fix: close dashboard-backend findings from Oracle audit wave 5 (1 P0 + 5 P1/P2)

Three parallel read-only Oracles (Pi context-handler internals; dashboard Rust
backend; m[0]/m[1] cache-core). HEADLINE: the cache-core is verified SOUND — no
P0 history-loss or cache-hit replay leak (DEFER replay byte-stable, supersede-
delta + CAS correct, atomic paired persistence). The cache-core + Pi findings are
cache/migration-critical → banked for review (cache-stability-path rule). The
dashboard-Rust batch is fixed here.

P0:
- Project-identity fallback cache divergence (project_identity.rs). Rust cached a
  dir:<md5> fallback for a non-git dir FOREVER in-process; after the dir gets
  .git + first commit, TS re-resolves to git:<root> but Rust kept serving the
  stale dir: — so dashboard filters/writes could target the WRONG project's
  memories. Fixed: serve cached git: directly, but drop a cached dir: fallback the
  moment has_git_dir() is true and re-resolve (mirrors TS resolveProjectIdentity).
  Also: classify the pre-spawn dir check via fs::metadata so NotFound stays
  deterministic (cacheable) but PermissionDenied/other are transient (uncached).
  +regression test (no-git → git init+commit flips dir:→git: without cache clear).

P1:
- update_memory_status accepted arbitrary status strings (db.rs) — a malformed
  "archive" (vs "archived") would make a memory vanish from active/permanent/
  archived logic. Now reject anything outside the canonical set with a friendly
  error before touching the DB.
- Dream-queue dedup not atomic (db.rs — a regression in my own wave-3 enqueue
  dedup). dream_queue has no UNIQUE on project_path, so a DEFERRED check-then-
  insert let two concurrent "dream now" clicks both insert. enqueue_dream +
  delete_dream_queue_entry now take &mut Connection and run under BEGIN IMMEDIATE.
- Session-detail used p.worktree instead of s.directory (db.rs
  get_opencode_session_detail) — global-bucketed git sessions (worktree "/")
  mis-resolved identity and showed "/". Now derive identity/display/path from
  s.directory (worktree fallback), matching list_opencode_sessions.

P2:
- open_readwrite could CREATE an empty DB if the file vanished (db.rs) — violates
  the "dashboard never owns schema" boundary. Now open_with_flags(READ_WRITE |
  NO_MUTEX) without CREATE.

Banked (need review): cache-core taxonomy refinements (O: /ctx-flush SOFT
violation, Pi eager-clear, hard-fold expiry determinism), Pi v25 tool-owner
cutover P0 (M), dashboard workspace share-category viewer filter (N-P1, product
semantics). See .alfonso/oracle-loop-findings.md.

Gate: dashboard rust 93+21+11+20/0, cargo check + fmt clean.

Author: ualtinok

packages/dashboard/src-tauri/src/commands.rs

@@ -465,15 +465,15 @@ pub fn enqueue_dream(
     reason: String,
 ) -> Result<i64, String> {
     let path = state.get_db_path()?;
-    let conn = db::open_readwrite(&path).map_err(|e| e.to_string())?;
-    db::enqueue_dream(&conn, &project_path, &reason).map_err(|e| e.to_string())
+    let mut conn = db::open_readwrite(&path).map_err(|e| e.to_string())?;
+    db::enqueue_dream(&mut conn, &project_path, &reason).map_err(|e| e.to_string())
 }
 
 #[tauri::command(async)]
 pub fn delete_dream_queue_entry(state: State<'_, AppState>, id: i64) -> Result<usize, String> {
     let path = state.get_db_path()?;
-    let conn = db::open_readwrite(&path).map_err(|e| e.to_string())?;
-    db::delete_dream_queue_entry(&conn, id).map_err(|e| e.to_string())
+    let mut conn = db::open_readwrite(&path).map_err(|e| e.to_string())?;
+    db::delete_dream_queue_entry(&mut conn, id).map_err(|e| e.to_string())
 }
 
