@@ -144,12 +144,26 @@ async function* pages(input: SourcePageInput): AsyncIterable<CopilotChatRow[]> {
   }
 }
 
+/** A message written before content blocks keeps its tool calls in a top-level `toolCalls` list. */
+function projectLegacyToolCall(call: unknown): unknown {
+  if (!isRecordLike(call) || call.name !== 'remember') return call
+  return {
+    name: 'remember',
+    ...(typeof call.id === 'string' ? { id: call.id } : {}),
+    ...(typeof call.status === 'string' ? { status: call.status } : {}),
+  }
+}
+
 /** Tool payloads can contain private notes even when their mutation failed or targeted a shared note. */
 function projectExportMessage(message: unknown): unknown {
-  if (!isRecordLike(message) || !Array.isArray(message.contentBlocks)) return message
+  if (!isRecordLike(message)) return message
+  const projected = Array.isArray(message.toolCalls)
+    ? { ...message, toolCalls: message.toolCalls.map(projectLegacyToolCall) }
+    : message
+  if (!Array.isArray(projected.contentBlocks)) return projected
   return {
-    ...message,
-    contentBlocks: message.contentBlocks.map((block: unknown) => {
+    ...projected,
+    contentBlocks: projected.contentBlocks.map((block: unknown) => {
       if (!isRecordLike(block) || !isRecordLike(block.toolCall)) return block
       if (block.toolCall.name !== 'remember') {
         if (!isRecordLike(block.toolCall.result) || !('output' in block.toolCall.result))
 
@@ -118,6 +118,22 @@ describe('Drain source coverage and payload safety in PostgreSQL', () => {
     const content = {
       role: 'assistant',
       content: 'Visible reply',
+      toolCalls: [
+        {
+          id: 'legacy',
+          name: 'remember',
+          status: 'success',
+          params: { content: 'hidden-memory-legacy-args' },
+          result: 'hidden-memory-legacy-result',
+          error: 'hidden-memory-legacy-error',
+        },
+        {
+          id: 'legacy-read',
+          name: 'read',
+          status: 'success',
+          params: { path: 'visible-legacy-path' },
+        },
+      ],
       contentBlocks: [
         { type: 'text', content: 'Visible reply' },
         {
@@ -176,6 +192,7 @@ describe('Drain source coverage and payload safety in PostgreSQL', () => {
       expect(wire).not.toContain('hidden-memory')
       expect(wire).toContain('Visible reply')
       expect(wire).toContain('visible-path')
+      expect(wire).toContain('visible-legacy-path')
       const [stored] = await runtime.db
         .select({ content: runtime.schema.copilotMessages.content })
         .from(runtime.schema.copilotMessages)
 
@@ -242,6 +242,19 @@ it('lets a read-only end user mutate private notes through either chat and keeps
   }
 })
 
+it('resolves overlapping workspace checks that share one Project without deadlocking', async () => {
+  const results = await Promise.all(
+    Array.from({ length: 6 }, (_, index) =>
+      resolveMemoryNotesAccess.execute({
+        principal: principal(index % 2 === 1),
+        input: { target: { scope: 'workspace', workspaceId }, action: 'read' },
+      })
+    )
+  )
+  for (const result of results)
+    expect(result.target).toMatchObject({ scope: 'workspace', currentProject: { id: projectId } })
+})
+
 it('does not turn write in one environment into shared Project write', async () => {
   await db
     .update(permissions)
 
