollection = this.deps.orchestrator.config.qmdColdCollection ?? "openclaw-engram-cold";
+      if (parts && parts.collection === coldCollection) {
+        const storages = [];
+        const seenStorageDirs = /* @__PURE__ */ new Set();
+        const addStorage = (candidateStorage) => {
+          const candidateDir = nodePath2.resolve(candidateStorage.dir);
+          if (seenStorageDirs.has(candidateDir)) return;
+          seenStorageDirs.add(candidateDir);
+          storages.push({ storage: candidateStorage, dir: candidateDir });
+        };
+        addStorage(storage);
+        for (const recallNamespace of recallNamespaces) {
+          try {
+            addStorage(await this.deps.orchestrator.getStorage(recallNamespace));
+          } catch {
+            continue;
+          }
+        }
+        for (const candidateStorage of storages) {
+          try {
+            const coldRoot = nodePath2.join(candidateStorage.dir, "cold");
+            for (const candidatePath of qmdResultPathCandidates(
+              coldRoot,
+              parts.relativePath
+            )) {
+              const memory = await candidateStorage.storage.readMemoryByPath(candidatePath);
+              if (memory) return { memory, baseDir: candidateStorage.dir };
+            }
+          } catch (err) {
+            if (err instanceof SecureStoreLockedError) throw err;
+            continue;
+          }
+        }
+        return null;
+      }
+      const collectionNamespace = parts ? collectionNamespaceFromPrefix(parts.collection) : null;
+      if (parts && collectionNamespace) {
+        try {
+          const collectionStorage = await this.deps.orchestrator.getStorage(collectionNamespace);
+          for (const candidate of qmdResultPathCandidates(
+            collectionStorage.dir,
+            parts.relativePath
+          )) {
+            const memory = await collectionStorage.readMemoryByPath(candidate);
+            if (memory) return { memory, baseDir: collectionStorage.dir };
+          }
+          return null;
+        } catch (err) {
+          if (err instanceof SecureStoreLockedError) throw err;
+          return null;
+        }
+      }
+      if (nodePath2.isAbsolute(memoryPath)) {
+        const ownerStorage = await this.deps.storageForAbsoluteRecallPath(
+          memoryPath,
+          namespace,
+          recallNamespaces
+        );
+        if (!ownerStorage) return null;
+        for (const candidate of qmdResultPathCandidates(
+          ownerStorage.dir,
+          memoryPath
+        )) {
+          const memory = await ownerStorage.storage.readMemoryByPath(candidate);
+          if (memory) return { memory, baseDir: ownerStorage.dir };
+        }
+        return null;
+      }
+      for (const candidate of qmdResultPathCandidates(storageDir, memoryPath)) {
+        const memory = await storage.readMemoryByPath(candidate);
+        if (memory) return { memory, baseDir: storageDir };
+      }
+      return null;
+    };
+    const rawExcerptsResult = rawContext?.rawExcerptsSuppressed === true ? (
+      // Implicit raw recall with NO readable LCM namespace (#1505 thread
+      // NBHWz): emit empty excerpts rather than falling back to the
+      // write/overlay `namespace` the read gate excludes.
+      []
+    ) : await this.deps.fetchRawExcerpts(
+      disclosure,
+      rawContext ? {
+        query: rawContext.query,
+        ...rawContext.sessionKey ? { sessionKey: rawContext.sessionKey } : {},
+        namespace: rawContext.rawExcerptNamespace ?? namespace,
+        ...rawContext.rawExcerptSessionIds !== void 0 ? { lcmSessionIds: rawContext.rawExcerptSessionIds } : {}
+      } : null
+    );
+    const rawExcerpts = rawExcerptsResult ?? void 0;
+    for (const memoryPath of snapshot.resultPaths ?? []) {
+      if (!memoryPath || seen.has(memoryPath)) continue;
+      const resolved = await readResultPath(memoryPath);
+      if (!resolved) continue;
+      const { memory, baseDir } = resolved;
+      seen.add(memoryPath);
+      results.push(
+        this.deps.serializeMemorySummary(
+          memory,
+          baseDir,
+          disclosure,
+          // Attach the (possibly empty) raw excerpts to the first raw
+          // result; subsequent results do not duplicate the array.
+          results.length === 0 ? rawExcerpts : void 0
+        )
+      );
+    }
+    if (results.length > 0) return results;
+    for (const memoryId of snapshot.memoryIds) {
+      const memory = await storage.getMemoryById(memoryId);
+      if (!memory || seen.has(memory.path)) continue;
+      seen.add(memory.path);
+      results.push(
+        this.deps.serializeMemorySummary(
+          memory,
+          storageDir,
+          disclosure,
+          results.length === 0 ? rawExcerpts : void 0
+        )
+      );
+    }
+    return results;
+  }
+  /**
+   * Fetch raw transcript excerpts from the LCM archive for `disclosure ===
+   * "raw"` recalls (issue #677 PR 2/4).  Returns `null` for non-raw recall
+   * depths, an empty array when LCM is disabled / not initialized / has no
+   * matches, and an array of LCM-side excerpts otherwise.  Errors are
+   * swallowed and treated as "no excerpts" so a failing LCM never breaks
+   * the recall response.
+   *
+   * Namespace handling: LCM archival prefixes non-default-namespace
+   * sessions with `${namespace}:${sessionKey}` (see `observe()` around
+   * line 2498), so the lookup must mirror that prefix or raw recalls in
+   * non-default namespaces miss their own excerpts.
+   */
+  async fetchRawExcerpts(disclosure, context) {
+    if (disclosure !== "raw") return null;
+    if (!context || !context.query) return [];
+    if (!context.sessionKey) return [];
+    const lcm = this.deps.orchestrator.lcmEngine;
+    if (!lcm || !lcm.enabled) return [];
+    try {
+      const legacyKey = context.namespace && context.namespace !== this.deps.orchestrator.config.defaultNamespace ? `${context.namespace}:${context.sessionKey}` : context.sessionKey;
+      const lcmSessionIds = context.lcmSessionIds !== void 0 ? context.lcmSessionIds : [legacyKey];
+      const limit = 5;
+      const seenRows = /* @__PURE__ */ new Set();
+      const excerpts = [];
+      const settledRows = await Promise.allSettled(
+        lcmSessionIds.map(
+          async (lcmSessionKey) => lcm.searchContextFull(context.query, limit, lcmSessionKey)
+        )
+      );
+      for (const result of settledRows) {
+        if (excerpts.length >= limit) break;
+        if (result.status !== "fulfilled") continue;
+        for (const r of result.value) {
+          const dedupeKey = `${r.session_id} ${r.turn_index}`;
+          if (seenRows.has(dedupeKey)) continue;
+          seenRows.add(dedupeKey);
+          excerpts.push({
+            turnIndex: r.turn_index,
+            role: r.role,
+            content: r.content,
+            sessionId: r.session_id
+          });
+          if (excerpts.length >= limit) break;
+        }
+      }
+      return excerpts;
+    } catch {
+      return [];
+    }
+  }
+  async executeRecall(request) {
+    const query = request.query;
+    const callerProvidedDisclosure = request.disclosure !== void 0 && request.disclosure !== null;
+    const requestedDisclosure = (() => {
+      if (!callerProvidedDisclosure) {
+        return DEFAULT_RECALL_DISCLOSURE;
+      }
+      if (!isRecallDisclosure(request.disclosure)) {
+        throw new EngramAccessInputError(
+          `disclosure must be one of: chunk, section, raw (got: ${String(request.disclosure)})`
+        );
+      }
+      return request.disclosure;
+    })();
+    if (request.codingContext !== void 0 && request.sessionKey) {
+      this.deps.setCodingContext({
+        sessionKey: request.sessionKey,
+        codingContext: request.codingContext
+      });
+    }
+    if (request.codingContext === void 0 && request.sessionKey) {
+      await this.deps.maybeAttachCodingContext(request.sessionKey, {
+        cwd: request.cwd,
+        projectTag: request.projectTag
+      });
+    }
+    const authenticatedPrincipal = request.authenticatedPrincipal?.trim();
+    const namespaceOverride = this.deps.resolveRecallNamespace(
+      request.namespace,
+      request.sessionKey,
+      authenticatedPrincipal
+    );
+    const namespace = namespaceOverride ?? this.deps.orchestrator.config.defaultNamespace;
+    const mode = this.deps.normalizeRecallMode(request.mode);
+    const maybePrincipal = this.deps.resolveRequestPrincipal(request.sessionKey, authenticatedPrincipal);
+    if (resolveNamespaceCapabilities(this.deps.orchestrator.config).namespaces && !maybePrincipal) {
+      throw new EngramAccessInputError(
+        "authentication required: namespaces are enabled and no principal was supplied"
+      );
+    }
+    const principal = maybePrincipal ?? "default";
+    const principalNamespace = defaultNamespaceForPrincipal(principal, this.deps.orchestrator.config);
+    const profileCodingContext = request.sessionKey && typeof this.deps.orchestrator.getCodingContextForSession === "function" ? this.deps.orchestrator.getCodingContextForSession(request.sessionKey) : null;
+    const profileCodingOverlay = !namespaceOverride && profileCodingContext && resolveNamespaceCapabilities(this.deps.orchestrator.config).namespaces && this.deps.orchestrator.config.codingMode?.projectScope ? resolveCodingNamespaceOverlay(
+      profileCodingContext,
+      this.deps.orchestrator.config.codingMode,
+      this.deps.orchestrator.config.defaultNamespace
+    ) : null;
+    const profilePlan = namespaceOverride ? null : resolveScopeProfilePlan({
+      config: this.deps.orchestrator.config,
+      principal,
+      codingContext: profileCodingContext,
+      codingOverlay: profileCodingOverlay
+    });
+    const modeSkipsBudget = mode === "no_recall";
+    const legacyRecallNamespaces = Array.isArray(this.deps.orchestrator.config.defaultRecallNamespaces) ? recallNamespacesForPrincipal(principal, this.deps.orchestrator.config) : [];
+    const effectiveNamespaces = namespaceOverride ? [namespaceOverride] : profilePlan ? expandScopeProfileReadNamespaces({
+      profilePlan,
+      principalSelfNamespace: profilePlan.baseNamespace,
+      config: this.deps.orchestrator.config,
+      principal,
+      codingOverlay: profileCodingOverlay,
+      legacyRecallNamespaces
+    }) : legacyRecallNamespaces;
+    const budgetPrincipalNamespace = profilePlan?.baseNamespace ?? principalNamespace;
+    let budgetDecision;
+    let recordBudgetAfterSuccess = false;
+    if (modeSkipsBudget) {
+      budgetDecision = {
+        allowed: true,
+        reason: "allowed-same-namespace",
+        count: 0,
+        limit: {
+          softLimit: this.deps.orchestrator.config.recallCrossNamespaceBudgetSoftLimit ?? 10,
+          hardLimit: this.deps.orchestrator.config.recallCrossNamespaceBudgetHardLimit ?? 30,
+          windowMs: this.deps.orchestrator.config.recallCrossNamespaceBudgetWindowMs ?? 6e4
+        }
+      };
+    } else {
+      let anyCrossNamespace = false;
+      let denied = null;
+      let crossNamespaceDecision = null;
+      for (const ns of effectiveNamespaces) {
+        const peek = this.deps.budget.peek({
+          principal,
+          principalNamespace: budgetPrincipalNamespace,
+          queryNamespace: ns
+        });
+        if (peek.reason !== "allowed-same-namespace") {
+          anyCrossNamespace = true;
+          crossNamespaceDecision ??= peek;
+        }
