claude-mem-lite 3.61.0 → 3.62.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "3.61.0",
+      "version": "3.62.0",
       "source": "./",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."
     }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.61.0",
+  "version": "3.62.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/cli/common.mjs

@@ -2,10 +2,13 @@
 // Extracted from mem-cli.mjs (v2.41) as first step in the god-module split.
 //
 // Scope: pure utilities only. No DB, no imports from other cli/ files; only
-// `lib/` leaf utilities may be re-exported through here (currently:
-// parseIdToken). This module is the single source of truth for stdout/stderr
-// framing, arg parsing, ID-token parsing, and relative-time formatting —
-// every command imports from here so the CLI stays consistent.
+// leaf utilities from `lib/` and the repo root may be pulled in (currently:
+// parseIdToken, neutralizeContextDelimiters). This module is the single source
+// of truth for stdout/stderr framing, arg parsing, ID-token parsing, and
+// relative-time formatting — every command imports from here so the CLI stays
+// consistent.
+
+import { neutralizeContextDelimiters } from '../format-utils.mjs';
 
 // ─── Argument Parsing ────────────────────────────────────────────────────────
 
@@ -85,8 +88,41 @@ export function parseArgs(argv) {
 
 // ─── Output Helpers ──────────────────────────────────────────────────────────
 
-/** Write a line to stdout. */
+/**
+ * Write a line to stdout, with structural context delimiters neutralized.
+ *
+ * CLI stdout IS model context, not just a human channel: commands/mem.md routes
+ * `/mem search|get|recall|timeline` to `node cli.mjs … via Bash`, and
+ * buildServerInstructions actively tells the agent the Bash CLI is the CHEAPER path
+ * than the MCP tool. The MCP read family has been defanged since v3.61 at its own
+ * chokepoint (server.mjs safeHandler), but the CLI twins printed stored text raw —
+ * so the exact indirect-prompt-injection channel the MCP defang closes stayed open on
+ * the surface the instructions recommend (audit 2026-08-14 A1). Observations are
+ * stored raw on purpose (defense lives at the injection boundary, not at save), so it
+ * has to happen here, at the write.
+ *
+ * `out` is the single stdout writer for every command in mem-cli.mjs and cli/*.mjs,
+ * so a NEW read command is covered by construction (§9 parallel-path completeness).
+ * Payloads that must round-trip byte-exact use `outVerbatim` instead — see below.
+ * The transform is idempotent (it strips brackets, it does not re-add them), so a
+ * path that already defanged upstream — `context` → buildSessionContextLines — is
+ * unaffected.
+ */
 export function out(text) {
+  // String() first: neutralizeContextDelimiters coerces nullish to '', which would turn
+  // a pre-existing `out(undefined)` line from "undefined" into an empty line.
+  outVerbatim(neutralizeContextDelimiters(String(text)));
+}
+
+/**
+ * Write a line to stdout with NO defang. The CLI mirror of
+ * `safeHandler(fn, { verbatim: true })` on the MCP side, and for the same single
+ * reason: `export` is the backup half of backup/restore, so neutralizing its payload
+ * would silently rewrite every backed-up row whose text legitimately contains these
+ * tags — and `restore` would write the rewritten text back. Only use this for bytes
+ * that must survive a round trip; anything a model reads goes through `out`.
+ */
+export function outVerbatim(text) {
   process.stdout.write(text + '\n');
 }
 
@@ -176,6 +212,11 @@ export const KNOWN_CLI_FLAGS = new Set([
   // stay silent about (`adopt --disable/--enable`, `activity --min-importance`,
   // `save --supersedes`). Verified by running each command and checking for a warning.
   'disable', 'enable', 'min-importance', 'supersedes',
+  // `doctor --benchmark --prompts-limit N` — read off raw argv in cli/doctor.mjs, so
+  // it never appeared in a `flags.x` grep. Caught by independent review after the
+  // warn-on-every-unknown-flag flip turned the omission into a false warning on a
+  // documented, working command.
+  'prompts-limit',
 ]);
 
 /** Levenshtein distance, early-exit past `max` (cheap enough for a handful of flags). */
@@ -255,6 +296,43 @@ export function fmtDateShort(iso) {
 // because the formatter lived only in mem-cli.mjs.
 export const OBS_TIME_FIELDS = ['superseded_at', 'last_accessed_at'];
 
+// Display labels for observation columns whose NAME misdescribes their contents.
+// `files_modified` holds whatever file list the writer attached: hook-captured rows fill
+// it from Edit/Write, but an explicit mem_save / `save --files` puts any associated path
+// there — including a file that was only read. Rendering the raw column name told the
+// reader those files were modified (audit 2026-08-14 F3). The label is `files` — the name
+// of the input parameter that fills it. The COLUMN is untouched, so `--fields
+// files_modified` / `fields:["files_modified"]` still select it. Shared by the CLI `get`
+// and MCP `mem_get` renderers so the two cannot drift.
+const OBS_FIELD_LABELS = { files_modified: 'files' };
+
+/** Reader-facing label for an observation column (identity for everything unmapped). */
+export function obsFieldLabel(field) {
+  return OBS_FIELD_LABELS[field] || field;
+}
+
+/**
+ * The `maintain scan` pending-purge line, shared by the CLI (mem-cli.mjs cmdMaintain) and
+ * the MCP mem_maintain handler (server.mjs) so the two cannot drift — same reason
+ * obsFieldLabel lives here.
+ *
+ * The count is `compressed_into = COMPRESSED_PENDING_PURGE` (lib/maintain-core.mjs:443),
+ * and the ONLY writers of that sentinel are the two idle/decay passes — decayAndMarkIdle
+ * (maintain-core.mjs:201) and runIdleCleanup (search-scoring.mjs:303). Compression writes
+ * COMPRESSED_AUTO (-1) or a positive parent id, and those rows are NOT counted. The CLI
+ * used to render this as "compressed originals awaiting cleanup", which told an operator
+ * about to run `maintain execute --ops purge_stale --confirm` that they were deleting
+ * compression leftovers when they were deleting decay-marked live originals (audit
+ * 2026-08-14 A4). Say what the rows are and what deletes them — and say nothing about
+ * compression, which is a different sentinel with a different lifecycle.
+ *
+ * @param {number} n stats.pendingPurge
+ * @returns {string} the full indented line, identical on both surfaces.
+ */
+export function formatPendingPurgeLine(n) {
+  return `  Pending purge (idle-marked): ${n} (live originals marked idle by decay — purge_stale deletes them)`;
+}
+
 // Pure formatter — null/undefined/non-time pass through; integer time fields
 // render as `<raw> (<relative>)` so callers get both an audit value and a
 // human/LLM-scannable hint, mirroring `recent`/`timeline`/`recall`.

package/format-utils.mjs

@@ -48,15 +48,79 @@ export function truncate(str, max = 80) {
 // itself, where source/observations carry the delimiter names.
 const CONTEXT_DELIMITER_RE = /<\/?(?:claude-mem-context|memory-context|session-handoff|system-reminder|task-notification|(?:antml:)?function_calls|(?:antml:)?function_results|(?:antml:)?invoke|(?:antml:)?parameter)(?:\s[^>]*)?>/gi;
 
