claude-mem-lite 3.61.1 → 3.63.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "3.61.1",
+      "version": "3.63.0",
       "source": "./",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."
     }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.61.1",
+  "version": "3.63.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/README.md

@@ -529,6 +529,32 @@ Notes:
 - Direct install / npx mode keeps auto-update enabled and uses staged replacement with rollback on install failure.
 - If you disabled the plugin but still have old mem hooks in `~/.claude/settings.json`, run `node install.mjs cleanup-hooks`.
 
+#### Trust model per install path
+
+The three install paths do **not** carry the same supply-chain guarantees — pick the one that matches your threat model:
+
+| Path | Update mechanism | Ed25519 release-signature verification |
+|------|------------------|----------------------------------------|
+| npm / npx / git-clone direct install | auto-update from GitHub Releases | **Yes** — every runtime file (140 entries incl. hook scripts, MCP launcher, plugin declaration files) is hash-pinned in a signed manifest; verification is fail-closed |
+| `/plugin install` (marketplace) | manual `/plugin marketplace update` + reinstall | **No** — Claude Code installs from a git clone of the marketplace repo; the plugin's own signature chain is not consulted on this path. You are trusting GitHub + the repo's branch protection, not the release signing key |
+
+**Rollback recipe (plugin path).** If an update misbehaves, pin the marketplace clone to the previous release tag and reinstall from it:
+
+```bash
+# 1. Find the local marketplace clone
+ls ~/.claude/plugins/marketplaces/          # e.g. sdsrss
+
+# 2. Pin it to the previous good tag (tags mirror npm versions, e.g. v3.62.0)
+cd ~/.claude/plugins/marketplaces/sdsrss
+git fetch --tags && git checkout v3.62.0
+
+# 3. Reinstall from the pinned clone — inside Claude Code:
+#    /plugin install claude-mem-lite@sdsrss
+# 4. To leave the pin later: git checkout main, then the normal update flow.
+```
+
+Your data directory (`~/.claude-mem-lite/`) is untouched by install/rollback; schema migrations are forward-only, so after rolling back more than one minor version check `node install.mjs doctor` before trusting search results.
+
 ### doctor
 
 Checks Node.js version, dependencies, server/hook files, database integrity, FTS5 indexes, and stale processes.

package/cli/common.mjs

@@ -2,10 +2,13 @@
 // Extracted from mem-cli.mjs (v2.41) as first step in the god-module split.
 //
 // Scope: pure utilities only. No DB, no imports from other cli/ files; only
-// `lib/` leaf utilities may be re-exported through here (currently:
-// parseIdToken). This module is the single source of truth for stdout/stderr
-// framing, arg parsing, ID-token parsing, and relative-time formatting —
-// every command imports from here so the CLI stays consistent.
+// leaf utilities from `lib/` and the repo root may be pulled in (currently:
+// parseIdToken, neutralizeContextDelimiters). This module is the single source
+// of truth for stdout/stderr framing, arg parsing, ID-token parsing, and
+// relative-time formatting — every command imports from here so the CLI stays
+// consistent.
+
+import { neutralizeContextDelimiters } from '../format-utils.mjs';
 
 // ─── Argument Parsing ────────────────────────────────────────────────────────
 
@@ -85,8 +88,41 @@ export function parseArgs(argv) {
 
 // ─── Output Helpers ──────────────────────────────────────────────────────────
 
-/** Write a line to stdout. */
+/**
+ * Write a line to stdout, with structural context delimiters neutralized.
+ *
+ * CLI stdout IS model context, not just a human channel: commands/mem.md routes
+ * `/mem search|get|recall|timeline` to `node cli.mjs … via Bash`, and
+ * buildServerInstructions actively tells the agent the Bash CLI is the CHEAPER path
+ * than the MCP tool. The MCP read family has been defanged since v3.61 at its own
+ * chokepoint (server.mjs safeHandler), but the CLI twins printed stored text raw —
+ * so the exact indirect-prompt-injection channel the MCP defang closes stayed open on
+ * the surface the instructions recommend (audit 2026-08-14 A1). Observations are
+ * stored raw on purpose (defense lives at the injection boundary, not at save), so it
+ * has to happen here, at the write.
+ *
+ * `out` is the single stdout writer for every command in mem-cli.mjs and cli/*.mjs,
+ * so a NEW read command is covered by construction (§9 parallel-path completeness).
+ * Payloads that must round-trip byte-exact use `outVerbatim` instead — see below.
+ * The transform is idempotent (it strips brackets, it does not re-add them), so a
+ * path that already defanged upstream — `context` → buildSessionContextLines — is
+ * unaffected.
+ */
 export function out(text) {
+  // String() first: neutralizeContextDelimiters coerces nullish to '', which would turn
+  // a pre-existing `out(undefined)` line from "undefined" into an empty line.
+  outVerbatim(neutralizeContextDelimiters(String(text)));
+}
+
+/**
+ * Write a line to stdout with NO defang. The CLI mirror of
+ * `safeHandler(fn, { verbatim: true })` on the MCP side, and for the same single
+ * reason: `export` is the backup half of backup/restore, so neutralizing its payload
+ * would silently rewrite every backed-up row whose text legitimately contains these
+ * tags — and `restore` would write the rewritten text back. Only use this for bytes
+ * that must survive a round trip; anything a model reads goes through `out`.
+ */
+export function outVerbatim(text) {
   process.stdout.write(text + '\n');
 }
 
