hippo-memory 1.61.0 → 1.63.0

package/dist/project-briefs.js

@@ -1,6 +1,5 @@
 /**
- * E2 project_brief first-class object
- * (docs/plans/2026-05-30-e2-project-brief-object.md).
+ * Project_brief first-class object.
  *
  * A `project_brief` is the living, repo-scoped summary of a repository's state: a
  * `summary` body scoped to a `repo`, evolving via the supersede delta lifecycle.
@@ -31,6 +30,7 @@ import { createMemory, Layer } from './memory.js';
 import { appendAuditEvent } from './audit.js';
 import { objectHalfLifeDays } from './half-life-migration.js';
 import { keysetAfter } from './keyset.js';
+import { escapeLike } from './escape.js';
 export const VALID_BRIEF_STATES = new Set([
     'active',
     'superseded',
@@ -103,9 +103,83 @@ const BRIEF_COLS = `
 function buildBriefContent(repo, summary) {
     return `${repo}\n\n${summary}`;
 }
-// ---------------------------------------------------------------------------
-// Public API
-// ---------------------------------------------------------------------------
+// Preflight the supersede target BEFORE inserting the new row (so the new
+// autoincrement id can never be its own supersede target); read the
+// predecessor version in the same SELECT for server-derived versioning.
+// Mirrors saveSkill / saveProcess.
+function preflightBriefSupersede(db, tenantId, supersedesId) {
+    // SAFETY: SELECT projects exactly status, version; .get() returns that
+    // shape for the matching row, or undefined when no brief/tenant pair matches.
+    const pred = db.prepare(`SELECT status, version FROM project_briefs WHERE id = ? AND tenant_id = ?`).get(supersedesId, tenantId);
+    if (!pred) {
+        throw new NotFoundError(`saveProjectBrief: brief ${supersedesId} to supersede not found for tenant ${tenantId}`);
+    }
+    if (pred.status !== 'active') {
+        throw new ConflictError(`saveProjectBrief: brief ${supersedesId} is not active (status='${pred.status}'); only active briefs can be superseded.`);
+    }
+    return pred.version + 1;
+}
+function insertBriefRow(db, memoryId, w, version) {
+    const result = db.prepare(`
+    INSERT INTO project_briefs(
+      memory_id, tenant_id, repo, summary, version,
+      status, superseded_by, superseded_at, change_summary, closed_at, created_at
+    ) VALUES (?, ?, ?, ?, ?, 'active', NULL, NULL, ?, NULL, ?)
+  `).run(memoryId, w.tenantId, w.repo, w.summary, version, w.changeSummary, w.now);
+    return Number(result.lastInsertRowid ?? 0);
+}
+function supersedeBriefRow(db, w, supersedesId, briefId, version) {
+    const sup = db.prepare(`
+    UPDATE project_briefs
+    SET status = 'superseded', superseded_by = ?, superseded_at = ?
+    WHERE id = ? AND tenant_id = ? AND status = 'active' AND id != ?
+  `).run(briefId, w.now, supersedesId, w.tenantId, briefId);
+    if (sup.changes === 0) {
+        throw new ConflictError(`saveProjectBrief: brief ${supersedesId} could not be superseded (no longer active or self-reference).`);
+    }
+    appendAuditEvent(db, {
+        tenantId: w.tenantId,
+        actor: w.actor,
+        op: 'project_brief_supersede',
+        targetId: String(supersedesId),
+        metadata: {
+            brief_id: supersedesId,
+            superseded_by: briefId,
+            new_version: version,
+            refreshed: w.isRefresh,
+            ...w.refreshAuditExtra,
+        },
+    });
+}
+/** The afterWrite body: preflight, INSERT, supersede, reload, create audit, all in one SAVEPOINT. */
+function writeBriefRow(db, memoryId, w) {
+    const version = w.supersedesId !== undefined ? preflightBriefSupersede(db, w.tenantId, w.supersedesId) : 1;
+    const briefId = insertBriefRow(db, memoryId, w, version);
+    if (w.supersedesId !== undefined)
+        supersedeBriefRow(db, w, w.supersedesId, briefId, version);
+    // SAFETY: SELECT ${BRIEF_COLS} projects exactly the ProjectBriefRow
+    // columns; .get() returns that row, or undefined only if the
+    // just-inserted id can't be found.
