@@ -2772,3 +2772,35 @@ kill and reap the child so `Wait` cannot hang behind a full stdout pipe. Stderr
 capture retains at most **4 KiB** while continuing to drain. Regression fixtures
 cover both engines, direct runtime roots, aliases, broad globs, subprocess
 termination, source worktrees, and growth during a snapshot read.
+
+## Contextual memory bounds
+
+One ordinary post-turn extraction can add one memory claim. It keeps at most eight
+independent receipts per turn, each clipped to 2,000 runes, and eight metadata items
+of 240 runes each. The existing 512-rune memory body stays unchanged; rich source
+words and reasoning live in the canonical journal. Approved context and direct
+lexical fallback together take at most eight claims, within the existing 4,800-rune
+memory block. Local source revision queries get a two-second cancellation bound.
+Only clean tracked revisions establish current outcome evidence.
+
+Binding retrieval spends its bounded window on authority: approved rules and
+confirmed decisions are read through a partial index (`events_contextual_approved`)
+that holds only binding rows, so the newest-128 window is a seek over the rule
+count rather than a walk of the owner's evidence partition. A projection that asks
+for many memories' latest evidence does so in ONE indexed read per owner through
+`events_contextual_memory` (an expression index over the memory id), and the live
+guards (validity, memory suppression, source retirement, derivation ancestry and
+conditions) are answered for the whole candidate set in batched, owner-scoped
+reads rather than a query per row. The per-memory latest read is NOT windowed to a
+record count: a live rule whose newest evidence sits behind a burst of newer rows
+is still answered, so no hidden total-claim ceiling can drop it. Source suppression
+still checks the owner journal to avoid old-source resurrection, and the ancestry
+it walks is bounded by the candidates' derivation closure, not by a fixed count.
+Dependency projections inspect 128 events and return at most eight links/notices.
+Only successful full reads of files up to 64 KiB can establish an exact-path link.
+At most eight source reads per pass can establish eight edges. Consumer probes are
+bounded to eight producer/consumer pairs; they make no provider calls or edits.
+Exact duplicate settlement streams the active owner partition transactionally: its
+cost grows with that partition, rather than losing punctuation or older duplicates
+behind a retrieval ceiling. The canonical event journal is not periodically pruned;
+projection/context work is bounded, while durable history continues to grow.
@@ -125,7 +125,7 @@ func seedDemoHome(dir string, now time.Time) (builtHome, error) {
 	}
 	built.Standing = orders
 
-	memories, err := writeMemories(brain)
+	memories, err := writeMemories(brain, projects[firstProjectName].dir)
 	if err != nil {
 		return built, err
 	}
 
@@ -12,6 +12,7 @@ package main
 import (
 	"fmt"
 
+	"github.com/Agent-Field/codeaf/internal/gitidentity"
 	"github.com/Agent-Field/codeaf/internal/store"
 )
 
@@ -73,12 +74,29 @@ var demoMemories = []demoMemory{
 }
 
 // writeMemories puts every memory into the store and answers how many it wrote.
-func writeMemories(brain *store.Store) (int, error) {
+//
+// THE PROJECT ROWS CARRY A REAL OWNER. A scope word alone would land them in
+// the quarantine ([store.OwnerLegacyProject]) — the honest answer for a row
+// whose project nobody proved, and the wrong one for a fixture whose project
+// is sitting right there: the demo home would show its project shelf all
+// quarantined rows and never a live project memory. The key is minted the way
+// every session mints one, from the workspace itself, so the demo's memory is
+// visible exactly where the demo's conversations run.
+func writeMemories(brain *store.Store, projectDir string) (int, error) {
+	key, err := gitidentity.ProjectKey(projectDir)
+	if err != nil || key == "" {
+		return 0, fmt.Errorf("mint the demo project key: %w", err)
+	}
+	projectOwner := store.OwnerProject(key)
 	written := 0
 	for _, held := range demoMemories {
-		made, err := brain.AddMemory(held.memory)
+		memory := held.memory
+		if memory.Scope == store.MemoryScopeProject {
+			memory.Owner = projectOwner
+		}
+		made, err := brain.AddMemory(memory)
 		if err != nil {
-			return written, fmt.Errorf("remember %q: %w", held.memory.Title, err)
+			return written, fmt.Errorf("remember %q: %w", memory.Title, err)
 		}
 		// One call per count: the two counters are written together from one
 		// confirmation after a turn, and there is no door that sets them to a
 
