diff --git a/apps/server/src/modules/agent/agent-node.service.ts b/apps/server/src/modules/agent/agent-node.service.ts
index 74b072e71..7855910e1 100644
--- a/apps/server/src/modules/agent/agent-node.service.ts
+++ b/apps/server/src/modules/agent/agent-node.service.ts
@@ -25,7 +25,7 @@ import {
 import { getLogger } from '../../utils/logger.js';
 import { executeCanvasCommandsOnHost } from '../canvas/canvas-command-router.js';
 import { buildSpatialBundle } from '../canvas/canvas-spatial.js';
-import { getCanvasStore } from '../storage/index.js';
+import { readCanvas } from '../canvas/space-read.js';
 
 import type { ExecuteOnServerOutput } from '../canvas/canvas-executor.js';
 
@@ -87,7 +87,9 @@ interface StoredNode {
 
 interface AgentNodeServiceDependencies {
   getProfileRegistry: () => AgentProfileRegistryPort | null;
-  readCanvasNodes: (canvasId: string) => StoredNode[] | null;
+  readCanvasNodes: (
+    canvasId: string,
+  ) => Promise<StoredNode[] | null> | StoredNode[] | null;
   execute: (input: {
     canvasId: string;
     commands: readonly CanvasCommand[];
@@ -95,8 +97,10 @@ interface AgentNodeServiceDependencies {
   }) => Promise<ExecuteOnServerOutput>;
 }
 
-function defaultReadCanvasNodes(canvasId: string): StoredNode[] | null {
-  const canvas = getCanvasStore(canvasId).read();
+async function defaultReadCanvasNodes(
+  canvasId: string,
+): Promise<StoredNode[] | null> {
+  const canvas = await readCanvas(canvasId);
   if (!canvas) return null;
   return canvas.state.nodes as StoredNode[];
 }
@@ -153,11 +157,11 @@ function resolveAnchor(
   return nodeId;
 }
 
-export function resolveAgentNodePosition(
+export async function resolveAgentNodePosition(
   canvasId: string,
   parentNodeId?: CanvasNodeId,
-): Point {
-  const canvas = getCanvasStore(canvasId).read();
+): Promise<Point> {
+  const canvas = await readCanvas(canvasId);
   if (!canvas) {
     throw new AgentNodeCreationError(
       'canvas_not_found',
@@ -201,7 +205,7 @@ export class AgentNodeService {
       throw error;
     }
 
-    const nodes = this.dependencies.readCanvasNodes(input.canvasId);
+    const nodes = await this.dependencies.readCanvasNodes(input.canvasId);
     if (!nodes) {
       throw new AgentNodeCreationError(
         'canvas_not_found',
diff --git a/apps/server/src/modules/agent/agent-thread-resolver.test.ts b/apps/server/src/modules/agent/agent-thread-resolver.test.ts
index 20f1a9b5b..630e2d8d5 100644
--- a/apps/server/src/modules/agent/agent-thread-resolver.test.ts
+++ b/apps/server/src/modules/agent/agent-thread-resolver.test.ts
@@ -41,8 +41,8 @@ const FIXED_NODE = {
 };
 
 describe('AgentThreadResolver', () => {
-  it('resolves a fixed external Agent Node from Canvas storage', () => {
-    const target = createResolver(
+  it('resolves a fixed external Agent Node from Canvas storage', async () => {
+    const target = await createResolver(
       [FIXED_NODE],
       'Existing prompt',
     ).resolveFixedAgentNode('canvas-a', 'thread-a');
@@ -65,36 +65,39 @@ describe('AgentThreadResolver', () => {
     });
   });
 
-  it('falls back for selectable or unrelated threads', () => {
+  it('falls back for selectable or unrelated threads', async () => {
     const selectable = {
       ...FIXED_NODE,
       data: { ...FIXED_NODE.data, agentBindingPolicy: 'selectable' },
     };
     expect(
-      createResolver([selectable]).resolveFixedAgentNode(
+      await createResolver([selectable]).resolveFixedAgentNode(
         'canvas-a',
         'thread-a',
       ),
     ).toBeNull();
     expect(
-      createResolver([FIXED_NODE]).resolveFixedAgentNode(
+      await createResolver([FIXED_NODE]).resolveFixedAgentNode(
         'canvas-a',
         'thread-other',
       ),
     ).toBeNull();
   });
 
-  it('resolves any Question Node as a possible parent', () => {
+  it('resolves any Question Node as a possible parent', async () => {
     const selectable = {
       ...FIXED_NODE,
       data: { ...FIXED_NODE.data, agentBindingPolicy: 'selectable' },
     };
     expect(
-      createResolver([selectable]).resolveAgentNodeId('canvas-a', 'thread-a'),
+      await createResolver([selectable]).resolveAgentNodeId(
+        'canvas-a',
+        'thread-a',
+      ),
     ).toBe('node-agent');
   });
 
-  it('resolves a Huabu Agent binding for invocation', () => {
+  it('resolves a Huabu Agent binding for invocation', async () => {
     const internal = {
       ...FIXED_NODE,
       data: {
@@ -103,19 +106,23 @@ describe('AgentThreadResolver', () => {
       },
     };
     expect(
-      createResolver([internal]).resolveFixedAgentNode('canvas-a', 'thread-a')
-        ?.agentBinding,
+      (
+        await createResolver([internal]).resolveFixedAgentNode(
+          'canvas-a',
+          'thread-a',
+        )
+      )?.agentBinding,
     ).toEqual({ kind: 'internal' });
   });
 
-  it('rejects duplicate threads and corrupt fixed-node metadata', () => {
+  it('rejects duplicate threads and corrupt fixed-node metadata', async () => {
     const duplicateResolver = createResolver([
       FIXED_NODE,
       { ...FIXED_NODE, id: 'node-agent-2' },
     ]);
-    expect(() =>
+    await expect(
       duplicateResolver.resolveFixedAgentNode('canvas-a', 'thread-a'),
-    ).toThrowError(
+    ).rejects.toThrowError(
       expect.objectContaining<Partial<AgentThreadResolutionError>>({
         code: 'duplicate_thread',
       }),
@@ -124,9 +131,9 @@ describe('AgentThreadResolver', () => {
     const corruptResolver = createResolver([
       { ...FIXED_NODE, data: { ...FIXED_NODE.data, agentBinding: null } },
     ]);
-    expect(() =>
+    await expect(
       corruptResolver.resolveFixedAgentNode('canvas-a', 'thread-a'),
-    ).toThrowError(
+    ).rejects.toThrowError(
       expect.objectContaining<Partial<AgentThreadResolutionError>>({
         code: 'invalid_binding',
       }),
diff --git a/apps/server/src/modules/agent/agent-thread-resolver.ts b/apps/server/src/modules/agent/agent-thread-resolver.ts
index b8afef64e..85034f2dc 100644
--- a/apps/server/src/modules/agent/agent-thread-resolver.ts
+++ b/apps/server/src/modules/agent/agent-thread-resolver.ts
@@ -14,7 +14,7 @@ import {
   InvalidAgentLaunchOverridesError,
   parseAgentLaunchOverrides,
 } from './agent-launch-overrides.js';
-import { getCanvasStore } from '../storage/index.js';
+import { readCanvas, readCanvasNode } from '../canvas/space-read.js';
 
 interface StoredNode {
   id: string;
@@ -23,8 +23,13 @@ interface StoredNode {
 }
 
 interface ResolverDependencies {
-  readCanvasNodes: (canvasId: string) => StoredNode[] | null;
-  readNodeContent: (canvasId: string, nodeId: string) => string | null;
+  readCanvasNodes: (
+    canvasId: string,
+  ) => Promise<StoredNode[] | null> | StoredNode[] | null;
+  readNodeContent: (
+    canvasId: string,
+    nodeId: string,
+  ) => Promise<string | null> | string | null;
 }
 
 export interface FixedAgentNodeTarget {
@@ -55,12 +60,12 @@ export class AgentThreadResolutionError extends Error {
 }
 
 const DEFAULT_DEPENDENCIES: ResolverDependencies = {
-  readCanvasNodes: (canvasId) => {
-    const canvas = getCanvasStore(canvasId).read();
+  readCanvasNodes: async (canvasId) => {
+    const canvas = await readCanvas(canvasId);
     return canvas ? (canvas.state.nodes as StoredNode[]) : null;
   },
-  readNodeContent: (canvasId, nodeId) =>
-    getCanvasStore(canvasId).readNode(nodeId)?.content ?? null,
+  readNodeContent: async (canvasId, nodeId) =>
+    (await readCanvasNode(canvasId, nodeId))?.content ?? null,
 };
 
 /**
@@ -74,8 +79,11 @@ export class AgentThreadResolver {
     private readonly dependencies: ResolverDependencies = DEFAULT_DEPENDENCIES,
   ) {}
 
-  resolveAgentNodeId(canvasId: string, threadId: string): CanvasNodeId | null {
-    const nodes = this.dependencies.readCanvasNodes(canvasId);
+  async resolveAgentNodeId(
+    canvasId: string,
+    threadId: string,
+  ): Promise<CanvasNodeId | null> {
+    const nodes = await this.dependencies.readCanvasNodes(canvasId);
     if (!nodes) {
       throw new AgentThreadResolutionError(
         'canvas_not_found',
@@ -93,11 +101,11 @@ export class AgentThreadResolver {
     return node?.type === 'question' ? (node.id as CanvasNodeId) : null;
   }
 
-  resolveFixedAgentNode(
+  async resolveFixedAgentNode(
     canvasId: string,
     threadId: string,
-  ): FixedAgentNodeTarget | null {
-    const nodes = this.dependencies.readCanvasNodes(canvasId);
+  ): Promise<FixedAgentNodeTarget | null> {
+    const nodes = await this.dependencies.readCanvasNodes(canvasId);
     if (!nodes) {
       throw new AgentThreadResolutionError(
         'canvas_not_found',
@@ -145,7 +153,7 @@ export class AgentThreadResolver {
       throw error;
     }
 
-    const content = this.dependencies.readNodeContent(canvasId, node.id);
+    const content = await this.dependencies.readNodeContent(canvasId, node.id);
     if (content === null) {
       throw new AgentThreadResolutionError(
         'missing_node_content',
diff --git a/apps/server/src/modules/agent/agent-thread.service.test.ts b/apps/server/src/modules/agent/agent-thread.service.test.ts
index d1bfcc7c9..8fc5e4369 100644
--- a/apps/server/src/modules/agent/agent-thread.service.test.ts
+++ b/apps/server/src/modules/agent/agent-thread.service.test.ts
@@ -164,7 +164,7 @@ describe('AgentThreadService', () => {
     expect(externalBindingFromWorkloadSpec({ binding: {} })).toBeNull();
   });
 
-  it('resolves a persisted external Thread without a fixed Agent Node', () => {
+  it('resolves a persisted external Thread without a fixed Agent Node', async () => {
     const binding = {
       kind: 'external' as const,
       profileId: 'profile-selectable',
@@ -173,11 +173,11 @@ describe('AgentThreadService', () => {
     const harness = createHarness({ target: null, persistedBinding: binding });
 
     expect(
-      harness.service.resolveExternalTarget('canvas-a', 'thread-a'),
+      await harness.service.resolveExternalTarget('canvas-a', 'thread-a'),
     ).toEqual({ binding, fixedTarget: null });
   });
 
-  it('prefers the fixed Agent Node binding when one exists', () => {
+  it('prefers the fixed Agent Node binding when one exists', async () => {
     const harness = createHarness({
       persistedBinding: {
         kind: 'external',
@@ -187,7 +187,7 @@ describe('AgentThreadService', () => {
     });
 
     expect(
-      harness.service.resolveExternalTarget('canvas-a', 'thread-a'),
+      await harness.service.resolveExternalTarget('canvas-a', 'thread-a'),
     ).toEqual({ binding: TARGET.agentBinding, fixedTarget: TARGET });
   });
 
diff --git a/apps/server/src/modules/agent/agent-thread.service.ts b/apps/server/src/modules/agent/agent-thread.service.ts
index 1ab52dab2..e1896e340 100644
--- a/apps/server/src/modules/agent/agent-thread.service.ts
+++ b/apps/server/src/modules/agent/agent-thread.service.ts
@@ -34,7 +34,7 @@ interface AgentThreadServiceDependencies {
   resolveFixedAgentNode: (
     canvasId: string,
     threadId: string,
-  ) => FixedAgentNodeTarget | null;
+  ) => Promise<FixedAgentNodeTarget | null> | FixedAgentNodeTarget | null;
   resolvePersistedExternalBinding: (
     canvasId: string,
     threadId: string,
@@ -160,20 +160,20 @@ export class AgentThreadService {
     private readonly dependencies: AgentThreadServiceDependencies = DEFAULT_DEPENDENCIES,
   ) {}
 
-  resolveFixedTarget(
+  async resolveFixedTarget(
     canvasId: string | undefined,
     threadId: string,
-  ): FixedAgentNodeTarget | null {
+  ): Promise<FixedAgentNodeTarget | null> {
     return canvasId
-      ? this.dependencies.resolveFixedAgentNode(canvasId, threadId)
+      ? await this.dependencies.resolveFixedAgentNode(canvasId, threadId)
       : null;
   }
 
-  resolveExternalTarget(
+  async resolveExternalTarget(
     canvasId: string,
     threadId: string,
-  ): ExternalAgentThreadTarget | null {
-    const fixedTarget = this.resolveFixedTarget(canvasId, threadId);
+  ): Promise<ExternalAgentThreadTarget | null> {
+    const fixedTarget = await this.resolveFixedTarget(canvasId, threadId);
     if (fixedTarget) {
       return fixedTarget.agentBinding.kind === 'external'
         ? { binding: fixedTarget.agentBinding, fixedTarget }
@@ -197,7 +197,7 @@ export class AgentThreadService {
   ): Promise<AgentThreadInvocation> {
     const fixedTarget =
       options.fixedTarget === undefined
-        ? this.resolveFixedTarget(options.canvasId, options.threadId)
+        ? await this.resolveFixedTarget(options.canvasId, options.threadId)
         : options.fixedTarget;
     const binding: AgentBinding = fixedTarget?.agentBinding ??
       options.requestBinding ?? { kind: 'internal' };
diff --git a/apps/server/src/modules/agent/agent.route.ts b/apps/server/src/modules/agent/agent.route.ts
index 597a2fb53..1ce5a34e2 100644
--- a/apps/server/src/modules/agent/agent.route.ts
+++ b/apps/server/src/modules/agent/agent.route.ts
@@ -546,7 +546,7 @@ const agentRoutes: FastifyPluginAsync = async (
     } = parsed.data;
 
     const resolvedThreadId = getOrCreateThreadId(threadId);
-    const fixedTarget = agentThreadService.resolveFixedTarget(
+    const fixedTarget = await agentThreadService.resolveFixedTarget(
       canvasId,
       resolvedThreadId,
     );
diff --git a/apps/server/src/modules/agent/conversation/envelope.ts b/apps/server/src/modules/agent/conversation/envelope.ts
index f4250ec7b..0c01967e8 100644
--- a/apps/server/src/modules/agent/conversation/envelope.ts
+++ b/apps/server/src/modules/agent/conversation/envelope.ts
@@ -24,7 +24,7 @@ import { getSkill } from '../../../prompt/index.js';
 import { getNodeNeighbourhood } from '../../canvas/node-neighbourhood.js';
 import { describeNode } from '../../canvas/node-prompt.js';
 import { snapshotNodesToArtifacts } from '../../canvas/snapshot-nodes.js';
-import { getCanvasStore } from '../../storage/index.js';
+import { readCanvasNode, readCanvasNodes } from '../../canvas/space-read.js';
 import { isUserInvokableSkill } from '../skills.route.js';
 
 import type { NodeNeighbourhoodContext } from '../../canvas/node-neighbourhood.js';
@@ -205,18 +205,23 @@ function collectSketchStrokeSubsets(
  * store is unavailable, so refs fall back to bare `{ id, type, label?,
  * filename }` (no preview).
  */
-function collectSelectedNodeRefs(
+async function collectSelectedNodeRefs(
   nodes: WireSelectionNode[],
   canvasId: string | null,
-): AgentNodePreview[] {
-  let store: ReturnType<typeof getCanvasStore> | null = null;
-  if (canvasId) {
-    try {
-      store = getCanvasStore(canvasId);
-    } catch {
-      store = null;
+): Promise<AgentNodePreview[]> {
+  const selectedIds: string[] = [];
+  const collectIds = (list: WireSelectionNode[]): void => {
+    for (const n of list) {
+      selectedIds.push(n.id);
+      if (n.children) collectIds(n.children);
     }
-  }
+  };
+  collectIds(nodes);
+  // A selection is a handful of nodes; reading the whole Space to describe
+  // them would make an unrelated node somewhere else cost this request.
+  const records = canvasId
+    ? await readCanvasNodes(canvasId, selectedIds)
+    : undefined;
   const refs: AgentNodePreview[] = [];
   const walk = (list: WireSelectionNode[]) => {
     for (const n of list) {
@@ -226,7 +231,6 @@ function collectSelectedNodeRefs(
       // label + file + preview + rev for every server-side node context.
       refs.push(
         describeNode(
-          store,
           {
             id: n.id,
             type: n.type,
@@ -234,6 +238,7 @@ function collectSelectedNodeRefs(
             ...(n.src !== undefined ? { src: n.src } : {}),
           },
           'preview',
+          records?.get(n.id),
         ),
       );
       if (n.children) walk(n.children);
@@ -408,10 +413,10 @@ export async function buildChatEnvelope(
   let anchor: ChatEnvelope['focus']['anchor'];
   if (anchorNodeId && canvasId) {
     const neighbourhood =
-      getNodeNeighbourhood(canvasId, anchorNodeId) ?? undefined;
+      (await getNodeNeighbourhood(canvasId, anchorNodeId)) ?? undefined;
     let label: string | undefined;
     try {
-      const meta = getCanvasStore(canvasId).readNode(anchorNodeId) as Record<
+      const meta = (await readCanvasNode(canvasId, anchorNodeId)) as Record<
         string,
         unknown
       > | null;
@@ -463,7 +468,7 @@ export async function buildChatEnvelope(
     focus: {
       selection: {
         refs: selectedNodes
-          ? collectSelectedNodeRefs(selectedNodes, canvasId)
+          ? await collectSelectedNodeRefs(selectedNodes, canvasId)
           : [],
         selectedIds: selectedNodes ? collectSelectedNodeIds(selectedNodes) : [],
         imageAttachments: dedupedImageAttachments,
diff --git a/apps/server/src/modules/agent/memory/trigger.ts b/apps/server/src/modules/agent/memory/trigger.ts
index 6367f1c58..3eaf49a6e 100644
--- a/apps/server/src/modules/agent/memory/trigger.ts
+++ b/apps/server/src/modules/agent/memory/trigger.ts
@@ -26,7 +26,7 @@ import { existsSync } from 'node:fs';
 
 import { atomicWriteJson, mkdirp, readJson } from '../../../utils/fs.js';
 import { createKeyedMutex } from '../../../utils/keyed-mutex.js';
-import { spaceDirectory } from '../../storage/index.js';
+import { diskSpaceTree } from '../../storage/index.js';
 import { memoryStatePath, canvasMemoryDir } from '../../workspace/paths.js';
 
 /** Op-count threshold that triggers a memory analysis pass. */
@@ -83,7 +83,7 @@ export function writeMemoryState(canvasId: string, state: MemoryState): void {
   // file. Same hazard for any in-flight memory worker that calls
   // `markAnalyzed` post-delete. Skip the write when the canvas root
   // is gone; losing one bookkeeping write is harmless.
-  if (!existsSync(spaceDirectory(canvasId))) return;
+  if (!existsSync(diskSpaceTree(canvasId).directory())) return;
   mkdirp(canvasMemoryDir(canvasId));
   atomicWriteJson(memoryStatePath(canvasId), state);
 }
diff --git a/apps/server/src/modules/agent/tools/executor.ts b/apps/server/src/modules/agent/tools/executor.ts
index deca047e6..f63d6c75e 100644
--- a/apps/server/src/modules/agent/tools/executor.ts
+++ b/apps/server/src/modules/agent/tools/executor.ts
@@ -119,10 +119,10 @@ export async function executeTool(
   };
   const withCanvasId = <T>(value: Record<string, unknown>, toolName: string) =>
     ({ ...value, canvasId: requireCanvasId(toolName) }) as unknown as T;
-  const withReadCanvasId = <T>(
+  const withReadCanvasId = async <T>(
     value: Record<string, unknown>,
     toolName: string,
-  ): T => {
+  ): Promise<T> => {
     const ownerCanvasId = requireCanvasId(toolName);
     const requested = value.targetCanvasId;
     if (requested !== undefined && typeof requested !== 'string') {
@@ -131,7 +131,7 @@ export async function executeTool(
     const { targetCanvasId: _targetCanvasId, ...toolArgs } = value;
     return {
       ...toolArgs,
-      canvasId: resolveWorldReadCanvasId(ownerCanvasId, requested),
+      canvasId: await resolveWorldReadCanvasId(ownerCanvasId, requested),
     } as unknown as T;
   };
 
@@ -141,31 +141,31 @@ export async function executeTool(
 
     case 'get_space_outline':
       return handleGetCanvasOutline(
-        withReadCanvasId<GetCanvasOutlineArgs>(args, 'get_space_outline'),
+        await withReadCanvasId<GetCanvasOutlineArgs>(args, 'get_space_outline'),
       );
 
     case 'inspect_nodes':
       return handleInspectNodes(
-        withReadCanvasId<InspectNodesArgs>(args, 'inspect_nodes'),
+        await withReadCanvasId<InspectNodesArgs>(args, 'inspect_nodes'),
       );
 
     case 'inspect_edges':
       return handleInspectEdges(
-        withReadCanvasId<InspectEdgesArgs>(args, 'inspect_edges'),
+        await withReadCanvasId<InspectEdgesArgs>(args, 'inspect_edges'),
       );
 
     case 'grep':
-      return handleGrep(withReadCanvasId<GrepArgs>(args, 'grep'));
+      return handleGrep(await withReadCanvasId<GrepArgs>(args, 'grep'));
 
     case 'find':
-      return handleFind(withReadCanvasId<FindArgs>(args, 'find'));
+      return handleFind(await withReadCanvasId<FindArgs>(args, 'find'));
 
     case 'ls':
-      return handleLs(withReadCanvasId<LsArgs>(args, 'ls'));
+      return handleLs(await withReadCanvasId<LsArgs>(args, 'ls'));
 
     case 'read': {
       const ownerCanvasId = requireCanvasId('read');
-      const readArgs = withReadCanvasId<ReadArgs>(args, 'read');
+      const readArgs = await withReadCanvasId<ReadArgs>(args, 'read');
       return handleRead(
         readArgs,
         readArgs.canvasId === ownerCanvasId ? context?.readSet : undefined,
diff --git a/apps/server/src/modules/agent/tools/handlers/canvas-query.ts b/apps/server/src/modules/agent/tools/handlers/canvas-query.ts
index 178b7fe2a..13a268204 100644
--- a/apps/server/src/modules/agent/tools/handlers/canvas-query.ts
+++ b/apps/server/src/modules/agent/tools/handlers/canvas-query.ts
@@ -50,7 +50,7 @@ export type InspectEdgesArgs = InspectEdgesQueryParams & {
 export async function handleGetCanvasOutline(
   args: GetCanvasOutlineArgs,
 ): Promise<string> {
-  const outline = buildCanvasOutline(args.canvasId, {
+  const outline = await buildCanvasOutline(args.canvasId, {
     includePreviews: args.includePreviews,
     includeStyle: args.includeStyle,
   });
@@ -64,7 +64,7 @@ export async function handleInspectNodes(
   args: InspectNodesArgs,
 ): Promise<string> {
   const { canvasId, ...predicates } = args;
-  const result = inspectNodes(canvasId, predicates);
+  const result = await inspectNodes(canvasId, predicates);
   // `inspectNodes` returns either a result object or `{ error }` when a
   // referenced node is missing. Promote the error case to a throw so
   // pi-agent-core flags the tool result as `isError: true`.
@@ -78,7 +78,7 @@ export async function handleInspectEdges(
   args: InspectEdgesArgs,
 ): Promise<string> {
   const { canvasId, ...predicates } = args;
-  const result = inspectEdges(canvasId, predicates);
+  const result = await inspectEdges(canvasId, predicates);
   if ('error' in result) {
     throw new Error(result.error);
   }
diff --git a/apps/server/src/modules/agent/tools/handlers/fs-read.ts b/apps/server/src/modules/agent/tools/handlers/fs-read.ts
index 780da71bf..59a019b13 100644
--- a/apps/server/src/modules/agent/tools/handlers/fs-read.ts
+++ b/apps/server/src/modules/agent/tools/handlers/fs-read.ts
@@ -39,7 +39,7 @@ import { normalizeRel, safeResolve } from './fs-sandbox.js';
 import { readSkillFile, resolveSkillPath } from '../../../../prompt/index.js';
 import { parseFrontmatter } from '../../../../utils/markdown-frontmatter.js';
 import { IMAGE_MIME_MAP, isVisionImageMime } from '../../../../utils/mime.js';
-import { getCanvasStore } from '../../../storage/index.js';
+import { readCanvasNode } from '../../../canvas/space-read.js';
 import { readCanvasMemory, readWorkspaceMemory } from '../../memory/index.js';
 
 import type { readParamsSchema } from '../definitions.js';
@@ -76,25 +76,26 @@ const NODE_FILE_RE = /^nodes\/[^/]+\.md$/;
  * content, and the same revision used by executor CAS. When supplied, the
  * turn read-set receives that revision for guarded follow-up writes.
  */
-function projectNodeRead(
+async function projectNodeRead(
   rel: string,
   canvasId: string,
   fileText: string,
   readSet?: Map<string, string>,
-):
+): Promise<
   | {
       content: string;
       frontmatter: Record<string, unknown>;
       rev: string;
     }
-  | undefined {
+  | undefined
+> {
   if (!NODE_FILE_RE.test(rel)) return undefined;
   const parsed = parseFrontmatter(fileText);
   const rawId = parsed.meta['id'];
   const nodeId = typeof rawId === 'string' && rawId ? rawId : undefined;
   if (!nodeId) return undefined;
   try {
-    const nc = getCanvasStore(canvasId).readNode(nodeId);
+    const nc = await readCanvasNode(canvasId, nodeId);
     if (!nc) return undefined;
     const rev = nodeRevisionOf({
       content: nc.content,
@@ -260,7 +261,7 @@ export async function handleRead(
   }
 
   const text = buf.toString('utf8');
-  const nodeRead = projectNodeRead(rel, args.canvasId, text, readSet);
+  const nodeRead = await projectNodeRead(rel, args.canvasId, text, readSet);
   if (nodeRead) {
     return renderTextResponse(rel, nodeRead.content, offset, limit, {
       frontmatter: nodeRead.frontmatter,
diff --git a/apps/server/src/modules/agent/tools/handlers/fs-sandbox.ts b/apps/server/src/modules/agent/tools/handlers/fs-sandbox.ts
index 18b80a5ea..d822dc497 100644
--- a/apps/server/src/modules/agent/tools/handlers/fs-sandbox.ts
+++ b/apps/server/src/modules/agent/tools/handlers/fs-sandbox.ts
@@ -30,7 +30,8 @@ import { readFileSync, readdirSync, statSync, type Dirent } from 'node:fs';
 import path from 'node:path';
 
 import { parseFrontmatter } from '../../../../utils/markdown-frontmatter.js';
-import { getCanvasStore, spaceDirectory } from '../../../storage/index.js';
+import { readCanvas } from '../../../canvas/space-read.js';
+import { diskSpaceTree } from '../../../storage/index.js';
 
 // ─── Always-skipped directory names ─────────────────────────────────────────
 
@@ -143,7 +144,7 @@ export function safeResolve(canvasId: string, rel: string): string {
   ) {
     throw new Error(`Invalid canvasId: ${canvasId}`);
   }
-  const root = spaceDirectory(canvasId);
+  const root = diskSpaceTree(canvasId).directory();
   // Accept the clean virtual prefixes (`upload/`, `artifacts/`) as aliases
   // for their hidden on-disk dirs so agents can reference either form.
   const target = path.resolve(root, toPhysicalRel(rel));
@@ -290,29 +291,23 @@ export interface NodeMeta {
 }
 
 /**
- * Lazy single-Space node lookup. Reads `space.json` at most once,
- * returning a closure that maps a canvas-relative path to its
- * `NodeMeta` if it matches `nodes/<filename>.md` and can be resolved via
- * frontmatter `id:` plus `space.json` metadata.
- * Returns `null` otherwise.
+ * Single-Space node lookup: a canvas-relative path to its {@link NodeMeta},
+ * or `null` when the path is not a node file.
+ *
+ * The Space record is read up front — one small read that gives every node's
+ * type and label. Building the path index is deferred to the first lookup
+ * that could use one, because that step opens and parses every file under
+ * `nodes/` and most searches never touch a node file at all: a grep for a
+ * string that lives in `.memory/` or an uploaded document would otherwise pay
+ * for the whole Space before matching anything.
  */
-export function makeNodeLookup(
+export async function makeNodeLookup(
   canvasId: string,
-): (canvasRelPath: string) => NodeMeta | null {
-  let cache: Map<string, NodeMeta> | null = null;
-  const ensure = (): Map<string, NodeMeta> => {
-    if (cache) return cache;
-
-    const byId = new Map<string, NodeMeta>();
-    const byPath = new Map<string, NodeMeta>();
-
-    let file;
-    try {
-      file = getCanvasStore(canvasId).read();
-    } catch {
-      file = null;
-    }
-    if (file) {
+): Promise<(canvasRelPath: string) => NodeMeta | null> {
+  const byId = new Map<string, NodeMeta>();
+  try {
+    const file = await readCanvas(canvasId);
+    if (file !== null) {
       const nodes = (file.state.nodes ?? []) as Array<Record<string, unknown>>;
       for (const n of nodes) {
         const id = n.id;
@@ -323,33 +318,24 @@ export function makeNodeLookup(
         byId.set(id, { nodeId: id, nodeType, label });
       }
     }
+  } catch {
+    // File enrichment is best-effort; the path result remains usable.
+  }
 
-    let nodesRoot: string;
-    try {
-      nodesRoot = safeResolve(canvasId, 'nodes');
-    } catch {
-      cache = byPath;
-      return byPath;
-    }
-
-    let nodesStat;
-    try {
-      nodesStat = statSync(nodesRoot);
-    } catch {
-      cache = byPath;
-      return byPath;
-    }
-    if (!nodesStat.isDirectory()) {
-      cache = byPath;
-      return byPath;
-    }
+  let byPath: Map<string, NodeMeta> | null = null;
+  const indexByPath = (): Map<string, NodeMeta> => {
+    if (byPath) return byPath;
+    const index = new Map<string, NodeMeta>();
+    byPath = index;
 
+    let nodesRoot: string;
     let entries: Dirent[];
     try {
+      nodesRoot = safeResolve(canvasId, 'nodes');
+      if (!statSync(nodesRoot).isDirectory()) return index;
       entries = readdirSync(nodesRoot, { withFileTypes: true });
     } catch {
-      cache = byPath;
-      return byPath;
+      return index;
     }
 
     for (const ent of entries) {
@@ -370,16 +356,14 @@ export function makeNodeLookup(
         nodeType: undefined,
         label: undefined,
       };
-      byPath.set(`nodes/${ent.name}`, metaFromCanvas);
+      index.set(`nodes/${ent.name}`, metaFromCanvas);
     }
-
-    cache = byPath;
-    return byPath;
+    return index;
   };
 
   return (canvasRelPath) => {
     const normalized = canvasRelPath.replace(/^\.\//, '');
     if (!CANVAS_NODE_RE.test(normalized)) return null;
-    return ensure().get(normalized) ?? null;
+    return indexByPath().get(normalized) ?? null;
   };
 }
diff --git a/apps/server/src/modules/agent/tools/handlers/fs-search.ts b/apps/server/src/modules/agent/tools/handlers/fs-search.ts
index d4fe60e43..a90c68b85 100644
--- a/apps/server/src/modules/agent/tools/handlers/fs-search.ts
+++ b/apps/server/src/modules/agent/tools/handlers/fs-search.ts
@@ -168,7 +168,7 @@ export async function handleGrep(args: GrepArgs): Promise<string> {
   const globRe = effectiveGlob ? globToRegExp(effectiveGlob) : null;
   const effectiveLimit = Math.max(1, limit ?? DEFAULT_GREP_LIMIT);
   const ctxN = Math.max(0, ctxLines ?? 0);
-  const lookup = makeNodeLookup(args.canvasId);
+  const lookup = await makeNodeLookup(args.canvasId);
   const deadline = Date.now() + GREP_DEADLINE_MS;
 
   // Enumerate candidate files, recording each as a canvas-relative
@@ -289,7 +289,7 @@ export async function handleFind(args: FindArgs): Promise<string> {
   }
 
   const effectiveLimit = Math.max(1, limit ?? DEFAULT_FIND_LIMIT);
-  const lookup = makeNodeLookup(args.canvasId);
+  const lookup = await makeNodeLookup(args.canvasId);
 
   const results: Array<Record<string, unknown>> = [];
   let truncated = false;
diff --git a/apps/server/src/modules/canvas/canvas-command-router.test.ts b/apps/server/src/modules/canvas/canvas-command-router.test.ts
index 5df34ef2b..7b20588c9 100644
--- a/apps/server/src/modules/canvas/canvas-command-router.test.ts
+++ b/apps/server/src/modules/canvas/canvas-command-router.test.ts
@@ -676,13 +676,13 @@ describe('workspace canvas command routing', () => {
           ? { ...node, type: 'note' }
           : node,
       );
-    expect(() =>
+    await expect(
       assertWorldPortalTopologyAllowed(
         'canvas-world',
         brokenTopology,
         convertedDescendant,
       ),
-    ).toThrow('A node reference cannot change node type');
+    ).rejects.toThrow('A node reference cannot change node type');
 
     const output = await executeCanvasCommandsOnHost({
       canvasId: 'canvas-world',
@@ -799,13 +799,13 @@ describe('workspace canvas command routing', () => {
     expect(
       directlyLocked.find((node) => node.id === nodeRef.id)?.data,
     ).toMatchObject({ locked: true });
-    expect(() =>
+    await expect(
       assertWorldPortalTopologyAllowed(
         'canvas-world',
         directlyLocked,
         directlyLocked,
       ),
-    ).not.toThrow();
+    ).resolves.toBeUndefined();
 
     await executeCanvasCommandsOnHost({
       canvasId: 'canvas-world',
@@ -828,13 +828,13 @@ describe('workspace canvas command routing', () => {
     expect(
       portalLocked.find((node) => node.id === nodeRef.id)?.data,
     ).toMatchObject({ __dragDisabledByFrameLock: true });
-    expect(() =>
+    await expect(
       assertWorldPortalTopologyAllowed(
         'canvas-world',
         portalLocked,
         portalLocked,
       ),
-    ).not.toThrow();
+    ).resolves.toBeUndefined();
 
     await executeCanvasCommandsOnHost({
       canvasId: 'canvas-world',
@@ -887,13 +887,13 @@ describe('workspace canvas command routing', () => {
       | undefined;
     if (!copiedTarget || !target) throw new Error('Missing nodeRef target');
     target.label = 'Copied source label';
-    expect(() =>
+    await expect(
       assertWorldPortalTopologyAllowed(
         'canvas-world',
         styled ?? [],
         copiedTarget,
       ),
-    ).toThrow('contains unsupported source-owned data');
+    ).rejects.toThrow('contains unsupported source-owned data');
 
     await expect(
       executeCanvasCommandsOnHost({
@@ -932,9 +932,9 @@ describe('workspace canvas command routing', () => {
     const previous = getCanvasStore('canvas-world').read()?.state.nodes;
     if (!previous) throw new Error('Missing World state');
     const canonical = structuredClone(previous);
-    expect(() =>
+    await expect(
       assertWorldPortalTopologyAllowed('canvas-world', previous, canonical),
-    ).not.toThrow();
+    ).resolves.toBeUndefined();
 
     const resized = structuredClone(previous) as Array<{
       type?: string;
@@ -943,20 +943,22 @@ describe('workspace canvas command routing', () => {
     const portal = resized.find((node) => node.type === 'canvasRef');
     if (!portal?.style) throw new Error('Missing Portal');
     portal.style.width = (portal.style.width ?? 0) + 100;
-    expect(() =>
+    await expect(
       assertWorldPortalTopologyAllowed('canvas-world', previous, resized),
-    ).toThrow(WorldPortalMutationError);
+    ).rejects.toThrow(WorldPortalMutationError);
 
     const withoutNodeRef = (
       structuredClone(previous) as Array<{ type?: string }>
     ).filter((node) => node.type !== 'nodeRef');
-    expect(() =>
+    await expect(
       assertWorldPortalTopologyAllowed(
         'canvas-world',
         previous,
         withoutNodeRef,
       ),
-    ).toThrow('Node references must be removed with SET_PORTAL_NODE_PINS');
+    ).rejects.toThrow(
+      'Node references must be removed with SET_PORTAL_NODE_PINS',
+    );
   });
 
   it('allows moving but rejects manually resizing a frameRef', async () => {
diff --git a/apps/server/src/modules/canvas/canvas-command-router.ts b/apps/server/src/modules/canvas/canvas-command-router.ts
index fc38724ed..92793ddf5 100644
--- a/apps/server/src/modules/canvas/canvas-command-router.ts
+++ b/apps/server/src/modules/canvas/canvas-command-router.ts
@@ -23,11 +23,7 @@ import {
 } from './canvas-executor.js';
 import { reconcileWorldPortals } from './world-portals.js';
 import { createKeyedMutex } from '../../utils/keyed-mutex.js';
-import {
-  listCanvasDirEntries,
-  requireWorldCanvasId,
-} from '../storage/canvas-dirs.js';
-import { getCanvasStore } from '../storage/index.js';
+import { getStructuredStore, requireWorldCanvasId } from '../storage/index.js';
 
 type PortalCommand = Extract<CanvasCommand, { type: 'SET_PORTAL_NODE_PINS' }>;
 const withPortalRoutingMutex = createKeyedMutex<string>();
@@ -210,7 +206,9 @@ async function ensureCanonicalPortals(
   worldCanvasId: string,
   commands: readonly PortalCommand[],
 ): Promise<void> {
-  const world = getCanvasStore(worldCanvasId).read() as StoredCanvas | null;
+  const world = (await getStructuredStore()
+    .space(worldCanvasId)
+    .read()) as StoredCanvas | null;
   const targets = new Set<string>();
   for (const node of (world?.state.nodes ?? []) as NestableNode[]) {
     const target = portalTarget(node);
@@ -249,14 +247,17 @@ async function executeCanvasCommandsOnHostInternal(
 
   assertConsistentDesiredStates(portalCommands);
 
-  const worldCanvasId = requireWorldCanvasId();
+  const worldCanvasId = await requireWorldCanvasId();
   if (!routingLockHeld) {
     return withPortalRoutingMutex(worldCanvasId, () =>
       executeCanvasCommandsOnHostInternal(input, true),
     );
   }
   await ensureCanonicalPortals(worldCanvasId, portalCommands);
-  const world = getCanvasStore(worldCanvasId).read() as StoredCanvas | null;
+  const structured = getStructuredStore();
+  const world = (await structured
+    .space(worldCanvasId)
+    .read()) as StoredCanvas | null;
   if (!world || !Array.isArray(world.state.nodes)) {
     throw new CanvasCommandRoutingError('World Canvas is unavailable');
   }
@@ -335,17 +336,20 @@ async function executeCanvasCommandsOnHostInternal(
   }
 
   const liveCanvasIds = new Set(
-    listCanvasDirEntries().map((entry) => entry.id),
+    (await structured.spaces().list()).map((entry) => entry.canvasId),
   );
-  const sourceStates = new Map<string, SourceState | null>();
-  const readSource = (canvasId: string): SourceState | null => {
+  const sourceStates = new Map<string, Promise<SourceState | null>>();
+  const readSource = (canvasId: string): Promise<SourceState | null> => {
     if (!sourceStates.has(canvasId)) {
       sourceStates.set(
         canvasId,
-        sourceStateOf(getCanvasStore(canvasId).read() as StoredCanvas | null),
+        structured
+          .space(canvasId)
+          .read()
+          .then((canvas) => sourceStateOf(canvas as StoredCanvas | null)),
       );
     }
-    return sourceStates.get(canvasId) ?? null;
+    return sourceStates.get(canvasId) ?? Promise.resolve(null);
   };
 
   const requested = new Map<string, boolean>();
@@ -356,7 +360,7 @@ async function executeCanvasCommandsOnHostInternal(
         throw new MissingWorldPortalError(update.sourceCanvasId);
       }
       const source = liveCanvasIds.has(update.sourceCanvasId)
-        ? readSource(update.sourceCanvasId)
+        ? await readSource(update.sourceCanvasId)
         : null;
       for (const sourceNodeId of update.sourceNodeIds) {
         requested.set(
@@ -398,7 +402,7 @@ async function executeCanvasCommandsOnHostInternal(
 
   const sourcePositions: PreparedPortalSourcePosition[] = [];
   for (const target of positionTargets.values()) {
-    const position = readSource(target.canvasId)?.absolutePosition(
+    const position = (await readSource(target.canvasId))?.absolutePosition(
       target.nodeId,
     );
     if (!position) continue;
@@ -433,6 +437,18 @@ async function executeCanvasCommandsOnHostInternal(
     }
   };
 