+    const row = db.prepare(`SELECT ${BRIEF_COLS} FROM project_briefs WHERE id = ?`)
+        .get(briefId);
+    if (!row)
+        throw new Error('saveProjectBrief: failed to reload saved brief row');
+    // GDPR-light metadata: ids + flags only, no brief text.
+    appendAuditEvent(db, {
+        tenantId: w.tenantId,
+        actor: w.actor,
+        op: 'project_brief_create',
+        targetId: String(briefId),
+        metadata: {
+            brief_id: briefId,
+            repo: w.repo,
+            version,
+            refreshed: w.isRefresh,
+            ...w.refreshAuditExtra,
+        },
+    });
+    return row;
+}
 /**
  * Create a project_brief (or a new version that supersedes an existing one). Writes
  * the memory mirror + the project_briefs row atomically inside writeEntry's
@@ -133,79 +207,22 @@ export function saveProjectBrief(hippoRoot, tenantId, opts, actor = 'cli') {
         baseHalfLifeDays: objectHalfLifeDays(hippoRoot),
         tenantId,
     });
+    const w = {
+        tenantId,
+        actor,
+        repo,
+        summary: opts.summary,
+        changeSummary,
+        supersedesId: opts.supersedesBriefId,
+        isRefresh,
+        refreshAuditExtra,
+        now,
+    };
     let savedRow;
     writeEntry(hippoRoot, mem, {
         actor,
         afterWrite: (db, memoryId) => {
-            // Preflight the supersede target BEFORE inserting the new row (so the new
-            // autoincrement id can never be its own supersede target); read the
-            // predecessor version in the same SELECT for server-derived versioning.
-            // Mirrors saveSkill / saveProcess (codex P1 2026-05-28).
-            let version = 1;
-            if (opts.supersedesBriefId !== undefined) {
-                // SAFETY: SELECT projects exactly status, version; .get() returns that
-                // shape for the matching row, or undefined when no brief/tenant pair matches.
-                const pred = db.prepare(`SELECT status, version FROM project_briefs WHERE id = ? AND tenant_id = ?`).get(opts.supersedesBriefId, tenantId);
-                if (!pred) {
-                    throw new NotFoundError(`saveProjectBrief: brief ${opts.supersedesBriefId} to supersede not found for tenant ${tenantId}`);
-                }
-                if (pred.status !== 'active') {
-                    throw new ConflictError(`saveProjectBrief: brief ${opts.supersedesBriefId} is not active (status='${pred.status}'); only active briefs can be superseded.`);
-                }
-                version = pred.version + 1;
-            }
-            const result = db.prepare(`
-        INSERT INTO project_briefs(
-          memory_id, tenant_id, repo, summary, version,
-          status, superseded_by, superseded_at, change_summary, closed_at, created_at
-        ) VALUES (?, ?, ?, ?, ?, 'active', NULL, NULL, ?, NULL, ?)
-      `).run(memoryId, tenantId, repo, opts.summary, version, changeSummary, now);
-            const briefId = Number(result.lastInsertRowid ?? 0);
-            if (opts.supersedesBriefId !== undefined) {
-                const sup = db.prepare(`
-          UPDATE project_briefs
-          SET status = 'superseded', superseded_by = ?, superseded_at = ?
-          WHERE id = ? AND tenant_id = ? AND status = 'active' AND id != ?
-        `).run(briefId, now, opts.supersedesBriefId, tenantId, briefId);
-                if (sup.changes === 0) {
-                    throw new ConflictError(`saveProjectBrief: brief ${opts.supersedesBriefId} could not be superseded (no longer active or self-reference).`);
-                }
-                appendAuditEvent(db, {
-                    tenantId,
-                    actor,
-                    op: 'project_brief_supersede',
-                    targetId: String(opts.supersedesBriefId),
-                    metadata: {
-                        brief_id: opts.supersedesBriefId,
-                        superseded_by: briefId,
-                        new_version: version,
-                        refreshed: isRefresh,
-                        ...refreshAuditExtra,
-                    },
-                });
-            }
-            // SAFETY: SELECT ${BRIEF_COLS} projects exactly the ProjectBriefRow
-            // columns; .get() returns that row, or undefined only if the
-            // just-inserted id can't be found.
