@remnic/core 9.63.3 → 9.63.5

package/src/meetings/fuse.ts

@@ -23,9 +23,9 @@ import type {
   FusionConversationInput,
   FusionSegmentInput,
 } from "../wearables/fusion/types.js";
+import type { ActivitySnapshot } from "../activity/types.js";
 import type {
   FusedMeeting,
-  MeetingActivitySnapshot,
   MeetingBuildInput,
   MeetingScreenContextEvent,
   MeetingsConfig,
@@ -119,20 +119,22 @@ function shortenUrl(url: string): string {
   return url.replace(/^[a-z]+:\/\//i, "");
 }
 
-function contextLabel(snap: MeetingActivitySnapshot): string {
-  if (snap.url !== undefined && snap.url.length > 0) return `${snap.app}: ${shortenUrl(snap.url)}`;
-  if (snap.title !== undefined && snap.title.length > 0) return `${snap.app}: ${snap.title}`;
+function contextLabel(snap: ActivitySnapshot): string {
+  if (snap.browserUrl !== undefined && snap.browserUrl.length > 0) {
+    return `${snap.app}: ${shortenUrl(snap.browserUrl)}`;
+  }
+  if (snap.windowTitle.length > 0) return `${snap.app}: ${snap.windowTitle}`;
   return snap.app;
 }
 
 /** True when a snapshot is the meeting app itself (captions/chat/participants),
  *  not other context. Matches the meeting's app or any configured app pattern. */
 function isMeetingAppSnapshot(
-  snap: MeetingActivitySnapshot,
+  snap: ActivitySnapshot,
   meetingApp: string | undefined,
   appPatterns: readonly string[],
 ): boolean {
-  const hay = `${snap.app} ${snap.title ?? ""} ${snap.url ?? ""}`.toLowerCase();
+  const hay = `${snap.app} ${snap.windowTitle} ${snap.browserUrl ?? ""}`.toLowerCase();
   if (meetingApp !== undefined && meetingApp.length > 0 && hay.includes(meetingApp.toLowerCase())) {
     return true;
   }
@@ -159,21 +161,25 @@ interface ScreenContextResult {
  * kept. Meeting-app snapshots never enter the timeline but feed excerpts.
  */
 function buildScreenContext(
-  activity: readonly MeetingActivitySnapshot[],
+  activity: readonly ActivitySnapshot[],
   windowStartMs: number,
   windowEndMs: number,
   meetingApp: string | undefined,
   config: MeetingsConfig,
 ): ScreenContextResult {
   const win = activity
-    .map((snap) => ({ snap, ms: Date.parse(snap.tsUtc) }))
+    .map((snap) => ({ snap, ms: Date.parse(snap.capturedAtUtc) }))
     .filter((entry) => Number.isFinite(entry.ms) && entry.ms >= windowStartMs && entry.ms < windowEndMs)
     .sort((a, b) => a.ms - b.ms || SORT_STR(a.snap.app, b.snap.app));
 
-  const keyOf = (snap: MeetingActivitySnapshot): string =>
+  /** Run key detail: the URL when present, else the window title. */
+  const keyDetail = (snap: ActivitySnapshot): string =>
+    snap.browserUrl !== undefined && snap.browserUrl.length > 0 ? snap.browserUrl : snap.windowTitle;
+
+  const keyOf = (snap: ActivitySnapshot): string =>
     isMeetingAppSnapshot(snap, meetingApp, config.appPatterns)
       ? MEETING_APP_KEY
-      : `${snap.app}\u0000${snap.url ?? snap.title ?? ""}`;
+      : `${snap.app}\u0000${keyDetail(snap)}`;
 
