claude-mem-lite 3.87.0 → 3.89.0

package/lib/citation-tracker.mjs

@@ -654,6 +654,39 @@ export function extractInjectedBySurface(transcriptPath, opts = {}) {
   return out;
 }
 
+/**
+ * Per-face count of how many DISTINCT hook attachments injected each id (D#193).
+ *
+ * `extractInjectedBySurface` returns Sets, which is right for every consumer that asks
+ * "was this id injected" — and useless for the one question the path-A exclude set exists
+ * to answer, which is "was it injected AGAIN". This is the same walk and the same
+ * SURFACE_MATCHERS table, deliberately not a second copy of either: the repo's standing
+ * defect here is a ruler that re-implements the shipped extractor and then measures its
+ * own twin (`benchmark/cite-recall.mjs`'s hand-copied markers, v3.81.0).
+ *
+ * Counting is per ATTACHMENT, not per occurrence within one: one block listing `#42`
+ * twice is one injection of #42, and the exclude set would not have suppressed it.
+ *
+ * @param {string|null|undefined} transcriptPath
+ * @param {{mainOnly?: boolean}} [opts]
+ * @returns {Record<string, Map<number, number>>} face -> (id -> attachments carrying it)
+ */
+export function countInjectedBySurface(transcriptPath, opts = {}) {
+  const out = {};
+  for (const face of ATTACHMENT_SURFACES) out[face] = new Map();
+  eachHookAttachment(transcriptPath, (ctx) => {
+    for (const face of ATTACHMENT_SURFACES) {
+      const matcher = SURFACE_MATCHERS[face];
+      if (!matcher.accepts(ctx)) continue;
+      // Per-attachment set first, so two mentions inside ONE block count once.
+      const here = new Set();
+      matcher.collect(ctx.text, (raw) => addObsId(here, raw));
+      for (const id of here) out[face].set(id, (out[face].get(id) || 0) + 1);
+    }
+  }, opts);
+  return out;
+}
+
 // Per-face extractors: thin wrappers over the shared table, kept as named
 // exports because callers and tests address individual faces.
 function extractOneSurface(face, transcriptPath, opts) {
@@ -830,13 +863,14 @@ export function extractAllInjected(transcriptPath, opts = {}) {
  *   changed the top-1 in 3 of 78. The bound is now IMPERATIVE_POOL_BACKSTOP = 5000,
  *   documented there as an OOM backstop and not a relevance gate.
  *
- *   A 3->2 demotion is a down-rank again. A 2->1 demotion is still an EVICTION, because
- *   the pool gate is `>= 2` and IMPORTANCE_FLOOR is 1 — and widening is what first makes
- *   importance=2 rows reachable by this face at all, so it creates the injections that can
- *   walk one there. Measured exposure is one row; see the constant's docblock. `subagent`
- *   shares that pool and inherits both halves. Still open in D#172: admitting `subagent`
- *   to the denominator, which is a separate decision needing the receiver-attributed cites
- *   merged asymmetrically.
+ *   The demotion half of that paragraph is now MOOT rather than merely improved:
+ *   D#179/D#198 stopped this loop writing `importance` at all, so neither a 3->2 nor a
+ *   2->1 walk can happen through decay and the pool gate `>= 2` is no longer something
+ *   citations move a row across. The widening still matters on its own terms — it is
+ *   what makes importance=2 rows reachable by this face — but the eviction risk it used
+ *   to carry is gone with the writes. `subagent` shares that pool. Still open in D#172:
+ *   admitting `subagent` to the denominator, which is a separate decision needing the
+ *   receiver-attributed cites merged asymmetrically.
  */
 const DECAY_EXCLUDED_SURFACES = new Set();
 
