claude-mem-lite 3.61.1 → 3.63.0

package/scripts/prompt-search-utils.mjs

@@ -154,13 +154,17 @@ export const DEDUP_STALE_MS = 300_000; // 5 minutes
  * Check if injection should be skipped based on deduplication state.
  * @param {number[]} newIds - candidate observation IDs
  * @param {string} injectedFile - path to the dedup state file
+ * @param {string} [sessionId] - CC session id; a payload written by a DIFFERENT
+ *   session never suppresses (M-6, audit 2026-08-14: the file is keyed by project,
+ *   so session A's injections + count cap silently carried into session B)
  * @returns {boolean} true if injection should be skipped
  */
-export function shouldSkipByDedup(newIds, injectedFile) {
+export function shouldSkipByDedup(newIds, injectedFile, sessionId) {
   if (!newIds || newIds.length === 0) return true;
   try {
     const raw = readFileSync(injectedFile, 'utf8');
-    const { ids: prevIds, ts, count = 0 } = JSON.parse(raw);
+    const { ids: prevIds, ts, count = 0, session } = JSON.parse(raw);
+    if (session && sessionId && session !== sessionId) return false;
     if (count >= MAX_SESSION_INJECTIONS) return true;
     if (!ts || Date.now() - ts > DEDUP_STALE_MS) return false;
     if (!Array.isArray(prevIds) || prevIds.length === 0) return false;

package/scripts/user-prompt-search.js

@@ -14,9 +14,14 @@ import Database from 'better-sqlite3';
 import { shouldSkip, computeEffectiveLen, detectIntent, shouldSkipByDedup, extractFiles, extractErrorSignature, extractDeferredRefs, DEDUP_STALE_MS, matchRegistrySkillName, detectMemOverride } from './prompt-search-utils.mjs';
 import { getDeferredByIds } from '../lib/deferred-work.mjs';
 import { recommendSkill } from '../registry-recommend.mjs';
+import { recordHookError } from '../lib/hook-telemetry.mjs';
+import { atomicWriteFileSync } from '../lib/atomic-write.mjs';
 
 // ─── Constants ──────────────────────────────────────────────────────────────
 
+// Telemetry sink (lib/hook-telemetry.mjs contract): env override for tests, else
+// <data-dir>/runtime — the same dir the sibling hook scripts + `stats` read.
+const RUNTIME_DIR = process.env.CLAUDE_MEM_RUNTIME_DIR || join(DB_DIR, 'runtime');
 const INJECTED_IDS_FILE = join(DB_DIR, 'runtime', `.claude-mem-injected-${inferProject()}`);
 // Per-prompt UPS cap. Cut from 5 → 3 after the 2026-05-09 per-hook recall
 // scan (#8255): UPS contributed 74% of silent injected IDs (131/177) at 26%
@@ -344,7 +349,7 @@ export function searchByFts(db, queryText, project, limit, typeFilter,
     SELECT o.id, o.type, o.title, o.lesson_learned,
            ${OBS_BM25} as bm25_raw,
            ${OBS_BM25}
-             * (1.0 + EXP(-0.693 * (? - o.created_at_epoch) / ${TYPE_DECAY_CASE}))
+             * (1.0 + EXP(-0.693 * MAX(0, ? - o.created_at_epoch) / ${TYPE_DECAY_CASE}))
              * ${TYPE_QUALITY_CASE}
              * (0.5 + 0.5 * COALESCE(o.importance, 1))
              * ${noisePenaltyClause('o')}
@@ -660,7 +665,7 @@ async function main() {
       // Namespace dedup ids as "D<id>" (parity with the "P<id>" prompt-corpus
       // convention) so obs ids can't collide in the shared injected-ids file.
       const dedupIds = openRows.map(r => `D${r.id}`);
-      if (openRows.length > 0 && !shouldSkipByDedup(dedupIds, INJECTED_IDS_FILE)) {
+      if (openRows.length > 0 && !shouldSkipByDedup(dedupIds, INJECTED_IDS_FILE, hookData.session_id)) {
         const lines = ['[mem] Deferred work referenced in prompt (open items, full detail):'];
         for (const r of openRows) {
           const pTag = r.priority === 3 ? '🔴' : r.priority === 1 ? '⚪' : '🟡';
@@ -680,15 +685,20 @@ async function main() {
           let prevCount = 0;
           try {
             const prev = JSON.parse(readFileSync(INJECTED_IDS_FILE, 'utf8'));
-            if (prev.ts && Date.now() - prev.ts < DEDUP_STALE_MS) {
+            // M-6: inherit only same-session (or legacy) state — another session's
+            // ids/count must not carry over. Atomic write below: a torn concurrent
+            // write left the shared marker as invalid JSON (dedup silently off).
+            if (prev.ts && Date.now() - prev.ts < DEDUP_STALE_MS
+                && !(prev.session && hookData.session_id && prev.session !== hookData.session_id)) {
               prevIds = Array.isArray(prev.ids) ? prev.ids : [];
               prevCount = prev.count || 0;
             }
           } catch {}
-          writeFileSync(INJECTED_IDS_FILE, JSON.stringify({
+          atomicWriteFileSync(INJECTED_IDS_FILE, JSON.stringify({
             ids: [...new Set([...prevIds.map(String), ...dedupIds])],
             ts: Date.now(),
             count: prevCount + 1,
+            ...(hookData.session_id ? { session: hookData.session_id } : {}),
           }));
         } catch {}
       }
@@ -712,7 +722,13 @@ async function main() {
   if (!db) {
     try {
       db = ensureDb();
-    } catch { return; }
+    } catch (e) {
+      // A failed DB open silently kills EVERY prompt-time injection while `stats`
+      // reads zero errors (audit 2026-08-14 M-5) — record before the mandatory
+      // swallow. Exact blindness class of the 2026-08-13 pre-recall:db-open outage.
+      recordHookError('ups:db-open', e, RUNTIME_DIR);
+      return;
+    }
   }
 