   const events: MeetingScreenContextEvent[] = [];
   const includedText: string[] = [];
@@ -197,7 +203,7 @@ function buildScreenContext(
       // Captions / chat / participant text visible on the meeting app itself.
       for (let i = runStartIdx; i < runEndIdx; i++) {
         const text = win[i]!.snap.text;
-        if (text !== undefined && text.trim().length > 0) includedText.push(text.trim());
+        if (text.trim().length > 0) includedText.push(text.trim());
       }
     } else if (dwellSeconds >= config.contextDwellSeconds) {
       events.push({
@@ -209,7 +215,7 @@ function buildScreenContext(
       });
       for (let i = runStartIdx; i < runEndIdx; i++) {
         const text = win[i]!.snap.text;
-        if (text !== undefined && text.trim().length > 0) includedText.push(text.trim());
+        if (text.trim().length > 0) includedText.push(text.trim());
       }
     }
     runStartIdx = runEndIdx;

package/src/meetings/types.ts

@@ -8,6 +8,7 @@
  * timestamps are UTC ISO-8601; windows are half-open [startUtc, endUtc).
  */
 
+import type { ActivitySnapshot } from "../activity/types.js";
 import type {
   FusedSegment,
   FusedSpeaker,
@@ -81,23 +82,6 @@ export interface MeetingsDetectionConfig {
   mergeGapMinutes: number;
 }
 
-/**
- * One screen-activity snapshot fed into meeting fusion (assembled from the
- * activity store by a later wiring slice; injected directly in tests). Text is
- * already post-redaction — meeting fusion never sees raw capture.
- */
-export interface MeetingActivitySnapshot {
-  /** ISO 8601 UTC instant the snapshot was captured. */
-  tsUtc: string;
-  /** Foreground application label (e.g. "Preview", "Chrome", "Zoom"). */
-  app: string;
-  /** Window title, when known. */
-  title?: string;
-  /** Browser URL, when known. */
-  url?: string;
-  /** Extracted on-screen text excerpt, when known. */
-  text?: string;
-}
 
 /** One entry in a meeting's screen-context timeline (an other-app dwell). */
 export interface MeetingScreenContextEvent {
@@ -144,8 +128,9 @@ export interface MeetingBuildInput {
    * is fine (they are clipped in `fuseMeeting`).
    */
   conversations: FusionConversationInput[];
-  /** Day screen-activity snapshots (filtered to the window in `fuseMeeting`). */
-  activity?: MeetingActivitySnapshot[];
+  /** Day screen-activity snapshots (filtered to the window in `fuseMeeting`).
+   * Already post-redaction — meeting fusion never sees raw capture. */
+  activity?: ActivitySnapshot[];
 }
 
