opencode-self-improvement 0.3.6 → 0.5.0

package/README.md

@@ -231,6 +231,18 @@ as `00:11:25.867`, or a unique substring of its text. Omit it to update the newe
 entry of that scope and type. A `query` matching nothing, or matching several rows,
 writes nothing and says so rather than updating the wrong memory.
 
+## Repo scoping
+
+Memories belong to the repo that wrote them: rows are stamped with your git
+remote (an id that survives re-clones and moves between machines) or, with no
+remote, the repo path. Injection, recall, the frontier block, compaction,
+`memory_forget`, and decay only ever see the current repo plus global rows —
+project A's facts never surface in project B. Preferences and habits that
+should follow you everywhere go in with `memory_remember global: true`.
+Memories written before this existed, and ones restored through the viewer,
+are global (visible everywhere), so upgrading changes nothing; exports carry
+origin stamps, so scoping survives a machine hop.
+
 ## Backup & move between machines
 
 `memory_export` writes the live store as JSONL — one JSON object per line
@@ -284,7 +296,7 @@ same data (`memory_status` tool under the hood; no model call):
     "abstained: no vocabulary overlap"
   - **RECENT BLOCKED WRITES** — that `memory_remember` that didn't stick,
     with its gate reason
-  - **STORE** — active / superseded / open / scopes
+  - **STORE** — active / superseded / open / scopes (plus `malformed`, only when the store contains rows whose `ts` is not a valid ISO instant — those are skipped by every reader, never loaded)
   - keys: `r` refresh, `f` fullscreen
 - a warning toast when a write is blocked (opt out: `"notifyBlocked": false`)
 
@@ -305,6 +317,8 @@ Run `bun memory-view` in your terminal and visit  http://127.0.0.1:8787 in your
 | --- | --- |
 | `memory_*` tools not available | The plugin didn't load. Restart opencode and check the `plugins` entry in your config. |
 | `memory_remember` says blocked | A gate rejected the write (stale code reference, a cited `path/to/file.ts` that doesn't exist in the repo, overlap with a superseded memory, or an ambiguous claim). The reason is logged — check `memory_evidence`, then rephrase against current code and retry. |
+| `invalid arguments to memory_*` | The tool call didn't match the tool's input schema — nothing was done, and the message names the offending fields. Schema validation lives at the tool boundary; gate blocks look different (`blocked at GATE (…)`). |
+| STORE shows `N malformed` | Rows in a daily file have a `ts=` that is not a valid ISO instant (typically a hand-edit gone wrong). Every reader skips them; fix the `ts=` value or restore the file with `memory_undo`. |
 | `/repo-init` missing from the command list | The self-install couldn't write to `~/.config/opencode/commands/` (e.g. read-only config dir). Create it, restart, or just ask the model to "init memory for this repo" — it calls the same tool. |
 | Init says `Graph: unavailable` | `codebase-memory-mcp` couldn't start (not installed, or its once-only download is blocked). Install pinned `0.11.0` via the one-liner above, or point `OPENCODE_CBM_BIN` at the binary. Scripts are still remembered without it. |
 | Stale plugin after an update | Bump the pinned version in the `plugin` entry (or `opencode plugin update opencode-self-improvement` on v2) and restart opencode. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-self-improvement",
-  "version": "0.3.6",
+  "version": "0.5.0",
   "description": "Durable memory for opencode: remember facts, decisions, and commands across sessions, plus a one-command per-repo setup (/repo-init).",
   "main": "index.ts",
   "exports": {
@@ -39,15 +39,15 @@
     "codebase-memory-mcp": "0.11.0"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.6.2",
-    "@opencode/plugin": "^2.0.32",
-    "@opentui/core": ">=0.6.6",
-    "@opentui/solid": ">=0.6.6",
-    "@semantic-release/git": "^11.0.1",
-    "@types/bun": "latest",
-    "semantic-release": "^25.0.9",
-    "solid-js": ">=1.9.0",
-    "typescript": "^7.0.2"
+    "@biomejs/biome": "2.6.2",
+    "@opencode/plugin": "2.0.32",
+    "@opentui/core": "0.6.6",
+    "@opentui/solid": "0.6.6",
+    "@semantic-release/git": "11.0.1",
+    "@types/bun": "1.4.2",
+    "semantic-release": "25.0.9",
+    "solid-js": "1.9.17",
+    "typescript": "7.0.2"
   },
   "peerDependencies": {
     "@opentui/core": ">=0.6.6",
@@ -62,5 +62,8 @@
     "bench:recall": "bun bench/recall-quality.ts",
     "memory-view": "bun run src/viewer/server.ts",
     "lint": "biome lint"
+  },
+  "dependencies": {
+    "zod": "4.6.7"
   }
 }

package/src/gates.ts

@@ -30,6 +30,11 @@ export interface WriteCandidate {
   issue?: string;
   tags?: string[];
   status?: "open" | "settled";
+  // "global" = cross-project (memory_remember global:true; imports carry a
+  // row's origin stamp). Any other value (including undefined) is resolved by
+  // appendMemory against the live repo scope (issue #8).
+  repo?: string;
+  repoPath?: string;
 }
 
 export interface GateContext {

package/src/index.ts

@@ -17,7 +17,9 @@ import { STATUSES, TYPES } from "./types.ts";
 import {
   clearSuperseded,
   isActive,
+  isVisibleHere,
   loadAll,
+  malformedCount,
   markSuperseded,
   resolveMemoryTarget,
   snapshotFiles,
@@ -60,22 +62,27 @@ import {
   onCompacting,
 } from "./triggers.ts";
 import { getCurrent, setCurrent } from "./state.ts";
+import { resolveRepo, setRepoScope } from "./repokey.ts";
 import { readLines } from "./logfmt.ts";
 import { buildCapturePrompt, flattenTranscript, parseCandidates, parseModelRef } from "./capture.ts";
 
-// --- minimal JSON Schema helpers (OpenCode V2 tools take JSON Schema) --------
-type JSONSchema = Record<string, unknown>;
-const str = (): JSONSchema => ({ type: "string" });
-const bool = (): JSONSchema => ({ type: "boolean" });
-const num = (): JSONSchema => ({ type: "number" });
-const strArray = (): JSONSchema => ({ type: "array", items: { type: "string" } });
-const en = (values: readonly string[]): JSONSchema => ({ type: "string", enum: [...values] });
-function obj(properties: Record<string, JSONSchema>, required: string[] = []): JSONSchema {
-  return { type: "object", properties, required, additionalProperties: false };
-}
-function withDesc(schema: JSONSchema, description: string): JSONSchema {
-  return { ...schema, description };
-}
+// Tool/input boundaries are zod schemas (src/schema.ts): the JSON Schema the
+// host sees is GENERATED from them, and raw args are re-parsed at execution.
+import {
+  DecayArgs,
+  EmptyArgs,
+  EvidenceArgs,
+  ExportArgs,
+  ForgetArgs,
+  ImportArgs,
+  InitArgs,
+  MergeReviewArgs,
+  RecallArgs,
+  RememberArgs,
+  UndoArgs,
+  UpdateArgs,
+  validated,
+} from "./schema.ts";
 
 function scoreMemory(m: Memory, q: string): number {
   const hay = `${m.type} ${m.scope} ${m.content}`.toLowerCase();
@@ -92,7 +99,7 @@ function scoreMemory(m: Memory, q: string): number {
 interface ToolDef {
   name: string;
   description: string;
-  input: JSONSchema;
+  input: Record<string, unknown>;
   options?: { codemode?: boolean; namespace?: string };
   execute: (args: any, context: any) => Promise<{ content: string }>;
 }
@@ -163,6 +170,11 @@ const impl = {
   async setup(ctx: PluginCtx): Promise<Cleanup | void> {
     const liveRoot = ctx?.location?.directory ?? process.cwd();
 
