claude-mem-lite 3.57.0 → 3.58.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "3.57.0",
+      "version": "3.58.0",
       "source": "./",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."
     }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.57.0",
+  "version": "3.58.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/adopt-cli.mjs

@@ -22,6 +22,7 @@ import {
 } from './memdir.mjs';
 import {
   writeManaged, removeManaged, isAdopted as claudeMdIsAdopted,
+  hasResidue as claudeMdHasResidue,
   needsRefresh, migrateLegacyMemoryDir, hasLegacyMemdirSentinel,
   claudeMdPath, detailDocPath,
 } from './claudemd.mjs';
@@ -311,8 +312,8 @@ function statusAll() {
 
   const known = listKnownProjectDirs();
   let adoptedCount = 0;
-  for (const dir of known) if (claudeMdIsAdopted(dir, PLUGIN_SLUG)) adoptedCount++;
-  log(`[adopt --status] known projects (~/.claude.json): ${known.length} scanned, ${adoptedCount} with a CLAUDE.md managed block.`);
+  for (const dir of known) if (claudeMdHasResidue(dir, PLUGIN_SLUG)) adoptedCount++;
+  log(`[adopt --status] known projects (~/.claude.json): ${known.length} scanned, ${adoptedCount} with a CLAUDE.md managed block or partial residue (detail doc/state).`);
   if (adoptedCount > 0) log('[adopt --status] run `claude-mem-lite unadopt --all` to remove every CLAUDE.md block.');
 
   const pluginRoot = process.env.CLAUDE_PLUGIN_ROOT ? 'set' : 'unset';
@@ -347,16 +348,20 @@ function unadoptAll(args) {
 
   // 1. New scheme: scrub CLAUDE.md managed blocks across known project paths.
   const projectDirs = listKnownProjectDirs();
-  let blocks = 0;
+  let blocks = 0, partial = 0;
   for (const dir of projectDirs) {
-    if (!claudeMdIsAdopted(dir, PLUGIN_SLUG)) continue;
+    // hasResidue, not isAdopted: the sweep must also catch PARTIAL residue
+    // (block without detail doc, or an orphaned doc/state sidecar) —
+    // isAdopted's block-AND-doc gate skipped those projects forever.
+    if (!claudeMdHasResidue(dir, PLUGIN_SLUG)) continue;
     if (dryRun) {
-      log(`[unadopt --all --dry-run] ${dir} → would-remove CLAUDE.md block + detail doc`);
+      log(`[unadopt --all --dry-run] ${dir} → would-remove plugin residue (CLAUDE.md block and/or detail doc/state)`);
       blocks++;
       continue;
     }
     const r = removeManaged(dir, PLUGIN_SLUG);
     if (r.action === 'removed') { log(`[unadopt --all] ${dir} → removed`); blocks++; }
+    else { log(`[unadopt --all] ${dir} → cleaned partial residue (detail doc/state, no block)`); partial++; }
   }
 
   // 2. Legacy memory-dir cleanup across every memdir (foreign-content guarded).
@@ -372,7 +377,8 @@ function unadoptAll(args) {
   }
 
   log('');
-  log(`[unadopt --all] ${dryRun ? 'would remove' : 'removed'} ${blocks} CLAUDE.md block(s) across ${projectDirs.length} known project(s); ${legacy} legacy memory-dir sentinel(s) ${dryRun ? 'pending' : 'cleaned'}.`);
+  const partialNote = partial > 0 ? ` (+${partial} partial-residue cleanup(s))` : '';
+  log(`[unadopt --all] ${dryRun ? 'would remove' : 'removed'} ${blocks} CLAUDE.md block(s)${partialNote} across ${projectDirs.length} known project(s); ${legacy} legacy memory-dir sentinel(s) ${dryRun ? 'pending' : 'cleaned'}.`);
   if (projectDirs.length === 0) {
     log('[unadopt --all] no known projects found in ~/.claude.json — if a project was adopted but never opened in Claude Code, run `claude-mem-lite unadopt` from inside it.');
   }
@@ -389,7 +395,7 @@ export function cmdUnadopt(args = []) {
 
