From d05d2904f3a98d932710906a415a82cca043aef7 Mon Sep 17 00:00:00 2001
From: ScriptedAlchemy <zack@module-federation.io>
Date: Mon, 29 Jun 2026 22:41:40 +0000
Subject: [PATCH 1/7] feat: add daemon dashboard project selector

---
 Cargo.lock                                    |   1 +
 Cargo.toml                                    |   1 +
 .../holographic/src/HolographicMemoryPage.tsx |   6 +-
 dashboard/shell/src/main.jsx                  |  70 ++++-
 dashboard/shell/src/sdk.jsx                   |  58 +++-
 dashboard/shell/src/styles.css                |  39 ++-
 dashboard/test/shell-sdk.test.mjs             |  56 ++++
 src/dashboard/memory_curate.rs                |   1 +
 src/dashboard/mod.rs                          | 135 +++++++++-
 src/dashboard/projects.rs                     | 248 ++++++++++++++++++
 tests/dashboard_api_test.rs                   | 131 +++++++++
 11 files changed, 720 insertions(+), 26 deletions(-)
 create mode 100644 src/dashboard/projects.rs

diff --git a/Cargo.lock b/Cargo.lock
index 6d1a7d25..6bcb6e0c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4536,6 +4536,7 @@ dependencies = [
  "tokensave-medium-treesitters",
  "tokio",
  "toml",
+ "tower 0.5.3",
  "tracing",
  "tree-sitter",
  "tree-sitter-hlsl",
diff --git a/Cargo.toml b/Cargo.toml
index 143ba8b5..3cf44539 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -104,6 +104,7 @@ path = "src/main.rs"
 
 [dependencies]
 axum = "0.8"
+tower = "0.5"
 libsql = "0.9.30"
 tree-sitter = "0.26"
 tree-sitter-language = "0.1"
diff --git a/dashboard/holographic/src/HolographicMemoryPage.tsx b/dashboard/holographic/src/HolographicMemoryPage.tsx
index 0676d93f..faddeb0c 100644
--- a/dashboard/holographic/src/HolographicMemoryPage.tsx
+++ b/dashboard/holographic/src/HolographicMemoryPage.tsx
@@ -333,9 +333,9 @@ function SearchBox({
   return (
     <div className="hm-searchbox relative min-w-0 w-full sm:max-w-xl">
       {refreshing ? (
-        <Spinner className="absolute left-2.5 top-1/2 -translate-y-1/2 text-[0.875rem] text-primary" />
+        <Spinner className="text-[0.875rem] text-primary" />
       ) : (
-        <Search className="absolute left-2.5 top-1/2 h-3.5 w-3.5 -translate-y-1/2 text-muted-foreground" />
+        <Search className="text-muted-foreground" />
       )}
       <Input
         placeholder="Search holographic facts"
@@ -347,7 +347,7 @@ function SearchBox({
         <Button
           ghost
           size="xs"
-          className="absolute right-1.5 top-1/2 -translate-y-1/2 text-muted-foreground hover:text-foreground"
+          className="text-muted-foreground hover:text-foreground"
           onClick={() => setQuery("")}
           aria-label="Clear"
         >
diff --git a/dashboard/shell/src/main.jsx b/dashboard/shell/src/main.jsx
index ac835660..7c98f132 100644
--- a/dashboard/shell/src/main.jsx
+++ b/dashboard/shell/src/main.jsx
@@ -13,7 +13,7 @@
 
 import React, { useEffect, useState, useCallback, useRef, useSyncExternalStore } from "react";
 import { createRoot } from "react-dom/client";
-import { buildSDK, fetchJSON, cn } from "./sdk.jsx";
+import { buildSDK, fetchJSON, cn, setSelectedProjectId as setSDKSelectedProjectId } from "./sdk.jsx";
 
 // ---------------------------------------------------------------------------
 // Registry
@@ -174,6 +174,14 @@ function injectPluginAssets(manifest) {
 
 const POLL_INTERVAL_MS = 15_000;
 
+function basename(path) {
+  return path?.split("/").filter(Boolean).pop() || path;
+}
+
+function projectLabel(project) {
+  return project?.label || basename(project?.project_root) || project?.project_id || "Project";
+}
+
 // ---------------------------------------------------------------------------
 // App
 // ---------------------------------------------------------------------------
@@ -181,6 +189,9 @@ const POLL_INTERVAL_MS = 15_000;
 function App() {
   const [plugins, setPlugins] = useState([]);
   const [capabilities, setCapabilities] = useState(null);
+  const [projects, setProjects] = useState([]);
+  const [selectedProjectId, setSelectedProjectId] = useState("");
+  const [projectRevision, setProjectRevision] = useState(0);
   const [active, setActive] = useState("");
   // Tabs that have been activated at least once; their panels stay mounted
   // (hidden) afterwards so in-progress exploration survives tab switches.
@@ -259,16 +270,25 @@ function App() {
     }
   }, []);
 
-  // Initial load: plugin list + capabilities in parallel.
+  // Initial load: plugin manifests are daemon-wide; project inventory selects
+  // which project-scoped APIs plugin panels should read from.
   useEffect(() => {
     let cancelled = false;
     (async () => {
       try {
-        const [list] = await Promise.all([
+        const [list, projectPayload] = await Promise.all([
           fetchJSON("/api/dashboard/plugins"),
-          fetchCapabilities(),
+          fetchJSON("/api/projects"),
         ]);
         if (cancelled) return;
+        const rows = Array.isArray(projectPayload?.projects) ? projectPayload.projects : [];
+        const initialProjectId =
+          projectPayload?.active_project_id || rows.find((p) => p.is_active)?.project_id || rows[0]?.project_id || "";
+        setProjects(rows);
+        setSelectedProjectId(initialProjectId);
+        setSDKSelectedProjectId(initialProjectId);
+        await fetchCapabilities();
+        if (cancelled) return;
         setPlugins(list);
         if (list.length > 0) {
           const fromUrl = tabFromUrl();
@@ -290,6 +310,20 @@ function App() {
     };
   }, []); // eslint-disable-line react-hooks/exhaustive-deps
 
+  const onProjectChange = useCallback(
+    async (event) => {
+      const next = event.target.value;
+      if (next === selectedProjectId) return;
+      setSelectedProjectId(next);
+      setSDKSelectedProjectId(next);
+      setCapabilities(null);
+      setProjectRevision((rev) => rev + 1);
+      setVisited(active ? new Set([active]) : new Set());
+      await fetchCapabilities();
+    },
+    [active, fetchCapabilities, selectedProjectId],
+  );
+
   // Poll capabilities for connection health — but only while the browser tab
   // is visible; a hidden tab refreshes once on return instead.
   useEffect(() => {
@@ -366,8 +400,12 @@ function App() {
 
   const activeManifest = plugins.find((p) => p.name === active);
   const ActiveComponent = registered.get(active);
-  const projectName =
-    capabilities?.project_root?.split("/").filter(Boolean).pop() ?? capabilities?.project_root;
+  const selectedProject =
+    projects.find((p) => p.project_id === selectedProjectId) ||
+    projects.find((p) => p.is_active) ||
+    null;
+  const projectName = selectedProject ? projectLabel(selectedProject) : basename(capabilities?.project_root);
+  const projectRoot = selectedProject?.project_root || capabilities?.project_root;
 
   const connLabel =
     connState === "ok"
@@ -383,7 +421,7 @@ function App() {
           <span className="ts-shell-logo" aria-hidden="true">◳</span>
           <h1 className="ts-shell-title">tracedecay</h1>
           {projectName && (
-            <span className="ts-shell-project" title={capabilities?.project_root}>
+            <span className="ts-shell-project" title={projectRoot}>
               {projectName}
             </span>
           )}
@@ -418,6 +456,22 @@ function App() {
         </div>
 
         <div className="ts-shell-controls">
+          {projects.length > 0 && (
+            <select
+              className="ts-project-select"
+              value={selectedProjectId}
+              onChange={onProjectChange}
+              aria-label="Project"
+              title={projectRoot || "Project"}
+            >
+              {projects.map((project) => (
+                <option key={project.project_id} value={project.project_id}>
+                  {projectLabel(project)}
+                </option>
+              ))}
+            </select>
+          )}
+
           <button
             className={cn("ts-conn-indicator", `ts-conn-indicator-${connState}`)}
             title={connLabel}
@@ -479,7 +533,7 @@ function App() {
             const Component = registered.get(p.name);
             return (
               <div
-                key={p.name}
+                key={`${selectedProjectId || "active"}:${projectRevision}:${p.name}`}
                 role="tabpanel"
                 id={`ts-tabpanel-${p.name}`}
                 aria-labelledby={`ts-tab-${p.name}`}
diff --git a/dashboard/shell/src/sdk.jsx b/dashboard/shell/src/sdk.jsx
index 849e8d82..06c33561 100644
--- a/dashboard/shell/src/sdk.jsx
+++ b/dashboard/shell/src/sdk.jsx
@@ -29,8 +29,57 @@ import { cn as cnImpl } from "../../lib/cn";
 export { makeSequence };
 export const cn = cnImpl;
 
+const projectListeners = new Set();
+let selectedProjectId = "";
+
+function notifyProjectListeners() {
+  for (const fn of projectListeners) {
+    try {
+      fn(selectedProjectId);
+    } catch {
+      /* listener errors should not break plugin fetches */
+    }
+  }
+}
+
+function isScopedApiUrl(url, prefix) {
+  return url === prefix || url.startsWith(`${prefix}/`) || url.startsWith(`${prefix}?`);
+}
+
+export function getSelectedProjectId() {
+  return selectedProjectId;
+}
+
+export function setSelectedProjectId(projectId) {
+  const next = String(projectId || "");
+  if (next === selectedProjectId) return;
+  selectedProjectId = next;
+  notifyProjectListeners();
+}
+
+export function subscribeSelectedProject(fn) {
+  projectListeners.add(fn);
+  return () => projectListeners.delete(fn);
+}
+
+export function projectScopedUrl(url) {
+  if (!selectedProjectId || typeof url !== "string" || !url.startsWith("/")) return url;
+  if (
+    !isScopedApiUrl(url, "/api/plugins") &&
+    !isScopedApiUrl(url, "/api/automation") &&
+    !isScopedApiUrl(url, "/api/capabilities")
+  ) {
+    return url;
+  }
+  return `/api/projects/${encodeURIComponent(selectedProjectId)}${url.slice("/api".length)}`;
+}
+
+export function authedFetch(url, init) {
+  return fetch(projectScopedUrl(url), init);
+}
+
 export async function fetchJSON(url, init) {
-  const res = await fetch(url, init);
+  const res = await authedFetch(url, init);
   if (!res.ok) {
     let detail = `${res.status} ${res.statusText}`;
     let body;
@@ -171,7 +220,7 @@ export function buildSDK() {
     hooks: { useState, useEffect, useCallback, useMemo, useRef, useContext, createContext },
     api: {},
     fetchJSON,
-    authedFetch: (url, init) => fetch(url, init),
+    authedFetch,
     buildWsUrl: (p) => p,
     buildWsAuthParam: () => ["", ""],
     /**
@@ -182,6 +231,11 @@ export function buildSDK() {
      * Null until the first successful fetch.
      */
     capabilities: null,
+    projects: {
+      getSelectedProjectId,
+      setSelectedProjectId,
+      subscribe: subscribeSelectedProject,
+    },
     components: {
       Card,
       CardHeader,
diff --git a/dashboard/shell/src/styles.css b/dashboard/shell/src/styles.css
index 9732fbb5..26555c41 100644
--- a/dashboard/shell/src/styles.css
+++ b/dashboard/shell/src/styles.css
@@ -531,6 +531,35 @@ select:focus-visible {
   flex-shrink: 0;
 }
 
+.ts-project-select {
+  appearance: none;
+  background:
+    linear-gradient(45deg, transparent 50%, var(--ts-text-3) 50%) calc(100% - 0.82rem) 50% / 5px 5px no-repeat,
+    linear-gradient(135deg, var(--ts-text-3) 50%, transparent 50%) calc(100% - 0.58rem) 50% / 5px 5px no-repeat,
+    var(--ts-conn-bg);
+  border: 1px solid var(--ts-line);
+  border-radius: 999px;
+  color: var(--ts-text-2);
+  cursor: pointer;
+  font-family: var(--theme-font-mono);
+  font-size: 0.72rem;
+  line-height: 1;
+  max-width: min(22vw, 18rem);
+  min-width: 10rem;
+  overflow: hidden;
+  padding: 0.43rem 1.55rem 0.43rem 0.72rem;
+  text-overflow: ellipsis;
+  transition: background-color 0.16s ease, border-color 0.16s ease, color 0.16s ease;
+  white-space: nowrap;
+}
+
+.ts-project-select:hover,
+.ts-project-select:focus {
+  border-color: var(--ts-line-strong);
+  color: var(--ts-text);
+  outline: none;
+}
+
 /* Connection indicator */
 .ts-conn-indicator {
   appearance: none;
@@ -814,7 +843,15 @@ select:focus-visible {
   }
 
