hippo-memory 1.60.0 → 1.62.0

package/dist/project-briefs.d.ts

@@ -21,6 +21,7 @@
  * Lifecycle: active -> superseded (a newer version replaces it) or active ->
  * closed (retired).
  */
+import { type KeysetPosition } from './keyset.js';
 export type BriefStatus = 'active' | 'superseded' | 'closed';
 export declare const VALID_BRIEF_STATES: ReadonlySet<BriefStatus>;
 /** Field caps (untrusted at the HTTP/SDK boundary). summary is a body, so a larger
@@ -72,6 +73,8 @@ export interface ListProjectBriefsOpts {
     /** Filter to a single repo. */
     repo?: string;
     limit?: number;
+    /** Resume after this row: the position the previous page ended on. */
+    after?: KeysetPosition;
 }
 /**
  * Create a project_brief (or a new version that supersedes an existing one). Writes

package/dist/project-briefs.js

@@ -23,13 +23,14 @@
  */
 import { BadRequestError, ConflictError, NotFoundError } from './api-errors.js';
 import { openHippoDb, closeHippoDb } from './db.js';
-import { writeEntry } from './store.js';
+import { writeEntry } from './store/entry-writes.js';
 import { assertTenantId } from './tenant.js';
 import { RECALL_DEFAULT_DENY_SCOPES } from './recall-scope.js';
-import { markGraphDirty, removeGraphEntitiesForObject } from './graph.js';
+import { markGraphDirty, removeGraphEntitiesForObject } from './graph/write.js';
 import { createMemory, Layer } from './memory.js';
 import { appendAuditEvent } from './audit.js';
 import { objectHalfLifeDays } from './half-life-migration.js';
+import { keysetAfter } from './keyset.js';
 export const VALID_BRIEF_STATES = new Set([
     'active',
     'superseded',
@@ -102,9 +103,83 @@ const BRIEF_COLS = `
 function buildBriefContent(repo, summary) {
     return `${repo}\n\n${summary}`;
 }
-// ---------------------------------------------------------------------------
-// Public API
-// ---------------------------------------------------------------------------
+// Preflight the supersede target BEFORE inserting the new row (so the new
+// autoincrement id can never be its own supersede target); read the
+// predecessor version in the same SELECT for server-derived versioning.
+// Mirrors saveSkill / saveProcess (codex P1 2026-05-28).
+function preflightBriefSupersede(db, tenantId, supersedesId) {
+    // SAFETY: SELECT projects exactly status, version; .get() returns that
+    // shape for the matching row, or undefined when no brief/tenant pair matches.
+    const pred = db.prepare(`SELECT status, version FROM project_briefs WHERE id = ? AND tenant_id = ?`).get(supersedesId, tenantId);
+    if (!pred) {
+        throw new NotFoundError(`saveProjectBrief: brief ${supersedesId} to supersede not found for tenant ${tenantId}`);
+    }
+    if (pred.status !== 'active') {
+        throw new ConflictError(`saveProjectBrief: brief ${supersedesId} is not active (status='${pred.status}'); only active briefs can be superseded.`);
+    }
+    return pred.version + 1;
+}
+function insertBriefRow(db, memoryId, w, version) {
+    const result = db.prepare(`
+    INSERT INTO project_briefs(
+      memory_id, tenant_id, repo, summary, version,
+      status, superseded_by, superseded_at, change_summary, closed_at, created_at
+    ) VALUES (?, ?, ?, ?, ?, 'active', NULL, NULL, ?, NULL, ?)
+  `).run(memoryId, w.tenantId, w.repo, w.summary, version, w.changeSummary, w.now);
+    return Number(result.lastInsertRowid ?? 0);
+}
+function supersedeBriefRow(db, w, supersedesId, briefId, version) {
+    const sup = db.prepare(`
+    UPDATE project_briefs
+    SET status = 'superseded', superseded_by = ?, superseded_at = ?
+    WHERE id = ? AND tenant_id = ? AND status = 'active' AND id != ?
+  `).run(briefId, w.now, supersedesId, w.tenantId, briefId);
+    if (sup.changes === 0) {
+        throw new ConflictError(`saveProjectBrief: brief ${supersedesId} could not be superseded (no longer active or self-reference).`);
+    }
+    appendAuditEvent(db, {
+        tenantId: w.tenantId,
+        actor: w.actor,
+        op: 'project_brief_supersede',
+        targetId: String(supersedesId),
+        metadata: {
+            brief_id: supersedesId,
+            superseded_by: briefId,
+            new_version: version,
+            refreshed: w.isRefresh,
+            ...w.refreshAuditExtra,
+        },
+    });
+}
+/** The afterWrite body: preflight, INSERT, supersede, reload, create audit, all in one SAVEPOINT. */
+function writeBriefRow(db, memoryId, w) {
+    const version = w.supersedesId !== undefined ? preflightBriefSupersede(db, w.tenantId, w.supersedesId) : 1;
+    const briefId = insertBriefRow(db, memoryId, w, version);
+    if (w.supersedesId !== undefined)
+        supersedeBriefRow(db, w, w.supersedesId, briefId, version);
+    // SAFETY: SELECT ${BRIEF_COLS} projects exactly the ProjectBriefRow
+    // columns; .get() returns that row, or undefined only if the
+    // just-inserted id can't be found.