   const cwd = detectCwd();
   if (dryRun) {
-    const blockState = claudeMdIsAdopted(cwd, PLUGIN_SLUG) ? 'would-remove CLAUDE.md block + detail doc' : 'no CLAUDE.md block';
+    const blockState = claudeMdHasResidue(cwd, PLUGIN_SLUG) ? 'would-remove CLAUDE.md block + detail doc' : 'no CLAUDE.md block';
     const legacy = hasLegacyMemdirSentinel(cwd, PLUGIN_SLUG) ? 'would-clean legacy memory-dir sentinel' : 'no legacy residue';
     log(`[unadopt --dry-run] ${cwd}`);
     log(`  ${blockState}`);

package/claudemd.mjs

@@ -98,6 +98,20 @@ export function isAdopted(cwd, slug) {
   return blk.body !== null && existsSync(detailDocPath(cwd, slug));
 }
 
+/**
+ * Any trace of adoption that unadopt should clean: managed block OR detail doc
+ * OR state sidecar. Deliberately weaker than isAdopted (whose AND lets a
+ * half-written adopt self-heal on the next SessionStart): the unadopt sweep
+ * gated on isAdopted skipped partial residue forever — e.g. a user deleted the
+ * detail doc but the CLAUDE.md block remained, and `unadopt --all` never
+ * removed it. removeManaged cleans all three pieces, so sweep on any of them.
+ */
+export function hasResidue(cwd, slug) {
+  return readBlock(cwd, slug).body !== null
+    || existsSync(detailDocPath(cwd, slug))
+    || existsSync(stateFilePath(cwd, slug));
+}
+
 /**
  * Whether the installed block/doc has drifted from the shipped content — i.e.
  * a version bump or a template edit means we should refresh. Returns true when

package/hook-shared.mjs

@@ -6,7 +6,7 @@ import { randomUUID } from 'crypto';
 import { join } from 'path';
 import { existsSync, readFileSync, writeFileSync, mkdirSync, renameSync, readdirSync, statSync, unlinkSync, chmodSync } from 'fs';
 import { inferProject, debugCatch } from './utils.mjs';
-import { ensureDb, DB_DIR } from './schema.mjs';
+import { ensureDbWithWalRecovery, DB_DIR } from './schema.mjs';
 import { getClaudePath as getClaudePathShared, resolveModel as resolveModelShared, flattenForCLI as _flattenForCLI, detectMode as detectLLMMode, callHaiku } from './haiku-client.mjs';
 // Phase D: invited-memory sentinel detection. memdir.mjs/claudemd.mjs only pull in
 // fs/path/os/crypto; adopt-content.mjs is pure strings. No circular deps —
@@ -154,7 +154,9 @@ export function createSessionId() {
 
 export function openDb() {
   try {
-    return ensureDb();
+    // WAL-corruption self-heal (was server.mjs-only): without it, hooks stayed
+    // silently dead (null DB) on a corrupt WAL until the next MCP server start.
+    return ensureDbWithWalRecovery();
   } catch {
     return null;
   }

package/hook-update.mjs

@@ -635,6 +635,32 @@ function smokeInstalledRelease(targetDir) {
       const p = join(targetDir, entry);
       if (existsSync(p)) execSync(`${q(process.execPath)} --check ${q(p)}`, { timeout: 10000, stdio: 'ignore' });
     }
+    // `cli.mjs help` exits without opening the DB, so it cannot see a
+    // present-but-unusable better-sqlite3 binding: npm >= 12 blocks
+    // install/lifecycle scripts by default, so the staging `npm install`
+    // above exits 0 with the native .node never compiled (a Node major bump
+    // strands a stale ABI the same way). Direct installs register server.mjs
+    // without the launch.mjs probe, so this gate is their only check. Probe
+    // in a child process (execSync so the unit-test mock intercepts, and so
+    // the running old-version process's require cache can't mask it); on
+    // failure rebuild with scripts enabled for just this dep — plain-rebuild
+    // fallback for older npm — then re-probe. A still-broken binding throws
+    // out of the try, smoke fails, and the caller rolls back to the old
+    // (working) install.
+    if (existsSync(join(targetDir, 'node_modules', 'better-sqlite3'))) {
+      const probeSrc = 'const{createRequire}=require("node:module");const D=createRequire(process.argv[1])("better-sqlite3");new D(":memory:").close();';
+      const probeCmd = `${q(process.execPath)} -e ${q(probeSrc)} ${q(join(targetDir, 'package.json'))}`;
+      try {
+        execSync(probeCmd, { timeout: 20000, stdio: 'ignore' });
+      } catch {
+        try {
+          execSync('npm rebuild better-sqlite3 --dangerously-allow-all-scripts', { cwd: targetDir, timeout: 120000, stdio: 'ignore' });
+        } catch {
+          execSync('npm rebuild better-sqlite3', { cwd: targetDir, timeout: 120000, stdio: 'ignore' });
+        }
+        execSync(probeCmd, { timeout: 20000, stdio: 'ignore' });
+      }
+    }
     return true;
   } catch (e) {
     debugLog('WARN', 'hook-update', `post-install smoke failed (rolling back): ${e.message}`);