+    // Repo scoping (issue #8): resolve this workspace's identity ONCE. Every
+    // append stamps it; every model-facing read filters by it. Never throws —
+    // a non-git dir simply scopes by path.
+    setRepoScope(resolveRepo(liveRoot));
+
     // Character budget for the epoch-frozen injection block: plugin options
     // (object form in opencode.json(c)) win, then OPENCODE_MEMORY_INJECT_BUDGET,
     // then the 1200 default.
@@ -195,26 +207,12 @@ const impl = {
     await ctx.tool?.transform((editor) => {
       const direct = { codemode: false } as const;
 
-      editor.add({
+      editor.add(validated(RememberArgs, {
         name: "memory_remember",
         description:
           "Store a memory after the 4-gate write pipeline validates it (canonical graph, stale refs, dupes). Blocked writes record evidence instead of persisting.",
         options: direct,
-        input: obj(
-          {
-            type: withDesc(en(TYPES), "Type of memory"),
-            scope: withDesc(str(), "Scope/area (e.g., auth, api, ctl)"),
-            content: withDesc(str(), "The memory content"),
-            issue: withDesc(str(), "Related issue"),
-            tags: strArray(),
-            status: withDesc(
-              en(STATUSES),
-              "open = live planning thread / frontier (surfaced at session start); settled or omitted = durable knowledge",
-            ),
-          },
-          ["type", "scope", "content"],
-        ),
-        async execute(args: any): Promise<{ content: string }> {
+        async execute(args): Promise<{ content: string }> {
           const candidate: WriteCandidate = {
             type: args.type,
             scope: args.scope,
@@ -222,6 +220,7 @@ const impl = {
             issue: args.issue,
             tags: args.tags,
             status: args.status,
+            repo: args.global ? "global" : undefined,
           };
           const outcome = await runWriteGate(candidate, gateContext());
           if (outcome.action === "promoted") return { content: `Remembered: ${args.type} in ${args.scope}` };
@@ -232,31 +231,26 @@ const impl = {
             }`,
           };
         },
-      });
+      }));
 
-      editor.add({
+      editor.add(validated(InitArgs, {
         name: "memory_init",
         description:
           "Initialize repository memory and knowledge graph. Ensures the codebase-memory graph for this repo is indexed (one-shot `cli` spawn; no session MCP needed) and re-derives build/lint/test/typecheck command memories through the write gate, then stores an init stamp keyed on git HEAD. Idempotent: a no-op when the stamp matches HEAD, unless force=true (refresh after a refactor).",
         options: direct,
-        input: obj({
-          force: withDesc(bool(), "Re-run even if initialized (refresh after drift)"),
-          mode: withDesc(en(["fast", "moderate", "full"]), "codebase-memory index mode (default moderate)"),
-        }),
-        async execute(args: any): Promise<{ content: string }> {
+        async execute(args): Promise<{ content: string }> {
           const summary = await runInit({ liveRoot, force: args.force, mode: args.mode });
           return { content: formatInit(summary) };
         },
-      });
+      }));
 
-      editor.add({
+      editor.add(validated(RecallArgs, {
         name: "memory_recall",
         description:
           "Look up durable project knowledge — build/test/lint commands, decisions, patterns, preferences, blockers — BEFORE searching the repo or reading files. Use for 'how do I run X', conventions, and past decisions. By scope, type, or free-text query; with no filters it returns the most recent memories.",
         options: direct,
-        input: obj({ scope: str(), type: en(TYPES), query: str(), limit: num() }),
-        async execute(args: any): Promise<{ content: string }> {
-          let results = (await loadAll()).filter(isActive);
+        async execute(args): Promise<{ content: string }> {
+          let results = (await loadAll()).filter(isActive).filter(isVisibleHere);
           if (!results.length) return { content: "No memories found" };
           const total = results.length;
           if (args.scope) results = results.filter((m) => m.scope.includes(args.scope!));
@@ -283,29 +277,16 @@ const impl = {
           }
           return { content: `Found ${results.length} (${total} total)\n\n${limited.map(formatMemory).join("\n")}` };
         },
-      });
+      }));
 
-      editor.add({
+      editor.add(validated(UpdateArgs, {
         name: "memory_update",
         description:
           "Update an existing memory (gated like remember; the prior entry is superseded, not erased). `query` selects which row to update: its exact id (ts), a clock fragment (e.g. HH:MM:SS.mmm), or a unique substring of its content. Omitting `query` targets the most recent active row of scope+type. An unmatched or ambiguous `query` fails closed and writes nothing.",
         options: direct,
-        input: obj(
-          {
-            scope: str(),
-            type: en(TYPES),
-            content: str(),
-            query: withDesc(
-              str(),
-              "Row selector: id (ts), clock fragment, or unique content substring. Omit to target the newest active row of scope+type.",
-            ),
-            status: en(STATUSES),
-          },
-          ["scope", "type", "content"],
-        ),
-        async execute(args: any): Promise<{ content: string }> {
+        async execute(args): Promise<{ content: string }> {
           const prior = (await loadAll()).filter(
-            (m) => m.scope === args.scope && m.type === args.type && isActive(m),
+            (m) => m.scope === args.scope && m.type === args.type && isActive(m) && isVisibleHere(m),
           );
           // Resolve the row BEFORE the gate: an update that cannot identify its
           // target must write nothing, rather than silently superseding whichever
@@ -344,32 +325,26 @@ const impl = {
           if (outcome.action === "collapsed") return { content: `Duplicate ignored: ${args.type}/${args.scope}` };
           return { content: `Write blocked at GATE (${outcome.reason}). ${outcome.hint ?? ""}`.trimEnd() };
         },
-      });
+      }));
 
