diff --git a/Cargo.lock b/Cargo.lock
index 6d1a7d25..6bcb6e0c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4536,6 +4536,7 @@ dependencies = [
  "tokensave-medium-treesitters",
  "tokio",
  "toml",
+ "tower 0.5.3",
  "tracing",
  "tree-sitter",
  "tree-sitter-hlsl",
diff --git a/Cargo.toml b/Cargo.toml
index 143ba8b5..3cf44539 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -104,6 +104,7 @@ path = "src/main.rs"
 
 [dependencies]
 axum = "0.8"
+tower = "0.5"
 libsql = "0.9.30"
 tree-sitter = "0.26"
 tree-sitter-language = "0.1"
diff --git a/dashboard/holographic/src/HolographicMemoryPage.tsx b/dashboard/holographic/src/HolographicMemoryPage.tsx
index 0676d93f..faddeb0c 100644
--- a/dashboard/holographic/src/HolographicMemoryPage.tsx
+++ b/dashboard/holographic/src/HolographicMemoryPage.tsx
@@ -333,9 +333,9 @@ function SearchBox({
   return (
     <div className="hm-searchbox relative min-w-0 w-full sm:max-w-xl">
       {refreshing ? (
-        <Spinner className="absolute left-2.5 top-1/2 -translate-y-1/2 text-[0.875rem] text-primary" />
+        <Spinner className="text-[0.875rem] text-primary" />
       ) : (
-        <Search className="absolute left-2.5 top-1/2 h-3.5 w-3.5 -translate-y-1/2 text-muted-foreground" />
+        <Search className="text-muted-foreground" />
       )}
       <Input
         placeholder="Search holographic facts"
@@ -347,7 +347,7 @@ function SearchBox({
         <Button
           ghost
           size="xs"
-          className="absolute right-1.5 top-1/2 -translate-y-1/2 text-muted-foreground hover:text-foreground"
+          className="text-muted-foreground hover:text-foreground"
           onClick={() => setQuery("")}
           aria-label="Clear"
         >
diff --git a/dashboard/shell/src/main.jsx b/dashboard/shell/src/main.jsx
index ac835660..07dfed78 100644
--- a/dashboard/shell/src/main.jsx
+++ b/dashboard/shell/src/main.jsx
@@ -13,7 +13,13 @@
 
 import React, { useEffect, useState, useCallback, useRef, useSyncExternalStore } from "react";
 import { createRoot } from "react-dom/client";
-import { buildSDK, fetchJSON, cn } from "./sdk.jsx";
+import {
+  buildSDK,
+  fetchJSON,
+  cn,
+  getSelectedProjectId,
+  setShellSelectedProjectId,
+} from "./sdk.jsx";
 
 // ---------------------------------------------------------------------------
 // Registry
@@ -174,6 +180,14 @@ function injectPluginAssets(manifest) {
 
 const POLL_INTERVAL_MS = 15_000;
 
+function basename(path) {
+  return path?.split("/").filter(Boolean).pop() || path;
+}
+
+function projectLabel(project) {
+  return project?.label || basename(project?.project_root) || project?.project_id || "Project";
+}
+
 // ---------------------------------------------------------------------------
 // App
 // ---------------------------------------------------------------------------
@@ -181,6 +195,9 @@ const POLL_INTERVAL_MS = 15_000;
 function App() {
   const [plugins, setPlugins] = useState([]);
   const [capabilities, setCapabilities] = useState(null);
+  const [projects, setProjects] = useState([]);
+  const [selectedProjectId, setSelectedProjectId] = useState("");
+  const [projectRevision, setProjectRevision] = useState(0);
   const [active, setActive] = useState("");
   // Tabs that have been activated at least once; their panels stay mounted
   // (hidden) afterwards so in-progress exploration survives tab switches.
@@ -244,9 +261,10 @@ function App() {
   }, []);
 
   // Fetch capabilities, update SDK, and return the payload (or null on failure).
-  const fetchCapabilities = useCallback(async () => {
+  const fetchCapabilities = useCallback(async (projectId = getSelectedProjectId()) => {
     try {
       const caps = await fetchJSON("/api/capabilities");
+      if (getSelectedProjectId() !== projectId) return null;
       setCapabilities(caps);
       setConnState("ok");
       setLastRefresh(Date.now());
@@ -254,21 +272,32 @@ function App() {
       window.__HERMES_PLUGIN_SDK__.capabilities = caps;
       return caps;
     } catch {
+      if (getSelectedProjectId() !== projectId) return null;
+      window.__HERMES_PLUGIN_SDK__.capabilities = null;
       setConnState("error");
       return null;
     }
   }, []);
 
-  // Initial load: plugin list + capabilities in parallel.
+  // Initial load: plugin manifests are daemon-wide; project inventory selects
+  // which project-scoped APIs plugin panels should read from.
   useEffect(() => {
     let cancelled = false;
     (async () => {
       try {
-        const [list] = await Promise.all([
+        const [list, projectPayload] = await Promise.all([
           fetchJSON("/api/dashboard/plugins"),
-          fetchCapabilities(),
+          fetchJSON("/api/projects"),
         ]);
         if (cancelled) return;
+        const rows = Array.isArray(projectPayload?.projects) ? projectPayload.projects : [];
+        const initialProjectId =
+          projectPayload?.active_project_id || rows.find((p) => p.is_active)?.project_id || rows[0]?.project_id || "";
+        setProjects(rows);
+        setSelectedProjectId(initialProjectId);
+        setShellSelectedProjectId(initialProjectId);
+        await fetchCapabilities(initialProjectId);
+        if (cancelled) return;
         setPlugins(list);
         if (list.length > 0) {
           const fromUrl = tabFromUrl();
@@ -290,6 +319,21 @@ function App() {
     };
   }, []); // eslint-disable-line react-hooks/exhaustive-deps
 