package/install.mjs

@@ -466,7 +466,7 @@ if (IS_DEV) {
     ok(`better-sqlite3: ${verify.action}`);
   } else {
     fail(`better-sqlite3 binding unusable after rebuild: ${verify.error}`);
-    log('Try manually: cd ' + INSTALL_DIR + ' && npm rebuild better-sqlite3 --build-from-source');
+    log('Try manually: cd ' + INSTALL_DIR + ' && npm rebuild better-sqlite3 --dangerously-allow-all-scripts');
     process.exit(1);
   }
 }

package/mem-cli.mjs

@@ -3,7 +3,7 @@
 // No MCP SDK or heavy deps — only imports schema.mjs and utils.mjs
 
 import { homedir } from 'os';
-import { ensureDb, DB_PATH, DB_DIR, REGISTRY_DB_PATH } from './schema.mjs';
+import { ensureDbWithWalRecovery, DB_PATH, DB_DIR, REGISTRY_DB_PATH } from './schema.mjs';
 import { truncate, typeIcon, inferProject, scrubSecrets } from './utils.mjs';
 import { resolveProject } from './project-utils.mjs';
 import { TIER_CASE_SQL, tierSqlParams } from './tier.mjs';
@@ -3156,14 +3156,16 @@ export async function run(argv) {
   }
 
   // adopt / unadopt do pure filesystem work on ~/.claude/projects/<encoded>/memory/ —
-  // no DB needed. Route them before ensureDb() so an unbootable DB doesn't block.
+  // no DB needed. Route them before the DB open so an unbootable DB doesn't block.
   if (cmd === 'adopt') { cmdAdopt(cmdArgs); return; }
   if (cmd === 'unadopt') { cmdUnadopt(cmdArgs); return; }
   if (cmd === 'memdir-audit') { cmdMemdirAudit(cmdArgs); return; }
 
   let db;
   try {
-    db = ensureDb();
+    // Corruption-gated WAL recovery (shared with server/hooks) — a corrupt WAL
+    // previously threw here with no auto-repair until the next MCP start.
+    db = ensureDbWithWalRecovery({ warn: (m) => process.stderr.write(`[mem] ${m}\n`) });
   } catch (e) {
     out(`[mem] Error: Cannot open database: ${e.message}`);
     out(`[mem] DB path: ${DB_PATH}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.57.0",
+  "version": "3.58.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",