 /** The fused, screen-aware view of a meeting produced by `fuseMeeting`. */

package/src/memory-cache-derived.test.ts

@@ -0,0 +1,90 @@
+/**
+ * Issue #2481 — the derived cache layers (episode map, rule memories) share
+ * one getVersionedCacheEntry read gate with the hot layer. These pin the
+ * per-layer contracts that must keep holding after that dedup: version-keyed
+ * round-trip, version-mismatch miss, keyId mismatch miss, and TTL expiry
+ * miss on EACH layer. (Hot-layer equivalents live in memory-cache-hot.test.ts.)
+ */
+
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import {
+  clearMemoryCache,
+  getCachedEpisodeMap,
+  getCachedRuleMemories,
+  setCachedEpisodeMap,
+  setCachedRuleMemories,
+} from "./memory-cache.js";
+import type { MemoryFile } from "./types.js";
+
+function mem(path: string, id: string, category = "fact", memoryKind?: string): MemoryFile {
+  return {
+    path,
+    frontmatter: { id, category, ...(memoryKind ? { memoryKind } : {}) },
+    content: "x",
+  } as unknown as MemoryFile;
+}
+
+const EPISODE = mem("a.md", "ep-1", "fact", "episode");
+
+test("episode map: matching version hits; version or keyId mismatch misses", () => {
+  const dir = "/tmp/remnic-derived-ep-ver";
+  clearMemoryCache();
+  setCachedEpisodeMap(dir, [EPISODE], 7, true, "key:1");
+  const got = getCachedEpisodeMap(dir, 7, "key:1");
+  assert.ok(got, "expected a hit at the matching version and keyId");
+  assert.deepEqual([...got.keys()], ["ep-1"]);
+  assert.equal(getCachedEpisodeMap(dir, 8, "key:1"), null, "a bumped version must miss");
+  assert.equal(getCachedEpisodeMap(dir, 7, "key:2"), null, "a mismatched keyId must miss");
+  clearMemoryCache();
+});
+
+test("episode map: TTL expiry misses; ttl=0 disables expiry", (t) => {
+  const dir = "/tmp/remnic-derived-ep-ttl";
+  clearMemoryCache();
+  t.mock.timers.enable({ apis: ["Date"] });
+  try {
+    setCachedEpisodeMap(dir, [EPISODE], 9);
+    assert.ok(getCachedEpisodeMap(dir, 9, "", 60_000), "fresh entry within TTL hits");
+    t.mock.timers.tick(120_000);
+    assert.equal(getCachedEpisodeMap(dir, 9, "", 60_000), null, "entry older than ttl is a miss");
+    setCachedEpisodeMap(dir, [EPISODE], 9);
+    t.mock.timers.tick(600_000);
+    assert.ok(getCachedEpisodeMap(dir, 9, "", 0), "ttl=0 disables expiry");
+  } finally {
+    t.mock.timers.reset();
+    clearMemoryCache();
+  }
+});
+
+test("rule memories: matching version hits; version or keyId mismatch misses", () => {
+  const dir = "/tmp/remnic-derived-rule-ver";
+  clearMemoryCache();
+  setCachedRuleMemories(dir, [mem("r.md", "r-1", "rule"), mem("f.md", "f-1", "fact")], 7, true, "key:1");
+  const got = getCachedRuleMemories(dir, 7, "key:1");
+  assert.ok(got, "expected a hit at the matching version and keyId");
+  assert.deepEqual(got.all.map((m) => m.frontmatter.id), ["r-1"], "only rule-category memories in all");
+  assert.ok(got.byId.has("f-1"), "byId indexes every memory");
+  assert.equal(getCachedRuleMemories(dir, 8, "key:1"), null, "a bumped version must miss");
+  assert.equal(getCachedRuleMemories(dir, 7, "key:2"), null, "a mismatched keyId must miss");
+  clearMemoryCache();
+});
+
+test("rule memories: TTL expiry misses; ttl=0 disables expiry", (t) => {
+  const dir = "/tmp/remnic-derived-rule-ttl";
+  clearMemoryCache();
+  t.mock.timers.enable({ apis: ["Date"] });
+  try {
+    setCachedRuleMemories(dir, [mem("r.md", "r-1", "rule")], 9);
+    assert.ok(getCachedRuleMemories(dir, 9, "", 60_000), "fresh entry within TTL hits");
+    t.mock.timers.tick(120_000);
+    assert.equal(getCachedRuleMemories(dir, 9, "", 60_000), null, "entry older than ttl is a miss");
+    setCachedRuleMemories(dir, [mem("r.md", "r-1", "rule")], 9);
+    t.mock.timers.tick(600_000);
+    assert.ok(getCachedRuleMemories(dir, 9, "", 0), "ttl=0 disables expiry");
+  } finally {
+    t.mock.timers.reset();
+    clearMemoryCache();
+  }
+});