 // ── Log commands ────────────────────────────────────────────
@@ -683,7 +683,10 @@ pub async fn get_available_models() -> Vec<String> {
             list.push(format!("{}\\npm\\opencode.exe", appdata));
         }
         if !localappdata.is_empty() {
-            list.push(format!("{}\\Microsoft\\WinGet\\Links\\opencode.exe", localappdata));
+            list.push(format!(
+                "{}\\Microsoft\\WinGet\\Links\\opencode.exe",
+                localappdata
+            ));
         }
         if !userprofile.is_empty() {
             list.push(format!("{}\\scoop\\shims\\opencode.exe", userprofile));
@@ -777,7 +780,10 @@ pub fn parse_pi_models_output(text: &str) -> Vec<String> {
     for raw_line in strip_ansi_pi_output(text).lines() {
         let mut line = raw_line.trim().to_string();
         if line.starts_with('•') || line.starts_with('*') || line.starts_with('-') {
-            line = line.trim_start_matches(['•', '*', '-']).trim_start().to_string();
+            line = line
+                .trim_start_matches(['•', '*', '-'])
+                .trim_start()
+                .to_string();
         }
         if line.is_empty() || line.to_ascii_lowercase().contains("usage:") {
             continue;
@@ -825,7 +831,10 @@ pub async fn get_available_pi_models() -> Vec<String> {
             list.push(format!("{}\\npm\\pi.exe", appdata));
         }
         if !localappdata.is_empty() {
-            list.push(format!("{}\\Microsoft\\WinGet\\Links\\pi.exe", localappdata));
+            list.push(format!(
+                "{}\\Microsoft\\WinGet\\Links\\pi.exe",
+                localappdata
+            ));
         }
         if !userprofile.is_empty() {
             list.push(format!("{}\\scoop\\shims\\pi.exe", userprofile));
@@ -1128,7 +1137,13 @@ mod tests {
     fn test_pick_first_line() {
         assert_eq!(pick_first_line(""), None);
         assert_eq!(pick_first_line("   \n"), None);
-        assert_eq!(pick_first_line("C:\\bin\\opencode.exe\nC:\\other\\opencode.exe"), Some("C:\\bin\\opencode.exe".to_string()));
-        assert_eq!(pick_first_line("  C:\\bin\\opencode.exe  \n"), Some("C:\\bin\\opencode.exe".to_string()));
+        assert_eq!(
+            pick_first_line("C:\\bin\\opencode.exe\nC:\\other\\opencode.exe"),
+            Some("C:\\bin\\opencode.exe".to_string())
+        );
+        assert_eq!(
+            pick_first_line("  C:\\bin\\opencode.exe  \n"),
+            Some("C:\\bin\\opencode.exe".to_string())
+        );
     }
 }

packages/dashboard/src-tauri/src/db.rs

@@ -120,7 +120,14 @@ pub fn open_readonly(path: &PathBuf) -> Result<Connection, rusqlite::Error> {
 
 /// Opens a read-write connection for write operations (memory edits, queue entries).
 pub fn open_readwrite(path: &PathBuf) -> Result<Connection, rusqlite::Error> {
-    let conn = Connection::open(path)?;
+    // READ_WRITE WITHOUT CREATE: if the DB file vanished after startup,
+    // Connection::open would CREATE an empty SQLite file — violating the
+    // "dashboard never owns the schema" boundary. The plugin owns DB lifecycle;
+    // a missing file should error, not silently spawn a blank DB.
+    let conn = Connection::open_with_flags(
+        path,
+        rusqlite::OpenFlags::SQLITE_OPEN_READ_WRITE | rusqlite::OpenFlags::SQLITE_OPEN_NO_MUTEX,
+    )?;
     // busy_timeout MUST come before journal_mode=WAL: setting WAL can itself need
     // the file lock, and with the timeout installed last a cold-open under
     // contention fails immediately with SQLITE_BUSY instead of waiting.
@@ -2728,6 +2735,18 @@ pub fn update_memory_status(
     memory_id: i64,
     new_status: &str,
 ) -> Result<(), rusqlite::Error> {
+    // Reject any status outside the canonical set before touching the DB. A
+    // malformed call setting status="archive" (vs "archived") or any free string
+    // would make the memory vanish from active/permanent/archived logic with no
+    // valid epoch/delta interpretation.
+    if !matches!(new_status, "active" | "permanent" | "archived") {
+        return Err(rusqlite::Error::SqliteFailure(
+            rusqlite::ffi::Error::new(rusqlite::ffi::SQLITE_CONSTRAINT),
+            Some(format!(
+                "Invalid memory status '{new_status}' (expected active, permanent, or archived)."
+            )),
+        ));
+    }
     // Phase A: resolve the target row before opening a write transaction.
     let target = lookup_memory_mutation_target(conn, memory_id)?;
     // Any transition that CHANGES which memories enter or how they rank in the
@@ -2893,7 +2912,12 @@ pub fn update_memory_category(
             "SELECT id FROM memories
              WHERE project_path = ?1 AND category = ?2 AND normalized_hash = ?3 AND id != ?4
              LIMIT 1",
-            params![target.project_path, new_category, normalized_hash, memory_id],
+            params![
+                target.project_path,
+                new_category,
+                normalized_hash,
+                memory_id
+            ],
             |row| row.get(0),
         )
         .optional()?;
@@ -3198,7 +3222,11 @@ pub fn list_opencode_sessions(filter: &SessionFilter) -> Vec<SessionRow> {
         let last_activity_ms: i64 = row.get(5)?;
         // Prefer the session's real directory; fall back to the project worktree
         // only when the session row has no directory (legacy rows).
-        let effective_dir = if directory.is_empty() { &worktree } else { &directory };
+        let effective_dir = if directory.is_empty() {
+            &worktree
+        } else {
+            &directory
+        };
         let identity = resolve_project_identity(effective_dir);
         let is_subagent = subagent_map.get(&session_id).copied().unwrap_or(false);
         // Friendly label: the named project wins; otherwise the directory's
@@ -3459,6 +3487,7 @@ pub fn get_opencode_session_detail(
     let oc_conn = open_readonly(&opencode_db_path)?;
     let row = oc_conn.query_row(
         "SELECT s.id, COALESCE(s.title, ''), COALESCE(p.name, ''), COALESCE(p.worktree, ''),
+                COALESCE(s.directory, ''),
                 COALESCE(json_object('id', s.id, 'title', s.title, 'directory', s.directory), '{}')
          FROM session s LEFT JOIN project p ON p.id = s.project_id WHERE s.id = ?1",
         [session_id],
@@ -3469,12 +3498,22 @@ pub fn get_opencode_session_detail(
                 row.get::<_, String>(2)?,
                 row.get::<_, String>(3)?,
                 row.get::<_, String>(4)?,
+                row.get::<_, String>(5)?,
             ))
         },
     );
-    let Ok((session_id, title, project_name, worktree, data_json)) = row else {
+    let Ok((session_id, title, project_name, worktree, directory, data_json)) = row else {
         return Ok(None);
     };
+    // Prefer s.directory over p.worktree for identity/display: OpenCode buckets
+    // git-repo sessions that had no remote/commit at creation under the `global`
+    // project (worktree "/"), and the plugin keys identity off session.directory —
+    // using worktree here would mis-resolve and show "/". Worktree is the fallback.
+    let effective_dir = if directory.is_empty() {
+        worktree.clone()
+    } else {
+        directory
+    };
 
