claude-mem-lite 3.74.1 → 3.75.1

package/lib/citation-tracker.mjs

@@ -10,10 +10,14 @@
 // column UPDATE including access_count. Per-row UPDATEs wrapped in try-catch
 // to prevent SQLITE_CORRUPT_VTAB cascades from stopping the whole scan.
 
-import { readFileSync, existsSync, readdirSync, statSync } from 'fs';
+import { readFileSync, readdirSync, statSync } from 'fs';
 import { join } from 'path';
 import { debugCatch } from '../utils.mjs';
 import { keyContextIdsFileName } from './injected-ids.mjs';
+import { readTranscriptEntries } from './transcript-scan.mjs';
+// The emitter's own prefix — see SURFACE_MATCHERS.task_imperative. Importing it rather
+// than re-typing the framing is what keeps emit and extract from becoming two lists.
+import { TASK_IMPERATIVE_PREFIX } from './task-imperative.mjs';
 
 import { DAY_MS } from './time-constants.mjs';
 // `#123` / `#45678` at a word boundary — matches the CLAUDE.md cite pattern.
@@ -32,13 +36,7 @@ const CITATION_RE = /#(\d{1,7})\b/g;
 export function extractCitationsFromTranscript(transcriptPath, opts = {}) {
   const { mainOnly = false } = opts;
   const ids = new Set();
-  if (!transcriptPath || !existsSync(transcriptPath)) return ids;
-  let raw;
-  try { raw = readFileSync(transcriptPath, 'utf8'); } catch { return ids; }
-  for (const line of raw.split('\n')) {
-    if (!line.trim()) continue;
-    let entry;
-    try { entry = JSON.parse(line); } catch { continue; }
+  for (const entry of readTranscriptEntries(transcriptPath)) {
     // Claude Code transcript: one JSON per line with type='assistant' | 'user' | ...
     if (entry.type !== 'assistant' || !entry.message) continue;
     // Citation-decay loop scopes citation signal to main-thread text only —
@@ -77,18 +75,10 @@ export function extractCitationsFromTranscript(transcriptPath, opts = {}) {
  *   Returns zeros if transcript is missing or empty.
  */
 export function computeCiteRecall(transcriptPath) {
-  const empty = { injected: 0, cited: 0, recalled: 0, ratio: 0 };
-  if (!transcriptPath || !existsSync(transcriptPath)) return empty;
-  let raw;
-  try { raw = readFileSync(transcriptPath, 'utf8'); } catch { return empty; }
-
   const injected = new Set();
   const cited = new Set();
 
-  for (const line of raw.split('\n')) {
-    if (!line.trim()) continue;
-    let entry;
-    try { entry = JSON.parse(line); } catch { continue; }
+  for (const entry of readTranscriptEntries(transcriptPath)) {
     const target = entry.type === 'assistant' ? cited : injected;
     // Walk every text-bearing surface the transcript carries: top-level content,
     // nested message content (assistant/user blocks), and tool_result-style
@@ -199,13 +189,7 @@ function normalizeHookCommand(command) {
  */
 function eachHookAttachment(transcriptPath, fn, opts = {}) {
   const { mainOnly = false } = opts;
-  if (!transcriptPath || !existsSync(transcriptPath)) return;
-  let raw;
-  try { raw = readFileSync(transcriptPath, 'utf8'); } catch { return; }
-  for (const line of raw.split('\n')) {
-    if (!line.trim()) continue;
-    let entry;
-    try { entry = JSON.parse(line); } catch { continue; }
+  for (const entry of readTranscriptEntries(transcriptPath)) {
     if (entry.type !== 'attachment') continue;
     if (mainOnly && entry.isSidechain === true) continue;
     const att = entry.attachment;
@@ -250,15 +234,21 @@ const FYI_LINE_ID_RE = /^#(\d{1,7})\s/;
 