package/src/memory-cache.ts

@@ -33,26 +33,41 @@ function sweepExpiredHotEntries(now: number): void {
   }
 }
 
-export function getCachedMemories(
-  baseDir: string,
+/**
+ * Shared read gate for every versioned cache layer (issue #2481): serve an
+ * entry only when its version and secure-store keyId match the caller.
+ * `currentVersion === 0` means version tracking is unavailable (tests, fresh
+ * installs) and always misses so disk is read. The TTL is a safety net for
+ * external filesystem edits that bypass the version sentinel (issue #1902):
+ * ttlMs <= 0 disables it, and on expiry the entry is evicted — not just
+ * skipped — so a stale dir releases its resident corpus instead of lingering
+ * until an explicit clear.
+ */
+function getVersionedCacheEntry<K, E extends { version: number; keyId: string; loadedAt: number }>(
+  cache: Map<K, E>,
+  key: K,
   currentVersion: number,
-  keyId = "",
-  ttlMs = 0,
-): MemoryFile[] | null {
-  // Don't serve from cache when version tracking is unavailable (version=0).
-  // This ensures tests and fresh installs without a version file always read disk.
+  keyId: string,
+  ttlMs: number,
+): E | null {
   if (currentVersion === 0) return null;
-  const entry = hotCacheByDir.get(baseDir);
+  const entry = cache.get(key);
   if (!entry || entry.version !== currentVersion || entry.keyId !== keyId) return null;
-  // TTL safety net (issue #1902): bound staleness from external filesystem edits
-  // that bypass the version sentinel. ttlMs <= 0 disables the check. On expiry
-  // evict the entry (not just return null) so a revisited-but-stale dir releases
-  // its resident corpus instead of lingering until an explicit clear.
   if (ttlMs > 0 && Date.now() - entry.loadedAt > ttlMs) {
-    hotCacheByDir.delete(baseDir);
+    cache.delete(key);
     return null;
   }
-  return [...entry.memories.values()];
+  return entry;
+}
+
+export function getCachedMemories(
+  baseDir: string,
+  currentVersion: number,
+  keyId = "",
+  ttlMs = 0,
+): MemoryFile[] | null {
+  const entry = getVersionedCacheEntry(hotCacheByDir, baseDir, currentVersion, keyId, ttlMs);
+  return entry ? [...entry.memories.values()] : null;
 }
 
 export function setCachedMemories(
@@ -89,10 +104,10 @@ export function getCachedArchivedMemories(
   currentVersion: number,
   keyId = "",
 ): MemoryFile[] | null {
-  if (currentVersion === 0) return null;
-  const entry = archiveCacheByDir.get(baseDir);
-  if (!entry || entry.version !== currentVersion || entry.keyId !== keyId) return null;
-  return [...entry.memories.values()];
+  // ttlMs 0: the archive cache has no age TTL; it is version-keyed and cleared
+  // via invalidation.
+  const entry = getVersionedCacheEntry(archiveCacheByDir, baseDir, currentVersion, keyId, 0);
+  return entry ? [...entry.memories.values()] : null;
 }
 
 export function setCachedArchivedMemories(
@@ -165,7 +180,7 @@ export function invalidateCachedEntities(baseDir: string): void {
 // These avoid O(146K) filter+map on every verified recall/rules call.
 interface DerivedCacheEntry<T> {
   data: T;
-  sourceVersion: number; // matches the hot cache version it was derived from
+  version: number; // matches the hot cache version it was derived from
   keyId: string; // secure-store key identity of the corpus it was derived from (#1902)
   loadedAt: number; // build time — bounds staleness from external edits via ttlMs (#1902)
 }
@@ -179,17 +194,8 @@ export function getCachedEpisodeMap(
   keyId = "",
   ttlMs = 0,
 ): Map<string, MemoryFile> | null {
-  if (currentVersion === 0) return null;
-  const entry = episodeMapByDir.get(baseDir);
-  if (!entry || entry.sourceVersion !== currentVersion || entry.keyId !== keyId) return null;
-  // TTL safety net (issue #1902): the version sentinel doesn't move on a direct
-  // external edit, so bound how long a derived view is served before a rebuild
-  // (which re-reads via readAllMemories, itself TTL-bounded). ttlMs <= 0 disables.
-  if (ttlMs > 0 && Date.now() - entry.loadedAt > ttlMs) {
-    episodeMapByDir.delete(baseDir);
-    return null;
-  }
-  return entry.data;
+  const entry = getVersionedCacheEntry(episodeMapByDir, baseDir, currentVersion, keyId, ttlMs);
+  return entry ? entry.data : null;
 }
 