     // Cheap row counts for badge rendering. Both are O(rows-in-session) at
     // worst but use only INTEGER aggregates (no JSON extraction or part-table
@@ -3522,13 +3561,13 @@ pub fn get_opencode_session_detail(
         harness: Harness::Opencode,
         session_id,
         title,
-        project_identity: resolve_project_identity(&worktree),
+        project_identity: resolve_project_identity(&effective_dir),
         project_display: if project_name.is_empty() {
-            basename(&worktree)
+            basename(&effective_dir)
         } else {
             project_name
         },
-        project_path: (!worktree.is_empty()).then_some(worktree),
+        project_path: (!effective_dir.is_empty()).then_some(effective_dir),
         opencode_session_json: serde_json::from_str(&data_json).ok(),
         pi_jsonl_path: None,
         messages_count,
@@ -4377,7 +4416,7 @@ pub fn get_dream_runs(
 }
 
 pub fn enqueue_dream(
-    conn: &Connection,
+    conn: &mut Connection,
     project_path: &str,
     reason: &str,
 ) -> Result<i64, rusqlite::Error> {
@@ -4386,35 +4425,46 @@ pub fn enqueue_dream(
     // clicks pile up duplicate rows that a single identity-filtered host drains one
     // at a time. project_path is the resolved identity (the UI passes git:/dir:),
     // matching how hosts dequeue — a raw path would never be drained.
+    //
+    // The check + insert run under BEGIN IMMEDIATE: dream_queue has no UNIQUE on
+    // project_path, so a DEFERRED check-then-insert lets two concurrent clicks both
+    // pass the SELECT and insert duplicates. The writer lock serializes them.
     let identity = normalize_stored_project_path(project_path);
-    let existing: Option<i64> = conn
+    let tx = conn.transaction_with_behavior(TransactionBehavior::Immediate)?;
+    let existing: Option<i64> = tx
         .query_row(
             "SELECT id FROM dream_queue WHERE project_path = ?1 LIMIT 1",
             rusqlite::params![identity],
             |row| row.get(0),
         )
         .optional()?;
     if let Some(id) = existing {
+        tx.commit()?;
         return Ok(id);
     }
     let now = chrono::Utc::now().timestamp_millis();
-    conn.execute(
+    tx.execute(
         "INSERT INTO dream_queue (project_path, reason, enqueued_at) VALUES (?1, ?2, ?3)",
         rusqlite::params![identity, reason, now],
     )?;
-    Ok(conn.last_insert_rowid())
+    let id = tx.last_insert_rowid();
+    tx.commit()?;
+    Ok(id)
 }
 
