claude-mem-lite 3.62.0 → 3.64.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "3.62.0",
+      "version": "3.64.0",
       "source": "./",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."
     }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.62.0",
+  "version": "3.64.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/README.md

@@ -529,6 +529,32 @@ Notes:
 - Direct install / npx mode keeps auto-update enabled and uses staged replacement with rollback on install failure.
 - If you disabled the plugin but still have old mem hooks in `~/.claude/settings.json`, run `node install.mjs cleanup-hooks`.
 
+#### Trust model per install path
+
+The three install paths do **not** carry the same supply-chain guarantees — pick the one that matches your threat model:
+
+| Path | Update mechanism | Ed25519 release-signature verification |
+|------|------------------|----------------------------------------|
+| npm / npx / git-clone direct install | auto-update from GitHub Releases | **Yes** — every runtime file (140 entries incl. hook scripts, MCP launcher, plugin declaration files) is hash-pinned in a signed manifest; verification is fail-closed |
+| `/plugin install` (marketplace) | manual `/plugin marketplace update` + reinstall | **No** — Claude Code installs from a git clone of the marketplace repo; the plugin's own signature chain is not consulted on this path. You are trusting GitHub + the repo's branch protection, not the release signing key |
+
+**Rollback recipe (plugin path).** If an update misbehaves, pin the marketplace clone to the previous release tag and reinstall from it:
+
+```bash
+# 1. Find the local marketplace clone
+ls ~/.claude/plugins/marketplaces/          # e.g. sdsrss
+
+# 2. Pin it to the previous good tag (tags mirror npm versions, e.g. v3.62.0)
+cd ~/.claude/plugins/marketplaces/sdsrss
+git fetch --tags && git checkout v3.62.0
+
+# 3. Reinstall from the pinned clone — inside Claude Code:
+#    /plugin install claude-mem-lite@sdsrss
+# 4. To leave the pin later: git checkout main, then the normal update flow.
+```
+
+Your data directory (`~/.claude-mem-lite/`) is untouched by install/rollback; schema migrations are forward-only, so after rolling back more than one minor version check `node install.mjs doctor` before trusting search results.
+
 ### doctor
 
 Checks Node.js version, dependencies, server/hook files, database integrity, FTS5 indexes, and stale processes.

package/format-utils.mjs

@@ -123,6 +123,27 @@ export function neutralizeSkillDelimiters(s) {
   return defangToFixpoint(s, SKILL_BLOCK_RE);
 }
 
+// <skill-bridge> is the wrapper scripts/pre-skill-bridge.js puts around a managed
+// skill body it injects as PreToolUse additionalContext. The body comes from a
+// third-party repo (tools/adopt import) — an untrusted boundary — so a literal
+// `</skill-bridge>` inside it would close the wrapper early and spill the rest of
+// the payload (e.g. a forged <system-reminder>) as undelimited context (audit
+// 2026-08-14 M-4). Not in CONTEXT_DELIMITER_RE for the same reason <skill-loaded>
+// isn't: the bridge's OWN wrapper must stay live, so the defang is applied per
+// call site to the untrusted body only.
+const SKILL_BRIDGE_RE = /<\/?skill-bridge(?:\s[^>]*)?>/gi;
+
+/**
+ * Defang a literal `<skill-bridge>` opener/closer in untrusted text that is about
+ * to be wrapped in a real skill-bridge block. Same fixpoint treatment as the
+ * classes above. Never apply to the wrapper itself.
+ * @param {string} s Input string (any type; coerced)
+ * @returns {string} Text with skill-bridge delimiters defanged
+ */
+export function neutralizeSkillBridgeDelimiters(s) {
+  return defangToFixpoint(s, SKILL_BRIDGE_RE);
+}
+
 /**
  * Render the PostToolUse error-recall hint block (hook.mjs::triggerErrorRecall).
  * The single most-relevant hit (rows[0]) that carries a lesson_learned gets its

