fix: dreamer merge honors workspace per-category sharing inside a workspace (D1)

The dreamer is the cross-PROJECT merge superuser (#5971) — its merge loop
supersedes each source under its own identity and reconciles every affected
project's m[1]. That power is correct OUTSIDE a workspace. But inside a workspace,
per-category sharing is the user's explicit privacy boundary, and the visibility
check sat only inside the non-dreamer branch — so the dreamer could merge
(supersede) a FOREIGN member's memory in a NON-shared category (e.g. a workspace
sharing only CONSTRAINTS, dreamer merges a foreign ARCHITECTURE memory), crossing
that boundary.

Fix: when the caller IS the dreamer AND it's operating in a workspace
(identities.length > 1), gate merge sources on memoryVisibleToTool — own→always,
foreign-shared-category→ok, foreign-non-shared→blocked. Outside a workspace the
dreamer's cross-project merge is unchanged (#5971 intact; the existing
"merging across identities" test still passes). Mirrored in Pi.

+2 OpenCode tests (dreamer blocked on foreign non-shared; allowed on foreign
shared, both inside a workspace). A4 in AUDIT-KNOWN-ISSUES updated with the
workspace refinement.

Gate: plugin ctx-memory 42/0 (+2), Pi ctx-memory 11/0, Pi tsc clean.

Author: ualtinok

docs/AUDIT-KNOWN-ISSUES.md

@@ -54,13 +54,21 @@ path that seldom runs and whose bias is already the desired one. Accepted.
 held to the same visibility gate as `update`/`archive`: every source memory must
 pass `memoryVisibleToTool` (own project in any category, or a foreign workspace
 member only in a shared category). A primary agent cannot consolidate a memory it
-cannot see. The **dreamer** keeps the unrestricted cross-identity path — its merge
-loop supersedes each source under **its own** project identity and queues a
-per-project supersede-delta row, so every affected project's m[1] reconciles
+cannot see. The **dreamer** keeps the cross-identity path **outside a workspace** —
+its merge loop supersedes each source under **its own** project identity and queues
+a per-project supersede-delta row, so every affected project's m[1] reconciles
 (see the "merging across identities" test). The gate is the same one
 update/archive use; do not weaken `merge` back to a bare project-ownership check —
 that reintroduces the foreign-non-shared-category mutation hole.
 
+**Workspace refinement (D1):** *inside* a workspace, the dreamer ALSO honors the
+per-category sharing policy — a foreign member's memory in a non-shared category is
+off-limits even to the dreamer, because the policy is the user's explicit privacy
+boundary that the system's own consolidation worker must respect. Outside a
+workspace the dreamer's cross-project power is unchanged (#5971). The gate is
+`agent === DREAMER && workspaceIdentitySet.identities.length > 1 →
+memoryVisibleToTool(source)`. Mirrored in Pi `ctx-memory.ts`.
+
 ### A5. Re-observing a fact does not revive an archived memory
 
 `getMemoryByHash` does not filter by status, so when a fact whose prior instance

packages/pi-plugin/src/tools/ctx-memory.ts

@@ -484,6 +484,21 @@ export function createCtxMemoryTool(
 					if (inactive) {
 						return err(inactiveMemoryError(inactive.id, "merging"));
 					}
+				} else if (workspaceIdentitySet.identities.length > 1) {
+					// The dreamer keeps cross-PROJECT merge power (#5971) OUTSIDE a
+					// workspace, but INSIDE a workspace per-category sharing is the
+					// user's explicit privacy boundary the dreamer honors too: a
+					// foreign member's memory in a non-shared category is off-limits.
+					// memoryVisibleToTool already encodes own→true,
+					// foreign-shared→true, else→false. (Parity with OpenCode D1.)
+					const blocked = sourceMemories.find(
+						(memory) => !memoryVisibleToTool(memory),
+					);
+					if (blocked) {
+						return err(
+							`Error: Memory with ID ${blocked.id} is in a category not shared with this workspace member and cannot be merged.`,
+						);
+					}
 				}
 
 				// Schema-validated literal union — no runtime re-check needed.

packages/plugin/src/tools/ctx-memory/tools.test.ts

@@ -582,6 +582,77 @@ describe("createCtxMemoryTools", () => {
         expect(getMemoryById(db, foreignShared.id)?.status).toBe("archived");
     });
 
