claude-mem-lite 3.62.0 → 3.64.0

package/scripts/post-tool-recall.js

@@ -16,6 +16,7 @@
 import { existsSync, readFileSync } from 'fs';
 import { basename, join } from 'path';
 import { resolveDataDir } from '../lib/resolve-data-dir.mjs';
+import { recordHookError } from '../lib/hook-telemetry.mjs';
 
 const SALIENCE_BIND = process.env.CLAUDE_MEM_SALIENCE === 'bind';
 
@@ -45,7 +46,13 @@ async function main() {
   const cdPath = cooldownPathFor(sessionId);
   if (!existsSync(cdPath)) return;
   let entry;
-  try { entry = JSON.parse(readFileSync(cdPath, 'utf8'))[filePath]; } catch { return; }
+  try { entry = JSON.parse(readFileSync(cdPath, 'utf8'))[filePath]; } catch (e) {
+    // A corrupt cooldown file (torn concurrent write — audit 2026-08-14 M-6) turns
+    // the bind-salience check into a zero-trace no-op; record it so `stats` can see
+    // the surface die instead of silently reading zero errors (M-5).
+    recordHookError('post-recall:cooldown-parse', e, RUNTIME_DIR, { file: basename(cdPath) });
+    return;
+  }
   const idents = entry && entry.lessonIdents;
   if (!idents || typeof idents !== 'object') return;
 
@@ -77,4 +84,7 @@ async function main() {
 // stream emits 'error' — without the (now-removed) forced exit, an unhandled one would
 // surface as a non-zero exit + stack. A hook must never fail loud on a dropped pipe.
 process.stdout.on('error', () => {});
-main().catch(() => {});
+// Record what slips past main()'s early returns before the mandatory swallow —
+// this script had zero telemetry (audit 2026-08-14 M-5). Recorder never throws;
+// the outer catch keeps the exit code 0 regardless.
+main().catch((e) => { try { recordHookError('post-recall:main', e, RUNTIME_DIR); } catch { /* never */ } });

package/scripts/pre-agent-inject.js

@@ -15,6 +15,23 @@
 const ENABLED = process.env.CLAUDE_MEM_SUBAGENT_INJECT === 'on'
   || process.env.CLAUDE_MEM_SUBAGENT_INJECT === '1';
 
+// Telemetry via DYNAMIC import so the default-off fast path stays import-free
+// (the file's stated contract). Only ever reached on the enabled path's failure
+// branches — this script had zero recordHookError coverage, so a dead DB or
+// schema drift silently disabled subagent injection with no trace (audit
+// 2026-08-14 M-5). Swallows everything: telemetry must never break a dispatch.
+async function recordFailure(scope, err, ctx) {
+  try {
+    const [{ recordHookError }, { resolveDataDir }, { join }] = await Promise.all([
+      import('../lib/hook-telemetry.mjs'),
+      import('../lib/resolve-data-dir.mjs'),
+      import('path'),
+    ]);
+    const dataDir = resolveDataDir(process.env.CLAUDE_MEM_DIR);
+    recordHookError(scope, err, process.env.CLAUDE_MEM_RUNTIME_DIR || join(dataDir, 'runtime'), ctx);
+  } catch { /* never */ }
+}
+
 function readStdin() {
   return new Promise((resolve) => {
     let data = '';
@@ -51,7 +68,7 @@ async function main() {
   const { buildSubagentInjection } = await import('../hook-memory.mjs');
 
   let db;
-  try { db = ensureDb(); } catch { return; }
+  try { db = ensureDb(); } catch (e) { await recordFailure('agent-inject:db-open', e); return; }
   try {
     const updatedInput = buildSubagentInjection(db, hook.tool_input, inferProject());
     if (updatedInput) {
@@ -59,7 +76,7 @@ async function main() {
         hookSpecificOutput: { hookEventName: 'PreToolUse', updatedInput },
       }));
     }
-  } catch { /* never break a dispatch */ } finally {
+  } catch (e) { await recordFailure('agent-inject:query', e); /* never break a dispatch */ } finally {
     try { db.close(); } catch { /* */ }
   }
 }
@@ -69,5 +86,6 @@ async function main() {
 // which FLUSHES stdout. The emitted updatedInput echoes the whole prompt back, so the
 // payload can exceed the ~64KB pipe buffer; a forced process.exit() would drop that
 // pending async write and truncate the JSON (the gotcha every sibling hook avoids).
-// Swallow any rejection so the exit code can never go non-zero.
-main().catch(() => {});
+// Swallow any rejection so the exit code can never go non-zero — but record it
+// first (recordFailure itself swallows everything, including its own failures).
+main().catch((e) => recordFailure('agent-inject:main', e));