 /**
  * The injection FACES memory can reach the model through, as stored in
- * `citation_surface_log.surface` (schema v45). The first four are
+ * `citation_surface_log.surface` (schema v45). The first five are
  * query-conditioned — a row appears there because it MATCHED something — and
  * are the ones that feed the citation-decay denominator via extractAllInjected.
  * `keyctx` is the odd one out: an unconditional SessionStart render, recorded
  * for VISIBILITY only and promotion-only in the decay loop (see
  * extractInjectedFromKeyContext).
- * @type {ReadonlyArray<'pretool'|'ups'|'error_recall'|'fyi'|'keyctx'>}
+ *
+ * `task_imperative` (v3.76) rides the SAME attachment as `ups` — one
+ * `hook.mjs user-prompt` invocation writes the `<memory-context>` block and then the
+ * imperative line — which is how it stayed unmetered since v3.23 while being a live
+ * injection: the `ups` matcher gates on `<memory-context` and collects only `- [` rows.
+ * The two faces therefore OVERLAP on attachments but never on ids.
+ * @type {ReadonlyArray<'pretool'|'ups'|'error_recall'|'fyi'|'task_imperative'|'keyctx'>}
  */
-export const CITATION_SURFACES = ['pretool', 'ups', 'error_recall', 'fyi', 'keyctx'];
+export const CITATION_SURFACES = ['pretool', 'ups', 'error_recall', 'fyi', 'task_imperative', 'keyctx'];
 
 // Single source of truth for "which attachment belongs to which face, and how
 // its ids are read off". Both the per-face extractors below AND the one-pass
@@ -326,6 +316,24 @@ const SURFACE_MATCHERS = {
       }
     },
   },
+  task_imperative: {
+    // Same hook entry as `ups`, different row. Gating on the emitter's own exported
+    // prefix (not a copy of the wording) keeps the meter tied to the framing; gating on
+    // the COMMAND too means a transcript that merely quotes the framing — a review of
+    // this code, say — is not counted as an injection.
+    accepts: ({ command, text }) =>
+      command.includes(UPS_COMMAND_SUFFIX) && text.includes(TASK_IMPERATIVE_PREFIX),
+    collect: (text, add) => {
+      for (const line of text.split('\n')) {
+        if (!line.startsWith(TASK_IMPERATIVE_PREFIX)) continue;
+        // Trailing `(#NN)` is this lesson's own id; earlier ones are cross-references
+        // inside the body (#8850 — an inlined lesson body must not pollute the set).
+        const matches = [...line.matchAll(UPS_ID_RE)];
+        if (matches.length === 0) continue;
+        add(matches[matches.length - 1][1]);
+      }
+    },
+  },
 };
 
 // The query-conditioned faces, in citation_surface_log label order. keyctx is
@@ -471,19 +479,39 @@ export function extractAllInjected(transcriptPath, opts = {}) {
   return unionSurfaces(extractInjectedBySurface(transcriptPath, opts));
 }
 