   try {
@@ -854,7 +870,7 @@ async function main() {
     const candidateIds = rows.length > 0
       ? rows.map(r => r.id)
       : promptRows.map(r => `P${r.id}`);
-    const dedupSkip = shouldSkipByDedup(candidateIds, INJECTED_IDS_FILE);
+    const dedupSkip = shouldSkipByDedup(candidateIds, INJECTED_IDS_FILE, hookData.session_id);
 
     const output = !dedupSkip
       ? (rows.length > 0 ? formatResults(rows) : formatPromptResults(promptRows))
@@ -866,12 +882,17 @@ async function main() {
         let prevCount = 0;
         try {
           const prev = JSON.parse(readFileSync(INJECTED_IDS_FILE, 'utf8'));
-          if (prev.ts && Date.now() - prev.ts < DEDUP_STALE_MS) prevCount = prev.count || 0;
+          // M-6: same-session (or legacy) count only; atomic write (torn-write guard).
+          if (prev.ts && Date.now() - prev.ts < DEDUP_STALE_MS
+              && !(prev.session && hookData.session_id && prev.session !== hookData.session_id)) {
+            prevCount = prev.count || 0;
+          }
         } catch {}
-        writeFileSync(INJECTED_IDS_FILE, JSON.stringify({
+        atomicWriteFileSync(INJECTED_IDS_FILE, JSON.stringify({
           ids: candidateIds,
           ts: Date.now(),
           count: prevCount + 1,
+          ...(hookData.session_id ? { session: hookData.session_id } : {}),
         }));
       } catch {}
       // v26 P0: bump injection_count for obs-based emits only (prompt-corpus
@@ -932,8 +953,11 @@ async function main() {
         finally { rdb.close(); }
       }
     } catch { /* silent — never block on recommendation failure */ }
-  } catch {
-    // Hooks must never break Claude Code — swallow all errors
+  } catch (e) {
+    // Hooks must never break Claude Code — swallow, but RECORD: this catch wraps
+    // every FTS query on the surface, so a schema/FTS drift here would zero out
+    // prompt-time injection with no trace anywhere (audit 2026-08-14 M-5).
+    recordHookError('ups:search', e, RUNTIME_DIR);
   } finally {
     try { db.close(); } catch {}
   }
@@ -962,5 +986,8 @@ export function isDirectInvocation(metaUrl, argv1) {
   return metaUrl.split('?')[0] === pathToFileURL(argv1).href;
 }
 if (isDirectInvocation(import.meta.url, process.argv[1])) {
-  main().catch(() => {});
+  // Last-resort telemetry for anything that escapes main()'s own catches (e.g. a
+  // throw between the entry and the guarded body). Recorder never throws; the
+  // outer catch keeps the never-non-zero-exit invariant regardless.
+  main().catch((e) => { try { recordHookError('ups:main', e, RUNTIME_DIR); } catch { /* never */ } });
 }

package/search-engine.mjs

@@ -10,7 +10,9 @@ import {
   DEFAULT_DECAY_HALF_LIFE_MS,
   notLowSignalTitleClause, LOW_SIGNAL_TITLE,
   relaxFtsQueryToOr, debugLog, debugCatch, estimateTokens,
+  noisePenaltyClause,
 } from './utils.mjs';
+import { citeFactorClause } from './scoring-sql.mjs';
 import { getVocabulary, computeVector, vectorSearch, rrfMerge, vectorsEnabled } from './tfidf.mjs';
 import { extractPRFTerms, expandQueryByConcepts } from './search-scoring.mjs';
 