   .ts-shell-controls {
-    align-self: flex-end;
+    align-self: stretch;
+    flex-wrap: wrap;
+    justify-content: flex-end;
+  }
+
+  .ts-project-select {
+    flex: 1 1 12rem;
+    max-width: none;
+    min-width: 0;
   }
 
   .ts-conn-time {
diff --git a/dashboard/test/shell-sdk.test.mjs b/dashboard/test/shell-sdk.test.mjs
index 7e4b6e4b..724d575f 100644
--- a/dashboard/test/shell-sdk.test.mjs
+++ b/dashboard/test/shell-sdk.test.mjs
@@ -40,6 +40,62 @@ test("fetchJSON returns parsed body on success", async () => {
   assert.deepEqual(seen, [["/ok", { method: "POST" }]]);
 });
 
+test("project scoped fetchJSON rewrites plugin and capability API calls", async () => {
+  const seen = [];
+  await withMockedFetch(
+    async (url, init) => {
+      seen.push([url, init]);
+      return {
+        ok: true,
+        json: async () => ({ ok: true }),
+      };
+    },
+    async () => {
+      sdk.setSelectedProjectId("proj_alpha");
+      await sdk.fetchJSON("/api/plugins/holographic/status?limit=2", { method: "GET" });
+      await sdk.fetchJSON("/api/automation/skills");
+      await sdk.fetchJSON("/api/capabilities");
+      await sdk.authedFetch("/api/plugins/graph/search?q=fn");
+    },
+  );
+
+  assert.deepEqual(seen, [
+    ["/api/projects/proj_alpha/plugins/holographic/status?limit=2", { method: "GET" }],
+    ["/api/projects/proj_alpha/automation/skills", undefined],
+    ["/api/projects/proj_alpha/capabilities", undefined],
+    ["/api/projects/proj_alpha/plugins/graph/search?q=fn", undefined],
+  ]);
+  sdk.setSelectedProjectId("");
+});
+
+test("project scoping leaves daemon APIs and absolute URLs unchanged", async () => {
+  const seen = [];
+  await withMockedFetch(
+    async (url, init) => {
+      seen.push([url, init]);
+      return {
+        ok: true,
+        json: async () => ({ ok: true }),
+      };
+    },
+    async () => {
+      sdk.setSelectedProjectId("proj_beta");
+      await sdk.fetchJSON("/api/projects");
+      await sdk.fetchJSON("/api/projects/proj_beta");
+      await sdk.fetchJSON("/api/dashboard/plugins");
+      await sdk.fetchJSON("https://example.test/api/plugins/holographic");
+    },
+  );
+
+  assert.deepEqual(seen, [
+    ["/api/projects", undefined],
+    ["/api/projects/proj_beta", undefined],
+    ["/api/dashboard/plugins", undefined],
+    ["https://example.test/api/plugins/holographic", undefined],
+  ]);
+  sdk.setSelectedProjectId("");
+});
+
 test("fetchJSON prefers JSON detail on failure", async () => {
   const body = {
     detail: "token expired",
diff --git a/src/dashboard/memory_curate.rs b/src/dashboard/memory_curate.rs
index 76d261d7..b6f0f7bb 100644
--- a/src/dashboard/memory_curate.rs
+++ b/src/dashboard/memory_curate.rs
@@ -120,6 +120,7 @@ async fn cli_state(cg: &TraceDecay) -> DashboardState {
     let (mem_conn, mem_db_path) = super::resolve_project_memory_store(cg).await;
     let store_layout = cg.store_layout();
     DashboardState {
+        project_id: store_layout.identity.project_id.clone(),
         graph_conn: cg.dashboard_connection(),
         graph_db_path: cg.dashboard_db_path().display().to_string(),
         mem_conn,
diff --git a/src/dashboard/mod.rs b/src/dashboard/mod.rs
index 0485dcc7..afa15206 100644
--- a/src/dashboard/mod.rs
+++ b/src/dashboard/mod.rs
@@ -42,6 +42,7 @@ mod memory_api;
 pub mod memory_curate;
 mod memory_queries;
 mod memory_service;
+mod projects;
 mod savings_api;
 mod savings_pricing;
 mod token_count;
@@ -51,12 +52,15 @@ use std::path::{Path, PathBuf};
 use std::sync::atomic::AtomicBool;
 use std::sync::Arc;
 
-use axum::extract::State;
-use axum::response::Json;
-use axum::routing::{get, post};
+use axum::body::Body;
+use axum::extract::{Path as AxumPath, State};
+use axum::http::{Request, StatusCode, Uri};
+use axum::response::{IntoResponse, Json, Response};
+use axum::routing::{any, get, post};
 use axum::Router;
 use serde_json::{json, Value};
 use tokio::sync::RwLock;
+use tower::ServiceExt;
 
 use crate::automation::backend;
 use crate::automation::config::{self, AutomationBackend, AutomationHostMode};
@@ -87,6 +91,8 @@ pub(crate) struct CuratePreviewEntry {
 
 #[derive(Clone)]
 pub(crate) struct DashboardState {
+    /// Registered project id for profile-backed stores, when known.
+    pub(crate) project_id: Option<String>,
     /// Active code-graph database. This can be branch-specific.
     pub(crate) graph_conn: libsql::Connection,
     /// Display path of the active code-graph database.
@@ -231,9 +237,11 @@ pub(crate) async fn resolve_project_memory_store(cg: &TraceDecay) -> (libsql::Co
     })
 }
 
-/// Builds the dashboard state shared by the CLI `run` path and the
-/// `tracedecay_dashboard` MCP tool.
-pub(crate) async fn build_state(cg: &TraceDecay) -> DashboardState {
+async fn build_state_inner(
+    cg: &TraceDecay,
+    repair_memory_on_startup: bool,
+    warm_token_counts: bool,
+) -> DashboardState {
     let (mem_conn, mem_db_path) = resolve_project_memory_store(cg).await;
     let lcm = resolve_lcm_store(cg).await;
     // Re-hydrate the last dry-run curation preview from its sidecar so it
@@ -252,6 +260,7 @@ pub(crate) async fn build_state(cg: &TraceDecay) -> DashboardState {
         .map(|p| p.display().to_string())
         .unwrap_or_default();
     let state = DashboardState {
+        project_id: cg.store_layout().identity.project_id.clone(),
         graph_conn: cg.dashboard_connection(),
         graph_db_path: cg.dashboard_db_path().display().to_string(),
         mem_conn,
@@ -271,15 +280,31 @@ pub(crate) async fn build_state(cg: &TraceDecay) -> DashboardState {
         code_diagnostics: Arc::new(RwLock::new(code_diagnostics)),
         code_diagnostics_backfill_started: Arc::new(AtomicBool::new(false)),
     };
-    if let Err(err) = memory_api::repair_derived_memory(&state).await {
-        eprintln!("Dashboard memory repair skipped: {err}");
+    if repair_memory_on_startup {
+        if let Err(err) = memory_api::repair_derived_memory(&state).await {
+            eprintln!("Dashboard memory repair skipped: {err}");
+        }
     }
     // Pre-count non-usage messages in the background so the first Savings
     // tab paint doesn't pay the initial BPE pass over the session store.
-    token_count::spawn_warm(state.clone());
+    if warm_token_counts {
+        token_count::spawn_warm(state.clone());
+    }
     state
 }
 
+/// Builds the dashboard state shared by the CLI `run` path and the
+/// `tracedecay_dashboard` MCP tool.
+pub(crate) async fn build_state(cg: &TraceDecay) -> DashboardState {
+    build_state_inner(cg, true, true).await
+}
+
+/// Builds a lightweight cached state for a non-active project selected from the
+/// dashboard project picker.
+pub(crate) async fn build_selected_project_state(cg: &TraceDecay) -> DashboardState {
+    build_state_inner(cg, false, false).await
+}
+
 /// Detached catch-up ingest for transcript sources (Claude, Codex, Vibe,
 /// Cline-like, and Cursor's historical backlog), mirroring the MCP serve
 /// startup sweep so a standalone `tracedecay dashboard` reflects transcripts
@@ -301,7 +326,7 @@ fn spawn_session_catch_up_ingest(project_root: PathBuf) {
     });
 }
 
-fn config_error(message: impl Into<String>) -> TraceDecayError {
+pub(crate) fn config_error(message: impl Into<String>) -> TraceDecayError {
     TraceDecayError::Config {
         message: message.into(),
     }
@@ -372,6 +397,7 @@ pub(crate) async fn bind_dashboard(
 }
 
 pub(crate) fn router(state: DashboardState) -> Router {
+    let runtime = projects::DashboardRuntime::new(state);
     Router::new()
         .route("/", get(assets::index_html))
         .route("/shell/{file}", get(assets::shell_asset))
@@ -379,8 +405,22 @@ pub(crate) fn router(state: DashboardState) -> Router {
             "/dashboard-plugins/{plugin}/dist/{file}",
             get(assets::plugin_asset),
         )
-        .route("/api/capabilities", get(capabilities))
         .route("/api/dashboard/plugins", get(plugins_list))
+        .route("/api/projects", get(projects::list))
+        .route("/api/projects/{project_id}", get(projects::context))
+        .route(
+            "/api/projects/{project_id}/{*tail}",
+            any(project_scoped_api_gateway),
+        )
+        .route("/api/capabilities", any(active_api_gateway))
+        .route("/api/plugins/{*tail}", any(active_api_gateway))
+        .route("/api/automation/{*tail}", any(active_api_gateway))
+        .with_state(runtime)
+}
+
+fn project_api_router() -> Router<DashboardState> {
+    Router::new()
+        .route("/api/capabilities", get(capabilities))
         // Holographic memory plugin API (mirrors holographic_plus plugin_api.py)
         .route("/api/plugins/holographic/", get(memory_api::overview))
         .route("/api/plugins/holographic", get(memory_api::overview))
@@ -590,7 +630,77 @@ pub(crate) fn router(state: DashboardState) -> Router {
         .route("/api/plugins/savings/sessions", get(savings_api::sessions))
         .route("/api/plugins/savings/models", get(savings_api::models))
         .route("/api/plugins/savings/pricing", get(savings_api::pricing))
-        .with_state(state)
+}
+
+async fn active_api_gateway(
+    State(runtime): State<projects::DashboardRuntime>,
+    req: Request<Body>,
+) -> Response {
+    forward_project_request(runtime.active_state(), req).await
+}
+
+async fn project_scoped_api_gateway(
+    State(runtime): State<projects::DashboardRuntime>,
+    AxumPath((project_id, tail)): AxumPath<(String, String)>,
+    mut req: Request<Body>,
+) -> Response {
+    let state_result = if tail.starts_with("plugins/holographic") {
+        runtime.memory_state_for_project(&project_id).await
+    } else {
+        runtime.state_for_project(&project_id).await
+    };
+    let state = match state_result {
+        Ok(state) => state,
+        Err(err) => {
+            return (
+                StatusCode::NOT_FOUND,
+                Json(json!({
+                    "status": "not_found",
+                    "detail": err.to_string(),
+                    "project_id": project_id,
+                })),
+            )
+                .into_response();
+        }
+    };
+
+    let query = req
+        .uri()
+        .query()
+        .map(|query| format!("?{query}"))
+        .unwrap_or_default();
+    let rewritten = format!("/api/{tail}{query}");
+    match rewritten.parse::<Uri>() {
+        Ok(uri) => {
+            *req.uri_mut() = uri;
+            forward_project_request(state, req).await
+        }
+        Err(err) => (
+            StatusCode::BAD_REQUEST,
+            Json(json!({
+                "status": "bad_request",
+                "detail": format!("invalid project-scoped dashboard path: {err}"),
+            })),
+        )
+            .into_response(),
+    }
+}
+
+async fn forward_project_request(state: DashboardState, req: Request<Body>) -> Response {
+    let (mut parts, body) = req.into_parts();
+    parts.extensions.clear();
+    let req = Request::from_parts(parts, body);
+    match project_api_router().with_state(state).oneshot(req).await {
+        Ok(response) => response,
+        Err(err) => (
+            StatusCode::INTERNAL_SERVER_ERROR,
+            Json(json!({
+                "status": "error",
+                "detail": format!("dashboard project route failed: {err}"),
+            })),
+        )
+            .into_response(),
+    }
 }
 