+// Pass cap for the fixpoint loop below. 32 nested layers of a forged delimiter is far past
+// anything prose produces; the cap exists only to bound the ADVERSARIAL cost (an unbounded
+// fixpoint is O(depth \u00d7 length), i.e. quadratic on a crafted 200k-char payload, on the
+// synchronous hook/CLI write path \u2014 this repo has shipped two ReDoS findings already).
+const DEFANG_MAX_PASSES = 32;
+
+/**
+ * Strip the angle brackets of every `re` match, repeatedly, until the text stops changing.
+ *
+ * A SINGLE pass is not enough, and the gap is two characters wide: in
+ * `<<system-reminder>>` the pattern matches the INNER pair, removing it leaves the outer
+ * pair wrapped around the bare tag name, and the "defanged" output is a live
+ * `<system-reminder>` \u2014 produced by the function whose job is to make it inert (pre-tag
+ * review, 2026-08-14). Widening the pattern to also eat adjacent brackets does not fix it
+ * either: `<system-reminder <system-reminder> x>y>` re-forms `<system-reminder x>` from
+ * text the widened match keeps. Only a fixpoint closes the general case.
+ *
+ * TERMINATION: every match begins with `<` and the replacement drops it, so any pass that
+ * changes the string removes at least one `<` \u2014 the iteration is self-bounded by the number
+ * of `<` in the input, and DEFANG_MAX_PASSES bounds it again by a constant.
+ *
+ * INERT AT ANY DEPTH: if the text is still changing when the cap is reached (\u226532 nested
+ * forged layers \u2014 not reachable by accident), every remaining angle bracket is removed.
+ * That is lossier than the normal path, but the return value then provably contains no tag,
+ * which is the property callers rely on; giving up at the cap and returning still-tagged
+ * text would hand the attacker exactly the bypass the loop exists to close.
+ *
+ * @param {string} s Input string (any type; coerced)
+ * @param {RegExp} re Global tag pattern whose matches start with `<` and end with `>`
+ * @returns {string} Text containing no match of `re`
+ */
+function defangToFixpoint(s, re) {
+  let text = String(s ?? '');
+  for (let pass = 0; pass < DEFANG_MAX_PASSES; pass++) {
+    const next = text.replace(re, (m) => m.slice(1, -1));
+    if (next === text) return text;   // fixpoint: nothing left to defang
+    text = next;
+  }
+  return text.replace(/[<>]/g, '');   // pathological nesting \u2192 fail closed
+}
+
 /**
  * Defang the literal context-block delimiter tags in user-derived text. Strips just the
  * angle brackets, so `</claude-mem-context>` renders as `/claude-mem-context` \u2014 still
  * readable, but no longer a structural delimiter. Complements `mdCell`'s pipe-escaping.
+ * Iterated to a fixpoint (see defangToFixpoint): a single pass let `<<system-reminder>>`
+ * come back live.
  * @param {string} s Input string (any type; coerced)
  * @returns {string} Text with delimiter tags defanged
  */
 export function neutralizeContextDelimiters(s) {
-  return String(s ?? '').replace(CONTEXT_DELIMITER_RE, (m) => m.slice(1, -1));
+  return defangToFixpoint(s, CONTEXT_DELIMITER_RE);
+}
+
+// <skill-loaded> is deliberately NOT in CONTEXT_DELIMITER_RE above: mem_use's legitimate
+// load path has to emit a REAL one, and that result goes through the same handler-wide
+// defang, which would strip it. So the tag is neutralized here instead — per call site,
+// on the untrusted text only. Attribute-bearing openers and the bare closer both match,
+// same "strip the brackets, keep the text" treatment as the class above.
+const SKILL_BLOCK_RE = /<\/?skill-loaded(?:\s[^>]*)?>/gi;
+
+/**
+ * Defang a literal `<skill-loaded>` opener/closer in text that is about to be echoed
+ * INSIDE a mem_use response. A caller-supplied name interpolated raw could otherwise
+ * forge a whole skill block (plus its execute imperative) in a message the caller
+ * controls end to end — audit F7, 2026-08-14. Never apply this to the real load path.
+ * Same fixpoint iteration as the class above, for the same reason: one pass turned the
+ * caller-supplied `<<skill-loaded>>` back into a live `<skill-loaded>` opener.
+ * @param {string} s Input string (any type; coerced)
+ * @returns {string} Text with skill-block delimiters defanged
+ */
+export function neutralizeSkillDelimiters(s) {
+  return defangToFixpoint(s, SKILL_BLOCK_RE);
 }
 
 /**

package/hook-handoff.mjs

@@ -173,11 +173,20 @@ export function buildAndSaveHandoff(db, sessionId, project, type, episodeSnapsho
     try { JSON.parse(row.files_modified).filter(isValidFile).forEach(f => fileSet.add(f)); } catch {}
   }
 
-  // 5. Key decisions — high importance observations (skip low-signal degraded titles)
+  // 5. Key decisions — high importance observations (skip low-signal degraded titles).
+  //
+  // superseded_at IS NULL, unlike `completed` and `files_modified` above: those two are
+  // the session's own history ("what happened here"), where an overturned decision still
+  // happened and erasing it would misreport the session. key_decisions is different — it
+  // is replayed to the NEXT session under "## Key Decisions" as standing policy, so a
+  // retracted decision rendered there is indistinguishable from live policy. The
+  // carry-forward fallback at the top of this function already filters the same column;
+  // this is the sibling that did not.
   const decisions = db.prepare(`
     SELECT title FROM observations
     WHERE memory_session_id = ? AND COALESCE(importance, 1) >= 2
-      AND COALESCE(compressed_into, 0) = 0 ${obsWindowClause}
+      AND COALESCE(compressed_into, 0) = 0
+      AND superseded_at IS NULL ${obsWindowClause}
     ORDER BY created_at_epoch DESC LIMIT 10
   `).all(sessionId, ...obsWindowParams).filter(d => d.title && !LOW_SIGNAL_TITLE.test(d.title)).slice(0, 5);
 

package/hook-llm.mjs

@@ -156,7 +156,7 @@ export function saveObservation(obs, projectOverride, sessionIdOverride, externa
     // (no lesson, importance<2, empty facts, thin narrative) is dropped before
     // dedup/MinHash/vector work. Opt-out: CLAUDE_MEM_KEEP_LOW_SIGNAL=1.
     if (isNoiseObservation(obs)) {
-      debugLog('saveObservation', `dropped noise: ${truncate(obs.title || '', 60)}`);
+      debugLog('DEBUG', 'saveObservation', `dropped noise: ${truncate(obs.title || '', 60)}`);
       return null;
     }
 
@@ -172,7 +172,7 @@ export function saveObservation(obs, projectOverride, sessionIdOverride, externa
     // pre-save is not lost on LLM success — that path clean-inserts a fresh row — but it loses
     // those three.) capNoiseImportance then caps any title-noise survivor to imp=1 as before.
     if (isLowYieldChangeObs(obs)) {
-      debugLog('saveObservation', `dropped low-yield change: ${truncate(obs.title || '', 60)}`);
+      debugLog('DEBUG', 'saveObservation', `dropped low-yield change: ${truncate(obs.title || '', 60)}`);
       return null;
     }
 
@@ -182,7 +182,7 @@ export function saveObservation(obs, projectOverride, sessionIdOverride, externa
     // enter the 7-day accelerated auto-compress window in hook.mjs.
     const capped = capNoiseImportance(obs);
     if (capped !== (obs.importance ?? 1)) {
-      debugLog('saveObservation', `capped imp ${obs.importance}→${capped}: ${truncate(obs.title || '', 60)}`);
+      debugLog('DEBUG', 'saveObservation', `capped imp ${obs.importance}→${capped}: ${truncate(obs.title || '', 60)}`);
       obs.importance = capped;
     }
 