@@ -21,13 +23,26 @@ import { extractPRFTerms, expandQueryByConcepts } from './search-scoring.mjs';
 // exponent large-positive → EXP overflowed to +Infinity → score -Infinity → that row sorted
 // #1 for any match AND JSON.stringify emitted `"score": null` (numeric-contract break). A
 // future row now reads as age 0 = max (finite) recency, not Infinity.
+// M-3 (audit 2026-08-14): cite/noise behavior factors joined FULL_SCORE — they had
+// shipped for months on every AUTO surface (UPS / pre-tool-recall / hook-memory)
+// while the EXPLICIT surfaces (mem_search / CLI search) discarded the accumulated
+// citation + noise signal (the mirror image of "guards wired on the auto face,
+// missing on the explicit face"). Both factors are hard-bounded (cite ∈ [0.4, 3.0],
+// noise ∈ {0.2, 0.5, 1.0}), so they reorder, never dominate. algo-F6 note: the
+// access-count LN bonus below stays — noisePenalty uses access_count only inside a
+// ratio GUARD (never as a bonus) and citeFactor reads cited/uncited columns, so no
+// term is counted twice as a reward. Denoise A/B 2026-08-16: NEUTRAL (suite rows
+// carry zero cite/noise state); the behavioral pin lives in
+// tests/audit-fixes-20260816.test.mjs (M-3).
 const FULL_SCORE = `${OBS_BM25}
   * (1.0 + EXP(-0.693 * MAX(0, ? - MAX(o.created_at_epoch, COALESCE(o.last_accessed_at, o.created_at_epoch))) / ${TYPE_DECAY_CASE}))
   * ${TYPE_QUALITY_CASE}
   * (CASE WHEN ? IS NOT NULL AND o.project = ? THEN 2.0 ELSE 1.0 END)
   * (0.5 + 0.5 * COALESCE(o.importance, 1))
   * (1.0 + 0.1 * LN(1 + COALESCE(o.access_count, 0)))
-  * (1.0 + 0.3 * (o.lesson_learned IS NOT NULL AND o.lesson_learned NOT IN ('', 'none')))`;
+  * (1.0 + 0.3 * (o.lesson_learned IS NOT NULL AND o.lesson_learned NOT IN ('', 'none')))
+  * ${noisePenaltyClause('o')}
+  * ${citeFactorClause('o')}`;
 
 const SIMPLE_SCORE = `${OBS_BM25}
   * (1.0 + EXP(-0.693 * MAX(0, ? - MAX(o.created_at_epoch, COALESCE(o.last_accessed_at, o.created_at_epoch))) / ${TYPE_DECAY_CASE}))
@@ -294,6 +309,10 @@ function expandObsByConceptCo(db, ctx, now, existingIds, results, includeNoise =
 function expandObsByPRF(db, ctx, now, primaryCount, existingIds, results, includeNoise = false) {
   const { ftsQuery, args, epochFrom, epochTo, limit } = ctx;
   if (primaryCount < 3) return;
+  // effectiveFtsQuery = the query that actually matched (OR-relaxed when the strict
+  // AND missed and the fallback rescued rows — M-2). The strict query here returned
+  // zero top docs in that case, silently disabling PRF where it helps most.
+  const seedQuery = ctx.effectiveFtsQuery || ftsQuery;
   const topResults = db.prepare(`
     SELECT o.title, o.narrative FROM observations_fts
     JOIN observations o ON observations_fts.rowid = o.id
@@ -302,7 +321,7 @@ function expandObsByPRF(db, ctx, now, primaryCount, existingIds, results, includ
       AND (? IS NULL OR o.project = ?)
     ORDER BY ${OBS_BM25}
     LIMIT 8
-  `).all(ftsQuery, args.project ?? null, args.project ?? null);
+  `).all(seedQuery, args.project ?? null, args.project ?? null);
   const prfTerms = extractPRFTerms(topResults, ftsQuery);
   if (prfTerms.length === 0) return;
   const prfFts = prfTerms.map(t => `"${t.replace(/"/g, '""')}"`).join(' OR ');
@@ -428,17 +447,28 @@ export function searchObservationsHybrid(db, ctx) {
       try {
         const orRows = db.prepare(buildObsFtsQuery('full', { multiplier: 0.5, withSnippet: true, withOffset: true, includeNoise }))
           .all(...buildObsFtsParams({ now, projectBoost, ftsQuery: orQuery, args, epochFrom, epochTo, limit: perSourceLimit, offset: perSourceOffset }));
-        if (orRows.length > 0) ctx.orFallbackFired = true;
+        if (orRows.length > 0) {
+          ctx.orFallbackFired = true;
+          // M-2: PRF's top-doc probe re-queries FTS itself — with the strict-AND
+          // query it reads 0 docs in exactly the OR-rescue case, keeping PRF inert.
+          // Record the query that actually produced the evidence rows.
+          ctx.effectiveFtsQuery = orQuery;
+        }
         for (const r of orRows) results.push(ftsRowToResult(r, { snippet: true }));
       } catch (e) { debugCatch(e, 'searchObservationsHybrid-or-fallback'); }
     }
   }
 