@@ -906,21 +940,32 @@ export const DECAY_DENOMINATOR_SURFACES = ATTACHMENT_SURFACES.filter((f) => !DEC
  *   FOUR of the five are 3->2 down-ranks (#8597, #8847 with cited_count 56, #8948,
  *   #10246). THE FIFTH WAS AN EVICTION and the first draft of this note said there were
  *   none: at 2026-08-25 18:00Z, #10716 sat at importance = 2, so its next miss would take
- *   it to IMPORTANCE_FLOOR = 1 — under the `COALESCE(importance, 1) >= 2` gate in
+ *   it to the floor of 1 (`IMPORTANCE_FLOOR`, a constant this loop no longer has — see the
+ *   correction two paragraphs down) — under the `COALESCE(importance, 1) >= 2` gate in
  *   rankImperativeCandidates, which is the candidate pool of the very face being
  *   admitted. IMPERATIVE_POOL_BACKSTOP closed the 3->2 eviction in v3.82.0 and 2->1 was
  *   always documented as still evicting; writing "down-ranks, not evictions" required
  *   assuming the marginal population was all importance = 3, which one query refutes.
  *   Count it before repeating it.
  *
- *   THAT ROW IS NO LONGER IN THAT STATE, AND THE REASON IS THIS LOOP (D#179). #10716 now
- *   reads importance 3 / uncited_streak 0 / demoted_at cleared, promoted by the session
- *   that WROTE THIS PARAGRAPH: `#10716` occurs 21 times in that session's assistant text,
- *   extractCitationsFromTranscript scans assistant text for `#NN`, and applyCitationDecay
- *   promotes on a hit. Discussing a memory is indistinguishable from applying it here.
- *   Anything in this file that quotes live decay STATE is therefore perturbed by being
- *   written down; quote it with a timestamp, and prefer the structural claim (the marginal
- *   population is not all importance = 3) to the row that demonstrated it.
+ *   THAT ROW WAS NO LONGER IN THAT STATE, AND AT THE TIME THE REASON WAS THIS LOOP (D#179).
+ *   #10716 read importance 3 / uncited_streak 0 / demoted_at cleared, promoted by the
+ *   session that WROTE THIS PARAGRAPH: `#10716` occurs 21 times in that session's assistant
+ *   text, extractCitationsFromTranscript scans assistant text for `#NN`, and at that time
+ *   applyCitationDecay raised `importance` on a hit. Discussing a memory was
+ *   indistinguishable from applying it.
+ *
+ *   CORRECTED (v3.88.0, D#179/D#198): that mechanism is gone. Neither branch of this loop
+ *   writes `importance` any more, so citing a row cannot promote it HERE and the specific
+ *   self-promotion described above can no longer occur. Two things still hold and are the
+ *   reason the paragraph is kept rather than deleted. The general warning stands — anything
+ *   in this file quoting live decay STATE is perturbed by being written down, since the
+ *   loop still writes `cited_count`, `uncited_streak`, `demoted_at` and the session
+ *   columns on a citation — so quote it with a timestamp and prefer the structural claim
+ *   (the marginal population is not all importance = 3) to the row that demonstrated it.
+ *   And a citation can still reach `importance` by a SECOND path this loop does not own:
+ *   `bumpCitationAccess` credits `access_count`, and the `boost` maintain op raises
+ *   `importance` by 1 above `access_count > 3` (D#206, open).
  *
  *   Cross-crediting — a main-face id the main thread never cited but a subagent did — is
  *   3 pairs. The denominator giving 0.25% is DISTINCT (session,id) across the five decay
@@ -1170,54 +1215,40 @@ export function hasMainThreadAssistantText(transcriptPath) {
   return false;
 }
 
-const IMPORTANCE_CAP = 3;
-// Demote floor = 1, NOT 0. Both passive injection surfaces exclude importance 0
-// (pre-tool-recall.js requires >=2, user-prompt-search.js requires >=1), so a row
-// demoted to 0 can never be re-injected → never re-cited → never recovers: a one-way
-// burial that silently hides lesson-bearing rows the "lessons never auto-GC" guards
-// (maintain decayAndMarkIdle + compress-core) protect on every other path. Floor 1
-// keeps a decayed row on the >=1 surface with a citation-recovery path. Genuine noise
-// still sinks via maintain's PENDING_PURGE pipeline, which keys on compressed_into
-// (not importance) over injection_count=0 rows — a disjoint population from these
-// injected-but-uncited rows — so noise GC is unaffected.
-const IMPORTANCE_FLOOR = 1;
+// IMPORTANCE_CAP (3) and IMPORTANCE_FLOOR (1) lived here until D#179/D#198 took
+// `importance` out of this loop entirely; both are gone rather than kept unused.
+// The reasoning behind the FLOOR is preserved because it is the sharpest statement
+// of why decay must not move this column at all: both passive injection surfaces
+// exclude importance 0 (pre-tool-recall.js requires >= 2, user-prompt-search.js
+// requires >= 1), so a row demoted to 0 could never be re-injected -> never
+// re-cited -> never recover. The floor bounded that one-way burial at the bottom
+// of the scale; it could do nothing about the same mechanism one step up, where
+// a 3 -> 2 evicts a row from the `>= 3` tier arm of the Key Context pool. Genuine
+// noise still sinks via maintain's PENDING_PURGE pipeline, which keys on
+// compressed_into (not importance) over injection_count = 0 rows.
 const UNCITED_STREAK_THRESHOLD = 3;
 