 /** Build and cache the episode memory map from the full memory list. */
@@ -206,7 +212,7 @@ export function setCachedEpisodeMap(
     if (m.frontmatter.memoryKind !== "episode") continue;
     map.set(m.frontmatter.id, m);
   }
-  if (cache) episodeMapByDir.set(baseDir, { data: map, sourceVersion: version, keyId, loadedAt: Date.now() });
+  if (cache) episodeMapByDir.set(baseDir, { data: map, version, keyId, loadedAt: Date.now() });
   return map;
 }
 
@@ -217,16 +223,8 @@ export function getCachedRuleMemories(
   keyId = "",
   ttlMs = 0,
 ): { all: MemoryFile[]; byId: Map<string, MemoryFile> } | null {
-  if (currentVersion === 0) return null;
-  const entry = ruleMemoriesByDir.get(baseDir);
-  if (!entry || entry.sourceVersion !== currentVersion || entry.keyId !== keyId) return null;
-  // TTL safety net (issue #1902): bound staleness from direct external edits
-  // that don't move the version sentinel. ttlMs <= 0 disables.
-  if (ttlMs > 0 && Date.now() - entry.loadedAt > ttlMs) {
-    ruleMemoriesByDir.delete(baseDir);
-    return null;
-  }
-  return entry.data;
+  const entry = getVersionedCacheEntry(ruleMemoriesByDir, baseDir, currentVersion, keyId, ttlMs);
+  return entry ? entry.data : null;
 }
 
 /** Build and cache the rule memories from the full memory list. */
@@ -250,7 +248,7 @@ export function setCachedRuleMemories(
     }
   }
   const result = { all, byId };
-  if (cache) ruleMemoriesByDir.set(baseDir, { data: result, sourceVersion: version, keyId, loadedAt: Date.now() });
+  if (cache) ruleMemoriesByDir.set(baseDir, { data: result, version, keyId, loadedAt: Date.now() });
   return result;
 }
 

package/src/namespaces/catalog.test.ts

@@ -600,15 +600,16 @@ test("catalog quarantines malformed JSONL record fields at the parse boundary",
 