+  const resolvedSources = new Map<string, SourceState | null>();
+  for (const command of portalCommands) {
+    for (const update of command.updates) {
+      if (!resolvedSources.has(update.sourceCanvasId)) {
+        resolvedSources.set(
+          update.sourceCanvasId,
+          await readSource(update.sourceCanvasId),
+        );
+      }
+    }
+  }
+
   const commands = portalCommands.map((command): CanvasCommand => {
     const pins: PreparedPortalNodePin[] = [];
     const seen = new Set<string>();
@@ -446,7 +462,7 @@ async function executeCanvasCommandsOnHostInternal(
           throw new MissingWorldPortalError(update.sourceCanvasId);
         }
         const desiredPinned = requested.get(key) ?? update.pinned;
-        const source = readSource(update.sourceCanvasId);
+        const source = resolvedSources.get(update.sourceCanvasId) ?? null;
         const sourceNode = source ? sourceNodeById(source, sourceNodeId) : null;
         const existing = preparedReferenceByTarget.get(key);
         if (!desiredPinned || !source || !sourceNode) {
diff --git a/apps/server/src/modules/canvas/canvas-executor.ts b/apps/server/src/modules/canvas/canvas-executor.ts
index 30461bec6..fffe47e8f 100644
--- a/apps/server/src/modules/canvas/canvas-executor.ts
+++ b/apps/server/src/modules/canvas/canvas-executor.ts
@@ -65,12 +65,10 @@ import {
 import { getLogger } from '../../utils/logger.js';
 import {
   canvasBlobs,
-  getCanvasStore,
   getStructuredStore,
   withCanvasMutex,
   type BlobScope,
   type CanvasFile,
-  type CanvasStore,
   type DeltaLogEntry,
   type NodeContent,
   type SpaceNodeMutation,
@@ -140,7 +138,7 @@ function stripNodesForCanvas(nodes: readonly CanvasNode[]): CanvasNode[] {
 }
 
 function hydrateNodes(
-  store: CanvasStore,
+  records: ReadonlyMap<string, NodeContent>,
   nodes: readonly CanvasNode[],
 ): CanvasNode[] {
   return nodes.map((node) => {
@@ -149,12 +147,7 @@ function hydrateNodes(
     const nodeType = typeof node.type === 'string' ? node.type : '';
     if (!MD_BACKED_NODE_TYPES.has(nodeType)) return { ...node };
 
-    let content: NodeContent | null = null;
-    try {
-      content = store.readNode(nodeId);
-    } catch {
-      content = null;
-    }
+    const content = records.get(nodeId) ?? null;
     if (!content) return { ...node };
 
     const data: Record<string, unknown> = { ...(node.data ?? {}) };
@@ -692,11 +685,7 @@ export async function executeOnServer(
   // writes to the same canvas. Idempotent for values that are already artifact
   // keys / `/api/` URLs / `data:` URIs.
   if (originator.source === 'agent') {
-    commands = await importForeignNodeSources(
-      getCanvasStore(canvasId),
-      canvasId,
-      commands,
-    );
+    commands = await importForeignNodeSources(canvasId, commands);
 
     // For image nodes with only width specified, calculate height from actual
     // image aspect ratio. This ensures correct proportions for all image sources.
@@ -704,9 +693,8 @@ export async function executeOnServer(
   }
 
   return await withCanvasMutex(canvasId, async () => {
-    const store = getCanvasStore(canvasId);
     const handle = getStructuredStore().space(canvasId);
-    const canvas = store.read();
+    const canvas = await handle.read();
     if (!canvas) throw new CanvasNotFoundError(canvasId);
 
     const fromVersion = canvas.version;
@@ -714,13 +702,19 @@ export async function executeOnServer(
     // Hydrate per-node content from .md sidecars before the engine sees
     // the prestate — handlers like MERGE_NODE_DATA need the current
     // `data.content` to merge against, but topology never carries it.
+    const nodeRecords = new Map(
+      [...(await handle.nodes.list())].map(([nodeId, snapshot]) => [
+        nodeId,
+        snapshot.record,
+      ]),
+    );
     const prestateNodes = hydrateNodes(
-      store,
+      nodeRecords,
       canvas.state.nodes as CanvasNode[],
     );
     const prestateEdges = (canvas.state.edges ?? []) as CanvasEdge[];
 
-    assertWorldPortalMutationsAllowed(
+    await assertWorldPortalMutationsAllowed(
       canvasId,
       commands,
       prestateNodes,
@@ -824,7 +818,7 @@ export async function executeOnServer(
     const sharedOut = applySharedPostEffectsFromWriteResult(writeResult);
     const finalNodes = writeResult.nodes;
     const finalEdges = sharedOut.edges;
-    assertWorldPortalResultAllowed(canvasId, prestateNodes, finalNodes);
+    await assertWorldPortalResultAllowed(canvasId, prestateNodes, finalNodes);
 
     const deltas = diffCanvasState(
       { nodes: prestateNodes, edges: prestateEdges },
@@ -1123,14 +1117,19 @@ export async function applyDeltasOnServer(input: {
   const { canvasId, originator, runId } = input;
 
   return await withCanvasMutex(canvasId, async () => {
-    const store = getCanvasStore(canvasId);
     const handle = getStructuredStore().space(canvasId);
-    const canvas = store.read();
+    const canvas = await handle.read();
     if (!canvas) throw new CanvasNotFoundError(canvasId);
 
     const fromVersion = canvas.version;
+    const nodeRecords = new Map(
+      [...(await handle.nodes.list())].map(([nodeId, snapshot]) => [
+        nodeId,
+        snapshot.record,
+      ]),
+    );
     const prestateNodes = hydrateNodes(
-      store,
+      nodeRecords,
       canvas.state.nodes as CanvasNode[],
     );
     const prestateEdges = (canvas.state.edges ?? []) as CanvasEdge[];
diff --git a/apps/server/src/modules/canvas/canvas-search.test.ts b/apps/server/src/modules/canvas/canvas-search.test.ts
index 9677f057b..be950b267 100644
--- a/apps/server/src/modules/canvas/canvas-search.test.ts
+++ b/apps/server/src/modules/canvas/canvas-search.test.ts
@@ -7,8 +7,8 @@
  * Covers the streaming {@link searchCanvas} driver. The route layer is
  * a thin NDJSON adapter, so the interesting behaviour — tiered emission
  * order, field filtering, snippet construction, limits, abort semantics
- * — all lives here and is exercised against a fake `CanvasStore` whose
- * `streamAllNodes` walks an in-memory snapshot. Production reads sidecars
+ * — all lives here and is exercised against a fake `SpaceHandle` whose
+ * node stream walks an in-memory snapshot. Production reads records
  * off disk, but the scanner takes a callback so the two are wire-compatible.
  */
 
@@ -24,7 +24,11 @@ import {
 import { createChatSubmission } from '../agent/agenetes/handle.js';
 
 import type { ChatEnvelope } from '../agent/conversation/envelope.js';
-import type { CanvasStore, NodeContent } from '../storage/canvas-store.js';
+import type {
+  NodeContent,
+  NodeSnapshot,
+  SpaceHandle,
+} from '../storage/index.js';
 import type { AgentTurn } from '@agenetes/protocol';
 import type { CanvasSearchEvent, CanvasSearchRequest } from '@huabu/shared';
 
@@ -76,16 +80,16 @@ function mkEdge(
 }
 
 /**
- * Build a duck-typed `CanvasStore` that satisfies just the two methods
+ * Build a duck-typed `SpaceHandle` that satisfies just the reads
  * `searchCanvas` actually reads from: `read()` (for the static node + edge
- * shape) and `streamAllNodes()` (for the sidecar bodies). The rest of the
+ * shape) and `nodes.stream()` (for the node records). The rest of the
  * store surface is irrelevant here, so we cast through `unknown`.
  */
 function makeFakeStore(opts: {
   nodes: readonly SearchableNode[];
   contents: readonly NodeContent[];
   edges?: readonly SearchableEdge[];
-}): CanvasStore {
+}): SpaceHandle {
   const stateNodes = opts.nodes.map((n) => ({
     id: n.id,
     type: n.type,
@@ -100,21 +104,24 @@ function makeFakeStore(opts: {
   }));
   const fake = {
     canvasId: 'test-canvas',
-    read: () => ({ state: { nodes: stateNodes, edges: stateEdges } }),
-    streamAllNodes: async (
-      onNode: (id: string, content: NodeContent) => void,
-      signal?: { readonly aborted: boolean },
-    ): Promise<Map<string, NodeContent>> => {
-      const map = new Map<string, NodeContent>();
-      for (const c of opts.contents) {
-        if (signal?.aborted) return map;
-        map.set(c.nodeId, c);
-        onNode(c.nodeId, c);
-      }
-      return map;
+    read: async () => ({ state: { nodes: stateNodes, edges: stateEdges } }),
+    nodes: {
+      stream: async (
+        onNode: (id: string, snapshot: NodeSnapshot) => void,
+        signal?: { readonly aborted: boolean },
+      ): Promise<Map<string, NodeSnapshot>> => {
+        const map = new Map<string, NodeSnapshot>();
+        for (const content of opts.contents) {
+          if (signal?.aborted) return map;
+          const snapshot = { record: content, revision: content.nodeId };
+          map.set(content.nodeId, snapshot);
+          onNode(content.nodeId, snapshot);
+        }
+        return map;
+      },
     },
   };
-  return fake as unknown as CanvasStore;
+  return fake as unknown as SpaceHandle;
 }
 
 async function collect(
diff --git a/apps/server/src/modules/canvas/canvas-search.ts b/apps/server/src/modules/canvas/canvas-search.ts
index 17e0754d6..39f073b70 100644
--- a/apps/server/src/modules/canvas/canvas-search.ts
+++ b/apps/server/src/modules/canvas/canvas-search.ts
@@ -6,11 +6,8 @@
  *
  * Two-tier scan:
  *   1. **Metadata tier** (label / summary / keywords) — emitted as each
- *      sidecar lands via `CanvasStore.streamAllNodes`. Matches start
- *      flowing to the client after the very first `.md` read resolves,
- *      not after the whole directory has been pulled into memory, so
- *      perceived latency is bounded by the slowest single file rather
- *      than the full scan.
+ *      node record lands via `SpaceNodes.stream`. Matches start flowing
+ *      before the whole Space has been pulled into memory.
  *   2. **Content tier** (markdown body) — scans the same `NodeContent`
  *      bodies already cached by step 1. No additional disk reads.
  *
@@ -18,13 +15,12 @@
  *   Search is low-frequency. The OS page cache handles repeated reads
  *   transparently, and adding our own cache would cost permanent RAM
  *   plus an invalidation surface across every sidecar write path. If a
- *   single canvas grows past ~30 MB of sidecar text, the right next
- *   step is swapping the scan for spawned `ripgrep`, not in-process
- *   caching. See discussion in #search-architecture for the call.
+ *   single Space grows past ~30 MB of text, the right next step is a
+ *   backend-native index, not another application cache.
  *
  * Cancellation:
  *   The caller passes a `signal` (AbortSignal-like — we only need
- *   `.aborted` polling). Workers inside `streamAllNodes` short-circuit
+ *   `.aborted` polling). Workers inside `SpaceNodes.stream` short-circuit
  *   when the signal aborts, and the content-tier loop checks before
  *   each node so a superseded keystroke doesn't waste CPU.
  *
@@ -46,7 +42,8 @@ import { agenetes } from '../agent/agenetes/drivers.js';
 import { chatEnvelopeFromSubmission } from '../agent/agenetes/handle.js';
 import { canvasAcpNamespace } from '../workspace/paths.js';
 
-import type { CanvasStore, NodeContent } from '../storage/canvas-store.js';
+import type { NodeContent } from './persistence-types.js';
+import type { SpaceHandle } from '../storage/index.js';
 import type { AgentTurn } from '@agenetes/protocol';
 
 /** Window of characters shown around each match in `snippet`. */
@@ -460,7 +457,7 @@ function stringArrayFrontmatter(
 }
 
 /**
- * Adapter: collect persisted nodes from a `CanvasStore.read()` payload.
+ * Adapter: collect persisted nodes from a Space record payload.
  * Lives here so the route layer can stay thin and tests can synthesise
  * canvas state without touching disk.
  */
@@ -494,7 +491,7 @@ export function extractSearchableNodes(state: unknown): SearchableNode[] {
 }
 
 /**
- * Adapter: collect persisted edges from a `CanvasStore.read()` payload.
+ * Adapter: collect persisted edges from a Space record payload.
  * Reads only what the scanner needs (`id`, endpoints, `label`); other
  * `EdgeStyle` fields (lineStyle, stroke, …) are intentionally
  * dropped so the in-memory footprint stays bounded.
@@ -531,20 +528,20 @@ export function extractSearchableEdges(state: unknown): SearchableEdge[] {
 }
 
 /**
- * Drive a search directly off a {@link CanvasStore}.
+ * Drive a search directly off a backend-neutral {@link SpaceHandle}.
  *
- * Streams meta-tier matches as each sidecar lands (no `await`-all
+ * Streams meta-tier matches as each node record lands (no `await`-all
  * barrier in front of the first emit). Content tier runs after the
  * stream settles, scanning the in-memory cache that was built as a
- * side effect of the meta walk — zero extra disk reads.
+ * side effect of the meta walk — zero extra storage reads.
  */
 export async function searchCanvas(
-  store: CanvasStore,
+  space: SpaceHandle,
   request: CanvasSearchRequest,
   emit: (event: CanvasSearchEvent) => void,
   signal?: AbortSignal,
 ): Promise<void> {
-  const file = store.read();
+  const file = await space.read();
   if (!file) {
     emit({ type: 'error', message: 'Canvas not found' });
     return;
@@ -583,7 +580,7 @@ export async function searchCanvas(
   // invokes the callback synchronously as each file resolves, so a
   // match against the very first parsed file ships before any of the
   // remaining files are even opened.
-  const contentByNodeId = await store.streamAllNodes((id, content) => {
+  const snapshots = await space.nodes.stream((id, snapshot) => {
     if (signal?.aborted) return;
     if (!wantsMeta) return;
     if (totalEmitted >= limit) {
@@ -592,13 +589,16 @@ export async function searchCanvas(
     }
     const node = candidateById.get(id);
     // Skip sidecars that belong to nodes filtered out by
-    // `nodeId` / `nodeTypes` — we still read them (the directory
-    // walk is unfiltered) but they contribute nothing here.
+    // `nodeId` / `nodeTypes` — the backend scan is unfiltered, but those
+    // records contribute nothing here.
     if (!node) return;
-    scanNodeMeta(node, content, fields, needleLower, needleLen, (m) =>
+    scanNodeMeta(node, snapshot.record, fields, needleLower, needleLen, (m) =>
       tryEmitMatch('meta', m),
     );
   }, signal);
+  const contentByNodeId = new Map(
+    [...snapshots].map(([nodeId, snapshot]) => [nodeId, snapshot.record]),
+  );
 
   if (signal?.aborted) return;
 
@@ -677,7 +677,7 @@ export async function searchCanvas(
       const label = content?.label ?? null;
       scanNodeConversation(
         node,
-        store.canvasId,
+        space.canvasId,
         label,
         needleLower,
         needleLen,
diff --git a/apps/server/src/modules/canvas/canvas-spatial.test.ts b/apps/server/src/modules/canvas/canvas-spatial.test.ts
index 70b98ceb0..a95900181 100644
--- a/apps/server/src/modules/canvas/canvas-spatial.test.ts
+++ b/apps/server/src/modules/canvas/canvas-spatial.test.ts
@@ -50,7 +50,7 @@ function seed(canvasId: string, nodes: SeedNode[]): void {
   });
 }
 
-function byId(result: ReturnType<typeof inspectNodes>): Map<
+function byId(result: Awaited<ReturnType<typeof inspectNodes>>): Map<
   string,
   {
     position: { x: number; y: number };
@@ -113,18 +113,18 @@ describe('inspect_nodes / outline — dual-field coordinates', () => {
     ]);
   }
 
-  it('root node reports position == absolutePosition', () => {
+  it('root node reports position == absolutePosition', async () => {
     seedScene();
-    const m = byId(inspectNodes(CANVAS, { ids: ['root'] }));
+    const m = byId(await inspectNodes(CANVAS, { ids: ['root'] }));
     expect(m.get('root')).toEqual({
       position: { x: 100, y: 100 },
       absolutePosition: { x: 100, y: 100 },
     });
   });
 
-  it('framed child reports parent-local position and world absolutePosition', () => {
+  it('framed child reports parent-local position and world absolutePosition', async () => {
     seedScene();
-    const m = byId(inspectNodes(CANVAS, { ids: ['child'] }));
+    const m = byId(await inspectNodes(CANVAS, { ids: ['child'] }));
     expect(m.get('child')).toEqual({
       // raw stored value = frame-relative
       position: { x: 50, y: 60 },
@@ -133,9 +133,9 @@ describe('inspect_nodes / outline — dual-field coordinates', () => {
     });
   });
 
-  it('resolves absolutePosition through a nested frame chain', () => {
+  it('resolves absolutePosition through a nested frame chain', async () => {
     seedScene();
-    const m = byId(inspectNodes(CANVAS, { ids: ['grandchild'] }));
+    const m = byId(await inspectNodes(CANVAS, { ids: ['grandchild'] }));
     expect(m.get('grandchild')).toEqual({
       // raw stored value = relative to inner frame
       position: { x: 10, y: 20 },
@@ -144,9 +144,9 @@ describe('inspect_nodes / outline — dual-field coordinates', () => {
     });
   });
 
-  it('get_canvas_outline emits the same dual fields', () => {
+  it('get_canvas_outline emits the same dual fields', async () => {
     seedScene();
-    const outline = buildCanvasOutline(CANVAS);
+    const outline = await buildCanvasOutline(CANVAS);
     if (!outline) throw new Error('no outline');
     const child = outline.nodes.find((n) => n.id === 'child');
     expect(child?.position).toEqual({ x: 50, y: 60 });
diff --git a/apps/server/src/modules/canvas/canvas-spatial.ts b/apps/server/src/modules/canvas/canvas-spatial.ts
index d96911163..ad2b2cce7 100644
--- a/apps/server/src/modules/canvas/canvas-spatial.ts
+++ b/apps/server/src/modules/canvas/canvas-spatial.ts
@@ -36,8 +36,7 @@
  *     parent, visual style on `data.style`, edge endpoints +
  *     `data.edgeStyle`, plus all derived spatial/topological metadata.
  *   - When `includePreviews` is set, outline pulls the preview text
- *     via `CanvasStore.readNode` — the only place it crosses into the
- *     markdown side, kept gated behind an opt-in flag.
+ *     from the already-read node records, kept gated behind an opt-in flag.
  */
 
 import {
@@ -53,10 +52,10 @@ import {
 } from '@huabu/shared/canvas-engine';
 
 import { describeNode, nodeLabel, type NodeInput } from './node-prompt.js';
-import { getCanvasStore } from '../storage/index.js';
+import { readCanvas, readCanvasSnapshot } from './space-read.js';
 
+import type { CanvasFile } from './persistence-types.js';
 import type { AgentNodeOutline } from '../agent/node-ref.js';
-import type { CanvasFile } from '../storage/canvas-store.js';
 import type {
   CanvasNodeType,
   CardinalDirection,
@@ -282,13 +281,13 @@ export interface CanvasOutlineOpts {
  * Build the one-shot "map" of a canvas: every node's geometry + edges +
  * spatial clusters. Returns `null` when the canvas does not exist.
  */
-export function buildCanvasOutline(
+export async function buildCanvasOutline(
   canvasId: string,
   opts: CanvasOutlineOpts = {},
-): CanvasOutline | null {
-  const store = getCanvasStore(canvasId);
-  const canvas = store.read();
-  if (!canvas) return null;
+): Promise<CanvasOutline | null> {
+  const snapshot = await readCanvasSnapshot(canvasId);
+  if (!snapshot) return null;
+  const { canvas, nodes: nodeRecords } = snapshot;
 
   const bundle = buildSpatialBundle(canvas);
   const summary = buildSpatialSummary(bundle.spatialNodes, bundle.edges);
@@ -314,7 +313,7 @@ export function buildCanvasOutline(
   const labelMemo = new Map<string, string | undefined>();
   const memoLabel = (id: string): string | undefined => {
     if (labelMemo.has(id)) return labelMemo.get(id);
-    const l = nodeLabel(store, id);
+    const l = nodeLabel(nodeRecords.get(id));
     labelMemo.set(id, l);
     return l;
   };
@@ -324,12 +323,12 @@ export function buildCanvasOutline(
     const parentLabel = s.parentId ? memoLabel(s.parentId) : undefined;
     const style = opts.includeStyle ? readVisualStyle(raw) : undefined;
     const out: CanvasOutlineNode = describeNode(
-      store,
       {
         ...spatialNodeInput(s, raw, parentLabel),
         ...(style ? { style } : {}),
       },
       'outline',
+      nodeRecords.get(s.id),
     );
     // The shared builder attaches `summary` (authored abstract) and
     // `preview` (raw body excerpt) from the sidecar; both are text scan
@@ -449,13 +448,13 @@ const DEFAULT_INSPECT_LIMIT = 50;
  * direction, edgeIds, hops, clusterId) are computed during filtering
  * and merged into the final result row.
  */
-export function inspectNodes(
+export async function inspectNodes(
   canvasId: string,
   args: InspectNodesArgs,
-): InspectNodesResult | InspectNodesError {
-  const store = getCanvasStore(canvasId);
-  const canvas = store.read();
-  if (!canvas) return { error: `Canvas ${canvasId} not found` };
+): Promise<InspectNodesResult | InspectNodesError> {
+  const snapshot = await readCanvasSnapshot(canvasId);
+  if (!snapshot) return { error: `Canvas ${canvasId} not found` };
+  const { canvas, nodes: nodeRecords } = snapshot;
 
   const bundle = buildSpatialBundle(canvas);
 
@@ -464,7 +463,7 @@ export function inspectNodes(
   const labelMemo = new Map<string, string | undefined>();
   const memoLabel = (id: string): string | undefined => {
     if (labelMemo.has(id)) return labelMemo.get(id);
-    const l = nodeLabel(store, id);
+    const l = nodeLabel(nodeRecords.get(id));
     labelMemo.set(id, l);
     return l;
   };
@@ -713,9 +712,9 @@ export function inspectNodes(
     const raw = bundle.rawById.get(s.id);
     const parentLabel = s.parentId ? memoLabel(s.parentId) : undefined;
     const base = describeNode(
-      store,
       spatialNodeInput(s, raw, parentLabel),
       'outline',
+      nodeRecords.get(s.id),
     );
     // Inspect deliberately omits text hints (`summary` / `preview`); agents
     // that need text use `get_canvas_outline({ includePreviews: true })` or
@@ -815,12 +814,11 @@ export type InspectEdgesError = { error: string };
  * `inspect_nodes({ connectedTo }).edgeIds` or directly from a styling
  * task, so even the unfiltered case is bounded in practice.
  */
-export function inspectEdges(
+export async function inspectEdges(
   canvasId: string,
   args: InspectEdgesArgs,
-): InspectEdgesResult | InspectEdgesError {
-  const store = getCanvasStore(canvasId);
-  const canvas = store.read();
+): Promise<InspectEdgesResult | InspectEdgesError> {
+  const canvas = await readCanvas(canvasId);
   if (!canvas) return { error: `Canvas ${canvasId} not found` };
 
   const bundle = buildSpatialBundle(canvas);
diff --git a/apps/server/src/modules/canvas/canvas.route.ts b/apps/server/src/modules/canvas/canvas.route.ts
index b6ffedde6..97cd4ebf9 100644
--- a/apps/server/src/modules/canvas/canvas.route.ts
+++ b/apps/server/src/modules/canvas/canvas.route.ts
@@ -2,8 +2,8 @@
 // Licensed under the MIT license.
 
 import { spawn } from 'node:child_process';
-import { createWriteStream, existsSync, mkdirSync, renameSync } from 'node:fs';
-import { mkdir, readFile, rm, unlink, writeFile } from 'node:fs/promises';
+import { createWriteStream, existsSync } from 'node:fs';
+import { mkdir, readFile, unlink, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 
@@ -33,6 +33,11 @@ import {
 import { CanvasNotFoundError, applyDeltasOnServer } from './canvas-executor.js';
 import { searchCanvas } from './canvas-search.js';
 import { publishCanvasUpdate } from './canvas-sync.js';
+import {
+  readCanvas,
+  readCanvasNode,
+  readCanvasSnapshot,
+} from './space-read.js';
 import {
   assertWorldPortalTopologyAllowed,
   WorldPortalMutationError,
@@ -43,31 +48,24 @@ import {
   WorldReferenceResolutionError,
 } from './world-reference-resolver.js';
 import { MAX_UPLOAD_BYTES } from '../../upload-limits.js';
-import { toSafeFilename } from '../../utils/naming.js';
 import { ARTIFACT_URL_REGEX } from '../artifact/utils.js';
 import { getPreprocessDispatcher, getProfile } from '../preprocessing/index.js';
 import { stripOfficeparserPreamble } from '../preprocessing/loaders/office-strip.js';
-import {
-  isWorldCanvasId,
-  refreshCanvasDirIndex,
-  registerCanvasDir,
-  suggestCanvasDir,
-} from '../storage/canvas-dirs.js';
 import {
   canvasBlobs,
   createSpace,
   deleteSpace,
-  getCanvasStore,
+  diskSpaceTree,
+  stageDiskSpaceImport,
   getStructuredStore,
-  spaceDirectory,
+  isWorldCanvasId,
   type CanvasFile,
+  type NodeContent,
+  type NodeReadWarning,
   type UpdateNodeOutcome,
   updateNode,
 } from '../storage/index.js';
-import { nodesDir, SPACE_JSON_FILENAME } from '../storage/paths.js';
-import { getWorkspacePath } from '../workspace.js';
 
-import type { CanvasStore, NodeContent } from '../storage/canvas-store.js';
 import type { CanvasNodeType } from '@huabu/shared';
 import type {
   ApiResult,
@@ -114,6 +112,10 @@ interface NodeLike {
   [key: string]: unknown;
 }
 
+/** Stable record names in the portable `.huabu.zip` bundle format. */
+const SPACE_BUNDLE_RECORD_FILENAME = 'space.json';
+const LEGACY_CANVAS_BUNDLE_RECORD_FILENAME = 'canvas.json';
+
 function nowMs(): number {
   return Date.now();
 }
@@ -347,20 +349,18 @@ async function singleArtifactProbe(
  * {@link hydrateNodeContent}; also used by the per-node GET endpoint so
  * batch and single-node hydration stay in lock-step.
  *
- * `preloaded` lets the batch path inject content from a one-pass
- * directory scan (see {@link CanvasStore.readAllNodes}) so we don't
- * re-read every `.md` file per node. Pass `undefined` to fall back to
- * the targeted single-node `store.readNode(nodeId)` lookup; pass
- * `null` to indicate the batch scan ran but found no sidecar.
+ * `nodeContent` comes from the request's structured read. Batch hydration
+ * supplies the result of one `SpaceNodes.list()` call; the single-node route
+ * supplies one `SpaceNodes.read()` result.
  *
  * Returns the original `node` reference when nothing was mutated so
  * callers can rely on identity-based diffing.
  */
 function hydrateOneNode(
-  store: CanvasStore,
   node: NodeLike,
   artifactExists: (key: string) => boolean,
-  preloaded?: NodeContent | null,
+  nodeContent: NodeContent | null,
+  warnings: readonly NodeReadWarning[] = [],
 ): NodeLike {
   const nodeId = typeof node.id === 'string' ? node.id : '';
   if (!nodeId) return node;
@@ -375,17 +375,6 @@ function hydrateOneNode(
   // is the only source of truth for those fields, so we read it before
   // any check that depends on them (notably the artifact-missing probe,
   // which needs the hydrated `src`).
-  let nodeContent: NodeContent | null;
-  if (preloaded !== undefined) {
-    nodeContent = preloaded;
-  } else {
-    try {
-      nodeContent = store.readNode(nodeId);
-    } catch {
-      nodeContent = null;
-    }
-  }
-
   if (!nodeContent) {
     if (MD_BACKED_NODE_TYPES.has(nodeType)) {
       data['contentMissing'] = true;
@@ -404,12 +393,14 @@ function hydrateOneNode(
   // claims this nodeId. Unlike a write (which hard-fails), a read stays
   // best-effort — the index keeps the last-scanned file so the node still
   // renders — but the client can flag it so the user resolves the
-  // duplicate. The duplicate set was already populated by the
-  // `readAllNodes()` scan that produced `preloaded`, so this is a cheap
-  // in-memory lookup with no extra disk I/O.
-  if (store.isDuplicateNode(nodeId)) {
+  // duplicate. The adapter attached this warning to the same node snapshot,
+  // so checking it adds no second storage read.
+  const duplicate = warnings.find(
+    (warning) => warning.kind === 'duplicate-record',
+  );
+  if (duplicate) {
     data['contentDuplicate'] = true;
-    data['duplicateFiles'] = store.duplicateNodeFiles(nodeId);
+    data['duplicateFiles'] = duplicate.names;
   } else {
     if ('contentDuplicate' in data) {
       delete data['contentDuplicate'];
@@ -508,13 +499,14 @@ function hydrateOneNode(
  * load on cold cache.
  */
 async function hydrateNodeContent(
-  store: CanvasStore,
+  canvasId: string,
   nodes: NodeLike[],
+  contentByNodeId: ReadonlyMap<string, NodeContent>,
+  warningsByNodeId: ReadonlyMap<string, readonly NodeReadWarning[]>,
 ): Promise<NodeLike[]> {
   // Read sidecars first because they are the source of truth for `src`.
   // Probe only the keys referenced by artifact-backed nodes; enumerating the
   // entire scope would make hydration cost grow with unrelated blob count.
-  const contentByNodeId = await store.readAllNodes();
   const referenced = new Set<string>();
   for (const node of nodes) {
     const nodeType = typeof node.type === 'string' ? node.type : '';
@@ -527,16 +519,16 @@ async function hydrateNodeContent(
   const present =
     referenced.size === 0
       ? new Set<string>()
-      : await canvasBlobs(store.canvasId).hasMany([...referenced]);
+      : await canvasBlobs(canvasId).hasMany([...referenced]);
   const artifactExists = (key: string): boolean => present.has(key);
 
   return nodes.map((node) => {
     const nodeId = typeof node.id === 'string' ? node.id : '';
     return hydrateOneNode(
-      store,
       node,
       artifactExists,
       contentByNodeId.get(nodeId) ?? null,
+      warningsByNodeId.get(nodeId) ?? [],
     );
   });
 }
@@ -882,20 +874,12 @@ const canvasRoutes: FastifyPluginAsync = async (fastify) => {
   }>('/:canvasId/nodes/:nodeId/content', async function (request, reply) {
     const { canvasId, nodeId } = request.params;
 
-    const store = getCanvasStore(canvasId);
-    const canvas = store.read();
+    const handle = getStructuredStore().space(canvasId);
+    const canvas = await handle.read();
     if (!canvas) {
       return reply.code(404).send({ message: 'Canvas not found' });
     }
 
-    // Reconcile the cached node index against disk before this read.
-    // Only re-scans when warranted: a node already flagged duplicate
-    // always re-reads (so a hand-resolved duplicate is detected — the
-    // cheap count probe alone can't see that case), otherwise it falls
-    // back to the names-only staleness probe. Keeps the common healthy
-    // read off the full content rescan.
-    store.revalidateNodeForRead(nodeId);
-
     // Find this node in the persisted canvas state so we know its type
     // (without it we can't apply the artifact-missing branch). For
     // nodes that exist in `.md` but not in canvas state we fall back
@@ -905,12 +889,8 @@ const canvasRoutes: FastifyPluginAsync = async (fastify) => {
     let nodeType =
       stateNode && typeof stateNode.type === 'string' ? stateNode.type : '';
 
-    let existing: NodeContent | null = null;
-    try {
-      existing = store.readNode(nodeId);
-    } catch {
-      existing = null;
-    }
+    const existingSnapshot = await handle.nodes.read(nodeId);
+    const existing = existingSnapshot?.record ?? null;
     if (!nodeType && existing) {
       nodeType = existing.type;
     }
@@ -934,13 +914,14 @@ const canvasRoutes: FastifyPluginAsync = async (fastify) => {
     // Reuse the batched hydration helper so single-node and whole-
     // canvas reads stay in lock-step.
     const hydrated = hydrateOneNode(
-      store,
       {
         id: nodeId,
         type: nodeType,
         data: { ...(stateNode?.data ?? {}) },
       },
-      await singleArtifactProbe(store.canvasId, existing.src),
+      await singleArtifactProbe(canvasId, existing.src),
+      existing,
+      existingSnapshot?.warnings,
     );
     const data = (hydrated.data ?? {}) as Record<string, unknown>;
 
@@ -1010,9 +991,10 @@ const canvasRoutes: FastifyPluginAsync = async (fastify) => {
     const { nodeType, trigger, snapshot, previousSnapshot, options } =
       parsed.data;
     const dispatcher = getPreprocessDispatcher();
-    const store = getCanvasStore(canvasId);
-
-    if (MD_BACKED_NODE_TYPES.has(nodeType) && !store.readNode(nodeId)) {
+    if (
+      MD_BACKED_NODE_TYPES.has(nodeType) &&
+      !(await readCanvasNode(canvasId, nodeId))
+    ) {
       return reply.send({
         nodeId,
         success: false,
@@ -1095,20 +1077,24 @@ const canvasRoutes: FastifyPluginAsync = async (fastify) => {
     Reply: ApiResult<GetCanvasResponse>;
   }>('/:canvasId', async function (request, reply) {
     const { canvasId } = request.params;
-    if (isWorldCanvasId(canvasId)) {
+    if (await isWorldCanvasId(canvasId)) {
       await reconcileWorldPortals();
     }
-    const store = getCanvasStore(canvasId);
-    const canvas = store.read();
-
-    if (!canvas) {
+    const snapshot = await readCanvasSnapshot(canvasId);
+    if (!snapshot) {
       return reply.code(404).send({ message: 'Canvas not found' });
     }
+    const { canvas } = snapshot;
 
     // Hydrate node content from the per-canvas store so clients always
     // receive fresh markdown bodies.
     const nodes = canvas.state.nodes as NodeLike[];
-    const hydratedNodes = await hydrateNodeContent(store, nodes);
+    const hydratedNodes = await hydrateNodeContent(
+      canvasId,
+      nodes,
+      snapshot.nodes,
+      snapshot.nodeWarnings,
+    );
 
     return reply.send({
       canvasId: canvas.canvasId,
@@ -1169,7 +1155,7 @@ const canvasRoutes: FastifyPluginAsync = async (fastify) => {
     }
 
     try {
-      assertWorldPortalTopologyAllowed(
+      await assertWorldPortalTopologyAllowed(
         canvasId,
         (existing?.state.nodes ?? []) as NodeLike[],
         incomingState.nodes ?? [],
@@ -1563,18 +1549,18 @@ const canvasRoutes: FastifyPluginAsync = async (fastify) => {
    * user can resolve a duplicate-markdown collision by hand (keep one
    * file, delete the rest). Desktop-first: the server runs on the same
    * machine as the UI, so it owns the only reliable filesystem path.
-   * The folder is sandboxed to the workspace via {@link nodesDir}.
+   * The folder is sandboxed to the workspace by the materialization
+   * capability, which validates the id before resolving a path.
    */
   fastify.post<{
     Params: { canvasId: string };
     Reply: ApiResult<RevealNodesFolderResponse>;
   }>('/:canvasId/reveal-nodes', async function (request, reply) {
     const { canvasId } = request.params;
-    const store = getCanvasStore(canvasId);
-    if (!store.read()) {
+    if (!(await readCanvas(canvasId))) {
       return reply.code(404).send({ message: 'Canvas not found' });
     }
-    const dir = nodesDir(canvasId);
+    const dir = diskSpaceTree(canvasId).nodesDirectory();
     if (!existsSync(dir)) {
       return reply.code(404).send({ message: 'Nodes folder not found' });
     }
@@ -1604,13 +1590,12 @@ const canvasRoutes: FastifyPluginAsync = async (fastify) => {
     }
     const includeHistory = parsedQuery.data.includeHistory !== 'false';
 
-    const store = getCanvasStore(canvasId);
-    const canvas = store.read();
+    const canvas = await readCanvas(canvasId);
     if (!canvas) {
       return reply.code(404).send({ message: 'Canvas not found' });
     }
 
-    const canvasDir = spaceDirectory(canvasId);
+    const canvasDir = diskSpaceTree(canvasId).directory();
     if (!existsSync(canvasDir)) {
       return reply.code(404).send({ message: 'Canvas directory not found' });
     }
@@ -1671,14 +1656,8 @@ const canvasRoutes: FastifyPluginAsync = async (fastify) => {
       // Stream the upload to a temp zip file
       const tmpZip = path.join(tmpdir(), `${createId('import')}.zip`);
       const targetCanvasId = createId('canvas');
-      // Extract into a hidden staging dir so `scanWorkspace()` ignores it
-      // (it skips dot-prefixed entries) and the as-yet-unrenamed dir cannot
-      // be picked up by `read()`'s self-heal as a canvas titled `<canvasId>`.
-      const stagingDir = path.join(
-        getWorkspacePath(),
-        `.import-${targetCanvasId}`,
-      );
-      let stagingCleanedUp = false;
+      const importStaging = await stageDiskSpaceImport(targetCanvasId);
+      const stagingDir = importStaging.directory;
       try {
         await new Promise<void>((resolve, reject) => {
           const ws = createWriteStream(tmpZip);
@@ -1702,8 +1681,6 @@ const canvasRoutes: FastifyPluginAsync = async (fastify) => {
           });
         }
 
-        mkdirSync(stagingDir, { recursive: true });
-
         type ImportManifest = {
           version?: string;
           sourceCanvasId?: string;
@@ -1746,16 +1723,21 @@ const canvasRoutes: FastifyPluginAsync = async (fastify) => {
         // Rewrite the topology file so canvasId matches the new directory.
         // New bundles carry `space.json`; still accept legacy `canvas.json`
         // exports and normalise them to the new name on the way in.
-        const stagedJsonPath = path.join(stagingDir, SPACE_JSON_FILENAME);
-        const legacyJsonPath = path.join(stagingDir, 'canvas.json');
+        const stagedJsonPath = path.join(
+          stagingDir,
+          SPACE_BUNDLE_RECORD_FILENAME,
+        );
+        const legacyJsonPath = path.join(
+          stagingDir,
+          LEGACY_CANVAS_BUNDLE_RECORD_FILENAME,
+        );
         const sourceJsonPath = existsSync(stagedJsonPath)
           ? stagedJsonPath
           : existsSync(legacyJsonPath)
             ? legacyJsonPath
             : null;
         if (!sourceJsonPath) {
-          await rm(stagingDir, { recursive: true, force: true });
-          stagingCleanedUp = true;
+          await importStaging.discard();
           return reply.code(400).send({
             message: 'Invalid bundle: missing space.json',
           });
@@ -1766,41 +1748,18 @@ const canvasRoutes: FastifyPluginAsync = async (fastify) => {
         const importedManifest = manifest as ImportManifest | null;
         const targetTitle =
           importedManifest?.title ?? parsed.title ?? 'Imported canvas';
-        const finalDirName = suggestCanvasDir(targetTitle, targetCanvasId);
-        const safeFromTitle = toSafeFilename(targetTitle, targetCanvasId);
-        const dedupeSuffix =
-          finalDirName === safeFromTitle
-            ? ''
-            : finalDirName.slice(safeFromTitle.length);
-        const resolvedTitle =
-          dedupeSuffix === '' ? targetTitle : targetTitle + dedupeSuffix;
 
         const remapped: CanvasFile = {
           ...parsed,
           canvasId: targetCanvasId,
-          title: resolvedTitle,
+          title: targetTitle,
           state: rewriteCanvasArtifactUrls(
             parsed.state,
             sourceCanvasId,
             targetCanvasId,
           ),
         };
-        // Always persist under the new name so the storage layer (which
-        // addresses `space.json`) can find it; drop a legacy source file.
-        await writeFile(stagedJsonPath, JSON.stringify(remapped));
-        if (sourceJsonPath !== stagedJsonPath) {
-          await rm(sourceJsonPath, { force: true });
-        }
-
-        // Move the staged dir into its final, title-derived location so
-        // the on-disk basename matches the title and `read()` will not
-        // self-heal-overwrite the title with the staging dir basename on
-        // the next access.
-        const finalDir = path.join(getWorkspacePath(), finalDirName);
-        renameSync(stagingDir, finalDir);
-        stagingCleanedUp = true;
-        registerCanvasDir(targetCanvasId, finalDirName, resolvedTitle);
-        refreshCanvasDirIndex();
+        await importStaging.publish(remapped);
 
         const response: ImportCanvasResponse = {
           canvasId: targetCanvasId,
@@ -1811,11 +1770,7 @@ const canvasRoutes: FastifyPluginAsync = async (fastify) => {
         return reply.code(500).send({ message: 'Failed to import canvas' });
       } finally {
         void unlink(tmpZip).catch(() => {});
-        if (!stagingCleanedUp && existsSync(stagingDir)) {
-          await rm(stagingDir, { recursive: true, force: true }).catch(
-            () => {},
-          );
-        }
+        await importStaging.discard().catch(() => {});
       }
     },
   );
@@ -1840,8 +1795,8 @@ const canvasRoutes: FastifyPluginAsync = async (fastify) => {
         });
       }
 
-      const store = getCanvasStore(canvasId);
-      const canvas = store.read();
+      const space = getStructuredStore().space(canvasId);
+      const canvas = await space.read();
       if (!canvas) {
         return reply.code(404).send({ message: 'Canvas not found' });
       }
@@ -1880,7 +1835,7 @@ const canvasRoutes: FastifyPluginAsync = async (fastify) => {
       request.raw.on('close', onClose);
 
       try {
-        await searchCanvas(store, parsed.data, writeEvent, abort.signal);
+        await searchCanvas(space, parsed.data, writeEvent, abort.signal);
       } catch (err) {
         request.log.error({ err, canvasId }, 'Canvas search failed');
         writeEvent({
diff --git a/apps/server/src/modules/canvas/external-watcher.test.ts b/apps/server/src/modules/canvas/external-watcher.test.ts
index cf3de2474..341bceb7b 100644
--- a/apps/server/src/modules/canvas/external-watcher.test.ts
+++ b/apps/server/src/modules/canvas/external-watcher.test.ts
@@ -69,7 +69,9 @@ vi.mock('../storage/canvas-dirs.js', () => ({
 }));
 
 const canvasStore = vi.hoisted(() => ({
-  read: vi.fn(() => ({ state: { nodes: [] } })),
+  read: vi.fn<() => { state: { nodes: never[] } } | null>(() => ({
+    state: { nodes: [] },
+  })),
 }));
 
