@remnic/core 9.7.14 → 9.8.0

package/src/orchestrator.ts

@@ -103,7 +103,11 @@ import { EntitySynthesisCoordinator } from "./orchestration/entity-synthesis-coo
 import { RecallResultFormatter } from "./orchestration/recall-result-formatter.js";
 import { ConversationIndexCoordinator } from "./orchestration/conversation-index-coordinator.js";
 import { RecallRerankCoordinator } from "./orchestration/recall-rerank-coordinator.js";
-import { RecallSectionCoordinator } from "./orchestration/recall-section-coordinator.js";
+import {
+  RecallSectionCoordinator,
+  type RecallSectionAppendOptions,
+  type RecallSectionBuckets,
+} from "./orchestration/recall-section-coordinator.js";
 import { QmdResultResolver, qmdCollectionPathParts, qmdResultPathCandidates } from "./orchestration/qmd-result-resolver.js";
 import { ContradictionLinkingCoordinator } from "./orchestration/contradiction-linking-coordinator.js";
 import {
@@ -126,6 +130,10 @@ import { RecallEntryCoordinator } from "./orchestration/recall-entry.js";
 import { SessionContextCoordinator } from "./orchestration/session-context.js";
 import { drainRecallWrites, trackRecallWrite } from "./orchestration/recall-background-writes.js";
 import { XrayCaptureQueue } from "./orchestration/xray-capture-queue.js";
+import {
+  computeSemanticDedupScope,
+  qmdCollectionNamespaceFromPrefix as computeQmdCollectionNamespaceFromPrefix,
+} from "./orchestration/orchestrator-namespace-scope.js";
 import {
   abortRecallError,
   buildCompressionGuidelinesMarkdown,
@@ -275,6 +283,7 @@ import {
 } from "./dedup/semantic.js";
 import { BootstrapEngine } from "./bootstrap.js";
 import { parseQmdExplain } from "./qmd.js";
+import { installPrioritizedEmbedding, type PrioritizedEmbeddingHandle } from "./prioritized-embed.js";
 import {
   buildQmdRecallCacheKey,
   getCachedQmdRecall,
@@ -364,7 +373,6 @@ import { resolveNamespaceCapabilities,
   resolveIdentityContinuityCapabilities,
   resolveLocalLlmCapabilities,
   resolveSecurityCapabilities, resolveEvalCapabilities, resolveUtilityLearningCapabilities, resolveObjectiveStateCapabilities, resolveCompressionCapabilities, resolvePresentationCapabilities, resolveConsolidationCapabilities, resolveRecallAuxiliaryCapabilities ,
-  resolveRecallEnhancementCapabilities,
   resolvePipelineProcessingCapabilities,
   resolveConversationContextCapabilities,
 } from "./capabilities.js";
@@ -437,7 +445,6 @@ import {
   type NamespaceMaintenanceHealthSummary,
 } from "./maintenance/namespace-maintenance-fanout.js";
 import {
-  namespaceIdentityFromToken,
   namespaceIdentityToken,
   normalizeNamespaceIdentity,
 } from "./namespaces/identity.js";
@@ -535,15 +542,12 @@ import type {
 } from "./types.js";
 import { disposeDefaultArchiveScoring, getDefaultArchiveScoring, memoryFileToScoreItem } from "./recall/archive-scoring.js";
 
-
 // Issue #1526 seam 15: ExtractionRunResult moved to orchestration/extraction-run.ts.
 export type { ExtractionRunResult } from "./orchestration/extraction-run.js";
 
-
 // Issue #1526 seam 15: deriveTopicsFromExtraction moved to orchestration/extraction-run.ts.
 export { deriveTopicsFromExtraction } from "./orchestration/extraction-run.js";
 
