@inetafrica/open-claudia 3.0.44 → 3.1.1

package/core/runner.js

@@ -1201,6 +1201,7 @@ function deriveCompactionRunContext(base, overrides = {}) {
     resumeSessionId: overrides.resumeSessionId ?? null,
     continueSession: false,
     fresh: !!overrides.fresh,
+    recallQuery: overrides.recallQuery ?? null,
     skipAutoCompact: true,
     requiredDelivery: false,
     readOnly: true,
@@ -1214,6 +1215,25 @@ function deriveCompactionRunContext(base, overrides = {}) {
   });
 }
 
+// The seed turn opens a fresh session, so whatever packs were active before
+// compaction only come back if recall re-attracts them. Match on what the
+// work IS — the condensed brief plus open task titles — rather than the seed
+// prompt's instruction boilerplate.
+function seedRecallQuery(condensedSummary) {
+  const parts = [String(condensedSummary || "").slice(0, 4000)];
+  try {
+    const { currentAdapter, currentChannelId } = require("./context");
+    const adapter = currentAdapter();
+    const channelId = currentChannelId();
+    if (adapter && channelId) {
+      const titles = require("./tasks").pendingSummary(adapter.id, channelId)
+        .map((t) => t.content).filter(Boolean).slice(0, 20);
+      if (titles.length) parts.push(titles.join("\n"));
+    }
+  } catch (_) {}
+  return parts.filter(Boolean).join("\n");
+}
+
 function successfulTerminalCapture(result, { requireSession = false } = {}) {
   return !!result?.ok && result.status === "succeeded" && result.terminalSeen === true
     && (!requireSession || (typeof result.sessionId === "string" && !!result.sessionId));
@@ -1296,6 +1316,7 @@ function createCompactionService(dependencies = {}) {
         previousSessionId: oldSessionId,
         fresh: true,
         outputSchemaPath,
+        recallQuery: seedRecallQuery(condensed || fullBrief),
       });
       const seedRun = await runCapture(seedPrompt, seedContext.cwd || cwd, {
         runContext: seedContext,

