claude-mem-lite 3.62.0 → 3.63.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "3.62.0",
+      "version": "3.63.0",
       "source": "./",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."
     }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.62.0",
+  "version": "3.63.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/README.md

@@ -529,6 +529,32 @@ Notes:
 - Direct install / npx mode keeps auto-update enabled and uses staged replacement with rollback on install failure.
 - If you disabled the plugin but still have old mem hooks in `~/.claude/settings.json`, run `node install.mjs cleanup-hooks`.
 
+#### Trust model per install path
+
+The three install paths do **not** carry the same supply-chain guarantees — pick the one that matches your threat model:
+
+| Path | Update mechanism | Ed25519 release-signature verification |
+|------|------------------|----------------------------------------|
+| npm / npx / git-clone direct install | auto-update from GitHub Releases | **Yes** — every runtime file (140 entries incl. hook scripts, MCP launcher, plugin declaration files) is hash-pinned in a signed manifest; verification is fail-closed |
+| `/plugin install` (marketplace) | manual `/plugin marketplace update` + reinstall | **No** — Claude Code installs from a git clone of the marketplace repo; the plugin's own signature chain is not consulted on this path. You are trusting GitHub + the repo's branch protection, not the release signing key |
+
+**Rollback recipe (plugin path).** If an update misbehaves, pin the marketplace clone to the previous release tag and reinstall from it:
+
+```bash
+# 1. Find the local marketplace clone
+ls ~/.claude/plugins/marketplaces/          # e.g. sdsrss
+
+# 2. Pin it to the previous good tag (tags mirror npm versions, e.g. v3.62.0)
+cd ~/.claude/plugins/marketplaces/sdsrss
+git fetch --tags && git checkout v3.62.0
+
+# 3. Reinstall from the pinned clone — inside Claude Code:
+#    /plugin install claude-mem-lite@sdsrss
+# 4. To leave the pin later: git checkout main, then the normal update flow.
+```
+
+Your data directory (`~/.claude-mem-lite/`) is untouched by install/rollback; schema migrations are forward-only, so after rolling back more than one minor version check `node install.mjs doctor` before trusting search results.
+
 ### doctor
 
 Checks Node.js version, dependencies, server/hook files, database integrity, FTS5 indexes, and stale processes.

package/format-utils.mjs

@@ -123,6 +123,27 @@ export function neutralizeSkillDelimiters(s) {
   return defangToFixpoint(s, SKILL_BLOCK_RE);
 }
 
+// <skill-bridge> is the wrapper scripts/pre-skill-bridge.js puts around a managed
+// skill body it injects as PreToolUse additionalContext. The body comes from a
+// third-party repo (tools/adopt import) — an untrusted boundary — so a literal
+// `</skill-bridge>` inside it would close the wrapper early and spill the rest of
+// the payload (e.g. a forged <system-reminder>) as undelimited context (audit
+// 2026-08-14 M-4). Not in CONTEXT_DELIMITER_RE for the same reason <skill-loaded>
+// isn't: the bridge's OWN wrapper must stay live, so the defang is applied per
+// call site to the untrusted body only.
+const SKILL_BRIDGE_RE = /<\/?skill-bridge(?:\s[^>]*)?>/gi;
+
+/**
+ * Defang a literal `<skill-bridge>` opener/closer in untrusted text that is about
+ * to be wrapped in a real skill-bridge block. Same fixpoint treatment as the
+ * classes above. Never apply to the wrapper itself.
+ * @param {string} s Input string (any type; coerced)
+ * @returns {string} Text with skill-bridge delimiters defanged
+ */
+export function neutralizeSkillBridgeDelimiters(s) {
+  return defangToFixpoint(s, SKILL_BRIDGE_RE);
+}
+
 /**
  * Render the PostToolUse error-recall hint block (hook.mjs::triggerErrorRecall).
  * The single most-relevant hit (rows[0]) that carries a lesson_learned gets its

package/hook.mjs

@@ -494,8 +494,12 @@ function triggerErrorRecall(db, toolInput, response) {
         AND COALESCE(o.compressed_into, 0) = 0
         AND o.superseded_at IS NULL
         AND ${notLowSignalTitleClause('o')}
+      -- MAX(0, …) clamps recency age to >= 0 (parity with search-engine FULL_SCORE):
+      -- a far-future created_at (reachable via restore/import-jsonl, which accept
+      -- arbitrary epochs) made the exponent large-positive → EXP overflow → that row
+      -- pinned #1 for every error until its "future" passed (audit 2026-08-14 M-1).
       ORDER BY ${OBS_BM25}
-        * (1.0 + EXP(-0.693 * (? - o.created_at_epoch) / 1209600000.0))
+        * (1.0 + EXP(-0.693 * MAX(0, ? - o.created_at_epoch) / 1209600000.0))
       LIMIT 3
     `).all(ftsQuery, project, nowR);
 
@@ -1017,6 +1021,15 @@ function runSessionStartAutoMaintain(db) {
 
       // Auto-dedup (exact): merge identical-title observations within 1h.
       // Catches rapid duplicate writes (same hook firing twice, race conditions).
+      // BOTH join sides must be live (audit 2026-08-14 H-1): without the
+      // superseded_at filters (which the fuzzy channel below always had), a row the
+      // fuzzy pass had tombstoned could come back as `a` (a.id < b.id) and tombstone
+      // the LIVE keeper `b` — both copies gone from every read path. Worse, a user
+      // correction saved with supersedes=[#A] (A.superseded_by = B's NUMERIC id) has
+      // the same title as A, so the pair (A, B) tombstoned the correction B itself
+      // and the string 'auto-dedup' write clobbered numeric supersession chains that
+      // citation-tracker decay hand-off and timeline re-anchoring both follow. The
+      // UPDATE repeats the guard so a concurrent writer can't re-stamp a chain.
       const dupPairs = db.prepare(`
         SELECT a.id as keep_id, b.id as remove_id
         FROM observations a
@@ -1025,12 +1038,14 @@ function runSessionStartAutoMaintain(db) {
           AND ABS(a.created_at_epoch - b.created_at_epoch) < 3600000
           AND COALESCE(a.compressed_into, 0) = 0
           AND COALESCE(b.compressed_into, 0) = 0
+          AND a.superseded_at IS NULL
+          AND b.superseded_at IS NULL
         LIMIT 20
       `).all();
       if (dupPairs.length > 0) {
         const removeIds = dupPairs.map(p => p.remove_id);
         const ph = removeIds.map(() => '?').join(',');
-        db.prepare(`UPDATE observations SET superseded_at = ?, superseded_by = 'auto-dedup' WHERE id IN (${ph})`).run(Date.now(), ...removeIds);
+        db.prepare(`UPDATE observations SET superseded_at = ?, superseded_by = 'auto-dedup' WHERE id IN (${ph}) AND superseded_at IS NULL`).run(Date.now(), ...removeIds);
         debugLog('DEBUG', 'auto-maintain', `auto-deduped ${dupPairs.length} near-identical observations`);
       }
 
