fix: close 6 data-integrity/correctness findings from Oracle audit wave 1

Three parallel read-only Oracle audits (transform cache-stability, data
integrity, workspaces security). Cache-stability core verified safe (6/6 replay
mechanisms). Six source-confirmed bugs fixed; two design questions banked to
.alfonso/oracle-loop-findings.md (NOT guessed).

1. Cheap-gate historian suppression (compartment-trigger.ts). With NO in-memory
   tail (post-restart / marker-drain lag), the trigger's cheap pre-gate used the
   scoped tagger floor for getTriggerTagTokenUpperBound. A collapsed floor above
   live eligible tags excluded their tokens → could falsely cheap-skip a needed
   historian fire (context overflow). Fix: use floor 0 for the bound when
   inMemoryTail is undefined (full active+dropped sum is still a valid upper
   bound, just looser; pre-boundary tags only inflate it). The inMemoryTail-
   present path is self-correcting (estimateUntaggedInMemoryTailUpperBound charges
   below-floor tags since coveredOwnerMessageIds is also floor-scoped). +test.

2. v22 backfill embedding loss (v22-deferred-backfill.ts). The legacy collision-
   merge path deleted a source memory row (FK-cascading its embedding) without
   transferring one to the survivor — same class as the live-path fix in 21ef95c,
   missed here. Fix: INSERT OR IGNORE the source embedding onto the target before
   delete. +test (real FK cascade under foreign_keys=ON).

3. migrate-session split-brain hardening (migrate-session.ts). (a) context.db
   BEGIN IMMEDIATE moved INSIDE the try with a txBegan guard so a throwing BEGIN
   (after OpenCode already committed) still compensates; rollback guarded so it
   can't mask the original error or skip compensation. (b) Refuse to apply when
   the OpenCode session row is missing (no half-migration). (c) Open context.db
   with PRAGMA foreign_keys=ON + busy_timeout=5000 — the CLI bypasses
   initializeDatabase, so without this the merge-delete leaves ORPHANED embeddings
   instead of cascading. +2 tests.

4. Dashboard category change didn't bump epoch (db.rs update_memory_category). A
   category edit is render- and visibility-changing (heading + workspace
   shared/non-shared flip) but only queued an m[1] "update" delta, leaving cached
   m[0] CAS-valid — a member session could keep receiving a now-non-shared foreign
   memory (or miss a now-shared one). Fix: bump member epochs (workspace fan-out
   inside the tx) like update_memory_status; no-op guard skips same-category;
   epoch-bump XOR delta. +1 test, existing test updated.

Gate: plugin 2168/0, CLI 179/0, dashboard rust 93+21+10+20/0, tsc+biome clean.

Author: ualtinok

packages/cli/src/commands/migrate-session.test.ts

@@ -452,4 +452,17 @@ describe("applyMigrateSession — memory actions", () => {
         expect(session.directory).toBe("/old/dir");
         expect(session.project_id).toBe("global");
     });
+
+    it("refuses to apply when the OpenCode session row is missing (no half-migration)", () => {
+        const { oc, ctx } = setup();
+        const plan = planMigrateSession(SID, "/home/u/benchmarks", makeDeps(oc, ctx));
+        // Session vanishes between plan and apply (e.g. deleted while we worked).
+        oc.prepare("DELETE FROM session WHERE id = ?").run(SID);
+        expect(() => applyMigrateSession(plan, "leave", makeDeps(oc, ctx))).toThrow(/not found/i);
+        // Context.db must be untouched — ownership stays on the source identity.
+        const ownership = ctx
+            .prepare("SELECT project_path FROM session_projects WHERE session_id = ?")
+            .get(SID) as { project_path: string };
+        expect(ownership.project_path).toBe(FROM);
+    });
 });

packages/cli/src/commands/migrate-session.ts

@@ -240,6 +240,14 @@ export function applyMigrateSession(
     const priorRow = deps.opencodeDb
         .prepare(`SELECT ${restoreCols.join(", ")} FROM session WHERE id = ?`)
         .get(plan.sessionId) as Record<string, string | null> | undefined;
+    // If the session row vanished between planning and applying (it shouldn't —
+    // the precondition is "OpenCode stopped"), refuse rather than mutate context
+    // for a session OpenCode no longer has and leave nothing to compensate with.
+    if (!priorRow) {
+        throw new Error(
+            `Session ${plan.sessionId} not found in opencode.db — aborting (is OpenCode still running, or was the session deleted?).`,
+        );
+    }
 