@@ -23,6 +23,7 @@ import (
 	"github.com/Agent-Field/codeaf/internal/effort"
 	"github.com/Agent-Field/codeaf/internal/enginehost"
 	"github.com/Agent-Field/codeaf/internal/env"
+	"github.com/Agent-Field/codeaf/internal/gitidentity"
 	"github.com/Agent-Field/codeaf/internal/guard"
 	"github.com/Agent-Field/codeaf/internal/home"
 	"github.com/Agent-Field/codeaf/internal/leave"
@@ -980,6 +981,20 @@ func openV3Launch(proc *v3Process, opts v3Options) (*v3Launch, error) {
 		// memory row is on, which is what makes "memory off makes no calls" a
 		// fact about the wiring instead of a branch every caller has to keep.
 		Memory: proc.Memory,
+		// AND THE CONVERSATION INDEX, WHICH IS NOT THE MEMORY ANY MORE. It is
+		// the process's search store — the same handle as Memory when memory
+		// is on, and its own handle of the same file when memory is off — so
+		// the search verb survives the memory row. The chat journal indexes
+		// the conversation into it either way; the memory row now decides
+		// only what is REMEMBERED (internal/session's memory.go).
+		MemoryIndex: proc.Search,
+		// AND THE PROJECT THIS SESSION CAN PROVE IT IS IN. The key is minted
+		// from the workspace's origin remote, or its canonical path when there
+		// is no remote, and it is what turns a `project` scope word into the
+		// owner a memory really belongs to. Empty (an error, or a workspace
+		// that could not be resolved) quarantines project writes rather than
+		// guessing.
+		MemoryProjectKey: v3ProjectKey(workspace),
 		// AND THE SKILL SHELF, which is the line above when memory is on and a
 		// shelf of the skill folders alone when it is off ([v3SkillShelf]):
 		// the skills a person installed for another harness are not memory,
@@ -2100,6 +2115,35 @@ func v3BuiltinApprovals() map[string]any {
 // made by [store.Open] itself, which is the one door every caller goes through,
 // and what reaches the line below is only ever a real reason: it names the file
 // and says what the disk said about it.
+// v3SearchStore opens the conversation index with the memory row OFF. It is
+// the same file the memory store is ([defaultChatDB]), opened when the memory
+// store was not — and its failures are the same non-fatal shape: a person who
+// wanted a conversation gets one, and the search verb answers what a missing
+// index honestly answers.
+func v3SearchStore(profileDir string) *store.Store {
+	brain, err := store.Open(defaultChatDB())
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "conversation search is off for this session: "+err.Error())
+		return nil
+	}
+	return brain
+}
+
+// v3ProjectKey mints the key this launch's workspace can prove it is. It is
+// the origin remote's normalized identity when the workspace is a git
+// repository with one, and the canonical path's hash when there is none —
+// never a guess. An error or an empty workspace answers "", and a session
+// carrying "" quarantines its project writes rather than attributing them
+// (internal/gitidentity's project.go states the rule; internal/session's
+// memory.go states where the empty key lands).
+func v3ProjectKey(workspace string) string {
+	key, err := gitidentity.ProjectKey(workspace)
+	if err != nil || strings.TrimSpace(key) == "" {
+		return ""
+	}
+	return key
+}
+
 func v3Memory(profileDir string) *store.Store {
 	if !config.MemoryEnabledAt(profileDir) {
 		return nil
@@ -2137,8 +2181,29 @@ func (s v3Brain) ChangedSince(t time.Time) (int, int, error) {
 	return s.brain.MemoryChangedSince(t)
 }
 
