claude-mem-lite 3.83.0 → 3.84.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "3.83.0",
+      "version": "3.84.0",
       "source": "./",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."
     }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.83.0",
+  "version": "3.84.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/README.md

@@ -163,7 +163,9 @@ Plugin mode manages its own hooks/runtime. On session start it only **checks and
 
 > **The plugin install is complete on its own** — hooks, MCP tools, and the bundled slash commands (`/mem`, `/lesson`, `/bug`, `/adopt`) all run from the plugin with no second step. The slash commands invoke the bundled CLI by an absolute path resolved from the plugin directory (`${CLAUDE_PLUGIN_ROOT}/cli.mjs <cmd>`), so they work without anything on your `PATH`. A global `claude-mem-lite` **shell** command (for running queries yourself in a terminal) is **optional** — `npm i -g claude-mem-lite` — and is a *separate* npm install: the plugin's auto-update does **not** refresh it, so re-run `npm i -g claude-mem-lite@latest` if you want that shell command kept in sync. You do **not** need it for the plugin to be fully functional.
 
-> **Auto-adopt fires on the first SessionStart per project (v2.82.1+).** The plugin automatically writes the **invited-memory sentinel** (a system-authority pointer that boosts Claude's proactive use of `mem_recall` / `mem_save`) into the project's memdir — **no manual `/adopt` needed**, regardless of install path (npm, npx, `/plugin`, manual). Per-project opt-out: `claude-mem-lite adopt --disable` (`--enable` to re-arm). Global opt-out: `export MEM_NO_AUTO_ADOPT=1`. Manual `/adopt` remains available for re-applying after edits and for the `--all` batch path.
+> **Auto-adopt writes into your project, on every SessionStart (v3.13+).** The plugin adds a slug-scoped **managed block** to your project's own **`<cwd>/CLAUDE.md`** — a file that is normally committed to git — plus a `<cwd>/.claude/plugin_claude_mem_lite.md` detail file. The block is a system-authority pointer that boosts Claude's proactive use of `mem_recall` / `mem_save`. Everything outside the block is preserved verbatim, and it coexists with other plugins' blocks in the same file ([details](#invited-memory-v232)). This happens on **every** SessionStart, not just the first: the sync is idempotent and re-applies the block if it is edited away, and refreshes it when the shipped template changes. It applies regardless of install path (npm, npx, `/plugin`, manual), so **no manual `/adopt` is needed**.
+>
+> Opt out per project with `claude-mem-lite adopt --disable` (`--enable` to re-arm), globally with `export MEM_NO_AUTO_ADOPT=1`, or freeze an already-adopted block against template refreshes with `CLAUDE_MEM_NO_TEMPLATE_REFRESH=1`. `claude-mem-lite unadopt` removes the block and the detail file. Manual `/adopt` remains available for re-applying after edits and for the `--all` batch path.
 
 ### Method 2: npx (one-liner)
 
@@ -355,8 +357,11 @@ Slash commands `/adopt` and `/unadopt` wrap the same CLI.
   ever rewritten, and duplicate / CRLF-orphaned copies are collapsed to one.
   Unlike the legacy `MEMORY.md` scheme there is no line-budget gate — `CLAUDE.md`
   has no truncation cap.
-- **Auto-adopt fires on the first SessionStart per project for any install
-  path (v2.82.1+).** Per-project opt-out: `claude-mem-lite adopt --disable`
+- **Auto-adopt runs on EVERY SessionStart, for any install path (v2.82.1+;
+  target moved from the memdir to `<cwd>/CLAUDE.md` in v3.13).** The sync is
+  idempotent — it re-applies the managed block if it was edited away and
+  refreshes it when the shipped template changes (freeze with
+  `CLAUDE_MEM_NO_TEMPLATE_REFRESH=1`). Per-project opt-out: `claude-mem-lite adopt --disable`
   (writes a durable `<memdir>/.mem-no-auto-adopt` sentinel that survives marker
   deletion / plugin reinstalls). Global opt-out: `MEM_NO_AUTO_ADOPT=1`.
   Pre-v2.82.1 the `CLAUDE_PLUGIN_ROOT` gate left auto-adopt unreachable for
@@ -783,8 +788,8 @@ claude-mem-lite.
 | `OPENROUTER_MODEL` | Overrides the OpenRouter model slug for **all** background calls (e.g. `openai/gpt-4o-mini`, `qwen/qwen-2.5-72b-instruct`). When unset, the `CLAUDE_MEM_MODEL` tier maps to `anthropic/claude-haiku-4.5` (haiku) or `anthropic/claude-sonnet-4.5` (sonnet). | _(tier default)_ |
 | `CLAUDE_MEM_DEBUG` | Enable debug logging (`1` to enable). | _(disabled)_ |
 | `MEM_QUIET_HOOKS` | Low-noise hooks. `1` drops the `File Lessons` / `Key Context` sections from SessionStart injection, the lesson suffix from `[mem] Related memories`, and the `WHEN TO USE` / `Decision rules` blocks from MCP server instructions. IDs and the `Recent` table still surface so `mem_get(ids=[…])` remains reachable. Intended for users running the invited-memory adopt path or who otherwise want minimal auto-injection. **Since v2.82.0 this env no longer gates auto-adopt — use `MEM_NO_AUTO_ADOPT=1` for that.** | _(disabled)_ |
-| `MEM_NO_AUTO_ADOPT` | Global opt-out for auto-adopt (v2.82.0+). `1` prevents the first-SessionStart auto-write of the invited-memory sentinel across **all** projects. For per-project opt-out use `claude-mem-lite adopt --disable` instead (writes a durable `<memdir>/.mem-no-auto-adopt` sentinel that survives marker deletion). | _(disabled)_ |
-| `MEM_NO_ADOPT_HINT` | Silences the one-line "Invited-memory 未启用：`claude-mem-lite adopt`…" hint that SessionStart appends when the current project hasn't been adopted. Since v2.82.1 auto-adopt fires on first SessionStart for any install path, so this hint typically surfaces only when you've explicitly opted out (`MEM_NO_AUTO_ADOPT=1` or `claude-mem-lite adopt --disable`). | _(disabled)_ |
+| `MEM_NO_AUTO_ADOPT` | Global opt-out for auto-adopt (v2.82.0+). `1` prevents the per-SessionStart auto-write of the `CLAUDE.md` managed block across **all** projects. For per-project opt-out use `claude-mem-lite adopt --disable` instead (writes a durable `<memdir>/.mem-no-auto-adopt` sentinel that survives marker deletion). | _(disabled)_ |
+| `MEM_NO_ADOPT_HINT` | Silences the one-line "Invited-memory 未启用：`claude-mem-lite adopt`…" hint that SessionStart appends when the current project hasn't been adopted. Since v2.82.1 auto-adopt runs on every SessionStart for any install path, so this hint typically surfaces only when you've explicitly opted out (`MEM_NO_AUTO_ADOPT=1` or `claude-mem-lite adopt --disable`). | _(disabled)_ |
 
 ### What gets injected into your context
 
@@ -841,6 +846,7 @@ benchmark and A/B harness are calibrated against — changing them invalidates t
 | `CLAUDE_MEM_CITE_NUDGE_THRESHOLD` | Cite-rate below which the nudge fires. | `0.6` |
 | `CLAUDE_MEM_CITE_NUDGE_MIN_INJECTED` | Minimum injection volume before the ratio gate is judged at all. | `5` |
 | `CLAUDE_MEM_CITE_NUDGE_SILENCE_AFTER` | Consecutive low-cite sessions before the nudge goes quiet; `0` = never silence. | `3` |
+| `CLAUDE_MEM_CITATION_RELEVANCE_GATE` | Stop credits an `access_count` to a memory the session cited only when something made that memory relevant to the session — it was injected, or you typed its `#NN` yourself. `off` restores the pre-v3.84.0 behaviour of crediting every `#NN` the assistant wrote, which over-counts sessions that discuss memories in prose (release notes, audit reports): measured on real transcripts, 267 of 859 credited (id, session) pairs — 31.1% — were mentions nothing had put in front of the model. Superseded citations are redirected to their keeper on both settings. | _(on)_ |
 | `CLAUDE_MEM_SUBAGENT_DECAY` | The `subagent` injection face feeds the decay loop: memories handed to a dispatched agent enter the denominator, and the citation that agent makes in its own transcript counts as the numerator. `0` returns the face to metered-but-never-decaying (v3.77–v3.82). | _(on)_ |
 | `CLAUDE_MEM_METRICS` | `1` records feature-injection counters surfaced by `claude-mem-lite stats`. | _(off)_ |
 

package/README.zh-CN.md

@@ -152,7 +152,9 @@ node install.mjs install
 1. **安装依赖** -- `npm install --omit=dev`（编译原生 `better-sqlite3`）
 2. **注册 MCP 服务器** -- `mem-lite` 服务器，包含 20 个工具（9 个核心通过 `tools/list` 暴露 + 11 个隐藏但可调；完整表见 Usage 段）。v2.78 前服务器名为通用的 `mem`，现已改名为 `mem-lite` 避免与用户其它 `.mcp.json` 冲突；工具名（`mem_search`/`mem_recall` 等）保持不变。
 