package/scripts/pre-skill-bridge.js

@@ -8,6 +8,9 @@ import { join, resolve, sep } from 'path';
 import { homedir } from 'os';
 import { recordHookError } from '../lib/hook-telemetry.mjs';
 import { resolveDataDir } from '../lib/resolve-data-dir.mjs';
+// format-utils.mjs is import-free — pulling three defang helpers keeps this script
+// inside its "lightweight standalone" budget (no heavy transitive deps).
+import { neutralizeContextDelimiters, neutralizeSkillDelimiters, neutralizeSkillBridgeDelimiters } from '../format-utils.mjs';
 
 // CLAUDE_MEM_DIR mirrors pre-tool-recall.js — one env var sandboxes everything.
 const DATA_DIR = resolveDataDir(process.env.CLAUDE_MEM_DIR);
@@ -88,12 +91,24 @@ try {
     // console.log() form would render on stock CC but no-op on those variants.
     // Token budget: ~4 chars per token, 4000 token limit = 16000 chars.
     const portablePath = resolvedPath.startsWith(homedir()) ? '~' + resolvedPath.slice(homedir().length) : resolvedPath;
+    // Defang the untrusted skill body + name before wrapping (audit 2026-08-14 M-4):
+    // registry rows come from third-party repos, and this was the one AUTO injection
+    // surface of that data with zero neutralization — a body carrying a literal
+    // `</skill-bridge>` + forged <system-reminder> (or a `<skill-loaded>` execute
+    // block) escaped the wrapper verbatim. Name additionally drops quote/bracket
+    // chars: it lands in an ATTRIBUTE position, where `"` breaks out of the wrapper
+    // tag itself. Applied to the truncated summary too (a cut can't be trusted to
+    // land mid-tag).
+    const defang = (s) => neutralizeSkillBridgeDelimiters(neutralizeSkillDelimiters(neutralizeContextDelimiters(s)));
+    const safeName = String(row.name).replace(/["'<>]/g, '');
     let additionalContext;
     if (content.length > 16000) {
-      const summary = content.slice(0, 800);
-      additionalContext = `<skill-bridge name="${row.name}" source="managed" truncated="true">\n${summary}\n...\n</skill-bridge>\n\nSkill content truncated. Read("${portablePath}") to load full content.`;
+      const summary = defang(content.slice(0, 800));
+      // D#122 ③: the path interpolates OUTSIDE the wrapper — defang it too (a
+      // locally-created managed dir can carry delimiter chars in its name).
+      additionalContext = `<skill-bridge name="${safeName}" source="managed" truncated="true">\n${summary}\n...\n</skill-bridge>\n\nSkill content truncated. Read("${defang(portablePath)}") to load full content.`;
     } else {
-      additionalContext = `<skill-bridge name="${row.name}" source="managed">\n${content}\n</skill-bridge>\n\nThis skill was loaded from the managed registry. Follow the instructions above.`;
+      additionalContext = `<skill-bridge name="${safeName}" source="managed">\n${defang(content)}\n</skill-bridge>\n\nThis skill was loaded from the managed registry. Follow the instructions above.`;
     }
     process.stdout.write(JSON.stringify({
       suppressOutput: true,

package/scripts/pre-tool-recall.js

@@ -4,9 +4,12 @@
 // and the pure-data lib/low-signal-patterns.mjs (zero runtime deps, ~1ms overhead).
 // Safety: readonly DB, exit 0 always, 3s timeout
 
-import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs';
+import { existsSync, readFileSync, mkdirSync } from 'fs';
 import { basename, join } from 'path';
 import { resolveDataDir } from '../lib/resolve-data-dir.mjs';
+import { atomicWriteFileSync } from '../lib/atomic-write.mjs';
+import { injectedIdsFileName } from '../lib/injected-ids.mjs';
+import { liveObsFilterSql } from '../lib/inject-search-core.mjs';
 import { buildNotLowSignalSql } from '../lib/low-signal-patterns.mjs';
 import { recordHookError } from '../lib/hook-telemetry.mjs';
 import { citeFactorClause } from '../scoring-sql.mjs';
@@ -152,34 +155,46 @@ function entryTimestamp(v) {
 }
 