@@ -1648,9 +1663,13 @@ async function handleUserPrompt() {
       try {
         const injectedFile = join(RUNTIME_DIR, `.claude-mem-injected-${project}`);
         const raw = readFileSync(injectedFile, 'utf8');
-        const { ids, ts } = JSON.parse(raw);
-        // Only use if written within last 10 seconds (same prompt cycle)
-        if (ts && Date.now() - ts < 10000 && Array.isArray(ids)) {
+        const { ids, ts, session } = JSON.parse(raw);
+        // Only use if written within last 10 seconds (same prompt cycle) AND by this
+        // CC session — the file is project-keyed, so a concurrent session's write
+        // would otherwise dedup-suppress OUR injection (M-6, audit 2026-08-14).
+        // Legacy payloads without `session` keep the old time-window-only behavior.
+        if (ts && Date.now() - ts < 10000 && Array.isArray(ids)
+            && !(session && ccSessionId && session !== ccSessionId)) {
           for (const id of ids) { keyContextIds.push(id); pathAInjectedIds.push(id); }
         }
       } catch { /* file may not exist — that's fine */ }
@@ -1871,6 +1890,11 @@ try {
   // lib/native-binding-hint.mjs.
   const line = formatHookError(err, event, { runtimeDir: RUNTIME_DIR });
   if (line) console.error(line);
+  // stderr alone is invisible to `stats` self-observation — only the native-binding
+  // family was persisted, so a non-binding fatal (schema drift, bad stdin shape)
+  // could kill every dispatch-routed surface while the hook-errors log read zero
+  // (audit 2026-08-14 M-5; same blindness one layer up from the v3.60 outage).
+  recordHookError(`hook:${event}`, err, RUNTIME_DIR);
 }
 
 process.exit(0);

package/install.mjs

@@ -1561,6 +1561,27 @@ async function doctor() {
     ok(`Native DB binding: loadable on Node ${process.version}`);
   }
 
+  // Disk footprint (audit 2026-08-14 M-9): a "lite" data dir had grown to 653MB
+  // against a 59MB DB — 360MB of it orphaned per-tag .bak snapshots — with no
+  // check anywhere. Cheap probes only (DB file + .bak aggregate, no tree walk).
+  // The budget itself is enforced by lib/db-backup on every new snapshot; this
+  // check surfaces stores that predate the budget or exceed it between snapshots.
+  try {
+    const { listSnapshots, backupBudgetBytes } = await import('./lib/db-backup.mjs');
+    const dbFile = join(MEM_DATA_DIR, 'claude-mem-lite.db');
+    const dbBytes = existsSync(dbFile) ? statSync(dbFile).size : 0;
+    const snaps = listSnapshots(dbFile);
+    const backupBytes = snaps.reduce((s, x) => s + x.size, 0);
+    const mb = (n) => (n / (1024 * 1024)).toFixed(1);
+    // Warn threshold = the REAL eviction budget (pre-release review 2026-08-16) —
+    // warning below it promised an eviction enforceBackupBudget would never do.
+    if (backupBytes > backupBudgetBytes()) {
+      dwarn(`Disk footprint: ${snaps.length} backup snapshot(s) hold ${mb(backupBytes)}MB, over the ${mb(backupBudgetBytes())}MB budget (CLAUDE_MEM_BACKUP_BUDGET_MB) — the next maintain/save snapshot evicts oldest snapshots past the 7d undo grace`);
+    } else {
+      ok(`Disk footprint: DB ${mb(dbBytes)}MB, ${snaps.length} backup snapshot(s) ${mb(backupBytes)}MB (budget ${mb(backupBudgetBytes())}MB)`);
+    }
+  } catch { /* footprint check is informational — never block doctor */ }
+
   // Plugin/hook lifecycle state
   const settings = readSettings();
   const hasHooks = hasMemHooksConfigured(settings);

package/lib/db-backup.mjs

@@ -7,10 +7,92 @@
 //
 // MUST be called OUTSIDE any transaction — VACUUM cannot run inside one, which is
 // why the maintenance entry points snapshot before opening their db.transaction().
-import { readdirSync, unlinkSync } from 'fs';
+import { readdirSync, unlinkSync, statSync } from 'fs';
 import { dirname, basename, join } from 'path';
 import { debugLog } from '../utils.mjs';
 
+// M-9 (audit 2026-08-14): per-tag retention alone let one-shot tags live forever —
+// each tag kept its newest 3, but a tag written once (pre-backfill-v3390 and four
+// siblings) never got a second snapshot to age it out, so 9 orphaned .bak files held
+// 360MB against a 59MB live DB. A TOTAL byte budget across ALL tags bounds the
+// footprint of a system whose name promises "lite". Oldest-first eviction, newest
+// snapshot always survives (the most recent safety net must outlive any budget).
+const DEFAULT_BACKUP_BUDGET_BYTES = 256 * 1024 * 1024;
+
+/** Effective budget (env-tunable). Exported so stats/doctor derive their
+ * footprint-warning thresholds from the SAME number eviction acts on —
+ * pre-release review 2026-08-16: a hardcoded `3× DB` hint fired ~2.7× below
+ * the real budget and promised an eviction that would never happen. */
+export function backupBudgetBytes() {
+  const mb = Number(process.env.CLAUDE_MEM_BACKUP_BUDGET_MB);
+  return Number.isFinite(mb) && mb > 0 ? mb * 1024 * 1024 : DEFAULT_BACKUP_BUDGET_BYTES;
+}
+
+// Eviction grace: snapshots younger than this are never budget-evicted. This is
+// what protects a fresh `pre-delete` undo pre-image (deleteObservations reports
+// its path as the recovery route) from being unlinked by same-day maintain churn
+// (pre-release review 2026-08-16). Deliberately age-based, NOT newest-per-tag:
+// a per-tag exemption would make every one-shot tag's only snapshot immortal —
+// exactly the 360MB orphan shape M-9 exists to evict. Mirrors the purge grace
+// convention (7d) used by stale-observation retention.
+export const BACKUP_EVICTION_GRACE_MS = 7 * 86400000;
+
+// Canonical snapshot shape `<base>.<tag>-<ISO stamp>-<pid>-<seq>.bak` (what
+// snapshotDb writes). Budget eviction deletes ONLY names matching this — a
+// user's hand-made `cp db db.before-upgrade.bak` must never be auto-unlinked.
+const SNAPSHOT_STAMP_RE = /-\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-\d{3}Z-\d+-\d+\.bak$/;
+
+/** All `<db>.<tag>-<ts>.bak` snapshots for `dbPath`, any tag, with size + mtime. */
+export function listSnapshots(dbPath) {
+  try {
+    const dir = dirname(dbPath);
+    const prefix = `${basename(dbPath)}.`;
+    const out = [];
+    for (const n of readdirSync(dir)) {
+      if (!n.startsWith(prefix) || !n.endsWith('.bak')) continue;
+      const full = join(dir, n);
+      try {
+        const st = statSync(full);
+        out.push({ path: full, size: st.size, mtimeMs: st.mtimeMs });
+      } catch { /* raced away */ }
+    }
+    return out;
+  } catch { return []; }
+}
+
+/**
+ * Evict oldest snapshots (across ALL tags) until the total is within the byte
+ * budget. Never evicted: the single newest snapshot (even if it alone exceeds
+ * the budget), anything younger than BACKUP_EVICTION_GRACE_MS, and any file not
+ * matching the canonical snapshot name shape. The total counts every .bak
+ * (exempt files included), so a burst of young snapshots can hold the dir above
+ * budget for up to the grace window — bounded by write rate, and the price of
+ * never deleting an undo pre-image someone may still want.
+ * Returns the number of files removed. Best-effort, never throws.
+ */
+export function enforceBackupBudget(dbPath, { budgetBytes = backupBudgetBytes(), nowMs = Date.now() } = {}) {
+  try {
+    const snaps = listSnapshots(dbPath).sort((a, b) => b.mtimeMs - a.mtimeMs); // newest first
+    let total = snaps.reduce((s, x) => s + x.size, 0);
+    let removed = 0;
+    const graceCutoff = nowMs - BACKUP_EVICTION_GRACE_MS;
+    // Walk oldest-first; stop before touching the newest (index 0).
+    for (let i = snaps.length - 1; i >= 1 && total > budgetBytes; i--) {
+      if (!SNAPSHOT_STAMP_RE.test(snaps[i].path)) continue;   // not ours — never delete
+      if (snaps[i].mtimeMs > graceCutoff) continue;           // inside undo grace
+      try {
+        unlinkSync(snaps[i].path);
+        total -= snaps[i].size;
+        removed++;
+      } catch { /* per-entry best-effort */ }
+    }
+    if (removed > 0) {
+      try { debugLog('DEBUG', 'db-backup', `budget eviction removed ${removed} snapshot(s)`); } catch { /* ignore */ }
+    }
+    return removed;
+  } catch { return 0; }
+}
+
 // Monotonic per-process suffix so two snapshots in the same millisecond (same pid)
 // still get unique filenames (VACUUM INTO fails if the target already exists).
 let _seq = 0;
@@ -31,6 +113,7 @@ export function snapshotDb(db, { tag = 'pre-maintain', retain = 3 } = {}) {
     // defensively since VACUUM INTO takes a string literal, not a bound param.
     db.exec(`VACUUM INTO '${out.replace(/'/g, "''")}'`);
     pruneSnapshots(dbPath, tag, retain);
+    enforceBackupBudget(dbPath);
     return out;
   } catch (e) {
     try { debugLog('WARN', 'db-backup', `snapshot skipped (proceeding without): ${e.message}`); } catch { /* ignore */ }