 /// Capability discovery for hosts and future delegated-host extensions. The UI
@@ -622,6 +732,7 @@ async fn capabilities(State(state): State<DashboardState>) -> Json<Value> {
         "name": "tracedecay-dashboard",
         "version": env!("CARGO_PKG_VERSION"),
         "mode": "standalone",
+        "project_id": state.project_id,
         "project_root": state.project_root.display().to_string(),
         "storage_mode": state.storage_mode,
         "store_root": state.store_root.display().to_string(),
diff --git a/src/dashboard/projects.rs b/src/dashboard/projects.rs
new file mode 100644
index 00000000..112abe25
--- /dev/null
+++ b/src/dashboard/projects.rs
@@ -0,0 +1,248 @@
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+
+use axum::extract::{Path as AxumPath, Query, State};
+use axum::http::StatusCode;
+use axum::response::Json;
+use serde::Deserialize;
+use serde_json::{json, Value};
+use tokio::sync::RwLock;
+
+use super::{build_selected_project_state, config_error, DashboardState};
+use crate::db::Database;
+use crate::errors::Result;
+use crate::global_db::{GlobalDb, ProjectRegistryContext};
+use crate::storage::{self, StoreArtifactPath};
+use crate::tracedecay::TraceDecay;
+
+#[derive(Clone)]
+pub(crate) struct DashboardRuntime {
+    active: DashboardState,
+    project_states: Arc<RwLock<HashMap<String, DashboardState>>>,
+    memory_project_states: Arc<RwLock<HashMap<String, DashboardState>>>,
+}
+
+impl DashboardRuntime {
+    pub(crate) fn new(active: DashboardState) -> Self {
+        Self {
+            active,
+            project_states: Arc::new(RwLock::new(HashMap::new())),
+            memory_project_states: Arc::new(RwLock::new(HashMap::new())),
+        }
+    }
+
+    pub(crate) fn active_state(&self) -> DashboardState {
+        self.active.clone()
+    }
+
+    pub(crate) fn active_project_id(&self) -> Option<&str> {
+        self.active.project_id.as_deref()
+    }
+
+    fn active_project_root(&self) -> String {
+        self.active.project_root.display().to_string()
+    }
+
+    pub(crate) async fn state_for_project(&self, project_id: &str) -> Result<DashboardState> {
+        if self.active.project_id.as_deref() == Some(project_id) {
+            return Ok(self.active.clone());
+        }
+
+        if let Some(state) = self.project_states.read().await.get(project_id).cloned() {
+            return Ok(state);
+        }
+
+        let db = GlobalDb::open()
+            .await
+            .ok_or_else(|| config_error("could not open tracedecay project registry"))?;
+        let context = db
+            .project_registry_context_by_id(project_id)
+            .await
+            .ok_or_else(|| config_error(format!("registered project not found: {project_id}")))?;
+        let project_root = PathBuf::from(context.project.display_root);
+        let cg = TraceDecay::open_read_only(&project_root).await?;
+        let state = build_selected_project_state(&cg).await;
+        self.project_states
+            .write()
+            .await
+            .insert(project_id.to_string(), state.clone());
+        Ok(state)
+    }
+
+    pub(crate) async fn memory_state_for_project(
+        &self,
+        project_id: &str,
+    ) -> Result<DashboardState> {
+        if self.active.project_id.as_deref() == Some(project_id) {
+            return Ok(self.active.clone());
+        }
+
+        if let Some(state) = self
+            .memory_project_states
+            .read()
+            .await
+            .get(project_id)
+            .cloned()
+        {
+            return Ok(state);
+        }
+
+        let db = GlobalDb::open()
+            .await
+            .ok_or_else(|| config_error("could not open tracedecay project registry"))?;
+        let context = db
+            .project_registry_context_by_id(project_id)
+            .await
+            .ok_or_else(|| config_error(format!("registered project not found: {project_id}")))?;
+        let state = self.memory_state_from_registry(&context).await?;
+        self.memory_project_states
+            .write()
+            .await
+            .insert(project_id.to_string(), state.clone());
+        Ok(state)
+    }
+
+    async fn memory_state_from_registry(
+        &self,
+        context: &ProjectRegistryContext,
+    ) -> Result<DashboardState> {
+        let profile_root = storage::default_profile_root()?;
+        let store = context
+            .stores
+            .iter()
+            .find(|store| {
+                store.store.store_kind == "code_project"
+                    && store.store.storage_mode == "profile_sharded"
+            })
+            .ok_or_else(|| {
+                config_error(format!(
+                    "registered project has no profile-sharded code-project store: {}",
+                    context.project.project_id
+                ))
+            })?;
+        let store_root =
+            StoreArtifactPath::resolve(&profile_root, Path::new(&store.store.store_relpath))?
+                .absolute_path();
+        let graph_db_path = match store.store.manifest_relpath.as_deref() {
+            Some(relpath) => {
+                let manifest_path =
+                    StoreArtifactPath::resolve(&profile_root, Path::new(relpath))?.absolute_path();
+                match storage::read_store_manifest(&manifest_path) {
+                    Ok(manifest) => store_root.join(manifest.graph_db_relpath),
+                    Err(_) => store_root.join(crate::config::db_filename(&store_root)),
+                }
+            }
+            None => store_root.join(crate::config::db_filename(&store_root)),
+        };
+        let (db, _) = Database::open_read_only(&graph_db_path).await?;
+        let conn = db.conn().clone();
+        let mut state = self.active.clone();
+        state.project_id = Some(context.project.project_id.clone());
+        state.graph_conn = conn.clone();
+        state.graph_db_path = graph_db_path.display().to_string();
+        state.mem_conn = conn;
+        state.mem_db_path = graph_db_path.display().to_string();
+        state.lcm_conn = None;
+        state.lcm_db_path.clear();
+        state.lcm_scope.clone_from(&store.store.storage_mode);
+        state.project_root = PathBuf::from(&context.project.display_root);
+        state.storage_mode.clone_from(&store.store.storage_mode);
+        state.store_root.clone_from(&store_root);
+        state.dashboard_root = store_root.join("dashboard");
+        Ok(state)
+    }
+}
+
+#[derive(Debug, Deserialize)]
+pub(crate) struct ProjectsParams {
+    limit: Option<usize>,
+}
+
+pub(crate) async fn list(
+    State(runtime): State<DashboardRuntime>,
+    Query(params): Query<ProjectsParams>,
+) -> Json<Value> {
+    let limit = params.limit.unwrap_or(100).clamp(1, 250);
+    let Some(db) = GlobalDb::open().await else {
+        return Json(json!({
+            "status": "missing_registry",
+            "projects": [],
+            "active_project_id": runtime.active_project_id(),
+            "active_project_root": runtime.active_project_root(),
+        }));
+    };
+
+    let mut projects = db.list_code_projects(limit + 1).await;
+    let truncated = projects.len() > limit;
+    projects.truncate(limit);
+    let active_project_id = runtime.active_project_id().map(str::to_string);
+    let rows = projects
+        .into_iter()
+        .map(|project| {
+            let is_active = Some(project.project_id.as_str()) == runtime.active_project_id();
+            let label = Path::new(&project.display_root)
+                .file_name()
+                .and_then(|name| name.to_str())
+                .unwrap_or(project.display_root.as_str())
+                .to_string();
+            json!({
+                "project_id": project.project_id,
+                "label": label,
+                "project_root": project.display_root,
+                "canonical_root": project.canonical_root,
+                "default_branch": project.default_branch,
+                "last_seen_at": project.last_seen_at,
+                "is_active": is_active,
+            })
+        })
+        .collect::<Vec<_>>();
+
+    Json(json!({
+        "status": "ok",
+        "limit": limit,
+        "truncated": truncated,
+        "active_project_id": active_project_id,
+        "active_project_root": runtime.active_project_root(),
+        "projects": rows,
+    }))
+}
+
+pub(crate) async fn context(
+    State(runtime): State<DashboardRuntime>,
+    AxumPath(project_id): AxumPath<String>,
+) -> (StatusCode, Json<Value>) {
+    let Some(db) = GlobalDb::open().await else {
+        return (
+            StatusCode::SERVICE_UNAVAILABLE,
+            Json(json!({
+                "status": "missing_registry",
+                "project": null,
+                "aliases": [],
+                "stores": [],
+            })),
+        );
+    };
+    let Some(context) = db.project_registry_context_by_id(&project_id).await else {
+        return (
+            StatusCode::NOT_FOUND,
+            Json(json!({
+                "status": "not_found",
+                "project": null,
+                "aliases": [],
+                "stores": [],
+            })),
+        );
+    };
+    let is_active = Some(project_id.as_str()) == runtime.active_project_id();
+    (
+        StatusCode::OK,
+        Json(json!({
+            "status": "ok",
+            "is_active": is_active,
+            "project": context.project,
+            "aliases": context.aliases,
+            "stores": context.stores,
+        })),
+    )
+}
diff --git a/tests/dashboard_api_test.rs b/tests/dashboard_api_test.rs
index bfee2628..f74b7f1e 100644
--- a/tests/dashboard_api_test.rs
+++ b/tests/dashboard_api_test.rs
@@ -44,6 +44,137 @@ fn dashboard_plugin_manifest_assets_are_served() {
     });
 }
 
+#[test]
+fn dashboard_projects_endpoint_lists_registered_projects_and_active_project() {
+    let _env_lock = GLOBAL_DB_ENV_LOCK
+        .lock()
+        .unwrap_or_else(|poisoned| poisoned.into_inner());
+    let runtime = create_runtime();
+    runtime.block_on(async {
+        let fixture = start_dashboard_fixture(false).await;
+        let agent = http_agent();
+
+        let target_root = fixture
+            ._tmp
+            .path()
+            .canonicalize()
+            .expect("fixture root should canonicalize")
+            .join("target-project");
+        let target_cg = setup_project(&target_root).await;
+        seed_memory_fixture(&target_cg).await;
+        drop(target_cg);
+
+        let (status, projects) = get_json(&agent, &format!("{}/api/projects", fixture.base_url));
+        assert_eq!(status, 200);
+        assert_eq!(projects["status"], "ok");
+        assert_eq!(
+            projects["active_project_root"],
+            fixture.project_root.display().to_string()
+        );
+        let rows = projects["projects"]
+            .as_array()
+            .unwrap_or_else(|| panic!("expected project list array: {projects}"));
+        assert!(
+            rows.iter().any(|row| row["project_root"]
+                == fixture.project_root.display().to_string()
+                && row["is_active"] == true),
+            "active project should be identified in daemon project list: {projects}"
+        );
+        assert!(
+            rows.iter().any(
+                |row| row["project_root"] == target_root.display().to_string()
+                    && row["is_active"] == false
+            ),
+            "other registered project should be listed for selection: {projects}"
+        );
+    });
+}
+
+#[test]
+fn project_scoped_plugin_routes_read_selected_project_store() {
+    let _env_lock = GLOBAL_DB_ENV_LOCK
+        .lock()
+        .unwrap_or_else(|poisoned| poisoned.into_inner());
+    let runtime = create_runtime();
+    runtime.block_on(async {
+        let fixture = start_dashboard_fixture(false).await;
+        let agent = http_agent();
+
+        let target_root = fixture
+            ._tmp
+            .path()
+            .canonicalize()
+            .expect("fixture root should canonicalize")
+            .join("target-project");
+        let target_cg = setup_project(&target_root).await;
+        let target_project_id = target_cg
+            .store_layout()
+            .identity
+            .project_id
+            .clone()
+            .expect("profile-backed target should have project_id");
+        target_cg
+            .db()
+            .conn()
+            .execute(
+                "INSERT INTO memory_facts
+                    (fact_id, content, category, tags, trust_score, retrieval_count, helpful_count, created_at, updated_at)
+                 VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)",
+                libsql::params![
+                    201_i64,
+                    "Target daemon project selector fact",
+                    "project",
+                    "[\"selector\"]",
+                    0.91_f64,
+                    1_i64,
+                    1_i64,
+                    1_700_010_000_i64,
+                    1_700_010_100_i64
+                ],
+            )
+            .await
+            .expect("target fact should insert");
+        target_cg
+            .checkpoint()
+            .await
+            .expect("target project DB should checkpoint before dashboard reopen");
+        target_cg.close();
+
+        let (active_status, active_payload) = get_json(
+            &agent,
+            &format!(
+                "{}/api/plugins/holographic/?q=selector&limit=10",
+                fixture.base_url
+            ),
+        );
+        assert_eq!(active_status, 200);
+        assert_eq!(
+            active_payload["holographic"]["facts"]
+                .as_array()
+                .map(Vec::len),
+            Some(0),
+            "active project should not contain target-only selector fact"
+        );
+
+        let (selected_status, selected_payload) = get_json(
+            &agent,
+            &format!(
+                "{}/api/projects/{}/plugins/holographic/?q=selector&limit=10",
+                fixture.base_url, target_project_id
+            ),
+        );
+        assert_eq!(selected_status, 200);
+        let selected_facts = selected_payload["holographic"]["facts"]
+            .as_array()
+            .unwrap_or_else(|| panic!("expected selected project facts: {selected_payload}"));
+        assert_eq!(selected_facts.len(), 1);
+        assert_eq!(
+            selected_facts[0]["content"],
+            "Target daemon project selector fact"
+        );
+    });
+}
+
 #[test]
 fn holographic_dashboard_endpoints_return_seeded_payloads() {
     let _env_lock = GLOBAL_DB_ENV_LOCK

From a8db978cede2b438ae5bb4b3e1188c3823597be6 Mon Sep 17 00:00:00 2001
From: ScriptedAlchemy <zack@module-federation.io>
Date: Tue, 30 Jun 2026 17:48:56 +0000
Subject: [PATCH 2/7] fix: isolate selected dashboard project state