 // A3 (v2.83): cross-hook injected-IDs store. UPS writes
-// `runtime/.claude-mem-injected-<project>` with {ids, ts, count}. We read
-// inside the staleness window, filter overlaps from PreToolUse output, then
-// merge back so the next UPS sees what we emitted too.
-function crossHookInjectedFile(project) {
-  return join(RUNTIME_DIR, `.claude-mem-injected-${project}`);
+// `runtime/.claude-mem-injected-<project>-<session>` with {ids, ts, count}. We
+// read inside the staleness window, filter overlaps from PreToolUse output,
+// then merge back so the next UPS sees what we emitted too.
+// D#120: the file is keyed per SESSION (payload-only keying let two concurrent
+// windows clobber each other's marker). Derivation shared via lib/injected-ids.mjs
+// (pure, no deps — within the standalone fast-path budget, #8447).
+function crossHookInjectedFile(project, sessionId) {
+  return join(RUNTIME_DIR, injectedIdsFileName(project, sessionId));
 }
 
-function readCrossHookInjected(project) {
+// M-6 (audit 2026-08-14): the marker file is keyed by PROJECT, so two concurrent
+// CC sessions in the same project shared one suppression state — session A's
+// injections silently deduped session B's, and B inherited A's count cap. Both
+// read and merge now carry the CC session id: a payload written by a DIFFERENT
+// session is ignored (read) / replaced (merge), mirroring the v3.35.2 episode
+// session-key fix. Legacy payloads without `session` keep the old behavior.
+function readCrossHookInjected(project, sessionId) {
   try {
-    const raw = readFileSync(crossHookInjectedFile(project), 'utf8');
-    const { ids, ts } = JSON.parse(raw);
+    const raw = readFileSync(crossHookInjectedFile(project, sessionId), 'utf8');
+    const { ids, ts, session } = JSON.parse(raw);
+    if (session && sessionId && session !== sessionId) return new Set();
     if (!ts || Date.now() - ts > CROSS_HOOK_DEDUP_MS) return new Set();
     if (!Array.isArray(ids)) return new Set();
     return new Set(ids.map(String));
   } catch { return new Set(); }
 }
 
-function mergeCrossHookInjected(project, newIds) {
+function mergeCrossHookInjected(project, newIds, sessionId) {
   if (!newIds || newIds.length === 0) return;
   try {
     mkdirSync(RUNTIME_DIR, { recursive: true });
-    const file = crossHookInjectedFile(project);
+    const file = crossHookInjectedFile(project, sessionId);
     let prev = { ids: [], ts: 0, count: 0 };
     try {
       const raw = readFileSync(file, 'utf8');
       const parsed = JSON.parse(raw);
-      // Within the staleness window: union. Outside: replace (fresh session).
-      if (parsed.ts && Date.now() - parsed.ts < CROSS_HOOK_DEDUP_MS) {
+      // Within the staleness window AND same session (or legacy): union.
+      // Outside / other session: replace.
+      if (parsed.ts && Date.now() - parsed.ts < CROSS_HOOK_DEDUP_MS
+          && !(parsed.session && sessionId && parsed.session !== sessionId)) {
         prev = parsed;
       }
     } catch { /* fresh file */ }
@@ -187,10 +202,13 @@ function mergeCrossHookInjected(project, newIds) {
       ...(Array.isArray(prev.ids) ? prev.ids.map(String) : []),
       ...newIds.map(String),
     ])];
-    writeFileSync(file, JSON.stringify({
+    // Atomic (tmp+rename, M-6): a plain write torn by a concurrent hook left the
+    // shared marker as invalid JSON, silently disabling cross-hook dedup.
+    atomicWriteFileSync(file, JSON.stringify({
       ids,
       ts: Date.now(),
       count: (prev.count || 0) + 1,
+      ...(sessionId ? { session: sessionId } : {}),
     }));
   } catch { /* silent — dedup is best-effort */ }
 }
@@ -209,7 +227,10 @@ function writeCooldown(cooldownPath, data, isSessionScoped) {
         if (ts && now - ts < STALE_MS) cleaned[k] = v;
       }
     }
-    writeFileSync(cooldownPath, JSON.stringify(cleaned));
+    // Atomic (tmp+rename, M-6): the cooldown carries lessonIdents that the
+    // PostToolUse bind-salience check reads back — a torn write turned that
+    // check into a zero-trace no-op.
+    atomicWriteFileSync(cooldownPath, JSON.stringify(cleaned));
   } catch { /* silent */ }
 }
 