+    const row = db.prepare(`SELECT ${BRIEF_COLS} FROM project_briefs WHERE id = ?`)
+        .get(briefId);
+    if (!row)
+        throw new Error('saveProjectBrief: failed to reload saved brief row');
+    // GDPR-light metadata: ids + flags only, no brief text.
+    appendAuditEvent(db, {
+        tenantId: w.tenantId,
+        actor: w.actor,
+        op: 'project_brief_create',
+        targetId: String(briefId),
+        metadata: {
+            brief_id: briefId,
+            repo: w.repo,
+            version,
+            refreshed: w.isRefresh,
+            ...w.refreshAuditExtra,
+        },
+    });
+    return row;
+}
 /**
  * Create a project_brief (or a new version that supersedes an existing one). Writes
  * the memory mirror + the project_briefs row atomically inside writeEntry's
@@ -132,79 +207,22 @@ export function saveProjectBrief(hippoRoot, tenantId, opts, actor = 'cli') {
         baseHalfLifeDays: objectHalfLifeDays(hippoRoot),
         tenantId,
     });
+    const w = {
+        tenantId,
+        actor,
+        repo,
+        summary: opts.summary,
+        changeSummary,
+        supersedesId: opts.supersedesBriefId,
+        isRefresh,
+        refreshAuditExtra,
+        now,
+    };
     let savedRow;
     writeEntry(hippoRoot, mem, {
         actor,
         afterWrite: (db, memoryId) => {
-            // Preflight the supersede target BEFORE inserting the new row (so the new
-            // autoincrement id can never be its own supersede target); read the
-            // predecessor version in the same SELECT for server-derived versioning.
-            // Mirrors saveSkill / saveProcess (codex P1 2026-05-28).
-            let version = 1;
-            if (opts.supersedesBriefId !== undefined) {
-                // SAFETY: SELECT projects exactly status, version; .get() returns that
-                // shape for the matching row, or undefined when no brief/tenant pair matches.
-                const pred = db.prepare(`SELECT status, version FROM project_briefs WHERE id = ? AND tenant_id = ?`).get(opts.supersedesBriefId, tenantId);
-                if (!pred) {
-                    throw new NotFoundError(`saveProjectBrief: brief ${opts.supersedesBriefId} to supersede not found for tenant ${tenantId}`);
-                }
-                if (pred.status !== 'active') {
-                    throw new ConflictError(`saveProjectBrief: brief ${opts.supersedesBriefId} is not active (status='${pred.status}'); only active briefs can be superseded.`);
-                }
-                version = pred.version + 1;
-            }
-            const result = db.prepare(`
-        INSERT INTO project_briefs(
-          memory_id, tenant_id, repo, summary, version,
-          status, superseded_by, superseded_at, change_summary, closed_at, created_at
-        ) VALUES (?, ?, ?, ?, ?, 'active', NULL, NULL, ?, NULL, ?)
-      `).run(memoryId, tenantId, repo, opts.summary, version, changeSummary, now);
-            const briefId = Number(result.lastInsertRowid ?? 0);
-            if (opts.supersedesBriefId !== undefined) {
-                const sup = db.prepare(`
-          UPDATE project_briefs
-          SET status = 'superseded', superseded_by = ?, superseded_at = ?
-          WHERE id = ? AND tenant_id = ? AND status = 'active' AND id != ?
-        `).run(briefId, now, opts.supersedesBriefId, tenantId, briefId);
-                if (sup.changes === 0) {
-                    throw new ConflictError(`saveProjectBrief: brief ${opts.supersedesBriefId} could not be superseded (no longer active or self-reference).`);
-                }
-                appendAuditEvent(db, {
-                    tenantId,
-                    actor,
-                    op: 'project_brief_supersede',
-                    targetId: String(opts.supersedesBriefId),
-                    metadata: {
-                        brief_id: opts.supersedesBriefId,
-                        superseded_by: briefId,
-                        new_version: version,
-                        refreshed: isRefresh,
-                        ...refreshAuditExtra,
-                    },
-                });
-            }
-            // SAFETY: SELECT ${BRIEF_COLS} projects exactly the ProjectBriefRow
-            // columns; .get() returns that row, or undefined only if the
-            // just-inserted id can't be found.