-// Adoption-rate gate (P5 ②). A project's cite-rate is SUM(cited_count) /
-// SUM(decay_seen_count) over its non-superseded observations: of every decay
-// resolution this project has ever produced, what fraction were citations.
-// Below ADOPTION_THRESHOLD with at least ADOPTION_MIN_SEEN resolutions on record,
-// the project has demonstrably not adopted the #NN convention, so we suppress
-// DEMOTION (never promotion) — see the construct-validity note on
-// applyCitationDecay. MIN_SEEN keeps the gate dormant for low-data projects so
-// the established behavior is preserved until there's enough signal to judge.
-const ADOPTION_THRESHOLD = 0.02;
-const ADOPTION_MIN_SEEN = 8;
-
-/**
- * Compute a project's citation-adoption snapshot: total citations vs total decay
- * resolutions on record, and their ratio. Read-only; safe to call before the
- * decay transaction (the gate decision is made on the pre-mutation snapshot).
- *
- * @param {import('better-sqlite3').Database} db
- * @param {string} project
- * @returns {{cited: number, seen: number, rate: number}}
- */
-export function computeCitationAdoption(db, project) {
-  const empty = { cited: 0, seen: 0, rate: 0 };
-  if (!db || !project) return empty;
-  try {
-    const row = db.prepare(`
-      SELECT COALESCE(SUM(cited_count), 0)       AS cited,
-             COALESCE(SUM(decay_seen_count), 0)  AS seen
-        FROM observations
-       WHERE project = ? AND superseded_at IS NULL
-    `).get(project);
-    const cited = row?.cited || 0;
-    const seen = row?.seen || 0;
-    return { cited, seen, rate: seen > 0 ? cited / seen : 0 };
-  } catch (e) { debugCatch(e, 'computeCitationAdoption'); return empty; }
-}
+// The adoption-rate gate (P5 ②) lived here, with computeCitationAdoption feeding
+// it and a streak CAP as its other half. All three are gone — D#204.
+//
+// It suppressed the demote branch in a project whose cite-rate was ~0 over enough
+// resolutions, on the reasoning that such a project has not adopted the `#NN`
+// convention and a demotion there is a false negative it could never earn back.
+// That reasoning was entirely about `importance`, which D#179 removed from this
+// loop. What was left behind was inverted: the suppressed path capped
+// uncited_streak at threshold-1 and so never returned to 0 without a citation,
+// pinning those projects' rows at citeFactor 0.5x permanently, while an adopting
+// project's rolled back to 1.0x every third resolution. The gate written to be
+// gentler on non-adopting projects had become the only thing punishing them.
+//
+// The cap's stated purpose — keep the streak from climbing unbounded into the
+// citeFactor floor — is served by the rollover itself, and served better, since
+// the rollover also recovers. One path for every project.
+//
+// CLAUDE_MEM_CITATION_ADOPTION_THRESHOLD tuned the gate. It is now inert, and
+// warned about rather than silently ignored (see applyCitationDecay): a setting
+// that is accepted but means nothing is worse than one that is unsupported.
+let adoptionThresholdWarned = false;
 