+  const onProjectChange = useCallback(
+    async (event) => {
+      const next = event.target.value;
+      if (next === selectedProjectId) return;
+      setSelectedProjectId(next);
+      setShellSelectedProjectId(next);
+      setCapabilities(null);
+      window.__HERMES_PLUGIN_SDK__.capabilities = null;
+      setProjectRevision((rev) => rev + 1);
+      setVisited(active ? new Set([active]) : new Set());
+      await fetchCapabilities(next);
+    },
+    [active, fetchCapabilities, selectedProjectId],
+  );
+
   // Poll capabilities for connection health — but only while the browser tab
   // is visible; a hidden tab refreshes once on return instead.
   useEffect(() => {
@@ -366,8 +410,12 @@ function App() {
 
   const activeManifest = plugins.find((p) => p.name === active);
   const ActiveComponent = registered.get(active);
-  const projectName =
-    capabilities?.project_root?.split("/").filter(Boolean).pop() ?? capabilities?.project_root;
+  const selectedProject =
+    projects.find((p) => p.project_id === selectedProjectId) ||
+    projects.find((p) => p.is_active) ||
+    null;
+  const projectName = selectedProject ? projectLabel(selectedProject) : basename(capabilities?.project_root);
+  const projectRoot = selectedProject?.project_root || capabilities?.project_root;
 
   const connLabel =
     connState === "ok"
@@ -383,7 +431,7 @@ function App() {
           <span className="ts-shell-logo" aria-hidden="true">◳</span>
           <h1 className="ts-shell-title">tracedecay</h1>
           {projectName && (
-            <span className="ts-shell-project" title={capabilities?.project_root}>
+            <span className="ts-shell-project" title={projectRoot}>
               {projectName}
             </span>
           )}
@@ -418,6 +466,22 @@ function App() {
         </div>
 
         <div className="ts-shell-controls">
+          {projects.length > 0 && (
+            <select
+              className="ts-project-select"
+              value={selectedProjectId}
+              onChange={onProjectChange}
+              aria-label="Project"
+              title={projectRoot || "Project"}
+            >
+              {projects.map((project) => (
+                <option key={project.project_id} value={project.project_id}>
+                  {projectLabel(project)}
+                </option>
+              ))}
+            </select>
+          )}
+
           <button
             className={cn("ts-conn-indicator", `ts-conn-indicator-${connState}`)}
             title={connLabel}
@@ -479,7 +543,7 @@ function App() {
             const Component = registered.get(p.name);
             return (
               <div
-                key={p.name}
+                key={`${selectedProjectId || "active"}:${projectRevision}:${p.name}`}
                 role="tabpanel"
                 id={`ts-tabpanel-${p.name}`}
                 aria-labelledby={`ts-tab-${p.name}`}
diff --git a/dashboard/shell/src/sdk.jsx b/dashboard/shell/src/sdk.jsx
index 849e8d82..43c955d4 100644
--- a/dashboard/shell/src/sdk.jsx
+++ b/dashboard/shell/src/sdk.jsx
@@ -29,8 +29,57 @@ import { cn as cnImpl } from "../../lib/cn";
 export { makeSequence };
 export const cn = cnImpl;
 
+const projectListeners = new Set();
+let selectedProjectId = "";
+
+function notifyProjectListeners() {
+  for (const fn of projectListeners) {
+    try {
+      fn(selectedProjectId);
+    } catch {
+      /* listener errors should not break plugin fetches */
+    }
+  }
+}
+
+function isScopedApiUrl(url, prefix) {
+  return url === prefix || url.startsWith(`${prefix}/`) || url.startsWith(`${prefix}?`);
+}
+
+export function getSelectedProjectId() {
+  return selectedProjectId;
+}
+
+export function setShellSelectedProjectId(projectId) {
+  const next = String(projectId || "");
+  if (next === selectedProjectId) return;
+  selectedProjectId = next;
+  notifyProjectListeners();
+}
+
+export function subscribeSelectedProject(fn) {
+  projectListeners.add(fn);
+  return () => projectListeners.delete(fn);
+}
+
+export function projectScopedUrl(url, init) {
+  if (!selectedProjectId || typeof url !== "string" || !url.startsWith("/")) return url;
+  if (
+    !isScopedApiUrl(url, "/api/plugins") &&
+    !isScopedApiUrl(url, "/api/automation") &&
+    !isScopedApiUrl(url, "/api/capabilities")
+  ) {
+    return url;
+  }
+  return `/api/projects/${encodeURIComponent(selectedProjectId)}${url.slice("/api".length)}`;
+}
+
+export function authedFetch(url, init) {
+  return fetch(projectScopedUrl(url, init), init);
+}
+
 export async function fetchJSON(url, init) {
-  const res = await fetch(url, init);
+  const res = await authedFetch(url, init);
   if (!res.ok) {
     let detail = `${res.status} ${res.statusText}`;
     let body;
@@ -171,7 +220,7 @@ export function buildSDK() {
     hooks: { useState, useEffect, useCallback, useMemo, useRef, useContext, createContext },
     api: {},
     fetchJSON,
-    authedFetch: (url, init) => fetch(url, init),
+    authedFetch,
     buildWsUrl: (p) => p,
     buildWsAuthParam: () => ["", ""],
     /**
@@ -182,6 +231,10 @@ export function buildSDK() {
      * Null until the first successful fetch.
      */
     capabilities: null,
+    projects: {
+      getSelectedProjectId,
+      subscribe: subscribeSelectedProject,
+    },
     components: {
       Card,
       CardHeader,
diff --git a/dashboard/shell/src/styles.css b/dashboard/shell/src/styles.css
index 9732fbb5..8960910f 100644
--- a/dashboard/shell/src/styles.css
+++ b/dashboard/shell/src/styles.css
@@ -531,6 +531,34 @@ select:focus-visible {
   flex-shrink: 0;
 }
 