-      editor.add({
+      editor.add(validated(ForgetArgs, {
         name: "memory_forget",
         description:
           "Delete memories by scope and type. Snapshots first, logs the reason for audit, never touches a repo.",
         options: direct,
-        input: obj({ scope: str(), type: en(TYPES), reason: withDesc(str(), "Why this is being deleted (audit)") }, [
-          "scope",
-          "type",
-          "reason",
-        ]),
-        async execute(args: any): Promise<{ content: string }> {
+        async execute(args): Promise<{ content: string }> {
           const res = await pruneMemory(args.scope, args.type, args.reason);
           if (!res.deleted.length) return { content: `No memories found for ${args.type} in ${args.scope}` };
           return { content: `Deleted ${res.deleted.length} ${args.type} memory(s) from ${args.scope}. Audit: ${res.audit}` };
         },
-      });
+      }));
 
-      editor.add({
+      editor.add(validated(EmptyArgs, {
         name: "memory_list",
         description: "List memory scopes and types for discovery.",
         options: direct,
-        input: obj({}),
         async execute(): Promise<{ content: string }> {
-          const mems = (await loadAll()).filter(isActive);
+          const mems = (await loadAll()).filter(isActive).filter(isVisibleHere);
           if (!mems.length) return { content: "No memories found" };
           const scopes = new Map<string, number>();
           const types = new Map<string, number>();
@@ -381,20 +356,14 @@ const impl = {
             [...map.entries()].sort((a, b) => b[1] - a[1]).map(([k, c]) => `  ${k}: ${c}`).join("\n");
           return { content: `Total: ${mems.length}\n\nScopes:\n${fmt(scopes)}\n\nTypes:\n${fmt(types)}` };
         },
-      });
+      }));
 
-      editor.add({
+      editor.add(validated(UndoArgs, {
         name: "memory_undo",
         description:
           "List memory snapshots, or restore one (rollback). SAFE BY DEFAULT: daily store files are shared across sessions, so if the current file has rows added or edited since the snapshot, restore REFUSES and lists them — re-run with merge=true to restore AND keep those rows, or force=true for the exact rollback. `snapshot` accepts a bare name from the list or a full path.",
         options: direct,
-        input: obj({
-          list: withDesc(bool(), "List snapshots"),
-          snapshot: withDesc(str(), "Snapshot to restore (bare name from list, or a full path)"),
-          merge: withDesc(bool(), "With snapshot: keep rows written after the snapshot instead of refusing"),
-          force: withDesc(bool(), "With snapshot: exact rollback even if the file changed since"),
-        }),
-        async execute(args: any): Promise<{ content: string }> {
+        async execute(args): Promise<{ content: string }> {
           if (args.snapshot) {
             const mode = args.force ? "force" : args.merge ? "merge" : "check";
             const res = await restoreSnapshot(args.snapshot, memoryRoot(), mode);
@@ -418,14 +387,13 @@ const impl = {
           if (!snaps.length) return { content: "No snapshots" };
           return { content: snaps.map((s) => `${s.name}  (${s.bytes} bytes)`).join("\n") };
         },
-      });
+      }));
 
-      editor.add({
+      editor.add(validated(EvidenceArgs, {
         name: "memory_evidence",
         description: "Read captured evidence (data only) for a date, optionally filtered by event.",
         options: direct,
-        input: obj({ date: str(), ev: str(), limit: num() }),
-        async execute(args: any): Promise<{ content: string }> {
+        async execute(args): Promise<{ content: string }> {
           const file = join(evidenceDir(), `${args.date || dateStr()}.logfmt`);
           let lines = await readLines(file);
           if (args.ev) lines = lines.filter((l) => l.includes(`ev=${args.ev}`));
@@ -433,22 +401,14 @@ const impl = {
           const limit = args.limit || 50;
           return { content: lines.slice(-limit).join("\n") };
         },
-      });
+      }));
 
-      editor.add({
+      editor.add(validated(MergeReviewArgs, {
         name: "memory_merge_review",
         description:
           "Resolve an open merge/review gate non-destructively: mark the loser as superseded_by the survivor, and clear any supersession the survivor itself carries so the canonical row stays recallable. Both rows stay active data (the loser is recoverable via memory_undo); nothing is deleted. Fails closed (no partial apply) when the reason or the survivor id is missing, or the loser is already superseded.",
         options: direct,
-        input: obj(
-          {
-            loser: withDesc(str(), "Evidence id of the rival/overlap write to supersede"),
-            survivor: withDesc(str(), "Evidence id of the canonical winning write"),
-            reason: withDesc(str(), "Why the survivor is canonical over the loser (written to evidence)"),
-          },
-          ["loser", "survivor", "reason"],
-        ),
-        async execute(args: any): Promise<{ content: string }> {
+        async execute(args): Promise<{ content: string }> {
           if (!args.loser || !args.survivor || !args.reason) {
             return { content: "merge_review blocked: loser, survivor, and reason are all required (fail-closed)." };
           }
@@ -473,30 +433,25 @@ const impl = {
               `Evidence recorded for reason='${args.reason}'.`,
           };
         },
-      });
+      }));
 
-      editor.add({
+      editor.add(validated(ExportArgs, {
         name: "memory_export",
         description:
           "Export active memories as a JSONL file (one JSON object per line: {ts,type,scope,content,status,tags,issue}) for backup or transfer to another machine. Defaults to <memory-root>/exports/<timestamp>.jsonl; pass `file` to choose the path, `scope` to export one scope. Superseded rows are not exported (history stays in the store).",
         options: direct,
-        input: obj({
-          scope: withDesc(str(), "Only export memories in this exact scope"),
-          file: withDesc(str(), "Destination path (default: <memory-root>/exports/)"),
-        }),
-        async execute(args: any): Promise<{ content: string }> {
+        async execute(args): Promise<{ content: string }> {
           const res = await exportMemories({ scope: args.scope, file: args.file });
           return { content: `Exported ${res.count} memories -> ${res.path}` };
         },
-      });
+      }));
 
-      editor.add({
+      editor.add(validated(ImportArgs, {
         name: "memory_import",
         description:
           "Import memories from a JSONL export (see memory_export). Every row goes through the same 4-gate write pipeline as memory_remember (tagged `import`, original tags preserved), so duplicates collapse and ungrounded rows are blocked exactly as usual — those are normal tallied outcomes, not errors. Malformed lines are skipped and counted.",
         options: direct,
-        input: obj({ file: withDesc(str(), "Path to a .jsonl export file") }, ["file"]),
-        async execute(args: any): Promise<{ content: string }> {
+        async execute(args): Promise<{ content: string }> {
           try {
             const t = await importMemories(args.file, (c) =>
               runWriteGate(
@@ -515,24 +470,14 @@ const impl = {
             };
           }
         },
-      });
+      }));
 