+    it("REFUSES a DREAMER merge of a foreign NON-shared-category memory INSIDE a workspace (D1)", async () => {
+        // The dreamer keeps cross-project merge OUTSIDE a workspace (#5971), but
+        // INSIDE a workspace the per-category sharing policy is the user's explicit
+        // privacy boundary the dreamer must honor too.
+        db.exec(`
+                INSERT INTO workspaces (id, name, created_at, updated_at, share_categories)
+                VALUES (1, 'ws', 1, 1, '["CONSTRAINTS"]');
+                INSERT INTO workspace_members (workspace_id, project_path, display_name, display_path, added_at)
+                VALUES (1, '/repo/project', 'Own', '/repo/project', 1),
+                       (1, '/repo/foreign', 'Foreign', '/repo/foreign', 1);
+            `);
+        const own = insertMemory(db, {
+            projectPath: "/repo/project",
+            category: "ARCHITECTURE",
+            content: "Own architecture detail D1.",
+        });
+        const foreignHidden = insertMemory(db, {
+            projectPath: "/repo/foreign",
+            category: "ARCHITECTURE", // foreign, NON-shared category
+            content: "Foreign architecture not shared with this workspace member.",
+        });
+
+        const result = await tools.ctx_memory.execute(
+            {
+                action: "merge",
+                ids: [own.id, foreignHidden.id],
+                content: "Merged architecture detail D1.",
+                category: "ARCHITECTURE",
+            },
+            toolContext("ses-dreamer", DREAMER_AGENT),
+        );
+
+        expect(result).toContain("not shared with this workspace member");
+        expect(getMemoryById(db, own.id)?.status).toBe("active");
+        expect(getMemoryById(db, foreignHidden.id)?.status).toBe("active");
+    });
+
+    it("ALLOWS a DREAMER merge of a foreign SHARED-category memory INSIDE a workspace (D1)", async () => {
+        db.exec(`
+                INSERT INTO workspaces (id, name, created_at, updated_at, share_categories)
+                VALUES (1, 'ws', 1, 1, '["CONSTRAINTS"]');
+                INSERT INTO workspace_members (workspace_id, project_path, display_name, display_path, added_at)
+                VALUES (1, '/repo/project', 'Own', '/repo/project', 1),
+                       (1, '/repo/foreign', 'Foreign', '/repo/foreign', 1);
+            `);
+        const own = insertMemory(db, {
+            projectPath: "/repo/project",
+            category: "CONSTRAINTS",
+            content: "Own constraint D1.",
+        });
+        const foreignShared = insertMemory(db, {
+            projectPath: "/repo/foreign",
+            category: "CONSTRAINTS", // shared
+            content: "Foreign constraint shared with the workspace.",
+        });
+
+        const result = await tools.ctx_memory.execute(
+            {
+                action: "merge",
+                ids: [own.id, foreignShared.id],
+                content: "Merged shared constraint D1.",
+                category: "CONSTRAINTS",
+            },
+            toolContext("ses-dreamer", DREAMER_AGENT),
+        );
+
+        expect(result).not.toContain("not shared");
+        expect(getMemoryById(db, own.id)?.status).toBe("archived");
+        expect(getMemoryById(db, foreignShared.id)?.status).toBe("archived");
+    });
+
     describe("#given update action", () => {
         it("updates a foreign workspace memory with duplicate checks and mutations under the target identity", async () => {
             db.exec(`

packages/plugin/src/tools/ctx-memory/tools.ts

@@ -503,6 +503,20 @@ function createCtxMemoryTool(deps: CtxMemoryToolDeps): ToolDefinition {
                     if (inactive) {
                         return inactiveMemoryError(inactive.id, "merging");
                     }
+                } else if (workspaceIdentitySet.identities.length > 1) {
+                    // The dreamer keeps its cross-PROJECT merge power (#5971) OUTSIDE
+                    // a workspace (the branch above leaves non-workspace dreamer
+                    // merges unrestricted). But INSIDE a workspace, per-category
+                    // sharing is the user's explicit privacy boundary that even the
+                    // system's own consolidation worker honors: a FOREIGN member's
+                    // memory in a non-shared category (or a non-member project's
+                    // memory) is off-limits. memoryVisibleToTool already encodes
+                    // exactly that for the workspace case (own → true,
+                    // foreign-shared-category → true, else → false).
+                    const blocked = sourceMemories.find((memory) => !memoryVisibleToTool(memory));
+                    if (blocked) {
+                        return `Error: Memory with ID ${blocked.id} is in a category not shared with this workspace member and cannot be merged.`;
+                    }
                 }
 
                 const category =