+/**
+ * Faces that are METERED (a citation_surface_log row) but deliberately kept OUT of the
+ * citation-decay denominator, with the reason each is here. Membership is a decision,
+ * never a default: `unionSurfaces` still walks every SURFACE_MATCHERS key, and a test
+ * requires each face to be either in the union or listed here — so a face added later
+ * cannot slip out of the denominator by being forgotten, only by being argued for.
+ *
+ * - `task_imperative` (v3.76): metering it is the point of adding it — D#137/D#150/D#151
+ *   are all blocked on not knowing this face's cite-rate. Widening the denominator at the
+ *   same moment would change what gets demoted in every live install on upgrade, and it
+ *   would do so on the face whose framing is itself the open question: if the imperative
+ *   framing under-performs, the penalty lands on the LESSONS it carried (imperativePick
+ *   selects high-value ones) rather than on the framing. Read the rate first, then decide.
+ *   Removing an entry from this set is the one-line change that widens the denominator.
+ */
+const DECAY_EXCLUDED_SURFACES = new Set(['task_imperative']);
+
+/** @type {ReadonlyArray<string>} faces that DO feed the decay denominator. */
+export const DECAY_DENOMINATOR_SURFACES = ATTACHMENT_SURFACES.filter((f) => !DECAY_EXCLUDED_SURFACES.has(f));
+
 /**
  * Flatten a per-face breakdown into the single injected set the decay loop
  * takes. Derived — NOT a second hand-maintained face list — so adding a face to
  * SURFACE_MATCHERS automatically widens the denominator (v45; the pre-v45 union
  * enumerated the faces a second time and that is exactly how a face goes
- * unmetered).
+ * unmetered), unless that face is argued into DECAY_EXCLUDED_SURFACES above.
  *
  * @param {Record<string, Set<number>>} bySurface
  * @returns {Set<number>}
  */
 export function unionSurfaces(bySurface) {
   const out = new Set();
-  for (const face of ATTACHMENT_SURFACES) {
+  for (const face of DECAY_DENOMINATOR_SURFACES) {
     for (const id of bySurface?.[face] || []) out.add(id);
   }
   return out;
@@ -523,12 +551,7 @@ const SUBAGENT_INJECT_ID_RE = /^\s{0,4}#(\d{1,7})\s+—/;
  */
 export function extractInjectedFromSubagentPrompt(transcriptPath) {
   const ids = new Set();
-  let raw;
-  try { raw = readFileSync(transcriptPath, 'utf8'); } catch { return ids; }
-  for (const line of raw.split('\n')) {
-    if (!line) continue;
-    let entry;
-    try { entry = JSON.parse(line); } catch { continue; }
+  for (const entry of readTranscriptEntries(transcriptPath)) {
     const c = entry.message?.content;
     const text = typeof c === 'string'
       ? c
@@ -612,22 +635,15 @@ export function aggregateProjectCiteRecall(txDir, { cutoff = 0 } = {}) {
  * @returns {boolean}
  */
 export function hasMainThreadAssistantText(transcriptPath) {
-  if (!transcriptPath || !existsSync(transcriptPath)) return false;
-  let raw;
-  try { raw = readFileSync(transcriptPath, 'utf8'); } catch { return false; }
-  // Reverse-iterate so a turn that just produced text returns true on the
-  // FIRST line examined instead of walking the entire transcript. Common case
-  // (model wrote a paragraph → Stop fires) short-circuits in O(1) line parses;
-  // pathological case (no text anywhere) still walks all entries but that's
-  // the degenerate state we want false for anyway. v2.80 perf polish — the
-  // pre-v2.80 forward scan held the full transcript in memory and walked
-  // every line on the common case too.
-  const lines = raw.split('\n');
-  for (let i = lines.length - 1; i >= 0; i--) {
-    const line = lines[i];
-    if (!line || !line.trim()) continue;
-    let entry;
-    try { entry = JSON.parse(line); } catch { continue; }
+  // Reverse-iterate so a turn that just produced text returns true on the FIRST entry
+  // examined instead of walking the whole transcript; the pathological case (no text
+  // anywhere) still walks everything, which is the degenerate state we want false for.
+  // v2.80 polish. The short-circuit is now over an already-parsed array rather than over
+  // JSON.parse calls, so it saves iteration rather than parsing — the parse is shared
+  // with the other seven scanners of the same file (audit P2-8).
+  const entries = readTranscriptEntries(transcriptPath);
+  for (let i = entries.length - 1; i >= 0; i--) {
+    const entry = entries[i];
     if (entry.type !== 'assistant' || !entry.message) continue;
     if (entry.isSidechain === true) continue;
     const content = entry.message.content;

package/lib/cite-back-hint.mjs

@@ -12,7 +12,8 @@
 // Legacy schema   (pre-v2.81):  { "<path>": <number> } — tolerated, never emits.
 
 import { basename, join } from 'path';
-import { readFileSync, existsSync } from 'fs';
+import { readFileSync } from 'fs';
+import { readTranscriptEntries } from './transcript-scan.mjs';
 import { EDIT_TOOLS } from '../utils.mjs';
 
 const MAX_FILES = 2;
@@ -140,19 +141,10 @@ const MEM_SAVE_TOOL_NAMES = new Set([
 ]);
 
 export function countUnsavedBugfixShape(transcriptPath) {
-  const empty = { nudged: 0, saved: 0, unsaved: 0 };
-  if (!transcriptPath || !existsSync(transcriptPath)) return empty;
-  let raw;
-  try { raw = readFileSync(transcriptPath, 'utf8'); } catch { return empty; }
-
   let nudged = 0;
   let saved = 0;
 