package/hook-shared.mjs

@@ -7,6 +7,9 @@ import { join } from 'path';
 import { existsSync, readFileSync, writeFileSync, mkdirSync, renameSync, readdirSync, statSync, unlinkSync, chmodSync } from 'fs';
 import { inferProject, debugCatch } from './utils.mjs';
 import { ensureDbWithWalRecovery, DB_DIR } from './schema.mjs';
+// Pure-`node:`/local module (it imports only binding-probe + native-binding-hint, and
+// neither imports this file) — no cycle.
+import { recordHookError } from './lib/hook-telemetry.mjs';
 import { getClaudePath as getClaudePathShared, resolveModel as resolveModelShared, flattenForCLI as _flattenForCLI, detectMode as detectLLMMode, callHaiku } from './haiku-client.mjs';
 // Phase D: invited-memory sentinel detection. memdir.mjs/claudemd.mjs only pull in
 // fs/path/os/crypto; adopt-content.mjs is pure strings. No circular deps —
@@ -157,7 +160,17 @@ export function openDb() {
     // WAL-corruption self-heal (was server.mjs-only): without it, hooks stayed
     // silently dead (null DB) on a corrupt WAL until the next MCP server start.
     return ensureDbWithWalRecovery();
-  } catch {
+  } catch (e) {
+    // Still null, still no throw — a hook must never crash the host session, and all
+    // eight call sites in hook.mjs are written to no-op on null. But "returned null"
+    // used to be the ONLY trace: nothing reached runtime/hook-errors/, so `stats`
+    // reported 0 and doctor printed "no recent silent hook breakage" while every
+    // capture path was dead (audit B1, 2026-08-14 — the same blindness that hid the
+    // v3.60 binding outage for four days). recordHookError is the established sink;
+    // scripts/pre-tool-recall.js already logs its own db-open failures this way, and
+    // routing through it also flags the native-binding family for the session-start
+    // self-heal. The recorder swallows its own errors, so this cannot throw.
+    recordHookError('hook-shared:db-open', e, RUNTIME_DIR);
     return null;
   }
 }

package/hook.mjs

@@ -47,6 +47,7 @@ import {
 import { handleLLMEpisode, handleLLMSummary, saveObservation, buildImmediateObservation, saveEpisodeImmediate } from './hook-llm.mjs';
 import { scrubRecord } from './lib/scrub-record.mjs';
 import { formatHookError } from './lib/native-binding-hint.mjs';
+import { recordHookError } from './lib/hook-telemetry.mjs';
 import { selectCompressionCandidates, groupByProjectWeek, compressGroup } from './lib/compress-core.mjs';
 import { cleanupBroken, decayAndMarkIdle, boostAccessed, selectFuzzyDedupeIds, hardDeleteCandidateCount, purgeStale, recoverOrphanedChildren, recoverBuriedLessons, sweepDeferredWorkOrphans } from './lib/maintain-core.mjs';
 import { snapshotDb } from './lib/db-backup.mjs';
@@ -94,8 +95,14 @@ const event = process.argv[2];
 // the dispatch below exits everything else). EVERY spawnBackground/queue* event
 // MUST be listed here — a missing entry makes the detached worker exit(0)
 // silently, which looks identical to "worker ran and found nothing" from the
-// outside (live-probe catch, 2026-07-18: enrich-save no-oped on this line).
-const BG_EVENTS = new Set(['llm-episode', 'llm-summary', 'auto-compress', 'llm-optimize', 'auto-maintain', 'enrich-save']);
+// outside (live-probe catch, 2026-07-18: enrich-save no-oped on this line;
+// audit F6, 2026-08-14: update-check had been dead the same way, so the 24h
+// release check never ran and every SessionStart respawned a worker that
+// exit(0)'d before its handler).
+// `tests/audit-findings-20260814.test.mjs` scans BOTH detached spawners
+// (spawnBackground here, spawn(node,[HOOK_PATH,…]) in lib/save-enrich.mjs) and
+// reds when a spawned event is missing from this list.
+const BG_EVENTS = new Set(['llm-episode', 'llm-summary', 'auto-compress', 'llm-optimize', 'auto-maintain', 'enrich-save', 'update-check']);
 
 // Respect Claude Code plugin disable state even when legacy settings.json hooks remain.
 // install.mjs writes direct hooks into ~/.claude/settings.json, so disabling the plugin
@@ -139,8 +146,19 @@ for (const sig of ['SIGTERM', 'SIGINT']) {
           // sessions into one garbled row. planEpisodeFlush returns [ep] by reference when
           // there is ≤1 CC session (the common case → identical to before), else one sub
           // per session. Pure/sync → safe inside the signal handler.
-          for (const sub of planEpisodeFlush(ep)) saveEpisodeImmediate(sub);
-          try { unlinkSync(join(RUNTIME_DIR, `ep-${inferProject()}.json`)); } catch {}
+          // Same B1 gate as flushEpisode: without an openable DB every save below is a
+          // no-op, so deleting the buffer afterwards would destroy the very episode this
+          // handler exists to salvage. openDb is sync (safe here) and records its own
+          // failure; leaving the file untouched lets the next fire retry it.
+          const db = openDb();
+          if (db) {
+            try {
+              for (const sub of planEpisodeFlush(ep)) saveEpisodeImmediate(sub, db);
+              try { unlinkSync(join(RUNTIME_DIR, `ep-${inferProject()}.json`)); } catch {}
+            } finally {
+              try { db.close(); } catch { /* already gone */ }
+            }
+          }
         }
       } catch {}
       process.exit(0);
@@ -164,6 +182,25 @@ const RECEIPT_EVENTS = new Set(['PostToolUse', 'SessionStart', 'UserPromptSubmit
 function flushEpisode(episode, hookEventName = 'PostToolUse') {
   if (!episode || episode.entries.length === 0) return;
 
+  // Acquire the DB ONCE, up front, and bail before touching anything destructive when it
+  // will not open. Every persistence step below is a no-op without it (saveObservation
+  // returns null on a null db; the detached llm-episode worker hits the same wall), yet
+  // the `unlinkSync(episodeFile())` at the tail used to run regardless — so a DB that
+  // could not be opened deleted the session's captured work while the hook exited 0 with
+  // empty stdout AND empty stderr (audit B1, 2026-08-14). Returning here leaves the
+  // buffer on disk for the next fire to retry; openDb() has already recorded the failure
+  // under `hook-shared:db-open`. Reusing the handle for the immediate saves also drops
+  // this path from one open per sub-episode to one per flush.
+  const db = openDb();
+  if (!db) return;
+  try {
+    flushEpisodeWithDb(db, episode, hookEventName);
+  } finally {
+    try { db.close(); } catch { /* already closed / gone */ }
+  }
+}
+
+function flushEpisodeWithDb(db, episode, hookEventName) {
   // Collect Read file paths tracked by post-tool-use.sh
   // Use rename to atomically collect — prevents losing concurrent appends
   const readsFile = join(RUNTIME_DIR, `reads-${episode.project || inferProject()}.txt`);
@@ -185,7 +222,7 @@ function flushEpisode(episode, hookEventName = 'PostToolUse') {
   const subs = planEpisodeFlush(episode);
   let anySignificant = false;
   for (const sub of subs) {
-    const r = flushEpisodeGroup(sub);
+    const r = flushEpisodeGroup(sub, db);
     if (r === 'writefail') {
       // Single-group: preserve the original early return — buffer left un-unlinked
       // for a later retry, no receipt. Multi-group: skip only the failed group and
@@ -250,7 +287,7 @@ function flushEpisode(episode, hookEventName = 'PostToolUse') {
 // 'significant' | 'insignificant' | 'writefail'. CLAUDE_MEM_SKIP_EPISODE_LLM
 // suppresses the detached enrichment spawn (test determinism; sibling of
 // CLAUDE_MEM_SKIP_COMPRESS / _OPTIMIZE) — the synchronous immediate obs still lands.
-function flushEpisodeGroup(ep) {
+function flushEpisodeGroup(ep, db) {
   const isSignificant = episodeHasSignificantContent(ep);
 
