claude-mem-lite 3.66.2 → 3.68.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "3.66.2",
+      "version": "3.68.0",
       "source": "./",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."
     }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.66.2",
+  "version": "3.68.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/haiku-client.mjs

@@ -286,6 +286,29 @@ export async function callHaikuJSON(prompt, opts) {
   return parseJsonFromLLM(result.text);
 }
 
+/**
+ * Non-blocking sibling of callHaikuJSON for callers reachable from an MCP request
+ * handler (registry enrichment: mem_registry `enrich` / `import_url`). Same
+ * provider priority; the CLI leg — primary AND post-provider-failure fallback —
+ * is the async spawn, so a keyed-provider outage cannot freeze the server event
+ * loop for BG_LLM_TIMEOUT_MS (D#138 MEDIUM-3).
+ *
+ * `resolveModel().cli`, NOT the literal 'haiku': despite the name, callHaikuJSON
+ * reaches the model through resolveModel() on ALL three legs (callHaikuAPI,
+ * callOpenRouterAPI, callHaikuCLI), so it honours the documented CLAUDE_MEM_MODEL
+ * knob. Pinning 'haiku' here would silently downgrade registry enrichment for
+ * every user who set CLAUDE_MEM_MODEL=sonnet — pre-tag review finding, v3.68.0.
+ *
+ * Defaults also mirror callHaiku (10s / 500 tokens), not callModelJSONAsync's
+ * 15s / 1000: a caller that omits opts must get the sync twin's budget.
+ * @param {string|{system?:string,user:string}} prompt
+ * @param {{timeout?:number,maxTokens?:number,temperature?:number}} [opts]
+ * @returns {Promise<object|null>} Parsed JSON or null
+ */
+export async function callHaikuJSONAsync(prompt, { timeout = 10000, maxTokens = 500, temperature = DEFAULT_LLM_TEMPERATURE } = {}) {
+  return callModelJSONAsync(prompt, resolveModel().cli, { timeout, maxTokens, temperature });
+}
+
 // ─── Model-Selectable API ────────────────────────────────────────────────────
 
 /**
@@ -328,6 +351,44 @@ export async function callLLMWithModel(prompt, model = 'haiku', { timeout = 1500
   catch (e) { debugCatch(e, `callLLMWithModel:cli-fallback:${resolvedModel}`); return null; }
 }
 
+/**
+ * Non-blocking sibling of callLLMWithModel — returns the RAW {text} envelope
+ * without JSON-parsing it. For MCP-reachable callers whose answer is not
+ * guaranteed to be an object: rerank accepts a bare `[2,1,3]` array, which a
+ * JSON-parsing dispatcher would keep but whose contract (rerank.mjs:72) is the
+ * envelope, not the parse. Both CLI legs use the async spawn, so a keyed-provider
+ * outage cannot freeze the server event loop (D#138 MEDIUM-3).
+ *
+ * Behaviourally identical to callLLMWithModel otherwise — same `if (primary)`
+ * test, same headless-flag compat retry and budget arithmetic, same timeout
+ * salvage. Only the CLI transport differs.
+ * @param {string|{system?:string,user:string}} prompt
+ * @param {'haiku'|'sonnet'} model
+ * @param {{timeout?:number,maxTokens?:number,temperature?:number}} [opts]
+ * @returns {Promise<{text: string}|null>} Response or null on failure
+ */
+export async function callLLMWithModelAsync(prompt, model = 'haiku', { timeout = 15000, maxTokens = 1000, temperature = DEFAULT_LLM_TEMPERATURE } = {}) {
+  if (!prompt) return null;
+  const resolvedModel = MODEL_MAP[model] ? model : 'haiku';
+  const mode = detectMode();
+
+  // CLI is terminal — no provider to fall back to.
+  if (mode === 'cli') return callModelCLIAsync(prompt, resolvedModel, { timeout });
+
+  let primary = null;
+  try {
+    primary = mode === 'api'
+      ? await callModelAPI(prompt, resolvedModel, { timeout, maxTokens, temperature })
+      : await callOpenRouterAPI(prompt, resolvedModel, { timeout, maxTokens, temperature });
+  } catch (e) {
+    debugCatch(e, `callLLMWithModelAsync:${mode}:${resolvedModel}`);
+  }
+  if (primary) return primary;
+
+  debugLog('WARN', 'haiku-client', `${mode} call failed, falling back to async claude CLI (${resolvedModel})`);
+  return callModelCLIAsync(prompt, resolvedModel, { timeout });
+}
+
 /**
  * Call LLM with model selection and parse JSON response.
  * @param {string} prompt
@@ -628,6 +689,20 @@ export async function callModelCLIAsync(prompt, model, { timeout }) {
     child.on('error', (e) => { debugCatch(e, `${model}-cli-async`); done({ result: null, stderr: '', stdout: '', code: null }); });
     child.on('close', (code) => {
       const t = stdout.trim();
+      // Parity with callModelCLI: execFileSync THROWS on a non-zero exit, so the
+      // sync leg only ever returns such output when parseJsonFromLLM accepts it
+      // (its catch-salvage). Without the same gate, a CLI that prints a
+      // diagnostic to stdout and dies — auth failure, overload banner, wrapper
+      // error — has that diagnostic returned as the model's ANSWER. rerank is the
+      // first caller to consume the raw {text}: extractRanked's last resort
+      // matches any bracketed number list in prose, so a `[1]` inside a stack
+      // frame becomes a ranking and silently reorders search results. The
+      // flag-compat probe below reads stderr/stdout/code directly, not `result`,
+      // so nulling here does not cost it its retry.
+      if (t && typeof code === 'number' && code !== 0 && parseJsonFromLLM(t) === null) {
+        done({ result: null, stderr, stdout, code });
+        return;
+      }
       done({ result: t ? { text: t } : null, stderr, stdout, code });
     });
     // EPIPE guard: the child may exit before we finish writing stdin.

package/hook-optimize.mjs

@@ -13,7 +13,7 @@ import {
   computeMinHash, estimateJaccardFromMinHash, jaccardSimilarity, clampImportance, cjkBigrams,
   notLowSignalTitleClause, scrubSecrets,
 } from './utils.mjs';
-import { callModelJSON, BG_LLM_TIMEOUT_MS } from './haiku-client.mjs';
+import { callModelJSONAsync, BG_LLM_TIMEOUT_MS } from './haiku-client.mjs';
 import { acquireLLMSlot, releaseLLMSlot } from './hook-semaphore.mjs';
 import { scrubRecord } from './lib/scrub-record.mjs';
 import { getVocabulary, computeVector, cosineSimilarity, vecTextForRow } from './tfidf.mjs';
@@ -175,7 +175,7 @@ Narrative: ${truncate(cand.narrative || '(no narrative)', 500)}
 
 JSON: {"search_aliases":["alt phrasing","synonym","spelled-out jargon","CJK term if the domain word has one"]}
 Give 3-6 aliases: words a user might search for the SAME concept but that are NOT already in the title (synonyms, the spelled-out form of an acronym, the jargon term for a described symptom, a CJK translation of a key domain term).`;
-        const parsed = await callModelJSON(aliasPrompt, 'haiku', { timeout: BG_LLM_TIMEOUT_MS, maxTokens: 300 });
+        const parsed = await callModelJSONAsync(aliasPrompt, 'haiku', { timeout: BG_LLM_TIMEOUT_MS, maxTokens: 300 });
         const aliasArr = parsed && Array.isArray(parsed.search_aliases)
           ? parsed.search_aliases.filter((a) => typeof a === 'string' && a.trim().length > 0)
           : [];
@@ -204,7 +204,7 @@ importance: 0=no value, 1=routine, 2=notable non-obvious insight, 3=critical. De
 lesson_learned: State what was learned. If routine, write "none".
 search_aliases: 2-6 alternative search terms (include CJK if applicable).`;
 