package/core/safe-mode.js

@@ -0,0 +1,227 @@
+// Safe-mode boot gate. Two failure classes land here instead of running (or
+// dying) blind:
+//   1) REQUIRED substrate missing — no node:sqlite means no pack FTS, no
+//      recall graph, no episodes. A pod once ran 16 days like that, silently.
+//      Running degraded is now an explicit operator choice, never a default.
+//   2) Boot crash loop — N consecutive boots died before reaching stable
+//      uptime. A hard exit here would strand the operator with a dead chat;
+//      safe mode keeps the channel alive so /doctor, /upgrade, /downgrade and
+//      /safemode continue can rescue it FROM CHAT.
+// Safe mode boots adapters + slash commands only: no scheduler, no crons, no
+// agent turns, no reviewer. bot.js consults beginBoot() once at startup;
+// router.js gates every message through isSafeMode()/commandAllowed().
+
+const fs = require("fs");
+const path = require("path");
+const CONFIG_DIR = require("../config-dir");
+const { sqliteAvailable } = require("./doctor-memory");
+
+const MARKER_FILE = path.join(CONFIG_DIR, "boot-marker.json");
+const CONTINUE_FILE = path.join(CONFIG_DIR, "safemode-continue.json");
+const VERSION_HISTORY_FILE = path.join(CONFIG_DIR, "version-history.json");
+
+const CRASH_LOOP_THRESHOLD = 3;
+const STABLE_UPTIME_MS = 5 * 60 * 1000;
+const CONTINUE_FRESH_MS = 15 * 60 * 1000;
+const VERSION_HISTORY_CAP = 20;
+
+// Commands that still work in safe mode: diagnosis + the ways out. Everything
+// else (agent turns, memory, schedulers, wizards) is paused.
+const SAFE_COMMANDS = new Set([
+  "help", "start", "version", "status", "doctor", "requirements",
+  "restart", "upgrade", "downgrade", "safemode", "whoami", "cluster",
+]);
+
+let _state = { mode: "full", reasons: [], consecutiveCrashes: 0, prevExit: null };
+
+function readJson(file) {
+  try { return JSON.parse(fs.readFileSync(file, "utf-8")); } catch (_) { return null; }
+}
+
+function writeJson(file, value) {
+  try {
+    fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+    fs.writeFileSync(file, JSON.stringify(value), { mode: 0o600 });
+    return true;
+  } catch (_) { return false; }
+}
+
+// Pure decision, unit-testable. degradedAllowed = explicit env override;
+// continueRequested = one-shot /safemode continue flag (also resets the loop).
+function decideBootMode({ sqliteOk, crashCount, degradedAllowed, continueRequested }) {
+  const reasons = [];
+  const effectiveCrashes = continueRequested ? 0 : crashCount;
+  if (!sqliteOk && !degradedAllowed && !continueRequested) reasons.push("substrate");
+  if (effectiveCrashes >= CRASH_LOOP_THRESHOLD) reasons.push("crash-loop");
+  if (reasons.length) return { mode: "safe", reasons };
+  return { mode: sqliteOk ? "full" : "degraded", reasons: [] };
+}
+
+function recordVersionSeen(version, now = Date.now()) {
+  if (!version) return;
+  const history = Array.isArray(readJson(VERSION_HISTORY_FILE)) ? readJson(VERSION_HISTORY_FILE) : [];
+  const last = history[history.length - 1];
+  if (last && last.version === version) return;
+  history.push({ version, at: new Date(now).toISOString() });
+  writeJson(VERSION_HISTORY_FILE, history.slice(-VERSION_HISTORY_CAP));
+}
+
+// Most recent version in boot history that differs from the current one — the
+// default /downgrade target ("what ran before this").
+function previousVersion(current) {
+  const history = readJson(VERSION_HISTORY_FILE);
+  if (!Array.isArray(history)) return null;
+  for (let i = history.length - 1; i >= 0; i--) {
+    const v = history[i] && history[i].version;
+    if (v && v !== current) return v;
+  }
+  return null;
+}
+
+function consumeContinueFlag(now = Date.now()) {
+  const flag = readJson(CONTINUE_FILE);
+  try { fs.rmSync(CONTINUE_FILE, { force: true }); } catch (_) {}
+  if (!flag || !flag.at) return false;
+  return now - Date.parse(flag.at) < CONTINUE_FRESH_MS;
+}
+
+function requestContinue() {
+  return writeJson(CONTINUE_FILE, { at: new Date().toISOString() });
+}
+
+// Called once per process at the very top of bot.js. Counts crash-loop state
+// from the previous boot marker + exit record, decides the boot mode, writes
+// this boot's marker. Crash rule: the previous incarnation counts as a crash
+// iff it never reached stable uptime AND did not record a clean (code 0)
+// deliberate exit. A safe-mode incarnation preserves the count (safe mode
+// being stable must not launder the loop away) — only markBootStable(),
+// /safemode continue, or a deliberate version change resets it.
+function beginBoot({ exitInfo = null, currentVersion = "", env = process.env, now = Date.now() } = {}) {
+  try {
+    // Test runs boot bot.js repeatedly and kill it hard; marker counting would
+    // sabotage the suite. The feature's own tests opt back in explicitly.