-
 export class Orchestrator {
 
   readonly storage: StorageManager;
@@ -560,6 +564,7 @@ export class Orchestrator {
    * runners (consolidation/pattern-reinforcement/governance) stay here.
    */
   readonly maintenanceScheduler: MaintenanceScheduler;
+  private prioritizedEmbedding?: PrioritizedEmbeddingHandle;
   private readonly conversationQmd?: ConversationQmdRuntime;
   private readonly conversationFaiss?: ReturnType<
     typeof createConversationIndexRuntime
@@ -604,7 +609,6 @@ export class Orchestrator {
   get fastGatewayLlm(): FallbackLlmClient | null {
     return this._fastGatewayLlm;
   }
-
   getConsoleFaithfulnessDistribution(): FaithfulnessGateCounters | undefined {
     return this.recallIntrospection.getConsoleFaithfulnessDistribution(
     );
@@ -701,7 +705,13 @@ export class Orchestrator {
   // Batched access-tracking counts and timestamps (Phase 1A).
   private accessTrackingBuffer: Map<
     string,
-    { count: number; lastAccessed: string }
+    {
+      memoryId: string;
+      memoryPath?: string;
+      namespace?: string;
+      count: number;
+      lastAccessed: string;
+    }
   > = new Map();
 
   // Passive correction capture (issue #1581) — dedup state + lazy service.
@@ -822,6 +832,7 @@ export class Orchestrator {
         hasContentHashDedup: (targetStorage, content) => this.hasContentHashDedup(targetStorage, content),
         backfillTemporalBoundsOnDedupHit: (targetStorage, dedupContent, bounds, entityRef, sourceConnector) =>
           this.backfillTemporalBoundsOnDedupHit(targetStorage, dedupContent, bounds, entityRef, sourceConnector),
+        // Removal-aware reconciling save serializes append vs removal (issue #1909).
         saveContentHashIndexes: () => this.saveContentHashIndexes(),
         artifactTypeForCategory: (category) => this.artifactTypeForCategory(category),
         loadRoutingRules: () => this.loadRoutingRules(),
@@ -927,12 +938,10 @@ export class Orchestrator {
       this.deferredInitAbort = null;
     }
   }
-
   /** Track a recall-side write so destroy() can wait for it before teardown. @internal */
   trackRecallBackgroundWrite(promise: Promise<void>, label: string): void {
     trackRecallWrite(this, promise, label);
   }
-
   /**
    * Stop background initialization and release runtime-owned handles.
    * Long-lived hosts should call this from their shutdown path; one-shot
@@ -948,28 +957,63 @@ export class Orchestrator {
     }
     this.maintenanceScheduler.dispose();
     await drainRecallWrites(this);
-    // Issue #1903: flush any coalesced namespace-catalog touches before teardown
-    // so a long-lived host does not drop buffered read/write timestamps.
-    await this.namespaceCatalog.flushPendingTouches().catch(() => undefined);
-    await this.namespaceSearchRouter.dispose();
-    await (this.qmd as { dispose?: () => void | Promise<void> }).dispose?.();
-    if (this.conversationQmd && this.conversationQmd !== this.qmd) {
-      await (this.conversationQmd as { dispose?: () => void | Promise<void> }).dispose?.();
+    // PR #2016 finding 3: drain any deferred lock-timeout hash-index retries so a
+    // short-lived writer's durable fact hash reaches disk before the process
+    // exits. The per-index background retry is unref'd (it never keeps a
+    // long-lived host alive), so a one-shot CLI could exit before it fires; this
+    // drives it to completion inline at the shutdown boundary. Best-effort.
+    await this.persistenceIndexCoordinator
+      .drainContentHashReconcileRetries()
+      .catch((err) => log.warn(`content-hash reconcile drain failed during destroy: ${err}`));
+    // Issue #1909: persist any turns buffered within the debounce window BEFORE
+    // flushing catalog touches (review round 11 finding 2). The buffer save fires
+    // a coalesced namespace-catalog touch on an unref'd timer; flushing touches
+    // first would let that shutdown-time touch queue after the flush and be lost.
+    // Ordering it before flushPendingTouches folds the buffer-save's touch into
+    // the flush below so both settle before destroy() returns.
+    //
+    // Graceful-shutdown durability contract (review round 14): the flush runs
+    // with throwOnFailure so a failed buffer write is NOT silently swallowed.
+    // flushPendingSave keeps the save pending on failure (in-memory turns are
+    // retained), so we finish the rest of teardown in a finally block and then
+    // rethrow — the host learns buffered turns did not reach disk instead of
+    // destroy() reporting a clean shutdown and losing them on exit.
+    let bufferFlushError: unknown;
+    try {
+      await this.buffer.flushPendingSave({ throwOnFailure: true });
+    } catch (err) {
+      bufferFlushError = err;
+    }
+    try {
+      // Issue #1903: flush any coalesced namespace-catalog touches before teardown
+      // so a long-lived host does not drop buffered read/write timestamps.
+      await this.namespaceCatalog.flushPendingTouches().catch(() => undefined);
+      this.prioritizedEmbedding?.dispose();
+      await this.namespaceSearchRouter.dispose();
+      await (this.qmd as { dispose?: () => void | Promise<void> }).dispose?.();
+      if (this.conversationQmd && this.conversationQmd !== this.qmd) {
+        await (this.conversationQmd as { dispose?: () => void | Promise<void> }).dispose?.();
+      }
+      // Issue #1674: terminate archive-scoring worker threads on destroy.
+      await disposeDefaultArchiveScoring();
+    } finally {
+      if (bufferFlushError !== undefined) {
+        log.warn(
+          `orchestrator.destroy: buffer flush failed; pending turns retained in memory but not persisted: ${String(bufferFlushError)}`,
+        );
+        throw bufferFlushError;
+      }
     }
-    // Issue #1674: terminate archive-scoring worker threads on destroy.
-    await disposeDefaultArchiveScoring();
   }
 