-> **首次 SessionStart 自动 adopt（v2.82.1+）。** 插件会自动向该项目 memdir 写入**邀请式 memory 哨兵**（一条提升 Claude 主动调用 `mem_recall` / `mem_save` 的 system-authority 指针），**任何安装路径都生效**（npm、npx、`/plugin`、手动），**无需再手动跑 `/adopt`**。项目级关闭：`claude-mem-lite adopt --disable`（重新启用用 `--enable`）。全局关闭：`export MEM_NO_AUTO_ADOPT=1`。手动 `/adopt` 仍保留用于编辑后重写或 `--all` 批量场景。
+> **自动 adopt 会写进你的项目，且每次 SessionStart 都跑（v3.13+）。** 插件向**项目自己的 `<cwd>/CLAUDE.md`**（通常是会进 git 的文件）写入一个 slug 限定的**托管块**，外加 `<cwd>/.claude/plugin_claude_mem_lite.md` 详情文件。该块是一条提升 Claude 主动调用 `mem_recall` / `mem_save` 的 system-authority 指针；块以外的内容逐字保留，也能与其它插件的块共存于同一文件。这是**每次** SessionStart 都做的幂等同步，不只是第一次——块被删掉会重新写回，出货模板变了会刷新。**任何安装路径都生效**（npm、npx、`/plugin`、手动），**无需再手动跑 `/adopt`**。
+>
+> 关闭方式：项目级 `claude-mem-lite adopt --disable`（重新启用用 `--enable`）；全局 `export MEM_NO_AUTO_ADOPT=1`；只冻结模板刷新用 `CLAUDE_MEM_NO_TEMPLATE_REFRESH=1`。`claude-mem-lite unadopt` 可移除托管块与详情文件。手动 `/adopt` 仍保留用于编辑后重写或 `--all` 批量场景。
 3. **配置钩子** -- `PostToolUse`、`PreToolUse`、`SessionStart`、`Stop`、`UserPromptSubmit` 生命周期钩子
 4. **创建数据目录** -- `~/.claude-mem-lite/`（隐藏目录），存放数据库、运行时和托管资源文件
 5. **自动迁移** -- 自动检测 `~/.claude-mem/`（原版 claude-mem）或 `~/claude-mem-lite/`（v0.5 前的非隐藏目录），将数据库和运行时文件迁移到 `~/.claude-mem-lite/`，原目录保持不变
@@ -297,7 +299,9 @@ Slash 命令 `/adopt` 和 `/unadopt` 是上述 CLI 的包装。
 - Hash 守护：你手动改了 sentinel 段 → 下一次 adopt 报 `UserEditedError`，
   除非显式 `--force`。
 - 预算门：MEMORY.md 已 >180 行时拒绝新增（避开 Claude Code 200 行截断）。
-- **任何安装路径首次 SessionStart 自动 adopt（v2.82.1+）。** 项目级关闭：
+- **任何安装路径每次 SessionStart 都自动 adopt（v2.82.1+；v3.13 起写入目标由
+  memdir 改为 `<cwd>/CLAUDE.md`）。** 同步是幂等的——托管块被删会写回，出货模板
+  变化会刷新（用 `CLAUDE_MEM_NO_TEMPLATE_REFRESH=1` 冻结）。项目级关闭：
   `claude-mem-lite adopt --disable`（写 `<memdir>/.mem-no-auto-adopt` 哨兵，
   存活于 marker 删除 / 插件重装）。全局关闭：`export MEM_NO_AUTO_ADOPT=1`。
   v2.82.1 前因 `CLAUDE_PLUGIN_ROOT` gate 与 `install.mjs` 写出的 hook 命令
@@ -614,8 +618,8 @@ npm run benchmark:gate    # CI 门控：指标回退超过 5% 容差时失败
 | `OPENROUTER_MODEL` | 覆盖**所有**后台调用的 OpenRouter 模型 slug（如 `openai/gpt-4o-mini`、`qwen/qwen-2.5-72b-instruct`）。未设时按 `CLAUDE_MEM_MODEL` 分层映射到 `anthropic/claude-haiku-4.5`（haiku）或 `anthropic/claude-sonnet-4.5`（sonnet）。 | _(分层默认)_ |
 | `CLAUDE_MEM_DEBUG` | 启用调试日志（设为 `1` 启用）。 | _(禁用)_ |
 | `MEM_QUIET_HOOKS` | 低噪声 hook。设为 `1` 时，SessionStart 注入去掉 `File Lessons` / `Key Context` 两节，`[mem] Related memories` 去掉 lesson 后缀，MCP server instructions 去掉 `WHEN TO USE` / `Decision rules` 两段。ID 与 `Recent` 表仍保留，`mem_get(ids=[…])` 可继续展开细节。适用于启用了 invited-memory adopt 流程或偏好最小化自动注入的用户。**v2.82.0 起此 env 不再阻挡 auto-adopt——如需关闭 auto-adopt 用 `MEM_NO_AUTO_ADOPT=1`。** | _(禁用)_ |
-| `MEM_NO_AUTO_ADOPT` | auto-adopt 全局关闭开关（v2.82.0+）。设为 `1` 阻止首次 SessionStart 在**所有**项目自动写入邀请式 memory 哨兵。项目级关闭走 `claude-mem-lite adopt --disable`（写 `<memdir>/.mem-no-auto-adopt` 哨兵，存活于 marker 删除）。 | _(禁用)_ |
-| `MEM_NO_ADOPT_HINT` | 静音当前项目未 adopt 时 SessionStart 追加的那一行 "Invited-memory 未启用…" 提示。v2.82.1 起任何安装路径首次 SessionStart 都自动 adopt，所以该提示一般只在你显式 opt out（`MEM_NO_AUTO_ADOPT=1` 或 `claude-mem-lite adopt --disable`）的项目才会出现。 | _(禁用)_ |
+| `MEM_NO_AUTO_ADOPT` | auto-adopt 全局关闭开关（v2.82.0+）。设为 `1` 阻止每次 SessionStart 在**所有**项目自动写入 `CLAUDE.md` 托管块。项目级关闭走 `claude-mem-lite adopt --disable`（写 `<memdir>/.mem-no-auto-adopt` 哨兵，存活于 marker 删除）。 | _(禁用)_ |
+| `MEM_NO_ADOPT_HINT` | 静音当前项目未 adopt 时 SessionStart 追加的那一行 "Invited-memory 未启用…" 提示。v2.82.1 起任何安装路径每次 SessionStart 都自动 adopt，所以该提示一般只在你显式 opt out（`MEM_NO_AUTO_ADOPT=1` 或 `claude-mem-lite adopt --disable`）的项目才会出现。 | _(禁用)_ |
 
 ## 许可证
 

package/hook-context.mjs

@@ -16,19 +16,14 @@ import { STALE_SESSION_MS, FALLBACK_OBS_WINDOW_MS, RUNTIME_DIR, effectiveQuiet,
 import { extractUnfinishedSummary } from './hook-handoff.mjs';
 import { recentInjectableEvents, renderInjectableEvent } from './lib/events-injection.mjs';
 import { liveObsFilterSql } from './lib/inject-search-core.mjs';
+// The canonical one (v3.84.0): this file carried a byte-identical private copy, which is
+// the same one-home rule this release enforced for the cooldown path and the dashboard.
+import { inferProjectDir } from './project-utils.mjs';
 // Single source for the type-quality weights (audit 2026-08-22 P2-10) — this table used
 // to be hand-copied here and in hook-memory.mjs, kept equal only by comment convention.
 import { TYPE_QUALITY, TYPE_QUALITY_DEFAULT } from './scoring-sql.mjs';
 
 import { DAY_MS } from './lib/time-constants.mjs';
-/**
- * Infer the project directory from environment variables or cwd.
- * @returns {string} Absolute path to the project directory
- */
-function inferProjectDir() {
-  return process.env.CLAUDE_PROJECT_DIR || process.env.PWD || process.cwd();
-}
-
 /**
  * Compute adaptive recall time windows based on project activity velocity.
  * High activity -> shorter windows (recent data more relevant).