@@ -412,8 +433,7 @@ try {
       JOIN observation_files of2 ON of2.obs_id = o.id
       WHERE o.project = ?
         AND o.importance >= 2
-        AND COALESCE(o.compressed_into, 0) = 0
-        AND o.superseded_at IS NULL
+        AND ${liveObsFilterSql('o')}
         AND o.created_at_epoch > ?
         AND ${fileMatch}
         ${edgeDecayFilter}
@@ -474,7 +494,7 @@ try {
     // P1 (D#78): tag each row's source table — events share the numeric id
     // space with observations, and the Stop-side edge attribution must never
     // feed an event id into observation_files updates.
-    const crossHookSeen = readCrossHookInjected(project);
+    const crossHookSeen = readCrossHookInjected(project, sessionId);
     const sourcedRows = [
       ...rows.map(r => ({ ...r, src: 'obs' })),
       ...eventRows.map(r => ({ ...r, src: 'evt' })),
@@ -638,7 +658,7 @@ try {
     // file so the next UPS prompt skips them too. Always write, even on
     // empty allRows, so the file's ts stays fresh for the no-op case where
     // we'd otherwise drift outside the dedup window.
-    mergeCrossHookInjected(project, allRows.map(r => r.id));
+    mergeCrossHookInjected(project, allRows.map(r => r.id), sessionId);
   } catch (e) {
     // Silent failure — never block editing, but record for self-observation.
     recordHookError('pre-recall:query', e, RUNTIME_DIR, { filePath });

package/scripts/prompt-search-utils.mjs

@@ -149,18 +149,25 @@ export function extractErrorSignature(text) {
 
 export const MAX_SESSION_INJECTIONS = 15;
 export const DEDUP_STALE_MS = 300_000; // 5 minutes
+// Marker file-name derivation lives in lib/injected-ids.mjs (D#120) — lib/, not
+// here, so hook.mjs can import it (scripts/ static imports from hook.mjs break
+// under the installExtractedRelease scripts-dir rename).
 
 /**
  * Check if injection should be skipped based on deduplication state.
  * @param {number[]} newIds - candidate observation IDs
  * @param {string} injectedFile - path to the dedup state file
+ * @param {string} [sessionId] - CC session id; a payload written by a DIFFERENT
+ *   session never suppresses (M-6, audit 2026-08-14: the file is keyed by project,
+ *   so session A's injections + count cap silently carried into session B)
  * @returns {boolean} true if injection should be skipped
  */
-export function shouldSkipByDedup(newIds, injectedFile) {
+export function shouldSkipByDedup(newIds, injectedFile, sessionId) {
   if (!newIds || newIds.length === 0) return true;
   try {
     const raw = readFileSync(injectedFile, 'utf8');
-    const { ids: prevIds, ts, count = 0 } = JSON.parse(raw);
+    const { ids: prevIds, ts, count = 0, session } = JSON.parse(raw);
+    if (session && sessionId && session !== sessionId) return false;
     if (count >= MAX_SESSION_INJECTIONS) return true;
     if (!ts || Date.now() - ts > DEDUP_STALE_MS) return false;
     if (!Array.isArray(prevIds) || prevIds.length === 0) return false;

package/scripts/user-prompt-search.js

@@ -4,20 +4,31 @@
 // Lightweight: only imports schema.mjs and utils.mjs, no MCP SDK
 