 /**
  * D#61: a lesson injected live and then superseded mid-session (auto-dedup /
@@ -1264,8 +1295,49 @@ export function redirectSupersededIds(db, project, ids) {
  * Apply the citation-feedback loop for one session: for each injected obs id,
  * decide cited vs uncited and mutate importance/streak/cited_count per spec.
  *
- * - cited: importance += 1 (cap 3), cited_count += 1, streak = 0.
- * - uncited: streak += 1; if it reaches 3, importance -= 1 (floor 1, IMPORTANCE_FLOOR), streak = 0.
+ * - cited: cited_count += 1, streak = 0, demoted_at cleared.
+ * - uncited: streak += 1; if it reaches 3, streak = 0 and demoted_at is stamped.
+ *
+ * D#179 / D#198 — THIS LOOP NO LONGER WRITES `importance`, on any branch.
+ * `importance` was carrying two jobs at once: a relevance prior AND a
+ * pool-admission gate. Every injection surface gates on it — `>= 1` or `>= 2` on
+ * the prompt faces, and hook-context's Key Context tier arms use `>= 1 / >= 2 /
+ * >= 3` — so a decay-driven 3 -> 2 was not a down-rank, it removed the row from
+ * the candidate POPULATION. That is the D#172 shape, confirmed on the imperative
+ * pool (v3.82.0) and then on the Key Context pool, where 45 of ~106 pool rows sat
+ * in the band where one demotion is an eviction (D#198).
+ *
+ * The ranking half of the loop is unaffected and was never the problem:
+ * cited_count and uncited_streak still feed citeFactorClause, a BOUNDED
+ * [0.4, 3.0] pure multiplier. So the feedback loop still responds to observed
+ * agent behaviour — it just does so by re-ranking within the population instead
+ * of by changing who is in it. Given that no available signal separates "acted on
+ * this lesson" from "wrote about this lesson" (D#179; a release-note session
+ * promotes exactly the rows it discusses, and the mention/application split
+ * measured on the live corpus is not a bound in either direction), a bounded rank
+ * shift is the right cost for a mis-read citation. An eviction is not.
+ *
+ * NOT covered by this change, and stated so nobody reads it as "citations can no
+ * longer move importance": `bumpCitationAccess` credits `access_count`, and the
+ * `boost` maintain op lifts `importance + 1` above `access_count > 3`. That is a
+ * SECOND, independent citation -> importance path (obs #10911, D#206).
+ *
+ * Scope it correctly — an earlier version of this paragraph said "for any `#NN` in
+ * assistant text", which has been false since v3.84.0 (f9a9eae). The credit is gated
+ * on `buildCitationRelevanceSet`: the id must have been injected on one of the five
+ * attachment faces, or by Key Context, or into a subagent, or typed by the user. A
+ * bare mention of an id you were never shown credits nothing, and the revert switch
+ * is CLAUDE_MEM_CITATION_RELEVANCE_GATE=off. What the gate does NOT ask is whether
+ * you acted on the lesson — an injected id named only in prose is still credited —
+ * which is why the path is open rather than closed.
+ *
+ * Measured before deciding to leave it (2026-09-02, live DB + 98 transcripts): 52
+ * rows are currently boost-eligible; 25 of them are cited nowhere in the corpus, and
+ * at most 3 could have crossed `access_count > 3` on citations even under an upper
+ * bound that ignores the gate entirely. So the path is real and its effect is small.
+ * It is untouched here because `access_count` has other writers (explicit recall /
+ * get / timeline) and is also an input to noisePenaltyClause, so changing it is a
+ * different decision with a different blast radius.
  * - per-(session, obs) idempotent via last_decided_session_id; re-running for
  *   the same session is a no-op (Stop hook may fire more than once).
  * - cross-project IDs are silently ignored by the WHERE clause.
@@ -1277,13 +1349,17 @@ export function redirectSupersededIds(db, project, ids) {
  *   2. (cite-back) the agent edited a file a prior lesson #NN had warned about —
  *      unioned into citedIds by the Stop handler before this call.
  * Signal 2 was added because signal 1 alone penalizes projects that act on a
- * lesson without typing its id. Even so, both are proxies. For a project that has
- * never cited anything (cite-rate below ADOPTION_THRESHOLD over ≥ADOPTION_MIN_SEEN
- * resolutions), demotion is suppressed: absent any positive signal we cannot
- * distinguish "useless lesson" from "useful lesson in a project that doesn't use
- * the #NN convention," and a false demotion is the costlier error. The gate trades
- * missed demotions (stale lessons linger) for avoided false demotions. Promotion
- * is never gated — a single citation lifts the project's rate and re-enables decay.
+ * lesson without typing its id. Even so, both are proxies, and nothing available
+ * separates "acted on this lesson" from "wrote about this lesson".
+ *
+ * That imprecision used to be answered with a per-project adoption gate that
+ * suppressed demotion where the cite-rate was ~0. It is gone (D#204), because the
+ * cost it was insuring against — losing `importance`, i.e. dropping out of the
+ * candidate pool — is gone too (D#179). What the proxies can still get wrong is
+ * bounded on its own: a mis-read citation moves citeFactorClause within
+ * [0.4, 3.0] and nothing else. The uncited streak rolls over at
+ * UNCITED_STREAK_THRESHOLD in every project, so a lesson in a project that never
+ * types `#NN` is not driven monotonically downward — it oscillates and recovers.
  *
  * @param {import('better-sqlite3').Database} db
  * @param {string} project
@@ -1303,16 +1379,22 @@ export function applyCitationDecay(db, project, injectedIds, citedIds, sessionId
   injected = redirectSupersededIds(db, project, injected);
   cited = redirectSupersededIds(db, project, cited);
 
-  // Adoption gate (snapshot taken before any mutation this run). Suppress only
-  // demotion; promotion always proceeds. Threshold overridable via env.
-  const adoption = computeCitationAdoption(db, project);
-  const envThreshold = Number.parseFloat(process.env.CLAUDE_MEM_CITATION_ADOPTION_THRESHOLD);
-  const adoptionThreshold = Number.isFinite(envThreshold) && envThreshold >= 0 ? envThreshold : ADOPTION_THRESHOLD;
-  const suppressDemotion = adoption.seen >= ADOPTION_MIN_SEEN && adoption.rate < adoptionThreshold;
+  // D#204: the adoption gate is gone. Its env override is still READ, once, only
+  // to say out loud that it no longer does anything — the alternative is a
+  // setting a user can configure and watch have no effect.
+  if (!adoptionThresholdWarned && process.env.CLAUDE_MEM_CITATION_ADOPTION_THRESHOLD !== undefined) {
+    adoptionThresholdWarned = true;
+    try {
+      process.stderr.write(
+        '[claude-mem-lite] CLAUDE_MEM_CITATION_ADOPTION_THRESHOLD is set but no longer has any effect — '
+        + 'the citation-decay adoption gate was removed (D#204). Unset it.\n'
+      );
+    } catch (e) { debugCatch(e, 'adoption-threshold-warn'); }
+  }
 