+// ListMemories answers the surface's scope word as the OWNERS it means. The
+// person's overview reads the whole store (the snapshot above does), so an
+// empty scope stays "every owner"; `project` is the word the surface spells
+// for "the project rows", and it answers every project's rows — this is the
+// person's own audit page, not a session's retrieval, and the session-scoped
+// reads live in internal/session. A scope this build does not spell answers
+// nothing rather than everything.
 func (s v3Brain) ListMemories(scope string, limit int) ([]store.Memory, error) {
-	return s.brain.ListMemories(scope, limit)
+	switch strings.TrimSpace(scope) {
+	case "":
+		return s.brain.ListMemories(nil, limit)
+	case store.MemoryScopeUser:
+		return s.brain.ListMemories([]string{store.OwnerUser}, limit)
+	case store.MemoryScopeEnv:
+		return s.brain.ListMemories([]string{store.OwnerMachine}, limit)
+	case store.MemoryScopeProject:
+		// EVERY PROJECT'S ROWS, INCLUDING THE QUARANTINE: this is the person's
+		// audit shelf, not a session's retrieval — a project-scoped listing
+		// that answered only the quarantine would hide every real project's
+		// memories the day the first one was written with an owner.
+		return s.brain.ListProjectMemories(limit)
+	}
+	return nil, nil
 }
 
 func (s v3Brain) UpdateMemory(id, title, text string, tags []string) error {
 
@@ -415,12 +415,20 @@ func v3PointAt(cfg session.Config, place session.Place) (session.Config, error)
 		if workspace := strings.TrimSpace(place.Workspace); workspace != "" {
 			cfg.Workspace = workspace
 		}
+		cfg.MemoryProjectKey = v3ProjectKey(cfg.Workspace)
 		return cfg, nil
 	}
 	if err := prepareOwnedWorkspace(place); err != nil {
 		return cfg, err
 	}
 	cfg.Workspace = place.Work()
+	// AND THE PROJECT KEY FOLLOWS THE WORKSPACE, because the key IS the
+	// workspace's provable identity: a conversation moved to another session
+	// folder — /new, a resume, a picker — is a conversation that may be in a
+	// different project, and a memory scoped to the wrong key is a memory in
+	// the wrong place. Recomputed here, where the workspace is settled, so
+	// every door through this function agrees about whose project this is.
+	cfg.MemoryProjectKey = v3ProjectKey(cfg.Workspace)
 	return cfg, nil
 }
 