 import { ensureDb, DB_DIR, REGISTRY_DB_PATH } from '../schema.mjs';
-import { sanitizeFtsQuery, relaxFtsQueryToOr, truncate, typeIcon, inferProject, OBS_BM25, TYPE_DECAY_CASE, TYPE_QUALITY_CASE, notLowSignalTitleClause, noisePenaltyClause, stripPrivate, neutralizeContextDelimiters, MAX_UPS_PROMPT_BYTES } from '../utils.mjs';
-import { citeFactorClause } from '../scoring-sql.mjs';
+import { sanitizeFtsQuery, relaxFtsQueryToOr, truncate, typeIcon, inferProject, OBS_BM25, notLowSignalTitleClause, stripPrivate, neutralizeContextDelimiters, MAX_UPS_PROMPT_BYTES } from '../utils.mjs';
+import { liveObsFilterSql, injectionRelevanceSql } from '../lib/inject-search-core.mjs';
 import { cjkPrecisionOk } from '../nlp.mjs';
 import { writeFileSync, readFileSync, existsSync, renameSync } from 'fs';
 import { join, sep } from 'path';
 import { pathToFileURL } from 'url';
 import Database from 'better-sqlite3';
 import { shouldSkip, computeEffectiveLen, detectIntent, shouldSkipByDedup, extractFiles, extractErrorSignature, extractDeferredRefs, DEDUP_STALE_MS, matchRegistrySkillName, detectMemOverride } from './prompt-search-utils.mjs';
+import { injectedIdsFileName } from '../lib/injected-ids.mjs';
 import { getDeferredByIds } from '../lib/deferred-work.mjs';
 import { recommendSkill } from '../registry-recommend.mjs';
+import { recordHookError } from '../lib/hook-telemetry.mjs';
+import { atomicWriteFileSync } from '../lib/atomic-write.mjs';
 
 // ─── Constants ──────────────────────────────────────────────────────────────
 
-const INJECTED_IDS_FILE = join(DB_DIR, 'runtime', `.claude-mem-injected-${inferProject()}`);
+// Telemetry sink (lib/hook-telemetry.mjs contract): env override for tests, else
+// <data-dir>/runtime — the same dir the sibling hook scripts + `stats` read.
+const RUNTIME_DIR = process.env.CLAUDE_MEM_RUNTIME_DIR || join(DB_DIR, 'runtime');
+// D#120: one marker file per CC session — payload-only session keying (M-6) let
+// two concurrent windows full-replace each other's marker, killing dedup between
+// them and resetting `count` on every alternation. Derived per invocation once
+// the session id is parsed from stdin; no session id → legacy project-keyed file.
+const injectedIdsFileFor = (sessionId) =>
+  join(DB_DIR, 'runtime', injectedIdsFileName(inferProject(), sessionId));
 // Per-prompt UPS cap. Cut from 5 → 3 after the 2026-05-09 per-hook recall
 // scan (#8255): UPS contributed 74% of silent injected IDs (131/177) at 26%
 // recall, vs PreToolUse:Read at 94% recall on a tighter file-keyed set.
@@ -61,7 +72,7 @@ const PROMPT_MIN_LENGTH = 15;
 // v2.33.1: follow-up prompts ("前面那个", "继续 X", "再看看 Y") are short by
 // nature but semantically depend on prior turns. Once a session has injected
 // memory at least once, relax gates so short follow-ups still get recall.
-// Detection: INJECTED_IDS_FILE count > 0 within DEDUP_STALE_MS window.
+// Detection: injected-ids marker count > 0 within DEDUP_STALE_MS window.
 const FOLLOWUP_PROMPT_MIN_LENGTH = 8;
 const FOLLOWUP_BM25_MIN_SCORE = Number(process.env.CLAUDE_MEM_UPS_BM25_MIN_FOLLOWUP || 5e-6);
 