package/hook-llm.mjs

@@ -25,6 +25,7 @@ import { episodeHasSignificantContent } from './hook-episode.mjs';
 import { OBS_TYPE_SET } from './lib/obs-types.mjs';
 
 import { DAY_MS } from './lib/time-constants.mjs';
+import { liveObsFilterSql } from './lib/inject-search-core.mjs';
 // T9: memdir-incompatible types live in the `events` table, not `observations`.
 // Set lookup is O(1) — authoritative source is lib/activity.mjs::EVENT_TYPES.
 const EVENT_TYPE_SET = new Set(EVENT_TYPES);
@@ -351,7 +352,18 @@ export function persistHaikuSummary(db, summary, ctx) {
 
     if (ctx.preSavedObsId) {
       const id = db.transaction(() => {
-        db.prepare(`DELETE FROM observations WHERE id = ?`).run(ctx.preSavedObsId);
+        // Same live-row guard as the in-place upgrade (FLOW-7). If auto-dedup superseded
+        // or compressed the pre-saved row while this worker was in flight, that row is no
+        // longer ours to hard-delete — a keeper may have absorbed it, and children can
+        // point at it through compressed_into. Leave it to the maintenance path, which
+        // recovers children before deleting; the event still gets written either way.
+        const removed = db.prepare(
+          `DELETE FROM observations WHERE id = ? AND ${liveObsFilterSql('')}`,
+        ).run(ctx.preSavedObsId).changes;
+        if (removed === 0) {
+          debugLog('DEBUG', 'llm-episode',
+            `upgrade-delete: pre-saved obs #${ctx.preSavedObsId} no longer live — left in place`);
+        }
         return insertEvent();
       })();
       return { table: 'events', id };
@@ -1014,12 +1026,18 @@ ${actionList}`;
           lesson_learned: obs.lessonLearned || null,
           search_aliases: obs.searchAliases || null,
         });
-        db.prepare(`
+        // The live-row guard (FLOW-7, 2026-08-29 audit). This worker is 2-5s behind the
+        // foreground pre-save, and auto-dedup can supersede or compress that row inside
+        // the window. An unguarded `WHERE id = ?` then writes the whole enrichment onto a
+        // tombstone: `changes` is 1, nothing looks wrong, and the row it landed on is
+        // excluded from every read face by liveObsFilterSql. Same clause as those read
+        // faces, so "what the update may touch" and "what a query may return" cannot drift.
+        const upgraded = db.prepare(`
           UPDATE observations SET type=?, title=?, subtitle=?,
             narrative=COALESCE(NULLIF(?, ''), narrative), concepts=?, facts=?,
             text=?, importance=?, files_read=?, minhash_sig=?, lesson_learned=?, search_aliases=?,
             scope=COALESCE(?, scope)
-          WHERE id = ?
+          WHERE id = ? AND ${liveObsFilterSql('')}
         `).run(
           obs.type, safe.title, safe.subtitle,
           safe.narrative,
@@ -1031,23 +1049,38 @@ ${actionList}`;
           safe.search_aliases,
           normalizeScope(obs.scope),
           episode.savedId
-        );
-        savedId = episode.savedId;
-        savedTable = 'observations';
-        debugLog('DEBUG', 'llm-episode', `upgraded pre-saved obs #${savedId}`);
-
-        // Update TF-IDF vector with enriched content
-        try {
-          const vocab = getVocabulary(db);
-          if (vocab) {
-            const vecText = vecTextForRow({ title: obs.title, narrative: obs.narrative, concepts: conceptsText, lesson_learned: safe.lesson_learned, search_aliases: safe.search_aliases });
-            const vec = computeVector(vecText, vocab);
-            if (vec) {
-              db.prepare('INSERT OR REPLACE INTO observation_vectors (observation_id, vector, vocab_version, created_at_epoch) VALUES (?, ?, ?, ?)')
-                .run(savedId, Buffer.from(vec.buffer), vocab.version, Date.now());
+        ).changes;
+
+        if (upgraded === 0) {
+          // The pre-saved row is gone or tombstoned. Dropping the enrichment here is the
+          // silent-loss shape this repository keeps paying for, so save it as a fresh row
+          // and let the normal dedup path decide whether it merges into the keeper.
+          debugLog('DEBUG', 'llm-episode',
+            `pre-saved obs #${episode.savedId} no longer live — saving enrichment as a fresh row`);
+          const result = persistHaikuSummary(db, obsToSummary(obs), {
+            project: episode.project,
+            session_id: episode.sessionId,
+          });
+          savedId = result.id;
+          savedTable = result.table;
+        } else {
+          savedId = episode.savedId;
+          savedTable = 'observations';
+          debugLog('DEBUG', 'llm-episode', `upgraded pre-saved obs #${savedId}`);
+
+          // Update TF-IDF vector with enriched content
+          try {
+            const vocab = getVocabulary(db);
+            if (vocab) {
+              const vecText = vecTextForRow({ title: obs.title, narrative: obs.narrative, concepts: conceptsText, lesson_learned: safe.lesson_learned, search_aliases: safe.search_aliases });
+              const vec = computeVector(vecText, vocab);
+              if (vec) {
+                db.prepare('INSERT OR REPLACE INTO observation_vectors (observation_id, vector, vocab_version, created_at_epoch) VALUES (?, ?, ?, ?)')
+                  .run(savedId, Buffer.from(vec.buffer), vocab.version, Date.now());
+              }
             }
-          }
-        } catch (e) { debugCatch(e, 'handleLLMEpisode-vector'); }
+          } catch (e) { debugCatch(e, 'handleLLMEpisode-vector'); }
+        }
       }
     } else {
       // Clean insert (no pre-save) — dispatcher routes by type.

package/hook-shared.mjs

@@ -30,6 +30,16 @@ export const EPISODE_TIME_GAP_MS = 5 * 60 * 1000;       // 5 min
 export const SESSION_EXPIRY_MS = 12 * 60 * 60 * 1000;    // 12h
 export const STALE_SESSION_MS = 24 * 60 * 60 * 1000;     // 24h
 export const STALE_LOCK_MS = 30000;                       // 30s
+
+// The background-maintenance mutex, defined HERE next to the sweeper policy it has to
+// escape. cleanStaleLockFiles() below unlinks any `*.lock` older than STALE_LOCK_MS
+// WITHOUT checking whether the holder is alive — right for the episode lock's millisecond
+// critical section, fatal for a maintenance pass that runs for seconds to minutes. The
+// name therefore ends in `.proclock`, and `tests/auto-maintain-proc-lock.test.mjs` asserts
+// that against THIS constant rather than a re-typed copy: the first version of that test
+// built its own path from a literal, so renaming the lock left it green with the hazard
+// back. proc-lock's own staleness policy (age OR provably-dead pid) is the correct one.
+export const AUTO_MAINTAIN_LOCK = 'auto-maintain.proclock';
 export const DEDUP_WINDOW_MS = 5 * 60 * 1000;            // 5 min (title dedup)
 export const RELATED_OBS_WINDOW_MS = 7 * DAY_MS;       // 7 days
 export const FALLBACK_OBS_WINDOW_MS = RELATED_OBS_WINDOW_MS; // same window
@@ -108,13 +118,35 @@ export function sweepOrphanEpisodeFiles(runtimeDir, { ageMs = ORPHAN_EPISODE_AGE
   const readsCutoff = now - readsAgeMs;
   let count = 0;
   for (const f of entries) {
-    // `.claim-` = handleStop's lock-contended fallback claim file (ep-<project>.json.claim-<pid>-<ts>),
-    // which leaks if the process dies between rename and unlink; sweep it on the same 1h cutoff.
-    const isEpisode = f.startsWith('ep-flush-') || f.startsWith('pending-') || f.includes('.claim-');
+    // Crash residue: this runtime dir writes four families of temp name, each the middle
+    // of a rename-or-unlink pair that leaks if the process dies between the two steps.
+    // The predicate covered only `.claim-`, whose comment states the reason it exists —
+    // and the other three are that same window (audit FLOW-3):
+    //   .claim-   handleStop's lock-contended fallback   (hook.mjs)
+    //   .collect- the reads-file rename a flush performs (hook.mjs)
+    //   .trim-    the reads-file truncation              (hook.mjs)
+    //   .tmp-     every atomic write                     (hook-episode.mjs, atomicWrite)
+    // Neither of the old clauses could reach them: `reads-<p>.txt.collect-<ts>` does not
+    // end in `.txt`, and `ep-<p>.json.tmp-<pid>` does not start with `ep-flush-`.
+    //
+    // Anchored to the END of the name, and the reason is not the one first written here.
+    // The original note claimed it protected `reads-x.tmp-y.txt` from the short clock; it
+    // does not — that name ends in `.txt`, so `isReads` picks the 24h cutoff either way,
+    // and dropping the anchor killed no test (caught by a pre-tag reviewer). What the
+    // anchor actually protects is the LIVE episode buffer of a project whose sanitized
+    // name contains the token: `ep-x.tmp-y.json` matches an unanchored pattern, and would
+    // then be swept as residue one hour into a session that is still using it.
+    const isCrashResidue = /\.(claim|collect|trim|tmp)-[^.]*$/.test(f);
+    const isEpisode = f.startsWith('ep-flush-') || f.startsWith('pending-');
     const isReads = f.startsWith('reads-') && f.endsWith('.txt');
-    if (!isEpisode && !isReads) continue;
+    if (!isCrashResidue && !isEpisode && !isReads) continue;
     const full = join(runtimeDir, f);
     try {
+      // Residue takes the short cutoff and a live tracker takes the 24h one, with no
+      // tie-break needed: residue always APPENDS its suffix, so it never ends in `.txt`
+      // and `isReads` is already false for it. (A `&& !isCrashResidue` tie-break was
+      // written here first and no mutation could kill it — it was guarding a state the
+      // two predicates cannot both be in.)
       if (statSync(full).mtimeMs < (isReads ? readsCutoff : cutoff)) {
         unlinkSync(full);
         count++;