+    if (env.OPEN_CLAUDIA_TEST === "1" && env.OPEN_CLAUDIA_SAFEMODE_TEST !== "1") {
+      _state = { mode: "full", reasons: [], consecutiveCrashes: 0, prevExit: exitInfo };
+      return { ..._state };
+    }
+    recordVersionSeen(currentVersion, now);
+    const prev = readJson(MARKER_FILE);
+    const cleanExit = !!(exitInfo && Number(exitInfo.code) === 0);
+    const crashed = !!(prev && !prev.stable && !cleanExit);
+    const baseCount = prev ? Number(prev.consecutiveCrashes) || 0 : 0;
+    const crashCount = crashed ? baseCount + 1 : (prev && prev.mode === "safe" ? baseCount : 0);
+    const continueRequested = consumeContinueFlag(now);
+    const decision = decideBootMode({
+      sqliteOk: sqliteAvailable(),
+      crashCount,
+      degradedAllowed: env.MEMORY_ALLOW_DEGRADED === "1",
+      continueRequested,
+    });
+    const effectiveCount = continueRequested ? 0 : crashCount;
+    writeJson(MARKER_FILE, {
+      bootedAt: new Date(now).toISOString(),
+      pid: process.pid,
+      mode: decision.mode,
+      // The safe-mode process itself is stable; its marker must still carry
+      // the count so a plain /restart re-enters safe mode instead of retrying
+      // the crashing full boot.
+      stable: decision.mode === "safe",
+      consecutiveCrashes: effectiveCount,
+      version: currentVersion,
+    });
+    _state = {
+      mode: decision.mode,
+      reasons: decision.reasons,
+      consecutiveCrashes: effectiveCount,
+      prevExit: exitInfo,
+    };
+    return { ..._state };
+  } catch (e) {
+    // The gate must never itself brick a boot.
+    try { console.error("safe-mode beginBoot failed:", e.message); } catch (_) {}
+    _state = { mode: "full", reasons: [], consecutiveCrashes: 0, prevExit: exitInfo };
+    return { ..._state };
+  }
+}
+
+// Full/degraded boots call this after STABLE_UPTIME_MS: the incarnation
+// proved itself, so the crash streak resets.
+function markBootStable() {
+  const marker = readJson(MARKER_FILE);
+  if (!marker) return;
+  marker.stable = true;
+  marker.consecutiveCrashes = 0;
+  writeJson(MARKER_FILE, marker);
+}
+
+// A deliberate version change (/upgrade, /downgrade) is an operator fix
+// attempt: give the next boot a clean slate.
+function clearCrashLoop() {
+  const marker = readJson(MARKER_FILE);
+  if (!marker) return;
+  marker.consecutiveCrashes = 0;
+  if (marker.mode === "safe") marker.mode = "full";
+  writeJson(MARKER_FILE, marker);
+}
+
+function isSafeMode() {
+  return _state.mode === "safe";
+}
+
+function bootInfo() {
+  return { ..._state };
+}
+
+function commandAllowed(text) {
+  const t = String(text || "").trim();
+  if (!t.startsWith("/")) return false;
+  const word = t.slice(1).split(/\s+/)[0].split("@")[0].toLowerCase();
+  return SAFE_COMMANDS.has(word);
+}
+
+function reasonLines() {
+  const lines = [];
+  for (const r of _state.reasons) {
+    if (r === "substrate") {
+      lines.push(`• Memory substrate missing: Node ${process.version} has no node:sqlite (Open Claudia requires Node ≥24).`);
+    } else if (r === "crash-loop") {
+      lines.push(`• Boot crash loop: ${_state.consecutiveCrashes} consecutive boots died before reaching stable uptime.`);
+    }
+  }
+  return lines;
+}
+
+function lastExitLine() {
+  if (_state.prevExit && _state.prevExit.reason) return `Last exit: ${_state.prevExit.reason}`;
+  return "Last exit: hard kill — no exit record (OOM, SIGKILL, or a crash before any handler ran).";
+}
+
+function banner() {
+  const why = _state.reasons.includes("substrate") ? "memory substrate missing" : "boot crash loop";
+  return `⛔ Safe mode (${why}) — normal turns are paused. /safemode shows details and ways out; /doctor /status /upgrade /downgrade /restart still work.`;
+}
+
+function formatSafeModeAlert({ version = "" } = {}) {
+  return [
+    `⛔ SAFE MODE — Open Claudia v${version} booted with normal operation suspended.`,
+    ...reasonLines(),
+    lastExitLine(),
+    "",
+    "No agent turns, crons, watches or memory writes will run in this state.",
+    "Working commands: /doctor /status /version /cluster /upgrade /downgrade [version] /restart /safemode continue /help",
+    "",
+    "Ways out:",
+    "• /upgrade — install the latest release",
+    "• /downgrade — roll back to the previously-running version",
+    "• /safemode continue — boot normally anyway (keyword-only memory if the substrate is missing)",
+    "• Fix the runtime (pods: roll to the node:24 image), then /restart",
+  ].join("\n");
+}
+
+module.exports = {
+  MARKER_FILE, CONTINUE_FILE, VERSION_HISTORY_FILE,
+  CRASH_LOOP_THRESHOLD, STABLE_UPTIME_MS, SAFE_COMMANDS,
+  decideBootMode, beginBoot, markBootStable, clearCrashLoop,
+  recordVersionSeen, previousVersion, requestContinue,
+  isSafeMode, bootInfo, commandAllowed, banner, formatSafeModeAlert,
+};

