- **The first memory write is now audited when the crews directory appears after startup (#4968).** A write made while the deferred watcher initialized could become its polling baseline and remain unrecorded until another modification. The watcher now sends its first snapshot through the existing audit path when the crews root was absent at boot. Normal startup with an existing root keeps its historical baseline behavior.