   /** Set per-session workspace for the next recall() call (compaction reset). @internal */
   setRecallWorkspaceOverride(sessionKey: string, dir: string): void {
     this._recallWorkspaceOverrides.set(sessionKey, dir);
   }
-
   /** Remove a per-session workspace selection (cleanup on error or early return). @internal */
   clearRecallWorkspaceOverride(sessionKey: string): void {
     this._recallWorkspaceOverrides.delete(sessionKey);
   }
-
   resolvePrincipal(sessionKey?: string): string | undefined {
     return resolvePrincipal(sessionKey, this.config);
   }
@@ -1249,23 +1293,26 @@ export class Orchestrator {
   ): Promise<ContentHashIndex | null> {
     if (!resolveRecallAuxiliaryCapabilities(this.config).factDeduplication) return null;
 
+    // Round 12: share the StorageManager's corpus-AUTHORITATIVE fact-hash index
+    // (rebuilt from the .md corpus on first use per process) instead of loading a
+    // separate, possibly-stale fact-hashes.txt. This makes the orchestrator's
+    // dedup layer and StorageManager.hasFactContentHash() one coherent source:
+    // after a crash before the deferred batch save, the restart rebuild includes
+    // the durable fact, so hasContentHashDedup() sees it and persistExtraction
+    // does not re-create it. We still cache the reference so saveContentHashIndexes
+    // persists exactly the shared instance.
+    // PR #2016: use the shared (best-effort) accessor, not the throwing
+    // authoritative one — the shared instance must be available for registration
+    // add/remove even under lock contention (it reconciles to disk via the
+    // deferred retry). The dedup READ path (extraction-persist) gates a MISS on
+    // isFactContentHashAuthoritative() and confirms against the corpus, so a
+    // non-authoritative snapshot never causes a false dedup miss.
+    const index = await targetStorage.getSharedFactHashIndex();
     if (targetStorage.dir === this.storage.dir) {
-      if (!this.contentHashIndex) {
-        this.contentHashIndex = this.storage.createContentHashIndex();
-        await this.contentHashIndex.load();
-      }
-      return this.contentHashIndex;
+      this.contentHashIndex = index;
+    } else {
+      this.contentHashIndexesByStorageDir.set(targetStorage.dir, index);
     }
-
-    const cached = this.contentHashIndexesByStorageDir.get(targetStorage.dir);
-    if (cached) return cached;
-
-    const index = targetStorage.createContentHashIndex();
-    await index.load();
-    this.contentHashIndexesByStorageDir.set(targetStorage.dir, index);
-    log.info(
-      `content-hash dedup: loaded ${index.size} hashes for storage ${targetStorage.dir}`,
-    );
     return index;
   }
 