-  for (const line of raw.split('\n')) {
-    if (!line.trim()) continue;
-    let entry;
-    try { entry = JSON.parse(line); } catch { continue; }
-
+  for (const entry of readTranscriptEntries(transcriptPath)) {
     // Bugfix-shape hint emissions live in PostToolUse attachment.stdout.
     if (entry.type === 'attachment') {
       const stdout = entry.attachment?.stdout || '';
@@ -281,13 +273,7 @@ const CITE_BACK_ID_RE = /#(\d{1,7})\b/g;
 
 export function extractCiteBackSignals(transcriptPath) {
   const ids = new Set();
-  if (!transcriptPath || !existsSync(transcriptPath)) return ids;
-  let raw;
-  try { raw = readFileSync(transcriptPath, 'utf8'); } catch { return ids; }
-  for (const line of raw.split('\n')) {
-    if (!line.trim()) continue;
-    let entry;
-    try { entry = JSON.parse(line); } catch { continue; }
+  for (const entry of readTranscriptEntries(transcriptPath)) {
     if (entry.type !== 'attachment') continue;
     const stdout = entry.attachment?.stdout || '';
     if (!stdout.includes(CITE_BACK_HINT_LEADER)) continue;

package/lib/doctor-drift.mjs

@@ -82,9 +82,16 @@ export function checkDevDrift(installDir, sourceFiles) {
 // stale in silence: tests/doctor-hook-script-manifest.test.mjs re-derives it from the
 // `command` strings in hooks/hooks.json and asserts equality, so registering a new hook
 // script without classifying it here goes red.
+//
+// `pre-agent-inject.js` moved OUT of this set on 2026-08-22 (audit P2-5): no command line
+// names it any more — `pre-agent-inject.sh` does, and execs the .js only when the feature
+// is switched on. It is still shipped and still executed, so `checkHookScriptDrift` keeps
+// grading it; it now reports as the module class, whose message ("ERR_MODULE_NOT_FOUND at
+// hook time") is the truer description of what its absence does. Same severity either way,
+// which is why this set is documented as driving the MESSAGE, not the grade.
 export const HOOK_SCRIPT_ENTRY_POINTS = new Set([
   'post-tool-use.sh', 'user-prompt-search.js', 'pre-tool-recall.js',
-  'post-tool-recall.js', 'pre-skill-bridge.js', 'pre-agent-inject.js',
+  'post-tool-recall.js', 'pre-skill-bridge.js', 'pre-agent-inject.sh',
   'hook-launcher.mjs',
 ]);
 

package/lib/fast-summary.mjs

@@ -0,0 +1,87 @@
+// The non-LLM session summary — one shape, three callers.
+//
+// Audit 2026-08-22 P2-9. hook.mjs carried three hand-copied versions of "read this
+// session's first prompt and its last few observation titles, scrub them, insert a
+// session_summaries row": the Stop-time fast path, the SessionStart previous-session
+// path, and the SessionStart /exit-restart fallback. They had already drifted — the
+// 13-column INSERT was retyped each time, and the truncation limits split 600/600/400
+// against 300/200. Copy-and-miss on exactly this kind of triplicate is what broke
+// v3.35.2, and the comment in one of these blocks announcing "parity with the other"
+// is the tell that parity was being maintained by hand.
+//
+// NOT collapsed in here: hook-llm.mjs's summary insert. That row is produced by the
+// model and carries two more columns (lessons, key_decisions); it is a different
+// record that happens to share a table, and merging it would mean inventing a shape
+// that fits neither.
+import { scrubRecord } from './scrub-record.mjs';
+import { truncate } from '../format-utils.mjs';
+
+/** Column list + placeholder row, written once. */
+const INSERT_SQL = `
+  INSERT INTO session_summaries
+  (memory_session_id, project, request, investigated, learned, completed, next_steps,
+   remaining_items, files_read, files_edited, notes, created_at, created_at_epoch)
+  VALUES (?, ?, ?, '', '', ?, '', ?, '[]', '[]', ?, ?, ?)
+`;
+
+/**
+ * Per-caller truncation limits. These are NOT unified on purpose: the Stop path stores
+ * roughly twice what the two SessionStart paths do, and every one of these strings is
+ * re-injected into a later session's context. Collapsing them to one number changes how
+ * much text the product injects, which is a measurable behaviour change and not
+ * something a refactor gets to decide. Passed explicitly so the difference is visible
+ * at the call site instead of living in three retyped `truncate(...)` arguments.
+ */
+export const FAST_SUMMARY_LIMITS = {
+  stop:         { request: 200, completed: 600, remaining: 600, notes: 400 },
+  sessionStart: { request: 200, completed: 300, remaining: 200, notes: 400 },
+  exitRestart:  { request: 200, completed: 300, remaining: 200, notes: 400 },
+};
+
+/**
+ * The two reads every fast summary is built from: the session's opening prompt, and the
+ * titles of its most recent observations.
+ * @returns {{request: string, completed: string}} raw (unscrubbed, untruncated) values
+ */
+export function readFastSummarySource(db, sessionId) {
+  const firstPrompt = db.prepare(`
+    SELECT prompt_text FROM user_prompts
+    WHERE content_session_id = ?
+    ORDER BY prompt_number ASC LIMIT 1
+  `).get(sessionId);
+  const recentObs = db.prepare(`
+    SELECT title FROM observations
+    WHERE memory_session_id = ? AND COALESCE(compressed_into, 0) = 0
+    ORDER BY created_at_epoch DESC LIMIT 5
+  `).all(sessionId);
+  return {
+    request: firstPrompt?.prompt_text || '',
+    completed: recentObs.map((o) => o.title).filter(Boolean).join('; '),
+  };
+}
+
+/**
+ * Scrub, truncate, insert. Raw values go into scrubRecord and truncation happens after,
+ * at the bind site — a secret straddling the truncation boundary would otherwise fall
+ * below scrubSecrets' length floors and survive into the row (privacy review, v3.x).
+ * That ordering is the reason this function exists in one copy.
+ *
+ * @param {{request?: string, completed?: string, remaining?: string, notes?: string}} values raw
+ * @param {{request: number, completed: number, remaining: number, notes: number}} limits
+ */
+export function insertFastSummary(db, { sessionId, project, values, limits, now }) {
+  const safe = scrubRecord('session_summaries', {
+    request: values.request || '',
+    completed: values.completed || '',
+    remaining_items: values.remaining || '',
+    notes: values.notes || 'fast',
+  });
+  db.prepare(INSERT_SQL).run(
+    sessionId, project,
+    truncate(safe.request, limits.request),
+    truncate(safe.completed, limits.completed),
+    truncate(safe.remaining_items, limits.remaining),
+    truncate(safe.notes, limits.notes),
+    now.toISOString(), now.getTime(),
+  );
+}