-  // Two-phase query expansion (only when well below limit)
-  if (rows.length > 0 && results.length < Math.ceil(limit / 2)) {
+  // Two-phase query expansion (only when well below limit). Gate on results.length,
+  // NOT rows.length (M-2, audit 2026-08-14): `rows` is the strict-AND set only, so
+  // when strict-AND missed and the OR fallback rescued a few rows — exactly the
+  // vocab-mismatch shape where expansion helps most — the old gate read rows.length
+  // === 0 and skipped concept/PRF expansion entirely. PRF likewise seeds from the
+  // rescued rows now (they are the only relevance evidence available).
+  if (results.length > 0 && results.length < Math.ceil(limit / 2)) {
     const existingIds = new Set(results.map(r => r.id));
     expandObsByConceptCo(db, ctx, now, existingIds, results, includeNoise);
-    expandObsByPRF(db, ctx, now, rows.length, existingIds, results, includeNoise);
+    expandObsByPRF(db, ctx, now, results.length, existingIds, results, includeNoise);
   }
 
   // Vector search + RRF hybrid merge

package/search-scoring.mjs

@@ -165,8 +165,13 @@ export function extractPRFTerms(results, ftsQuery, limit = 3) {
   // "cach" returns zero rows, only "caching"/"cache" match). Emitting a bare stem would
   // silently match nothing and kill expansion recall. Track each stem's surface forms with
   // their occurrence counts and emit the most frequent (best-matchable) surface.
-  const stemDocCount = {};      // stem -> # of top docs it appears in (the >=2 bar)
-  const stemSurfaces = {};      // stem -> Map(surface -> total occurrences)
+  // Prototype-less: doc text tokenizes to arbitrary identifiers, and a stem that
+  // collides with an Object.prototype property ("constructor" — common in code
+  // narratives) made `stemSurfaces[stem] ||= new Map()` read the INHERITED function
+  // as truthy, skip the assignment, and crash on sm.get (surfaced 2026-08-16 when
+  // the M-2 gate fix first ran PRF over OR-rescued rows).
+  const stemDocCount = Object.create(null);   // stem -> # of top docs it appears in (the >=2 bar)
+  const stemSurfaces = Object.create(null);   // stem -> Map(surface -> total occurrences)
   const docCount = Math.min(results.length, 8);
   for (let i = 0; i < docCount; i++) {
     const r = results[i];

package/server.mjs

@@ -27,8 +27,11 @@ import { effectiveQuiet, RUNTIME_DIR } from './hook-shared.mjs';
 import { TIER_CASE_SQL, tierSqlParams } from './tier.mjs';
 import { computeStatsFeed } from './lib/stats-core.mjs';
 import { buildLessonNudge } from './lib/save-nudge.mjs';
-import { formatObsFieldValue } from './cli/common.mjs';
-import { neutralizeContextDelimiters } from './format-utils.mjs';
+import { formatObsFieldValue, obsFieldLabel, formatPendingPurgeLine } from './cli/common.mjs';
+// The partial-export warning points the caller at the CLI twin, which exports the complete
+// set by default — the invocation has to be the one that actually works on this install.
+import { CLI_INVOKE } from './cli-path.mjs';
+import { neutralizeContextDelimiters, neutralizeSkillDelimiters } from './format-utils.mjs';
 import { memSearchSchema, memRecentSchema, memTimelineSchema, memGetSchema, memDeleteSchema, memSaveSchema, memStatsSchema, memCompressSchema, memMaintainSchema, memOptimizeSchema, memUpdateSchema, memExportSchema, memRecallSchema, memFtsCheckSchema, memRegistrySchema, memBrowseSchema, memUseSchema, memDeferSchema, memDeferListSchema, memDeferDropSchema, tools as TOOL_DEFS } from './tool-schemas.mjs';
 