-      const parsed = await callModelJSON(prompt, 'haiku', { timeout: BG_LLM_TIMEOUT_MS, maxTokens: 500 });
+      const parsed = await callModelJSONAsync(prompt, 'haiku', { timeout: BG_LLM_TIMEOUT_MS, maxTokens: 500 });
       if (!parsed || !parsed.title) { skipped++; continue; }
 
       // Auto-hide on importance:0 targets fully-degraded NARROW rows (this branch predates
@@ -356,7 +356,7 @@ Rules:
 - Include CJK ↔ English equivalents if present
 - Skip terms that have no synonyms in the list`;
 
-    const parsed = await callModelJSON(prompt, 'sonnet', { timeout: BG_LLM_TIMEOUT_MS, maxTokens: 1000 });
+    const parsed = await callModelJSONAsync(prompt, 'sonnet', { timeout: BG_LLM_TIMEOUT_MS, maxTokens: 1000 });
     if (!parsed?.groups || !Array.isArray(parsed.groups)) return [];
     return parsed.groups.filter(g => g.canonical && Array.isArray(g.aliases) && g.aliases.length > 0);
   } catch (e) {
@@ -524,7 +524,7 @@ Return ONLY valid JSON:
 - If they should NOT be merged: {"should_merge":false}
 - If they SHOULD be merged: {"should_merge":true,"merged_title":"≤120 char comprehensive title","merged_narrative":"comprehensive ≤800 char summary preserving all key details","merged_concepts":["kw1","kw2"],"merged_facts":["specific fact 1"],"merged_lesson":"synthesized non-obvious lesson or null","importance":2}`;
 
-    const parsed = await callModelJSON(prompt, 'sonnet', { timeout: BG_LLM_TIMEOUT_MS, maxTokens: 1000 });
+    const parsed = await callModelJSONAsync(prompt, 'sonnet', { timeout: BG_LLM_TIMEOUT_MS, maxTokens: 1000 });
     if (!parsed || !parsed.should_merge) return { merged: false };
 
     // Keeper = highest importance, then highest access_count. Previously access_count
@@ -758,7 +758,7 @@ ${obsDescriptions}
 
 JSON: {"title":"descriptive summary ≤120 chars","narrative":"comprehensive summary ≤800 chars preserving key decisions and lessons","concepts":["kw1","kw2"],"facts":["all specific facts preserved"],"lesson_learned":"most important synthesized lesson or 'none'","search_aliases":["alt search 1","alt search 2"]}`;
 
-    const parsed = await callModelJSON(prompt, 'sonnet', { timeout: BG_LLM_TIMEOUT_MS, maxTokens: 1000 });
+    const parsed = await callModelJSONAsync(prompt, 'sonnet', { timeout: BG_LLM_TIMEOUT_MS, maxTokens: 1000 });
     if (!parsed || !parsed.title) return { compressed: false };
 
     // Scrub BEFORE truncate (see re-enrich note): boundary cut on scrubbed text.

package/hook-semaphore.mjs

@@ -4,15 +4,62 @@
 import { join } from 'path';
 import { readFileSync, unlinkSync, readdirSync, openSync, closeSync, writeSync, constants as fsConstants } from 'fs';
 import { RUNTIME_DIR } from './hook-shared.mjs';
+import { BG_LLM_TIMEOUT_MS } from './haiku-client.mjs';
 
 export const LLM_SEM_MAX = 2;
-export const LLM_SEM_TIMEOUT = 30000; // 30s max wait
+
+// D#134 MEDIUM-2 — both budgets are DERIVED from the longest a slot can
+// legitimately be held, not hand-set. They used to be the literals 30000 and
+// 60000, sized for the ~15-20s LLM calls of the time; v3.66.0 raised the
+// background call budget to 45s and neither literal followed, leaving two
+// silent failures:
+//
+//   • wait budget < hold: with both slots busy the third worker gave up after
+//     30s while a holder was still legitimately working, and its caller fell
+//     through to degraded storage — the observation is SAVED but never
+//     enriched. Nothing errors; the row just quietly lacks aliases/lesson.
+//   • stale threshold barely above hold: a 45s holder had 15s of margin, so a
+//     slow SIGTERM, GC pause, or loaded machine let a PEER delete the live
+//     holder's file. That drops it out of `active`, and the peer then sees
+//     room that does not exist — more than LLM_SEM_MAX concurrent calls.
+//
+// Wait one full hold plus a wait-cycle of slack: the worst honest case is
+// arriving just as a 45s call started.
+export const LLM_SEM_TIMEOUT = BG_LLM_TIMEOUT_MS + 15000; // 60s max wait
+// Reaping is the PID-REUSE backstop, not the liveness test (that is
+// process.kill(pid, 0) below). At 2x the hold plus slack it cannot fire on a
+// working holder, which is why the ts written at acquire never needs
+// refreshing — a heartbeat would buy nothing this margin doesn't.
+export const LLM_SEM_STALE_MS = BG_LLM_TIMEOUT_MS * 2 + 30000; // 120s
 
 export const sleepMs = (ms) => new Promise(r => setTimeout(r, ms));
 
+// Does THIS process currently hold the (single, pid-named) slot?
+//
+// The slot file is one per process, and until the MCP LLM legs went async in
+// v3.68.0 two acquires could not overlap inside one: execFileSync held the event
+// loop, so a second tools/call was not even read from stdio while the first was
+// in its LLM call. The EEXIST branch below encodes that era's assumption — "we
+// are inside acquire and therefore do NOT hold a slot, so it is always stale" —
+// and unlinks unconditionally. With two concurrent mem_optimize handlers that
+// unlink would delete a LIVE sibling's slot: the cross-process count stops
+// seeing it (so more than LLM_SEM_MAX `claude -p` children run at once), and the
+// first holder's release then unlinks the second holder's file. This bookkeeping
+// makes the EEXIST branch's claim true again by keeping same-process acquires out
+// of it — they wait for the holder instead.
+//
+// A TIMESTAMP, not a boolean, and the difference is load-bearing: a boolean has no
+// self-heal, so one caller that acquired and never released would deadlock every
+// later LLM call in a long-lived MCP server for the life of the process — strictly
+// worse than the race it fixes. Past LLM_SEM_STALE_MS the local record is treated
+// as broken bookkeeping and we fall through to the file-side logic, which is the
+// same age escape hatch the reaper applies to other processes' slots. 0 = not held.
+let localHeldAt = 0;
+
 /**
  * Acquire a file-based semaphore slot for LLM calls.
  * Uses acquire-then-verify: atomically creates a slot file, then checks total count.
+ * At most one slot per process; a concurrent same-process caller queues behind it.
  * @returns {Promise<boolean>} true if slot acquired, false on timeout
  */
 export async function acquireLLMSlot() {
@@ -20,6 +67,12 @@ export async function acquireLLMSlot() {
   const slotFile = join(RUNTIME_DIR, `llm-sem-${process.pid}`);
 