@@ -1327,8 +1374,7 @@ export class Orchestrator {
   }
 
   private async saveContentHashIndexes(): Promise<void> {
-    return this.persistenceIndexCoordinator.saveContentHashIndexes(
-    );
+    return this.persistenceIndexCoordinator.saveContentHashIndexes();
   }
 
   constructor(config: PluginConfig) {
@@ -1338,12 +1384,16 @@ export class Orchestrator {
     // — including the ephemeral ones recall sub-stages build over the same dir
     // — honors the operator's setting. Destructured (not `config.<flag>`) so
     // this single access-layer read stays off the scattered-flag ratchet.
-    const { hotMemoriesCacheEnabled } = config;
+    const { hotMemoriesCacheEnabled, scopedCacheInvalidationEnabled } = config;
     StorageManager.setHotMemoriesCacheDefault(
       config.memoryDir,
       hotMemoriesCacheEnabled,
       config.hotMemoriesCacheTtlMs,
     );
+    // Register the #1904 scope-invalidation gate for this dir so every
+    // StorageManager over it (including ephemeral recall sub-stage instances)
+    // honors the operator's rollback lever.
+    StorageManager.setScopedCacheInvalidationDefault(config.memoryDir, scopedCacheInvalidationEnabled);
     this.profiler = new ProfilingCollector({
       enabled: resolvePipelineProcessingCapabilities(this.config).profiling,
       storageDir: config.profilingStorageDir || path.join(config.memoryDir, "profiling"),
@@ -1414,15 +1464,28 @@ export class Orchestrator {
       // and writes will throw SecureStoreLockedError via resolveWriteKey().
     }
     this.qmd = createSearchBackend(config);
+    // #2019: prioritized embedding for write-path searchability.
+    const qmdCaps = resolveQmdCapabilities(config);
+    if (qmdCaps.qmd && qmdCaps.qmdAutoEmbed) {
+      this.prioritizedEmbedding = installPrioritizedEmbedding(
+        (namespace) => this.namespaceSearchRouter.backendForNamespace(namespace),
+        (msg) => log.debug(msg),
+      );
+      const defaultNs = this.config.defaultNamespace;
+      this.storage.onMemoryWrite = (filePath) => this.prioritizedEmbedding?.enqueue(filePath, defaultNs);
+      this.storageRouter.onStorageCreated = (storage, namespace) => {
+        storage.onMemoryWrite = (filePath) => this.prioritizedEmbedding?.enqueue(filePath, namespace);
+      };
+      this.storageRouter.forEachCachedStorage((storage, namespace) => {
+        storage.onMemoryWrite = (filePath) => this.prioritizedEmbedding?.enqueue(filePath, namespace);
+      });
+    }
     this.maintenanceScheduler = new MaintenanceScheduler({
       config,
-      // Live accessor: the orchestrator reassigns this.qmd to NoopSearchBackend
-      // after construction when the collection is missing (initialize /
-      // startupSearchSync); the scheduler must read the current backend so
-      // debounced maintenance never runs against a stale/disposed one.
       getQmd: () => this.qmd,
       namespaceSearchRouter: this.namespaceSearchRouter,
       namespaceCatalog: this.namespaceCatalog,
+      getStorage: () => this.storage, storageForNamespace: (namespace) => this.storageRouter.storageFor(namespace),
     });
     // Issue #1526: background extraction queue lives on its own coordinator.
     this.extractionQueueCoordinator = new ExtractionQueueCoordinator();
@@ -1457,8 +1520,8 @@ export class Orchestrator {
     this.recallRerankCoordinator = new RecallRerankCoordinator({
       getConfig: () => this.config,
       getStorage: (namespace) => this.getStorage(namespace),
-      readQmdResultMemory: (resultPath, fallbackStorage, recallNamespaces) =>
-        this.readQmdResultMemory(resultPath, fallbackStorage, recallNamespaces),
+      readQmdResultMemory: (resultPath, fallbackStorage, recallNamespaces, preferredNamespace) =>
+        this.readQmdResultMemory(resultPath, fallbackStorage, recallNamespaces, preferredNamespace),
     });
     this.recallSectionCoordinator = new RecallSectionCoordinator({
       getConfig: () => this.config,
@@ -1484,12 +1547,15 @@ export class Orchestrator {
         this.resolveColdQmdResultForRecall(result, fallbackStorage, recallNamespaces),
       storageForAbsoluteQmdResultPath: (resultPath, fallbackStorage, recallNamespaces) =>
         this.storageForAbsoluteQmdResultPath(resultPath, fallbackStorage, recallNamespaces),
-      readQmdResultMemory: (resultPath, fallbackStorage, recallNamespaces) =>
-        this.readQmdResultMemory(resultPath, fallbackStorage, recallNamespaces),
+      readQmdResultMemory: (resultPath, fallbackStorage, recallNamespaces, preferredNamespace) =>
+        this.readQmdResultMemory(resultPath, fallbackStorage, recallNamespaces, preferredNamespace),
     });
     this.relevance = new RelevanceStore(config.memoryDir);
     this.negatives = new NegativeExampleStore(config.memoryDir);
-    this.lastRecall = new LastRecallStore(config.memoryDir);
+    this.lastRecall = new LastRecallStore(config.memoryDir, {
+      impressionsRotateBytes: config.recallImpressionsRotateBytes,
+      impressionsRotateKeep: config.recallImpressionsRotateKeep,
+    });
     this.handleHistory = new RecallHandleHistoryStore(config.memoryDir, {
       maxDepth: config.recallHandleSnapshotDepth,
     });
@@ -1512,6 +1578,7 @@ export class Orchestrator {
           config.hotMemoriesCacheEnabled,
           config.hotMemoriesCacheTtlMs,
         );
+        StorageManager.setScopedCacheInvalidationDefault(parentDir, scopedCacheInvalidationEnabled);
         return new StorageManager(parentDir, config.entitySchemas, config.hotMemoriesCacheEnabled);
       },
     });
@@ -1531,7 +1598,7 @@ export class Orchestrator {
       getConfig: () => this.config,
       storageFor: (namespace) => this.storageRouter.storageFor(namespace),
       storageDirNamespace: (storageDir) => this.storageDirNamespace(storageDir),
-      qmdCollectionNamespaceFromPrefix: (prefix) => this.qmdCollectionNamespaceFromPrefix(prefix),
+      qmdCollectionNamespaceFromPrefix: (prefix) => computeQmdCollectionNamespaceFromPrefix(prefix, this.config),
       namespaceFromPath: (p) => this.namespaceFromPath(p),
     });
 