---
 dashboard/shell/src/main.jsx      |   6 +-
 dashboard/shell/src/sdk.jsx       |  12 ++-
 dashboard/test/shell-sdk.test.mjs |  48 ++++++++++-
 src/dashboard/mod.rs              |  24 +++---
 src/dashboard/projects.rs         | 112 +++++---------------------
 tests/dashboard_api_test.rs       | 128 ++++++++++++++++++++++++++++++
 6 files changed, 219 insertions(+), 111 deletions(-)

diff --git a/dashboard/shell/src/main.jsx b/dashboard/shell/src/main.jsx
index 7c98f132..c8019422 100644
--- a/dashboard/shell/src/main.jsx
+++ b/dashboard/shell/src/main.jsx
@@ -13,7 +13,7 @@
 
 import React, { useEffect, useState, useCallback, useRef, useSyncExternalStore } from "react";
 import { createRoot } from "react-dom/client";
-import { buildSDK, fetchJSON, cn, setSelectedProjectId as setSDKSelectedProjectId } from "./sdk.jsx";
+import { buildSDK, fetchJSON, cn, setShellSelectedProjectId } from "./sdk.jsx";
 
 // ---------------------------------------------------------------------------
 // Registry
@@ -286,7 +286,7 @@ function App() {
           projectPayload?.active_project_id || rows.find((p) => p.is_active)?.project_id || rows[0]?.project_id || "";
         setProjects(rows);
         setSelectedProjectId(initialProjectId);
-        setSDKSelectedProjectId(initialProjectId);
+        setShellSelectedProjectId(initialProjectId);
         await fetchCapabilities();
         if (cancelled) return;
         setPlugins(list);
@@ -315,7 +315,7 @@ function App() {
       const next = event.target.value;
       if (next === selectedProjectId) return;
       setSelectedProjectId(next);
-      setSDKSelectedProjectId(next);
+      setShellSelectedProjectId(next);
       setCapabilities(null);
       setProjectRevision((rev) => rev + 1);
       setVisited(active ? new Set([active]) : new Set());
diff --git a/dashboard/shell/src/sdk.jsx b/dashboard/shell/src/sdk.jsx
index 06c33561..2e1833e4 100644
--- a/dashboard/shell/src/sdk.jsx
+++ b/dashboard/shell/src/sdk.jsx
@@ -50,7 +50,7 @@ export function getSelectedProjectId() {
   return selectedProjectId;
 }
 
-export function setSelectedProjectId(projectId) {
+export function setShellSelectedProjectId(projectId) {
   const next = String(projectId || "");
   if (next === selectedProjectId) return;
   selectedProjectId = next;
@@ -62,8 +62,13 @@ export function subscribeSelectedProject(fn) {
   return () => projectListeners.delete(fn);
 }
 
-export function projectScopedUrl(url) {
+function requestMethod(init) {
+  return String(init?.method || "GET").toUpperCase();
+}
+
+export function projectScopedUrl(url, init) {
   if (!selectedProjectId || typeof url !== "string" || !url.startsWith("/")) return url;
+  if (!["GET", "HEAD"].includes(requestMethod(init))) return url;
   if (
     !isScopedApiUrl(url, "/api/plugins") &&
     !isScopedApiUrl(url, "/api/automation") &&
@@ -75,7 +80,7 @@ export function projectScopedUrl(url) {
 }
 
 export function authedFetch(url, init) {
-  return fetch(projectScopedUrl(url), init);
+  return fetch(projectScopedUrl(url, init), init);
 }
 
 export async function fetchJSON(url, init) {
@@ -233,7 +238,6 @@ export function buildSDK() {
     capabilities: null,
     projects: {
       getSelectedProjectId,
-      setSelectedProjectId,
       subscribe: subscribeSelectedProject,
     },
     components: {
diff --git a/dashboard/test/shell-sdk.test.mjs b/dashboard/test/shell-sdk.test.mjs
index 724d575f..eb1109f0 100644
--- a/dashboard/test/shell-sdk.test.mjs
+++ b/dashboard/test/shell-sdk.test.mjs
@@ -51,7 +51,7 @@ test("project scoped fetchJSON rewrites plugin and capability API calls", async
       };
     },
     async () => {
-      sdk.setSelectedProjectId("proj_alpha");
+      sdk.setShellSelectedProjectId("proj_alpha");
       await sdk.fetchJSON("/api/plugins/holographic/status?limit=2", { method: "GET" });
       await sdk.fetchJSON("/api/automation/skills");
       await sdk.fetchJSON("/api/capabilities");
@@ -65,7 +65,7 @@ test("project scoped fetchJSON rewrites plugin and capability API calls", async
     ["/api/projects/proj_alpha/capabilities", undefined],
     ["/api/projects/proj_alpha/plugins/graph/search?q=fn", undefined],
   ]);
-  sdk.setSelectedProjectId("");
+  sdk.setShellSelectedProjectId("");
 });
 
 test("project scoping leaves daemon APIs and absolute URLs unchanged", async () => {
@@ -79,7 +79,7 @@ test("project scoping leaves daemon APIs and absolute URLs unchanged", async ()
       };
     },
     async () => {
-      sdk.setSelectedProjectId("proj_beta");
+      sdk.setShellSelectedProjectId("proj_beta");
       await sdk.fetchJSON("/api/projects");
       await sdk.fetchJSON("/api/projects/proj_beta");
       await sdk.fetchJSON("/api/dashboard/plugins");
@@ -93,7 +93,47 @@ test("project scoping leaves daemon APIs and absolute URLs unchanged", async ()
     ["/api/dashboard/plugins", undefined],
     ["https://example.test/api/plugins/holographic", undefined],
   ]);
-  sdk.setSelectedProjectId("");
+  sdk.setShellSelectedProjectId("");
+});
+
+test("project scoping leaves mutating API calls on the active project route", async () => {
+  const seen = [];
+  await withMockedFetch(
+    async (url, init) => {
+      seen.push([url, init]);
+      return {
+        ok: true,
+        json: async () => ({ ok: true }),
+      };
+    },
+    async () => {
+      sdk.setShellSelectedProjectId("proj_gamma");
+      await sdk.fetchJSON("/api/plugins/holographic/curate", { method: "POST" });
+      await sdk.authedFetch("/api/automation/run/memory-curator", { method: "PATCH" });
+    },
+  );
+
+  assert.deepEqual(seen, [
+    ["/api/plugins/holographic/curate", { method: "POST" }],
+    ["/api/automation/run/memory-curator", { method: "PATCH" }],
+  ]);
+  sdk.setShellSelectedProjectId("");
+});
+
+test("plugin SDK exposes selected project as read-only subscribed state", () => {
+  const pluginSDK = sdk.buildSDK();
+  const seen = [];
+  const unsubscribe = pluginSDK.projects.subscribe((projectId) => seen.push(projectId));
+
+  assert.equal(pluginSDK.projects.getSelectedProjectId(), "");
+  assert.equal(pluginSDK.projects.setSelectedProjectId, undefined);
+
+  sdk.setShellSelectedProjectId("proj_delta");
+  assert.equal(pluginSDK.projects.getSelectedProjectId(), "proj_delta");
+  assert.deepEqual(seen, ["proj_delta"]);
+
+  unsubscribe();
+  sdk.setShellSelectedProjectId("");
 });
 
 test("fetchJSON prefers JSON detail on failure", async () => {
diff --git a/src/dashboard/mod.rs b/src/dashboard/mod.rs
index afa15206..32193f0c 100644
--- a/src/dashboard/mod.rs
+++ b/src/dashboard/mod.rs
@@ -54,7 +54,7 @@ use std::sync::Arc;
 
 use axum::body::Body;
 use axum::extract::{Path as AxumPath, State};
-use axum::http::{Request, StatusCode, Uri};
+use axum::http::{Method, Request, StatusCode, Uri};
 use axum::response::{IntoResponse, Json, Response};
 use axum::routing::{any, get, post};
 use axum::Router;
@@ -644,13 +644,8 @@ async fn project_scoped_api_gateway(
     AxumPath((project_id, tail)): AxumPath<(String, String)>,
     mut req: Request<Body>,
 ) -> Response {
-    let state_result = if tail.starts_with("plugins/holographic") {
-        runtime.memory_state_for_project(&project_id).await
-    } else {
-        runtime.state_for_project(&project_id).await
-    };
-    let state = match state_result {
-        Ok(state) => state,
+    let selected = match runtime.selected_project_state(&project_id).await {
+        Ok(selected) => selected,
         Err(err) => {
             return (
                 StatusCode::NOT_FOUND,
@@ -663,6 +658,17 @@ async fn project_scoped_api_gateway(
                 .into_response();
         }
     };
+    if !selected.is_active && !matches!(req.method(), &Method::GET | &Method::HEAD) {
+        return (
+            StatusCode::METHOD_NOT_ALLOWED,
+            Json(json!({
+                "status": "read_only_project",
+                "detail": "project-scoped dashboard APIs are read-only for non-active projects",
+                "project_id": project_id,
+            })),
+        )
+            .into_response();
+    }
 
     let query = req
         .uri()
@@ -673,7 +679,7 @@ async fn project_scoped_api_gateway(
     match rewritten.parse::<Uri>() {
         Ok(uri) => {
             *req.uri_mut() = uri;
-            forward_project_request(state, req).await
+            forward_project_request(selected.state, req).await
         }
         Err(err) => (
             StatusCode::BAD_REQUEST,
diff --git a/src/dashboard/projects.rs b/src/dashboard/projects.rs
index 112abe25..6e4c3e7b 100644
--- a/src/dashboard/projects.rs
+++ b/src/dashboard/projects.rs
@@ -10,17 +10,14 @@ use serde_json::{json, Value};
 use tokio::sync::RwLock;
 
 use super::{build_selected_project_state, config_error, DashboardState};
-use crate::db::Database;
 use crate::errors::Result;
-use crate::global_db::{GlobalDb, ProjectRegistryContext};
-use crate::storage::{self, StoreArtifactPath};
+use crate::global_db::GlobalDb;
 use crate::tracedecay::TraceDecay;
 
 #[derive(Clone)]
 pub(crate) struct DashboardRuntime {
     active: DashboardState,
     project_states: Arc<RwLock<HashMap<String, DashboardState>>>,
-    memory_project_states: Arc<RwLock<HashMap<String, DashboardState>>>,
 }
 
 impl DashboardRuntime {
@@ -28,7 +25,6 @@ impl DashboardRuntime {
         Self {
             active,
             project_states: Arc::new(RwLock::new(HashMap::new())),
-            memory_project_states: Arc::new(RwLock::new(HashMap::new())),
         }
     }
 
@@ -44,13 +40,22 @@ impl DashboardRuntime {
         self.active.project_root.display().to_string()
     }
 
-    pub(crate) async fn state_for_project(&self, project_id: &str) -> Result<DashboardState> {
+    pub(crate) async fn selected_project_state(
+        &self,
+        project_id: &str,
+    ) -> Result<SelectedProjectState> {
         if self.active.project_id.as_deref() == Some(project_id) {
-            return Ok(self.active.clone());
+            return Ok(SelectedProjectState {
+                state: self.active.clone(),
+                is_active: true,
+            });
         }
 
         if let Some(state) = self.project_states.read().await.get(project_id).cloned() {
-            return Ok(state);
+            return Ok(SelectedProjectState {
+                state,
+                is_active: false,
+            });
         }
 
         let db = GlobalDb::open()
@@ -67,91 +72,16 @@ impl DashboardRuntime {
             .write()
             .await
             .insert(project_id.to_string(), state.clone());
-        Ok(state)
-    }
-
-    pub(crate) async fn memory_state_for_project(
-        &self,
-        project_id: &str,
-    ) -> Result<DashboardState> {
-        if self.active.project_id.as_deref() == Some(project_id) {
-            return Ok(self.active.clone());
-        }
-
-        if let Some(state) = self
-            .memory_project_states
-            .read()
-            .await
-            .get(project_id)
-            .cloned()
-        {
-            return Ok(state);
-        }
-
-        let db = GlobalDb::open()
-            .await
-            .ok_or_else(|| config_error("could not open tracedecay project registry"))?;
-        let context = db
-            .project_registry_context_by_id(project_id)
-            .await
-            .ok_or_else(|| config_error(format!("registered project not found: {project_id}")))?;
-        let state = self.memory_state_from_registry(&context).await?;
-        self.memory_project_states
-            .write()
-            .await
-            .insert(project_id.to_string(), state.clone());
-        Ok(state)
+        Ok(SelectedProjectState {
+            state,
+            is_active: false,
+        })
     }
+}
 