package/lib/export-columns.mjs

@@ -18,10 +18,16 @@
 // exported: `related_ids` (holds observation ids, stale/dangling after restore remaps ids)
 // and `discovery_tokens` (a derived retrieval metric, rebuilt by the live system; exporting
 // it would freeze a stale value into backups).
+// `compressed_into` (audit 2026-08-14 M-8): only ever non-null in an export taken
+// with --include-compressed / include_compressed — the default WHERE excludes those
+// rows. Without the column, a compressed member round-tripped through restore as a
+// LIVE row and turned up in search results next to the weekly-summary keeper that
+// already absorbed it. Restore does not remap it (the keeper's id is meaningless in
+// the target store); it REJECTS marked rows instead — see cmdRestore.
 export const EXPORT_COLUMNS = [
   'id', 'memory_session_id', 'project', 'type', 'title', 'subtitle', 'narrative', 'text',
   'concepts', 'facts', 'files_read', 'files_modified', 'lesson_learned', 'search_aliases',
-  'scope',
+  'scope', 'compressed_into',
   'importance', 'branch', 'access_count', 'cited_count', 'uncited_streak', 'injection_count',
   'decay_seen_count', 'last_accessed_at', 'created_at', 'created_at_epoch',
 ];

package/mem-cli.mjs

@@ -22,7 +22,7 @@ import {
   hardDeleteCandidateCount,
   OP_CAP, STALE_AGE_MS, PINNED_INJ_THRESHOLD,
 } from './lib/maintain-core.mjs';
-import { snapshotDb } from './lib/db-backup.mjs';
+import { snapshotDb, listSnapshots, backupBudgetBytes } from './lib/db-backup.mjs';
 import { deleteObservations } from './lib/delete-core.mjs';
 import { OBS_TYPE_SET } from './lib/obs-types.mjs';
 import { computeStatsFeed } from './lib/stats-core.mjs';
@@ -36,7 +36,7 @@ import { aggregateProjectCiteRecall } from './lib/citation-tracker.mjs';
 import { probeOtherSources as probeIdSources, bucketIdTokens, splitDeferredTokens } from './lib/id-routing.mjs';
 import { join, sep, dirname } from 'path';
 import { spawnSync } from 'child_process';
-import { readFileSync, existsSync, readdirSync } from 'fs';
+import { readFileSync, existsSync, readdirSync, statSync } from 'fs';
 
 // v2.41: shared CLI helpers extracted to cli/common.mjs. Keep this file as the
 // router + remaining-command bodies during the incremental split. Future work:
@@ -1200,6 +1200,15 @@ async function cmdStats(db, args) {
   // failure mode that left code-graph's matcher bug undetected for 10 sessions.
   const hookErrors24h = countRecentHookErrors(join(DB_DIR, 'runtime'), now - 86400000);
 
+  // M-9 (audit 2026-08-14): disk footprint — a "lite" store had accumulated 360MB of
+  // pre-maintain snapshots against a 59MB DB with nothing reporting it. Cheap probes
+  // only (DB file + .bak aggregate), no recursive tree walk.
+  let dbBytes = 0;
+  try { dbBytes = statSync(join(DB_DIR, 'claude-mem-lite.db')).size; } catch { /* fresh */ }
+  const snaps = listSnapshots(join(DB_DIR, 'claude-mem-lite.db'));
+  const backupBytes = snaps.reduce((s, x) => s + x.size, 0);
+  const mb = (n) => (n / (1024 * 1024)).toFixed(1);
+
   if (jsonOutput) {
     out(JSON.stringify({
       project,
@@ -1226,6 +1235,9 @@ async function cmdStats(db, args) {
         compressed: compressedCount.c,
         superseded_only: supersededOnlyCount.c,
         hook_errors_24h: hookErrors24h,
+        db_bytes: dbBytes,
+        backup_count: snaps.length,
+        backup_bytes: backupBytes,
       },
       tier_distribution: {
         working: tierMap.working ?? 0,
@@ -1265,6 +1277,9 @@ async function cmdStats(db, args) {
   out(`  Low-signal titles (Modified/Error/Worked on…): ${lowSignalTitle.c} (${(lowSignalRatio * 100).toFixed(1)}%)`);
   out(`  Compressed: ${compressedCount.c}`);
   out(`  Hook errors (last 24h): ${hookErrors24h}${hookErrors24h > 0 ? `  ← tail ${join(DB_DIR, 'runtime/hook-errors')}` : ''}`);
+  // Hint threshold = the REAL eviction budget (pre-release review 2026-08-16: a
+  // hardcoded 3×-DB heuristic promised an eviction that fires only past the budget).
+  out(`  Disk: DB ${mb(dbBytes)}MB | ${snaps.length} backup snapshot(s) ${mb(backupBytes)}MB${backupBytes > backupBudgetBytes() ? `  ← over the ${mb(backupBudgetBytes())}MB backup budget; next maintain/save snapshot evicts oldest (>7d old)` : ''}`);
   // Tier-1 firing counters for ① file-intel + ② reread-guard (recorded by
   // pre-tool-recall.js via lib/metrics.mjs; CLAUDE_MEM_METRICS=1 to enable).
   const featAgg = aggregateMetrics(DB_DIR, 7);
@@ -1799,9 +1814,15 @@ function cmdRestore(db, argv) {
       decay_seen_count = ?, last_accessed_at = ?
     WHERE id = ?`);
 
-  let restored = 0, skipped = 0, malformed = 0;
+  let restored = 0, skipped = 0, malformed = 0, tombstoned = 0;
   for (const r of rows) {
     if (!r || typeof r !== 'object' || !r.type || !r.title) { malformed++; continue; }
+    // M-8 (audit 2026-08-14): a row exported with --include-compressed carries its
+    // compressed_into tombstone. Restoring it as a live row resurrects a member its
+    // weekly-summary keeper already absorbed (duplicate search hits, and the marker's
+    // target id is meaningless in this store). Reject rather than remap; the content
+    // lives on in the keeper.
+    if (r.compressed_into) { tombstoned++; continue; }
     const project = projOverride || r.project || inferProject();
     const createdEpoch = Number.isFinite(Number(r.created_at_epoch)) ? Number(r.created_at_epoch) : Date.now();
     // Durable exact-dup guard — saveObservation's 5-min Jaccard window can't catch a
@@ -1868,7 +1889,8 @@ function cmdRestore(db, argv) {
   // ones that parsed.
   const totalMalformed = malformed + parseFailures;
   const totalLines = rows.length + parseFailures;
-  out(`[mem] Restore${dryRun ? ' (dry-run)' : ''}: ${restored} restored, ${skipped} duplicate(s) skipped, ${totalMalformed} malformed/failed from ${totalLines} row(s).`);
+  const tombstoneNote = tombstoned > 0 ? `, ${tombstoned} compressed member(s) rejected (already absorbed by their summary keeper)` : '';
+  out(`[mem] Restore${dryRun ? ' (dry-run)' : ''}: ${restored} restored, ${skipped} duplicate(s) skipped${tombstoneNote}, ${totalMalformed} malformed/failed from ${totalLines} row(s).`);
   // Name the lossiness where the user meets it. Export omits related_ids and drops
   // superseded rows, and restore re-inserts under fresh AUTOINCREMENT ids — so no
   // cross-link can survive the round-trip. That is a deliberate format tradeoff (stored