   while (Date.now() < deadline) {
+    // A sibling call in this process holds the slot — queue, do not race. The
+    // file cannot be re-created without destroying the holder's.
+    if (localHeldAt && Date.now() - localHeldAt < LLM_SEM_STALE_MS) {
+      await sleepMs(200 + Math.random() * 800);
+      continue;
+    }
     // Acquire-then-verify: atomically create our slot first, then check total count
     let created;
     try {
@@ -35,8 +88,9 @@ export async function acquireLLMSlot() {
     } catch {
       // Our own pid-named slot file already exists: a leftover from a prior acquire
       // that never released (crash between acquire and releaseLLMSlot, or PID reuse).
-      // We are inside acquire and therefore do NOT currently hold a slot, so it is
-      // always stale — remove it and retry. The await is essential: a bare `continue`
+      // `localHeldAt` was checked above, so this process either holds nothing right
+      // now or its record is past the stale threshold — either way the file is not
+      // a live sibling's. Remove it and retry. The await is essential: a bare `continue`
       // here re-hits the same EEXIST every iteration, a synchronous tight loop that
       // pins a core until the 30s deadline (the age-based cleanup below is unreachable
       // on this path — it only runs after a successful create).
@@ -57,18 +111,24 @@ export async function acquireLLMSlot() {
           const raw = readFileSync(fp, 'utf8');
           const info = JSON.parse(raw);
           const age = Date.now() - (info.ts || 0);
-          if (age > 60000) {
-            try { unlinkSync(fp); } catch {}
-            continue;
-          }
+          // Liveness FIRST, age second. The pre-D#134 order reaped on age alone,
+          // which evicted holders that were alive and mid-call (see the budget
+          // note at the top of this file). A dead holder is reaped at any age;
+          // a live one only once its age is implausible as a real hold, which is
+          // the pid-reuse case the age check exists for.
           if (info.pid) {
-            try { process.kill(info.pid, 0); active++; } catch (killErr) {
-              if (killErr.code === 'ESRCH') { try { unlinkSync(fp); } catch {} }
-              else { active++; } // EPERM = process exists but different user
+            let alive;
+            try { process.kill(info.pid, 0); alive = true; } catch (killErr) {
+              // EPERM = process exists but belongs to another user → alive.
+              alive = killErr.code !== 'ESRCH';
             }
-          } else {
-            active++;
+            if (!alive) { try { unlinkSync(fp); } catch {} continue; }
+          }
+          if (age > LLM_SEM_STALE_MS) {
+            try { unlinkSync(fp); } catch {}
+            continue;
           }
+          active++;
         } catch {
           // Corrupt/unreadable semaphore file — treat as stale and remove
           try { unlinkSync(fp); } catch {}
@@ -76,7 +136,7 @@ export async function acquireLLMSlot() {
       }
     } catch {}
 
-    if (active <= LLM_SEM_MAX) return true; // Slot acquired
+    if (active <= LLM_SEM_MAX) { localHeldAt = Date.now(); return true; } // Slot acquired
 
     // Too many concurrent — release our slot and back off
     try { unlinkSync(slotFile); } catch {}
@@ -89,5 +149,6 @@ export async function acquireLLMSlot() {
  * Release the file-based semaphore slot for the current process.
  */
 export function releaseLLMSlot() {
+  localHeldAt = 0;
   try { unlinkSync(join(RUNTIME_DIR, `llm-sem-${process.pid}`)); } catch {}
 }

package/hook.mjs

@@ -53,12 +53,14 @@ import { cleanupBroken, decayAndMarkIdle, boostAccessed, selectFuzzyDedupeIds, h
 import { snapshotDb } from './lib/db-backup.mjs';
 import {
   extractCitationsFromTranscript,
-  extractAllInjected,
+  extractInjectedBySurface,
+  unionSurfaces,
   extractInjectedFromKeyContext,
   bumpCitationAccess,
   computeCiteRecall,
   applyCitationDecay,
   recordCitationFunnel,
+  recordCitationSurfaces,
   hasMainThreadAssistantText,
 } from './lib/citation-tracker.mjs';
 import { resolveEdgeAttribution, readPreRecallFileEdges } from './lib/edge-attribution.mjs';
@@ -741,7 +743,14 @@ async function handleStop() {
             // filter as citedMain (the numerator, below) — an obs injected only
             // inside a subagent (sidechain) would otherwise enter the denominator
             // but never the numerator and streak-demote despite being used there.
-            const injected = extractAllInjected(transcriptPath, { mainOnly: true });
+            // v45: take the per-FACE breakdown and union it, instead of asking
+            // for the union directly. Same ids (extractAllInjected IS this union
+            // — see unionSurfaces), same single transcript walk, but the split
+            // survives to citation_surface_log below so "which face earns its
+            // budget" becomes answerable. Before this, every face was merged
+            // before anything was recorded and no lever had a target.
+            const injectedBySurface = extractInjectedBySurface(transcriptPath, { mainOnly: true });
+            const injected = unionSurfaces(injectedBySurface);
             // P5 ①: cite-back signals — observations whose warned file the agent
             // edited this session. Union into injected so they're resolved (they
             // were injected via pre-tool-recall) and, below, into cited so the
@@ -789,6 +798,19 @@ async function handleStop() {
                 // obs resolved this run (denominator), promoted = obs cited this run
                 // (numerator). Idempotent (touched is 0 on re-fire) + best-effort.
                 recordCitationFunnel(db, project, sessionId, r.touched, r.promoted);
+                // v45: the same funnel split by injection FACE. Keyed on
+                // ccSessionId — the SAME D#60 reasoning as applyCitationDecay
+                // above, and load-bearing here for a second reason: this table
+                // OVERWRITES rather than accumulates, and the memory sessionId
+                // is one file per PROJECT, so two concurrent CC sessions in one
+                // project would share a row and the later Stop would erase the
+                // earlier session's counts outright. citation_log survives the
+                // shared key only because it adds deltas.
+                // keyctx rides along for VISIBILITY only — it is a separate
+                // telemetry table, so recording it here cannot widen the decay
+                // denominator the way v3.66.0's union did.
+                recordCitationSurfaces(db, project, ccSessionId || sessionId,
+                  { ...injectedBySurface, keyctx: keyCtxIds }, citedMain);
                 // P1 (D#78): per-edge attribution. The session cooldown file
                 // (keyed by CC session id) records which FILE each obs was
                 // injected for; resolve those (obs,file) edges as hit/miss with
@@ -1727,12 +1749,20 @@ async function handleUserPrompt() {
         }
       } catch { /* file may not exist — that's fine */ }
 
-      // Phase-2 task-imperative (default OFF — CLAUDE_MEM_TASK_IMPERATIVE): the single
-      // highest-value lesson relevant to THIS prompt, delivered at the prompt position under
-      // an imperative template. Excluded from the <memory-context> list so it is never
-      // injected twice. Channel-isolation measure (efficacy arm U, 2026-06-29): task-prompt
-      // 6-8/8 vs PreToolUse hook 0/8. Flipping the default ON is a separate L3 decision
-      // gated on the live cite-recall canary.
+      // Phase-2 task-imperative (EXPERIMENTAL, default OFF — CLAUDE_MEM_TASK_IMPERATIVE):
+      // the single highest-value lesson relevant to THIS prompt, delivered at the prompt
+      // position under an imperative template. Excluded from the <memory-context> list so it
+      // is never injected twice. Channel-isolation measure (efficacy arm U, 2026-06-29):
+      // task-prompt 6-8/8 vs PreToolUse hook 0/8.
+      //
+      // The default flip is ABANDONED (D#137, 2026-08-16). rankImperativeCandidates requires
+      // identifier overlap between the prompt and the lesson body/title, and over the last 400
+      // real prompts that gate opened 76 times = 19.0% (CJK prompts 57/352 = 16.2%, ASCII
+      // 19/48 = 39.6%). With 88% of prompts on this install in Chinese, the emitter fires
+      // roughly once every six prompts — the canary can never accumulate n, because the
+      // ceiling is the gate's DESIGN (precision-first symbol anchoring), not a defect.
+      // Reviving the flip needs a CJK-viable anchor proven in A/B without a precision loss;
+      // until then this stays experimental and off.
       const taskImperativeOn = process.env.CLAUDE_MEM_TASK_IMPERATIVE === 'on'
         || process.env.CLAUDE_MEM_TASK_IMPERATIVE === '1';
       // Exclude only ids path-A (user-prompt-search.js) already injected — NOT the

package/lib/citation-tracker.mjs

@@ -223,28 +223,6 @@ function eachHookAttachment(transcriptPath, fn, opts = {}) {
   }
 }
 