+        if (!peek.allowed) {
+          denied = peek;
+          break;
+        }
+      }
+      if (denied) {
+        budgetDecision = denied;
+      } else if (anyCrossNamespace) {
+        budgetDecision = crossNamespaceDecision ?? {
+          allowed: true,
+          reason: "allowed-under-soft",
+          count: 0,
+          limit: {
+            softLimit: this.deps.orchestrator.config.recallCrossNamespaceBudgetSoftLimit ?? 10,
+            hardLimit: this.deps.orchestrator.config.recallCrossNamespaceBudgetHardLimit ?? 30,
+            windowMs: this.deps.orchestrator.config.recallCrossNamespaceBudgetWindowMs ?? 6e4
+          }
+        };
+        recordBudgetAfterSuccess = true;
+      } else {
+        budgetDecision = {
+          allowed: true,
+          reason: "allowed-same-namespace",
+          count: 0,
+          limit: {
+            softLimit: this.deps.orchestrator.config.recallCrossNamespaceBudgetSoftLimit ?? 10,
+            hardLimit: this.deps.orchestrator.config.recallCrossNamespaceBudgetHardLimit ?? 30,
+            windowMs: this.deps.orchestrator.config.recallCrossNamespaceBudgetWindowMs ?? 6e4
+          }
+        };
+      }
+      if (!budgetDecision.allowed) {
+        throw new EngramAccessInputError(
+          `recall denied: cross-namespace budget exceeded (${budgetDecision.count}/${budgetDecision.limit.hardLimit} in ${budgetDecision.limit.windowMs}ms window)`
+        );
+      }
+      this.deps.budget.gc();
+    }
+    const topK = Number.isFinite(request.topK) ? Math.max(0, Math.floor(request.topK ?? 0)) : void 0;
+    let asOf;
+    if (request.asOf !== void 0 && request.asOf !== null) {
+      if (typeof request.asOf !== "string" || request.asOf.trim().length === 0) {
+        throw new EngramAccessInputError(
+          "asOf must be a non-empty ISO 8601 timestamp string"
+        );
+      }
+      const parsed = Date.parse(request.asOf);
+      if (!Number.isFinite(parsed)) {
+        throw new EngramAccessInputError(
+          `asOf must be a parseable ISO 8601 timestamp (got: "${request.asOf}")`
+        );
+      }
+      asOf = request.asOf;
+    }
+    const recallOptions = {
+      namespace: namespaceOverride,
       topK,
       mode,
       ...authenticatedPrincipal ? { principalOverride: authenticatedPrincipal } : {},
@@ -6370,25 +6682,6 @@ var AccessRecallSurface = class {
   }
 };
 
-// src/orchestration/self-deps.ts
-function selfDeps(self) {
-  const source = self;
-  return new Proxy(/* @__PURE__ */ Object.create(null), {
-    get(_target, prop) {
-      const value = source[prop];
-      return typeof value === "function" ? value.bind(self) : value;
-    },
-    set(_target, prop, value) {
-      if (!(prop in source)) return false;
-      source[prop] = value;
-      return true;
-    },
-    has(_target, prop) {
-      return prop in source;
-    }
-  });
-}
-
 // src/access-service.ts
 var EngramAccessInputError = class extends Error {
 };
@@ -6572,6 +6865,16 @@ var EngramAccessService = class {
   budgetLocks = /* @__PURE__ */ new Map();
   budget;
   auditAdapter;
+  /** AccessObserveWriteSurface (access-service decomposition). Lazy; selfDeps live wiring. */
+  _accessObserveWriteSurface;
+  get accessObserveWriteSurface() {
+    if (!this._accessObserveWriteSurface) {
+      this._accessObserveWriteSurface = new AccessObserveWriteSurface(
+        selfDeps(this)
+      );
+    }
+    return this._accessObserveWriteSurface;
+  }
   /** AccessLcmSurface (access-service decomposition). Lazy; selfDeps live wiring. */
   _accessLcmSurface;
   get accessLcmSurface() {
@@ -7309,114 +7612,20 @@ var EngramAccessService = class {
     });
   }
   async qmdHealth(searchBackend, qmdEnabled, namespace, collection) {
-    if (searchBackend !== "qmd" || !qmdEnabled) {
-      return {
-        enabled: qmdEnabled,
-        active: false,
-        degraded: false,
-        mode: searchBackend !== "qmd" ? "not-selected" : "disabled",
-        collection,
-        collectionState: "skipped",
-        installedVersion: null,
-        supportedVersion: null,
-        supported: null,
-        upgradeAvailable: null,
-        doctorAvailable: null,
-        debugStatus: searchBackend !== "qmd" ? `backend=${searchBackend}` : "backend=disabled"
-      };
-    }
-    if (resolveNamespaceCapabilities(this.orchestrator.config).namespaces === true) {
-      const namespaceHealth = await this.namespaceQmdHealth(searchBackend, qmdEnabled, namespace, collection);
-      if (namespaceHealth) return namespaceHealth;
-    }
-    const qmd = this.orchestrator.qmd;
-    if (!qmd) {
-      return {
-        enabled: true,
-        active: false,
-        degraded: true,
-        mode: "fallback",
-        collection,
-        collectionState: "unknown",
-        installedVersion: null,
-        supportedVersion: null,
-        supported: null,
-        upgradeAvailable: null,
-        doctorAvailable: null,
-        debugStatus: "backend=unavailable"
-      };
-    }
-    const diagnosticAvailable = await this.qmdProbeAvailable(searchBackend, qmdEnabled);
-    const operationalAvailable = diagnosticAvailable || qmd.isAvailable();
-    const collectionState = diagnosticAvailable ? await this.qmdCollectionState(searchBackend, qmdEnabled, collection) : "unknown";
-    const active = operationalAvailable && collectionState !== "missing";
-    const degraded = searchBackend === "qmd" && qmdEnabled && (!active || !diagnosticAvailable || collectionState === "unknown");
-    const debugStatus = qmd.debugStatus();
-    const versionStatus = "getVersionStatus" in qmd && typeof qmd.getVersionStatus === "function" ? qmd.getVersionStatus() : null;
-    const daemonMode = "isDaemonMode" in qmd && typeof qmd.isDaemonMode === "function" ? qmd.isDaemonMode() === true : false;
-    const mode = searchBackend !== "qmd" ? "not-selected" : !qmdEnabled ? "disabled" : !active ? "fallback" : daemonMode ? "daemon" : "cli";
-    return {
-      enabled: qmdEnabled,
-      active,
-      degraded,
-      mode,
-      collection,
-      collectionState,
-      installedVersion: versionStatus?.installedVersion ?? null,
-      supportedVersion: versionStatus?.supportedVersion ?? null,
-      supported: versionStatus?.supported ?? null,
-      upgradeAvailable: versionStatus?.upgradeAvailable ?? null,
-      doctorAvailable: versionStatus?.capabilities?.doctor ?? null,
-      debugStatus
-    };
+    return this.accessObserveWriteSurface.qmdHealth(
+      searchBackend,
+      qmdEnabled,
+      namespace,
+      collection
+    );
   }
   async namespaceQmdHealth(searchBackend, qmdEnabled, namespace, fallbackCollection) {
-    if (searchBackend !== "qmd" || !qmdEnabled) return null;
-    const searchHealthForNamespace = this.orchestrator.searchHealthForNamespace;
-    if (typeof searchHealthForNamespace !== "function") return null;
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), 2e3);
-    timer.unref?.();
-    try {
-      const health = await searchHealthForNamespace.call(this.orchestrator, namespace, {
-        signal: controller.signal
-      });
-      const active = health.available && health.collectionState !== "missing";
-      const degraded = !active || health.collectionState === "unknown";
-      const mode = !active ? "fallback" : health.daemonMode === true ? "daemon" : "cli";
-      return {
-        enabled: true,
-        active,
-        degraded,
-        mode,
-        collection: health.collection || fallbackCollection,
-        collectionState: health.collectionState,
-        installedVersion: health.installedVersion,
-        supportedVersion: health.supportedVersion,
-        supported: health.supported,
-        upgradeAvailable: health.upgradeAvailable,
-        doctorAvailable: health.doctorAvailable,
-        debugStatus: health.debugStatus
-      };
-    } catch (error) {
-      const detail = displayErrorDetail(error) || "unknown";
-      return {
-        enabled: true,
-        active: false,
-        degraded: true,
-        mode: "fallback",
-        collection: fallbackCollection,
-        collectionState: "unknown",
-        installedVersion: null,
-        supportedVersion: null,
-        supported: null,
-        upgradeAvailable: null,
-        doctorAvailable: null,
-        debugStatus: `backend=namespace-unavailable error=${detail}`
-      };
-    } finally {
-      clearTimeout(timer);
-    }
+    return this.accessObserveWriteSurface.namespaceQmdHealth(
+      searchBackend,
+      qmdEnabled,
+      namespace,
+      fallbackCollection
+    );
   }
   async qmdCollectionState(searchBackend, qmdEnabled, collection) {
     if (searchBackend !== "qmd" || !qmdEnabled) return "skipped";
@@ -7471,70 +7680,14 @@ var EngramAccessService = class {
     if (memories.length === 0) {
       return this.orchestrator.generateDaySummaryAuto(namespace, {
         timeZone: request.timeZone
-      });
-    }
-    return this.orchestrator.generateDaySummary(memories);
-  }
-  /**
-   * Build a daily context briefing. Gracefully degrades when the OpenAI key
-   * or Responses API is unavailable — never throws for LLM-related problems.
-   */
-  async briefing(request) {
-    const config = this.orchestrator.config;
-    if (!config.briefing.enabled) {
-      throw new EngramAccessInputError("briefing is disabled");
-    }
-    const namespace = this.resolveReadableNamespace(request.namespace, request.principal);
-    const storage = await this.orchestrator.getStorage(namespace);
-    const token = typeof request.since === "string" && request.since.trim().length > 0 ? request.since.trim() : config.briefing.defaultWindow;
-    const window = parseBriefingWindow(token);
-    if (!window) {
-      throw new EngramAccessInputError(`invalid briefing window: ${token}`);
-    }
-    const rawFocus = typeof request.focus === "string" ? request.focus.trim() : "";
-    let focus = null;
-    if (rawFocus.length > 0) {
-      focus = parseBriefingFocus(rawFocus);
-      if (!focus) {
-        throw new EngramAccessInputError(
-          `invalid briefing focus filter: ${request.focus}`
-        );
-      }
-    }
-    const SUPPORTED_FORMATS = ["markdown", "json"];
-    if (typeof request.format === "string" && !SUPPORTED_FORMATS.includes(request.format)) {
-      throw new EngramAccessInputError(
-        `unsupported briefing format: "${request.format}". Accepted: ${SUPPORTED_FORMATS.join(", ")}.`
-      );
+      });
     }
-    const format = request.format === "json" ? "json" : request.format === "markdown" ? "markdown" : config.briefing.defaultFormat;
-    const maxFollowups = typeof request.maxFollowups === "number" && Number.isFinite(request.maxFollowups) ? Math.max(0, Math.min(10, Math.floor(request.maxFollowups))) : config.briefing.maxFollowups;
-    const calendarSource = config.briefing.calendarSource ? new FileCalendarSource(config.briefing.calendarSource) : void 0;
-    const result = await buildBriefing({
-      storage,
-      namespace,
-      window,
-      focus,
-      calendarSource,
-      maxFollowups,
-      allowLlm: config.briefing.llmFollowups,
-      openaiApiKey: config.openaiApiKey,
-      openaiBaseUrl: config.openaiBaseUrl,
-      model: config.model,
-      // Without a direct OpenAI key, route follow-ups through the configured
-      // LLM chain (gateway model source or local LLM) — same fallback every
-      // other LLM feature uses. A configured key keeps its precedence so
-      // existing deployments are unchanged.