@@ -260,6 +296,43 @@ export function fmtDateShort(iso) {
 // because the formatter lived only in mem-cli.mjs.
 export const OBS_TIME_FIELDS = ['superseded_at', 'last_accessed_at'];
 
+// Display labels for observation columns whose NAME misdescribes their contents.
+// `files_modified` holds whatever file list the writer attached: hook-captured rows fill
+// it from Edit/Write, but an explicit mem_save / `save --files` puts any associated path
+// there — including a file that was only read. Rendering the raw column name told the
+// reader those files were modified (audit 2026-08-14 F3). The label is `files` — the name
+// of the input parameter that fills it. The COLUMN is untouched, so `--fields
+// files_modified` / `fields:["files_modified"]` still select it. Shared by the CLI `get`
+// and MCP `mem_get` renderers so the two cannot drift.
+const OBS_FIELD_LABELS = { files_modified: 'files' };
+
+/** Reader-facing label for an observation column (identity for everything unmapped). */
+export function obsFieldLabel(field) {
+  return OBS_FIELD_LABELS[field] || field;
+}
+
+/**
+ * The `maintain scan` pending-purge line, shared by the CLI (mem-cli.mjs cmdMaintain) and
+ * the MCP mem_maintain handler (server.mjs) so the two cannot drift — same reason
+ * obsFieldLabel lives here.
+ *
+ * The count is `compressed_into = COMPRESSED_PENDING_PURGE` (lib/maintain-core.mjs:443),
+ * and the ONLY writers of that sentinel are the two idle/decay passes — decayAndMarkIdle
+ * (maintain-core.mjs:201) and runIdleCleanup (search-scoring.mjs:303). Compression writes
+ * COMPRESSED_AUTO (-1) or a positive parent id, and those rows are NOT counted. The CLI
+ * used to render this as "compressed originals awaiting cleanup", which told an operator
+ * about to run `maintain execute --ops purge_stale --confirm` that they were deleting
+ * compression leftovers when they were deleting decay-marked live originals (audit
+ * 2026-08-14 A4). Say what the rows are and what deletes them — and say nothing about
+ * compression, which is a different sentinel with a different lifecycle.
+ *
+ * @param {number} n stats.pendingPurge
+ * @returns {string} the full indented line, identical on both surfaces.
+ */
+export function formatPendingPurgeLine(n) {
+  return `  Pending purge (idle-marked): ${n} (live originals marked idle by decay — purge_stale deletes them)`;
+}
+
 // Pure formatter — null/undefined/non-time pass through; integer time fields
 // render as `<raw> (<relative>)` so callers get both an audit value and a
 // human/LLM-scannable hint, mirroring `recent`/`timeline`/`recall`.

package/format-utils.mjs

@@ -48,15 +48,100 @@ export function truncate(str, max = 80) {
 // itself, where source/observations carry the delimiter names.
 const CONTEXT_DELIMITER_RE = /<\/?(?:claude-mem-context|memory-context|session-handoff|system-reminder|task-notification|(?:antml:)?function_calls|(?:antml:)?function_results|(?:antml:)?invoke|(?:antml:)?parameter)(?:\s[^>]*)?>/gi;
 