 // The facade is stubbed for the store, but the handle helpers must stay the
@@ -79,7 +81,23 @@ const canvasStore = vi.hoisted(() => ({
 vi.mock('../storage/index.js', async () => {
   const handles = await import('../storage/backends/disk/space-dir-handles.js');
   return {
-    getCanvasStore: () => canvasStore,
+    getStructuredStore: () => ({
+      space: () => ({ read: async () => canvasStore.read() }),
+    }),
+    diskSpaceTree: (canvasId: string) => {
+      const directoryName =
+        canvasDirs.list().find((entry) => entry.id === canvasId)?.filename ??
+        canvasId;
+      const directory = `/ws/${directoryName}`;
+      return {
+        canvasId,
+        directory: () => directory,
+        nodesDirectory: () => `${directory}/nodes`,
+        nodeIdForPath: async () => null,
+        registerHandleOwner: (owner: { release(): void; reacquire(): void }) =>
+          handles.registerSpaceDirHandleOwner(canvasId, owner),
+      };
+    },
     registerSpaceDirHandleOwner: handles.registerSpaceDirHandleOwner,
     withSpaceDirHandlesReleased: handles.withSpaceDirHandlesReleased,
   };
@@ -105,7 +123,7 @@ import {
   openExternalNoteSession,
   resetExternalNoteSessions,
 } from './external-watcher.js';
-import { withSpaceDirHandlesReleased } from '../storage/index.js';
+import { withSpaceDirHandlesReleased } from '../storage/backends/disk/space-dir-handles.js';
 
 import type { ExternalNoteEvent } from '@huabu/shared';
 
@@ -252,7 +270,7 @@ describe('openExternalNoteSession', () => {
     (await opening).close();
   });
 
-  it('reads the Space topology at most once per lazy scan', async () => {
+  it('shares one lazy scan while refreshing topology per subscriber', async () => {
     canvasDirs.list.mockReturnValue([{ id: 'canvas-a', filename: 'canvas-a' }]);
     fileIO.readdir.mockResolvedValue([
       { name: 'first.md', isFile: () => true },
@@ -266,9 +284,9 @@ describe('openExternalNoteSession', () => {
     expect(
       readPaths.filter((filePath) => filePath.endsWith('.md')),
     ).toHaveLength(2);
-    expect(
-      readPaths.filter((filePath) => filePath.endsWith('space.json')),
-    ).toHaveLength(1);
+    // One read supplies the shared scan and one refresh supplies each
+    // subscriber's snapshot against the current topology.
+    expect(canvasStore.read).toHaveBeenCalledTimes(3);
     expect(fileIO.readdir).toHaveBeenCalledTimes(1);
     expect(first.snapshot).toHaveLength(2);
 
@@ -796,6 +814,7 @@ describe('Space-directory handle release', () => {
 
     await withSpaceDirHandlesReleased('canvas-a', async () => {
       canvasDirs.list.mockReturnValue([]);
+      canvasStore.read.mockReturnValue(null);
     });
 
     expect(nativeWatchMock).not.toHaveBeenCalled();
diff --git a/apps/server/src/modules/canvas/external-watcher.ts b/apps/server/src/modules/canvas/external-watcher.ts
index fc37894a7..fb0995e72 100644
--- a/apps/server/src/modules/canvas/external-watcher.ts
+++ b/apps/server/src/modules/canvas/external-watcher.ts
@@ -30,13 +30,11 @@ import {
 import { readFile, readdir, stat } from 'node:fs/promises';
 import path from 'node:path';
 
+import { readCanvas } from './space-read.js';
 import { getLogger } from '../../utils/logger.js';
 import { parseFrontmatter } from '../../utils/markdown-frontmatter.js';
-import { listAllCanvasDirEntries } from '../storage/canvas-dirs.js';
-import { getCanvasStore } from '../storage/index.js';
-import { registerSpaceDirHandleOwner } from '../storage/index.js';
-import { SPACE_JSON_FILENAME } from '../storage/paths.js';
-import { getWorkspacePath, isWorkspaceConfigured } from '../workspace.js';
+import { diskSpaceTree } from '../storage/index.js';
+import { isWorkspaceConfigured } from '../workspace.js';
 
 import type { CanvasFile } from '../storage/index.js';
 import type { ExternalNoteEvent, ExternalNoteItem } from '@huabu/shared';
@@ -113,11 +111,11 @@ function isSessionCurrent(session: ActiveSpaceWatch, stamp?: string): boolean {
 
 function nodesPathFor(canvasId: string): string | null {
   if (!isWorkspaceConfigured()) return null;
-  const entry = listAllCanvasDirEntries().find(
-    (candidate) => candidate.id === canvasId,
-  );
-  if (!entry) return null;
-  return path.join(getWorkspacePath(), entry.filename, 'nodes');
+  try {
+    return diskSpaceTree(canvasId).nodesDirectory();
+  } catch {
+    return null;
+  }
 }
 
 function noteIdsFromCanvas(canvas: CanvasFile | null): Set<string> {
@@ -130,19 +128,15 @@ function noteIdsFromCanvas(canvas: CanvasFile | null): Set<string> {
   return ids;
 }
 
-function canvasNoteIds(canvasId: string): Set<string> {
-  return noteIdsFromCanvas(getCanvasStore(canvasId).read());
+async function canvasNoteIds(canvasId: string): Promise<Set<string>> {
+  return noteIdsFromCanvas(await readCanvas(canvasId));
 }
 
 async function readInitialCanvasNoteIds(
-  nodesPath: string,
+  canvasId: string,
 ): Promise<Set<string>> {
   try {
-    const raw = await readFile(
-      path.join(path.dirname(nodesPath), SPACE_JSON_FILENAME),
-      'utf8',
-    );
-    return noteIdsFromCanvas(JSON.parse(raw) as CanvasFile);
+    return await canvasNoteIds(canvasId);
   } catch {
     return new Set();
   }
@@ -195,8 +189,10 @@ function forgetItem(session: ActiveSpaceWatch, relativePath: string): void {
   emit(session, { type: 'removed', data: { relativePath } });
 }
 
-function snapshotOf(session: ActiveSpaceWatch): ExternalNoteItem[] {
-  const known = canvasNoteIds(session.canvasId);
+function snapshotOf(
+  session: ActiveSpaceWatch,
+  known: ReadonlySet<string>,
+): ExternalNoteItem[] {
   const out: ExternalNoteItem[] = [];
   for (const [rel, item] of session.pendingItems) {
     if (item.noteId && known.has(item.noteId)) {
@@ -228,7 +224,7 @@ function scheduleNodeEvent(session: ActiveSpaceWatch, basename: string): void {
         .then(async (fileStat) => {
           if (!fileStat.isFile()) return;
           const item = await buildItem(absPath, relativePath, () =>
-            Promise.resolve(canvasNoteIds(session.canvasId)),
+            canvasNoteIds(session.canvasId),
           );
           if (!item || !isSessionCurrent(session, stamp)) return;
           recordItem(session, item);
@@ -590,8 +586,16 @@ function destroySession(session: ActiveSpaceWatch): void {
  * a deleted Space drops its live state and tells subscribers it is now empty.
  * Idempotent, so it doubles as the handle-owner `reacquire` hook.
  */
-function resyncSession(session: ActiveSpaceWatch): void {
+async function resyncSession(session: ActiveSpaceWatch): Promise<void> {
   if (session.closed) return;
+  if (!(await readCanvas(session.canvasId))) {
+    disarmSessionWatcher(session);
+    session.nodesPath = '';
+    session.pendingItems.clear();
+    session.initialScan = null;
+    emit(session, { type: 'snapshot', data: { items: [] } });
+    return;
+  }
   const nodesPath = nodesPathFor(session.canvasId);
   if (!nodesPath) {
     disarmSessionWatcher(session);
@@ -674,7 +678,7 @@ async function runInitialScan(session: ActiveSpaceWatch): Promise<void> {
 
     let topology: Promise<Set<string>> | null = null;
     const knownNoteIds = (): Promise<Set<string>> =>
-      (topology ??= readInitialCanvasNoteIds(session.nodesPath));
+      (topology ??= readInitialCanvasNoteIds(session.canvasId));
 
     let nextIndex = 0;
     const worker = async (): Promise<void> => {
@@ -759,10 +763,12 @@ export async function openExternalNoteSession(
     sessions.set(canvasId, created);
     // Declare the handle so a server-owned rename/delete of this Space can
     // release it; `resyncSession` re-resolves the directory on re-acquire.
-    created.unregisterHandleOwner = registerSpaceDirHandleOwner(canvasId, {
-      release: () => disarmSessionWatcher(created),
-      reacquire: () => resyncSession(created),
-    });
+    created.unregisterHandleOwner = diskSpaceTree(canvasId).registerHandleOwner(
+      {
+        release: () => disarmSessionWatcher(created),
+        reacquire: () => resyncSession(created),
+      },
+    );
     armSessionWatcher(created);
   }
 
@@ -789,9 +795,10 @@ export async function openExternalNoteSession(
 
   // Registering the listener and reading the snapshot must stay in one
   // synchronous block so no event can slip between them.
+  const known = await canvasNoteIds(active.canvasId);
   if (released || !isSessionCurrent(active)) return { snapshot: [], close };
   active.listeners.add(listener);
-  return { snapshot: snapshotOf(active), close };
+  return { snapshot: snapshotOf(active, known), close };
 }
 
 /** Remove and return a pending item — used by the import endpoint. */
diff --git a/apps/server/src/modules/canvas/external.route.ts b/apps/server/src/modules/canvas/external.route.ts
index 0984daa1c..05258198a 100644
--- a/apps/server/src/modules/canvas/external.route.ts
+++ b/apps/server/src/modules/canvas/external.route.ts
@@ -17,7 +17,7 @@ import {
   takeExternalNote,
 } from './external-watcher.js';
 import { parseFrontmatter } from '../../utils/markdown-frontmatter.js';
-import { spaceDirectory } from '../storage/index.js';
+import { diskSpaceTree } from '../storage/index.js';
 
 import type { FastifyPluginAsync } from 'fastify';
 
@@ -95,7 +95,10 @@ const externalRoutes: FastifyPluginAsync = async (fastify): Promise<void> => {
       return reply.code(404).send({ message: 'External note not found' });
     }
 
-    const abs = path.join(spaceDirectory(canvasId), item.relativePath);
+    const abs = path.join(
+      diskSpaceTree(canvasId).directory(),
+      item.relativePath,
+    );
     let raw: string;
     try {
       raw = await readFile(abs, 'utf8');
diff --git a/apps/server/src/modules/canvas/import-node-src.test.ts b/apps/server/src/modules/canvas/import-node-src.test.ts
index 089ad92ac..93cbae9bc 100644
--- a/apps/server/src/modules/canvas/import-node-src.test.ts
+++ b/apps/server/src/modules/canvas/import-node-src.test.ts
@@ -18,7 +18,7 @@ import { createCanvas } from '../storage/compatibility/canvas.js';
 import {
   canvasBlobs,
   getCanvasStore,
-  spaceDirectory,
+  diskSpaceTree,
 } from '../storage/index.js';
 import { setWorkspacePath } from '../workspace.js';
 
@@ -49,7 +49,7 @@ afterEach(() => {
 
 /** Stage a file under the canvas's hidden `.upload/` scratch dir. */
 function stageUpload(canvasId: string, name: string, body: string): string {
-  const uploadDir = path.join(spaceDirectory(canvasId), '.upload');
+  const uploadDir = path.join(diskSpaceTree(canvasId).directory(), '.upload');
   mkdirSync(uploadDir, { recursive: true });
   const abs = path.join(uploadDir, name);
   writeFileSync(abs, body);
@@ -97,7 +97,6 @@ function seedWebNode(canvasId: string, nodeId: string, src: string): void {
 describe('importForeignNodeSources — web nodes', () => {
   it('relocates a locally-staged HTML upload into .artifacts/ and reclaims it', async () => {
     const canvasId = 'c-web-local';
-    const store = getCanvasStore(canvasId);
     const uploadAbs = stageUpload(
       canvasId,
       'index.html',
@@ -117,7 +116,7 @@ describe('importForeignNodeSources — web nodes', () => {
       },
     ];
 
-    const out = await importForeignNodeSources(store, canvasId, commands);
+    const out = await importForeignNodeSources(canvasId, commands);
     const src = firstSrc(out);
 
     // Rewritten to a bare artifact key…
@@ -132,7 +131,6 @@ describe('importForeignNodeSources — web nodes', () => {
 
   it('rejects a non-HTML local upload without reclaiming it', async () => {
     const canvasId = 'c-web-invalid-local';
-    const store = getCanvasStore(canvasId);
     const uploadAbs = stageUpload(canvasId, 'document.pdf', 'not html');
 
     const commands: CanvasCommand[] = [
@@ -148,7 +146,7 @@ describe('importForeignNodeSources — web nodes', () => {
       },
     ];
 
-    const out = await importForeignNodeSources(store, canvasId, commands);
+    const out = await importForeignNodeSources(canvasId, commands);
 
     expect(firstSrc(out)).toBe('upload/document.pdf');
     expect(existsSync(uploadAbs)).toBe(true);
@@ -156,7 +154,6 @@ describe('importForeignNodeSources — web nodes', () => {
 
   it('leaves a live remote URL untouched (never downloads it)', async () => {
     const canvasId = 'c-web-remote';
-    const store = getCanvasStore(canvasId);
     const remote = 'https://example.com/some/page.html';
 
     const commands: CanvasCommand[] = [
@@ -172,13 +169,12 @@ describe('importForeignNodeSources — web nodes', () => {
       },
     ];
 
-    const out = await importForeignNodeSources(store, canvasId, commands);
+    const out = await importForeignNodeSources(canvasId, commands);
     expect(firstSrc(out)).toBe(remote);
   });
 
   it('leaves a data: URL untouched', async () => {
     const canvasId = 'c-web-data';
-    const store = getCanvasStore(canvasId);
     const dataUrl = 'data:text/html,<h1>inline</h1>';
 
     const commands: CanvasCommand[] = [
@@ -194,7 +190,7 @@ describe('importForeignNodeSources — web nodes', () => {
       },
     ];
 
-    const out = await importForeignNodeSources(store, canvasId, commands);
+    const out = await importForeignNodeSources(canvasId, commands);
     expect(firstSrc(out)).toBe(dataUrl);
   });
 
@@ -202,7 +198,6 @@ describe('importForeignNodeSources — web nodes', () => {
     const canvasId = 'c-web-merge-local';
     const nodeId = 'node-web-merge-local';
     seedWebNode(canvasId, nodeId, 'https://example.com/old');
-    const store = getCanvasStore(canvasId);
     const uploadAbs = stageUpload(
       canvasId,
       'replacement.html',
@@ -215,7 +210,7 @@ describe('importForeignNodeSources — web nodes', () => {
       },
     ];
 
-    const out = await importForeignNodeSources(store, canvasId, commands);
+    const out = await importForeignNodeSources(canvasId, commands);
     const src = firstPatchedSrc(out);
 
     expect(src).toMatch(/^artifact-[^/]+\.html$/);
@@ -229,7 +224,6 @@ describe('importForeignNodeSources — web nodes', () => {
     const canvasId = 'c-web-merge-remote';
     const nodeId = 'node-web-merge-remote';
     seedWebNode(canvasId, nodeId, 'https://example.com/old');
-    const store = getCanvasStore(canvasId);
     const remote = 'https://example.com/new';
     const commands: CanvasCommand[] = [
       {
@@ -238,7 +232,7 @@ describe('importForeignNodeSources — web nodes', () => {
       },
     ];
 
-    const out = await importForeignNodeSources(store, canvasId, commands);
+    const out = await importForeignNodeSources(canvasId, commands);
 
     expect(firstPatchedSrc(out)).toBe(remote);
   });
@@ -247,7 +241,6 @@ describe('importForeignNodeSources — web nodes', () => {
 describe('importForeignNodeSources — media nodes (regression)', () => {
   it('still relocates a locally-staged image upload', async () => {
     const canvasId = 'c-image-local';
-    const store = getCanvasStore(canvasId);
     stageUpload(canvasId, 'pic.png', 'not-a-real-png-but-bytes');
 
     const commands: CanvasCommand[] = [
@@ -263,7 +256,7 @@ describe('importForeignNodeSources — media nodes (regression)', () => {
       },
     ];
 
-    const out = await importForeignNodeSources(store, canvasId, commands);
+    const out = await importForeignNodeSources(canvasId, commands);
     const src = firstSrc(out);
     expect(src).toMatch(/^artifact-[^/]+\.png$/);
     expect(src).toBeDefined();
@@ -273,8 +266,7 @@ describe('importForeignNodeSources — media nodes (regression)', () => {
 
   it('canonicalizes an artifact path that leaves and re-enters the Space', async () => {
     const canvasId = 'c-image-reentered';
-    const store = getCanvasStore(canvasId);
-    const spaceDir = spaceDirectory(canvasId);
+    const spaceDir = diskSpaceTree(canvasId).directory();
     const artifactsDir = path.join(spaceDir, '.artifacts');
     mkdirSync(artifactsDir, { recursive: true });
     writeFileSync(path.join(artifactsDir, 'pic.png'), 'existing artifact');
@@ -298,7 +290,7 @@ describe('importForeignNodeSources — media nodes (regression)', () => {
       },
     ];
 
-    const out = await importForeignNodeSources(store, canvasId, commands);
+    const out = await importForeignNodeSources(canvasId, commands);
 
     expect(firstSrc(out)).toBe('pic.png');
   });
diff --git a/apps/server/src/modules/canvas/import-node-src.ts b/apps/server/src/modules/canvas/import-node-src.ts
index 39837f701..81dea1e5f 100644
--- a/apps/server/src/modules/canvas/import-node-src.ts
+++ b/apps/server/src/modules/canvas/import-node-src.ts
@@ -35,15 +35,14 @@ import {
   type CanvasNodeCreateInput,
 } from '@huabu/shared';
 
+import { readCanvas } from './space-read.js';
 import { getLogger } from '../../utils/logger.js';
 import {
   safeResolve,
   isArtifactsRel,
   toPhysicalRel,
 } from '../agent/tools/handlers/fs-sandbox.js';
-import { canvasBlobs, spaceDirectory } from '../storage/index.js';
-
-import type { CanvasStore } from '../storage/index.js';
+import { canvasBlobs, diskSpaceTree } from '../storage/index.js';
 
 const log = getLogger('canvas.import-node-src');
 
@@ -136,18 +135,17 @@ function srcNormalizeMode(type: string): SrcNormalizeMode | null {
  * preserved so a single unreachable URL never fails the whole batch.
  */
 export async function importForeignNodeSources(
-  store: CanvasStore,
   canvasId: string,
   commands: readonly CanvasCommand[],
 ): Promise<CanvasCommand[]> {
   // Lazily built nodeId → nodeType map, needed only to gate MERGE_NODE_DATA
   // patches (CREATE_NODES carries `nodeType` inline). Node type is immutable,
   // so reading the pre-batch snapshot here is race-free.
+  const canvas = await readCanvas(canvasId);
   let typeById: Map<string, string> | null = null;
   const nodeType = (nodeId: string): string => {
     if (!typeById) {
       typeById = new Map();
-      const canvas = store.read();
       for (const raw of canvas?.state.nodes ?? []) {
         const n = raw as { id?: unknown; type?: unknown };
         if (typeof n.id === 'string' && typeof n.type === 'string') {
@@ -167,7 +165,6 @@ export async function importForeignNodeSources(
           if (!mode) return node;
           const data = node.data as Record<string, unknown> | undefined;
           const key = await resolveImportedSrc(
-            store,
             canvasId,
             data?.['src'],
             mode.allowRemoteDownload,
@@ -191,7 +188,6 @@ export async function importForeignNodeSources(
           const mode = srcNormalizeMode(nodeType(entry.nodeId));
           if (!mode) return entry;
           const key = await resolveImportedSrc(
-            store,
             canvasId,
             entry.patch?.['src'],
             mode.allowRemoteDownload,
@@ -222,7 +218,6 @@ export async function importForeignNodeSources(
  * preserved in place and left unchanged.
  */
 async function resolveImportedSrc(
-  store: CanvasStore,
   canvasId: string,
   raw: unknown,
   allowRemoteDownload: boolean,
@@ -248,7 +243,7 @@ async function resolveImportedSrc(
     ) {
       return null;
     }
-    return await downloadToArtifact(store, src, pathname);
+    return await downloadToArtifact(canvasId, src, pathname);
   }
 
   // Already an in-app API path — leave it for the web resolver.
@@ -272,7 +267,10 @@ async function resolveImportedSrc(
   // is judged by where it actually lands, while the helper still owns the
   // virtual/physical `.artifacts` vocabulary. A nested path is not a blob key,
   // so it falls through and is copied into the artifact root below.
-  const resolvedPhysicalRel = path.relative(spaceDirectory(canvasId), absPath);
+  const resolvedPhysicalRel = path.relative(
+    diskSpaceTree(canvasId).directory(),
+    absPath,
+  );
   if (isArtifactsRel(resolvedPhysicalRel)) {
     const key = path.basename(absPath);
     const canonicalPath = safeResolve(
@@ -295,12 +293,12 @@ async function resolveImportedSrc(
     return null;
   }
 
-  return await copyToArtifact(store, absPath, physicalRel);
+  return await copyToArtifact(canvasId, absPath, physicalRel);
 }
 
 /** Copy a canvas-local file into blob storage, returning the new key. */
 async function copyToArtifact(
-  store: CanvasStore,
+  canvasId: string,
   absPath: string,
   physicalRel: string,
 ): Promise<string | null> {
@@ -309,7 +307,7 @@ async function copyToArtifact(
     const id = createId('artifact');
     const key = `${id}${ext}`;
     const buffer = await readFile(absPath);
-    await canvasBlobs(store.canvasId).put(key, buffer);
+    await canvasBlobs(canvasId).put(key, buffer);
 
     // Move semantics: reclaim RFS scratch uploads once they are safely
     // stored. Never delete user node files or other canvas content —
@@ -334,7 +332,7 @@ async function copyToArtifact(
 
 /** Download an online resource into `.artifacts/`, returning the new key. */
 async function downloadToArtifact(
-  store: CanvasStore,
+  canvasId: string,
   url: string,
   pathname: string,
 ): Promise<string | null> {
@@ -365,7 +363,7 @@ async function downloadToArtifact(
     }
     const ext = pickDownloadExt(pathname, contentType);
     const key = `${createId('artifact')}${ext}`;
-    await canvasBlobs(store.canvasId).put(key, buffer);
+    await canvasBlobs(canvasId).put(key, buffer);
     return key;
   } catch (err) {
     log.warn({ err, url }, 'Failed to download online node src into artifacts');
diff --git a/apps/server/src/modules/canvas/node-neighbourhood.ts b/apps/server/src/modules/canvas/node-neighbourhood.ts
index 350f3d78b..d59f46225 100644
--- a/apps/server/src/modules/canvas/node-neighbourhood.ts
+++ b/apps/server/src/modules/canvas/node-neighbourhood.ts
@@ -41,12 +41,12 @@ import {
 
 import { buildSpatialBundle } from './canvas-spatial.js';
 import { describeNode } from './node-prompt.js';
+import { readCanvas, readCanvasNodes } from './space-read.js';
 import {
   escapeXmlAttr,
   renderNodes,
 } from '../agent/conversation/prompt/node-element.js';
 import { buildAgentNodePreview } from '../agent/node-ref.js';
-import { getCanvasStore } from '../storage/index.js';
 
 import type { AgentNodePreview } from '../agent/node-ref.js';
 import type { CanvasNodeType, SpatialNode } from '@huabu/shared';
@@ -72,17 +72,33 @@ import type { CanvasNodeType, SpatialNode } from '@huabu/shared';
  * `data.content` / `data.src` (text-on-canvas nodes whose body never
  * touches disk). Per-node disk reads are memoized.
  */
-export function getNodeNeighbourhood(
+export async function getNodeNeighbourhood(
   canvasId: string,
   anchorNodeId: string,
-): NodeNeighbourhoodContext | null {
-  const canvas = getCanvasStore(canvasId).read();
+): Promise<NodeNeighbourhoodContext | null> {
+  const canvas = await readCanvas(canvasId);
   if (!canvas) return null;
   const bundle = buildSpatialBundle(canvas);
   const target = bundle.spatialNodes.find((n) => n.id === anchorNodeId);
   if (!target) return null;
 
-  const store = getCanvasStore(canvasId);
+  // Which nodes end up in the neighbourhood is the algorithm's decision, and
+  // it is a small bounded set — so let it decide first, without records, then
+  // read exactly those. The algorithm is pure geometry over an in-memory
+  // bundle; running it twice costs far less than reading a Space's worth of
+  // node records to describe a dozen of them.
+  const shape = buildNodeNeighbourhoodContext(
+    target,
+    bundle.spatialNodes,
+    bundle.edges,
+  );
+  const nodeRecords = await readCanvasNodes(
+    canvasId,
+    shape.layers.flatMap((layer) =>
+      layer.groups.flatMap((group) => group.nodes.map((node) => node.id)),
+    ),
+  );
+
   const cache = new Map<string, AgentNodePreview>();
   // One assembler for every neighbour: the node carries whatever the spatial
   // bundle knows (id / type; its `data.label` is always empty), and
@@ -93,9 +109,9 @@ export function getNodeNeighbourhood(
     const hit = cache.get(n.id);
     if (hit) return hit;
     const preview = describeNode(
-      store,
       { id: n.id, type: n.type, ...(n.label ? { label: n.label } : {}) },
       'preview',
+      nodeRecords.get(n.id),
     );
     cache.set(n.id, preview);
     return preview;
diff --git a/apps/server/src/modules/canvas/node-prompt.test.ts b/apps/server/src/modules/canvas/node-prompt.test.ts
index e8f309348..1afdd07cf 100644
--- a/apps/server/src/modules/canvas/node-prompt.test.ts
+++ b/apps/server/src/modules/canvas/node-prompt.test.ts
@@ -15,33 +15,34 @@ import { describe, expect, it } from 'vitest';
 
 import { describeNode, nodeLabel, renderNodes } from './node-prompt.js';
 
-import type { CanvasStore, NodeContent } from '../storage/canvas-store.js';
+import type { NodeContent } from './persistence-types.js';
 
-/** Minimal stub: only `readNode` is exercised by this module. */
-function stubStore(
+function stubMeta(
   nodes: Record<string, Partial<NodeContent> | null>,
-): CanvasStore {
-  return {
-    readNode(id: string): NodeContent | null {
-      const n = nodes[id];
-      if (n == null) return null;
-      return {
-        nodeId: id,
-        type: 'note',
-        label: null,
-        content: '',
-        ...n,
-      } as NodeContent;
-    },
-  } as unknown as CanvasStore;
+): (id: string) => NodeContent | null {
+  return (id: string): NodeContent | null => {
+    const node = nodes[id];
+    if (node === null || node === undefined) return null;
+    return {
+      nodeId: id,
+      type: 'note',
+      label: null,
+      content: '',
+      ...node,
+    } as NodeContent;
+  };
 }
 
 describe('describeNode — preview level', () => {
   it('fills label + body from the sidecar when the caller has none', () => {
-    const store = stubStore({
+    const meta = stubMeta({
       n1: { label: 'My Note', content: 'Hello body', summary: 'Abstract' },
     });
-    const node = describeNode(store, { id: 'n1', type: 'note' }, 'preview');
+    const node = describeNode(
+      { id: 'n1', type: 'note' },
+      'preview',
+      meta('n1'),
+    );
 
     expect(node.label).toBe('My Note');
     // filename is derived from the (sidecar) label — the real on-disk path,
@@ -53,19 +54,23 @@ describe('describeNode — preview level', () => {
   });
 
   it("prefers the caller's own field over the sidecar (own wins)", () => {
-    const store = stubStore({ n1: { label: 'Sidecar Label', content: 'x' } });
+    const meta = stubMeta({ n1: { label: 'Sidecar Label', content: 'x' } });
     const node = describeNode(
-      store,
       { id: 'n1', type: 'note', label: 'Wire Label' },
       'preview',
+      meta('n1'),
     );
     expect(node.label).toBe('Wire Label');
     expect(node.filename).toBe('nodes/Wire Label.md');
   });
 
   it('omits rev / summary / preview for a node with no body or summary', () => {
-    const store = stubStore({ n1: { label: 'Empty' } }); // content '' by default
-    const node = describeNode(store, { id: 'n1', type: 'note' }, 'preview');
+    const meta = stubMeta({ n1: { label: 'Empty' } }); // content '' by default
+    const node = describeNode(
+      { id: 'n1', type: 'note' },
+      'preview',
+      meta('n1'),
+    );
     expect(node.label).toBe('Empty');
     expect(node.rev).toBeUndefined();
     expect(node.summary).toBeUndefined();
@@ -73,26 +78,33 @@ describe('describeNode — preview level', () => {
   });
 
   it('emits summary and preview as INDEPENDENT fields', () => {
-    const store = stubStore({
+    const meta = stubMeta({
       n1: { label: 'L', summary: 'The abstract', content: 'The full body' },
     });
-    const node = describeNode(store, { id: 'n1', type: 'note' }, 'preview');
+    const node = describeNode(
+      { id: 'n1', type: 'note' },
+      'preview',
+      meta('n1'),
+    );
     expect(node.summary).toBe('The abstract');
     expect(node.preview).toBe('The full body');
   });
 
   it('hashes rev from a source-backed node with no body', () => {
-    const store = stubStore({
+    const meta = stubMeta({
       n1: { type: 'image', label: 'Pic', src: 'artifacts/a.png' },
     });
-    const node = describeNode(store, { id: 'n1', type: 'image' }, 'preview');
+    const node = describeNode(
+      { id: 'n1', type: 'image' },
+      'preview',
+      meta('n1'),
+    );
     expect(typeof node.rev).toBe('string');
     expect(node.preview).toBeUndefined(); // src is not a content preview
   });
 
   it('with a null store, uses only the caller-supplied fields', () => {
     const node = describeNode(
-      null,
       { id: 'n1', type: 'note', label: 'L', content: 'Body' },
       'preview',
     );
@@ -101,10 +113,8 @@ describe('describeNode — preview level', () => {
     expect(typeof node.rev).toBe('string');
   });
 
-  it('with meta=null, forces "no sidecar" even when a store is passed', () => {
-    const store = stubStore({ n1: { label: 'Sidecar', content: 'x' } });
+  it('with meta=null, uses only the caller-authored fields', () => {
     const node = describeNode(
-      store,
       { id: 'n1', type: 'note', label: 'Own' },
       'preview',
       null,
@@ -116,11 +126,10 @@ describe('describeNode — preview level', () => {
 
 describe('describeNode — outline level', () => {
   it('layers spatial metadata on top of the sidecar-sourced fields', () => {
-    const store = stubStore({
+    const meta = stubMeta({
       n1: { label: 'Node', content: 'Body', summary: 'Sum' },
     });
     const node = describeNode(
-      store,
       {
         id: 'n1',
         type: 'note',
@@ -130,6 +139,7 @@ describe('describeNode — outline level', () => {
         style: { color: 'red' },
       },
       'outline',
+      meta('n1'),
     );
     expect(node.position).toEqual({ x: 10, y: 20 });
     expect(node.size).toEqual({ width: 30, height: 40 });
@@ -144,9 +154,8 @@ describe('describeNode — outline level', () => {
   });
 
   it('carries an explicit absolutePosition distinct from parent-local position', () => {
-    const store = stubStore({ n1: { label: 'Node' } });
+    const meta = stubMeta({ n1: { label: 'Node' } });
     const node = describeNode(
-      store,
       {
         id: 'n1',
         type: 'note',
@@ -156,6 +165,7 @@ describe('describeNode — outline level', () => {
         parentFrame: { id: 'f1', label: 'Frame' },
       },
       'outline',
+      meta('n1'),
     );
     expect(node.position).toEqual({ x: 50, y: 60 });
     expect(node.absolutePosition).toEqual({ x: 1050, y: 560 });
@@ -164,14 +174,14 @@ describe('describeNode — outline level', () => {
 
 describe('nodeLabel', () => {
   it('returns the sidecar label', () => {
-    const store = stubStore({ n1: { label: 'Frame Title' } });
-    expect(nodeLabel(store, 'n1')).toBe('Frame Title');
+    const meta = stubMeta({ n1: { label: 'Frame Title' } });
+    expect(nodeLabel(meta('n1'))).toBe('Frame Title');
   });
 
   it('returns undefined when the node has no sidecar or no label', () => {
-    const store = stubStore({ n1: null, n2: { label: null } });
-    expect(nodeLabel(store, 'n1')).toBeUndefined();
-    expect(nodeLabel(store, 'n2')).toBeUndefined();
+    const meta = stubMeta({ n1: null, n2: { label: null } });
+    expect(nodeLabel(meta('n1'))).toBeUndefined();
+    expect(nodeLabel(meta('n2'))).toBeUndefined();
   });
 });
 
@@ -205,10 +215,14 @@ describe('renderNodes', () => {
   });
 
   it('renders the summary/preview split from describeNode end-to-end', () => {
-    const store = stubStore({
+    const meta = stubMeta({
       n1: { label: 'Risks', summary: 'FX exposure', content: 'Full body' },
     });
-    const node = describeNode(store, { id: 'n1', type: 'note' }, 'preview');
+    const node = describeNode(
+      { id: 'n1', type: 'note' },
+      'preview',
+      meta('n1'),
+    );
     const xml = renderNodes([node]);
     expect(xml).toBe(
       '<node id="n1" type="note" label="Risks" file="nodes/Risks.md" ' +
diff --git a/apps/server/src/modules/canvas/node-prompt.ts b/apps/server/src/modules/canvas/node-prompt.ts
index 9ea262b11..3800b473c 100644
--- a/apps/server/src/modules/canvas/node-prompt.ts
+++ b/apps/server/src/modules/canvas/node-prompt.ts
@@ -2,14 +2,14 @@
 // Licensed under the MIT license.
 
 /**
- * Store-aware "node → context" assembly.
+ * Pure "node → context" assembly.
  *
  * ONE rule: a node is carried into the prompt with whatever authored info
  * the caller already has; anything missing (label / body / summary / src)
- * is filled from the node's on-disk `.md` sidecar — the CANONICAL source.
+ * is filled from the node's canonical structured record.
  * Topology never persists `data.label` or note bodies, so a
  * caller that only has the raw canvas node hands in almost nothing and the
- * sidecar supplies the rest. This is the single place assembly lives, so
+ * node record supplies the rest. This is the single place assembly lives, so
  * every server-side path (selection / neighbourhood / outline / inspect)
  * produces the same `label / file / preview / rev` and cannot drift.
  *
@@ -22,7 +22,7 @@
  *
  * The pure ladder (`buildAgentNodePreview` / `buildAgentNodeOutline`) stays
  * in `agent/node-ref.ts` and owns the filename rule / preview ladder / rev
- * hash; this module only adds the store lookup that feeds it.
+ * hash; callers own the one storage read that feeds it.
  */
 
 import {
@@ -30,8 +30,8 @@ import {
   buildAgentNodePreview,
 } from '../agent/node-ref.js';
 
+import type { NodeContent } from './persistence-types.js';
 import type { AgentNodeOutline, AgentNodePreview } from '../agent/node-ref.js';
-import type { CanvasStore, NodeContent } from '../storage/canvas-store.js';
 import type { CanvasNodeType } from '@huabu/shared';
 
 export { renderNodes } from '../agent/conversation/prompt/node-element.js';
@@ -39,7 +39,7 @@ export { renderNodes } from '../agent/conversation/prompt/node-element.js';
 /**
  * Whatever the caller already knows about a node. Only `id` is required;
  * every other field is optional and, when absent, is filled from the
- * sidecar by {@link describeNode}. `position` / `size` (and the optional
+ * node record by {@link describeNode}. `position` / `size` (and the optional
  * `parentFrame` / `style`) are only consumed at the `'outline'` level.
  */
 export interface NodeInput {
@@ -63,22 +63,20 @@ export interface NodeInput {
 export type NodeLevel = 'preview' | 'outline';
 
 /** Prefer the caller's own value; fall back to the sidecar's. */
-function pick(own: unknown, fromStore: unknown): string | undefined {
+function pick(own: unknown, fromRecord: unknown): string | undefined {
   if (typeof own === 'string' && own.trim()) return own;
-  return typeof fromStore === 'string' && fromStore ? fromStore : undefined;
+  return typeof fromRecord === 'string' && fromRecord ? fromRecord : undefined;
 }
 
 /**
- * Merge the caller's authored fields with the sidecar's (own wins). Pass a
- * pre-read `meta` (e.g. from a batch {@link CanvasStore.readAllNodes}) to
- * skip the per-node disk read; pass `null` to force "no sidecar".
+ * Merge the caller's authored fields with a pre-read node record (own wins).
+ * Pass `null` when the node has no canonical content record.
  */
 function authoredFields(
-  store: CanvasStore | null,
   input: NodeInput,
-  meta?: NodeContent | null,
+  meta: NodeContent | null = null,
 ): { label?: string; summary?: string; content?: string; src?: string } {
-  const m = meta !== undefined ? meta : store ? store.readNode(input.id) : null;
+  const m = meta;
   const out: {
     label?: string;
     summary?: string;
@@ -101,25 +99,21 @@ function authoredFields(
 
 /**
  * Node → LLM-facing data object at the requested `level`. Carries the
- * caller's authored fields and fills any gaps from the sidecar; always
+ * caller's authored fields and fills any gaps from the node record; always
  * emits `rev` for content-bearing nodes (the freshness / CAS token).
- * `store` may be `null` (e.g. the store is unavailable) — then only the
- * caller's own fields are used.
+ * When `meta` is absent only the caller's own fields are used.
  */
 export function describeNode(
-  store: CanvasStore | null,
   input: NodeInput,
   level: 'preview',
   meta?: NodeContent | null,
 ): AgentNodePreview;
 export function describeNode(
-  store: CanvasStore | null,
   input: NodeInput,
   level: 'outline',
   meta?: NodeContent | null,
 ): AgentNodeOutline;
 export function describeNode(
-  store: CanvasStore | null,
   input: NodeInput,
   level: NodeLevel,
   meta?: NodeContent | null,
@@ -127,7 +121,7 @@ export function describeNode(
   const common = {
     id: input.id,
     type: (input.type ?? 'note') as CanvasNodeType,
-    ...authoredFields(store, input, meta),
+    ...authoredFields(input, meta),
   };
   if (level === 'outline') {
     return buildAgentNodeOutline({
@@ -147,15 +141,12 @@ export function describeNode(
 }
 
 /**
- * Resolve just a node's display label from the sidecar. Used for the
+ * Resolve just a node's display label from its pre-read record. Used for the
  * parent-frame `label=` hint — a plain string, not an agent-facing node,
  * so it needs no rev.
  */
 export function nodeLabel(
-  store: CanvasStore,
-  nodeId: string,
-  meta?: NodeContent | null,
+  meta: NodeContent | null | undefined,
 ): string | undefined {
-  const m = meta !== undefined ? meta : store.readNode(nodeId);
-  return typeof m?.label === 'string' && m.label ? m.label : undefined;
+  return typeof meta?.label === 'string' && meta.label ? meta.label : undefined;
 }
diff --git a/apps/server/src/modules/canvas/snapshot-nodes.ts b/apps/server/src/modules/canvas/snapshot-nodes.ts
index 9d79bbdc2..65b4735d5 100644
--- a/apps/server/src/modules/canvas/snapshot-nodes.ts
+++ b/apps/server/src/modules/canvas/snapshot-nodes.ts
@@ -67,9 +67,11 @@ import {
 } from '@huabu/shared';
 import { getSketchRenderedSize } from '@huabu/shared/canvas-engine';
 
+import { readCanvas, readCanvasNodes } from './space-read.js';
 import { RASTERIZABLE_IMAGE_EXT_MIME } from '../../utils/mime.js';
-import { canvasBlobs, getCanvasStore } from '../storage/index.js';
+import { canvasBlobs } from '../storage/index.js';
 
+import type { NodeContent } from './persistence-types.js';
 import type {
   SketchNodeData,
   SnapshotNodesQueryParams,
@@ -405,11 +407,11 @@ const IMAGE_EXT_MIME = RASTERIZABLE_IMAGE_EXT_MIME;
  * missing/blank.
  */
 function readSidecarString(
-  store: ReturnType<typeof getCanvasStore>,
+  records: ReadonlyMap<string, NodeContent>,
   nodeId: string,
   key: 'src',
 ): string | null {
-  const sidecar = store.readNode(nodeId);
+  const sidecar = records.get(nodeId);
   if (!sidecar) return null;
   const value = sidecar[key];
   return typeof value === 'string' && value.length > 0 ? value : null;
@@ -440,17 +442,18 @@ export interface ContextImage {
  * this image.
  */
 async function loadContextImage(
-  store: ReturnType<typeof getCanvasStore>,
+  canvasId: string,
+  records: ReadonlyMap<string, NodeContent>,
   node: CanvasNode,
 ): Promise<ContextImage | null> {
-  const src = readSidecarString(store, node.id, 'src');
+  const src = readSidecarString(records, node.id, 'src');
   if (!src) return null;
   const ext = path.extname(src).toLowerCase();
   const mimeType = IMAGE_EXT_MIME[ext];
   if (!mimeType) return null;
   const { width, height } = nodeBoxSize(node);
   if (width <= 0 || height <= 0) return null;
-  const bytes = await canvasBlobs(store.canvasId).read(src);
+  const bytes = await canvasBlobs(canvasId).read(src);
   if (!bytes) return null;
   return { node, resolvedSrc: src, bytes, mimeType, width, height };
 }
@@ -795,11 +798,11 @@ async function resampleImageBytes(
  * so repeated calls with the same parameters are O(1) cache hits.
  */
 async function maybeResizeImageArtifact(
-  store: ReturnType<typeof getCanvasStore>,
+  canvasId: string,
   src: string,
   maxEdge: number,
 ): Promise<{ src: string; width: number; height: number } | null> {
-  const blobs = canvasBlobs(store.canvasId);
+  const blobs = canvasBlobs(canvasId);
   const ext = path.extname(src).toLowerCase();
   const mimeType = IMAGE_EXT_MIME[ext];
   if (!mimeType) return null;
@@ -860,8 +863,7 @@ export async function snapshotNodesToArtifacts(
     Math.min(SPACE_SNAPSHOT_MAX_PIXELS, args.maxPixels ?? CLUSTER_MAX_PIXELS),
   );
 
-  const store = getCanvasStore(args.canvasId);
-  const canvas = store.read();
+  const canvas = await readCanvas(args.canvasId);
   if (!canvas) {
     throw new SnapshotNodeError(
       `Canvas ${args.canvasId} not found`,
@@ -923,6 +925,13 @@ export async function snapshotNodesToArtifacts(
   };
   for (const id of orderedIds) expand(id, false);
 