package/schema.mjs

@@ -1000,6 +1000,49 @@ export function ensureDb() {
   }
 }
 
+/**
+ * Whether an open/init error carries a genuine corruption signature. WAL-delete
+ * recovery is ONLY safe for these: on a transient error (SQLITE_BUSY) or the
+ * forward-version guard throw, deleting the WAL would discard committed-but-
+ * uncheckpointed transactions — silent data loss.
+ */
+export function isDbCorruptionError(err) {
+  return /SQLITE_CORRUPT|SQLITE_NOTADB|malformed|not a database|disk image/i
+    .test(`${err?.code || ''} ${err?.message || ''}`);
+}
+
+/**
+ * ensureDb with corruption-gated WAL recovery. Was inlined in server.mjs only,
+ * so hooks (openDb → silent null) and the CLI (raw throw) stayed degraded on a
+ * corrupt WAL until the next MCP server start. One shared implementation now
+ * serves all three openers.
+ *
+ * Non-corruption failure → rethrows the original error, WAL/SHM left intact.
+ * Corruption → deletes -wal/-shm, retries once; a still-failing retry rethrows
+ * with `err.walRecoveryAttempted = true` so callers can word their fatal hint
+ * accurately (recovery already tried vs WAL deliberately preserved).
+ *
+ * @param {{warn?: (msg: string) => void, info?: (msg: string) => void}} [opts]
+ */
+export function ensureDbWithWalRecovery({ warn, info } = {}) {
+  try {
+    return ensureDb();
+  } catch (firstErr) {
+    if (!isDbCorruptionError(firstErr)) throw firstErr;
+    warn?.(`DB corruption detected, attempting WAL recovery: ${firstErr.message}`);
+    try { rmSync(DB_PATH + '-wal', { force: true }); } catch { /* best-effort */ }
+    try { rmSync(DB_PATH + '-shm', { force: true }); } catch { /* best-effort */ }
+    try {
+      const db = ensureDb();
+      info?.('DB recovered after WAL cleanup');
+      return db;
+    } catch (retryErr) {
+      try { retryErr.walRecoveryAttempted = true; } catch { /* frozen error — fine */ }
+      throw retryErr;
+    }
+  }
+}
+
 /**
  * Create FTS5 virtual table + sync triggers for a content table.
  * Idempotent: skips if already exists. Exported for test helpers.

package/scripts/launch.mjs

@@ -36,11 +36,37 @@ if (!existsSync(join(ROOT, 'node_modules', 'better-sqlite3'))) {
 // intact but the .node binary stale → server FATALs with "Could not locate
 // the bindings file" on first DB open. Probe + auto-rebuild before launching.
 try {
-  const { ensureBetterSqlite3Working } = await import('../lib/binding-probe.mjs');
-  const verify = await ensureBetterSqlite3Working(ROOT);
+  const { ensureBetterSqlite3Working, probeBetterSqlite3Binding } = await import('../lib/binding-probe.mjs');
+  // The rebuild inside ensureBetterSqlite3Working mutates node_modules — the
+  // same write class as install/repair/update, and this was the ONE rebuild
+  // path outside the shared install.lock: a second MCP launch or a concurrent
+  // `install.mjs repair` (hook-launcher heal) could clobber the .node
+  // mid-compile. Take the lock for the rebuild-capable path; a live peer →
+  // wait up to 10s, then degrade to a probe-only pass (healthy binding
+  // proceeds; a broken one defers to the peer instead of racing it).
+  const { acquireLock } = await import('../lib/proc-lock.mjs');
+  const { resolveDataDir } = await import('../lib/resolve-data-dir.mjs');
+  const lockPath = join(resolveDataDir(process.env.CLAUDE_MEM_DIR), 'runtime', 'install.lock');
+  let release = null;
+  for (let i = 0; i < 20 && !(release = acquireLock(lockPath)); i++) {
+    await new Promise((r) => setTimeout(r, 500));
+  }
+  let verify;
+  try {
+    if (release) {
+      verify = await ensureBetterSqlite3Working(ROOT);
+    } else {
+      const probe = await probeBetterSqlite3Binding(ROOT);
+      verify = probe.ok
+        ? { ok: true, action: 'verified' }
+        : { ok: false, error: `${probe.error} (another install/repair holds the lock — not rebuilding concurrently; reconnect with /mcp once it finishes)` };
+    }
+  } finally {
+    if (release) release();
+  }
   if (!verify.ok) {
     process.stderr.write(`[claude-mem-lite] better-sqlite3 binding unusable: ${verify.error}\n`);
-    process.stderr.write(`[claude-mem-lite] Repair: cd "${ROOT}" && npm rebuild better-sqlite3 --build-from-source\n`);
+    process.stderr.write(`[claude-mem-lite] Repair: cd "${ROOT}" && npm rebuild better-sqlite3 --dangerously-allow-all-scripts\n`);
     process.exit(1);
   }
   if (verify.action === 'rebuilt') {