-    async fn memory_state_from_registry(
-        &self,
-        context: &ProjectRegistryContext,
-    ) -> Result<DashboardState> {
-        let profile_root = storage::default_profile_root()?;
-        let store = context
-            .stores
-            .iter()
-            .find(|store| {
-                store.store.store_kind == "code_project"
-                    && store.store.storage_mode == "profile_sharded"
-            })
-            .ok_or_else(|| {
-                config_error(format!(
-                    "registered project has no profile-sharded code-project store: {}",
-                    context.project.project_id
-                ))
-            })?;
-        let store_root =
-            StoreArtifactPath::resolve(&profile_root, Path::new(&store.store.store_relpath))?
-                .absolute_path();
-        let graph_db_path = match store.store.manifest_relpath.as_deref() {
-            Some(relpath) => {
-                let manifest_path =
-                    StoreArtifactPath::resolve(&profile_root, Path::new(relpath))?.absolute_path();
-                match storage::read_store_manifest(&manifest_path) {
-                    Ok(manifest) => store_root.join(manifest.graph_db_relpath),
-                    Err(_) => store_root.join(crate::config::db_filename(&store_root)),
-                }
-            }
-            None => store_root.join(crate::config::db_filename(&store_root)),
-        };
-        let (db, _) = Database::open_read_only(&graph_db_path).await?;
-        let conn = db.conn().clone();
-        let mut state = self.active.clone();
-        state.project_id = Some(context.project.project_id.clone());
-        state.graph_conn = conn.clone();
-        state.graph_db_path = graph_db_path.display().to_string();
-        state.mem_conn = conn;
-        state.mem_db_path = graph_db_path.display().to_string();
-        state.lcm_conn = None;
-        state.lcm_db_path.clear();
-        state.lcm_scope.clone_from(&store.store.storage_mode);
-        state.project_root = PathBuf::from(&context.project.display_root);
-        state.storage_mode.clone_from(&store.store.storage_mode);
-        state.store_root.clone_from(&store_root);
-        state.dashboard_root = store_root.join("dashboard");
-        Ok(state)
-    }
+pub(crate) struct SelectedProjectState {
+    pub(crate) state: DashboardState,
+    pub(crate) is_active: bool,
 }
 
 #[derive(Debug, Deserialize)]
diff --git a/tests/dashboard_api_test.rs b/tests/dashboard_api_test.rs
index f74b7f1e..bfa9436b 100644
--- a/tests/dashboard_api_test.rs
+++ b/tests/dashboard_api_test.rs
@@ -175,6 +175,134 @@ fn project_scoped_plugin_routes_read_selected_project_store() {
     });
 }
 
+#[test]
+fn project_scoped_curation_preview_and_activity_do_not_leak_active_state() {
+    let _env_lock = GLOBAL_DB_ENV_LOCK
+        .lock()
+        .unwrap_or_else(|poisoned| poisoned.into_inner());
+    let runtime = create_runtime();
+    runtime.block_on(async {
+        let fixture = start_dashboard_fixture(false).await;
+        let agent = http_agent();
+
+        let target_root = fixture
+            ._tmp
+            .path()
+            .canonicalize()
+            .expect("fixture root should canonicalize")
+            .join("target-project");
+        let target_cg = setup_project(&target_root).await;
+        let target_project_id = target_cg
+            .store_layout()
+            .identity
+            .project_id
+            .clone()
+            .expect("profile-backed target should have project_id");
+        target_cg
+            .checkpoint()
+            .await
+            .expect("target project DB should checkpoint before dashboard reopen");
+        target_cg.close();
+
+        let (active_curate_status, active_curate) = post_json_body(
+            &agent,
+            &format!("{}/api/plugins/holographic/curate", fixture.base_url),
+            &serde_json::json!({ "dry_run": true }),
+        );
+        assert_eq!(active_curate_status, 200);
+        assert_eq!(active_curate["dry_run"], true);
+
+        let (active_preview_status, active_preview) = get_json(
+            &agent,
+            &format!(
+                "{}/api/plugins/holographic/curation/preview",
+                fixture.base_url
+            ),
+        );
+        assert_eq!(active_preview_status, 200);
+        assert!(
+            !active_preview["report"].is_null(),
+            "active dry-run should save a preview"
+        );
+        let (active_activity_status, active_activity) = get_json(
+            &agent,
+            &format!(
+                "{}/api/plugins/holographic/curation/activity?limit=75",
+                fixture.base_url
+            ),
+        );
+        assert_eq!(active_activity_status, 200);
+        assert!(
+            active_activity["count"].as_i64().unwrap_or_default() > 0,
+            "active dry-run should record curation activity"
+        );
+
+        let (selected_preview_status, selected_preview) = get_json(
+            &agent,
+            &format!(
+                "{}/api/projects/{}/plugins/holographic/curation/preview",
+                fixture.base_url, target_project_id
+            ),
+        );
+        assert_eq!(selected_preview_status, 200);
+        assert!(
+            selected_preview["report"].is_null(),
+            "selected non-active project must not reuse the active preview: {selected_preview}"
+        );
+
+        let (selected_activity_status, selected_activity) = get_json(
+            &agent,
+            &format!(
+                "{}/api/projects/{}/plugins/holographic/curation/activity?limit=75",
+                fixture.base_url, target_project_id
+            ),
+        );
+        assert_eq!(selected_activity_status, 200);
+        assert_eq!(
+            selected_activity["count"], 0,
+            "selected non-active project must not reuse active curation activity: {selected_activity}"
+        );
+    });
+}
+
+#[test]
+fn project_scoped_mutations_are_rejected_for_non_active_projects() {
+    let _env_lock = GLOBAL_DB_ENV_LOCK
+        .lock()
+        .unwrap_or_else(|poisoned| poisoned.into_inner());
+    let runtime = create_runtime();
+    runtime.block_on(async {
+        let fixture = start_dashboard_fixture(false).await;
+        let agent = http_agent();
+
+        let target_root = fixture
+            ._tmp
+            .path()
+            .canonicalize()
+            .expect("fixture root should canonicalize")
+            .join("target-project");
+        let target_cg = setup_project(&target_root).await;
+        let target_project_id = target_cg
+            .store_layout()
+            .identity
+            .project_id
+            .clone()
+            .expect("profile-backed target should have project_id");
+        target_cg.close();
+
+        let (status, body) = post_json_body(
+            &agent,
+            &format!(
+                "{}/api/projects/{}/plugins/holographic/curate",
+                fixture.base_url, target_project_id
+            ),
+            &serde_json::json!({ "dry_run": true }),
+        );
+        assert_eq!(status, 405);
+        assert_eq!(body["status"], "read_only_project");
+    });
+}
+
 #[test]
 fn holographic_dashboard_endpoints_return_seeded_payloads() {
     let _env_lock = GLOBAL_DB_ENV_LOCK

From 707f5b86ab78d4b8445bdb093839505a6a3767a9 Mon Sep 17 00:00:00 2001
From: ScriptedAlchemy <zack@module-federation.io>
Date: Tue, 30 Jun 2026 18:08:25 +0000
Subject: [PATCH 3/7] fix: reject scoped project mutations before state load

---
 src/dashboard/mod.rs      | 25 ++++++++++++++-----------
 src/dashboard/projects.rs | 12 ++----------
 2 files changed, 16 insertions(+), 21 deletions(-)

diff --git a/src/dashboard/mod.rs b/src/dashboard/mod.rs
index 32193f0c..c1cfb93b 100644
--- a/src/dashboard/mod.rs
+++ b/src/dashboard/mod.rs
@@ -644,6 +644,20 @@ async fn project_scoped_api_gateway(
     AxumPath((project_id, tail)): AxumPath<(String, String)>,
     mut req: Request<Body>,
 ) -> Response {
+    if runtime.active_project_id() != Some(project_id.as_str())
+        && !matches!(req.method(), &Method::GET | &Method::HEAD)
+    {
+        return (
+            StatusCode::METHOD_NOT_ALLOWED,
+            Json(json!({
+                "status": "read_only_project",
+                "detail": "project-scoped dashboard APIs are read-only for non-active projects",
+                "project_id": project_id,
+            })),
+        )
+            .into_response();
+    }
+
     let selected = match runtime.selected_project_state(&project_id).await {
         Ok(selected) => selected,
         Err(err) => {
@@ -658,17 +672,6 @@ async fn project_scoped_api_gateway(
                 .into_response();
         }
     };
-    if !selected.is_active && !matches!(req.method(), &Method::GET | &Method::HEAD) {
-        return (
-            StatusCode::METHOD_NOT_ALLOWED,
-            Json(json!({
-                "status": "read_only_project",
-                "detail": "project-scoped dashboard APIs are read-only for non-active projects",
-                "project_id": project_id,
-            })),
-        )
-            .into_response();
-    }
 
     let query = req
         .uri()
diff --git a/src/dashboard/projects.rs b/src/dashboard/projects.rs
index 6e4c3e7b..d9f397f0 100644
--- a/src/dashboard/projects.rs
+++ b/src/dashboard/projects.rs
@@ -47,15 +47,11 @@ impl DashboardRuntime {
         if self.active.project_id.as_deref() == Some(project_id) {
             return Ok(SelectedProjectState {
                 state: self.active.clone(),
-                is_active: true,
             });
         }
 
         if let Some(state) = self.project_states.read().await.get(project_id).cloned() {
-            return Ok(SelectedProjectState {
-                state,
-                is_active: false,
-            });
+            return Ok(SelectedProjectState { state });
         }
 
         let db = GlobalDb::open()
@@ -72,16 +68,12 @@ impl DashboardRuntime {
             .write()
             .await
             .insert(project_id.to_string(), state.clone());
-        Ok(SelectedProjectState {
-            state,
-            is_active: false,
-        })
+        Ok(SelectedProjectState { state })
     }
 }
 
 pub(crate) struct SelectedProjectState {
     pub(crate) state: DashboardState,
-    pub(crate) is_active: bool,
 }
 
 #[derive(Debug, Deserialize)]

From 20976f93f1669ba197946036031f9759d6ce2ca9 Mon Sep 17 00:00:00 2001
From: ScriptedAlchemy <zack@module-federation.io>
Date: Tue, 30 Jun 2026 18:25:29 +0000
Subject: [PATCH 4/7] test: allow selected project first-touch latency

---
 tests/common/mod.rs                | 6 +++++-
 tests/dashboard_api_support/mod.rs | 6 +++---
 tests/dashboard_api_test.rs        | 6 +++---
 3 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/tests/common/mod.rs b/tests/common/mod.rs
index c39d70dc..d6ba171d 100644
--- a/tests/common/mod.rs
+++ b/tests/common/mod.rs
@@ -280,9 +280,13 @@ pub fn pick_free_port() -> u16 {
 }
 
 pub fn http_agent() -> ureq::Agent {
+    http_agent_with_timeout(Duration::from_secs(4))
+}
+
+pub fn http_agent_with_timeout(timeout: Duration) -> ureq::Agent {
     ureq::Agent::config_builder()
         .http_status_as_error(false)
-        .timeout_global(Some(Duration::from_secs(4)))
+        .timeout_global(Some(timeout))
         .build()
         .into()
 }
diff --git a/tests/dashboard_api_support/mod.rs b/tests/dashboard_api_support/mod.rs
index 04e2583b..14bc32ed 100644
--- a/tests/dashboard_api_support/mod.rs
+++ b/tests/dashboard_api_support/mod.rs
@@ -6,9 +6,9 @@ pub(crate) use std::process::Command;
 pub(crate) use std::thread;
 
 pub(crate) use crate::common::{
-    create_runtime, fake_codex_bin, get_json, http_agent, install_fake_codex_launcher,
-    pick_free_port, response_to_json, tempdir_or_panic, wait_for_dashboard, EnvVarGuard,
-    GLOBAL_DB_ENV, GLOBAL_DB_ENV_LOCK,
+    create_runtime, fake_codex_bin, get_json, http_agent, http_agent_with_timeout,
+    install_fake_codex_launcher, pick_free_port, response_to_json, tempdir_or_panic,
+    wait_for_dashboard, EnvVarGuard, GLOBAL_DB_ENV, GLOBAL_DB_ENV_LOCK,
 };
 pub(crate) use serde_json::Value;
 pub(crate) use tempfile::TempDir;
diff --git a/tests/dashboard_api_test.rs b/tests/dashboard_api_test.rs
index bfa9436b..c3b77855 100644
--- a/tests/dashboard_api_test.rs
+++ b/tests/dashboard_api_test.rs
@@ -98,7 +98,7 @@ fn project_scoped_plugin_routes_read_selected_project_store() {
     let runtime = create_runtime();
     runtime.block_on(async {
         let fixture = start_dashboard_fixture(false).await;
-        let agent = http_agent();
+        let agent = http_agent_with_timeout(std::time::Duration::from_secs(20));
 
         let target_root = fixture
             ._tmp
@@ -183,7 +183,7 @@ fn project_scoped_curation_preview_and_activity_do_not_leak_active_state() {
     let runtime = create_runtime();
     runtime.block_on(async {
         let fixture = start_dashboard_fixture(false).await;
-        let agent = http_agent();
+        let agent = http_agent_with_timeout(std::time::Duration::from_secs(20));
 
         let target_root = fixture
             ._tmp
@@ -273,7 +273,7 @@ fn project_scoped_mutations_are_rejected_for_non_active_projects() {
     let runtime = create_runtime();
     runtime.block_on(async {
         let fixture = start_dashboard_fixture(false).await;
-        let agent = http_agent();
+        let agent = http_agent_with_timeout(std::time::Duration::from_secs(20));
 
         let target_root = fixture
             ._tmp

From 5364c7fe1436e3c311dc26f88288683b3d727c80 Mon Sep 17 00:00:00 2001
From: ScriptedAlchemy <zack@module-federation.io>
Date: Tue, 30 Jun 2026 19:54:46 +0000
Subject: [PATCH 5/7] fix: harden dashboard project selection

