Summary

Fixes #90361.

memory_search intermittently returned disabled/unavailable with index metadata is missing during parallel or closely overlapping calls, even though the durable builtin index was valid (CLI deep status, direct DB inspection, and fresh-manager checks all showed valid metadata). The cause is a race: MemoryIndexManager.search() can kick off an async sync, and runSafeReindex() briefly swaps the live this.db to a fresh temp db (resetting vector/FTS state before metadata is written). A concurrent status() / tool-wrapper read during that window refreshes index identity from the temp db, finds no metadata, and fails closed with index metadata is missing — while the real index is fine.

What changed

extensions/memory-core/src/memory/manager-sync-ops.ts — add a reindexInProgress flag, set for the duration of runSafeReindex's atomic temp-db swap and always cleared in a finally.

extensions/memory-core/src/memory/manager.ts — in refreshIndexIdentityDirty, while reindexInProgress is set, a transient missing no longer overwrites a previously valid identity; the last stable identity is returned instead. Real mismatches — and missing outside a rebuild — still propagate, so genuine provider/model/settings drift keeps failing closed.

extensions/memory-core/src/memory/index.test.ts — deterministic regression test: it drives a real safe (atomic) reindex and reads status() from inside the reindex build, after the temp db has been swapped in, asserting the durable identity stays valid.

Real behavior proof

Behavior addressed: A status() read concurrent with a safe reindex's temp-db swap keeps returning the durable valid identity instead of a transient missing, so memory_search no longer fails closed mid-rebuild. Real provider/model/settings mismatches and durable-missing states still fail closed.

Real environment tested: Local worktree of origin/main at base 118060157d, Node v22.22.0. Drove the real MemoryIndexManager over a real on-disk SQLite index via node scripts/run-vitest.mjs (the actual production reindex + status paths, no manager mocks). The concurrent status() is read from inside the real reindex build, while the real temp db is swapped in.

Exact steps or command run after this patch:

# Concurrent status() during a real safe (atomic) reindex:
node scripts/run-vitest.mjs run extensions/memory-core/src/memory/index.test.ts -t "concurrent status"
# Baseline measured by git-stashing the manager.ts guard and re-running the same test.

Evidence after fix: With the guard reverted (origin manager.ts), the same test fails — the concurrent read sees the temp db, reproducing the issue:

AssertionError: expected { status: 'missing', … } to deeply equal { status: 'valid' }
+   "reason": "index metadata is missing",
+   "status": "missing",

With the fix applied:

Test Files  1 passed (1)
     Tests  1 passed | 34 skipped (35)

Observed result after fix: During a real safe reindex (temp db swapped in), status().custom.indexIdentity stays { status: "valid" } instead of { status: "missing", reason: "index metadata is missing" }. The transient missing reported by the issue is gone; durable-missing and real mismatch still surface.

What was not tested: No live OpenClaw v2026.6.1 end-to-end reproduction across multiple OS/providers; the change is in the deterministic manager identity-refresh path, exercised directly against the real manager and SQLite index. The fix is scoped to the manager identity layer (not a tool-wrapper-only mitigation), preserving real mismatch fail-closed as requested in the issue review.

Validation (supplemental)

• index.test.ts + tools.test.ts + manager-reindex-state.test.ts → 59 passed; manager.async-search.test.ts → 3 passed
• tsgo:extensions:test → no new errors in changed files; oxlint → clean