-            const row = db.prepare(`SELECT ${BRIEF_COLS} FROM project_briefs WHERE id = ?`)
-                .get(briefId);
-            if (!row)
-                throw new Error('saveProjectBrief: failed to reload saved brief row');
-            savedRow = row;
-            // GDPR-light metadata: ids + flags only, no brief text.
-            appendAuditEvent(db, {
-                tenantId,
-                actor,
-                op: 'project_brief_create',
-                targetId: String(briefId),
-                metadata: {
-                    brief_id: briefId,
-                    repo,
-                    version,
-                    refreshed: isRefresh,
-                    ...refreshAuditExtra,
-                },
-            });
+            savedRow = writeBriefRow(db, memoryId, w);
         },
         // afterCommit covers refreshBrief (delegates here) + brief new/supersede.
         afterCommit: () => markGraphDirty(hippoRoot, tenantId, mem.id),
@@ -259,7 +276,7 @@ export function closeProjectBrief(hippoRoot, tenantId, id, actor = 'cli') {
             // Closing removes the object from the graph. Remove its rows DIRECTLY (deterministic),
             // not only via an enqueued rebuild whose queue item is lost if the mirror is later
             // forgotten (the queue row cascade-deletes with the memory), which would leave the closed
-            // object stale and could block that forget (codex P1). Still enqueue when a mirror exists
+            // object stale and could block that forget. Still enqueue when a mirror exists
             // so a concurrent rebuild re-derives consistently (harmless if it also runs).
             removeGraphEntitiesForObject(hippoRoot, tenantId, 'project', closed.id);
             if (closed.memoryId) {
@@ -334,7 +351,7 @@ export function loadProjectBriefs(hippoRoot, tenantId, opts = {}) {
 /**
  * The repo's CURRENT active brief, or null. By convention there is one active brief
  * per (tenant, repo); if an operator created more than one (the DB does not prevent
- * it, consistent with every other E2 object), the MOST-RECENT active row wins.
+ * it, consistent with every other first-class object), the MOST-RECENT active row wins.
  */
 export function loadActiveBriefForRepo(hippoRoot, tenantId, repo) {
     assertTenantId('loadActiveBriefForRepo', tenantId);
@@ -358,10 +375,6 @@ export function loadActiveBriefForRepo(hippoRoot, tenantId, repo) {
 // ---------------------------------------------------------------------------
 // Refresh assembler (the distinguishing deliverable)
 // ---------------------------------------------------------------------------
-/** Escape LIKE wildcards in operator-supplied text (mirror of store/search-rows.ts). */
-function escapeLike(term) {
-    return term.replace(/[%_\\]/g, '\\$&');
-}
 /** Single-line headline for a receipt: first non-empty line, newline-stripped,
  *  truncated. Deterministic + safe for the markdown bullet list. */
 function receiptHeadline(content) {
@@ -371,34 +384,16 @@ function receiptHeadline(content) {
         ? `${trimmed.slice(0, MAX_RECEIPT_HEADLINE_LEN)}...`
         : trimmed;
 }
-/**
- * Assemble the repo's recent receipts into a deterministic markdown digest, and
- * return it WITH the receipt count (the count feeds refreshBrief's change_summary +
- * audit metadata). NO LLM. Always returns a non-empty, valid summary (a brief
- * `summary` is NOT NULL), including the zero-receipts case.
- *
- * A "receipt" = a tenant memory row carrying the repo's `path:<repo>` tag. The
- * brief's OWN memory mirror (source='project_brief') is excluded so a brief never
- * becomes its own receipt on the next refresh. The match is against the JSON-array
- * serialization (each element is a double-quoted string `"path:hippo"`); the
- * surrounding quotes are load-bearing — they stop `hip` matching `path:hippo`.
- * `repo` is LIKE-escaped + parameterized (operator-supplied; security.md).