-      editor.add({
+      editor.add(validated(DecayArgs, {
         name: "memory_decay",
         description:
           "Retire stale open threads (status=open older than olderThanDays) by superseding them — never deleting; rows stay recoverable via memory_undo. DRY RUN BY DEFAULT: without an explicit dryRun=false this only LISTS what would retire and mutates nothing (fail-closed). A real run snapshots every affected file before the first mutation.",
         options: direct,
-        input: obj({
-          olderThanDays: withDesc(
-            { type: "number", default: 14 },
-            "Age threshold in days (default 14)",
-          ),
-          dryRun: withDesc(
-            { type: "boolean", default: true },
-            "Preview only (default true). Set false to actually supersede.",
-          ),
-        }),
-        async execute(args: any): Promise<{ content: string }> {
+        async execute(args): Promise<{ content: string }> {
           const days = Number(args.olderThanDays) > 0 ? Number(args.olderThanDays) : 14;
           const dryRun = args.dryRun !== false; // only an explicit false mutates
           const stale = await findStaleOpen(days);
@@ -583,14 +528,13 @@ const impl = {
               "Recover with memory_undo.",
           };
         },
-      });
+      }));
 
-      editor.add({
+      editor.add(validated(EmptyArgs, {
         name: "memory_status",
         description:
           "Plain-text memory report for chat clients (desktop/web/IDE), same sections as the terminal /memory panel: CONTEXT (this session's injected block, budget use, cumulative ride and abstentions), CACHE (epoch invalidations plus the measured session prompt-cache read rate), the block verbatim, recent blocked writes with gate reasons, and store stats. Reads only — no model call.",
         options: direct,
-        input: obj({}),
         async execute(): Promise<{ content: string }> {
           // In-process truth: the live epoch + ledger, fresher than any file.
           const sid = getCurrent().sid;
@@ -602,12 +546,13 @@ const impl = {
             superseded: all.length - act.length,
             open: act.filter((m) => m.status === "open").length,
             scopes: new Set(act.map((m) => m.scope)).size,
+            malformed: malformedCount(),
           };
           return {
             content: renderMemoryReport({ status, store, blocked: await blockedRecent(6) }),
           };
         },
-      });
+      }));
     });
 
     // Per-session frozen injection epochs: the relevance block plus the store
@@ -655,6 +600,7 @@ const impl = {
           superseded: all.length - act.length,
           open: act.filter((m) => m.status === "open").length,
           scopes: new Set(act.map((m) => m.scope)).size,
+          malformed: malformedCount(),
         },
         stats: statsFor(sid),
         measured: measuredTurns.get(sid) ?? null,

package/src/init.ts

@@ -8,7 +8,7 @@
 import { basename, join } from "node:path";
 import { existsSync } from "node:fs";
 import { cbmBin } from "./config.ts";
-import { loadAll, markSuperseded } from "./memory.ts";
+import { isVisibleHere, loadAll, markSuperseded } from "./memory.ts";
 import { runWriteGate, type GateContext } from "./gates.ts";
 import { record } from "./evidence.ts";
 import { evidenceCalls, hasGateCheck } from "./triggers.ts";
@@ -185,7 +185,11 @@ export interface InitStamp {
 }
 
 export async function initStamp(scope: string): Promise<InitStamp | null> {
-  const mems = (await loadAll()).filter((m) => !m.superseded_by);
+  // Issue #8: scope is a basename, so two different repos can share one
+  // ("api" next to "api", a fork beside its upstream). Visibility filtering
+  // makes each repo see only its own stamp — basename collisions no longer
+  // alias init state between repos.
+  const mems = (await loadAll()).filter((m) => !m.superseded_by && isVisibleHere(m));
   for (const m of mems) {
     if (m.type !== "context" || m.scope !== scope) continue;
     if (!m.tags?.some((t) => t === "init-stamp")) continue;

package/src/inject.ts

@@ -5,7 +5,7 @@
 // results. Evidence is never injected (invariant I3). Open threads (status=
 // "open") get a single capped frontier block in the digest so planning sessions
 // start at the previous session's frontier instead of re-deriving it.
-import { isActive, loadAll, type Memory } from "./memory.ts";
+import { isActive, loadAll, visibleHere, type Memory } from "./memory.ts";
 import { record } from "./evidence.ts";
 import { dateStr } from "./config.ts";
 import { bracketList } from "./logfmt.ts";
@@ -93,7 +93,8 @@ export async function systemDigest(
   _input: unknown,
   output: TransformOutput,
 ): Promise<void> {
-  const mems = (await loadAll()).filter(isActive);
+  // Repo-scoped (issue #8): model-facing reads see this repo + global rows.
+  const mems = visibleHere((await loadAll()).filter(isActive));
   if (!mems.length) return;
   const latest = mems.map((m) => m.ts).sort().pop() ?? "?";
   output.system.push(
@@ -143,7 +144,8 @@ export async function systemDigest(
 export async function relevantKnowledge(message: string, limit = 3): Promise<string> {
   const text = message.trim();
   if (!text) return "";
-  const mems = (await loadAll()).filter(isActive);
+  // Repo-scoped (issue #8): model-facing reads see this repo + global rows.
+  const mems = visibleHere((await loadAll()).filter(isActive));
   const top = scoreMemories(text, mems, limit);
   if (!top.length) return "";
   return `## Relevant durable memory\n${top.map(formatMemory).join("\n")}`;
@@ -154,7 +156,8 @@ export async function relevantKnowledge(message: string, limit = 3): Promise<str
 // injection block is recomputed only when this string changes (or after a
 // compaction). Evidence and superseded rows never affect it (I3, memory.ts).
 export async function storeVersion(): Promise<string> {
-  const mems = (await loadAll()).filter(isActive);
+  // Repo-scoped (issue #8): model-facing reads see this repo + global rows.
+  const mems = visibleHere((await loadAll()).filter(isActive));
   let max = "";
   for (const m of mems) if (m.ts > max) max = m.ts;
   return `${mems.length}:${max}`;
@@ -193,7 +196,8 @@ const ANCHOR_SETTLED_LIMIT = 5;
 const ANCHOR_BUDGET = 2500;
 
 export async function compactionAnchor(limit = 12): Promise<string> {
-  const mems = (await loadAll()).filter(isActive);
+  // Repo-scoped (issue #8): model-facing reads see this repo + global rows.
+  const mems = visibleHere((await loadAll()).filter(isActive));
   if (!mems.length) return "";
   const byNewest = (a: Memory, b: Memory) => (a.ts < b.ts ? 1 : a.ts > b.ts ? -1 : 0);
   const open = mems
@@ -218,7 +222,8 @@ export async function contextualPull(input: PullInput, output: PullOutput): Prom
   if (!["grep", "glob", "read"].includes(tool)) return;
   const term = argText(input.args);
   if (!term) return;
-  const mems = (await loadAll()).filter(isActive);
+  // Repo-scoped (issue #8): model-facing reads see this repo + global rows.
+  const mems = visibleHere((await loadAll()).filter(isActive));
   const top = scoreMemories(term, mems, 3);
   if (!top.length) return;
   const block = top.map(formatMemory).join("\n");

package/src/memory.ts

@@ -5,6 +5,7 @@
 import { existsSync } from "node:fs";
 import { join, basename } from "node:path";
 import { memoryRoot, deletionsFile, snapshotDir } from "./config.ts";
+import { repoScope } from "./repokey.ts";
 import { appendLog, ensureDir, formatLine, parseLine, readLines } from "./logfmt.ts";
 import { blockedTs } from "./blocklist.ts";
 