     deps.opencodeDb.exec("BEGIN IMMEDIATE");
     try {
@@ -248,7 +256,11 @@ export function applyMigrateSession(
             .run(...params, plan.sessionId);
         deps.opencodeDb.exec("COMMIT");
     } catch (error) {
-        deps.opencodeDb.exec("ROLLBACK");
+        try {
+            deps.opencodeDb.exec("ROLLBACK");
+        } catch {
+            // ignore — nothing committed yet, the throw below is what matters
+        }
         throw error;
     }
 
@@ -280,8 +292,13 @@ export function applyMigrateSession(
     let chunkEmbeddingsRestamped = 0;
     const epochsBumped: string[] = [];
 
-    deps.contextDb.exec("BEGIN IMMEDIATE");
+    // BEGIN is INSIDE the try: if it throws (e.g. DB locked), OpenCode is already
+    // committed, so we must still compensate. `txBegan` gates the rollback so we
+    // never ROLLBACK a transaction that never started.
+    let txBegan = false;
     try {
+        deps.contextDb.exec("BEGIN IMMEDIATE");
+        txBegan = true;
         // session_projects ownership → new identity (upsert).
         deps.contextDb
             .prepare(
@@ -351,9 +368,18 @@ export function applyMigrateSession(
 
         deps.contextDb.exec("COMMIT");
     } catch (error) {
-        deps.contextDb.exec("ROLLBACK");
-        // Context.db rolled back atomically; now undo the already-committed
-        // OpenCode move so the two databases stay consistent (no split-brain).
+        // Roll back context.db only if a transaction actually began, and never let
+        // a failing ROLLBACK mask the original error OR skip compensation.
+        if (txBegan) {
+            try {
+                deps.contextDb.exec("ROLLBACK");
+            } catch {
+                // ignore — compensation below is what keeps the two DBs consistent
+            }
+        }
+        // OpenCode was already committed; undo it so the two databases stay
+        // consistent (no split-brain). Runs for ANY post-OpenCode-commit failure,
+        // including a BEGIN that never started a transaction.
         compensateOpenCode();
         throw error;
     }
@@ -481,6 +507,18 @@ export async function runMigrateSessionCli(args: string[]): Promise<number> {
     const contextDbPath = defaultContextDbPath();
     const opencodeDb = new Database(opencodeDbPath);
     const contextDb = new Database(contextDbPath);
+    // This CLI opens context.db directly (bypassing initializeDatabase), so the
+    // pragmas the plugin normally sets are absent. foreign_keys=ON is REQUIRED:
+    // the collision-merge path (rekeyMemoryRowWithCollisionMerge) relies on
+    // memory_embeddings FK-cascading when a source memory row is deleted — without
+    // it, deletes leave ORPHANED embedding rows. busy_timeout avoids instant-fail
+    // if a plugin process touches the shared DB during the move.
+    try {
+        contextDb.exec("PRAGMA foreign_keys=ON");
+        contextDb.exec("PRAGMA busy_timeout=5000");
+    } catch {
+        // best-effort; the move's own transactions are the real safety net
+    }
     try {
         const deps = realDeps(opencodeDb, contextDb);
         const plan = planMigrateSession(sessionId, expandedTo, deps);

packages/dashboard/src-tauri/src/db.rs

@@ -2868,14 +2868,20 @@ pub fn update_memory_category(
     // Phase A: resolve the target row before opening a write transaction.
     let target = lookup_memory_mutation_target(conn, memory_id)?;
 
-    // Phase B: re-check the target row, mutate, and queue once.
+    // No-op guard: changing a memory to its current category must NOT bump any
+    // epoch (that would force a needless hard fold across every workspace member).
+    if target.category.as_deref() == Some(new_category) {
+        return Ok(());
+    }
+
+    // Phase B: re-check the target row, mutate, and bump epochs once.
     let tx = conn.transaction_with_behavior(TransactionBehavior::Immediate)?;
     verify_memory_project_path_unchanged(&tx, memory_id, &target.project_path)?;
 