package/hook-memory.mjs

@@ -3,6 +3,7 @@
 
 import { sanitizeFtsQuery, relaxFtsQueryToOr, debugCatch, truncate, OBS_BM25, notLowSignalTitleClause, noisePenaltyClause, tokenizeHandoff, HANDOFF_STOP_WORDS, extractCjkKeywords, neutralizeContextDelimiters, basenameAnySep } from './utils.mjs';
 import { citeFactorJs } from './scoring-sql.mjs';
+import { liveObsFilterSql } from './lib/inject-search-core.mjs';
 import { recordMetric } from './lib/metrics.mjs';
 import { DB_DIR } from './schema.mjs';
 import { extractIdents } from './lib/lesson-idents.mjs';
@@ -218,8 +219,7 @@ export function searchRelevantMemories(db, userPrompt, project, excludeIds = [])
         AND o.project = ?
         AND o.importance >= 1
         AND o.created_at_epoch > ?
-        AND COALESCE(o.compressed_into, 0) = 0
-        AND o.superseded_at IS NULL
+        AND ${liveObsFilterSql('o')}
         AND ${notLowSignalTitleClause('o')}
       ORDER BY ${OBS_BM25}
       LIMIT 10
@@ -266,8 +266,7 @@ export function searchRelevantMemories(db, userPrompt, project, excludeIds = [])
           AND o.type IN ('decision', 'discovery')
           AND o.importance >= 2
           AND o.created_at_epoch > ?
-          AND COALESCE(o.compressed_into, 0) = 0
-          AND o.superseded_at IS NULL
+          AND ${liveObsFilterSql('o')}
           AND ${notLowSignalTitleClause('o')}
         ORDER BY ${OBS_BM25}
         LIMIT 5
@@ -316,7 +315,7 @@ export function searchRelevantMemories(db, userPrompt, project, excludeIds = [])
     // Adaptive threshold: scales with corpus size to filter noise.
     // Each result must individually exceed the threshold (not just the top one).
     const obsCount = db.prepare(
-      'SELECT COUNT(*) as c FROM observations WHERE project = ? AND COALESCE(compressed_into, 0) = 0 AND superseded_at IS NULL',
+      `SELECT COUNT(*) as c FROM observations WHERE project = ? AND ${liveObsFilterSql('')}`,
     ).get(project)?.c || 0;
     const { TINY, SMALL, MEDIUM, LARGE } = BM25_THRESHOLD;
     const threshold = obsCount < 5 ? TINY : obsCount < 100 ? SMALL : obsCount < 500 ? MEDIUM : LARGE;
@@ -389,8 +388,7 @@ export function recallForFile(db, filePath, project) {
       JOIN observation_files of2 ON of2.obs_id = o.id
       WHERE o.project = ?
         AND o.importance >= 2
-        AND COALESCE(o.compressed_into, 0) = 0
-        AND o.superseded_at IS NULL
+        AND ${liveObsFilterSql('o')}
         AND o.created_at_epoch > ?
         AND (of2.filename = ? OR of2.filename LIKE ? ESCAPE '\\')
       ORDER BY o.created_at_epoch DESC
@@ -431,8 +429,7 @@ export function rankImperativeCandidates(db, userPrompt, project, excludeIds = [
       SELECT id, title, lesson_learned, importance
       FROM observations
       WHERE project = ?
-        AND COALESCE(compressed_into, 0) = 0
-        AND superseded_at IS NULL
+        AND ${liveObsFilterSql('')}
         AND COALESCE(importance, 1) >= 2
         AND lesson_learned IS NOT NULL
         AND TRIM(lesson_learned) != ''

package/hook.mjs

@@ -68,6 +68,8 @@ import { formatTaskImperative } from './lib/task-imperative.mjs';
 import { recordSkillAdoption, gcOldShadowShards } from './registry-recommend.mjs';
 import { gcOldMetricShards, recordMetric } from './lib/metrics.mjs';
 import { detectMemOverride } from './lib/mem-override.mjs';
+import { injectedIdsFileName } from './lib/injected-ids.mjs';
+import { liveObsFilterSql, recencyDecaySql } from './lib/inject-search-core.mjs';
 import { buildAndSaveHandoff, detectContinuationIntent, renderHandoffInjection, pickHandoffToInject, extractUnfinishedSummary } from './hook-handoff.mjs';
 import { checkForUpdate, getCachedUpdateBanner, isUpdateCheckDue } from './hook-update.mjs';
 import { handleLLMOptimize } from './hook-optimize.mjs';
@@ -491,11 +493,12 @@ function triggerErrorRecall(db, toolInput, response) {
         -- only for symmetry: the block's own footer is a mem_get(ids=...) pointer, and a
         -- COMPRESSED_PENDING_PURGE row is queued for deletion by maintain purge_stale,
         -- so that pointer would resolve to nothing.
-        AND COALESCE(o.compressed_into, 0) = 0
-        AND o.superseded_at IS NULL
+        AND ${liveObsFilterSql('o')}
         AND ${notLowSignalTitleClause('o')}
+      -- Decay via the shared core (P2-11): the M-1 MAX(0,…) age clamp lives there.
+      -- Fixed 14d half-life (error recency matters more than obs type here).
       ORDER BY ${OBS_BM25}
-        * (1.0 + EXP(-0.693 * (? - o.created_at_epoch) / 1209600000.0))
+        * ${recencyDecaySql({ tsExpr: 'o.created_at_epoch', halfLifeSql: '1209600000.0' })}
       LIMIT 3
     `).all(ftsQuery, project, nowR);
 