 // Lookup helper: all user-facing tool descriptions live in tool-schemas.mjs
@@ -638,7 +641,7 @@ server.registerTool(
           // gets a scannable hint instead of a bare millisecond integer.
           const display = formatObsFieldValue(f, val);
           const maxLen = f === 'narrative' ? 1000 : f === 'lesson_learned' ? 500 : f === 'text' ? 500 : 200;
-          lines.push(`${f}: ${typeof display === 'string' && display.length > maxLen ? display.slice(0, maxLen) + '…' : display}`);
+          lines.push(`${obsFieldLabel(f)}: ${typeof display === 'string' && display.length > maxLen ? display.slice(0, maxLen) + '…' : display}`);
         }
         sections.push(lines.join('\n'));
       }
@@ -1113,7 +1116,7 @@ server.registerTool(
         `  Stale (>30d, imp=1, no access, never injected): ${stats.stale}`,
         `  Broken (no title/narrative): ${stats.broken}`,
         `  Boostable (accessed>3, imp<3): ${stats.boostable}`,
-        `  Pending purge (idle-marked): ${stats.pendingPurge}`,
+        formatPendingPurgeLine(stats.pendingPurge),
       ];
       if (duplicates.length > 0) {
         const autoMergeable = duplicates.filter(d => parseFloat(d.similarity) >= AUTO_MERGE_THRESHOLD);
@@ -1159,32 +1162,22 @@ server.registerTool(
       const staleAge = Date.now() - STALE_AGE_MS;
       const mctx = { projectFilter, baseParams, staleAge, opCap: OP_CAP };
 
-      // T2-P0-A: purge_stale is the only DELETE in this handler. Require confirm=true;
-      // a first call without confirm returns a dry-run preview so callers know the blast radius.
-      const purgeRequested = ops.includes('purge_stale');
-      if (purgeRequested && args.confirm !== true) {
-        const retainDays = args.retain_days ?? 30;
-        const retainCutoff = Date.now() - retainDays * 86400000;
-        const previewRow = purgeStalePreview(db, mctx, retainCutoff);
-        const lines = [
-          'purge_stale preview (confirm=false):',
-          `  Candidates (pending-purge, older than ${retainDays}d): ${previewRow.candidates}`,
-        ];
-        if (previewRow.candidates > 0) {
-          lines.push(`  Oldest: ${new Date(previewRow.oldest).toISOString().slice(0, 10)}`);
-          lines.push(`  Newest: ${new Date(previewRow.newest).toISOString().slice(0, 10)}`);
-        }
-        lines.push('');
-        lines.push('Nothing was deleted. To execute, re-run with confirm=true:');
-        lines.push(`  mem_maintain(action="execute", operations=${JSON.stringify(ops)}, confirm=true${args.retain_days ? `, retain_days=${args.retain_days}` : ''}${args.project ? `, project="${args.project}"` : ''})`);
-        return { content: [{ type: 'text', text: lines.join('\n') }] };
-      }
+      // T2-P0-A: purge_stale is the only op gated on confirm=true — cleanupBroken also
+      // hard-deletes (broken rows only) but always ran unconfirmed on both surfaces, and
+      // the pre-transaction snapshot above covers it. An unconfirmed call gets a dry-run
+      // preview of the purge INSTEAD OF the purge.
+      // M-7 (audit 2026-08-14): preview-instead-of-early-return — the old
+      // `return`-on-unconfirmed skipped EVERY requested op, while the CLI twin ran the
+      // non-destructive ones (cleanup/decay/boost) and previewed only the purge. Same
+      // op list, two different amounts of work done, both reporting success. Aligned
+      // to the CLI semantics (the safer surface changed less: nothing destructive
+      // runs unconfirmed on either surface now or before).
+      const purgeConfirmed = args.confirm === true;
 
       // MED-2: snapshot the DB before the irreversible cleanup/purge hard-deletes —
       // only when rows will actually be removed, and OUTSIDE the transaction below
-      // (VACUUM cannot run inside one). purge_stale is already confirmed by here (the
-      // preview branch returned above otherwise). Best-effort; snapshotDb never throws.
-      if (hardDeleteCandidateCount(db, mctx, { cleanup: ops.includes('cleanup'), purge: ops.includes('purge_stale') }) > 0) {
+      // (VACUUM cannot run inside one). Best-effort; snapshotDb never throws.
+      if (hardDeleteCandidateCount(db, mctx, { cleanup: ops.includes('cleanup'), purge: ops.includes('purge_stale') && purgeConfirmed }) > 0) {
         snapshotDb(db, { tag: 'pre-maintain' });
       }
 