@@ -2004,7 +2071,6 @@ export class Orchestrator {
     });
   }
 
-
   async applyBehaviorRuntimePolicy(
     state: BehaviorLoopPolicyState,
   ): Promise<{
@@ -2605,14 +2671,16 @@ export class Orchestrator {
   }
 
   private appendRecallSection(
-    sectionBuckets: Map<string, string[]>,
+    sectionBuckets: RecallSectionBuckets,
     sectionId: string,
     content: string,
+    options?: RecallSectionAppendOptions,
   ): boolean {
     return this.recallSectionCoordinator.appendRecallSection(
       sectionBuckets,
       sectionId,
       content,
+      options,
     );
   }
 
@@ -2631,7 +2699,7 @@ export class Orchestrator {
   }
 
   private assembleRecallSections(
-    sectionBuckets: Map<string, string[]>,
+    sectionBuckets: RecallSectionBuckets,
     budgetOverride?: number,
   ): {
     sections: string[];
@@ -2639,6 +2707,10 @@ export class Orchestrator {
     omittedIds: string[];
     truncated: boolean;
     finalChars: number;
+    includedMemoryIds: string[];
+    includedMemoryPaths: string[];
+    includedMemoryNamespaces: Array<string | undefined>;
+    omittedMemoryIds: string[];
   } {
     return this.recallSectionCoordinator.assembleRecallSections(
       sectionBuckets,
@@ -2646,7 +2718,6 @@ export class Orchestrator {
     );
   }
 