@@ -853,16 +856,21 @@ function buildCiteRecallNudge(project) {
   return libBuildCiteRecallNudge(project, RUNTIME_DIR);
 }
 
-// GC pre-recall cooldown files older than 24h. Pulled out of pre-tool-recall.js
-// (where it ran on every Edit, costing 15-30 disk stats per call on long-lived
-// projects) and consolidated here — once per SessionStart is enough to keep
-// RUNTIME_DIR from growing unbounded across stale sessions.
+// GC stale per-session runtime files older than 24h: pre-recall cooldowns AND
+// (D#120) the per-session injected-ids markers — both grow one file per session.
+// Pulled out of pre-tool-recall.js (where it ran on every Edit, costing 15-30
+// disk stats per call on long-lived projects) and consolidated here — once per
+// SessionStart is enough to keep RUNTIME_DIR from growing unbounded.
 const PRE_RECALL_COOLDOWN_STALE_MS = 24 * 60 * 60 * 1000;
 function gcStalePreRecallCooldowns() {
   try {
     const now = Date.now();
     for (const name of readdirSync(RUNTIME_DIR)) {
-      if (!name.startsWith('pre-recall-cooldown-') || !name.endsWith('.json')) continue;
+      // D#120: the injected-ids marker is also per-session now — same growth
+      // shape as the cooldown files, same 24h GC (dedup window is 5 min).
+      const isCooldown = name.startsWith('pre-recall-cooldown-') && name.endsWith('.json');
+      const isInjectedMarker = name.startsWith('.claude-mem-injected-');
+      if (!isCooldown && !isInjectedMarker) continue;
       try {
         const p = join(RUNTIME_DIR, name);
         const st = statSync(p);
@@ -1017,20 +1025,29 @@ function runSessionStartAutoMaintain(db) {
 
       // Auto-dedup (exact): merge identical-title observations within 1h.
       // Catches rapid duplicate writes (same hook firing twice, race conditions).
+      // BOTH join sides must be live (audit 2026-08-14 H-1): without the
+      // superseded_at filters (which the fuzzy channel below always had), a row the
+      // fuzzy pass had tombstoned could come back as `a` (a.id < b.id) and tombstone
+      // the LIVE keeper `b` — both copies gone from every read path. Worse, a user
+      // correction saved with supersedes=[#A] (A.superseded_by = B's NUMERIC id) has
+      // the same title as A, so the pair (A, B) tombstoned the correction B itself
+      // and the string 'auto-dedup' write clobbered numeric supersession chains that
+      // citation-tracker decay hand-off and timeline re-anchoring both follow. The
+      // UPDATE repeats the guard so a concurrent writer can't re-stamp a chain.
       const dupPairs = db.prepare(`
         SELECT a.id as keep_id, b.id as remove_id
         FROM observations a
         JOIN observations b ON a.title = b.title AND a.project = b.project
           AND a.id < b.id
           AND ABS(a.created_at_epoch - b.created_at_epoch) < 3600000
-          AND COALESCE(a.compressed_into, 0) = 0
-          AND COALESCE(b.compressed_into, 0) = 0
+          AND ${liveObsFilterSql('a')}
+          AND ${liveObsFilterSql('b')}
         LIMIT 20
       `).all();
       if (dupPairs.length > 0) {
         const removeIds = dupPairs.map(p => p.remove_id);
         const ph = removeIds.map(() => '?').join(',');
-        db.prepare(`UPDATE observations SET superseded_at = ?, superseded_by = 'auto-dedup' WHERE id IN (${ph})`).run(Date.now(), ...removeIds);
+        db.prepare(`UPDATE observations SET superseded_at = ?, superseded_by = 'auto-dedup' WHERE id IN (${ph}) AND superseded_at IS NULL`).run(Date.now(), ...removeIds);
         debugLog('DEBUG', 'auto-maintain', `auto-deduped ${dupPairs.length} near-identical observations`);
       }
 
@@ -1047,8 +1064,7 @@ function runSessionStartAutoMaintain(db) {
         const recent = db.prepare(`
           SELECT id, title, importance, created_at_epoch, narrative, text
           FROM observations
-          WHERE COALESCE(compressed_into, 0) = 0
-            AND superseded_at IS NULL
+          WHERE ${liveObsFilterSql('')}
             AND created_at_epoch > ?
             AND title IS NOT NULL AND title != ''
           ORDER BY created_at_epoch DESC LIMIT ${SCAN_LIMIT}
@@ -1646,11 +1662,17 @@ async function handleUserPrompt() {
 