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.62.0",
+  "version": "3.63.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "claude-mem-lite",
-      "version": "3.62.0",
+      "version": "3.63.0",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.26.0",
         "better-sqlite3": "^12.6.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.62.0",
+  "version": "3.63.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",

package/scripts/post-tool-recall.js

@@ -16,6 +16,7 @@
 import { existsSync, readFileSync } from 'fs';
 import { basename, join } from 'path';
 import { resolveDataDir } from '../lib/resolve-data-dir.mjs';
+import { recordHookError } from '../lib/hook-telemetry.mjs';
 
 const SALIENCE_BIND = process.env.CLAUDE_MEM_SALIENCE === 'bind';
 
@@ -45,7 +46,13 @@ async function main() {
   const cdPath = cooldownPathFor(sessionId);
   if (!existsSync(cdPath)) return;
   let entry;
-  try { entry = JSON.parse(readFileSync(cdPath, 'utf8'))[filePath]; } catch { return; }
+  try { entry = JSON.parse(readFileSync(cdPath, 'utf8'))[filePath]; } catch (e) {
+    // A corrupt cooldown file (torn concurrent write — audit 2026-08-14 M-6) turns
+    // the bind-salience check into a zero-trace no-op; record it so `stats` can see
+    // the surface die instead of silently reading zero errors (M-5).
+    recordHookError('post-recall:cooldown-parse', e, RUNTIME_DIR, { file: basename(cdPath) });
+    return;
+  }
   const idents = entry && entry.lessonIdents;
   if (!idents || typeof idents !== 'object') return;
 
@@ -77,4 +84,7 @@ async function main() {
 // stream emits 'error' — without the (now-removed) forced exit, an unhandled one would
 // surface as a non-zero exit + stack. A hook must never fail loud on a dropped pipe.
 process.stdout.on('error', () => {});
-main().catch(() => {});
+// Record what slips past main()'s early returns before the mandatory swallow —
+// this script had zero telemetry (audit 2026-08-14 M-5). Recorder never throws;
+// the outer catch keeps the exit code 0 regardless.
+main().catch((e) => { try { recordHookError('post-recall:main', e, RUNTIME_DIR); } catch { /* never */ } });

package/scripts/pre-agent-inject.js

@@ -15,6 +15,23 @@
 const ENABLED = process.env.CLAUDE_MEM_SUBAGENT_INJECT === 'on'
   || process.env.CLAUDE_MEM_SUBAGENT_INJECT === '1';
 
+// Telemetry via DYNAMIC import so the default-off fast path stays import-free
+// (the file's stated contract). Only ever reached on the enabled path's failure
+// branches — this script had zero recordHookError coverage, so a dead DB or
+// schema drift silently disabled subagent injection with no trace (audit
+// 2026-08-14 M-5). Swallows everything: telemetry must never break a dispatch.
+async function recordFailure(scope, err, ctx) {
+  try {
+    const [{ recordHookError }, { resolveDataDir }, { join }] = await Promise.all([
+      import('../lib/hook-telemetry.mjs'),
+      import('../lib/resolve-data-dir.mjs'),
+      import('path'),
+    ]);
+    const dataDir = resolveDataDir(process.env.CLAUDE_MEM_DIR);
+    recordHookError(scope, err, process.env.CLAUDE_MEM_RUNTIME_DIR || join(dataDir, 'runtime'), ctx);
+  } catch { /* never */ }
+}
+
 function readStdin() {
   return new Promise((resolve) => {
     let data = '';
@@ -51,7 +68,7 @@ async function main() {
   const { buildSubagentInjection } = await import('../hook-memory.mjs');
 
   let db;
-  try { db = ensureDb(); } catch { return; }
+  try { db = ensureDb(); } catch (e) { await recordFailure('agent-inject:db-open', e); return; }
   try {
     const updatedInput = buildSubagentInjection(db, hook.tool_input, inferProject());
     if (updatedInput) {
@@ -59,7 +76,7 @@ async function main() {
         hookSpecificOutput: { hookEventName: 'PreToolUse', updatedInput },
       }));
     }
-  } catch { /* never break a dispatch */ } finally {
+  } catch (e) { await recordFailure('agent-inject:query', e); /* never break a dispatch */ } finally {
     try { db.close(); } catch { /* */ }
   }
 }
@@ -69,5 +86,6 @@ async function main() {
 // which FLUSHES stdout. The emitted updatedInput echoes the whole prompt back, so the
 // payload can exceed the ~64KB pipe buffer; a forced process.exit() would drop that
 // pending async write and truncate the JSON (the gotcha every sibling hook avoids).
-// Swallow any rejection so the exit code can never go non-zero.
-main().catch(() => {});
+// Swallow any rejection so the exit code can never go non-zero — but record it
+// first (recordFailure itself swallows everything, including its own failures).
+main().catch((e) => recordFailure('agent-inject:main', e));

package/scripts/pre-skill-bridge.js

@@ -8,6 +8,9 @@ import { join, resolve, sep } from 'path';
 import { homedir } from 'os';
 import { recordHookError } from '../lib/hook-telemetry.mjs';
 import { resolveDataDir } from '../lib/resolve-data-dir.mjs';
+// format-utils.mjs is import-free — pulling three defang helpers keeps this script
+// inside its "lightweight standalone" budget (no heavy transitive deps).
+import { neutralizeContextDelimiters, neutralizeSkillDelimiters, neutralizeSkillBridgeDelimiters } from '../format-utils.mjs';
 
 // CLAUDE_MEM_DIR mirrors pre-tool-recall.js — one env var sandboxes everything.
 const DATA_DIR = resolveDataDir(process.env.CLAUDE_MEM_DIR);
@@ -88,12 +91,22 @@ try {
     // console.log() form would render on stock CC but no-op on those variants.
     // Token budget: ~4 chars per token, 4000 token limit = 16000 chars.
     const portablePath = resolvedPath.startsWith(homedir()) ? '~' + resolvedPath.slice(homedir().length) : resolvedPath;
+    // Defang the untrusted skill body + name before wrapping (audit 2026-08-14 M-4):
+    // registry rows come from third-party repos, and this was the one AUTO injection
+    // surface of that data with zero neutralization — a body carrying a literal
+    // `</skill-bridge>` + forged <system-reminder> (or a `<skill-loaded>` execute
+    // block) escaped the wrapper verbatim. Name additionally drops quote/bracket
+    // chars: it lands in an ATTRIBUTE position, where `"` breaks out of the wrapper
+    // tag itself. Applied to the truncated summary too (a cut can't be trusted to
+    // land mid-tag).
+    const defang = (s) => neutralizeSkillBridgeDelimiters(neutralizeSkillDelimiters(neutralizeContextDelimiters(s)));
+    const safeName = String(row.name).replace(/["'<>]/g, '');
     let additionalContext;
     if (content.length > 16000) {
-      const summary = content.slice(0, 800);
-      additionalContext = `<skill-bridge name="${row.name}" source="managed" truncated="true">\n${summary}\n...\n</skill-bridge>\n\nSkill content truncated. Read("${portablePath}") to load full content.`;
+      const summary = defang(content.slice(0, 800));
+      additionalContext = `<skill-bridge name="${safeName}" source="managed" truncated="true">\n${summary}\n...\n</skill-bridge>\n\nSkill content truncated. Read("${portablePath}") to load full content.`;
     } else {
-      additionalContext = `<skill-bridge name="${row.name}" source="managed">\n${content}\n</skill-bridge>\n\nThis skill was loaded from the managed registry. Follow the instructions above.`;
+      additionalContext = `<skill-bridge name="${safeName}" source="managed">\n${defang(content)}\n</skill-bridge>\n\nThis skill was loaded from the managed registry. Follow the instructions above.`;
     }
     process.stdout.write(JSON.stringify({
       suppressOutput: true,