+  // Only the expanded set contributes: a snapshot needs each node's `src`,
+  // and nothing else in the Space is consulted.
+  const nodeRecords = await readCanvasNodes(
+    args.canvasId,
+    expansion.map((entry) => entry.id),
+  );
+
   const results: SnapshotNodeResult[] = [];
   // All snapshottable nodes (image + sketch) feed into the same
   // bucket-by-frame + spatial-cluster pipeline. There is no
@@ -974,7 +983,7 @@ export async function snapshotNodesToArtifacts(
     // resvg downscale, instead of building a full composite SVG.
     if (cluster.length === 1 && cluster[0].type === 'image') {
       const entry = cluster[0];
-      const src = readSidecarString(store, entry.node.id, 'src');
+      const src = readSidecarString(nodeRecords, entry.node.id, 'src');
       if (!src) {
         if (entry.fromFrame) continue;
         throw new SnapshotNodeError(
@@ -982,7 +991,11 @@ export async function snapshotNodesToArtifacts(
           'invalid_snapshot_request',
         );
       }
-      const resized = await maybeResizeImageArtifact(store, src, maxEdge);
+      const resized = await maybeResizeImageArtifact(
+        args.canvasId,
+        src,
+        maxEdge,
+      );
       if (resized) {
         results.push({
           src: resized.src,
@@ -1012,7 +1025,11 @@ export async function snapshotNodesToArtifacts(
 
     const contextImages: ContextImage[] = [];
     for (const entry of imageEntries) {
-      const loaded = await loadContextImage(store, entry.node);
+      const loaded = await loadContextImage(
+        args.canvasId,
+        nodeRecords,
+        entry.node,
+      );
       if (loaded) {
         contextImages.push(loaded);
         continue;
@@ -1025,7 +1042,7 @@ export async function snapshotNodesToArtifacts(
       // (the strokes will still render; losing one backdrop is
       // preferable to failing the whole batch).
       if (entry.fromFrame) continue;
-      const src = readSidecarString(store, entry.node.id, 'src');
+      const src = readSidecarString(nodeRecords, entry.node.id, 'src');
       if (!src) {
         throw new SnapshotNodeError(
           `Node ${entry.node.id} (image) has no src — nothing to return. The artifact may have been deleted, or the node's markdown sidecar (nodes/<label>.md) is missing its \`src:\` frontmatter entry.`,
@@ -1060,10 +1077,10 @@ export async function snapshotNodesToArtifacts(
         ? `sketch-raster-${fingerprint}`
         : `sketch-raster-${fingerprint}-${maxEdge}`;
     const filename = `${id}.png`;
-    const existing = await canvasBlobs(store.canvasId).head(filename);
+    const existing = await canvasBlobs(args.canvasId).head(filename);
     if (!existing) {
       const png = await renderClusterPng(built.svg, built.width);
-      await canvasBlobs(store.canvasId).put(filename, png);
+      await canvasBlobs(args.canvasId).put(filename, png);
     }
     results.push({
       src: filename,
diff --git a/apps/server/src/modules/canvas/space-query.ts b/apps/server/src/modules/canvas/space-query.ts
index df480323e..84b120aae 100644
--- a/apps/server/src/modules/canvas/space-query.ts
+++ b/apps/server/src/modules/canvas/space-query.ts
@@ -13,7 +13,7 @@ import {
   snapshotNodesToArtifacts,
   SnapshotNodeError,
 } from './snapshot-nodes.js';
-import { getCanvasStore } from '../storage/index.js';
+import { getStructuredStore } from '../storage/index.js';
 
 import type {
   CanvasSearchMatch,
@@ -47,7 +47,7 @@ export async function executeSpaceQuery(
   switch (query.type) {
     case 'GET_SPACE_OUTLINE': {
       const { type: _type, ...params } = query;
-      const result = buildCanvasOutline(canvasId, params);
+      const result = await buildCanvasOutline(canvasId, params);
       if (!result) {
         throw new SpaceQueryError(
           `Canvas ${canvasId} not found`,
@@ -58,7 +58,7 @@ export async function executeSpaceQuery(
     }
     case 'INSPECT_NODES': {
       const { type: _type, ...params } = query;
-      const result = inspectNodes(canvasId, params);
+      const result = await inspectNodes(canvasId, params);
       if ('error' in result) throwQueryError(result.error);
       return {
         type: query.type,
@@ -67,7 +67,7 @@ export async function executeSpaceQuery(
     }
     case 'INSPECT_EDGES': {
       const { type: _type, ...params } = query;
-      const result = inspectEdges(canvasId, params);
+      const result = await inspectEdges(canvasId, params);
       if ('error' in result) throwQueryError(result.error);
       return {
         type: query.type,
@@ -86,15 +86,19 @@ export async function executeSpaceQuery(
       }> = [];
       let truncated = false;
       let error: string | undefined;
-      await searchCanvas(getCanvasStore(canvasId), request, (event) => {
-        if (event.type === 'match') {
-          matches.push({ tier: event.tier, match: event.match });
-        } else if (event.type === 'done') {
-          truncated = event.truncated;
-        } else if (event.type === 'error') {
-          error = event.message;
-        }
-      });
+      await searchCanvas(
+        getStructuredStore().space(canvasId),
+        request,
+        (event) => {
+          if (event.type === 'match') {
+            matches.push({ tier: event.tier, match: event.match });
+          } else if (event.type === 'done') {
+            truncated = event.truncated;
+          } else if (event.type === 'error') {
+            error = event.message;
+          }
+        },
+      );
       if (error) {
         throw new SpaceQueryError(
           error,
diff --git a/apps/server/src/modules/canvas/space-read.ts b/apps/server/src/modules/canvas/space-read.ts
new file mode 100644
index 000000000..8514083bf
--- /dev/null
+++ b/apps/server/src/modules/canvas/space-read.ts
@@ -0,0 +1,110 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT license.
+
+/**
+ * Canvas-owned application read models assembled from structured storage.
+ *
+ * Two shapes, and the choice between them is about cost, not convenience.
+ * {@link readCanvasSnapshot} reads the record and *every* node, which is what
+ * a whole-Space job needs — hydrating a prestate, serving the Space to a
+ * client. {@link readCanvasNodesFor} reads the record and only the nodes
+ * named, which is what most callers actually want: a selection to describe, a
+ * neighbourhood to render, one view to serve. Reaching for the snapshot when
+ * a handful of ids would do makes the request cost grow with the Space.
+ */
+
+import { getStructuredStore } from '../storage/index.js';
+
+import type { CanvasFile, NodeContent } from './persistence-types.js';
+import type { NodeReadWarning } from '../storage/index.js';
+
+export interface CanvasReadSnapshot {
+  readonly canvas: CanvasFile;
+  readonly nodes: ReadonlyMap<string, NodeContent>;
+  readonly nodeWarnings: ReadonlyMap<string, readonly NodeReadWarning[]>;
+}
+
+function nodeRecords(
+  snapshots: ReadonlyMap<
+    string,
+    { readonly record: NodeContent; readonly revision: string }
+  >,
+): ReadonlyMap<string, NodeContent> {
+  return new Map(
+    [...snapshots].map(([nodeId, snapshot]) => [nodeId, snapshot.record]),
+  );
+}
+
+export async function readCanvas(canvasId: string): Promise<CanvasFile | null> {
+  return getStructuredStore().space(canvasId).read();
+}
+
+export async function readCanvasNode(
+  canvasId: string,
+  nodeId: string,
+): Promise<NodeContent | null> {
+  return (
+    (await getStructuredStore().space(canvasId).nodes.read(nodeId))?.record ??
+    null
+  );
+}
+
+function warningsOf(
+  snapshots: ReadonlyMap<
+    string,
+    { readonly warnings?: readonly NodeReadWarning[] }
+  >,
+): ReadonlyMap<string, readonly NodeReadWarning[]> {
+  return new Map(
+    [...snapshots]
+      .filter(([, snapshot]) => snapshot.warnings?.length)
+      .map(([nodeId, snapshot]) => [nodeId, snapshot.warnings ?? []]),
+  );
+}
+
+/** The Space record and every node record it holds. */
+export async function readCanvasSnapshot(
+  canvasId: string,
+): Promise<CanvasReadSnapshot | null> {
+  const handle = getStructuredStore().space(canvasId);
+  const canvas = await handle.read();
+  if (!canvas) return null;
+  const snapshots = await handle.nodes.list();
+  return {
+    canvas,
+    nodes: nodeRecords(snapshots),
+    nodeWarnings: warningsOf(snapshots),
+  };
+}
+
+/**
+ * The Space record plus the node records for `nodeIds` only.
+ *
+ * `nodes` is keyed the same way {@link readCanvasSnapshot} keys it and omits
+ * ids that hold no record, so a caller can read either one through the same
+ * lookups. Ids that are not in this Space simply do not appear.
+ */
+export async function readCanvasNodesFor(
+  canvasId: string,
+  nodeIds: Iterable<string>,
+): Promise<CanvasReadSnapshot | null> {
+  const handle = getStructuredStore().space(canvasId);
+  const canvas = await handle.read();
+  if (!canvas) return null;
+  const snapshots = await handle.nodes.readMany(nodeIds);
+  return {
+    canvas,
+    nodes: nodeRecords(snapshots),
+    nodeWarnings: warningsOf(snapshots),
+  };
+}
+
+/** Node records for `nodeIds`, without re-reading the Space record. */
+export async function readCanvasNodes(
+  canvasId: string,
+  nodeIds: Iterable<string>,
+): Promise<ReadonlyMap<string, NodeContent>> {
+  return nodeRecords(
+    await getStructuredStore().space(canvasId).nodes.readMany(nodeIds),
+  );
+}
diff --git a/apps/server/src/modules/canvas/sync.route.ts b/apps/server/src/modules/canvas/sync.route.ts
index add7e4978..778a478be 100644
--- a/apps/server/src/modules/canvas/sync.route.ts
+++ b/apps/server/src/modules/canvas/sync.route.ts
@@ -14,7 +14,7 @@
  */
 
 import { subscribeCanvasUpdates } from './canvas-sync.js';
-import { getCanvasStore } from '../storage/index.js';
+import { readCanvas } from './space-read.js';
 
 import type { CanvasSyncEvent } from '@huabu/shared';
 import type { FastifyPluginAsync } from 'fastify';
@@ -51,7 +51,7 @@ const syncRoutes: FastifyPluginAsync = async (fastify): Promise<void> => {
       // Subscribe before reading the baseline. Updates committed while the
       // snapshot is read are buffered and delivered after it, closing the
       // handshake race without reordering updates ahead of the snapshot.
-      const canvas = getCanvasStore(canvasId).read();
+      const canvas = await readCanvas(canvasId);
       writeSSE(reply.raw, {
         type: 'snapshot',
         data: { version: canvas?.version ?? 0 },
diff --git a/apps/server/src/modules/canvas/world-portal-policy.ts b/apps/server/src/modules/canvas/world-portal-policy.ts
index 606a97ec5..aa3557444 100644
--- a/apps/server/src/modules/canvas/world-portal-policy.ts
+++ b/apps/server/src/modules/canvas/world-portal-policy.ts
@@ -3,10 +3,7 @@
 
 import { fitPortals, getDescendantIds } from '@huabu/shared/canvas-engine';
 
-import {
-  isWorldCanvasId,
-  listCanvasDirEntries,
-} from '../storage/canvas-dirs.js';
+import { getStructuredStore, isWorldCanvasId } from '../storage/index.js';
 
 import type { CanvasCommand } from '@huabu/shared';
 import type { NestableNode } from '@huabu/shared/canvas-engine';
@@ -118,18 +115,18 @@ function ancestorPortal(
  * Validate the legacy full-state PUT boundary against the same Portal
  * ownership contract enforced for command execution.
  */
-export function assertWorldPortalTopologyAllowed(
+export async function assertWorldPortalTopologyAllowed(
   canvasId: string,
   previousNodesInput: readonly unknown[],
   nextNodesInput: readonly unknown[],
-): void {
+): Promise<void> {
   const previousNodes = storedNodes(previousNodesInput);
   const nextNodes = storedNodes(nextNodesInput);
   const nextPortals = nextNodes.filter((node) => node.type === 'canvasRef');
   const nextNodeRefs = nextNodes.filter(
     (node) => node.type === 'nodeRef' || node.type === 'frameRef',
   );
-  if (!isWorldCanvasId(canvasId)) {
+  if (!(await isWorldCanvasId(canvasId))) {
     if (nextPortals.length > 0 || nextNodeRefs.length > 0) {
       throw new WorldPortalMutationError(
         'Portals and references may only exist in the World Canvas',
@@ -284,7 +281,7 @@ export function assertWorldPortalTopologyAllowed(
   }
 
   const liveCanvasIds = new Set(
-    listCanvasDirEntries().map((entry) => entry.id),
+    (await getStructuredStore().spaces().list()).map((entry) => entry.canvasId),
   );
   for (const previous of previousNodes) {
     const previousNodeRef = nodeRefTarget(previous);
@@ -327,15 +324,15 @@ export function assertWorldPortalTopologyAllowed(
 }
 
 /** Recheck live Portal retention against the final sequential batch result. */
-export function assertWorldPortalResultAllowed(
+export async function assertWorldPortalResultAllowed(
   canvasId: string,
   previousNodesInput: readonly unknown[],
   nextNodesInput: readonly unknown[],
-): void {
-  if (!isWorldCanvasId(canvasId)) return;
+): Promise<void> {
+  if (!(await isWorldCanvasId(canvasId))) return;
 
   const liveCanvasIds = new Set(
-    listCanvasDirEntries().map((entry) => entry.id),
+    (await getStructuredStore().spaces().list()).map((entry) => entry.canvasId),
   );
   const nextById = new Map(
     storedNodes(nextNodesInput).map((node) => [node.id, node]),
@@ -353,12 +350,12 @@ export function assertWorldPortalResultAllowed(
 }
 
 /** Enforce server-authoritative ownership of canonical World Portals. */
-export function assertWorldPortalMutationsAllowed(
+export async function assertWorldPortalMutationsAllowed(
   canvasId: string,
   commands: readonly CanvasCommand[],
   nodes: readonly StoredNode[],
   source: 'ui' | 'agent' | 'system',
-): void {
+): Promise<void> {
   if (source === 'system') return;
 
   for (const command of commands) {
@@ -377,10 +374,10 @@ export function assertWorldPortalMutationsAllowed(
     }
   }
 
-  if (!isWorldCanvasId(canvasId)) return;
+  if (!(await isWorldCanvasId(canvasId))) return;
 
   const liveCanvasIds = new Set(
-    listCanvasDirEntries().map((entry) => entry.id),
+    (await getStructuredStore().spaces().list()).map((entry) => entry.canvasId),
   );
   const byId = new Map(nodes.map((node) => [node.id, node]));
 
diff --git a/apps/server/src/modules/canvas/world-portals.test.ts b/apps/server/src/modules/canvas/world-portals.test.ts
index a80bb40e7..ef2dad2a1 100644
--- a/apps/server/src/modules/canvas/world-portals.test.ts
+++ b/apps/server/src/modules/canvas/world-portals.test.ts
@@ -208,9 +208,9 @@ describe('World Portal reconciliation', () => {
     const previous = getCanvasStore('canvas-world').read()?.state.nodes;
     if (!previous) throw new Error('Missing World topology');
 
-    expect(() =>
+    await expect(
       assertWorldPortalTopologyAllowed('canvas-world', previous, []),
-    ).toThrow(WorldPortalMutationError);
+    ).rejects.toThrow(WorldPortalMutationError);
 
     const moved = structuredClone(previous) as Array<{
       type?: string;
@@ -219,11 +219,11 @@ describe('World Portal reconciliation', () => {
     const portal = moved.find((node) => node.type === 'canvasRef');
     if (!portal) throw new Error('Missing Portal');
     portal.position = { x: 999, y: 999 };
-    expect(() =>
+    await expect(
       assertWorldPortalTopologyAllowed('canvas-world', previous, moved),
-    ).not.toThrow();
+    ).resolves.toBeUndefined();
 
-    expect(() =>
+    await expect(
       assertWorldPortalTopologyAllowed(
         'canvas-a',
         [],
@@ -236,7 +236,7 @@ describe('World Portal reconciliation', () => {
           },
         ],
       ),
-    ).toThrow(WorldPortalMutationError);
+    ).rejects.toThrow(WorldPortalMutationError);
   });
 
   it('allows a nested reference subtree to leave with its broken Portal', async () => {
@@ -280,12 +280,12 @@ describe('World Portal reconciliation', () => {
     });
     refreshCanvasDirIndex();
 
-    expect(() =>
+    await expect(
       assertWorldPortalTopologyAllowed('canvas-world', previous, []),
-    ).not.toThrow();
+    ).resolves.toBeUndefined();
   });
 
-  it('rejects a manually resized frameRef behind an apparently fitted Portal', () => {
+  it('rejects a manually resized frameRef behind an apparently fitted Portal', async () => {
     const raw = [
       {
         id: 'node-portal',
@@ -321,13 +321,13 @@ describe('World Portal reconciliation', () => {
       },
     ] as NestableNode[];
     const canonical = fitPortals(raw, ['node-frame-ref', 'node-portal']);
-    expect(() =>
+    await expect(
       assertWorldPortalTopologyAllowed(
         'canvas-world',
         canonical,
         structuredClone(canonical),
       ),
-    ).not.toThrow();
+    ).resolves.toBeUndefined();
 
     const resized = structuredClone(canonical);
     const frameRef = resized.find((node) => node.id === 'node-frame-ref');
@@ -342,16 +342,16 @@ describe('World Portal reconciliation', () => {
     };
     const apparentlyFitted = fitPortalToChildren(resized, 'node-portal');
 
-    expect(() =>
+    await expect(
       assertWorldPortalTopologyAllowed(
         'canvas-world',
         canonical,
         apparentlyFitted,
       ),
-    ).toThrow('Frame reference size is managed by its contents');
+    ).rejects.toThrow('Frame reference size is managed by its contents');
   });
 
-  it('rejects resizing an empty frameRef through a full-state write', () => {
+  it('rejects resizing an empty frameRef through a full-state write', async () => {
     const raw = [
       {
         id: 'node-portal',
@@ -384,16 +384,16 @@ describe('World Portal reconciliation', () => {
     };
     const apparentlyFitted = fitPortalToChildren(resized, 'node-portal');
 
-    expect(() =>
+    await expect(
       assertWorldPortalTopologyAllowed(
         'canvas-world',
         canonical,
         apparentlyFitted,
       ),
-    ).toThrow('Frame reference size is managed by its contents');
+    ).rejects.toThrow('Frame reference size is managed by its contents');
   });
 
-  it('rejects cyclic frameRef topology without hanging during fit', () => {
+  it('rejects cyclic frameRef topology without hanging during fit', async () => {
     const cyclic = [
       {
         id: 'node-portal',
@@ -427,12 +427,12 @@ describe('World Portal reconciliation', () => {
       },
     ];
 
-    expect(() =>
+    await expect(
       assertWorldPortalTopologyAllowed(
         'canvas-world',
         cyclic,
         structuredClone(cyclic),
       ),
-    ).toThrow('World reference hierarchy is cyclic');
+    ).rejects.toThrow('World reference hierarchy is cyclic');
   });
 });
diff --git a/apps/server/src/modules/canvas/world-portals.ts b/apps/server/src/modules/canvas/world-portals.ts
index 57625b23c..7a949d5ea 100644
--- a/apps/server/src/modules/canvas/world-portals.ts
+++ b/apps/server/src/modules/canvas/world-portals.ts
@@ -13,11 +13,7 @@ import {
 } from '@huabu/shared/canvas-engine';
 
 import { executeOnServer } from './canvas-executor.js';
-import {
-  listCanvasDirEntries,
-  requireWorldCanvasId,
-} from '../storage/canvas-dirs.js';
-import { getCanvasStore } from '../storage/index.js';
+import { getStructuredStore, requireWorldCanvasId } from '../storage/index.js';
 
 const PORTAL_WIDTH = PORTAL_DEFAULT_WIDTH;
 const PORTAL_HEIGHT = PORTAL_DEFAULT_HEIGHT;
@@ -113,9 +109,10 @@ interface WorldPortalReconciliationPlan {
   inputs: CanvasNodeCreateInput[];
 }
 
-function planWorldPortalReconciliation(): WorldPortalReconciliationPlan {
-  const worldCanvasId = requireWorldCanvasId();
-  const world = getCanvasStore(worldCanvasId).read();
+async function planWorldPortalReconciliation(): Promise<WorldPortalReconciliationPlan> {
+  const structured = getStructuredStore();
+  const worldCanvasId = await requireWorldCanvasId();
+  const world = await structured.space(worldCanvasId).read();
   if (!world) {
     throw new WorldPortalIntegrityError('World Canvas is not readable');
   }
@@ -141,9 +138,9 @@ function planWorldPortalReconciliation(): WorldPortalReconciliationPlan {
     portalByTarget.set(targetCanvasId, node);
   }
 
-  const spaces = listCanvasDirEntries()
-    .filter((entry) => !portalByTarget.has(entry.id))
-    .sort((a, b) => a.id.localeCompare(b.id));
+  const spaces = (await structured.spaces().list())
+    .filter((entry) => !portalByTarget.has(entry.canvasId))
+    .sort((a, b) => a.canvasId.localeCompare(b.canvasId));
   const byId = new Map(nodes.map((node) => [node.id, node]));
   const occupied: Rect[] = nodes.map((node) => {
     const position = absolutePosition(node, byId);
@@ -168,7 +165,7 @@ function planWorldPortalReconciliation(): WorldPortalReconciliationPlan {
       position,
       size: { width: PORTAL_WIDTH, height: PORTAL_HEIGHT },
       data: {
-        targetCanvasId: space.id,
+        targetCanvasId: space.canvasId,
       },
       selectOnCreate: false,
     };
@@ -178,7 +175,7 @@ function planWorldPortalReconciliation(): WorldPortalReconciliationPlan {
 }
 
 async function reconcileWorldPortalsOnce(): Promise<void> {
-  const { worldCanvasId, inputs } = planWorldPortalReconciliation();
+  const { worldCanvasId, inputs } = await planWorldPortalReconciliation();
   if (inputs.length === 0) return;
 
   const command: CanvasCommand = {
diff --git a/apps/server/src/modules/canvas/world-reference-resolver.ts b/apps/server/src/modules/canvas/world-reference-resolver.ts
index d3c2b7276..772109ffa 100644
--- a/apps/server/src/modules/canvas/world-reference-resolver.ts
+++ b/apps/server/src/modules/canvas/world-reference-resolver.ts
@@ -5,13 +5,9 @@ import { agentBindingSchema, getQuestionNodeStatus } from '@huabu/shared';
 
 import { describeNode } from './node-prompt.js';
 import { readWorldTargetCanvasesStrict } from './world-target-access.js';
-import {
-  isWorldCanvasId,
-  refreshCanvasDirIndex,
-} from '../storage/canvas-dirs.js';
-import { getCanvasStore } from '../storage/index.js';
+import { getStructuredStore, isWorldCanvasId } from '../storage/index.js';
 
-import type { CanvasFile, NodeContent } from '../storage/canvas-store.js';
+import type { CanvasFile, NodeContent } from './persistence-types.js';
 import type {
   CanvasNodeType,
   GetWorldReferencesResponse,
@@ -40,12 +36,13 @@ interface SourceCanvas {
 export async function resolveWorldReferences(
   worldCanvasId: string,
 ): Promise<GetWorldReferencesResponse> {
-  if (!isWorldCanvasId(worldCanvasId)) {
+  if (!(await isWorldCanvasId(worldCanvasId))) {
     throw new WorldReferenceResolutionError(
       'References can be resolved only for the World Canvas',
     );
   }
-  const world = getCanvasStore(worldCanvasId).read();
+  const structured = getStructuredStore();
+  const world = await structured.space(worldCanvasId).read();
   if (!world) {
     throw new WorldReferenceResolutionError('World Canvas is not readable');
   }
@@ -76,16 +73,24 @@ export async function resolveWorldReferences(
   }
 
   const sources = new Map<string, SourceCanvas>();
-  const sourceCanvases = readWorldTargetCanvasesStrict(sourceCanvasIds);
-  refreshCanvasDirIndex();
+  const sourceCanvases = await readWorldTargetCanvasesStrict(sourceCanvasIds);
   await Promise.all(
     [...sourceCanvasIds].map(async (canvasId) => {
-      const store = getCanvasStore(canvasId);
       const canvas = sourceCanvases.get(canvasId) ?? null;
+      const snapshots = canvas
+        ? await structured.space(canvasId).nodes.list()
+        : null;
       sources.set(canvasId, {
         canvas,
-        ...(canvas
-          ? { content: await store.readAllNodes({ strict: true }) }
+        ...(snapshots
+          ? {
+              content: new Map(
+                [...snapshots].map(([nodeId, snapshot]) => [
+                  nodeId,
+                  snapshot.record,
+                ]),
+              ),
+            }
           : {}),
       });
     }),
@@ -141,7 +146,6 @@ export async function resolveWorldReferences(
 
     const sourceContent = source.content?.get(target.nodeId) ?? null;
     const resolved = describeNode(
-      getCanvasStore(target.canvasId),
       {
         id: target.nodeId,
         type: sourceNode.type as CanvasNodeType,
diff --git a/apps/server/src/modules/canvas/world-target-access.ts b/apps/server/src/modules/canvas/world-target-access.ts
index 714a54174..a5b7bb7b5 100644
--- a/apps/server/src/modules/canvas/world-target-access.ts
+++ b/apps/server/src/modules/canvas/world-target-access.ts
@@ -1,18 +1,9 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 
-import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
-import path from 'node:path';
+import { getStructuredStore, isWorldCanvasId } from '../storage/index.js';
 
-import {
-  isWorldCanvasId,
-  refreshCanvasDirIndex,
-} from '../storage/canvas-dirs.js';
-import { getCanvasStore } from '../storage/index.js';
-import { SPACE_JSON_FILENAME } from '../storage/paths.js';
-import { getWorkspacePath } from '../workspace.js';
-
-import type { CanvasFile } from '../storage/canvas-store.js';
+import type { CanvasFile } from './persistence-types.js';
 
 interface StoredNode {
   type?: string;
@@ -26,38 +17,35 @@ export class WorldTargetAccessError extends Error {
   }
 }
 
-export function readWorldTargetCanvasesStrict(
+/**
+ * Read the named Spaces, refusing a record whose topology is unusable.
+ *
+ * The strictness is the point of the name: a cross-Space read must not
+ * silently present a Space whose `state` is not a pair of arrays as an empty
+ * one. The check reads the record rather than the substrate, so it survives a
+ * backend that keeps topology in tables.
+ */
+export async function readWorldTargetCanvasesStrict(
   canvasIds: ReadonlySet<string>,
-): Map<string, CanvasFile | null> {
-  const matches = new Map<string, CanvasFile | null>(
-    [...canvasIds].map((canvasId) => [canvasId, null] as const),
+): Promise<Map<string, CanvasFile | null>> {
+  const structured = getStructuredStore();
+  return new Map(
+    await Promise.all(
+      [...canvasIds].map(async (canvasId) => {
+        const canvas = await structured.space(canvasId).read();
+        if (
+          canvas &&
+          (!Array.isArray(canvas.state?.nodes) ||
+            !Array.isArray(canvas.state.edges))
+        ) {
+          throw new WorldTargetAccessError(
+            `Canvas ${canvasId} has malformed topology`,
+          );
+        }
+        return [canvasId, canvas] as const;
+      }),
+    ),
   );
-  const workspace = getWorkspacePath();
-  for (const entry of readdirSync(workspace)) {
-    if (entry.startsWith('.')) continue;
-    const root = path.join(workspace, entry);
-    if (!statSync(root).isDirectory()) continue;
-    const topologyPath = path.join(root, SPACE_JSON_FILENAME);
-    if (!existsSync(topologyPath)) continue;
-    const raw = readFileSync(topologyPath, 'utf8');
-    const canvas = JSON.parse(raw) as CanvasFile;
-    if (!canvasIds.has(canvas.canvasId)) continue;
-    if (matches.get(canvas.canvasId)) {
-      throw new WorldTargetAccessError(
-        `Canvas ${canvas.canvasId} has duplicate topology`,
-      );
-    }
-    if (
-      !Array.isArray(canvas.state?.nodes) ||
-      !Array.isArray(canvas.state.edges)
-    ) {
-      throw new WorldTargetAccessError(
-        `Canvas ${canvas.canvasId} has malformed topology`,
-      );
-    }
-    matches.set(canvas.canvasId, canvas);
-  }
-  return matches;
 }
 
 /**
@@ -65,18 +53,18 @@ export function readWorldTargetCanvasesStrict(
  * Explicit cross-Canvas reads are available only from World and only through
  * one canonical Portal in the current World topology.
  */
-export function resolveWorldReadCanvasId(
+export async function resolveWorldReadCanvasId(
   ownerCanvasId: string,
   targetCanvasId: string | undefined,
-): string {
+): Promise<string> {
   if (!targetCanvasId) return ownerCanvasId;
-  if (!isWorldCanvasId(ownerCanvasId)) {
+  if (!(await isWorldCanvasId(ownerCanvasId))) {
     throw new WorldTargetAccessError(
       'targetCanvasId is available only in a World conversation',
     );
   }
 
-  const world = getCanvasStore(ownerCanvasId).read();
+  const world = await getStructuredStore().space(ownerCanvasId).read();
   if (!world) {
     throw new WorldTargetAccessError('World Canvas is not readable');
   }
@@ -90,7 +78,13 @@ export function resolveWorldReadCanvasId(
       `Canvas ${targetCanvasId} is not addressed by one canonical World Portal`,
     );
   }
-  readWorldTargetCanvasesStrict(new Set([targetCanvasId]));
-  refreshCanvasDirIndex();
+  const target = (
+    await readWorldTargetCanvasesStrict(new Set([targetCanvasId]))
+  ).get(targetCanvasId);
+  if (!target) {
+    throw new WorldTargetAccessError(
+      `Canvas ${targetCanvasId} is not readable`,
+    );
+  }
   return targetCanvasId;
 }
diff --git a/apps/server/src/modules/canvas/write-coordinator.test.ts b/apps/server/src/modules/canvas/write-coordinator.test.ts
index a720b8a3a..3b391c616 100644
--- a/apps/server/src/modules/canvas/write-coordinator.test.ts
+++ b/apps/server/src/modules/canvas/write-coordinator.test.ts
@@ -33,6 +33,20 @@ function fakeRepository(canvasId = 'c1') {
       if (revision === null) throw new Error('test storage token is missing');
       return { record, revision };
     },
+    async list(): Promise<ReadonlyMap<string, NodeSnapshot>> {
+      const snapshot = await nodes.read('n1');
+      return snapshot ? new Map([['n1', snapshot]]) : new Map();
+    },
+    async readMany(nodeIds): Promise<ReadonlyMap<string, NodeSnapshot>> {
+      const listed = await nodes.list();
+      const wanted = new Set(nodeIds);
+      return new Map([...listed].filter(([nodeId]) => wanted.has(nodeId)));
+    },
+    async stream(onNode): Promise<ReadonlyMap<string, NodeSnapshot>> {
+      const snapshots = await nodes.list();
+      for (const [nodeId, snapshot] of snapshots) onNode(nodeId, snapshot);
+      return snapshots;
+    },
     async put(input) {
       if (suppressed) return { ok: false, reason: 'write-suppressed' };
       const currentRevision = storageRevisionOf(record);
diff --git a/apps/server/src/modules/interactive-view/interactive-view.route.ts b/apps/server/src/modules/interactive-view/interactive-view.route.ts
index 0e8124c97..b6966eeab 100644
--- a/apps/server/src/modules/interactive-view/interactive-view.route.ts
+++ b/apps/server/src/modules/interactive-view/interactive-view.route.ts
@@ -58,7 +58,7 @@ const interactiveViewRoutes: FastifyPluginAsync = async (app) => {
       });
     }
     try {
-      const resource = interactiveViewService.get(
+      const resource = await interactiveViewService.get(
         params.data.canvasId,
         params.data.nodeId,
       );
@@ -153,7 +153,10 @@ const interactiveViewRoutes: FastifyPluginAsync = async (app) => {
     }
     try {
       return reply.send(
-        interactiveViewService.get(parsed.data.canvasId, parsed.data.nodeId),
+        await interactiveViewService.get(
+          parsed.data.canvasId,
+          parsed.data.nodeId,
+        ),
       );
     } catch (error) {
       if (error instanceof InteractiveViewServiceError) {
diff --git a/apps/server/src/modules/interactive-view/interactive-view.service.ts b/apps/server/src/modules/interactive-view/interactive-view.service.ts
index 7d91903e9..41064d9fd 100644
--- a/apps/server/src/modules/interactive-view/interactive-view.service.ts
+++ b/apps/server/src/modules/interactive-view/interactive-view.service.ts
@@ -33,10 +33,11 @@ import {
   type InteractiveViewConflict,
 } from '../canvas/canvas-executor.js';
 import {
-  canvasBlobs,
-  getCanvasStore,
-  getStructuredStore,
-} from '../storage/index.js';
+  readCanvas,
+  readCanvasNode,
+  readCanvasNodes,
+} from '../canvas/space-read.js';
+import { canvasBlobs, getStructuredStore } from '../storage/index.js';
 
 import type { FastifyBaseLogger } from 'fastify';
 
@@ -74,12 +75,12 @@ export class InteractiveViewServiceError extends Error {
   }
 }
 
-function resolveOwnerThread(
+async function resolveOwnerThread(
   canvasId: string,
   threadId: string,
-): ExternalAgentThreadTarget | null {
+): Promise<ExternalAgentThreadTarget | null> {
   try {
-    return agentThreadService.resolveExternalTarget(canvasId, threadId);
+    return await agentThreadService.resolveExternalTarget(canvasId, threadId);
   } catch (error) {
     if (error instanceof AgentThreadResolutionError) {
       throw new InteractiveViewServiceError(
@@ -160,8 +161,8 @@ function validateDefinition(definition: InteractiveViewDefinitionV1): void {
 }
 
 function resourceFromNode(
-  canvasId: string,
   node: StoredNode,
+  sidecar: { src?: string } | null | undefined,
 ): InteractiveViewResource | null {
   if (node.type !== 'web' || typeof node.id !== 'string') return null;
   const data =
@@ -172,7 +173,6 @@ function resourceFromNode(
     data.interactiveView,
   );
   if (!parsed.success) return null;
-  const sidecar = getCanvasStore(canvasId).readNode(node.id);
   const rendererArtifact =
     typeof sidecar?.src === 'string'
       ? sidecar.src
@@ -190,16 +190,31 @@ function resourceFromNode(
 }
 
 export class InteractiveViewService {
-  list(canvasId: string, viewKey?: string): InteractiveViewResource[] {
-    const canvas = getCanvasStore(canvasId).read();
+  async list(
+    canvasId: string,
+    viewKey?: string,
+  ): Promise<InteractiveViewResource[]> {
+    const canvas = await readCanvas(canvasId);
     if (!canvas) {
       throw new InteractiveViewServiceError(
         'canvas_not_found',
         `Canvas ${canvasId} does not exist`,
       );
     }
-    return (canvas.state.nodes as StoredNode[]).flatMap((node) => {
-      const resource = resourceFromNode(canvasId, node);
+    const nodes = canvas.state.nodes as StoredNode[];
+    // Only `web` nodes can carry a View, and their records supply nothing but
+    // the renderer artifact — so read those, not the Space.
+    const records = await readCanvasNodes(
+      canvasId,
+      nodes.flatMap((node) =>
+        node.type === 'web' && typeof node.id === 'string' ? [node.id] : [],
+      ),
+    );
+    return nodes.flatMap((node) => {
+      const resource = resourceFromNode(
+        node,
+        typeof node.id === 'string' ? records.get(node.id) : null,
+      );
       if (
         !resource ||
         (viewKey !== undefined && resource.viewKey !== viewKey)
@@ -210,8 +225,11 @@ export class InteractiveViewService {
     });
   }
 
-  get(canvasId: string, nodeId: string): InteractiveViewResource {
-    const canvas = getCanvasStore(canvasId).read();
+  async get(
+    canvasId: string,
+    nodeId: string,
+  ): Promise<InteractiveViewResource> {
+    const canvas = await readCanvas(canvasId);
     if (!canvas) {
       throw new InteractiveViewServiceError(
         'canvas_not_found',
@@ -221,7 +239,9 @@ export class InteractiveViewService {
     const node = (canvas.state.nodes as StoredNode[]).find(
       (candidate) => candidate.id === nodeId,
     );
-    const resource = node ? resourceFromNode(canvasId, node) : null;
+    const resource = node
+      ? resourceFromNode(node, await readCanvasNode(canvasId, nodeId))
+      : null;
     if (!resource) {
       throw new InteractiveViewServiceError(
         'view_not_found',
@@ -235,7 +255,7 @@ export class InteractiveViewService {
     canvasId: string,
     nodeId: string,
   ): Promise<InteractiveViewRuntimeSnapshot> {
-    const resource = this.get(canvasId, nodeId);
+    const resource = await this.get(canvasId, nodeId);
     const data: InteractiveViewRuntimeSnapshot['data'] = {};
     for (const binding of resource.definition.bindings) {
       let value: InteractiveViewJsonValue;
@@ -277,7 +297,7 @@ export class InteractiveViewService {
           if (run.rootThreadId) threadIds.add(run.rootThreadId);
         }
       } else {
-        const canvas = getCanvasStore(canvasId).read();
+        const canvas = await readCanvas(canvasId);
         if (!canvas) {
           throw new InteractiveViewServiceError(
             'canvas_not_found',
@@ -328,14 +348,14 @@ export class InteractiveViewService {
     canvasId: string,
     request: CreateInteractiveViewRequest,
   ): Promise<InteractiveViewResource> {
-    const canvas = getCanvasStore(canvasId).read();
+    const canvas = await readCanvas(canvasId);
     if (!canvas) {
       throw new InteractiveViewServiceError(
         'canvas_not_found',
         `Canvas ${canvasId} does not exist`,
       );
     }
-    if (!resolveOwnerThread(canvasId, request.ownerThreadId)) {
+    if (!(await resolveOwnerThread(canvasId, request.ownerThreadId))) {
       throw new InteractiveViewServiceError(
         'invalid_owner_thread',
         `Owner thread ${request.ownerThreadId} is not an external Agent thread in this Canvas`,
@@ -398,7 +418,7 @@ export class InteractiveViewService {
         output.results[0]?.reason ?? 'Interactive View creation was rejected',
       );
     }
-    return this.get(canvasId, nodeId);
+    return await this.get(canvasId, nodeId);
   }
 
   async replaceState(
@@ -408,7 +428,7 @@ export class InteractiveViewService {
     value: InteractiveViewJsonValue,
     actor: 'host-bridge' | 'trusted-agent',
   ): Promise<InteractiveViewResource> {
-    const current = this.get(canvasId, nodeId);
+    const current = await this.get(canvasId, nodeId);
     if (
       actor === 'host-bridge' &&
       !current.definition.actions.some(
@@ -466,7 +486,7 @@ export class InteractiveViewService {
         output.results[0]?.reason ?? 'Interactive View update was rejected',
       );
     }
-    return this.get(canvasId, nodeId);
+    return await this.get(canvasId, nodeId);
   }
 
   async submitAgentEvent(
@@ -481,7 +501,7 @@ export class InteractiveViewService {
     if (inputIssue) {
       throw new InteractiveViewServiceError('invalid_definition', inputIssue);
     }
-    const resource = this.get(canvasId, nodeId);
+    const resource = await this.get(canvasId, nodeId);
     const grant = resource.definition.actions.find(
       (candidate) => candidate.actionId === actionId,
     );
@@ -505,7 +525,7 @@ export class InteractiveViewService {
       ...(input !== undefined ? { input } : {}),
       viewRevision: resource.revision,
     };
-    const ownerTarget = resolveOwnerThread(
+    const ownerTarget = await resolveOwnerThread(
       canvasId,
       resource.definition.ownerThreadId,
     );
diff --git a/apps/server/src/modules/remote_fs/node-meta.ts b/apps/server/src/modules/remote_fs/node-meta.ts
index b92a4e144..628c078e1 100644
--- a/apps/server/src/modules/remote_fs/node-meta.ts
+++ b/apps/server/src/modules/remote_fs/node-meta.ts
@@ -38,7 +38,8 @@ import {
   safeResolve,
   toPhysicalRel,
 } from '../agent/tools/handlers/fs-sandbox.js';
-import { getCanvasStore } from '../storage/index.js';
+import { readCanvas, readCanvasNode } from '../canvas/space-read.js';
+import { diskSpaceTree } from '../storage/index.js';
 
 import type { CanvasNodeType } from '@huabu/shared';
 import type { CanvasNode, CanvasEdge } from '@huabu/shared/canvas-engine';
@@ -88,31 +89,32 @@ const NODE_FILE_RE = /^nodes\/[^/]+\.md$/;
  * the path is not a node file or no node currently claims it — callers then
  * serve the bytes without `X-Huabu-*` headers.
  *
- * The file → node mapping goes through the store's frontmatter-`id` index
- * ({@link CanvasStore.nodeIdForFilename}), NOT a re-derived
- * `toSafeFilename(label)` — topology never carries `data.label`, so the
- * derived path would collapse to `nodes/<id>.md` and never match a real
- * label-named file. `label` / `rev` are then sourced from the sidecar.
+ * The file → node mapping is asked of the materialization capability, NOT
+ * re-derived from `toSafeFilename(label)` and not read out of the file's own
+ * frontmatter — topology never carries `data.label`, so the derived path
+ * would collapse to `nodes/<id>.md` and never match a real label-named file,
+ * and reading the id out of the bytes would bind this route to one backend's
+ * record encoding. `label` / `rev` are then sourced from the node record.
  */
-export function lookupNodeByPath(
+export async function lookupNodeByPath(
   canvasId: string,
   physicalRel: string,
-): RfsNodeLookup | null {
+): Promise<RfsNodeLookup | null> {
   if (!NODE_FILE_RE.test(physicalRel)) return null;
 
-  const store = getCanvasStore(canvasId);
-  const canvas = store.read();
-  if (!canvas) return null;
+  const nodeId = await diskSpaceTree(canvasId).nodeIdForPath(physicalRel);
+  if (nodeId === null) return null;
 
-  const filename = physicalRel.slice('nodes/'.length);
-  const nodeId = store.nodeIdForFilename(filename);
-  if (!nodeId) return null;
+  const [canvas, sidecar] = await Promise.all([
+    readCanvas(canvasId),
+    readCanvasNode(canvasId, nodeId),
+  ]);
+  if (!canvas) return null;
 
   const nodes = (canvas.state.nodes ?? []) as CanvasNode[];
   const match = nodes.find((n) => n.id === nodeId);
   if (!match) return null;
 