       // Read IDs already injected by user-prompt-search.js to avoid duplicate injection
       try {
-        const injectedFile = join(RUNTIME_DIR, `.claude-mem-injected-${project}`);
+        // D#120: the marker file is session-keyed (no ccSessionId → legacy
+        // project-keyed name), so a concurrent session's write can no longer
+        // replace this session's payload between the UPS write and this read.
+        const injectedFile = join(RUNTIME_DIR, injectedIdsFileName(project, ccSessionId));
         const raw = readFileSync(injectedFile, 'utf8');
-        const { ids, ts } = JSON.parse(raw);
-        // Only use if written within last 10 seconds (same prompt cycle)
-        if (ts && Date.now() - ts < 10000 && Array.isArray(ids)) {
+        const { ids, ts, session } = JSON.parse(raw);
+        // Only use if written within last 10 seconds (same prompt cycle) AND by this
+        // CC session (M-6 payload gate, still load-bearing for legacy files).
+        // Legacy payloads without `session` keep the old time-window-only behavior.
+        if (ts && Date.now() - ts < 10000 && Array.isArray(ids)
+            && !(session && ccSessionId && session !== ccSessionId)) {
           for (const id of ids) { keyContextIds.push(id); pathAInjectedIds.push(id); }
         }
       } catch { /* file may not exist — that's fine */ }
@@ -1871,6 +1893,11 @@ try {
   // lib/native-binding-hint.mjs.
   const line = formatHookError(err, event, { runtimeDir: RUNTIME_DIR });
   if (line) console.error(line);
+  // stderr alone is invisible to `stats` self-observation — only the native-binding
+  // family was persisted, so a non-binding fatal (schema drift, bad stdin shape)
+  // could kill every dispatch-routed surface while the hook-errors log read zero
+  // (audit 2026-08-14 M-5; same blindness one layer up from the v3.60 outage).
+  recordHookError(`hook:${event}`, err, RUNTIME_DIR);
 }
 
 process.exit(0);

package/install.mjs

@@ -1561,6 +1561,27 @@ async function doctor() {
     ok(`Native DB binding: loadable on Node ${process.version}`);
   }
 
+  // Disk footprint (audit 2026-08-14 M-9): a "lite" data dir had grown to 653MB
+  // against a 59MB DB — 360MB of it orphaned per-tag .bak snapshots — with no
+  // check anywhere. Cheap probes only (DB file + .bak aggregate, no tree walk).
+  // The budget itself is enforced by lib/db-backup on every new snapshot; this
+  // check surfaces stores that predate the budget or exceed it between snapshots.
+  try {
+    const { listSnapshots, backupBudgetBytes } = await import('./lib/db-backup.mjs');
+    const dbFile = join(MEM_DATA_DIR, 'claude-mem-lite.db');
+    const dbBytes = existsSync(dbFile) ? statSync(dbFile).size : 0;
+    const snaps = listSnapshots(dbFile);
+    const backupBytes = snaps.reduce((s, x) => s + x.size, 0);
+    const mb = (n) => (n / (1024 * 1024)).toFixed(1);
+    // Warn threshold = the REAL eviction budget (pre-release review 2026-08-16) —
+    // warning below it promised an eviction enforceBackupBudget would never do.
+    if (backupBytes > backupBudgetBytes()) {
+      dwarn(`Disk footprint: ${snaps.length} backup snapshot(s) hold ${mb(backupBytes)}MB, over the ${mb(backupBudgetBytes())}MB budget (CLAUDE_MEM_BACKUP_BUDGET_MB) — the next maintain/save snapshot evicts oldest snapshots past the 7d undo grace`);
+    } else {
+      ok(`Disk footprint: DB ${mb(dbBytes)}MB, ${snaps.length} backup snapshot(s) ${mb(backupBytes)}MB (budget ${mb(backupBudgetBytes())}MB)`);
+    }
+  } catch { /* footprint check is informational — never block doctor */ }
+
   // Plugin/hook lifecycle state
   const settings = readSettings();
   const hasHooks = hasMemHooksConfigured(settings);