package/hook.mjs

@@ -29,6 +29,13 @@ import {
   formatErrorRecallHints,
   MAX_HOOK_STDIN_BYTES,
 } from './utils.mjs';
+// Direct import (not via the utils.mjs barrel): the barrel's re-exports are a v2.21
+// backward-compat surface that knip already lists as unused; new shared symbols go to
+// their canonical module.
+import { inferProjectDir } from './project-utils.mjs';
+// Aliased: `acquireLock` from hook-episode.mjs below is the episode buffer's own
+// (argument-less) lock — a different mutex with a different staleness policy.
+import { acquireLock as acquireProcLock } from './lib/proc-lock.mjs';
 import {
   readEpisodeRaw, episodeFile,
   acquireLock, releaseLock, readEpisode, writeEpisode,
@@ -39,7 +46,7 @@ import { cleanupClaudeMdLegacyBlock, buildSessionContextLines } from './hook-con
 import { entry as preCompactEntry } from './hook-precompact.mjs';
 import {
   RUNTIME_DIR, EPISODE_BUFFER_SIZE, EPISODE_TIME_GAP_MS,
-  SESSION_EXPIRY_MS, STALE_SESSION_MS, STALE_LOCK_MS,
+  SESSION_EXPIRY_MS, STALE_SESSION_MS, STALE_LOCK_MS, AUTO_MAINTAIN_LOCK,
   HANDOFF_EXPIRY_CLEAR, HANDOFF_EXPIRY_EXIT,
   sessionFile, getSessionId, createSessionId, openDb,
   spawnBackground, sweepOrphanEpisodeFiles, sweepStaleProjectMarkers,
@@ -56,6 +63,7 @@ import { snapshotDb } from './lib/db-backup.mjs';
 import {
   extractCitationsFromTranscript,
   extractInjectedBySurface,
+  buildCitationRelevanceSet,
   unionSurfaces,
   extractInjectedFromKeyContext,
   bumpCitationAccess,
@@ -70,6 +78,7 @@ import { resolveEdgeAttribution, readPreRecallFileEdges } from './lib/edge-attri
 import { extractTailAssistantText, extractStructuredSummary } from './lib/summary-extractor.mjs';
 import { searchRelevantMemories, formatMemoryLine, selectImperativeLesson } from './hook-memory.mjs';
 import { searchInjectableEvents, renderInjectableEvent } from './lib/events-injection.mjs';
+import { upsFtsQuery } from './lib/ups-query.mjs';
 import { formatTaskImperative } from './lib/task-imperative.mjs';
 import { recordSkillAdoption, gcOldShadowShards } from './registry-recommend.mjs';
 import { gcOldMetricShards, recordMetric } from './lib/metrics.mjs';
@@ -946,8 +955,19 @@ async function handleStop() {
 
           const ids = extractCitationsFromTranscript(transcriptPath);
           if (ids.size > 0) {
-            const n = bumpCitationAccess(db, ids, project);
-            debugLog('DEBUG', 'handleStop', `citations: ${ids.size} ids scanned, ${n} obs bumped`);
+            // Gate the access-count channel on relevance (audit FLOW-2 / D#179). The cited
+            // set is every `#NN` in this session's assistant text and cannot tell a
+            // citation from a mention; in this repository a CHANGELOG or audit-writing
+            // session names dozens of ids in prose, and access_count > 3 promotes a row a
+            // tier via boostAccessed. The population to credit — all seven faces, and why
+            // extractAllInjected alone is the wrong five — lives in the builder.
+            const relevant = buildCitationRelevanceSet({
+              transcriptPath, runtimeDir: RUNTIME_DIR, project,
+              sessionId: ccSessionId, subagentInjected: sub.injected,
+            });
+            const n = bumpCitationAccess(db, ids, project, relevant);
+            debugLog('DEBUG', 'handleStop',
+              `citations: ${ids.size} ids scanned, ${relevant.size} relevant, ${n} obs bumped`);
           }
 
           // v32 citation-decay: tighter feedback loop on top of P4. Re-scan
@@ -1550,14 +1570,52 @@ function scheduleSessionStartAutoMaintain(project) {
   if (!process.env.CLAUDE_MEM_SKIP_MAINTAIN) spawnBackground('auto-maintain', project);
 }
 
+// The maintenance mutex deliberately does NOT end in `.lock`: cleanStaleLockFiles()
+// below unlinks every `*.lock` in RUNTIME_DIR whose age exceeds STALE_LOCK_MS (30s)
+// WITHOUT consulting the holder's pid — a policy written for the episode lock, whose
+// critical section is milliseconds. A maintenance pass is seconds to minutes (VACUUM INTO
+// snapshot, purge, decay, dedup over the whole DB), so that sweeper would strip this lock
+// mid-pass and hand the exclusion straight back to the race it exists to close.
+// proc-lock brings its own staleness policy (age OR provably-dead pid), which is the
+// correct one here.
+// Generous upper bound on one pass; a crashed holder is normally reclaimed sooner via the
+// dead-pid check, so this only matters for a holder killed on another host.
+const AUTO_MAINTAIN_LOCK_STALE_MS = 10 * 60 * 1000;
+
 // Detached `auto-maintain` worker entry: opens its own DB and runs the maintenance
 // pass off the interactive boot path. runSessionStartAutoMaintain still owns the 24h
 // gate + the compress/optimize spawns at its tail.
+//
+// Cross-process mutual exclusion (2026-08-29 audit FLOW-1). The pass is shaped
+// read-gate → long work → write-gate, so two Claude Code windows booting either side of
+// the 24h boundary both see "due" and both spawn a worker. That breaks a documented
+// in-process invariant: decayAndMarkIdle marks BEFORE it decays precisely so an imp-2 row
+// cannot be decayed 2→1 and marked COMPRESSED_PENDING_PURGE in the same pass (MED-1, see
+// its docblock — each importance tier is supposed to buy a grace cycle). Across two
+// processes the ordering is gone: worker A decays 2→1, worker B's mark-idle then sees a
+// qualifying imp-1 row and hides it, 37 days from a hard delete. The same overlap
+// double-runs the cascade below it (duplicate weekly summaries from compressGroup, whose
+// UPDATE has no compressed_into guard; doubled llm-optimize spend).
+//
+// Lock at the worker entry rather than around the individual ops: the cascade spawns sit
+// inside the pass, so one gate covers the whole family. Not acquiring is a plain no-op —
+// a peer is already doing exactly this work.
 function handleAutoMaintain(project) {
-  const db = openDb();
-  if (!db) return;
-  try { runSessionStartAutoMaintain(db, project); }
-  finally { try { db.close(); } catch { /* ignore */ } }
+  const release = acquireProcLock(join(RUNTIME_DIR, AUTO_MAINTAIN_LOCK), {
+    staleMs: AUTO_MAINTAIN_LOCK_STALE_MS,
+  });
+  if (!release) {
+    debugLog('DEBUG', 'auto-maintain', 'skipped — a live peer holds the maintenance lock');
+    return;
+  }
+  try {
+    const db = openDb();
+    if (!db) return;
+    try { runSessionStartAutoMaintain(db, project); }
+    finally { try { db.close(); } catch { /* ignore */ } }
+  } finally {
+    release();
+  }
 }
 
 function saveHandoffAndFastSummary(db, { prevSessionId, prevProject, project, ccSessionId, episodeSnapshot, now }) {
@@ -1686,7 +1744,11 @@ async function buildStartupDashboardText(db, project) {
   // tests/session-start-stdout-envelope.test.mjs.
   try {
     const { buildDashboard } = await import('./lib/startup-dashboard.mjs');
-    let dashboardText = buildDashboard({ db, project, projectPath: process.cwd() });
+    // projectPath MUST come from the same place `project` does (inferProjectDir), not from
+    // process.cwd(): otherwise the dashboard renders directory A's git state and task list
+    // under directory B's project name whenever the hook process was not spawned at the
+    // project root. See inferProjectDir()'s docblock for the case this closed.
+    let dashboardText = buildDashboard({ db, project, projectPath: inferProjectDir() });
     const citeNudge = buildCiteRecallNudge(project);
     if (citeNudge) {
       dashboardText = dashboardText ? `${citeNudge}\n${dashboardText}` : citeNudge;
@@ -2158,7 +2220,14 @@ async function handleUserPrompt() {
       // ranking and citation extractors (bare-`#` anchored) never read an event id as
       // an obs id. Nested try so an events failure can't suppress the imperative pick.
       try {
-        const events = searchInjectableEvents(db, { prompt: promptText, project });
+        // upsFtsQuery, not the raw prompt (audit ALGO-1). lib/ups-query.mjs declares
+        // itself "the ONE query-cap definition for the UserPromptSubmit event", and both
+        // OTHER legs of this same event go through it — but this leg, wired in v3.48
+        // before that module existed, handed searchInjectableEvents the whole prompt and
+        // let it call the uncapped sanitizeFtsQuery. Measured here: a 250KB CJK prompt
+        // (path B's stdin cap is 256KB) costs 356ms uncapped against 5.5ms capped, all of
+        // it synchronous, before the model sees the turn.
+        const events = searchInjectableEvents(db, { ftsQuery: upsFtsQuery(promptText), project });
         if (events.length > 0) {
           const elines = ['<memory-context relevance="events">'];
           for (const e of events) elines.push(`- ${renderInjectableEvent(e)}`);

package/lib/citation-tracker.mjs

@@ -12,7 +12,7 @@
 
 import { readFileSync, readdirSync, statSync } from 'fs';
 import { join } from 'path';
-import { debugCatch } from '../utils.mjs';
+import { debugCatch, debugLog } from '../utils.mjs';
 import { keyContextIdsFileName } from './injected-ids.mjs';
 import { readTranscriptEntries } from './transcript-scan.mjs';
 // The emitter's own prefix — see SURFACE_MATCHERS.task_imperative. Importing it rather
@@ -169,21 +169,168 @@ export function computeCiteRecall(transcriptPath) {
   return { injected: injected.size, cited: cited.size, recalled, ratio };
 }
 