+.ts-project-select {
+  appearance: none;
+  background:
+    linear-gradient(45deg, transparent 50%, var(--ts-text-3) 50%) calc(100% - 0.82rem) 50% / 5px 5px no-repeat,
+    linear-gradient(135deg, var(--ts-text-3) 50%, transparent 50%) calc(100% - 0.58rem) 50% / 5px 5px no-repeat,
+    var(--ts-conn-bg);
+  border: 1px solid var(--ts-line);
+  border-radius: 999px;
+  color: var(--ts-text-2);
+  cursor: pointer;
+  font-family: var(--theme-font-mono);
+  font-size: 0.72rem;
+  line-height: 1;
+  max-width: min(22vw, 18rem);
+  min-width: 10rem;
+  overflow: hidden;
+  padding: 0.43rem 1.55rem 0.43rem 0.72rem;
+  text-overflow: ellipsis;
+  transition: background-color 0.16s ease, border-color 0.16s ease, color 0.16s ease;
+  white-space: nowrap;
+}
+
+.ts-project-select:hover,
+.ts-project-select:focus {
+  border-color: var(--ts-line-strong);
+  color: var(--ts-text);
+}
+
 /* Connection indicator */
 .ts-conn-indicator {
   appearance: none;
@@ -814,7 +842,15 @@ select:focus-visible {
   }
 
   .ts-shell-controls {
-    align-self: flex-end;
+    align-self: stretch;
+    flex-wrap: wrap;
+    justify-content: flex-end;
+  }
+
+  .ts-project-select {
+    flex: 1 1 12rem;
+    max-width: none;
+    min-width: 0;
   }
 
   .ts-conn-time {
diff --git a/dashboard/test/shell-sdk.test.mjs b/dashboard/test/shell-sdk.test.mjs
index 7e4b6e4b..0b224b18 100644
--- a/dashboard/test/shell-sdk.test.mjs
+++ b/dashboard/test/shell-sdk.test.mjs
@@ -40,6 +40,102 @@ test("fetchJSON returns parsed body on success", async () => {
   assert.deepEqual(seen, [["/ok", { method: "POST" }]]);
 });
 
+test("project scoped fetchJSON rewrites plugin and capability API calls", async () => {
+  const seen = [];
+  await withMockedFetch(
+    async (url, init) => {
+      seen.push([url, init]);
+      return {
+        ok: true,
+        json: async () => ({ ok: true }),
+      };
+    },
+    async () => {
+      sdk.setShellSelectedProjectId("proj_alpha");
+      await sdk.fetchJSON("/api/plugins/holographic/status?limit=2", { method: "GET" });
+      await sdk.fetchJSON("/api/automation/skills");
+      await sdk.fetchJSON("/api/capabilities");
+      await sdk.authedFetch("/api/plugins/graph/search?q=fn");
+    },
+  );
+
+  assert.deepEqual(seen, [
+    ["/api/projects/proj_alpha/plugins/holographic/status?limit=2", { method: "GET" }],
+    ["/api/projects/proj_alpha/automation/skills", undefined],
+    ["/api/projects/proj_alpha/capabilities", undefined],
+    ["/api/projects/proj_alpha/plugins/graph/search?q=fn", undefined],
+  ]);
+  sdk.setShellSelectedProjectId("");
+});
+
+test("project scoping leaves daemon APIs and absolute URLs unchanged", async () => {
+  const seen = [];
+  await withMockedFetch(
+    async (url, init) => {
+      seen.push([url, init]);
+      return {
+        ok: true,
+        json: async () => ({ ok: true }),
+      };
+    },
+    async () => {
+      sdk.setShellSelectedProjectId("proj_beta");
+      await sdk.fetchJSON("/api/projects");
+      await sdk.fetchJSON("/api/projects/proj_beta");
+      await sdk.fetchJSON("/api/dashboard/plugins");
+      await sdk.fetchJSON("https://example.test/api/plugins/holographic");
+    },
+  );
+
+  assert.deepEqual(seen, [
+    ["/api/projects", undefined],
+    ["/api/projects/proj_beta", undefined],
+    ["/api/dashboard/plugins", undefined],
+    ["https://example.test/api/plugins/holographic", undefined],
+  ]);
+  sdk.setShellSelectedProjectId("");
+});
+
+test("project scoping routes mutating API calls through the selected project guard", async () => {
+  const seen = [];
+  await withMockedFetch(
+    async (url, init) => {
+      seen.push([url, init]);
+      return {
+        ok: true,
+        json: async () => ({ ok: true }),
+      };
+    },
+    async () => {
+      sdk.setShellSelectedProjectId("proj_gamma");
+      await sdk.fetchJSON("/api/plugins/holographic/curate", { method: "POST" });
+      await sdk.authedFetch("/api/plugins/holographic/curation/config", { method: "PATCH" });
+    },
+  );
+
+  assert.deepEqual(seen, [
+    ["/api/projects/proj_gamma/plugins/holographic/curate", { method: "POST" }],
+    ["/api/projects/proj_gamma/plugins/holographic/curation/config", { method: "PATCH" }],
+  ]);
+  sdk.setShellSelectedProjectId("");
+});
+
+test("plugin SDK exposes selected project as read-only subscribed state", () => {
+  const pluginSDK = sdk.buildSDK();
+  const seen = [];
+  const unsubscribe = pluginSDK.projects.subscribe((projectId) => seen.push(projectId));
+
+  assert.equal(pluginSDK.projects.getSelectedProjectId(), "");
+  assert.equal(pluginSDK.projects.setSelectedProjectId, undefined);
+
+  sdk.setShellSelectedProjectId("proj_delta");
+  assert.equal(pluginSDK.projects.getSelectedProjectId(), "proj_delta");
+  assert.deepEqual(seen, ["proj_delta"]);
+
+  unsubscribe();
+  sdk.setShellSelectedProjectId("");
+});
+
 test("fetchJSON prefers JSON detail on failure", async () => {
   const body = {
     detail: "token expired",
diff --git a/src/dashboard/memory_curate.rs b/src/dashboard/memory_curate.rs
index 76d261d7..b6f0f7bb 100644
--- a/src/dashboard/memory_curate.rs
+++ b/src/dashboard/memory_curate.rs
@@ -120,6 +120,7 @@ async fn cli_state(cg: &TraceDecay) -> DashboardState {
     let (mem_conn, mem_db_path) = super::resolve_project_memory_store(cg).await;
     let store_layout = cg.store_layout();
     DashboardState {
+        project_id: store_layout.identity.project_id.clone(),
         graph_conn: cg.dashboard_connection(),
         graph_db_path: cg.dashboard_db_path().display().to_string(),
         mem_conn,
diff --git a/src/dashboard/mod.rs b/src/dashboard/mod.rs
index 0485dcc7..13147a68 100644
--- a/src/dashboard/mod.rs
+++ b/src/dashboard/mod.rs
@@ -42,6 +42,7 @@ mod memory_api;
 pub mod memory_curate;
 mod memory_queries;
 mod memory_service;
+mod projects;
 mod savings_api;
 mod savings_pricing;
 mod token_count;
@@ -51,12 +52,15 @@ use std::path::{Path, PathBuf};
 use std::sync::atomic::AtomicBool;
 use std::sync::Arc;
 
