[saucam]

What this fixes

On a daemon shared by more than one tenant, conductor fleet tools and the search box could return other tenants' memory.
fleet_recall, fleet_find, and session.search with scope all searched every workspace in the memory store, which spans every tenant on the daemon.
fleet_find had the same hole as the two paths named in #415.

Now every search that spans workspaces is limited to the caller's tenant, and that limit is enforced in the memory store itself, not by each caller.
A workspace whose owner can't be proven is excluded from those searches.

Fixes #415.

What changes for users

• Shared daemons: one tenant's conductor and search no longer see another tenant's sessions, live or destroyed.
• Single-user daemons: cross-workspace search behaves as before for every session that still exists and for memory whose owner can be proven. On the maintainer's real store, 28 of 29 workspaces got an owner automatically. The remaining one (8 episodes from long-destroyed sessions) has no provable owner and stays out of cross-workspace search; per-workspace recall in its own directory is unchanged.
• One-time boot step: the first start after upgrading records each existing workspace's owner. It took 2.5 s on that store and logs what it did.
• Speed: cross-workspace keyword search runs in 1–16 ms on that store. An earlier draft of this fix made it 200–8000x slower; the reviews caught it and a query-plan test now guards it.

Review

Two independent audit rounds, each with a security reviewer and a correctness reviewer, all findings folded in:

• round 1 fixed the query-plan regression, made the backfill use the ids episodes actually carry, and stopped an older migration from handing a destroyed tenant's memory to a surviving one;
• round 2 made the backfill wait for that older migration, bounded and memoized the git probes it runs, kept probing to session workdirs and the user's home, and chunked a query under SQLite's parameter limit.

Full suite: 3709 pass / 0 fail. Typecheck and lint clean.

For agents: implementation

• memory/store.ts: new workspace_tenants (workspace_id PK, account_id, project_id) and memory_migrations. listWorkspaceIds(tenant) and ftsSearchGlobal(query, limit, tenant) join it; the FTS query uses CROSS JOIN so the FTS index drives (explainFtsSearchGlobal + plan test). registerWorkspaceTenant, isWorkspaceOwnedBy, listWorkspaceTenants.
• backfillWorkspaceTenants: one-time, waits until needsWorkspaceMigration() is false. Registers (a) episode-carried ids whose persisted sessions all share one tenant, excluding pre-tenant path ids, and (b) orphan ids only when workspaceIdFromPath(dir, tenant) reproduces them, for dirs under session workdirs or $HOME (≤400) and tenants from sessions plus local.
• migrateWorkspaceIdsToTenant no longer re-keys orphans (surviving sessions cannot prove a destroyed session's tenant), and skips a malformed row instead of aborting.
• workspaceIdFromPath refuses NUL in tenant parts; the git probe has a 5 s timeout and a per-directory cache.
• memory/engine.ts: recallGlobal requires tenant (throws without); searchSessions takes SearchSessionsScope — a workspace, or a tenant for cross-workspace; a workspace given with a tenant must belong to it; registerWorkspace.
• session.ts: registers its workspace at construction and retries before the next episode if that failed.
• fleet.ts: FleetDeps.tenant, used by fleet_find/fleet_recall. session-manager.ts: conductor + orchestrator deps set it; session.search passes the caller's tenant.
• server.ts: runs the backfill after the re-key migration, with local tenant and $HOME probe root.
• Not fixed here (pre-existing, documented in review): stores already migrated by the old orphan re-key may hold a destroyed tenant's episodes inside a surviving tenant's workspace; this PR does not widen who can read them.

🤖 Generated with Claude Code