[03/14] Connection access: Filter project collections and live/replay streams #4

Part of #1. User approved ticket execution on 2026-10-10.

Stack order: 03/14. Run one implementation session at a time by default.
Depends on: #3. Earlier slices are transitive prerequisites.
Branch: access/03-project-streams. Initial fork PR base: access/02-device-auth. Restack against accepted preceding slice when necessary.

Purpose: Visible project set applies before snapshot enrichment, search ranking and event delivery.

Likely files: ws.ts, project/http.ts, orchestration-v2/http.ts, ShellStream.ts, ThreadSearch.ts, ProjectionStore.ts, WireProjection.ts, auth/ResourceAuthorization.ts.

Contract/API: Preserve existing snapshot/event schemas and sequence cursor meaning. Restricted shell contains only granted projects/threads. Archive snapshots, subscription metadata/resume hydration, project refresh, search snippets/counts, and every project-backed collection filter consistently. Search SQL filters project IDs before rank/limit. Preserve completion/cursor progress for filtered batches; do not fabricate fake events or leak hidden metadata. Grant revision requires fresh snapshot rather than resuming old entitlement.

Acceptance: Seed A/B, active/archived, identical search terms, newer hidden events, empty grants, future all/explicit additions. HTTP/WS initial/replay/live/enrichment all omit B titles/paths/snippets/references. Hidden search candidates cannot crowd out A. Archive behavior preserved. Filter before expensive provider/project enrichment; retain bounded shell transport behavior.

vp test run apps/server/src/ws.test.ts apps/server/src/project/http.test.ts apps/server/src/orchestration-v2/ShellStream.test.ts apps/server/src/orchestration-v2/ThreadSearch.test.ts apps/server/src/orchestration-v2/ThreadTransportPerformance.test.ts
vp lint apps/server/src/ws.ts apps/server/src/project/http.ts apps/server/src/orchestration-v2/http.ts apps/server/src/orchestration-v2/ShellStream.ts apps/server/src/orchestration-v2/ThreadSearch.ts apps/server/src/orchestration-v2/WireProjection.ts
vp run --filter t3 typecheck

Handoff: Enumerate covered collection tags/routes, replay checkpoint rule and remaining direct paths. Safe to merge: Gate closed; no collection fixture leaks B; existing owner stream shape/performance assertions pass.

Session rules

• Reuse approved parent policy: manual pairing first; per-device project and configured-provider/model grants; queue-only interaction with another device's active run; grant cuts cancel/interrupt affected device work; no OS sandbox.
• V1 restricted scheduled tasks are denied, rather than implementing full restricted automation.
• Early slices remain inert. Restricted issuance/edit/conversion stays disabled until activation ticket.
• Focused checks only; exact test/file list may adjust after inspecting source. Do not run repo-wide checks, paid provider agents, dev servers, browsers or devices without explicit authorization.
• Configured git identity; no agent attribution or Co-Authored-By trailers. Plans/evidence stay outside repository.
• After focused checks, commit/push this fork branch and open one fork PR, link it to T3 session, and report validation plus remaining risks. Do not merge PR or start next ticket yourself; coordinating session handles readiness and dependency handoff.

Execution status

Implementation complete; source review accepted at 2a848c2. PR #18 targets access/02-device-auth at reviewed 7421492. No blocking source findings. Focused validation: 409 tests / 14 files, touched-file lint, named server typecheck and diff check pass. CI remains queued; PR unmerged. Restricted production gate stays closed. Issue stays open until integration merge.

Covered: HTTP projects/shell, WS active/archive initial/live/refresh, SQL-before-limit search, PR lists/stats/linked threads, clone progress and typed cross-project references. Explicit grants or edited authority force fresh snapshot; revision-zero owner retains bounded replay. Real event sequences preserved; no fabricated hidden-only deltas. Direct reads/mutations continue in #5.

Implementation session: Ticket 03. Coordinator owns CI, integration/restack and final client verification.