+/**
+ * Observation ids the USER typed in their own messages this session.
+ *
+ * Half of the relevance gate bumpCitationAccess takes (audit FLOW-2). Someone writing
+ * `look at #10716` is naming that memory deliberately, which is at least as strong a
+ * relevance signal as an automatic injection — dropping it would have been the cost of
+ * the narrower "injected only" gate.
+ *
+ * Hook injections ride the `attachment` channel (see eachHookAttachment), not user
+ * message text, so this reads a different stream than the surface extractors do. It does
+ * not filter injected content out of the result: the only consumer unions this with the
+ * injected set, where a duplicate is free.
+ *
+ * `tool_result` blocks are program output echoed back inside a user turn — not something
+ * the user wrote — so only `text` blocks count.
+ *
+ * @param {string|null|undefined} transcriptPath
+ * @param {{mainOnly?: boolean}} [opts]
+ * @returns {Set<number>}
+ */
+export function extractUserTypedIds(transcriptPath, opts = {}) {
+  const { mainOnly = false } = opts;
+  const ids = new Set();
+  for (const entry of readTranscriptEntries(transcriptPath)) {
+    if (entry.type !== 'user' || !entry.message) continue;
+    if (mainOnly && entry.isSidechain === true) continue;
+    const content = entry.message.content;
+    const blocks = typeof content === 'string'
+      ? [{ type: 'text', text: content }]
+      : (Array.isArray(content) ? content : []);
+    for (const block of blocks) {
+      if (block.type !== 'text' || typeof block.text !== 'string') continue;
+      CITATION_RE.lastIndex = 0;
+      let m;
+      while ((m = CITATION_RE.exec(block.text))) addObsId(ids, m[1]);
+    }
+  }
+  return ids;
+}
+
+/**
+ * The set of ids this session actually put in front of the model, across ALL SEVEN faces.
+ *
+ * This is the population `bumpCitationAccess` credits against, and it lives here rather
+ * than inline at the call site because getting it from `extractAllInjected` alone is
+ * wrong in a way nothing would have caught. That helper unions the five faces with a hook
+ * attachment to walk; the two it omits are NON_ATTACHMENT_SURFACES, and each is omitted
+ * for a reason that does not apply to the promotion channel:
+ *
+ *   * `keyctx` — kept out of extractAllInjected because an unconditional SessionStart
+ *     render is no evidence for the decay DENOMINATOR. `extractInjectedFromKeyContext`'s
+ *     docblock then names this exact caller: "Callers must therefore intersect with the
+ *     cited set (see handleStop) so a CITED Key Context row is credited while an uncited
+ *     one is left alone." Dropping it inverts that contract — and does so INVISIBLY on an
+ *     adopted project, where the marker is empty by construction. The loss lands on a
+ *     non-adopted project, the default for a new install, where that block is the most
+ *     prominent injection surface there is.
+ *   * `subagent` — a lesson handed to a dispatched agent was still shown by this session.
+ *
+ * Derived from CITATION_SURFACES rather than re-enumerated, so a new face cannot be added
+ * to the store and silently miss this gate (`assertRelevanceCoversAllFaces` binds it).
+ *
+ * @param {object} ctx
+ * @param {string|null|undefined} ctx.transcriptPath
+ * @param {string} [ctx.runtimeDir]
+ * @param {string} [ctx.project]
+ * @param {string|null} [ctx.sessionId]
+ * @param {Iterable<number>} [ctx.subagentInjected] Already-collected subagent ids
+ *        (collectSubagentSurface parses sidechains and evicts the transcript memo, so the
+ *        caller runs it once and hands the result in rather than paying for it twice).
+ * @returns {Set<number>}
+ */
+export function buildCitationRelevanceSet({
+  transcriptPath, runtimeDir, project, sessionId = null, subagentInjected = [],
+} = {}) {
+  const out = new Set();
+  for (const id of extractAllInjected(transcriptPath)) out.add(id);          // 5 attachment faces
+  if (runtimeDir && project) {
+    for (const id of extractInjectedFromKeyContext({ runtimeDir, project, sessionId })) out.add(id);
+  }
+  for (const id of subagentInjected) out.add(id);
+  for (const id of extractUserTypedIds(transcriptPath)) out.add(id);         // the user named it
+  return out;
+}
+
+/**
+ * Every face in CITATION_SURFACES must have a source in buildCitationRelevanceSet.
+ *
+ * Structural, because the behavioural version cannot exist: the faces are read off
+ * different streams (attachments, a runtime marker, sidechain files, user text), so no one
+ * fixture drives all seven. Throws rather than returns, so a face added without a source
+ * fails loudly at test time instead of quietly losing its promotion channel.
+ *
+ * @param {ReadonlyArray<string>} [sourced] Faces the builder reads, for the test to pass in.
+ */
+export function assertRelevanceCoversAllFaces(sourced) {
+  const covered = new Set(sourced ?? [...ATTACHMENT_SURFACES, ...NON_ATTACHMENT_SURFACES]);
+  const missing = CITATION_SURFACES.filter((f) => !covered.has(f));
+  if (missing.length) {
+    throw new Error(`buildCitationRelevanceSet has no source for face(s): ${missing.join(', ')} — `
+      + 'a face with no source here loses its access-count promotion channel silently.');
+  }
+  return true;
+}
+
 /**
  * Increment `access_count` (and `last_accessed_at`) for each cited observation
- * that belongs to `project`. Returns the count of successful increments.
+ * that belongs to `project` AND is relevant to this session. Returns the count of
+ * successful increments.
+ *
+ * `relevantIds` is REQUIRED, and it is the whole point (audit FLOW-2 / D#179).
+ *
+ * The cited set is "every `#NN` that appears in this session's assistant text", which
+ * cannot tell a citation from a mention. In this repository — whose subject matter IS the
+ * memory store — a session that writes a CHANGELOG or an audit report names dozens of ids
+ * in prose, and each one was being credited with a use. Downstream that is not cosmetic:
+ * `access_count > 3` promotes the row a tier via boostAccessed (maintain-core.mjs), so
+ * discussing a memory made it more likely to be injected, and the same inflation fed the
+ * cite-rate instrumentation that product decisions are read off. citation-tracker's own
+ * notes record #10716 promoted by 21 mentions from the session that WROTE it.
+ *
+ * The gate is "did anything make this row relevant to this session" — injection did, and
+ * the user naming an id in their own message did. An agent mentioning an id it just wrote
+ * about did not. Deliberately NOT a context regex trying to separate "citing" from
+ * "mentioning": that distinction is not enumerable, and trying was rejected up front.
+ *
+ * Passing no set is a no-op rather than an open gate: the caller must name the population
+ * it is crediting, so a future call site cannot reopen this by omission. It says so in the
+ * telemetry rather than failing silently.
+ *
+ * Superseded ids are redirected to their keeper first (FLOW-6), matching
+ * applyCitationDecay and recordCitationSurfaces — this was the last access-side surface
+ * still crediting a tombstone instead of the row that absorbed it. Both sets are
+ * redirected, or a keeper id in one would not meet its superseded twin in the other.
  *
  * Per-row UPDATE in try-catch so a single FTS-corrupted row can't abort the
  * scan. Cross-project IDs are silently ignored by the WHERE clause.
  *
  * @param {import('better-sqlite3').Database} db
- * @param {Iterable<number>} ids
+ * @param {Iterable<number>} ids  ids cited in this session's assistant text
  * @param {string} project
+ * @param {Set<number>|Iterable<number>} relevantIds  ids injected this session, unioned
+ *        with ids the user typed themselves. Required.
  * @returns {number} count of rows incremented
  */
-export function bumpCitationAccess(db, ids, project) {
+export function bumpCitationAccess(db, ids, project, relevantIds, env = process.env) {
   if (!db || !ids || !project) return 0;
-  const idList = Array.isArray(ids) ? ids : [...ids];
+  // Revert path for the gate (CLAUDE_MEM_CITATION_RELEVANCE_GATE=off). It restores the
+  // pre-v3.84.0 behaviour — every mention credited — including the missing-argument hole,
+  // because a half-reverted gate is a third behaviour nobody has measured.
+  const gateOff = String(env.CLAUDE_MEM_CITATION_RELEVANCE_GATE || '').toLowerCase() === 'off';
+  if (!gateOff && (relevantIds === undefined || relevantIds === null)) {
+    debugLog('WARN', 'bumpCitationAccess', 'no relevantIds passed — refusing to credit ungated mentions');
+    return 0;
+  }
+  const cited = redirectSupersededIds(db, project, ids instanceof Set ? ids : new Set(ids));
+  const allowed = redirectSupersededIds(
+    db, project, relevantIds instanceof Set ? relevantIds : new Set(relevantIds ?? []),
+  );
+  // The superseded redirect is NOT part of the flag: it was a separate defect (FLOW-6,
+  // crediting a tombstone instead of the row that absorbed it) with no upside to restore.
+  const idList = gateOff ? [...cited] : [...cited].filter((id) => allowed.has(id));
   if (idList.length === 0) return 0;
   const stmt = db.prepare(`
     UPDATE observations SET access_count = access_count + 1, last_accessed_at = ?