package/core/state.js

@@ -629,10 +629,10 @@ function seedConversationContinuity(state) {
   if (!isRecord(legacy) || isRecord(state.activeSessions[convo])) return;
   state.activeSessions[convo] = { ...legacy };
   if (isRecord(state.usageBySession)) {
-    const prefix = "Workspace";
+    const prefix = "Workspace\u0000";
     for (const [key, usage] of Object.entries(state.usageBySession)) {
       if (key.startsWith(prefix) && isRecord(usage)) {
-        const moved = `${convo}${key.slice(prefix.length)}`;
+        const moved = `${convo}\u0000${key.slice(prefix.length)}`;
         if (!state.usageBySession[moved]) state.usageBySession[moved] = { ...usage };
       }
     }

package/core/system-prompt.js

@@ -539,6 +539,23 @@ function consumeLastInjected() {
   return out;
 }
 
+// A Stance line carrying the word LOCKED (uppercase — prose "locked" stays
+// put) is a constraint the user explicitly froze. The branding-font incident
+// showed such a line sitting mid-Stance reads as background prose and gets
+// violated; hoist LOCKED lines under a must-follow header so they carry rule
+// authority in every injection mode.
+function formatStanceSection(stance) {
+  const lines = stance.split("\n");
+  const locked = lines.map((l) => l.trim()).filter((l) => l && /\bLOCKED\b/.test(l));
+  if (!locked.length) return stance;
+  const rest = lines.filter((l) => !/\bLOCKED\b/.test(l)).join("\n").trim();
+  const block = [
+    "BINDING CONSTRAINTS (LOCKED — follow exactly; do not deviate or reinterpret unless the user explicitly unlocks them this turn):",
+    ...locked.map((l) => (/^[-*]/.test(l) ? l : `- ${l}`)),
+  ].join("\n");
+  return rest ? `${block}\n\n${rest}` : block;
+}
+
 function formatPackForContext(pack, packsLib, opts = {}) {
   const extractive = !!opts.extractive;
   const headline = !!opts.headline;
@@ -564,7 +581,7 @@ function formatPackForContext(pack, packsLib, opts = {}) {
   // still used by the classic engine and as the fallback when no lines matched.
   if (extractive) {
     const stance = (pack.sections.Stance || "").trim();
-    if (stance) parts.push(`#### Stance\n${stance}`);
+    if (stance) parts.push(`#### Stance\n${formatStanceSection(stance)}`);
     const stanceLow = stance.toLowerCase();
     const bySection = new Map();
     for (const h of (Array.isArray(opts.matchedLines) ? opts.matchedLines : [])) {
@@ -598,7 +615,7 @@ function formatPackForContext(pack, packsLib, opts = {}) {
       : ["Stance", "Procedure", "State"];
     for (const section of sections) {
       const body = (pack.sections[section] || "").trim();
-      if (body) parts.push(`#### ${section}\n${body}`);
+      if (body) parts.push(`#### ${section}\n${section === "Stance" ? formatStanceSection(body) : body}`);
     }
     if (headline) {
       const hidden = ["State", "Procedure", "Journal"].filter((s) => (pack.sections[s] || "").trim());
@@ -984,7 +1001,25 @@ function voiceReplyGuidance(opts = {}) {
 