+// Pass cap for the fixpoint loop below. 32 nested layers of a forged delimiter is far past
+// anything prose produces; the cap exists only to bound the ADVERSARIAL cost (an unbounded
+// fixpoint is O(depth \u00d7 length), i.e. quadratic on a crafted 200k-char payload, on the
+// synchronous hook/CLI write path \u2014 this repo has shipped two ReDoS findings already).
+const DEFANG_MAX_PASSES = 32;
+
+/**
+ * Strip the angle brackets of every `re` match, repeatedly, until the text stops changing.
+ *
+ * A SINGLE pass is not enough, and the gap is two characters wide: in
+ * `<<system-reminder>>` the pattern matches the INNER pair, removing it leaves the outer
+ * pair wrapped around the bare tag name, and the "defanged" output is a live
+ * `<system-reminder>` \u2014 produced by the function whose job is to make it inert (pre-tag
+ * review, 2026-08-14). Widening the pattern to also eat adjacent brackets does not fix it
+ * either: `<system-reminder <system-reminder> x>y>` re-forms `<system-reminder x>` from
+ * text the widened match keeps. Only a fixpoint closes the general case.
+ *
+ * TERMINATION: every match begins with `<` and the replacement drops it, so any pass that
+ * changes the string removes at least one `<` \u2014 the iteration is self-bounded by the number
+ * of `<` in the input, and DEFANG_MAX_PASSES bounds it again by a constant.
+ *
+ * INERT AT ANY DEPTH: if the text is still changing when the cap is reached (\u226532 nested
+ * forged layers \u2014 not reachable by accident), every remaining angle bracket is removed.
+ * That is lossier than the normal path, but the return value then provably contains no tag,
+ * which is the property callers rely on; giving up at the cap and returning still-tagged
+ * text would hand the attacker exactly the bypass the loop exists to close.
+ *
+ * @param {string} s Input string (any type; coerced)
+ * @param {RegExp} re Global tag pattern whose matches start with `<` and end with `>`
+ * @returns {string} Text containing no match of `re`
+ */
+function defangToFixpoint(s, re) {
+  let text = String(s ?? '');
+  for (let pass = 0; pass < DEFANG_MAX_PASSES; pass++) {
+    const next = text.replace(re, (m) => m.slice(1, -1));
+    if (next === text) return text;   // fixpoint: nothing left to defang
+    text = next;
+  }
+  return text.replace(/[<>]/g, '');   // pathological nesting \u2192 fail closed
+}
+
 /**
  * Defang the literal context-block delimiter tags in user-derived text. Strips just the
  * angle brackets, so `</claude-mem-context>` renders as `/claude-mem-context` \u2014 still
  * readable, but no longer a structural delimiter. Complements `mdCell`'s pipe-escaping.
+ * Iterated to a fixpoint (see defangToFixpoint): a single pass let `<<system-reminder>>`
+ * come back live.
  * @param {string} s Input string (any type; coerced)
  * @returns {string} Text with delimiter tags defanged
  */
 export function neutralizeContextDelimiters(s) {
-  return String(s ?? '').replace(CONTEXT_DELIMITER_RE, (m) => m.slice(1, -1));
+  return defangToFixpoint(s, CONTEXT_DELIMITER_RE);
+}
+
+// <skill-loaded> is deliberately NOT in CONTEXT_DELIMITER_RE above: mem_use's legitimate
+// load path has to emit a REAL one, and that result goes through the same handler-wide
+// defang, which would strip it. So the tag is neutralized here instead — per call site,
+// on the untrusted text only. Attribute-bearing openers and the bare closer both match,
+// same "strip the brackets, keep the text" treatment as the class above.
+const SKILL_BLOCK_RE = /<\/?skill-loaded(?:\s[^>]*)?>/gi;
+
+/**
+ * Defang a literal `<skill-loaded>` opener/closer in text that is about to be echoed
+ * INSIDE a mem_use response. A caller-supplied name interpolated raw could otherwise
+ * forge a whole skill block (plus its execute imperative) in a message the caller
+ * controls end to end — audit F7, 2026-08-14. Never apply this to the real load path.
+ * Same fixpoint iteration as the class above, for the same reason: one pass turned the
+ * caller-supplied `<<skill-loaded>>` back into a live `<skill-loaded>` opener.
+ * @param {string} s Input string (any type; coerced)
+ * @returns {string} Text with skill-block delimiters defanged
+ */
+export function neutralizeSkillDelimiters(s) {
+  return defangToFixpoint(s, SKILL_BLOCK_RE);
+}
+
+// <skill-bridge> is the wrapper scripts/pre-skill-bridge.js puts around a managed
+// skill body it injects as PreToolUse additionalContext. The body comes from a
+// third-party repo (tools/adopt import) — an untrusted boundary — so a literal
+// `</skill-bridge>` inside it would close the wrapper early and spill the rest of
+// the payload (e.g. a forged <system-reminder>) as undelimited context (audit
+// 2026-08-14 M-4). Not in CONTEXT_DELIMITER_RE for the same reason <skill-loaded>
+// isn't: the bridge's OWN wrapper must stay live, so the defang is applied per
+// call site to the untrusted body only.
+const SKILL_BRIDGE_RE = /<\/?skill-bridge(?:\s[^>]*)?>/gi;
+
+/**
+ * Defang a literal `<skill-bridge>` opener/closer in untrusted text that is about
+ * to be wrapped in a real skill-bridge block. Same fixpoint treatment as the
+ * classes above. Never apply to the wrapper itself.
+ * @param {string} s Input string (any type; coerced)
+ * @returns {string} Text with skill-bridge delimiters defanged
+ */
+export function neutralizeSkillBridgeDelimiters(s) {
+  return defangToFixpoint(s, SKILL_BRIDGE_RE);
 }
 