   const selectStmt = db.prepare(
-    // superseded_at IS NULL: mirror computeCitationAdoption + the 4 injection SELECTs so a
-    // row superseded mid-session (injected live, then auto-dedup supersedes it before this
+    // superseded_at IS NULL: mirror the 4 injection SELECTs so a row superseded
+    // mid-session (injected live, then auto-dedup supersedes it before this
     // decay resolves) is not decayed/streaked/mutated — defense-in-depth parity.
     'SELECT id, importance, uncited_streak, last_decided_session_id, last_cited_session_id FROM observations WHERE id = ? AND project = ? AND superseded_at IS NULL'
   );
@@ -1341,8 +1423,7 @@ export function applyCitationDecay(db, project, injectedIds, citedIds, sessionId
   // list would silently renumber if a clause were ever reordered.
   const updatePromote = db.prepare(`
     UPDATE observations
-       SET importance = MIN(@cap, COALESCE(importance, 1) + 1),
-           cited_count = cited_count + 1,
+       SET cited_count = cited_count + 1,
            uncited_streak = 0,
            demoted_at = NULL,
            last_decided_session_id = @session,
@@ -1361,22 +1442,16 @@ export function applyCitationDecay(db, project, injectedIds, citedIds, sessionId
            decay_seen_count = decay_seen_count + 1
      WHERE id = ?
   `);
-  // Suppressed (non-adopting) projects never demote, so uncited_streak would grow
-  // UNBOUNDED — and citeFactorClause penalizes -0.25*streak (floor 0.4), pinning every
-  // memory at the ranking floor with no recovery path. Cap at UNCITED_STREAK_THRESHOLD-1
-  // to hold the [0, threshold-1] steady state the scoring header asserts (in an adopting
-  // project the streak resets to 0 on demote, so the STORED value never exceeds 2).
-  const updateStreakCapped = db.prepare(`
-    UPDATE observations
-       SET uncited_streak = MIN(uncited_streak + 1, ?),
-           last_decided_session_id = ?,
-           decay_seen_count = decay_seen_count + 1
-     WHERE id = ?
-  `);
+  // D#179/D#198: this branch no longer touches `importance`. It is the STREAK
+  // ROLLOVER: at UNCITED_STREAK_THRESHOLD the streak resets to 0 and the moment
+  // is stamped in demoted_at. The name and the returned `demoted` counter are
+  // kept because both are load-bearing for callers and citation-stats; what
+  // changed is that the rollover is now a bookkeeping event, not a change of
+  // population membership. Resetting the streak (rather than pinning it) is what
+  // holds citeFactorClause's documented [0, threshold-1] steady state.
   const updateDemote = db.prepare(`
     UPDATE observations
-       SET importance = MAX(?, COALESCE(importance, 1) - 1),
-           uncited_streak = 0,
+       SET uncited_streak = 0,
            last_decided_session_id = ?,
            demoted_at = ?,
            decay_seen_count = decay_seen_count + 1
@@ -1403,7 +1478,7 @@ export function applyCitationDecay(db, project, injectedIds, citedIds, sessionId
         // decay_seen_count and the funnel's injected_n (cite-rate would read N/2, not N/1).
         const firstResolution = !decidedThisSession;
         updatePromote.run({
-          cap: IMPORTANCE_CAP, session: sessionId, seenInc: firstResolution ? 1 : 0, id,
+          session: sessionId, seenInc: firstResolution ? 1 : 0, id,
         });
         promoted++;
         if (firstResolution) touched++;
@@ -1413,15 +1488,12 @@ export function applyCitationDecay(db, project, injectedIds, citedIds, sessionId
         if (decidedThisSession) continue;
         touched++;
         const nextStreak = (row.uncited_streak || 0) + 1;
-        // Demote only when the streak is up AND the project has demonstrably
-        // adopted citations. A non-adopting project advances the streak (idempotent
-        // bookkeeping) but never loses importance — see construct-validity note.
-        if (nextStreak >= UNCITED_STREAK_THRESHOLD && !suppressDemotion) {
-          updateDemote.run(IMPORTANCE_FLOOR, sessionId, Date.now(), id);
+        // D#204: one path for every project. The rollover both bounds the streak
+        // (so citeFactorClause cannot sink toward its floor) and lets it recover
+        // to 0 without requiring a citation.
+        if (nextStreak >= UNCITED_STREAK_THRESHOLD) {
+          updateDemote.run(sessionId, Date.now(), id);
           demoted++;
-        } else if (suppressDemotion) {
-          // Never-demoting project: cap the streak so cite_factor can't sink to floor.
-          updateStreakCapped.run(UNCITED_STREAK_THRESHOLD - 1, sessionId, id);
         } else {
           updateStreakOnly.run(sessionId, id);
         }

package/lib/deferred-work.mjs

@@ -119,6 +119,55 @@ export function dropDeferred(db, id, reason) {
   return { changed: r.changes };
 }
 