package/lib/cite-back-hint.mjs

@@ -15,6 +15,13 @@ import { basename, join } from 'path';
 import { readFileSync } from 'fs';
 import { readTranscriptEntries } from './transcript-scan.mjs';
 import { EDIT_TOOLS } from '../utils.mjs';
+// SEC-6 (2026-08-29 audit): these two hints were the only one of the injection surfaces
+// whose text cells reach the model undefanged. Every sibling neutralizes (events-injection
+// titles/lessons, hook-context's whole block, hook-handoff — which defangs the output of
+// basename() specifically, at hook-handoff.mjs:473). A filename is attacker-influenceable
+// in the ordinary case: it is whatever the repository being worked on happens to contain.
+import { neutralizeContextDelimiters } from '../format-utils.mjs';
+import { cooldownPathFor as sharedCooldownPathFor } from './cooldown-path.mjs';
 // One caliber for `#NN`. citation-tracker.mjs does NOT import this module, so the edge
 // is acyclic.
 import { citationIdRe } from './citation-tracker.mjs';
@@ -60,7 +67,7 @@ export function buildCiteBackHint(episode, cooldown) {
     `${CITE_BACK_HINT_LEADER} edited ${matches.length} file(s) with ${totalLessons} prior lesson(s) this session. Save now if any was the root cause:`,
   ];
   for (const m of matches) {
-    const fname = basename(m.file);
+    const fname = neutralizeContextDelimiters(basename(m.file));
     const idList = m.ids.map(id => `#${id}`).join(', ');
     lines.push(`  • ${fname} ← ${idList} — /lesson --file ${fname} "<root cause + fix>"`);
   }
@@ -105,17 +112,17 @@ export function buildUnsavedBugfixHint(episode) {
   if (!hasError || !hasEdit || editedFiles.size === 0) return null;
 
   const files = [...editedFiles];
-  const displayed = files.slice(0, MAX_DISPLAY_FILES).map(f => basename(f));
-  const firstFname = basename(files[0]);
+  const displayed = files.slice(0, MAX_DISPLAY_FILES).map(f => neutralizeContextDelimiters(basename(f)));
+  const firstFname = neutralizeContextDelimiters(basename(files[0]));
   return `[mem] ⚠ Unsaved bugfix-shape: error+edit across ${files.length} file(s) in ${entries.length} entries (${displayed.join(', ')}). Save now if it was a real fix: /lesson --file ${firstFname} "<root cause + fix>"`;
 }
 
-// Path scheme MUST mirror scripts/pre-tool-recall.js cooldownPathFor() — drift
-// silently zeros cite-back across the release. Pinned by tests/cite-back-hint.test.mjs
-// 'sanitizes the sessionId the same way pre-tool-recall.js does'.
+// Path scheme comes from lib/cooldown-path.mjs, the single definition shared with the
+// writer (scripts/pre-tool-recall.js) and the other reader (lib/edge-attribution.mjs).
+// Argument order is flipped from the shared helper's, so keep this thin adapter rather
+// than re-ordering every call site (ARCH-2).
 function cooldownPathFor(sessionId, runtimeDir) {
-  const safe = String(sessionId).replace(/[^a-zA-Z0-9_.-]/g, '-').slice(0, 64);
-  return join(runtimeDir, `pre-recall-cooldown-${safe}.json`);
+  return sharedCooldownPathFor(runtimeDir, sessionId);
 }
 
 // ─── countUnsavedBugfixShape (B2, v2.83.1) ──────────────────────────────────

package/lib/cooldown-path.mjs

@@ -0,0 +1,42 @@
+// lib/cooldown-path.mjs — the ONE definition of the pre-recall cooldown file's path.
+//
+// The rule (sanitize the session id, cap it at 64 chars, join it to RUNTIME_DIR under a
+// fixed prefix) had three independent copies: scripts/pre-tool-recall.js writes the file,
+// lib/cite-back-hint.mjs and lib/edge-attribution.mjs read it. Two of the three carried a
+// comment saying the copies MUST agree and that drift silently zeros the surface that
+// depends on them — a writer and a reader disagreeing does not error, it just reads a
+// file nobody wrote. Only the pre-tool-recall/cite-back pair was pinned by a test; the
+// edge-attribution copy, whose drift silently zeros Stop-side attribution, was not.
+//
+// The original reason for copying (#8447: keep the standalone hook fast-path free of
+// imports) was retired by v3.80.0 — scripts/pre-tool-recall.js already imports
+// lib/resolve-data-dir.mjs and lib/hook-telemetry.mjs on its startup path. This module is
+// two pure functions over `node:path` and adds nothing measurable to that.
+
+import { join } from 'path';
+
+/** Filename prefix. Exported so a sweeper can match the family without re-deriving it. */
+export const COOLDOWN_FILE_PREFIX = 'pre-recall-cooldown-';
+
+/**
+ * Session id → filesystem-safe key. The 64-char cap and the character class are part of
+ * the contract, not defensive hygiene: writer and readers must derive the same name from
+ * the same id, so a change here is a change to all three at once.
+ *
+ * @param {unknown} sessionId
+ * @returns {string}
+ */
+export function cooldownSessionKey(sessionId) {
+  return String(sessionId).replace(/[^a-zA-Z0-9_.-]/g, '-').slice(0, 64);
+}
+
+/**
+ * Absolute path to a session's pre-recall cooldown file.
+ *
+ * @param {string} runtimeDir Absolute RUNTIME_DIR.
+ * @param {unknown} sessionId Claude Code session id.
+ * @returns {string}
+ */
+export function cooldownPathFor(runtimeDir, sessionId) {
+  return join(runtimeDir, `${COOLDOWN_FILE_PREFIX}${cooldownSessionKey(sessionId)}.json`);
+}

package/lib/edge-attribution.mjs

@@ -15,16 +15,13 @@
 // resolveEdgeAttribution inside the same text-floor-gated block.
 
 import { readFileSync, existsSync } from 'fs';
-import { join } from 'path';
 import { debugCatch } from '../utils.mjs';
 import { fileMatchClause, fileMatchParams } from './file-edge-match.mjs';
+import { cooldownPathFor } from './cooldown-path.mjs';
 
-// Mirrors pre-tool-recall.js cooldownPathFor sanitization — the two MUST agree
-// or Stop-side resolution reads a different file than the hook wrote.
-function cooldownFileFor(runtimeDir, ccSessionId) {
-  const safe = String(ccSessionId).replace(/[^a-zA-Z0-9_.-]/g, '-').slice(0, 64);
-  return join(runtimeDir, `pre-recall-cooldown-${safe}.json`);
-}
+// Path scheme comes from lib/cooldown-path.mjs. This copy was the untested one of the
+// three, and its drift zeros Stop-side attribution without a single error (ARCH-2).
+const cooldownFileFor = cooldownPathFor;
 
 /**
  * Read the session cooldown file and return the file→obsIds edge list for

package/lib/events-injection.mjs

@@ -23,7 +23,6 @@
 
 import { searchEventsFts } from './search-core.mjs';
 import { neutralizeContextDelimiters } from '../format-utils.mjs';
-import { sanitizeFtsQuery } from '../utils.mjs';
 
 const DEFAULT_LIMIT = 3;
 const DEFAULT_MIN_IMPORTANCE = 2;
@@ -44,11 +43,19 @@ function normalizeRow(r) {
 /**
  * FTS-matched events for a prompt (UserPromptSubmit surfaces). Superseded events are
  * excluded by searchEventsFts; importance floor drops low-value rows. Never throws.
+ *
+ * Takes a BUILT query, never raw prompt text (audit ALGO-1). The old `prompt` option ran
+ * the uncapped sanitizeFtsQuery, and the one caller used it — so this leg of
+ * UserPromptSubmit paid 356ms on a 250KB CJK prompt while the event's other two legs
+ * went through lib/ups-query.mjs's cap. Removing the option rather than capping it here
+ * is what stops the next caller walking back in: prompt-time callers must name the cap
+ * they are using, and `claude-mem-lite search` stays deliberately uncapped.
+ *
  * @returns {Array<{id,type,title,lesson_learned,importance,created_at_epoch}>}
  */
-export function searchInjectableEvents(db, { prompt, ftsQuery, project, limit = DEFAULT_LIMIT, minImportance = DEFAULT_MIN_IMPORTANCE } = {}) {
+export function searchInjectableEvents(db, { ftsQuery, project, limit = DEFAULT_LIMIT, minImportance = DEFAULT_MIN_IMPORTANCE } = {}) {
   if (!db || !project) return [];
-  const q = ftsQuery || (prompt ? sanitizeFtsQuery(prompt) : null);
+  const q = ftsQuery || null;
   if (!q) return [];
   try {
     const rows = searchEventsFts(db, {

package/lib/hook-telemetry.mjs

@@ -25,6 +25,10 @@ import { join } from 'path';
 // lightweight standalone scripts" property stated above.
 import { isNativeBindingError } from './binding-probe.mjs';
 import { recordNativeBindingBreakage } from './native-binding-hint.mjs';
+// secret-scrub.mjs is pure regex over one pure-`node:` import (lib/private-strip.mjs),
+// so it preserves the "usable from the lightweight standalone scripts" property above.
+// lib/err-sampler.mjs — the sibling sink — already depends on it for the same reason.
+import { scrubSecrets } from '../secret-scrub.mjs';
 
 import { DAY_MS } from './time-constants.mjs';
 const RETENTION_MS = 14 * DAY_MS;
@@ -76,12 +80,24 @@ export function recordHookError(scope, err, runtimeDir, ctx) {
     const dir = hookErrorsDir(runtimeDir);
     if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 0o700 });
 