package/lib/browse-core.mjs

@@ -0,0 +1,67 @@
+// lib/browse-core.mjs — shared data collection for the CLI `browse` / MCP
+// `mem_browse` twin (P2-12, audit 2026-08-14). The tier count + row queries were
+// duplicated and had already drifted (the CLI SELECT carried `importance`, the
+// MCP one had dropped it). Collection lives here with the superset column shape;
+// each face keeps its own rendering (text dashboard vs --json vs MCP text).
+
+import { TIER_CASE_SQL, tierSqlParams } from '../tier.mjs';
+import { liveObsFilterSql } from './inject-search-core.mjs';
+
+export const BROWSE_TIERS = ['working', 'active', 'archive'];
+export const BROWSE_TIER_LABELS = { working: '🔴 Working Memory', active: '🟡 Active Memory', archive: '🔵 Archive' };
+
+/** Newest active memory_session_id for the project ('' when none) — the tier
+ *  classifier's "current session" input, needed identically by both faces. */
+export function getActiveMemorySessionId(db, project) {
+  const row = db.prepare(
+    "SELECT memory_session_id FROM sdk_sessions WHERE project = ? AND status = 'active' ORDER BY started_at_epoch DESC LIMIT 1"
+  ).get(project);
+  return row?.memory_session_id ?? '';
+}
+
+/**
+ * Collect per-tier counts + rows for the memory dashboard.
+ * Archive keeps its count but skips row fetch in the unfiltered view (both faces'
+ * documented behavior — the archive tail is reachable via `browse --tier archive`).
+ * @returns {{showTiers: string[], tierData: object, tierCounts: object, grandTotal: number}}
+ */
+export function collectBrowseTiers(db, { project, tierFilter, limit, now, currentSessionId }) {
+  const ctx = { now, currentProject: project, currentSessionId };
+  const params = tierSqlParams(ctx);
+  const showTiers = tierFilter ? [tierFilter] : BROWSE_TIERS;
+
+  const tierData = {};
+  const tierCounts = {};
+  let grandTotal = 0;
+
+  for (const tier of showTiers) {
+    const countRow = db.prepare(`
+      SELECT COUNT(*) as c FROM (
+        SELECT ${TIER_CASE_SQL} as tier FROM observations
+        WHERE project = ? AND ${liveObsFilterSql('')}
+      ) WHERE tier = ?
+    `).get(...params, project, tier);
+    const count = countRow?.c ?? 0;
+    tierCounts[tier] = count;
+    grandTotal += count;
+
+    const skipRows = tier === 'archive' && !tierFilter;
+    if (count === 0 || skipRows) {
+      tierData[tier] = { count, rows: [] };
+      continue;
+    }
+
+    const rows = db.prepare(`
+      SELECT * FROM (
+        SELECT id, type, title, importance, created_at, created_at_epoch, ${TIER_CASE_SQL} as tier
+        FROM observations
+        WHERE project = ? AND ${liveObsFilterSql('')}
+      ) WHERE tier = ?
+      ORDER BY created_at_epoch DESC
+      LIMIT ?
+    `).all(...params, project, tier, limit);
+    tierData[tier] = { count, rows };
+  }
+
+  return { showTiers, tierData, tierCounts, grandTotal };
+}

package/lib/db-backup.mjs

@@ -7,10 +7,92 @@
 //
 // MUST be called OUTSIDE any transaction — VACUUM cannot run inside one, which is
 // why the maintenance entry points snapshot before opening their db.transaction().
-import { readdirSync, unlinkSync } from 'fs';
+import { readdirSync, unlinkSync, statSync } from 'fs';
 import { dirname, basename, join } from 'path';
 import { debugLog } from '../utils.mjs';
 