-      followupGenerator: config.openaiApiKey ? void 0 : this.orchestrator.briefingChainFollowupGenerator
-    });
-    return {
-      format,
-      window: result.window,
-      namespace,
-      markdown: result.markdown,
-      json: result.json,
-      followupsUnavailableReason: result.followupsUnavailableReason
-    };
+    return this.orchestrator.generateDaySummary(memories);
+  }
+  async briefing(request) {
+    return this.accessObserveWriteSurface.briefing(
+      request
+    );
   }
   /**
    * Attach a coding context to a session (issue #569). Used by the Claude
@@ -7760,63 +7913,10 @@ var EngramAccessService = class {
   // per-tenant) do not block each other.
   xrayQueue = Promise.resolve();
   async memoryStore(request, hooks) {
-    const namespace = await this.resolveCodingScopedWriteNamespace(request);
-    const schemaVersion = request.schemaVersion ?? ENGRAM_ACCESS_WRITE_SCHEMA_VERSION;
-    if (schemaVersion !== ENGRAM_ACCESS_WRITE_SCHEMA_VERSION) {
-      throw new EngramAccessInputError(`unsupported schemaVersion: ${schemaVersion}`);
-    }
-    const execute = async () => {
-      const candidate = this.validateWriteCandidate(request, namespace);
-      if (request.dryRun === true) {
-        return {
-          schemaVersion: ENGRAM_ACCESS_WRITE_SCHEMA_VERSION,
-          operation: "memory_store",
-          namespace,
-          dryRun: true,
-          accepted: true,
-          queued: false,
-          status: "validated",
-          idempotencyKey: request.idempotencyKey?.trim() || void 0
-        };
-      }
-      const result = await persistExplicitCapture(this.orchestrator, candidate, "memory_store");
-      await this.attachCodingContextAfterScopedWrite(request);
-      const blocked = result.tombstoneBlocked === true;
-      const response = {
-        schemaVersion: ENGRAM_ACCESS_WRITE_SCHEMA_VERSION,
-        operation: "memory_store",
-        namespace,
-        dryRun: false,
-        accepted: true,
-        queued: blocked,
-        status: blocked ? "queued_for_review" : result.duplicateOf ? "duplicate" : "stored",
-        memoryId: result.id,
-        duplicateOf: result.duplicateOf,
-        idempotencyKey: request.idempotencyKey?.trim() || void 0
-      };
-      log.info(
-        `access-write op=memory_store namespace=${namespace} dryRun=false status=${response.status} memoryId=${response.memoryId ?? "-"} idempotency=${response.idempotencyKey ? "yes" : "no"}`
-      );
-      return response;
-    };
-    return this.handleIdempotentWrite({
-      operation: "memory_store",
-      idempotencyKey: request.idempotencyKey,
-      requestFingerprint: {
-        schemaVersion,
-        content: request.content,
-        category: request.category,
-        confidence: request.confidence,
-        namespace,
-        tags: request.tags,
-        entityRef: request.entityRef,
-        ttl: request.ttl,
-        sourceReason: request.sourceReason
-      },
-      skip: request.dryRun === true,
-      beforeExecute: hooks?.enforceWriteQuota,
-      execute
-    });
+    return this.accessObserveWriteSurface.memoryStore(
+      request,
+      hooks
+    );
   }
   async peekMemoryStoreIdempotency(request) {
     const namespace = await this.resolveCodingScopedWriteNamespace(request);
@@ -7842,67 +7942,10 @@ var EngramAccessService = class {
     });
   }
   async suggestionSubmit(request, hooks) {
-    const namespace = await this.resolveCodingScopedWriteNamespace(request);
-    const schemaVersion = request.schemaVersion ?? ENGRAM_ACCESS_WRITE_SCHEMA_VERSION;
-    if (schemaVersion !== ENGRAM_ACCESS_WRITE_SCHEMA_VERSION) {
-      throw new EngramAccessInputError(`unsupported schemaVersion: ${schemaVersion}`);
-    }
-    const execute = async () => {
-      const candidate = this.validateWriteCandidate(request, namespace);
-      if (request.dryRun === true) {
-        return {
-          schemaVersion: ENGRAM_ACCESS_WRITE_SCHEMA_VERSION,
-          operation: "suggestion_submit",
-          namespace,
-          dryRun: true,
-          accepted: true,
-          queued: true,
-          status: "validated",
-          idempotencyKey: request.idempotencyKey?.trim() || void 0
-        };
-      }
-      const result = await queueExplicitCaptureForReview(
-        this.orchestrator,
-        candidate,
-        "suggestion_submit",
-        new Error(request.sourceReason?.trim() || "submitted via engram suggestion_submit")
-      );
-      await this.attachCodingContextAfterScopedWrite(request);
-      const response = {
-        schemaVersion: ENGRAM_ACCESS_WRITE_SCHEMA_VERSION,
-        operation: "suggestion_submit",
-        namespace,
-        dryRun: false,
-        accepted: true,
-        queued: true,
-        status: "queued_for_review",
-        memoryId: result.id,
-        duplicateOf: result.duplicateOf,
-        idempotencyKey: request.idempotencyKey?.trim() || void 0
-      };
-      log.info(
-        `access-write op=suggestion_submit namespace=${namespace} dryRun=false status=${response.status} memoryId=${response.memoryId ?? "-"} idempotency=${response.idempotencyKey ? "yes" : "no"}`
-      );
-      return response;
-    };
-    return this.handleIdempotentWrite({
-      operation: "suggestion_submit",
-      idempotencyKey: request.idempotencyKey,
-      requestFingerprint: {
-        schemaVersion,
-        content: request.content,
-        category: request.category,
-        confidence: request.confidence,
-        namespace,
-        tags: request.tags,
-        entityRef: request.entityRef,
-        ttl: request.ttl,
-        sourceReason: request.sourceReason
-      },
-      skip: request.dryRun === true,
-      beforeExecute: hooks?.enforceWriteQuota,
-      execute
-    });
+    return this.accessObserveWriteSurface.suggestionSubmit(
+      request,
+      hooks
+    );
   }
   async peekSuggestionSubmitIdempotency(request) {
     const namespace = await this.resolveCodingScopedWriteNamespace(request);
@@ -8716,145 +8759,34 @@ var EngramAccessService = class {
   }
   serializeMemorySummary(memory, baseDir, disclosure, rawExcerpts) {
     return shapeMemorySummary(memory, baseDir, disclosure, rawExcerpts);
-  }
-  async observe(request, hooks) {
-    const idempotencyKey = request.idempotencyKey?.trim();
-    let effectiveCodingContext;
-    if (idempotencyKey && !(typeof request.namespace === "string" && request.namespace.trim().length > 0)) {
-      effectiveCodingContext = (typeof this.orchestrator.getCodingContextForSession === "function" ? this.orchestrator.getCodingContextForSession(request.sessionKey) : null) ?? await this.resolveCodingContextFromOptions(request);
-    }
-    return this.handleIdempotentWrite({
-      operation: "observe",
-      idempotencyKey: request.idempotencyKey,
-      requestFingerprint: {
-        sessionKey: request.sessionKey,
-        messages: request.messages,
-        namespace: request.namespace,
-        skipExtraction: request.skipExtraction,
-        authenticatedPrincipal: request.authenticatedPrincipal,
-        cwd: request.cwd,
-        projectTag: request.projectTag,
-        effectiveCodingContext: effectiveCodingContext ?? null
-      },
-      beforeExecute: hooks?.enforceWriteQuota,
-      execute: () => this.runObserve(request)
-    });
-  }
-  async runObserve(request) {
-    if (!request.sessionKey || typeof request.sessionKey !== "string" || request.sessionKey.trim().length === 0) {
-      throw new EngramAccessInputError("sessionKey is required and must be a non-empty string");
-    }
-    if (!Array.isArray(request.messages) || request.messages.length === 0) {
-      throw new EngramAccessInputError("messages is required and must be a non-empty array");
-    }
-    for (const msg of request.messages) {
-      if (!msg || typeof msg !== "object" || typeof msg.role !== "string" || typeof msg.content !== "string") {
-        throw new EngramAccessInputError("each message must have a string 'role' and 'content'");
-      }
-      if (msg.role !== "user" && msg.role !== "assistant") {
-        throw new EngramAccessInputError(`invalid message role: ${msg.role} (expected 'user' or 'assistant')`);
-      }
-    }
-    const scope = await this.resolveMemoryScopePlan(request);
-    const writeNamespace = scope.writeNamespace;
-    const namespace = this.legacyResponseNamespaceForScope(scope);
-    const shouldWriteObjectiveState = resolveObjectiveStateCapabilities(this.orchestrator.config).objectiveStateMemory === true && resolveObjectiveStateCapabilities(this.orchestrator.config).objectiveStateSnapshotWrites === true;
-    await this.maybeAttachCodingContext(request.sessionKey, {
-      cwd: request.cwd,
-      projectTag: request.projectTag
-    });
-    const lcmSessionKey = lcmSessionKeyForNamespace(
-      writeNamespace,
-      request.sessionKey,
-      this.orchestrator.config.defaultNamespace
-    ) ?? request.sessionKey;
-    if (shouldWriteObjectiveState) {
-      try {
-        const objectiveStateLocation = await this.objectiveStateStoreLocationForNamespace(
-          scope.objectiveStateNamespace
-        );
-        await recordObjectiveStateSnapshotsFromObservedMessages({
-          memoryDir: objectiveStateLocation.memoryDir,
-          objectiveStateStoreDir: objectiveStateLocation.objectiveStateStoreDir,
-          objectiveStateMemoryEnabled: resolveObjectiveStateCapabilities(this.orchestrator.config).objectiveStateMemory,
-          objectiveStateSnapshotWritesEnabled: resolveObjectiveStateCapabilities(this.orchestrator.config).objectiveStateSnapshotWrites,
-          sessionKey: request.sessionKey,
-          recordedAt: (/* @__PURE__ */ new Date()).toISOString(),
-          messages: request.messages
-        });
-      } catch (err) {
-        log.error(`access-observe objective-state snapshot write failed: ${err}`);
-      }
-    }
-    let lcmArchived = false;
-    if (this.orchestrator.lcmEngine && this.orchestrator.lcmEngine.enabled) {
-      try {
-        this.orchestrator.lcmEngine.enqueueObserveMessages(lcmSessionKey, request.messages);
-        lcmArchived = true;
-      } catch (err) {
-        log.error(`access-observe LCM enqueue failed: ${err}`);
-      }
-    }
-    let extractionQueued = false;
-    if (request.skipExtraction !== true) {
-      const turns = request.messages.map((m) => ({
-        source: "openclaw",
-        // Identity-vs-routing separation (#1505 thread 1, cursor): extraction
-        // derives the provenance principal via `resolvePrincipal(turn.sessionKey)`
-        // and threads `turn.sessionKey` into conversation threading. Feeding the
-        // namespace-PREFIXED `lcmSessionKey` here mis-derived the principal to
-        // `default` (a `<ns>:<key>` string matches no prefix/map rule and fails
-        // the `agent:` heuristic). Pass the ORIGINAL sessionKey so identity is
-        // correct; storage routing is pinned separately via
-        // writeNamespaceOverride below, and the authenticated principal is pinned
-        // via principalOverride.