-/**
- * Extract observation IDs injected by pre-tool-recall hook in this transcript.
- *
- * Tighter than `computeCiteRecall`'s over-inclusive "any #NN in non-assistant
- * text" — only counts IDs the agent actually saw from us, not user-pasted
- * references or unrelated #NN tokens in tool output.
- *
- * @param {string|null|undefined} transcriptPath
- * @returns {Set<number>} unique injected IDs (empty set on missing path/file)
- */
-export function extractInjectedFromPreToolUse(transcriptPath, opts = {}) {
-  const ids = new Set();
-  eachHookAttachment(transcriptPath, ({ command, text }) => {
-    if (!command.includes('pre-tool-recall')) return;
-    for (const line of text.split('\n')) {
-      const m = INJECTED_ROW_RE.exec(line);
-      if (m) addObsId(ids, m[1]);
-    }
-  }, opts);
-  return ids;
-}
-
 // v34.x: UserPromptSubmit injection extractor. hook.mjs handleUserPrompt emits
 // formatMemoryLine `- [type] title | Lesson: X (#NN)[ [verify-before-use]]`,
 // which INJECTED_RE (anchored on `#NN [type]`) never matched — leaving this
@@ -260,88 +238,169 @@ const UPS_ID_RE = /\(#(\d{1,7})\)/g;
 // `node "/abs/hook.mjs" user-prompt` → normalized to `node /abs/hook.mjs user-prompt`.
 const UPS_COMMAND_SUFFIX = 'hook.mjs user-prompt';
 
+// user-prompt-search.js formatResults emits `[mem] FYI — Related memories ...`
+// then one `#NN <icon> title` row per obs (raw stdout, line-leading id). Distinct
+// from the `<memory-context>` block (hook.mjs) — the two UPS injectors dedup obs
+// by id at inject time, so they carry DISJOINT obs sets; both must be extracted
+// or the FYI-carried (highest-importance keyContext) obs never reach decay.
+const FYI_HEADER = '[mem] FYI — Related memories';
+// Anchored at line start so `P#NN` past-question rows (user_prompts, different id
+// space) and any `#NN` inside lesson text are NOT matched.
+const FYI_LINE_ID_RE = /^#(\d{1,7})\s/;
+
 /**
- * Extract observation IDs injected by the UserPromptSubmit `<memory-context>`
- * block (hook.mjs handleUserPrompt). Disjoint from pre-tool-recall extraction —
- * the Stop handler unions all surfaces via extractAllInjected.
+ * The injection FACES memory can reach the model through, as stored in
+ * `citation_surface_log.surface` (schema v45). The first four are
+ * query-conditioned — a row appears there because it MATCHED something — and
+ * are the ones that feed the citation-decay denominator via extractAllInjected.
+ * `keyctx` is the odd one out: an unconditional SessionStart render, recorded
+ * for VISIBILITY only and promotion-only in the decay loop (see
+ * extractInjectedFromKeyContext).
+ * @type {ReadonlyArray<'pretool'|'ups'|'error_recall'|'fyi'|'keyctx'>}
+ */
+export const CITATION_SURFACES = ['pretool', 'ups', 'error_recall', 'fyi', 'keyctx'];
+
+// Single source of truth for "which attachment belongs to which face, and how
+// its ids are read off". Both the per-face extractors below AND the one-pass
+// extractInjectedBySurface dispatch through this table, so a face can never be
+// taught to one path and forgotten on the other — the shape of miss that let
+// UserPromptSubmit go unmetered for a whole minor version (v34.x) and that
+// #10379 records as the repeat offender.
+const SURFACE_MATCHERS = {
+  pretool: {
+    // Tighter than `computeCiteRecall`'s over-inclusive "any #NN in
+    // non-assistant text" — only counts IDs the agent actually saw from us,
+    // not user-pasted references or unrelated #NN tokens in tool output.
+    accepts: ({ command }) => command.includes('pre-tool-recall'),
+    collect: (text, add) => {
+      for (const line of text.split('\n')) {
+        const m = INJECTED_ROW_RE.exec(line);
+        if (m) add(m[1]);
+      }
+    },
+  },
+  ups: {
+    // The `<memory-context>` block emitted by hook.mjs handleUserPrompt.
+    // Disjoint from pre-tool-recall by construction: PTR has `[type]` AFTER
+    // `#NN`, UPS has `(#NN)` at end-of-line.
+    accepts: ({ command, text }) =>
+      command.includes(UPS_COMMAND_SUFFIX) && text.includes('<memory-context'),
+    collect: (text, add) => {
+      for (const memLine of text.split('\n')) {
+        if (!memLine.startsWith(UPS_LINE_PREFIX)) continue;
+        // Take the LAST (#NN) on the line — formatMemoryLine puts the obs id
+        // in trailing parens, possibly followed by ` [verify-before-use]`. Any
+        // earlier (#NN) refs are inside title/lesson text.
+        const matches = [...memLine.matchAll(UPS_ID_RE)];
+        if (matches.length === 0) continue;
+        add(matches[matches.length - 1][1]);
+      }
+    },
+  },
+  error_recall: {
+    // hook.mjs triggerErrorRecall → `[claude-mem-lite] Related memories found
+    // for this error:` followed by `  #NN [type] title` lines, delivered via
+    // post-tool-use.sh. High-volume surface that NO extractor matched before
+    // v3.47 — error-recall'd obs accrued injection_count but never reached
+    // applyCitationDecay, so they could neither promote nor demote.
+    accepts: ({ command, text }) =>
+      command.includes('post-tool-use') && text.includes('Related memories found for this error'),
+    collect: (text, add) => {
+      // Per-line anchored: match only a row that STARTS with `#NN [type]` (after its
+      // indent), NOT every such token in the block. The inlined lesson body (v3.16.x)
+      // can quote another obs id, which must not enter the injected set; the trailing
+      // `Use mem_get(ids=[...])` line (bare numbers) is excluded too.
+      for (const line of text.split('\n')) {
+        const m = INJECTED_ROW_RE.exec(line);
+        if (m) add(m[1]);
+      }
+    },
+  },
+  fyi: {
+    accepts: ({ command, text }) =>
+      command.includes('user-prompt-search') && text.includes(FYI_HEADER),
+    collect: (text, add) => {
+      for (const fyiLine of text.split('\n')) {
+        const m = FYI_LINE_ID_RE.exec(fyiLine);
+        if (m) add(m[1]);
+      }
+    },
+  },
+};
+
+// The query-conditioned faces, in citation_surface_log label order. keyctx is
+// absent on purpose: it has no hook attachment to walk.
+const ATTACHMENT_SURFACES = Object.keys(SURFACE_MATCHERS);
+
+/**
+ * Split a transcript's injections by FACE in ONE walk.
+ *
+ * This is the primitive; `extractAllInjected` is its union. Pre-v45 each face
+ * re-read and re-parsed the whole transcript (4 walks per Stop) AND the union
+ * was a separate list that had to be kept in sync by hand — this collapses both
+ * problems into the SURFACE_MATCHERS table.
  *
  * @param {string|null|undefined} transcriptPath
- * @returns {Set<number>}
+ * @param {{mainOnly?: boolean}} [opts]
+ * @returns {{pretool: Set<number>, ups: Set<number>, error_recall: Set<number>, fyi: Set<number>}}
+ *   Always all four keys, always Sets (empty on missing/unreadable transcript).
  */
-export function extractInjectedFromUserPromptSubmit(transcriptPath, opts = {}) {
-  const ids = new Set();
-  eachHookAttachment(transcriptPath, ({ command, text }) => {
-    if (!command.includes(UPS_COMMAND_SUFFIX)) return;
-    if (!text.includes('<memory-context')) return;
-    for (const memLine of text.split('\n')) {
-      if (!memLine.startsWith(UPS_LINE_PREFIX)) continue;
-      // Take the LAST (#NN) on the line — formatMemoryLine puts the obs id
-      // in trailing parens, possibly followed by ` [verify-before-use]`. Any
-      // earlier (#NN) refs are inside title/lesson text.
-      const matches = [...memLine.matchAll(UPS_ID_RE)];
-      if (matches.length === 0) continue;
-      addObsId(ids, matches[matches.length - 1][1]);
+export function extractInjectedBySurface(transcriptPath, opts = {}) {
+  const out = {};
+  for (const face of ATTACHMENT_SURFACES) out[face] = new Set();
+  eachHookAttachment(transcriptPath, (ctx) => {
+    for (const face of ATTACHMENT_SURFACES) {
+      const matcher = SURFACE_MATCHERS[face];
+      if (!matcher.accepts(ctx)) continue;
+      const target = out[face];
+      matcher.collect(ctx.text, (raw) => addObsId(target, raw));
     }
   }, opts);
-  return ids;
+  return out;
+}
+
+// Per-face extractors: thin wrappers over the shared table, kept as named
+// exports because callers and tests address individual faces.
+function extractOneSurface(face, transcriptPath, opts) {
+  return extractInjectedBySurface(transcriptPath, opts)[face];
 }
 