-            const row = db.prepare(`SELECT ${BRIEF_COLS} FROM project_briefs WHERE id = ?`)
-                .get(briefId);
-            if (!row)
-                throw new Error('saveProjectBrief: failed to reload saved brief row');
-            savedRow = row;
-            // GDPR-light metadata: ids + flags only, no brief text.
-            appendAuditEvent(db, {
-                tenantId,
-                actor,
-                op: 'project_brief_create',
-                targetId: String(briefId),
-                metadata: {
-                    brief_id: briefId,
-                    repo,
-                    version,
-                    refreshed: isRefresh,
-                    ...refreshAuditExtra,
-                },
-            });
+            savedRow = writeBriefRow(db, memoryId, w);
         },
         // afterCommit covers refreshBrief (delegates here) + brief new/supersede.
         afterCommit: () => markGraphDirty(hippoRoot, tenantId, mem.id),
@@ -298,6 +316,7 @@ export function loadProjectBriefById(hippoRoot, tenantId, id) {
 export function loadProjectBriefs(hippoRoot, tenantId, opts = {}) {
     assertTenantId('loadProjectBriefs', tenantId);
     const limit = opts.limit ?? 100;
+    const after = keysetAfter('created_at', 'id', opts.after);
     if (opts.status && !VALID_BRIEF_STATES.has(opts.status)) {
         throw new BadRequestError(`loadProjectBriefs: status must be one of ${Array.from(VALID_BRIEF_STATES).join('|')}; got ${opts.status}`);
     }
@@ -313,13 +332,13 @@ export function loadProjectBriefs(hippoRoot, tenantId, opts = {}) {
             clauses.push('repo = ?');
             params.push(opts.repo);
         }
-        params.push(limit);
+        params.push(...after.params, limit);
         // SAFETY: SELECT ${BRIEF_COLS} projects exactly the ProjectBriefRow columns
         // regardless of the dynamic WHERE clause built above; .all() returns rows
         // in that shape.
         const rows = db.prepare(`
       SELECT ${BRIEF_COLS} FROM project_briefs
-      WHERE ${clauses.join(' AND ')}
+      WHERE ${clauses.join(' AND ')}${after.sql}
       ORDER BY created_at DESC, id DESC
       LIMIT ?
     `).all(...params);
@@ -356,7 +375,7 @@ export function loadActiveBriefForRepo(hippoRoot, tenantId, repo) {
 // ---------------------------------------------------------------------------
 // Refresh assembler (the distinguishing deliverable)
 // ---------------------------------------------------------------------------
-/** Escape LIKE wildcards in operator-supplied text (mirror of store.ts:782). */
+/** Escape LIKE wildcards in operator-supplied text (mirror of store/search-rows.ts). */
 function escapeLike(term) {
     return term.replace(/[%_\\]/g, '\\$&');
 }
@@ -369,34 +388,16 @@ function receiptHeadline(content) {
         ? `${trimmed.slice(0, MAX_RECEIPT_HEADLINE_LEN)}...`
         : trimmed;
 }
-/**
- * Assemble the repo's recent receipts into a deterministic markdown digest, and
- * return it WITH the receipt count (the count feeds refreshBrief's change_summary +
- * audit metadata). NO LLM. Always returns a non-empty, valid summary (a brief
- * `summary` is NOT NULL), including the zero-receipts case.
- *
- * A "receipt" = a tenant memory row carrying the repo's `path:<repo>` tag. The
- * brief's OWN memory mirror (source='project_brief') is excluded so a brief never
- * becomes its own receipt on the next refresh. The match is against the JSON-array
- * serialization (each element is a double-quoted string `"path:hippo"`); the
- * surrounding quotes are load-bearing — they stop `hip` matching `path:hippo`.
- * `repo` is LIKE-escaped + parameterized (operator-supplied; security.md).
- */
-export function assembleBriefFromReceipts(hippoRoot, tenantId, repo) {
-    assertTenantId('assembleBriefFromReceipts', tenantId);
-    const normalizedRepo = (repo ?? '').trim();
-    if (normalizedRepo.length === 0) {
-        throw new BadRequestError('assembleBriefFromReceipts: repo is required');
-    }
+/** The repo's receipt rows, newest first, capped at MAX_BRIEF_RECEIPTS. */
+function loadBriefReceipts(hippoRoot, tenantId, normalizedRepo) {
     const tag = `path:${normalizedRepo.toLowerCase()}`;
     const likeParam = `%"${escapeLike(tag)}"%`;
     const denyPlaceholders = RECALL_DEFAULT_DENY_SCOPES.map(() => '?').join(', ');
     const db = openHippoDb(hippoRoot);
-    let receipts;
     try {
         // SAFETY: SELECT projects exactly id, created, source, content (the
         // ReceiptRow columns); .all() returns rows in that shape.