package/lib/get-core.mjs

@@ -15,6 +15,41 @@ export const OBS_FIELDS = ['id', 'type', 'title', 'subtitle', 'narrative', 'text
  *  6-field subset made notes/remaining_items/files_* searchable-but-unrenderable. */
 export const SESSION_DETAIL_FIELDS = ['id', 'request', 'investigated', 'learned', 'completed', 'next_steps', 'remaining_items', 'files_read', 'files_edited', 'notes', 'project', 'created_at', 'memory_session_id', 'prompt_number'];
 
+/** User-prompt detail render set. The CLI face rendered only prompt_text +
+ *  content_session_id while MCP rendered prompt_number and created_at too — the same
+ *  searchable-but-invisible shape SESSION_DETAIL_FIELDS was created to close, reopened on
+ *  the prompt source (audit 2026-08-22, P2-6). */
+export const PROMPT_DETAIL_FIELDS = ['id', 'prompt_text', 'content_session_id', 'prompt_number', 'created_at'];
+
+/** Event detail render set. `body` carries the distilled lesson persistHaikuSummary
+ *  writes (lesson_learned || narrative). */
+export const EVENT_DETAIL_FIELDS = ['id', 'event_type', 'title', 'body', 'project', 'importance', 'file_paths', 'git_sha', 'created_at'];
+
+/**
+ * Fetch user-prompt detail rows, oldest-first.
+ * No access bump: prompts are not ranked, so reading one is not a usage signal.
+ */
+export function fetchPromptDetail(db, ids) {
+  const ph = ids.map(() => '?').join(',');
+  return db.prepare(`SELECT * FROM user_prompts WHERE id IN (${ph}) ORDER BY created_at_epoch ASC`).all(...ids);
+}
+
+/**
+ * Fetch event detail rows, oldest-first.
+ *
+ * The events table has no `created_at` ISO column — only `created_at_epoch`. Both faces
+ * used to derive the ISO string themselves; deriving it once here means EVENT_DETAIL_FIELDS
+ * can name `created_at` like every other field set and neither face special-cases it.
+ */
+export function fetchEventDetail(db, ids) {
+  const ph = ids.map(() => '?').join(',');
+  const rows = db.prepare(`SELECT * FROM events WHERE id IN (${ph}) ORDER BY created_at_epoch ASC`).all(...ids);
+  return rows.map(r => ({
+    ...r,
+    created_at: r.created_at_epoch ? new Date(r.created_at_epoch).toISOString() : null,
+  }));
+}
+
 /**
  * Fetch observation detail rows: bump access_count/last_accessed_at (reading a
  * detail IS an access signal — feeds noisePenalty's ratio guard), run the

package/lib/maintain-core.mjs

@@ -12,7 +12,7 @@
 // auto-maintain block). `ctx` carries the per-caller knobs:
 //   { projectFilter: 'AND project = ?' | '', baseParams: [project?] , staleAge, opCap }
 