-use axum::extract::State;
-use axum::response::Json;
-use axum::routing::{get, post};
+use axum::body::Body;
+use axum::extract::{Path as AxumPath, State};
+use axum::http::{Method, Request, StatusCode, Uri};
+use axum::response::{IntoResponse, Json, Response};
+use axum::routing::{any, get, post};
 use axum::Router;
 use serde_json::{json, Value};
 use tokio::sync::RwLock;
+use tower::ServiceExt;
 
 use crate::automation::backend;
 use crate::automation::config::{self, AutomationBackend, AutomationHostMode};
@@ -87,6 +91,8 @@ pub(crate) struct CuratePreviewEntry {
 
 #[derive(Clone)]
 pub(crate) struct DashboardState {
+    /// Registered project id for profile-backed stores, when known.
+    pub(crate) project_id: Option<String>,
     /// Active code-graph database. This can be branch-specific.
     pub(crate) graph_conn: libsql::Connection,
     /// Display path of the active code-graph database.
@@ -231,9 +237,11 @@ pub(crate) async fn resolve_project_memory_store(cg: &TraceDecay) -> (libsql::Co
     })
 }
 
-/// Builds the dashboard state shared by the CLI `run` path and the
-/// `tracedecay_dashboard` MCP tool.
-pub(crate) async fn build_state(cg: &TraceDecay) -> DashboardState {
+async fn build_state_inner(
+    cg: &TraceDecay,
+    repair_memory_on_startup: bool,
+    warm_token_counts: bool,
+) -> DashboardState {
     let (mem_conn, mem_db_path) = resolve_project_memory_store(cg).await;
     let lcm = resolve_lcm_store(cg).await;
     // Re-hydrate the last dry-run curation preview from its sidecar so it
@@ -252,6 +260,7 @@ pub(crate) async fn build_state(cg: &TraceDecay) -> DashboardState {
         .map(|p| p.display().to_string())
         .unwrap_or_default();
     let state = DashboardState {
+        project_id: cg.store_layout().identity.project_id.clone(),
         graph_conn: cg.dashboard_connection(),
         graph_db_path: cg.dashboard_db_path().display().to_string(),
         mem_conn,
@@ -271,15 +280,31 @@ pub(crate) async fn build_state(cg: &TraceDecay) -> DashboardState {
         code_diagnostics: Arc::new(RwLock::new(code_diagnostics)),
         code_diagnostics_backfill_started: Arc::new(AtomicBool::new(false)),
     };
-    if let Err(err) = memory_api::repair_derived_memory(&state).await {
-        eprintln!("Dashboard memory repair skipped: {err}");
+    if repair_memory_on_startup {
+        if let Err(err) = memory_api::repair_derived_memory(&state).await {
+            eprintln!("Dashboard memory repair skipped: {err}");
+        }
     }
     // Pre-count non-usage messages in the background so the first Savings
     // tab paint doesn't pay the initial BPE pass over the session store.
-    token_count::spawn_warm(state.clone());
+    if warm_token_counts {
+        token_count::spawn_warm(state.clone());
+    }
     state
 }
 
+/// Builds the dashboard state shared by the CLI `run` path and the
+/// `tracedecay_dashboard` MCP tool.
+pub(crate) async fn build_state(cg: &TraceDecay) -> DashboardState {
+    build_state_inner(cg, true, true).await
+}
+
+/// Builds a lightweight cached state for a non-active project selected from the
+/// dashboard project picker.
+pub(crate) async fn build_selected_project_state(cg: &TraceDecay) -> DashboardState {
+    build_state_inner(cg, false, false).await
+}
+
 /// Detached catch-up ingest for transcript sources (Claude, Codex, Vibe,
 /// Cline-like, and Cursor's historical backlog), mirroring the MCP serve
 /// startup sweep so a standalone `tracedecay dashboard` reflects transcripts
@@ -301,7 +326,7 @@ fn spawn_session_catch_up_ingest(project_root: PathBuf) {
     });
 }
 
-fn config_error(message: impl Into<String>) -> TraceDecayError {
+pub(crate) fn config_error(message: impl Into<String>) -> TraceDecayError {
     TraceDecayError::Config {
         message: message.into(),
     }
@@ -372,6 +397,7 @@ pub(crate) async fn bind_dashboard(
 }
 