+/**
+ * Reasons that mean "this item was FIXED", for which `defer drop` is the wrong
+ * verb — dropping loses the closed_by_obs_id link that `save --closes-deferred`
+ * would have written, and leaves the row indistinguishable from a genuinely
+ * rejected one (D#195; v3.86.0 dropped six fixed items this way).
+ *
+ * Deliberately a POSITIVE pattern for the fixed-shape, not a stop-list of
+ * rejection wordings: the set of ways to say "no longer relevant" is open-ended,
+ * the set of ways to say "done" is small. Advisory only — the drop still
+ * succeeds, so a false positive costs one line of output.
+ */
+// `closed` and `landed` are here because of the six real v3.86.0 mis-drops this
+// hint exists to prevent: their reason was "closed this round; fix + mutation-
+// verified binding test landed", which an earlier draft anchored on `fixed` and
+// `closed by` and therefore MISSED — the motivating case fell through its own
+// predicate. Bare `fix` is deliberately NOT here: "waiting for an upstream fix"
+// is a legitimate rejection and carries no veto word in English.
+const DROP_REASON_FIXED_RE = /\b(fixed|implemented|shipped|resolved|done|closed|landed)\b|修复|已实现|已完成|完成了|已发布|已解决/i;
+
+/**
+ * Negative-sense veto, applied to the WHOLE reason before the positive pattern.
+ *
+ * A lookbehind cannot do this job: the sense-carrying word is not adjacent to the
+ * keyword. "等待上游修复" (waiting for an upstream fix) puts 游 immediately before
+ * 修复, so `(?<![待未需])修复` still fires on it — measured, which is why the
+ * predicate is two-stage rather than one clever pattern. Suppression is the safe
+ * direction here: a missed hint costs nothing, a wrong hint trains the reader to
+ * ignore the line.
+ */
+// `wontfix` is spelled with no boundary after `wont`, so a plain `won'?t\b` misses the
+// single most common English way of writing this rejection and the hint then fires on
+// "resolved as wontfix" — the positive arm's `resolved` winning over a veto that never
+// ran. Matched explicitly rather than by loosening the boundary, which would also admit
+// `wonton`. (pre-tag review v3.88.0, correctness N4)
+const DROP_REASON_NOT_YET_RE = /\bwon'?tfix\b|\b(not|won'?t|cannot|can'?t|unable|pending|todo|blocked|waiting|obsolete|superseded|duplicate|irrelevant|refuted)\b|待|未|尚|需|无法|暂不|过时|重复|取代/i;
+
+/**
+ * @param {string} reason The drop reason about to be recorded.
+ * @returns {string|null} Advisory hint, or null when the reason does not look
+ *          like a completion.
+ */
+export function formatDropReasonHint(reason) {
+  if (typeof reason !== 'string') return null;
+  if (DROP_REASON_NOT_YET_RE.test(reason)) return null;
+  if (!DROP_REASON_FIXED_RE.test(reason)) return null;
+  return '⚠ that reason reads like the item was FIXED — prefer `save --closes-deferred D#<id>`, '
+    + 'which records status=done plus the closing observation id. `drop` records a rejection.';
+}
+
 /**
  * Fetch full deferred_work rows by raw id — ANY status, input order preserved,
  * missing ids omitted. This is the read half of the D# surface: `defer list`
@@ -161,6 +210,11 @@ export function formatDeferredDetail(row) {
   if (row.created_at_epoch) lines.push(`created: ${new Date(row.created_at_epoch).toISOString()}`);
   if (row.status === 'dropped' && row.drop_reason) lines.push(`drop_reason: ${row.drop_reason}`);
   if (row.status === 'done' && row.closed_by_obs_id) lines.push(`closed_by: #${row.closed_by_obs_id}`);
+  // D#195: a row re-closed out of 'dropped' keeps its drop_reason. Render it under
+  // a distinct label rather than dropping it from the view — the mis-drop is the
+  // part a later reader needs, and a `drop_reason:` line on a done row would read
+  // as a contradiction.
+  if (row.status === 'done' && row.drop_reason) lines.push(`previously_dropped: ${row.drop_reason}`);
   return lines.join('\n');
 }
 
@@ -258,18 +312,31 @@ export function formatDeferredSearchTrailer(rows, invokeHint) {
 