---
 dashboard/shell/src/main.jsx         |  18 +-
 dashboard/shell/src/sdk.jsx          |   5 -
 dashboard/shell/src/styles.css       |   1 -
 dashboard/test/shell-sdk.test.mjs    |   8 +-
 src/dashboard/mod.rs                 |  14 +-
 src/dashboard/projects.rs            |  26 ++-
 tests/dashboard_api_test.rs          | 259 ---------------------------
 tests/dashboard_projects_api_test.rs | 244 +++++++++++++++++++++++++
 8 files changed, 291 insertions(+), 284 deletions(-)
 create mode 100644 tests/dashboard_projects_api_test.rs

diff --git a/dashboard/shell/src/main.jsx b/dashboard/shell/src/main.jsx
index c8019422..07dfed78 100644
--- a/dashboard/shell/src/main.jsx
+++ b/dashboard/shell/src/main.jsx
@@ -13,7 +13,13 @@
 
 import React, { useEffect, useState, useCallback, useRef, useSyncExternalStore } from "react";
 import { createRoot } from "react-dom/client";
-import { buildSDK, fetchJSON, cn, setShellSelectedProjectId } from "./sdk.jsx";
+import {
+  buildSDK,
+  fetchJSON,
+  cn,
+  getSelectedProjectId,
+  setShellSelectedProjectId,
+} from "./sdk.jsx";
 
 // ---------------------------------------------------------------------------
 // Registry
@@ -255,9 +261,10 @@ function App() {
   }, []);
 
   // Fetch capabilities, update SDK, and return the payload (or null on failure).
-  const fetchCapabilities = useCallback(async () => {
+  const fetchCapabilities = useCallback(async (projectId = getSelectedProjectId()) => {
     try {
       const caps = await fetchJSON("/api/capabilities");
+      if (getSelectedProjectId() !== projectId) return null;
       setCapabilities(caps);
       setConnState("ok");
       setLastRefresh(Date.now());
@@ -265,6 +272,8 @@ function App() {
       window.__HERMES_PLUGIN_SDK__.capabilities = caps;
       return caps;
     } catch {
+      if (getSelectedProjectId() !== projectId) return null;
+      window.__HERMES_PLUGIN_SDK__.capabilities = null;
       setConnState("error");
       return null;
     }
@@ -287,7 +296,7 @@ function App() {
         setProjects(rows);
         setSelectedProjectId(initialProjectId);
         setShellSelectedProjectId(initialProjectId);
-        await fetchCapabilities();
+        await fetchCapabilities(initialProjectId);
         if (cancelled) return;
         setPlugins(list);
         if (list.length > 0) {
@@ -317,9 +326,10 @@ function App() {
       setSelectedProjectId(next);
       setShellSelectedProjectId(next);
       setCapabilities(null);
+      window.__HERMES_PLUGIN_SDK__.capabilities = null;
       setProjectRevision((rev) => rev + 1);
       setVisited(active ? new Set([active]) : new Set());
-      await fetchCapabilities();
+      await fetchCapabilities(next);
     },
     [active, fetchCapabilities, selectedProjectId],
   );
diff --git a/dashboard/shell/src/sdk.jsx b/dashboard/shell/src/sdk.jsx
index 2e1833e4..43c955d4 100644
--- a/dashboard/shell/src/sdk.jsx
+++ b/dashboard/shell/src/sdk.jsx
@@ -62,13 +62,8 @@ export function subscribeSelectedProject(fn) {
   return () => projectListeners.delete(fn);
 }
 
-function requestMethod(init) {
-  return String(init?.method || "GET").toUpperCase();
-}
-
 export function projectScopedUrl(url, init) {
   if (!selectedProjectId || typeof url !== "string" || !url.startsWith("/")) return url;
-  if (!["GET", "HEAD"].includes(requestMethod(init))) return url;
   if (
     !isScopedApiUrl(url, "/api/plugins") &&
     !isScopedApiUrl(url, "/api/automation") &&
diff --git a/dashboard/shell/src/styles.css b/dashboard/shell/src/styles.css
index 26555c41..8960910f 100644
--- a/dashboard/shell/src/styles.css
+++ b/dashboard/shell/src/styles.css
@@ -557,7 +557,6 @@ select:focus-visible {
 .ts-project-select:focus {
   border-color: var(--ts-line-strong);
   color: var(--ts-text);
-  outline: none;
 }
 
 /* Connection indicator */
diff --git a/dashboard/test/shell-sdk.test.mjs b/dashboard/test/shell-sdk.test.mjs
index eb1109f0..0b224b18 100644
--- a/dashboard/test/shell-sdk.test.mjs
+++ b/dashboard/test/shell-sdk.test.mjs
@@ -96,7 +96,7 @@ test("project scoping leaves daemon APIs and absolute URLs unchanged", async ()
   sdk.setShellSelectedProjectId("");
 });
 
-test("project scoping leaves mutating API calls on the active project route", async () => {
+test("project scoping routes mutating API calls through the selected project guard", async () => {
   const seen = [];
   await withMockedFetch(
     async (url, init) => {
@@ -109,13 +109,13 @@ test("project scoping leaves mutating API calls on the active project route", as
     async () => {
       sdk.setShellSelectedProjectId("proj_gamma");
       await sdk.fetchJSON("/api/plugins/holographic/curate", { method: "POST" });
-      await sdk.authedFetch("/api/automation/run/memory-curator", { method: "PATCH" });
+      await sdk.authedFetch("/api/plugins/holographic/curation/config", { method: "PATCH" });
     },
   );
 
   assert.deepEqual(seen, [
-    ["/api/plugins/holographic/curate", { method: "POST" }],
-    ["/api/automation/run/memory-curator", { method: "PATCH" }],
+    ["/api/projects/proj_gamma/plugins/holographic/curate", { method: "POST" }],
+    ["/api/projects/proj_gamma/plugins/holographic/curation/config", { method: "PATCH" }],
   ]);
   sdk.setShellSelectedProjectId("");
 });
diff --git a/src/dashboard/mod.rs b/src/dashboard/mod.rs
index c1cfb93b..13147a68 100644
--- a/src/dashboard/mod.rs
+++ b/src/dashboard/mod.rs
@@ -397,7 +397,7 @@ pub(crate) async fn bind_dashboard(
 }
 
 pub(crate) fn router(state: DashboardState) -> Router {
-    let runtime = projects::DashboardRuntime::new(state);
+    let runtime = projects::DashboardRuntime::new(state, project_api_router());
     Router::new()
         .route("/", get(assets::index_html))
         .route("/shell/{file}", get(assets::shell_asset))
@@ -636,7 +636,7 @@ async fn active_api_gateway(
     State(runtime): State<projects::DashboardRuntime>,
     req: Request<Body>,
 ) -> Response {
-    forward_project_request(runtime.active_state(), req).await
+    forward_project_request(runtime.project_api_router(), runtime.active_state(), req).await
 }
 
 async fn project_scoped_api_gateway(
@@ -682,7 +682,7 @@ async fn project_scoped_api_gateway(
     match rewritten.parse::<Uri>() {
         Ok(uri) => {
             *req.uri_mut() = uri;
-            forward_project_request(selected.state, req).await
+            forward_project_request(runtime.project_api_router(), selected.state, req).await
         }
         Err(err) => (
             StatusCode::BAD_REQUEST,
@@ -695,11 +695,15 @@ async fn project_scoped_api_gateway(
     }
 }
 
-async fn forward_project_request(state: DashboardState, req: Request<Body>) -> Response {
+async fn forward_project_request(
+    project_api: Router<DashboardState>,
+    state: DashboardState,
+    req: Request<Body>,
+) -> Response {
     let (mut parts, body) = req.into_parts();
     parts.extensions.clear();
     let req = Request::from_parts(parts, body);
-    match project_api_router().with_state(state).oneshot(req).await {
+    match project_api.with_state(state).oneshot(req).await {
         Ok(response) => response,
         Err(err) => (
             StatusCode::INTERNAL_SERVER_ERROR,
diff --git a/src/dashboard/projects.rs b/src/dashboard/projects.rs
index d9f397f0..4d1a4fbc 100644
--- a/src/dashboard/projects.rs
+++ b/src/dashboard/projects.rs
@@ -5,6 +5,7 @@ use std::sync::Arc;
 use axum::extract::{Path as AxumPath, Query, State};
 use axum::http::StatusCode;
 use axum::response::Json;
+use axum::Router;
 use serde::Deserialize;
 use serde_json::{json, Value};
 use tokio::sync::RwLock;
@@ -17,13 +18,15 @@ use crate::tracedecay::TraceDecay;
 #[derive(Clone)]
 pub(crate) struct DashboardRuntime {
     active: DashboardState,
+    project_api: Router<DashboardState>,
     project_states: Arc<RwLock<HashMap<String, DashboardState>>>,
 }
 
 impl DashboardRuntime {
-    pub(crate) fn new(active: DashboardState) -> Self {
+    pub(crate) fn new(active: DashboardState, project_api: Router<DashboardState>) -> Self {
         Self {
             active,
+            project_api,
             project_states: Arc::new(RwLock::new(HashMap::new())),
         }
     }
@@ -36,6 +39,10 @@ impl DashboardRuntime {
         self.active.project_id.as_deref()
     }
 
+    pub(crate) fn project_api_router(&self) -> Router<DashboardState> {
+        self.project_api.clone()
+    }
+
     fn active_project_root(&self) -> String {
         self.active.project_root.display().to_string()
     }
@@ -61,13 +68,20 @@ impl DashboardRuntime {
             .project_registry_context_by_id(project_id)
             .await
             .ok_or_else(|| config_error(format!("registered project not found: {project_id}")))?;
-        let project_root = PathBuf::from(context.project.display_root);
+        let project_root = PathBuf::from(&context.project.canonical_root);
         let cg = TraceDecay::open_read_only(&project_root).await?;
+        if cg.store_layout().identity.project_id.as_deref() != Some(project_id) {
+            return Err(config_error(format!(
+                "registered project id mismatch for {project_id}: {}",
+                project_root.display()
+            )));
+        }
         let state = build_selected_project_state(&cg).await;
-        self.project_states
-            .write()
-            .await
-            .insert(project_id.to_string(), state.clone());
+        let mut project_states = self.project_states.write().await;
+        if let Some(cached) = project_states.get(project_id).cloned() {
+            return Ok(SelectedProjectState { state: cached });
+        }
+        project_states.insert(project_id.to_string(), state.clone());
         Ok(SelectedProjectState { state })
     }
 }
diff --git a/tests/dashboard_api_test.rs b/tests/dashboard_api_test.rs
index c3b77855..bfee2628 100644
--- a/tests/dashboard_api_test.rs
+++ b/tests/dashboard_api_test.rs
@@ -44,265 +44,6 @@ fn dashboard_plugin_manifest_assets_are_served() {
     });
 }
 