 pub(crate) fn router(state: DashboardState) -> Router {
+    let runtime = projects::DashboardRuntime::new(state, project_api_router());
     Router::new()
         .route("/", get(assets::index_html))
         .route("/shell/{file}", get(assets::shell_asset))
@@ -379,8 +405,22 @@ pub(crate) fn router(state: DashboardState) -> Router {
             "/dashboard-plugins/{plugin}/dist/{file}",
             get(assets::plugin_asset),
         )
-        .route("/api/capabilities", get(capabilities))
         .route("/api/dashboard/plugins", get(plugins_list))
+        .route("/api/projects", get(projects::list))
+        .route("/api/projects/{project_id}", get(projects::context))
+        .route(
+            "/api/projects/{project_id}/{*tail}",
+            any(project_scoped_api_gateway),
+        )
+        .route("/api/capabilities", any(active_api_gateway))
+        .route("/api/plugins/{*tail}", any(active_api_gateway))
+        .route("/api/automation/{*tail}", any(active_api_gateway))
+        .with_state(runtime)
+}
+
+fn project_api_router() -> Router<DashboardState> {
+    Router::new()
+        .route("/api/capabilities", get(capabilities))
         // Holographic memory plugin API (mirrors holographic_plus plugin_api.py)
         .route("/api/plugins/holographic/", get(memory_api::overview))
         .route("/api/plugins/holographic", get(memory_api::overview))
@@ -590,7 +630,90 @@ pub(crate) fn router(state: DashboardState) -> Router {
         .route("/api/plugins/savings/sessions", get(savings_api::sessions))
         .route("/api/plugins/savings/models", get(savings_api::models))
         .route("/api/plugins/savings/pricing", get(savings_api::pricing))
-        .with_state(state)
+}
+
+async fn active_api_gateway(
+    State(runtime): State<projects::DashboardRuntime>,
+    req: Request<Body>,
+) -> Response {
+    forward_project_request(runtime.project_api_router(), runtime.active_state(), req).await
+}
+
+async fn project_scoped_api_gateway(
+    State(runtime): State<projects::DashboardRuntime>,
+    AxumPath((project_id, tail)): AxumPath<(String, String)>,
+    mut req: Request<Body>,
+) -> Response {
+    if runtime.active_project_id() != Some(project_id.as_str())
+        && !matches!(req.method(), &Method::GET | &Method::HEAD)
+    {
+        return (
+            StatusCode::METHOD_NOT_ALLOWED,
+            Json(json!({
+                "status": "read_only_project",
+                "detail": "project-scoped dashboard APIs are read-only for non-active projects",
+                "project_id": project_id,
+            })),
+        )
+            .into_response();
+    }
+
+    let selected = match runtime.selected_project_state(&project_id).await {
+        Ok(selected) => selected,
+        Err(err) => {
+            return (
+                StatusCode::NOT_FOUND,
+                Json(json!({
+                    "status": "not_found",
+                    "detail": err.to_string(),
+                    "project_id": project_id,
+                })),
+            )
+                .into_response();
+        }
+    };
+
+    let query = req
+        .uri()
+        .query()
+        .map(|query| format!("?{query}"))
+        .unwrap_or_default();
+    let rewritten = format!("/api/{tail}{query}");
+    match rewritten.parse::<Uri>() {
+        Ok(uri) => {
+            *req.uri_mut() = uri;
+            forward_project_request(runtime.project_api_router(), selected.state, req).await
+        }
+        Err(err) => (
+            StatusCode::BAD_REQUEST,
+            Json(json!({
+                "status": "bad_request",
+                "detail": format!("invalid project-scoped dashboard path: {err}"),
+            })),
+        )
+            .into_response(),
+    }
+}
+
+async fn forward_project_request(
+    project_api: Router<DashboardState>,
+    state: DashboardState,
+    req: Request<Body>,
+) -> Response {
+    let (mut parts, body) = req.into_parts();
+    parts.extensions.clear();
+    let req = Request::from_parts(parts, body);
+    match project_api.with_state(state).oneshot(req).await {
+        Ok(response) => response,
+        Err(err) => (
+            StatusCode::INTERNAL_SERVER_ERROR,
+            Json(json!({
+                "status": "error",
+                "detail": format!("dashboard project route failed: {err}"),
+            })),
+        )
+            .into_response(),
+    }
 }
 