 /**
- * Extract observation IDs injected by the PostToolUse error-recall hint
- * (hook.mjs triggerErrorRecall → `[claude-mem-lite] Related memories found for
- * this error:` followed by `  #NN [type] title` lines, delivered via
- * post-tool-use.sh). This is a high-volume surface that NO extractor matched
- * before — error-recall'd obs accrued injection_count but never reached
- * applyCitationDecay, so they could neither promote nor demote.
- *
+ * Extract observation IDs injected by pre-tool-recall hook in this transcript.
+ * @param {string|null|undefined} transcriptPath
+ * @returns {Set<number>} unique injected IDs (empty set on missing path/file)
+ */
+export function extractInjectedFromPreToolUse(transcriptPath, opts = {}) {
+  return extractOneSurface('pretool', transcriptPath, opts);
+}
+
+/**
+ * Extract observation IDs injected by the UserPromptSubmit `<memory-context>`
+ * block (hook.mjs handleUserPrompt).
  * @param {string|null|undefined} transcriptPath
  * @returns {Set<number>}
  */
-export function extractInjectedFromErrorRecall(transcriptPath, opts = {}) {
-  const ids = new Set();
-  eachHookAttachment(transcriptPath, ({ command, text }) => {
-    if (!command.includes('post-tool-use')) return;
-    if (!text.includes('Related memories found for this error')) return;
-    // Per-line anchored: match only a row that STARTS with `#NN [type]` (after its
-    // indent), NOT every such token in the block. The inlined lesson body (v3.16.x)
-    // can quote another obs id, which must not enter the injected set; the trailing
-    // `Use mem_get(ids=[...])` line (bare numbers) is excluded too.
-    for (const line of text.split('\n')) {
-      const m = INJECTED_ROW_RE.exec(line);
-      if (m) addObsId(ids, m[1]);
-    }
-  }, opts);
-  return ids;
+export function extractInjectedFromUserPromptSubmit(transcriptPath, opts = {}) {
+  return extractOneSurface('ups', transcriptPath, opts);
 }
 
-// user-prompt-search.js formatResults emits `[mem] FYI — Related memories ...`
-// then one `#NN <icon> title` row per obs (raw stdout, line-leading id). Distinct
-// from the `<memory-context>` block (hook.mjs) — the two UPS injectors dedup obs
-// by id at inject time, so they carry DISJOINT obs sets; both must be extracted
-// or the FYI-carried (highest-importance keyContext) obs never reach decay.
-const FYI_HEADER = '[mem] FYI — Related memories';
-// Anchored at line start so `P#NN` past-question rows (user_prompts, different id
-// space) and any `#NN` inside lesson text are NOT matched.
-const FYI_LINE_ID_RE = /^#(\d{1,7})\s/;
+/**
+ * Extract observation IDs injected by the PostToolUse error-recall hint.
+ * @param {string|null|undefined} transcriptPath
+ * @returns {Set<number>}
+ */
+export function extractInjectedFromErrorRecall(transcriptPath, opts = {}) {
+  return extractOneSurface('error_recall', transcriptPath, opts);
+}
 
 /**
  * Extract observation IDs injected by the user-prompt-search.js `[mem] FYI —
  * Related memories` block.
- *
  * @param {string|null|undefined} transcriptPath
  * @returns {Set<number>}
  */
 export function extractInjectedFromFyi(transcriptPath, opts = {}) {
-  const ids = new Set();
-  eachHookAttachment(transcriptPath, ({ command, text }) => {
-    if (!command.includes('user-prompt-search')) return;
-    if (!text.includes(FYI_HEADER)) return;
-    for (const fyiLine of text.split('\n')) {
-      const m = FYI_LINE_ID_RE.exec(fyiLine);
-      if (m) addObsId(ids, m[1]);
-    }
-  }, opts);
-  return ids;
+  return extractOneSurface('fyi', transcriptPath, opts);
 }
 
 /**
@@ -409,12 +468,25 @@ export function extractInjectedFromKeyContext({ runtimeDir, project, sessionId =
  * @returns {Set<number>}
  */
 export function extractAllInjected(transcriptPath, opts = {}) {
-  return new Set([
-    ...extractInjectedFromPreToolUse(transcriptPath, opts),
-    ...extractInjectedFromUserPromptSubmit(transcriptPath, opts),
-    ...extractInjectedFromErrorRecall(transcriptPath, opts),
-    ...extractInjectedFromFyi(transcriptPath, opts),
-  ]);
+  return unionSurfaces(extractInjectedBySurface(transcriptPath, opts));
+}
+
+/**
+ * Flatten a per-face breakdown into the single injected set the decay loop
+ * takes. Derived — NOT a second hand-maintained face list — so adding a face to
+ * SURFACE_MATCHERS automatically widens the denominator (v45; the pre-v45 union
+ * enumerated the faces a second time and that is exactly how a face goes
+ * unmetered).
+ *
+ * @param {Record<string, Set<number>>} bySurface
+ * @returns {Set<number>}
+ */
+export function unionSurfaces(bySurface) {
+  const out = new Set();
+  for (const face of ATTACHMENT_SURFACES) {
+    for (const id of bySurface?.[face] || []) out.add(id);
+  }
+  return out;
 }
 
 /**
@@ -617,6 +689,47 @@ export function computeCitationAdoption(db, project) {
   } catch (e) { debugCatch(e, 'computeCitationAdoption'); return empty; }
 }
 