-import { COMPRESSED_PENDING_PURGE, computeMinHash, estimateJaccardFromMinHash, jaccardSimilarity } from '../utils.mjs';
+import { COMPRESSED_AUTO, COMPRESSED_PENDING_PURGE, computeMinHash, estimateJaccardFromMinHash, jaccardSimilarity } from '../utils.mjs';
 import { rebuildVocabulary, computeVector, _resetVocabCache, vectorsEnabled, vecTextForRow } from '../tfidf.mjs';
 import { DEDUP_JACCARD_THRESHOLD, MINHASH_PRE_THRESHOLD as MINHASH_PRE_THRESHOLD_SRC, FUZZY_DEDUP_THRESHOLD, FUZZY_BODY_THRESHOLD, MINHASH_PREFILTER } from './dedup-constants.mjs';
 import { liveObsFilterSql } from './inject-search-core.mjs';
@@ -81,6 +81,100 @@ export function selectFuzzyDedupeIds(rows, {
   return removeIds;
 }
 
+/**
+ * Tombstone the ids an auto-dedup pass selected.
+ *
+ * `AND superseded_at IS NULL` is the load-bearing half. Both dedup channels select live
+ * rows and then stamp them, and between those two steps another writer can supersede a
+ * row — `save --supersedes=[#A]` writes A.superseded_by = B's NUMERIC id, and the chain
+ * citation-tracker's decay hand-off and timeline re-anchoring both follow. An unguarded
+ * UPDATE overwrites that numeric chain with the string marker and the chain silently dead-
+ * ends. The window is narrow and the failure is not reproducible on demand, which is
+ * exactly why it survived seven rounds of this invariant being re-broken.
+ *
+ * The exact channel grew this guard in v3.63; the fuzzy channel did not, and the audit of
+ * 2026-08-22 (P2-1) found the asymmetry still open. Both channels now stamp through this
+ * one function, so the guard cannot be present on one and missing on the other.
+ *
+ * @param {object} db open DB handle
+ * @param {number[]} ids observation ids selected for superseding
+ * @param {string} marker superseded_by value ('auto-dedup' | 'auto-dedup-fuzzy')
+ * @returns {number} rows actually stamped — less than ids.length means the guard held
+ */
+export function stampDedupSuperseded(db, ids, marker) {
+  if (!Array.isArray(ids) || ids.length === 0) return 0;
+  const ph = ids.map(() => '?').join(',');
+  const res = db.prepare(
+    `UPDATE observations SET superseded_at = ?, superseded_by = ?
+     WHERE id IN (${ph}) AND superseded_at IS NULL`
+  ).run(Date.now(), marker, ...ids);
+  return res.changes;
+}
+
+/**
+ * Mark auto-compressible observations for one project — the two full-table conditional
+ * UPDATEs that used to run inside the SessionStart transaction on every single boot
+ * (audit 2026-08-22, P2-11). They are maintenance by definition: nothing about a new
+ * session makes a 30-day-old row newly compressible, and the same 24h auto-maintain gate
+ * that guards decay/purge/backup was already sitting right next to them.
+ *
+ * Both predicates are unchanged, including the project scope — this moves *when* the
+ * marking runs, not *what* it marks.
+ *
+ * @param {object} db open DB handle
+ * @param {string} project project scope (unchanged from the SessionStart behavior)
+ * @param {object} [opts]
+ * @param {number} [opts.agedAgeMs] age floor for the general 30d pass
+ * @param {number} [opts.noiseAgeMs] age floor for the accelerated 7d LOW_SIGNAL pass
+ * @returns {{aged: number, noise: number}} rows marked by each pass
+ */
+export function markAutoCompressible(db, project, {
+  agedAgeMs = 30 * DAY_MS,
+  noiseAgeMs = 7 * DAY_MS,
+} = {}) {
+  if (!project) return { aged: 0, noise: 0 };
+  const now = Date.now();
+
+  // v2.56.0 #4: protect injection_count > 0 obs (proven contextually relevant via
+  // hook-memory injection, even if the user never explicitly fetched them).
+  // `<= 1` (was `= 1`): citation-decay floors importance at 0 and the LLM low-signal
+  // filter saves at imp=0 — those rows are STRICTLY lower value than imp=1 yet escaped
+  // GC, accumulating to ~40% of a mature DB (immortal: hidden from injection by the
+  // imp>=1 floor, but visible as explicit-search noise).
+  // v3.23: never auto-hide a row that carries a real lesson — compression folds sources
+  // into a title-only summary (lesson lost) and COMPRESSED_AUTO hides the row from search
+  // entirely (audit: 62 lessons buried this way).
+  const aged = db.prepare(`
+    UPDATE observations SET compressed_into = ${COMPRESSED_AUTO}
+    WHERE COALESCE(compressed_into, 0) = 0
+      AND COALESCE(importance, 1) <= 1
+      AND COALESCE(injection_count, 0) = 0
+      AND (lesson_learned IS NULL OR lesson_learned = '' OR lesson_learned = 'none')
+      AND created_at_epoch < ?
+      AND project = ?
+  `).run(now - agedAgeMs, project).changes;
+
+  // v2.47 P0-3: accelerated pass for LOW_SIGNAL + no-signal noise — 7 days instead of 30.
+  // The write-side capNoiseImportance already forces imp=1 on these; this only shrinks GC
+  // latency so the corpus reduction materializes within a week instead of bleeding into
+  // the 30-day tier.
+  const noise = db.prepare(`
+    UPDATE observations SET compressed_into = ${COMPRESSED_AUTO}
+    WHERE COALESCE(compressed_into, 0) = 0
+      AND COALESCE(importance, 1) <= 1
+      AND (lesson_learned IS NULL OR lesson_learned = '' OR lesson_learned = 'none')
+      AND (facts IS NULL OR facts = '' OR facts = '[]')
+      AND (
+        title LIKE 'Modified %' OR title LIKE 'Worked on %'
+        OR title LIKE 'Reviewed %' OR title LIKE 'Error%'
+      )
+      AND created_at_epoch < ?
+      AND project = ?
+  `).run(now - noiseAgeMs, project).changes;
+
+  return { aged, noise };
+}
+
 /** Delete broken observations (no title AND no narrative). Returns rows deleted. */
 // Before hard-deleting observations, un-hide any rows merged INTO them. A child has
 // compressed_into = <keeperId>; deleting that keeper (compressed_into has no FK) would