-        sessionKey: request.sessionKey,
-        role: m.role,
-        content: m.content,
-        parts: m.parts,
-        rawContent: m.rawContent,
-        sourceFormat: m.sourceFormat,
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      }));
-      const writeNamespaceOverride = resolveNamespaceCapabilities(this.orchestrator.config).namespaces === true ? writeNamespace : void 0;
-      const principalOverride = typeof scope.principal === "string" && scope.principal.length > 0 ? scope.principal : void 0;
-      try {
-        const extractionPromise = this.orchestrator.ingestReplayBatch(turns, {
-          archiveLcm: false,
-          writeNamespaceOverride,
-          principalOverride
-        });
-        extractionPromise.catch((err) => {
-          log.error(`access-observe background extraction failed: ${err}`);
-        });
-        extractionQueued = true;
-      } catch (err) {
-        log.error(`access-observe extraction enqueue failed: ${err}`);
-      }
+  }
+  async observe(request, hooks) {
+    const idempotencyKey = request.idempotencyKey?.trim();
+    let effectiveCodingContext;
+    if (idempotencyKey && !(typeof request.namespace === "string" && request.namespace.trim().length > 0)) {
+      effectiveCodingContext = (typeof this.orchestrator.getCodingContextForSession === "function" ? this.orchestrator.getCodingContextForSession(request.sessionKey) : null) ?? await this.resolveCodingContextFromOptions(request);
     }
-    log.info(
-      `access-observe namespace=${namespace} effectiveNamespace=${writeNamespace} sessionKey=${request.sessionKey} messages=${request.messages.length} lcm=${lcmArchived} extraction=${extractionQueued}`
-    );
-    return {
-      accepted: request.messages.length,
-      sessionKey: request.sessionKey,
-      namespace,
-      effectiveNamespace: writeNamespace,
-      scopeDebug: {
-        principal: scope.principal,
-        explicitNamespace: scope.explicitNamespace,
-        baseNamespace: scope.baseNamespace,
-        writeNamespace: scope.writeNamespace,
-        codingOverlayApplied: scope.codingOverlayApplied,
-        readNamespaces: scope.readNamespaces,
-        scopeProfile: scope.scopeProfile,
-        writeLayer: scope.writeLayer,
-        layers: scope.layers,
-        promotionTargets: scope.promotionTargets
+    return this.handleIdempotentWrite({
+      operation: "observe",
+      idempotencyKey: request.idempotencyKey,
+      requestFingerprint: {
+        sessionKey: request.sessionKey,
+        messages: request.messages,
+        namespace: request.namespace,
+        skipExtraction: request.skipExtraction,
+        authenticatedPrincipal: request.authenticatedPrincipal,
+        cwd: request.cwd,
+        projectTag: request.projectTag,
+        effectiveCodingContext: effectiveCodingContext ?? null
       },
-      lcmArchived,
-      extractionQueued
-    };
+      beforeExecute: hooks?.enforceWriteQuota,
+      execute: () => this.runObserve(request)
+    });
+  }
+  async runObserve(request) {
+    return this.accessObserveWriteSurface.runObserve(
+      request
+    );
   }
   async lcmSearch(request) {
     return this.accessLcmSurface.lcmSearch(
@@ -9251,137 +9183,19 @@ var EngramAccessService = class {
   }
   // ── Work Layer ──────────────────────────────────────────────────────────
   async workTask(request) {
-    const STATUSES = /* @__PURE__ */ new Set(["todo", "in_progress", "blocked", "done", "cancelled"]);
-    const PRIORITIES = /* @__PURE__ */ new Set(["low", "medium", "high"]);
-    const asStatus = (v) => v && STATUSES.has(v) ? v : void 0;
-    const asPriority = (v) => v && PRIORITIES.has(v) ? v : void 0;
-    const storage = new WorkStorage(this.orchestrator.config.memoryDir);
-    await storage.ensureDirectories();
-    const action = request.action;
-    if (action === "create") {
-      if (!request.title?.trim()) throw new EngramAccessInputError("title is required for create");
-      const task = await storage.createTask({
-        title: request.title,
-        description: request.description,
-        status: asStatus(request.status),
-        priority: asPriority(request.priority),
-        owner: request.owner?.trim() || void 0,
-        assignee: request.assignee?.trim() || void 0,
-        projectId: request.projectId?.trim() || void 0,
-        tags: request.tags,
-        dueAt: request.dueAt?.trim() || void 0
-      });
-      return { action, task };
-    }
-    if (action === "get") {
-      if (!request.id?.trim()) throw new EngramAccessInputError("id is required for get");
-      return { action, task: await storage.getTask(request.id) };
-    }
-    if (action === "list") {
-      const tasks = await storage.listTasks({
-        status: asStatus(request.status),
-        owner: request.owner?.trim() || void 0,
-        assignee: request.assignee?.trim() || void 0,
-        projectId: request.projectId?.trim() || void 0
-      });
-      return { action, count: tasks.length, tasks };
-    }
-    if (action === "update") {
-      if (!request.id?.trim()) throw new EngramAccessInputError("id is required for update");
-      const patch = {};
-      if (request.title !== void 0) patch.title = request.title;
-      if (request.description !== void 0) patch.description = request.description;
-      const st = asStatus(request.status);
-      if (st) patch.status = st;
-      const pr = asPriority(request.priority);
-      if (pr) patch.priority = pr;
-      if (request.owner !== void 0) patch.owner = request.owner || null;
-      if (request.assignee !== void 0) patch.assignee = request.assignee || null;
-      if (request.projectId !== void 0) patch.projectId = request.projectId || null;
-      if (request.tags) patch.tags = request.tags;
-      if (request.dueAt !== void 0) patch.dueAt = request.dueAt || null;
-      return { action, task: await storage.updateTask(request.id, patch) };
-    }
-    if (action === "transition") {
-      if (!request.id?.trim()) throw new EngramAccessInputError("id is required for transition");
-      const st = asStatus(request.status);
-      if (!st) throw new EngramAccessInputError("valid status is required for transition");
-      return { action, task: await storage.transitionTask(request.id, st) };
-    }
-    if (action === "delete") {
-      if (!request.id?.trim()) throw new EngramAccessInputError("id is required for delete");
-      return { action, deleted: await storage.deleteTask(request.id) };
-    }
-    throw new EngramAccessInputError(`Unsupported work_task action: ${action}`);
+    return this.accessObserveWriteSurface.workTask(
+      request
+    );
   }
   async workProject(request) {
-    const STATUSES = /* @__PURE__ */ new Set(["active", "on_hold", "completed", "archived"]);
-    const asStatus = (v) => v && STATUSES.has(v) ? v : void 0;
-    const storage = new WorkStorage(this.orchestrator.config.memoryDir);
-    await storage.ensureDirectories();
-    const action = request.action;
-    if (action === "create") {
-      if (!request.name?.trim()) throw new EngramAccessInputError("name is required for create");
-      const project = await storage.createProject({
-        name: request.name,
-        description: request.description,
-        status: asStatus(request.status),
-        owner: request.owner?.trim() || void 0,
-        tags: request.tags
-      });
-      return { action, project };
-    }
-    if (action === "get") {
-      if (!request.id?.trim()) throw new EngramAccessInputError("id is required for get");
-      return { action, project: await storage.getProject(request.id) };
-    }
-    if (action === "list") {
-      const projects = await storage.listProjects();
-      return { action, count: projects.length, projects };
-    }
-    if (action === "update") {
-      if (!request.id?.trim()) throw new EngramAccessInputError("id is required for update");
-      const patch = {};
-      if (request.name !== void 0) patch.name = request.name;
-      if (request.description !== void 0) patch.description = request.description;
-      const st = asStatus(request.status);
-      if (st) patch.status = st;
-      if (request.owner !== void 0) patch.owner = request.owner || null;
-      if (request.tags) patch.tags = request.tags;
-      return { action, project: await storage.updateProject(request.id, patch) };
-    }
-    if (action === "delete") {
-      if (!request.id?.trim()) throw new EngramAccessInputError("id is required for delete");
-      return { action, deleted: await storage.deleteProject(request.id) };
-    }
-    if (action === "link_task") {
-      if (!request.taskId?.trim() || !request.projectId?.trim()) {
-        throw new EngramAccessInputError("taskId and projectId are required for link_task");
-      }
-      return { action, linked: await storage.linkTaskToProject(request.taskId, request.projectId) };
-    }
-    throw new EngramAccessInputError(`Unsupported work_project action: ${action}`);
+    return this.accessObserveWriteSurface.workProject(
+      request
+    );
   }
   async workBoard(request) {
-    const memoryDir = this.orchestrator.config.memoryDir;
-    await new WorkStorage(memoryDir).ensureDirectories();
-    const action = request.action;
-    const projectId = request.projectId?.trim() || void 0;
-    if (action === "export_markdown") {
-      const markdown = await exportWorkBoardMarkdown({ memoryDir, projectId });
-      return { action, markdown: wrapWorkLayerContext(markdown, { linkToMemory: request.linkToMemory === true }) };
-    }
-    if (action === "export_snapshot") {
-      const snapshot = await exportWorkBoardSnapshot({ memoryDir, projectId });
-      return { action, snapshot };
-    }
-    if (action === "import_snapshot") {
-      if (!request.snapshotJson?.trim()) throw new EngramAccessInputError("snapshotJson is required for import_snapshot");
-      const snapshot = JSON.parse(request.snapshotJson);
-      const result = await importWorkBoardSnapshot({ memoryDir, snapshot, projectId });
-      return { action, result };
-    }
-    throw new EngramAccessInputError(`Unsupported work_board action: ${action}`);
+    return this.accessObserveWriteSurface.workBoard(
+      request
+    );
   }
   // ── Shared Context / Compounding ────────────────────────────────────────
   async sharedContextWriteOutput(request) {
@@ -9665,90 +9479,35 @@ ${next}`);
    */
   async memoryOutcome(request) {
     if (request.memoryId.includes("/") || request.memoryId.includes("\\")) {
-      throw new EngramAccessInputError(
-        "memoryId must not contain path separators"
-      );
-    }
-    const resolvedNs = this.writableNamespaceFor(
-      request.namespace,
-      request.sessionKey,
-      request.principal
-    );
-    const storage = await this.orchestrator.getStorage(resolvedNs);
-    return recordMemoryOutcome(storage, {
-      memoryPath: `${request.memoryId}.md`,
-      outcome: request.outcome,
-      timestamp: request.timestamp
-    });
-  }
-  async memoryPromote(request) {
-    const resolvedNs = this.writableNamespaceFor(request.namespace, request.sessionKey, request.principal);
-    const storage = await this.orchestrator.getStorage(resolvedNs);
-    await storage.updateMemoryFrontmatter(request.memoryId, {
-      lifecycleState: "active",
-      updated: (/* @__PURE__ */ new Date()).toISOString()
-    });
-    return { promoted: true, memoryId: request.memoryId };
-  }
-  async memoryActionApply(request) {
-    const actionTypes = /* @__PURE__ */ new Set([
-      "store_episode",
-      "store_note",
-      "update_note",
-      "create_artifact",
-      "summarize_node",
-      "discard",
-      "link_graph"
-    ]);
-    if (!actionTypes.has(request.action)) {
-      throw new EngramAccessInputError(
-        `memory_action_apply: invalid action ${JSON.stringify(request.action)}`
-      );
-    }
-    if (resolveCompressionCapabilities(this.orchestrator.config).contextCompressionActions !== true) {
-      throw new EngramAccessInputError(
-        "memory_action_apply is disabled; enable contextCompressionActionsEnabled to use this tool"
-      );
-    }
-    const outcome = request.outcome ?? "skipped";
-    if (outcome !== "applied" && outcome !== "skipped" && outcome !== "failed") {
-      throw new EngramAccessInputError(
-        `memory_action_apply: outcome must be "applied", "skipped", or "failed"; got ${JSON.stringify(outcome)}`
-      );
-    }
-    const resolvedNs = this.writableNamespaceFor(
-      request.namespace,
-      request.sessionKey,
-      request.principal
-    );
-    const inputSummaryParts = [
-      request.content,
-      request.category ? `category=${request.category}` : void 0,
-      request.linkTargetId ? `linkTargetId=${request.linkTargetId}` : void 0,
-      request.linkType ? `linkType=${request.linkType}` : void 0,
-      typeof request.linkStrength === "number" ? `linkStrength=${request.linkStrength}` : void 0,
-      request.artifactType ? `artifactType=${request.artifactType}` : void 0,
-      typeof request.execute === "boolean" ? `execute=${request.execute}` : void 0
-    ].filter((part) => typeof part === "string" && part.length > 0);
-    const event = {
-      action: request.action,
-      outcome,
-      namespace: resolvedNs,
-      actor: "access.memory_action_apply",
-      subsystem: "access.memory_action_apply",
-      reason: request.reason,
-      memoryId: request.memoryId,
-      sourceSessionKey: request.sessionKey,
-      inputSummary: inputSummaryParts.length > 0 ? inputSummaryParts.join(" | ").slice(0, 500) : void 0,
-      dryRun: request.dryRun === true,
-      promptHash: typeof request.sourcePrompt === "string" && request.sourcePrompt.length > 0 ? createHash5("sha256").update(request.sourcePrompt).digest("hex") : void 0
-    };
-    const preview = this.orchestrator.previewMemoryActionEvent(event);
-    if (request.dryRun === true) {
-      return { recorded: false, dryRun: true, event: preview };
+      throw new EngramAccessInputError(
+        "memoryId must not contain path separators"
+      );
     }
-    const recorded = await this.orchestrator.appendMemoryActionEvent(event);
-    return { recorded, event: preview };
+    const resolvedNs = this.writableNamespaceFor(
+      request.namespace,
+      request.sessionKey,
+      request.principal
+    );
+    const storage = await this.orchestrator.getStorage(resolvedNs);
+    return recordMemoryOutcome(storage, {
+      memoryPath: `${request.memoryId}.md`,
+      outcome: request.outcome,
+      timestamp: request.timestamp
+    });
+  }
+  async memoryPromote(request) {
+    const resolvedNs = this.writableNamespaceFor(request.namespace, request.sessionKey, request.principal);
+    const storage = await this.orchestrator.getStorage(resolvedNs);
+    await storage.updateMemoryFrontmatter(request.memoryId, {
+      lifecycleState: "active",
+      updated: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    return { promoted: true, memoryId: request.memoryId };
+  }
+  async memoryActionApply(request) {
+    return this.accessObserveWriteSurface.memoryActionApply(
+      request
+    );
   }
   async contextCheckpoint(request) {
     const resolvedNs = this.writableNamespaceFor(request.namespace, request.sessionKey, request.principal);
@@ -10365,397 +10124,699 @@ ${next}`);
       limit: request.limit
     });
   }
-  async wearablesTranscriptMemories(request) {
-    return this.orchestrator.getWearablesService().transcriptMemories({
-      source: request.source,
-      date: request.date,
-      limit: request.limit
+  async wearablesTranscriptMemories(request) {
+    return this.orchestrator.getWearablesService().transcriptMemories({
+      source: request.source,
+      date: request.date,
+      limit: request.limit
+    });
+  }
+  // ── Admin console surfaces (issue #1502) ────────────────────────────────
+  //
+  // Thin delegators. Every method threads `this.orchestrator` references
+  // into the pure `admin/admin-surfaces.ts` functions so the dashboard
+  // never re-resolves scope, re-derives promotion targets, or re-lists
+  // namespaces.