     assert.deepEqual(
       list.map((r) => r.namespace),
-      ["valid"],
-      "invalid enum/token/timestamp records must not surface",
+      ["bad-kind", "valid"],
+      "unknown kinds coerce to explicit; other malformed records stay quarantined",
     );
-    assert.equal(list[0]?.identityToken, validToken);
-    assert.equal(list[0]?.kind, "project");
-    assert.equal(list[0]?.discoveredBy, "write");
-    assert.equal(list[0]?.lastReadAt, undefined);
-    assert.equal(list[0]?.lastWriteAt, undefined);
-    assert.deepEqual(list[0]?.lastMaintenanceAt, { ok: now });
+    assert.equal(list.find((r) => r.namespace === "bad-kind")?.kind, "explicit");
+    const valid = list.find((r) => r.namespace === "valid");
+    assert.equal(valid?.kind, "project");
+    assert.equal(valid?.discoveredBy, "write");
+    assert.equal(valid?.lastReadAt, undefined);
+    assert.equal(valid?.lastWriteAt, undefined);
+    assert.deepEqual(valid?.lastMaintenanceAt, { ok: now });
   } finally {
     await rm(memoryDir, { recursive: true, force: true });
   }
@@ -3952,3 +3953,47 @@ test("#1903 cross-instance compaction never drops another instance's rows", asyn
     await rm(memoryDir, { recursive: true, force: true });
   }
 });
+
+test("#2469 persisted self/legacy kinds coerce to explicit and drop unused hints", async () => {
+  const memoryDir = await mkMemoryDir();
+  try {
+    const ns = "project-origin-dead-kind";
+    const token = namespaceIdentityToken(ns);
+    const stateDir = path.join(memoryDir, "state");
+    await mkdir(stateDir, { recursive: true });
+    const line = JSON.stringify({
+      namespace: ns,
+      identityToken: token,
+      kind: "self",
+      principal: "unused",
+      projectId: "unused",
+      branch: "unused",
+      parentNamespace: "unused",
+      createdAt: "2026-08-17T00:00:00.000Z",
+      storageDir: path.join(memoryDir, "namespaces", token),
+      discoveredBy: "write",
+    });
+    const legacyLine = JSON.stringify({
+      namespace: "shared",
+      identityToken: namespaceIdentityToken("shared"),
+      kind: "legacy",
+      createdAt: "2026-08-17T00:00:00.000Z",
+      storageDir: path.join(memoryDir, "namespaces", namespaceIdentityToken("shared")),
+      discoveredBy: "config",
+    });
+    await writeFile(path.join(stateDir, "namespaces.jsonl"), `${line}\n${legacyLine}\n`, "utf8");
+
+    const catalog = new NamespaceCatalog(makeConfig(memoryDir));
+    const selfRecord = await catalog.getNamespaceRecord(ns);
+    assert.equal(selfRecord?.kind, "explicit");
+    assert.equal(
+      (selfRecord as { principal?: string } | null)?.principal,
+      undefined,
+    );
+    const legacyRecord = await catalog.getNamespaceRecord("shared");
+    assert.equal(legacyRecord?.kind, "explicit");
+  } finally {
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});
+

package/src/namespaces/catalog.ts

@@ -59,13 +59,11 @@ import { ALL_CATEGORY_DIRS } from "../utils/category-dir.js";
 
 export type NamespaceKind =
   | "default"
-  | "self"
   | "shared"
   | "project"
   | "branch"
   | "team-project"
-  | "explicit"
-  | "legacy";
+  | "explicit";
 
 export type NamespaceDiscoverySource = "config" | "write" | "read" | "scan" | "migration";
 
@@ -73,10 +71,6 @@ export interface NamespaceRecord {
   namespace: string;
   identityToken: string;
   kind: NamespaceKind;
-  principal?: string;
-  projectId?: string;
-  branch?: string;
-  parentNamespace?: string;
   createdAt: string;
   lastReadAt?: string;
   lastWriteAt?: string;
@@ -95,10 +89,6 @@ export interface NamespaceCatalogFilter {
 export interface NamespaceTouchMetadata {
   discoveredBy?: NamespaceDiscoverySource;
   kind?: NamespaceKind;
-  principal?: string;
-  projectId?: string;
-  branch?: string;
-  parentNamespace?: string;
   /** Explicit storage dir (when the caller already resolved it). */
   storageDir?: string;
   /** Override the touch timestamp (mainly for tests / migration replay). */
@@ -129,13 +119,11 @@ export interface NamespaceCatalogRebuildResult {
 
 const NAMESPACE_KINDS: readonly NamespaceKind[] = [
   "default",
-  "self",
   "shared",
   "project",
   "branch",
   "team-project",
   "explicit",
-  "legacy",
 ];
 
 const NAMESPACE_DISCOVERY_SOURCES: readonly NamespaceDiscoverySource[] = [
@@ -275,7 +263,7 @@ function isValidIsoTimestamp(value: string): boolean {
   return Number.isFinite(ms);
 }
 
-function isNamespaceKind(value: unknown): value is NamespaceKind {
+export function isNamespaceKind(value: unknown): value is NamespaceKind {
   return typeof value === "string" && (NAMESPACE_KINDS as readonly string[]).includes(value);
 }
 