package/scripts/pre-tool-recall.js

@@ -4,9 +4,10 @@
 // and the pure-data lib/low-signal-patterns.mjs (zero runtime deps, ~1ms overhead).
 // Safety: readonly DB, exit 0 always, 3s timeout
 
-import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs';
+import { existsSync, readFileSync, mkdirSync } from 'fs';
 import { basename, join } from 'path';
 import { resolveDataDir } from '../lib/resolve-data-dir.mjs';
+import { atomicWriteFileSync } from '../lib/atomic-write.mjs';
 import { buildNotLowSignalSql } from '../lib/low-signal-patterns.mjs';
 import { recordHookError } from '../lib/hook-telemetry.mjs';
 import { citeFactorClause } from '../scoring-sql.mjs';
@@ -159,17 +160,24 @@ function crossHookInjectedFile(project) {
   return join(RUNTIME_DIR, `.claude-mem-injected-${project}`);
 }
 
-function readCrossHookInjected(project) {
+// M-6 (audit 2026-08-14): the marker file is keyed by PROJECT, so two concurrent
+// CC sessions in the same project shared one suppression state — session A's
+// injections silently deduped session B's, and B inherited A's count cap. Both
+// read and merge now carry the CC session id: a payload written by a DIFFERENT
+// session is ignored (read) / replaced (merge), mirroring the v3.35.2 episode
+// session-key fix. Legacy payloads without `session` keep the old behavior.
+function readCrossHookInjected(project, sessionId) {
   try {
     const raw = readFileSync(crossHookInjectedFile(project), 'utf8');
-    const { ids, ts } = JSON.parse(raw);
+    const { ids, ts, session } = JSON.parse(raw);
+    if (session && sessionId && session !== sessionId) return new Set();
     if (!ts || Date.now() - ts > CROSS_HOOK_DEDUP_MS) return new Set();
     if (!Array.isArray(ids)) return new Set();
     return new Set(ids.map(String));
   } catch { return new Set(); }
 }
 
-function mergeCrossHookInjected(project, newIds) {
+function mergeCrossHookInjected(project, newIds, sessionId) {
   if (!newIds || newIds.length === 0) return;
   try {
     mkdirSync(RUNTIME_DIR, { recursive: true });
@@ -178,8 +186,10 @@ function mergeCrossHookInjected(project, newIds) {
     try {
       const raw = readFileSync(file, 'utf8');
       const parsed = JSON.parse(raw);
-      // Within the staleness window: union. Outside: replace (fresh session).
-      if (parsed.ts && Date.now() - parsed.ts < CROSS_HOOK_DEDUP_MS) {
+      // Within the staleness window AND same session (or legacy): union.
+      // Outside / other session: replace.
+      if (parsed.ts && Date.now() - parsed.ts < CROSS_HOOK_DEDUP_MS
+          && !(parsed.session && sessionId && parsed.session !== sessionId)) {
         prev = parsed;
       }
     } catch { /* fresh file */ }
@@ -187,10 +197,13 @@ function mergeCrossHookInjected(project, newIds) {
       ...(Array.isArray(prev.ids) ? prev.ids.map(String) : []),
       ...newIds.map(String),
     ])];
-    writeFileSync(file, JSON.stringify({
+    // Atomic (tmp+rename, M-6): a plain write torn by a concurrent hook left the
+    // shared marker as invalid JSON, silently disabling cross-hook dedup.
+    atomicWriteFileSync(file, JSON.stringify({
       ids,
       ts: Date.now(),
       count: (prev.count || 0) + 1,
+      ...(sessionId ? { session: sessionId } : {}),
     }));
   } catch { /* silent — dedup is best-effort */ }
 }
@@ -209,7 +222,10 @@ function writeCooldown(cooldownPath, data, isSessionScoped) {
         if (ts && now - ts < STALE_MS) cleaned[k] = v;
       }
     }
-    writeFileSync(cooldownPath, JSON.stringify(cleaned));
+    // Atomic (tmp+rename, M-6): the cooldown carries lessonIdents that the
+    // PostToolUse bind-salience check reads back — a torn write turned that
+    // check into a zero-trace no-op.
+    atomicWriteFileSync(cooldownPath, JSON.stringify(cleaned));
   } catch { /* silent */ }
 }
 
@@ -474,7 +490,7 @@ try {
     // P1 (D#78): tag each row's source table — events share the numeric id
     // space with observations, and the Stop-side edge attribution must never
     // feed an event id into observation_files updates.
-    const crossHookSeen = readCrossHookInjected(project);
+    const crossHookSeen = readCrossHookInjected(project, sessionId);
     const sourcedRows = [
       ...rows.map(r => ({ ...r, src: 'obs' })),
       ...eventRows.map(r => ({ ...r, src: 'evt' })),
@@ -638,7 +654,7 @@ try {
     // file so the next UPS prompt skips them too. Always write, even on
     // empty allRows, so the file's ts stays fresh for the no-op case where
     // we'd otherwise drift outside the dedup window.
-    mergeCrossHookInjected(project, allRows.map(r => r.id));
+    mergeCrossHookInjected(project, allRows.map(r => r.id), sessionId);
   } catch (e) {
     // Silent failure — never block editing, but record for self-observation.
     recordHookError('pre-recall:query', e, RUNTIME_DIR, { filePath });

package/scripts/prompt-search-utils.mjs

@@ -154,13 +154,17 @@ export const DEDUP_STALE_MS = 300_000; // 5 minutes
  * Check if injection should be skipped based on deduplication state.
  * @param {number[]} newIds - candidate observation IDs
  * @param {string} injectedFile - path to the dedup state file
+ * @param {string} [sessionId] - CC session id; a payload written by a DIFFERENT
+ *   session never suppresses (M-6, audit 2026-08-14: the file is keyed by project,
+ *   so session A's injections + count cap silently carried into session B)
  * @returns {boolean} true if injection should be skipped
  */
-export function shouldSkipByDedup(newIds, injectedFile) {
+export function shouldSkipByDedup(newIds, injectedFile, sessionId) {
   if (!newIds || newIds.length === 0) return true;
   try {
     const raw = readFileSync(injectedFile, 'utf8');
-    const { ids: prevIds, ts, count = 0 } = JSON.parse(raw);
+    const { ids: prevIds, ts, count = 0, session } = JSON.parse(raw);
+    if (session && sessionId && session !== sessionId) return false;
     if (count >= MAX_SESSION_INJECTIONS) return true;
     if (!ts || Date.now() - ts > DEDUP_STALE_MS) return false;
     if (!Array.isArray(prevIds) || prevIds.length === 0) return false;

package/scripts/user-prompt-search.js

@@ -14,9 +14,14 @@ import Database from 'better-sqlite3';
 import { shouldSkip, computeEffectiveLen, detectIntent, shouldSkipByDedup, extractFiles, extractErrorSignature, extractDeferredRefs, DEDUP_STALE_MS, matchRegistrySkillName, detectMemOverride } from './prompt-search-utils.mjs';
 import { getDeferredByIds } from '../lib/deferred-work.mjs';
 import { recommendSkill } from '../registry-recommend.mjs';
+import { recordHookError } from '../lib/hook-telemetry.mjs';
+import { atomicWriteFileSync } from '../lib/atomic-write.mjs';
 