   // Immediate save: rule-based observation for instant visibility; the LLM
@@ -258,7 +295,9 @@ function flushEpisodeGroup(ep) {
   if (isSignificant) {
     try {
       const obs = buildImmediateObservation(ep);
-      const id = saveObservation(obs, ep.project, ep.sessionId);
+      // `db` is flushEpisode's handle — passed in so the caller owns open/close and the
+      // whole flush is gated on one availability check (B1).
+      const id = saveObservation(obs, ep.project, ep.sessionId, db);
       if (id) ep.savedId = id;
     } catch (e) { debugCatch(e, 'flushEpisode-immediateSave'); }
   }
@@ -300,6 +339,23 @@ async function handlePostToolUse() {
 
   const { tool_name, tool_input, tool_response } = hookData;
   if (!tool_name) return;
+  // A non-string tool_name is a host-protocol violation, not a payload we can handle:
+  // `tool_name.startsWith(p)` two lines down threw a TypeError that the top-level catch
+  // absorbed, so the observation was dropped with nothing attributable behind it. Guard the
+  // type (parity with scripts/pre-skill-bridge.js:43) and RECORD it rather than dropping
+  // quietly: PostToolUse is the plugin's whole capture path, so a host field-shape change
+  // would kill every observation, and hook-errors/ is the only window into that — the same
+  // blindness that let the v3.60 binding outage run for 4 days. Volume is bounded by the
+  // recorder's 14-day retention and one short line per fire.
+  if (typeof tool_name !== 'string') {
+    recordHookError(
+      'post-tool-use:tool_name-type',
+      new TypeError(`tool_name is ${Array.isArray(tool_name) ? 'array' : typeof tool_name}, expected string`),
+      RUNTIME_DIR,
+      { toolNameType: Array.isArray(tool_name) ? 'array' : typeof tool_name },
+    );
+    return;
+  }
 
   // Skip noise (source of truth: skip-tools.mjs)
   if (SKIP_TOOLS.has(tool_name)) return;
@@ -426,6 +482,17 @@ function triggerErrorRecall(db, toolInput, response) {
       FROM observations_fts
       JOIN observations o ON observations_fts.rowid = o.id
       WHERE observations_fts MATCH ? AND o.project = ?
+        -- Live-row invariant, same as every other model-facing retrieval path
+        -- (hook-context obsPool/fallbackObs/keyObs, hook-memory, search-engine,
+        -- recent/search/timeline/recall-core, pre-tool-recall, user-prompt-search).
+        -- This surface INLINES rows[0].lesson_learned into the model context, so an
+        -- unfiltered SELECT handed a retracted lesson to the agent verbatim while its
+        -- correction trailed as a bare pointer. compressed_into is filtered too, not
+        -- only for symmetry: the block's own footer is a mem_get(ids=...) pointer, and a
+        -- COMPRESSED_PENDING_PURGE row is queued for deletion by maintain purge_stale,
+        -- so that pointer would resolve to nothing.
+        AND COALESCE(o.compressed_into, 0) = 0
+        AND o.superseded_at IS NULL
         AND ${notLowSignalTitleClause('o')}
       ORDER BY ${OBS_BM25}
         * (1.0 + EXP(-0.693 * (? - o.created_at_epoch) / 1209600000.0))
@@ -497,10 +564,17 @@ async function handleStop() {
     // Prevents data loss from concurrent PostToolUse writes between read and delete.
     const epFile = episodeFile();
     const claimFile = epFile + `.claim-${process.pid}-${Date.now()}`;
+    // Third instance of the B1 gate (flushEpisode and the SIGTERM salvage are the other
+    // two): this path already MOVED the buffer out of the way, so with no openable DB the
+    // `unlinkSync(claimFile)` below would destroy it just as surely — and the 1h orphan
+    // sweep would have eaten a restored-but-unnoticed claim file anyway. Open once, and
+    // put the buffer back under its real name when the save cannot happen.
+    let claimDb;
     try {
       renameSync(epFile, claimFile);
+      claimDb = openDb();
       try {
-        const episode = JSON.parse(readFileSync(claimFile, 'utf8'));
+        const episode = claimDb ? JSON.parse(readFileSync(claimFile, 'utf8')) : null;
         if (episode && episode.entries && episode.entries.length > 0 && episodeHasSignificantContent(episode)) {
           if (!episode.sessionId) episode.sessionId = sessionId;
           if (!episode.project) episode.project = project;
@@ -519,7 +593,7 @@ async function handleStop() {
             if (!episodeHasSignificantContent(sub)) continue;
             try {
               const obs = buildImmediateObservation(sub);
-              const id = saveObservation(obs, sub.project, sub.sessionId);
+              const id = saveObservation(obs, sub.project, sub.sessionId, claimDb);
               if (id) sub.savedId = id;
             } catch (e) { debugCatch(e, 'handleStop-fallback-immediateSave'); }
             const flushFile = join(RUNTIME_DIR, `ep-flush-${Date.now()}-${randomUUID().slice(0, 8)}.json`);
@@ -528,7 +602,15 @@ async function handleStop() {
           }
         }
       } finally {
-        try { unlinkSync(claimFile); } catch {}
+        if (claimDb) {
+          try { unlinkSync(claimFile); } catch {}
+          try { claimDb.close(); } catch { /* already gone */ }
+        } else {
+          // Nothing was (or could be) persisted — restore the buffer under its real name
+          // so the next fire retries it. If even the rename fails, the claim file stays
+          // and the 1h orphan sweep collects it, which is the pre-B1 behaviour.
+          try { renameSync(claimFile, epFile); } catch { /* leave it for sweepOrphanEpisodeFiles */ }
+        }
       }
     } catch (e) { debugCatch(e, 'handleStop-fallback'); }
   }
@@ -1767,9 +1849,19 @@ try {
     case 'auto-maintain':    handleAutoMaintain(); break;
     case 'llm-optimize':   await handleLLMOptimize(); break;
     // Detached update refresh spawned by handleSessionStart (audit P3d) — does the
-    // GitHub fetch + (non-plugin) install off the SessionStart critical path,
-    // writing update-state.json so the NEXT session's cached banner is fresh.
-    case 'update-check':     await checkForUpdate(); break;
+    // GitHub fetch off the SessionStart critical path, writing update-state.json so
+    // the NEXT session's cached banner is fresh.
+    //
+    // F6 staging: the detached update-check worker has not run since v2.85.0
+    // (missing from BG_EVENTS). Restore the check + banner first; re-enable the
+    // self-replacing install in a follow-up once this path has proven itself, so a
+    // failure in either half is attributable. Without the option, hook-update.mjs's
+    // `allowInstall = options.allowInstall ?? !pluginMode` defaults to TRUE on a
+    // direct / settings.json install, so fixing F6 would switch a ten-week-dormant
+    // self-installer back on in the same release that resurrects the worker. The
+    // module default and the installer's own guards are unchanged — install.mjs
+    // still passes allowInstall:true for the explicit, user-invoked update.
+    case 'update-check':     await checkForUpdate({ allowInstall: false }); break;
   }
 } catch (err) {
   // Log fatal errors (ungated) with structured format. ERR_DLOPEN_FAILED (an

package/hooks/hooks.json

@@ -72,6 +72,16 @@
             "timeout": 5
           }
         ]
+      },
+      {
+        "matcher": "Edit|Write|NotebookEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/hook-launcher.mjs\" scripts/post-tool-recall.js",
+            "timeout": 3
+          }
+        ]
       }
     ],
     "Stop": [

package/install.mjs

@@ -679,6 +679,24 @@ const memPostToolUse = {
   }]
 };
 
+// Component 2 of the bind-salience forcing function: after an Edit/Write, flag an
+// identifier the file's own lesson named that the edit just removed (component 1 is the
+// pre-edit directive from scripts/pre-tool-recall.js, which also records the identifiers
+// this one checks). Shipped, signed and tested since it was written, but registered in
+// NEITHER registry — so `CLAUDE_MEM_SALIENCE=bind` delivered half the mechanism and
+// nothing said so (audit B6, 2026-08-14). Matched on the edit tools only, NOT Read: there
+// is no post-edit state to compare after a read. Inert (returns before touching stdin)
+// unless CLAUDE_MEM_SALIENCE=bind, so the default chain pays one short-circuit spawn per
+// edit and emits nothing.
+const memPostToolRecall = {
+  matcher: 'Edit|Write|NotebookEdit',
+  hooks: [{
+    type: 'command',
+    command: nodeHook('scripts/post-tool-recall.js'),
+    timeout: 3
+  }]
+};
+
 const memSessionStart = {
   matcher: 'startup|clear|compact',
   hooks: [{
@@ -697,6 +715,21 @@ const memStop = {
   }]
 };
 