@@ -301,8 +289,7 @@ function coerceRecord(value: unknown): NamespaceRecord | null {
   if (typeof v.storageDir !== "string" || v.storageDir.length === 0) return null;
   if (typeof v.createdAt !== "string" || v.createdAt.length === 0) return null;
   if (!isValidIsoTimestamp(v.createdAt)) return null;
-  const kind = v.kind === undefined ? "explicit" : isNamespaceKind(v.kind) ? v.kind : null;
-  if (!kind) return null;
+  const kind = isNamespaceKind(v.kind) ? v.kind : "explicit";
   const discoveredBy =
     v.discoveredBy === undefined
       ? "scan"
@@ -318,10 +305,6 @@ function coerceRecord(value: unknown): NamespaceRecord | null {
     storageDir: v.storageDir,
     discoveredBy,
   };
-  if (typeof v.principal === "string") record.principal = v.principal;
-  if (typeof v.projectId === "string") record.projectId = v.projectId;
-  if (typeof v.branch === "string") record.branch = v.branch;
-  if (typeof v.parentNamespace === "string") record.parentNamespace = v.parentNamespace;
   if (typeof v.lastReadAt === "string" && isValidIsoTimestamp(v.lastReadAt)) {
     record.lastReadAt = v.lastReadAt;
   }
@@ -792,12 +775,6 @@ export class NamespaceCatalog {
     if (kind === "read" && cached.lastReadAt === undefined) return true;
     if (!metadata) return false;
     if (metadata.kind !== undefined && metadata.kind !== cached.kind) return true;
-    if (metadata.principal !== undefined && metadata.principal !== cached.principal) return true;
-    if (metadata.projectId !== undefined && metadata.projectId !== cached.projectId) return true;
-    if (metadata.branch !== undefined && metadata.branch !== cached.branch) return true;
-    if (metadata.parentNamespace !== undefined && metadata.parentNamespace !== cached.parentNamespace) {
-      return true;
-    }
     // A changed storageDir repoints routing/containment for this namespace —
     // must be observable at once, not held stale by the coalesce window (#1903, Cursor).
     if (metadata.storageDir !== undefined && metadata.storageDir !== cached.storageDir) return true;
@@ -1399,15 +1376,10 @@ export class NamespaceCatalog {
                 (kind === "register" ? "config" : kind === "maintenance" ? "scan" : kind),
             };
 
-        // Update mutable fields. storageDir, kind, and the principal/project hints
-        // may legitimately change over a namespace's lifetime, so they upsert.
+        // Update mutable fields. storageDir and kind may change over a
+        // namespace's lifetime, so they upsert.
         record.storageDir = storageDir;
         if (metadata?.kind) record.kind = metadata.kind;
-        if (metadata?.principal !== undefined) record.principal = metadata.principal;
-        if (metadata?.projectId !== undefined) record.projectId = metadata.projectId;
-        if (metadata?.branch !== undefined) record.branch = metadata.branch;
-        if (metadata?.parentNamespace !== undefined)
-          record.parentNamespace = metadata.parentNamespace;
         // PROVENANCE (creation-only, with one upgrade — round 6, codex P2 NBPmT):
         // `discoveredBy` is otherwise preserved for existing records (a routine
         // read/register/resolve never relabels it). The single exception is a real
@@ -2109,10 +2081,6 @@ export class NamespaceCatalog {
     if (prior.lastReadAt) merged.lastReadAt = prior.lastReadAt;
     if (prior.lastWriteAt) merged.lastWriteAt = prior.lastWriteAt;
     if (prior.lastMaintenanceAt) merged.lastMaintenanceAt = { ...prior.lastMaintenanceAt };
-    if (prior.principal !== undefined) merged.principal = prior.principal;
-    if (prior.projectId !== undefined) merged.projectId = prior.projectId;
-    if (prior.branch !== undefined) merged.branch = prior.branch;
-    if (prior.parentNamespace !== undefined) merged.parentNamespace = prior.parentNamespace;
     return merged;
   }
   // ── Persistence ──────────────────────────────────────────────────────────