+  /**
+   * Resolve an effective scope inspection for the console. Inputs are
+   * redacted before return so an operator-supplied principal preview /
+   * namespace override never echoes a pasted credential back.
+   */
+  async adminInspectScope(options) {
+    const config = this.orchestrator.config;
+    const codingContext = options.sessionKey ? this.orchestrator.getCodingContextForSession(options.sessionKey) ?? null : null;
+    const inspection = inspectScope({
+      config,
+      sessionKey: options.sessionKey,
+      namespace: options.namespace,
+      principalOverride: options.principalOverride,
+      codingContext,
+      operation: options.operation
+    });
+    return redactSensitive(inspection);
+  }
+  /**
+   * List configured + discovered namespaces from the catalog with the
+   * admin filters the console exposes.
+   */
+  async adminListNamespaces(filter) {
+    const result = await listAdminNamespaces({
+      catalog: this.orchestrator.namespaceCatalog,
+      filter
+    });
+    return redactSensitive(result);
+  }
+  /**
+   * Per-namespace maintenance + QMD health. QMD diagnostics are probed via
+   * the orchestrator's search health accessor (one probe per namespace).
+   */
+  async adminMaintenanceHealth() {
+    const report = await gatherMaintenanceHealth({
+      catalog: this.orchestrator.namespaceCatalog,
+      qmdHealthProvider: async (namespace) => {
+        try {
+          const health = await this.orchestrator.searchHealthForNamespace(namespace);
+          return {
+            namespace,
+            collection: health.collection,
+            available: health.available,
+            collectionState: health.collectionState,
+            debugStatus: health.debugStatus,
+            installedVersion: health.installedVersion,
+            supportedVersion: health.supportedVersion,
+            supported: health.supported,
+            upgradeAvailable: health.upgradeAvailable,
+            daemonMode: health.daemonMode
+          };
+        } catch (err) {
+          throw err;
+        }
+      }
+    });
+    return redactSensitive(report);
+  }
+  /**
+   * Dry-run transcript/session audit. Detects mixed `other/default` data
+   * and legacy stranded directories. Never applies a migration.
+   */
+  async adminTranscriptAudit() {
+    const result = await auditTranscripts(this.orchestrator.config.memoryDir);
+    return redactSensitive(result);
+  }
+  async adminPromoteMemory(request) {
+    return this.accessAdminOpsSurface.adminPromoteMemory(
+      request
+    );
+  }
+};
+
+// src/access-observe-write-surface.ts
+var AccessObserveWriteSurface = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  deps;
+  async qmdHealth(searchBackend, qmdEnabled, namespace, collection) {
+    if (searchBackend !== "qmd" || !qmdEnabled) {
+      return {
+        enabled: qmdEnabled,
+        active: false,
+        degraded: false,
+        mode: searchBackend !== "qmd" ? "not-selected" : "disabled",
+        collection,
+        collectionState: "skipped",
+        installedVersion: null,
+        supportedVersion: null,
+        supported: null,
+        upgradeAvailable: null,
+        doctorAvailable: null,
+        debugStatus: searchBackend !== "qmd" ? `backend=${searchBackend}` : "backend=disabled"
+      };
+    }
+    if (resolveNamespaceCapabilities(this.deps.orchestrator.config).namespaces === true) {
+      const namespaceHealth = await this.deps.namespaceQmdHealth(searchBackend, qmdEnabled, namespace, collection);
+      if (namespaceHealth) return namespaceHealth;
+    }
+    const qmd = this.deps.orchestrator.qmd;
+    if (!qmd) {
+      return {
+        enabled: true,
+        active: false,
+        degraded: true,
+        mode: "fallback",
+        collection,
+        collectionState: "unknown",
+        installedVersion: null,
+        supportedVersion: null,
+        supported: null,
+        upgradeAvailable: null,
+        doctorAvailable: null,
+        debugStatus: "backend=unavailable"
+      };
+    }
+    const diagnosticAvailable = await this.deps.qmdProbeAvailable(searchBackend, qmdEnabled);
+    const operationalAvailable = diagnosticAvailable || qmd.isAvailable();
+    const collectionState = diagnosticAvailable ? await this.deps.qmdCollectionState(searchBackend, qmdEnabled, collection) : "unknown";
+    const active = operationalAvailable && collectionState !== "missing";
+    const degraded = searchBackend === "qmd" && qmdEnabled && (!active || !diagnosticAvailable || collectionState === "unknown");
+    const debugStatus = qmd.debugStatus();
+    const versionStatus = "getVersionStatus" in qmd && typeof qmd.getVersionStatus === "function" ? qmd.getVersionStatus() : null;
+    const daemonMode = "isDaemonMode" in qmd && typeof qmd.isDaemonMode === "function" ? qmd.isDaemonMode() === true : false;
+    const mode = searchBackend !== "qmd" ? "not-selected" : !qmdEnabled ? "disabled" : !active ? "fallback" : daemonMode ? "daemon" : "cli";
+    return {
+      enabled: qmdEnabled,
+      active,
+      degraded,
+      mode,
+      collection,
+      collectionState,
+      installedVersion: versionStatus?.installedVersion ?? null,
+      supportedVersion: versionStatus?.supportedVersion ?? null,
+      supported: versionStatus?.supported ?? null,
+      upgradeAvailable: versionStatus?.upgradeAvailable ?? null,
+      doctorAvailable: versionStatus?.capabilities?.doctor ?? null,
+      debugStatus
+    };
+  }
+  async namespaceQmdHealth(searchBackend, qmdEnabled, namespace, fallbackCollection) {
+    if (searchBackend !== "qmd" || !qmdEnabled) return null;
+    const searchHealthForNamespace = this.deps.orchestrator.searchHealthForNamespace;
+    if (typeof searchHealthForNamespace !== "function") return null;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 2e3);
+    timer.unref?.();
+    try {
+      const health = await searchHealthForNamespace.call(this.deps.orchestrator, namespace, {
+        signal: controller.signal
+      });
+      const active = health.available && health.collectionState !== "missing";
+      const degraded = !active || health.collectionState === "unknown";
+      const mode = !active ? "fallback" : health.daemonMode === true ? "daemon" : "cli";
+      return {
+        enabled: true,
+        active,
+        degraded,
+        mode,
+        collection: health.collection || fallbackCollection,
+        collectionState: health.collectionState,
+        installedVersion: health.installedVersion,
+        supportedVersion: health.supportedVersion,
+        supported: health.supported,
+        upgradeAvailable: health.upgradeAvailable,
+        doctorAvailable: health.doctorAvailable,
+        debugStatus: health.debugStatus
+      };
+    } catch (error) {
+      const detail = displayErrorDetail(error) || "unknown";
+      return {
+        enabled: true,
+        active: false,
+        degraded: true,
+        mode: "fallback",
+        collection: fallbackCollection,
+        collectionState: "unknown",
+        installedVersion: null,
+        supportedVersion: null,
+        supported: null,
+        upgradeAvailable: null,
+        doctorAvailable: null,
+        debugStatus: `backend=namespace-unavailable error=${detail}`
+      };
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  /**
+   * Build a daily context briefing. Gracefully degrades when the OpenAI key
+   * or Responses API is unavailable — never throws for LLM-related problems.
+   */
+  async briefing(request) {
+    const config = this.deps.orchestrator.config;
+    if (!config.briefing.enabled) {
+      throw new EngramAccessInputError("briefing is disabled");
+    }
+    const namespace = this.deps.resolveReadableNamespace(request.namespace, request.principal);
+    const storage = await this.deps.orchestrator.getStorage(namespace);
+    const token = typeof request.since === "string" && request.since.trim().length > 0 ? request.since.trim() : config.briefing.defaultWindow;
+    const window = parseBriefingWindow(token);
+    if (!window) {
+      throw new EngramAccessInputError(`invalid briefing window: ${token}`);
+    }
+    const rawFocus = typeof request.focus === "string" ? request.focus.trim() : "";
+    let focus = null;
+    if (rawFocus.length > 0) {
+      focus = parseBriefingFocus(rawFocus);
+      if (!focus) {
+        throw new EngramAccessInputError(
+          `invalid briefing focus filter: ${request.focus}`
+        );
+      }
+    }
+    const SUPPORTED_FORMATS = ["markdown", "json"];
+    if (typeof request.format === "string" && !SUPPORTED_FORMATS.includes(request.format)) {
+      throw new EngramAccessInputError(
+        `unsupported briefing format: "${request.format}". Accepted: ${SUPPORTED_FORMATS.join(", ")}.`
+      );
+    }
+    const format = request.format === "json" ? "json" : request.format === "markdown" ? "markdown" : config.briefing.defaultFormat;
+    const maxFollowups = typeof request.maxFollowups === "number" && Number.isFinite(request.maxFollowups) ? Math.max(0, Math.min(10, Math.floor(request.maxFollowups))) : config.briefing.maxFollowups;
+    const calendarSource = config.briefing.calendarSource ? new FileCalendarSource(config.briefing.calendarSource) : void 0;
+    const result = await buildBriefing({
+      storage,
+      namespace,
+      window,
+      focus,
+      calendarSource,
+      maxFollowups,
+      allowLlm: config.briefing.llmFollowups,
+      openaiApiKey: config.openaiApiKey,
+      openaiBaseUrl: config.openaiBaseUrl,
+      model: config.model,
+      // Without a direct OpenAI key, route follow-ups through the configured
+      // LLM chain (gateway model source or local LLM) — same fallback every
+      // other LLM feature uses. A configured key keeps its precedence so
+      // existing deployments are unchanged.