+// Fires immediately BEFORE auto-compaction, re-emitting <claude-mem-context> so the
+// summarizer that rewrites the transcript still has memory in scope (SessionStart's
+// compact matcher fires AFTER, when the context is already gone). Parity with
+// hooks/hooks.json: omitting it here made every settings.json install lose exactly the
+// block that exists to survive compaction, invisibly — doctor only ever asked "are ANY
+// mem hooks present", never "which events" (audit B3, 2026-08-14).
+const memPreCompact = {
+  matcher: '*',
+  hooks: [{
+    type: 'command',
+    command: nodeHook('hook.mjs', 'pre-compact'),
+    timeout: 5
+  }]
+};
+
 const memUserPrompt = {
   matcher: '*',
   hooks: [
@@ -754,9 +787,14 @@ const memPreAgentInject = {
 
 // Filter out existing mem hooks, then append fresh ones
 // PreToolUse has three separate matchers, so we register all three
+// Event set MUST stay equal to hooks/hooks.json's (minus scripts/setup.sh, which
+// bootstraps the plugin cache and has no settings.json counterpart) —
+// tests/audit-silent-20260814.test.mjs diffs a real `install --dev` run's
+// settings.json against the shipped manifest and reds on any new divergence.
 const hookConfigs = {
   PreToolUse: [memPreToolRecall, memPreSkillBridge, memPreAgentInject],
-  PostToolUse: [memPostToolUse],
+  PostToolUse: [memPostToolUse, memPostToolRecall],
+  PreCompact: [memPreCompact],
   SessionStart: [memSessionStart],
   Stop: [memStop],
   UserPromptSubmit: [memUserPrompt],
@@ -768,7 +806,10 @@ for (const [event, configs] of Object.entries(hookConfigs)) {
 }
 
 writeSettings(settings);
-ok('Hooks configured (PreToolUse, PostToolUse, SessionStart, Stop, UserPromptSubmit)');
+// Derived from the map, not a parallel literal: the pre-B3 line said five events and
+// kept saying five after the map changed, which is how a missing registration reads as
+// a successful one.
+ok(`Hooks configured (${Object.keys(hookConfigs).join(', ')})`);
 }
 
 function backupLegacyClaudeMemData() {

package/lib/recall-core.mjs

@@ -13,6 +13,13 @@ import { notLowSignalTitleClause } from '../utils.mjs';
  * { filename, rows } where rows carry the column superset both surfaces render.
  * Side effect: bumps access_count / last_accessed_at on every returned row —
  * recall IS engagement, and the tier/decay system feeds on these counters.
+ *
+ * `superseded_at IS NULL` is load-bearing twice over (audit B2, 2026-08-14): recall was
+ * the ONE retrieval path missing it, so a lesson a later save explicitly retracted
+ * (`--supersedes N`) was still served to an agent about to edit that very file — and the
+ * access-count bump below runs over exactly these rows, so the tombstone was ALSO pushed
+ * back up the decay/tier system on every read. `includeNoise` is about LOW_SIGNAL titles
+ * and must not reach this clause: nobody asks for retracted content.
  */
 export function recallByFile(db, file, { limit = 10, includeNoise = false } = {}) {
   const filename = basename(file);
@@ -25,6 +32,7 @@ export function recallByFile(db, file, { limit = 10, includeNoise = false } = {}
     FROM observations o
     JOIN observation_files of2 ON of2.obs_id = o.id
     WHERE COALESCE(o.compressed_into, 0) = 0
+      AND o.superseded_at IS NULL
       AND (of2.filename = ? OR of2.filename LIKE ? ESCAPE '\\')
       ${noiseClause}
     ORDER BY o.created_at_epoch DESC

package/mem-cli.mjs

@@ -43,7 +43,7 @@ import { readFileSync, existsSync, readdirSync } from 'fs';
 // move each cmdXxx into its own cli/<cmd>.mjs; mem-cli.mjs becomes pure dispatch.
 import { isNativeBindingError, healAndReexec } from './lib/binding-probe.mjs';
 import { CLI_PATH, CLI_INVOKE } from './cli-path.mjs';
-import { parseArgs, out, fail, relativeTime, fmtDateShort, parseIdToken, formatProbeHints, rejectBareStringFlags, resolvePositionalAlias, suggestUnknownFlags, OBS_TIME_FIELDS, formatObsFieldValue } from './cli/common.mjs';
+import { parseArgs, out, outVerbatim, fail, relativeTime, fmtDateShort, parseIdToken, formatProbeHints, rejectBareStringFlags, resolvePositionalAlias, suggestUnknownFlags, OBS_TIME_FIELDS, formatObsFieldValue, obsFieldLabel, formatPendingPurgeLine } from './cli/common.mjs';
 import { saveObservation } from './lib/save-observation.mjs';
 import { rebuildObservationDerived, normalizeScope, insertObservationVector } from './lib/observation-write.mjs';
 import { EXPORT_COLUMNS_SQL } from './lib/export-columns.mjs';
@@ -533,7 +533,7 @@ function renderObsRows(db, ids, requestedFields) {
       const formatted = formatObsFieldValue(f, val);
       const maxLen = f === 'narrative' ? 1000 : f === 'lesson_learned' ? 500 : f === 'text' ? 500 : 200;
       const display = typeof formatted === 'string' && formatted.length > maxLen ? formatted.slice(0, maxLen) + '…' : formatted;
-      lines.push(`${f}: ${display}`);
+      lines.push(`${obsFieldLabel(f)}: ${display}`);
     }
     parts.push(lines.join('\n'));
   }
@@ -1327,7 +1327,13 @@ function cmdContext(db, args) {
     }
     out(JSON.stringify(result, null, 2));
   } else {
-    out(`<claude-mem-context>\n${block}\n</claude-mem-context>`);
+    // outVerbatim: `context` is the one CLI command that must EMIT a real
+    // <claude-mem-context> wrapper — it prints the same block the SessionStart hook
+    // injects, so `out`'s defang would strip the delimiters this command exists to
+    // produce (the CLI twin of why <skill-loaded> is excluded from CONTEXT_DELIMITER_RE).
+    // The untrusted half is already neutralized one layer up: buildSessionContextLines
+    // defangs every row it renders, so only the trusted wrapper is written raw here.
+    outVerbatim(`<claude-mem-context>\n${block}\n</claude-mem-context>`);
   }
 }
 
@@ -1714,15 +1720,20 @@ function cmdExport(db, args) {
     //   jsonl → 0 lines (valid empty file)
     // The friendly note goes to stderr so it doesn't poison stdout for callers
     // piping to a parser.
-    if (format === 'json') out('[]');
+    if (format === 'json') outVerbatim('[]');
     process.stderr.write('[mem] No observations found matching criteria\n');
     return;
   }
 