- */
-export function assembleBriefFromReceipts(hippoRoot, tenantId, repo) {
-    assertTenantId('assembleBriefFromReceipts', tenantId);
-    const normalizedRepo = (repo ?? '').trim();
-    if (normalizedRepo.length === 0) {
-        throw new BadRequestError('assembleBriefFromReceipts: repo is required');
-    }
+/** The repo's receipt rows, newest first, capped at MAX_BRIEF_RECEIPTS. */
+function loadBriefReceipts(hippoRoot, tenantId, normalizedRepo) {
     const tag = `path:${normalizedRepo.toLowerCase()}`;
     const likeParam = `%"${escapeLike(tag)}"%`;
     const denyPlaceholders = RECALL_DEFAULT_DENY_SCOPES.map(() => '?').join(', ');
     const db = openHippoDb(hippoRoot);
-    let receipts;
     try {
         // SAFETY: SELECT projects exactly id, created, source, content (the
         // ReceiptRow columns); .all() returns rows in that shape.
-        receipts = db.prepare(`
+        return db.prepare(`
       SELECT id, created, source, content FROM memories
       WHERE tenant_id = ?
         AND source != 'project_brief'
@@ -411,17 +406,19 @@ export function assembleBriefFromReceipts(hippoRoot, tenantId, repo) {
     finally {
         closeHippoDb(db);
     }
-    // NOTE on ordering: the `id DESC` tiebreak is lexical on a random-ish memory id
-    // (e.g. `sem_<hex>`), NOT chronological — within the same `created` timestamp the
-    // order is stable-but-arbitrary, not insertion order. `created DESC` is the real
-    // recency ordering. (plan-eng-critic 2026-05-30, med.)
-    //
-    // Budget-aware assembly (codex-review-critic 2026-05-30, P2): the digest is the
-    // brief `summary`, which saveProjectBrief caps at MAX_BRIEF_SUMMARY_LEN. The
-    // receipt/headline caps (50 x ~200) could otherwise build an ~11KB body that the
-    // store then REJECTS, breaking refresh for inputs within the advertised caps. So
-    // include receipt lines newest-first only while they fit under the cap (reserving
-    // slack for the header + an omission footer), and note the omitted remainder.
+}
+// NOTE on ordering: the `id DESC` tiebreak is lexical on a random-ish memory id
+// (e.g. `sem_<hex>`), NOT chronological — within the same `created` timestamp the
+// order is stable-but-arbitrary, not insertion order. `created DESC` is the real
+// recency ordering.
+//
+// Budget-aware assembly: the digest is the
+// brief `summary`, which saveProjectBrief caps at MAX_BRIEF_SUMMARY_LEN. The
+// receipt/headline caps (50 x ~200) could otherwise build an ~11KB body that the
+// store then REJECTS, breaking refresh for inputs within the advertised caps. So
+// include receipt lines newest-first only while they fit under the cap (reserving
+// slack for the header + an omission footer), and note the omitted remainder.
+function fitReceiptLines(receipts) {
     const buildReceiptLine = (r) => `- ${(r.created ?? '').slice(0, 10)} [${r.source}] ${receiptHeadline(r.content)}`;
     const receiptLines = [];
     if (receipts.length > 0) {
@@ -437,17 +434,20 @@ export function assembleBriefFromReceipts(hippoRoot, tenantId, repo) {
             bodyBudget -= line.length + 1;
         }
     }
-    const omitted = receipts.length - receiptLines.length;
+    return receiptLines;
+}
+function renderBriefDigest(normalizedRepo, receiptCount, receiptLines) {
+    const omitted = receiptCount - receiptLines.length;
     const lines = [];
     lines.push(`# Project Brief: ${normalizedRepo}`);
     lines.push('');
     lines.push(omitted > 0
-        ? `_Auto-assembled from ${receiptLines.length} of ${receipts.length} receipt(s)._`
-        : `_Auto-assembled from ${receipts.length} receipt(s)._`);
+        ? `_Auto-assembled from ${receiptLines.length} of ${receiptCount} receipt(s)._`
+        : `_Auto-assembled from ${receiptCount} receipt(s)._`);
     lines.push('');
     lines.push('## Recent receipts');
     lines.push('');
-    if (receipts.length === 0) {
+    if (receiptCount === 0) {
         lines.push(`_No receipts found for ${normalizedRepo}._`);
     }
     else {
@@ -464,6 +464,29 @@ export function assembleBriefFromReceipts(hippoRoot, tenantId, repo) {
     if (markdown.length > MAX_BRIEF_SUMMARY_LEN) {
         markdown = markdown.slice(0, MAX_BRIEF_SUMMARY_LEN);
     }
+    return markdown;
+}
+/**
+ * Assemble the repo's recent receipts into a deterministic markdown digest, and
+ * return it WITH the receipt count (the count feeds refreshBrief's change_summary +
+ * audit metadata). NO LLM. Always returns a non-empty, valid summary (a brief
+ * `summary` is NOT NULL), including the zero-receipts case.