 // ─── Constants ──────────────────────────────────────────────────────────────
 
+// Telemetry sink (lib/hook-telemetry.mjs contract): env override for tests, else
+// <data-dir>/runtime — the same dir the sibling hook scripts + `stats` read.
+const RUNTIME_DIR = process.env.CLAUDE_MEM_RUNTIME_DIR || join(DB_DIR, 'runtime');
 const INJECTED_IDS_FILE = join(DB_DIR, 'runtime', `.claude-mem-injected-${inferProject()}`);
 // Per-prompt UPS cap. Cut from 5 → 3 after the 2026-05-09 per-hook recall
 // scan (#8255): UPS contributed 74% of silent injected IDs (131/177) at 26%
@@ -344,7 +349,7 @@ export function searchByFts(db, queryText, project, limit, typeFilter,
     SELECT o.id, o.type, o.title, o.lesson_learned,
            ${OBS_BM25} as bm25_raw,
            ${OBS_BM25}
-             * (1.0 + EXP(-0.693 * (? - o.created_at_epoch) / ${TYPE_DECAY_CASE}))
+             * (1.0 + EXP(-0.693 * MAX(0, ? - o.created_at_epoch) / ${TYPE_DECAY_CASE}))
              * ${TYPE_QUALITY_CASE}
              * (0.5 + 0.5 * COALESCE(o.importance, 1))
              * ${noisePenaltyClause('o')}
@@ -660,7 +665,7 @@ async function main() {
       // Namespace dedup ids as "D<id>" (parity with the "P<id>" prompt-corpus
       // convention) so obs ids can't collide in the shared injected-ids file.
       const dedupIds = openRows.map(r => `D${r.id}`);
-      if (openRows.length > 0 && !shouldSkipByDedup(dedupIds, INJECTED_IDS_FILE)) {
+      if (openRows.length > 0 && !shouldSkipByDedup(dedupIds, INJECTED_IDS_FILE, hookData.session_id)) {
         const lines = ['[mem] Deferred work referenced in prompt (open items, full detail):'];
         for (const r of openRows) {
           const pTag = r.priority === 3 ? '🔴' : r.priority === 1 ? '⚪' : '🟡';
@@ -680,15 +685,20 @@ async function main() {
           let prevCount = 0;
           try {
             const prev = JSON.parse(readFileSync(INJECTED_IDS_FILE, 'utf8'));
-            if (prev.ts && Date.now() - prev.ts < DEDUP_STALE_MS) {
+            // M-6: inherit only same-session (or legacy) state — another session's
+            // ids/count must not carry over. Atomic write below: a torn concurrent
+            // write left the shared marker as invalid JSON (dedup silently off).
+            if (prev.ts && Date.now() - prev.ts < DEDUP_STALE_MS
+                && !(prev.session && hookData.session_id && prev.session !== hookData.session_id)) {
               prevIds = Array.isArray(prev.ids) ? prev.ids : [];
               prevCount = prev.count || 0;
             }
           } catch {}
-          writeFileSync(INJECTED_IDS_FILE, JSON.stringify({
+          atomicWriteFileSync(INJECTED_IDS_FILE, JSON.stringify({
             ids: [...new Set([...prevIds.map(String), ...dedupIds])],
             ts: Date.now(),
             count: prevCount + 1,
+            ...(hookData.session_id ? { session: hookData.session_id } : {}),
           }));
         } catch {}
       }
@@ -712,7 +722,13 @@ async function main() {
   if (!db) {
     try {
       db = ensureDb();
-    } catch { return; }
+    } catch (e) {
+      // A failed DB open silently kills EVERY prompt-time injection while `stats`
+      // reads zero errors (audit 2026-08-14 M-5) — record before the mandatory
+      // swallow. Exact blindness class of the 2026-08-13 pre-recall:db-open outage.
+      recordHookError('ups:db-open', e, RUNTIME_DIR);
+      return;
+    }
   }
 
   try {
@@ -854,7 +870,7 @@ async function main() {
     const candidateIds = rows.length > 0
       ? rows.map(r => r.id)
       : promptRows.map(r => `P${r.id}`);
-    const dedupSkip = shouldSkipByDedup(candidateIds, INJECTED_IDS_FILE);
+    const dedupSkip = shouldSkipByDedup(candidateIds, INJECTED_IDS_FILE, hookData.session_id);
 
     const output = !dedupSkip
       ? (rows.length > 0 ? formatResults(rows) : formatPromptResults(promptRows))
@@ -866,12 +882,17 @@ async function main() {
         let prevCount = 0;
         try {
           const prev = JSON.parse(readFileSync(INJECTED_IDS_FILE, 'utf8'));
-          if (prev.ts && Date.now() - prev.ts < DEDUP_STALE_MS) prevCount = prev.count || 0;
+          // M-6: same-session (or legacy) count only; atomic write (torn-write guard).
+          if (prev.ts && Date.now() - prev.ts < DEDUP_STALE_MS
+              && !(prev.session && hookData.session_id && prev.session !== hookData.session_id)) {
+            prevCount = prev.count || 0;
+          }
         } catch {}
-        writeFileSync(INJECTED_IDS_FILE, JSON.stringify({
+        atomicWriteFileSync(INJECTED_IDS_FILE, JSON.stringify({
           ids: candidateIds,
           ts: Date.now(),
           count: prevCount + 1,
+          ...(hookData.session_id ? { session: hookData.session_id } : {}),
         }));
       } catch {}
       // v26 P0: bump injection_count for obs-based emits only (prompt-corpus
@@ -932,8 +953,11 @@ async function main() {
         finally { rdb.close(); }
       }
     } catch { /* silent — never block on recommendation failure */ }
-  } catch {
-    // Hooks must never break Claude Code — swallow all errors
+  } catch (e) {
+    // Hooks must never break Claude Code — swallow, but RECORD: this catch wraps
+    // every FTS query on the surface, so a schema/FTS drift here would zero out
+    // prompt-time injection with no trace anywhere (audit 2026-08-14 M-5).
+    recordHookError('ups:search', e, RUNTIME_DIR);
   } finally {
     try { db.close(); } catch {}
   }
@@ -962,5 +986,8 @@ export function isDirectInvocation(metaUrl, argv1) {
   return metaUrl.split('?')[0] === pathToFileURL(argv1).href;
 }
 if (isDirectInvocation(import.meta.url, process.argv[1])) {
-  main().catch(() => {});
+  // Last-resort telemetry for anything that escapes main()'s own catches (e.g. a
+  // throw between the entry and the guarded body). Recorder never throws; the
+  // outer catch keeps the never-non-zero-exit invariant regardless.
+  main().catch((e) => { try { recordHookError('ups:main', e, RUNTIME_DIR); } catch { /* never */ } });
 }

package/search-engine.mjs

@@ -10,7 +10,9 @@ import {
   DEFAULT_DECAY_HALF_LIFE_MS,
   notLowSignalTitleClause, LOW_SIGNAL_TITLE,
   relaxFtsQueryToOr, debugLog, debugCatch, estimateTokens,
+  noisePenaltyClause,
 } from './utils.mjs';
+import { citeFactorClause } from './scoring-sql.mjs';
 import { getVocabulary, computeVector, vectorSearch, rrfMerge, vectorsEnabled } from './tfidf.mjs';
 import { extractPRFTerms, expandQueryByConcepts } from './search-scoring.mjs';
 