@@ -28,6 +29,12 @@ export interface Memory {
   superseded_by?: string;
   reason?: string;
   status?: MemoryStatus;
+  // Origin repo (issue #8): sha1 of the normalized origin URL, the toplevel
+  // path when the repo had no remote, the literal "global" for cross-project
+  // writes, or absent for legacy/viewer rows — all three read as described
+  // in isVisibleHere().
+  repo?: string;
+  repoPath?: string;
   file: string;
   index: number;
 }
@@ -39,12 +46,36 @@ const RESERVED = new Set([
   "blocklist.logfmt",
 ]);
 
+// Row identity is `ts`: supersede chains, the blocklist, undo matching, and
+// the viewer's action buttons all key off it (issue #15). A row whose ts is
+// not an ISO instant must never become an addressable live row — readers
+// treat it as malformed: skipped, counted, warned once per file. The shape
+// check lives here (the store knows its schema); logfmt stays a dumb parser.
+const ISO_TS_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$/;
+let malformedRows = 0;
+const malformedWarnedFiles = new Set<string>();
+
+/** Rows skipped as malformed by the most recent store read (approximate, in-process). */
+export function malformedCount(): number {
+  return malformedRows;
+}
+
 function toMemory(fields: Record<string, unknown>, file: string, index: number): Memory | null {
   const ts = fields.ts;
   const type = fields.type;
   const scope = fields.scope;
   if (typeof ts !== "string" || typeof type !== "string") return null;
   if (typeof scope !== "string") return null;
+  if (!ISO_TS_RE.test(ts) || Number.isNaN(Date.parse(ts))) {
+    malformedRows++;
+    if (!malformedWarnedFiles.has(file)) {
+      malformedWarnedFiles.add(file);
+      console.warn(
+        `[memory] malformed row skipped in ${file} (ts is not an ISO instant): ${JSON.stringify(ts.slice(0, 48))}`,
+      );
+    }
+    return null;
+  }
   return {
     ts,
     type,
@@ -56,6 +87,8 @@ function toMemory(fields: Record<string, unknown>, file: string, index: number):
     reason: typeof fields.reason === "string" ? fields.reason : undefined,
     status:
       fields.status === "open" || fields.status === "settled" ? fields.status : undefined,
+    repo: typeof fields.repo === "string" ? fields.repo : undefined,
+    repoPath: typeof fields.repoPath === "string" ? fields.repoPath : undefined,
     file,
     index,
   };
@@ -76,6 +109,7 @@ export async function memoryFiles(): Promise<string[]> {
 }
 
 export async function loadAll(): Promise<Memory[]> {
+  malformedRows = 0; // per-load telemetry: the most recent read wins
   const blocked = await blockedTs();
   const out: Memory[] = [];
   for (const file of await memoryFiles()) {
@@ -89,7 +123,9 @@ export async function loadAll(): Promise<Memory[]> {
 }
 
 export async function loadScope(scope: string): Promise<Memory[]> {
-  return (await loadAll()).filter((m) => m.scope === scope);
+  // Gate dedup/stale reads are repo-scoped: a row from another repo must not
+  // collapse or supersede a write here (issue #8).
+  return (await loadAll()).filter((m) => m.scope === scope && isVisibleHere(m));
 }
 
 export interface AppendMemoryInput {
@@ -99,6 +135,11 @@ export interface AppendMemoryInput {
   issue?: string;
   tags?: string[];
   status?: MemoryStatus;
+  // "global" for explicit cross-project writes; imports carry the row's own
+  // origin stamp (hash survives the machine hop — see repokey.ts). Any other
+  // value is resolved by appendMemory against the live repo scope.
+  repo?: string;
+  repoPath?: string;
 }
 
 // Existing ts values across all memory files, used to guarantee uniqueness of
@@ -130,6 +171,18 @@ export async function appendMemory(input: AppendMemoryInput): Promise<string> {
   while (taken.has(ts) && guard++ < 1000) {
     ts = new Date(new Date(ts).getTime() + 1).toISOString();
   }
+  // Repo stamp (issue #8) at the single write choke point: gated writes,
+  // viewer restores and edits all pass through here. Explicit "global"
+  // survives; an unscoped process (viewer) stamps nothing = global.
+  let repo = input.repo;
+  let repoPath = input.repoPath;
+  if (repo === undefined) {
+    const cur = repoScope();
+    if (cur) {
+      repo = cur.key;
+      repoPath = cur.path;
+    }
+  }
   const file = join(memoryRoot(), `${ts.split("T")[0]}.logfmt`);
   await appendLog(
     file,
@@ -141,6 +194,8 @@ export async function appendMemory(input: AppendMemoryInput): Promise<string> {
       issue: input.issue,
       tags: input.tags?.length ? input.tags.join(",") : undefined,
       status: input.status,
+      repo,
+      repoPath,
     }),
   );
   return ts;
@@ -333,7 +388,10 @@ export async function prune(scope: string, type: string, reason: string): Promis
     for (const line of lines) {
       const parsed = parseLine(line);
       const m = parsed ? toMemory(parsed, file, 0) : null;
-      if (m && m.scope === scope && m.type === type) {
+      // Repo floor (issue #8): forgetting scope X here must never delete
+      // another repo's row for scope X — same basename collisions are real
+      // (a fork next to its upstream).
+      if (m && m.scope === scope && m.type === type && isVisibleHere(m)) {
         deleted.push({ memory: m, reason });
         await logDeletion(m, reason);
         changed = true;
@@ -349,3 +407,21 @@ export async function prune(scope: string, type: string, reason: string): Promis
 export function isActive(m: Memory): boolean {
   return !m.superseded_by;
 }
+
+// The ONLY repo filter the model-facing paths use (injection sinks, recall,
+// list, update targeting, prune, decay, gate scope reads). A row is visible
+// when it is global (explicit marker OR no stamp — legacy rows and writes by
+// processes with no scope, e.g. the viewer), or was written in this repo.
+// Keeping it one predicate is what stops the filtering from drifting between
+// entry points the way pre-zod validation did.
+export function isVisibleHere(m: Memory): boolean {
+  if (!m.repo || m.repo === "global") return true;
+  const cur = repoScope();
+  if (!cur) return true; // unscoped process: no partitioning
+  return m.repo === cur.key || (!!m.repoPath && m.repoPath === cur.path);
+}
+
+// Rows visible to the current process (active filtering stays with callers).
+export function visibleHere(mems: Memory[]): Memory[] {
+  return mems.filter(isVisibleHere);
+}

package/src/portable.ts

@@ -5,7 +5,7 @@
 // moat. Decay is supersede-not-delete and snapshot-first, mirroring prune.
 import { join } from "node:path";
 import { memoryRoot } from "./config.ts";
-import { isActive, loadAll, type Memory } from "./memory.ts";
+import { isActive, isVisibleHere, loadAll, type Memory } from "./memory.ts";
 import { TYPES } from "./types.ts";
 import type { WriteCandidate } from "./gates.ts";
 