+    // Scrub BEFORE truncating, on every field — same caliber as lib/err-sampler.mjs, which
+    // is the twin of this sink and has carried the scrub since it was written. This one had
+    // not: an error message is a documented carrier for the input that provoked it, and the
+    // hook scripts hand it exactly that. `scripts/pre-tool-recall.js:319` records
+    // `pre-recall:json` from a JSON.parse of raw hook stdin, and Node >= 20 quotes the
+    // offending text back inside the SyntaxError message ("Unexpected token 's',
+    // \"{\"a\": sk-proj-AB\"... is not valid JSON") — that stdin is the user's prompt and
+    // the tool output around it. Truncating first would also let a secret straddling the
+    // slice boundary survive as a fragment. `scope` is an in-code literal today; scrubbing
+    // it costs nothing and removes the exception that would otherwise need re-arguing.
     const line = JSON.stringify({
       ts: new Date().toISOString(),
-      scope: String(scope || '').slice(0, 80),
-      msg: String(err?.message ?? err ?? '').slice(0, 500),
-      stack: typeof err?.stack === 'string' ? err.stack.split('\n').slice(0, 6).join('\n') : undefined,
-      ctx: ctx === undefined ? undefined : JSON.stringify(ctx).slice(0, 240),
+      scope: scrubSecrets(String(scope || '')).slice(0, 80),
+      msg: scrubSecrets(String(err?.message ?? err ?? '')).slice(0, 500),
+      stack: typeof err?.stack === 'string'
+        ? scrubSecrets(err.stack.split('\n').slice(0, 6).join('\n'))
+        : undefined,
+      ctx: ctx === undefined ? undefined : scrubSecrets(JSON.stringify(ctx)).slice(0, 240),
     }) + '\n';
 
     appendFileSync(join(dir, `${today()}.jsonl`), line, { mode: 0o600 });

package/lib/private-strip.mjs

@@ -19,18 +19,53 @@
 // Case-insensitive on the tag (`<PRIVATE>`, `<Private>` all work) since users
 // type by hand. Non-greedy match handles multiple blocks correctly.
 
-const PRIVATE_BLOCK_RE = /<private>([\s\S]*?)<\/private>/gi;
+// Tag scanner, NOT a block matcher. The block form this replaced —
+// /<private>([\s\S]*?)<\/private>/gi — is quadratic on opener-dense input: every one of
+// N openers costs the engine a lazy `[\s\S]*?` walk to the end of the string looking for
+// a close that is not there. Measured before the rewrite: 20k unclosed openers (180KB)
+// 545ms, 28k (252KB — the PostToolUse/UserPromptSubmit stdin cap) 891ms, against 0.6ms
+// for 1MB of plain text. stripPrivate is the FIRST step of every scrubSecrets() call and
+// sits on the synchronous UserPromptSubmit path, so that is per-prompt latency the model
+// waits on; lib/import-jsonl.mjs feeds it user files with no cap at all.
+//
+// "Return early when there is no close tag" does not fix it: `'</private>' + N openers`
+// has a close and still costs 456ms. The alternation below has no quantifier to back off
+// into, so the scan is linear in the input regardless of tag density.
+const PRIVATE_TAG_RE = /<(\/?)private>/gi;
 const REDACTION_MARKER = '[redacted]';
 
 /**
  * Replace each well-formed <private>...</private> block with [redacted].
  * Returns input unchanged if no closed block is present.
  *
+ * Pairing rule reproduces the leftmost-then-lazy semantics of the block regex exactly:
+ * the EARLIEST unmatched opener claims the next close (so `<private>a<private>b</private>`
+ * collapses whole, as the regex did), a close with no open ahead of it stays intact, and
+ * an opener with no close after it stays intact.
+ *
  * @param {unknown} text Input string (non-string passes through)
  * @returns {string|unknown} Stripped text, or input unchanged if not a string
  */
 export function stripPrivate(text) {
   if (typeof text !== 'string') return text;
   if (!text.includes('<')) return text; // fast path — most prompts have no tags
-  return text.replace(PRIVATE_BLOCK_RE, REDACTION_MARKER);
+
+  PRIVATE_TAG_RE.lastIndex = 0;
+  let out = null;       // stays null until the first replacement — no-op inputs return as-is
+  let cursor = 0;       // end of the last emitted span
+  let openAt = -1;      // index of the earliest opener not yet paired
+  let m;
+  while ((m = PRIVATE_TAG_RE.exec(text)) !== null) {
+    if (m[1] !== '/') {
+      if (openAt < 0) openAt = m.index;
+    } else if (openAt >= 0) {
+      if (out === null) out = [];
+      out.push(text.slice(cursor, openAt), REDACTION_MARKER);
+      cursor = m.index + m[0].length;
+      openAt = -1;
+    }
+  }
+  if (out === null) return text;
+  out.push(text.slice(cursor));
+  return out.join('');
 }

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.83.0",
+  "version": "3.84.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "claude-mem-lite",
-      "version": "3.83.0",
+      "version": "3.84.0",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.26.0",
         "better-sqlite3": "^12.6.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.83.0",
+  "version": "3.84.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",
@@ -65,6 +65,7 @@
     "lib/edge-attribution.mjs",
     "lib/file-edge-match.mjs",
     "lib/cite-back-hint.mjs",
+    "lib/cooldown-path.mjs",
     "lib/tmp-fixture-sweep.mjs",
     "lib/summary-extractor.mjs",
     "lib/id-routing.mjs",

package/project-utils.mjs

@@ -29,7 +29,26 @@ const _cache = new Map();
  * @returns {string} Sanitized project identifier safe for use in filenames
  */
 export function inferProject() {
-  return projectNameFromDir(process.env.CLAUDE_PROJECT_DIR || process.env.PWD || process.cwd());
+  return projectNameFromDir(inferProjectDir());
+}
+
+/**
+ * The DIRECTORY `inferProject()` derives its name from — the session's project root.
+ *
+ * Callers that read the filesystem on behalf of the current project (git state, tasks,
+ * adoption sentinel) must use THIS, not `process.cwd()`. The two diverge whenever the
+ * process was not spawned with cwd == project root, and the result is a surface that
+ * labels directory A's git/tasks with directory B's project name. That was live in the
+ * startup dashboard: `buildDashboard({ project: inferProject(), projectPath: process.cwd() })`
+ * — the identity came from the env, the filesystem root from the process. In production the
+ * two happen to coincide, so only the test face showed it (a hook subprocess spawned with the
+ * repo root as cwd read the REAL repo's git state, and the assertion pinning the dashboard
+ * leg passed or failed on whether the host tree was dirty).
+ *
+ * @returns {string} Absolute project root directory.
+ */
+export function inferProjectDir() {
+  return process.env.CLAUDE_PROJECT_DIR || process.env.PWD || process.cwd();
 }
 
 /**

package/scripts/post-tool-use.sh

@@ -77,7 +77,37 @@ if [[ "$tool" == "Read" ]]; then
     # hook.mjs flushEpisode reads reads-<project>.txt from CLAUDE_MEM_DIR/runtime; if this
     # bash fast-path wrote to $HOME unconditionally, a relocated install would drop all
     # Read context from episodes AND grow an uncollected reads file in $HOME forever.
-    runtime_dir="${CLAUDE_MEM_DIR:-$HOME/.claude-mem-lite}/runtime"
+    _data_dir="${CLAUDE_MEM_DIR:-$HOME/.claude-mem-lite}"
+    # Test containment, mirroring containInTests() in lib/resolve-data-dir.mjs (audit
+    # ENG-1). That guard sits at the NODE exit of this channel, and this channel has two:
+    # the Read fast path above never reaches Node, so a test that spawned the prefilter
+    # without setting CLAUDE_MEM_DIR appended straight into the developer's live runtime
+    # dir. That is not hypothetical — it is what v3.83.0 had to clean up, and the fix
+    # there was a single-file canary keyed on one fingerprint, so any other test using
+    # any other project name still walked through.
+    #
+    # Same three conditions as the Node side, same order: guard armed, target IS the real
+    # directory (not merely "outside tmp" — suites legitimately point HOME at fixtures),
+    # and an absolute sandbox to redirect into. Pure builtins; no spawn on this ~5ms path.
+    if [[ "${CLAUDE_MEM_TEST_GUARD:-}" == "1" ]]; then
+      _real_dir="${CLAUDE_MEM_TEST_REALDIR:-$HOME/.claude-mem-lite}"
+      # Node compares resolve(dir) !== resolve(real); a raw string compare here let
+      # `CLAUDE_MEM_DIR="$HOME/.claude-mem-lite/"` (trailing slash) walk straight through
+      # the guard and append into the live runtime dir — the exact leak this exists to
+      # close. Trailing-slash strip only, with the same builtin loop used for `_dir` above:
+      # a realpath spawn would blow the ~5ms budget, and a trailing slash is the spelling
+      # difference that actually occurs.
+      while [[ "$_data_dir" == */ && ${#_data_dir} -gt 1 ]]; do _data_dir="${_data_dir%/}"; done
+      while [[ "$_real_dir" == */ && ${#_real_dir} -gt 1 ]]; do _real_dir="${_real_dir%/}"; done
+      if [[ "$_data_dir" == "$_real_dir" ]]; then
+        if [[ "${CLAUDE_MEM_TEST_SANDBOX:-}" == /* ]]; then
+          _data_dir="$CLAUDE_MEM_TEST_SANDBOX"
+        else
+          _data_dir="${TMPDIR:-/tmp}"; _data_dir="${_data_dir%/}/claude-mem-test-fallback"
+        fi
+      fi
+    fi
+    runtime_dir="${_data_dir}/runtime"
     # Owner-only (0700 dir / 0600 file): reads-<project>.txt lists captured file
     # paths, so on a shared host the default umask leaked them to every local user.
     # umask is a shell builtin — no extra process on this ~5ms per-tool-call path