+  // outVerbatim, NOT out: `out` neutralizes structural context delimiters (cli/common.mjs)
+  // because CLI stdout is model context — but this stream is a BACKUP that `restore` reads
+  // back, so defanging it would silently rewrite any row whose text legitimately contains
+  // `<system-reminder>`/`</claude-mem-context>` and persist the rewrite on restore. Mirrors
+  // safeHandler(mem_export, { verbatim: true }) on the MCP side (audit 2026-08-14 A1).
   if (format === 'jsonl') {
-    for (const r of rows) out(JSON.stringify(r));
+    for (const r of rows) outVerbatim(JSON.stringify(r));
   } else {
-    out(JSON.stringify(rows, null, 2));
+    outVerbatim(JSON.stringify(rows, null, 2));
   }
 
   if (limitGiven && rows.length >= limit) {
@@ -1971,7 +1982,7 @@ function cmdMaintain(db, args) {
     out(`  Broken (no title/narrative): ${stats.broken}`);
     out(`  Boostable (accessed>3, imp<3): ${stats.boostable}`);
     out(`  Pinned-but-uncited (inj>=${PINNED_INJ_THRESHOLD}, cited=0, imp>1): ${stats.pinned} — run: maintain execute --ops demote_pinned`);
-    out(`  Pending purge: ${stats.pendingPurge} (compressed originals awaiting cleanup)`);
+    out(formatPendingPurgeLine(stats.pendingPurge));
     if (duplicates.length > 0) {
       const autoMergeable = duplicates.filter(d => parseFloat(d.similarity) >= AUTO_MERGE_THRESHOLD);
       const manualReview = duplicates.filter(d => parseFloat(d.similarity) < AUTO_MERGE_THRESHOLD);
@@ -3119,8 +3130,12 @@ async function cmdOptimize(db, args) {
     if (project) out(`  Project filter: ${project}`);
     out(`  Re-enrich candidates: ${preview.reenrich}${preview.reenrichWide !== undefined && preview.reenrichWide !== null ? `  (wide scope: ${preview.reenrichWide})` : ''}${preview.reenrichAliases ? `  (aliases scope: ${preview.reenrichAliases})` : ''}`);
     out(`  Normalize: ${preview.normalizeGateOpen ? `${preview.normalize} unique concepts` : 'gate closed (7-day interval)'}`);
-    out(`  Cluster-merge: ${preview.clusterMerge} clusters`);
-    out(`  Smart-compress: ${preview.smartCompress} clusters`);
+    // "candidates" matches the MCP wording (server.mjs mem_optimize preview) AND the
+    // Re-enrich line just above, which already read that way on both surfaces. The two
+    // surfaces render one optimizePreview() result — tests/audit-findings-20260814.test.mjs
+    // drives both and compares the label lists, so the drift cannot reopen.
+    out(`  Cluster-merge candidates: ${preview.clusterMerge} clusters`);
+    out(`  Smart-compress candidates: ${preview.smartCompress} clusters`);
     out(`  Total: ${preview.total} items`);
     if (verbose) {
       out('');
@@ -3194,7 +3209,7 @@ export async function run(argv) {
   for (const { flag, suggestion } of suggestUnknownFlags(parseArgs(cmdArgs).flags)) {
     process.stderr.write(suggestion
       ? `[mem] Unknown flag --${flag}; did you mean --${suggestion}?\n`
-      : `[mem] Unknown flag --${flag} — ignored (it filtered nothing). Run "claude-mem-lite help" for this command's flags.\n`);
+      : `[mem] Unknown flag --${flag} — ignored, it had no effect. Run "claude-mem-lite help" for this command's flags.\n`);
   }
 
   // adopt / unadopt do pure filesystem work on ~/.claude/projects/<encoded>/memory/ —

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.61.0",
+  "version": "3.62.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "claude-mem-lite",
-      "version": "3.61.0",
+      "version": "3.62.0",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.26.0",
         "better-sqlite3": "^12.6.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.61.0",
+  "version": "3.62.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",

package/scripts/user-prompt-search.js

@@ -114,7 +114,7 @@ const OR_TOP_BM25_FLOOR = TOP_REL_FLOOR === 0
   ? 0
   : Number(process.env.CLAUDE_MEM_UPS_OR_BM25_MIN || 30);
 
-// ─── Corpus-size normalization of the absolute floors (v3.60.2) ─────────────
+// ─── Corpus-size normalization of the absolute floors (v3.61.0) ─────────────
 //
 // Both floors above are ABSOLUTE magnitudes, but the quantity they gate is not
 // scale-free: FTS5 bm25 carries an IDF term ≈ ln(N/df), so the SAME hit scores

package/secret-scrub.mjs

@@ -30,16 +30,45 @@ export const SECRET_PATTERNS = [
   // value is covered (the hex-only assignment pattern below misses non-hex values).
   //   1a. `=` assignment → ALWAYS scrub (config syntax, never prose):
   [/((?:\b|_)(?:password|passwd|passphrase|token|bearer|secret)\s*=\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi, '$1***'],
-  //   1b. `:` separator, PASSWORD nouns → always scrub. The prose lookbehind below
-  //       was originally applied to the whole noun class, which meant any credential
-  //       noun preceded by an English word escaped — so a session narrative like
-  //       "deployed to staging, the db password: hunter2correct" persisted the
-  //       password in plaintext and re-injected it into every later context block
-  //       (R5 dogfood, 2026-08-13). Unlike `token`/`bearer`/`secret`, the pinned
-  //       prose set (#8283) contains no `password|passwd|passphrase` case: writing
-  //       "<word> password: <6+ chars>" names a credential, it is not conversational
-  //       usage. Letter-glued non-keywords (`mypassword:`) still miss via `(?:\b|_)`.
-  [/((?:\b|_)(?:password|passwd|passphrase)\s*:\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi, '$1***'],
+  //   1b. `:` separator, PASSWORD nouns. Position decides how permissive the value
+  //       class may be, because the two positions have opposite error costs.
+  //
+  //       CONFIG position (start of line, or not preceded by an English word +
+  //       space) is unambiguous assignment syntax → scrub any value, exactly as
+  //       before. Pinned by the `  password: hunter2` indent cases.
+  //
+  //       PROSE position ("<word> password: …") is where v3.61.0 first removed the
+  //       lookbehind outright, to stop "deployed to staging, the db password:
+  //       hunter2correct" from persisting a credential. That closed a leak by
+  //       trading it for something worse: scrubbing runs on the WRITE path, and the
+  //       value class matches ordinary English, so "Reset the password: instructions
+  //       are in the onboarding doc" was stored irreversibly as "password: *** are
+  //       in the onboarding doc" (caught by independent pre-tag review). The claim
+  //       that "<word> password: <6+ chars>" always names a credential was simply
+  //       false. So in prose position the VALUE must look like a credential: not a
+  //       run of lowercase letters. A digit, any uppercase, or a symbol qualifies —
+  //       `hunter2correct`, `S3cretValue`, `correct-horse-battery-staple` all scrub,
+  //       while `instructions` / `rotation` / `yesterday` are left alone.
+  //
+  //       "Credential-shaped" is spelled as: NOT a single run of ≤15 letters. The
+  //       patterns carry `i`, so the letter class is case-insensitive by
+  //       construction — deliberately, because prose capitalizes ("Reset the
+  //       password: Instructions are in the doc" must survive, and a
+  //       lowercase-only test would corrupt it). The length bound is what still
+  //       catches a letters-only secret: English words in prose run short, secrets
+  //       do not, so `aVeryLongOpaqueSecretToken` (26) scrubs while `instructions`
+  //       (12) does not.
+  //
+  //       Two known, accepted gaps: a short letters-only password in prose position
+  //       ("the password: hunter") survives, and an English word longer than 15
+  //       letters is over-scrubbed. Config position still catches the former; the
+  //       latter is rare in prose and errs toward protecting a secret. A value
+  //       indistinguishable from an English word cannot be told from one without
+  //       corrupting prose — which is exactly the error this arm exists to undo.
+  //       Both arms emit `***` (3 chars, under the {6,} floor), so they cannot
+  //       double-apply.
+  [/((?<![A-Za-z][ \t])(?:\b|_)(?:password|passwd|passphrase)\s*:\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi, '$1***'],
+  [/((?:\b|_)(?:password|passwd|passphrase)\s*:\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)(?![A-Za-z]{1,15}(?=[\s,;'"}\]]|$))[^\s,;'"}\]]{6,}/gi, '$1***'],
   //   1c. `:` separator, prose-ambiguous nouns → keep the lookbehind ("the token: alice"):
   [/((?<![A-Za-z][ \t])(?:\b|_)(?:token|bearer|secret)\s*:\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi, '$1***'],
   // access_token / refresh_token are the canonical OAuth2 field names — they were