-
   /**
    * Clock source for the shared post-retrieval assembly/enrichment budget. The
    * deadline is set from this value and every expiry check reads it back, so a
@@ -3084,8 +3155,7 @@ export class Orchestrator {
   requestQmdMaintenanceForTool(reason: string): void {
     this.maintenanceScheduler.requestQmdMaintenanceForTool(reason);
   }
-
-  private async persistExtraction(
+  async persistExtraction(
     result: ExtractionResult,
     storage: StorageManager,
     threadIdForExtraction?: string | null,
@@ -3096,8 +3166,8 @@ export class Orchestrator {
     sourceText?: string,
     graphCaps: GraphConstructionCapabilitySet = resolveGraphConstructionCapabilities(this.config),
     lifecycleCaps: MemoryLifecycleCapabilitySet = resolveMemoryLifecycleCapabilities(this.config),
-  ): Promise<string[]> {
-    return this.extractionPersistCoordinator.persistExtraction(
+  ): Promise<{ persistedIds: string[]; memoryPathById: Map<string, string> }> {
+    const { persistedIds, memoryPathById } = await this.extractionPersistCoordinator.persistExtraction(
       result,
       storage,
       threadIdForExtraction,
@@ -3108,6 +3178,7 @@ export class Orchestrator {
       graphCaps,
       lifecycleCaps,
     );
+    return { persistedIds, memoryPathById };
   }
   /**
    * Append persisted ids to the thread episode set, excluding pending_review
@@ -3210,7 +3281,6 @@ export class Orchestrator {
     return this.compressionGuidelineCoordinator.buildCompressionGuidelineRecallSection();
   }
 
-
   async runLifecyclePolicyNow(storage: StorageManager = this.storage): Promise<{ memoriesAssessed: number }> {
     const lifecycleCorpus = await storage.readAllMemories();
     // Record the catalog write when the pass rewrote any frontmatter (codex NR-tS).
@@ -3345,7 +3415,7 @@ export class Orchestrator {
   private publishRecallResults(options: {
     title: string;
     results: QmdSearchResult[];
-    sectionBuckets: Map<string, string[]>;
+    sectionBuckets: RecallSectionBuckets;
     retrievalQuery: string;
     sessionKey: string | undefined;
     identityInjection?: {
@@ -3370,41 +3440,13 @@ export class Orchestrator {
     );
   }
 
-  /**
-   * Apply MMR over the pre-truncation recall candidate pool and then slice
-   * the result to `limit`. This is the single place in the pipeline where
-   * MMR runs, and it must be called *before* callers throw away candidates
-   * that would otherwise sit below the final cutoff. Running MMR post-slice
-   * is a no-op in the cases we care about — diverse candidates just below
-   * the cutoff are already gone and can never be promoted.
-   *
-   * Callers must pass the full candidate pool (post-rerank, pre-slice).
-   */
-  private qmdCollectionNamespaceFromPrefix(collectionPrefix: string): string | null {
-    const baseCollection = this.config.qmdCollection;
-    if (collectionPrefix === baseCollection) return this.config.defaultNamespace;
-    const namespaceSuffix = collectionPrefix.startsWith(`${baseCollection}--`)
-      ? collectionPrefix.slice(baseCollection.length + 2)
-      : "";
-    if (!namespaceSuffix) return null;
-
-    const decoded = namespaceIdentityFromToken(namespaceSuffix);
-    if (decoded !== null) return decoded || this.config.defaultNamespace;
-    if (namespaceSuffix.startsWith("ns--")) {
-      const legacyNamespace = namespaceSuffix.slice("ns--".length).trim();
-      return legacyNamespace || null;
-    }
-    return null;
-  }
-
-  // Issue #1526 seam 11: QMD result-resolution methods moved to QmdResultResolver.
-  // Thin delegation keeps the private API stable for callers + tests.
   private async readQmdResultMemory(
     resultPath: string,
     fallbackStorage: StorageManager,
     recallNamespaces: readonly string[] = [],
+    preferredNamespace?: string,
   ): Promise<MemoryFile | null> {
-    return this.qmdResultResolver.readQmdResultMemory(resultPath, fallbackStorage, recallNamespaces);
+    return this.qmdResultResolver.readQmdResultMemory(resultPath, fallbackStorage, recallNamespaces, preferredNamespace);
   }
 