+      followupGenerator: config.openaiApiKey ? void 0 : this.deps.orchestrator.briefingChainFollowupGenerator
+    });
+    return {
+      format,
+      window: result.window,
+      namespace,
+      markdown: result.markdown,
+      json: result.json,
+      followupsUnavailableReason: result.followupsUnavailableReason
+    };
+  }
+  async memoryStore(request, hooks) {
+    const namespace = await this.deps.resolveCodingScopedWriteNamespace(request);
+    const schemaVersion = request.schemaVersion ?? ENGRAM_ACCESS_WRITE_SCHEMA_VERSION;
+    if (schemaVersion !== ENGRAM_ACCESS_WRITE_SCHEMA_VERSION) {
+      throw new EngramAccessInputError(`unsupported schemaVersion: ${schemaVersion}`);
+    }
+    const execute = async () => {
+      const candidate = this.deps.validateWriteCandidate(request, namespace);
+      if (request.dryRun === true) {
+        return {
+          schemaVersion: ENGRAM_ACCESS_WRITE_SCHEMA_VERSION,
+          operation: "memory_store",
+          namespace,
+          dryRun: true,
+          accepted: true,
+          queued: false,
+          status: "validated",
+          idempotencyKey: request.idempotencyKey?.trim() || void 0
+        };
+      }
+      const result = await persistExplicitCapture(this.deps.orchestrator, candidate, "memory_store");
+      await this.deps.attachCodingContextAfterScopedWrite(request);
+      const blocked = result.tombstoneBlocked === true;
+      const response = {
+        schemaVersion: ENGRAM_ACCESS_WRITE_SCHEMA_VERSION,
+        operation: "memory_store",
+        namespace,
+        dryRun: false,
+        accepted: true,
+        queued: blocked,
+        status: blocked ? "queued_for_review" : result.duplicateOf ? "duplicate" : "stored",
+        memoryId: result.id,
+        duplicateOf: result.duplicateOf,
+        idempotencyKey: request.idempotencyKey?.trim() || void 0
+      };
+      log.info(
+        `access-write op=memory_store namespace=${namespace} dryRun=false status=${response.status} memoryId=${response.memoryId ?? "-"} idempotency=${response.idempotencyKey ? "yes" : "no"}`
+      );
+      return response;
+    };
+    return this.deps.handleIdempotentWrite({
+      operation: "memory_store",
+      idempotencyKey: request.idempotencyKey,
+      requestFingerprint: {
+        schemaVersion,
+        content: request.content,
+        category: request.category,
+        confidence: request.confidence,
+        namespace,
+        tags: request.tags,
+        entityRef: request.entityRef,
+        ttl: request.ttl,
+        sourceReason: request.sourceReason
+      },
+      skip: request.dryRun === true,
+      beforeExecute: hooks?.enforceWriteQuota,
+      execute
     });
   }
-  // ── Admin console surfaces (issue #1502) ────────────────────────────────
-  //
-  // Thin delegators. Every method threads `this.orchestrator` references
-  // into the pure `admin/admin-surfaces.ts` functions so the dashboard
-  // never re-resolves scope, re-derives promotion targets, or re-lists
-  // namespaces.
-  /**
-   * Resolve an effective scope inspection for the console. Inputs are
-   * redacted before return so an operator-supplied principal preview /
-   * namespace override never echoes a pasted credential back.
-   */
-  async adminInspectScope(options) {
-    const config = this.orchestrator.config;
-    const codingContext = options.sessionKey ? this.orchestrator.getCodingContextForSession(options.sessionKey) ?? null : null;
-    const inspection = inspectScope({
-      config,
-      sessionKey: options.sessionKey,
-      namespace: options.namespace,
-      principalOverride: options.principalOverride,
-      codingContext,
-      operation: options.operation
+  async suggestionSubmit(request, hooks) {
+    const namespace = await this.deps.resolveCodingScopedWriteNamespace(request);
+    const schemaVersion = request.schemaVersion ?? ENGRAM_ACCESS_WRITE_SCHEMA_VERSION;
+    if (schemaVersion !== ENGRAM_ACCESS_WRITE_SCHEMA_VERSION) {
+      throw new EngramAccessInputError(`unsupported schemaVersion: ${schemaVersion}`);
+    }
+    const execute = async () => {
+      const candidate = this.deps.validateWriteCandidate(request, namespace);
+      if (request.dryRun === true) {
+        return {
+          schemaVersion: ENGRAM_ACCESS_WRITE_SCHEMA_VERSION,
+          operation: "suggestion_submit",
+          namespace,
+          dryRun: true,
+          accepted: true,
+          queued: true,
+          status: "validated",
+          idempotencyKey: request.idempotencyKey?.trim() || void 0
+        };
+      }
+      const result = await queueExplicitCaptureForReview(
+        this.deps.orchestrator,
+        candidate,
+        "suggestion_submit",
+        new Error(request.sourceReason?.trim() || "submitted via engram suggestion_submit")
+      );
+      await this.deps.attachCodingContextAfterScopedWrite(request);
+      const response = {
+        schemaVersion: ENGRAM_ACCESS_WRITE_SCHEMA_VERSION,
+        operation: "suggestion_submit",
+        namespace,
+        dryRun: false,
+        accepted: true,
+        queued: true,
+        status: "queued_for_review",
+        memoryId: result.id,
+        duplicateOf: result.duplicateOf,
+        idempotencyKey: request.idempotencyKey?.trim() || void 0
+      };
+      log.info(
+        `access-write op=suggestion_submit namespace=${namespace} dryRun=false status=${response.status} memoryId=${response.memoryId ?? "-"} idempotency=${response.idempotencyKey ? "yes" : "no"}`
+      );
+      return response;
+    };
+    return this.deps.handleIdempotentWrite({
+      operation: "suggestion_submit",
+      idempotencyKey: request.idempotencyKey,
+      requestFingerprint: {
+        schemaVersion,
+        content: request.content,
+        category: request.category,
+        confidence: request.confidence,
+        namespace,
+        tags: request.tags,
+        entityRef: request.entityRef,
+        ttl: request.ttl,
+        sourceReason: request.sourceReason
+      },
+      skip: request.dryRun === true,
+      beforeExecute: hooks?.enforceWriteQuota,
+      execute
     });
-    return redactSensitive(inspection);
   }
-  /**
-   * List configured + discovered namespaces from the catalog with the
-   * admin filters the console exposes.
-   */
-  async adminListNamespaces(filter) {
-    const result = await listAdminNamespaces({
-      catalog: this.orchestrator.namespaceCatalog,
-      filter
+  async runObserve(request) {
+    if (!request.sessionKey || typeof request.sessionKey !== "string" || request.sessionKey.trim().length === 0) {
+      throw new EngramAccessInputError("sessionKey is required and must be a non-empty string");
+    }
+    if (!Array.isArray(request.messages) || request.messages.length === 0) {
+      throw new EngramAccessInputError("messages is required and must be a non-empty array");
+    }
+    for (const msg of request.messages) {
+      if (!msg || typeof msg !== "object" || typeof msg.role !== "string" || typeof msg.content !== "string") {
+        throw new EngramAccessInputError("each message must have a string 'role' and 'content'");
+      }
+      if (msg.role !== "user" && msg.role !== "assistant") {
+        throw new EngramAccessInputError(`invalid message role: ${msg.role} (expected 'user' or 'assistant')`);
+      }
+    }
+    const scope = await this.deps.resolveMemoryScopePlan(request);
+    const writeNamespace = scope.writeNamespace;
+    const namespace = this.deps.legacyResponseNamespaceForScope(scope);
+    const shouldWriteObjectiveState = resolveObjectiveStateCapabilities(this.deps.orchestrator.config).objectiveStateMemory === true && resolveObjectiveStateCapabilities(this.deps.orchestrator.config).objectiveStateSnapshotWrites === true;
+    await this.deps.maybeAttachCodingContext(request.sessionKey, {
+      cwd: request.cwd,
+      projectTag: request.projectTag
     });
-    return redactSensitive(result);
-  }
-  /**
-   * Per-namespace maintenance + QMD health. QMD diagnostics are probed via
-   * the orchestrator's search health accessor (one probe per namespace).
-   */
-  async adminMaintenanceHealth() {
-    const report = await gatherMaintenanceHealth({
-      catalog: this.orchestrator.namespaceCatalog,
-      qmdHealthProvider: async (namespace) => {
-        try {
-          const health = await this.orchestrator.searchHealthForNamespace(namespace);
-          return {
-            namespace,
-            collection: health.collection,
-            available: health.available,
-            collectionState: health.collectionState,
-            debugStatus: health.debugStatus,
-            installedVersion: health.installedVersion,
-            supportedVersion: health.supportedVersion,
-            supported: health.supported,
-            upgradeAvailable: health.upgradeAvailable,
-            daemonMode: health.daemonMode
-          };
-        } catch (err) {
-          throw err;
-        }
+    const lcmSessionKey = lcmSessionKeyForNamespace(
+      writeNamespace,
+      request.sessionKey,
+      this.deps.orchestrator.config.defaultNamespace
+    ) ?? request.sessionKey;
+    if (shouldWriteObjectiveState) {
+      try {
+        const objectiveStateLocation = await this.deps.objectiveStateStoreLocationForNamespace(
+          scope.objectiveStateNamespace
+        );
+        await recordObjectiveStateSnapshotsFromObservedMessages({
+          memoryDir: objectiveStateLocation.memoryDir,
+          objectiveStateStoreDir: objectiveStateLocation.objectiveStateStoreDir,
+          objectiveStateMemoryEnabled: resolveObjectiveStateCapabilities(this.deps.orchestrator.config).objectiveStateMemory,
+          objectiveStateSnapshotWritesEnabled: resolveObjectiveStateCapabilities(this.deps.orchestrator.config).objectiveStateSnapshotWrites,
+          sessionKey: request.sessionKey,
+          recordedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          messages: request.messages
+        });
+      } catch (err) {
+        log.error(`access-observe objective-state snapshot write failed: ${err}`);
+      }
+    }
+    let lcmArchived = false;
+    if (this.deps.orchestrator.lcmEngine && this.deps.orchestrator.lcmEngine.enabled) {
+      try {
+        this.deps.orchestrator.lcmEngine.enqueueObserveMessages(lcmSessionKey, request.messages);
+        lcmArchived = true;
+      } catch (err) {
+        log.error(`access-observe LCM enqueue failed: ${err}`);
+      }
+    }
+    let extractionQueued = false;
+    if (request.skipExtraction !== true) {
+      const turns = request.messages.map((m) => ({
+        source: "openclaw",
+        // Identity-vs-routing separation (#1505 thread 1, cursor): extraction
+        // derives the provenance principal via `resolvePrincipal(turn.sessionKey)`
+        // and threads `turn.sessionKey` into conversation threading. Feeding the
+        // namespace-PREFIXED `lcmSessionKey` here mis-derived the principal to
+        // `default` (a `<ns>:<key>` string matches no prefix/map rule and fails
+        // the `agent:` heuristic). Pass the ORIGINAL sessionKey so identity is
+        // correct; storage routing is pinned separately via
+        // writeNamespaceOverride below, and the authenticated principal is pinned
+        // via principalOverride.
+        sessionKey: request.sessionKey,
+        role: m.role,
+        content: m.content,
+        parts: m.parts,
+        rawContent: m.rawContent,
+        sourceFormat: m.sourceFormat,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      }));
+      const writeNamespaceOverride = resolveNamespaceCapabilities(this.deps.orchestrator.config).namespaces === true ? writeNamespace : void 0;
+      const principalOverride = typeof scope.principal === "string" && scope.principal.length > 0 ? scope.principal : void 0;
+      try {
+        const extractionPromise = this.deps.orchestrator.ingestReplayBatch(turns, {
+          archiveLcm: false,
+          writeNamespaceOverride,
+          principalOverride
+        });
+        extractionPromise.catch((err) => {
+          log.error(`access-observe background extraction failed: ${err}`);
+        });
+        extractionQueued = true;
+      } catch (err) {
+        log.error(`access-observe extraction enqueue failed: ${err}`);
       }
-    });
-    return redactSensitive(report);
-  }
-  /**
-   * Dry-run transcript/session audit. Detects mixed `other/default` data
-   * and legacy stranded directories. Never applies a migration.