@@ -45,6 +45,10 @@ export async function exportMemories(opts: ExportOptions = {}): Promise<ExportRe
       status: m.status,
       tags: m.tags,
       issue: m.issue,
+      // Origin stamps ride along so scoping survives the machine hop (the
+      // repo key is a remote-URL hash; the path is the secondary match).
+      repo: m.repo,
+      repoPath: m.repoPath,
     }),
   );
   await Bun.write(path, lines.length ? lines.join("\n") + "\n" : "");
@@ -79,6 +83,11 @@ function parseRow(line: string): WriteCandidate | null {
   if (r.status === "open" || r.status === "settled") c.status = r.status;
   if (Array.isArray(r.tags) && r.tags.every((t) => typeof t === "string")) c.tags = r.tags;
   if (typeof r.issue === "string" && r.issue) c.issue = r.issue;
+  // Origin stamps survive an export/import hop (repokey.ts): a row written
+  // for repo X stays visible only where repo X is opened, even on a new
+  // machine. Unstamped rows stay global.
+  if (typeof r.repo === "string" && r.repo) c.repo = r.repo;
+  if (typeof r.repoPath === "string" && r.repoPath) c.repoPath = r.repoPath;
   return c;
 }
 
@@ -116,6 +125,8 @@ export async function importMemories(
 export async function findStaleOpen(days: number): Promise<Memory[]> {
   const cutoff = new Date(Date.now() - days * 86_400_000).toISOString();
   return (await loadAll())
-    .filter((m) => isActive(m) && m.status === "open" && m.ts < cutoff)
+    // Decay is repo-scoped (issue #8): running it here must not retire
+    // another repo's open threads.
+    .filter((m) => isActive(m) && isVisibleHere(m) && m.status === "open" && m.ts < cutoff)
     .sort((a, b) => (a.ts < b.ts ? -1 : a.ts > b.ts ? 1 : 0));
 }

package/src/repokey.ts

@@ -0,0 +1,66 @@
+// Repo identity for memory scoping (issue #8). One plugin process serves one
+// workspace, so the scope resolves ONCE at setup; every store write stamps
+// it and every model-facing read filters by it.
+//
+// Two keys, both cheap, with opposite failure modes:
+//   key  — sha1 of the normalized origin URL: survives re-clone, moves, and
+//          export/import to another machine. Absent when the repo has no
+//          origin (fresh or remote-less), where the path is used as the key.
+//   path — resolved git toplevel: the secondary match, so rows stamped
+//          before an origin was added keep recognizing their repo.
+// Rows carry no stamp when their writer had no scope (viewer process,
+// tests) and legacy rows predate the field: both read as GLOBAL — visible
+// everywhere — which keeps every upgrade non-breaking.
+import { createHash } from "node:crypto";
+
+export interface RepoScope {
+  key: string;
+  path: string;
+}
+
+let current: RepoScope | null = null;
+
+export function setRepoScope(scope: RepoScope | null): void {
+  current = scope;
+}
+
+export function repoScope(): RepoScope | null {
+  return current;
+}
+
+// git@github.com:Owner/Repo.git / https://GitHub.com/owner/repo/ ->
+// github.com/owner/repo — the same repo must hash identically whichever
+// remote form (and case) the clone used.
+export function normalizeRemote(url: string): string {
+  let u = url.trim().toLowerCase();
+  u = u.replace(/^(?:https?:\/\/|ssh:\/\/|git:\/\/)/, "");
+  u = u.replace(/^git@/, "");
+  u = u.replace(/\/$/, "");
+  u = u.replace(/\.git$/, "");
+  // scp-style "github.com:owner/repo" -> slash form, so every transport of
+  // one repo hashes to one id. (First colon only; URL ports in remotes are
+  // rarer than the scp form and merely produce a stable different id.)
+  u = u.replace(":", "/");
+  return u;
+}
+
+function git(args: string[], cwd: string): string | null {
+  try {
+    const p = Bun.spawnSync(args, { cwd, stdout: "pipe", stderr: "ignore" });
+    const out = p.stdout?.toString().trim();
+    return p.exitCode === 0 && out ? out : null;
+  } catch {
+    return null;
+  }
+}
+
+// Resolve the current repo from any start dir (never throws; a non-git dir
+// simply scopes by its own path).
+export function resolveRepo(startDir: string): RepoScope {
+  const path = git(["git", "rev-parse", "--show-toplevel"], startDir) ?? startDir;
+  const remote = git(["git", "remote", "get-url", "origin"], path);
+  const key = remote
+    ? createHash("sha1").update(normalizeRemote(remote)).digest("hex").slice(0, 12)
+    : path;
+  return { key, path };
+}

package/src/resolver.ts

@@ -116,7 +116,11 @@ export function extractCallForms(content: string): CallForm[] {
   return forms;
 }
 
-const PATH_RE = /[A-Za-z0-9_@./-]+\.(?:ts|tsx|js|jsx|mjs|cjs)(?::\d+)?/g;
+// The extension must end the name: without the lookahead `Button.tsx` matched
+// as `Button.ts` and `config.json` as `config.js`, and the existence check then
+// blocked real files. `.tsx.snap` and `.js.map` are other files, not refs; a
+// sentence-ending `.` still ends the ref.
+const PATH_RE = /[A-Za-z0-9_@./-]+\.(?:ts|tsx|js|jsx|mjs|cjs)(?!\w|\.\w)(?::\d+)?/g;
 
 export function extractPathRefs(content: string): string[] {
   if (content.length > REGEX_SCAN_MAX_CHARS) return [];