+/**
+ * D#61: a lesson injected live and then superseded mid-session (auto-dedup /
+ * `supersedes=` save) leaves its citation crediting NOBODY — every consumer
+ * excludes superseded rows by design, so the keeper that now carries the lesson
+ * goes uncredited. Redirect such ids to their NUMERIC superseded_by keeper (one
+ * hop; superseded_by is polymorphic — the typeof guard mirrors timeline-core).
+ *
+ * Returns a COPY: callers own their input sets. Shared by the per-obs decay loop
+ * and the per-surface funnel so the two can't disagree about who gets credit —
+ * the superseded invariant has been reopened once per surface that forgot it.
+ *
+ * @param {import('better-sqlite3').Database} db
+ * @param {string} project
+ * @param {Set<number>|Iterable<number>} ids
+ * @returns {Set<number>}
+ */
+export function redirectSupersededIds(db, project, ids) {
+  const src = ids instanceof Set ? ids : new Set(ids || []);
+  const out = new Set();
+  // Both bail-outs copy: returning `src` would hand back the CALLER'S own Set
+  // on the very paths that skip the redirect, quietly breaking the contract one
+  // line below this and making a future caller's mutation action-at-a-distance.
+  if (!db || !project) return new Set(src);
+  let stmt;
+  try {
+    stmt = db.prepare(
+      'SELECT superseded_by FROM observations WHERE id = ? AND project = ? AND superseded_at IS NOT NULL'
+    );
+  } catch (e) { debugCatch(e, 'redirectSupersededIds-prepare'); return new Set(src); }
+  for (const id of src) {
+    const r = stmt.get(id, project);
+    if (r && typeof r.superseded_by === 'number' && Number.isInteger(r.superseded_by)
+        && r.superseded_by > 0 && r.superseded_by !== id) {
+      out.add(r.superseded_by);
+    } else {
+      out.add(id);
+    }
+  }
+  return out;
+}
+
 /**
  * Apply the citation-feedback loop for one session: for each injected obs id,
  * decide cited vs uncited and mutate importance/streak/cited_count per spec.
@@ -657,31 +770,8 @@ export function applyCitationDecay(db, project, injectedIds, citedIds, sessionId
   if (injected.size === 0) return empty;
   let cited = citedIds instanceof Set ? citedIds : new Set(citedIds || []);
 
-  // D#61: a lesson injected live and then superseded mid-session (auto-dedup /
-  // supersedes= save) leaves its citation crediting NOBODY — selectStmt below
-  // excludes superseded rows by design (defense-in-depth parity), so the keeper
-  // that now carries the lesson goes uncredited. Redirect such ids to their
-  // NUMERIC superseded_by keeper (one hop; superseded_by is polymorphic — the
-  // typeof guard mirrors timeline-core). Copies, not mutation: callers own the
-  // input sets.
-  const redirectStmt = db.prepare(
-    'SELECT superseded_by FROM observations WHERE id = ? AND project = ? AND superseded_at IS NOT NULL'
-  );
-  const redirectSet = (set) => {
-    const out = new Set();
-    for (const id of set) {
-      const r = redirectStmt.get(id, project);
-      if (r && typeof r.superseded_by === 'number' && Number.isInteger(r.superseded_by)
-          && r.superseded_by > 0 && r.superseded_by !== id) {
-        out.add(r.superseded_by);
-      } else {
-        out.add(id);
-      }
-    }
-    return out;
-  };
-  injected = redirectSet(injected);
-  cited = redirectSet(cited);
+  injected = redirectSupersededIds(db, project, injected);
+  cited = redirectSupersededIds(db, project, cited);
 
   // Adoption gate (snapshot taken before any mutation this run). Suppress only
   // demotion; promotion always proceeds. Threshold overridable via env.
@@ -840,6 +930,132 @@ export function recordCitationFunnel(db, project, sessionId, injectedDelta, cite
   } catch (e) { debugCatch(e, 'recordCitationFunnel'); }
 }
 
+/**
+ * v45 — persist this session's invocation→cite funnel split by INJECTION FACE.
+ *
+ * The aggregate twin (recordCitationFunnel) accumulates deltas because its
+ * source is applyCitationDecay's per-run return. This one OVERWRITES, because
+ * its source is the transcript, which only ever grows: recomputing after a Stop
+ * re-fire yields the same-or-larger sets, so overwrite is idempotent by
+ * construction AND lets a cross-turn late citation raise cited_n without
+ * double-counting injected_n. No per-obs state, no idempotency key needed.
+ *
+ * NOT A PARTITION, and NOT comparable to citation_log in either direction.
+ * Upward: an obs carried by two faces is counted in BOTH rows. Downward: the
+ * Stop handler unions cite-back signals into the aggregate denominator AFTER
+ * taking this breakdown, and those ids belong to no face (and skip the mainOnly
+ * filter), so citation_log can exceed the surface sum too. A per-face view
+ * answers "which face earns its budget", not "how was the budget divided".
+ *
+ * Ids are filtered to observations that actually exist in this project and are
+ * not superseded (redirected to their keeper first), mirroring the decay loop's
+ * SELECT — so a cross-project id, a deleted row, or an events-table id can't
+ * inflate a face's denominator.
+ *
+ * Telemetry only: every write is wrapped, and a failure here can never break the
+ * Stop handler.
+ *
+ * @param {import('better-sqlite3').Database} db
+ * @param {string} project
+ * @param {string} sessionId — the CLAUDE CODE session id, NOT the memory
+ *   session id citation_log uses. Overwrite semantics make the key choice
+ *   load-bearing: the memory session id is one file per PROJECT, so two
+ *   concurrent CC sessions in one project share it and the second Stop would
+ *   erase the first's counts. citation_log survives that only because it
+ *   accumulates. Same reasoning as D#60 for applyCitationDecay.
+ * @param {Record<string, Set<number>|Iterable<number>>} surfaceSets — keys must
+ *   be CITATION_SURFACES members; unknown labels are dropped, not written.
+ * @param {Set<number>|Iterable<number>} citedIds — this session's cited set
+ *   (same one the decay loop uses)
+ * @returns {Record<string, {injected: number, cited: number}>} what was written
+ */
+export function recordCitationSurfaces(db, project, sessionId, surfaceSets, citedIds) {
+  const written = {};
+  if (!db || !project || !sessionId || !surfaceSets || typeof surfaceSets !== 'object') return written;
+  try {
+    const cited = redirectSupersededIds(db, project, citedIds instanceof Set ? citedIds : new Set(citedIds || []));
+    const liveStmt = db.prepare(
+      'SELECT 1 AS ok FROM observations WHERE id = ? AND project = ? AND superseded_at IS NULL'
+    );
+    const upsert = db.prepare(`
+      INSERT INTO citation_surface_log (project, session_id, surface, resolved_at, injected_n, cited_n)
+      VALUES (?, ?, ?, ?, ?, ?)
+      ON CONFLICT(project, session_id, surface) DO UPDATE SET
+        injected_n = excluded.injected_n,
+        cited_n = excluded.cited_n,
+        resolved_at = excluded.resolved_at
+    `);
+    const now = Date.now();
+    const rows = [];
+    for (const [surface, rawIds] of Object.entries(surfaceSets)) {
+      if (!CITATION_SURFACES.includes(surface)) continue; // unknown label → unqueryable row
+      const ids = redirectSupersededIds(db, project, rawIds instanceof Set ? rawIds : new Set(rawIds || []));
+      let injected = 0, citedN = 0;
+      for (const id of ids) {
+        if (!liveStmt.get(id, project)) continue;
+        injected++;
+        if (cited.has(id)) citedN++;
+      }
+      if (injected === 0) continue; // empty face → no telemetry noise
+      rows.push([surface, injected, citedN]);
+      written[surface] = { injected, cited: citedN };
+    }
+    if (rows.length === 0) return written;
+    const txn = db.transaction(() => {
+      for (const [surface, injected, citedN] of rows) {
+        upsert.run(project, sessionId, surface, now, injected, citedN);
+      }
+    });
+    txn();
+  } catch (e) { debugCatch(e, 'recordCitationSurfaces'); }
+  return written;
+}
+
+/**
+ * v45 — read citation_surface_log back as a per-face cite-rate leaderboard for
+ * the window, highest injection volume first (the face spending the most budget
+ * is the one worth aiming a lever at).
+ *
+ * `unavailable` is set — and ONLY set — when the read could not run (no handle,
+ * missing table, unreadable DB). An empty window leaves it undefined. Without
+ * this split both render as `surfaces: []`, which is exactly how a table that was
+ * never created reads as "no data yet" for as long as the surface stays unmetered
+ * (#10650): the reader swallows `no such table` into the debug log, and the only
+ * caller-visible signal is a shape identical to the benign case.
+ *
+ * @param {import('better-sqlite3').Database} db
+ * @param {{days?: number, project?: string|null}} [opts]
+ * @returns {{window_days: number, surfaces: Array<{surface: string, injected: number, cited: number, rate: number, sessions: number}>, unavailable?: string}}
+ */
+export function computeSurfaceFunnel(db, { days = 7, project = null } = {}) {
+  const empty = { window_days: days, surfaces: [] };
+  if (!db) return { ...empty, unavailable: 'no database handle' };
+  try {
+    const windowStart = Date.now() - days * DAY_MS;
+    const params = project ? [windowStart, project] : [windowStart];
+    const rows = db.prepare(`
+      SELECT surface,
+             COALESCE(SUM(injected_n), 0)   AS injected,
+             COALESCE(SUM(cited_n), 0)      AS cited,
+             -- DISTINCT, not COUNT(*): rows are keyed (project, session,
+             -- surface), so an unfiltered COUNT(*) counts project-sessions and
+             -- over-reports "over N sessions" whenever a session spans projects.
+             COUNT(DISTINCT session_id)     AS sessions
+        FROM citation_surface_log
+       WHERE resolved_at >= ? ${project ? 'AND project = ?' : ''}
+    GROUP BY surface
+    ORDER BY injected DESC, surface ASC
+    `).all(...params);
+    return {
+      window_days: days,
+      surfaces: rows.map(r => ({ ...r, rate: r.injected > 0 ? r.cited / r.injected : 0 })),
+    };
+  } catch (e) {
+    debugCatch(e, 'computeSurfaceFunnel');
+    return { ...empty, unavailable: e?.message || 'query failed' };
+  }
+}
+
 /**
  * R1 — read the per-session invocation→cite funnel as a windowed trend.
  * `window` aggregates [now-days, now]; `prior` aggregates [now-2*days, now-days)