   private async resolveColdQmdResultForRecall(
@@ -3428,18 +3470,20 @@ export class Orchestrator {
   private async applyMemoryWorthRerank(
     results: QmdSearchResult[],
     namespaces: string[],
+    preloadedFrontmatter?: ReadonlyMap<string, MemoryFile>,
   ): Promise<QmdSearchResult[]> {
-    return this.recallRerankCoordinator.applyMemoryWorthRerank(results, namespaces);
+    return this.recallRerankCoordinator.applyMemoryWorthRerank(results, namespaces, preloadedFrontmatter);
   }
 
   private async applyTrustScoreRerank(
     results: QmdSearchResult[],
     namespaces: string[],
+    preloadedFrontmatter?: ReadonlyMap<string, MemoryFile>,
   ): Promise<{
     results: QmdSearchResult[];
     trustByPath: Map<string, TrustStageResultItem> | null;
   }> {
-    return this.recallRerankCoordinator.applyTrustScoreRerank(results, namespaces);
+    return this.recallRerankCoordinator.applyTrustScoreRerank(results, namespaces, preloadedFrontmatter);
   }
 
   private async applyTrustScoreToBranch(
@@ -3447,11 +3491,20 @@ export class Orchestrator {
     namespaces: string[],
     caps: CapabilitySet,
     label: string,
+    preloadedFrontmatter?: ReadonlyMap<string, MemoryFile>,
+    abortSignal?: AbortSignal,
   ): Promise<{
     results: QmdSearchResult[];
     trustByPath: Map<string, TrustStageResultItem> | null;
   }> {
-    return this.recallRerankCoordinator.applyTrustScoreToBranch(results, namespaces, caps, label);
+    return this.recallRerankCoordinator.applyTrustScoreToBranch(
+      results,
+      namespaces,
+      caps,
+      label,
+      preloadedFrontmatter,
+      abortSignal,
+    );
   }
 
   private diversifyAndLimitRecallResults(
@@ -3480,13 +3533,17 @@ export class Orchestrator {
     finalContextChars?: number;
     truncated?: boolean;
     includedSections?: string[];
+    includedMemoryIds?: string[];
+    includedMemoryPaths?: string[];
+    includedMemoryNamespaces?: Array<string | undefined>;
+    omittedMemoryIds?: string[];
     omittedSections?: string[];
   }): LastRecallBudgetSummary {
     return this.recallSectionCoordinator.buildLastRecallBudgetSummary(options);
   }
 