package/scripts/setup.sh

@@ -80,20 +80,22 @@ mkdir -p "$DATA_DIR/runtime" 2>/dev/null || true
 
 mark_deps_broken() {
   local reason="$1"
+  local repair="${2:-npm install --omit=dev}"
   # Embed reason + repair command so hook.mjs renders a complete error without
   # having to re-derive them. Delegate JSON serialization to node so embedded
   # quotes / shell metachars in $ROOT or $reason can't produce an invalid file
   # (bash `printf '"..%s.."'` cannot escape arbitrary strings safely; v2.79.1 fix).
   # shellcheck disable=SC2016  # node script single-quoted on purpose; vars passed via env (MARK_*), not shell expansion
-  MARK_REASON="$reason" MARK_ROOT="$ROOT" MARK_FLAG="$DEPS_FLAG" node -e '
+  MARK_REASON="$reason" MARK_ROOT="$ROOT" MARK_FLAG="$DEPS_FLAG" MARK_REPAIR="$repair" node -e '
     const fs = require("fs");
     const reason = process.env.MARK_REASON || "unknown";
     const root = process.env.MARK_ROOT || "";
+    const repair = process.env.MARK_REPAIR || "npm install --omit=dev";
     fs.writeFileSync(process.env.MARK_FLAG, JSON.stringify({
       ts: new Date().toISOString(),
       reason,
       root,
-      repair: `cd ${JSON.stringify(root)} && npm install --omit=dev`,
+      repair: `cd ${JSON.stringify(root)} && ${repair}`,
     }) + "\n");
   ' 2>/dev/null || true
 }
@@ -107,7 +109,6 @@ if [[ ! -d "$ROOT/node_modules/better-sqlite3" ]]; then
   if [[ -d "$DATA_DIR/node_modules/better-sqlite3" ]]; then
     if ln -sfn "$DATA_DIR/node_modules" "$ROOT/node_modules" 2>/dev/null; then
       log_ok "Dependencies linked from $DATA_DIR"
-      mark_deps_ok
     fi
   fi
   # Slow path: npm install (first-time only, ~10-20s for native addon)
@@ -115,15 +116,96 @@ if [[ ! -d "$ROOT/node_modules/better-sqlite3" ]]; then
     log_info "Installing dependencies (first-time setup)..."
     if (cd "$ROOT" && npm install --omit=dev --no-audit --no-fund 2>&1) >&2; then
       log_ok "Dependencies installed"
-      mark_deps_ok
     else
       log_warn "Dependency install failed — hooks may have limited functionality (flag: $DEPS_FLAG)"
       mark_deps_broken "npm install --omit=dev failed in plugin cache root"
     fi
   fi
-else
-  # Deps already present — make sure we don't keep stale broken flag around
-  mark_deps_ok
+fi
+
+# 6b. Binding probe: node_modules/better-sqlite3 PRESENT is not node binding
+#     WORKING. npm >= 12 blocks install/lifecycle scripts by default, so the
+#     `npm install` above exits 0 with the native .node binding never compiled
+#     (and a Node major upgrade strands a stale-ABI binding the same way) —
+#     pre-v3.58 this branch called mark_deps_ok on directory presence alone,
+#     leaving every hook dead with a false-green flag until the MCP server's
+#     own probe ran. Probe via the shared fix point lib/binding-probe.mjs
+#     (opens a :memory: DB; auto-rebuilds with --dangerously-allow-all-scripts,
+#     plain-rebuild fallback for older npm). The ABI-keyed marker lives inside
+#     node_modules/ — WITH the tree it certifies — so healthy sessions cost one
+#     stat, a new plugin-cache version dir (fresh node_modules) re-probes, and
+#     a Node upgrade (new ABI) re-probes. While broken, every SessionStart
+#     retries the rebuild until it heals.
+if [[ -d "$ROOT/node_modules/better-sqlite3" ]]; then
+  NODE_ABI="$(node -p 'process.versions.modules' 2>/dev/null || echo 0)"
+  BINDING_MARKER="$ROOT/node_modules/.mem-binding-ok-$NODE_ABI"
+  if [[ -f "$BINDING_MARKER" ]]; then
+    mark_deps_ok