package/src/schema.ts

@@ -0,0 +1,211 @@
+// Input-boundary schemas (issue #15's sibling work; zod verdict from the
+// 2026-10-21 security review). ONE definition per boundary serves both sides:
+// the JSON Schema handed to the host/model is GENERATED from these zod
+// schemas, and every raw tool call / viewer POST is re-parsed through them
+// before touching any business logic. Keeping a hand-written wire schema next
+// to a runtime validator would just recreate the drift surface zod removes.
+//
+// Scope — shape, not meaning:
+//   * Numbers coerce (z.coerce.number): `limit: "20"` means 20, and stringified
+//     numerics already worked downstream, so coercion is strictly non-breaking.
+//   * Booleans and strings stay strict. z.coerce.boolean() is JS Boolean() —
+//     "false" would coerce to TRUE, silently flipping a dry run into a
+//     mutation; a rejected call gets a clear error the model can fix instead.
+//   * Nothing here validates semantics (a well-shaped lie still passes) —
+//     that is what the 4-gate pipeline is for.
+//   * Store reads deliberately do NOT use zod: they get a plain ISO-instant
+//     check in memory.ts (row identity, issue #15), where the row schema lives.
+import { z, type ZodTypeAny } from "zod";
+import { STATUSES, TYPES } from "./types.ts";
+
+type JSONSchema = Record<string, unknown>;
+
+/** Row identity anywhere it arrives off a boundary: an ISO instant. */
+export const isoTs = z.iso.datetime();
+
+// ---- tool argument schemas (JSON Schema generated from these) ------------
+
+export const RememberArgs = z.object({
+  type: z.enum(TYPES).describe("Type of memory"),
+  scope: z.string().describe("Scope/area (e.g., auth, api, ctl)"),
+  content: z.string().describe("The memory content"),
+  issue: z.string().describe("Related issue").optional(),
+  tags: z.array(z.string()).optional(),
+  status: z
+    .enum(STATUSES)
+    .describe(
+      "open = live planning thread / frontier (surfaced at session start); settled or omitted = durable knowledge",
+    )
+    .optional(),
+  global: z
+    .boolean()
+    .describe(
+      "Store cross-project (visible in every repo): user preferences and general tooling habits. Default false = the memory belongs to THIS repo.",
+    )
+    .optional(),
+});
+
+export const InitArgs = z.object({
+  force: z.boolean().describe("Re-run even if initialized (refresh after drift)").optional(),
+  mode: z
+    .enum(["fast", "moderate", "full"])
+    .describe("codebase-memory index mode (default moderate)")
+    .optional(),
+});
+
+export const RecallArgs = z.object({
+  scope: z.string().optional(),
+  type: z.enum(TYPES).optional(),
+  query: z.string().optional(),
+  limit: z.coerce.number().optional(),
+});
+
+export const UpdateArgs = z.object({
+  scope: z.string(),
+  type: z.enum(TYPES),
+  content: z.string(),
+  query: z
+    .string()
+    .describe(
+      "Row selector: id (ts), clock fragment, or unique content substring. Omit to target the newest active row of scope+type.",
+    )
+    .optional(),
+  status: z.enum(STATUSES).optional(),
+});
+
+export const ForgetArgs = z.object({
+  scope: z.string(),
+  type: z.enum(TYPES),
+  reason: z.string().describe("Why this is being deleted (audit)"),
+});
+
+export const EmptyArgs = z.object({});
+
+export const UndoArgs = z.object({
+  list: z.boolean().describe("List snapshots").optional(),
+  snapshot: z
+    .string()
+    .describe("Snapshot to restore (bare name from list, or a full path)")
+    .optional(),
+  merge: z
+    .boolean()
+    .describe("With snapshot: keep rows written after the snapshot instead of refusing")
+    .optional(),
+  force: z
+    .boolean()
+    .describe("With snapshot: exact rollback even if the file changed since")
+    .optional(),
+});
+
+export const EvidenceArgs = z.object({
+  date: z.string().optional(),
+  ev: z.string().optional(),
+  limit: z.coerce.number().optional(),
+});
+
+export const MergeReviewArgs = z.object({
+  loser: z.string().describe("Evidence id of the rival/overlap write to supersede"),
+  survivor: z.string().describe("Evidence id of the canonical winning write"),
+  reason: z.string().describe("Why the survivor is canonical over the loser (written to evidence)"),
+});
+
+export const ExportArgs = z.object({
+  scope: z.string().describe("Only export memories in this exact scope").optional(),
+  file: z.string().describe("Destination path (default: <memory-root>/exports/)").optional(),
+});
+
+export const ImportArgs = z.object({
+  file: z.string().describe("Path to a .jsonl export file"),
+});
+
+export const DecayArgs = z.object({
+  olderThanDays: z
+    .coerce
+    .number()
+    .optional()
+    .meta({ default: 14 })
+    .describe("Age threshold in days (default 14)"),
+  // Strict boolean on purpose: only a real JSON false mutates. A string
+  // "false" is rejected with guidance, never coerced into `true` (see header).
+  dryRun: z
+    .boolean()
+    .optional()
+    .meta({ default: true })
+    .describe("Preview only (default true). Set false to actually supersede."),
+});
+
+// ---- viewer request bodies (the boundary here is the network) ------------
+// /api/restore is NOT here: its `name` grammar (basename + pinned regex) is
+// containment logic with its own regression tests, not a shape gate.
+
+export const EditBody = z.object({
+  ts: isoTs,
+  type: z.enum(TYPES),
+  scope: z.string().min(1),
+  content: z.string().min(1),
+  issue: z.string().optional(),
+  tags: z.array(z.string()).optional(),
+  // min NOT enforced here: the mutate layer owns the audit-reason contract
+  // (and its tests pin its message). Shape is the boundary's job only.
+  reason: z.string(),
+});
+
+export const DeleteBody = z.object({ ts: isoTs, reason: z.string() });
+export const BlockBody = z.object({ ts: isoTs, reason: z.string() });
+export const UnblockBody = z.object({ ts: isoTs });
+// The restore-entry hole (security review): unvalidated POSTs used to append
+// rows with empty type/scope/content — String(body.x ?? "") made anything fit.
+export const RestoreEntryBody = z.object({
+  type: z.enum(TYPES),
+  scope: z.string().min(1),
+  content: z.string().min(1),
+});
+
+// ---- wiring ---------------------------------------------------------------
+
+/**
+ * Generate the host-facing JSON Schema. Matches the pre-zod hand-written
+ * builders byte-for-byte modulo key order (test/boundaries.test.ts pins all
+ * 13 against a capture from main): $schema stripped, empty `required` kept.
+ */
+export function wire(schema: ZodTypeAny): JSONSchema {
+  const out = z.toJSONSchema(schema) as JSONSchema;
+  delete out.$schema;
+  out.required ??= [];
+  return out;
+}
+
+export interface ToolDef<S extends ZodTypeAny> {
+  name: string;
+  description: string;
+  options: { codemode: false };
+  execute(args: z.infer<S>): Promise<{ content: string }>;
+}
+
+/**
+ * Register a tool: wire schema from zod + runtime re-parse of raw args.
+ * A malformed call returns a self-describing error the model can act on —
+ * nothing was done — instead of throwing inside the host or coercing junk
+ * into the store.
+ */
+export function validated<S extends ZodTypeAny>(
+  schema: S,
+  def: ToolDef<S>,
+): ToolDef<S> & { input: JSONSchema } {
+  return {
+    ...def,
+    input: wire(schema),
+    async execute(raw: unknown): Promise<{ content: string }> {
+      const parsed = schema.safeParse(raw ?? {});
+      if (!parsed.success) {
+        const issues = parsed.error.issues.map(
+          (i) => `${i.path.join(".") || "(root)"}: ${i.message}`,
+        );
+        return {
+          content: `invalid arguments to ${def.name} — nothing was done: ${issues.join("; ")}`,
+        };
+      }
+      return def.execute(parsed.data);
+    },
+  };
+}

package/src/status.ts

@@ -22,6 +22,8 @@ export interface StoreCounts {
   superseded: number;
   open: number;
   scopes: number;
+  /** Rows skipped as malformed by the most recent store read (issue #15). */
+  malformed: number;
 }
 