package/mem-cli.mjs

@@ -55,7 +55,18 @@ import { resolveAnchorToken, formatAnchorError, resolveQueryAnchor, fetchRecentT
 import { buildSearchFtsQuery, parseDateBounds, parseDuration, coreRunSearchPipeline } from './lib/search-core.mjs';
 import { AUTO_MERGE_THRESHOLD } from './lib/dedup-constants.mjs';
 import { countRecentHookErrors } from './lib/hook-telemetry.mjs';
-import { computeCitationFunnelTrend } from './lib/citation-tracker.mjs';
+import { computeCitationFunnelTrend, computeSurfaceFunnel } from './lib/citation-tracker.mjs';
+
+// Human labels for citation_surface_log.surface. Padded to a common width so
+// the citation-stats face table lines up; the enum itself lives in
+// lib/citation-tracker.mjs (CITATION_SURFACES).
+const SURFACE_LABELS = {
+  pretool:      'PreToolUse recall  ',
+  ups:          'UserPromptSubmit   ',
+  error_recall: 'error-recall       ',
+  fyi:          'FYI (prompt-search)',
+  keyctx:       'Key Context        ',
+};
 import { aggregateMetrics, readMetrics } from './lib/metrics.mjs';
 import {
   insertDeferred, listOpenWithOrdinal, dropDeferred,
@@ -2524,6 +2535,8 @@ function cmdCitationStats(db, args) {
   // R1: per-session invocation→cite funnel trend (citation_log). Same `days` window
   // as the per-project cite rate above; funnel.prior/delta_pt show the direction.
   const funnel = computeCitationFunnelTrend(db, { days });
+  // v45: per-injection-face split of the same funnel (citation_surface_log).
+  const surfaceFunnel = computeSurfaceFunnel(db, { days });
 
   // Survivorship-honesty: the per-project rate (cited_count/decay_seen_count over
   // SURVIVING in-window obs) is doubly biased — GC drops uncited obs from the
@@ -2542,7 +2555,7 @@ function cmdCitationStats(db, args) {
   }
 
   if (json) {
-    out(JSON.stringify({ window_days: days, per_project: perProject, decay_queue: decayQueue, promoted, demoted, data_pollution_note: dataPollutionNote, funnel }, null, 2));
+    out(JSON.stringify({ window_days: days, per_project: perProject, decay_queue: decayQueue, promoted, demoted, data_pollution_note: dataPollutionNote, funnel, surface_funnel: surfaceFunnel }, null, 2));
     return;
   }
 
@@ -2577,6 +2590,28 @@ function cmdCitationStats(db, args) {
   }
   out(trendLine);
   out('');
+
+  // v45: the same funnel split by INJECTION FACE. The aggregate above says
+  // whether effectiveness is rising; this says WHICH face to aim a lever at.
+  out(`Cite rate by injection face (last ${days}d):`);
+  out('  a per-face VIEW, not a partition — do NOT reconcile against the funnel above: faces overlap (an obs carried by two counts in both) and the funnel also counts cite-back signals that belong to no face:');
+  if (surfaceFunnel.unavailable) {
+    // The read FAILED — a missing/unreadable citation_surface_log. Pre-b4 this
+    // rendered identically to an empty window, so the #10650 shape (table never
+    // created, `no such table` swallowed into the debug log) read as "no data
+    // yet" for as long as the surface stayed unmetered.
+    out(`  (UNAVAILABLE — the per-face table could not be read: ${surfaceFunnel.unavailable})`);
+    out('  this is a failure, not an empty window: run `claude-mem-lite fts-check` to repair the schema');
+  } else if (surfaceFunnel.surfaces.length === 0) {
+    out('  (no rows in this window yet — rows accrue at Stop, one per injection face per session)');
+  } else {
+    for (const s of surfaceFunnel.surfaces) {
+      const pct = (s.rate * 100).toFixed(1) + '%';
+      const note = s.surface === 'keyctx' ? '  (promotion-only: never demotes)' : '';
+      out(`  ${SURFACE_LABELS[s.surface] || s.surface}  inj ${String(s.injected).padStart(4)}  cited ${String(s.cited).padStart(4)}  ${pct.padStart(6)}  over ${s.sessions} session(s)${note}`);
+    }
+  }
+  out('');
   out('Active decay queue (uncited_streak >= 2, next miss → demote):');
   if (decayQueue.length === 0) out('  (none)');
   for (const r of decayQueue) {

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.66.2",
+  "version": "3.68.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "claude-mem-lite",
-      "version": "3.66.2",
+      "version": "3.68.0",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.26.0",
         "better-sqlite3": "^12.6.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.66.2",
+  "version": "3.68.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",

package/registry-enricher.mjs

@@ -2,7 +2,10 @@
 // Sends resource content to Haiku for semantic metadata generation
 // Graceful degradation: failure preserves existing data
 
-import { callHaikuJSON, BG_LLM_TIMEOUT_MS } from './haiku-client.mjs';
+// Async dispatcher: enrichResource is reached from the MCP handlers for
+// mem_registry `enrich` and `import_url`, where a blocking CLI leg would freeze
+// the server event loop for the whole BG_LLM_TIMEOUT_MS budget (D#138 MEDIUM-3).
+import { callHaikuJSONAsync, BG_LLM_TIMEOUT_MS } from './haiku-client.mjs';
 import { truncate, debugCatch } from './utils.mjs';
 
 /**
@@ -84,7 +87,7 @@ export async function enrichResource(db, name, type, content) {
 
   try {
     const prompt = buildEnrichPrompt(name, content, existing);
-    const result = await callHaikuJSON(prompt, { timeout: BG_LLM_TIMEOUT_MS, maxTokens: 500 });
+    const result = await callHaikuJSONAsync(prompt, { timeout: BG_LLM_TIMEOUT_MS, maxTokens: 500 });
 
     if (!result || !result.capability_summary) {
       db.prepare("UPDATE resources SET enrichment_status = 'failed' WHERE name = ? AND type = ?").run(name, type);

package/rerank.mjs

@@ -69,10 +69,13 @@ export async function llmRerankOrder(query, cand /* [{sid,text}] */, llm) {
 }
 