@@ -1198,8 +1191,25 @@ server.registerTool(
         if (ops.includes('purge_stale')) {
           const retainDays = args.retain_days ?? 30;
           const retainCutoff = Date.now() - retainDays * 86400000;
-          const purged = purgeStale(db, mctx, retainCutoff);
-          results.push(`Purged ${purged} stale observations (retained last ${retainDays} days)` + (purged >= OP_CAP ? ' (cap reached, re-run for more)' : ''));
+          if (!purgeConfirmed) {
+            // Dry-run preview (parity with CLI `maintain` without --confirm): the other
+            // requested non-destructive ops still run below.
+            const previewRow = purgeStalePreview(db, mctx, retainCutoff);
+            const lines = [
+              'purge_stale preview (confirm=false):',
+              `  Candidates (pending-purge, older than ${retainDays}d): ${previewRow.candidates}`,
+            ];
+            if (previewRow.candidates > 0) {
+              lines.push(`  Oldest: ${new Date(previewRow.oldest).toISOString().slice(0, 10)}`);
+              lines.push(`  Newest: ${new Date(previewRow.newest).toISOString().slice(0, 10)}`);
+            }
+            lines.push('  Nothing was deleted. To delete, re-run with confirm=true:');
+            lines.push(`  mem_maintain(action="execute", operations=${JSON.stringify(ops)}, confirm=true${args.retain_days ? `, retain_days=${args.retain_days}` : ''}${args.project ? `, project="${args.project}"` : ''})`);
+            results.push(lines.join('\n'));
+          } else {
+            const purged = purgeStale(db, mctx, retainCutoff);
+            results.push(`Purged ${purged} stale observations (retained last ${retainDays} days)` + (purged >= OP_CAP ? ' (cap reached, re-run for more)' : ''));
+          }
         }
 
         if (ops.includes('cleanup')) {
@@ -1567,6 +1577,11 @@ server.registerTool(
 
 // ─── Tool: mem_use ──────────────────────────────────────────────────────────
 
+// Cap on the caller-supplied name echoed back in a miss message. Well past any real
+// skill/agent name (the longest registered one here is 23 chars), short enough that an
+// unbounded argument cannot pad the response — the echo appears twice.
+const ECHO_NAME_MAX = 80;
+
 server.registerTool(
   'mem_use',
   {
@@ -1582,8 +1597,8 @@ server.registerTool(
     const name = args.name.trim();
     const type = args.type || 'skill';
 
-    // 1. Exact match by name or invocation_name
-    let row = rdb.prepare(`
+    // 1. Exact match by name or invocation_name — the ONLY path that loads content.
+    const row = rdb.prepare(`
       SELECT id, name, type, local_path, invocation_name, capability_summary
       FROM resources
       WHERE status = 'active' AND type = ?
@@ -1591,16 +1606,36 @@ server.registerTool(
       LIMIT 1
     `).get(type, name, name);
 
-    // 2. Fuzzy fallback: FTS5 search, take top result
+    // 2. Name miss → SUGGEST, never substitute. The FTS5 search still runs (it is what
+    // produces the candidate list), but its result is only ever rendered as names: loading
+    // the top hit under the caller's requested name shipped a different skill's body inside
+    // <skill-loaded> plus "Follow the instructions above to execute this <type>." — with
+    // nothing marking the swap, so an agent that asked for A executed B (audit F1,
+    // 2026-08-14: with only `deploy-rollback-runbook` registered, `deploy-notes` /
+    // `rollback-checklist` / `runbook-index` each returned its full body). Loading stays an
+    // exact-name decision the caller makes.
     if (!row) {
-      const results = searchResources(rdb, name, { type, limit: 1 });
-      if (results.length > 0) {
-        row = rdb.prepare(`SELECT id, name, type, local_path, invocation_name, capability_summary FROM resources WHERE name = ? AND type = ? AND status = 'active'`).get(results[0].name, results[0].type);
+      let candidates = [];
+      try { candidates = searchResources(rdb, name, { type, limit: 5 }).map((r) => r.name).filter(Boolean); }
+      catch { /* a suggestion is best-effort; the miss message below still stands */ }
+      // Every echo of the caller's own name below is bounded + delimiter-inert (audit F7):
+      // raw interpolation let a crafted `name` forge a <skill-loaded> block and the execute
+      // imperative inside this message, and the handler-wide defangResult cannot catch it —
+      // <skill-loaded> is off CONTEXT_DELIMITER_RE precisely so the real load path can emit
+      // it. `truncate` also folds newlines, so a multi-line name cannot fake block structure.
+      // Registered names are defanged too (a crafted one can be imported), but NOT truncated:
+      // the suggestion tells the caller to load one by its exact name, so it must stay exact.
+      const echoed = neutralizeSkillDelimiters(truncate(name, ECHO_NAME_MAX));
+      const echoedCandidates = candidates.map((n) => neutralizeSkillDelimiters(n));
+      const head = `No ${type} found for "${echoed}".`;
+      const browse = `mem_registry(action="search", query="${echoed}")`;
+      if (candidates.length === 0) {
+        return { content: [{ type: 'text', text: `${head} Try ${browse} to browse.` }] };
       }
-    }
-
-    if (!row) {
-      return { content: [{ type: 'text', text: `No ${type} found for "${name}". Try mem_registry(action="search", query="${name}") to browse.` }] };
+      const list = echoedCandidates.map((n) => `  - ${n}`).join('\n');
+      return { content: [{ type: 'text', text:
+        `${head} Closest ${type}s by search (NOT loaded — none matched the name you asked for):\n${list}\n\n` +
+        `Load one deliberately with its exact name, e.g. mem_use(name="${echoedCandidates[0]}"${type === 'skill' ? '' : `, type="${type}"`}), or browse with ${browse}.` }] };
     }
 
