@inetafrica/open-claudia 3.0.44 → 3.1.1

package/core/tools.js

@@ -30,6 +30,7 @@ const fs = require("fs");
 const path = require("path");
 const crypto = require("crypto");
 const CONFIG_DIR = require("../config-dir");
+const { atomicWriteFileSync } = require("./fsutil");
 
 const TOOLS_DIR = process.env.TOOLS_DIR ? path.resolve(process.env.TOOLS_DIR) : path.join(CONFIG_DIR, "tools");
 
@@ -90,7 +91,7 @@ function readUsage() {
 }
 
 function writeUsage(u) {
-  try { ensureDir(); fs.writeFileSync(USAGE_FILE, JSON.stringify(u), { mode: 0o600 }); }
+  try { ensureDir(); atomicWriteFileSync(USAGE_FILE, JSON.stringify(u), { mode: 0o600 }); }
   catch (e) { /* best-effort */ }
 }
 
@@ -106,7 +107,7 @@ function writeState(name, s) {
   const file = p.state || path.join(TOOLS_DIR, sanitizeName(name), "state.json");
   try {
     fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
-    fs.writeFileSync(file, JSON.stringify(s, null, 1), { mode: 0o600 });
+    atomicWriteFileSync(file, JSON.stringify(s, null, 1), { mode: 0o600 });
   } catch (e) { /* best-effort */ }
 }
 

package/core/turn-observer.js

@@ -13,6 +13,9 @@
 const { chatContext, currentAdapter } = require("./context");
 const { send } = require("./io");
 
+// Consecutive recall failures on one channel before the owner is alerted (B5).
+const RECALL_FAILURE_ALERT_AFTER = 3;
+
 function esc(s) {
   return String(s).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
@@ -71,8 +74,27 @@ function createTurnObserver({ state, store }) {
   // 🧠 /recall + 🔧 /tooltrace banners, fired once the prompt bundle (and its
   // recall metadata) exists — before the provider spawns, like v2.15.
   const onRecallSurfaced = (metadata) => {
-    if (guarded) return;
     const r = metadata;
+    // B5: recall fails OPEN (the turn proceeds without memory), so a persistent
+    // breakage is invisible unless someone counts. Track consecutive failures
+    // on channel state and tell the owner once per streak — a one-off transient
+    // stays quiet, an outage does not.
+    if (r && r.reason === "optional_recall_unavailable") {
+      state.recallFailureStreak = (state.recallFailureStreak || 0) + 1;
+      if (settings.showRecall) {
+        notify("banner:recall", "🧠 Recall FAILED this turn — I'm answering without pack/entity/tool memory. See bot log: [recall] builder failed.");
+      }
+      if (state.recallFailureStreak === RECALL_FAILURE_ALERT_AFTER) {
+        notify("alert:recall-failure", [
+          `⚠️ Memory recall has failed ${state.recallFailureStreak} turns in a row — I'm running without pack/entity/tool context.`,
+          r.detail ? `Last error: ${r.detail}` : null,
+          "Check the bot log for \"[recall] builder failed\". I'll stay quiet until it recovers or breaks again.",
+        ].filter(Boolean).join("\n"));
+      }
+    } else if (r && !r.omitted) {
+      state.recallFailureStreak = 0;
+    }
+    if (guarded) return;
     if (!r || r.omitted) return;
     const fmt = (arr, icon) => (arr || []).map((x) => (x.why ? `${icon} <b>${esc(x.name)}</b> — ${esc(x.why)}` : `${icon} <b>${esc(x.name)}</b>`));
     if (settings.showRecall) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "3.0.44",
+  "version": "3.1.1",
   "description": "An always-on, provider-agnostic coding-agent harness for Claude Code and OpenAI Codex via chat",
   "main": "bot.js",
   "bin": {
@@ -9,7 +9,7 @@
   "scripts": {
     "setup": "node setup.js",
     "start": "node bot.js",
-    "pretest": "node test-provider-fixture.js && node test-provider-core-prompt.js && node test-provider-prompt-parity.js && node test-provider-env-isolation.js && node test-provider-resume-parity.js && node test-provider-bootstrap.js && node test-provider-registry.js && node test-provider-stream-decoder.js && node test-provider-events.js && node test-provider-claude.js && node test-provider-codex.js && node test-provider-runner.js && node test-provider-refusal-recovery.js && node test-provider-run-lifecycle.js && node test-provider-gateway.js && node test-provider-side-chat.js && node test-single-runtime.js && node test-provider-migration-backup.js && node test-provider-state-migration.js && node test-provider-session-history.js && node test-provider-session-commands.js && node test-provider-compaction.js && node test-provider-scheduler.js && node test-credential-capture.js && node test-cursor-removal.js && node test-utility-provider-policy.js && node test-provider-subagent.js && node test-provider-recall.js && node test-provider-pack-review.js && node test-memory-mutation-queue.js && node test-provider-dream.js && node test-provider-enforcer.js && node test-provider-tool-hooks.js && node test-provider-boot-matrix.js && node test-provider-capabilities.js && node test-provider-language.js && node test-provider-coupling-audit.js && node test-provider-parity-e2e.js && node test-kazee-channel-health.js && node test-prompt-budget.js && node test-agency-ledger.js && node test-agency-deliberate.js && node test-guardrail.js && node test-spaces-comment-content.js",
+    "pretest": "node test-provider-fixture.js && node test-provider-core-prompt.js && node test-turn-observer.js && node test-provider-prompt-parity.js && node test-provider-env-isolation.js && node test-provider-resume-parity.js && node test-provider-bootstrap.js && node test-provider-registry.js && node test-provider-stream-decoder.js && node test-provider-events.js && node test-provider-claude.js && node test-provider-codex.js && node test-provider-runner.js && node test-provider-refusal-recovery.js && node test-provider-run-lifecycle.js && node test-provider-gateway.js && node test-provider-side-chat.js && node test-single-runtime.js && node test-provider-migration-backup.js && node test-provider-state-migration.js && node test-provider-session-history.js && node test-provider-session-commands.js && node test-provider-compaction.js && node test-provider-scheduler.js && node test-credential-capture.js && node test-cursor-removal.js && node test-utility-provider-policy.js && node test-provider-subagent.js && node test-provider-recall.js && node test-provider-pack-review.js && node test-memory-mutation-queue.js && node test-provider-dream.js && node test-provider-enforcer.js && node test-provider-tool-hooks.js && node test-provider-boot-matrix.js && node test-provider-capabilities.js && node test-provider-language.js && node test-provider-coupling-audit.js && node test-provider-parity-e2e.js && node test-kazee-channel-health.js && node test-prompt-budget.js && node test-agency-ledger.js && node test-agency-deliberate.js && node test-guardrail.js && node test-spaces-comment-content.js && node test-boot-health.js && node test-lexical-floor.js && node test-safe-mode.js && node test-logout.js",
     "test": "OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node -e \"require('./vault'); console.log('OK')\" && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-runner-watchdog-static.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-usage-accounting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-engine.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-discoverer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-walker-score.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-score-gate.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-cokept-warming.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-project-transcripts-smoke.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-abilities.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-extraction.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-couse.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-transfer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-tiers.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-merge-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-learning-e2e.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-pack-nesting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-pack-search.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-extractive-injection.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-journal-dedupe.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-read-signal.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tools.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tool-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tool-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tooling-mode.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tool-manifest.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-evolution.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-approval-async.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-unified-identity.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-queue-routing.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-persona-packs.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-speaker-persona.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-persona-pipeline.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-relationship-gate.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-relationship.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-enforcer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-identity-prune.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-kazee-message-id.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-delivery-contract.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-run-lock.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-web-sessions.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-telegram-poll-recovery.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-telegram-409-grace.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-telegram-conflict-heal-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-single-instance.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-streaming-split.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-spaces-autoenable.js"
   },
   "files": [
@@ -132,7 +132,7 @@
   "license": "MIT",
   "type": "commonjs",
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=24.0.0"
   },
   "dependencies": {
     "node-cron": "^4.2.1",