-    let (content, normalized_hash): (String, String) = tx.query_row(
-        "SELECT content, normalized_hash FROM memories WHERE id = ?1",
+    let normalized_hash: String = tx.query_row(
+        "SELECT normalized_hash FROM memories WHERE id = ?1",
         params![memory_id],
-        |row| Ok((row.get(0)?, row.get(1)?)),
+        |row| row.get(0),
     )?;
 
     // Pre-check the UNIQUE(project_path, category, normalized_hash) constraint
@@ -2903,15 +2909,17 @@ pub fn update_memory_category(
         params![new_category, now_millis(), memory_id],
     )?;
 
-    queue_memory_mutation(
-        &tx,
-        &target.project_path,
-        "update",
-        memory_id,
-        None,
-        Some(new_category),
-        Some(&content),
-    )?;
+    // A category change is visibility- AND render-changing: it alters the heading
+    // a memory renders under in <project-memory>, and (in a workspace) can flip a
+    // foreign memory between shared and non-shared. Both change m[0] bytes, so bump
+    // member epochs to force a hard fold — exactly like update_memory_status. The
+    // hard fold re-renders m[0] from true memory state, so we do NOT also queue an
+    // m[1] "update" delta (epoch-bump XOR delta, matching the status path). Fan-out
+    // is resolved INSIDE the write tx so a concurrent add-member can't miss it.
+    let project_identity = normalize_stored_project_path(&target.project_path);
+    let epoch_bump_identities =
+        crate::workspaces::workspace_member_identities_for_project(&tx, &project_identity)?;
+    crate::workspaces::bump_epochs_for_identities(&tx, &epoch_bump_identities)?;
 
     tx.commit()?;
     Ok(())

packages/dashboard/src-tauri/tests/db_mutations.rs

@@ -702,17 +702,33 @@ fn test_update_memory_category_success() {
         .expect("get category");
     assert_eq!(category, "NAMING");
 
-    // Verify mutation log row is written
-    assert_eq!(
-        mutation_log_rows(&conn),
-        vec![(
-            "git:project-a".to_string(),
-            "update".to_string(),
-            id,
-            Some("NAMING".to_string()),
-            Some("memory for git:project-a".to_string()),
-        )]
-    );
+    // A category change is render- AND visibility-changing (heading + workspace
+    // shared/non-shared flip), so it bumps the epoch to force a hard fold and
+    // writes NO m[1] mutation-log row (epoch-bump XOR delta, like status changes).
+    assert_eq!(memory_epoch(&conn, "git:project-a"), 12);
+    assert_eq!(mutation_log_rows(&conn), vec![]);
+}
+
+#[test]
+fn update_memory_category_noop_does_not_bump_epoch() {
+    // Changing a memory to its CURRENT category must not bump any epoch (that
+    // would force a needless hard fold across every workspace member).
+    let mut conn = make_db();
+    let id = insert_memory(&conn, "git:project-a", "active");
+    // Re-setting a memory to its existing category must be a no-op.
+    let current: String = conn
+        .query_row(
+            "SELECT category FROM memories WHERE id = ?1",
+            params![id],
+            |row| row.get(0),
+        )
+        .expect("get category");
+    seed_project_state(&conn, "git:project-a", 5, 0);
+
+    db::update_memory_category(&mut conn, id, &current).expect("noop category update");
+
+    assert_eq!(memory_epoch(&conn, "git:project-a"), 5);
+    assert_eq!(mutation_log_rows(&conn), vec![]);
 }
 
 #[test]

packages/plugin/src/features/magic-context/v22-deferred-backfill.test.ts

@@ -179,6 +179,45 @@ describe("runDeferredV22Backfill", () => {
         expect(unresolved.count).toBe(0);
     });
 