 /**
@@ -309,7 +311,8 @@ export function renderMemoryReport(input: {
   out.push(
     "",
     "STORE",
-    `  ${store.active} active · ${store.superseded} superseded · ${store.open} open · ${store.scopes} scopes`,
+    `  ${store.active} active · ${store.superseded} superseded · ${store.open} open · ${store.scopes} scopes` +
+      (store.malformed ? ` · ${store.malformed} malformed (skipped; fix the ts= field or undo)` : ""),
   );
   out.push("", "Terminal (CLI/TUI) users: /memory opens this as a live panel; the footer shows a one-line badge.");
   return out.join("\n");

package/src/tui.tsx

@@ -285,7 +285,8 @@ function MemoryPanel(props: {
       <Show when={s()}>
         <text fg={context.theme.text.base}>
           {"  " + (s()?.store.active ?? 0) + " active · " + (s()?.store.superseded ?? 0) + " superseded · " +
-            (s()?.store.open ?? 0) + " open · " + (s()?.store.scopes ?? 0) + " scopes"}
+            (s()?.store.open ?? 0) + " open · " + (s()?.store.scopes ?? 0) + " scopes" +
+            ((s()?.store.malformed ?? 0) > 0 ? " · " + s()!.store.malformed + " malformed (skipped)" : "")}
         </text>
       </Show>
 

package/src/viewer/server.ts

@@ -6,6 +6,8 @@
 // I2: serves only file data; never writes into any repo.
 import { basename, join } from "node:path";
 import { serve, type Server } from "bun";
+import { z, type ZodTypeAny } from "zod";
+import { BlockBody, DeleteBody, EditBody, RestoreEntryBody, UnblockBody } from "../schema.ts";
 import { deletionsFile, memoryRoot, snapshotDir } from "../config.ts";
 import { blockedEntries } from "../blocklist.ts";
 import { listSnapshots, restoreSnapshot } from "../undo.ts";
@@ -194,48 +196,67 @@ async function loaded(): Promise<Record<string, unknown>> {
 
 async function route(req: Request, url: URL): Promise<Response> {
   if (req.method === "POST") {
-    const body = (await req.json().catch(() => ({}))) as Record<string, unknown>;
-    if (url.pathname === "/api/edit") return editRoute(body);
-    if (url.pathname === "/api/delete") return deleteRoute(body);
-    if (url.pathname === "/api/block") return blockRoute(body);
-    if (url.pathname === "/api/unblock") return unblockRoute(body);
-    if (url.pathname === "/api/restore-entry") return restoreEntryRoute(body);
-    if (url.pathname === "/api/restore") return restoreRoute(body);
+    const body: unknown = await req.json().catch(() => ({}));
+    if (url.pathname === "/api/edit") return parseWith(EditBody, body, editRoute);
+    if (url.pathname === "/api/delete") return parseWith(DeleteBody, body, deleteRoute);
+    if (url.pathname === "/api/block") return parseWith(BlockBody, body, blockRoute);
+    if (url.pathname === "/api/unblock") return parseWith(UnblockBody, body, unblockRoute);
+    if (url.pathname === "/api/restore-entry") return parseWith(RestoreEntryBody, body, restoreEntryRoute);
+    // /api/restore is deliberately NOT schema-parsed here: its name check is
+    // basename + pinned-grammar CONTAINMENT (issue #21), not a shape gate,
+    // and its regression tests pin that behavior.
+    if (url.pathname === "/api/restore") return restoreRoute(body as Record<string, unknown>);
   }
   return json({ error: "not found" }, 404);
 }
 
-async function editRoute(body: Record<string, unknown>): Promise<Response> {
+// Boundary shape check for POST routes (the restore-entry hole from the
+// 2026-10-21 review): the old `String(body.ts ?? "")` coercion made ANY junk
+// fit — ts:{} became "[object Object]" as a row identity, a missing content
+// appended an empty row. A malformed call now gets a clean 400; semantics
+// (which row, what for) stay with the mutate layer.
+function parseWith<S extends ZodTypeAny>(
+  schema: S,
+  body: unknown,
+  h: (data: z.infer<S>) => Response | Promise<Response>,
+): Response | Promise<Response> {
+  const p = schema.safeParse(body);
+  if (!p.success) {
+    return error(
+      `invalid request: ${p.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ")}`,
+      400,
+    );
+  }
+  return h(p.data);
+}
+
+async function editRoute(body: z.infer<typeof EditBody>): Promise<Response> {
   const r: MutationResult = await editMemory({
-    ts: String(body.ts ?? ""),
-    type: String(body.type ?? ""),
-    scope: String(body.scope ?? ""),
-    content: String(body.content ?? ""),
-    issue: typeof body.issue === "string" ? body.issue : undefined,
-    tags: Array.isArray(body.tags) ? (body.tags as string[]) : undefined,
-    reason: String(body.reason ?? ""),
+    ts: body.ts,
+    type: body.type,
+    scope: body.scope,
+    content: body.content,
+    issue: body.issue,
+    tags: body.tags,
+    reason: body.reason,
   });
   return json(r);
 }
 
-async function deleteRoute(body: Record<string, unknown>): Promise<Response> {
-  return json(await deleteMemory({ ts: String(body.ts ?? ""), reason: String(body.reason ?? "") }));
+async function deleteRoute(body: z.infer<typeof DeleteBody>): Promise<Response> {
+  return json(await deleteMemory({ ts: body.ts, reason: body.reason }));
 }
 
-async function blockRoute(body: Record<string, unknown>): Promise<Response> {
-  return json({ ts: await addBlock(String(body.ts ?? ""), String(body.reason ?? "")) });
+async function blockRoute(body: z.infer<typeof BlockBody>): Promise<Response> {
+  return json({ ts: await addBlock(body.ts, body.reason) });
 }
 
-async function unblockRoute(body: Record<string, unknown>): Promise<Response> {
-  return json({ unblocked: await removeBlock(String(body.ts ?? "")) });
+async function unblockRoute(body: z.infer<typeof UnblockBody>): Promise<Response> {
+  return json({ unblocked: await removeBlock(body.ts) });
 }
 
-async function restoreEntryRoute(body: Record<string, unknown>): Promise<Response> {
-  const t = await appendMemory({
-    type: String(body.type ?? ""),
-    scope: String(body.scope ?? ""),
-    content: String(body.content ?? ""),
-  });
+async function restoreEntryRoute(body: z.infer<typeof RestoreEntryBody>): Promise<Response> {
+  const t = await appendMemory({ type: body.type, scope: body.scope, content: body.content });
   return json({ restored: t });
 }