 async function buildOptionalRecallContext(prompt, opts = {}) {
   const collector = { packs: [], packDirs: [], entities: [], recall: null };
-  const { userText, contextText } = recallMatchParts(prompt);
+  // Compaction meta-turns: the summarizer's prompt is instructions about
+  // summarizing, so matching packs against it is pure noise — skip recall.
+  // The seed turn is the opposite: it opens a FRESH session, so recall is the
+  // only way the packs active before compaction come back — match on the
+  // runner-supplied recallQuery (condensed brief + open task titles), not the
+  // seed prompt's boilerplate.
+  if (opts.runContext?.purpose === "compact-summary") {
+    return {
+      dynamicContext: "",
+      metadata: { status: "omitted", omitted: true, reason: "compaction_meta_turn" },
+      legacy: collector,
+    };
+  }
+  const queryOverride = typeof opts.runContext?.recallQuery === "string" && opts.runContext.recallQuery.trim()
+    ? opts.runContext.recallQuery
+    : null;
+  const { userText, contextText } = queryOverride
+    ? { userText: stripRecallAnnouncements(queryOverride), contextText: "" }
+    : recallMatchParts(prompt);
   let historyText = "";
   try {
     historyText = stripRecallAnnouncements(require("./transcripts").recentTranscriptText({ limit: 6 }, promptState(opts)));
@@ -1085,12 +1120,17 @@ function createPromptBuilder(dependencies = {}) {
           throw new TypeError("recall builder returned an invalid result");
         }
       } catch (error) {
+        // Fail-open by design (a broken recall must not block the turn), but
+        // never silently: the error goes to the bot log here, and the turn
+        // observer counts consecutive failures and alerts the owner (B5).
+        try { console.error("[recall] builder failed:", error?.message || error); } catch (_) {}
         recallResult = {
           dynamicContext: "",
           metadata: {
             status: "omitted",
             omitted: true,
             reason: "optional_recall_unavailable",
+            detail: String(error?.message || error).slice(0, 200),
           },
           legacy: { packs: [], packDirs: [], entities: [], recall: null },
         };

package/core/tool-graph.js

@@ -23,6 +23,14 @@
 // and traversed directionally. Each edge carries a Hebbian `weight` bumped on
 // co-use and decayed over time; unlike pack edges there is no structural floor,
 // so a chain that stops being used eventually decays away and is pruned.
+//
+// Decay is computed ON READ (same doctrine as core/recall/graph.js): the stored
+// `weight` is the value AS OF `last_reinforced`; reads map it through
+// effectiveWeight() and reinforcement settles accrued decay before bumping.
+// Nothing rewrites weights nightly — tend() only physically deletes edges whose
+// effective weight has faded under `pruneBelow`. The old nightly decay()
+// rewrite compounded (full age reapplied to an already-decayed weight each
+// night), emptying chains in days; that path no longer exists.
 
 const fs = require("fs");
 const path = require("path");
@@ -37,8 +45,8 @@ const GRAPH_DB = process.env.TOOL_GRAPH_DB
 
 // Tunables (overridable via dream knobs later).
 const DEFAULTS = {
-  halfLifeDays: 45,   // Hebbian weight half-life for decay()
-  pruneBelow: 0.15,   // edges decayed under this are dropped (no structural floor)
+  halfLifeDays: 45,   // Hebbian weight half-life for read-time decay
+  pruneBelow: 0.15,   // edges whose effective weight falls under this are dead (no structural floor)
 };
 
 let _db = null;
@@ -82,6 +90,18 @@ function openDb() {
     )`);
     db.exec("CREATE INDEX IF NOT EXISTS pack_tool_edges_pack ON pack_tool_edges (pack)");
     db.exec("CREATE INDEX IF NOT EXISTS pack_tool_edges_tool ON pack_tool_edges (tool)");
+    // v1 migration: legacy DBs carry weights the old nightly decay() rewrite
+    // had already over-decayed (compounding). Treat stored values as current
+    // and restart the clock — decay is read-time from here on.
+    try {
+      const uv = db.prepare("PRAGMA user_version").get() || {};
+      if (Number(uv.user_version || 0) < 1) {
+        const stamp = now();
+        db.prepare("UPDATE tool_edges SET last_reinforced=? WHERE last_reinforced IS NOT NULL").run(stamp);
+        db.prepare("UPDATE pack_tool_edges SET last_reinforced=? WHERE last_reinforced IS NOT NULL").run(stamp);
+        db.exec("PRAGMA user_version = 1");
+      }
+    } catch (e) {}
     _db = db;
     return db;
   } catch (e) {
@@ -91,23 +111,49 @@ function openDb() {
 