+// M-9 (audit 2026-08-14): per-tag retention alone let one-shot tags live forever —
+// each tag kept its newest 3, but a tag written once (pre-backfill-v3390 and four
+// siblings) never got a second snapshot to age it out, so 9 orphaned .bak files held
+// 360MB against a 59MB live DB. A TOTAL byte budget across ALL tags bounds the
+// footprint of a system whose name promises "lite". Oldest-first eviction, newest
+// snapshot always survives (the most recent safety net must outlive any budget).
+const DEFAULT_BACKUP_BUDGET_BYTES = 256 * 1024 * 1024;
+
+/** Effective budget (env-tunable). Exported so stats/doctor derive their
+ * footprint-warning thresholds from the SAME number eviction acts on —
+ * pre-release review 2026-08-16: a hardcoded `3× DB` hint fired ~2.7× below
+ * the real budget and promised an eviction that would never happen. */
+export function backupBudgetBytes() {
+  const mb = Number(process.env.CLAUDE_MEM_BACKUP_BUDGET_MB);
+  return Number.isFinite(mb) && mb > 0 ? mb * 1024 * 1024 : DEFAULT_BACKUP_BUDGET_BYTES;
+}
+
+// Eviction grace: snapshots younger than this are never budget-evicted. This is
+// what protects a fresh `pre-delete` undo pre-image (deleteObservations reports
+// its path as the recovery route) from being unlinked by same-day maintain churn
+// (pre-release review 2026-08-16). Deliberately age-based, NOT newest-per-tag:
+// a per-tag exemption would make every one-shot tag's only snapshot immortal —
+// exactly the 360MB orphan shape M-9 exists to evict. Mirrors the purge grace
+// convention (7d) used by stale-observation retention.
+export const BACKUP_EVICTION_GRACE_MS = 7 * 86400000;
+
+// Canonical snapshot shape `<base>.<tag>-<ISO stamp>-<pid>-<seq>.bak` (what
+// snapshotDb writes). Budget eviction deletes ONLY names matching this — a
+// user's hand-made `cp db db.before-upgrade.bak` must never be auto-unlinked.
+const SNAPSHOT_STAMP_RE = /-\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-\d{3}Z-\d+-\d+\.bak$/;
+
+/** All `<db>.<tag>-<ts>.bak` snapshots for `dbPath`, any tag, with size + mtime. */
+export function listSnapshots(dbPath) {
+  try {
+    const dir = dirname(dbPath);
+    const prefix = `${basename(dbPath)}.`;
+    const out = [];
+    for (const n of readdirSync(dir)) {
+      if (!n.startsWith(prefix) || !n.endsWith('.bak')) continue;
+      const full = join(dir, n);
+      try {
+        const st = statSync(full);
+        out.push({ path: full, size: st.size, mtimeMs: st.mtimeMs });
+      } catch { /* raced away */ }
+    }
+    return out;
+  } catch { return []; }
+}
+
+/**
+ * Evict oldest snapshots (across ALL tags) until the total is within the byte
+ * budget. Never evicted: the single newest snapshot (even if it alone exceeds
+ * the budget), anything younger than BACKUP_EVICTION_GRACE_MS, and any file not
+ * matching the canonical snapshot name shape. The total counts every .bak
+ * (exempt files included), so a burst of young snapshots can hold the dir above
+ * budget for up to the grace window — bounded by write rate, and the price of
+ * never deleting an undo pre-image someone may still want.
+ * Returns the number of files removed. Best-effort, never throws.
+ */
+export function enforceBackupBudget(dbPath, { budgetBytes = backupBudgetBytes(), nowMs = Date.now() } = {}) {
+  try {
+    const snaps = listSnapshots(dbPath).sort((a, b) => b.mtimeMs - a.mtimeMs); // newest first
+    let total = snaps.reduce((s, x) => s + x.size, 0);
+    let removed = 0;
+    const graceCutoff = nowMs - BACKUP_EVICTION_GRACE_MS;
+    // Walk oldest-first; stop before touching the newest (index 0).
+    for (let i = snaps.length - 1; i >= 1 && total > budgetBytes; i--) {
+      if (!SNAPSHOT_STAMP_RE.test(snaps[i].path)) continue;   // not ours — never delete
+      if (snaps[i].mtimeMs > graceCutoff) continue;           // inside undo grace
+      try {
+        unlinkSync(snaps[i].path);
+        total -= snaps[i].size;
+        removed++;
+      } catch { /* per-entry best-effort */ }
+    }
+    if (removed > 0) {
+      try { debugLog('DEBUG', 'db-backup', `budget eviction removed ${removed} snapshot(s)`); } catch { /* ignore */ }
+    }
+    return removed;
+  } catch { return 0; }
+}
+
 // Monotonic per-process suffix so two snapshots in the same millisecond (same pid)
 // still get unique filenames (VACUUM INTO fails if the target already exists).
 let _seq = 0;
@@ -31,6 +113,7 @@ export function snapshotDb(db, { tag = 'pre-maintain', retain = 3 } = {}) {
     // defensively since VACUUM INTO takes a string literal, not a bound param.
     db.exec(`VACUUM INTO '${out.replace(/'/g, "''")}'`);
     pruneSnapshots(dbPath, tag, retain);
+    enforceBackupBudget(dbPath);
     return out;
   } catch (e) {
     try { debugLog('WARN', 'db-backup', `snapshot skipped (proceeding without): ${e.message}`); } catch { /* ignore */ }

package/lib/delete-core.mjs

@@ -7,7 +7,7 @@
 // merged/compressed-child recovery, and the delete transaction.
 import { snapshotDb } from './db-backup.mjs';
 import { recoverChildrenOf } from './maintain-core.mjs';
-import { debugCatch } from '../utils.mjs';
+import { debugCatch, truncate } from '../utils.mjs';
 
 /**
  * Hard-delete the given observation ids with full orchestration. The CALLER owns
@@ -70,3 +70,20 @@ export function deleteObservations(db, ids, { snapshotTag = 'pre-delete' } = {})
   const result = deleteTx();
   return { deleted: result.changes, recoveredChildren: result.recovered, snapshotPath };
 }
+
+/**
+ * Shared delete-preview body (P2-12): fetch the doomed rows and format the
+ * per-row lines both faces print between their own header ("Preview: N …")
+ * and footer (--confirm vs confirm=true remedy). The SELECT and the row shape
+ * were duplicated in mem-cli.mjs + server.mjs and are the exact place a
+ * preview/execute drift would hide.
+ * @param {import('better-sqlite3').Database} db
+ * @param {number[]} ids
+ * @returns {{rows: Array<{id:number,type:string,title:string,project:string}>, lines: string[]}}
+ */
+export function previewDeleteRows(db, ids) {
+  const ph = ids.map(() => '?').join(',');
+  const rows = db.prepare(`SELECT id, type, title, project FROM observations WHERE id IN (${ph})`).all(...ids);
+  const lines = rows.map((r) => `  #${r.id} [${r.type}] ${truncate(r.title || '(untitled)', 80)} | ${r.project}`);
+  return { rows, lines };
+}