     // 3. Resolve path: directory skills → SKILL.md (agents always have full .md paths)
@@ -1717,7 +1752,13 @@ async function runExport(db, args) {
   }
 
   const where = wheres.length > 0 ? 'WHERE ' + wheres.join(' AND ') : '';
-  const exportLimit = Math.min(args.limit ?? 200, 1000);
+  // No clamp (audit 2026-08-14 A2): `Math.min(args.limit ?? 200, 1000)` made an MCP-driven
+  // backup of a >1000-row store impossible, on the tool whose own description says "USE
+  // when: Backing up memory before a migration or reinstall" — while the CLI twin exported
+  // the complete matching set (mem-cli.mjs cmdExport, fixed there for the same reason). The
+  // DEFAULT stays 200: an MCP result is model context, so a bare exploratory call must not
+  // dump a whole store into the transcript. An explicit limit is now honoured at any size.
+  const exportLimit = args.limit ?? 200;
   // T3-P2-B: probe limit+1 so we can tell "user hit their own limit with more waiting" from
   // "user got exactly what existed". Trim to exportLimit before rendering.
   // EXPORT_COLUMNS_SQL: shared with CLI cmdExport — the full round-trippable set restore
@@ -1733,7 +1774,27 @@ async function runExport(db, args) {
     ? rows.map(r => JSON.stringify(r)).join('\n')
     : JSON.stringify(rows, null, 2);
 
-  const cap = moreAvailable ? `\nNote: Results capped at ${exportLimit}. Use date_from/date_to or increase limit (max 1000) to export more.` : '';
+  // A truncated backup is the failure mode this tool must never produce quietly: the old
+  // note ("Results capped at N … increase limit (max 1000)") never said how much was
+  // missing, and its advice was a dead end on a store past the ceiling. Name the real
+  // total, the number of rows left out, and a remedy that actually returns all of them.
+  //
+  // The remedy has to lead with a FILE REDIRECT (pre-tag review, 2026-08-14). Removing the
+  // 1000-row ceiling took away the only bound on an MCP export's size, and the 200 default
+  // is kept precisely because an MCP result IS model context — so "re-run with
+  // limit: <total>", the previous first suggestion, told the caller to put the entire store
+  // into one tool result (thin fixture rows measure ~612 bytes each, so a few-thousand-row
+  // store is megabytes in a single message), and a bare `cli.mjs export` had the same
+  // property unredirected. The limit re-run stays mentioned but demoted, with its cost
+  // stated: it is occasionally what the caller actually wants, and silently dropping it
+  // would send them back to guessing.
+  let cap = '';
+  if (moreAvailable) {
+    const total = db.prepare(`SELECT COUNT(*) AS c FROM observations ${where}`).get(...params).c;
+    cap = `\nWARNING — PARTIAL EXPORT, NOT A COMPLETE BACKUP: capped at ${exportLimit} of ${total} matching observations; ${total - exportLimit} rows are missing from this payload and restoring it would lose them.` +
+      `\nFor a complete backup, write it to a FILE instead of pulling it through this conversation: \`${CLI_INVOKE} export --format jsonl > backup.jsonl\` (the CLI exports the complete set by default). Narrowing with date_from/date_to also works.` +
+      `\nRaising \`limit\` here is the last resort, not the first: this result is model context, so all ${total} rows would be loaded into the transcript.`;
+  }
   return { content: [{ type: 'text', text: `Exported ${rows.length} observations:${cap}\n${output}` }] };
 }
 

package/source-files.mjs

@@ -264,9 +264,37 @@ const LAUNCHER_SCRIPT_FILES = [
   'binding-probe-cli.mjs',
 ];
 