package/test-extractive-injection.js

@@ -67,4 +67,25 @@ assert.ok(/#### Stance/.test(outHeadline), "headline still shows Stance");
 assert.ok(!outHeadline.includes("The ArgoCD sync for payments"), "headline does NOT inline State (unchanged legacy behavior)");
 assert.ok(/not shown/.test(outHeadline), "headline still points to hidden sections");
 
+// ── LOCKED hoist: a Stance line carrying LOCKED (uppercase) is pulled under
+//    a binding-constraints header in every mode; prose "locked" stays put ──
+const lockedPack = {
+  ...pack,
+  dir: "coders-africa",
+  sections: {
+    ...pack.sections,
+    Stance: "Audience-first design.\nLOCKED: heading font is Marcellus, body font is Nunito.\nThe staging door is locked after 18:00.",
+  },
+};
+const outLockedX = formatPackForContext(lockedPack, packsLib, { extractive: true, matchedLines: [] });
+assert.ok(/BINDING CONSTRAINTS \(LOCKED/.test(outLockedX), "extractive mode hoists LOCKED lines under the binding header");
+assert.ok(/- LOCKED: heading font is Marcellus, body font is Nunito\./.test(outLockedX), "the LOCKED line is bulleted verbatim");
+const bindingIdx = outLockedX.indexOf("BINDING CONSTRAINTS");
+assert.ok(bindingIdx !== -1 && bindingIdx < outLockedX.indexOf("Audience-first design."), "binding block leads the Stance section");
+assert.ok(outLockedX.includes("The staging door is locked after 18:00."), "lowercase 'locked' prose is not hoisted");
+assert.strictEqual((outLockedX.match(/heading font is Marcellus/g) || []).length, 1, "hoisted line is moved, not duplicated");
+assert.ok(/BINDING CONSTRAINTS \(LOCKED/.test(formatPackForContext(lockedPack, packsLib, { headline: true })), "headline mode hoists too");
+assert.ok(/BINDING CONSTRAINTS \(LOCKED/.test(formatPackForContext(lockedPack, packsLib, {})), "full mode hoists too");
+assert.ok(!/BINDING CONSTRAINTS/.test(out), "packs without LOCKED lines are untouched");
+
 console.log("extractive injection OK");

package/test-memory-mutation-queue.js

@@ -15,6 +15,7 @@ fs.mkdirSync(process.env.OPEN_CLAUDIA_CONFIG_DIR, { recursive: true });
 const {
   MemoryMutationQueue,
   MutationQueueError,
+  inspectLock,
 } = require("./core/memory-mutation-queue");
 const { atomicWriteFileSync } = require("./core/fsutil");
 