-  const sidecar = store.readNode(nodeId);
   const data = (match.data ?? {}) as {
     locked?: boolean;
     src?: string;
diff --git a/apps/server/src/modules/remote_fs/rfs.route.test.ts b/apps/server/src/modules/remote_fs/rfs.route.test.ts
index 7fcd331b3..34062aefa 100644
--- a/apps/server/src/modules/remote_fs/rfs.route.test.ts
+++ b/apps/server/src/modules/remote_fs/rfs.route.test.ts
@@ -59,7 +59,7 @@ import * as selectableProfiles from '../agent/selectable-agent-profile.js';
 import {
   getCanvasStore,
   resetStorageCache,
-  spaceDirectory,
+  diskSpaceTree,
 } from '../storage/index.js';
 import {
   RunCompletionError,
@@ -159,7 +159,7 @@ describe('GET /api/rfs/:canvasId/skill', () => {
   it('returns only the bundled root guide without authorization', async () => {
     seedNote('c1', 'node-1', 'Anchor', 'content');
     writeFileSync(
-      join(spaceDirectory('c1'), 'skill.md'),
+      join(diskSpaceTree('c1').directory(), 'skill.md'),
       '# Private Space Override',
       'utf8',
     );
@@ -1321,7 +1321,7 @@ describe('node download revision (ETag / conditional GET)', () => {
 
 describe('POST /api/rfs/:canvasId/agent', () => {
   it('creates an idle Agent and connects its parent when available', async () => {
-    vi.spyOn(agentThreadResolver, 'resolveAgentNodeId').mockReturnValue(
+    vi.spyOn(agentThreadResolver, 'resolveAgentNodeId').mockResolvedValue(
       'node-parent' as CanvasNodeId,
     );
     const create = vi.spyOn(agentNodeService, 'create').mockResolvedValue({
@@ -1419,7 +1419,9 @@ describe('POST /api/rfs/:canvasId/agent', () => {
       content: '',
     });
 
-    vi.spyOn(agentThreadService, 'resolveFixedTarget').mockReturnValue(target);
+    vi.spyOn(agentThreadService, 'resolveFixedTarget').mockResolvedValue(
+      target,
+    );
     const dispose = vi.fn().mockResolvedValue(undefined);
     const invoke = vi
       .spyOn(agentThreadService, 'invoke')
@@ -1482,7 +1484,9 @@ describe('POST /api/rfs/:canvasId/agent', () => {
       profileId: 'huabu',
       parentConnection: 'not_requested',
     });
-    vi.spyOn(agentThreadService, 'resolveFixedTarget').mockReturnValue(target);
+    vi.spyOn(agentThreadService, 'resolveFixedTarget').mockResolvedValue(
+      target,
+    );
     vi.spyOn(agentThreadService, 'invoke').mockImplementation(
       async (options) => ({
         binding: target.agentBinding,
@@ -1529,7 +1533,7 @@ describe('POST /api/rfs/:canvasId/agent', () => {
       profileId: 'huabu',
       parentConnection: 'not_requested',
     });
-    vi.spyOn(agentThreadService, 'resolveFixedTarget').mockReturnValue(null);
+    vi.spyOn(agentThreadService, 'resolveFixedTarget').mockResolvedValue(null);
 
     const app = await buildApp();
     try {
@@ -1561,7 +1565,9 @@ describe('POST /api/rfs/:canvasId/agent', () => {
       status: 'done',
       content: 'Earlier request',
     };
-    vi.spyOn(agentThreadService, 'resolveFixedTarget').mockReturnValue(target);
+    vi.spyOn(agentThreadService, 'resolveFixedTarget').mockResolvedValue(
+      target,
+    );
     const invoke = vi
       .spyOn(agentThreadService, 'invoke')
       .mockImplementation(async (options) => ({
@@ -1610,7 +1616,7 @@ describe('POST /api/rfs/:canvasId/agent', () => {
   });
 
   it('returns thread_not_found before opening SSE', async () => {
-    vi.spyOn(agentThreadService, 'resolveFixedTarget').mockReturnValue(null);
+    vi.spyOn(agentThreadService, 'resolveFixedTarget').mockResolvedValue(null);
 
     const app = await buildApp();
     try {
@@ -1630,7 +1636,7 @@ describe('POST /api/rfs/:canvasId/agent', () => {
 
   it('creates the Agent when its requested parent cannot be found', async () => {
     seedNote('c1', 'node-anchor', 'Anchor', 'content');
-    vi.spyOn(agentThreadResolver, 'resolveAgentNodeId').mockReturnValue(null);
+    vi.spyOn(agentThreadResolver, 'resolveAgentNodeId').mockResolvedValue(null);
     vi.spyOn(agentNodeService, 'create').mockResolvedValue({
       canvasId: 'c1',
       nodeId: 'node-independent' as CanvasNodeId,
@@ -1677,7 +1683,9 @@ describe('POST /api/rfs/:canvasId/agent', () => {
       status: 'running',
       content: 'Working',
     };
-    vi.spyOn(agentThreadService, 'resolveFixedTarget').mockReturnValue(target);
+    vi.spyOn(agentThreadService, 'resolveFixedTarget').mockResolvedValue(
+      target,
+    );
     vi.spyOn(agentThreadService, 'invoke').mockRejectedValue(
       new AgentThreadBusyError('thread-busy'),
     );
@@ -1707,7 +1715,9 @@ describe('POST /api/rfs/:canvasId/agent', () => {
       status: 'idle',
       content: '',
     };
-    vi.spyOn(agentThreadService, 'resolveFixedTarget').mockReturnValue(target);
+    vi.spyOn(agentThreadService, 'resolveFixedTarget').mockResolvedValue(
+      target,
+    );
     vi.spyOn(agentThreadService, 'invoke').mockImplementation(
       async (options) => ({
         binding: target.agentBinding,
@@ -1746,7 +1756,9 @@ describe('POST /api/rfs/:canvasId/agent', () => {
       status: 'idle',
       content: '',
     };
-    vi.spyOn(agentThreadService, 'resolveFixedTarget').mockReturnValue(target);
+    vi.spyOn(agentThreadService, 'resolveFixedTarget').mockResolvedValue(
+      target,
+    );
     vi.spyOn(agentThreadService, 'invoke').mockImplementation(
       async (options) => ({
         binding: target.agentBinding,
diff --git a/apps/server/src/modules/remote_fs/rfs.route.ts b/apps/server/src/modules/remote_fs/rfs.route.ts
index 495d4c484..8e2293891 100644
--- a/apps/server/src/modules/remote_fs/rfs.route.ts
+++ b/apps/server/src/modules/remote_fs/rfs.route.ts
@@ -317,7 +317,7 @@ const rfsRoutes: FastifyPluginAsync = async (app) => {
     }
     try {
       return reply.send({
-        views: interactiveViewService.list(
+        views: await interactiveViewService.list(
           request.params.canvasId,
           query.data.viewKey,
         ),
@@ -391,7 +391,10 @@ const rfsRoutes: FastifyPluginAsync = async (app) => {
     }
     try {
       return reply.send(
-        interactiveViewService.get(params.data.canvasId, params.data.nodeId),
+        await interactiveViewService.get(
+          params.data.canvasId,
+          params.data.nodeId,
+        ),
       );
     } catch (error) {
       if (error instanceof InteractiveViewServiceError) {
@@ -667,7 +670,7 @@ const rfsRoutes: FastifyPluginAsync = async (app) => {
         return reply.code(404).send(rfsError(`No file at "${requestRel}".`));
       }
 
-      const lookup = lookupNodeByPath(canvasId, physicalRel);
+      const lookup = await lookupNodeByPath(canvasId, physicalRel);
 
       // Node files carry a revision ETag (hash of authored content) so an
       // agent can conditional-GET: an unchanged node returns `304` and the
@@ -1064,7 +1067,7 @@ const rfsRoutes: FastifyPluginAsync = async (app) => {
       let parentLookupFailed = false;
       if (parentThreadId) {
         try {
-          parentNodeId = agentThreadResolver.resolveAgentNodeId(
+          parentNodeId = await agentThreadResolver.resolveAgentNodeId(
             canvasId,
             parentThreadId,
           );
@@ -1081,7 +1084,7 @@ const rfsRoutes: FastifyPluginAsync = async (app) => {
       try {
         position =
           creation.position ??
-          resolveAgentNodePosition(canvasId, parentNodeId ?? undefined);
+          (await resolveAgentNodePosition(canvasId, parentNodeId ?? undefined));
       } catch (error) {
         if (
           error instanceof AgentNodeCreationError &&
@@ -1185,7 +1188,7 @@ const rfsRoutes: FastifyPluginAsync = async (app) => {
           .send(rfsError('An initial prompt is required.', 'prompt_required'));
       }
 
-      const target = agentThreadService.resolveFixedTarget(
+      const target = await agentThreadService.resolveFixedTarget(
         canvasId,
         created.threadId,
       );
@@ -1325,7 +1328,10 @@ const rfsRoutes: FastifyPluginAsync = async (app) => {
 
       let target;
       try {
-        target = agentThreadService.resolveFixedTarget(canvasId, threadId);
+        target = await agentThreadService.resolveFixedTarget(
+          canvasId,
+          threadId,
+        );
       } catch (error) {
         if (error instanceof AgentThreadResolutionError) {
           return reply
diff --git a/apps/server/src/modules/remote_fs/skill.ts b/apps/server/src/modules/remote_fs/skill.ts
index 7dcbb5c97..3f61da5b7 100644
--- a/apps/server/src/modules/remote_fs/skill.ts
+++ b/apps/server/src/modules/remote_fs/skill.ts
@@ -15,7 +15,7 @@ import { existsSync, readFileSync } from 'node:fs';
 import path from 'node:path';
 
 import { renderPromptFile } from '../../prompt/agents/loader.js';
-import { spaceDirectory } from '../storage/index.js';
+import { diskSpaceTree } from '../storage/index.js';
 
 /** PROMPT-ROOT-relative path of the bundled access guide. */
 const ACCESS_GUIDE_TEMPLATE = 'external-agent/access-huabu.md';
@@ -40,7 +40,7 @@ export function resolveBundledRootSkill(): string {
  * markdown text (served with `Content-Type: text/markdown`).
  */
 export function resolveCanvasSkill(canvasId: string): string {
-  const override = path.join(spaceDirectory(canvasId), 'skill.md');
+  const override = path.join(diskSpaceTree(canvasId).directory(), 'skill.md');
   if (existsSync(override)) {
     return readFileSync(override, 'utf8');
   }
diff --git a/apps/server/src/modules/storage/backends/disk/blob-store.ts b/apps/server/src/modules/storage/backends/disk/blob-store.ts
index 88dd8eb6d..bc85aff15 100644
--- a/apps/server/src/modules/storage/backends/disk/blob-store.ts
+++ b/apps/server/src/modules/storage/backends/disk/blob-store.ts
@@ -26,7 +26,7 @@ import {
 import path from 'node:path';
 import { pipeline } from 'node:stream/promises';
 
-import { artifactsDir } from './layout.js';
+import { ARTIFACTS_DIR_NAME, canvasRoot } from './layout.js';
 import { renameOverWithRetry } from '../../../../utils/fs.js';
 import { getWorkspacePath } from '../../../workspace.js';
 import { createBlobLease, normalizeBlobName } from '../../ports/blob.js';
@@ -56,11 +56,6 @@ function isTempEntry(entry: string): boolean {
   return entry.startsWith(TEMP_PREFIX);
 }
 
-/** Resolve a scope to its backing directory. */
-function scopeDir(ref: BlobScopeRef): string {
-  return artifactsDir(ref.canvasId);
-}
-
 /** Resolve one blob beneath an already-bound scope directory. */
 function blobPath(dir: string, name: string): string {
   return path.join(dir, normalizeBlobName(name));
@@ -91,7 +86,10 @@ class DiskBlobScope implements BlobScope {
     // Resolve once per operation, before its first await. Every later path in
     // that operation is derived from this absolute directory, so a workspace
     // switch cannot combine a temp in A with a destination in B.
-    return scopeDir(this.#ref);
+    // The Disk blob adapter owns its own placement. Borrowing it from the
+    // Space-tree capability made two modules answer "where is this Space",
+    // which is one more than can stay in agreement.
+    return path.join(canvasRoot(this.#ref.canvasId), ARTIFACTS_DIR_NAME);
   }
 
   async #headAt(dir: string, name: string): Promise<BlobInfo | null> {
diff --git a/apps/server/src/modules/storage/backends/disk/canvas-dirs.ts b/apps/server/src/modules/storage/backends/disk/canvas-dirs.ts
index 1780e1065..b674ab6ca 100644
--- a/apps/server/src/modules/storage/backends/disk/canvas-dirs.ts
+++ b/apps/server/src/modules/storage/backends/disk/canvas-dirs.ts
@@ -124,7 +124,12 @@ function scanWorkspace(): void {
       continue;
     }
     const canvasEntry = readCanvasDirEntry(full, entry);
-    if (canvasEntry) index.add(canvasEntry);
+    if (canvasEntry) {
+      if (index.has(canvasEntry.id)) {
+        throw new Error(`Duplicate ordinary Space canvasId: ${canvasEntry.id}`);
+      }
+      index.add(canvasEntry);
+    }
   }
   if (worldEntry && index.has(worldEntry.id)) {
     throw new Error(
diff --git a/apps/server/src/modules/storage/backends/disk/legacy/canvas-store.ts b/apps/server/src/modules/storage/backends/disk/legacy/canvas-store.ts
index d020fd9bd..a5c180fd1 100644
--- a/apps/server/src/modules/storage/backends/disk/legacy/canvas-store.ts
+++ b/apps/server/src/modules/storage/backends/disk/legacy/canvas-store.ts
@@ -952,6 +952,7 @@ export class CanvasStore {
   async streamAllNodes(
     onNode: (id: string, content: NodeContent) => void,
     signal?: { readonly aborted: boolean },
+    options?: { strict?: boolean },
   ): Promise<Map<string, NodeContent>> {
     this.assertActiveWorkspace();
     const generation = this.nodeIndexGeneration;
@@ -967,7 +968,9 @@ export class CanvasStore {
           indexIsConclusive = false;
           return;
         }
-        const raw = await readTextAsync(path.join(dir, file));
+        const raw = options?.strict
+          ? await readFile(path.join(dir, file), 'utf8')
+          : await readTextAsync(path.join(dir, file));
         if (raw === null) {
           indexIsConclusive = false;
           return;
@@ -980,7 +983,7 @@ export class CanvasStore {
             ? rawId
             : file.replace(/\.md$/, '');
         addSidecarToIndex(idx, duplicates, this.canvasId, id, file);
-        const content = markdownToNodeContent(id, raw);
+        const content = markdownToNodeContent(id, raw, options?.strict);
         contents.set(id, content);
         // JS is single-threaded between awaits, so even though
         // multiple workers may be in-flight, exactly one onNode call
diff --git a/apps/server/src/modules/storage/backends/disk/space-dir-handles.ts b/apps/server/src/modules/storage/backends/disk/space-dir-handles.ts
index c090d0c30..894624e44 100644
--- a/apps/server/src/modules/storage/backends/disk/space-dir-handles.ts
+++ b/apps/server/src/modules/storage/backends/disk/space-dir-handles.ts
@@ -20,13 +20,13 @@
 /** A component holding OS handles inside one Space directory. */
 export interface SpaceDirHandleOwner {
   /** Close every handle held inside the Space directory. */
-  release(): void;
+  release(): Promise<void> | void;
   /**
    * Re-acquire handles after the mutation. The Space directory may have been
    * renamed or deleted, so implementations must re-resolve their paths from
    * the canvas-directory index rather than reusing a cached path.
    */
-  reacquire(): void;
+  reacquire(): Promise<void> | void;
 }
 
 const ownersByCanvas = new Map<string, Set<SpaceDirHandleOwner>>();
@@ -70,7 +70,7 @@ export async function withSpaceDirHandlesReleased<T>(
   const depth = suspendDepth.get(canvasId) ?? 0;
   if (depth === 0) {
     for (const owner of [...(ownersByCanvas.get(canvasId) ?? [])]) {
-      owner.release();
+      await owner.release();
     }
   }
   suspendDepth.set(canvasId, depth + 1);
@@ -85,7 +85,7 @@ export async function withSpaceDirHandlesReleased<T>(
       // Re-read the owner set: a subscriber may have arrived or left while
       // the mutation ran. `reacquire` must therefore be idempotent.
       for (const owner of [...(ownersByCanvas.get(canvasId) ?? [])]) {
-        owner.reacquire();
+        await owner.reacquire();
       }
     }
   }
diff --git a/apps/server/src/modules/storage/backends/disk/space-nodes.test.ts b/apps/server/src/modules/storage/backends/disk/space-nodes.test.ts
index b688e8fbb..252e3c010 100644
--- a/apps/server/src/modules/storage/backends/disk/space-nodes.test.ts
+++ b/apps/server/src/modules/storage/backends/disk/space-nodes.test.ts
@@ -205,6 +205,59 @@ describe('DiskSpaceNodes', () => {
     ).resolves.toMatchObject({ ok: false, reason: 'duplicate-node' });
   });
 
+  it('reports duplicate representations as a warning on the listed node', async () => {
+    mkdirSync(nodesDir('canvas-a'), { recursive: true });
+    for (const filename of ['Node A.md', 'Duplicate A.md']) {
+      writeFileSync(
+        path.join(nodesDir('canvas-a'), filename),
+        `---\nid: node-a\ntype: note\nlabel: ${filename.replace(/\.md$/, '')}\n---\nbody\n`,
+        'utf8',
+      );
+    }
+    const repository = new DiskSpaceNodes(getCanvasStore('canvas-a'));
+
+    const listed = await repository.list();
+
+    expect(listed.get('node-a')?.warnings).toEqual([
+      { kind: 'duplicate-record', names: ['Duplicate A.md', 'Node A.md'] },
+    ]);
+    await expect(repository.read('node-a')).resolves.toMatchObject({
+      warnings: [
+        { kind: 'duplicate-record', names: ['Duplicate A.md', 'Node A.md'] },
+      ],
+    });
+  });
+
+  it('does not re-enumerate the Space per node when nothing is duplicated', async () => {
+    const store = getCanvasStore('canvas-a');
+    const repository = new DiskSpaceNodes(store);
+    for (let i = 0; i < 5; i++) {
+      await repository.put({
+        nodeId: `node-${i}`,
+        record: note(`node-${i}`, `Node ${i}`, `body ${i}`),
+      });
+    }
+
+    // The disk-truth enumeration opens and parses every file in the Space.
+    // Reaching for it once per node turns a read, a whole-Space list, and a
+    // write into quadratic synchronous I/O, so a healthy Space must never
+    // reach it at all — the warm duplicate set answers first.
+    const enumerate = vi.spyOn(store, 'duplicateNodeFiles');
+    try {
+      await repository.list();
+      await repository.read('node-3');
+      await repository.stream(() => {});
+      await repository.put({
+        nodeId: 'node-3',
+        record: note('node-3', 'Node 3', 'updated'),
+      });
+
+      expect(enumerate).not.toHaveBeenCalled();
+    } finally {
+      enumerate.mockRestore();
+    }
+  });
+
   it('deletes the indexed representative of a duplicate node', async () => {
     mkdirSync(nodesDir('canvas-a'), { recursive: true });
     for (const filename of ['Node A.md', 'Duplicate A.md']) {
diff --git a/apps/server/src/modules/storage/backends/disk/space-nodes.ts b/apps/server/src/modules/storage/backends/disk/space-nodes.ts
index 759d07a1c..a65a1fdfe 100644
--- a/apps/server/src/modules/storage/backends/disk/space-nodes.ts
+++ b/apps/server/src/modules/storage/backends/disk/space-nodes.ts
@@ -24,10 +24,23 @@ function revisionOf(record: NodeContent | null): string | null {
   return createHash('sha256').update(JSON.stringify(record)).digest('hex');
 }
 
-function snapshotOf(record: NodeContent): NodeSnapshot {
+function snapshotOf(
+  record: NodeContent,
+  duplicateNames: readonly string[] = [],
+): NodeSnapshot {
   const revision = revisionOf(record);
   if (revision === null) throw new Error('A persisted node must have a token');
-  return { record, revision };
+  return {
+    record,
+    revision,
+    ...(duplicateNames.length > 1
+      ? {
+          warnings: [
+            { kind: 'duplicate-record' as const, names: duplicateNames },
+          ],
+        }
+      : {}),
+  };
 }
 
 export class DiskSpaceNodes implements SpaceNodes {
@@ -45,7 +58,62 @@ export class DiskSpaceNodes implements SpaceNodes {
   async read(nodeId: string): Promise<NodeSnapshot | null> {
     this.#assertActiveWorkspace();
     const record = this.#store.readNodeStrict(nodeId);
-    return record === null ? null : snapshotOf(record);
+    return record === null
+      ? null
+      : snapshotOf(record, this.#duplicates(nodeId));
+  }
+
+  async readMany(
+    nodeIds: Iterable<string>,
+  ): Promise<ReadonlyMap<string, NodeSnapshot>> {
+    this.#assertActiveWorkspace();
+    const out = new Map<string, NodeSnapshot>();
+    // Each targeted read resolves a filename through the index and opens one
+    // file, so the cost follows the request. Deduplicated because a caller
+    // assembling ids from topology can easily name one twice.
+    for (const nodeId of new Set(nodeIds)) {
+      const record = this.#store.readNodeStrict(nodeId);
+      if (record === null) continue;
+      out.set(nodeId, snapshotOf(record, this.#duplicates(nodeId)));
+    }
+    return out;
+  }
+
+  async list(): Promise<ReadonlyMap<string, NodeSnapshot>> {
+    this.#assertActiveWorkspace();
+    const records = await this.#store.readAllNodes({ strict: true });
+    return new Map(
+      [...records].map(([nodeId, record]) => [
+        nodeId,
+        snapshotOf(record, this.#duplicates(nodeId)),
+      ]),
+    );
+  }
+
+  async stream(
+    onNode: (nodeId: string, snapshot: NodeSnapshot) => void,
+    signal?: { readonly aborted: boolean },
+  ): Promise<ReadonlyMap<string, NodeSnapshot>> {
+    this.#assertActiveWorkspace();
+    // Retain what was delivered and reuse it for the returned map, so the
+    // two can never disagree: the adapter's duplicate set is republished
+    // when the scan finishes, which is after the first record is delivered.
+    const delivered = new Map<string, NodeSnapshot>();
+    const records = await this.#store.streamAllNodes(
+      (nodeId, record) => {
+        const snapshot = snapshotOf(record, this.#duplicates(nodeId));
+        delivered.set(nodeId, snapshot);
+        onNode(nodeId, snapshot);
+      },
+      signal,
+      { strict: true },
+    );
+    return new Map(
+      [...records].map(([nodeId, record]) => [
+        nodeId,
+        delivered.get(nodeId) ?? snapshotOf(record, this.#duplicates(nodeId)),
+      ]),
+    );
   }
 
   async put(input: NodePutInput): Promise<NodePutResult> {
@@ -118,7 +186,10 @@ export class DiskSpaceNodes implements SpaceNodes {
         `SpaceNodes(${this.canvasId}) wrote node ${JSON.stringify(input.nodeId)} but could not read it back`,
       );
     }
-    return { ok: true, ...snapshotOf(persisted) };
+    return {
+      ok: true,
+      ...snapshotOf(persisted, this.#duplicates(input.nodeId)),
+    };
   }
 
   async delete(nodeId: string): Promise<NodeDeleteResult> {
@@ -126,6 +197,20 @@ export class DiskSpaceNodes implements SpaceNodes {
     return this.#store.deleteNode(nodeId);
   }
 
+  /**
+   * Physical names claiming `nodeId`, or none when it is not duplicated.
+   *
+   * Gated on the index's duplicate set, which is a warm in-memory lookup
+   * populated by the same scan that produced these records. The disk-truth
+   * enumeration behind it opens and parses every file in the Space, so
+   * calling it per node — on a read, a whole-Space list, or a write —
+   * would make each of those quadratic and synchronous.
+   */
+  #duplicates(nodeId: string): readonly string[] {
+    if (!this.#store.isDuplicateNode(nodeId)) return [];
+    return this.#store.duplicateNodeFiles(nodeId);
+  }
+
   #assertActiveWorkspace(): void {
     if (path.resolve(getWorkspacePath()) !== this.#workspacePath) {
       throw new Error(
diff --git a/apps/server/src/modules/storage/backends/disk/space-repository.test.ts b/apps/server/src/modules/storage/backends/disk/space-repository.test.ts
index dd7ab747d..4e9dd1183 100644
--- a/apps/server/src/modules/storage/backends/disk/space-repository.test.ts
+++ b/apps/server/src/modules/storage/backends/disk/space-repository.test.ts
@@ -115,10 +115,26 @@ describeSpaceRepositoryContract('Disk', () => {
         },
       }),
     worldCanvasId: WORLD_ID,
+    openUnbootstrapped: () => {
+      makeWorkspace('huabu-space-repository-contract-empty-');
+      return new DiskStructuredStore().spaces();
+    },
   };
 });
 
 describe('DiskSpaceRepository membership', () => {
+  it('rejects duplicate ordinary Space ids', async () => {
+    const root = makeWorkspace('huabu-space-membership-duplicate-');
+    seedWorld(root);
+    writeRecord(root, 'First', record('canvas-duplicate', 'First'));
+    writeRecord(root, 'Second', record('canvas-duplicate', 'Second'));
+    refreshCanvasDirIndex();
+
+    await expect(new DiskSpaceRepository().list()).rejects.toThrow(
+      'Duplicate ordinary Space canvasId',
+    );
+  });
+
   it('refreshes external additions, deletions, and directory renames', async () => {
     const root = makeWorkspace('huabu-space-membership-refresh-');
     seedWorld(root);
diff --git a/apps/server/src/modules/storage/backends/disk/space-repository.ts b/apps/server/src/modules/storage/backends/disk/space-repository.ts
index e59b78fd2..91e4dd1bc 100644
--- a/apps/server/src/modules/storage/backends/disk/space-repository.ts
+++ b/apps/server/src/modules/storage/backends/disk/space-repository.ts
@@ -36,6 +36,7 @@ import {
   titleForAllocatedDirectory,
   titleVisibleAtDirectory,
 } from './space-title.js';
+import { ensureWorldCanvasOnDisk } from './world-canvas.js';
 import { atomicWriteJson, mkdirp, sanitizeId } from '../../../../utils/fs.js';
 import { normalizeForCompare } from '../../../../utils/naming.js';
 import { getWorkspacePath } from '../../../workspace.js';
@@ -66,11 +67,27 @@ export class DiskSpaceRepository implements SpaceRepository {
   readonly #workspacePath: string;
   readonly #now: () => number;
 
-  constructor(now: () => number = Date.now) {
-    this.#workspacePath = path.resolve(getWorkspacePath());
+  constructor(
+    now: () => number = Date.now,
+    workspacePath = getWorkspacePath(),
+  ) {
+    this.#workspacePath = path.resolve(workspacePath);
     this.#now = now;
   }
 
+  async ensureWorld(): Promise<string> {
+    const canvasId = ensureWorldCanvasOnDisk(this.#workspacePath);
+    try {
+      if (path.resolve(getWorkspacePath()) === this.#workspacePath) {
+        refreshCanvasDirIndex();
+      }
+    } catch {
+      // A staged mount deliberately initializes before the Workspace becomes
+      // process-active. Its activation read refreshes the locator afterwards.
+    }
+    return canvasId;
+  }
+
   async list(): Promise<CanvasSummary[]> {
     this.#assertActiveWorkspace();
     refreshCanvasDirIndex();
diff --git a/apps/server/src/modules/storage/backends/disk/space-tree.test.ts b/apps/server/src/modules/storage/backends/disk/space-tree.test.ts
new file mode 100644
index 000000000..60a20fe6c
--- /dev/null
+++ b/apps/server/src/modules/storage/backends/disk/space-tree.test.ts
@@ -0,0 +1,158 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT license.
+
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+
+import { afterEach, describe, expect, it } from 'vitest';
+
+import { DiskSpaceTrees } from './space-tree.js';
+import { setWorkspacePath } from '../../../workspace.js';
+
+import type { CanvasFile } from '../../../canvas/persistence-types.js';
+
+const roots: string[] = [];
+
+function workspace(): string {
+  const root = mkdtempSync(path.join(tmpdir(), 'huabu-space-tree-'));
+  roots.push(root);
+  setWorkspacePath(root);
+  return root;
+}
+
+function record(canvasId: string): CanvasFile {
+  return {
+    canvasId,
+    title: 'Imported Space',
+    version: 0,
+    state: { nodes: [], edges: [] },
+    createdAt: 1,
+    updatedAt: 1,
+  };
+}
+
+afterEach(() => {
+  for (const root of roots.splice(0)) {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+describe('DiskSpaceTrees', () => {
+  it('publishes an imported bundle into the Space namespace', async () => {
+    const root = workspace();
+    const trees = new DiskSpaceTrees(root);
+    const staged = await trees.stageImport('canvas-imported');
+    mkdirSync(path.join(staged.directory, 'nodes'), { recursive: true });
+    writeFileSync(
+      path.join(staged.directory, 'nodes', 'Note.md'),
+      '---\nid: node-a\n---\nBody',
+      'utf8',
+    );
+    writeFileSync(path.join(staged.directory, 'canvas.json'), '{}', 'utf8');
+
+    const published = await staged.publish(record('canvas-imported'));
+    const tree = trees.space('canvas-imported');
+
+    expect(published.title).toBe('Imported Space');
+    expect(tree.directory()).toBe(path.join(root, 'Imported Space'));
+    expect(tree.nodesDirectory()).toBe(
+      path.join(root, 'Imported Space', 'nodes'),
+    );
+    expect(
+      JSON.parse(
+        readFileSync(path.join(tree.directory(), 'space.json'), 'utf8'),
+      ),
+    ).toEqual(published);
+    // The legacy record name never survives an import.
+    expect(existsSync(path.join(tree.directory(), 'canvas.json'))).toBe(false);
+    expect(existsSync(path.join(tree.nodesDirectory(), 'Note.md'))).toBe(true);
+  });
+
+  it('adjusts the title when the directory name it wants is taken', async () => {
+    const root = workspace();
+    const trees = new DiskSpaceTrees(root);
+    mkdirSync(path.join(root, 'Imported Space'), { recursive: true });
+    writeFileSync(
+      path.join(root, 'Imported Space', 'space.json'),
+      JSON.stringify(record('canvas-existing')),
+      'utf8',
+    );
+    const staged = await trees.stageImport('canvas-imported');
+
+    const published = await staged.publish(record('canvas-imported'));
+
+    // The caller must use the returned record: the directory is derived from
+    // the title, so allocating a free name changes the title with it.
+    expect(published.title).not.toBe('Imported Space');
+    expect(trees.space('canvas-imported').directory()).toBe(
+      path.join(root, published.title as string),
+    );
+  });
+
+  it('discards a staged bundle that was never published', async () => {
+    const root = workspace();
+    const trees = new DiskSpaceTrees(root);
+    const staged = await trees.stageImport('canvas-discard');
+    writeFileSync(path.join(staged.directory, 'seed.txt'), 'body', 'utf8');
+
+    await staged.discard();
+
+    expect(existsSync(staged.directory)).toBe(false);
+  });
+
+  it('refuses a bundle addressed to another Space, and a second publish', async () => {
+    const root = workspace();
+    const trees = new DiskSpaceTrees(root);
+    const staged = await trees.stageImport('canvas-imported');
+
+    await expect(staged.publish(record('canvas-other'))).rejects.toThrow(
+      'id mismatch',
+    );
+    await staged.publish(record('canvas-imported'));
+    await expect(staged.publish(record('canvas-imported'))).rejects.toThrow(
+      'already published',
+    );
+  });
+
+  it('resolves a node file through the sidecar index, not its name', async () => {
+    const root = workspace();
+    const trees = new DiskSpaceTrees(root);
+    const staged = await trees.stageImport('canvas-imported');
+    mkdirSync(path.join(staged.directory, 'nodes'), { recursive: true });
+    writeFileSync(
+      path.join(staged.directory, 'nodes', 'Note.md'),
+      '---\nid: node-a\n---\nBody',
+      'utf8',
+    );
+    await staged.publish(record('canvas-imported'));
+    const tree = trees.space('canvas-imported');
+
+    // A node is filed under its label, so only the index can invert it.
+    await expect(tree.nodeIdForPath('nodes/Note.md')).resolves.toBe('node-a');
+    // Nothing else in a Space carries a node record.
+    await expect(tree.nodeIdForPath('nodes/Missing.md')).resolves.toBeNull();
+    await expect(tree.nodeIdForPath('setting/user.md')).resolves.toBeNull();
+    await expect(tree.nodeIdForPath('nodes/deep/x.md')).resolves.toBeNull();
+  });
+
+  it('fences a retained tree after Workspace activation changes', async () => {
+    const first = workspace();
+    const trees = new DiskSpaceTrees(first);
+    const tree = trees.space('canvas-a');
+    workspace();
+
+    expect(() => tree.directory()).toThrow('inactive workspace');
+    expect(() => tree.nodesDirectory()).toThrow('inactive workspace');
+    await expect(trees.stageImport('canvas-imported')).rejects.toThrow(
+      'inactive Workspace',
+    );
+  });
+});
diff --git a/apps/server/src/modules/storage/backends/disk/space-tree.ts b/apps/server/src/modules/storage/backends/disk/space-tree.ts
new file mode 100644
index 000000000..c38bc86d8
--- /dev/null
+++ b/apps/server/src/modules/storage/backends/disk/space-tree.ts
@@ -0,0 +1,206 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT license.
+
+/**
+ * The Disk backend's Space directory, for consumers that need a real one.
+ *
+ * **This is a Disk capability, not a portable one, and it is not a port.**
+ * `StructuredStore` and `BlobStore` are the two ports; everything portable
+ * goes through them. What lives here is the residue: features that today
+ * reach a Space as a filesystem tree — RFS projecting a directory listing,
+ * the external-note watcher arming `fs.watch`, the built-in file tools
+ * rooting a sandbox, the agent domain keeping `.memory/` and ACP sessions
+ * beside a Space.
+ *
+ * Those are not portable requirements and must not be dressed up as if they
+ * were. A backend that keeps Spaces in tables has no directory to hand out
+ * and would have to fabricate one; a capability absent from a backend is an
+ * acceptable outcome, and the honest one. The route out is for those features
+ * to stop needing a tree — an agent can reach a Space over Huabu's HTTP API
+ * instead of a projected filesystem — not for storage to promise every
+ * backend a directory.
+ *
+ * So this is deliberately reached by a name with `disk` in it, exported from
+ * exactly one place, and enumerated by `module-boundaries.test.ts` so the
+ * consumer list can only shrink. Every entry on that list is a reason a
+ * non-Disk structured profile is not selectable.
+ */
+
+import { mkdir, rename, rm, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+
+import {
+  refreshCanvasDirIndex,
+  registerCanvasDir,
+  suggestCanvasDir,
+} from './canvas-dirs.js';
+import { canvasRoot, SPACE_JSON_FILENAME } from './layout.js';
+import { getCanvasStore } from './legacy/canvas-store-cache.js';
+import {
+  registerSpaceDirHandleOwner,
+  type SpaceDirHandleOwner,
+} from './space-dir-handles.js';
+import { sanitizeId } from '../../../../utils/fs.js';
+import { toSafeFilename } from '../../../../utils/naming.js';
+import { getWorkspacePath } from '../../../workspace.js';
+
+import type { CanvasFile } from '../../../canvas/persistence-types.js';
+
+/** Space-relative markdown node file; capture group is the bare filename. */
+const NODE_FILE_RE = /^nodes\/([^/]+\.md)$/;
+
+/** One Space's directory under the Disk layout. */
+export interface DiskSpaceTree {
+  readonly canvasId: string;
+  /** Absolute root of this Space's directory. */
+  directory(): string;
+  /** Absolute path to the node-sidecar directory. */
+  nodesDirectory(): string;
+  /**
+   * The node whose sidecar is `relativePath`, or null when none is.
+   *
+   * A node is filed under its *label*, so the name cannot be inverted — only
+   * the sidecar index knows. Reading the id out of the file's frontmatter
+   * instead would spread Disk's record encoding into whoever asked.
+   */
+  nodeIdForPath(relativePath: string): Promise<string | null>;
+  /** Register a live native handle that must be released for rename/delete. */
+  registerHandleOwner(owner: SpaceDirHandleOwner): () => void;
+}
+
+/** An uploaded bundle staged outside the Space namespace until published. */
+export interface DiskSpaceImport {
+  readonly canvasId: string;
+  readonly directory: string;
+  /**
+   * Adopt the staged directory as this Space's directory.
+   *
+   * Returns the record as written. The title may come back adjusted: the
+   * directory name is derived from it and the name may already be taken, so
+   * callers must use the returned record rather than the one they passed in.
+   */
+  publish(record: CanvasFile): Promise<CanvasFile>;
+  /** Remove the unpublished staging directory. Idempotent after publish. */
+  discard(): Promise<void>;
+}
+
+export class DiskSpaceTrees {
+  readonly #workspacePath: string;
+
+  constructor(workspacePath = getWorkspacePath()) {
+    this.#workspacePath = path.resolve(workspacePath);
+    try {
+      if (path.resolve(getWorkspacePath()) === this.#workspacePath) {
+        refreshCanvasDirIndex();
+      }
+    } catch {
+      // Staged mounts are constructed before their Workspace becomes active.
+    }
+  }
+
+  /**
+   * Refresh the process-local directory index after a Workspace commit.
+   *
+   * Called once the new Workspace path is committed and before the mount is
+   * swapped in, so it must not fail: it only drops a cache.
+   */
+  activate(): void {
+    refreshCanvasDirIndex();
+  }
+
+  space(canvasId: string): DiskSpaceTree {
+    const safeId = sanitizeId(canvasId, 'canvasId');
+    const assertActive = (): void => {
+      if (path.resolve(getWorkspacePath()) !== this.#workspacePath) {
+        throw new Error(
+          `Space directory for "${safeId}" belongs to an inactive workspace. Resolve a fresh one after workspace activation.`,
+        );
+      }
+    };
+    return Object.freeze({
+      canvasId: safeId,
+      directory: (): string => {
+        assertActive();
+        return canvasRoot(safeId);
+      },
+      nodesDirectory: (): string => {
+        assertActive();
+        return path.join(canvasRoot(safeId), 'nodes');
+      },
+      nodeIdForPath: async (relativePath: string): Promise<string | null> => {
+        assertActive();
+        const filename = NODE_FILE_RE.exec(relativePath)?.[1];
+        if (filename === undefined) return null;
+        return getCanvasStore(safeId).nodeIdForFilename(filename);
+      },
+      registerHandleOwner: (owner: SpaceDirHandleOwner): (() => void) => {
+        assertActive();
+        return registerSpaceDirHandleOwner(safeId, owner);
+      },
+    });
+  }
+
+  async stageImport(canvasId: string): Promise<DiskSpaceImport> {
+    this.#assertActive();
+    const safeId = sanitizeId(canvasId, 'canvasId');
+    const stagingDirectory = path.join(
+      this.#workspacePath,
+      `.import-${safeId}`,
+    );
+    await mkdir(stagingDirectory, { recursive: true });
+    let published = false;
+
+    return Object.freeze({
+      canvasId: safeId,
+      directory: stagingDirectory,
+      publish: async (record: CanvasFile): Promise<CanvasFile> => {
+        if (published) throw new Error('Imported Space was already published');
+        this.#assertActive();
+        if (record.canvasId !== safeId) {
+          throw new Error(
+            `Imported Space id mismatch: expected ${safeId}, received ${record.canvasId}`,
+          );
+        }
+
+        const requestedTitle = record.title ?? 'Imported canvas';
+        const finalDirectoryName = suggestCanvasDir(requestedTitle, safeId);
+        const safeFromTitle = toSafeFilename(requestedTitle, safeId);
+        const dedupeSuffix =
+          finalDirectoryName === safeFromTitle
+            ? ''
+            : finalDirectoryName.slice(safeFromTitle.length);
+        const resolvedRecord: CanvasFile = {
+          ...record,
+          title:
+            dedupeSuffix === ''
+              ? requestedTitle
+              : requestedTitle + dedupeSuffix,
+        };
+
+        await writeFile(
+          path.join(stagingDirectory, SPACE_JSON_FILENAME),
+          JSON.stringify(resolvedRecord),
+        );
+        await rm(path.join(stagingDirectory, 'canvas.json'), { force: true });
+        await rename(
+          stagingDirectory,
+          path.join(this.#workspacePath, finalDirectoryName),
+        );
+        published = true;
+        registerCanvasDir(safeId, finalDirectoryName, resolvedRecord.title);
+        refreshCanvasDirIndex();
+        return resolvedRecord;
+      },
+      discard: async (): Promise<void> => {
+        if (published) return;
+        await rm(stagingDirectory, { recursive: true, force: true });
+      },
+    });
+  }
+
+  #assertActive(): void {
+    if (path.resolve(getWorkspacePath()) !== this.#workspacePath) {
+      throw new Error('Cannot stage an import for an inactive Workspace');
+    }
+  }
+}
diff --git a/apps/server/src/modules/storage/backends/disk/storage-recovery.test.ts b/apps/server/src/modules/storage/backends/disk/storage-recovery.test.ts
index 26bac81f9..80fb947d4 100644
--- a/apps/server/src/modules/storage/backends/disk/storage-recovery.test.ts
+++ b/apps/server/src/modules/storage/backends/disk/storage-recovery.test.ts
@@ -126,7 +126,10 @@ beforeEach(() => {
   workspaceState.path = root;
   resetStorageCache();
   restoreStorage = setStorageForTesting(
-    createStorage({ structured: { kind: 'disk' }, blobs: { kind: 'disk' } }),
+    createStorage({
+      structured: { kind: 'disk' },
+      blobs: { kind: 'disk' },
+    }),
   );
 });
 
diff --git a/apps/server/src/modules/storage/backends/disk/structured-store.ts b/apps/server/src/modules/storage/backends/disk/structured-store.ts
index e02f25d49..8f0a83081 100644
--- a/apps/server/src/modules/storage/backends/disk/structured-store.ts
+++ b/apps/server/src/modules/storage/backends/disk/structured-store.ts
@@ -21,6 +21,8 @@
  * Space has one long-lived instance.
  */
 
