@obsunified/collector 2.0.1 → 2.2.0

package/src/lib/blob-store.ts

@@ -6,7 +6,7 @@
  *  - `R2BlobStore` — Cloudflare R2 binding (default on Workers).
  *  - `S3BlobStore` (sibling file) — AWS S3 / MinIO / any S3-compatible.
  *
- * Replay chunks live under `replays/<session_id>/<chunk_id>`; pprof
+ * Replay chunks live under `replays/<project_id>/<session_id>/<chunk_id>`; pprof
  * profiles live under `profiles/<service>/<trace_id>/<span_id>`. The
  * adapter never sees these paths — they're constructed by the callers
  * (`replay-receiver`, `profile-routes`).

package/src/lib/eval-cases-store.ts

@@ -76,6 +76,10 @@ export interface EvalRunCandidate {
 	modelProvider: string | null;
 	model: string | null;
 	modelVersion: string | null;
+	environment?: string | null;
+	serviceVersion?: string | null;
+	commitSha?: string | null;
+	configDigest?: string | null;
 }
 
 export interface EvalRunSourceCase {
@@ -99,6 +103,12 @@ export interface EvalRun {
 	evalCaseId: string | null;
 	status: EvalRunStatus;
 	candidate: EvalRunCandidate;
+	environment?: string;
+	serviceVersion?: string | null;
+	commitSha?: string | null;
+	configDigest?: string | null;
+	inputPayloadHash?: string | null;
+	failureFingerprint?: string | null;
 	startedAt: string | null;
 	endedAt: string | null;
 	totalCount: number;
@@ -117,6 +127,12 @@ export interface EvalRunInput {
 	evalCaseId?: string | null;
 	status?: EvalRunStatus;
 	candidate?: Partial<EvalRunCandidate>;
+	environment?: string | null;
+	serviceVersion?: string | null;
+	commitSha?: string | null;
+	configDigest?: string | null;
+	inputPayloadHash?: string | null;
+	failureFingerprint?: string | null;
 	startedAt?: string | null;
 	endedAt?: string | null;
 	totalCount?: number;
@@ -144,6 +160,12 @@ interface EvalRunRow {
 	candidate_model_provider: string | null;
 	candidate_model: string | null;
 	candidate_model_version: string | null;
+	environment?: string | null;
+	service_version?: string | null;
+	commit_sha?: string | null;
+	config_digest?: string | null;
+	input_payload_hash?: string | null;
+	failure_fingerprint?: string | null;
 	status: string;
 	started_at: string | null;
 	ended_at: string | null;
@@ -412,7 +434,17 @@ const rowToEvalRun = (row: EvalRunRow): EvalRun => {
 			modelProvider: row.candidate_model_provider ?? null,
 			model: row.candidate_model ?? null,
 			modelVersion: row.candidate_model_version ?? null,
+			environment: row.environment ?? "default",
+			serviceVersion: row.service_version ?? null,
+			commitSha: row.commit_sha ?? null,
+			configDigest: row.config_digest ?? null,
 		},
+		environment: row.environment ?? "default",
+		serviceVersion: row.service_version ?? null,
+		commitSha: row.commit_sha ?? null,
+		configDigest: row.config_digest ?? null,
+		inputPayloadHash: row.input_payload_hash ?? null,
+		failureFingerprint: row.failure_fingerprint ?? null,
 		startedAt: row.started_at ?? null,
 		endedAt: row.ended_at ?? null,
 		totalCount: row.total_count ?? 0,
@@ -560,6 +592,16 @@ export class EvalCasesStore {
 		}
 