@@ -62,14 +63,12 @@ async function main() {
     journalFile,
     maxPending: 2,
     lockPollMs: 5,
-    staleLockMs: 10,
   });
   const liveContender = new MemoryMutationQueue({
     lockDir: liveLockDir,
     journalFile,
     maxPending: 2,
     lockPollMs: 5,
-    staleLockMs: 10,
     lockTimeoutMs: 50,
   });
   const liveMutation = liveOwner.enqueue("long-dream", async () => liveGate.promise);
@@ -92,11 +91,42 @@ async function main() {
     lockDir: deadLockDir,
     journalFile,
     lockPollMs: 5,
-    staleLockMs: 10,
     lockTimeoutMs: 200,
   });
   assert.strictEqual(await deadRecovery.enqueue("recover-dead-lock", async () => "recovered"), "recovered");
 
+  // Container pid-1 reuse: a lock left by a CRASHED incarnation of this same
+  // pid (different bootId) must be broken immediately — pid-liveness alone
+  // reads it as held forever, which starved reviewers on restarting pods.
+  const rebootLockDir = path.join(root, "reboot-stale.lock");
+  fs.mkdirSync(rebootLockDir);
+  fs.writeFileSync(path.join(rebootLockDir, "owner.json"),
+    JSON.stringify({ token: "prev", pid: process.pid, bootId: "previous-incarnation" }));
+  const rebootRecovery = new MemoryMutationQueue({
+    lockDir: rebootLockDir,
+    journalFile,
+    lockPollMs: 5,
+    lockTimeoutMs: 200,
+  });
+  assert.strictEqual(await rebootRecovery.enqueue("recover-reboot-lock", async () => "recovered"), "recovered",
+    "a lock from a previous incarnation sharing our pid is broken immediately");
+  assert.strictEqual(
+    inspectLock(rebootLockDir).held, false,
+    "inspectLock reports a released lock as not held");
+
+  // Orphan: mkdir succeeded but owner.json never landed (crash mid-acquire).
+  const orphanLockDir = path.join(root, "orphan.lock");
+  fs.mkdirSync(orphanLockDir);
+  fs.utimesSync(orphanLockDir, old, old);
+  assert.strictEqual(inspectLock(orphanLockDir).stale, true, "an aged ownerless lock dir reads as stale");
+  const orphanRecovery = new MemoryMutationQueue({
+    lockDir: orphanLockDir,
+    journalFile,
+    lockPollMs: 5,
+    lockTimeoutMs: 200,
+  });
+  assert.strictEqual(await orphanRecovery.enqueue("recover-orphan-lock", async () => "recovered"), "recovered");
+
   const failureQueue = new MemoryMutationQueue({
     lockDir: path.join(root, "failure.lock"),
     journalFile,

package/test-provider-compaction.js

@@ -122,6 +122,11 @@ async function immutableSuccessProbe() {
   assert.strictEqual(contexts[1].permissionMode, "plan");
   assert.strictEqual(contexts[1].maxTurns, 1);
   assert.strictEqual(contexts[1].timeoutMs, contexts[0].timeoutMs);
+  assert.strictEqual(contexts[0].purpose, "compact-summary");
+  assert.strictEqual(contexts[0].recallQuery, null, "summary stage carries no recall query");
+  assert.strictEqual(contexts[1].purpose, "compact-seed");
+  assert.ok(String(contexts[1].recallQuery || "").includes("A sufficiently detailed condensed continuation"),
+    "seed recall query carries the condensed brief, not seed-prompt boilerplate");
   const restrictedEnv = runner.decorateForegroundInvocation(
     { env: { FIXTURE_SAFE: "1" } },
     contexts[0],

package/test-provider-core-prompt.js

@@ -164,6 +164,9 @@ async function probe() {
     assert.strictEqual(omitted.userPrompt, "RECALL FAILURE USER SENTINEL");
     assert.strictEqual(omitted.recallMetadata.status, "omitted");
     assert.strictEqual(omitted.recallMetadata.omitted, true);
+    assert.strictEqual(omitted.recallMetadata.reason, "optional_recall_unavailable");
+    assert.strictEqual(omitted.recallMetadata.detail, "fixture optional recall failure",
+      "the swallowed recall error surfaces in metadata for the owner alert");
     assert.ok(omitted.coreInstructions.includes("## Delivery"));
     assert.ok(omitted.dynamicContext.includes("## Runtime state"));
 