 
@@ -30,6 +30,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"github.com/Agent-Field/codeaf/internal/gitidentity"
 	"os"
 	"path/filepath"
 	"strings"
@@ -92,6 +93,17 @@ type v3Process struct {
 	// answer to give. Each conversation still gets its own memory pass and its
 	// own context, which is per-agent already.
 	Memory *store.Store
+	// Search is the store the CONVERSATION INDEX lives in — the same file as
+	// Memory when memory is on, and the same file opened alone when it is off.
+	// THAT IS THE WHOLE DECOUPLING: the memory row turns off what the session
+	// REMEMBERS, never what the next conversation can SEARCH. It used to be
+	// one field and one decision, so turning memory off also closed the
+	// conversation index and the search verb with it — a person who turned
+	// memory off lost a feature they never asked to lose.
+	//
+	// Search is legitimately PROFILE-scoped, for Memory's reason (one handle
+	// per file per process; two pools on one file arbitrate through a timeout).
+	Search *store.Store
 	// Skills is the skill shelf every conversation this process opens reads:
 	// the Memory store itself when memory is on, and otherwise a store of its
 	// own that holds nothing but the skills the folders on disk hold
@@ -256,6 +268,16 @@ func openV3ProcessWith(door string, askKey bool) (*v3Process, error) {
 	wirePoolIndex(settings.ProfileDir)
 	shelf := newV3ModelShelf(models, discovery)
 	shelf.setSources(settings.Sources)
+	memory := v3Memory(settings.ProfileDir)
+	// THE SEARCH STORE IS THE MEMORY STORE WHEN MEMORY IS ON — one handle, one
+	// file — and its own handle of the same file when memory is off. Never two
+	// handles at once: [v3Process.Memory]'s law is about one file, one pool.
+	var search *store.Store
+	if memory != nil {
+		search = memory
+	} else {
+		search = v3SearchStore(settings.ProfileDir)
+	}
 	process := &v3Process{
 		Settings:          settings,
 		ProfileDir:        settings.ProfileDir,
@@ -265,12 +287,20 @@ func openV3ProcessWith(door string, askKey bool) (*v3Process, error) {
 		processStop:       processStop,
 		Shelf:             shelf,
 		Harnesses:         subharness.Default(),
-		Memory:            v3Memory(settings.ProfileDir),
+		Memory:            memory,
+		Search:            search,
 		Artifacts:         artifactsIndexPath(),
 		Conns:             v3Connect(settings.ProfileDir),
 		LaunchDir:         launchDir,
 	}
 	process.Skills, process.skillsDir = v3SkillShelf(process.Memory)
+	// AND THE QUARANTINE IS GIVEN ITS OWNERS BACK, once per process, only when
+	// there is something to give: rows the migration could not attribute are
+	// re-homed to the project their source session provably ran in. This is
+	// the "recover authoritative source ownership" half of the migration — the
+	// store quarantined rather than guessed, and the disk (where a session's
+	// workspace is a fact) is what does the proving.
+	v3RehomeLegacyMemories(memory)
 	process.creditWatcher = newV3CreditWatcher(process)
 	process.startPlaceSweep()
 	return process, nil
@@ -657,6 +687,14 @@ func (p *v3Process) closeAll() {
 	if p.Memory != nil {
 		_ = p.Memory.Close()
 	}
+	// THE SEARCH HANDLE CLOSES ONLY WHEN IT IS NOT THE MEMORY'S. When memory
+	// is on the two fields are one handle and the close above already took
+	// it; when memory is off the search store was opened on its own, and a
+	// handle left open here is a WAL that never checkpoints and a file the
+	// next process reads mid-write.
+	if p.Search != nil && p.Search != p.Memory {
+		_ = p.Search.Close()
+	}
 	// The memory-off shelf goes with the process that built it: it was only
 	// ever a reading of the skill folders, and the next launch reads them
 	// again.
@@ -933,6 +971,11 @@ func (s *v3Seam) anchor(agent interface {
 	s.boot.Config.Workspace = resolved
 	s.boot.Config.Place.Workspace = resolved
 	s.boot.Config.Place.Owned = false
+	// AND THE PROJECT KEY FOLLOWS THE WORKSPACE here too, through the one mint
+	// [v3PointAt] uses: the anchor moved the boot config's subject, and a key left
+	// on the scratch folder would scope every later launch's project reads and
+	// writes to a project this conversation is no longer in.
+	s.boot.Config.MemoryProjectKey = v3ProjectKey(resolved)
 	s.boot.Place = s.boot.Config.Place
 	if bucket, bucketErr := v3ProjectDir(resolved); bucketErr == nil {
 		s.boot.Bucket = bucket
@@ -955,3 +998,44 @@ func (p *v3Process) liveSettings(base config.Config) func() config.Config {
 		return live
 	}
 }
+