 		const candidate = input.candidate ?? {};
+		const environment =
+			input.environment?.trim() || candidate.environment?.trim() || "default";
+		const serviceVersion =
+			input.serviceVersion?.trim() || candidate.serviceVersion?.trim() || null;
+		const commitSha =
+			input.commitSha?.trim() || candidate.commitSha?.trim() || null;
+		const configDigest =
+			input.configDigest?.trim() || candidate.configDigest?.trim() || null;
+		const inputPayloadHash = input.inputPayloadHash?.trim() || null;
+		const failureFingerprint = input.failureFingerprint?.trim() || null;
 		const totalCount = nonNegativeInteger(input.totalCount);
 		const passCount = nonNegativeInteger(input.passCount);
 		const failCount = nonNegativeInteger(input.failCount);
@@ -580,10 +622,12 @@ export class EvalCasesStore {
 					candidate_agent_id, candidate_agent_version,
 					candidate_prompt_id, candidate_prompt_version,
 					candidate_model_provider, candidate_model, candidate_model_version,
+					environment, service_version, commit_sha, config_digest,
+					input_payload_hash, failure_fingerprint,
 					status, started_at, ended_at,
 					total_count, pass_count, fail_count, average_score,
 					metadata_json, created_at
-				) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+				) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
 			)
 			.bind(
 				id,
@@ -596,6 +640,12 @@ export class EvalCasesStore {
 				candidate.modelProvider ?? null,
 				candidate.model ?? null,
 				candidate.modelVersion ?? null,
+				environment,
+				serviceVersion,
+				commitSha,
+				configDigest,
+				inputPayloadHash,
+				failureFingerprint,
 				status,
 				startedAt,
 				endedAt,
@@ -679,6 +729,14 @@ export class EvalCasesStore {
 					average_score = (
 						SELECT AVG(score) FROM eval_case_results
 						WHERE project_id = ? AND run_id = ? AND score IS NOT NULL
+					),
+					input_payload_hash = COALESCE(
+						input_payload_hash,
+						(SELECT input_payload_hash FROM eval_case_results WHERE project_id = ? AND run_id = ? AND input_payload_hash IS NOT NULL LIMIT 1)
+					),
+					failure_fingerprint = COALESCE(
+						failure_fingerprint,
+						(SELECT failure_fingerprint FROM eval_case_results WHERE project_id = ? AND run_id = ? AND failure_fingerprint IS NOT NULL LIMIT 1)
 					)
 				WHERE project_id = ? AND id = ?`,
 			)
@@ -693,6 +751,10 @@ export class EvalCasesStore {
 				id,
 				projectId,
 				id,
+				projectId,
+				id,
+				projectId,
+				id,
 			)
 			.run();
 	}

package/src/lib/evidence-references.ts

@@ -146,6 +146,12 @@ export const evidenceRouteFor = (
 			return traceRoute(entityId);
 		case "docs":
 			return entityId.startsWith("#/") ? entityId : `#/docs/${entityId}`;
+		case "change":
+			return `#/changes/${encodeURIComponent(entityId)}`;
+		case "finding":
+			return `#/findings/${encodeURIComponent(entityId)}`;
+		case "incident":
+			return `#/incidents/${encodeURIComponent(entityId)}`;
 	}
 	const exhaustive: never = entityKind;
 	return exhaustive;