-        receipts = db.prepare(`
+        return db.prepare(`
       SELECT id, created, source, content FROM memories
       WHERE tenant_id = ?
         AND source != 'project_brief'
@@ -409,17 +410,19 @@ export function assembleBriefFromReceipts(hippoRoot, tenantId, repo) {
     finally {
         closeHippoDb(db);
     }
-    // NOTE on ordering: the `id DESC` tiebreak is lexical on a random-ish memory id
-    // (e.g. `sem_<hex>`), NOT chronological — within the same `created` timestamp the
-    // order is stable-but-arbitrary, not insertion order. `created DESC` is the real
-    // recency ordering. (plan-eng-critic 2026-05-30, med.)
-    //
-    // Budget-aware assembly (codex-review-critic 2026-05-30, P2): the digest is the
-    // brief `summary`, which saveProjectBrief caps at MAX_BRIEF_SUMMARY_LEN. The
-    // receipt/headline caps (50 x ~200) could otherwise build an ~11KB body that the
-    // store then REJECTS, breaking refresh for inputs within the advertised caps. So
-    // include receipt lines newest-first only while they fit under the cap (reserving
-    // slack for the header + an omission footer), and note the omitted remainder.
+}
+// NOTE on ordering: the `id DESC` tiebreak is lexical on a random-ish memory id
+// (e.g. `sem_<hex>`), NOT chronological — within the same `created` timestamp the
+// order is stable-but-arbitrary, not insertion order. `created DESC` is the real
+// recency ordering. (plan-eng-critic 2026-05-30, med.)
+//
+// Budget-aware assembly (codex-review-critic 2026-05-30, P2): the digest is the
+// brief `summary`, which saveProjectBrief caps at MAX_BRIEF_SUMMARY_LEN. The
+// receipt/headline caps (50 x ~200) could otherwise build an ~11KB body that the
+// store then REJECTS, breaking refresh for inputs within the advertised caps. So
+// include receipt lines newest-first only while they fit under the cap (reserving
+// slack for the header + an omission footer), and note the omitted remainder.
+function fitReceiptLines(receipts) {
     const buildReceiptLine = (r) => `- ${(r.created ?? '').slice(0, 10)} [${r.source}] ${receiptHeadline(r.content)}`;
     const receiptLines = [];
     if (receipts.length > 0) {
@@ -435,17 +438,20 @@ export function assembleBriefFromReceipts(hippoRoot, tenantId, repo) {
             bodyBudget -= line.length + 1;
         }
     }
-    const omitted = receipts.length - receiptLines.length;
+    return receiptLines;
+}
+function renderBriefDigest(normalizedRepo, receiptCount, receiptLines) {
+    const omitted = receiptCount - receiptLines.length;
     const lines = [];
     lines.push(`# Project Brief: ${normalizedRepo}`);
     lines.push('');
     lines.push(omitted > 0
-        ? `_Auto-assembled from ${receiptLines.length} of ${receipts.length} receipt(s)._`
-        : `_Auto-assembled from ${receipts.length} receipt(s)._`);
+        ? `_Auto-assembled from ${receiptLines.length} of ${receiptCount} receipt(s)._`
+        : `_Auto-assembled from ${receiptCount} receipt(s)._`);
     lines.push('');
     lines.push('## Recent receipts');
     lines.push('');
-    if (receipts.length === 0) {
+    if (receiptCount === 0) {
         lines.push(`_No receipts found for ${normalizedRepo}._`);
     }
     else {
@@ -462,6 +468,29 @@ export function assembleBriefFromReceipts(hippoRoot, tenantId, repo) {
     if (markdown.length > MAX_BRIEF_SUMMARY_LEN) {
         markdown = markdown.slice(0, MAX_BRIEF_SUMMARY_LEN);
     }
+    return markdown;
+}
+/**
+ * Assemble the repo's recent receipts into a deterministic markdown digest, and
+ * return it WITH the receipt count (the count feeds refreshBrief's change_summary +
+ * audit metadata). NO LLM. Always returns a non-empty, valid summary (a brief
+ * `summary` is NOT NULL), including the zero-receipts case.
+ *
+ * A "receipt" = a tenant memory row carrying the repo's `path:<repo>` tag. The
+ * brief's OWN memory mirror (source='project_brief') is excluded so a brief never
+ * becomes its own receipt on the next refresh. The match is against the JSON-array
+ * serialization (each element is a double-quoted string `"path:hippo"`); the
+ * surrounding quotes are load-bearing — they stop `hip` matching `path:hippo`.