+    test("collision-merge preserves the source row's embedding on the survivor (no FK-cascade loss)", async () => {
+        // Regression: when a legacy source row carrying an embedding collides with
+        // an existing target row that has NONE, the merge deletes the source —
+        // FK-cascading its embedding away. Without the INSERT OR IGNORE transfer,
+        // the survivor would be left unembedded (silent vector loss). The DB is
+        // initialized with foreign_keys=ON, so the cascade is real here.
+        const database = makeDb();
+        const targetId = insertMemory(database, "/proj/canonical", "dup-hash");
+        const sourceId = insertMemory(database, "/proj/symlinked", "dup-hash");
+        // Only the SOURCE (later-deleted) row has an embedding.
+        database
+            .prepare(
+                "INSERT INTO memory_embeddings (memory_id, embedding, model_id) VALUES (?, ?, 'm')",
+            )
+            .run(sourceId, new Uint8Array([1, 2, 3, 4]));
+
+        const summary = await runDeferredV22Backfill(database, {
+            resolveIdentity: () => "git:sharedidentity",
+            yieldToEventLoop: async () => {},
+        });
+
+        expect(summary.status).toBe("completed");
+        // Source row gone; survivor is the earlier (target) row. (.get() returns
+        // null on node:sqlite / undefined on bun:sqlite for a missing row.)
+        expect(
+            database.prepare("SELECT id FROM memories WHERE id = ?").get(sourceId) ?? null,
+        ).toBeNull();
+        // The survivor must now carry the adopted embedding — not lost to cascade.
+        const surviving = database
+            .prepare("SELECT COUNT(*) AS c FROM memory_embeddings WHERE memory_id = ?")
+            .get(targetId) as { c: number };
+        expect(surviving.c).toBe(1);
+        // And no orphaned embedding rows remain anywhere.
+        const total = database.prepare("SELECT COUNT(*) AS c FROM memory_embeddings").get() as {
+            c: number;
+        };
+        expect(total.c).toBe(1);
+    });
+
     test("concurrent project_path mutation is a guarded no-op", async () => {
         const database = makeDb();
         const rowId = insertMemory(database, "/race", "race");

packages/plugin/src/features/magic-context/v22-deferred-backfill.ts

@@ -295,6 +295,16 @@ export async function runDeferredV22Backfill(
                  LIMIT 1`,
             );
             const bumpSeenCount = db.prepare("UPDATE memories SET seen_count = ? WHERE id = ?");
+            // Preserve an embedding on the surviving target BEFORE the source row's
+            // embedding FK-cascades away on DELETE. Same fix as the live
+            // collision-merge path (rekeyMemoryRowWithCollisionMerge): the two rows
+            // are content-equivalent (same category + normalized_hash), so either
+            // vector is valid; INSERT OR IGNORE keeps the target's if it has one,
+            // adopts the source's otherwise — so a merged row never loses its vector.
+            const preserveEmbedding = db.prepare(
+                `INSERT OR IGNORE INTO memory_embeddings (memory_id, embedding, model_id)
+                 SELECT ?, embedding, model_id FROM memory_embeddings WHERE memory_id = ?`,
+            );
             const deleteMemoryRow = db.prepare("DELETE FROM memories WHERE id = ?");
 
             for (const row of resolvedRows) {
@@ -312,6 +322,7 @@ export async function runDeferredV22Backfill(
                     if (mergedSeen !== (collision.seen_count ?? 1)) {
                         bumpSeenCount.run(mergedSeen, collision.id);
                     }
+                    preserveEmbedding.run(collision.id, row.id);
                     deleteMemoryRow.run(row.id);
                     changedRows += 1;
                     changedIdentities.add(row.identity);

packages/plugin/src/hooks/magic-context/compartment-trigger.test.ts

@@ -276,6 +276,61 @@ describe("checkCompartmentTrigger", () => {
         expect(covered.partReads()).toBeGreaterThan(0);
     });
 