 /// Capability discovery for hosts and future delegated-host extensions. The UI
@@ -622,6 +745,7 @@ async fn capabilities(State(state): State<DashboardState>) -> Json<Value> {
         "name": "tracedecay-dashboard",
         "version": env!("CARGO_PKG_VERSION"),
         "mode": "standalone",
+        "project_id": state.project_id,
         "project_root": state.project_root.display().to_string(),
         "storage_mode": state.storage_mode,
         "store_root": state.store_root.display().to_string(),
diff --git a/src/dashboard/projects.rs b/src/dashboard/projects.rs
new file mode 100644
index 00000000..d8d851a6
--- /dev/null
+++ b/src/dashboard/projects.rs
@@ -0,0 +1,288 @@
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+
+use axum::extract::{Path as AxumPath, Query, State};
+use axum::http::StatusCode;
+use axum::response::Json;
+use axum::Router;
+use serde::Deserialize;
+use serde_json::{json, Value};
+use tokio::sync::RwLock;
+
+use super::{build_selected_project_state, config_error, DashboardState};
+use crate::errors::Result;
+use crate::global_db::{GlobalDb, ProjectRegistryContext};
+use crate::tracedecay::TraceDecay;
+
+#[derive(Clone)]
+pub(crate) struct DashboardRuntime {
+    active: DashboardState,
+    project_api: Router<DashboardState>,
+    project_states: Arc<RwLock<HashMap<String, CachedProjectState>>>,
+}
+
+#[derive(Clone)]
+struct CachedProjectState {
+    registry_context: ProjectRegistryContext,
+    state: DashboardState,
+}
+
+impl DashboardRuntime {
+    pub(crate) fn new(active: DashboardState, project_api: Router<DashboardState>) -> Self {
+        Self {
+            active,
+            project_api,
+            project_states: Arc::new(RwLock::new(HashMap::new())),
+        }
+    }
+
+    pub(crate) fn active_state(&self) -> DashboardState {
+        self.active.clone()
+    }
+
+    pub(crate) fn active_project_id(&self) -> Option<&str> {
+        self.active.project_id.as_deref()
+    }
+
+    pub(crate) fn project_api_router(&self) -> Router<DashboardState> {
+        self.project_api.clone()
+    }
+
+    fn active_project_root(&self) -> String {
+        self.active.project_root.display().to_string()
+    }
+
+    pub(crate) async fn selected_project_state(
+        &self,
+        project_id: &str,
+    ) -> Result<SelectedProjectState> {
+        if self.active.project_id.as_deref() == Some(project_id) {
+            return Ok(SelectedProjectState {
+                state: self.active.clone(),
+            });
+        }
+
+        let db = GlobalDb::open()
+            .await
+            .ok_or_else(|| config_error("could not open tracedecay project registry"))?;
+        let context = db
+            .project_registry_context_by_id(project_id)
+            .await
+            .ok_or_else(|| config_error(format!("registered project not found: {project_id}")))?;
+        if let Some(cached) = self.project_states.read().await.get(project_id).cloned() {
+            if cached.registry_context == context {
+                return Ok(SelectedProjectState {
+                    state: cached.state,
+                });
+            }
+        }
+        let project_root = PathBuf::from(&context.project.canonical_root);
+        let cg = TraceDecay::open_read_only(&project_root).await?;
+        if cg.store_layout().identity.project_id.as_deref() != Some(project_id) {
+            return Err(config_error(format!(
+                "registered project id mismatch for {project_id}: {}",
+                project_root.display()
+            )));
+        }
+        let state = build_selected_project_state(&cg).await;
+        let mut project_states = self.project_states.write().await;
+        if let Some(cached) = project_states.get(project_id).cloned() {
+            if cached.registry_context == context {
+                return Ok(SelectedProjectState {
+                    state: cached.state,
+                });
+            }
+        }
+        project_states.insert(
+            project_id.to_string(),
+            CachedProjectState {
+                registry_context: context,
+                state: state.clone(),
+            },
+        );
+        Ok(SelectedProjectState { state })
+    }
+}
+
+pub(crate) struct SelectedProjectState {
+    pub(crate) state: DashboardState,
+}
+
+#[derive(Debug, Deserialize)]
+pub(crate) struct ProjectsParams {
+    limit: Option<usize>,
+}
+
+pub(crate) async fn list(
+    State(runtime): State<DashboardRuntime>,
+    Query(params): Query<ProjectsParams>,
+) -> Json<Value> {
+    let limit = params.limit.unwrap_or(100).clamp(1, 250);
+    let Some(db) = GlobalDb::open().await else {
+        return Json(json!({
+            "status": "missing_registry",
+            "projects": [],
+            "active_project_id": runtime.active_project_id(),
+            "active_project_root": runtime.active_project_root(),
+        }));
+    };
+
+    let mut projects = db.list_code_projects(limit + 1).await;
+    let truncated = projects.len() > limit;
+    projects.truncate(limit);
+    let active_project_id = runtime.active_project_id().map(str::to_string);
+    let rows = projects
+        .into_iter()
+        .map(|project| {
+            let is_active = Some(project.project_id.as_str()) == runtime.active_project_id();
+            let label = Path::new(&project.display_root)
+                .file_name()