   private collectLastRecallSources(
-    sectionBuckets: Map<string, string[]>,
+    sectionBuckets: RecallSectionBuckets,
     recallSource:
       | "none"
       | "hot_qmd"
@@ -3530,34 +3587,7 @@ export class Orchestrator {
     pathPrefix?: string;
     pathExcludePrefixes?: readonly string[];
   } {
-    if (!resolveNamespaceCapabilities(this.config).namespaces) return {};
-    const memoryDir = path.resolve(this.config.memoryDir);
-    const storageDir = path.resolve(targetStorage.dir);
-    if (storageDir === memoryDir) {
-      // Default namespace at legacy root. Include everything that isn't
-      // under `namespaces/*` (those belong to other namespaces).
-      return { pathExcludePrefixes: ["namespaces/"] };
-    }
-    let rel = path.relative(memoryDir, storageDir);
-    if (!rel || rel.startsWith("..")) {
-      // Round 12 fix (PR #399 thread PRRT_kwDORJXyws56U6Gj): when
-      // targetStorage.dir is outside memoryDir (custom namespace routing),
-      // toMemoryRelativePath() stores the absolute file path in the index
-      // rather than a memoryDir-relative path. Return the absolute storageDir
-      // as the pathPrefix so the search() filter still scopes the lookup to
-      // the correct tenant's files. Previously this returned {} (no scoping),
-      // which let high-similarity hits from other namespaces' absolute-path
-      // entries suppress writes in the target namespace — a cross-tenant
-      // dedup suppression path.
-      log.debug(
-        `semantic dedup: target storage dir ${storageDir} is outside memoryDir ${memoryDir}; scoping lookup to absolute path prefix`,
-      );
-      const absPrefix = storageDir.replace(/\\/g, "/");
-      return { pathPrefix: absPrefix.endsWith("/") ? absPrefix : `${absPrefix}/` };
-    }
-    rel = rel.replace(/\\/g, "/");
-    if (!rel.endsWith("/")) rel = `${rel}/`;
-    return { pathPrefix: rel };
+    return computeSemanticDedupScope(targetStorage, this.config);
   }
 
   private async searchEmbeddingFallback(
@@ -3640,27 +3670,16 @@ export class Orchestrator {
    * Record that memories were accessed (retrieved).
    * Updates are batched in memory and flushed during consolidation.
    */
-  trackMemoryAccess(memoryIds: string[]): void {
-    if (!resolveRecallEnhancementCapabilities(this.config).accessTracking) return;
-
-    const now = new Date().toISOString();
-    for (const id of memoryIds) {
-      const existing = this.accessTrackingBuffer.get(id);
-      this.accessTrackingBuffer.set(id, {
-        count: (existing?.count ?? 0) + 1,
-        lastAccessed: now,
-      });
-    }
-
-    // Flush if buffer exceeds max size
-    if (
-      this.accessTrackingBuffer.size >= this.config.accessTrackingBufferMaxSize
-    ) {
-      this.trackRecallBackgroundWrite(
-        this.flushAccessTracking(),
-        "background access tracking flush",
-      );
-    }
+  trackMemoryAccess(
+    memoryIds: string[],
+    memoryPaths: string[] = [],
+    memoryNamespaces: Array<string | undefined> = [],
+  ): void {
+    this.workspaceOpsCoordinator.trackMemoryAccess(
+      memoryIds,
+      memoryPaths,
+      memoryNamespaces,
+    );
   }
 
   async flushAccessTracking(): Promise<void> {
@@ -3753,15 +3772,10 @@ export class Orchestrator {
     );
   }
 
-  /**
-   * Extract memory IDs from QMD search results for access tracking.
-   */
   private extractMemoryIdsFromResults(results: QmdSearchResult[]): string[] {
-    // QMD results have paths like /path/to/fact-123.md
-    // Extract the ID from the filename
     return results
       .map((r) => {
-        const match = r.path.match(/([^/]+)\.md$/);
+        const match = r.path.match(/([^/\\]+)\.md$/);
         return match ? match[1] : null;
       })
       .filter((id): id is string => id !== null);
@@ -3795,6 +3809,10 @@ export class Orchestrator {
     return this.lastRecall.get(sessionKey);
   }
 
+  async drainPendingRecallImpressions() {
+    return this.lastRecall.drainPendingImpressions();
+  }
+
   /**
    * Issue #1582 — resolve a memory handle (`[m:4f2a]` / bare hex) to its memory
    * id against THIS session's recent recall history. Returns the id on a unique
@@ -3942,7 +3960,6 @@ export class Orchestrator {
    * and inline-note writes were missing from `writtenSince`/maintenance).
    */
 
-
   // markCatalogRead removed — use storageRouter.recordRead() instead (#1522).
 
   private async readAllMemoriesForNamespaces(
@@ -3952,7 +3969,6 @@ export class Orchestrator {
       namespaces,
     );
   }
-
   private async readArchivedMemoriesForNamespaces(
     namespaces: string[],
   ): Promise<MemoryFile[]> {