@@ -21,13 +23,26 @@ import { extractPRFTerms, expandQueryByConcepts } from './search-scoring.mjs';
 // exponent large-positive → EXP overflowed to +Infinity → score -Infinity → that row sorted
 // #1 for any match AND JSON.stringify emitted `"score": null` (numeric-contract break). A
 // future row now reads as age 0 = max (finite) recency, not Infinity.
+// M-3 (audit 2026-08-14): cite/noise behavior factors joined FULL_SCORE — they had
+// shipped for months on every AUTO surface (UPS / pre-tool-recall / hook-memory)
+// while the EXPLICIT surfaces (mem_search / CLI search) discarded the accumulated
+// citation + noise signal (the mirror image of "guards wired on the auto face,
+// missing on the explicit face"). Both factors are hard-bounded (cite ∈ [0.4, 3.0],
+// noise ∈ {0.2, 0.5, 1.0}), so they reorder, never dominate. algo-F6 note: the
+// access-count LN bonus below stays — noisePenalty uses access_count only inside a
+// ratio GUARD (never as a bonus) and citeFactor reads cited/uncited columns, so no
+// term is counted twice as a reward. Denoise A/B 2026-08-16: NEUTRAL (suite rows
+// carry zero cite/noise state); the behavioral pin lives in
+// tests/audit-fixes-20260816.test.mjs (M-3).
 const FULL_SCORE = `${OBS_BM25}
   * (1.0 + EXP(-0.693 * MAX(0, ? - MAX(o.created_at_epoch, COALESCE(o.last_accessed_at, o.created_at_epoch))) / ${TYPE_DECAY_CASE}))
   * ${TYPE_QUALITY_CASE}
   * (CASE WHEN ? IS NOT NULL AND o.project = ? THEN 2.0 ELSE 1.0 END)
   * (0.5 + 0.5 * COALESCE(o.importance, 1))
   * (1.0 + 0.1 * LN(1 + COALESCE(o.access_count, 0)))
-  * (1.0 + 0.3 * (o.lesson_learned IS NOT NULL AND o.lesson_learned NOT IN ('', 'none')))`;
+  * (1.0 + 0.3 * (o.lesson_learned IS NOT NULL AND o.lesson_learned NOT IN ('', 'none')))
+  * ${noisePenaltyClause('o')}
+  * ${citeFactorClause('o')}`;
 
 const SIMPLE_SCORE = `${OBS_BM25}
   * (1.0 + EXP(-0.693 * MAX(0, ? - MAX(o.created_at_epoch, COALESCE(o.last_accessed_at, o.created_at_epoch))) / ${TYPE_DECAY_CASE}))
@@ -294,6 +309,10 @@ function expandObsByConceptCo(db, ctx, now, existingIds, results, includeNoise =
 function expandObsByPRF(db, ctx, now, primaryCount, existingIds, results, includeNoise = false) {
   const { ftsQuery, args, epochFrom, epochTo, limit } = ctx;
   if (primaryCount < 3) return;
+  // effectiveFtsQuery = the query that actually matched (OR-relaxed when the strict
+  // AND missed and the fallback rescued rows — M-2). The strict query here returned
+  // zero top docs in that case, silently disabling PRF where it helps most.
+  const seedQuery = ctx.effectiveFtsQuery || ftsQuery;
   const topResults = db.prepare(`
     SELECT o.title, o.narrative FROM observations_fts
     JOIN observations o ON observations_fts.rowid = o.id
@@ -302,7 +321,7 @@ function expandObsByPRF(db, ctx, now, primaryCount, existingIds, results, includ
       AND (? IS NULL OR o.project = ?)
     ORDER BY ${OBS_BM25}
     LIMIT 8
-  `).all(ftsQuery, args.project ?? null, args.project ?? null);
+  `).all(seedQuery, args.project ?? null, args.project ?? null);
   const prfTerms = extractPRFTerms(topResults, ftsQuery);
   if (prfTerms.length === 0) return;
   const prfFts = prfTerms.map(t => `"${t.replace(/"/g, '""')}"`).join(' OR ');
@@ -428,17 +447,28 @@ export function searchObservationsHybrid(db, ctx) {
       try {
         const orRows = db.prepare(buildObsFtsQuery('full', { multiplier: 0.5, withSnippet: true, withOffset: true, includeNoise }))
           .all(...buildObsFtsParams({ now, projectBoost, ftsQuery: orQuery, args, epochFrom, epochTo, limit: perSourceLimit, offset: perSourceOffset }));
-        if (orRows.length > 0) ctx.orFallbackFired = true;
+        if (orRows.length > 0) {
+          ctx.orFallbackFired = true;
+          // M-2: PRF's top-doc probe re-queries FTS itself — with the strict-AND
+          // query it reads 0 docs in exactly the OR-rescue case, keeping PRF inert.
+          // Record the query that actually produced the evidence rows.
+          ctx.effectiveFtsQuery = orQuery;
+        }
         for (const r of orRows) results.push(ftsRowToResult(r, { snippet: true }));
       } catch (e) { debugCatch(e, 'searchObservationsHybrid-or-fallback'); }
     }
   }
 
-  // Two-phase query expansion (only when well below limit)
-  if (rows.length > 0 && results.length < Math.ceil(limit / 2)) {
+  // Two-phase query expansion (only when well below limit). Gate on results.length,
+  // NOT rows.length (M-2, audit 2026-08-14): `rows` is the strict-AND set only, so
+  // when strict-AND missed and the OR fallback rescued a few rows — exactly the
+  // vocab-mismatch shape where expansion helps most — the old gate read rows.length
+  // === 0 and skipped concept/PRF expansion entirely. PRF likewise seeds from the
+  // rescued rows now (they are the only relevance evidence available).
+  if (results.length > 0 && results.length < Math.ceil(limit / 2)) {
     const existingIds = new Set(results.map(r => r.id));
     expandObsByConceptCo(db, ctx, now, existingIds, results, includeNoise);
-    expandObsByPRF(db, ctx, now, rows.length, existingIds, results, includeNoise);
+    expandObsByPRF(db, ctx, now, results.length, existingIds, results, includeNoise);
   }
 
   // Vector search + RRF hybrid merge

package/search-scoring.mjs

@@ -165,8 +165,13 @@ export function extractPRFTerms(results, ftsQuery, limit = 3) {
   // "cach" returns zero rows, only "caching"/"cache" match). Emitting a bare stem would
   // silently match nothing and kill expansion recall. Track each stem's surface forms with
   // their occurrence counts and emit the most frequent (best-matchable) surface.
-  const stemDocCount = {};      // stem -> # of top docs it appears in (the >=2 bar)
-  const stemSurfaces = {};      // stem -> Map(surface -> total occurrences)
+  // Prototype-less: doc text tokenizes to arbitrary identifiers, and a stem that
+  // collides with an Object.prototype property ("constructor" — common in code
+  // narratives) made `stemSurfaces[stem] ||= new Map()` read the INHERITED function
+  // as truthy, skip the assignment, and crash on sm.get (surfaced 2026-08-16 when
+  // the M-2 gate fix first ran PRF over OR-rescued rows).
+  const stemDocCount = Object.create(null);   // stem -> # of top docs it appears in (the >=2 bar)
+  const stemSurfaces = Object.create(null);   // stem -> Map(surface -> total occurrences)
   const docCount = Math.min(results.length, 8);
   for (let i = 0; i < docCount; i++) {
     const r = results[i];

package/server.mjs

@@ -1162,32 +1162,22 @@ server.registerTool(
       const staleAge = Date.now() - STALE_AGE_MS;
       const mctx = { projectFilter, baseParams, staleAge, opCap: OP_CAP };
 