 /**

package/hook-handoff.mjs

@@ -173,11 +173,20 @@ export function buildAndSaveHandoff(db, sessionId, project, type, episodeSnapsho
     try { JSON.parse(row.files_modified).filter(isValidFile).forEach(f => fileSet.add(f)); } catch {}
   }
 
-  // 5. Key decisions — high importance observations (skip low-signal degraded titles)
+  // 5. Key decisions — high importance observations (skip low-signal degraded titles).
+  //
+  // superseded_at IS NULL, unlike `completed` and `files_modified` above: those two are
+  // the session's own history ("what happened here"), where an overturned decision still
+  // happened and erasing it would misreport the session. key_decisions is different — it
+  // is replayed to the NEXT session under "## Key Decisions" as standing policy, so a
+  // retracted decision rendered there is indistinguishable from live policy. The
+  // carry-forward fallback at the top of this function already filters the same column;
+  // this is the sibling that did not.
   const decisions = db.prepare(`
     SELECT title FROM observations
     WHERE memory_session_id = ? AND COALESCE(importance, 1) >= 2
-      AND COALESCE(compressed_into, 0) = 0 ${obsWindowClause}
+      AND COALESCE(compressed_into, 0) = 0
+      AND superseded_at IS NULL ${obsWindowClause}
     ORDER BY created_at_epoch DESC LIMIT 10
   `).all(sessionId, ...obsWindowParams).filter(d => d.title && !LOW_SIGNAL_TITLE.test(d.title)).slice(0, 5);
 

package/hook-llm.mjs

@@ -156,7 +156,7 @@ export function saveObservation(obs, projectOverride, sessionIdOverride, externa
     // (no lesson, importance<2, empty facts, thin narrative) is dropped before
     // dedup/MinHash/vector work. Opt-out: CLAUDE_MEM_KEEP_LOW_SIGNAL=1.
     if (isNoiseObservation(obs)) {
-      debugLog('saveObservation', `dropped noise: ${truncate(obs.title || '', 60)}`);
+      debugLog('DEBUG', 'saveObservation', `dropped noise: ${truncate(obs.title || '', 60)}`);
       return null;
     }
 
@@ -172,7 +172,7 @@ export function saveObservation(obs, projectOverride, sessionIdOverride, externa
     // pre-save is not lost on LLM success — that path clean-inserts a fresh row — but it loses
     // those three.) capNoiseImportance then caps any title-noise survivor to imp=1 as before.
     if (isLowYieldChangeObs(obs)) {
-      debugLog('saveObservation', `dropped low-yield change: ${truncate(obs.title || '', 60)}`);
+      debugLog('DEBUG', 'saveObservation', `dropped low-yield change: ${truncate(obs.title || '', 60)}`);
       return null;
     }
 
@@ -182,7 +182,7 @@ export function saveObservation(obs, projectOverride, sessionIdOverride, externa
     // enter the 7-day accelerated auto-compress window in hook.mjs.
     const capped = capNoiseImportance(obs);
     if (capped !== (obs.importance ?? 1)) {
-      debugLog('saveObservation', `capped imp ${obs.importance}→${capped}: ${truncate(obs.title || '', 60)}`);
+      debugLog('DEBUG', 'saveObservation', `capped imp ${obs.importance}→${capped}: ${truncate(obs.title || '', 60)}`);
       obs.importance = capped;
     }
 

package/hook-shared.mjs

@@ -7,6 +7,9 @@ import { join } from 'path';
 import { existsSync, readFileSync, writeFileSync, mkdirSync, renameSync, readdirSync, statSync, unlinkSync, chmodSync } from 'fs';
 import { inferProject, debugCatch } from './utils.mjs';
 import { ensureDbWithWalRecovery, DB_DIR } from './schema.mjs';
+// Pure-`node:`/local module (it imports only binding-probe + native-binding-hint, and
+// neither imports this file) — no cycle.
+import { recordHookError } from './lib/hook-telemetry.mjs';
 import { getClaudePath as getClaudePathShared, resolveModel as resolveModelShared, flattenForCLI as _flattenForCLI, detectMode as detectLLMMode, callHaiku } from './haiku-client.mjs';
 // Phase D: invited-memory sentinel detection. memdir.mjs/claudemd.mjs only pull in
 // fs/path/os/crypto; adopt-content.mjs is pure strings. No circular deps —
@@ -157,7 +160,17 @@ export function openDb() {
     // WAL-corruption self-heal (was server.mjs-only): without it, hooks stayed
     // silently dead (null DB) on a corrupt WAL until the next MCP server start.
     return ensureDbWithWalRecovery();
-  } catch {
+  } catch (e) {
+    // Still null, still no throw — a hook must never crash the host session, and all
+    // eight call sites in hook.mjs are written to no-op on null. But "returned null"
+    // used to be the ONLY trace: nothing reached runtime/hook-errors/, so `stats`
+    // reported 0 and doctor printed "no recent silent hook breakage" while every
+    // capture path was dead (audit B1, 2026-08-14 — the same blindness that hid the
+    // v3.60 binding outage for four days). recordHookError is the established sink;
+    // scripts/pre-tool-recall.js already logs its own db-open failures this way, and
+    // routing through it also flags the native-binding family for the session-start
+    // self-heal. The recorder swallows its own errors, so this cannot throw.
+    recordHookError('hook-shared:db-open', e, RUNTIME_DIR);
     return null;
   }
 }

package/hook.mjs

@@ -47,6 +47,7 @@ import {
 import { handleLLMEpisode, handleLLMSummary, saveObservation, buildImmediateObservation, saveEpisodeImmediate } from './hook-llm.mjs';
 import { scrubRecord } from './lib/scrub-record.mjs';
 import { formatHookError } from './lib/native-binding-hint.mjs';
+import { recordHookError } from './lib/hook-telemetry.mjs';
 import { selectCompressionCandidates, groupByProjectWeek, compressGroup } from './lib/compress-core.mjs';
 import { cleanupBroken, decayAndMarkIdle, boostAccessed, selectFuzzyDedupeIds, hardDeleteCandidateCount, purgeStale, recoverOrphanedChildren, recoverBuriedLessons, sweepDeferredWorkOrphans } from './lib/maintain-core.mjs';
 import { snapshotDb } from './lib/db-backup.mjs';
@@ -94,8 +95,14 @@ const event = process.argv[2];
 // the dispatch below exits everything else). EVERY spawnBackground/queue* event
 // MUST be listed here — a missing entry makes the detached worker exit(0)
 // silently, which looks identical to "worker ran and found nothing" from the
-// outside (live-probe catch, 2026-07-18: enrich-save no-oped on this line).
-const BG_EVENTS = new Set(['llm-episode', 'llm-summary', 'auto-compress', 'llm-optimize', 'auto-maintain', 'enrich-save']);
+// outside (live-probe catch, 2026-07-18: enrich-save no-oped on this line;
+// audit F6, 2026-08-14: update-check had been dead the same way, so the 24h
+// release check never ran and every SessionStart respawned a worker that
+// exit(0)'d before its handler).
+// `tests/audit-findings-20260814.test.mjs` scans BOTH detached spawners
+// (spawnBackground here, spawn(node,[HOOK_PATH,…]) in lib/save-enrich.mjs) and
+// reds when a spawned event is missing from this list.
+const BG_EVENTS = new Set(['llm-episode', 'llm-summary', 'auto-compress', 'llm-optimize', 'auto-maintain', 'enrich-save', 'update-check']);
 
 // Respect Claude Code plugin disable state even when legacy settings.json hooks remain.
 // install.mjs writes direct hooks into ~/.claude/settings.json, so disabling the plugin
@@ -139,8 +146,19 @@ for (const sig of ['SIGTERM', 'SIGINT']) {
           // sessions into one garbled row. planEpisodeFlush returns [ep] by reference when
           // there is ≤1 CC session (the common case → identical to before), else one sub
           // per session. Pure/sync → safe inside the signal handler.
-          for (const sub of planEpisodeFlush(ep)) saveEpisodeImmediate(sub);
-          try { unlinkSync(join(RUNTIME_DIR, `ep-${inferProject()}.json`)); } catch {}
+          // Same B1 gate as flushEpisode: without an openable DB every save below is a
+          // no-op, so deleting the buffer afterwards would destroy the very episode this
+          // handler exists to salvage. openDb is sync (safe here) and records its own
+          // failure; leaving the file untouched lets the next fire retry it.
+          const db = openDb();
+          if (db) {
+            try {
+              for (const sub of planEpisodeFlush(ep)) saveEpisodeImmediate(sub, db);
+              try { unlinkSync(join(RUNTIME_DIR, `ep-${inferProject()}.json`)); } catch {}
+            } finally {
+              try { db.close(); } catch { /* already gone */ }
+            }
+          }
         }
       } catch {}
       process.exit(0);
@@ -164,6 +182,25 @@ const RECEIPT_EVENTS = new Set(['PostToolUse', 'SessionStart', 'UserPromptSubmit
 function flushEpisode(episode, hookEventName = 'PostToolUse') {
   if (!episode || episode.entries.length === 0) return;
 
+  // Acquire the DB ONCE, up front, and bail before touching anything destructive when it
+  // will not open. Every persistence step below is a no-op without it (saveObservation
+  // returns null on a null db; the detached llm-episode worker hits the same wall), yet
+  // the `unlinkSync(episodeFile())` at the tail used to run regardless — so a DB that
+  // could not be opened deleted the session's captured work while the hook exited 0 with
+  // empty stdout AND empty stderr (audit B1, 2026-08-14). Returning here leaves the
+  // buffer on disk for the next fire to retry; openDb() has already recorded the failure
+  // under `hook-shared:db-open`. Reusing the handle for the immediate saves also drops
+  // this path from one open per sub-episode to one per flush.
+  const db = openDb();
+  if (!db) return;
+  try {
+    flushEpisodeWithDb(db, episode, hookEventName);
+  } finally {
+    try { db.close(); } catch { /* already closed / gone */ }
+  }
+}
+
+function flushEpisodeWithDb(db, episode, hookEventName) {
   // Collect Read file paths tracked by post-tool-use.sh
   // Use rename to atomically collect — prevents losing concurrent appends
   const readsFile = join(RUNTIME_DIR, `reads-${episode.project || inferProject()}.txt`);
@@ -185,7 +222,7 @@ function flushEpisode(episode, hookEventName = 'PostToolUse') {
   const subs = planEpisodeFlush(episode);
   let anySignificant = false;
   for (const sub of subs) {
-    const r = flushEpisodeGroup(sub);
+    const r = flushEpisodeGroup(sub, db);
     if (r === 'writefail') {
       // Single-group: preserve the original early return — buffer left un-unlinked
       // for a later retry, no receipt. Multi-group: skip only the failed group and
@@ -250,7 +287,7 @@ function flushEpisode(episode, hookEventName = 'PostToolUse') {
 // 'significant' | 'insignificant' | 'writefail'. CLAUDE_MEM_SKIP_EPISODE_LLM
 // suppresses the detached enrichment spawn (test determinism; sibling of
 // CLAUDE_MEM_SKIP_COMPRESS / _OPTIMIZE) — the synchronous immediate obs still lands.
-function flushEpisodeGroup(ep) {
+function flushEpisodeGroup(ep, db) {
   const isSignificant = episodeHasSignificantContent(ep);
 
   // Immediate save: rule-based observation for instant visibility; the LLM
@@ -258,7 +295,9 @@ function flushEpisodeGroup(ep) {
   if (isSignificant) {
     try {
       const obs = buildImmediateObservation(ep);
-      const id = saveObservation(obs, ep.project, ep.sessionId);
+      // `db` is flushEpisode's handle — passed in so the caller owns open/close and the
+      // whole flush is gated on one availability check (B1).
+      const id = saveObservation(obs, ep.project, ep.sessionId, db);
       if (id) ep.savedId = id;
     } catch (e) { debugCatch(e, 'flushEpisode-immediateSave'); }
   }
@@ -300,6 +339,23 @@ async function handlePostToolUse() {
 
   const { tool_name, tool_input, tool_response } = hookData;
   if (!tool_name) return;
+  // A non-string tool_name is a host-protocol violation, not a payload we can handle:
+  // `tool_name.startsWith(p)` two lines down threw a TypeError that the top-level catch
+  // absorbed, so the observation was dropped with nothing attributable behind it. Guard the
+  // type (parity with scripts/pre-skill-bridge.js:43) and RECORD it rather than dropping
+  // quietly: PostToolUse is the plugin's whole capture path, so a host field-shape change
+  // would kill every observation, and hook-errors/ is the only window into that — the same
+  // blindness that let the v3.60 binding outage run for 4 days. Volume is bounded by the
+  // recorder's 14-day retention and one short line per fire.
+  if (typeof tool_name !== 'string') {
+    recordHookError(
+      'post-tool-use:tool_name-type',
+      new TypeError(`tool_name is ${Array.isArray(tool_name) ? 'array' : typeof tool_name}, expected string`),
+      RUNTIME_DIR,
+      { toolNameType: Array.isArray(tool_name) ? 'array' : typeof tool_name },
+    );
+    return;
+  }
 