@@ -168,9 +179,9 @@ export function corpusFloorScale(db) {
   }
 }
 
-function isFollowUpSession() {
+function isFollowUpSession(injectedIdsFile) {
   try {
-    const raw = readFileSync(INJECTED_IDS_FILE, 'utf8');
+    const raw = readFileSync(injectedIdsFile, 'utf8');
     const { ts, count = 0 } = JSON.parse(raw);
     if (!ts || Date.now() - ts > DEDUP_STALE_MS) return false;
     return count > 0;
@@ -343,12 +354,7 @@ export function searchByFts(db, queryText, project, limit, typeFilter,
   const sql = `
     SELECT o.id, o.type, o.title, o.lesson_learned,
            ${OBS_BM25} as bm25_raw,
-           ${OBS_BM25}
-             * (1.0 + EXP(-0.693 * (? - o.created_at_epoch) / ${TYPE_DECAY_CASE}))
-             * ${TYPE_QUALITY_CASE}
-             * (0.5 + 0.5 * COALESCE(o.importance, 1))
-             * ${noisePenaltyClause('o')}
-             * ${citeFactorClause('o')} as relevance
+           ${injectionRelevanceSql('o')} as relevance
     FROM observations_fts
     JOIN observations o ON o.id = observations_fts.rowid
     WHERE observations_fts MATCH ?
@@ -356,8 +362,7 @@ export function searchByFts(db, queryText, project, limit, typeFilter,
       AND o.importance >= 1
       AND o.created_at_epoch > ?
       AND (? IS NULL OR o.created_at_epoch <= ?)
-      AND COALESCE(o.compressed_into, 0) = 0
-      AND o.superseded_at IS NULL
+      AND ${liveObsFilterSql('o')}
       AND ${notLowSignalTitleClause('o')}
       ${typeClause}
     ORDER BY relevance
@@ -403,8 +408,7 @@ function searchByFile(db, files, project, limit) {
       JOIN observation_files of2 ON of2.obs_id = o.id
       WHERE o.project = ?
         AND o.importance >= 1
-        AND COALESCE(o.compressed_into, 0) = 0
-        AND o.superseded_at IS NULL
+        AND ${liveObsFilterSql('o')}
         AND o.created_at_epoch > ?
         AND (of2.filename = ? OR of2.filename LIKE ? ESCAPE '\\')
         AND ${notLowSignalTitleClause('o')}
@@ -479,8 +483,7 @@ function searchRecent(db, project, limit) {
     FROM observations
     WHERE project = ?
       AND importance >= 1
-      AND COALESCE(compressed_into, 0) = 0
-      AND superseded_at IS NULL
+      AND ${liveObsFilterSql('')}
       AND created_at_epoch > ?
       AND ${notLowSignalTitleClause('')}
     ORDER BY created_at_epoch DESC
@@ -631,6 +634,9 @@ async function main() {
   // would never legitimately be wrapped in <private>).
   if (rawPrompt.startsWith('<task-notification>')) return;
 
+  // D#120: session-keyed dedup marker — every read/write below uses this path.
+  const injectedIdsFile = injectedIdsFileFor(hookData.session_id);
+
   // Strip <private>...</private> blocks before length gates and FTS query
   // construction — private content must not pad effective length nor leak
   // into the FTS MATCH query terms. Mirrors hook.mjs handleUserPrompt.
@@ -660,7 +666,7 @@ async function main() {
       // Namespace dedup ids as "D<id>" (parity with the "P<id>" prompt-corpus
       // convention) so obs ids can't collide in the shared injected-ids file.
       const dedupIds = openRows.map(r => `D${r.id}`);
-      if (openRows.length > 0 && !shouldSkipByDedup(dedupIds, INJECTED_IDS_FILE)) {
+      if (openRows.length > 0 && !shouldSkipByDedup(dedupIds, injectedIdsFile, hookData.session_id)) {
         const lines = ['[mem] Deferred work referenced in prompt (open items, full detail):'];
         for (const r of openRows) {
           const pTag = r.priority === 3 ? '🔴' : r.priority === 1 ? '⚪' : '🟡';
@@ -679,16 +685,21 @@ async function main() {
           let prevIds = [];
           let prevCount = 0;
           try {
-            const prev = JSON.parse(readFileSync(INJECTED_IDS_FILE, 'utf8'));
-            if (prev.ts && Date.now() - prev.ts < DEDUP_STALE_MS) {
+            const prev = JSON.parse(readFileSync(injectedIdsFile, 'utf8'));
+            // M-6: inherit only same-session (or legacy) state — another session's
+            // ids/count must not carry over. Atomic write below: a torn concurrent
+            // write left the shared marker as invalid JSON (dedup silently off).
+            if (prev.ts && Date.now() - prev.ts < DEDUP_STALE_MS
+                && !(prev.session && hookData.session_id && prev.session !== hookData.session_id)) {
               prevIds = Array.isArray(prev.ids) ? prev.ids : [];
               prevCount = prev.count || 0;
             }
           } catch {}
-          writeFileSync(INJECTED_IDS_FILE, JSON.stringify({
+          atomicWriteFileSync(injectedIdsFile, JSON.stringify({
             ids: [...new Set([...prevIds.map(String), ...dedupIds])],
             ts: Date.now(),
             count: prevCount + 1,
+            ...(hookData.session_id ? { session: hookData.session_id } : {}),
           }));
         } catch {}
       }
@@ -703,7 +714,7 @@ async function main() {
   // "fix bug now") that carry too few content tokens for a meaningful FTS lookup.
   // v2.33.1: follow-up prompts in an already-active session get a lower gate —
   // short continuations ("前面那个?", "does it work?") depend on prior context.
-  const followUp = isFollowUpSession();
+  const followUp = isFollowUpSession(injectedIdsFile);
   const promptMinLen = followUp ? FOLLOWUP_PROMPT_MIN_LENGTH : PROMPT_MIN_LENGTH;
   if (computeEffectiveLen(promptText.trim()) < promptMinLen) { try { db?.close(); } catch {} return; }
   const bm25Floor = followUp ? FOLLOWUP_BM25_MIN_SCORE : BM25_MIN_SCORE;
@@ -712,7 +723,13 @@ async function main() {
   if (!db) {
     try {
       db = ensureDb();
-    } catch { return; }
+    } catch (e) {
+      // A failed DB open silently kills EVERY prompt-time injection while `stats`
+      // reads zero errors (audit 2026-08-14 M-5) — record before the mandatory
+      // swallow. Exact blindness class of the 2026-08-13 pre-recall:db-open outage.
+      recordHookError('ups:db-open', e, RUNTIME_DIR);
+      return;
+    }
   }
 