 function now() { return new Date().toISOString(); }
 
-// Directed upsert of a follows-edge src→dst. `bump` adds to the current weight
-// (Hebbian) and stamps last_reinforced; with no bump it just ensures the edge
-// exists at `weight` (default 1).
+// Read-time weight of an edge row: exponential decay of the stored weight since
+// last_reinforced. Pure — storage is never touched. No structural floor here;
+// an edge that was never reinforced (last_reinforced null) does not decay.
+function effectiveWeight(e, nowMs = Date.now(), halfLifeDays = DEFAULTS.halfLifeDays) {
+  if (!e || !Number.isFinite(e.weight)) return 0;
+  if (!e.last_reinforced) return e.weight;
+  const ageDays = (nowMs - Date.parse(e.last_reinforced)) / 86400000;
+  if (!(ageDays > 0)) return e.weight;
+  return e.weight * Math.exp(-Math.log(2) * ageDays / Math.max(1, halfLifeDays));
+}
+
+// Rank rows by read-time weight, dropping ones already faded under pruneBelow
+// (dead advice — physically deleted on the next tend()). Weights are rounded
+// to 4dp so a seconds-old reinforcement still reads as its whole value.
+function rankLive(rows, limit) {
+  const nowMs = Date.now();
+  return rows
+    .map((r) => ({ ...r, weight: Math.round(effectiveWeight(r, nowMs) * 1e4) / 1e4 }))
+    .filter((r) => r.weight >= DEFAULTS.pruneBelow)
+    .sort((a, b) => b.weight - a.weight
+      || String(b.last_reinforced || "").localeCompare(String(a.last_reinforced || "")))
+    .slice(0, Math.max(0, limit));
+}
+
+// Directed upsert of a follows-edge src→dst. `bump` settles the decay accrued
+// since last_reinforced, adds to the effective weight (Hebbian) and restamps;
+// with no bump it just ensures the edge exists at `weight` (default 1).
 function addFollow(src, dst, opts = {}) {
   const db = openDb();
   if (!db || !src || !dst || src === dst) return false;
   const bump = Number.isFinite(opts.bump) ? opts.bump : 0;
   const weight = Number.isFinite(opts.weight) ? opts.weight : 1;
   try {
-    const existing = db.prepare("SELECT weight FROM tool_edges WHERE src=? AND dst=?").get(src, dst);
+    const existing = db.prepare("SELECT weight, last_reinforced FROM tool_edges WHERE src=? AND dst=?").get(src, dst);
     if (existing) {
-      const next = bump ? existing.weight + bump : Math.max(existing.weight, weight);
       if (bump) {
         db.prepare("UPDATE tool_edges SET weight=?, last_reinforced=? WHERE src=? AND dst=?")
-          .run(next, now(), src, dst);
+          .run(effectiveWeight(existing) + bump, now(), src, dst);
       } else {
-        db.prepare("UPDATE tool_edges SET weight=? WHERE src=? AND dst=?").run(next, src, dst);
+        const next = Math.max(existing.weight, weight);
+        if (next !== existing.weight) {
+          db.prepare("UPDATE tool_edges SET weight=? WHERE src=? AND dst=?").run(next, src, dst);
+        }
       }
     } else {
       // No structural floor for tools: a brand-new edge is worth exactly its
@@ -148,14 +194,14 @@ function allEdges() {
   catch (e) { return []; }
 }
 
-// Tools that tend to follow `name`, strongest first. This is the surfaced
-// signal: "you ran X — you usually run these next".
+// Tools that tend to follow `name`, strongest first (read-time weights). This
+// is the surfaced signal: "you ran X — you usually run these next".
 function followers(name, limit = 5) {
   const db = openDb();
   if (!db || !name) return [];
   try {
-    return db.prepare("SELECT dst AS name, weight FROM tool_edges WHERE src=? ORDER BY weight DESC LIMIT ?")
-      .all(name, limit);
+    const rows = db.prepare("SELECT dst AS name, weight, last_reinforced FROM tool_edges WHERE src=?").all(name);
+    return rankLive(rows, limit).map((r) => ({ name: r.name, weight: r.weight }));
   } catch (e) { return []; }
 }
 
@@ -164,8 +210,8 @@ function predecessors(name, limit = 5) {
   const db = openDb();
   if (!db || !name) return [];
   try {
-    return db.prepare("SELECT src AS name, weight FROM tool_edges WHERE dst=? ORDER BY weight DESC LIMIT ?")
-      .all(name, limit);
+    const rows = db.prepare("SELECT src AS name, weight, last_reinforced FROM tool_edges WHERE dst=?").all(name);
+    return rankLive(rows, limit).map((r) => ({ name: r.name, weight: r.weight }));
   } catch (e) { return []; }
 }
 