package/test-provider-language.js

@@ -99,7 +99,65 @@ assert.match(pkg.description, /provider-agnostic coding-agent harness/i);
 // ids all forced fresh) and the refused prompt is auto-retried exactly ONCE in
 // a fresh session behind a ♻️ notice. A refusal on already-fresh context gets
 // no retry (the new message itself is the problem); capture runs never retry.
-assert.strictEqual(pkg.version, "3.0.44", "release version must remain unchanged without explicit approval");
+// 3.0.45 approved by Sumeet 2026-07-20 ("Ok so you ready to implement?"): first
+// fix batch from the 2026-07-20 blind code review. Recall-graph decay moves to
+// decay-on-read (the nightly rewrite compounded — a 60d half-life emptied in
+// ~10 nights; one-time user_version 0→1 restamp, dream-tunable half-life);
+// keyring/tool-state/tuning writes become crash-safe (atomic temp+fsync+rename,
+// keyring .bak snapshot with read-through repair); recall failures alert after
+// 3 consecutive memoryless turns instead of degrading silently; the recall
+// pre-gate strips pleasantry prefixes so "ok deploy … now" recalls; tool-run
+// creds are preflighted BEFORE an approval token is consumed (a missing key no
+// longer burns the human's Approve); tool-graph parsing splits on | and &;
+// raw NUL bytes in discoverer.js/state.js become \u0000 escapes; README
+// corrected — discoverer is the shipped default engine, classic the opt-out.
+// 3.0.45 second wave folded in per Sumeet 2026-07-20 ("i think just wok
+// through all these features and fold them into .45?"): the memory-substrate
+// revival. Root cause: pods on node:20 have no node:sqlite, so pack FTS, the
+// recall graph and episodes silently never initialized — rahilcoder ran 16
+// days with seedsTotal=0 while repeating corrected branding mistakes, and its
+// reviewer starved 87% of runs on a stale mutation lock (container pid-1
+// reuse made a crashed incarnation's lock look alive forever). Ships:
+// Dockerfile.base FROM node:24-slim (+ CI build image node:24); a /doctor
+// memory-health section (substrate hard-fail, graph stats, 24h recall
+// pipeline, reviewer health, mutation lock, deferred reviews, corpus caps,
+// disk) with a deduped boot-time substrate alert and a post-upgrade doctor
+// gate on all three /upgrade paths; a pure-JS lexical seed floor under
+// matchPacks/matchEntities (recall degrades to keyword matching, never to
+// OFF — parity-tested with and without the sim-no-sqlite shim); the
+// mutation-queue lock gains a boot id + ownerless-lock grace so pid-1 reuse
+// can't wedge it, plus a reviewer retry+defer seatbelt; LOCKED Stance lines
+// hoist under a BINDING CONSTRAINTS header and the reviewer must carry them
+// verbatim and journal violations; compaction recall is fixed (summary
+// meta-turn skips recall; the fresh seed matches on condensed brief + open
+// task titles, not prompt boilerplate).
+// 3.1.0 approved by Sumeet 2026-07-20 ("yes that's fine but if in hard boot
+// loop it shoyuld give the user a way to get back online and diagnose or fall
+// back into a safe mode or something to have it fixed or set up or downgrade,
+// actually i think that's improtant as well to have a downgrade, i think add
+// this all in and let's bump the minor to 3.1.0"): the substrate-revival
+// fold graduates to a minor because boot semantics change. node:sqlite is now
+// REQUIRED — a missing substrate boots into SAFE MODE (adapters + diagnostic
+// slash commands only; no agent turns, crons, or memory writes) instead of
+// silently degrading; MEMORY_ALLOW_DEGRADED=1 or a one-shot /safemode
+// continue is the explicit keyword-only escape hatch. A boot crash loop (3
+// consecutive boots dying before 5min stable uptime) also lands in safe mode
+// so the operator keeps a live chat to rescue from instead of a dead pod.
+// New /downgrade rolls back to the previously-running version from boot
+// history (strict semver-validated target); /upgrade//downgrade clear the
+// crash counter as deliberate fix attempts. package.json engines >=24.
+// 3.1.1 approved by Sumeet 2026-07-20: he reported the re-auth trap ("wjen i
+// want to reauth a new account for say claude or gpt and i do /login and
+// select it but i am still logged in it just shows me the same model instead
+// of a reatuh and there is no logut option?") and green-lit the proposed fix
+// (deferred once behind the smart-brenda slash-menu check, then resumed).
+// Ships: /logout [claude|codex] full sign-out — CLI credential store AND the
+// bot-held Claude token in one step (partial clears were the trap: any
+// surviving source keeps authStatus "authenticated" so the /login picker
+// never re-offers a sign-in); a 🔁 Switch account button on connected
+// providers in /login behind an explicit confirm that names the signed-in
+// account where the CLI exposes it, then chains logout → fresh login.
+assert.strictEqual(pkg.version, "3.1.1", "release version must remain unchanged without explicit approval");
 for (const keyword of ["claude", "codex", "coding-agent", "provider-agnostic"]) {
   assert.ok(pkg.keywords.includes(keyword), `package keyword missing: ${keyword}`);
 }

package/test-provider-recall.js

@@ -253,6 +253,39 @@ async function main() {
   recall.getEngine = originalGetEngine;
   assert.strictEqual(admittedProvider, "codex");
 