   try {
@@ -854,7 +871,7 @@ async function main() {
     const candidateIds = rows.length > 0
       ? rows.map(r => r.id)
       : promptRows.map(r => `P${r.id}`);
-    const dedupSkip = shouldSkipByDedup(candidateIds, INJECTED_IDS_FILE);
+    const dedupSkip = shouldSkipByDedup(candidateIds, injectedIdsFile, hookData.session_id);
 
     const output = !dedupSkip
       ? (rows.length > 0 ? formatResults(rows) : formatPromptResults(promptRows))
@@ -865,13 +882,18 @@ async function main() {
       try {
         let prevCount = 0;
         try {
-          const prev = JSON.parse(readFileSync(INJECTED_IDS_FILE, 'utf8'));
-          if (prev.ts && Date.now() - prev.ts < DEDUP_STALE_MS) prevCount = prev.count || 0;
+          const prev = JSON.parse(readFileSync(injectedIdsFile, 'utf8'));
+          // M-6: same-session (or legacy) count only; atomic write (torn-write guard).
+          if (prev.ts && Date.now() - prev.ts < DEDUP_STALE_MS
+              && !(prev.session && hookData.session_id && prev.session !== hookData.session_id)) {
+            prevCount = prev.count || 0;
+          }
         } catch {}
-        writeFileSync(INJECTED_IDS_FILE, JSON.stringify({
+        atomicWriteFileSync(injectedIdsFile, JSON.stringify({
           ids: candidateIds,
           ts: Date.now(),
           count: prevCount + 1,
+          ...(hookData.session_id ? { session: hookData.session_id } : {}),
         }));
       } catch {}
       // v26 P0: bump injection_count for obs-based emits only (prompt-corpus
@@ -932,8 +954,11 @@ async function main() {
         finally { rdb.close(); }
       }
     } catch { /* silent — never block on recommendation failure */ }
-  } catch {
-    // Hooks must never break Claude Code — swallow all errors
+  } catch (e) {
+    // Hooks must never break Claude Code — swallow, but RECORD: this catch wraps
+    // every FTS query on the surface, so a schema/FTS drift here would zero out
+    // prompt-time injection with no trace anywhere (audit 2026-08-14 M-5).
+    recordHookError('ups:search', e, RUNTIME_DIR);
   } finally {
     try { db.close(); } catch {}
   }
@@ -962,5 +987,8 @@ export function isDirectInvocation(metaUrl, argv1) {
   return metaUrl.split('?')[0] === pathToFileURL(argv1).href;
 }
 if (isDirectInvocation(import.meta.url, process.argv[1])) {
-  main().catch(() => {});
+  // Last-resort telemetry for anything that escapes main()'s own catches (e.g. a
+  // throw between the entry and the guarded body). Recorder never throws; the
+  // outer catch keeps the never-non-zero-exit invariant regardless.
+  main().catch((e) => { try { recordHookError('ups:main', e, RUNTIME_DIR); } catch { /* never */ } });
 }