+                .and_then(|name| name.to_str())
+                .unwrap_or(project.display_root.as_str())
+                .to_string();
+            json!({
+                "project_id": project.project_id,
+                "label": label,
+                "project_root": project.display_root,
+                "canonical_root": project.canonical_root,
+                "default_branch": project.default_branch,
+                "last_seen_at": project.last_seen_at,
+                "is_active": is_active,
+            })
+        })
+        .collect::<Vec<_>>();
+
+    Json(json!({
+        "status": "ok",
+        "limit": limit,
+        "truncated": truncated,
+        "active_project_id": active_project_id,
+        "active_project_root": runtime.active_project_root(),
+        "projects": rows,
+    }))
+}
+
+pub(crate) async fn context(
+    State(runtime): State<DashboardRuntime>,
+    AxumPath(project_id): AxumPath<String>,
+) -> (StatusCode, Json<Value>) {
+    let Some(db) = GlobalDb::open().await else {
+        return (
+            StatusCode::SERVICE_UNAVAILABLE,
+            Json(json!({
+                "status": "missing_registry",
+                "project": null,
+                "aliases": [],
+                "stores": [],
+            })),
+        );
+    };
+    let Some(context) = db.project_registry_context_by_id(&project_id).await else {
+        return (
+            StatusCode::NOT_FOUND,
+            Json(json!({
+                "status": "not_found",
+                "project": null,
+                "aliases": [],
+                "stores": [],
+            })),
+        );
+    };
+    let is_active = Some(project_id.as_str()) == runtime.active_project_id();
+    (
+        StatusCode::OK,
+        Json(json!({
+            "status": "ok",
+            "is_active": is_active,
+            "project": context.project,
+            "aliases": context.aliases,
+            "stores": context.stores,
+        })),
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::global_db::{
+        CodeProjectRecord, GraphScopeRecord, ProjectRegistryContext, ProjectStoreContext,
+        StoreArtifactRecord, StoreInstanceRecord,
+    };
+
+    fn code_project() -> CodeProjectRecord {
+        CodeProjectRecord {
+            project_id: "proj_test".to_string(),
+            canonical_root: "/repo".to_string(),
+            display_root: "/repo".to_string(),
+            git_common_dir: Some("/repo/.git".to_string()),
+            git_remote_url: Some("https://example.com/repo.git".to_string()),
+            default_branch: Some("main".to_string()),
+            created_at: 100,
+            last_seen_at: 200,
+        }
+    }
+
+    fn store_context() -> ProjectStoreContext {
+        ProjectStoreContext {
+            store: StoreInstanceRecord {
+                store_id: "store:test".to_string(),
+                project_id: "proj_test".to_string(),
+                store_kind: "code_project".to_string(),
+                storage_mode: "profile_sharded".to_string(),
+                store_relpath: "projects/proj_test".to_string(),
+                manifest_relpath: Some("projects/proj_test/store_manifest.json".to_string()),
+                created_at: 110,
+                last_verified_at: Some(210),
+                last_write_at: Some(220),
+            },
+            graph_scopes: vec![GraphScopeRecord {
+                graph_scope_id: "store:test:branch:main".to_string(),
+                project_id: "proj_test".to_string(),
+                store_id: "store:test".to_string(),
+                branch_name: "main".to_string(),
+                db_relpath: "projects/proj_test/branches/main.db".to_string(),
+                parent_scope_id: None,
+                last_synced_at: Some(230),
+                writable: true,
+            }],
+            artifacts: vec![StoreArtifactRecord {
+                store_id: "store:test".to_string(),
+                artifact_kind: "graph_db".to_string(),
+                relpath: "projects/proj_test/branches/main.db".to_string(),
+                size_bytes: Some(4096),
+                schema_version: None,
+                updated_at: Some(240),
+            }],
+        }
+    }
+
+    fn registry_context() -> ProjectRegistryContext {
+        ProjectRegistryContext {
+            project: code_project(),
+            aliases: Vec::new(),
+            stores: vec![store_context()],
+        }
+    }
+
+    #[test]
+    fn registry_context_changes_with_project_metadata() {
+        let base = registry_context();
+        let mut changed = registry_context();
+        changed.project.canonical_root = "/new-repo".to_string();
+        changed.project.last_seen_at += 1;
+
+        assert_ne!(base, changed);
+    }
+
+    #[test]
+    fn registry_context_changes_with_store_metadata() {
+        let base = registry_context();
+        let mut changed = registry_context();
+        changed.stores[0].store.last_write_at = Some(999);
+        changed.stores[0].graph_scopes[0].db_relpath =
+            "projects/proj_test/branches/feature.db".to_string();
+        changed.stores[0].artifacts[0].updated_at = Some(1000);
+
+        assert_ne!(base, changed);
+    }
+}
diff --git a/tests/common/mod.rs b/tests/common/mod.rs
index c39d70dc..d6ba171d 100644
--- a/tests/common/mod.rs
+++ b/tests/common/mod.rs
@@ -280,9 +280,13 @@ pub fn pick_free_port() -> u16 {
 }
 