-      // T2-P0-A: purge_stale is the only DELETE in this handler. Require confirm=true;
-      // a first call without confirm returns a dry-run preview so callers know the blast radius.
-      const purgeRequested = ops.includes('purge_stale');
-      if (purgeRequested && args.confirm !== true) {
-        const retainDays = args.retain_days ?? 30;
-        const retainCutoff = Date.now() - retainDays * 86400000;
-        const previewRow = purgeStalePreview(db, mctx, retainCutoff);
-        const lines = [
-          'purge_stale preview (confirm=false):',
-          `  Candidates (pending-purge, older than ${retainDays}d): ${previewRow.candidates}`,
-        ];
-        if (previewRow.candidates > 0) {
-          lines.push(`  Oldest: ${new Date(previewRow.oldest).toISOString().slice(0, 10)}`);
-          lines.push(`  Newest: ${new Date(previewRow.newest).toISOString().slice(0, 10)}`);
-        }
-        lines.push('');
-        lines.push('Nothing was deleted. To execute, re-run with confirm=true:');
-        lines.push(`  mem_maintain(action="execute", operations=${JSON.stringify(ops)}, confirm=true${args.retain_days ? `, retain_days=${args.retain_days}` : ''}${args.project ? `, project="${args.project}"` : ''})`);
-        return { content: [{ type: 'text', text: lines.join('\n') }] };
-      }
+      // T2-P0-A: purge_stale is the only op gated on confirm=true — cleanupBroken also
+      // hard-deletes (broken rows only) but always ran unconfirmed on both surfaces, and
+      // the pre-transaction snapshot above covers it. An unconfirmed call gets a dry-run
+      // preview of the purge INSTEAD OF the purge.
+      // M-7 (audit 2026-08-14): preview-instead-of-early-return — the old
+      // `return`-on-unconfirmed skipped EVERY requested op, while the CLI twin ran the
+      // non-destructive ones (cleanup/decay/boost) and previewed only the purge. Same
+      // op list, two different amounts of work done, both reporting success. Aligned
+      // to the CLI semantics (the safer surface changed less: nothing destructive
+      // runs unconfirmed on either surface now or before).
+      const purgeConfirmed = args.confirm === true;
 
       // MED-2: snapshot the DB before the irreversible cleanup/purge hard-deletes —
       // only when rows will actually be removed, and OUTSIDE the transaction below
-      // (VACUUM cannot run inside one). purge_stale is already confirmed by here (the
-      // preview branch returned above otherwise). Best-effort; snapshotDb never throws.
-      if (hardDeleteCandidateCount(db, mctx, { cleanup: ops.includes('cleanup'), purge: ops.includes('purge_stale') }) > 0) {
+      // (VACUUM cannot run inside one). Best-effort; snapshotDb never throws.
+      if (hardDeleteCandidateCount(db, mctx, { cleanup: ops.includes('cleanup'), purge: ops.includes('purge_stale') && purgeConfirmed }) > 0) {
         snapshotDb(db, { tag: 'pre-maintain' });
       }
 
@@ -1201,8 +1191,25 @@ server.registerTool(
         if (ops.includes('purge_stale')) {
           const retainDays = args.retain_days ?? 30;
           const retainCutoff = Date.now() - retainDays * 86400000;
-          const purged = purgeStale(db, mctx, retainCutoff);
-          results.push(`Purged ${purged} stale observations (retained last ${retainDays} days)` + (purged >= OP_CAP ? ' (cap reached, re-run for more)' : ''));
+          if (!purgeConfirmed) {
+            // Dry-run preview (parity with CLI `maintain` without --confirm): the other
+            // requested non-destructive ops still run below.
+            const previewRow = purgeStalePreview(db, mctx, retainCutoff);
+            const lines = [
+              'purge_stale preview (confirm=false):',
+              `  Candidates (pending-purge, older than ${retainDays}d): ${previewRow.candidates}`,
+            ];
+            if (previewRow.candidates > 0) {
+              lines.push(`  Oldest: ${new Date(previewRow.oldest).toISOString().slice(0, 10)}`);
+              lines.push(`  Newest: ${new Date(previewRow.newest).toISOString().slice(0, 10)}`);
+            }
+            lines.push('  Nothing was deleted. To delete, re-run with confirm=true:');
+            lines.push(`  mem_maintain(action="execute", operations=${JSON.stringify(ops)}, confirm=true${args.retain_days ? `, retain_days=${args.retain_days}` : ''}${args.project ? `, project="${args.project}"` : ''})`);
+            results.push(lines.join('\n'));
+          } else {
+            const purged = purgeStale(db, mctx, retainCutoff);
+            results.push(`Purged ${purged} stale observations (retained last ${retainDays} days)` + (purged >= OP_CAP ? ' (cap reached, re-run for more)' : ''));
+          }
         }
 
         if (ops.includes('cleanup')) {

package/source-files.mjs

@@ -264,9 +264,37 @@ const LAUNCHER_SCRIPT_FILES = [
   'binding-probe-cli.mjs',
 ];
 
+// Plugin/marketplace DECLARATION files (audit 2026-08-14 P-2). Not executable
+// themselves, but they NAME what gets executed: hooks/hooks.json declares the
+// command lines Claude Code runs on every hook fire, .mcp.json declares the MCP
+// server launch command, plugin.json/marketplace.json steer the install source,
+// commands/*.md are model-visible skill bodies, registry/preinstalled.json seeds
+// the resource registry. All ship in the tarball; none were signed — the same
+// shape as the two closed RCE gaps (hook scripts v3.40, launch.mjs v3.42): a
+// release published without the signing key could swap hooks.json to point a
+// hook event at an arbitrary command while every signed hash still matched.
+// Additive: buildReleaseManifest skips entries absent at sign time, and
+// verifyReleaseFiles needs no change to enforce whatever the manifest carries.
+const PLUGIN_DECLARATION_FILES = [
+  'hooks/hooks.json',
+  '.mcp.json',
+  '.claude-plugin/plugin.json',
+  '.claude-plugin/marketplace.json',
+  'registry/preinstalled.json',
+  'commands/mem.md',
+  'commands/memory.md',
+  'commands/update.md',
+  'commands/tools.md',
+  'commands/adopt.md',
+  'commands/unadopt.md',
+  'commands/lesson.md',
+  'commands/bug.md',
+];
+
 // The complete set of files the release signature MUST cover: every runtime .mjs
 // (SOURCE_FILES) PLUS the executable hook scripts (copyReleaseIntoStaging installs these
-// into the live dir and they run on every hook fire) PLUS the launcher/setup scripts.
+// into the live dir and they run on every hook fire) PLUS the launcher/setup scripts
+// PLUS the plugin declaration files above.
 // HOOK_SCRIPT_FILES were historically NOT in the signed manifest, so an attacker able to
 // PUBLISH a release — but without the signing key — could swap a hook script (e.g.
 // post-tool-use.sh / hook-launcher.mjs) while every SOURCE_FILES hash still matched, and
@@ -278,4 +306,5 @@ export const RELEASE_SIGNED_FILES = [
   ...SOURCE_FILES,
   ...HOOK_SCRIPT_FILES.map(name => `scripts/${name}`),
   ...LAUNCHER_SCRIPT_FILES.map(name => `scripts/${name}`),
+  ...PLUGIN_DECLARATION_FILES,
 ];