package/scripts/pre-tool-recall.js

@@ -12,6 +12,7 @@ import { injectedIdsFileName } from '../lib/injected-ids.mjs';
 import { liveObsFilterSql } from '../lib/inject-search-core.mjs';
 import { buildNotLowSignalSql } from '../lib/low-signal-patterns.mjs';
 import { recordHookError } from '../lib/hook-telemetry.mjs';
+import { cooldownPathFor as sharedCooldownPathFor } from '../lib/cooldown-path.mjs';
 import { citeFactorClause } from '../scoring-sql.mjs';
 import { fileMatchClause, fileMatchParams, basenameAnySep } from '../lib/file-edge-match.mjs';
 import { fileIntelFor } from '../lib/file-intel.mjs';
@@ -53,12 +54,13 @@ import { DAY_MS } from '../lib/time-constants.mjs';
 const DATA_DIR = resolveDataDir(process.env.CLAUDE_MEM_DIR);
 const DB_PATH = process.env.CLAUDE_MEM_DB_PATH || join(DATA_DIR, 'claude-mem-lite.db');
 const RUNTIME_DIR = process.env.CLAUDE_MEM_RUNTIME_DIR || join(DATA_DIR, 'runtime');
-// A3 (v2.83): cross-hook dedup window — must mirror DEDUP_STALE_MS in
-// scripts/prompt-search-utils.mjs. UPS writes
-// `runtime/.claude-mem-injected-<project>` after each inject; we read it to
-// drop IDs the agent already saw in this 5-min window. Standalone fast-path
-// (#8447) so we inline the constant rather than importing the helper.
-const CROSS_HOOK_DEDUP_MS = 5 * 60 * 1000;
+// A3 (v2.83): cross-hook dedup window. UPS writes
+// `runtime/.claude-mem-injected-<project>` after each inject; we read it to drop IDs the
+// agent already saw in this window. Imported, not inlined (ARCH-3): the copy's stated
+// reason — keep this standalone fast path import-free (#8447) — was retired by v3.80.0,
+// which already imports lib modules here, and the inlined value silently encoded the
+// same premise twice.
+import { DEDUP_STALE_MS as CROSS_HOOK_DEDUP_MS } from './prompt-search-utils.mjs';
 // v2.33.1: cooldown path is session-scoped so same-file-twice within one
 // session never re-injects (was: global file, 5-min window). Cross-session:
 // fresh file, fresh nudges — this is intended. No session_id → fall back to
@@ -160,10 +162,14 @@ const REREAD_MIN_TOKENS = Math.max(1,
 // Edit cost 15-30 disk stats per call. SessionStart fires once at session boot,
 // which is enough to keep RUNTIME_DIR from growing unbounded.
 
+// Path rule lives in lib/cooldown-path.mjs — this script WRITES the file that
+// lib/cite-back-hint.mjs and lib/edge-attribution.mjs read, and a writer/reader
+// disagreement does not error, it silently reads a file nobody wrote (ARCH-2). The
+// no-session legacy fallback stays here: it is this script's own back-compat, not part
+// of the shared naming rule.
 function cooldownPathFor(sessionId) {
   if (!sessionId) return LEGACY_COOLDOWN_PATH;
-  const safe = String(sessionId).replace(/[^a-zA-Z0-9_.-]/g, '-').slice(0, 64);
-  return join(RUNTIME_DIR, `pre-recall-cooldown-${safe}.json`);
+  return sharedCooldownPathFor(RUNTIME_DIR, sessionId);
 }
 
 // Comprehension-bridge (CLAUDE_MEM_SALIENCE=bridge): rewrite the top bound lesson

package/source-files.mjs

@@ -61,6 +61,9 @@ export const SOURCE_FILES = [
   // scripts/pre-tool-recall.js (hook fast-path) and lib/edge-attribution.mjs.
   'lib/file-edge-match.mjs',
   'lib/cite-back-hint.mjs',
+  // The one definition of the pre-recall cooldown path — shared by its writer
+  // (scripts/pre-tool-recall.js) and both readers (cite-back-hint, edge-attribution).
+  'lib/cooldown-path.mjs',
   // v2.85: stale test-fixture sweeper. Imported by install.mjs (cleanup) + cli.mjs.
   // Missing from manifest → tarball ships install.mjs that ERR_MODULE_NOT_FOUND on cleanup.
   'lib/tmp-fixture-sweep.mjs',

package/utils.mjs

@@ -5,6 +5,9 @@
 import { basename, dirname, resolve, sep } from 'path';
 import { execSync } from 'child_process';
 import { buildLowSignalRegex } from './lib/low-signal-patterns.mjs';
+// Local binding for internal use: the `export … from './secret-scrub.mjs'` re-export below
+// is a pass-through and creates no binding in this module's scope.
+import { scrubSecrets as _scrubSecrets } from './secret-scrub.mjs';
 
 // ─── Re-exports from extracted modules ──────────────────────────────────────
 // Backward compatibility: all consumers import from utils.mjs
@@ -200,34 +203,51 @@ export function isRelatedToEpisode(episode, newFiles) {
  * @param {boolean} [opts.isError] If provided, overrides inline error regex detection
  * @returns {string} Concise description of the action
  */
+// SEC-3 (2026-08-29 audit): scrub BEFORE truncating, inside the function that truncates.
+//
+// The caller wraps this whole result in scrubSecrets(), which is one step too late: every
+// field below is already cut to 40-60 characters by then, so a secret straddling the cut
+// has lost the tail its value-length-gated pattern needs and the head survives verbatim.
+// The prompt path fixed this ordering (hook.mjs) and this path kept the old one.
+//
+// The scrub input is windowed rather than whole: `resp` is an uncapped tool response (a
+// Bash stdout can be megabytes) and this runs on every PostToolUse. 4096 is two orders of
+// magnitude above the longest cut here, so a secret that begins before the cut is still
+// seen whole by the patterns, at bounded cost.
+const DESC_SCRUB_WINDOW = 4096;
+function scrubTruncate(str, max) {
+  if (typeof str !== 'string' || str === '') return truncate(str, max);
+  return truncate(_scrubSecrets(str.slice(0, DESC_SCRUB_WINDOW)), max);
+}
+
 export function makeEntryDesc(toolName, input, resp, opts) {
   switch (toolName) {
     case 'Edit':
-      return `${basename(input.file_path || '')}: "${truncate(input.old_string || '', 40)}" → "${truncate(input.new_string || '', 40)}"`;
+      return `${basename(input.file_path || '')}: "${scrubTruncate(input.old_string || '', 40)}" → "${scrubTruncate(input.new_string || '', 40)}"`;
     case 'Write':
       return `Created ${basename(input.file_path || '')} (${(input.content || '').length} chars)`;
     case 'NotebookEdit':
-      return `Notebook cell: ${truncate(input.new_source || '', 60)}`;
+      return `Notebook cell: ${scrubTruncate(input.new_source || '', 60)}`;
     case 'Bash': {
-      const cmd = truncate(input.command || '', 50);
+      const cmd = scrubTruncate(input.command || '', 50);
       // Use caller-provided bashSig.isError (word-boundary aware) when available;
       // fall back to inline regex only for standalone callers (tests, etc.)
       const isErr = opts?.isError ?? (/\berror\b|\bfail(ed|ure)?\b|\bexception\b|\bpanic\b/i.test(resp) && resp.length > 30);
-      const snippet = truncate(resp, 60);
+      const snippet = scrubTruncate(resp, 60);
       return isErr ? `${cmd} → ERROR: ${snippet}` : `${cmd} → ${snippet}`;
     }
     case 'Grep':
-      return `Search "${truncate(input.pattern || '', 20)}" → ${truncate(resp, 60)}`;
+      return `Search "${scrubTruncate(input.pattern || '', 20)}" → ${scrubTruncate(resp, 60)}`;
     case 'LSP':
       return `${input.operation || ''} ${basename(input.filePath || '')}`;
     case 'Task': case 'Agent':
-      return truncate(input.description || '', 60);
+      return scrubTruncate(input.description || '', 60);
     case 'WebSearch':
-      return `Web: ${truncate(input.query || '', 50)}`;
+      return `Web: ${scrubTruncate(input.query || '', 50)}`;
     case 'WebFetch':
-      return `Fetch: ${truncate(input.url || '', 50)}`;
+      return `Fetch: ${scrubTruncate(input.url || '', 50)}`;
     default:
-      return `${toolName}: ${truncate(resp, 50)}`;
+      return `${toolName}: ${scrubTruncate(resp, 50)}`;
   }
 }