package/lib/persist-reminder.mjs

@@ -11,7 +11,7 @@
 // the context). Remind-only by design: false positives cost one line, so the
 // signal list stays conservative and never auto-writes anything.
 
-import { readFileSync, existsSync } from 'fs';
+import { readTranscriptEntries } from './transcript-scan.mjs';
 
 // Distinctive finalization word forms (CJK + EN). Deliberately NOT included:
 // "方案 A 定" and bare "定" (too FP-prone), bare "ok/好" (noise). The list is
@@ -62,14 +62,14 @@ const MEMDIR_WRITE_RE = /[\\/]\.claude[\\/]projects[\\/][^\\/]+[\\/]memory[\\/][
  * `save` / `defer add`) in the session transcript. 0 on missing/unreadable.
  */
 export function countDeliberatePersistence(transcriptPath) {
-  if (!transcriptPath || !existsSync(transcriptPath)) return 0;
-  let raw;
-  try { raw = readFileSync(transcriptPath, 'utf8'); } catch { return 0; }
+  // Shares the Stop-time parse (lib/transcript-scan.mjs) rather than doing its own
+  // read+split+parse. It was the NINTH scanner of the same file and was missed when the
+  // other eight were collapsed — sitting two lines away from two that were migrated, so
+  // it was quietly charging a full re-parse (~20-25ms on a 5.7MB transcript) against a
+  // pass whose whole point was to stop doing that. Missing/unreadable paths still yield
+  // 0, because readTranscriptEntries returns [] for them.
   let count = 0;
-  for (const line of raw.split('\n')) {
-    if (!line.trim()) continue;
-    let entry;
-    try { entry = JSON.parse(line); } catch { continue; }
+  for (const entry of readTranscriptEntries(transcriptPath)) {
     if (entry.type !== 'assistant' && entry.message?.role !== 'assistant') continue;
     const content = entry.message?.content;
     if (!Array.isArray(content)) continue;