+ * `repo` is LIKE-escaped + parameterized (operator-supplied; security.md).
+ */
+export function assembleBriefFromReceipts(hippoRoot, tenantId, repo) {
+    assertTenantId('assembleBriefFromReceipts', tenantId);
+    const normalizedRepo = (repo ?? '').trim();
+    if (normalizedRepo.length === 0) {
+        throw new BadRequestError('assembleBriefFromReceipts: repo is required');
+    }
+    const receipts = loadBriefReceipts(hippoRoot, tenantId, normalizedRepo);
+    const markdown = renderBriefDigest(normalizedRepo, receipts.length, fitReceiptLines(receipts));
     return { markdown, receiptCount: receipts.length };
 }
 /**

package/dist/project-identity.js

@@ -1,3 +1,4 @@
+import { envHippoHome, envXdgDataHome } from './env.js';
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
@@ -170,10 +171,10 @@ export function classifyOriginProject(origin, currentName) {
  * shared.getGlobalRoot delegates to this.
  */
 export function resolveGlobalRootDir() {
-    const hippoHome = process.env.HIPPO_HOME?.trim();
+    const hippoHome = envHippoHome();
     if (hippoHome)
         return hippoHome;
-    const xdgData = process.env.XDG_DATA_HOME?.trim();
+    const xdgData = envXdgDataHome();
     if (xdgData)
         return path.join(xdgData, 'hippo');
     return path.join(os.homedir(), '.hippo');

package/dist/project-merge.d.ts

@@ -18,7 +18,15 @@ export interface MergeResult {
     readonly compactions: number;
     readonly backup: string | null;
 }
+export interface ProjectFold {
+    readonly from: string;
+    readonly into: string;
+}
 export interface RepairResult {
+    /** Imported notes filed under the wrong project, or under a project name when a user-global import holds the same text: set aside. */
+    readonly copies: readonly string[];
+    /** Names whose recorded session folders all resolve to one other project today, folded as `merge` would. */
+    readonly folds: readonly ProjectFold[];
     readonly toProject: ReadonlyArray<{
         readonly id: string;
         readonly origin: string;
@@ -42,10 +50,10 @@ export declare function mergeProjects(db: DatabaseSyncLike, hippoRoot: string, o
     into: string;
     dryRun: boolean;
 }): MergeResult;
-/** Reads only, so doctor can call it on a read-only handle: what the repair would do to each user-global merged row. */
-export declare function planUserGlobalRepair(db: DatabaseSyncLike, tenantId: string): Omit<RepairResult, 'backup'>;
-/** Re-tags sleep's merged rows saved as user-global before the fix, by the projects of their parents. */
-export declare function repairUserGlobalMerges(db: DatabaseSyncLike, hippoRoot: string, opts: {
+/** Reads only, so doctor and a dry run take no write lock; merged rows are planned before any fold, so a few may re-tag differently once folds apply. */
+export declare function planProjectRepair(db: DatabaseSyncLike, hippoRoot: string, tenantId: string): Omit<RepairResult, 'backup'>;
+/** Sets aside stray imports, folds the names the resolver now maps elsewhere, then re-tags sleep's user-global merges by their parents; a dry run only plans. */
+export declare function repairProjects(db: DatabaseSyncLike, hippoRoot: string, opts: {
     tenantId: string;
     dryRun: boolean;
 }): RepairResult;

package/dist/project-merge.js

@@ -1,12 +1,19 @@
-// `hippo projects`: list the project names a store holds, fold one into another, and re-tag sleep's old user-global merges.
+// `hippo projects`: list the project names a store holds, fold one into another, and repair old tags in one reversible pass.