package/server.mjs

@@ -27,8 +27,11 @@ import { effectiveQuiet, RUNTIME_DIR } from './hook-shared.mjs';
 import { TIER_CASE_SQL, tierSqlParams } from './tier.mjs';
 import { computeStatsFeed } from './lib/stats-core.mjs';
 import { buildLessonNudge } from './lib/save-nudge.mjs';
-import { formatObsFieldValue } from './cli/common.mjs';
-import { neutralizeContextDelimiters } from './format-utils.mjs';
+import { formatObsFieldValue, obsFieldLabel, formatPendingPurgeLine } from './cli/common.mjs';
+// The partial-export warning points the caller at the CLI twin, which exports the complete
+// set by default — the invocation has to be the one that actually works on this install.
+import { CLI_INVOKE } from './cli-path.mjs';
+import { neutralizeContextDelimiters, neutralizeSkillDelimiters } from './format-utils.mjs';
 import { memSearchSchema, memRecentSchema, memTimelineSchema, memGetSchema, memDeleteSchema, memSaveSchema, memStatsSchema, memCompressSchema, memMaintainSchema, memOptimizeSchema, memUpdateSchema, memExportSchema, memRecallSchema, memFtsCheckSchema, memRegistrySchema, memBrowseSchema, memUseSchema, memDeferSchema, memDeferListSchema, memDeferDropSchema, tools as TOOL_DEFS } from './tool-schemas.mjs';
 
 // Lookup helper: all user-facing tool descriptions live in tool-schemas.mjs
@@ -638,7 +641,7 @@ server.registerTool(
           // gets a scannable hint instead of a bare millisecond integer.
           const display = formatObsFieldValue(f, val);
           const maxLen = f === 'narrative' ? 1000 : f === 'lesson_learned' ? 500 : f === 'text' ? 500 : 200;
-          lines.push(`${f}: ${typeof display === 'string' && display.length > maxLen ? display.slice(0, maxLen) + '…' : display}`);
+          lines.push(`${obsFieldLabel(f)}: ${typeof display === 'string' && display.length > maxLen ? display.slice(0, maxLen) + '…' : display}`);
         }
         sections.push(lines.join('\n'));
       }
@@ -1113,7 +1116,7 @@ server.registerTool(
         `  Stale (>30d, imp=1, no access, never injected): ${stats.stale}`,
         `  Broken (no title/narrative): ${stats.broken}`,
         `  Boostable (accessed>3, imp<3): ${stats.boostable}`,
-        `  Pending purge (idle-marked): ${stats.pendingPurge}`,
+        formatPendingPurgeLine(stats.pendingPurge),
       ];
       if (duplicates.length > 0) {
         const autoMergeable = duplicates.filter(d => parseFloat(d.similarity) >= AUTO_MERGE_THRESHOLD);
@@ -1567,6 +1570,11 @@ server.registerTool(
 
 // ─── Tool: mem_use ──────────────────────────────────────────────────────────
 
+// Cap on the caller-supplied name echoed back in a miss message. Well past any real
+// skill/agent name (the longest registered one here is 23 chars), short enough that an
+// unbounded argument cannot pad the response — the echo appears twice.
+const ECHO_NAME_MAX = 80;
+
 server.registerTool(
   'mem_use',
   {
@@ -1582,8 +1590,8 @@ server.registerTool(
     const name = args.name.trim();
     const type = args.type || 'skill';
 
-    // 1. Exact match by name or invocation_name
-    let row = rdb.prepare(`
+    // 1. Exact match by name or invocation_name — the ONLY path that loads content.
+    const row = rdb.prepare(`
       SELECT id, name, type, local_path, invocation_name, capability_summary
       FROM resources
       WHERE status = 'active' AND type = ?
@@ -1591,16 +1599,36 @@ server.registerTool(
       LIMIT 1
     `).get(type, name, name);
 
-    // 2. Fuzzy fallback: FTS5 search, take top result
+    // 2. Name miss → SUGGEST, never substitute. The FTS5 search still runs (it is what
+    // produces the candidate list), but its result is only ever rendered as names: loading
+    // the top hit under the caller's requested name shipped a different skill's body inside
+    // <skill-loaded> plus "Follow the instructions above to execute this <type>." — with
+    // nothing marking the swap, so an agent that asked for A executed B (audit F1,
+    // 2026-08-14: with only `deploy-rollback-runbook` registered, `deploy-notes` /
+    // `rollback-checklist` / `runbook-index` each returned its full body). Loading stays an
+    // exact-name decision the caller makes.
     if (!row) {
-      const results = searchResources(rdb, name, { type, limit: 1 });
-      if (results.length > 0) {
-        row = rdb.prepare(`SELECT id, name, type, local_path, invocation_name, capability_summary FROM resources WHERE name = ? AND type = ? AND status = 'active'`).get(results[0].name, results[0].type);
+      let candidates = [];
+      try { candidates = searchResources(rdb, name, { type, limit: 5 }).map((r) => r.name).filter(Boolean); }
+      catch { /* a suggestion is best-effort; the miss message below still stands */ }
+      // Every echo of the caller's own name below is bounded + delimiter-inert (audit F7):
+      // raw interpolation let a crafted `name` forge a <skill-loaded> block and the execute
+      // imperative inside this message, and the handler-wide defangResult cannot catch it —
+      // <skill-loaded> is off CONTEXT_DELIMITER_RE precisely so the real load path can emit
+      // it. `truncate` also folds newlines, so a multi-line name cannot fake block structure.
+      // Registered names are defanged too (a crafted one can be imported), but NOT truncated:
+      // the suggestion tells the caller to load one by its exact name, so it must stay exact.
+      const echoed = neutralizeSkillDelimiters(truncate(name, ECHO_NAME_MAX));
+      const echoedCandidates = candidates.map((n) => neutralizeSkillDelimiters(n));
+      const head = `No ${type} found for "${echoed}".`;
+      const browse = `mem_registry(action="search", query="${echoed}")`;
+      if (candidates.length === 0) {
+        return { content: [{ type: 'text', text: `${head} Try ${browse} to browse.` }] };
       }
-    }
-
-    if (!row) {
-      return { content: [{ type: 'text', text: `No ${type} found for "${name}". Try mem_registry(action="search", query="${name}") to browse.` }] };
+      const list = echoedCandidates.map((n) => `  - ${n}`).join('\n');
+      return { content: [{ type: 'text', text:
+        `${head} Closest ${type}s by search (NOT loaded — none matched the name you asked for):\n${list}\n\n` +
+        `Load one deliberately with its exact name, e.g. mem_use(name="${echoedCandidates[0]}"${type === 'skill' ? '' : `, type="${type}"`}), or browse with ${browse}.` }] };
     }
 
     // 3. Resolve path: directory skills → SKILL.md (agents always have full .md paths)
@@ -1717,7 +1745,13 @@ async function runExport(db, args) {
   }
 
   const where = wheres.length > 0 ? 'WHERE ' + wheres.join(' AND ') : '';
-  const exportLimit = Math.min(args.limit ?? 200, 1000);
+  // No clamp (audit 2026-08-14 A2): `Math.min(args.limit ?? 200, 1000)` made an MCP-driven
+  // backup of a >1000-row store impossible, on the tool whose own description says "USE
+  // when: Backing up memory before a migration or reinstall" — while the CLI twin exported
+  // the complete matching set (mem-cli.mjs cmdExport, fixed there for the same reason). The
+  // DEFAULT stays 200: an MCP result is model context, so a bare exploratory call must not
+  // dump a whole store into the transcript. An explicit limit is now honoured at any size.
+  const exportLimit = args.limit ?? 200;
   // T3-P2-B: probe limit+1 so we can tell "user hit their own limit with more waiting" from
   // "user got exactly what existed". Trim to exportLimit before rendering.
   // EXPORT_COLUMNS_SQL: shared with CLI cmdExport — the full round-trippable set restore
@@ -1733,7 +1767,27 @@ async function runExport(db, args) {
     ? rows.map(r => JSON.stringify(r)).join('\n')
     : JSON.stringify(rows, null, 2);
 