+  # shellcheck disable=SC2016  # node script single-quoted on purpose; ROOT passed via env, not shell expansion
+  elif PROBE_ROOT="$ROOT" node --input-type=module -e '
+    // NOTE: this whole script sits in a single-quoted bash string — no
+    // apostrophes anywhere in it.
+    const { pathToFileURL } = await import("node:url");
+    const { join } = await import("node:path");
+    const root = process.env.PROBE_ROOT;
+    const libUrl = (f) => pathToFileURL(join(root, "lib", f)).href;
+    let helpers = null;
+    try {
+      const [probeMod, lockMod, dirMod] = await Promise.all(
+        ["binding-probe.mjs", "proc-lock.mjs", "resolve-data-dir.mjs"].map((f) => import(libUrl(f))));
+      helpers = { ...probeMod, ...lockMod, ...dirMod };
+    } catch {
+      // Probe helpers missing (half-installed tree) — fall back to a bare
+      // probe with no rebuild: a WORKING binding must still clear the flag,
+      // and a helperless broken tree is repaired by the hook-launcher path.
+      const { createRequire } = await import("node:module");
+      try {
+        const D = createRequire(join(root, "package.json"))("better-sqlite3");
+        new D(":memory:").close();
+        process.exit(0);
+      } catch (e) {
+        process.stderr.write(`[claude-mem-lite] binding probe: ${e.message}\n`);
+        process.exit(1);
+      }
+    }
+    // Probe first — read-only, no lock needed. Healthy binding exits here.
+    const first = await helpers.probeBetterSqlite3Binding(root);
+    if (first.ok) process.exit(0);
+    // Broken: rebuild ONLY under the shared install.lock (a second MCP launch
+    // or install.mjs repair rebuilding the same node_modules concurrently can
+    // tear the .node), and with the exec bounded to 20s — this script runs
+    // under the SessionStart hook cap (hooks.json timeout 30), and letting the
+    // hook SIGKILL a mid-flight node-gyp leaves a partial .node with no flag
+    // written. On lock-miss or timeout: mark broken and defer the heal to the
+    // MCP launch path (no hook cap, same lock).
+    const lockPath = join(helpers.resolveDataDir(process.env.CLAUDE_MEM_DIR), "runtime", "install.lock");
+    const release = helpers.acquireLock(lockPath);
+    if (!release) {
+      const firstLine = String(first.error).split("\n")[0];
+      process.stderr.write(`[claude-mem-lite] binding probe: ${firstLine} (another install/repair in flight — deferring heal)\n`);
+      process.exit(1);
+    }
+    let r;
+    try {
+      const { execSync } = await import("node:child_process");
+      r = await helpers.ensureBetterSqlite3Working(root, {
+        exec: (cmd, opts) => execSync(cmd, { ...opts, timeout: 20000 }),
+      });
+    } finally {
+      // process.exit skips finally blocks — exits live BELOW this so the
+      // lock is always released.
+      release();
+    }
+    if (!r.ok) { process.stderr.write(`[claude-mem-lite] binding probe: ${r.error}\n`); process.exit(1); }
+    if (r.action === "rebuilt") process.stderr.write("[claude-mem-lite] rebuilt better-sqlite3 binding for current Node ABI\n");
+  '; then
+    rm -f "$ROOT/node_modules/.mem-binding-ok-"* 2>/dev/null || true
+    touch "$BINDING_MARKER" 2>/dev/null || true
+    mark_deps_ok
+  else
+    log_warn "better-sqlite3 native binding unusable — hooks degraded until repaired (flag: $DEPS_FLAG)"
+    mark_deps_broken "better-sqlite3 binding probe/rebuild failed (npm >= 12 blocks compile scripts by default)" "npm rebuild better-sqlite3 --dangerously-allow-all-scripts"
+  fi
 fi
 