+ *
+ * A "receipt" = a tenant memory row carrying the repo's `path:<repo>` tag. The
+ * brief's OWN memory mirror (source='project_brief') is excluded so a brief never
+ * becomes its own receipt on the next refresh. The match is against the JSON-array
+ * serialization (each element is a double-quoted string `"path:hippo"`); the
+ * surrounding quotes are load-bearing — they stop `hip` matching `path:hippo`.
+ * `repo` is LIKE-escaped + parameterized (operator-supplied; security.md).
+ */
+export function assembleBriefFromReceipts(hippoRoot, tenantId, repo) {
+    assertTenantId('assembleBriefFromReceipts', tenantId);
+    const normalizedRepo = (repo ?? '').trim();
+    if (normalizedRepo.length === 0) {
+        throw new BadRequestError('assembleBriefFromReceipts: repo is required');
+    }
+    const receipts = loadBriefReceipts(hippoRoot, tenantId, normalizedRepo);
+    const markdown = renderBriefDigest(normalizedRepo, receipts.length, fitReceiptLines(receipts));
     return { markdown, receiptCount: receipts.length };
 }
 /**
@@ -491,8 +514,8 @@ export function refreshBrief(hippoRoot, tenantId, repo, actor = 'cli') {
         supersedesBriefId: active ? active.id : undefined,
         refreshReceiptCount: receiptCount,
         // Tag the refreshed brief's mirror as repo-local so path-aware recall boosts
-        // it like the manual `brief new`/`supersede` paths do (codex-review 2026-05-30,
-        // P2). Safe vs self-recursion: assembleBriefFromReceipts excludes
+        // it like the manual `brief new`/`supersede` paths do.
+        // Safe vs self-recursion: assembleBriefFromReceipts excludes
         // source='project_brief', so the brief never becomes its own receipt.
         extraTags: [`path:${normalizedRepo.toLowerCase()}`],
     }, actor);

package/dist/project-identity.d.ts

@@ -1,6 +1,5 @@
 /**
- * Project identity resolution for memory scope isolation (ROADMAP.md Part I
- * [Committed] "Memory scope isolation"; plan docs/plans/2026-07-01-memory-scope-isolation.md S1).
+ * Project identity resolution for memory scope isolation.
  *
  * Resolution rules:
  * - The nearest ancestor of cwd (including cwd itself) containing a `.hippo`
@@ -11,6 +10,9 @@
  * - A directory with no marker anywhere up the walk is NOT a project: it
  *   resolves to the user-global identity (empty name), so memories written
  *   there stay injectable everywhere (matches pre-isolation behavior).
+ * - A project's name is its id: `.hippo-project.json` at the root, else the
+ *   checkout's normalised `origin` remote, else the folder rule (legacyName),
+ *   so two repos in folders of one name stay apart.
  *
  * NOTE: this module must stay free of imports from shared.ts / store.ts /
  * api.ts so any of them can import it without creating a cycle.
@@ -19,8 +21,12 @@
 export interface ProjectIdentity {
     /** Realpath-resolved root directory of the project (the start dir when not in a project). */
     root: string;
-    /** Lowercased basename of the project root, or of its repo for a linked worktree with no `.hippo` (a store keeps the name its rows carry); '' outside a project. */
+    /** The project id rows are stamped with: the project file's id, the origin remote, or legacyName; '' outside a project. */
     name: string;
+    /** The folder rule rows written before ids carry: the root's lowercased basename, or its repo's for a linked worktree with no `.hippo`. */
+    legacyName: string;
+    /** Every other name this root resolves to (the project file id, the origin remote even with the rule off, legacyName), so rows written under an earlier id stay readable. */
+    aliases?: readonly string[];
     /** True when the directory resolves to the user home working set. */
     isHome: boolean;
 }
@@ -33,7 +39,7 @@ export interface ResolveProjectIdentityOpts {
     homeDir?: string;
     stopDir?: string;
 }
-/** Clear the per-process identity cache (test seam). */
+/** Clear the per-process identity cache and the remote switch it read (test seam). */
 export declare function clearProjectIdentityCache(): void;
 /**
  * Canonicalize a path via realpath, falling back to path.resolve when the
@@ -46,17 +52,25 @@ export declare function realpathOrResolve(p: string): string;
  */
 export declare function resolveProjectIdentity(cwd?: string, opts?: ResolveProjectIdentityOpts): ProjectIdentity;
 /** Nearest ancestor `.hippo` below home and the temp root (never projects; on Windows the temp root sits inside home).