@@ -21,7 +21,7 @@ import type {
 } from '@/lib/mothership/generated/memory-notes-access'
 import { assertWorkspaceCapability } from '@/lib/permission-groups/capability-assertions'
 import { PermissionGroupCapabilityError } from '@/lib/permission-groups/capability-error'
-import { acquirePermissionGroupOrgLock } from '@/lib/permission-groups/locks'
+import { acquirePermissionGroupOrgReadLock } from '@/lib/permission-groups/locks'
 import { loadProjectAccess } from '@/lib/projects/application/authorization'
 import {
   requireCurrentCopilotProjectInvocation,
@@ -91,15 +91,20 @@ async function projectAccess(
   projectId: string,
   scope: { organizationId: string | null; workspaceId?: string }
 ): Promise<Extract<MemoryNotesAccessResult['target'], { scope: 'project' }>> {
-  const access = await loadProjectAccess(tx, principal.subjectUserId, {
-    projectId,
-    ...(scope.organizationId ? { organizationId: scope.organizationId } : {}),
-    ...(scope.workspaceId ? { workspaceId: scope.workspaceId } : {}),
-  })
+  const access = await loadProjectAccess(
+    tx,
+    principal.subjectUserId,
+    {
+      projectId,
+      ...(scope.organizationId ? { organizationId: scope.organizationId } : {}),
+      ...(scope.workspaceId ? { workspaceId: scope.workspaceId } : {}),
+    },
+    'shared'
+  )
   if (scope.organizationId !== access.record.organizationId)
     throw new OrchestrationError('not_found', 'Project not found in this conversation')
   if (access.record.organizationId)
-    await acquirePermissionGroupOrgLock(tx, access.record.organizationId)
+    await acquirePermissionGroupOrgReadLock(tx, access.record.organizationId)
   await requireCurrentCopilotProjectInvocation(
     tx,
     {
 
@@ -0,0 +1,50 @@
+/**
+ * @vitest-environment node
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockEnv, mockEnqueue } = vi.hoisted(() => ({
+  mockEnv: { COPILOT_API_KEY: undefined as string | undefined } as Record<
+    string,
+    string | undefined
+  >,
+  mockEnqueue: vi.fn(),
+}))
+
+vi.mock('@/lib/core/config/env', () => ({ env: mockEnv }))
+vi.mock('@/lib/core/outbox/service', () => ({ enqueueOutboxEvent: mockEnqueue }))
+vi.mock('@/lib/mothership/constants', () => ({ SIM_AGENT_API_URL: 'https://agent.example.test' }))
+vi.mock('@/lib/mothership/request/go/fetch', () => ({ fetchGo: vi.fn() }))
+vi.mock('@/lib/mothership/request/headers', () => ({ mothershipRequestHeaders: () => ({}) }))
+vi.mock('@/lib/mothership/server/agent-url', () => ({ getMothershipSourceEnvHeaders: () => ({}) }))
+
+import { enqueueMemoryCleanup } from '@/lib/mothership/memories/cleanup-outbox'
+
+const executor = { insert: vi.fn() }
+const targets = [
+  { kind: 'private_owner' as const, userId: 'user-1' },
+  { kind: 'workspace' as const, workspaceId: '00000000-0000-4000-8000-000000000001' },
+]
+
+describe('enqueueMemoryCleanup', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockEnv.COPILOT_API_KEY = undefined
+  })
+
+  it('queues nothing when this Sim has no worker credential', async () => {
+    await enqueueMemoryCleanup(executor, targets)
+    expect(mockEnqueue).not.toHaveBeenCalled()
+  })
+
+  it('queues one credential-bound event per destination and target', async () => {
+    mockEnv.COPILOT_API_KEY = 'configured-key'
+    await enqueueMemoryCleanup(executor, targets)
+    expect(mockEnqueue).toHaveBeenCalledTimes(targets.length)
+    for (const [, , payload] of mockEnqueue.mock.calls)
+      expect(payload).toMatchObject({
+        baseUrl: 'https://agent.example.test',
+        credentialFingerprint: expect.any(String),
+      })
+  })
+})
@@ -35,12 +35,17 @@ function credentialFingerprint(): string | null {
   return env.COPILOT_API_KEY ? createHash('sha256').update(env.COPILOT_API_KEY).digest('hex') : null
 }
 
-/** Captures configured routes before deletion; notes can outlive a user's environment selection. */
+/**
+ * Captures configured routes before deletion; notes can outlive a user's environment selection.
+ * Without `COPILOT_API_KEY` this Sim never reached a worker, so it holds no notes to erase and
+ * queues nothing rather than an event no delivery could authenticate.
+ */
 export async function enqueueMemoryCleanup(
   executor: Pick<typeof db, 'insert'>,
   targets: MemoryCleanupInput['target'][]
 ): Promise<void> {
   const fingerprint = credentialFingerprint()
+  if (!fingerprint) return
   const sourceHeaders = getMothershipSourceEnvHeaders()
   for (const baseUrl of destinations()) {
     for (const target of targets) {