package/lib/export-columns.mjs

@@ -18,10 +18,16 @@
 // exported: `related_ids` (holds observation ids, stale/dangling after restore remaps ids)
 // and `discovery_tokens` (a derived retrieval metric, rebuilt by the live system; exporting
 // it would freeze a stale value into backups).
+// `compressed_into` (audit 2026-08-14 M-8): only ever non-null in an export taken
+// with --include-compressed / include_compressed — the default WHERE excludes those
+// rows. Without the column, a compressed member round-tripped through restore as a
+// LIVE row and turned up in search results next to the weekly-summary keeper that
+// already absorbed it. Restore does not remap it (the keeper's id is meaningless in
+// the target store); it REJECTS marked rows instead — see cmdRestore.
 export const EXPORT_COLUMNS = [
   'id', 'memory_session_id', 'project', 'type', 'title', 'subtitle', 'narrative', 'text',
   'concepts', 'facts', 'files_read', 'files_modified', 'lesson_learned', 'search_aliases',
-  'scope',
+  'scope', 'compressed_into',
   'importance', 'branch', 'access_count', 'cited_count', 'uncited_streak', 'injection_count',
   'decay_seen_count', 'last_accessed_at', 'created_at', 'created_at_epoch',
 ];

package/lib/get-core.mjs

@@ -0,0 +1,33 @@
+// lib/get-core.mjs — shared core for the CLI `get` / MCP `mem_get` twin (P2-12,
+// audit 2026-08-14). The 23-element OBS_FIELDS array was duplicated verbatim in
+// mem-cli.mjs and server.mjs (the 16-vs-24-column export data-loss incident's
+// precursor shape), and the session detail field sets had ALREADY diverged
+// (MCP 13 fields vs CLI 6 — a `remaining_items` FTS hit was a dead end in the
+// CLI detail view). Field sets + the access-bump fetch live here; each face
+// keeps its own header/label rendering conventions.
+
+import { autoBoostIfNeeded } from '../search-scoring.mjs';
+
+/** Every observation column `get --fields` accepts, in render order. */
+export const OBS_FIELDS = ['id', 'type', 'title', 'subtitle', 'narrative', 'text', 'facts', 'concepts', 'lesson_learned', 'search_aliases', 'files_read', 'files_modified', 'project', 'created_at', 'memory_session_id', 'prompt_number', 'importance', 'related_ids', 'access_count', 'branch', 'superseded_at', 'superseded_by', 'last_accessed_at'];
+
+/** Session-summary detail render set — the FULL set (both faces). The CLI's old
+ *  6-field subset made notes/remaining_items/files_* searchable-but-unrenderable. */
+export const SESSION_DETAIL_FIELDS = ['id', 'request', 'investigated', 'learned', 'completed', 'next_steps', 'remaining_items', 'files_read', 'files_edited', 'notes', 'project', 'created_at', 'memory_session_id', 'prompt_number'];
+
+/**
+ * Fetch observation detail rows: bump access_count/last_accessed_at (reading a
+ * detail IS an access signal — feeds noisePenalty's ratio guard), run the
+ * auto-boost heuristic, and return rows oldest-first.
+ * @param {import('better-sqlite3').Database} db
+ * @param {number[]} ids
+ * @returns {object[]} full observation rows (SELECT *), created order
+ */
+export function fetchObsDetail(db, ids) {
+  const ph = ids.map(() => '?').join(',');
+  try {
+    db.prepare(`UPDATE observations SET access_count = COALESCE(access_count, 0) + 1, last_accessed_at = ? WHERE id IN (${ph})`).run(Date.now(), ...ids);
+    autoBoostIfNeeded(db, ids);
+  } catch { /* non-critical: FTS5 trigger may fail on corrupted index */ }
+  return db.prepare(`SELECT * FROM observations WHERE id IN (${ph}) ORDER BY created_at_epoch ASC`).all(...ids);
+}