+import path from 'node:path';
+
 import { getCanvasStore } from './legacy/canvas-store-cache.js';
 import { createDiskSpaceLogs } from './space-logs.js';
 import { DiskSpaceNodes } from './space-nodes.js';
@@ -28,12 +30,18 @@ import { createDiskSpaceRecordReader } from './space-record.js';
 import { DiskSpaceRepository } from './space-repository.js';
 import { DiskSpaceTasks } from './space-tasks.js';
 import { createDiskSpaceWrite } from './space-write.js';
+import { getWorkspacePath } from '../../../workspace.js';
 
 import type { StorageHealth } from '../../ports/common.js';
 import type { SpaceHandle, StructuredStore } from '../../ports/structured.js';
 
 export class DiskStructuredStore implements StructuredStore {
   readonly kind = 'disk' as const;
+  readonly #workspacePath: string;
+
+  constructor(workspacePath = getWorkspacePath()) {
+    this.#workspacePath = path.resolve(workspacePath);
+  }
 
   async init(): Promise<void> {
     // The workspace directory is prepared by `workspace-prepare.ts`; Space
@@ -47,10 +55,15 @@ export class DiskStructuredStore implements StructuredStore {
   async close(): Promise<void> {}
 
   spaces(): DiskSpaceRepository {
-    return new DiskSpaceRepository();
+    return new DiskSpaceRepository(Date.now, this.#workspacePath);
   }
 
   space(canvasId: string): SpaceHandle {
+    if (path.resolve(getWorkspacePath()) !== this.#workspacePath) {
+      throw new Error(
+        'Structured store belongs to an inactive workspace. Resolve storage after workspace activation.',
+      );
+    }
     // `getCanvasStore` validates the id and owns the instance cache.
     const store = getCanvasStore(canvasId);
     const { events, changes } = createDiskSpaceLogs(store);
diff --git a/apps/server/src/modules/storage/compatibility/delete-canvas.test.ts b/apps/server/src/modules/storage/compatibility/delete-canvas.test.ts
index cbcda58cc..5d33f9af0 100644
--- a/apps/server/src/modules/storage/compatibility/delete-canvas.test.ts
+++ b/apps/server/src/modules/storage/compatibility/delete-canvas.test.ts
@@ -22,6 +22,7 @@ import { DiskStructuredStore } from '../backends/disk/structured-store.js';
 import { getCanvasStore } from '../index.js';
 import {
   canvasBlobs,
+  createStorage,
   deleteSpace,
   setStorageForTesting,
   type Storage,
@@ -195,9 +196,12 @@ let restoreStorage: () => void;
 
 function installBlobStore(next: BlobStore): void {
   restoreStorage();
+  const storage = createStorage({
+    structured: { kind: 'disk' },
+    blobs: { kind: 'disk' },
+  });
   restoreStorage = setStorageForTesting({
-    profile: { structured: { kind: 'disk' }, blobs: { kind: 'disk' } },
-    structured: new DiskStructuredStore(),
+    ...storage,
     blobs: next,
   } satisfies Storage);
 }
@@ -211,9 +215,12 @@ beforeEach(() => {
   resetStorageCache();
 
   blobs = new OrderRecordingBlobStore();
+  const storage = createStorage({
+    structured: { kind: 'disk' },
+    blobs: { kind: 'disk' },
+  });
   restoreStorage = setStorageForTesting({
-    profile: { structured: { kind: 'disk' }, blobs: { kind: 'disk' } },
-    structured: new DiskStructuredStore(),
+    ...storage,
     blobs,
   } satisfies Storage);
 });
diff --git a/apps/server/src/modules/storage/index.ts b/apps/server/src/modules/storage/index.ts
index 88d251d1b..1d789126c 100644
--- a/apps/server/src/modules/storage/index.ts
+++ b/apps/server/src/modules/storage/index.ts
@@ -9,12 +9,12 @@
  *
  *   - `ports/`          backend-neutral contracts and their reusable suites
  *   - `backends/disk/`  the Disk adapters implementing those ports
- *   - `compatibility/`  the current synchronous application surface
+ *   - `compatibility/`  the residual Disk legacy/test surface
  *
  * Application code imports from here, never from `backends/`.
  */
 
-// ─── Compatibility surface (current application API) ───────────────────────
+// ─── Compatibility surface (legacy and adapter tests only) ─────────────────
 
 export {
   CanvasStore,
@@ -24,27 +24,10 @@ export {
 } from './compatibility/canvas.js';
 export type { RenameResult, RenameSelfResult } from './compatibility/canvas.js';
 
-export {
-  getWorldCanvasId,
-  isWorldCanvasId,
-  requireWorldCanvasId,
-} from './backends/disk/canvas-dirs.js';
-
 /**
- * Materialization-tier capabilities, re-exported so consumers that need a
- * real Space directory reach them through the facade rather than naming a
- * backend (§12.5.4).
- *
- * Each is Disk-shaped by nature, not by accident: releasing directory handles
- * exists so Windows can rename a Space folder, and the World bootstrap writes
- * one. A profile that does not materialize Spaces has nothing for either to
- * do, which is the gate that keeps them off the portable surface.
+ * Disk-only bootstrap retained for the isolated legacy migration worker.
+ * Runtime World bootstrap enters through `SpaceRepository.ensureWorld()`.
  */
-export {
-  registerSpaceDirHandleOwner,
-  withSpaceDirHandlesReleased,
-} from './backends/disk/space-dir-handles.js';
-export type { SpaceDirHandleOwner } from './backends/disk/space-dir-handles.js';
 export { ensureWorldCanvasOnDisk } from './backends/disk/world-canvas.js';
 export { withCanvasMutex, updateNode } from '../canvas/write-coordinator.js';
 export type {
@@ -62,18 +45,27 @@ export type {
 
 export {
   canvasBlobs,
+  closeStorage,
   createSpace,
   createStorage,
   deleteSpace,
   getBlobStore,
   getStorage,
   getStructuredStore,
+  getWorldCanvasId,
   initStorage,
+  isWorldCanvasId,
+  requireWorldCanvasId,
   setStorageForTesting,
-  spaceDirectory,
+  stageStorageForWorkspace,
   storageHealth,
 } from './storage.js';
-export type { SpaceDeleteOutcome, Storage } from './storage.js';
+export type {
+  SpaceDeleteOutcome,
+  StagedStorageMount,
+  Storage,
+  StorageRuntime,
+} from './storage.js';
 export {
   parseStorageProfile,
   StorageProfileError,
@@ -92,11 +84,26 @@ export type {
   BlobStore,
 } from './ports/blob.js';
 export type { StorageHealth } from './ports/common.js';
+/**
+ * Disk-only capabilities, exported here because they have nowhere portable to
+ * live and every consumer must be visible.
+ *
+ * These are **not** ports and carry no cross-backend promise. Each caller is
+ * a reason a non-Disk structured profile is not selectable, and
+ * `module-boundaries.test.ts` keeps the exact list so it can only shrink.
+ */
+export { diskSpaceTree, stageDiskSpaceImport } from './storage.js';
+export type {
+  DiskSpaceImport,
+  DiskSpaceTree,
+} from './backends/disk/space-tree.js';
+export type { SpaceDirHandleOwner } from './backends/disk/space-dir-handles.js';
 export type {
   NewCanvasEvent,
   NodeDeleteResult,
   NodePutInput,
   NodePutResult,
+  NodeReadWarning,
   NodeSnapshot,
   SpaceBeginDeleteResult,
   SpaceChanges,
diff --git a/apps/server/src/modules/storage/module-boundaries.test.ts b/apps/server/src/modules/storage/module-boundaries.test.ts
index 80fdca34e..66333dcaa 100644
--- a/apps/server/src/modules/storage/module-boundaries.test.ts
+++ b/apps/server/src/modules/storage/module-boundaries.test.ts
@@ -70,6 +70,56 @@ function resolveSpecifier(fromRelative: string, spec: string): string | null {
   return resolved.replace(/\.js$/, '');
 }
 
+/**
+ * Names a file imports, whatever they are imported from.
+ *
+ * Import-level rather than identifier-level on purpose: a module is coupled
+ * to the Disk layout when it *brings in* `canvasRoot`, not when it happens to
+ * name a local variable `artifactPath`.
+ */
+function importedNames(relative: string): string[] {
+  const source = read(relative);
+  const out: string[] = [];
+  const re = /import\s+(?:type\s+)?\{([^}]*)\}\s*from\s*['"][^'"]+['"]/gs;
+  let match: RegExpExecArray | null;
+  while ((match = re.exec(source)) !== null) {
+    for (const clause of match[1].split(',')) {
+      const name = clause
+        .trim()
+        .split(/\s+as\s+/)[0]
+        ?.replace(/^type\s+/, '');
+      if (name) out.push(name.trim());
+    }
+  }
+  return out;
+}
+
+/**
+ * The members that describe how the Disk backend stores a Space.
+ *
+ * They moved to `backends/disk/layout.ts` in Phase 4.5. Nothing outside the
+ * storage boundary may name them: each one answers "how does *this* backend
+ * store that", so a consumer holding one has bound the application to Disk.
+ */
+const DISK_LAYOUT_SYMBOLS = [
+  'SPACE_JSON_FILENAME',
+  'WORLD_CANVAS_DIR_NAME',
+  'canvasJsonPath',
+  'nodesDir',
+  'nodeFilePath',
+  'ARTIFACTS_DIR_NAME',
+  'artifactsDir',
+  'artifactPath',
+  'HISTORY_DIR_NAME',
+  'historyDir',
+  'chatDir',
+  'tasksPath',
+  'eventsPath',
+  'deltaLogPath',
+  'changesPath',
+  'canvasRoot',
+];
+
 const storageFiles = walk(STORAGE_DIR);
 const sourceFiles = walk(SRC_DIR);
 
@@ -89,13 +139,36 @@ describe('storage module tree', () => {
       'index.ts',
       'module-boundaries.test.ts',
       'paths.ts',
+      'product-boundary.test.ts',
       'profile.test.ts',
       'profile.ts',
       'space-lifecycle-admission.ts',
       'storage.ts',
+      'testing.ts',
     ]);
   });
 
+  /**
+   * The settled architecture is **two** backend ports (§6.3, and the
+   * proposal's own scope note). A third file appearing here would be a
+   * third port, which is an architectural decision rather than an
+   * implementation detail — so it has to be made deliberately, by editing
+   * this list, and not by someone finding `ports/` a convenient place to put
+   * an interface.
+   *
+   * Space directories are the case that already tried. They are not portable
+   * and must not be made to look it: a backend keeping Spaces in tables has
+   * no directory to offer. They stay a named Disk capability instead — see
+   * the exported-surface guard below.
+   */
+  it('keeps ports/ to exactly the two backend ports', () => {
+    const portFiles = storageFiles
+      .filter((f) => path.dirname(f) === 'modules/storage/ports')
+      .map((f) => path.basename(f));
+
+    expect(portFiles.sort()).toEqual(['blob.ts', 'common.ts', 'structured.ts']);
+  });
+
   it('keeps every other file inside ports/, backends/, or compatibility/', () => {
     const nested = storageFiles.filter(
       (f) => path.dirname(f) !== 'modules/storage',
@@ -246,33 +319,16 @@ describe('workspace module names no backend', () => {
     expect(violations).toEqual([]);
   });
 
+  // Stricter than the import-level rule that covers every other module:
+  // here even *naming* one of these is a violation, because this is the
+  // module the layout was extracted from and a re-implementation under a
+  // local name would restore the same coupling with a clean import list.
   it('names no Disk record or blob layout symbol', () => {
-    // These are the members that moved to `backends/disk/layout.ts`. Their
-    // reappearance here would mean the workspace had started describing how a
-    // backend stores things again, whatever the import path said.
-    const DISK_LAYOUT = [
-      'SPACE_JSON_FILENAME',
-      'WORLD_CANVAS_DIR_NAME',
-      'canvasJsonPath',
-      'nodesDir',
-      'nodeFilePath',
-      'ARTIFACTS_DIR_NAME',
-      'artifactsDir',
-      'artifactPath',
-      'HISTORY_DIR_NAME',
-      'historyDir',
-      'chatDir',
-      'tasksPath',
-      'eventsPath',
-      'deltaLogPath',
-      'changesPath',
-      'canvasRoot',
-    ];
     const violations: string[] = [];
     for (const file of workspaceFiles) {
       if (file.startsWith('modules/workspace/migrations/')) continue;
       const source = read(file);
-      for (const symbol of DISK_LAYOUT) {
+      for (const symbol of DISK_LAYOUT_SYMBOLS) {
         if (new RegExp(`\\b${symbol}\\b`).test(source)) {
           violations.push(`${file} → ${symbol}`);
         }
@@ -335,6 +391,109 @@ describe('structured write authority', () => {
   });
 });
 
+/**
+ * The Disk-only surface, held to an exact list.
+ *
+ * Some features still reach a Space as a filesystem tree — RFS, the
+ * external-note watcher, the file-tool sandbox, and the agent domain's
+ * `.memory/` and ACP files. That is not portable and the barrel does not
+ * pretend otherwise: it exports `diskSpaceTree` / `stageDiskSpaceImport`,
+ * whose names say so at every call site.
+ *
+ * Both lists below are snapshots so they can only shrink. Every consumer is a
+ * reason a non-Disk structured profile is not selectable; the route out is
+ * for these features to stop needing a tree (an agent can reach a Space over
+ * the HTTP API instead of a projected filesystem), not for storage to promise
+ * one it cannot keep.
+ */
+describe('Disk-only surface', () => {
+  it('exposes no portable path capability from the barrel', () => {
+    const barrel = read('modules/storage/index.ts');
+
+    // Anything named for a Space's files without `disk` in it reads as a
+    // promise every backend keeps. There is no such promise.
+    expect(barrel).not.toMatch(/\bSpaceMaterialization\b/);
+    expect(barrel).not.toMatch(/\bMaterializationKind\b/);
+    expect(barrel).not.toMatch(/\bspaceDirectory\b/);
+    expect(barrel).not.toMatch(/\bgetSpaceFiles\b/);
+  });
+
+  it('keeps the exact Disk-only export list', () => {
+    const barrel = read('modules/storage/index.ts');
+    const diskExports = [...barrel.matchAll(/\bdisk[A-Z]\w*|\bstageDisk\w*/g)]
+      .map((m) => m[0])
+      .filter((name, index, all) => all.indexOf(name) === index)
+      .sort();
+
+    expect(diskExports).toEqual(['diskSpaceTree', 'stageDiskSpaceImport']);
+  });
+
+  it('keeps the exact list of files that need a Space directory', () => {
+    const consumers = sourceFiles
+      .filter((file) => !file.startsWith('modules/storage/'))
+      .filter((file) =>
+        /\b(?:diskSpaceTree|stageDiskSpaceImport)\b/.test(read(file)),
+      )
+      .sort();
+
+    expect(consumers).toEqual([
+      'modules/agent/memory/trigger.ts',
+      'modules/agent/tools/handlers/fs-sandbox.ts',
+      'modules/canvas/canvas.route.ts',
+      'modules/canvas/external-watcher.test.ts',
+      'modules/canvas/external-watcher.ts',
+      'modules/canvas/external.route.ts',
+      'modules/canvas/import-node-src.test.ts',
+      'modules/canvas/import-node-src.ts',
+      'modules/remote_fs/node-meta.ts',
+      'modules/remote_fs/rfs.route.test.ts',
+      'modules/remote_fs/skill.ts',
+      'modules/workspace/legacy-workspace-activation.test.ts',
+      'modules/workspace/paths.ts',
+    ]);
+  });
+});
+
+describe('backend-neutral production reads', () => {
+  /**
+   * §12.6.4's second guard, at the scope the phase claimed: *no* production
+   * module outside `storage/` imports a Disk-layout symbol, not merely the
+   * workspace module.
+   *
+   * Two exemptions, both the same ones the sibling rules make. A migration
+   * rewrites a frozen historical on-disk shape, so it is Disk-bound by
+   * definition and cannot be expressed against a port. A test that names the
+   * layout is choosing its subject rather than binding the application to it
+   * — and the shim-importer snapshots below already pin which tests those
+   * are, so they cannot grow unnoticed.
+   */
+  it('does not import a Disk-layout symbol outside the storage boundary', () => {
+    const violations: string[] = [];
+    for (const file of sourceFiles) {
+      if (file.startsWith('modules/storage/')) continue;
+      if (file.startsWith('modules/workspace/migrations/')) continue;
+      if (file.endsWith('.test.ts')) continue;
+      for (const name of importedNames(file)) {
+        if (DISK_LAYOUT_SYMBOLS.includes(name)) {
+          violations.push(`${file} → ${name}`);
+        }
+      }
+    }
+    expect(violations).toEqual([]);
+  });
+
+  it('does not import CanvasStore or getCanvasStore from the public barrel', () => {
+    const legacyReadImport =
+      /import\s+(?:type\s+)?\{[^}]*\b(?:CanvasStore|getCanvasStore)\b[^}]*\}\s+from\s+['"][^'"]*storage\/index\.js['"]/s;
+    const violations = sourceFiles
+      .filter((file) => !file.endsWith('.test.ts'))
+      .filter((file) => !file.startsWith('modules/storage/'))
+      .filter((file) => legacyReadImport.test(read(file)));
+
+    expect(violations).toEqual([]);
+  });
+});
+
 describe('root forwarding shims', () => {
   const SHIMS = [
     'modules/storage/canvas-store.ts',
@@ -358,37 +517,17 @@ describe('root forwarding shims', () => {
 
   /** Exact snapshot of the remaining deprecated-path importers. */
   const EXPECTED_IMPORTERS: Record<string, readonly string[]> = {
-    'storage/canvas-store.js': [
-      'modules/canvas/canvas-search.test.ts',
-      'modules/canvas/canvas-search.ts',
-      'modules/canvas/canvas-spatial.ts',
-      'modules/canvas/canvas.route.ts',
-      'modules/canvas/node-prompt.test.ts',
-      'modules/canvas/node-prompt.ts',
-      'modules/canvas/world-reference-resolver.ts',
-      'modules/canvas/world-target-access.ts',
-    ],
+    'storage/canvas-store.js': [],
     'storage/canvas-dirs.js': [
       'modules/agent/tools/world-target-read.test.ts',
       'modules/canvas/canvas-command-router.test.ts',
-      'modules/canvas/canvas-command-router.ts',
-      'modules/canvas/canvas.route.ts',
       'modules/canvas/external-watcher.test.ts',
-      'modules/canvas/external-watcher.ts',
-      'modules/canvas/world-portal-policy.ts',
       'modules/canvas/world-portals.test.ts',
-      'modules/canvas/world-portals.ts',
       'modules/canvas/world-reference-resolver.test.ts',
-      'modules/canvas/world-reference-resolver.ts',
-      'modules/canvas/world-target-access.ts',
-      'modules/workspace.ts',
     ],
     'storage/paths.js': [
       'modules/canvas/canvas-content-cas.test.ts',
       'modules/canvas/canvas.route.test.ts',
-      'modules/canvas/canvas.route.ts',
-      'modules/canvas/external-watcher.ts',
-      'modules/canvas/world-target-access.ts',
       'modules/workspace/migrations/migrate-acp-sessions.ts',
     ],
   };
diff --git a/apps/server/src/modules/storage/ports/contracts/space-nodes.contract.ts b/apps/server/src/modules/storage/ports/contracts/space-nodes.contract.ts
index f6499cf9b..af8ea7d0d 100644
--- a/apps/server/src/modules/storage/ports/contracts/space-nodes.contract.ts
+++ b/apps/server/src/modules/storage/ports/contracts/space-nodes.contract.ts
@@ -66,6 +66,83 @@ export function describeSpaceNodesContract(
       await expect(repository.read('contract-missing')).resolves.toBeNull();
     });
 
+    it('lists every complete node record with the same revisions as targeted reads', async () => {
+      const { repository } = await open();
+      const first = await putSuccessfully(repository, {
+        nodeId: 'contract-list-node-a',
+        record: note('contract-list-node-a', 'Contract list A', 'alpha'),
+      });
+      const second = await putSuccessfully(repository, {
+        nodeId: 'contract-list-node-b',
+        record: note('contract-list-node-b', 'Contract list B', 'beta'),
+      });
+
+      await expect(repository.list()).resolves.toEqual(
+        new Map([
+          ['contract-list-node-a', first],
+          ['contract-list-node-b', second],
+        ]),
+      );
+    });
+
+    it('reads the named nodes, agreeing with list and omitting absentees', async () => {
+      const { repository } = await open();
+      const first = await putSuccessfully(repository, {
+        nodeId: 'contract-many-node-a',
+        record: note('contract-many-node-a', 'Contract many A', 'alpha'),
+      });
+      await putSuccessfully(repository, {
+        nodeId: 'contract-many-node-b',
+        record: note('contract-many-node-b', 'Contract many B', 'beta'),
+      });
+
+      const selected = await repository.readMany([
+        'contract-many-node-a',
+        'contract-missing',
+        // Repeated on purpose: a caller assembling ids from topology can
+        // easily name one twice, and that must not change the result.
+        'contract-many-node-a',
+      ]);
+
+      expect(selected).toEqual(new Map([['contract-many-node-a', first]]));
+      // Whatever it returns must be exactly what the whole-Space read holds,
+      // so a caller can move between the two without noticing.
+      const listed = await repository.list();
+      expect(selected.get('contract-many-node-a')).toEqual(
+        listed.get('contract-many-node-a'),
+      );
+    });
+
+    it('reads nothing for an empty id set', async () => {
+      const { repository } = await open();
+      await putSuccessfully(repository, {
+        nodeId: 'contract-many-empty',
+        record: note('contract-many-empty', 'Contract many empty', 'alpha'),
+      });
+
+      await expect(repository.readMany([])).resolves.toEqual(new Map());
+    });
+
+    it('streams the same snapshot returned by list', async () => {
+      const { repository } = await open();
+      await putSuccessfully(repository, {
+        nodeId: 'contract-stream-node-a',
+        record: note('contract-stream-node-a', 'Contract stream A', 'alpha'),
+      });
+      await putSuccessfully(repository, {
+        nodeId: 'contract-stream-node-b',
+        record: note('contract-stream-node-b', 'Contract stream B', 'beta'),
+      });
+      const delivered = new Map<string, NodeSnapshot>();
+
+      const streamed = await repository.stream((nodeId, snapshot) => {
+        delivered.set(nodeId, snapshot);
+      });
+
+      await expect(repository.list()).resolves.toEqual(streamed);
+      expect(delivered).toEqual(streamed);
+    });
+
     it('returns the exact persisted record and its matching revision from put', async () => {
       const { repository } = await open();
       const input: NodePutInput = {
@@ -236,6 +313,7 @@ export function describeSpaceNodesContract(
       await expect(repository.delete(nodeId)).resolves.toBe('deleted');
       await expect(repository.read(nodeId)).resolves.toBeNull();
       await expect(repository.delete(nodeId)).resolves.toBe('absent');
+      expect((await repository.list()).has(nodeId)).toBe(false);
     });
 
     it('suppresses a late standalone put after deletion', async () => {
diff --git a/apps/server/src/modules/storage/ports/contracts/space-repository.contract.ts b/apps/server/src/modules/storage/ports/contracts/space-repository.contract.ts
index 32cdf2909..79017c6aa 100644
--- a/apps/server/src/modules/storage/ports/contracts/space-repository.contract.ts
+++ b/apps/server/src/modules/storage/ports/contracts/space-repository.contract.ts
@@ -21,6 +21,14 @@ export interface SpaceRepositoryContractHarness {
   readonly read: (canvasId: string) => Promise<CanvasFile | null>;
   /** Stable World id in the harness namespace. */
   readonly worldCanvasId: string;
+  /**
+   * Repository over a second namespace that has never held a World.
+   *
+   * Bootstrap has two branches and a new backend meets the empty one first,
+   * so the suite has to be able to reach a namespace the harness has not
+   * already seeded.
+   */
+  readonly openUnbootstrapped: () => Promise<SpaceRepository> | SpaceRepository;
   /** One representative portable mutation for deletion-fence checks. */
   readonly attemptMutation: (canvasId: string) => Promise<unknown>;
   readonly cleanup?: () => Promise<void> | void;
@@ -51,6 +59,29 @@ export function describeSpaceRepositoryContract(
       await expect(repository.list()).resolves.toEqual([]);
     });
 
+    it('ensures the existing World idempotently', async () => {
+      const { repository, worldCanvasId } = await open();
+
+      await expect(repository.ensureWorld()).resolves.toBe(worldCanvasId);
+      await expect(repository.ensureWorld()).resolves.toBe(worldCanvasId);
+      await expect(repository.worldId()).resolves.toBe(worldCanvasId);
+    });
+
+    it('creates exactly one World in a namespace that has none', async () => {
+      const { openUnbootstrapped } = await open();
+      const repository = await openUnbootstrapped();
+
+      const created = await repository.ensureWorld();
+
+      expect(created).toBeTruthy();
+      // Same id on a second call: bootstrap must not mint a new identity,
+      // and the World it created must be the one `worldId()` now reports.
+      await expect(repository.ensureWorld()).resolves.toBe(created);
+      await expect(repository.worldId()).resolves.toBe(created);
+      // The World is never an ordinary, user-visible Space.
+      await expect(repository.list()).resolves.toEqual([]);
+    });
+
     it('lists created ordinary Spaces without promising order', async () => {
       const { repository } = await open();
       const first = await repository.create({
diff --git a/apps/server/src/modules/storage/ports/structured.ts b/apps/server/src/modules/storage/ports/structured.ts
index 274074304..cf6600924 100644
--- a/apps/server/src/modules/storage/ports/structured.ts
+++ b/apps/server/src/modules/storage/ports/structured.ts
@@ -173,6 +173,8 @@ export type SpaceRenameResult =
  * complete before a later, independent record write fails.
  */
 export interface SpaceRepository {
+  /** Return the stable World id, creating the one initial World if absent. */
+  ensureWorld(): Promise<string>;
   list(): Promise<CanvasSummary[]>;
   /**
    * Return the stable id of the hidden World Space.
@@ -401,8 +403,15 @@ export interface SpaceTaskRuns {
 export interface NodeSnapshot {
   readonly record: NodeContent;
   readonly revision: string;
+  /** Non-fatal integrity findings observed while reading this record. */
+  readonly warnings?: readonly NodeReadWarning[];
 }
 
+export type NodeReadWarning = {
+  readonly kind: 'duplicate-record';
+  readonly names: readonly string[];
+};
+
 export interface NodePutInput {
   readonly nodeId: string;
   readonly record: NodeContent;
@@ -471,6 +480,33 @@ export interface SpaceNodes {
    */
   readonly canvasId: string;
   read(nodeId: string): Promise<NodeSnapshot | null>;
+  /**
+   * Read the named node records, keyed by stable id.
+   *
+   * Ids with no record are absent from the result rather than present and
+   * null, so the map is the same shape {@link list} returns and callers can
+   * treat the two interchangeably.
+   *
+   * This exists because most readers want a handful of named nodes, not the
+   * Space: a selection to describe, a neighbourhood to render, one view to
+   * serve. Expressing those as `list()` makes their cost grow with the Space
+   * instead of with the request, and it is a shape every backend can serve
+   * better than a full scan — a SQL adapter answers it with one `WHERE id IN`
+   * rather than reading every row.
+   */
+  readMany(
+    nodeIds: Iterable<string>,
+  ): Promise<ReadonlyMap<string, NodeSnapshot>>;
+  /** Read every complete node record in this Space, keyed by stable id. */
+  list(): Promise<ReadonlyMap<string, NodeSnapshot>>;
+  /**
+   * Deliver complete node records as they become available and return the
+   * same final snapshot as {@link list}. Delivery order is unspecified.
+   */
+  stream(
+    onNode: (nodeId: string, snapshot: NodeSnapshot) => void,
+    signal?: { readonly aborted: boolean },
+  ): Promise<ReadonlyMap<string, NodeSnapshot>>;
   put(input: NodePutInput): Promise<NodePutResult>;
   delete(nodeId: string): Promise<NodeDeleteResult>;
 }
diff --git a/apps/server/src/modules/storage/product-boundary.test.ts b/apps/server/src/modules/storage/product-boundary.test.ts
new file mode 100644
index 000000000..19c458e8e
--- /dev/null
+++ b/apps/server/src/modules/storage/product-boundary.test.ts
@@ -0,0 +1,164 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT license.
+
+/**
+ * Phase 4.6's exit criterion, exercised rather than asserted (§12.6).
+ *
+ * "Adding another `StructuredStore` changes adapter, composition, and
+ * migration code, but does not require feature modules to learn that
+ * backend's record layout." The way to test that claim is to reach for
+ * everything a feature module reaches for — records, node content, blobs, the
+ * materialized tree — through the public storage surface only, and to run it
+ * against whichever profiles are mounted rather than against Disk by name.
+ *
+ * Nothing here names a directory, a filename, or `space.json`. If a future
+ * change makes any of these behaviours depend on one backend's layout, this
+ * suite still passes on Disk and fails on the next profile — which is exactly
+ * the signal Phase 5 needs and cannot get from the per-adapter contracts.
+ */
+
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+
+import { afterEach, describe, expect, it } from 'vitest';
+
+import {
+  describeProfile,
+  mountTestStorage,
+  PRODUCT_STORAGE_PROFILES,
+  type MountedTestStorage,
+} from './testing.js';
+import { readCanvas, readCanvasNodes } from '../canvas/space-read.js';
+
+import {
+  canvasBlobs,
+  createSpace,
+  diskSpaceTree,
+  getStructuredStore,
+} from './index.js';
+
+let mounted: MountedTestStorage | null = null;
+
+afterEach(async () => {
+  await mounted?.unmount();
+  mounted = null;
+});
+
+describe.each(PRODUCT_STORAGE_PROFILES.map((p) => [describeProfile(p), p]))(
+  'product storage boundary: %s',
+  (_label, profile) => {
+    async function mount(): Promise<MountedTestStorage> {
+      mounted = await mountTestStorage({ profile });
+      return mounted;
+    }
+
+    it('bootstraps exactly one World that ordinary listings omit', async () => {
+      await mount();
+      const spaces = getStructuredStore().spaces();
+
+      const worldId = await spaces.worldId();
+
+      expect(worldId).toBeTruthy();
+      await expect(spaces.ensureWorld()).resolves.toBe(worldId);
+      await expect(spaces.list()).resolves.toEqual([]);
+    });
+
+    it('round-trips a Space and its node through the application read model', async () => {
+      await mount();
+      const canvasId = 'canvas-product-a';
+      const created = await createSpace(canvasId, 'Product Space');
+      expect(created.ok).toBe(true);
+
+      const put = await getStructuredStore()
+        .space(canvasId)
+        .nodes.put({
+          nodeId: 'node-product-a',
+          record: {
+            nodeId: 'node-product-a',
+            type: 'note',
+            label: 'Product node',
+            content: 'body',
+          },
+        });
+      expect(put.ok).toBe(true);
+
+      // The read model is what feature modules use; it must answer without
+      // anyone naming where the record went.
+      await expect(readCanvas(canvasId)).resolves.toMatchObject({
+        canvasId,
+        title: 'Product Space',
+      });
+      const records = await readCanvasNodes(canvasId, ['node-product-a']);
+      expect(records.get('node-product-a')).toMatchObject({
+        label: 'Product node',
+        content: 'body',
+      });
+    });
+
+    it('materializes the Space where its blobs are written', async () => {
+      await mount();
+      const canvasId = 'canvas-product-b';
+      await createSpace(canvasId, 'Blob Space');
+
+      await canvasBlobs(canvasId).put('artifact-a.png', Buffer.from('bytes'));
+
+      // The one invariant a feature module depends on: the tree it is handed
+      // and the tree blobs land in are the same tree.
+      const directory = diskSpaceTree(canvasId).directory();
+      expect(diskSpaceTree(canvasId).directory()).toBe(directory);
+      expect(existsSync(directory)).toBe(true);
+      await expect(
+        canvasBlobs(canvasId).read('artifact-a.png'),
+      ).resolves.toEqual(Buffer.from('bytes'));
+    });
+
+    it('maps a materialized node file back to the record it carries', async () => {
+      await mount();
+      const canvasId = 'canvas-product-c';
+      await createSpace(canvasId, 'File Space');
+      await getStructuredStore()
+        .space(canvasId)
+        .nodes.put({
+          nodeId: 'node-product-c',
+          record: {
+            nodeId: 'node-product-c',
+            type: 'note',
+            label: 'Mapped node',
+            content: 'body',
+          },
+        });
+
+      // RFS serves files and needs the record behind one. Which file that is
+      // belongs to the materialization, so the test asks it rather than
+      // constructing a name.
+      const scope = diskSpaceTree(canvasId);
+      const nodesDirectory = scope.nodesDirectory();
+      expect(nodesDirectory.startsWith(scope.directory())).toBe(true);
+
+      const { readdirSync } = await import('node:fs');
+      const [filename] = readdirSync(nodesDirectory).filter((entry) =>
+        entry.endsWith('.md'),
+      );
+      expect(filename).toBeTruthy();
+      await expect(scope.nodeIdForPath(`nodes/${filename}`)).resolves.toBe(
+        'node-product-c',
+      );
+      expect(existsSync(path.join(nodesDirectory, filename))).toBe(true);
+    });
+
+    it('deletes a Space across both stores', async () => {
+      await mount();
+      const canvasId = 'canvas-product-d';
+      await createSpace(canvasId, 'Doomed Space');
+      await canvasBlobs(canvasId).put('artifact-a.png', Buffer.from('bytes'));
+
+      const { deleteSpace } = await import('./index.js');
+      await expect(deleteSpace(canvasId)).resolves.toMatchObject({ ok: true });
+
+      await expect(readCanvas(canvasId)).resolves.toBeNull();
+      await expect(canvasBlobs(canvasId).read('artifact-a.png')).resolves.toBe(
+        null,
+      );
+    });
+  },
+);
diff --git a/apps/server/src/modules/storage/profile.test.ts b/apps/server/src/modules/storage/profile.test.ts
index 18be15c91..da14b02d1 100644
--- a/apps/server/src/modules/storage/profile.test.ts
+++ b/apps/server/src/modules/storage/profile.test.ts
@@ -92,9 +92,18 @@ describe('requiresExplicitInit', () => {
   });
 
   it.each([
-    { structured: { kind: 'postgres' }, blobs: { kind: 'disk' } },
-    { structured: { kind: 'sqlite' }, blobs: { kind: 'disk' } },
-    { structured: { kind: 'disk' }, blobs: { kind: 'azure' } },
+    {
+      structured: { kind: 'postgres' },
+      blobs: { kind: 'disk' },
+    },
+    {
+      structured: { kind: 'sqlite' },
+      blobs: { kind: 'disk' },
+    },
+    {
+      structured: { kind: 'disk' },
+      blobs: { kind: 'azure' },
+    },
   ] as const)('requires an awaited init for %j', (profile) => {
     expect(requiresExplicitInit(profile)).toBe(true);
   });
diff --git a/apps/server/src/modules/storage/profile.ts b/apps/server/src/modules/storage/profile.ts
index f548af174..a37137157 100644
--- a/apps/server/src/modules/storage/profile.ts
+++ b/apps/server/src/modules/storage/profile.ts
@@ -89,6 +89,11 @@ export function parseStorageProfile(
  * cross-axis rules belong as backends land — for example, Postgres paired
  * with a node-local disk blob root is unsafe across replicas unless the
  * path is a deliberately shared filesystem.
+ *
+ * Space materialization is deliberately absent: it is not an axis. There is
+ * exactly one coherent placement per structured backend, so the composition
+ * root derives it rather than validating a choice nobody makes. See
+ * `materialization.ts`.
  */
 export function validateStorageProfile(profile: StorageProfile): void {
   if (!IMPLEMENTED_STRUCTURED.includes(profile.structured.kind)) {
diff --git a/apps/server/src/modules/storage/storage.ts b/apps/server/src/modules/storage/storage.ts
index c11a93e0b..46705242c 100644
--- a/apps/server/src/modules/storage/storage.ts
+++ b/apps/server/src/modules/storage/storage.ts
@@ -26,9 +26,14 @@ import path from 'node:path';
 import {
   acquireWorkspaceOperationLease,
   getWorkspacePath,
+  isWorkspaceConfigured,
 } from '../workspace.js';
 import { DiskBlobStore } from './backends/disk/blob-store.js';
-import { canvasRoot } from './backends/disk/layout.js';
+import {
+  DiskSpaceTrees,
+  type DiskSpaceImport,
+  type DiskSpaceTree,
+} from './backends/disk/space-tree.js';
 import { DiskStructuredStore } from './backends/disk/structured-store.js';
 import {
   parseStorageProfile,
@@ -38,6 +43,7 @@ import {
   type StorageProfile,
 } from './profile.js';
 import { withSpacePutAdmission } from './space-lifecycle-admission.js';
+import { getLogger } from '../../utils/logger.js';
 
 import type {
   BlobInfo,
@@ -55,6 +61,8 @@ import type {
 } from './ports/structured.js';
 import type { Readable } from 'node:stream';
 
+const log = getLogger('storage');
+
 /**
  * Outcome of the cross-store Space deletion this module composes.
  *
@@ -97,8 +105,18 @@ function drainRejectedBody(body: Readable | Buffer): void {
 
 export interface Storage {
   readonly profile: StorageProfile;
+  readonly workspacePath: string;
   readonly structured: StructuredStore;
   readonly blobs: BlobStore;
+  /**
+   * Disk's Space directories — **not a third port**.
+   *
+   * Present only while the profile is Disk, and `null` otherwise, because a
+   * backend that keeps Spaces in tables has no directory to offer and should
+   * not pretend. Reached through {@link diskSpaceTree}, never directly, so
+   * every consumer is enumerable.
+   */
+  readonly diskTrees: DiskSpaceTrees | null;
 }
 
 function buildBlobStore(profile: StorageProfile): BlobStore {
@@ -111,10 +129,13 @@ function buildBlobStore(profile: StorageProfile): BlobStore {
   }
 }
 
-function buildStructuredStore(profile: StorageProfile): StructuredStore {
+function buildStructuredStore(
+  profile: StorageProfile,
+  workspacePath: string,
+): StructuredStore {
   switch (profile.structured.kind) {
     case 'disk':
-      return new DiskStructuredStore();
+      return new DiskStructuredStore(workspacePath);
     default:
       throw new Error(
         `Unsupported structured backend: ${profile.structured.kind}`,
@@ -122,21 +143,43 @@ function buildStructuredStore(profile: StorageProfile): StructuredStore {
   }
 }
 
-/** Validate a profile and construct both connections. Does not `init()`. */
-export function createStorage(profile: StorageProfile): Storage {
+/** Validate a profile and construct the Workspace-bound connections. */
+export function createStorage(
+  profile: StorageProfile,
+  workspacePath: string = getWorkspacePath(),
+): Storage {
   validateStorageProfile(profile);
+  const resolvedWorkspacePath = path.resolve(workspacePath);
   return {
     profile,
-    structured: buildStructuredStore(profile),
+    workspacePath: resolvedWorkspacePath,
+    structured: buildStructuredStore(profile, resolvedWorkspacePath),
     blobs: buildBlobStore(profile),
+    diskTrees:
+      profile.structured.kind === 'disk'
+        ? new DiskSpaceTrees(resolvedWorkspacePath)
+        : null,
   };
 }
 
 // ─── Process-wide holder ────────────────────────────────────────────────────
 
 let current: Storage | null = null;
+let configuredProfile: StorageProfile | null = null;
 let spaceCreateTail: Promise<void> = Promise.resolve();
 
+export interface StorageRuntime {
+  readonly profile: StorageProfile;
+  readonly mounted: boolean;
+  readonly workspacePath: string | null;
+}
+
+export interface StagedStorageMount {
+  readonly storage: Storage;
+  activate(): Promise<void>;
+  abort(): Promise<void>;
+}
+
 function defaultSpaceTitle(
   existing: readonly { readonly title: string | null }[],
 ): string {
@@ -159,12 +202,14 @@ function serializeSpaceCreate<T>(operation: () => Promise<T>): Promise<T> {
 }
 
 function ensure(): Storage {
-  if (current) return current;
+  const workspacePath = activeWorkspacePath();
+  if (current?.workspacePath === workspacePath) return current;
 
-  const profile = parseStorageProfile();
+  const profile =
+    current?.profile ?? configuredProfile ?? parseStorageProfile();
   // Build first, so an unimplemented backend reports that rather than the
   // initialization complaint below.
-  const storage = createStorage(profile);
+  const storage = createStorage(profile, workspacePath);
   if (requiresExplicitInit(profile)) {
     throw new StorageProfileError(
       `Storage was used before initStorage(). The ` +
@@ -173,10 +218,69 @@ function ensure(): Storage {
         `Call initStorage() during startup.`,
     );
   }
+  // The synchronous free-mode compatibility path can still commit a new
+  // Workspace directly. Disk connections are inert, so rebuilding their
+  // Workspace-bound handles here preserves that path without letting a
+  // retained handle cross namespaces. Backends that require async startup
+  // are rejected above and must use the staged activation lifecycle.
   current = storage;
   return current;
 }
 
+async function closeConnections(storage: Storage): Promise<void> {
+  await Promise.all([storage.structured.close(), storage.blobs.close()]);
+}
+
+async function openConnections(storage: Storage): Promise<void> {
+  try {
+    await Promise.all([storage.structured.init(), storage.blobs.init()]);
+    await storage.structured.spaces().ensureWorld();
+  } catch (error) {
+    await closeConnections(storage).catch(() => undefined);
+    throw error;
+  }
+}
+
+/** Prepare all connections for a Workspace without changing the active mount. */
+export async function stageStorageForWorkspace(
+  workspacePath: string,
+  profile: StorageProfile = configuredProfile ?? parseStorageProfile(),
+): Promise<StagedStorageMount> {
+  const storage = createStorage(profile, workspacePath);
+  await openConnections(storage);
+  let state: 'staged' | 'active' | 'aborted' = 'staged';
+  return Object.freeze({
+    storage,
+    async activate(): Promise<void> {
+      if (state !== 'staged') {
+        throw new Error(`Storage mount is already ${state}`);
+      }
+      // Refresh only the process-local Disk directory index after the
+      // Workspace path has been committed. This performs no filesystem I/O;
+      // fallible connection setup and World bootstrap happened while staged.
+      storage.diskTrees?.activate();
+      state = 'active';
+      const previous = current;
+      current = storage;
+      configuredProfile = profile;
+      spaceCreateTail = Promise.resolve();
+      if (previous && previous !== storage) {
+        await closeConnections(previous).catch((error: unknown) => {
+          log.error(
+            { error, workspacePath: previous.workspacePath },
+            'Previous Workspace storage did not close cleanly',
+          );
+        });
+      }
+    },
+    async abort(): Promise<void> {
+      if (state !== 'staged') return;
+      state = 'aborted';
+      await closeConnections(storage);
+    },
+  });
+}
+
 /**
  * Build the storage connections and open them.
  *
@@ -185,11 +289,26 @@ function ensure(): Storage {
  */
 export async function initStorage(
   profile: StorageProfile = parseStorageProfile(),
-): Promise<Storage> {
-  const storage = createStorage(profile);
-  await Promise.all([storage.structured.init(), storage.blobs.init()]);
-  current = storage;
-  return storage;
+): Promise<StorageRuntime> {
+  validateStorageProfile(profile);
+  configuredProfile = profile;
+  if (!isWorkspaceConfigured()) {
+    return { profile, mounted: false, workspacePath: null };
+  }
+  const staged = await stageStorageForWorkspace(getWorkspacePath(), profile);
+  await staged.activate();
+  return {
+    profile,
+    mounted: true,
+    workspacePath: staged.storage.workspacePath,
+  };
+}
+
+/** Close the current Workspace-bound connections during graceful shutdown. */
+export async function closeStorage(): Promise<void> {
+  const storage = current;
+  current = null;
+  if (storage) await closeConnections(storage);
 }
 
 export function getStorage(): Storage {
@@ -204,6 +323,18 @@ export function getStructuredStore(): StructuredStore {
   return ensure().structured;
 }
 