 /// Delete a single dream-queue entry by id. Used to clear stale entries for
 /// projects with no active runner (e.g. a manual dashboard trigger for a project
 /// that is not currently loaded by any OpenCode/Pi host, so nothing ever
 /// dequeues it). Returns the number of rows removed (0 if the id was already
 /// gone — e.g. a runner picked it up between the list read and this call).
-pub fn delete_dream_queue_entry(conn: &Connection, id: i64) -> Result<usize, rusqlite::Error> {
-    conn.execute(
+pub fn delete_dream_queue_entry(conn: &mut Connection, id: i64) -> Result<usize, rusqlite::Error> {
+    let tx = conn.transaction_with_behavior(TransactionBehavior::Immediate)?;
+    let removed = tx.execute(
         "DELETE FROM dream_queue WHERE id = ?1",
         rusqlite::params![id],
-    )
+    )?;
+    tx.commit()?;
+    Ok(removed)
 }
 
 // ── User Memory types ───────────────────────────────────────
@@ -6052,7 +6102,10 @@ mod memory_project_filter_tests {
 
         let rows = enumerate_memory_projects(&conn).expect("enumerate");
         assert_eq!(rows.len(), 2);
-        assert_eq!(rows[0].identity, "dir:fedcba0987654321fedcba0987654321fedcba0987654321fedcba0987654321");
+        assert_eq!(
+            rows[0].identity,
+            "dir:fedcba0987654321fedcba0987654321fedcba0987654321fedcba0987654321"
+        );
         assert_eq!(rows[0].display_name, "dir:fedcba0987…");
         assert_eq!(rows[1].identity, "git:abc1234567890abcdef");
         assert_eq!(rows[1].display_name, "git:abc1234567…");

packages/dashboard/src-tauri/src/project_identity.rs

@@ -16,6 +16,13 @@ fn cache() -> &'static RwLock<HashMap<PathBuf, String>> {
     IDENTITY_CACHE.get_or_init(|| RwLock::new(HashMap::new()))
 }
 
+/// Whether a `.git` exists at `canonical` (worktree dir or a gitdir file/dir).
+/// Used to invalidate a cached `dir:` fallback once a repo appears — mirrors the
+/// TS resolver's `hasGitDir` re-resolve gate.
+fn has_git_dir(canonical: &Path) -> bool {
+    canonical.join(".git").exists()
+}
+
 /// Lexically resolve `input` against `cwd`, matching Node's `path.resolve` semantics.
 ///
 /// This intentionally does not touch the filesystem: no symlink resolution, no
@@ -98,9 +105,20 @@ pub fn resolve_project_identity_strict(directory: &Path) -> Result<String, Ident
     let canonical = logical_absolute(directory, &cwd);
 
     // If the cwd itself is missing, the git spawn would also return NotFound; distinguish
-    // that from a missing git binary before classifying the spawn error.
-    if !canonical.exists() {
-        return Err(IdentityErrorClass::PathInaccessible);
+    // that from a missing git binary before classifying the spawn error. Use
+    // metadata() (not exists(), which collapses ALL errors to false): a genuine
+    // NotFound is DETERMINISTIC (cacheable dir: fallback), but a PermissionDenied/
+    // other stat error is TRANSIENT and must NOT be cached (a retry could resolve
+    // the real git: identity once access is restored).
+    match std::fs::metadata(&canonical) {
+        Ok(_) => {}
+        Err(error) => {
+            return Err(match error.kind() {
+                std::io::ErrorKind::NotFound => IdentityErrorClass::PathInaccessible,
+                std::io::ErrorKind::PermissionDenied => IdentityErrorClass::PermissionDenied,
+                _ => IdentityErrorClass::Unknown,
+            });
+        }
     }
 
     let mut child = Command::new("git")
@@ -168,7 +186,24 @@ pub fn resolve_project_identity<P: AsRef<Path>>(directory: P) -> String {
 
     if let Ok(cache) = cache().read() {
         if let Some(identity) = cache.get(&canonical) {
-            return identity.clone();
+            // Serve a cached `git:` identity directly (stable once a repo exists).
+            // A cached `dir:` FALLBACK, however, must be dropped the moment a `.git`
+            // appears, so the identity can flip to the stable `git:<root>` — the
+            // common "scratch dir later `git init` + first commit" case. Without
+            // this re-resolve gate the dashboard pins the wrong `dir:` identity for
+            // the whole process and mis-groups the project (P0: it then reads/
+            // mutates the wrong project's memories). Mirrors TS resolveProjectIdentity.
+            if identity.starts_with("git:") || !has_git_dir(&canonical) {
+                return identity.clone();
+            }
+        }
+    }
+    // Cached fallback is stale (a repo appeared) — evict before re-resolving.
+    if let Ok(mut cache) = cache().write() {
+        if let Some(identity) = cache.get(&canonical) {
+            if identity.starts_with("dir:") && has_git_dir(&canonical) {
+                cache.remove(&canonical);
+            }
         }
     }