What

_get_kg() and _call_kg() now key the per-path KnowledgeGraph cache through a
new _canonicalize_kg_path(path) helper that applies os.path.realpath
(resolves symlinks) followed by os.path.normcase (Windows drive-letter
casing + path-separator). On POSIX normcase is a no-op; the real change
is symlink resolution. On Windows both apply.

Why

#1372 (mcp: per-path KG cache should canonicalize via realpath, not abspath):

#1160 replaced the module-level KnowledgeGraph singleton with a lazy
per-path cache keyed by os.path.abspath(_resolve_kg_path()).
os.path.abspath() does not resolve symlinks or canonicalize Windows
drive-letter casing. Two tenants pointing at /srv/A and
/srv/link-to-A (or C:\palace\foo and c:\palace\foo) get separate
KnowledgeGraph instances over the same SQLite file.

The PR scope-note for #1160 explicitly accepted this trade-off as v3.4
follow-up territory.

How

def _canonicalize_kg_path(path: str) -> str:
    return os.path.normcase(os.path.realpath(path))

Applied at both _kg_by_path access sites:

• _get_kg(canonical_path=None) -- insert + lookup. The optional arg
  lets a caller that has already captured a canonical key (see
  _call_kg below) pass it through, so the dict insert here uses the
  same key the caller will later evict under. With canonical_path=None
  the function resolves and canonicalizes from module state -- the
  default for direct callers.
• _call_kg() -- captures the canonical key once at the top of the
  function, before the retry loop, and threads it through every
  _get_kg(path) call plus the eviction lookup. Capturing at the top
  surfaces an OSError from realpath cleanly via the dispatcher's
  exception envelope rather than letting it raise inside the
  except sqlite3.ProgrammingError branch and mask the original close
  signal. Threading the captured key through _get_kg locks the
  insert/evict keys together even if env (MEMPALACE_PALACE_PATH
  rotation) or FS state (symlink remap, mount remap) mutates between
  attempts.

Drain logic in tool_reconnect iterates _kg_by_path.values(), so it is not
path-sensitive and stays unchanged.

Tests

TestKGLazyCache gains:

• test_canonicalize_kg_path_collapses_symlink_alias -- creates a real
  symlinked tmp_path layout; asserts both real/kg.sqlite3 and
  link/kg.sqlite3 produce the same canonical key. Skipped on Windows
  because symlink creation requires admin.
• test_canonicalize_kg_path_routes_through_normcase -- patches both
  os.path.realpath and os.path.normcase with sentinel wrappers and
  asserts the helper composes them as normcase(realpath(p)). Swapping
  the order would leave Windows symlinks under the original case,
  defeating the dedup.
• test_get_kg_dedupes_symlink_alias_end_to_end -- two _get_kg() calls
  via different symlink layers; asserts identical instance + a single
  KnowledgeGraph construction.
• test_call_kg_passes_captured_path_through_resolve_drift -- patches
  _resolve_kg_path with a shifting iterator, pre-seeds the closed
  handle under the captured key, and asserts both _get_kg calls
  receive the captured path and the closed handle is evicted by retry.
  Without the pass-through, the second _get_kg would re-resolve to
  the drifted path and the closed handle would leak.
• test_call_kg_oserror_at_top_propagates_unmasked -- patches
  _canonicalize_kg_path to raise OSError; asserts it propagates
  unchanged. Pins the rationale that capturing-at-the-top means FS
  errors surface cleanly instead of masking a ProgrammingError
  mid-retry.

The existing _call_kg retry tests
(test_call_kg_retries_after_concurrent_close,
test_call_kg_does_not_retry_on_other_errors) now use
_canonicalize_kg_path(path) for cache setup so lookup keys match the
production code path on every platform -- under os.path.abspath they
would diverge from production keys on Windows.

Local: full suite pytest tests/ --ignore=tests/benchmarks -- 1556 pass +
1 skip + 3 pre-existing chromadb/httpx env failures on Python 3.14
linuxbrew (same on every branch, unrelated). ruff check . && ruff format --check . clean. Symlink smoke test confirms /tmp/symtest_link/...
collapses to /tmp/symtest_real/....

Out of scope

• Default-path resolution when --palace is not passed -- separate
  concern.
• Path normalization elsewhere in the codebase (palace_path, WAL dir,
  etc.) -- separate concerns.

Closes #1372.