+export function getWorldCanvasId(): Promise<string> {
+  return ensure().structured.spaces().worldId();
+}
+
+export async function isWorldCanvasId(canvasId: string): Promise<boolean> {
+  return (await getWorldCanvasId()) === canvasId;
+}
+
+export function requireWorldCanvasId(): Promise<string> {
+  return getWorldCanvasId();
+}
+
 /**
  * Create one ordinary Space through the selected structured backend.
  *
@@ -332,22 +463,44 @@ export async function storageHealth(): Promise<StorageHealth[]> {
 }
 
 /**
- * The real directory backing a Space — the materialization capability.
+ * The Disk directory backing a Space — a **Disk-only** capability.
  *
- * Some consumers genuinely need a filesystem path rather than a record: an
- * ACP agent needs a working directory, the external watcher needs something
- * to watch, RFS exposes a tree. That is a product requirement, not a leak
- * (proposal §12.5.4), and it is the Space-level counterpart to
- * `BlobScope.materialize()`.
+ * Some features currently need a Space as a filesystem tree: RFS projects a
+ * listing, the external-note watcher arms `fs.watch`, the built-in file tools
+ * root a sandbox, and the agent domain keeps `.memory/` and ACP sessions
+ * beside a Space. None of that is portable, and none of it is promised by a
+ * port — `StructuredStore` and `BlobStore` are the whole portable surface.
  *
- * It lives in the composition root because only this module may ask a named
- * backend where anything is. Every profile selectable today materializes, so
- * this resolves unconditionally; a backend that stores Spaces without a
- * directory would refuse here rather than hand back a path that does not
- * exist.
+ * It therefore refuses rather than improvising when the profile is not Disk.
+ * A backend that keeps Spaces in tables has no directory to hand out, and
+ * fabricating one would only move the failure somewhere less obvious. Every
+ * caller of this is a reason a non-Disk structured profile is not selectable,
+ * which is why `module-boundaries.test.ts` keeps an exact list of them.
  */
-export function spaceDirectory(canvasId: string): string {
-  return canvasRoot(canvasId);
+export function diskSpaceTree(canvasId: string): DiskSpaceTree {
+  const trees = ensure().diskTrees;
+  if (!trees) {
+    throw new StorageProfileError(
+      `Space directories are a Disk capability, and the structured backend ` +
+        `is "${ensure().profile.structured.kind}". The feature that asked ` +
+        `for one needs a filesystem projection this backend does not have.`,
+    );
+  }
+  return trees.space(canvasId);
+}
+
+/** Stage an uploaded Space bundle. Disk-only, for the same reason. */
+export function stageDiskSpaceImport(
+  canvasId: string,
+): Promise<DiskSpaceImport> {
+  const trees = ensure().diskTrees;
+  if (!trees) {
+    throw new StorageProfileError(
+      `Space bundle import is a Disk capability, and the structured backend ` +
+        `is "${ensure().profile.structured.kind}".`,
+    );
+  }
+  return trees.stageImport(canvasId);
 }
 
 /**
diff --git a/apps/server/src/modules/storage/testing.ts b/apps/server/src/modules/storage/testing.ts
new file mode 100644
index 000000000..d01dd284c
--- /dev/null
+++ b/apps/server/src/modules/storage/testing.ts
@@ -0,0 +1,98 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT license.
+
+/**
+ * Mount a real storage profile for a product test.
+ *
+ * The reusable suites under `ports/contracts/` prove an adapter honours a
+ * contract in isolation. They cannot prove the thing Phase 5 actually needs
+ * to know: that the *application* still works when the backend changes. That
+ * question is only answerable by running product behaviour — real Canvas
+ * services, real serializers, real materialization — against a mounted
+ * profile, and it is only worth answering once there is more than one profile
+ * to mount.
+ *
+ * So this is deliberately not a stub factory. `setStorageForTesting()` swaps
+ * in a fake and is the right tool for isolating a caller from storage; this
+ * one goes through the production lifecycle — a prepared Workspace, staged
+ * connections, `ensureWorld()`, the atomic mount swap — so what a test
+ * exercises is what the server does. A test written against it is
+ * backend-agnostic by construction: adding a profile to
+ * {@link PRODUCT_STORAGE_PROFILES} runs every such test against it.
+ */
+
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+
+import { type StorageProfile } from './profile.js';
+import {
+  closeStorage,
+  getStorage,
+  stageStorageForWorkspace,
+  type Storage,
+} from './storage.js';
+import { setWorkspacePath } from '../workspace.js';
+
+export interface MountedTestStorage {
+  readonly profile: StorageProfile;
+  readonly workspacePath: string;
+  readonly storage: Storage;
+  /** Close the connections and remove the temporary Workspace. */
+  unmount(): Promise<void>;
+}
+
+/**
+ * Every profile product behaviour should hold for.
+ *
+ * One entry today. It is a list rather than a constant because that is the
+ * whole point: the second structured adapter joins it, and every test written
+ * against {@link mountTestStorage} starts covering it without being touched.
+ */
+export const PRODUCT_STORAGE_PROFILES: readonly StorageProfile[] = [
+  {
+    structured: { kind: 'disk' },
+    blobs: { kind: 'disk' },
+  },
+];
+
+/** A short, stable label for a profile — useful as a test name. */
+export function describeProfile(profile: StorageProfile): string {
+  return `${profile.structured.kind}/${profile.blobs.kind}`;
+}
+
+/**
+ * Prepare a temporary Workspace and mount `profile` onto it.
+ *
+ * The Workspace is prepared through `setWorkspacePath`, so boot migrations
+ * and the World bootstrap run exactly as they do at startup.
+ */
+export async function mountTestStorage(
+  options: {
+    readonly profile?: StorageProfile;
+    readonly prefix?: string;
+  } = {},
+): Promise<MountedTestStorage> {
+  const profile = options.profile ?? PRODUCT_STORAGE_PROFILES[0];
+  const workspacePath = mkdtempSync(
+    path.join(tmpdir(), options.prefix ?? 'huabu-product-'),
+  );
+  setWorkspacePath(workspacePath);
+  const staged = await stageStorageForWorkspace(workspacePath, profile);
+  await staged.activate();
+
+  let unmounted = false;
+  return {
+    profile,
+    workspacePath,
+    get storage(): Storage {
+      return getStorage();
+    },
+    async unmount(): Promise<void> {
+      if (unmounted) return;
+      unmounted = true;
+      await closeStorage();
+      rmSync(workspacePath, { recursive: true, force: true });
+    },
+  };
+}
diff --git a/apps/server/src/modules/task/run-launcher.ts b/apps/server/src/modules/task/run-launcher.ts
index 5fddbbbba..7c0e732a0 100644
--- a/apps/server/src/modules/task/run-launcher.ts
+++ b/apps/server/src/modules/task/run-launcher.ts
@@ -33,7 +33,8 @@ import {
   SelectableAgentProfileError,
 } from '../agent/selectable-agent-profile.js';
 import { buildSpatialBundle } from '../canvas/canvas-spatial.js';
-import { getStructuredStore, getCanvasStore } from '../storage/index.js';
+import { readCanvas } from '../canvas/space-read.js';
+import { getStructuredStore } from '../storage/index.js';
 
 import type { ChatEnvelope } from '../agent/conversation/envelope.js';
 import type { SpaceTasks } from '../storage/index.js';
@@ -57,12 +58,12 @@ function createRootEnvelope(goal: string): ChatEnvelope {
   };
 }
 
-export function resolveRootAgentPosition(
+export async function resolveRootAgentPosition(
   canvasId: string,
   anchorNodeId: string,
   runOrdinal: number,
-): Point {
-  const canvas = getCanvasStore(canvasId).read();
+): Promise<Point> {
+  const canvas = await readCanvas(canvasId);
   if (!canvas) throw new Error(`Canvas ${canvasId} does not exist`);
   const bundle = buildSpatialBundle(canvas);
   const anchor = bundle.spatialById.get(anchorNodeId);
@@ -91,7 +92,7 @@ interface RunLauncherDependencies {
     canvasId: string,
     anchorNodeId: string,
     runOrdinal: number,
-  ) => Point;
+  ) => Promise<Point> | Point;
   createAgentNode: (
     input: CreateAgentNodeInput,
   ) => Promise<CreateAgentNodeResult>;
@@ -337,7 +338,7 @@ export class RunLauncher {
       if (runOrdinal < 0) {
         throw new Error(`Run ${runId} disappeared after creation`);
       }
-      return this.dependencies.resolveRootPosition(
+      return await this.dependencies.resolveRootPosition(
         task.canvasId,
         task.anchorNodeId,
         runOrdinal,
diff --git a/apps/server/src/modules/web/web.route.ts b/apps/server/src/modules/web/web.route.ts
index 171125926..a19135e54 100644
--- a/apps/server/src/modules/web/web.route.ts
+++ b/apps/server/src/modules/web/web.route.ts
@@ -9,7 +9,7 @@ import {
   webLookupQuerySchema,
 } from '@huabu/shared';
 
-import { getCanvasStore } from '../storage/index.js';
+import { readCanvas, readCanvasNode } from '../canvas/space-read.js';
 
 import type {
   WebLookupQuery,
@@ -168,7 +168,7 @@ const webRoutes: FastifyPluginAsync = async (fastify) => {
 
       const { canvasId, nodeId } = parsed.data;
 
-      const source = getCanvasStore(canvasId).readNode(nodeId);
+      const source = await readCanvasNode(canvasId, nodeId);
       if (!source || source.type !== 'web') {
         return reply.code(404).send({ message: 'Source not ingested' });
       }
@@ -227,7 +227,7 @@ const webRoutes: FastifyPluginAsync = async (fastify) => {
 
       const { canvasId, nodeId } = parsed.data;
 
-      const source = getCanvasStore(canvasId).readNode(nodeId);
+      const source = await readCanvasNode(canvasId, nodeId);
       if (!source || source.type !== 'web') {
         return reply.code(404).send({ message: 'Source not ingested' });
       }
@@ -284,7 +284,7 @@ const webRoutes: FastifyPluginAsync = async (fastify) => {
 
     const { canvasId, nodeId } = parsed.data;
 
-    const source = getCanvasStore(canvasId).readNode(nodeId);
+    const source = await readCanvasNode(canvasId, nodeId);
     if (!source || source.type !== 'web') {
       return reply.code(404).send({ message: 'Source not ingested' });
     }
@@ -342,7 +342,7 @@ const webRoutes: FastifyPluginAsync = async (fastify) => {
       return reply.send(payload);
     }
 
-    const structuralNodes = getCanvasStore(canvasId).read()?.state.nodes as
+    const structuralNodes = (await readCanvas(canvasId))?.state.nodes as
       | Array<{
           id?: unknown;
           type?: unknown;
diff --git a/apps/server/src/modules/workspace-activation.test.ts b/apps/server/src/modules/workspace-activation.test.ts
index ac05eadca..bb74f2423 100644
--- a/apps/server/src/modules/workspace-activation.test.ts
+++ b/apps/server/src/modules/workspace-activation.test.ts
@@ -1,10 +1,11 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 
+import { getStorage } from './storage/index.js';
 import {
   activateWorkspacePath,
   runWorkspacePreparation,
@@ -67,6 +68,37 @@ describe('workspace activation isolation', () => {
     expect(getWorkspacePath()).toBe(path.resolve(previous));
   });
 
+  it('commits a prepared Workspace together with its storage mount', async () => {
+    const previous = tempDir('huabu-workspace-previous-');
+    const next = tempDir('huabu-workspace-next-');
+    const workerPath = worker(`process.send({ ok: true });`);
+    setWorkspacePath(previous);
+    const previousStorage = getStorage();
+
+    await activateWorkspacePath(next, { workerPath, timeoutMs: 1_000 });
+
+    expect(getWorkspacePath()).toBe(path.resolve(next));
+    expect(getStorage()).not.toBe(previousStorage);
+    expect(getStorage().workspacePath).toBe(path.resolve(next));
+  });
+
+  it('keeps the previous Workspace and mount when staged storage rejects', async () => {
+    const previous = tempDir('huabu-workspace-previous-');
+    const next = tempDir('huabu-workspace-invalid-');
+    const workerPath = worker(`process.send({ ok: true });`);
+    setWorkspacePath(previous);
+    const previousStorage = getStorage();
+    mkdirSync(path.join(next, '.world'), { recursive: true });
+    writeFileSync(path.join(next, '.world', 'space.json'), '{', 'utf8');
+
+    await expect(
+      activateWorkspacePath(next, { workerPath, timeoutMs: 1_000 }),
+    ).rejects.toThrow();
+
+    expect(getWorkspacePath()).toBe(path.resolve(previous));
+    expect(getStorage()).toBe(previousStorage);
+  });
+
   it('rejects a concurrent activation while preparation is running', async () => {
     const workerPath = worker(`setInterval(() => {}, 1_000);`);
     const first = activateWorkspacePath(tempDir('huabu-workspace-first-'), {
diff --git a/apps/server/src/modules/workspace-activation.ts b/apps/server/src/modules/workspace-activation.ts
index ca2144d05..51ffc8599 100644
--- a/apps/server/src/modules/workspace-activation.ts
+++ b/apps/server/src/modules/workspace-activation.ts
@@ -15,9 +15,12 @@ import { existsSync } from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
+import { stageStorageForWorkspace } from './storage/index.js';
 import {
   commitWorkspacePath,
+  getWorkspacePath,
   isManagedMode,
+  isWorkspaceConfigured,
   resolveWorkspacePath,
 } from './workspace.js';
 import { getLogger } from '../utils/logger.js';
@@ -194,7 +197,20 @@ export async function activateWorkspacePath(
   activationInProgress = true;
   try {
     await runWorkspacePreparation(resolvedPath, options);
-    commitWorkspacePath(resolvedPath);
+    const staged = await stageStorageForWorkspace(resolvedPath);
+    // The mount's own activation refreshes process-global locators, which
+    // only resolve once the path is committed — so the commit has to lead.
+    // Should the swap still fail, put the previous path back rather than
+    // leaving a committed Workspace whose storage was just discarded.
+    const previousPath = isWorkspaceConfigured() ? getWorkspacePath() : null;
+    try {
+      commitWorkspacePath(resolvedPath);
+      await staged.activate();
+    } catch (error) {
+      if (previousPath !== null) commitWorkspacePath(previousPath);
+      await staged.abort();
+      throw error;
+    }
   } finally {
     activationInProgress = false;
   }
diff --git a/apps/server/src/modules/workspace.route.ts b/apps/server/src/modules/workspace.route.ts
index 1a0f98353..1b63fba6e 100644
--- a/apps/server/src/modules/workspace.route.ts
+++ b/apps/server/src/modules/workspace.route.ts
@@ -9,7 +9,7 @@ import path from 'node:path';
 import { validatePathSchema, workspacePathSchema } from '@huabu/shared';
 
 import { resetPreprocessDispatcher } from './preprocessing/index.js';
-import { getStructuredStore, resetStorageCache } from './storage/index.js';
+import { getStructuredStore } from './storage/index.js';
 import {
   activateWorkspacePath,
   WorkspaceActivationInProgressError,
@@ -262,8 +262,6 @@ const workspaceRoutes: FastifyPluginAsync = async (app) => {
     }
     try {
       await activateWorkspacePath(parsed.data.path);
-      // Reset singletons that cache filesystem handles for the old workspace.
-      resetStorageCache();
       resetPreprocessDispatcher();
       return await buildWorkspaceState();
     } catch (e) {
diff --git a/apps/server/src/modules/workspace.ts b/apps/server/src/modules/workspace.ts
index 235042a92..0d2be756d 100644
--- a/apps/server/src/modules/workspace.ts
+++ b/apps/server/src/modules/workspace.ts
@@ -39,7 +39,6 @@
 import path from 'node:path';
 
 import { resetExternalNoteSessions } from './canvas/external-watcher.js';
-import { refreshCanvasDirIndex } from './storage/canvas-dirs.js';
 import { prepareWorkspaceOnDisk } from './workspace-prepare.js';
 import { invalidateUserSkill } from '../prompt/index.js';
 
@@ -212,9 +211,6 @@ export function resolveWorkspacePath(newPath: string): string {
 export function commitWorkspacePath(resolvedPath: string): void {
   assertWorkspacePathChangeAllowed(resolvedPath);
   _workspacePath = resolvedPath;
-  // Drop the cached canvas-dir index so subsequent lookups (used by
-  // migrations and route handlers) reflect the new workspace.
-  refreshCanvasDirIndex();
   // Drop any user-skill cache built against the previous workspace so
   // the next `listSkills` / `read("skills/...")` call rescans the new
   // `<workspace>/setting/skills/` from scratch. The import-cycle with
diff --git a/apps/server/src/modules/workspace/legacy-workspace-activation.test.ts b/apps/server/src/modules/workspace/legacy-workspace-activation.test.ts
index 756569b33..3150991d7 100644
--- a/apps/server/src/modules/workspace/legacy-workspace-activation.test.ts
+++ b/apps/server/src/modules/workspace/legacy-workspace-activation.test.ts
@@ -5,7 +5,7 @@
  * End-to-end activation of a legacy workspace, over the production routes.
  *
  * Phase 4.5 moved the Disk record layout inside the storage boundary and
- * routed every "where is this Space" question through `spaceDirectory()`. This
+ * routed every "where is this Space" question through `diskSpaceTree().directory()`. This
  * suite exists to prove that the move did not change what the app can read or
  * write. It does not test a module — it activates a workspace the way a launch
  * does (`setWorkspacePath` → `prepareWorkspaceOnDisk` → every migration) and
@@ -57,7 +57,7 @@ import agentRoutes from '../agent/agent.route.js';
 import artifactRoute from '../artifact/artifact.route.js';
 import canvasRoutes from '../canvas/canvas.route.js';
 import { createCanvas } from '../storage/compatibility/canvas.js';
-import { resetStorageCache, spaceDirectory } from '../storage/index.js';
+import { resetStorageCache, diskSpaceTree } from '../storage/index.js';
 import { setWorkspacePath } from '../workspace.js';
 
 import type { FastifyInstance } from 'fastify';
@@ -203,7 +203,7 @@ async function seedLegacyWorkspace(): Promise<void> {
   }
 
   // A legacy artifact, in the layout the Disk backend has always used.
-  const spaceDir = spaceDirectory(CANVAS_ID);
+  const spaceDir = diskSpaceTree(CANVAS_ID).directory();
   mkdirSync(join(spaceDir, '.artifacts'), { recursive: true });
   writeFileSync(
     join(spaceDir, '.artifacts', 'art_legacy.txt'),
@@ -408,7 +408,7 @@ describe('activating a legacy workspace on the new storage boundary', () => {
 
       // 2. Execute a real command batch that imports a staged local file into
       //    the artifact store through the blob port.
-      const uploadDir = join(spaceDirectory(CANVAS_ID), '.upload');
+      const uploadDir = join(diskSpaceTree(CANVAS_ID).directory(), '.upload');
       mkdirSync(uploadDir, { recursive: true });
       writeFileSync(join(uploadDir, 'fresh.txt'), 'freshly imported bytes');
       const exec = await app.inject({
diff --git a/apps/server/src/modules/workspace/paths.ts b/apps/server/src/modules/workspace/paths.ts
index 773816e27..f01da1588 100644
--- a/apps/server/src/modules/workspace/paths.ts
+++ b/apps/server/src/modules/workspace/paths.ts
@@ -36,7 +36,7 @@
 import path from 'node:path';
 
 import { sanitizeId } from '../../utils/fs.js';
-import { spaceDirectory } from '../storage/index.js';
+import { diskSpaceTree } from '../storage/index.js';
 import { getWorkspacePath } from '../workspace.js';
 
 import type { Namespace } from '@agenetes/protocol';
@@ -50,7 +50,10 @@ import type { Namespace } from '@agenetes/protocol';
 const LEGACY_HISTORY_DIR_NAME = '.history';
 
 function legacyHistoryDir(canvasId: string): string {
-  return path.join(spaceDirectory(canvasId), LEGACY_HISTORY_DIR_NAME);
+  return path.join(
+    diskSpaceTree(canvasId).directory(),
+    LEGACY_HISTORY_DIR_NAME,
+  );
 }
 
 // ─── Memory module paths ───────────────────────────────────────────────────
@@ -71,7 +74,10 @@ export function workspaceMemoryPath(): string {
 export const WORKING_MEMORY_DIR_NAME = '.memory';
 
 export function canvasMemoryDir(canvasId: string): string {
-  return path.join(spaceDirectory(canvasId), WORKING_MEMORY_DIR_NAME);
+  return path.join(
+    diskSpaceTree(canvasId).directory(),
+    WORKING_MEMORY_DIR_NAME,
+  );
 }
 
 /** Working memory body for a canvas. */
diff --git a/apps/server/src/server.ts b/apps/server/src/server.ts
index 4b22089c4..cf304216f 100644
--- a/apps/server/src/server.ts
+++ b/apps/server/src/server.ts
@@ -7,7 +7,7 @@ import { app } from './app.js';
 import { resolveBindHost } from './bind-host.js';
 import { prewarmOAuthCredentials } from './modules/agent/oauth.js';
 import { resolveDeploymentConfig } from './modules/security/deployment-config.js';
-import { initStorage } from './modules/storage/index.js';
+import { closeStorage, initStorage } from './modules/storage/index.js';
 import { initializeSecretStore } from './security/secret-store.js';
 import { getLogger } from './utils/logger.js';
 
@@ -39,6 +39,7 @@ async function start(): Promise<void> {
       {
         structured: storage.profile.structured.kind,
         blobs: storage.profile.blobs.kind,
+        mounted: storage.mounted,
       },
       'Storage backends ready',
     );
@@ -106,6 +107,7 @@ function shutdown(reason: string): void {
   forceExit.unref();
   app
     .close()
+    .then(() => closeStorage())
     .then(() => {
       clearTimeout(forceExit);
       process.exit(0);
diff --git a/docs/architecture/canvas-storage.md b/docs/architecture/canvas-storage.md
index 39a9cabb9..eee2a48fc 100644
--- a/docs/architecture/canvas-storage.md
+++ b/docs/architecture/canvas-storage.md
@@ -1,12 +1,66 @@
 # Canvas Storage Architecture
 
-> Last updated: 2026-08-11
+> Last updated: 2026-08-18
 
 ## 1. Overview
 
-Every Space remains fully self-contained on Disk by default, but storage no longer presents one all-purpose `CanvasStore` as its backend contract. `apps/server/src/modules/storage/` separates backend-neutral blob and structured ports, Disk adapters, process-wide composition, and a shrinking Disk compatibility facade. Opaque artifact bytes flow through `BlobStore`; `StructuredStore` exposes one `spaces()` repository for the Space collection — membership, World identity, and create/delete/rename — while `SpaceHandle` exposes the Space's own async record read and ordered write plus the parts it holds: `nodes`, `changes`, `tasks`, and `events`. Space creation and deletion, standalone node writes, executor and revert batches, preprocessing persistence, and event/change mutations enter these ports. The remaining compatibility consumers are explicit Disk capabilities and paths such as ZIP import/export, RFS upload/delete, external-note observation/claim, bootstrap/migration, and hydration helpers; some read and some mutate physical files, so they keep non-Disk profiles unselectable until their own contracts are designed.
-
-Runtime Home-folder activation prepares and migrates the selected directory in a disposable child process before committing it as the active workspace. This isolation is required because synchronous filesystem calls against cloud, network, or virtual drives can block indefinitely; a stuck preparation is terminated after 70 seconds with `WORKSPACE_ACTIVATION_TIMEOUT`, while the Server event loop and previously active workspace remain available. Concurrent activation attempts return `WORKSPACE_ACTIVATION_IN_PROGRESS`. Managed-mode startup still prepares synchronously before the Server accepts requests.
+Every Space remains fully self-contained on Disk by default, but storage no
+longer presents one all-purpose `CanvasStore` as its application contract.
+`apps/server/src/modules/storage/` separates backend-neutral blob and
+structured ports, the residual Disk directory capability, Disk
+adapters, process-wide composition, and a shrinking compatibility facade.
+Opaque artifact bytes flow through `BlobStore`; `StructuredStore` exposes one
+`spaces()` repository for the Space collection — membership, World identity,
+bootstrap, and create/delete/rename — while `SpaceHandle` exposes the Space's
+own async record read and ordered write plus the parts it holds: `nodes`,
+`changes`, `tasks`, and `events`. Production Canvas, agent, RFS, web,
+interactive-view, and Task structured reads and writes use these ports.
+`CanvasStore` remains an internal Disk primitive and compatibility-test seam,
+not an application service.
+
+File-native features such as RFS, built-in file tools, external-note watching,
+memory/debug files, and bundle import/export resolve their Workspace-bound
+materialization through `diskSpaceTree()`. They may use real paths, but do not name
+the Disk record layout or title-derived locator, and they ask
+`DiskSpaceTree.nodeIdForPath()` which record a materialized file carries
+rather than reading it out of the file's own frontmatter.
+
+A Space directory is **Disk's, and not portable**. `ports/` holds exactly
+`StructuredStore` and `BlobStore`; there is no third port and no promise that
+every backend can hand out a tree, because one that keeps Spaces in tables
+cannot. The capability is therefore reached as `diskSpaceTree(canvasId)` and
+`stageDiskSpaceImport()` — names that say Disk at the call site — and it
+refuses rather than improvising when the profile is not Disk.
+`module-boundaries.test.ts` pins both the exported names and the exact list of
+files that use them, so the surface only shrinks; each entry is a reason a
+non-Disk structured profile is not selectable.
+
+That list is not one population. Some of it is Disk-only for good — bundle
+export/import, reveal-in-file-manager, the built-in file tools, external-note
+discovery, Windows handle coordination — and off Disk those features are simply
+unavailable rather than emulated. The rest is headed for a port: worker state
+and other record-shaped files to `StructuredStore`, named user-authored
+documents to `BlobStore`, change notification to a per-backend capability. See
+[Multi-Backend Storage §6.4](../proposals/multi-backend-storage.md) for the
+disposition of each and for the single `space(canvasId)` handle that will vend
+them; neither is implemented here yet.
+
+The Disk blob adapter resolves its own `.artifacts/` placement from the Disk
+layout rather than borrowing the Space tree, so exactly one module answers
+"where is this Space" for each population it owns.
+
+Runtime Home-folder activation prepares and migrates the selected directory in
+a disposable child process, stages and initializes the Workspace-bound storage
+connections, and asks `SpaceRepository.ensureWorld()` to bootstrap the stable
+World before committing the path and swapping the active mount. A failed child
+or storage stage leaves the previous Workspace and mount active. This isolation
+is required because synchronous filesystem calls against cloud, network, or
+virtual drives can block indefinitely; a stuck preparation is terminated after
+70 seconds with `WORKSPACE_ACTIVATION_TIMEOUT`, while the Server event loop and
+previously active workspace remain available. Concurrent activation attempts
+return `WORKSPACE_ACTIVATION_IN_PROGRESS`. Managed-mode startup still prepares
+synchronously before the Server accepts requests, then initializes the same
+storage lifecycle. Graceful shutdown closes the mounted connections.
 
 ## 2. Disk Layout
 
@@ -42,10 +96,15 @@ Key points:
 
 - An ordinary Space **directory name** is derived from its title via `toSafeFilename(title)`, not from `canvasId`. The stable `canvasId` only lives inside `space.json`; the World is the reserved `.world` exception.
 - `SpaceRepository.list()` rescans on every call, returns ordinary Spaces only, skips ordinary directories without `space.json`, rejects malformed records (including a corrupt established World), and leaves ordering to the caller. `worldId()` resolves the hidden World from the same rescan and rejects missing or malformed state; it is the single World resolution point the collection's own create/delete/rename refusals also go through.
+- Two ordinary Space directories carrying the same `canvasId` are an integrity error raised by the directory scan, so a Finder-side duplication fails every catalogue read instead of resolving to an arbitrary copy.
 - The `canvasId -> directory name` index in `canvas-dirs.ts` is invalidated **lazily**, never by a live filesystem watcher. Catalogue reads and the World resolvers re-scan unconditionally, server-owned create/rename register the new directory directly, and `CanvasStore.read()` re-scans and retries when `space.json` is missing — which is also how a Finder-side Space rename is adopted as the new title. A stale index therefore self-heals on the next read of the affected Space.
 - External-note observation exists for one feature: surfacing user-authored `.md` files dropped into `<Space>/nodes/` from outside the app. There is **no workspace-level watcher**. In steady state there is at most one native `fs.watch` handle per **active Space session**; concurrent SSE subscribers to the same Space share that session, watcher, and scan, so watcher count follows distinct active Spaces rather than open streams. Opening a Space's stream arms its native watcher _before_ the one lazy scan begins (closing the scan-then-watch gap), limits that scan to eight concurrent file reads plus one asynchronous topology read for filtering known note ids, and returns a single merged snapshot; live events read the latest topology synchronously and always win over an older scan observation of the same path. When `nodes/` does not exist, non-Windows sessions watch the Space root and promote themselves to the child directory as soon as it appears. Windows sessions use one periodic existence probe instead, avoiding a root handle that would block external Space rename/delete. If an active `nodes/` directory is deleted or replaced, the session verifies its filesystem identity before emitting an empty snapshot, re-resolves a Finder-renamed Space by `canvasId`, then waits for the path and resumes child watching instead of remaining attached to the stale inode. The final `close()` releases the watcher, clears pending timers, and drops the Space's discovery state. A failed scan is not cached, so a later subscription retries. Workspace and session generations reject scans and events that resolve after a workspace switch or a close/reopen. Inactive Spaces hold no watcher and no in-memory state; their eventual state is rebuilt by the first lazy scan when they are next opened.
 - Because a live `fs.watch` handle inside a Space subtree makes `renameSync` / `rmSync` fail with EPERM on Windows, `space-dir-handles.ts` arbitrates between handle owners and directory mutations. Each active external-note session registers itself against its `canvasId`; server-owned Space rename and delete bracket the mutation with `withSpaceDirHandlesReleased(canvasId, fn)`, which releases that Space's handles and lets the owner re-acquire afterwards — re-resolving the directory, so a rename re-arms at the new path and a delete collapses the session to an empty snapshot. A Space with no open stream has no registered owner, so the bracket is a plain passthrough. Neither side knows about the other.
-- Workspace preparation creates exactly one hidden `.world/space.json` after migrations. Its generated `canvasId` remains stable, resolves through the normal `CanvasStore`, and is exposed separately as `WorkspaceInfo.worldCanvasId`; ordinary Canvas lists continue to omit it.
+- Workspace preparation and `SpaceRepository.ensureWorld()` share the same
+  idempotent Disk bootstrap primitive. They create exactly one hidden
+  `.world/space.json`; its generated `canvasId` remains stable, resolves through
+  the normal `SpaceHandle`, and is exposed separately as
+  `WorkspaceInfo.worldCanvasId`. Ordinary Space lists continue to omit it.
 - An established `.world` directory with a missing or malformed `space.json` is an integrity error. World identity is never silently regenerated, and the World cannot be deleted or directory-renamed through ordinary Space lifecycle operations.
 - Reading the World reconciles one canonical `canvasRef` Portal for every live ordinary Space; a Portal Pin whose source Space has no Portal yet runs the same reconciliation first, so pinning never depends on the user having opened the World. Reconciliation creates only missing Portals in deterministic open grid slots, preserves every existing node and position, rejects duplicate or malformed Portal identities, and leaves a broken Portal when its source Space is deleted.
 - Canonical Portal identity is server-owned: non-system commands cannot create or repoint a `canvasRef`, a live Portal cannot be deleted, and only a broken Portal may be removed. Portal geometry may move like ordinary World geometry, but its size is content-managed rather than manually resized.
@@ -65,24 +124,64 @@ Key points:
 
 `apps/server/src/modules/storage/` has three layers plus its composition root:
 
-| Path                                            | Responsibility                                                                                                                                                      |
-| ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `ports/blob.ts`                                 | Backend-neutral `BlobStore` connection/scope contract for opaque bytes and bounded materialization leases.                                                          |
-| `ports/structured.ts`                           | Backend-neutral `StructuredStore`, the `SpaceRepository` collection, and the `SpaceHandle` composite: record read/ordered write, nodes, changes, Tasks, and events. |
-| `ports/contracts/`                              | Reusable Space-collection, node, Space-write, log, blob, and store suites; guarantees are the minimum every adapter implements.                                     |
-| `backends/disk/`                                | Disk implementations plus before-image restoration for rejected in-process ordered batches; no journal or startup recovery.                                         |
-| `backends/disk/legacy/`                         | The legacy `CanvasStore` and its synchronous adapter primitives, bounded Workspace-qualified cache, and process-local node tombstones.                              |
-| `compatibility/canvas.ts`                       | Residual Disk reads plus direct-module create/delete test fixtures; lifecycle writers are not exported from the public storage barrel.                              |
-| `space-lifecycle-admission.ts`                  | Backend-neutral, writer-preferring single-process coordinator shared by structured mutations and blob puts during a delete session.                                 |
-| `profile.ts` and `storage.ts`                   | Two-axis backend selection, validation, adapter construction, process-wide lifecycle, blob scopes, and the blob-first deletion saga.                                |
-| `index.ts`                                      | Public exports only; application code imports here rather than reaching into an adapter.                                                                            |
-| `canvas-store.ts`, `paths.ts`, `canvas-dirs.ts` | Deprecated forwarding shims with no logic, retained only for high-fanout compatibility imports.                                                                     |
-
-The Disk structured adapter and compatibility facade resolve the same cached legacy object, so migration does not create two in-memory authorities. All portable repository methods are async. `SpaceRepository` owns membership reads, structured create/rename, and an exclusive `beginDelete()` session; composition holds that session across the existing blob-first delete saga and then calls `finish()` or `abort()`. Every Space-record write goes through `SpaceHandle.write`, which is the version-checked replacement with the node and delta batch attached; `SpaceHandle.read` reads only. `SpaceNodes` returns complete records plus revision tokens without exposing filenames. `write` preserves the old node mutations → Space record → optional delta order. When a normal in-process node → record → delta batch rejects, the adapter must restore that batch's prestate before returning the rejection. An explicit title rename remains the preceding ordered, best-effort boundary and is not rolled back with the batch. The port does not promise process-crash or power-loss recovery, a determinate result after an unknown remote outcome, multi-process serialization, idempotent retry, or publication. Disk meets the in-process restoration requirement with its existing before-image rollback; a SQL adapter may use a native transaction.
-
-Canvas persistence DTOs and the write coordinator live under `modules/canvas/`; physical Workspace paths, name indexes, directory-handle arbitration, and boot migrations live under `modules/workspace/`; generic filesystem and Markdown codecs live under `utils/`. `canvasRoot()` validates the identifier and then verifies that the resolved Space directory remains a strict descendant of the active Workspace before any downstream Disk operation receives it. `module-boundaries.test.ts` enforces the storage dependency direction and prevents new consumers of the forwarding shims.
-
-Space deletion is serialized against composed blob puts by a writer-preferring admission coordinator and holds an active-Workspace lease across blob cleanup and structured destruction. `beginDelete()` acquires the exclusive session before blob I/O; `finish()` removes structured state, while `abort()` releases the fence without doing so. Blobs are swept before structure so a failed sweep can be retried while the Space record still names them. Puts already admitted may finish; a put queued behind a successful deletion rechecks existence and fails without recreating blobs, while a failed blob sweep leaves the record available for retry. Mutations through existing Space handles and repositories reject while deletion is active or queued; reads remain available for cleanup. Residual direct-filesystem capabilities such as ZIP import, RFS upload/delete, and external-note claim are outside this repository fence and remain blockers for a non-Disk profile.
+| Path                                            | Responsibility                                                                                                                                                                                           |
+| ----------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `ports/blob.ts`                                 | Backend-neutral `BlobStore` connection/scope contract for opaque bytes and bounded materialization leases.                                                                                               |
+| `ports/structured.ts`                           | Backend-neutral `StructuredStore`, the `SpaceRepository` collection, and the `SpaceHandle` composite: record read/ordered write, nodes, changes, Tasks, and events.                                      |
+| `ports/contracts/`                              | Reusable Space-collection, node, Space-write, log, blob, and store suites; guarantees are the minimum every adapter implements.                                                                          |
+| `backends/disk/`                                | Disk implementations plus before-image restoration for rejected in-process ordered batches; no journal or startup recovery. `space-tree.ts` holds the Disk-only Space directory capability — not a port. |
+| `backends/disk/legacy/`                         | The legacy `CanvasStore` and its synchronous adapter primitives, bounded Workspace-qualified cache, and process-local node tombstones.                                                                   |
+| `compatibility/canvas.ts`                       | Residual Disk test/legacy facade over the same adapter primitive; production feature reads no longer enter here.                                                                                         |
+| `space-lifecycle-admission.ts`                  | Backend-neutral, writer-preferring single-process coordinator shared by structured mutations and blob puts during a delete session.                                                                      |
+| `profile.ts` and `storage.ts`                   | Backend selection, cross-axis validation, Workspace-scoped staged mount lifecycle, World bootstrap, blob scopes, the Disk-only Space-tree accessors, and the blob-first deletion saga.                   |
+| `testing.ts`                                    | Mounts a real profile onto a temporary Workspace through the production lifecycle, so product tests are written once and run against every profile.                                                      |
+| `index.ts`                                      | Public exports only; application code imports here rather than reaching into an adapter.                                                                                                                 |
+| `canvas-store.ts`, `paths.ts`, `canvas-dirs.ts` | Deprecated forwarding shims with no logic, retained only for high-fanout compatibility imports.                                                                                                          |
+
+The Disk structured adapter and compatibility facade resolve the same cached
+legacy object, so migration does not create two in-memory authorities. All
+portable repository methods are async. `SpaceRepository` owns membership
+reads, idempotent World bootstrap, structured create/rename, and an exclusive
+`beginDelete()` session; composition holds that session across the existing
+blob-first delete saga and then calls `finish()` or `abort()`. Every
+Space-record write goes through `SpaceHandle.write`, which is the
+version-checked replacement with the node and delta batch attached;
+`SpaceHandle.read` reads only. `SpaceNodes.read/readMany/list/stream` return
+complete records plus opaque revision tokens without exposing filenames.
+`readMany` is the shape most readers want — a selection, a neighbourhood, one
+View — and keeps their cost proportional to the request rather than to the
+Space; `list`/`stream` stay for work that genuinely spans it. `write`
+preserves the old node mutations → Space record → optional delta order. When a
+normal in-process node → record → delta batch rejects, the adapter must restore
+that batch's prestate before returning the rejection. An explicit title rename
+remains the preceding ordered, best-effort boundary and is not rolled back with
+the batch. The port does not promise process-crash or power-loss recovery, a
+determinate result after an unknown remote outcome, multi-process
+serialization, idempotent retry, or publication. Disk meets the in-process
+restoration requirement with its existing before-image rollback; a SQL adapter
+may use a native transaction.
+
+Canvas persistence DTOs and the write coordinator live under `modules/canvas/`;
+Disk record paths, name indexes, and directory-handle arbitration live inside
+the Disk adapter; boot migrations remain under `modules/workspace/migrations/`;
+generic filesystem and Markdown codecs live under `utils/`. `diskSpaceTree()`
+validates identifiers and fences retained scopes after a Workspace switch
+before any feature receives a path. `module-boundaries.test.ts` enforces the
+storage dependency direction, rejects production backend imports, and keeps
+the deprecated forwarding-shim importer lists shrinking.
+
+Space deletion is serialized against composed blob puts by a writer-preferring
+admission coordinator and holds an active-Workspace lease across blob cleanup
+and structured destruction. `beginDelete()` acquires the exclusive session
+before blob I/O; `finish()` removes structured state, while `abort()` releases
+the fence without doing so. Blobs are swept before structure so a failed sweep
+can be retried while the Space record still names them. Puts already admitted
+may finish; a put queued behind a successful deletion rechecks existence and
+fails without recreating blobs, while a failed blob sweep leaves the record
+available for retry. Mutations through existing Space handles and repositories
+reject while deletion is active or queued; reads remain available for cleanup.
+File-native operations remain separate physical actions, but they enter through
+`diskSpaceTree()` rather than binding application code to one backend layout.
 
 Retained Disk Space repository and handle instances, blob scopes, and legacy `CanvasStore` instances reject use after the active Workspace changes. Each `spaces()` call returns a fresh Workspace-bound handle and each read rescans current Disk state. The Workspace-qualified LRU is cleared and rebuilt on the next lookup after a switch. The delete-session contract covers overlapping operations through one configured backend instance. Disk realizes it with the shared process-local coordinator; it is not a multi-process transaction or distributed lock, and a SQL adapter must supply an equivalent backend-instance fence using its own mechanisms.
 
@@ -126,7 +225,7 @@ publication remain in the Canvas application layer. Conflict responses now
 report the existing logical title/label instead of a Disk filename or directory
 locator.
 