 pub fn http_agent() -> ureq::Agent {
+    http_agent_with_timeout(Duration::from_secs(4))
+}
+
+pub fn http_agent_with_timeout(timeout: Duration) -> ureq::Agent {
     ureq::Agent::config_builder()
         .http_status_as_error(false)
-        .timeout_global(Some(Duration::from_secs(4)))
+        .timeout_global(Some(timeout))
         .build()
         .into()
 }
diff --git a/tests/dashboard_api_support/mod.rs b/tests/dashboard_api_support/mod.rs
index 04e2583b..14bc32ed 100644
--- a/tests/dashboard_api_support/mod.rs
+++ b/tests/dashboard_api_support/mod.rs
@@ -6,9 +6,9 @@ pub(crate) use std::process::Command;
 pub(crate) use std::thread;
 
 pub(crate) use crate::common::{
-    create_runtime, fake_codex_bin, get_json, http_agent, install_fake_codex_launcher,
-    pick_free_port, response_to_json, tempdir_or_panic, wait_for_dashboard, EnvVarGuard,
-    GLOBAL_DB_ENV, GLOBAL_DB_ENV_LOCK,
+    create_runtime, fake_codex_bin, get_json, http_agent, http_agent_with_timeout,
+    install_fake_codex_launcher, pick_free_port, response_to_json, tempdir_or_panic,
+    wait_for_dashboard, EnvVarGuard, GLOBAL_DB_ENV, GLOBAL_DB_ENV_LOCK,
 };
 pub(crate) use serde_json::Value;
 pub(crate) use tempfile::TempDir;
diff --git a/tests/dashboard_projects_api_test.rs b/tests/dashboard_projects_api_test.rs
new file mode 100644
index 00000000..7c98c49d
--- /dev/null
+++ b/tests/dashboard_projects_api_test.rs
@@ -0,0 +1,244 @@
+mod common;
+mod dashboard_api_support;
+
+use dashboard_api_support::*;
+use std::path::PathBuf;
+
+async fn setup_target_project(fixture: &DashboardFixture) -> (PathBuf, TraceDecay) {
+    let target_root = fixture
+        ._tmp
+        .path()
+        .canonicalize()
+        .expect("fixture root should canonicalize")
+        .join("target-project");
+    let target_cg = setup_project(&target_root).await;
+    (target_root, target_cg)
+}
+
+fn project_id(cg: &TraceDecay) -> String {
+    cg.store_layout()
+        .identity
+        .project_id
+        .clone()
+        .expect("profile-backed target should have project_id")
+}
+
+#[test]
+fn dashboard_projects_endpoint_lists_registered_projects_and_active_project() {
+    let _env_lock = GLOBAL_DB_ENV_LOCK
+        .lock()
+        .unwrap_or_else(|poisoned| poisoned.into_inner());
+    let runtime = create_runtime();
+    runtime.block_on(async {
+        let fixture = start_dashboard_fixture(false).await;
+        let agent = http_agent();
+
+        let (target_root, target_cg) = setup_target_project(&fixture).await;
+        seed_memory_fixture(&target_cg).await;
+        drop(target_cg);
+
+        let (status, projects) = get_json(&agent, &format!("{}/api/projects", fixture.base_url));
+        assert_eq!(status, 200);
+        assert_eq!(projects["status"], "ok");
+        assert_eq!(
+            projects["active_project_root"],
+            fixture.project_root.display().to_string()
+        );
+        let rows = projects["projects"]
+            .as_array()
+            .unwrap_or_else(|| panic!("expected project list array: {projects}"));
+        assert!(
+            rows.iter().any(|row| row["project_root"]
+                == fixture.project_root.display().to_string()
+                && row["is_active"] == true),
+            "active project should be identified in daemon project list: {projects}"
+        );
+        assert!(
+            rows.iter().any(
+                |row| row["project_root"] == target_root.display().to_string()
+                    && row["is_active"] == false
+            ),
+            "other registered project should be listed for selection: {projects}"
+        );
+    });
+}
+
+#[test]
+fn project_scoped_plugin_routes_read_selected_project_store() {
+    let _env_lock = GLOBAL_DB_ENV_LOCK
+        .lock()
+        .unwrap_or_else(|poisoned| poisoned.into_inner());
+    let runtime = create_runtime();
+    runtime.block_on(async {
+        let fixture = start_dashboard_fixture(false).await;
+        let agent = http_agent_with_timeout(std::time::Duration::from_secs(20));
+
+        let (_target_root, target_cg) = setup_target_project(&fixture).await;
+        let target_project_id = project_id(&target_cg);
+        target_cg
+            .db()
+            .conn()
+            .execute(
+                "INSERT INTO memory_facts
+                    (fact_id, content, category, tags, trust_score, retrieval_count, helpful_count, created_at, updated_at)
+                 VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)",
+                libsql::params![
+                    201_i64,
+                    "Target daemon project selector fact",
+                    "project",
+                    "[\"selector\"]",
+                    0.91_f64,
+                    1_i64,
+                    1_i64,
+                    1_700_010_000_i64,
+                    1_700_010_100_i64
+                ],
+            )
+            .await
+            .expect("target fact should insert");
+        target_cg
+            .checkpoint()
+            .await
+            .expect("target project DB should checkpoint before dashboard reopen");
+        target_cg.close();
+
+        let (active_status, active_payload) = get_json(
+            &agent,
+            &format!(
+                "{}/api/plugins/holographic/?q=selector&limit=10",
+                fixture.base_url
+            ),
+        );
+        assert_eq!(active_status, 200);
+        assert_eq!(
+            active_payload["holographic"]["facts"]
+                .as_array()
+                .map(Vec::len),
+            Some(0),
+            "active project should not contain target-only selector fact"
+        );
+
+        let (selected_status, selected_payload) = get_json(
+            &agent,
+            &format!(
+                "{}/api/projects/{}/plugins/holographic/?q=selector&limit=10",
+                fixture.base_url, target_project_id
+            ),
+        );
+        assert_eq!(selected_status, 200);
+        let selected_facts = selected_payload["holographic"]["facts"]
+            .as_array()
+            .unwrap_or_else(|| panic!("expected selected project facts: {selected_payload}"));
+        assert_eq!(selected_facts.len(), 1);
+        assert_eq!(
+            selected_facts[0]["content"],
+            "Target daemon project selector fact"
+        );
+    });
+}
+
+#[test]
+fn project_scoped_curation_preview_and_activity_do_not_leak_active_state() {
+    let _env_lock = GLOBAL_DB_ENV_LOCK
+        .lock()
+        .unwrap_or_else(|poisoned| poisoned.into_inner());
+    let runtime = create_runtime();
+    runtime.block_on(async {
+        let fixture = start_dashboard_fixture(false).await;
+        let agent = http_agent_with_timeout(std::time::Duration::from_secs(20));
+
+        let (_target_root, target_cg) = setup_target_project(&fixture).await;
+        let target_project_id = project_id(&target_cg);
+        target_cg
+            .checkpoint()
+            .await
+            .expect("target project DB should checkpoint before dashboard reopen");
+        target_cg.close();
+
+        let (active_curate_status, active_curate) = post_json_body(
+            &agent,
+            &format!("{}/api/plugins/holographic/curate", fixture.base_url),
+            &serde_json::json!({ "dry_run": true }),
+        );
+        assert_eq!(active_curate_status, 200);
+        assert_eq!(active_curate["dry_run"], true);
+
+        let (active_preview_status, active_preview) = get_json(
+            &agent,
+            &format!(
+                "{}/api/plugins/holographic/curation/preview",
+                fixture.base_url
+            ),
+        );
+        assert_eq!(active_preview_status, 200);
+        assert!(
+            !active_preview["report"].is_null(),
+            "active dry-run should save a preview"
+        );
+        let (active_activity_status, active_activity) = get_json(
+            &agent,
+            &format!(
+                "{}/api/plugins/holographic/curation/activity?limit=75",
+                fixture.base_url
+            ),
+        );
+        assert_eq!(active_activity_status, 200);
+        assert!(
+            active_activity["count"].as_i64().unwrap_or_default() > 0,
+            "active dry-run should record curation activity"
+        );
+
+        let (selected_preview_status, selected_preview) = get_json(
+            &agent,
+            &format!(
+                "{}/api/projects/{}/plugins/holographic/curation/preview",
+                fixture.base_url, target_project_id
+            ),
+        );
+        assert_eq!(selected_preview_status, 200);
+        assert!(
+            selected_preview["report"].is_null(),
+            "selected non-active project must not reuse the active preview: {selected_preview}"
+        );
+
+        let (selected_activity_status, selected_activity) = get_json(
+            &agent,
+            &format!(
+                "{}/api/projects/{}/plugins/holographic/curation/activity?limit=75",
+                fixture.base_url, target_project_id
+            ),
+        );
+        assert_eq!(selected_activity_status, 200);
+        assert_eq!(
+            selected_activity["count"], 0,
+            "selected non-active project must not reuse active curation activity: {selected_activity}"
+        );
+    });
+}
+
+#[test]
+fn project_scoped_mutations_are_rejected_for_non_active_projects() {
+    let _env_lock = GLOBAL_DB_ENV_LOCK
+        .lock()
+        .unwrap_or_else(|poisoned| poisoned.into_inner());
+    let runtime = create_runtime();
+    runtime.block_on(async {
+        let fixture = start_dashboard_fixture(false).await;
+        let agent = http_agent_with_timeout(std::time::Duration::from_secs(20));
+
+        let (_target_root, target_cg) = setup_target_project(&fixture).await;
+        let target_project_id = project_id(&target_cg);
+        target_cg.close();
+
+        let (status, body) = post_json_body(
+            &agent,
+            &format!(
+                "{}/api/projects/{}/plugins/holographic/curate",
+                fixture.base_url, target_project_id
+            ),
+            &serde_json::json!({ "dry_run": true }),
+        );
+        assert_eq!(status, 405);
+        assert_eq!(body["status"], "read_only_project");
+    });
+}