- *  Everything is realpath'd so a symlinked temp root or cwd still matches its bound. Design notes: docs/plans/2026-09-05-*.md */
+ *  Everything is realpath'd so a symlinked temp root or cwd still matches its bound. */
 export declare function findHippoStoreDir(cwd?: string, opts?: ResolveProjectIdentityOpts): string | null;
+/** A reader's project: a bare name, or an identity whose own rows may also carry its legacy folder name. */
+export type ProjectRef = string | Pick<ProjectIdentity, 'name' | 'legacyName' | 'aliases'>;
+/** The id a reader's new rows are stamped with; '' outside a project. */
+export declare function projectId(project: ProjectRef): string;
+/** Every origin_project value the reader's own rows carry: the id first, then each alias and the legacy name. */
+export declare function projectNames(project: ProjectRef): readonly string[];
+/** `origin_project IN (?, ...)` with one placeholder per name; an empty list matches nothing. */
+export declare function originInSql(names: readonly string[], column?: string): string;
 /**
  * v39 memory scope isolation: classify a memory's origin_project against the
- * active project. `currentName === ''` means the session is not in a project
+ * active project. An empty current id means the session is not in a project
  * (home dir or markerless cwd) - everything is in scope there, matching
  * pre-isolation behavior. NULL/undefined origin is a legacy pre-v39 row and
  * is treated as cross-project (deny by default) - the safe direction for a
  * security partition.
  */
-export declare function classifyOriginProject(origin: string | null | undefined, currentName: string): 'project' | 'user-global' | 'cross-project';
+export declare function classifyOriginProject(origin: string | null | undefined, current: ProjectRef): 'project' | 'user-global' | 'cross-project';
 /**
  * The global Hippo store directory, resolved the same way shared.ts does:
  * $HIPPO_HOME > $XDG_DATA_HOME/hippo > ~/.hippo. Lives here (leaf module) so
@@ -85,8 +99,7 @@ export declare function originFromSource(source: string | null | undefined, home
  * Returns the project name, or '' for user-global (written at/under home or
  * in a markerless directory) - injectable everywhere. Write sites must always
  * persist this value; a NULL origin_project column is reserved for legacy
- * pre-migration rows, which ambient context treats as deny (see plan
- * docs/plans/2026-07-01-memory-scope-isolation.md "Origin model").
+ * pre-migration rows, which ambient context treats as deny.
  */
 export declare function deriveOriginProject(cwd?: string, opts?: ResolveProjectIdentityOpts): string;
 //# sourceMappingURL=project-identity.d.ts.map

package/dist/project-identity.js

@@ -2,12 +2,31 @@ import { envHippoHome, envXdgDataHome } from './env.js';
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
+import { loadConfig } from './config.js';
 import { log } from './log.js';
+import { originRemoteId, projectFileId } from './project-remote.js';
 const MAX_WALK_DEPTH = 64;
 const identityCache = new Map();
-/** Clear the per-process identity cache (test seam). */
+let remoteSwitch = null;
+/** Clear the per-process identity cache and the remote switch it read (test seam). */
 export function clearProjectIdentityCache() {
     identityCache.clear();
+    remoteSwitch = null;
+}
+// The global store's config only: a per-store switch would stamp one checkout two ways.