 // Default provider — lazy import so stub-injected callers never load the client.
-// Uses callLLMWithModel (returns {text}) rather than callModelJSONAsync (which
+// Uses the {text}-envelope dispatcher rather than callModelJSONAsync (which
 // JSON-parses internally and nulls on any non-{...} output) so extractRanked can
-// recover bare-array answers the strict JSON parse drops.
+// recover bare-array answers the strict JSON parse drops. The Async variant is
+// load-bearing: rerank runs inside the mem_search MCP handler (deep + rerank), so
+// the blocking callLLMWithModel froze the server event loop whenever a keyed
+// provider was down and the call degraded to the CLI (D#138 MEDIUM-3).
 export async function defaultRerankLLM(prompt) {
-  const { callLLMWithModel } = await import('./haiku-client.mjs');
-  return callLLMWithModel(prompt, 'haiku', { timeout: 20000, maxTokens: 300 });
+  const { callLLMWithModelAsync } = await import('./haiku-client.mjs');
+  return callLLMWithModelAsync(prompt, 'haiku', { timeout: 20000, maxTokens: 300 });
 }

package/schema.mjs

@@ -129,7 +129,30 @@ export const CODE_DIR = join(homedir(), '.claude-mem-lite');
 // 2026-07-14 on this machine's own DB). One version per migration batch keeps
 // the version number itself the detector. LATEST_MIGRATION_COLUMN advances to
 // observations.scope.
-export const CURRENT_SCHEMA_VERSION = 44;
+// v45 (per-surface funnel): citation_surface_log — the same invocation→cite
+// funnel as citation_log (v38) but split by INJECTION FACE. citation_log answers
+// "is effectiveness rising or falling" for a project; it cannot answer "which
+// face is burning the budget", because hook.mjs unions all four
+// query-conditioned faces (pre-tool-recall / UserPromptSubmit <memory-context> /
+// PostToolUse error-recall / user-prompt-search FYI) before anything is
+// recorded. Without per-face cite-rate there is no evidence to aim any
+// precision lever at, which is what gated D#44 and D#129's remaining legs.
+// The two tables are NOT comparable in either direction and the readers say so
+// out loud: an obs carried by two faces is counted in both rows (pushes the
+// surface sum UP), while cite-back signals join citation_log's denominator
+// without belonging to any face and without the mainOnly filter (pushes the
+// aggregate UP). Neither is a partition of the other.
+// Keyed on the CC session id, NOT the memory session id — see the DDL comment.
+// The column was renamed memory_session_id -> session_id BEFORE v45 ever
+// shipped (pre-tag review), so no released database carries the old shape and
+// no rename migration exists; the sentinel stays on `surface`, which is a
+// table-presence check either way.
+// New TABLE (not a column) reached via CORE_SCHEMA's CREATE TABLE IF NOT EXISTS
+// on the forced migration pass. UNLIKE v38/v39 this DOES register a sentinel
+// (citation_surface_log.surface) in LATEST_MIGRATION_COLUMNS: a table that only
+// the forced pass can create is unreachable forever once the version row says
+// "done", which is not a hypothetical — see the note there.
+export const CURRENT_SCHEMA_VERSION = 45;
 
 // Sentinel columns for the LATEST migration set(s). The fast-path uses these
 // to self-heal half-migrated DBs — schema_version bumped but column ALTERs
@@ -139,7 +162,18 @@ export const CURRENT_SCHEMA_VERSION = 44;
 // table's pre-migration shape while the version row and the other table stay
 // current — a single sentinel can't see that hole, so every recent batch
 // keeps a representative column here until it is ancient enough to retire.
+// A new TABLE needs an entry here just as much as a new COLUMN does, and v38/v39
+// not having one is a latent hole, not a precedent: CORE_SCHEMA is reached ONLY
+// on the forced pass, so if anything stamps the version without running it (a
+// half-applied dev tree, an interrupted migration, a peer on a newer build), the
+// fast-path returns forever and the table can never appear. Observed live during
+// v45 development — the version bump and the CREATE landed in two edits, a hook
+// fired between them, and the DB sat at v45 with no citation_surface_log while
+// every reader silently swallowed "no such table" as "no data yet".
+// pragma_table_info on a missing table returns zero rows (it does not throw), so
+// naming any column of the new table is a table-presence check.
 const LATEST_MIGRATION_COLUMNS = [
+  { table: 'citation_surface_log', column: 'surface' },            // v45
   { table: 'observations', column: 'scope' },                      // v44
   { table: 'observation_files', column: 'last_cited_session_id' }, // v43
 ];
@@ -243,6 +277,34 @@ const CORE_SCHEMA = `
     PRIMARY KEY (project, memory_session_id)
   );
 
+  -- v45: per-INJECTION-FACE twin of citation_log. One row per
+  -- (project, session, surface); the surface column is one of the
+  -- CITATION_SURFACES enum in lib/citation-tracker.mjs
+  -- (pretool | ups | error_recall | fyi | keyctx).
+  --
+  -- session_id is the CLAUDE CODE session id, NOT the memory session id that
+  -- keys citation_log. The two tables therefore do NOT join, on purpose. The
+  -- memory session id lives in one file per PROJECT (hook-shared session-<project>,
+  -- 12h), so two concurrent CC sessions in one project share it -- which is
+  -- survivable for citation_log because that table ACCUMULATES deltas, and
+  -- destructive here because this one OVERWRITES: the second session's Stop
+  -- would erase the first's counts. Same reasoning that moved applyCitationDecay
+  -- onto the CC session id in D#60.
+  --
+  -- Overwrite (not accumulate) is correct for this table because its source --
+  -- ONE CC session's transcript -- only ever grows, so a Stop re-fire recomputes
+  -- the same-or-larger sets: idempotent by construction, and a cross-turn late
+  -- citation raises cited_n without touching injected_n.
+  CREATE TABLE IF NOT EXISTS citation_surface_log (
+    project TEXT NOT NULL,
+    session_id TEXT NOT NULL,
+    surface TEXT NOT NULL,
+    resolved_at INTEGER,
+    injected_n INTEGER NOT NULL DEFAULT 0,
+    cited_n INTEGER NOT NULL DEFAULT 0,
+    PRIMARY KEY (project, session_id, surface)
+  );
+
   CREATE TABLE IF NOT EXISTS migration_cleanups (
     name TEXT PRIMARY KEY,
     done_at_epoch INTEGER NOT NULL
@@ -904,11 +966,13 @@ const DEFERRED_CLEANUPS = [
             // Rename the short project to canonical on EVERY project-scoped table.
             // Originally only the first three were rewritten, so a short-named
             // project's deferred TODOs (deferred_work), activity (events), citation
-            // history (citation_log), and /clear-/exit handoffs (session_handoffs)
-            // were stranded on the old name — invisible to every project-scoped query
-            // after normalization. All seven carry a `project` column (verified).
+            // history (citation_log + v45 citation_surface_log), and /clear-/exit
+            // handoffs (session_handoffs) were stranded on the old name — invisible to
+            // every project-scoped query after normalization. All eight carry a
+            // `project` column (verified).
             for (const table of ['observations', 'sdk_sessions', 'session_summaries',
-                                 'session_handoffs', 'citation_log', 'events', 'deferred_work']) {
+                                 'session_handoffs', 'citation_log', 'citation_surface_log',
+                                 'events', 'deferred_work']) {
               db.prepare(`UPDATE ${table} SET project = ? WHERE project = ?`).run(canonical.project, shortName);
             }
           }