-   */
-  async adminTranscriptAudit() {
-    const result = await auditTranscripts(this.orchestrator.config.memoryDir);
-    return redactSensitive(result);
-  }
-  async adminPromoteMemory(request) {
-    return this.accessAdminOpsSurface.adminPromoteMemory(
-      request
+    }
+    log.info(
+      `access-observe namespace=${namespace} effectiveNamespace=${writeNamespace} sessionKey=${request.sessionKey} messages=${request.messages.length} lcm=${lcmArchived} extraction=${extractionQueued}`
     );
+    return {
+      accepted: request.messages.length,
+      sessionKey: request.sessionKey,
+      namespace,
+      effectiveNamespace: writeNamespace,
+      scopeDebug: {
+        principal: scope.principal,
+        explicitNamespace: scope.explicitNamespace,
+        baseNamespace: scope.baseNamespace,
+        writeNamespace: scope.writeNamespace,
+        codingOverlayApplied: scope.codingOverlayApplied,
+        readNamespaces: scope.readNamespaces,
+        scopeProfile: scope.scopeProfile,
+        writeLayer: scope.writeLayer,
+        layers: scope.layers,
+        promotionTargets: scope.promotionTargets
+      },
+      lcmArchived,
+      extractionQueued
+    };
   }
-};
-
-// src/access-lcm-surface.ts
-var AccessLcmSurface = class {
-  constructor(deps) {
-    this.deps = deps;
-  }
-  deps;
-  async lcmSearch(request) {
-    if (!request.query || typeof request.query !== "string" || request.query.trim().length === 0) {
-      throw new EngramAccessInputError("query is required and must be a non-empty string");
+  async workTask(request) {
+    const STATUSES = /* @__PURE__ */ new Set(["todo", "in_progress", "blocked", "done", "cancelled"]);
+    const PRIORITIES = /* @__PURE__ */ new Set(["low", "medium", "high"]);
+    const asStatus = (v) => v && STATUSES.has(v) ? v : void 0;
+    const asPriority = (v) => v && PRIORITIES.has(v) ? v : void 0;
+    const storage = new WorkStorage(this.deps.orchestrator.config.memoryDir);
+    await storage.ensureDirectories();
+    const action = request.action;
+    if (action === "create") {
+      if (!request.title?.trim()) throw new EngramAccessInputError("title is required for create");
+      const task = await storage.createTask({
+        title: request.title,
+        description: request.description,
+        status: asStatus(request.status),
+        priority: asPriority(request.priority),
+        owner: request.owner?.trim() || void 0,
+        assignee: request.assignee?.trim() || void 0,
+        projectId: request.projectId?.trim() || void 0,
+        tags: request.tags,
+        dueAt: request.dueAt?.trim() || void 0
+      });
+      return { action, task };
     }
-    const principal = this.deps.resolveRequestPrincipal(request.sessionKey, request.authenticatedPrincipal);
-    const hasExplicitNamespace = typeof request.namespace === "string" && request.namespace.trim().length > 0;
-    const profileLcmReadNamespaces = hasExplicitNamespace ? null : this.deps.resolveScopeProfileLcmReadNamespaces(
-      request.sessionKey,
-      request.authenticatedPrincipal
-    );
-    const namespace = hasExplicitNamespace ? this.deps.resolveReadableNamespace(request.namespace, principal) : profileLcmReadNamespaces !== null ? profileLcmReadNamespaces[0] : this.deps.resolveImplicitLcmReadFallbackNamespace(principal);
-    if (!this.deps.orchestrator.lcmEngine || !this.deps.orchestrator.lcmEngine.enabled) {
-      return {
-        query: request.query,
-        namespace: namespace ?? this.deps.orchestrator.config.defaultNamespace,
-        results: [],
-        count: 0,
-        lcmEnabled: false
-      };
+    if (action === "get") {
+      if (!request.id?.trim()) throw new EngramAccessInputError("id is required for get");
+      return { action, task: await storage.getTask(request.id) };
     }
-    if (profileLcmReadNamespaces !== null && profileLcmReadNamespaces.length === 0) {
-      return {
-        query: request.query,
-        namespace: this.deps.orchestrator.config.defaultNamespace,
-        results: [],
-        count: 0,
-        lcmEnabled: true
-      };
+    if (action === "list") {
+      const tasks = await storage.listTasks({
+        status: asStatus(request.status),
+        owner: request.owner?.trim() || void 0,
+        assignee: request.assignee?.trim() || void 0,
+        projectId: request.projectId?.trim() || void 0
+      });
+      return { action, count: tasks.length, tasks };
     }
-    if (namespace === void 0) {
-      return {
-        query: request.query,
-        namespace: this.deps.orchestrator.config.defaultNamespace,
-        results: [],
-        count: 0,
-        lcmEnabled: true
-      };
+    if (action === "update") {
+      if (!request.id?.trim()) throw new EngramAccessInputError("id is required for update");
+      const patch = {};
+      if (request.title !== void 0) patch.title = request.title;
+      if (request.description !== void 0) patch.description = request.description;
+      const st = asStatus(request.status);
+      if (st) patch.status = st;
+      const pr = asPriority(request.priority);
+      if (pr) patch.priority = pr;
+      if (request.owner !== void 0) patch.owner = request.owner || null;
+      if (request.assignee !== void 0) patch.assignee = request.assignee || null;
+      if (request.projectId !== void 0) patch.projectId = request.projectId || null;
+      if (request.tags) patch.tags = request.tags;
+      if (request.dueAt !== void 0) patch.dueAt = request.dueAt || null;
+      return { action, task: await storage.updateTask(request.id, patch) };
     }
-    const limit = Math.max(1, Math.min(request.limit ?? 10, 100));
-    const lcmReadNamespace = profileLcmReadNamespaces !== null ? profileLcmReadNamespaces[0] ?? this.deps.orchestrator.config.defaultNamespace : this.deps.resolveLcmReadNamespace(
-      request.namespace,
-      namespace,
-      request.sessionKey,
-      request.authenticatedPrincipal
-    );
-    const lcmSessionKeyIds = request.sessionKey ? profileLcmReadNamespaces !== null ? this.deps.lcmSessionIdsForNamespaces(
-      profileLcmReadNamespaces,
-      request.sessionKey
-    ) : this.deps.resolveLcmReadSessionIds(
-      request.namespace,
-      namespace,
-      request.sessionKey,
-      request.authenticatedPrincipal
-    ) : [void 0];
-    const lcmSessionPrefixes = request.sessionPrefix ? profileLcmReadNamespaces !== null && !request.sessionKey ? this.deps.lcmSessionIdsForNamespaces(
-      profileLcmReadNamespaces,
-      request.sessionPrefix
-    ) : [
-      lcmSessionKeyForNamespace(
-        lcmReadNamespace,
-        request.sessionPrefix,
-        this.deps.orchestrator.config.defaultNamespace
-      ) ?? request.sessionPrefix
-    ] : [void 0];
-    const hasScopedSession = typeof request.sessionKey === "string" && request.sessionKey.length > 0 || lcmSessionPrefixes.some((prefix) => typeof prefix === "string" && prefix.length > 0);
-    if (!hasScopedSession && resolveNamespaceCapabilities(this.deps.orchestrator.config).namespaces === true) {
-      return {
-        query: request.query,
-        namespace,
-        results: [],
-        count: 0,
-        lcmEnabled: true
-      };
+    if (action === "transition") {
+      if (!request.id?.trim()) throw new EngramAccessInputError("id is required for transition");
+      const st = asStatus(request.status);
+      if (!st) throw new EngramAccessInputError("valid status is required for transition");
+      return { action, task: await storage.transitionTask(request.id, st) };
     }
-    const seenRows = /* @__PURE__ */ new Set();
-    const results = [];
-    const lcmSearches = [];
-    for (const lcmSessionKey of lcmSessionKeyIds) {
-      for (const lcmSessionPrefix of lcmSessionPrefixes) {
-        lcmSearches.push({
-          key: lcmSessionKey,
-          prefix: lcmSessionPrefix,
-          promise: this.deps.orchestrator.lcmEngine.searchContextFull(
-            request.query,
-            limit,
-            lcmSessionKey,
-            lcmSessionPrefix
-          )
-        });
-      }
+    if (action === "delete") {
+      if (!request.id?.trim()) throw new EngramAccessInputError("id is required for delete");
+      return { action, deleted: await storage.deleteTask(request.id) };
     }
-    const settledSearches = await Promise.allSettled(
-      lcmSearches.map((search) => search.promise)
-    );
-    for (let i = 0; i < settledSearches.length; i += 1) {
-      if (results.length >= limit) break;
-      const settled = settledSearches[i];
-      if (!settled || settled.status === "rejected") {
-        const failed = lcmSearches[i];
-        log.warn(
-          `lcmSearch: failed for key=${failed?.key ?? "<none>"} prefix=${failed?.prefix ?? "<none>"}: ${settled?.status === "rejected" ? settled.reason : "missing result"}`
-        );
-        continue;
-      }
-      for (const r of settled.value) {
-        const dedupeKey = `${r.session_id}\0${r.turn_index}`;
-        if (seenRows.has(dedupeKey)) continue;
-        seenRows.add(dedupeKey);
-        results.push({
-          sessionId: r.session_id,
-          content: r.content,
-          turnIndex: r.turn_index
-        });
-        if (results.length >= limit) break;
+    throw new EngramAccessInputError(`Unsupported work_task action: ${action}`);
+  }
+  async workProject(request) {
+    const STATUSES = /* @__PURE__ */ new Set(["active", "on_hold", "completed", "archived"]);
+    const asStatus = (v) => v && STATUSES.has(v) ? v : void 0;
+    const storage = new WorkStorage(this.deps.orchestrator.config.memoryDir);
+    await storage.ensureDirectories();
+    const action = request.action;
+    if (action === "create") {
+      if (!request.name?.trim()) throw new EngramAccessInputError("name is required for create");
+      const project = await storage.createProject({
+        name: request.name,
+        description: request.description,
+        status: asStatus(request.status),
+        owner: request.owner?.trim() || void 0,
+        tags: request.tags
+      });
+      return { action, project };
+    }
+    if (action === "get") {
+      if (!request.id?.trim()) throw new EngramAccessInputError("id is required for get");
+      return { action, project: await storage.getProject(request.id) };
+    }
+    if (action === "list") {
+      const projects = await storage.listProjects();
+      return { action, count: projects.length, projects };
+    }
+    if (action === "update") {
+      if (!request.id?.trim()) throw new EngramAccessInputError("id is required for update");
+      const patch = {};
+      if (request.name !== void 0) patch.name = request.name;
+      if (request.description !== void 0) patch.description = request.description;
+      const st = asStatus(request.status);
+      if (st) patch.status = st;
+      if (request.owner !== void 0) patch.owner = request.owner || null;
+      if (request.tags) patch.tags = request.tags;
+      return { action, project: await storage.updateProject(request.id, patch) };
+    }
+    if (action === "delete") {
+      if (!request.id?.trim()) throw new EngramAccessInputError("id is required for delete");
+      return { action, deleted: await storage.deleteProject(request.id) };
+    }
+    if (action === "link_task") {
+      if (!request.taskId?.trim() || !request.projectId?.trim()) {
+        throw new EngramAccessInputError("taskId and projectId are required for link_task");
       }
+      return { action, linked: await storage.linkTaskToProject(request.taskId, request.projectId) };
     }
-    return {
-      query: request.query,
-      namespace,
-      results,
-      count: results.length,
-      lcmEnabled: true
-    };
+    throw new EngramAccessInputError(`Unsupported work_project action: ${action}`);
   }
-  /**
-   * Resolve the effective LCM NAMESPACE a same-session operation must prefix
-   * with (the namespace half of {@link resolveLcmReadSessionKey}). Split out so
-   * `lcmSearch` can apply ONE namespace to BOTH its `sessionKey` and its
-   * `sessionPrefix` — the prefix is a search fragment, not a real session, so its
-   * own coding context can't be looked up; it must inherit the namespace resolved
-   * from the real session (`sessionKeyForOverlay`).
-   *
-   * `purpose` selects the AUTHORIZATION gate applied before honouring the
-   * coding overlay (#1505 round 3 + round 4, codex P2):
-   *
-   *  - `"read"` (`lcmSearch` / raw-excerpt recall): the overlay rows are only
-   *    visible when the principal SELF base is in the READABLE RECALL SET — the
-   *    same gate the orchestrator's `lcmReadNamespaceForSession` and the recall
-   *    namespace set use (`recallNamespacesForPrincipal`, gated by both
-   *    `defaultRecallNamespaces.includes("self")` AND `canReadNamespace`). A
-   *    caller that passed the default read check must NOT receive
-   *    `<principal>-project-*` rows the policy never granted (cross-tenant read
-   *    leak). When the self base is not readable, keep the just-authorized
-   *    namespace (collapses to the raw key on the default store).