+  // ── compaction recall policy: the summary meta-turn skips recall entirely;
+  //    the seed turn matches on the runner-supplied recallQuery (condensed
+  //    brief + task titles), never the seed prompt's boilerplate ──
+  const summarySkip = await systemPrompt.buildOptionalRecallContext(
+    "Summarize this conversation for a fresh compacted continuation.",
+    {
+      state: mutableState,
+      runContext: { provider: "claude", purpose: "compact-summary", project: { name: "project-a", dir: root }, sessionId: null, runId: "compact-sum" },
+    },
+  );
+  assert.strictEqual(summarySkip.metadata.status, "omitted", "summary turn skips recall");
+  assert.strictEqual(summarySkip.metadata.reason, "compaction_meta_turn");
+  assert.strictEqual(summarySkip.dynamicContext, "");
+
+  let seedQueryText = null;
+  recall.getEngine = () => ({
+    name: "fixture",
+    async run(ctx) {
+      seedQueryText = ctx.userText;
+      return { packBlock: "", entityBlock: "", toolBlock: "", episodeBlock: "", packMatches: [], entityMatches: [] };
+    },
+  });
+  await systemPrompt.buildOptionalRecallContext(
+    "This is a compacted continuation of a previous Open Claudia session. Treat the following summary as the prior conversation context.",
+    {
+      state: mutableState,
+      runContext: { provider: "claude", purpose: "compact-seed", recallQuery: "coders africa branding fonts\nFinalize v3.0.45", project: { name: "project-a", dir: root }, sessionId: null, runId: "compact-seed" },
+    },
+  );
+  recall.getEngine = originalGetEngine;
+  assert.strictEqual(seedQueryText, "coders africa branding fonts\nFinalize v3.0.45",
+    "seed recall matches on recallQuery, not the seed prompt");
+
   for (const file of ["core/recall-filter.js", "core/recall/discoverer.js", "core/recall/warm-walker.js"]) {
     const source = fs.readFileSync(path.join(__dirname, file), "utf8");
     assert.ok(!source.includes("spawnSubagent"), `${file} no longer uses the compatibility sub-agent path`);

package/test-recall-discoverer.js

@@ -53,6 +53,14 @@ assert.strictEqual(disc.recallTier("restart bot", 3), "seeds", "short command
 assert.strictEqual(disc.recallTier("show fup logs", 2), "seeds", "≤4 words → seeds-only tier");
 assert.strictEqual(disc.recallTier("yes we need to see the 100", 2), "full", "substantive yes-prefixed turn → full");
 assert.strictEqual(disc.recallTier("how do I deploy the mobile app", 4), "full", "substantive → full");
+// B2: a pleasantry prefix is stripped BEFORE tiering, so a short real request
+// wearing an ack is no longer swallowed by the ≤4-word pleasantry skip.
+assert.strictEqual(disc.recallTier("ok deploy kazee now", 3), "seeds", "ack-prefixed 4-word command → seeds, not skip");
+assert.strictEqual(disc.recallTier("yes deploy it", 4), "seeds", "approval + command → seeds, not skip");
+assert.strictEqual(disc.recallTier("thanks! restart euvy bot", 3), "seeds", "thanks-prefixed command → seeds, not skip");
+assert.strictEqual(disc.needsRecall("ok deploy kazee now", 0), true, "prefixed command needs recall");
+assert.strictEqual(disc.recallTier("ok thanks sounds good perfect", 5), "skip", "stacked pure pleasantries skip at any length");
+assert.strictEqual(disc.recallTier("morning check the kazee deploys", 2), "seeds", "greeting stripped → remainder tiers as a short command");
 
 // --- shared stub corpus + helpers ---
 const packs = {

package/test-recall-graph.js

@@ -7,6 +7,9 @@ const path = require("path");
 
 const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "recall-graph-"));
 process.env.RECALL_GRAPH_DB = path.join(tmp, "graph.db");
+// Pin the read-time decay half-life so assertions are deterministic (env pin
+// beats any tuning file the dream may have written).
+process.env.RECALL_DECAY_HALF_LIFE_DAYS = "30";
 
 const graph = require("./core/recall/graph");
 
@@ -51,18 +54,33 @@ for (const [, v] of act) assert.ok(v.activation > 0 && v.hop >= 1, "activation h
 // seeds with no edges produce nothing
 assert.strictEqual(graph.expand([{ id: "pack:orphanseed", score: 5 }]).size, 0);
 
-// --- decay (never below structural floor) ---
-graph.addEdge("pack:d", "pack:e", "parent"); // base weight 3, no last_reinforced → untouched
-graph.reinforce("pack:d", "pack:f", 10);
-// backdate the reinforced edge well past the half-life
+// --- decay-on-read (never below structural floor; reads never rewrite storage) ---
+graph.addEdge("pack:d", "pack:e", "parent"); // base weight 3, no last_reinforced → never decays
+graph.reinforce("pack:d", "pack:f", 10);     // stored 11, stamped now
 const db = graph.openDb();
-const old = new Date(Date.now() - 400 * 86400000).toISOString();
-db.prepare("UPDATE edges SET last_reinforced=? WHERE src=? AND dst=?").run(old, "pack:d", "pack:f");
-graph.decay({ halfLifeDays: 30 });
-const df = graph.allEdges().find((e) => e.src === "pack:d" && e.dst === "pack:f");
-assert.ok(df.weight < 11 && df.weight >= 1, "reinforced edge decayed toward floor");
-const de = graph.allEdges().find((e) => e.src === "pack:d" && e.dst === "pack:e");
-assert.strictEqual(de.weight, 3, "structural edge with no reinforcement untouched by decay");
+const oneHL = new Date(Date.now() - 30 * 86400000).toISOString(); // exactly one pinned half-life
+db.prepare("UPDATE edges SET last_reinforced=? WHERE src=? AND dst=?").run(oneHL, "pack:d", "pack:f");
+const dfEff = graph.neighbors("pack:d").find((n) => n.node === "pack:f").weight;
+assert.ok(dfEff > 5.3 && dfEff < 5.7, `one half-life on read ≈ 5.5 (${dfEff})`);
+const deEff = graph.neighbors("pack:d").find((n) => n.node === "pack:e").weight;
+assert.strictEqual(deEff, 3, "structural edge with no reinforcement never decays");
+// far past the half-life the effective weight clamps at the type's base
+const longAgo = new Date(Date.now() - 400 * 86400000).toISOString();
+db.prepare("UPDATE edges SET last_reinforced=? WHERE src=? AND dst=?").run(longAgo, "pack:d", "pack:f");
+const floored = graph.neighbors("pack:d").find((n) => n.node === "pack:f").weight;
+assert.strictEqual(floored, 1, "effective weight clamps at the related floor");
+// storage untouched by all those reads
+assert.strictEqual(graph.allEdges().find((e) => e.src === "pack:d" && e.dst === "pack:f").weight, 11,
+  "reads never rewrite the stored weight");
+
+// REGRESSION (P1 compounding decay): the nightly weight-rewrite path is gone.
+assert.strictEqual(graph.decay, undefined, "decay() rewrite removed — decay is read-time only");
+
+// reinforcement settles accrued decay, THEN bumps — never bumps the stale stored value
+db.prepare("UPDATE edges SET last_reinforced=? WHERE src=? AND dst=?").run(oneHL, "pack:d", "pack:f");
+graph.reinforce("pack:d", "pack:f", 1); // effective ≈ 5.5 + 1
+const settledDF = graph.allEdges().find((e) => e.src === "pack:d" && e.dst === "pack:f").weight;
+assert.ok(settledDF > 6.3 && settledDF < 6.7, `settle-then-bump ≈ 6.5, not 12 (${settledDF})`);
 