+// v3RehomeLegacyMemories moves every quarantined memory whose source session
+// can be proven to a workspace into that workspace's project owner, and leaves
+// the rest in quarantine — a row whose session cannot be found has an owner
+// nobody can name, and attributing it anyway is the guess the migration
+// refused to make.
+//
+// It runs at process open, after the store is open and before the first
+// conversation builds, and only when the quarantine holds rows: one pass, a
+// bounded read of the places root, and nothing when the migration's work was
+// already done.
+func v3RehomeLegacyMemories(brain *store.Store) {
+	if brain == nil {
+		return
+	}
+	rows, err := brain.QuarantinedMemories(500)
+	if err != nil || len(rows) == 0 {
+		return
+	}
+	bySession := session.SessionWorkspaces()
+	owners := map[string][]string{}
+	for _, row := range rows {
+		workspace := bySession[row.SourceSession]
+		if workspace == "" {
+			continue
+		}
+		key, err := gitidentity.ProjectKey(workspace)
+		if err != nil || strings.TrimSpace(key) == "" {
+			continue
+		}
+		owner := store.OwnerProject(key)
+		owners[owner] = append(owners[owner], row.ID)
+	}
+	for owner, ids := range owners {
+		if _, err := brain.RehomeMemories(ids, owner); err != nil {
+			// A failed re-home is not fatal and not silent: the rows stay in
+			// quarantine, and the complaint names where.
+			fmt.Fprintln(os.Stderr, "memory: could not re-home quarantined rows: "+err.Error())
+		}
+	}
+}
@@ -140,10 +140,20 @@ func v3StandingTicker(store *standing.Store) (*standing.Ticker, func(), error) {
 	}
 	idle := session.StandingIdle()
 	return &standing.Ticker{
-		Store:    store,
-		Sentinel: session.NewStandingSentinel(posture),
-		Runner:   session.NewStandingRunner(posture, store.Root()),
-		Idle:     idle,
+		Store: store,
+		// THE THREE-WAY READER IS WHAT A REAL TICK USES. An ambiguous, refused
+		// or timed-out sentinel reply is [standing.VerdictUnknown] and the item
+		// stays due; the binary reader below folds every non-yes into "no" and
+		// is kept only for callers that still speak in yes/no. A per-item pinned
+		// model is read off the item inside the sentinel and the runner
+		// ([session.standingPinnedConfig]), so a pass reloaded from the profile
+		// cannot route an item the person ratified under `--one-model` onto a
+		// different model (the pinned-model boundary this file's posture note
+		// describes).
+		SentinelVerdict: session.NewStandingSentinelVerdict(posture),
+		Sentinel:        session.NewStandingSentinel(posture),
+		Runner:          session.NewStandingRunnerWithMemory(posture, store.Root(), v3MemoryPath(settings.ProfileDir)),
+		Idle:            idle,
 		// The dreaming pass over what is remembered, which rides this pass
 		// because it wants exactly what this pass already has: one process
 		// elected among every window and the OS timer, and a machine nobody is
Original file line number	Diff line number	Diff line change
`@@ -125,7 +125,7 @@ func seedDemoHome(dir string, now time.Time) (builtHome, error) {`
`125`	`125`	`}`
`126`	`126`	`built.Standing = orders`
`127`	`127`
`128`		`- memories, err := writeMemories(brain)`
	`128`	`+ memories, err := writeMemories(brain, projects[firstProjectName].dir)`
`129`	`129`	`if err != nil {`
`130`	`130`	`return built, err`
`131`	`131`	`}`
Original file line number	Diff line number	Diff line change
`@@ -415,12 +415,20 @@ func v3PointAt(cfg session.Config, place session.Place) (session.Config, error)`
`415`	`415`	`if workspace := strings.TrimSpace(place.Workspace); workspace != "" {`
`416`	`416`	`cfg.Workspace = workspace`
`417`	`417`	`}`
	`418`	`+ cfg.MemoryProjectKey = v3ProjectKey(cfg.Workspace)`
`418`	`419`	`return cfg, nil`
`419`	`420`	`}`
`420`	`421`	`if err := prepareOwnedWorkspace(place); err != nil {`
`421`	`422`	`return cfg, err`
`422`	`423`	`}`
`423`	`424`	`cfg.Workspace = place.Work()`
	`425`	`+ // AND THE PROJECT KEY FOLLOWS THE WORKSPACE, because the key IS the`
	`426`	`+ // workspace's provable identity: a conversation moved to another session`
	`427`	`+ // folder — /new, a resume, a picker — is a conversation that may be in a`
	`428`	`+ // different project, and a memory scoped to the wrong key is a memory in`
	`429`	`+ // the wrong place. Recomputed here, where the workspace is settled, so`
	`430`	`+ // every door through this function agrees about whose project this is.`
	`431`	`+ cfg.MemoryProjectKey = v3ProjectKey(cfg.Workspace)`
`424`	`432`	`return cfg, nil`
`425`	`433`	`}`
`426`	`434`