-Phase 4 changes no shared schema or web/client source. HTTP statuses and schemas
+Phase 4.6 changes no shared schema or web/client source. HTTP statuses and schemas
 and the SSE shape remain stable, subject to the logical conflict-value correction
 above. Publication remains an application action after persistence rather than
 a storage-port responsibility.
diff --git a/docs/proposals/multi-backend-storage.md b/docs/proposals/multi-backend-storage.md
index b787dd494..88654f967 100644
--- a/docs/proposals/multi-backend-storage.md
+++ b/docs/proposals/multi-backend-storage.md
@@ -1,15 +1,15 @@
 # Multi-Backend Storage
 
-Status: Phases 1–4 implemented
-Last updated: 2026-08-11
+Status: Phase 4.6 implemented; direction revised by §6.4
+Last updated: 2026-08-19
 
 > **Scope and decision confidence.** This proposal records the two-port
 > `StructuredStore` / `BlobStore` split and their target backend families as
 > the settled direction. The Blob contract, the structured module/repository
 > shape, the Space catalogue/lifecycle, async node repository, and minimal ordered
 > writer are accepted. Exact schemas, stronger transactional APIs, migration
-> mechanics, backend-selection scope, virtual filesystem behavior, agent
-> workspace materialization, and write-back are still design space. Remaining
+> mechanics, backend-selection scope, and virtual-filesystem and agent
+> write-back semantics are still design space. Remaining
 > candidate interfaces below are discussion aids, not implementation
 > instructions.
 >
@@ -47,11 +47,26 @@ Last updated: 2026-08-11
 > Corrections made during implementation and adversarial
 > review are recorded in place, including the CAS race ordering (§12.2.5),
 > log-family interface segregation (§12.2.6), and retained-handle Workspace
-> guards (§12.2.4). Remaining Disk-only read and physical capabilities still
-> keep non-Disk profiles unselectable. No SQLite, Postgres, or Azure adapter
-> exists. §12 is the
+> guards (§12.2.4). Phase 4.5 moved storage-owned Disk layout behind the
+> storage boundary in PR #93. Phase 4.6 is the application-neutrality bridge
+> specified in §12.6: production structured reads moved off `CanvasStore`,
+> filesystem consumers depend on one declared Space-file capability, and
+> storage connections gained an explicit Workspace mount lifecycle before a
+> second structured adapter is selectable. No SQLite, Postgres, or Azure
+> adapter exists on `main`. §12 is the
 > authoritative phase plan; the decision table in §2 marks what each phase
 > has actually settled.
+>
+> **Revision, 2026-08-19.** Phase 4.6 landed a single residual "Space-file"
+> capability covering every consumer that needs a real directory, and gave
+> them one route out: stop needing a tree and reach a Space over the HTTP API.
+> Review found that route correct for some of those consumers and wrong for
+> the rest — several of them want a _port_, not an API. §6.4 replaces the one
+> capability with four dispositions and states the composition-layer Space
+> handle that joins both ports; §12.5.4, §12.6.2, and §12.7 are revised to
+> match, and §12.7 gains Phase 4.7, which does that work. The revision
+> invalidates no implemented behavior; what changes is where the remaining
+> families are headed.
 
 ---
 
@@ -91,7 +106,10 @@ built above these ports, but its form is intentionally unresolved here.
 | Blob key, staging, deletion, and GC semantics          | Proposed / open           | Names are the existing `<artifactId><ext>` keys; `deleteAll()` covers Space destruction. Staging, reference counting, and GC remain undesigned. Per-key deletion stays out of the public port, but the absence of any cleanup path is what makes atomic replace mandatory (§6.2).                                                                                                          |
 | Space-handle identity and caching                      | **Corrected** (P1)        | `space(id)` returning a stable handle is bounded by the LRU behind it, not guaranteed. In-memory tombstones and the filename index are therefore adapter-local caches, never durable state (§12.1.1, §12.2.4).                                                                                                                                                                             |
 | Backend selection scope                                | Open                      | Process-global today because the profile is read from env. Per-Workspace or per-Space selection has not been fixed.                                                                                                                                                                                                                                                                        |
-| Logical filesystem view                                | Open                      | A possible `SpaceFileView` above both stores; name and contract are not accepted yet.                                                                                                                                                                                                                                                                                                      |
+| Unified per-Space handle                               | **Settled direction**     | One composition-layer `space(canvasId)` vends every storage capability for one Space: its structured parts, its blob scope, and any backend-specific extras. The two ports stay independent and are joined above them, never inside one (§6.4.1).                                                                                                                                          |
+| Storage for owners outside this port                   | **Settled direction**     | The Space handle vends an isolated _substrate_ per namespace — a directory, a table prefix, a schema — and the owner brings its own store implementation and SQL. Storage owns namespace isolation and lifecycle only, and never sees the data (§6.4.4).                                                                                                                                   |
+| Disposition of residual per-Space files                | **Settled direction**     | Four outcomes, not one: Disk-only and unimplemented elsewhere; portable capability with a per-backend implementation; a structured record; or a blob. Phase 4.6 applied the first of the four to all of them (§6.4.2, §6.4.3).                                                                                                                                                             |
+| Logical filesystem view                                | Open                      | A possible `SpaceFileView` above both stores; name and contract are not accepted yet. §6.4 narrows what such a view would have to synthesize — named files become blobs — without deciding to build it.                                                                                                                                                                                    |
 | Real agent workspace                                   | Open                      | Materialized directory, OS mount, protocol-only access, or a combination remain under evaluation.                                                                                                                                                                                                                                                                                          |
 | Agent-authored filesystem write-back                   | Open                      | Read-only projection, explicit checkout/commit, and live bidirectional sync are alternatives, not decisions.                                                                                                                                                                                                                                                                               |
 
@@ -204,6 +222,11 @@ remains the sole owner of its existing `ThreadStore`, `EventLogStore`, and
 backend family and inject matching adapters into both domains, but it must not
 move L2 persistence ownership back into `CanvasStore`.
 
+The one thing this port offers another domain is a _connection point_
+(§6.4.4): an isolated substrate per namespace — a directory, a table prefix, a
+schema — that the owner builds its own store on. Storage never sees the data,
+so no ownership moves and no schema is shared.
+
 Every current Canvas structured port is asynchronous so a synchronous Disk or
 SQLite implementation does not constrain Postgres or another remote adapter.
 The corresponding migration for Agenetes ports that are synchronous today
@@ -316,6 +339,273 @@ rejects kinds that are named but not implemented, so an unsupported profile
 fails at startup with an actionable message rather than nondeterministically
 while serving data.
 
+### 6.4 One Space handle, four dispositions — revised direction
+
+Phases 1–4.6 established the two ports and moved the application off Disk's
+record layout. What they did not settle is the residue: the per-Space state
+that is still a file because it always was one, and the fact that reaching a
+Space still means calling two unrelated functions. This section settles both
+and supersedes the single "Space materialization" framing of §12.5.4 and
+§12.6.2.
+
+Confidence: §6.4.1, the four-outcome test in §6.4.2, the assignments in
+§6.4.3, and the opaque-state member in §6.4.4 are a **settled direction**.
+What remains open is scheduling — which adapter pays for which move (§12.7) —
+and the concrete member names, which are still discussion aids.
+
+#### 6.4.1 One handle per Space
+
+A Space's durable state spans both ports — its record and nodes are
+structured, its files are bytes — so the application should reach all of it
+through one object, from one function, on the object that already holds both
+ports:
+
+```ts
+interface Storage {
+  readonly profile: StorageProfile;
+  readonly workspacePath: string;
+  readonly structured: StructuredStore;
+  readonly blobs: BlobStore;
+  space(canvasId: string): Space;
+}
+```
+
+`Storage` is the composition root's own type — it is what `getStorage()`
+already returns, and it is the only object in the process that holds both
+ports, so it is where the two are allowed to meet. The barrel exports a free
+`space(canvasId)` that is exactly `getStorage().space(canvasId)`, matching how
+`canvasBlobs()` is already called; that is an ergonomic shorthand for the same
+method, not a second design.
+
+`Space` is a **composition-layer facade, not a port type**.
+`StructuredStore.space()` keeps returning the structured-only `SpaceHandle`,
+`BlobStore.scope()` keeps returning a `BlobScope`, and neither port imports the
+other (§6.3). They are joined in the layer that already owns every cross-store
+rule: the blob-put precondition ("bytes only for a Space whose record exists")
+and the blob-first delete saga.
+
+The join cannot move down into a port, for three separate reasons:
+
+- the two axes are configured independently, so a `SpaceHandle` that vended
+  blobs would oblige the Disk structured adapter to construct an Azure blob
+  scope;
+- deletion ordering deliberately keeps remote blob I/O outside any database
+  transaction (§6.1); a handle owning both would move that ordering inside an
+  adapter;
+- `BlobScopeRef` is a union whose only member is `canvas` today. Workspace
+  assets and agent scratch have no Space, and a blob store reachable only
+  through a Space handle could not serve them.
+
+What is wrong today is therefore only the spelling.
+`getStructuredStore().space(id)` and `canvasBlobs(id)` are two entry points —
+37 and 21 production call sites — that never say they address one Space.
+
+**Backend-specific members hang off the same handle.** A capability only some
+backends implement is named for the backend that has it and typed by its
+absence (`null`), not hidden behind a parallel free function and not present as
+a stub that throws:
+
+```ts
+interface Space {
+  readonly canvasId: string;
+  read(): Promise<CanvasFile | null>;
+  write(input: SpaceWriteInput): Promise<SpaceWriteResult>;
+  readonly nodes: SpaceNodes;
+  readonly changes: SpaceChanges;
+  readonly tasks: SpaceTasks;
+  readonly events: SpaceEvents;
+  extension(namespace: string): SpaceSubstrate; // §6.4.4
+  readonly blobs: BlobScope;
+  /** Disk's directory for this Space. `null` on every other backend. */
+  readonly diskTree: DiskSpaceTree | null;
+}
+```
+
+A caller branching on `null` is told the truth once; a caller that must
+remember a second import is being asked to know the storage module's internal
+topology. This revises the Phase 4.6 decision to expose the Disk tree as a
+standalone `diskSpaceTree()`: the fence that matters is the name and the
+enumerated consumer list, and both survive the move onto the handle.
+
+#### 6.4.2 The disposition test
+
+§12.5.2 asked of a _symbol_: is it still useful, unchanged, when the structured
+backend becomes SQLite? That question sorted `paths.ts`. Asked of a _consumer_
+it sorts the residual filesystem population — and it returns four answers, not
+one:
+
+| Disposition                     | The question under SQLite                         | Consequence                                                             |
+| ------------------------------- | ------------------------------------------------- | ----------------------------------------------------------------------- |
+| **A. Disk-only**                | Meaningless — the feature is _about_ a filesystem | Not implemented off Disk. The feature is **unavailable**, not emulated. |
+| **B. Portable, re-implemented** | Survives; only the mechanism dies                 | A declared capability every backend answers in its own way.             |
+| **C. Structured record**        | It was a record wearing a file's clothes          | Moves to `StructuredStore`.                                             |
+| **D. Blob**                     | It is genuinely a named file                      | Moves to `BlobStore`.                                                   |
+
+Phase 4.6 assigned **A** to all of them and offered one route out: features
+stop needing a tree, and an agent reaches a Space over Huabu's HTTP API. That
+is right for A and wrong for the other three. B, C, and D do not need the HTTP
+API — they need a port, and routing them through an API instead would leave
+the same state unportable behind a network hop.
+
+An outcome of A is an acceptable, stated product limitation, not debt. It
+belongs in a capability matrix that `validateStorageProfile()` can consult,
+alongside the existing rule that an unimplemented kind fails at startup.
+
+**A is the default answer, and the cheap one.** B, C, and D each cost a port
+change, a contract suite, and a migration; A costs a row in the matrix. A
+family earns B, C, or D by a product need that survives being told plainly
+"this is not available on that backend" — not by being technically portable.
+Where the two are close, take A and say so. A workaround that makes a feature
+_nearly_ work on a backend is worse than its absence: it has to be built,
+tested, and explained, and it hides the limitation instead of stating it.
+
+**Nothing here is built before a backend needs it.** Assigning a disposition
+fixes the direction; it does not schedule the work. B and the open parts of C
+and D land with the adapter that first requires them, so the second backend
+pays for its own portability rather than Disk paying in advance for a
+requirement nobody has stated. The exception is a move that simplifies Disk on
+its own merits — deleting an ad-hoc file format in favour of a record the Space
+handle already writes — which is worth doing whenever it comes up.
+
+#### 6.4.3 Inventory
+
+Every consumer of the Disk Space-tree capability as implemented, with its
+disposition. Every assignment is settled; what is deferred is _when_ each is
+built, not _where_ it goes (§6.4.2, §12.7).
+
+| Consumer                                                   | What it does today                                             | Disposition                                                                                                                                                                                                                                 |
+| ---------------------------------------------------------- | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `GET /:id/export` — Space bundle                           | `archiver.glob('**/*', {cwd: spaceDir, dot: true})`            | **A**, accepted. A _portable_ export generated from records plus reachable blob references is a separate later design (§11); the current bundle is a Disk projection.                                                                       |
+| `POST /import` — Space bundle                              | Unzip into a staging dir, rename into place                    | **A**, accepted. Same pairing as export.                                                                                                                                                                                                    |
+| `POST /:id/reveal-nodes`                                   | `openInFileManager(nodesDir)`                                  | **A**, accepted. The feature _is_ "show me this in Finder".                                                                                                                                                                                 |
+| Built-in `read`/`write`/`glob`/`grep` tools (`fs-sandbox`) | Space directory as the sandbox root                            | **A**, accepted. Off Disk the first-party agent uses RFS/HTTP, which is what external agents already use (§9).                                                                                                                              |
+| `import-node-src` artifact-ref classification              | `path.relative(spaceDir, abs)`                                 | **A**, accepted — and it should ask `fs-sandbox` for its root, not storage. Not a storage consumer at all.                                                                                                                                  |
+| Windows directory-handle coordination                      | `registerHandleOwner` around `fs.watch` handles                | **A**, accepted. Exists so a directory rename can succeed; no directory, no problem.                                                                                                                                                        |
+| External-note observation and claim                        | `fs.watch` on `nodes/`, then read + unlink                     | **A** as a product feature; **B** for the notification underneath it. Nothing is built until a second backend exists — see below.                                                                                                           |
+| RFS path → node resolution                                 | `nodeIdForPath('nodes/Foo.md')` inverts Disk's filename        | **B**, deferred. Every backend can mint `nodes/<label>.md` names from records; Disk keeps inverting the real filename because the file is really there. Until a second backend exists, RFS's file plane is Disk's.                          |
+| Memory-worker state (`.memory/state.json`)                 | `atomicWriteJson` of `{counter, lastAnalyzedAt, cursor}`       | **C**, accepted. Per-Space bookkeeping with no reason to be a file; a small store on the §6.4.4 substrate.                                                                                                                                  |
+| Space-existence guard (`existsSync(spaceDir)`)             | Resurrection guard in the memory trigger                       | **C**, accepted — and it disappears rather than moving. The guard exists because an ad-hoc file write can recreate a deleted Space's directory; a structured record write cannot, because the port refuses a write to a Space that is gone. |
+| ACP session state (`.history/acp-sessions.json`)           | Handed to the ACP driver as `storage.root`                     | **C**, accepted. Storage supplies an isolated substrate under a namespace (§6.4.4); Agenetes keeps its own ports, its own store, and its own schema (§6.1).                                                                                 |
+| Chat prompt log (`.history/chat/<thread>.prompt.log`)      | Written under `HUABU_DEBUG_PROMPT`, never read by the app      | **C**, accepted. One namespace on the §6.4.4 substrate, one entry per thread.                                                                                                                                                               |
+| Memory body (`.memory/space.md`)                           | AI-private Markdown an agent reads and rewrites                | **D**, accepted. A document the agent edits as a file.                                                                                                                                                                                      |
+| `skill.md` (per-Space RFS access guide)                    | User-authored override read at the Space root                  | **D**, accepted. A future `AGENTS.md` is the same case.                                                                                                                                                                                     |
+| Upload scratch (`.upload/`)                                | RFS upload and interactive-view write here through the sandbox | **D**, accepted. Its own scope kind, so retention can differ from artifacts later without moving the bytes again.                                                                                                                           |
+
+Three consequences worth stating separately.
+
+**B is where "watch" belongs — later.** Change notification is not a
+filesystem primitive a database lacks; it is a database primitive a filesystem
+happens to also have (`fs.watch`, a SQLite update hook, Postgres
+`LISTEN`/`NOTIFY`). That is why the disposition is B rather than A.
+
+The product behaviour layered on it today does _not_ generalize: external-note
+discovery watches for documents that arrived **without going through the
+application**, and a database backend has no such arrival path unless someone
+writes to the store out of band. Rather than invent one, external-note
+discovery is simply unavailable off Disk, and the notification capability is
+declared only when a second backend has a consumer for it. Building a portable
+watch port now would buy nothing — the one caller is the Disk-only feature.
+
+**D changes what `BlobStore` is for, minimally.** §6.2 says blobs are "opaque
+bytes, not application records", with names that are the existing
+`<artifactId><ext>` keys. Named user-authored documents — `skill.md`, a future
+`AGENTS.md`, the memory body — are still opaque to storage, so the contract
+holds unchanged. One detail needs a decision and it has a cheap answer: the
+Disk adapter maps the single canvas scope onto `.artifacts/`, so a blob named
+`skill.md` would land in a hidden directory rather than at the Space root where
+a user authors it. Add one `BlobScopeRef` kind per user-visible area. That is a
+union member and a directory constant per adapter; it keeps the Disk layout a
+user sees unchanged, and it avoids hierarchical names, which §7.1 excluded for
+every backend and which would be the expensive answer to the same problem.
+
+Rename and per-key delete stay **unsupported**, as they are today. A human will
+eventually want to remove a `skill.md`, and the honest answer until some
+product operation actually requires it is that storage does not offer it —
+overwriting is the supported edit. Adding per-key deletion drags in the
+reference-counting and GC design §14 already parks, which is a large bill for a
+small convenience.
+
+#### 6.4.4 The extension point is a connection, not a data API
+
+Disposition C must not grow `StructuredStore` one member per feature —
+`memory`, `acpSessions`, `promptLogs` — obliging every future backend to model
+data it has no stake in. §12.5.7 rejected exactly that when it declined a
+`SpaceChats.list()` port.
+
+A namespaced opaque key/value member on the port is the obvious repair and is
+also wrong, for a reason worth recording: it fixes one access shape —
+whole-value rewrite, no queries, no indexes — for every owner, forever. An
+owner with real query needs then encodes its own index inside an opaque value,
+which is the two-authorities hazard reappearing one level down. The sibling
+`../octostaff` bubble runtime shows what the owners actually look like: each
+extension ships its own `repository-contract.ts` with `repository-memory.ts`
+and `repository-postgres.ts` beside it, and the Postgres one is constructed
+with an injected `PostgresConnection` carrying `sql` and a `schema` name.
+
+So the port exposes **the connection point and nothing else**. The owner brings
+its own store implementations and its own SQL:
+
+```ts
+/** What a namespace gets to build on. Discriminated by the live backend. */
+type SpaceSubstrate =
+  | { kind: 'disk'; directory: string }
+  | { kind: 'sqlite'; db: SqliteDatabase; tablePrefix: string }
+  | { kind: 'postgres'; sql: Sql; schema: string };
+
+interface Space {
+  /** Isolated substrate for one namespace's own store. */
+  extension(namespace: string): SpaceSubstrate;
+}
+```
+
+The namespace is the isolation token and the only thing storage validates: a
+reserved directory on Disk, a table prefix on SQLite, a schema on Postgres.
+Storage guarantees the namespace is unique and unshared. It guarantees nothing
+about what is inside, and cannot, because it never sees the data.
+
+**Storage keeps lifecycle, because only it can.** A namespace is created on
+demand and destroyed with the Space — `rm -rf` the directory, drop tables
+matching the prefix, drop the schema. That keeps `beginDelete`/`finish` whole
+without any owner registering a cleanup hook, and it is the one operation an
+owner cannot perform without knowing a layout that is not its own.
+
+**An extension supports the backends it chooses.** One that implements only
+`disk` does not load under Postgres, and that is a stated limitation rather
+than a defect — disposition A applied one level out (§6.4.2). Storage's
+contract suites cover none of this: there is no portable behaviour to assert
+about data the port cannot read.
+
+**Ownership does not move.** Agenetes keeps `ThreadStore`, `EventLogStore`, and
+`TurnStore` as its contracts (§6.1) and gains a substrate to implement them
+over, in place of a bare directory path. What §12.5.7 forbade — Huabu's ports
+learning the shape of agent-runtime data — is stronger here than under a
+key/value member: the port does not store the data, it hands over a place to
+put it.
+
+Three consequences to accept openly rather than design against:
+
+- **The backend kind is part of the extension API.** An owner written against
+  `sqlite` breaks if a deployment moves to Postgres. That is inherent in
+  letting owners write their own SQL, and the alternative is the lowest common
+  denominator this section exists to avoid.
+- **The substrate is unfenced.** A live `sql` handle can run arbitrary DDL
+  outside its schema, and a directory path is the very thing §12.5.4 pulled
+  back inside the boundary. The namespace bounds it by convention, not by
+  enforcement. Extensions are in-process code, trusted at the same level as the
+  Server; an untrusted or out-of-process extension model is not supported and is
+  not being designed here.
+- **First-party state pays the same price.** Memory-worker state is three
+  fields, and under a substrate it needs a small store per backend kind rather
+  than a `put()`. Phase 4.7 writes the Disk one directly. If a second owner
+  wants the same shape, extract a shared key/value helper **over** the
+  substrate, in `utils/` — never as a port member, because that is the design
+  this section rejected.
+
+`Namespace.storage.root` follows from this. Under bubble's pattern the driver
+is constructed with its substrate by the composition root, so the serializable
+`Namespace` carries only the scope name and never a path or a live handle —
+which is also what §14 asked for.
+
 ## 7. Contracts
 
 ### 7.1 BlobStore — normative
@@ -572,6 +862,13 @@ This would centralize path mapping and visibility rules without promising an
 OS mount. Its exact path vocabulary, search behavior, ACL model, generated
 `space.json` semantics, and write surface are open.
 
+§6.4 shrinks what such a view would have to invent without deciding to build
+it. Once named user files are blobs and node documents are structured records,
+the view synthesizes only a _path vocabulary_ over state the ports already
+hold, rather than deriving both the names and the bytes. That is also what RFS
+path resolution needs (§6.4.3, disposition B), so the two questions have
+converged even though neither is answered here.
+
 ### 10.2 Materialized agent workspace
 
 A materializer could create a real directory on the machine where Codex,
@@ -1805,6 +2102,14 @@ Consumers needing a Space's real directory ask `storage/`, so the current
 `storage → workspace/disk` edge inverts to `workspace ← storage` plus an
 explicit capability — instead of every domain reaching into a shared layout.
 
+**Superseded in part by §6.4.** The dependency direction this subsection
+settles — consumers ask `storage/` for a Space's real directory, rather than
+every domain reaching into a shared layout module — stands. What does not is
+the assumption that one declared capability serves all of them. Applying the
+disposition test to each consumer individually (§6.4.3) sends most of them to a
+port instead, and leaves the capability covering only the families that are
+genuinely about a filesystem.
+
 #### 12.5.5 Scope
 
 In:
@@ -1847,7 +2152,7 @@ Phase 5 rebases onto this and drops its `utils/naming.ts` extraction, its
 is flat and holds `paths.ts` plus `migrations/`; the Disk record layout, blob
 layout, directory index, name index, directory-handle coordination, and World
 bootstrap all sit under `storage/backends/disk/`. Consumers that need only a
-real Space directory call `spaceDirectory()`; directory-handle release and
+real Space directory call the Disk-only Space-tree accessor; directory-handle release and
 World bootstrap are re-exported from the facade rather than reached by path.
 This does not close every application-to-Disk read: `canvas.route.ts`,
 `external-watcher.ts`, and `world-target-access.ts` intentionally retain
@@ -1908,6 +2213,13 @@ not own — `legacy/canvas-store.ts` states plainly that threads and turns
 belong to the agent runtime — and would oblige every future structured backend
 to model Agenetes' turn log, which is the two-authorities hazard in §13.
 
+The extension substrate (§6.4.4) is not a reversal of this. What was rejected
+is a port that _knows the shape_ of agent-runtime data. What is offered is a
+place to put data — a directory, a table prefix, a schema — that the owner
+builds its own store on. A `list()` over chat turns is no more available
+through storage than it was before; it is Agenetes' own query against Agenetes'
+own tables.
+
 **Follow-up (open):** decide whether the memory agent should see conversation
 turns at all, and if so reinstate the digest against `agenetes.history()` —
 the call `canvas-search.ts` already uses for exactly this data. That is a
@@ -1916,17 +2228,177 @@ no working behavior moves. The `latestChatTs` field and its
 `lastSeenThreadCursor` plumbing survive the removal because they are the
 resume point such a digest would need.
 
-### 12.6 Later phases — provisional
+### 12.6 Phase 4.6 — backend-neutral application and Workspace mount
+
+Phase 4.6 closes the application-side gap between the portable storage contracts and the SQLite adapter proof. It contains no SQLite schema, driver, migration, or profile-selectability branch. Its exit criterion is: **adding another `StructuredStore` changes adapter, composition, and migration code, but does not require Canvas, agent, web, RFS, interactive-view, Task, or Workspace feature modules to learn that backend's record layout.**
+
+#### 12.6.1 Portable read completion
+
+Every production structured read uses `StructuredStore`: Space topology through `SpaceHandle.read()`, single node content through `SpaceNodes.read()`, a named subset through `SpaceNodes.readMany()`, and whole-Space or incremental scans through `SpaceNodes.list()` / `SpaceNodes.stream()`. All of them return the same complete node records and opaque storage revisions; the streaming callback is delivery order only and promises neither query ordering nor a backend cursor. Search keeps its progressive metadata delivery without naming a filesystem scan.
+
+`readMany` exists because most readers want a handful of named nodes rather than the Space — a selection to describe, a neighbourhood to render, one View to serve. Expressing those as `list()` makes an unrelated node somewhere else cost the request, and it is a shape every backend serves better than a scan. Whole-Space reads stay on `list()` where the work genuinely is whole-Space: executor prestate hydration, the Space GET, the canvas outline, cross-node inspection.
+
+`CanvasStore` remains inside the Disk adapter and compatibility tests only. It is not an application service, and production module-boundary tests reject new or remaining feature imports. Pure Canvas context builders accept already-read `CanvasFile` / node-record values instead of reaching into storage themselves; their async adapters own repository access once per request.
+
+#### 12.6.2 Declared Space-file capability — **revised by §6.4**
+
+RFS, built-in file tools, ACP working directories, external-note observation,
+bundle import/export, debug logs, and memory files all reach a Space as a
+filesystem tree. Phase 4.6 gave them one named Disk capability instead of
+`canvasRoot`, `nodesDir`, `SPACE_JSON_FILENAME`, a title-derived directory
+index, or another Disk-layout symbol. The capability owns a Workspace-bound
+Space directory, bundle publication, the sidecar-to-record mapping, and
+directory-handle coordination. Consumers may interpret their own public
+virtual paths and the public `.huabu.zip` format, but cannot infer the active
+backend's structured record layout.
+
+It is **not a port and not portable**, and it does not live in `ports/`.
+`StructuredStore` and `BlobStore` are the whole portable surface. A Space
+directory is Disk's, and a backend that keeps Spaces in tables does not have
+one — a capability missing from a backend is an acceptable outcome, and the
+honest one. Making every backend promise a directory would mean fabricating
+one, which moves the failure somewhere less obvious than the refusal.
+
+So it is reached as `diskSpaceTree(canvasId)` / `stageDiskSpaceImport()` from
+the barrel: names that say Disk at every call site, refusing rather than
+improvising on a non-Disk profile. `module-boundaries.test.ts` holds both the
+exported names and the exact consumer list, so the surface can only shrink,
+and asserts the barrel exposes nothing that reads as a portable path API.
+
+**What §6.4 revises.** Two claims above are narrower than this phase made them.
+
+First, the consumer list is not one population. Phase 4.6 read it as a single
+"needs a tree" group with a single route out — features stop needing a tree and
+reach a Space over the HTTP API. That holds for export, import, reveal,
+the built-in file tools, and Windows handle coordination. It does not hold for
+change notification, RFS path resolution, memory-worker state, the memory body,
+`skill.md`, or upload scratch: those want a port, and an HTTP hop in front of
+unportable state would not make it portable. §6.4.3 assigns each one.
+
+Second, the accessor's _shape_ was over-corrected. Keeping the Disk capability
+off the Space handle and behind a separate free function was meant to keep an
+unportable surface from looking portable, but the name and the enumerated
+consumer list already do that work. §6.4.1 moves it back onto the single
+`space(canvasId)` handle as a member typed by its absence, so one function
+answers every storage question about a Space.
+
+Neither revision invalidates what landed. The consumer list, its enforcement,
+and the refusal on a non-Disk profile all carry forward; Phase 4.7 shrinks the
+list to the families §6.4.3 assigns **A** and relocates the rest.
+
+This phase does not choose bidirectional projection or native write-back
+semantics: external-note claim and bundle import continue to enter the
+authoritative application commands/repositories they use today, while unowned
+scratch and agent-domain files stay ordinary materialized files.
+
+#### 12.6.3 Workspace-scoped storage lifecycle and World bootstrap
+
+Storage construction receives the resolved Workspace path. Startup may hold only a validated profile while free mode has no active Workspace; activating one stages and initializes both backend connections, asks the structured collection to ensure its one stable World, commits the Workspace path, atomically swaps the process-wide storage holder, and then closes the previous connections. A failed stage leaves the old Workspace and connections active. Graceful Server shutdown closes the mounted stores.
+
+`SpaceRepository.ensureWorld()` is the backend-neutral bootstrap hook. It returns the existing stable World or creates exactly one version-0 World when the namespace is new; an established malformed World remains an integrity error. Disk delegates to its existing `.world` bootstrap. The older on-disk preparation path may call the same idempotent Disk primitive before the mount while legacy migrations remain filesystem-based.
+
+#### 12.6.4 Proof and scope boundary
+
+The reusable node and Space-collection contracts cover `readMany`/list/stream equivalence and both branches of World bootstrap — the existing World, and the empty namespace a new backend meets first.
+
+The product-level harness is `storage/testing.ts`: it mounts a real profile onto a temporary Workspace through the production lifecycle — prepared Workspace, staged connections, `ensureWorld()`, atomic swap — rather than swapping in a stub. `product-boundary.test.ts` runs the exit criterion against every profile in `PRODUCT_STORAGE_PROFILES`, naming no directory, filename, or `space.json`; Phase 5 adds one entry to that list and the same behaviours are covered for SQLite. Elsewhere, product tests replace only storage connections or the declared Space-file capability; real Canvas services, serializers, repository behavior, and filesystem materialization inside the claimed boundary remain real.
+
+A module-boundary guard rejects production `CanvasStore` imports, and rejects Disk-layout imports from every production module outside `storage/` — not merely the workspace module. The check is import-level, so a local variable that happens to be called `artifactPath` is not a violation while importing `canvasRoot` is. Migrations are exempt (they rewrite frozen historical on-disk shapes); tests are exempt for the same reason they may name an adapter, and the shim-importer snapshots pin which ones do.
+
+One behavioural hardening rides along and is not implied by the criterion above: two Space directories carrying the same `canvasId` used to resolve last-wins, and now raise from the directory scan. That makes a Finder-side duplication a loud failure of every catalogue read rather than a Space that silently resolves to an arbitrary copy.
+
+In scope: Canvas/agent/web/interactive-view/Task structured reads, World target reads, RFS node metadata, built-in file-tool node enrichment, external-note membership checks, storage mount/remount/close, World bootstrap, naming and fencing the residual Disk directory capability, architecture documentation, and the shared product-level backend harness needed for Phase 5.
+
+Out of scope: a SQLite adapter or schema, Disk→SQLite data migration, SQLite profile registration, Postgres/Azure, Agenetes persistence migration, a writable general-purpose virtual filesystem, protocol or UI changes, and stronger crash/distributed transaction guarantees.
+
+### 12.7 Later phases — provisional
+
+#### Phase 4.7 — one Space handle and the four dispositions
+
+Phase 4.7 implements §6.4. It adds no adapter and changes no persisted format
+except where a family moves store, and each move is listed below. Its exit
+criterion is: **every storage capability for one Space is reached through one
+`space(canvasId)` handle, and every family that is still a bare file is one the
+capability matrix declares Disk-only.**
+
+In — the interface, and only the moves that pay for themselves on Disk alone:
+
+1. `Storage` gains `space(canvasId)`, joining the structured handle with the
+   Space's blob scope and any backend-specific members, plus a free
+   `space(canvasId)` shorthand on the barrel. `StructuredStore` and `BlobStore`
+   keep their current interfaces and their independence; the facade is the only
+   new type. `getStructuredStore().space(id)` and `canvasBlobs(id)` call sites
+   migrate to it.
+2. The Disk tree moves from the standalone `diskSpaceTree()` accessor onto that
+   handle as `diskTree`, typed by its absence, keeping the Disk name and the
+   enumerated consumer list.
+3. **The extension substrate (§6.4.4)** lands as one Space-handle member with a
+   Disk case, namespace validation, and destruction with the Space. Its
+   contract is isolation and lifecycle only — there is no data behaviour to
+   assert. Memory-worker state and the debug prompt log become the first two
+   namespaces, each with its own small Disk store, retiring two ad-hoc file
+   formats and the `existsSync` resurrection guard. ACP session state keeps the
+   same disposition but moves with phase 6: `Namespace.storage.root` is a
+   filesystem path in the shared `@agenetes/protocol` contract, and replacing it
+   with a composition-injected substrate is an Agenetes port change, not a
+   storage one.
+4. **D.** `skill.md`, the memory body, and upload scratch become blobs, each
+   user-visible area getting its own `BlobScopeRef` kind so the Disk paths a
+   user sees are unchanged and retention can diverge later without moving bytes
+   again. These qualify under the "simplifies Disk on its own merits"
+   exception: each is a bare `readFileSync`/`writeFile` against a path the
+   caller assembled, and the move retires those plus one resolver in the memory
+   sandbox. The new machinery is a union member and a directory constant per
+   area.
+5. **A is written down.** Export, import, reveal, the built-in file tools,
+   external-note discovery, and Windows handle coordination stay Disk-only and
+   become entries in a capability matrix `validateStorageProfile()` can consult,
+   so an operator selecting a profile learns up front which product features it
+   does not offer.
+6. The boundary test keeps its exact consumer list, now covering the A families
+   only; C and D consumers leave it by construction rather than by exemption.
+
+Out — deferred to the adapter or phase that first needs them, per §6.4.2:
+
+- the portable change-notification capability (its only consumer today is the
+  Disk-only external-note feature);
+- RFS's backend-neutral path vocabulary;
+- ACP session relocation, which is phase 6's `Namespace` change;
+- any SQLite/Postgres/Azure adapter, the portable export format, the rest of
+  the Agenetes persistence migration, an OS mount or writable general-purpose
+  virtual filesystem, and protocol or UI changes.
+
+#### Remaining phases
 
 5. Add one new adapter at a time — SQLite, then Postgres, then Azure Blob —
    running the same contract suites, migration fixtures, failure injection,
    and concurrency tests against each. An adapter may exist for isolated
    testing before its backend profile is selectable; profile validation keeps
    rejecting it until the required capability matrix is satisfied.
+
+   The SQLite preview branch predates Phase 4.6 and forks from the same
+   commit, so it does not yet satisfy the port it will be rebased onto. What
+   it owes, concretely: `SpaceRepository.ensureWorld()`; `SpaceNodes.readMany`
+   / `list` / `stream`; an entry in `PRODUCT_STORAGE_PROFILES`, which is what
+   runs the product-level boundary suite against it; and `IMPLEMENTED_STRUCTURED`
+   plus `StructuredBackendKind`. It owes **no** Space directory and no
+   portable materialization: Phase 4.6 removed the second placement policy and
+   the profile axis that selected one, because a policy nothing could observe
+   proved nothing. What it owes instead is whatever Phase 4.7 assigns
+   dispositions B, C, and D, and an entry in the capability matrix declaring
+   the A families unavailable.
+
 6. Migrate the currently synchronous Agenetes persistence ports without
-   changing their persist-before-notify, sequence, and fencing semantics.
+   changing their persist-before-notify, sequence, and fencing semantics. This
+   is also where ACP session state leaves `.history/`: `Namespace` stops carrying
+   a filesystem path and carries only its scope name, while the composition root
+   injects the substrate the session store builds on (§6.4.4). The same route is
+   available to the `chat_v2` turn and event logs, which keep their own
+   contracts either way.
 7. Refactor RFS and built-in file tools only after a logical file-view contract
-   is accepted, if that option is chosen.
+   is accepted, if that option is chosen. §6.4 removes part of the reason such
+   a view would need to synthesize anything: named files are blobs, node
+   documents are structured records, and only the path vocabulary is left.
 8. Prototype native CLI access separately and decide between protocol-only,
    materialization, and mounting from measured product requirements.
 9. Design and implement backend migration/export/import only after source and
@@ -1966,6 +2438,30 @@ resume point such a digest would need.
   export/import.
 - A local projection may expose private memory/history or host paths to an
   external agent unless visibility is capability-scoped.
+- A composition-layer Space facade that vends both ports is one import away
+  from becoming the place cross-store invariants accumulate silently. Every
+  rule it enforces has to be stated as a rule, or the facade becomes a third
+  authority with no contract suite of its own (§6.4.1).
+- Declaring a family Disk-only (§6.4.2, disposition A) is honest but is also
+  the cheapest answer available at any moment. Without a capability matrix an
+  operator can read before selecting a profile, "unavailable" degrades from a
+  stated product limitation into a surprise at first use.
+- Moving user-authored files into `BlobStore` (disposition D) puts documents a
+  human edits behind a port with no rename and no per-key delete — omissions
+  sized for artifacts nobody edits by hand (§6.2, §7.1). §6.4.3 keeps them
+  unsupported deliberately; the risk is that a product requirement for
+  "delete my skill.md" arrives and reopens the GC design §14 parks.
+- Declaring dispositions without building them (§6.4.2) leaves the direction on
+  paper, where it can quietly stop matching the code. The capability matrix is
+  the mitigation only if a profile is actually validated against it.
+- The extension substrate (§6.4.4) hands out a live SQL handle and a real
+  directory path. A namespace bounds an owner by convention; nothing stops DDL
+  outside its schema, a long-held transaction, or a write into a sibling
+  directory. This is the deliberate cost of letting owners write their own SQL,
+  and it makes every extension trusted Server code.
+- The substrate makes the backend kind part of the extension API, so a profile
+  change can break owners that a storage contract suite will never exercise —
+  by construction, since the port cannot read their data.
 
 ## 14. Open questions
 
@@ -2021,7 +2517,21 @@ resume point such a digest would need.
   changing their persist-before-notify, sequence, and fencing semantics?
 - Where do user memory, Space memory, memory-worker state, chat digest, and
   user-authored skills belong? The analyzer's Space record, action-event, and
-  intent inputs moved in P3; these physical files did not.
+  intent inputs moved in P3; these physical files did not. §6.4.3 answers the
+  per-Space half — worker state is a structured record, the memory body is a
+  blob — and leaves the Workspace-scoped ones (`setting/user.md`, user skills)
+  untouched, because a Workspace is not a Space and no port scopes to it yet.
+- Does an extension namespace need an owner registry, or is a string convention
+  (`huabu.memory`, `agenetes.acp`) enough? A registry buys collision detection
+  and a place to hang the supported-backend list; a convention buys nothing to
+  maintain.
+- Is the substrate per Space, per Workspace, or both? Every consumer today is
+  per Space, so that is what §6.4.4 defines. A Workspace-scoped extension —
+  bubble's schedules are deployment-scoped, not per-conversation — is the same
+  idea one level up and is not designed here.
+- Who runs an extension's schema migrations, and when? Storage creates and
+  destroys the namespace but knows nothing inside it, so an owner arriving at a
+  populated namespace it wrote a previous version of has no hook to migrate on.
 
 ### Blob storage
 
@@ -2031,14 +2541,23 @@ resume point such a digest would need.
   bypasses `sendBlob` entirely — which means `put()` grows an options
   parameter (§7.1).
 - Should any scope kind ever need hierarchical names? The contract currently
-  collapses names to a single segment for every backend (§7.1).
+  collapses names to a single segment for every backend (§7.1). §6.4.3 proposes
+  answering "no" and adding a `BlobScopeRef` kind per user-visible area
+  instead, so `skill.md`, the memory body, artifacts, and upload scratch stay
+  where a user sees them today without the port learning paths.
+- Do user-authored blobs need rename and per-key delete? Answered "not until a
+  product operation requires it" (§6.4.3): overwriting is the supported edit,
+  because per-key deletion reopens reference counting and GC. Revisit if a
+  product surface offers deleting one.
 - Does `health()` need a failure mode? It cannot currently report one, and the
   contract suite asserts success, so an unhealthy backend fails the suite
   rather than reporting itself unhealthy.
 - Where do staging state, orphan detection, reference counts, retention, and GC
   live?
 - Is an upload scratch area durable BlobStore state, leased temporary state, or
-  agent-workspace state?
+  agent-workspace state? Answered: durable blob state under its own scope kind
+  (§6.4.3), which leaves retention free to diverge from artifacts later without
+  relocating bytes.
 - How are encryption, credentials, tenancy prefixes, and Azure container
   lifecycle configured?
 
@@ -2072,9 +2591,25 @@ resume point such a digest would need.
 - How is a stable directory refreshed across a long-lived ACP session?
 - How do rename, delete, duplicate IDs, filename collisions, and conflict files
   map back to domain mutations?
-- Does external-note discovery remain a Disk-only optional capability?
 - Is an OS mount justified on every supported desktop platform?
 
+Settled by §6.4, recorded here because this section asked them:
+
+- **Does external-note discovery remain a Disk-only optional capability?** Yes.
+  It watches for documents that arrived without going through the application,
+  and no database backend has such an arrival path (§6.4.3).
+- **Are the built-in file tools, reveal, and bundle export/import portable?**
+  No. They are Disk-only and declared as such, rather than emulated over a
+  synthesized tree. Off Disk the first-party agent uses RFS/HTTP, which is
+  already how external agents reach a Space (§9).
+
+- **Where do the ACP sessions, memory-worker state, and the debug prompt log
+  live?** All three become structured state on an isolated substrate under
+  their own namespace (§6.4.4). Storage owns namespace isolation and lifecycle;
+  each owner brings its own store.
+- **Is upload scratch durable blob state?** Yes, under its own blob scope kind,
+  so retention can diverge from artifacts later without relocating bytes.
+
 ## 15. Validation criteria for a later implementation
 
 Before a new backend is production-ready: