claude-mem-lite 3.61.1 → 3.63.0

package/install.mjs

@@ -679,6 +679,24 @@ const memPostToolUse = {
   }]
 };
 
+// Component 2 of the bind-salience forcing function: after an Edit/Write, flag an
+// identifier the file's own lesson named that the edit just removed (component 1 is the
+// pre-edit directive from scripts/pre-tool-recall.js, which also records the identifiers
+// this one checks). Shipped, signed and tested since it was written, but registered in
+// NEITHER registry — so `CLAUDE_MEM_SALIENCE=bind` delivered half the mechanism and
+// nothing said so (audit B6, 2026-08-14). Matched on the edit tools only, NOT Read: there
+// is no post-edit state to compare after a read. Inert (returns before touching stdin)
+// unless CLAUDE_MEM_SALIENCE=bind, so the default chain pays one short-circuit spawn per
+// edit and emits nothing.
+const memPostToolRecall = {
+  matcher: 'Edit|Write|NotebookEdit',
+  hooks: [{
+    type: 'command',
+    command: nodeHook('scripts/post-tool-recall.js'),
+    timeout: 3
+  }]
+};
+
 const memSessionStart = {
   matcher: 'startup|clear|compact',
   hooks: [{
@@ -697,6 +715,21 @@ const memStop = {
   }]
 };
 
+// Fires immediately BEFORE auto-compaction, re-emitting <claude-mem-context> so the
+// summarizer that rewrites the transcript still has memory in scope (SessionStart's
+// compact matcher fires AFTER, when the context is already gone). Parity with
+// hooks/hooks.json: omitting it here made every settings.json install lose exactly the
+// block that exists to survive compaction, invisibly — doctor only ever asked "are ANY
+// mem hooks present", never "which events" (audit B3, 2026-08-14).
+const memPreCompact = {
+  matcher: '*',
+  hooks: [{
+    type: 'command',
+    command: nodeHook('hook.mjs', 'pre-compact'),
+    timeout: 5
+  }]
+};
+
 const memUserPrompt = {
   matcher: '*',
   hooks: [
@@ -754,9 +787,14 @@ const memPreAgentInject = {
 
 // Filter out existing mem hooks, then append fresh ones
 // PreToolUse has three separate matchers, so we register all three
+// Event set MUST stay equal to hooks/hooks.json's (minus scripts/setup.sh, which
+// bootstraps the plugin cache and has no settings.json counterpart) —
+// tests/audit-silent-20260814.test.mjs diffs a real `install --dev` run's
+// settings.json against the shipped manifest and reds on any new divergence.
 const hookConfigs = {
   PreToolUse: [memPreToolRecall, memPreSkillBridge, memPreAgentInject],
-  PostToolUse: [memPostToolUse],
+  PostToolUse: [memPostToolUse, memPostToolRecall],
+  PreCompact: [memPreCompact],
   SessionStart: [memSessionStart],
   Stop: [memStop],
   UserPromptSubmit: [memUserPrompt],
@@ -768,7 +806,10 @@ for (const [event, configs] of Object.entries(hookConfigs)) {
 }
 
 writeSettings(settings);
-ok('Hooks configured (PreToolUse, PostToolUse, SessionStart, Stop, UserPromptSubmit)');
+// Derived from the map, not a parallel literal: the pre-B3 line said five events and
+// kept saying five after the map changed, which is how a missing registration reads as
+// a successful one.
+ok(`Hooks configured (${Object.keys(hookConfigs).join(', ')})`);
 }
 
 function backupLegacyClaudeMemData() {
@@ -1520,6 +1561,27 @@ async function doctor() {
     ok(`Native DB binding: loadable on Node ${process.version}`);
   }
 
+  // Disk footprint (audit 2026-08-14 M-9): a "lite" data dir had grown to 653MB
+  // against a 59MB DB — 360MB of it orphaned per-tag .bak snapshots — with no
+  // check anywhere. Cheap probes only (DB file + .bak aggregate, no tree walk).
+  // The budget itself is enforced by lib/db-backup on every new snapshot; this
+  // check surfaces stores that predate the budget or exceed it between snapshots.
+  try {
+    const { listSnapshots, backupBudgetBytes } = await import('./lib/db-backup.mjs');
+    const dbFile = join(MEM_DATA_DIR, 'claude-mem-lite.db');
+    const dbBytes = existsSync(dbFile) ? statSync(dbFile).size : 0;
+    const snaps = listSnapshots(dbFile);
+    const backupBytes = snaps.reduce((s, x) => s + x.size, 0);
+    const mb = (n) => (n / (1024 * 1024)).toFixed(1);
+    // Warn threshold = the REAL eviction budget (pre-release review 2026-08-16) —
+    // warning below it promised an eviction enforceBackupBudget would never do.
+    if (backupBytes > backupBudgetBytes()) {
+      dwarn(`Disk footprint: ${snaps.length} backup snapshot(s) hold ${mb(backupBytes)}MB, over the ${mb(backupBudgetBytes())}MB budget (CLAUDE_MEM_BACKUP_BUDGET_MB) — the next maintain/save snapshot evicts oldest snapshots past the 7d undo grace`);
+    } else {
+      ok(`Disk footprint: DB ${mb(dbBytes)}MB, ${snaps.length} backup snapshot(s) ${mb(backupBytes)}MB (budget ${mb(backupBudgetBytes())}MB)`);
+    }
+  } catch { /* footprint check is informational — never block doctor */ }
+
   // Plugin/hook lifecycle state
   const settings = readSettings();
   const hasHooks = hasMemHooksConfigured(settings);

package/lib/db-backup.mjs

@@ -7,10 +7,92 @@
 //
 // MUST be called OUTSIDE any transaction — VACUUM cannot run inside one, which is
 // why the maintenance entry points snapshot before opening their db.transaction().
-import { readdirSync, unlinkSync } from 'fs';
+import { readdirSync, unlinkSync, statSync } from 'fs';
 import { dirname, basename, join } from 'path';
 import { debugLog } from '../utils.mjs';
 
+// M-9 (audit 2026-08-14): per-tag retention alone let one-shot tags live forever —
+// each tag kept its newest 3, but a tag written once (pre-backfill-v3390 and four
+// siblings) never got a second snapshot to age it out, so 9 orphaned .bak files held
+// 360MB against a 59MB live DB. A TOTAL byte budget across ALL tags bounds the
+// footprint of a system whose name promises "lite". Oldest-first eviction, newest
+// snapshot always survives (the most recent safety net must outlive any budget).
+const DEFAULT_BACKUP_BUDGET_BYTES = 256 * 1024 * 1024;
+
+/** Effective budget (env-tunable). Exported so stats/doctor derive their
+ * footprint-warning thresholds from the SAME number eviction acts on —
+ * pre-release review 2026-08-16: a hardcoded `3× DB` hint fired ~2.7× below
+ * the real budget and promised an eviction that would never happen. */
+export function backupBudgetBytes() {
+  const mb = Number(process.env.CLAUDE_MEM_BACKUP_BUDGET_MB);
+  return Number.isFinite(mb) && mb > 0 ? mb * 1024 * 1024 : DEFAULT_BACKUP_BUDGET_BYTES;
+}
+
+// Eviction grace: snapshots younger than this are never budget-evicted. This is
+// what protects a fresh `pre-delete` undo pre-image (deleteObservations reports
+// its path as the recovery route) from being unlinked by same-day maintain churn
+// (pre-release review 2026-08-16). Deliberately age-based, NOT newest-per-tag:
+// a per-tag exemption would make every one-shot tag's only snapshot immortal —
+// exactly the 360MB orphan shape M-9 exists to evict. Mirrors the purge grace
+// convention (7d) used by stale-observation retention.
+export const BACKUP_EVICTION_GRACE_MS = 7 * 86400000;
+
+// Canonical snapshot shape `<base>.<tag>-<ISO stamp>-<pid>-<seq>.bak` (what
+// snapshotDb writes). Budget eviction deletes ONLY names matching this — a
+// user's hand-made `cp db db.before-upgrade.bak` must never be auto-unlinked.
+const SNAPSHOT_STAMP_RE = /-\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-\d{3}Z-\d+-\d+\.bak$/;
+
+/** All `<db>.<tag>-<ts>.bak` snapshots for `dbPath`, any tag, with size + mtime. */
+export function listSnapshots(dbPath) {
+  try {
+    const dir = dirname(dbPath);
+    const prefix = `${basename(dbPath)}.`;
+    const out = [];
+    for (const n of readdirSync(dir)) {
+      if (!n.startsWith(prefix) || !n.endsWith('.bak')) continue;
+      const full = join(dir, n);
+      try {
+        const st = statSync(full);
+        out.push({ path: full, size: st.size, mtimeMs: st.mtimeMs });
+      } catch { /* raced away */ }
+    }
+    return out;
+  } catch { return []; }
+}
+
+/**
+ * Evict oldest snapshots (across ALL tags) until the total is within the byte
+ * budget. Never evicted: the single newest snapshot (even if it alone exceeds
+ * the budget), anything younger than BACKUP_EVICTION_GRACE_MS, and any file not
+ * matching the canonical snapshot name shape. The total counts every .bak
+ * (exempt files included), so a burst of young snapshots can hold the dir above
+ * budget for up to the grace window — bounded by write rate, and the price of
+ * never deleting an undo pre-image someone may still want.
+ * Returns the number of files removed. Best-effort, never throws.
+ */
+export function enforceBackupBudget(dbPath, { budgetBytes = backupBudgetBytes(), nowMs = Date.now() } = {}) {
+  try {
+    const snaps = listSnapshots(dbPath).sort((a, b) => b.mtimeMs - a.mtimeMs); // newest first
+    let total = snaps.reduce((s, x) => s + x.size, 0);
+    let removed = 0;
+    const graceCutoff = nowMs - BACKUP_EVICTION_GRACE_MS;
+    // Walk oldest-first; stop before touching the newest (index 0).
+    for (let i = snaps.length - 1; i >= 1 && total > budgetBytes; i--) {
+      if (!SNAPSHOT_STAMP_RE.test(snaps[i].path)) continue;   // not ours — never delete
+      if (snaps[i].mtimeMs > graceCutoff) continue;           // inside undo grace
+      try {
+        unlinkSync(snaps[i].path);
+        total -= snaps[i].size;
+        removed++;
+      } catch { /* per-entry best-effort */ }
+    }
+    if (removed > 0) {
+      try { debugLog('DEBUG', 'db-backup', `budget eviction removed ${removed} snapshot(s)`); } catch { /* ignore */ }
+    }
+    return removed;
+  } catch { return 0; }
+}
+
 // Monotonic per-process suffix so two snapshots in the same millisecond (same pid)
 // still get unique filenames (VACUUM INTO fails if the target already exists).
 let _seq = 0;
@@ -31,6 +113,7 @@ export function snapshotDb(db, { tag = 'pre-maintain', retain = 3 } = {}) {
     // defensively since VACUUM INTO takes a string literal, not a bound param.
     db.exec(`VACUUM INTO '${out.replace(/'/g, "''")}'`);
     pruneSnapshots(dbPath, tag, retain);
+    enforceBackupBudget(dbPath);
     return out;
   } catch (e) {
     try { debugLog('WARN', 'db-backup', `snapshot skipped (proceeding without): ${e.message}`); } catch { /* ignore */ }

package/lib/export-columns.mjs

@@ -18,10 +18,16 @@
 // exported: `related_ids` (holds observation ids, stale/dangling after restore remaps ids)
 // and `discovery_tokens` (a derived retrieval metric, rebuilt by the live system; exporting
 // it would freeze a stale value into backups).
+// `compressed_into` (audit 2026-08-14 M-8): only ever non-null in an export taken
+// with --include-compressed / include_compressed — the default WHERE excludes those
+// rows. Without the column, a compressed member round-tripped through restore as a
+// LIVE row and turned up in search results next to the weekly-summary keeper that
+// already absorbed it. Restore does not remap it (the keeper's id is meaningless in
+// the target store); it REJECTS marked rows instead — see cmdRestore.
 export const EXPORT_COLUMNS = [
   'id', 'memory_session_id', 'project', 'type', 'title', 'subtitle', 'narrative', 'text',
   'concepts', 'facts', 'files_read', 'files_modified', 'lesson_learned', 'search_aliases',
-  'scope',
+  'scope', 'compressed_into',
   'importance', 'branch', 'access_count', 'cited_count', 'uncited_streak', 'injection_count',
   'decay_seen_count', 'last_accessed_at', 'created_at', 'created_at_epoch',
 ];

package/lib/recall-core.mjs

@@ -13,6 +13,13 @@ import { notLowSignalTitleClause } from '../utils.mjs';
  * { filename, rows } where rows carry the column superset both surfaces render.
  * Side effect: bumps access_count / last_accessed_at on every returned row —
  * recall IS engagement, and the tier/decay system feeds on these counters.
+ *
+ * `superseded_at IS NULL` is load-bearing twice over (audit B2, 2026-08-14): recall was
+ * the ONE retrieval path missing it, so a lesson a later save explicitly retracted
+ * (`--supersedes N`) was still served to an agent about to edit that very file — and the
+ * access-count bump below runs over exactly these rows, so the tombstone was ALSO pushed
+ * back up the decay/tier system on every read. `includeNoise` is about LOW_SIGNAL titles
+ * and must not reach this clause: nobody asks for retracted content.
  */
 export function recallByFile(db, file, { limit = 10, includeNoise = false } = {}) {
   const filename = basename(file);
@@ -25,6 +32,7 @@ export function recallByFile(db, file, { limit = 10, includeNoise = false } = {}
     FROM observations o
     JOIN observation_files of2 ON of2.obs_id = o.id
     WHERE COALESCE(o.compressed_into, 0) = 0
+      AND o.superseded_at IS NULL
       AND (of2.filename = ? OR of2.filename LIKE ? ESCAPE '\\')
       ${noiseClause}
     ORDER BY o.created_at_epoch DESC

package/mem-cli.mjs

@@ -22,7 +22,7 @@ import {
   hardDeleteCandidateCount,
   OP_CAP, STALE_AGE_MS, PINNED_INJ_THRESHOLD,
 } from './lib/maintain-core.mjs';
-import { snapshotDb } from './lib/db-backup.mjs';
+import { snapshotDb, listSnapshots, backupBudgetBytes } from './lib/db-backup.mjs';
 import { deleteObservations } from './lib/delete-core.mjs';
 import { OBS_TYPE_SET } from './lib/obs-types.mjs';
 import { computeStatsFeed } from './lib/stats-core.mjs';
@@ -36,14 +36,14 @@ import { aggregateProjectCiteRecall } from './lib/citation-tracker.mjs';
 import { probeOtherSources as probeIdSources, bucketIdTokens, splitDeferredTokens } from './lib/id-routing.mjs';
 import { join, sep, dirname } from 'path';
 import { spawnSync } from 'child_process';
-import { readFileSync, existsSync, readdirSync } from 'fs';
+import { readFileSync, existsSync, readdirSync, statSync } from 'fs';
 
 // v2.41: shared CLI helpers extracted to cli/common.mjs. Keep this file as the
 // router + remaining-command bodies during the incremental split. Future work:
 // move each cmdXxx into its own cli/<cmd>.mjs; mem-cli.mjs becomes pure dispatch.
 import { isNativeBindingError, healAndReexec } from './lib/binding-probe.mjs';
 import { CLI_PATH, CLI_INVOKE } from './cli-path.mjs';
-import { parseArgs, out, fail, relativeTime, fmtDateShort, parseIdToken, formatProbeHints, rejectBareStringFlags, resolvePositionalAlias, suggestUnknownFlags, OBS_TIME_FIELDS, formatObsFieldValue } from './cli/common.mjs';
+import { parseArgs, out, outVerbatim, fail, relativeTime, fmtDateShort, parseIdToken, formatProbeHints, rejectBareStringFlags, resolvePositionalAlias, suggestUnknownFlags, OBS_TIME_FIELDS, formatObsFieldValue, obsFieldLabel, formatPendingPurgeLine } from './cli/common.mjs';
 import { saveObservation } from './lib/save-observation.mjs';
 import { rebuildObservationDerived, normalizeScope, insertObservationVector } from './lib/observation-write.mjs';
 import { EXPORT_COLUMNS_SQL } from './lib/export-columns.mjs';
@@ -533,7 +533,7 @@ function renderObsRows(db, ids, requestedFields) {
       const formatted = formatObsFieldValue(f, val);
       const maxLen = f === 'narrative' ? 1000 : f === 'lesson_learned' ? 500 : f === 'text' ? 500 : 200;
       const display = typeof formatted === 'string' && formatted.length > maxLen ? formatted.slice(0, maxLen) + '…' : formatted;
-      lines.push(`${f}: ${display}`);
+      lines.push(`${obsFieldLabel(f)}: ${display}`);
     }
     parts.push(lines.join('\n'));
   }
@@ -1200,6 +1200,15 @@ async function cmdStats(db, args) {
   // failure mode that left code-graph's matcher bug undetected for 10 sessions.
   const hookErrors24h = countRecentHookErrors(join(DB_DIR, 'runtime'), now - 86400000);
 
+  // M-9 (audit 2026-08-14): disk footprint — a "lite" store had accumulated 360MB of
+  // pre-maintain snapshots against a 59MB DB with nothing reporting it. Cheap probes
+  // only (DB file + .bak aggregate), no recursive tree walk.
+  let dbBytes = 0;
+  try { dbBytes = statSync(join(DB_DIR, 'claude-mem-lite.db')).size; } catch { /* fresh */ }
+  const snaps = listSnapshots(join(DB_DIR, 'claude-mem-lite.db'));
+  const backupBytes = snaps.reduce((s, x) => s + x.size, 0);
+  const mb = (n) => (n / (1024 * 1024)).toFixed(1);
+
   if (jsonOutput) {
     out(JSON.stringify({
       project,
@@ -1226,6 +1235,9 @@ async function cmdStats(db, args) {
         compressed: compressedCount.c,
         superseded_only: supersededOnlyCount.c,
         hook_errors_24h: hookErrors24h,
+        db_bytes: dbBytes,
+        backup_count: snaps.length,
+        backup_bytes: backupBytes,
       },
       tier_distribution: {
         working: tierMap.working ?? 0,
@@ -1265,6 +1277,9 @@ async function cmdStats(db, args) {
   out(`  Low-signal titles (Modified/Error/Worked on…): ${lowSignalTitle.c} (${(lowSignalRatio * 100).toFixed(1)}%)`);
   out(`  Compressed: ${compressedCount.c}`);
   out(`  Hook errors (last 24h): ${hookErrors24h}${hookErrors24h > 0 ? `  ← tail ${join(DB_DIR, 'runtime/hook-errors')}` : ''}`);
+  // Hint threshold = the REAL eviction budget (pre-release review 2026-08-16: a
+  // hardcoded 3×-DB heuristic promised an eviction that fires only past the budget).
+  out(`  Disk: DB ${mb(dbBytes)}MB | ${snaps.length} backup snapshot(s) ${mb(backupBytes)}MB${backupBytes > backupBudgetBytes() ? `  ← over the ${mb(backupBudgetBytes())}MB backup budget; next maintain/save snapshot evicts oldest (>7d old)` : ''}`);
   // Tier-1 firing counters for ① file-intel + ② reread-guard (recorded by
   // pre-tool-recall.js via lib/metrics.mjs; CLAUDE_MEM_METRICS=1 to enable).
   const featAgg = aggregateMetrics(DB_DIR, 7);
@@ -1327,7 +1342,13 @@ function cmdContext(db, args) {
     }
     out(JSON.stringify(result, null, 2));
   } else {
-    out(`<claude-mem-context>\n${block}\n</claude-mem-context>`);
+    // outVerbatim: `context` is the one CLI command that must EMIT a real
+    // <claude-mem-context> wrapper — it prints the same block the SessionStart hook
+    // injects, so `out`'s defang would strip the delimiters this command exists to
+    // produce (the CLI twin of why <skill-loaded> is excluded from CONTEXT_DELIMITER_RE).
+    // The untrusted half is already neutralized one layer up: buildSessionContextLines
+    // defangs every row it renders, so only the trusted wrapper is written raw here.
+    outVerbatim(`<claude-mem-context>\n${block}\n</claude-mem-context>`);
   }
 }
 
@@ -1714,15 +1735,20 @@ function cmdExport(db, args) {
     //   jsonl → 0 lines (valid empty file)
     // The friendly note goes to stderr so it doesn't poison stdout for callers
     // piping to a parser.
-    if (format === 'json') out('[]');
+    if (format === 'json') outVerbatim('[]');
     process.stderr.write('[mem] No observations found matching criteria\n');
     return;
   }
 
+  // outVerbatim, NOT out: `out` neutralizes structural context delimiters (cli/common.mjs)
+  // because CLI stdout is model context — but this stream is a BACKUP that `restore` reads
+  // back, so defanging it would silently rewrite any row whose text legitimately contains
+  // `<system-reminder>`/`</claude-mem-context>` and persist the rewrite on restore. Mirrors
+  // safeHandler(mem_export, { verbatim: true }) on the MCP side (audit 2026-08-14 A1).
   if (format === 'jsonl') {
-    for (const r of rows) out(JSON.stringify(r));
+    for (const r of rows) outVerbatim(JSON.stringify(r));
   } else {
-    out(JSON.stringify(rows, null, 2));
+    outVerbatim(JSON.stringify(rows, null, 2));
   }
 
   if (limitGiven && rows.length >= limit) {
@@ -1788,9 +1814,15 @@ function cmdRestore(db, argv) {
       decay_seen_count = ?, last_accessed_at = ?
     WHERE id = ?`);
 
-  let restored = 0, skipped = 0, malformed = 0;
+  let restored = 0, skipped = 0, malformed = 0, tombstoned = 0;
   for (const r of rows) {
     if (!r || typeof r !== 'object' || !r.type || !r.title) { malformed++; continue; }
+    // M-8 (audit 2026-08-14): a row exported with --include-compressed carries its
+    // compressed_into tombstone. Restoring it as a live row resurrects a member its
+    // weekly-summary keeper already absorbed (duplicate search hits, and the marker's
+    // target id is meaningless in this store). Reject rather than remap; the content
+    // lives on in the keeper.
+    if (r.compressed_into) { tombstoned++; continue; }
     const project = projOverride || r.project || inferProject();
     const createdEpoch = Number.isFinite(Number(r.created_at_epoch)) ? Number(r.created_at_epoch) : Date.now();
     // Durable exact-dup guard — saveObservation's 5-min Jaccard window can't catch a
@@ -1857,7 +1889,8 @@ function cmdRestore(db, argv) {
   // ones that parsed.
   const totalMalformed = malformed + parseFailures;
   const totalLines = rows.length + parseFailures;
-  out(`[mem] Restore${dryRun ? ' (dry-run)' : ''}: ${restored} restored, ${skipped} duplicate(s) skipped, ${totalMalformed} malformed/failed from ${totalLines} row(s).`);
+  const tombstoneNote = tombstoned > 0 ? `, ${tombstoned} compressed member(s) rejected (already absorbed by their summary keeper)` : '';
+  out(`[mem] Restore${dryRun ? ' (dry-run)' : ''}: ${restored} restored, ${skipped} duplicate(s) skipped${tombstoneNote}, ${totalMalformed} malformed/failed from ${totalLines} row(s).`);
   // Name the lossiness where the user meets it. Export omits related_ids and drops
   // superseded rows, and restore re-inserts under fresh AUTOINCREMENT ids — so no
   // cross-link can survive the round-trip. That is a deliberate format tradeoff (stored
@@ -1971,7 +2004,7 @@ function cmdMaintain(db, args) {
     out(`  Broken (no title/narrative): ${stats.broken}`);
     out(`  Boostable (accessed>3, imp<3): ${stats.boostable}`);
     out(`  Pinned-but-uncited (inj>=${PINNED_INJ_THRESHOLD}, cited=0, imp>1): ${stats.pinned} — run: maintain execute --ops demote_pinned`);
-    out(`  Pending purge: ${stats.pendingPurge} (compressed originals awaiting cleanup)`);
+    out(formatPendingPurgeLine(stats.pendingPurge));
     if (duplicates.length > 0) {
       const autoMergeable = duplicates.filter(d => parseFloat(d.similarity) >= AUTO_MERGE_THRESHOLD);
       const manualReview = duplicates.filter(d => parseFloat(d.similarity) < AUTO_MERGE_THRESHOLD);
@@ -3119,8 +3152,12 @@ async function cmdOptimize(db, args) {
     if (project) out(`  Project filter: ${project}`);
     out(`  Re-enrich candidates: ${preview.reenrich}${preview.reenrichWide !== undefined && preview.reenrichWide !== null ? `  (wide scope: ${preview.reenrichWide})` : ''}${preview.reenrichAliases ? `  (aliases scope: ${preview.reenrichAliases})` : ''}`);
     out(`  Normalize: ${preview.normalizeGateOpen ? `${preview.normalize} unique concepts` : 'gate closed (7-day interval)'}`);
-    out(`  Cluster-merge: ${preview.clusterMerge} clusters`);
-    out(`  Smart-compress: ${preview.smartCompress} clusters`);
+    // "candidates" matches the MCP wording (server.mjs mem_optimize preview) AND the
+    // Re-enrich line just above, which already read that way on both surfaces. The two
+    // surfaces render one optimizePreview() result — tests/audit-findings-20260814.test.mjs
+    // drives both and compares the label lists, so the drift cannot reopen.
+    out(`  Cluster-merge candidates: ${preview.clusterMerge} clusters`);
+    out(`  Smart-compress candidates: ${preview.smartCompress} clusters`);
     out(`  Total: ${preview.total} items`);
     if (verbose) {
       out('');

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.61.1",
+  "version": "3.63.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "claude-mem-lite",
-      "version": "3.61.1",
+      "version": "3.63.0",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.26.0",
         "better-sqlite3": "^12.6.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.61.1",
+  "version": "3.63.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",

package/scripts/post-tool-recall.js

@@ -16,6 +16,7 @@
 import { existsSync, readFileSync } from 'fs';
 import { basename, join } from 'path';
 import { resolveDataDir } from '../lib/resolve-data-dir.mjs';
+import { recordHookError } from '../lib/hook-telemetry.mjs';
 
 const SALIENCE_BIND = process.env.CLAUDE_MEM_SALIENCE === 'bind';
 
@@ -45,7 +46,13 @@ async function main() {
   const cdPath = cooldownPathFor(sessionId);
   if (!existsSync(cdPath)) return;
   let entry;
-  try { entry = JSON.parse(readFileSync(cdPath, 'utf8'))[filePath]; } catch { return; }
+  try { entry = JSON.parse(readFileSync(cdPath, 'utf8'))[filePath]; } catch (e) {
+    // A corrupt cooldown file (torn concurrent write — audit 2026-08-14 M-6) turns
+    // the bind-salience check into a zero-trace no-op; record it so `stats` can see
+    // the surface die instead of silently reading zero errors (M-5).
+    recordHookError('post-recall:cooldown-parse', e, RUNTIME_DIR, { file: basename(cdPath) });
+    return;
+  }
   const idents = entry && entry.lessonIdents;
   if (!idents || typeof idents !== 'object') return;
 
@@ -77,4 +84,7 @@ async function main() {
 // stream emits 'error' — without the (now-removed) forced exit, an unhandled one would
 // surface as a non-zero exit + stack. A hook must never fail loud on a dropped pipe.
 process.stdout.on('error', () => {});
-main().catch(() => {});
+// Record what slips past main()'s early returns before the mandatory swallow —
+// this script had zero telemetry (audit 2026-08-14 M-5). Recorder never throws;
+// the outer catch keeps the exit code 0 regardless.
+main().catch((e) => { try { recordHookError('post-recall:main', e, RUNTIME_DIR); } catch { /* never */ } });

package/scripts/pre-agent-inject.js

@@ -15,6 +15,23 @@
 const ENABLED = process.env.CLAUDE_MEM_SUBAGENT_INJECT === 'on'
   || process.env.CLAUDE_MEM_SUBAGENT_INJECT === '1';
 
+// Telemetry via DYNAMIC import so the default-off fast path stays import-free
+// (the file's stated contract). Only ever reached on the enabled path's failure
+// branches — this script had zero recordHookError coverage, so a dead DB or
+// schema drift silently disabled subagent injection with no trace (audit
+// 2026-08-14 M-5). Swallows everything: telemetry must never break a dispatch.
+async function recordFailure(scope, err, ctx) {
+  try {
+    const [{ recordHookError }, { resolveDataDir }, { join }] = await Promise.all([
+      import('../lib/hook-telemetry.mjs'),
+      import('../lib/resolve-data-dir.mjs'),
+      import('path'),
+    ]);
+    const dataDir = resolveDataDir(process.env.CLAUDE_MEM_DIR);
+    recordHookError(scope, err, process.env.CLAUDE_MEM_RUNTIME_DIR || join(dataDir, 'runtime'), ctx);
+  } catch { /* never */ }
+}
+
 function readStdin() {
   return new Promise((resolve) => {
     let data = '';
@@ -51,7 +68,7 @@ async function main() {
   const { buildSubagentInjection } = await import('../hook-memory.mjs');
 
   let db;
-  try { db = ensureDb(); } catch { return; }
+  try { db = ensureDb(); } catch (e) { await recordFailure('agent-inject:db-open', e); return; }
   try {
     const updatedInput = buildSubagentInjection(db, hook.tool_input, inferProject());
     if (updatedInput) {
@@ -59,7 +76,7 @@ async function main() {
         hookSpecificOutput: { hookEventName: 'PreToolUse', updatedInput },
       }));
     }
-  } catch { /* never break a dispatch */ } finally {
+  } catch (e) { await recordFailure('agent-inject:query', e); /* never break a dispatch */ } finally {
     try { db.close(); } catch { /* */ }
   }
 }
@@ -69,5 +86,6 @@ async function main() {
 // which FLUSHES stdout. The emitted updatedInput echoes the whole prompt back, so the
 // payload can exceed the ~64KB pipe buffer; a forced process.exit() would drop that
 // pending async write and truncate the JSON (the gotcha every sibling hook avoids).
-// Swallow any rejection so the exit code can never go non-zero.
-main().catch(() => {});
+// Swallow any rejection so the exit code can never go non-zero — but record it
+// first (recordFailure itself swallows everything, including its own failures).
+main().catch((e) => recordFailure('agent-inject:main', e));

package/scripts/pre-skill-bridge.js

@@ -8,6 +8,9 @@ import { join, resolve, sep } from 'path';
 import { homedir } from 'os';
 import { recordHookError } from '../lib/hook-telemetry.mjs';
 import { resolveDataDir } from '../lib/resolve-data-dir.mjs';
+// format-utils.mjs is import-free — pulling three defang helpers keeps this script
+// inside its "lightweight standalone" budget (no heavy transitive deps).
+import { neutralizeContextDelimiters, neutralizeSkillDelimiters, neutralizeSkillBridgeDelimiters } from '../format-utils.mjs';
 
 // CLAUDE_MEM_DIR mirrors pre-tool-recall.js — one env var sandboxes everything.
 const DATA_DIR = resolveDataDir(process.env.CLAUDE_MEM_DIR);
@@ -88,12 +91,22 @@ try {
     // console.log() form would render on stock CC but no-op on those variants.
     // Token budget: ~4 chars per token, 4000 token limit = 16000 chars.
     const portablePath = resolvedPath.startsWith(homedir()) ? '~' + resolvedPath.slice(homedir().length) : resolvedPath;
+    // Defang the untrusted skill body + name before wrapping (audit 2026-08-14 M-4):
+    // registry rows come from third-party repos, and this was the one AUTO injection
+    // surface of that data with zero neutralization — a body carrying a literal
+    // `</skill-bridge>` + forged <system-reminder> (or a `<skill-loaded>` execute
+    // block) escaped the wrapper verbatim. Name additionally drops quote/bracket
+    // chars: it lands in an ATTRIBUTE position, where `"` breaks out of the wrapper
+    // tag itself. Applied to the truncated summary too (a cut can't be trusted to
+    // land mid-tag).
+    const defang = (s) => neutralizeSkillBridgeDelimiters(neutralizeSkillDelimiters(neutralizeContextDelimiters(s)));
+    const safeName = String(row.name).replace(/["'<>]/g, '');
     let additionalContext;
     if (content.length > 16000) {
-      const summary = content.slice(0, 800);
-      additionalContext = `<skill-bridge name="${row.name}" source="managed" truncated="true">\n${summary}\n...\n</skill-bridge>\n\nSkill content truncated. Read("${portablePath}") to load full content.`;
+      const summary = defang(content.slice(0, 800));
+      additionalContext = `<skill-bridge name="${safeName}" source="managed" truncated="true">\n${summary}\n...\n</skill-bridge>\n\nSkill content truncated. Read("${portablePath}") to load full content.`;
     } else {
-      additionalContext = `<skill-bridge name="${row.name}" source="managed">\n${content}\n</skill-bridge>\n\nThis skill was loaded from the managed registry. Follow the instructions above.`;
+      additionalContext = `<skill-bridge name="${safeName}" source="managed">\n${defang(content)}\n</skill-bridge>\n\nThis skill was loaded from the managed registry. Follow the instructions above.`;
     }
     process.stdout.write(JSON.stringify({
       suppressOutput: true,

package/scripts/pre-tool-recall.js

@@ -4,9 +4,10 @@
 // and the pure-data lib/low-signal-patterns.mjs (zero runtime deps, ~1ms overhead).
 // Safety: readonly DB, exit 0 always, 3s timeout
 
-import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs';
+import { existsSync, readFileSync, mkdirSync } from 'fs';
 import { basename, join } from 'path';
 import { resolveDataDir } from '../lib/resolve-data-dir.mjs';
+import { atomicWriteFileSync } from '../lib/atomic-write.mjs';
 import { buildNotLowSignalSql } from '../lib/low-signal-patterns.mjs';
 import { recordHookError } from '../lib/hook-telemetry.mjs';
 import { citeFactorClause } from '../scoring-sql.mjs';
@@ -159,17 +160,24 @@ function crossHookInjectedFile(project) {
   return join(RUNTIME_DIR, `.claude-mem-injected-${project}`);
 }
 
-function readCrossHookInjected(project) {
+// M-6 (audit 2026-08-14): the marker file is keyed by PROJECT, so two concurrent
+// CC sessions in the same project shared one suppression state — session A's
+// injections silently deduped session B's, and B inherited A's count cap. Both
+// read and merge now carry the CC session id: a payload written by a DIFFERENT
+// session is ignored (read) / replaced (merge), mirroring the v3.35.2 episode
+// session-key fix. Legacy payloads without `session` keep the old behavior.
+function readCrossHookInjected(project, sessionId) {
   try {
     const raw = readFileSync(crossHookInjectedFile(project), 'utf8');
-    const { ids, ts } = JSON.parse(raw);
+    const { ids, ts, session } = JSON.parse(raw);
+    if (session && sessionId && session !== sessionId) return new Set();
     if (!ts || Date.now() - ts > CROSS_HOOK_DEDUP_MS) return new Set();
     if (!Array.isArray(ids)) return new Set();
     return new Set(ids.map(String));
   } catch { return new Set(); }
 }
 
-function mergeCrossHookInjected(project, newIds) {
+function mergeCrossHookInjected(project, newIds, sessionId) {
   if (!newIds || newIds.length === 0) return;
   try {
     mkdirSync(RUNTIME_DIR, { recursive: true });
@@ -178,8 +186,10 @@ function mergeCrossHookInjected(project, newIds) {
     try {
       const raw = readFileSync(file, 'utf8');
       const parsed = JSON.parse(raw);
-      // Within the staleness window: union. Outside: replace (fresh session).
-      if (parsed.ts && Date.now() - parsed.ts < CROSS_HOOK_DEDUP_MS) {
+      // Within the staleness window AND same session (or legacy): union.
+      // Outside / other session: replace.
+      if (parsed.ts && Date.now() - parsed.ts < CROSS_HOOK_DEDUP_MS
+          && !(parsed.session && sessionId && parsed.session !== sessionId)) {
         prev = parsed;
       }
     } catch { /* fresh file */ }
@@ -187,10 +197,13 @@ function mergeCrossHookInjected(project, newIds) {
       ...(Array.isArray(prev.ids) ? prev.ids.map(String) : []),
       ...newIds.map(String),
     ])];
-    writeFileSync(file, JSON.stringify({
+    // Atomic (tmp+rename, M-6): a plain write torn by a concurrent hook left the
+    // shared marker as invalid JSON, silently disabling cross-hook dedup.
+    atomicWriteFileSync(file, JSON.stringify({
       ids,
       ts: Date.now(),
       count: (prev.count || 0) + 1,
+      ...(sessionId ? { session: sessionId } : {}),
     }));
   } catch { /* silent — dedup is best-effort */ }
 }
@@ -209,7 +222,10 @@ function writeCooldown(cooldownPath, data, isSessionScoped) {
         if (ts && now - ts < STALE_MS) cleaned[k] = v;
       }
     }
-    writeFileSync(cooldownPath, JSON.stringify(cleaned));
+    // Atomic (tmp+rename, M-6): the cooldown carries lessonIdents that the
+    // PostToolUse bind-salience check reads back — a torn write turned that
+    // check into a zero-trace no-op.
+    atomicWriteFileSync(cooldownPath, JSON.stringify(cleaned));
   } catch { /* silent */ }
 }
 
@@ -474,7 +490,7 @@ try {
     // P1 (D#78): tag each row's source table — events share the numeric id
     // space with observations, and the Stop-side edge attribution must never
     // feed an event id into observation_files updates.
-    const crossHookSeen = readCrossHookInjected(project);
+    const crossHookSeen = readCrossHookInjected(project, sessionId);
     const sourcedRows = [
       ...rows.map(r => ({ ...r, src: 'obs' })),
       ...eventRows.map(r => ({ ...r, src: 'evt' })),
@@ -638,7 +654,7 @@ try {
     // file so the next UPS prompt skips them too. Always write, even on
     // empty allRows, so the file's ts stays fresh for the no-op case where
     // we'd otherwise drift outside the dedup window.
-    mergeCrossHookInjected(project, allRows.map(r => r.id));
+    mergeCrossHookInjected(project, allRows.map(r => r.id), sessionId);
   } catch (e) {
     // Silent failure — never block editing, but record for self-observation.
     recordHookError('pre-recall:query', e, RUNTIME_DIR, { filePath });