package/src/lib/housekeeping.test.ts

@@ -0,0 +1,153 @@
+import { describe, expect, it } from "vitest";
+import { purgeSecondaryRows } from "./housekeeping";
+import { createMigratedSqliteDb } from "./test-utils/node-sqlite-db";
+
+const HOUR = 3_600_000;
+const NOW = Date.UTC(2026, 9, 13, 12, 0, 0);
+const iso = (hoursAgo: number) => new Date(NOW - hoursAgo * HOUR).toISOString();
+
+describe("purgeSecondaryRows", () => {
+	it("removes only rows no API window or ingest path can still reach", async () => {
+		const db = createMigratedSqliteDb();
+		const raw = db.raw;
+		raw.exec(`
+			INSERT INTO projects (id, name, slug, created_at) VALUES ('alpha', 'A', 'a', '${iso(1000)}');
+			INSERT INTO alert_rules (id, project_id, name, signal, query_json, threshold, window_mins, comparison, channels_json, enabled, created_at, updated_at)
+			VALUES ('r1', 'alpha', 'r', 'spans', '{}', 1, 5, '>', '[]', 1, '${iso(1000)}', '${iso(1000)}');
+		`);
+		const ev = raw.prepare(
+			`INSERT INTO alert_evaluations (id, rule_id, project_id, evaluated_at, value, state, notified) VALUES (?, 'r1', 'alpha', ?, 1, 'ok', 0)`,
+		);
+		ev.run("old", iso(721));
+		ev.run("edge", iso(719));
+		const ask = raw.prepare(
+			`INSERT INTO ask_evidence_events (project_id, analysis_id, asked_at) VALUES ('alpha', 'x', ?)`,
+		);
+		ask.run(NOW - 31 * 24 * HOUR);
+		ask.run(NOW - 29 * 24 * HOUR);
+		const series = raw.prepare(
+			`INSERT INTO metric_series (id, project_id, name, type, identity, created_at) VALUES (?, 'alpha', 'm', 'gauge', ?, ?)`,
+		);
+		series.run("orphan-old", "i1", iso(100)); // no points, older than window
+		series.run("orphan-new", "i2", iso(1)); // no points but just created
+		series.run("live", "i3", iso(100)); // old but still has a point
+		raw
+			.prepare(
+				`INSERT INTO metric_point (id, series_id, project_id, ts_ns, received_at, expires_at) VALUES ('p1', 'live', 'alpha', '1', ?, ?)`,
+			)
+			.run(iso(1), iso(-1));
+		const ref = raw.prepare(
+			`INSERT INTO evidence_retrieval_refs (ref_id, project_id, kind, anchor_kind, anchor_id, source, expires_at) VALUES (?, 'alpha', 'logs', 'trace', 't', 'test', ?)`,
+		);
+		ref.run("expired", iso(1));
+		ref.run("fresh", iso(-1));
+		ref.run("no-expiry", null);
+		const exp = raw.prepare(
+			`INSERT INTO evidence_ref_expansions (id, ref_id, project_id, kind, operation, result_status) VALUES (?, ?, 'alpha', 'logs', 'expand', 'ok')`,
+		);
+		exp.run("e1", "expired");
+		exp.run("e2", "fresh");
+
+		const summary = await purgeSecondaryRows(db, {
+			retentionHours: 72,
+			now: () => NOW,
+		});
+		expect(summary).toEqual({
+			alert_evaluations: 1,
+			ask_evidence_events: 1,
+			metric_series: 1,
+			evidence_refs: 1,
+			evidence_ref_expansions: 1,
+			ontology_edges: 0,
+			ontology_nodes: 0,
+			change_events: 0,
+			incident_investigations: 0,
+			remediation_proposals: 0,
+			investigation_findings: 0,
+		});
+		const ids = (sql: string) =>
+			(raw.prepare(sql).all() as Array<{ id: string }>).map((r) => r.id).sort();
+		expect(ids("SELECT id FROM alert_evaluations")).toEqual(["edge"]);
+		expect(ids("SELECT id FROM metric_series")).toEqual(["live", "orphan-new"]);
+		expect(ids("SELECT ref_id AS id FROM evidence_retrieval_refs")).toEqual([
+			"fresh",
+			"no-expiry",
+		]);
+		expect(ids("SELECT id FROM evidence_ref_expansions")).toEqual(["e2"]);