+function remoteRuleOn() {
+    const globalRoot = resolveGlobalRootDir();
+    if (remoteSwitch?.globalRoot !== globalRoot)
+        remoteSwitch = { globalRoot, on: loadConfig(globalRoot).projectIdentity.remote };
+    return remoteSwitch.on;
+}
+/** The id a root names itself by plus every rung that resolves; only the root's own `.git` is read, so a store nested in another checkout keeps its folder name. */
+function namesAt(root, legacyName) {
+    const fileId = projectFileId(root);
+    const remoteId = originRemoteId(root);
+    const name = fileId ?? (remoteRuleOn() ? remoteId : null) ?? legacyName;
+    const aliases = [...new Set([fileId, remoteId, legacyName])].filter((n) => n !== null && n !== name);
+    return aliases.length > 0 ? { name, aliases } : { name };
 }
 /**
  * Canonicalize a path via realpath, falling back to path.resolve when the
@@ -72,16 +91,16 @@ export function resolveProjectIdentity(cwd, opts) {
     let identity;
     const root = hippoRoot ?? gitRoot;
     if (root !== null) {
-        const name = (hippoRoot === null ? linkedWorktreeRepoName(root, home) : null) ?? path.basename(root).toLowerCase();
-        identity = { root, name, isHome: false };
+        const legacyName = (hippoRoot === null ? linkedWorktreeRepoName(root, home) : null) ?? path.basename(root).toLowerCase();
+        identity = { root, ...namesAt(root, legacyName), legacyName, isHome: false };
     }
     else if (reachedHome || isUnder(start, home)) {
-        identity = { root: home, name: '', isHome: true };
+        identity = { root: home, name: '', legacyName: '', isHome: true };
     }
     else {
         // No markers anywhere: not a project. Empty name keeps these memories
         // user-global rather than fabricating an origin from a basename.
-        identity = { root: start, name: '', isHome: false };
+        identity = { root: start, name: '', legacyName: '', isHome: false };
     }
     if (cacheable)
         identityCache.set(startInput, identity);
@@ -137,7 +156,7 @@ function walkProjectMarkers(start, home, stopDirs) {
     return { hippoRoot, gitRoot, reachedHome };
 }
 /** Nearest ancestor `.hippo` below home and the temp root (never projects; on Windows the temp root sits inside home).
- *  Everything is realpath'd so a symlinked temp root or cwd still matches its bound. Design notes: docs/plans/2026-09-05-*.md */
+ *  Everything is realpath'd so a symlinked temp root or cwd still matches its bound. */
 export function findHippoStoreDir(cwd, opts) {
     const home = realpathOrResolve(opts?.homeDir ?? os.homedir());
     const stops = [realpathOrResolve(os.tmpdir())];
@@ -147,22 +166,39 @@ export function findHippoStoreDir(cwd, opts) {
     const { hippoRoot } = walkProjectMarkers(start, home, stops);
     return hippoRoot === null ? null : path.join(hippoRoot, '.hippo');
 }
+function isBareName(project) {
+    return typeof project === 'string';
+}
+/** The id a reader's new rows are stamped with; '' outside a project. */
+export function projectId(project) {
+    return isBareName(project) ? project : project.name;
+}
+/** Every origin_project value the reader's own rows carry: the id first, then each alias and the legacy name. */
+export function projectNames(project) {
+    if (isBareName(project) || project.name === '')
+        return [projectId(project)];
+    return [...new Set([project.name, ...(project.aliases ?? []), project.legacyName])].filter((n) => n !== '');
+}
+/** `origin_project IN (?, ...)` with one placeholder per name; an empty list matches nothing. */
+export function originInSql(names, column = 'origin_project') {
+    return names.length === 0 ? '0' : `${column} IN (${names.map(() => '?').join(', ')})`;
+}
 /**
  * v39 memory scope isolation: classify a memory's origin_project against the
- * active project. `currentName === ''` means the session is not in a project
+ * active project. An empty current id means the session is not in a project
  * (home dir or markerless cwd) - everything is in scope there, matching
  * pre-isolation behavior. NULL/undefined origin is a legacy pre-v39 row and
  * is treated as cross-project (deny by default) - the safe direction for a
  * security partition.