-  const cap = moreAvailable ? `\nNote: Results capped at ${exportLimit}. Use date_from/date_to or increase limit (max 1000) to export more.` : '';
+  // A truncated backup is the failure mode this tool must never produce quietly: the old
+  // note ("Results capped at N … increase limit (max 1000)") never said how much was
+  // missing, and its advice was a dead end on a store past the ceiling. Name the real
+  // total, the number of rows left out, and a remedy that actually returns all of them.
+  //
+  // The remedy has to lead with a FILE REDIRECT (pre-tag review, 2026-08-14). Removing the
+  // 1000-row ceiling took away the only bound on an MCP export's size, and the 200 default
+  // is kept precisely because an MCP result IS model context — so "re-run with
+  // limit: <total>", the previous first suggestion, told the caller to put the entire store
+  // into one tool result (thin fixture rows measure ~612 bytes each, so a few-thousand-row
+  // store is megabytes in a single message), and a bare `cli.mjs export` had the same
+  // property unredirected. The limit re-run stays mentioned but demoted, with its cost
+  // stated: it is occasionally what the caller actually wants, and silently dropping it
+  // would send them back to guessing.
+  let cap = '';
+  if (moreAvailable) {
+    const total = db.prepare(`SELECT COUNT(*) AS c FROM observations ${where}`).get(...params).c;
+    cap = `\nWARNING — PARTIAL EXPORT, NOT A COMPLETE BACKUP: capped at ${exportLimit} of ${total} matching observations; ${total - exportLimit} rows are missing from this payload and restoring it would lose them.` +
+      `\nFor a complete backup, write it to a FILE instead of pulling it through this conversation: \`${CLI_INVOKE} export --format jsonl > backup.jsonl\` (the CLI exports the complete set by default). Narrowing with date_from/date_to also works.` +
+      `\nRaising \`limit\` here is the last resort, not the first: this result is model context, so all ${total} rows would be loaded into the transcript.`;
+  }
   return { content: [{ type: 'text', text: `Exported ${rows.length} observations:${cap}\n${output}` }] };
 }
 
@@ -1745,7 +1799,10 @@ server.registerTool(
   },
   // verbatim: the export payload feeds `restore` — defanging it would silently
   // rewrite backed-up rows whose text legitimately contains these tags.
-  safeHandler(async (args) => runExport(db, args), { verbatim: true })
+  safeHandler(
+    async (args) => runExport(db, applyArgAliases(args, { from: 'date_from', to: 'date_to' })),
+    { verbatim: true },
+  )
 );
 
 // ─── Tool: mem_recall ────────────────────────────────────────────────────────

package/tool-schemas.mjs

@@ -100,7 +100,7 @@ export const memSearchSchema = {
   or: coerceBool.optional().describe('Force OR semantics between query terms from the start (default: AND with automatic OR-fallback when AND returns 0). Aligns with CLI --or.'),
   deep: coerceBool.optional().describe('Tri-state LLM multi-query/HyDE deep search (observations-only). true=force; false=never; omit=AUTO (default ON for mem_search): a normal search that returns weak/few results auto-escalates with ONE Haiku call (query rewritten to keyword/concept/HyDE variants, RRF-fused). Set CLAUDE_MEM_AUTO_DEEP=0 to disable AUTO. Passive recall stays single-query.'),
   rerank: coerceBool.optional().describe('Opt-in: LLM-rerank the deep-search candidates for ranking precision (one extra Haiku call, ~1.4s). Requires deep=true (no effect on AUTO/normal). Reserve for hard, ranking-sensitive queries where the right memory is likely retrieved but mis-ranked — skip for routine search. Default off.'),
-  // ── CLI-flag aliases (v3.60.2) ──────────────────────────────────────────────
+  // ── CLI-flag aliases (v3.61.0) ──────────────────────────────────────────────
   // A property the schema doesn't declare is STRIPPED by the validator, so a caller
   // using the CLI vocabulary (`--source` / `--from` / `--to` / `--since`) previously
   // got the UNFILTERED answer with nothing marking the filter as dropped — a wider
@@ -206,7 +206,7 @@ export const memSaveSchema = {
   type: OBS_TYPE_ENUM.optional().describe('Observation type (default: discovery)'),
   project: z.string().optional().describe('Project name (default: inferred from CWD)'),
   importance: coerceInt.pipe(z.number().int().min(1).max(3)).optional().describe('Importance level: 1=routine, 2=notable, 3=critical (default: 2 for explicit saves)'),
-  files: coerceStringArray.optional().describe('File paths associated with this observation'),
+  files: coerceStringArray.optional().describe('File paths associated with this observation. Stored in the `files_modified` column and rendered as `files` — passing a path here does not assert the file was edited; a file you only read belongs here too'),
   lesson_learned: z.string().max(500).optional().describe('Key lesson or takeaway, ≤500 chars (for bugfix: root cause & fix; for decision: rationale)'),
   closes_deferred: coerceDeferredTokens.optional().describe('Close one or more deferred_work items in the same project. Mixed array: bare integer = ordinal-within-project, "D#<n>" string = raw id. Transactional with the obs insert — a single invalid id rolls back the whole save.'),
   supersedes: coerceSupersedes.optional().describe('Observation ids (same project) that this save overturns. They are marked superseded — dropped from live search — and linked to the new row (superseded_by). Use ONLY when this genuinely replaces a prior conclusion; do NOT use for merely-related or updated-but-still-valid memories.'),
@@ -274,8 +274,19 @@ export const memExportSchema = {
   format: z.enum(['json', 'jsonl']).optional().describe('Output format (default: json)'),
   date_from: z.string().optional().describe('Start date (ISO 8601 or YYYY-MM-DD)'),
   date_to: z.string().optional().describe('End date (ISO 8601 or YYYY-MM-DD)'),
+  // CLI-flag aliases — `export` reads flags.from / flags.to (mem-cli.mjs). Same
+  // silent-drop defect the search/recent aliases fix, and the widest blast radius of
+  // the three: an ignored bound exports the whole DB instead of a date slice.
+  from: z.string().optional().describe('Alias for `date_from` (CLI `export --from`)'),
+  to: z.string().optional().describe('Alias for `date_to` (CLI `export --to`)'),
   include_compressed: coerceBool.optional().describe('Include compressed observations (default: false)'),
-  limit: coerceInt.pipe(z.number().int().min(1).max(1000)).optional().describe('Max observations to export (default: 200, max: 1000)'),
+  // No upper bound: this is the BACKUP tool ("USE when: Backing up memory before a
+  // migration or reinstall"), and a 1000-row ceiling made a complete backup of a bigger
+  // store impossible over MCP while the CLI twin exported everything (audit 2026-08-14 A2).
+  // The default stays 200 because an MCP result is model context — a bare exploratory call
+  // must not dump a whole store into the transcript — but a capped result now announces
+  // itself as PARTIAL and names the limit that would return all of it.
+  limit: coerceInt.pipe(z.number().int().min(1)).optional().describe('Max observations to export (default: 200 — a capped result is flagged PARTIAL and names the total; pass that total for a complete backup, no upper bound)'),
 };
 
 export const memRecallSchema = {
@@ -584,7 +595,8 @@ export const tools = [
   {
     name: 'mem_use',
     description:
-      'Load and activate a skill or agent from the registry by name (exact or fuzzy).\n' +
+      'Load and activate a skill or agent from the registry by EXACT name or invocation_name.\n' +
+      'A name that matches nothing returns closest-match names to pick from — never another resource\'s content.\n' +
       '\n' +
       'DO NOT use when:\n' +
       '  - You have not confirmed the skill exists (run mem_registry action="list" first)\n' +