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { setAsideRow } from './agent-memories/apply.js';
-import { AGENT_MEMORY_SOURCE_PREFIX, AGENT_MEMORY_TOOLS } from './agent-memories/tools.js';
-import { appendAuditEvent } from './audit.js';
+import { transcriptNotesOrigin } from './agent-memories/claude-code.js';
+import { containerId, containerPrefix } from './agent-memories/source.js';
+import { AGENT_MEMORY_SOURCE_PREFIX, AGENT_MEMORY_TOOLS, toolSourcePrefix } from './agent-memories/tools.js';
+import { appendAuditEvent, queryAuditEvents } from './audit.js';
 import { insertDormantRow, listDormantSnapshots, replaceDormantEntry } from './dormant.js';
+import { processEnv } from './env.js';
 import { calculateStrength } from './memory.js';
-import { deleteEntryRowInTx, removeEntryMirrors, selectAllEntries, writeEntryMirrors } from './store.js';
+import { deriveOriginProject, isGlobalStoreRoot } from './project-identity.js';
+import { duplicateKey } from './same-text.js';
+import { removeEntryMirrors } from './store/mirrors.js';
+import { deleteEntryRowInTx, writeEntryMirrors } from './store/entry-writes.js';
+import { selectAllEntries, selectLiveEntriesBySourcePrefix } from './store/entry-reads.js';
 const ACTOR = 'cli';
 function isImport(entry) {
     return entry.source.startsWith(AGENT_MEMORY_SOURCE_PREFIX);
@@ -23,8 +30,9 @@ export function listProjects(db, tenantId) {
     for (const e of live) {
         const origin = e.origin_project ?? null;
         byOrigin.set(origin, [...(byOrigin.get(origin) ?? []), e]);
+        const key = duplicateKey(e.content);
         if (isImport(e))
-            holders.set(e.content, (holders.get(e.content) ?? new Set()).add(origin));
+            holders.set(key, (holders.get(key) ?? new Set()).add(origin));
     }
     return [...byOrigin].map(([origin, rows]) => {
         const imports = rows.filter(isImport);
@@ -33,7 +41,7 @@ export function listProjects(db, tenantId) {
             live: rows.length,
             imported: imports.length,
             newest: rows.reduce((max, e) => (e.created > max ? e.created : max), ''),
-            copiesElsewhere: imports.filter((e) => (holders.get(e.content)?.size ?? 0) > 1).length,
+            copiesElsewhere: imports.filter((e) => (holders.get(duplicateKey(e.content))?.size ?? 0) > 1).length,
         };
     }).sort((a, b) => b.newest.localeCompare(a.newest));
 }
@@ -76,44 +84,111 @@ export function mergeProjects(db, hippoRoot, opts) {
     const { tenantId, from, into, dryRun } = opts;
     const backup = dryRun ? null : backupStore(db, hippoRoot, 'before-merge');
     const result = inTransaction(db, dryRun, () => {
-        const rows = selectAllEntries(db, tenantId).filter((e) => e.origin_project === from);
-        const setAside = [];
-        for (const row of rows) {
-            const tag = toolTag(row.source);
-            if (!isImport(row) || row.superseded_by || row.kind === 'raw' || tag === null)
-                continue;
-            if (setAsideRow(db, tag, { ...row, origin_project: into }, 'project-merge').kind === 'dormant')
-                setAside.push(row.id);
-        }
-        const gone = new Set(setAside);
-        const restamped = rows.filter((e) => !gone.has(e.id)).map((e) => e.id);
-        db.prepare(`UPDATE memories SET origin_project = ?, updated_at = datetime('now') WHERE tenant_id = ? AND origin_project = ?`)
-            .run(into, tenantId, from);
-        const dormantRestamped = [];
-        for (const snap of listDormantSnapshots(db, tenantId)) {
-            if (snap.entry.origin_project !== from || gone.has(snap.entry.id))
-                continue;
-            replaceDormantEntry(db, tenantId, snap.entry.id, { ...snap.entry, origin_project: into });
-            dormantRestamped.push(snap.entry.id);
-        }
-        const compactions = Number(db.prepare(`UPDATE compactions SET origin_project = ? WHERE tenant_id = ? AND origin_project = ?`)
-            .run(into, tenantId, from).changes ?? 0);
-        appendAuditEvent(db, {
-            tenantId, actor: ACTOR, op: 'project_merge',
-            metadata: { from, into, backup, setAside, restamped, dormantRestamped, compactions },
-        });
-        return { from, into, setAside, restamped, dormantRestamped, compactions, backup };
+        const folded = foldInTx(db, tenantId, from, into);
+        appendAuditEvent(db, { tenantId, actor: ACTOR, op: 'project_merge', metadata: { from, into, backup, ...folded } });
+        return { from, into, ...folded, backup };
     });
     if (!dryRun)
         refreshMirrors(db, hippoRoot, tenantId, result.restamped, result.setAside);
     return result;
 }
-/** Reads only, so doctor can call it on a read-only handle: what the repair would do to each user-global merged row. */
-export function planUserGlobalRepair(db, tenantId) {
+function foldInTx(db, tenantId, from, into) {
+    const rows = selectAllEntries(db, tenantId).filter((e) => e.origin_project === from);