+		db.close();
+	});
+
+	it("enforces RFC 0013 AutoSRE retention windows while preserving counterfactual_verified and operationally_corroborated findings", async () => {
+		const db = createMigratedSqliteDb();
+		const raw = db.raw;
+		raw.exec(`
+			INSERT INTO projects (id, name, slug, created_at) VALUES ('alpha', 'A', 'a', '${iso(3000)}');
+		`);
+		// Ontology edges/nodes (30d = 720h)
+		raw
+			.prepare(
+				`INSERT INTO ontology_nodes (id, project_id, environment, kind, name, first_seen_at, last_seen_at) VALUES (?, 'alpha', 'prod', 'service', ?, ?, ?)`,
+			)
+			.run("n-old", "old-svc", iso(800), iso(750));
+		raw
+			.prepare(
+				`INSERT INTO ontology_nodes (id, project_id, environment, kind, name, first_seen_at, last_seen_at) VALUES (?, 'alpha', 'prod', 'service', ?, ?, ?)`,
+			)
+			.run("n-fresh", "fresh-svc", iso(100), iso(10));
+		raw
+			.prepare(
+				`INSERT INTO ontology_edges (id, project_id, environment, source_node_id, predicate, target_node_id, relationship_certainty, first_seen_at, last_seen_at) VALUES (?, 'alpha', 'prod', 'n-old', 'calls', 'n-fresh', 'exact', ?, ?)`,
+			)
+			.run("edge-old", iso(800), iso(750));
+
+		// Change events (90d = 2160h)
+		raw
+			.prepare(
+				`INSERT INTO change_events (id, project_id, environment, kind, source, target_node_id, summary, occurred_at, received_at) VALUES (?, 'alpha', 'prod', 'deploy', 'ci_webhook', 'n-fresh', 'old deploy', ?, ?)`,
+			)
+			.run("chg-old", iso(2200), iso(2200));
+		raw
+			.prepare(
+				`INSERT INTO change_events (id, project_id, environment, kind, source, target_node_id, summary, occurred_at, received_at) VALUES (?, 'alpha', 'prod', 'deploy', 'ci_webhook', 'n-fresh', 'recent deploy', ?, ?)`,
+			)
+			.run("chg-recent", iso(100), iso(100));
+
+		// Findings (90d = 2160h, unless counterfactual_verified or operationally_corroborated)
+		const insFinding = raw.prepare(
+			`INSERT INTO investigation_findings (id, project_id, environment, fingerprint, fingerprint_input_json, title, summary, causal_proof_tier, causal_verification_status, confidence, confidence_breakdown_json, symptom_entity_kind, symptom_entity_id, fault_locus_entity_kind, fault_locus_entity_id, causal_chain_json, cited_evidence_ids_json, actor_type, actor_id, created_at, updated_at) VALUES (?, 'alpha', 'prod', 'fp_1', '{}', 't', 's', 'corroborated_candidate', ?, 0.8, '{}', 'trace', 't1', 'span', 's1', '[]', '["t1"]', 'agent', 'autosre', ?, ?)`,
+		);
+		insFinding.run("fnd-old-unverified", "unverified", iso(2200), iso(2200));
+		insFinding.run(
+			"fnd-old-verified",
+			"counterfactual_verified",
+			iso(2200),
+			iso(2200),
+		);
+		insFinding.run(
+			"fnd-old-corroborated",
+			"operationally_corroborated",
+			iso(2200),
+			iso(2200),
+		);
+
+		const summary = await purgeSecondaryRows(db, {
+			retentionHours: 72,
+			now: () => NOW,
+		});
+		expect(summary.ontology_edges).toBe(1);
+		expect(summary.ontology_nodes).toBe(1);
+		expect(summary.change_events).toBe(1);
+		expect(summary.investigation_findings).toBe(1);
+
+		const remainingFindings = (
+			raw
+				.prepare(`SELECT id FROM investigation_findings ORDER BY id ASC`)
+				.all() as Array<{ id: string }>
+		).map((r) => r.id);
+		expect(remainingFindings).toEqual([
+			"fnd-old-corroborated",
+			"fnd-old-verified",
+		]);
+		db.close();
+	});
+});