package/lib/inject-search-core.mjs

@@ -0,0 +1,84 @@
+// lib/inject-search-core.mjs — the injection-side shared core (P2-11, audit
+// 2026-08-14). Shared home for the three SQL atoms that kept drifting across
+// hand-copied twins on the INJECTION-side retrieval surfaces (the five consumer
+// files the ledger test enforces — NOT yet the whole read surface: recall-core /
+// recent-core / timeline-core / hook-context / hook-handoff / hook-optimize /
+// deep-search / stats and the sessions/events decay arms in lib/search-core
+// still inline their own copies; extending them is the deferred second cut):
+//
+//   * live-row filter        — the compressed+superseded pair whose omission was
+//                              the superseded-invariant's recurring reopening
+//                              (7th occurrence fixed in v3.63 H-1, write-side)
+//   * clamped recency decay  — the MAX(0,…) age clamp (audit M-1: a far-future
+//                              created_at from restore/import-jsonl EXP-overflowed
+//                              and pinned that row #1; the fix reached
+//                              search-engine but not the UPS/error-recall twins)
+//   * injection relevance    — the full multiplicative chain incl. cite/noise
+//                              behavior factors (audit M-3: wired on every auto
+//                              surface, missing from the explicit-surface score)
+//
+// Consumers: scripts/user-prompt-search.js, scripts/pre-tool-recall.js,
+// hook-memory.mjs, hook.mjs (error-recall), search-engine.mjs. Each surface keeps
+// its own deliberate pipeline composition (BM25-sort + JS scoring vs SQL full
+// chain vs file-keyed sort — see #8786: per-surface asymmetries stay explicit);
+// only the ATOMS are shared. tests/inject-search-core.test.mjs holds the ledger:
+// the five consumer files must compose these builders, never re-inline copies.
+//
+// Lives under lib/ (not scripts/) so hook.mjs can statically import it without
+// colliding with the installExtractedRelease scripts-dir rename (same constraint
+// as lib/mem-override.mjs). Dependency-light by design: pre-tool-recall's
+// standalone fast-path (#8447) already imports scoring-sql.mjs.
+
+import {
+  OBS_BM25, TYPE_DECAY_CASE, TYPE_QUALITY_CASE,
+  noisePenaltyClause, citeFactorClause,
+} from '../scoring-sql.mjs';
+
+/**
+ * Live-row filter: rows a model-facing retrieval surface may return. Excludes
+ * compression tombstones (positive keeper ids AND -2 pending-purge) and
+ * superseded rows (a retracted lesson must never outrank its correction).
+ * @param {string} [alias='o'] table alias; '' for unqualified single-table queries
+ * @returns {string} SQL boolean expression (no leading AND)
+ */
+export function liveObsFilterSql(alias = 'o') {
+  const a = alias ? `${alias}.` : '';
+  return `COALESCE(${a}compressed_into, 0) = 0 AND ${a}superseded_at IS NULL`;
+}
+
+/**
+ * Clamped recency-decay factor: (1 + EXP(-ln2 · age / halfLife)), age >= 0.
+ * The MAX(0,…) clamp is the M-1 fix — restore/import-jsonl accept arbitrary
+ * epochs, and an unclamped future timestamp makes the exponent large-positive →
+ * EXP overflows to +Infinity → that row sorts #1 for every query (and its score
+ * serializes as null). A future row reads as age 0 = max finite recency instead.
+ * Binds one `?` placeholder: the caller passes `now` (epoch ms) at that position.
+ * @param {object} opts
+ * @param {string} opts.tsExpr - SQL expression for the row's reference timestamp
+ *   (e.g. 'o.created_at_epoch', or the created/last-accessed MAX search-engine uses)
+ * @param {string} [opts.halfLifeSql=TYPE_DECAY_CASE] - SQL expression for the
+ *   half-life in ms (constant or per-type CASE; TYPE_DECAY_CASE assumes alias 'o')
+ * @returns {string} SQL numeric expression (parenthesized)
+ */
+export function recencyDecaySql({ tsExpr, halfLifeSql = TYPE_DECAY_CASE }) {
+  return `(1.0 + EXP(-0.693 * MAX(0, ? - ${tsExpr}) / ${halfLifeSql}))`;
+}
+
+/**
+ * Injection relevance: the full multiplicative chain the prompt-time injection
+ * surface (UPS searchByFts) ranks by — BM25 × clamped type-decay × type-quality
+ * × importance × noise penalty × cite factor. Alias is fixed to 'o' because
+ * TYPE_DECAY_CASE / TYPE_QUALITY_CASE bake that alias in.
+ * Binds one `?` placeholder (the decay `now`), first in parameter order.
+ * @param {string} [alias='o'] must be 'o'
+ * @returns {string} SQL numeric expression
+ */
+export function injectionRelevanceSql(alias = 'o') {
+  if (alias !== 'o') throw new Error('injectionRelevanceSql: alias must be "o" (TYPE_*_CASE bake it in)');
+  return `${OBS_BM25}
+             * ${recencyDecaySql({ tsExpr: 'o.created_at_epoch' })}
+             * ${TYPE_QUALITY_CASE}
+             * (0.5 + 0.5 * COALESCE(o.importance, 1))
+             * ${noisePenaltyClause('o')}
+             * ${citeFactorClause('o')}`;
+}