-#[test]
-fn dashboard_projects_endpoint_lists_registered_projects_and_active_project() {
-    let _env_lock = GLOBAL_DB_ENV_LOCK
-        .lock()
-        .unwrap_or_else(|poisoned| poisoned.into_inner());
-    let runtime = create_runtime();
-    runtime.block_on(async {
-        let fixture = start_dashboard_fixture(false).await;
-        let agent = http_agent();
-
-        let target_root = fixture
-            ._tmp
-            .path()
-            .canonicalize()
-            .expect("fixture root should canonicalize")
-            .join("target-project");
-        let target_cg = setup_project(&target_root).await;
-        seed_memory_fixture(&target_cg).await;
-        drop(target_cg);
-
-        let (status, projects) = get_json(&agent, &format!("{}/api/projects", fixture.base_url));
-        assert_eq!(status, 200);
-        assert_eq!(projects["status"], "ok");
-        assert_eq!(
-            projects["active_project_root"],
-            fixture.project_root.display().to_string()
-        );
-        let rows = projects["projects"]
-            .as_array()
-            .unwrap_or_else(|| panic!("expected project list array: {projects}"));
-        assert!(
-            rows.iter().any(|row| row["project_root"]
-                == fixture.project_root.display().to_string()
-                && row["is_active"] == true),
-            "active project should be identified in daemon project list: {projects}"
-        );
-        assert!(
-            rows.iter().any(
-                |row| row["project_root"] == target_root.display().to_string()
-                    && row["is_active"] == false
-            ),
-            "other registered project should be listed for selection: {projects}"
-        );
-    });
-}
-
-#[test]
-fn project_scoped_plugin_routes_read_selected_project_store() {
-    let _env_lock = GLOBAL_DB_ENV_LOCK
-        .lock()
-        .unwrap_or_else(|poisoned| poisoned.into_inner());
-    let runtime = create_runtime();
-    runtime.block_on(async {
-        let fixture = start_dashboard_fixture(false).await;
-        let agent = http_agent_with_timeout(std::time::Duration::from_secs(20));
-
-        let target_root = fixture
-            ._tmp
-            .path()
-            .canonicalize()
-            .expect("fixture root should canonicalize")
-            .join("target-project");
-        let target_cg = setup_project(&target_root).await;
-        let target_project_id = target_cg
-            .store_layout()
-            .identity
-            .project_id
-            .clone()
-            .expect("profile-backed target should have project_id");
-        target_cg
-            .db()
-            .conn()
-            .execute(
-                "INSERT INTO memory_facts
-                    (fact_id, content, category, tags, trust_score, retrieval_count, helpful_count, created_at, updated_at)
-                 VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)",
-                libsql::params![
-                    201_i64,
-                    "Target daemon project selector fact",
-                    "project",
-                    "[\"selector\"]",
-                    0.91_f64,
-                    1_i64,
-                    1_i64,
-                    1_700_010_000_i64,
-                    1_700_010_100_i64
-                ],
-            )
-            .await
-            .expect("target fact should insert");
-        target_cg
-            .checkpoint()
-            .await
-            .expect("target project DB should checkpoint before dashboard reopen");
-        target_cg.close();
-
-        let (active_status, active_payload) = get_json(
-            &agent,
-            &format!(
-                "{}/api/plugins/holographic/?q=selector&limit=10",
-                fixture.base_url
-            ),
-        );
-        assert_eq!(active_status, 200);
-        assert_eq!(
-            active_payload["holographic"]["facts"]
-                .as_array()
-                .map(Vec::len),
-            Some(0),
-            "active project should not contain target-only selector fact"
-        );
-
-        let (selected_status, selected_payload) = get_json(
-            &agent,
-            &format!(
-                "{}/api/projects/{}/plugins/holographic/?q=selector&limit=10",
-                fixture.base_url, target_project_id
-            ),
-        );
-        assert_eq!(selected_status, 200);
-        let selected_facts = selected_payload["holographic"]["facts"]
-            .as_array()
-            .unwrap_or_else(|| panic!("expected selected project facts: {selected_payload}"));
-        assert_eq!(selected_facts.len(), 1);
-        assert_eq!(
-            selected_facts[0]["content"],
-            "Target daemon project selector fact"
-        );
-    });
-}
-
-#[test]
-fn project_scoped_curation_preview_and_activity_do_not_leak_active_state() {
-    let _env_lock = GLOBAL_DB_ENV_LOCK
-        .lock()
-        .unwrap_or_else(|poisoned| poisoned.into_inner());
-    let runtime = create_runtime();
-    runtime.block_on(async {
-        let fixture = start_dashboard_fixture(false).await;
-        let agent = http_agent_with_timeout(std::time::Duration::from_secs(20));
-
-        let target_root = fixture
-            ._tmp
-            .path()
-            .canonicalize()
-            .expect("fixture root should canonicalize")
-            .join("target-project");
-        let target_cg = setup_project(&target_root).await;
-        let target_project_id = target_cg
-            .store_layout()
-            .identity
-            .project_id
-            .clone()
-            .expect("profile-backed target should have project_id");
-        target_cg
-            .checkpoint()
-            .await
-            .expect("target project DB should checkpoint before dashboard reopen");
-        target_cg.close();
-
-        let (active_curate_status, active_curate) = post_json_body(
-            &agent,
-            &format!("{}/api/plugins/holographic/curate", fixture.base_url),
-            &serde_json::json!({ "dry_run": true }),
-        );
-        assert_eq!(active_curate_status, 200);
-        assert_eq!(active_curate["dry_run"], true);
-
-        let (active_preview_status, active_preview) = get_json(
-            &agent,
-            &format!(
-                "{}/api/plugins/holographic/curation/preview",
-                fixture.base_url
-            ),
-        );
-        assert_eq!(active_preview_status, 200);
-        assert!(
-            !active_preview["report"].is_null(),
-            "active dry-run should save a preview"
-        );
-        let (active_activity_status, active_activity) = get_json(
-            &agent,
-            &format!(
-                "{}/api/plugins/holographic/curation/activity?limit=75",
-                fixture.base_url
-            ),
-        );
-        assert_eq!(active_activity_status, 200);
-        assert!(
-            active_activity["count"].as_i64().unwrap_or_default() > 0,
-            "active dry-run should record curation activity"
-        );
-
-        let (selected_preview_status, selected_preview) = get_json(
-            &agent,
-            &format!(
-                "{}/api/projects/{}/plugins/holographic/curation/preview",
-                fixture.base_url, target_project_id
-            ),
-        );
-        assert_eq!(selected_preview_status, 200);
-        assert!(
-            selected_preview["report"].is_null(),
-            "selected non-active project must not reuse the active preview: {selected_preview}"
-        );
-
-        let (selected_activity_status, selected_activity) = get_json(
-            &agent,
-            &format!(
-                "{}/api/projects/{}/plugins/holographic/curation/activity?limit=75",
-                fixture.base_url, target_project_id
-            ),
-        );
-        assert_eq!(selected_activity_status, 200);
-        assert_eq!(
-            selected_activity["count"], 0,
-            "selected non-active project must not reuse active curation activity: {selected_activity}"
-        );
-    });
-}
-
-#[test]
-fn project_scoped_mutations_are_rejected_for_non_active_projects() {
-    let _env_lock = GLOBAL_DB_ENV_LOCK
-        .lock()
-        .unwrap_or_else(|poisoned| poisoned.into_inner());
-    let runtime = create_runtime();
-    runtime.block_on(async {
-        let fixture = start_dashboard_fixture(false).await;
-        let agent = http_agent_with_timeout(std::time::Duration::from_secs(20));
-
-        let target_root = fixture
-            ._tmp
-            .path()
-            .canonicalize()
-            .expect("fixture root should canonicalize")
-            .join("target-project");
-        let target_cg = setup_project(&target_root).await;
-        let target_project_id = target_cg
-            .store_layout()
-            .identity
-            .project_id
-            .clone()
-            .expect("profile-backed target should have project_id");
-        target_cg.close();
-
-        let (status, body) = post_json_body(
-            &agent,
-            &format!(
-                "{}/api/projects/{}/plugins/holographic/curate",
-                fixture.base_url, target_project_id
-            ),
-            &serde_json::json!({ "dry_run": true }),
-        );
-        assert_eq!(status, 405);
-        assert_eq!(body["status"], "read_only_project");
-    });
-}
-
 #[test]
 fn holographic_dashboard_endpoints_return_seeded_payloads() {
     let _env_lock = GLOBAL_DB_ENV_LOCK
diff --git a/tests/dashboard_projects_api_test.rs b/tests/dashboard_projects_api_test.rs
new file mode 100644
index 00000000..7c98c49d
--- /dev/null
+++ b/tests/dashboard_projects_api_test.rs
@@ -0,0 +1,244 @@
+mod common;
+mod dashboard_api_support;
+
+use dashboard_api_support::*;
+use std::path::PathBuf;
+
+async fn setup_target_project(fixture: &DashboardFixture) -> (PathBuf, TraceDecay) {
+    let target_root = fixture
+        ._tmp
+        .path()
+        .canonicalize()
+        .expect("fixture root should canonicalize")
+        .join("target-project");
+    let target_cg = setup_project(&target_root).await;
+    (target_root, target_cg)
+}
+
+fn project_id(cg: &TraceDecay) -> String {
+    cg.store_layout()
+        .identity
+        .project_id
+        .clone()
+        .expect("profile-backed target should have project_id")
+}
+
+#[test]
+fn dashboard_projects_endpoint_lists_registered_projects_and_active_project() {
+    let _env_lock = GLOBAL_DB_ENV_LOCK
+        .lock()
+        .unwrap_or_else(|poisoned| poisoned.into_inner());
+    let runtime = create_runtime();
+    runtime.block_on(async {
+        let fixture = start_dashboard_fixture(false).await;
+        let agent = http_agent();
+
+        let (target_root, target_cg) = setup_target_project(&fixture).await;
+        seed_memory_fixture(&target_cg).await;
+        drop(target_cg);
+
+        let (status, projects) = get_json(&agent, &format!("{}/api/projects", fixture.base_url));
+        assert_eq!(status, 200);
+        assert_eq!(projects["status"], "ok");
+        assert_eq!(
+            projects["active_project_root"],
+            fixture.project_root.display().to_string()
+        );
+        let rows = projects["projects"]
+            .as_array()
+            .unwrap_or_else(|| panic!("expected project list array: {projects}"));
+        assert!(
+            rows.iter().any(|row| row["project_root"]
+                == fixture.project_root.display().to_string()
+                && row["is_active"] == true),
+            "active project should be identified in daemon project list: {projects}"
+        );
+        assert!(
+            rows.iter().any(
+                |row| row["project_root"] == target_root.display().to_string()
+                    && row["is_active"] == false
+            ),
+            "other registered project should be listed for selection: {projects}"
+        );
+    });
+}
+
+#[test]
+fn project_scoped_plugin_routes_read_selected_project_store() {
+    let _env_lock = GLOBAL_DB_ENV_LOCK
+        .lock()
+        .unwrap_or_else(|poisoned| poisoned.into_inner());
+    let runtime = create_runtime();
+    runtime.block_on(async {
+        let fixture = start_dashboard_fixture(false).await;
+        let agent = http_agent_with_timeout(std::time::Duration::from_secs(20));
+
+        let (_target_root, target_cg) = setup_target_project(&fixture).await;
+        let target_project_id = project_id(&target_cg);
+        target_cg
+            .db()
+            .conn()
+            .execute(
+                "INSERT INTO memory_facts
+                    (fact_id, content, category, tags, trust_score, retrieval_count, helpful_count, created_at, updated_at)
+                 VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)",
+                libsql::params![
+                    201_i64,
+                    "Target daemon project selector fact",
+                    "project",
+                    "[\"selector\"]",
+                    0.91_f64,
+                    1_i64,
+                    1_i64,
+                    1_700_010_000_i64,
+                    1_700_010_100_i64
+                ],
+            )
+            .await
+            .expect("target fact should insert");
+        target_cg
+            .checkpoint()
+            .await
+            .expect("target project DB should checkpoint before dashboard reopen");
+        target_cg.close();
+
+        let (active_status, active_payload) = get_json(
+            &agent,
+            &format!(
+                "{}/api/plugins/holographic/?q=selector&limit=10",
+                fixture.base_url
+            ),
+        );
+        assert_eq!(active_status, 200);
+        assert_eq!(
+            active_payload["holographic"]["facts"]
+                .as_array()
+                .map(Vec::len),
+            Some(0),
+            "active project should not contain target-only selector fact"
+        );
+
+        let (selected_status, selected_payload) = get_json(
+            &agent,
+            &format!(
+                "{}/api/projects/{}/plugins/holographic/?q=selector&limit=10",
+                fixture.base_url, target_project_id
+            ),
+        );
+        assert_eq!(selected_status, 200);
+        let selected_facts = selected_payload["holographic"]["facts"]
+            .as_array()
+            .unwrap_or_else(|| panic!("expected selected project facts: {selected_payload}"));
+        assert_eq!(selected_facts.len(), 1);
+        assert_eq!(
+            selected_facts[0]["content"],
+            "Target daemon project selector fact"
+        );
+    });
+}
+
+#[test]
+fn project_scoped_curation_preview_and_activity_do_not_leak_active_state() {
+    let _env_lock = GLOBAL_DB_ENV_LOCK
+        .lock()
+        .unwrap_or_else(|poisoned| poisoned.into_inner());
+    let runtime = create_runtime();
+    runtime.block_on(async {
+        let fixture = start_dashboard_fixture(false).await;
+        let agent = http_agent_with_timeout(std::time::Duration::from_secs(20));
+
+        let (_target_root, target_cg) = setup_target_project(&fixture).await;
+        let target_project_id = project_id(&target_cg);
+        target_cg
+            .checkpoint()
+            .await
+            .expect("target project DB should checkpoint before dashboard reopen");
+        target_cg.close();
+
+        let (active_curate_status, active_curate) = post_json_body(
+            &agent,
+            &format!("{}/api/plugins/holographic/curate", fixture.base_url),
+            &serde_json::json!({ "dry_run": true }),
+        );
+        assert_eq!(active_curate_status, 200);
+        assert_eq!(active_curate["dry_run"], true);
+
+        let (active_preview_status, active_preview) = get_json(
+            &agent,
+            &format!(
+                "{}/api/plugins/holographic/curation/preview",
+                fixture.base_url
+            ),
+        );
+        assert_eq!(active_preview_status, 200);
+        assert!(
+            !active_preview["report"].is_null(),
+            "active dry-run should save a preview"
+        );
+        let (active_activity_status, active_activity) = get_json(
+            &agent,
+            &format!(
+                "{}/api/plugins/holographic/curation/activity?limit=75",
+                fixture.base_url
+            ),
+        );
+        assert_eq!(active_activity_status, 200);
+        assert!(
+            active_activity["count"].as_i64().unwrap_or_default() > 0,
+            "active dry-run should record curation activity"
+        );
+
+        let (selected_preview_status, selected_preview) = get_json(
+            &agent,
+            &format!(
+                "{}/api/projects/{}/plugins/holographic/curation/preview",
+                fixture.base_url, target_project_id
+            ),
+        );
+        assert_eq!(selected_preview_status, 200);
+        assert!(
+            selected_preview["report"].is_null(),
+            "selected non-active project must not reuse the active preview: {selected_preview}"
+        );
+
+        let (selected_activity_status, selected_activity) = get_json(
+            &agent,
+            &format!(
+                "{}/api/projects/{}/plugins/holographic/curation/activity?limit=75",
+                fixture.base_url, target_project_id
+            ),
+        );
+        assert_eq!(selected_activity_status, 200);
+        assert_eq!(
+            selected_activity["count"], 0,
+            "selected non-active project must not reuse active curation activity: {selected_activity}"
+        );
+    });
+}
+
+#[test]
+fn project_scoped_mutations_are_rejected_for_non_active_projects() {
+    let _env_lock = GLOBAL_DB_ENV_LOCK
+        .lock()
+        .unwrap_or_else(|poisoned| poisoned.into_inner());
+    let runtime = create_runtime();
+    runtime.block_on(async {
+        let fixture = start_dashboard_fixture(false).await;
+        let agent = http_agent_with_timeout(std::time::Duration::from_secs(20));
+
+        let (_target_root, target_cg) = setup_target_project(&fixture).await;
+        let target_project_id = project_id(&target_cg);
+        target_cg.close();
+
+        let (status, body) = post_json_body(
+            &agent,
+            &format!(
+                "{}/api/projects/{}/plugins/holographic/curate",
+                fixture.base_url, target_project_id
+            ),
+            &serde_json::json!({ "dry_run": true }),
+        );
+        assert_eq!(status, 405);
+        assert_eq!(body["status"], "read_only_project");
+    });
+}