   // Skip noise (source of truth: skip-tools.mjs)
   if (SKIP_TOOLS.has(tool_name)) return;
@@ -426,9 +482,24 @@ function triggerErrorRecall(db, toolInput, response) {
       FROM observations_fts
       JOIN observations o ON observations_fts.rowid = o.id
       WHERE observations_fts MATCH ? AND o.project = ?
+        -- Live-row invariant, same as every other model-facing retrieval path
+        -- (hook-context obsPool/fallbackObs/keyObs, hook-memory, search-engine,
+        -- recent/search/timeline/recall-core, pre-tool-recall, user-prompt-search).
+        -- This surface INLINES rows[0].lesson_learned into the model context, so an
+        -- unfiltered SELECT handed a retracted lesson to the agent verbatim while its
+        -- correction trailed as a bare pointer. compressed_into is filtered too, not
+        -- only for symmetry: the block's own footer is a mem_get(ids=...) pointer, and a
+        -- COMPRESSED_PENDING_PURGE row is queued for deletion by maintain purge_stale,
+        -- so that pointer would resolve to nothing.
+        AND COALESCE(o.compressed_into, 0) = 0
+        AND o.superseded_at IS NULL
         AND ${notLowSignalTitleClause('o')}
+      -- MAX(0, …) clamps recency age to >= 0 (parity with search-engine FULL_SCORE):
+      -- a far-future created_at (reachable via restore/import-jsonl, which accept
+      -- arbitrary epochs) made the exponent large-positive → EXP overflow → that row
+      -- pinned #1 for every error until its "future" passed (audit 2026-08-14 M-1).
       ORDER BY ${OBS_BM25}
-        * (1.0 + EXP(-0.693 * (? - o.created_at_epoch) / 1209600000.0))
+        * (1.0 + EXP(-0.693 * MAX(0, ? - o.created_at_epoch) / 1209600000.0))
       LIMIT 3
     `).all(ftsQuery, project, nowR);
 
@@ -497,10 +568,17 @@ async function handleStop() {
     // Prevents data loss from concurrent PostToolUse writes between read and delete.
     const epFile = episodeFile();
     const claimFile = epFile + `.claim-${process.pid}-${Date.now()}`;
+    // Third instance of the B1 gate (flushEpisode and the SIGTERM salvage are the other
+    // two): this path already MOVED the buffer out of the way, so with no openable DB the
+    // `unlinkSync(claimFile)` below would destroy it just as surely — and the 1h orphan
+    // sweep would have eaten a restored-but-unnoticed claim file anyway. Open once, and
+    // put the buffer back under its real name when the save cannot happen.
+    let claimDb;
     try {
       renameSync(epFile, claimFile);
+      claimDb = openDb();
       try {
-        const episode = JSON.parse(readFileSync(claimFile, 'utf8'));
+        const episode = claimDb ? JSON.parse(readFileSync(claimFile, 'utf8')) : null;
         if (episode && episode.entries && episode.entries.length > 0 && episodeHasSignificantContent(episode)) {
           if (!episode.sessionId) episode.sessionId = sessionId;
           if (!episode.project) episode.project = project;
@@ -519,7 +597,7 @@ async function handleStop() {
             if (!episodeHasSignificantContent(sub)) continue;
             try {
               const obs = buildImmediateObservation(sub);
-              const id = saveObservation(obs, sub.project, sub.sessionId);
+              const id = saveObservation(obs, sub.project, sub.sessionId, claimDb);
               if (id) sub.savedId = id;
             } catch (e) { debugCatch(e, 'handleStop-fallback-immediateSave'); }
             const flushFile = join(RUNTIME_DIR, `ep-flush-${Date.now()}-${randomUUID().slice(0, 8)}.json`);
@@ -528,7 +606,15 @@ async function handleStop() {
           }
         }
       } finally {
-        try { unlinkSync(claimFile); } catch {}
+        if (claimDb) {
+          try { unlinkSync(claimFile); } catch {}
+          try { claimDb.close(); } catch { /* already gone */ }
+        } else {
+          // Nothing was (or could be) persisted — restore the buffer under its real name
+          // so the next fire retries it. If even the rename fails, the claim file stays
+          // and the 1h orphan sweep collects it, which is the pre-B1 behaviour.
+          try { renameSync(claimFile, epFile); } catch { /* leave it for sweepOrphanEpisodeFiles */ }
+        }
       }
     } catch (e) { debugCatch(e, 'handleStop-fallback'); }
   }
@@ -935,6 +1021,15 @@ function runSessionStartAutoMaintain(db) {
 