 // --- structural sync from a stubbed corpus ---
 const packsStub = {
@@ -88,7 +106,44 @@ const pruned = graph.pruneOrphans(packsStub, entStub);
 assert.ok(pruned >= 1, "orphan edge pruned");
 assert.ok(!graph.allEdges().some((e) => e.src === "pack:ghost"), "ghost edge gone");
 
+// --- REGRESSION (P1): repeated nightly tend() must leave stored weights
+// bit-identical — the old decay() rewrite shrank them again every night
+// (compounding: full age reapplied to an already-decayed weight). ---
+graph.reinforce("pack:kazee-mobile", "pack:kazee", 9); // stored 10, stamped now
+db.prepare("UPDATE edges SET last_reinforced=? WHERE src=? AND dst=? AND type='related'")
+  .run(oneHL, "pack:kazee-mobile", "pack:kazee");
+const kmStored = () => graph.allEdges()
+  .find((e) => e.src === "pack:kazee-mobile" && e.dst === "pack:kazee" && e.type === "related").weight;
+const before3 = kmStored();
+for (let i = 0; i < 3; i++) graph.tend(packsStub, entStub);
+assert.strictEqual(kmStored(), before3, "three nightly tends never rewrite a reinforced weight");
+const kmEff = graph.neighbors("pack:kazee-mobile")
+  .find((n) => n.node === "pack:kazee" && n.type === "related").weight;
+assert.ok(kmEff > 4.7 && kmEff < 5.3, `effective after 3 tends is still one half-life ≈ 5 (${kmEff})`);
+
 // parseLinks
 assert.deepStrictEqual(graph.parseLinks("see [[Foo-Bar]] and [[baz]]"), ["foo-bar", "baz"]);
 
+// --- v1 migration: a legacy DB (pre decay-on-read) gets its clock restarted on
+// first open — stored weights are treated as current, nothing else changes. ---
+graph._resetForTest();
+process.env.RECALL_GRAPH_DB = path.join(tmp, "legacy.db");
+{
+  const { DatabaseSync } = require("node:sqlite");
+  const raw = new DatabaseSync(process.env.RECALL_GRAPH_DB);
+  raw.exec(`CREATE TABLE edges (src TEXT NOT NULL, dst TEXT NOT NULL, type TEXT NOT NULL,
+    weight REAL NOT NULL DEFAULT 1, last_reinforced TEXT, created TEXT, PRIMARY KEY (src, dst, type))`);
+  raw.prepare("INSERT INTO edges (src, dst, type, weight, last_reinforced, created) VALUES (?,?,?,?,?,?)")
+    .run("pack:l1", "pack:l2", "related", 4, new Date(Date.now() - 200 * 86400000).toISOString(), new Date().toISOString());
+  raw.close();
+}
+delete require.cache[require.resolve("./core/recall/graph")];
+const graph2 = require("./core/recall/graph");
+const legacy = graph2.allEdges().find((e) => e.src === "pack:l1");
+assert.ok(Date.parse(legacy.last_reinforced) > Date.now() - 60000, "migration restamps legacy reinforced rows");
+assert.strictEqual(legacy.weight, 4, "migration leaves the stored weight untouched");
+const legacyEff = graph2.neighbors("pack:l1").find((n) => n.node === "pack:l2").weight;
+assert.ok(legacyEff > 3.9, `restamped legacy row reads at ~full stored weight (${legacyEff})`);
+graph2._resetForTest();
+
 console.log("recall graph OK");

package/test-tool-graph.js

@@ -53,25 +53,35 @@ graph.addFollow("ensure-src", "ensure-dst"); // weight 1, last_reinforced=null
 const ensured = graph.followers("ensure-src");
 assert.strictEqual(ensured[0].weight, 1, "ensure edge weighs 1");
 