package/src/lib/housekeeping.ts

@@ -0,0 +1,193 @@
+/**
+ * Retention for the secondary tables the hourly sweep did not cover. Each
+ * rule is tied to an existing contract rather than a new policy:
+ *
+ *  - `alert_evaluations`: `/internal/alerts/evaluations` accepts at most a
+ *    720-hour window, so rows older than that are unreachable through the API.
+ *  - `ask_evidence_events`: feeds `getTopAskedAnalyses`, whose trailing window
+ *    is 7 days; rows older than 30 days cannot influence it.
+ *  - `metric_series`: identity rows whose points have all expired and that
+ *    were created before the retention window. They hold no data; the next
+ *    ingest of that identity recreates the row.
+ *  - `evidence_retrieval_refs`: rows carry their own `expires_at` (copied from
+ *    the signal they reference); expansions follow their ref.
+ */
+
+import { evaluateRemediationWatchdogs } from "./autosre-remediation-gate";
+import type { SqlDb } from "./sql-db";
+
+export const ALERT_EVALUATIONS_MAX_AGE_HOURS = 720;
+export const ASK_EVIDENCE_EVENTS_MAX_AGE_HOURS = 30 * 24;
+
+export interface HousekeepingSummary {
+	alert_evaluations: number;
+	ask_evidence_events: number;
+	metric_series: number;
+	evidence_refs: number;
+	evidence_ref_expansions: number;
+	ontology_edges?: number;
+	ontology_nodes?: number;
+	change_events?: number;
+	incident_investigations?: number;
+	investigation_findings?: number;
+	remediation_proposals?: number;
+}
+
+export interface HousekeepingOptions {
+	/** Window that bounds orphaned metric series; same value the main sweep uses. */
+	retentionHours: number;
+	/** Clock override for tests. */
+	now?: () => number;
+}
+
+const changes = (r: { meta?: { changes?: number } }) => r.meta?.changes ?? 0;
+
+export async function purgeSecondaryRows(
+	db: SqlDb,
+	options: HousekeepingOptions,
+): Promise<HousekeepingSummary> {
+	const nowMs = options.now?.() ?? Date.now();
+	const isoBefore = (hours: number) =>
+		new Date(nowMs - hours * 3_600_000).toISOString();
+	const nowIso = isoBefore(0);
+
+	const alertEvaluations = await db
+		.prepare(`DELETE FROM alert_evaluations WHERE evaluated_at < ?`)
+		.bind(isoBefore(ALERT_EVALUATIONS_MAX_AGE_HOURS))
+		.run();
+
+	const askEvents = await db
+		.prepare(`DELETE FROM ask_evidence_events WHERE asked_at < ?`)
+		.bind(nowMs - ASK_EVIDENCE_EVENTS_MAX_AGE_HOURS * 3_600_000)
+		.run();
+
+	// Points and exemplars for the window are purged by MetricsStore first;
+	// a series created before the window with no remaining points is inert.
+	const series = await db
+		.prepare(
+			`DELETE FROM metric_series
+			 WHERE created_at < ?
+			   AND NOT EXISTS (
+			     SELECT 1 FROM metric_point p WHERE p.series_id = metric_series.id
+			   )`,
+		)
+		.bind(isoBefore(options.retentionHours))
+		.run();
+
+	const refs = await db
+		.prepare(
+			`DELETE FROM evidence_retrieval_refs
+			 WHERE expires_at IS NOT NULL AND expires_at < ?`,
+		)
+		.bind(nowIso)
+		.run();
+	const expansions = await db
+		.prepare(
+			`DELETE FROM evidence_ref_expansions
+			 WHERE NOT EXISTS (
+			   SELECT 1 FROM evidence_retrieval_refs r
+			   WHERE r.ref_id = evidence_ref_expansions.ref_id
+			 )`,
+		)
+		.run();
+
+	// RFC 0013 — AutoSRE ontology, change events, incident investigations,
+	// investigation findings, and remediation proposals retention + watchdog.