  */
-export function classifyOriginProject(origin, currentName) {
-    if (currentName === '')
+export function classifyOriginProject(origin, current) {
+    if (projectId(current) === '')
         return 'project';
     if (origin === undefined || origin === null)
         return 'cross-project';
     if (origin === '')
         return 'user-global';
-    return origin === currentName ? 'project' : 'cross-project';
+    return projectNames(current).includes(origin) ? 'project' : 'cross-project';
 }
 /**
  * The global Hippo store directory, resolved the same way shared.ts does:
@@ -221,8 +257,7 @@ export function originFromSource(source, homeName) {
  * Returns the project name, or '' for user-global (written at/under home or
  * in a markerless directory) - injectable everywhere. Write sites must always
  * persist this value; a NULL origin_project column is reserved for legacy
- * pre-migration rows, which ambient context treats as deny (see plan
- * docs/plans/2026-07-01-memory-scope-isolation.md "Origin model").
+ * pre-migration rows, which ambient context treats as deny.
  */
 export function deriveOriginProject(cwd, opts) {
     return resolveProjectIdentity(cwd, opts).name;

package/dist/project-merge.d.ts

@@ -11,14 +11,29 @@ export interface ProjectSummary {
 export interface MergeResult {
     readonly from: string;
     readonly into: string;
-    /** Imported note copies moved to dormant storage; the next sync under `into` imports the notes still on disk. */
+    /** Imports `into` already holds for the same note, moved to dormant storage; the rest are re-tagged and the next sync files them under `into`. */
     readonly setAside: readonly string[];
     readonly restamped: readonly string[];
     readonly dormantRestamped: readonly string[];
     readonly compactions: number;
     readonly backup: string | null;
 }
+export interface ProjectFold {
+    readonly from: string;
+    readonly into: string;
+}
+/** An old name whose session folders now resolve to several projects: no fold can say whose rows are whose. */
+export interface ProjectCollision {
+    readonly name: string;
+    readonly ids: readonly string[];
+}
 export interface RepairResult {
+    /** Imported notes filed under the wrong project, or under a project name when a user-global import holds the same text: set aside. */
+    readonly copies: readonly string[];
+    /** Names whose recorded session folders all resolve to one other project today, folded as `merge` would. */
+    readonly folds: readonly ProjectFold[];
+    /** Names left unfolded because their folders now resolve to more than one project; only `merge` by hand can split them. */
+    readonly collisions: readonly ProjectCollision[];
     readonly toProject: ReadonlyArray<{
         readonly id: string;
         readonly origin: string;
@@ -42,11 +57,19 @@ export declare function mergeProjects(db: DatabaseSyncLike, hippoRoot: string, o
     into: string;
     dryRun: boolean;
 }): MergeResult;
-/** Reads only, so doctor can call it on a read-only handle: what the repair would do to each user-global merged row. */
-export declare function planUserGlobalRepair(db: DatabaseSyncLike, tenantId: string): Omit<RepairResult, 'backup'>;
-/** Re-tags sleep's merged rows saved as user-global before the fix, by the projects of their parents. */
-export declare function repairUserGlobalMerges(db: DatabaseSyncLike, hippoRoot: string, opts: {
+/** Names folded, directly or through others, into one of `names`; the sync moves imports still filed under them. */
+export declare function namesFoldedInto(db: DatabaseSyncLike, tenantId: string, names: readonly string[]): string[];
+/** Reads only, so doctor and a dry run take no write lock; merged rows are planned before any fold, so a few may re-tag differently once folds apply. */
+export declare function planProjectRepair(db: DatabaseSyncLike, hippoRoot: string, tenantId: string, globalFolds?: boolean): Omit<RepairResult, 'backup'>;
+/** Sets aside stray imports, folds the names the resolver now maps elsewhere, then re-tags sleep's user-global merges by their parents; a dry run only plans. */
+export declare function repairProjects(db: DatabaseSyncLike, hippoRoot: string, opts: {
     tenantId: string;
     dryRun: boolean;
+    globalFolds?: boolean;
 }): RepairResult;
+/**
+ * Sleep runs repair once per store, so an upgrade needs no command. Global-store folds stay
+ * with `hippo projects repair`: their evidence is compaction folders, blind to a same-named repo that never compacted.
+ */
+export declare function repairOnceOnSleep(db: DatabaseSyncLike, hippoRoot: string, tenantId: string): RepairResult | null;
 //# sourceMappingURL=project-merge.d.ts.map