-// ── decay: backdate a reinforced edge far into the past, then it prunes (no floor) ──
+// ── read-time decay + prune: backdate a reinforced edge far into the past —
+// reads hide it immediately, prune() physically deletes it (no floor) ──
 const db = graph.openDb();
 const longAgo = new Date(Date.now() - 365 * 86400000).toISOString();
 db.prepare("UPDATE tool_edges SET last_reinforced=? WHERE src=? AND dst=?").run(longAgo, "auth", "list");
-let res = graph.decay({ halfLifeDays: 1, pruneBelow: 0.15 });
+assert.ok(!graph.followers("auth").some((r) => r.name === "list"), "faded edge invisible to reads before any prune");
+let res = graph.prune({ halfLifeDays: 1, pruneBelow: 0.15 });
 assert.ok(res.pruned >= 1, "a year-old edge under the floor is pruned");
-assert.ok(!graph.followers("auth").some((r) => r.name === "list"), "pruned edge is gone");
+assert.ok(!graph.allEdges().some((e) => e.src === "auth" && e.dst === "list"), "pruned edge physically gone");
 
-// the ensure edge (last_reinforced=null) was skipped by decay, not pruned
-assert.ok(graph.followers("ensure-src").some((r) => r.name === "ensure-dst"), "un-reinforced edge survives decay");
+// the ensure edge (last_reinforced=null) neither fades on read nor prunes
+assert.ok(graph.followers("ensure-src").some((r) => r.name === "ensure-dst"), "un-reinforced edge survives prune");
 
-// ── decay that reduces but keeps an edge above the floor ──
+// ── read-time decay that reduces but keeps an edge; storage never rewritten ──
 graph.addFollow("warm-a", "warm-b", { bump: 10 });
-const recent = new Date(Date.now() - 30 * 86400000).toISOString();
-db.prepare("UPDATE tool_edges SET last_reinforced=? WHERE src=? AND dst=?").run(recent, "warm-a", "warm-b");
-graph.decay({ halfLifeDays: 30, pruneBelow: 0.15 }); // one half-life → ~5
+const oneHL = new Date(Date.now() - 45 * 86400000).toISOString(); // one default half-life
+db.prepare("UPDATE tool_edges SET last_reinforced=? WHERE src=? AND dst=?").run(oneHL, "warm-a", "warm-b");
 const warm = graph.followers("warm-a")[0];
 assert.ok(warm && warm.name === "warm-b", "warm edge survives a single half-life");
-assert.ok(warm.weight < 10 && warm.weight > 0.15, `warm edge decayed but kept (${warm.weight})`);
+assert.ok(warm.weight > 4.7 && warm.weight < 5.3, `read-time weight ≈ half of stored (${warm.weight})`);
+assert.strictEqual(graph.allEdges().find((e) => e.src === "warm-a").weight, 10, "reads never rewrite the stored weight");
+
+// ── settle-then-bump: reinforcing a decayed edge bumps its EFFECTIVE weight ──
+graph.addFollow("warm-a", "warm-b", { bump: 1 }); // ≈ 5 + 1
+const settled = graph.allEdges().find((e) => e.src === "warm-a" && e.dst === "warm-b").weight;
+assert.ok(settled > 5.7 && settled < 6.3, `settle-then-bump ≈ 6, not 11 (${settled})`);
+
+// REGRESSION (P1 compounding decay): the nightly weight-rewrite path is gone.
+assert.strictEqual(graph.decay, undefined, "decay() rewrite removed — prune() only deletes");
 
 // ── removeEdge ──
 assert.strictEqual(graph.removeEdge("warm-a", "warm-b"), true, "removeEdge succeeds");
@@ -84,10 +94,11 @@ const removed = graph.pruneOrphans(fakeLib);
 assert.ok(removed >= 1, "edge pointing at an unregistered tool ('dead') is pruned");
 assert.ok(!graph.followers("live").length, "live→dead removed because dead is not a live tool");
 
-// ── tend() is the nightly entry: decays + prunes orphans + returns stats ──
+// ── tend() is the nightly entry: prunes faded + orphaned edges, returns stats ──
 const t = graph.tend(fakeLib);
 assert.ok(typeof t.edges === "number" && typeof t.nodes === "number", "tend returns stats");
-assert.ok(typeof t.pruned === "number" && typeof t.decayed === "number", "tend returns decay/prune counts");
+assert.ok(typeof t.pruned === "number", "tend returns prune count");
+assert.strictEqual(t.decayed, undefined, "tend has no decay pass (decay is read-time)");
 
 // ── stats / allEdges sanity ──
 const s = graph.stats();
@@ -111,6 +122,16 @@ assert.strictEqual(runs[0].name, "spaces", "first run is spaces");
 assert.strictEqual(runs[0].shape, "spaces docs --task-id <id> <path>", "first run shaped");
 assert.strictEqual(runs[1].name, "other", "second run is other (args did not bleed across &&)");
 assert.strictEqual(graph.parseToolRuns("ls -la").length, 0, "non-tool command yields no runs");
+// B17: every shell composition operator splits — the single pipe was missed,
+// so piped compositions taught no follows-edge.
+const piped = graph.parseToolRuns("open-claudia tool run kticket list | open-claudia tool run report weekly");
+assert.deepStrictEqual(piped.map((r) => r.name), ["kticket", "report"], "single-pipe composition parses both runs");
+assert.strictEqual(piped[0].shape, "kticket list", "piped first run's args don't bleed into the second");
+const bg = graph.parseToolRuns("open-claudia tool run a1 go & open-claudia tool run b2 go");
+assert.deepStrictEqual(bg.map((r) => r.name), ["a1", "b2"], "background & splits too");
+const quotedPipe = graph.parseToolRuns('open-claudia tool run kchat send "a | b" && open-claudia tool run other list');
+assert.deepStrictEqual(quotedPipe.map((r) => r.name), ["kchat", "other"], "a pipe inside a quoted argument does not split");
+assert.strictEqual(quotedPipe[0].shape, "kchat send <text>", "quoted argument still masks to <text>");
 