-   *
-   *  - `"write"` (`lcmCompactionFlush` / `lcmCompactionRecord`): these are
-   *    write/maintenance operations on the SAME queue `observe` just wrote, so
-   *    the gate must mirror observe's WRITE authorization (`canWriteNamespace`
-   *    on the self base), NOT readability. A principal that can WRITE but not
-   *    READ its self namespace (or whose `defaultRecallNamespaces` omits `self`)
-   *    archived under the overlay key via `observe`; gating compaction by
-   *    readability would fall back to the default/raw key and leave that queue
-   *    never flushed/recorded (round-4 codex P2). Write-authorized ⇒ overlay
-   *    key, matching the observe write key (rule 42 read/write parity; rule 39
-   *    identical gates across paths).
-   */
-  resolveLcmReadNamespace(explicitNamespace, resolvedNamespace, sessionKeyForOverlay, authenticatedPrincipal, purpose = "read") {
-    const hasExplicitNamespace = typeof explicitNamespace === "string" && explicitNamespace.trim().length > 0;
-    if (hasExplicitNamespace) return resolvedNamespace;
-    const principal = this.deps.resolveRequestPrincipal(
-      sessionKeyForOverlay,
-      authenticatedPrincipal
-    );
-    const base = defaultNamespaceForPrincipal(principal, this.deps.orchestrator.config);
-    const overlaid = this.deps.orchestrator.applyCodingNamespaceOverlay(
-      sessionKeyForOverlay,
-      base
-    );
-    if (overlaid === base) return this.deps.orchestrator.config.defaultNamespace;
-    const authorized = purpose === "write" ? canWriteNamespace(principal, base, this.deps.orchestrator.config) : recallNamespacesForPrincipal(
-      principal,
-      this.deps.orchestrator.config
-    ).includes(base);
-    if (authorized) return overlaid;
-    if (purpose === "read") return this.deps.orchestrator.config.defaultNamespace;
-    return resolvedNamespace;
+  async workBoard(request) {
+    const memoryDir = this.deps.orchestrator.config.memoryDir;
+    await new WorkStorage(memoryDir).ensureDirectories();
+    const action = request.action;
+    const projectId = request.projectId?.trim() || void 0;
+    if (action === "export_markdown") {
+      const markdown = await exportWorkBoardMarkdown({ memoryDir, projectId });
+      return { action, markdown: wrapWorkLayerContext(markdown, { linkToMemory: request.linkToMemory === true }) };
+    }
+    if (action === "export_snapshot") {
+      const snapshot = await exportWorkBoardSnapshot({ memoryDir, projectId });
+      return { action, snapshot };
+    }
+    if (action === "import_snapshot") {
+      if (!request.snapshotJson?.trim()) throw new EngramAccessInputError("snapshotJson is required for import_snapshot");
+      const snapshot = JSON.parse(request.snapshotJson);
+      const result = await importWorkBoardSnapshot({ memoryDir, snapshot, projectId });
+      return { action, result };
+    }
+    throw new EngramAccessInputError(`Unsupported work_board action: ${action}`);
   }
-  /**
-   * Resolve the namespace the raw-disclosure excerpt lookup
-   * ({@link fetchRawExcerpts}) must prefix its LCM `session_id` with (#1505
-   * thread 2f7). Raw disclosure reads the SAME LCM archive `lcmSearch` and the
-   * in-prompt LCM sections read, so it MUST pass through the identical
-   * read-authorization gate — NOT `snapshot.namespace`, which records the
-   * effective WRITE/overlay namespace (`<principal>-project-*`) even when the
-   * principal can WRITE but not READ its self base (or `defaultRecallNamespaces`
-   * omits `self`). Routing through `resolveLcmReadNamespace(..., "read")` makes
-   * raw disclosure fall back to the default store exactly like normal recall +
-   * `lcmSearch`, so it never attaches overlay transcript rows the read gate
-   * excludes (cross-tenant read leak). Collapses to the default store / raw
-   * sessionKey for single-store / no-overlay / explicit-default flows, so
-   * single-user recall is byte-for-byte unchanged.
-   *
-   * Returns `undefined` when NO readable LCM namespace exists for an IMPLICIT
-   * (no explicit `namespace`) raw recall — i.e. a restrictive `default` READ
-   * policy denies the principal `default` AND no overlay/self namespace is
-   * readable. In that case the caller emits NO excerpts rather than throwing
-   * `namespace is not readable: default` (#1505 thread NBHWz): normal recall
-   * still succeeds via `recallNamespacesForPrincipal`, so `disclosure: "raw"`
-   * must degrade gracefully (empty excerpts), never pre-authorize `default`.
-   *
-   * IMPLICIT-namespace fallback selection derives from the ALREADY
-   * read-authorized recall namespace set (`recallNamespacesForPrincipal` +
-   * `canReadNamespace`) — the principal's self base when it is in the readable
-   * recall set, else `config.defaultNamespace` ONLY when the principal may read
-   * it. It NEVER pre-authorizes `default`. An EXPLICIT `namespace` is still
-   * authorized strictly via `resolveReadableNamespace` (explicit reads must pass
-   * the ACL — no behavior change).
-   */
-  resolveRawExcerptReadNamespace(explicitNamespace, sessionKey, authenticatedPrincipal) {
-    const principal = this.deps.resolveRequestPrincipal(
-      sessionKey,
-      authenticatedPrincipal
-    );
-    const hasExplicitNamespace = typeof explicitNamespace === "string" && explicitNamespace.trim().length > 0;
-    if (hasExplicitNamespace) {
-      const resolvedNamespace = this.deps.resolveReadableNamespace(
-        explicitNamespace,
-        principal
+  async memoryActionApply(request) {
+    const actionTypes = /* @__PURE__ */ new Set([
+      "store_episode",
+      "store_note",
+      "update_note",
+      "create_artifact",
+      "summarize_node",
+      "discard",
+      "link_graph"
+    ]);
+    if (!actionTypes.has(request.action)) {
+      throw new EngramAccessInputError(
+        `memory_action_apply: invalid action ${JSON.stringify(request.action)}`
       );
-      return this.deps.resolveLcmReadNamespace(
-        explicitNamespace,
-        resolvedNamespace,
-        sessionKey,
-        authenticatedPrincipal,
-        "read"
+    }
+    if (resolveCompressionCapabilities(this.deps.orchestrator.config).contextCompressionActions !== true) {
+      throw new EngramAccessInputError(
+        "memory_action_apply is disabled; enable contextCompressionActionsEnabled to use this tool"
       );
     }
-    const profileReadNamespaces = this.deps.resolveScopeProfileLcmReadNamespaces(
-      sessionKey,
-      authenticatedPrincipal
-    );
-    if (profileReadNamespaces !== null) return profileReadNamespaces[0];
-    const fallbackNamespace = this.deps.resolveImplicitLcmReadFallbackNamespace(principal);
-    if (fallbackNamespace === void 0) return void 0;
-    return this.deps.resolveLcmReadNamespace(
-      explicitNamespace,
-      fallbackNamespace,
-      sessionKey,
-      authenticatedPrincipal,
-      "read"
-    );
-  }
-  resolveLcmReadSessionIds(explicitNamespace, resolvedNamespace, sessionKey, authenticatedPrincipal) {
-    const primary = this.deps.resolveLcmReadSessionKey(
-      explicitNamespace,
-      resolvedNamespace,
-      sessionKey,
-      authenticatedPrincipal,
-      "read"
-    );
-    const hasExplicitNamespace = typeof explicitNamespace === "string" && explicitNamespace.trim().length > 0;
-    if (hasExplicitNamespace) return [primary];
-    const profileReadNamespaces = this.deps.resolveScopeProfileLcmReadNamespaces(
-      sessionKey,
-      authenticatedPrincipal
-    );
-    if (profileReadNamespaces !== null) {
-      return this.deps.lcmSessionIdsForNamespaces(profileReadNamespaces, sessionKey);
+    const outcome = request.outcome ?? "skipped";
+    if (outcome !== "applied" && outcome !== "skipped" && outcome !== "failed") {
+      throw new EngramAccessInputError(
+        `memory_action_apply: outcome must be "applied", "skipped", or "failed"; got ${JSON.stringify(outcome)}`
+      );
     }
-    const principal = this.deps.resolveRequestPrincipal(
-      sessionKey,
-      authenticatedPrincipal
-    );
-    const base = defaultNamespaceForPrincipal(
-      principal,
-      this.deps.orchestrator.config
-    );
-    const overlaid = this.deps.orchestrator.applyCodingNamespaceOverlay(
-      sessionKey,
-      base
-    );
-    if (overlaid === base) return [primary];
-    const selfReadableInRecall = recallNamespacesForPrincipal(
-      principal,
-      this.deps.orchestrator.config
-    ).includes(base);
-    if (!selfReadableInRecall) return [primary];
-    const overlay = resolveCodingNamespaceOverlay(
-      this.deps.orchestrator.getCodingContextForSession(sessionKey),
-      this.deps.orchestrator.config.codingMode,
-      this.deps.orchestrator.config.defaultNamespace
-    );
-    const fallbackNamespaces = (overlay?.readFallbacks ?? []).map(
-      (fallback) => combineNamespaces(base, fallback)
+    const resolvedNs = this.deps.writableNamespaceFor(
+      request.namespace,
+      request.sessionKey,
+      request.principal
     );
-    const out = [primary];
-    const seen = /* @__PURE__ */ new Set([primary]);
-    for (const ns of fallbackNamespaces) {
-      const key = lcmSessionKeyForNamespace(
-        ns,
-        sessionKey,
-        this.deps.orchestrator.config.defaultNamespace
-      ) ?? sessionKey;
-      if (!seen.has(key)) {
-        seen.add(key);
-        out.push(key);
-      }
+    const inputSummaryParts = [
+      request.content,
+      request.category ? `category=${request.category}` : void 0,
+      request.linkTargetId ? `linkTargetId=${request.linkTargetId}` : void 0,
+      request.linkType ? `linkType=${request.linkType}` : void 0,
+      typeof request.linkStrength === "number" ? `linkStrength=${request.linkStrength}` : void 0,
+      request.artifactType ? `artifactType=${request.artifactType}` : void 0,
+      typeof request.execute === "boolean" ? `execute=${request.execute}` : void 0
+    ].filter((part) => typeof part === "string" && part.length > 0);
+    const event = {
+      action: request.action,
+      outcome,
+      namespace: resolvedNs,
+      actor: "access.memory_action_apply",
+      subsystem: "access.memory_action_apply",
+      reason: request.reason,
+      memoryId: request.memoryId,
+      sourceSessionKey: request.sessionKey,
+      inputSummary: inputSummaryParts.length > 0 ? inputSummaryParts.join(" | ").slice(0, 500) : void 0,
+      dryRun: request.dryRun === true,
+      promptHash: typeof request.sourcePrompt === "string" && request.sourcePrompt.length > 0 ? createHash6("sha256").update(request.sourcePrompt).digest("hex") : void 0
+    };
+    const preview = this.deps.orchestrator.previewMemoryActionEvent(event);
+    if (request.dryRun === true) {
+      return { recorded: false, dryRun: true, event: preview };
     }
-    return out;
+    const recorded = await this.deps.orchestrator.appendMemoryActionEvent(event);
+    return { recorded, event: preview };
   }
 };
 
@@ -10770,11 +10831,11 @@ export {
   clusterByKey,
   computeProcedureStats,
   formatProcedureStatsText,
+  AccessObserveWriteSurface,
   AccessLcmSurface,
   qmdCollectionPathParts,
   QmdResultResolver,
   AccessRecallSurface,
-  selfDeps,
   EngramAccessInputError,
   ENGRAM_ACCESS_WRITE_SCHEMA_VERSION,
   buildProjectedGovernanceProposedActions,
@@ -10783,4 +10844,4 @@ export {
   EngramAccessService,
   AccessAdminOpsSurface
 };
-//# sourceMappingURL=chunk-L4AS7TIG.js.map
+//# sourceMappingURL=chunk-DWDDQLSZ.js.map