+    const setAside = [];
+    for (const row of rows) {
+        const tag = toolTag(row.source);
+        if (!isImport(row) || row.superseded_by || row.kind === 'raw' || tag === null)
+            continue;
+        if (setAsideRow(db, tag, { ...row, origin_project: into }, 'project-merge').kind === 'dormant')
+            setAside.push(row.id);
+    }
+    const gone = new Set(setAside);
+    const restamped = rows.filter((e) => !gone.has(e.id)).map((e) => e.id);
+    db.prepare(`UPDATE memories SET origin_project = ?, updated_at = datetime('now') WHERE tenant_id = ? AND origin_project = ?`)
+        .run(into, tenantId, from);
+    const dormantRestamped = [];
+    for (const snap of listDormantSnapshots(db, tenantId)) {
+        if (snap.entry.origin_project !== from || gone.has(snap.entry.id))
+            continue;
+        replaceDormantEntry(db, tenantId, snap.entry.id, { ...snap.entry, origin_project: into });
+        dormantRestamped.push(snap.entry.id);
+    }
+    const compactions = Number(db.prepare(`UPDATE compactions SET origin_project = ? WHERE tenant_id = ? AND origin_project = ?`)
+        .run(into, tenantId, from).changes ?? 0);
+    return { setAside, restamped, dormantRestamped, compactions };
+}
+/** Live imports under a project name whose exact text a user-global import holds: a session folder's notes stamped with the folder it ended in. */
+function importCopies(db, tenantId) {
+    const live = selectAllEntries(db, tenantId).filter((e) => !e.superseded_by && isImport(e));
+    const userGlobal = new Set(live.filter((e) => e.origin_project === '').map((e) => duplicateKey(e.content)));
+    return live.filter((e) => e.origin_project && e.kind !== 'raw' && !e.pinned && toolTag(e.source) !== null && userGlobal.has(duplicateKey(e.content)));
+}
+/** Imports to set aside. The global store also checks each Claude session folder a compaction recorded: its notes under any other project are misfiled, edited or not, and a text copy in the right folder is kept. */
+function strayImports(db, hippoRoot, tenantId) {
+    const copies = importCopies(db, tenantId);
+    if (!isGlobalStoreRoot(hippoRoot))
+        return copies;
+    const machine = { platform: process.platform, env: processEnv() };
+    const { platform } = machine;
+    // SAFETY: the SELECT names the two columns of the row type.
+    const sessions = db.prepare(`SELECT DISTINCT transcript_path AS transcript, cwd FROM compactions WHERE tenant_id = ? AND transcript_path IS NOT NULL`)
+        .all(tenantId);
+    const owners = new Map();
+    for (const { transcript, cwd } of sessions) {
+        const origin = transcriptNotesOrigin(transcript, cwd, machine);
+        const dir = path.join(path.dirname(transcript), 'memory');
+        if (origin !== null)
+            owners.set(dir, (owners.get(dir) ?? new Set()).add(origin));
+    }
+    const tool = toolSourcePrefix('claude-code');
+    const live = selectLiveEntriesBySourcePrefix(db, tenantId, tool).filter((e) => e.kind !== 'raw' && !e.pinned);
+    const origins = new Set(live.map((e) => e.origin_project ?? ''));
+    const right = new Set();
+    const wrong = new Set();
+    for (const [dir, owner] of owners) {
+        if (owner.size !== 1)
+            continue;
+        for (const origin of origins)
+            (owner.has(origin) ? right : wrong).add(containerPrefix('claude-code', containerId(dir, 'project', platform, origin)));
+    }
+    const prefix = (e) => e.source.slice(0, e.source.indexOf('/', tool.length) + 1);
+    const misfiled = live.filter((e) => wrong.has(prefix(e)));
+    const seen = new Set(misfiled.map((e) => e.id));
+    return [...misfiled, ...copies.filter((e) => !seen.has(e.id) && !right.has(prefix(e)))];
+}
+/** Global store only, where a compaction's name came from its cwd: a name whose every cwd still on disk resolves to one other project today. */
+function planFolds(db, tenantId) {
+    // SAFETY: the SELECT names the two columns of the row type.
+    const rows = db.prepare(`SELECT DISTINCT origin_project AS origin, cwd FROM compactions WHERE tenant_id = ? AND origin_project <> '' AND cwd IS NOT NULL`)
+        .all(tenantId);
+    const today = new Map();
+    for (const { origin, cwd } of rows) {
+        if (fs.existsSync(cwd))
+            today.set(origin, (today.get(origin) ?? new Set()).add(deriveOriginProject(cwd)));
+    }
+    // A name someone merged into by hand stays: undoing their choice would rest on the resolver alone.
+    const chosen = new Set(queryAuditEvents(db, { tenantId, op: 'project_merge', limit: 10000 }).map((e) => e.metadata.into));
+    const folds = [...today].flatMap(([from, names]) => {
+        const [into] = names;
+        return names.size === 1 && into !== '' && into !== from && !chosen.has(from) ? [{ from, into }] : [];
+    });
+    // A fold into a name that itself folds would land rows by run order; the next repair takes the rest of the chain.