 // ── recordPackTool: insert, then bump accumulates; packTools surfaces strongest ──
 graph.recordPackTool("san-marco-agreements", "spaces", { command: "spaces docs --task-id <id> <path>", bump: 1 });
@@ -132,13 +153,15 @@ assert.ok(graph.toolPacks("spaces").some((u) => u.pack === "san-marco-agreements
 assert.strictEqual(graph.stats().packToolEdges, graph.allPackToolEdges().length, "stats packToolEdges matches allPackToolEdges");
 assert.ok(graph.stats().packToolEdges >= 2, "at least two pack↔tool edges present");
 
-// ── decay: a year-old pack↔tool edge under the floor is pruned ──
+// ── prune: a year-old pack↔tool edge fades on read and is physically deleted ──
 const ptDb = graph.openDb();
 ptDb.prepare("UPDATE pack_tool_edges SET last_reinforced=? WHERE pack=? AND tool=?")
   .run(new Date(Date.now() - 365 * 86400000).toISOString(), "san-marco-agreements", "spaces");
-const decayRes = graph.decay({ halfLifeDays: 1, pruneBelow: 0.15 });
-assert.ok(decayRes.pruned >= 1, "stale pack↔tool edge pruned by decay");
-assert.strictEqual(graph.packTools("san-marco-agreements").length, 0, "pruned pack↔tool edges gone");
+assert.strictEqual(graph.packTools("san-marco-agreements").length, 0, "faded pack↔tool edges invisible to reads");
+const pruneRes = graph.prune({ halfLifeDays: 1, pruneBelow: 0.15 });
+assert.ok(pruneRes.pruned >= 1, "stale pack↔tool edge pruned");
+assert.strictEqual(graph.allPackToolEdges().filter((e) => e.pack === "san-marco-agreements").length, 0,
+  "pruned pack↔tool rows physically gone");
 
 // ── pruneOrphans: drops edges for a removed tool and (with packsLib) a removed pack ──
 graph.recordPackTool("live-pack", "live-tool", { command: "live-tool go", bump: 1 });
@@ -152,5 +175,33 @@ assert.ok(graph.packTools("live-pack").some((u) => u.tool === "live-tool"), "liv
 assert.ok(!graph.packTools("live-pack").some((u) => u.tool === "ghost-tool"), "missing-tool edge gone");
 assert.strictEqual(graph.packTools("ghost-pack").length, 0, "missing-pack edge gone");
 
+// ── v1 migration: legacy DBs (pre decay-on-read) get their clocks restarted on
+// first open — stored weights are treated as current in both tables ──
 graph._resetForTest();
+process.env.TOOL_GRAPH_DB = path.join(tmp, "legacy.db");
+{
+  const { DatabaseSync } = require("node:sqlite");
+  const raw = new DatabaseSync(process.env.TOOL_GRAPH_DB);
+  const old = new Date(Date.now() - 200 * 86400000).toISOString();
+  raw.exec(`CREATE TABLE tool_edges (src TEXT NOT NULL, dst TEXT NOT NULL,
+    weight REAL NOT NULL DEFAULT 1, last_reinforced TEXT, created TEXT, PRIMARY KEY (src, dst))`);
+  raw.exec(`CREATE TABLE pack_tool_edges (pack TEXT NOT NULL, tool TEXT NOT NULL,
+    command TEXT NOT NULL DEFAULT '', intent TEXT NOT NULL DEFAULT '',
+    weight REAL NOT NULL DEFAULT 1, last_reinforced TEXT, created TEXT, PRIMARY KEY (pack, tool, command))`);
+  raw.prepare("INSERT INTO tool_edges (src, dst, weight, last_reinforced, created) VALUES (?,?,?,?,?)")
+    .run("l-a", "l-b", 3, old, old);
+  raw.prepare("INSERT INTO pack_tool_edges (pack, tool, command, weight, last_reinforced, created) VALUES (?,?,?,?,?,?)")
+    .run("l-pack", "l-tool", "l-tool go", 2, old, old);
+  raw.close();
+}
+delete require.cache[require.resolve("./core/tool-graph")];
+const graph2 = require("./core/tool-graph");
+const lEdge = graph2.allEdges().find((e) => e.src === "l-a");
+const lPt = graph2.allPackToolEdges().find((e) => e.pack === "l-pack");
+assert.ok(Date.parse(lEdge.last_reinforced) > Date.now() - 60000, "migration restamps legacy tool edges");
+assert.ok(Date.parse(lPt.last_reinforced) > Date.now() - 60000, "migration restamps legacy pack↔tool edges");
+assert.strictEqual(lEdge.weight, 3, "stored weight untouched by migration");
+assert.strictEqual(graph2.followers("l-a")[0].weight, 3, "restamped edge reads at full stored weight");
+graph2._resetForTest();
+
 console.log("tool-graph OK");