package/lib/registry-core.mjs

@@ -0,0 +1,94 @@
+// Shared body for the registry write actions — import / remove / reindex.
+//
+// These were the last un-collapsed CLI/MCP twin (audit 2026-08-22 P1-3): mem-cli.mjs and
+// server.mjs each wrote their own SQL for the same three actions, and had already drifted —
+// the CLI granted a user-initiated import `quality_tier = 'installed'` and the MCP twin did
+// not, so the same intent produced differently-ranked rows depending on which surface the
+// user reached for. That is this project's first-listed病类 ("a guard wired into one face,
+// missing on the other"), so the fix is a single body both faces call, not a second patch.
+//
+// Contract: these functions decide and write. They return structured results and never
+// format output or touch process state — rendering (and CLI-only concerns like bare-flag
+// rejection or the "add --capability-summary" tip) stays in the surface.
+
+import { upsertResource } from '../registry.mjs';
+
+/**
+ * String columns an import may set, in canonical snake_case. Single source: the CLI derives
+ * its kebab-case flag names from this list, the MCP tool reads its args by these keys, so a
+ * new column is added once and both surfaces pick it up.
+ */
+export const IMPORT_STRING_FIELDS = [
+  'repo_url',
+  'local_path',
+  'invocation_name',
+  'intent_tags',
+  'domain_tags',
+  'trigger_patterns',
+  'capability_summary',
+  'keywords',
+  'tech_stack',
+  'use_cases',
+];
+
+/**
+ * Resolve the `source` column for an import.
+ *
+ * Preserve provenance on a metadata-only re-import: default to 'user' only for a genuinely
+ * NEW resource. Re-importing an existing github/preinstalled row without an explicit source
+ * must not flip it to 'user' (which also mis-grants the user-source rank boost).
+ */
+function resolveSource(db, { type, name, source }) {
+  if (source) return source;
+  const existing = db.prepare('SELECT source FROM resources WHERE type = ? AND name = ?').get(type, name);
+  return existing ? existing.source : 'user';
+}
+
+/**
+ * Upsert one resource.
+ *
+ * @param {object} db  open resource-registry.db handle
+ * @param {object} params
+ * @param {string} params.name
+ * @param {string} params.type              'skill' | 'agent'
+ * @param {string} [params.source]          explicit provenance; absent = user-initiated
+ * @param {object} [params.fields]          IMPORT_STRING_FIELDS values (snake_case keys)
+ * @returns {{id: number, source: string, installedTierGranted: boolean}}
+ */
+export function importResource(db, { name, type, source, fields = {} }) {
+  const resolvedSource = resolveSource(db, { type, name, source });
+
+  const row = { name, type, status: 'active', source: resolvedSource };
+  for (const f of IMPORT_STRING_FIELDS) row[f] = fields[f] || '';
+
+  const id = upsertResource(db, row);
+
+  // A user-initiated import (no explicit --source/source arg) means the user deliberately
+  // added this resource — it gets the 'installed' quality tier, which the retriever reads as
+  // a ranking bonus and the recommendation gate reads as a precision signal.
+  const installedTierGranted = Boolean(id) && !source;
+  if (installedTierGranted) {
+    db.prepare("UPDATE resources SET quality_tier = 'installed' WHERE id = ?").run(id);
+  }
+
+  return { id, source: resolvedSource, installedTierGranted };
+}
+
+/**
+ * Delete one resource.
+ * @returns {{removed: boolean}} removed=false means nothing matched (not an error).
+ */
+export function removeResource(db, { name, type }) {
+  const result = db.prepare('DELETE FROM resources WHERE type = ? AND name = ?').run(type, name);
+  return { removed: result.changes > 0 };
+}
+
+/**
+ * Rebuild the FTS5 index over the resources table.
+ * @returns {{activeCount: number}}
+ */
+export function reindexResources(db) {
+  db.exec("INSERT INTO resources_fts(resources_fts) VALUES('rebuild')");
+  const row = db.prepare('SELECT COUNT(*) as c FROM resources WHERE status = ?').get('active');
+  return { activeCount: row.c };
+}