@@ -206,7 +252,13 @@ function parseToolRuns(command) {
   const out = [];
   const cmd = String(command || "");
   if (!/tool\s+(?:run|exec)\s+/i.test(cmd)) return out;
-  for (const seg of cmd.split(/&&|\|\||[;\n]/)) {
+  // B17: split on ALL shell composition operators — &&, ||, |, &, ;, newline.
+  // The single pipe was missed, so `tool run a … | tool run b …` parsed as one
+  // segment and only the first tool earned a follows-edge. Separators inside
+  // quoted spans are neutralized first so a pipe in an argument doesn't split
+  // (quoted content never reaches the shape anyway — shapeCommand masks it).
+  const masked = cmd.replace(/(["'])(?:\\.|(?!\1).)*\1/g, (q) => q.replace(/[;\n|&]/g, " "));
+  for (const seg of masked.split(/[;\n|&]+/)) {
     const m = seg.match(/\btool\s+(?:run|exec)\s+["']?([a-z0-9][\w.-]*)["']?\s*(.*)$/i);
     if (!m) continue;
     out.push({ name: m[1], shape: shapeCommand(`${m[1]} ${m[2] || ""}`) });
@@ -227,7 +279,8 @@ function recordPackTool(pack, tool, opts = {}) {
   try {
     const row = db.prepare("SELECT weight, intent, last_reinforced FROM pack_tool_edges WHERE pack=? AND tool=? AND command=?").get(pack, tool, command);
     if (row) {
-      const next = bump ? row.weight + bump : Math.max(row.weight, weight);
+      // Bump settles accrued decay first (same invariant as addFollow).
+      const next = bump ? effectiveWeight(row) + bump : Math.max(row.weight, weight);
       const intent = (opts.intent != null && opts.intent !== "") ? String(opts.intent).slice(0, 200) : row.intent;
       db.prepare("UPDATE pack_tool_edges SET weight=?, intent=?, last_reinforced=? WHERE pack=? AND tool=? AND command=?")
         .run(next, intent, bump ? now() : row.last_reinforced, pack, tool, command);
@@ -243,15 +296,16 @@ function recordPackTool(pack, tool, opts = {}) {
 }
 
 // Strongest contextual tool usages recorded under a pack, for surfacing in that
-// pack's injected context. Ordered by reinforced weight, newest first as a
+// pack's injected context. Ordered by read-time weight, newest first as a
 // tiebreak. One row per distinct command shape.
 function packTools(pack, limit = 2) {
   const db = openDb();
   if (!db || !pack) return [];
   try {
-    return db.prepare(
-      "SELECT tool, command, intent, weight FROM pack_tool_edges WHERE pack=? ORDER BY weight DESC, last_reinforced DESC LIMIT ?"
-    ).all(pack, limit);
+    const rows = db.prepare(
+      "SELECT tool, command, intent, weight, last_reinforced FROM pack_tool_edges WHERE pack=?"
+    ).all(pack);
+    return rankLive(rows, limit).map((r) => ({ tool: r.tool, command: r.command, intent: r.intent, weight: r.weight }));
   } catch (e) { return []; }
 }
 
@@ -260,9 +314,10 @@ function toolPacks(tool, limit = 5) {
   const db = openDb();
   if (!db || !tool) return [];
   try {
-    return db.prepare(
-      "SELECT pack, command, intent, weight FROM pack_tool_edges WHERE tool=? ORDER BY weight DESC, last_reinforced DESC LIMIT ?"
-    ).all(tool, limit);
+    const rows = db.prepare(
+      "SELECT pack, command, intent, weight, last_reinforced FROM pack_tool_edges WHERE tool=?"
+    ).all(tool);
+    return rankLive(rows, limit).map((r) => ({ pack: r.pack, command: r.command, intent: r.intent, weight: r.weight }));
   } catch (e) { return []; }
 }
 
@@ -280,53 +335,25 @@ function allPackToolEdges() {
   catch (e) { return []; }
 }
 