 # 7. MCP cleanup: one-shot purge of stale global MCP registrations.

package/server.mjs

@@ -7,7 +7,7 @@ import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
 import { ListToolsRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 import { truncate, typeIcon, inferProject, scrubSecrets, fmtDate, debugLog, debugCatch, isPathConfined } from './utils.mjs';
 import { resolveProject as _resolveProjectShared } from './project-utils.mjs';
-import { ensureDb, DB_PATH, DB_DIR, REGISTRY_DB_PATH } from './schema.mjs';
+import { ensureDbWithWalRecovery, DB_PATH, DB_DIR, REGISTRY_DB_PATH } from './schema.mjs';
 import { reRankWithContext, autoBoostIfNeeded, runIdleCleanup, buildServerInstructions } from './search-scoring.mjs';
 import { searchObservationsHybrid } from './search-engine.mjs';
 import { deepSearch, resolveDeepMode, shouldEscalateToDeep, autoDeepLlmReady } from './deep-search.mjs';
@@ -66,36 +66,25 @@ const { version: PKG_VERSION } = require('./package.json');
 
 // ─── Database ───────────────────────────────────────────────────────────────
 
-import { rmSync, existsSync, readFileSync, writeFileSync, appendFileSync, mkdirSync, readdirSync, chmodSync } from 'fs';
+import { existsSync, readFileSync, writeFileSync, appendFileSync, mkdirSync, readdirSync, chmodSync } from 'fs';
 
 let db;
 try {
-  db = ensureDb();
-} catch (firstErr) {
-  // WAL-delete recovery is ONLY safe for genuine corruption. On a transient
-  // error (SQLITE_BUSY) or the forward-version guard throw, deleting the WAL
-  // would discard committed-but-uncheckpointed transactions — silent data loss.
-  // Restrict the rm to corruption signatures; otherwise fail fast, WAL intact.
-  const sig = `${firstErr.code || ''} ${firstErr.message || ''}`;
-  const isCorruption = /SQLITE_CORRUPT|SQLITE_NOTADB|malformed|not a database|disk image/i.test(sig);
-  if (!isCorruption) {
-    console.error(`[claude-mem-lite] FATAL: Database cannot be opened: ${firstErr.message}`);
-    console.error(`[claude-mem-lite] Left WAL/SHM intact (not a corruption error). If this persists, retry or reinstall: node install.mjs install`);
-    process.exit(1);
-  }
-  // Recovery: remove WAL/SHM files (corrupt WAL is the most common cause) and retry
-  debugLog('WARN', 'server', `DB corruption detected, attempting WAL recovery: ${firstErr.message}`);
-  try { rmSync(DB_PATH + '-wal', { force: true }); } catch {}
-  try { rmSync(DB_PATH + '-shm', { force: true }); } catch {}
-  try {
-    db = ensureDb();
-    debugLog('INFO', 'server', 'DB recovered after WAL cleanup');
-  } catch (retryErr) {
-    // Fatal: log and exit with descriptive message (Claude Code shows stderr)
-    console.error(`[claude-mem-lite] FATAL: Database cannot be opened: ${retryErr.message}`);
+  // Corruption-gated WAL recovery lives in schema.mjs (shared with hooks/CLI
+  // since the D#8-adjacent P3 fix); the server keeps only its exit semantics.
+  db = ensureDbWithWalRecovery({
+    warn: (m) => debugLog('WARN', 'server', m),
+    info: (m) => debugLog('INFO', 'server', m),
+  });
+} catch (err) {
+  // Fatal: log and exit with descriptive message (Claude Code shows stderr)
+  console.error(`[claude-mem-lite] FATAL: Database cannot be opened: ${err.message}`);
+  if (err.walRecoveryAttempted) {
     console.error(`[claude-mem-lite] Try: rm "${DB_PATH}-wal" "${DB_PATH}-shm" or reinstall with: node install.mjs install`);
-    process.exit(1);
+  } else {
+    console.error(`[claude-mem-lite] Left WAL/SHM intact (not a corruption error). If this persists, retry or reinstall: node install.mjs install`);
   }
+  process.exit(1);
 }
 // Server process uses longer busy_timeout for concurrent MCP requests
 db.pragma('busy_timeout = 5000');