       // Auto-dedup (exact): merge identical-title observations within 1h.
       // Catches rapid duplicate writes (same hook firing twice, race conditions).
+      // BOTH join sides must be live (audit 2026-08-14 H-1): without the
+      // superseded_at filters (which the fuzzy channel below always had), a row the
+      // fuzzy pass had tombstoned could come back as `a` (a.id < b.id) and tombstone
+      // the LIVE keeper `b` — both copies gone from every read path. Worse, a user
+      // correction saved with supersedes=[#A] (A.superseded_by = B's NUMERIC id) has
+      // the same title as A, so the pair (A, B) tombstoned the correction B itself
+      // and the string 'auto-dedup' write clobbered numeric supersession chains that
+      // citation-tracker decay hand-off and timeline re-anchoring both follow. The
+      // UPDATE repeats the guard so a concurrent writer can't re-stamp a chain.
       const dupPairs = db.prepare(`
         SELECT a.id as keep_id, b.id as remove_id
         FROM observations a
@@ -943,12 +1038,14 @@ function runSessionStartAutoMaintain(db) {
           AND ABS(a.created_at_epoch - b.created_at_epoch) < 3600000
           AND COALESCE(a.compressed_into, 0) = 0
           AND COALESCE(b.compressed_into, 0) = 0
+          AND a.superseded_at IS NULL
+          AND b.superseded_at IS NULL
         LIMIT 20
       `).all();
       if (dupPairs.length > 0) {
         const removeIds = dupPairs.map(p => p.remove_id);
         const ph = removeIds.map(() => '?').join(',');
-        db.prepare(`UPDATE observations SET superseded_at = ?, superseded_by = 'auto-dedup' WHERE id IN (${ph})`).run(Date.now(), ...removeIds);
+        db.prepare(`UPDATE observations SET superseded_at = ?, superseded_by = 'auto-dedup' WHERE id IN (${ph}) AND superseded_at IS NULL`).run(Date.now(), ...removeIds);
         debugLog('DEBUG', 'auto-maintain', `auto-deduped ${dupPairs.length} near-identical observations`);
       }
 
@@ -1566,9 +1663,13 @@ async function handleUserPrompt() {
       try {
         const injectedFile = join(RUNTIME_DIR, `.claude-mem-injected-${project}`);
         const raw = readFileSync(injectedFile, 'utf8');
-        const { ids, ts } = JSON.parse(raw);
-        // Only use if written within last 10 seconds (same prompt cycle)
-        if (ts && Date.now() - ts < 10000 && Array.isArray(ids)) {
+        const { ids, ts, session } = JSON.parse(raw);
+        // Only use if written within last 10 seconds (same prompt cycle) AND by this
+        // CC session — the file is project-keyed, so a concurrent session's write
+        // would otherwise dedup-suppress OUR injection (M-6, audit 2026-08-14).
+        // Legacy payloads without `session` keep the old time-window-only behavior.
+        if (ts && Date.now() - ts < 10000 && Array.isArray(ids)
+            && !(session && ccSessionId && session !== ccSessionId)) {
           for (const id of ids) { keyContextIds.push(id); pathAInjectedIds.push(id); }
         }
       } catch { /* file may not exist — that's fine */ }
@@ -1767,9 +1868,19 @@ try {
     case 'auto-maintain':    handleAutoMaintain(); break;
     case 'llm-optimize':   await handleLLMOptimize(); break;
     // Detached update refresh spawned by handleSessionStart (audit P3d) — does the
-    // GitHub fetch + (non-plugin) install off the SessionStart critical path,
-    // writing update-state.json so the NEXT session's cached banner is fresh.
-    case 'update-check':     await checkForUpdate(); break;
+    // GitHub fetch off the SessionStart critical path, writing update-state.json so
+    // the NEXT session's cached banner is fresh.
+    //
+    // F6 staging: the detached update-check worker has not run since v2.85.0
+    // (missing from BG_EVENTS). Restore the check + banner first; re-enable the
+    // self-replacing install in a follow-up once this path has proven itself, so a
+    // failure in either half is attributable. Without the option, hook-update.mjs's
+    // `allowInstall = options.allowInstall ?? !pluginMode` defaults to TRUE on a
+    // direct / settings.json install, so fixing F6 would switch a ten-week-dormant
+    // self-installer back on in the same release that resurrects the worker. The
+    // module default and the installer's own guards are unchanged — install.mjs
+    // still passes allowInstall:true for the explicit, user-invoked update.
+    case 'update-check':     await checkForUpdate({ allowInstall: false }); break;
   }
 } catch (err) {
   // Log fatal errors (ungated) with structured format. ERR_DLOPEN_FAILED (an
@@ -1779,6 +1890,11 @@ try {
   // lib/native-binding-hint.mjs.
   const line = formatHookError(err, event, { runtimeDir: RUNTIME_DIR });
   if (line) console.error(line);
+  // stderr alone is invisible to `stats` self-observation — only the native-binding
+  // family was persisted, so a non-binding fatal (schema drift, bad stdin shape)
+  // could kill every dispatch-routed surface while the hook-errors log read zero
+  // (audit 2026-08-14 M-5; same blindness one layer up from the v3.60 outage).
+  recordHookError(`hook:${event}`, err, RUNTIME_DIR);
 }
 
 process.exit(0);

package/hooks/hooks.json

@@ -72,6 +72,16 @@
             "timeout": 5
           }
         ]
+      },
+      {
+        "matcher": "Edit|Write|NotebookEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/hook-launcher.mjs\" scripts/post-tool-recall.js",
+            "timeout": 3
+          }
+        ]
       }
     ],
     "Stop": [