 /**
  * Resolve mixed ordinal (int) + raw-id ("D#<n>") tokens to real deferred_work
- * ids, validated against caller project + status='open'.
+ * ids, validated against caller project + an allowed status set.
  *
  * - bare integer N → ordinal-within-project (uses same ROW_NUMBER as listOpenWithOrdinal)
- * - "D#<n>" string → raw deferred_work.id; must belong to caller project AND be open
+ * - "D#<n>" string → raw deferred_work.id; must belong to caller project AND
+ *   carry an allowed status
+ *
+ * `allowStatuses` defaults to open-only, which is the DROP verb's policy and the
+ * historical behaviour of every caller. The CLOSE verb (`save --closes-deferred`)
+ * passes `['open', 'dropped']` per D#195: dropping an item that was actually
+ * fixed used to be a one-way gate, permanently losing the closed_by_obs_id link.
+ * 'done' is never allowed under either policy — re-closing would overwrite an
+ * existing obs link with a different one.
+ *
+ * Ordinals stay open-only under every policy: the ROW_NUMBER that defines them
+ * is computed over open rows, so a dropped row simply has no ordinal to name.
+ * Reaching one requires the explicit `D#<n>` form.
  *
  * @param {Database} db
  * @param {string} project Caller project (FK guard)
  * @param {Array<number|string>} tokens Mixed input
+ * @param {{allowStatuses?: string[]}} [opts]
  * @returns {number[]} Real deferred_work ids in input order
  * @throws {Error} On unresolvable input — error message names the offending token
  */
-export function resolveDeferredIds(db, project, tokens) {
+export function resolveDeferredIds(db, project, tokens, { allowStatuses = ['open'] } = {}) {
   if (!Array.isArray(tokens)) throw new Error('tokens must be an array');
   // Pre-load open list once for ordinal resolution (ROW_NUMBER snapshot stable
   // within this call so [1, 2] resolves consistently).
@@ -300,10 +367,11 @@ export function resolveDeferredIds(db, project, tokens) {
       if (row.project !== project) {
         throw new Error(`D#${id} belongs to project "${row.project}", not "${project}"`);
       }
-      if (row.status !== 'open') {
+      if (!allowStatuses.includes(row.status)) {
         // Verb-neutral: resolveDeferredIds is shared by close (save --closes-deferred)
         // AND drop (mem_defer_drop), so "cannot close" mis-described the drop path.
-        throw new Error(`D#${id} status is "${row.status}" — only 'open' items can be closed or dropped`);
+        const allowed = allowStatuses.map(s => `'${s}'`).join(' or ');
+        throw new Error(`D#${id} status is "${row.status}" — only ${allowed} items are accepted here`);
       }
     } else {
       throw new Error(`invalid token type ${typeof t} — expected D#N or integer ordinal`);
@@ -327,7 +395,7 @@ export function resolveDeferredIds(db, project, tokens) {
  * @param {Database} db
  * @param {number[]} ids Already-resolved real ids (use resolveDeferredIds first)
  * @param {number} closingObsId observations.id that proves closure
- * @throws {Error} If any id is not currently open (lookup-based safety net)
+ * @throws {Error} If any id is neither 'open' nor 'dropped' (lookup-based safety net)
  */
 export function closeDeferredItems(db, ids, closingObsId) {
   if (!Array.isArray(ids) || ids.length === 0) return;
@@ -337,17 +405,22 @@ export function closeDeferredItems(db, ids, closingObsId) {
   // Defense-in-depth: even if caller already validated via resolveDeferredIds,
   // re-check status here (caller may have done resolution earlier in the same
   // transaction without holding a lock).
+  //
+  // D#195: 'dropped' is closable. drop_reason is intentionally NOT cleared — the
+  // row's history is what makes a mis-drop auditable, and formatDeferredDetail
+  // renders it as `previously_dropped:` once the status is 'done'. 'done' stays
+  // excluded so a second close cannot overwrite an existing closed_by_obs_id.
   const stmt = db.prepare(`
     UPDATE deferred_work
     SET status='done', closed_at_epoch=?, closed_by_obs_id=?
-    WHERE id=? AND status='open'
+    WHERE id=? AND status IN ('open', 'dropped')
   `);
   const now = Date.now();
   const tx = db.transaction((idList) => {
     for (const id of idList) {
       const r = stmt.run(now, closingObsId, id);
       if (r.changes !== 1) {
-        throw new Error(`closeDeferredItems: id ${id} was not in 'open' status (changes=${r.changes})`);
+        throw new Error(`closeDeferredItems: id ${id} was not in a closable status ('open' or 'dropped') (changes=${r.changes})`);
       }
     }
   });

package/lib/events-injection.mjs

@@ -20,9 +20,20 @@
 // row is never mis-attributed to an observation id (which would let citation decay
 // mutate an unrelated observation sharing that id). Events carry no citation columns,
 // so they inject as reference-only — reachability, not decay bookkeeping.
+//
+// D#202: that paragraph was true of the faces it names and FALSE of the one it does
+// not. `scripts/pre-tool-recall.js` renders its own merged obs+event rows and used a
+// bare `#` for both, so nearly half of that channel's injected rows (44.9%, measured
+// over 4227 firings) were event ids entering the observation decay denominator —
+// exactly the mis-attribution this prefix exists to prevent. The invariant was stated
+// here while the face that broke it lived elsewhere and was not enumerated. The prefix
+// is now a shared constant (lib/injected-ids.mjs, a leaf so the hot PreToolUse path
+// need not pull this file's search-core chain) and
+// tests/pretool-event-id-namespace.test.mjs sweeps both renderers.
 