+	const thirtyDaysAgoIso = isoBefore(30 * 24);
+	const ninetyDaysAgoIso = isoBefore(90 * 24);
+	let ontologyEdgesPurged = 0;
+	let ontologyNodesPurged = 0;
+	let changeEventsPurged = 0;
+	let incidentInvestigationsPurged = 0;
+	let investigationFindingsPurged = 0;
+	let remediationProposalsPurged = 0;
+	try {
+		const edgesRes = await db
+			.prepare(`DELETE FROM ontology_edges WHERE last_seen_at < ?`)
+			.bind(thirtyDaysAgoIso)
+			.run();
+		ontologyEdgesPurged = changes(edgesRes);
+
+		const nodesRes = await db
+			.prepare(
+				`DELETE FROM ontology_nodes
+				 WHERE last_seen_at < ?
+				   AND NOT EXISTS (
+				     SELECT 1 FROM ontology_edges e
+				     WHERE e.project_id = ontology_nodes.project_id
+				       AND e.environment = ontology_nodes.environment
+				       AND (e.source_node_id = ontology_nodes.id OR e.target_node_id = ontology_nodes.id)
+				   )`,
+			)
+			.bind(thirtyDaysAgoIso)
+			.run();
+		ontologyNodesPurged = changes(nodesRes);
+
+		const proposalsRes = await db
+			.prepare(
+				`DELETE FROM remediation_proposals
+				 WHERE (expires_at IS NOT NULL AND expires_at < ?)
+				    OR (expires_at IS NULL AND created_at < ?)`,
+			)
+			.bind(nowIso, ninetyDaysAgoIso)
+			.run();
+		remediationProposalsPurged = changes(proposalsRes);
+
+		const findingsRes = await db
+			.prepare(
+				`DELETE FROM investigation_findings
+				 WHERE causal_verification_status NOT IN ('counterfactual_verified', 'operationally_corroborated')
+				   AND ((expires_at IS NOT NULL AND expires_at < ?)
+				     OR (expires_at IS NULL AND created_at < ?))`,
+			)
+			.bind(nowIso, ninetyDaysAgoIso)
+			.run();
+		investigationFindingsPurged = changes(findingsRes);
+
+		// Preserve change_events referenced by active investigation_findings
+		const changesRes = await db
+			.prepare(
+				`DELETE FROM change_events
+				 WHERE ((expires_at IS NOT NULL AND expires_at < ?)
+				     OR (expires_at IS NULL AND occurred_at < ?))
+				   AND NOT EXISTS (
+				     SELECT 1 FROM investigation_findings f
+				     WHERE f.project_id = change_events.project_id
+				       AND f.environment = change_events.environment
+				       AND f.contributing_change_id = change_events.id
+				   )`,
+			)
+			.bind(nowIso, ninetyDaysAgoIso)
+			.run();
+		changeEventsPurged = changes(changesRes);
+
+		const incidentsRes = await db
+			.prepare(
+				`DELETE FROM incident_investigations
+				 WHERE status IN ('resolved', 'escalated')
+				   AND ((expires_at IS NOT NULL AND expires_at < ?)
+				     OR (expires_at IS NULL AND updated_at < ?))`,
+			)
+			.bind(nowIso, ninetyDaysAgoIso)
+			.run();
+		incidentInvestigationsPurged = changes(incidentsRes);
+
+		await evaluateRemediationWatchdogs(db, { nowIso });
+	} catch {
+		// Gracefully ignore when running against partial test schemas without 050
+	}
+
+	return {
+		alert_evaluations: changes(alertEvaluations),
+		ask_evidence_events: changes(askEvents),
+		metric_series: changes(series),
+		evidence_refs: changes(refs),
+		evidence_ref_expansions: changes(expansions),
+		ontology_edges: ontologyEdgesPurged,
+		ontology_nodes: ontologyNodesPurged,
+		change_events: changeEventsPurged,
+		incident_investigations: incidentInvestigationsPurged,
+		investigation_findings: investigationFindingsPurged,
+		remediation_proposals: remediationProposalsPurged,
+	};
+}