+    it("does NOT cheap-skip below-floor tags when inMemoryTail is undefined (no historian suppression)", () => {
+        // Regression: with NO in-memory tail (post-restart / marker-drain lag),
+        // the cheap-gate cannot account for below-floor tags via
+        // estimateUntaggedInMemoryTailUpperBound (that path needs the tail). If a
+        // collapsed floor sits ABOVE live eligible tags, a SCOPED bound would
+        // exclude their tokens → falsely cheap-skip a needed historian fire. The
+        // fix uses floor 0 for the bound when inMemoryTail is undefined, so the
+        // gate stays conservative and falls through to the authoritative path,
+        // which then fires on the meaningful eligible head.
+        useTempDataHome("compartment-trigger-belowfloor-undefined-tail-");
+        const sessionId = "ses-belowfloor-undefined";
+        // Big narratable eligible head (m-1..m-6) + protected tail (m-7..m-11).
+        createOpenCodeDb(sessionId, [
+            { id: "m-1", role: "user", text: "a ".repeat(3500) },
+            { id: "m-2", role: "assistant", text: "done" },
+            { id: "m-3", role: "user", text: "b ".repeat(3500) },
+            { id: "m-4", role: "assistant", text: "done" },
+            { id: "m-5", role: "user", text: "c ".repeat(3500) },
+            { id: "m-6", role: "assistant", text: "done" },
+            { id: "m-7", role: "user", text: "protected 1" },
+            { id: "m-8", role: "user", text: "protected 2" },
+            { id: "m-9", role: "user", text: "protected 3" },
+            { id: "m-10", role: "user", text: "protected 4" },
+            { id: "m-11", role: "user", text: "protected 5" },
+        ]);
+        const db = openDatabase();
+        // Tag the eligible head at LOW tag_numbers (1..3) carrying real tokens.
+        insertCoveredMessageTag(db, sessionId, "m-1", 1, 3500);
+        insertCoveredMessageTag(db, sessionId, "m-3", 2, 3500);
+        insertCoveredMessageTag(db, sessionId, "m-5", 3, 3500);
+
+        // Pass a taggerFloorOverride ABOVE every tag (simulating a collapsed
+        // floor) with NO in-memory tail. Pre-fix: the scoped bound excludes tags
+        // 1..3 (bound 0, nullCount 0) → cheap-skip → shouldFire:false (WRONG).
+        // Post-fix: floor 0 includes them → bound >> budget → fall through →
+        // tail_size fires on the eligible head.
+        const result = checkCompartmentTrigger(
+            db,
+            sessionId,
+            makeSessionMeta(sessionId, 25),
+            { percentage: 25, inputTokens: 50_000 },
+            25,
+            65,
+            1_000,
+            undefined,
+            undefined,
+            undefined,
+            undefined,
+            undefined, // inMemoryTail undefined — the regressing condition
+            10_000, // taggerFloorOverride well above the tags' numbers (1..3)
+        );
+
+        expect(result.shouldFire).toBe(true);
+    });
+
     it("falls through when the in-memory upper bound equals the trigger budget", () => {
         useTempDataHome("compartment-trigger-memory-equality-");
         const db = openDatabase();

packages/plugin/src/hooks/magic-context/compartment-trigger.ts

@@ -489,10 +489,21 @@ export function checkCompartmentTrigger(
             // sum is a uselessly-loose bound AND leaves nullCount stuck at the
             // legacy-row count forever (never backfilled), so the skip could never
             // trigger; scoping makes it a tight valid upper bound with nullCount≈0.
+            // When there IS an in-memory tail, the scoped floor is safe: any live
+            // tag sitting below the floor has its owner message in `inMemoryTail`
+            // and is NOT in the (also-floor-scoped) covered-owner set, so
+            // estimateUntaggedInMemoryTailUpperBound charges its true-raw tokens —
+            // nothing is lost. But with NO in-memory tail (post-restart /
+            // marker-drain lag) there is no such compensation: a scoped bound would
+            // silently DROP the tokens of any live tool tag below the floor and
+            // could falsely cheap-skip a needed historian fire (context overflow).
+            // So fall back to floor 0 here — the full active+dropped sum is still a
+            // valid UPPER bound (pre-boundary tags only inflate it), just looser.
+            const boundFloor = inMemoryTail ? taggerFloor : 0;
             const { bound: persistedBound, nullCount } = getTriggerTagTokenUpperBound(
                 db,
                 sessionId,
-                taggerFloor,
+                boundFloor,
             );
             if (nullCount === 0) {
                 const untaggedUpperBound = inMemoryTail