From 9173ce26e3c15f499e7f3ceae13593ab434c04f4 Mon Sep 17 00:00:00 2001
From: ScriptedAlchemy <zack@module-federation.io>
Date: Tue, 30 Jun 2026 20:33:34 +0000
Subject: [PATCH 6/7] fix: refresh selected project cache

---
 src/dashboard/projects.rs | 137 +++++++++++++++++++++++++++++++++++---
 1 file changed, 129 insertions(+), 8 deletions(-)

diff --git a/src/dashboard/projects.rs b/src/dashboard/projects.rs
index 4d1a4fbc..9f764244 100644
--- a/src/dashboard/projects.rs
+++ b/src/dashboard/projects.rs
@@ -12,14 +12,29 @@ use tokio::sync::RwLock;
 
 use super::{build_selected_project_state, config_error, DashboardState};
 use crate::errors::Result;
-use crate::global_db::GlobalDb;
+use crate::global_db::{GlobalDb, ProjectRegistryContext};
 use crate::tracedecay::TraceDecay;
 
 #[derive(Clone)]
 pub(crate) struct DashboardRuntime {
     active: DashboardState,
     project_api: Router<DashboardState>,
-    project_states: Arc<RwLock<HashMap<String, DashboardState>>>,
+    project_states: Arc<RwLock<HashMap<String, CachedProjectState>>>,
+}
+
+#[derive(Clone)]
+struct CachedProjectState {
+    fingerprint: ProjectCacheFingerprint,
+    state: DashboardState,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+struct ProjectCacheFingerprint(ProjectRegistryContext);
+
+impl ProjectCacheFingerprint {
+    fn from_registry_context(context: &ProjectRegistryContext) -> Self {
+        Self(context.clone())
+    }
 }
 
 impl DashboardRuntime {
@@ -57,10 +72,6 @@ impl DashboardRuntime {
             });
         }
 
-        if let Some(state) = self.project_states.read().await.get(project_id).cloned() {
-            return Ok(SelectedProjectState { state });
-        }
-
         let db = GlobalDb::open()
             .await
             .ok_or_else(|| config_error("could not open tracedecay project registry"))?;
@@ -68,6 +79,14 @@ impl DashboardRuntime {
             .project_registry_context_by_id(project_id)
             .await
             .ok_or_else(|| config_error(format!("registered project not found: {project_id}")))?;
+        let fingerprint = ProjectCacheFingerprint::from_registry_context(&context);
+        if let Some(cached) = self.project_states.read().await.get(project_id).cloned() {
+            if cached.fingerprint == fingerprint {
+                return Ok(SelectedProjectState {
+                    state: cached.state,
+                });
+            }
+        }
         let project_root = PathBuf::from(&context.project.canonical_root);
         let cg = TraceDecay::open_read_only(&project_root).await?;
         if cg.store_layout().identity.project_id.as_deref() != Some(project_id) {
@@ -79,9 +98,19 @@ impl DashboardRuntime {
         let state = build_selected_project_state(&cg).await;
         let mut project_states = self.project_states.write().await;
         if let Some(cached) = project_states.get(project_id).cloned() {
-            return Ok(SelectedProjectState { state: cached });
+            if cached.fingerprint == fingerprint {
+                return Ok(SelectedProjectState {
+                    state: cached.state,
+                });
+            }
         }
-        project_states.insert(project_id.to_string(), state.clone());
+        project_states.insert(
+            project_id.to_string(),
+            CachedProjectState {
+                fingerprint,
+                state: state.clone(),
+            },
+        );
         Ok(SelectedProjectState { state })
     }
 }
@@ -182,3 +211,95 @@ pub(crate) async fn context(
         })),
     )
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::global_db::{
+        CodeProjectRecord, GraphScopeRecord, ProjectRegistryContext, ProjectStoreContext,
+        StoreArtifactRecord, StoreInstanceRecord,
+    };
+
+    fn code_project() -> CodeProjectRecord {
+        CodeProjectRecord {
+            project_id: "proj_test".to_string(),
+            canonical_root: "/repo".to_string(),
+            display_root: "/repo".to_string(),
+            git_common_dir: Some("/repo/.git".to_string()),
+            git_remote_url: Some("https://example.com/repo.git".to_string()),
+            default_branch: Some("main".to_string()),
+            created_at: 100,
+            last_seen_at: 200,
+        }
+    }
+
+    fn store_context() -> ProjectStoreContext {
+        ProjectStoreContext {
+            store: StoreInstanceRecord {
+                store_id: "store:test".to_string(),
+                project_id: "proj_test".to_string(),
+                store_kind: "code_project".to_string(),
+                storage_mode: "profile_sharded".to_string(),
+                store_relpath: "projects/proj_test".to_string(),
+                manifest_relpath: Some("projects/proj_test/store_manifest.json".to_string()),
+                created_at: 110,
+                last_verified_at: Some(210),
+                last_write_at: Some(220),
+            },
+            graph_scopes: vec![GraphScopeRecord {
+                graph_scope_id: "store:test:branch:main".to_string(),
+                project_id: "proj_test".to_string(),
+                store_id: "store:test".to_string(),
+                branch_name: "main".to_string(),
+                db_relpath: "projects/proj_test/branches/main.db".to_string(),
+                parent_scope_id: None,
+                last_synced_at: Some(230),
+                writable: true,
+            }],
+            artifacts: vec![StoreArtifactRecord {
+                store_id: "store:test".to_string(),
+                artifact_kind: "graph_db".to_string(),
+                relpath: "projects/proj_test/branches/main.db".to_string(),
+                size_bytes: Some(4096),
+                schema_version: None,
+                updated_at: Some(240),
+            }],
+        }
+    }
+
+    fn registry_context() -> ProjectRegistryContext {
+        ProjectRegistryContext {
+            project: code_project(),
+            aliases: Vec::new(),
+            stores: vec![store_context()],
+        }
+    }
+
+    #[test]
+    fn project_cache_fingerprint_changes_with_project_metadata() {
+        let base = registry_context();
+        let mut changed = registry_context();
+        changed.project.canonical_root = "/new-repo".to_string();
+        changed.project.last_seen_at += 1;
+
+        assert_ne!(
+            ProjectCacheFingerprint::from_registry_context(&base),
+            ProjectCacheFingerprint::from_registry_context(&changed)
+        );
+    }
+
+    #[test]
+    fn project_cache_fingerprint_changes_with_store_metadata() {
+        let base = registry_context();
+        let mut changed = registry_context();
+        changed.stores[0].store.last_write_at = Some(999);
+        changed.stores[0].graph_scopes[0].db_relpath =
+            "projects/proj_test/branches/feature.db".to_string();
+        changed.stores[0].artifacts[0].updated_at = Some(1000);
+
+        assert_ne!(
+            ProjectCacheFingerprint::from_registry_context(&base),
+            ProjectCacheFingerprint::from_registry_context(&changed)
+        );
+    }
+}

From 78736bfc077f99562f870c8d096405f0570468a0 Mon Sep 17 00:00:00 2001
From: ScriptedAlchemy <zack@module-federation.io>
Date: Tue, 30 Jun 2026 20:51:31 +0000
Subject: [PATCH 7/7] refactor: simplify selected project cache

---
 src/dashboard/projects.rs | 33 ++++++++-------------------------
 1 file changed, 8 insertions(+), 25 deletions(-)

diff --git a/src/dashboard/projects.rs b/src/dashboard/projects.rs
index 9f764244..d8d851a6 100644
--- a/src/dashboard/projects.rs
+++ b/src/dashboard/projects.rs
@@ -24,19 +24,10 @@ pub(crate) struct DashboardRuntime {
 
 #[derive(Clone)]
 struct CachedProjectState {
-    fingerprint: ProjectCacheFingerprint,
+    registry_context: ProjectRegistryContext,
     state: DashboardState,
 }
 
-#[derive(Debug, Clone, PartialEq, Eq)]
-struct ProjectCacheFingerprint(ProjectRegistryContext);
-
-impl ProjectCacheFingerprint {
-    fn from_registry_context(context: &ProjectRegistryContext) -> Self {
-        Self(context.clone())
-    }
-}
-
 impl DashboardRuntime {
     pub(crate) fn new(active: DashboardState, project_api: Router<DashboardState>) -> Self {
         Self {
@@ -79,9 +70,8 @@ impl DashboardRuntime {
             .project_registry_context_by_id(project_id)
             .await
             .ok_or_else(|| config_error(format!("registered project not found: {project_id}")))?;
-        let fingerprint = ProjectCacheFingerprint::from_registry_context(&context);
         if let Some(cached) = self.project_states.read().await.get(project_id).cloned() {
-            if cached.fingerprint == fingerprint {
+            if cached.registry_context == context {
                 return Ok(SelectedProjectState {
                     state: cached.state,
                 });
@@ -98,7 +88,7 @@ impl DashboardRuntime {
         let state = build_selected_project_state(&cg).await;
         let mut project_states = self.project_states.write().await;
         if let Some(cached) = project_states.get(project_id).cloned() {
-            if cached.fingerprint == fingerprint {
+            if cached.registry_context == context {
                 return Ok(SelectedProjectState {
                     state: cached.state,
                 });
@@ -107,7 +97,7 @@ impl DashboardRuntime {
         project_states.insert(
             project_id.to_string(),
             CachedProjectState {
-                fingerprint,
+                registry_context: context,
                 state: state.clone(),
             },
         );
@@ -214,7 +204,6 @@ pub(crate) async fn context(
 
 #[cfg(test)]
 mod tests {
-    use super::*;
     use crate::global_db::{
         CodeProjectRecord, GraphScopeRecord, ProjectRegistryContext, ProjectStoreContext,
         StoreArtifactRecord, StoreInstanceRecord,
@@ -276,20 +265,17 @@ mod tests {
     }
 
     #[test]
-    fn project_cache_fingerprint_changes_with_project_metadata() {
+    fn registry_context_changes_with_project_metadata() {
         let base = registry_context();
         let mut changed = registry_context();
         changed.project.canonical_root = "/new-repo".to_string();
         changed.project.last_seen_at += 1;
 
-        assert_ne!(
-            ProjectCacheFingerprint::from_registry_context(&base),
-            ProjectCacheFingerprint::from_registry_context(&changed)
-        );
+        assert_ne!(base, changed);
     }
 
     #[test]
-    fn project_cache_fingerprint_changes_with_store_metadata() {
+    fn registry_context_changes_with_store_metadata() {
         let base = registry_context();
         let mut changed = registry_context();
         changed.stores[0].store.last_write_at = Some(999);
@@ -297,9 +283,6 @@ mod tests {
             "projects/proj_test/branches/feature.db".to_string();
         changed.stores[0].artifacts[0].updated_at = Some(1000);
 
-        assert_ne!(
-            ProjectCacheFingerprint::from_registry_context(&base),
-            ProjectCacheFingerprint::from_registry_context(&changed)
-        );
+        assert_ne!(base, changed);
     }
 }