package/src/lib/identity-index/action-lookups.ts

@@ -313,10 +313,10 @@ export async function manifestByAction(
 			.prepare(
 				`SELECT session_id, first_chunk_at, last_chunk_at, chunk_count, events_count
 					FROM session_replay_metadata
-					WHERE session_id IN (${sessionPlaceholders})
+					WHERE project_id = ? AND session_id IN (${sessionPlaceholders})
 					ORDER BY last_chunk_at DESC LIMIT 1`,
 			)
-			.bind(...sessionIds)
+			.bind(projectId, ...sessionIds)
 			.first<{
 				session_id: string;
 				first_chunk_at: string;
@@ -546,10 +546,10 @@ export async function manifestByAgentRun(
 			.prepare(
 				`SELECT session_id, first_chunk_at, last_chunk_at, chunk_count, events_count
 					FROM session_replay_metadata
-					WHERE session_id IN (${sessionPlaceholders})
+					WHERE project_id = ? AND session_id IN (${sessionPlaceholders})
 					ORDER BY last_chunk_at DESC LIMIT 1`,
 			)
-			.bind(...sessionIds)
+			.bind(projectId, ...sessionIds)
 			.first<{
 				session_id: string;
 				first_chunk_at: string;
@@ -767,10 +767,10 @@ export async function manifestByActor(
 			.prepare(
 				`SELECT session_id, first_chunk_at, last_chunk_at, chunk_count, events_count
 					FROM session_replay_metadata
-					WHERE session_id IN (${sessionPlaceholders})
+					WHERE project_id = ? AND session_id IN (${sessionPlaceholders})
 					ORDER BY last_chunk_at DESC LIMIT 1`,
 			)
-			.bind(...sessionIds)
+			.bind(projectId, ...sessionIds)
 			.first<{
 				session_id: string;
 				first_chunk_at: string;

package/src/lib/identity-index/key-lookups.ts

@@ -53,9 +53,9 @@ export async function manifestBySession(
 			.prepare(
 				`SELECT first_chunk_at, last_chunk_at, chunk_count, events_count
 					FROM session_replay_metadata
-					WHERE session_id = ?`,
+					WHERE project_id = ? AND session_id = ?`,
 			)
-			.bind(sessionId)
+			.bind(projectId, sessionId)
 			.first<{
 				first_chunk_at: string;
 				last_chunk_at: string;

package/src/lib/identity-index/user-lookup.ts

@@ -13,10 +13,13 @@ export async function manifestByUser(
 	const sessionLimit = Math.max(1, Math.min(opts.sessions ?? 5, 20));
 
 	// Step 1 — resolve user_id → visitor_id. user_profiles is the only
-	// table that owns the user_id ↔ visitor_id binding.
+	// table that owns the user_id ↔ visitor_id binding, keyed per project
+	// (the same user_id can exist in several projects — migration 045).
 	const profile = await db
-		.prepare(`SELECT visitor_id FROM user_profiles WHERE user_id = ? LIMIT 1`)
-		.bind(userId)
+		.prepare(
+			`SELECT visitor_id FROM user_profiles WHERE project_id = ? AND user_id = ? LIMIT 1`,
+		)
+		.bind(projectId, userId)
 		.first<{ visitor_id: string }>();
 	if (!profile) {
 		return {
@@ -105,10 +108,10 @@ export async function manifestByUser(
 			.prepare(
 				`SELECT session_id, first_chunk_at, last_chunk_at, chunk_count, events_count
 					FROM session_replay_metadata
-					WHERE session_id IN (${placeholders})
+					WHERE project_id = ? AND session_id IN (${placeholders})
 					ORDER BY last_chunk_at DESC LIMIT 1`,
 			)
-			.bind(...sessionIds)
+			.bind(projectId, ...sessionIds)
 			.first<{
 				session_id: string;
 				first_chunk_at: string;

package/src/lib/identity-index.test.ts

@@ -81,13 +81,12 @@ describe("IdentityIndex.bySession", () => {
 			eventsCount: 42,
 		});
 
-		// All five queries pin (project_id, session_id) — replay lookup uses
-		// just session_id since replay is global.
+		// All five queries pin (project_id, session_id).
 		const allCalls = db.calls.filter((c) => c.op !== "first" || c.binds.length);
 		const sessionQueries = allCalls.filter(
 			(c) => c.sql.includes("session_id") && c.binds.includes("proj-1"),
 		);
-		expect(sessionQueries.length).toBeGreaterThanOrEqual(4);
+		expect(sessionQueries.length).toBe(5);
 	});
 
 	it("returns null replay when session_replay_metadata is empty", async () => {