+// Plugin/marketplace DECLARATION files (audit 2026-08-14 P-2). Not executable
+// themselves, but they NAME what gets executed: hooks/hooks.json declares the
+// command lines Claude Code runs on every hook fire, .mcp.json declares the MCP
+// server launch command, plugin.json/marketplace.json steer the install source,
+// commands/*.md are model-visible skill bodies, registry/preinstalled.json seeds
+// the resource registry. All ship in the tarball; none were signed — the same
+// shape as the two closed RCE gaps (hook scripts v3.40, launch.mjs v3.42): a
+// release published without the signing key could swap hooks.json to point a
+// hook event at an arbitrary command while every signed hash still matched.
+// Additive: buildReleaseManifest skips entries absent at sign time, and
+// verifyReleaseFiles needs no change to enforce whatever the manifest carries.
+const PLUGIN_DECLARATION_FILES = [
+  'hooks/hooks.json',
+  '.mcp.json',
+  '.claude-plugin/plugin.json',
+  '.claude-plugin/marketplace.json',
+  'registry/preinstalled.json',
+  'commands/mem.md',
+  'commands/memory.md',
+  'commands/update.md',
+  'commands/tools.md',
+  'commands/adopt.md',
+  'commands/unadopt.md',
+  'commands/lesson.md',
+  'commands/bug.md',
+];
+
 // The complete set of files the release signature MUST cover: every runtime .mjs
 // (SOURCE_FILES) PLUS the executable hook scripts (copyReleaseIntoStaging installs these
-// into the live dir and they run on every hook fire) PLUS the launcher/setup scripts.
+// into the live dir and they run on every hook fire) PLUS the launcher/setup scripts
+// PLUS the plugin declaration files above.
 // HOOK_SCRIPT_FILES were historically NOT in the signed manifest, so an attacker able to
 // PUBLISH a release — but without the signing key — could swap a hook script (e.g.
 // post-tool-use.sh / hook-launcher.mjs) while every SOURCE_FILES hash still matched, and
@@ -278,4 +306,5 @@ export const RELEASE_SIGNED_FILES = [
   ...SOURCE_FILES,
   ...HOOK_SCRIPT_FILES.map(name => `scripts/${name}`),
   ...LAUNCHER_SCRIPT_FILES.map(name => `scripts/${name}`),
+  ...PLUGIN_DECLARATION_FILES,
 ];

package/tool-schemas.mjs

@@ -206,7 +206,7 @@ export const memSaveSchema = {
   type: OBS_TYPE_ENUM.optional().describe('Observation type (default: discovery)'),
   project: z.string().optional().describe('Project name (default: inferred from CWD)'),
   importance: coerceInt.pipe(z.number().int().min(1).max(3)).optional().describe('Importance level: 1=routine, 2=notable, 3=critical (default: 2 for explicit saves)'),
-  files: coerceStringArray.optional().describe('File paths associated with this observation'),
+  files: coerceStringArray.optional().describe('File paths associated with this observation. Stored in the `files_modified` column and rendered as `files` — passing a path here does not assert the file was edited; a file you only read belongs here too'),
   lesson_learned: z.string().max(500).optional().describe('Key lesson or takeaway, ≤500 chars (for bugfix: root cause & fix; for decision: rationale)'),
   closes_deferred: coerceDeferredTokens.optional().describe('Close one or more deferred_work items in the same project. Mixed array: bare integer = ordinal-within-project, "D#<n>" string = raw id. Transactional with the obs insert — a single invalid id rolls back the whole save.'),
   supersedes: coerceSupersedes.optional().describe('Observation ids (same project) that this save overturns. They are marked superseded — dropped from live search — and linked to the new row (superseded_by). Use ONLY when this genuinely replaces a prior conclusion; do NOT use for merely-related or updated-but-still-valid memories.'),
@@ -280,7 +280,13 @@ export const memExportSchema = {
   from: z.string().optional().describe('Alias for `date_from` (CLI `export --from`)'),
   to: z.string().optional().describe('Alias for `date_to` (CLI `export --to`)'),
   include_compressed: coerceBool.optional().describe('Include compressed observations (default: false)'),
-  limit: coerceInt.pipe(z.number().int().min(1).max(1000)).optional().describe('Max observations to export (default: 200, max: 1000)'),
+  // No upper bound: this is the BACKUP tool ("USE when: Backing up memory before a
+  // migration or reinstall"), and a 1000-row ceiling made a complete backup of a bigger
+  // store impossible over MCP while the CLI twin exported everything (audit 2026-08-14 A2).
+  // The default stays 200 because an MCP result is model context — a bare exploratory call
+  // must not dump a whole store into the transcript — but a capped result now announces
+  // itself as PARTIAL and names the limit that would return all of it.
+  limit: coerceInt.pipe(z.number().int().min(1)).optional().describe('Max observations to export (default: 200 — a capped result is flagged PARTIAL and names the total; pass that total for a complete backup, no upper bound)'),
 };
 
 export const memRecallSchema = {
@@ -589,7 +595,8 @@ export const tools = [
   {
     name: 'mem_use',
     description:
-      'Load and activate a skill or agent from the registry by name (exact or fuzzy).\n' +
+      'Load and activate a skill or agent from the registry by EXACT name or invocation_name.\n' +
+      'A name that matches nothing returns closest-match names to pick from — never another resource\'s content.\n' +
       '\n' +
       'DO NOT use when:\n' +
       '  - You have not confirmed the skill exists (run mem_registry action="list" first)\n' +