+    const sources = new Set(folds.map((f) => f.from));
+    return folds.filter((f) => !sources.has(f.into));
+}
+/** Reads only, so doctor and a dry run take no write lock; merged rows are planned before any fold, so a few may re-tag differently once folds apply. */
+export function planProjectRepair(db, hippoRoot, tenantId) {
+    const folds = isGlobalStoreRoot(hippoRoot) ? planFolds(db, tenantId) : [];
+    return { copies: strayImports(db, hippoRoot, tenantId).map((e) => e.id), folds, ...planUserGlobalRepair(db, tenantId, folds) };
+}
+/** Parents read with `folds` already applied, so a plan matches what apply does after folding. */
+function planUserGlobalRepair(db, tenantId, folds) {
     const all = selectAllEntries(db, tenantId);
-    const origins = new Map(listDormantSnapshots(db, tenantId).map((s) => [s.entry.id, s.entry.origin_project ?? null]));
+    const renamed = new Map(folds.map((f) => [f.from, f.into]));
+    const after = (origin) => (origin ? renamed.get(origin) ?? origin : origin ?? null);
+    const origins = new Map(listDormantSnapshots(db, tenantId).map((s) => [s.entry.id, after(s.entry.origin_project)]));
     for (const e of all)
-        origins.set(e.id, e.origin_project ?? null);
+        origins.set(e.id, after(e.origin_project));
     const toProject = [];
     const setAside = [];
     const untraced = [];
@@ -133,14 +208,22 @@ export function planUserGlobalRepair(db, tenantId) {
     }
     return { toProject, setAside, untraced };
 }
-/** Re-tags sleep's merged rows saved as user-global before the fix, by the projects of their parents. */
-export function repairUserGlobalMerges(db, hippoRoot, opts) {
+/** Sets aside stray imports, folds the names the resolver now maps elsewhere, then re-tags sleep's user-global merges by their parents; a dry run only plans. */
+export function repairProjects(db, hippoRoot, opts) {
     const { tenantId, dryRun } = opts;
     if (dryRun)
-        return { ...planUserGlobalRepair(db, tenantId), backup: null };
+        return { ...planProjectRepair(db, hippoRoot, tenantId), backup: null };
     const backup = backupStore(db, hippoRoot, 'before-repair');
-    const result = inTransaction(db, false, () => {
-        const plan = planUserGlobalRepair(db, tenantId);
+    const { result, rewrite, purge } = inTransaction(db, false, () => {
+        const copies = [];
+        for (const row of strayImports(db, hippoRoot, tenantId)) {
+            const tag = toolTag(row.source);
+            if (tag !== null && setAsideRow(db, tag, row, 'project-repair').kind === 'dormant')
+                copies.push(row.id);
+        }
+        const folds = isGlobalStoreRoot(hippoRoot) ? planFolds(db, tenantId) : [];
+        const folded = folds.map((f) => foldInTx(db, tenantId, f.from, f.into));
+        const plan = planUserGlobalRepair(db, tenantId, []);
         const stamp = db.prepare(`UPDATE memories SET origin_project = ?, updated_at = datetime('now') WHERE tenant_id = ? AND id = ?`);
         for (const { id, origin } of plan.toProject)
             stamp.run(origin, tenantId, id);
@@ -150,10 +233,14 @@ export function repairUserGlobalMerges(db, hippoRoot, opts) {
             insertDormantRow(db, { entry: row, strength: calculateStrength(row, now), reason: 'project-repair', dormantAt: now.toISOString() });
             deleteEntryRowInTx(db, row, ACTOR);
         }
-        appendAuditEvent(db, { tenantId, actor: ACTOR, op: 'project_repair', metadata: { backup, ...plan } });
-        return { ...plan, backup };
+        appendAuditEvent(db, { tenantId, actor: ACTOR, op: 'project_repair', metadata: { backup, copies, folds, folded, ...plan } });
+        return {
+            result: { copies, folds, ...plan, backup },
+            rewrite: [...plan.toProject.map((r) => r.id), ...folded.flatMap((f) => f.restamped)],
+            purge: [...copies, ...plan.setAside, ...folded.flatMap((f) => f.setAside)],
+        };
     });
-    refreshMirrors(db, hippoRoot, tenantId, result.toProject.map((r) => r.id), result.setAside);
+    refreshMirrors(db, hippoRoot, tenantId, rewrite, purge);
     return result;
 }
 /** After commit, as the agent memory sync does: a stale mirror would bring the old tag back on the next rebuild. */