-// Exponential time decay. Tools have no structural floor, so edges decay toward
-// zero and are pruned once under `pruneBelow` — a chain that fell out of use
-// disappears instead of lingering as stale advice. Applies to both the tool→tool
-// follows-edges and the pack↔tool contextual edges (same physics).
-function decay({ halfLifeDays = DEFAULTS.halfLifeDays, pruneBelow = DEFAULTS.pruneBelow } = {}) {
+// Physically delete edges whose EFFECTIVE weight has faded under `pruneBelow` —
+// a chain that fell out of use disappears instead of lingering as stale advice.
+// Weights themselves are never rewritten (decay-on-read); this is pure garbage
+// collection. Applies to both the tool→tool follows-edges and the pack↔tool
+// contextual edges (same physics). Never-reinforced ensure-edges don't fade.
+function prune({ halfLifeDays = DEFAULTS.halfLifeDays, pruneBelow = DEFAULTS.pruneBelow } = {}) {
   const db = openDb();
-  if (!db) return { decayed: 0, pruned: 0 };
+  if (!db) return { pruned: 0 };
   const nowMs = Date.now();
-  const ln2 = Math.log(2);
-  let decayed = 0, pruned = 0;
-  const decayFactor = (lastReinforced) => {
-    if (!lastReinforced) return null;
-    const ageDays = (nowMs - Date.parse(lastReinforced)) / 86400000;
-    if (!(ageDays > 0)) return null;
-    return Math.exp(-ln2 * ageDays / Math.max(1, halfLifeDays));
-  };
+  let pruned = 0;
   for (const e of allEdges()) {
-    const factor = decayFactor(e.last_reinforced);
-    if (factor === null) continue;
-    const next = e.weight * factor;
-    if (next < pruneBelow) {
-      if (removeEdge(e.src, e.dst)) pruned++;
-      continue;
-    }
-    if (Math.abs(next - e.weight) > 1e-6) {
-      try {
-        db.prepare("UPDATE tool_edges SET weight=? WHERE src=? AND dst=?").run(next, e.src, e.dst);
-        decayed++;
-      } catch (e2) {}
-    }
+    if (!e.last_reinforced) continue;
+    if (effectiveWeight(e, nowMs, halfLifeDays) < pruneBelow && removeEdge(e.src, e.dst)) pruned++;
   }
   for (const e of allPackToolEdges()) {
-    const factor = decayFactor(e.last_reinforced);
-    if (factor === null) continue;
-    const next = e.weight * factor;
-    if (next < pruneBelow) {
-      if (removePackTool(e.pack, e.tool, e.command)) pruned++;
-      continue;
-    }
-    if (Math.abs(next - e.weight) > 1e-6) {
-      try {
-        db.prepare("UPDATE pack_tool_edges SET weight=? WHERE pack=? AND tool=? AND command=?").run(next, e.pack, e.tool, e.command);
-        decayed++;
-      } catch (e2) {}
-    }
+    if (!e.last_reinforced) continue;
+    if (effectiveWeight(e, nowMs, halfLifeDays) < pruneBelow && removePackTool(e.pack, e.tool, e.command)) pruned++;
   }
-  return { decayed, pruned };
+  return { pruned };
 }
 
 // Drop edges whose endpoints are no longer registered tools (a tool was removed
@@ -361,13 +388,14 @@ function pruneOrphans(toolsLib, packsLib) {
   return removed;
 }
 
-// Nightly maintenance (called by the dream): decay reinforced weights and drop
-// orphaned/faded edges. Deterministic + safe — no model needed. Pass
-// { packsLib } to also prune pack↔tool edges whose pack was removed.
+// Nightly maintenance (called by the dream): drop faded and orphaned edges.
+// No weight pass — decay is applied on read. Deterministic + safe — no model
+// needed. Pass { packsLib } to also prune pack↔tool edges whose pack was
+// removed.
 function tend(toolsLib, opts = {}) {
-  const { decayed, pruned } = decay(opts);
+  const { pruned } = prune(opts);
   const orphaned = toolsLib ? pruneOrphans(toolsLib, opts.packsLib) : 0;
-  return { decayed, pruned: pruned + orphaned, ...stats() };
+  return { pruned: pruned + orphaned, ...stats() };
 }
 
 function stats() {
@@ -384,7 +412,7 @@ module.exports = {
   DEFAULTS, GRAPH_DB,
   available, openDb,
   addFollow, reinforceSequence, removeEdge, allEdges,
-  followers, predecessors, decay, pruneOrphans, tend, stats,
+  followers, predecessors, effectiveWeight, prune, pruneOrphans, tend, stats,
   shapeCommand, parseToolRuns, recordPackTool, packTools, toolPacks,
   removePackTool, allPackToolEdges,
   _resetForTest,