 import { searchEventsFts } from './search-core.mjs';
 import { neutralizeContextDelimiters } from '../format-utils.mjs';
+import { EVENT_ID_PREFIX } from './injected-ids.mjs';
 
 const DEFAULT_LIMIT = 3;
 const DEFAULT_MIN_IMPORTANCE = 2;
@@ -98,7 +109,7 @@ export function renderInjectableEvent(row) {
   // hook-llm.mjs behind `if (EVENT_TYPE_SET.has(summary.type))`), so it carries no
   // injection markers and is intentionally NOT defanged — mirrors the un-defanged
   // `[type]` for observations. If an unvalidated event writer is ever added, defang it.
-  const head = `E#${row.id} [${row.type}] ${title}`;
+  const head = `${EVENT_ID_PREFIX}${row.id} [${row.type}] ${title}`;
   if (row.lesson_learned) {
     const lesson = neutralizeContextDelimiters(row.lesson_learned.trim().slice(0, LESSON_MAX));
     if (lesson) return `${head} — ${lesson}`;

package/lib/injected-ids.mjs

@@ -95,6 +95,23 @@ export function injectedIdKey(id, src = 'obs') {
   return src === 'evt' ? `E${id}` : String(id);
 }
 
+/**
+ * DISPLAY prefix for an event id rendered into an injected line, as opposed to
+ * `injectedIdKey` above, which namespaces the same id inside the marker FILE.
+ * Two forms of one convention: the marker key is `E<id>` (no `#`, it is not
+ * citable text), the rendered token is `E#<id>` (the `#` is what makes an id
+ * look like an id to a reader).
+ *
+ * It lives in this leaf module — rather than beside either renderer — because
+ * D#202 was exactly the two renderers not agreeing. lib/events-injection.mjs
+ * had the `E#` convention and a header explaining it; scripts/pre-tool-recall.js
+ * rendered its own merged obs+event rows with a bare `#`, putting 44.9% of that
+ * channel's ids into the observation citation-decay denominator. Importing from
+ * here also keeps the hot PreToolUse path off events-injection.mjs's
+ * search-core.mjs dependency chain.
+ */
+export const EVENT_ID_PREFIX = 'E#';
+
 /**
  * Runtime-dir FILE NAME for the SessionStart Key Context marker: the obs ids
  * ACTUALLY rendered into the <claude-mem-context> File Lessons / Key Context

package/lib/maintain-core.mjs

@@ -265,8 +265,10 @@ export function recoverOrphanedChildren(db, { projectFilter = '', baseParams = [
   `).run(...baseParams).changes;
 }
 
-// Heal lesson-bearing rows that citation-decay buried at importance 0 under the old
-// IMPORTANCE_FLOOR=0 (fixed in citation-tracker.mjs → floor 1). All passive injection
+// Heal lesson-bearing rows that citation-decay buried at importance 0 back when its floor
+// was 0. That loop was later given a floor of 1, and as of D#179/D#198 it does not write
+// `importance` on any branch at all — so this op no longer has an active producer and only
+// drains the historical backlog. Keep it: nothing else lifts a stranded 0. All passive injection
 // surfaces exclude importance 0 (pre-tool-recall >=2, user-prompt-search >=1, memory-context
 // >=1), so a lesson demoted there is invisible AND — being injection_count>0 by construction
 // — sits in no GC queue either (decayAndMarkIdle only marks injection_count=0 rows): stranded

package/lib/native-binding-hint.mjs

@@ -21,7 +21,7 @@
 // property: it only `createRequire`s better-sqlite3 lazily inside its functions,
 // so importing it never dlopen's the very binding this module reports on.
 
-import { join } from 'node:path';
+import { join, dirname } from 'node:path';
 import { readFileSync, writeFileSync, mkdirSync, renameSync, unlinkSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { isNativeBindingError, flattenBindingError } from './binding-probe.mjs';
@@ -42,7 +42,10 @@ export const NATIVE_BINDING_BROKEN_MARKER = 'native-binding-broken';
 // `repair`: repair re-downloads and Ed25519-verifies a whole GitHub release and
 // fails closed offline — the wrong (often impossible) tool for recompiling one
 // native module against the running Node. (review #3)
-const CLI_REBUILD_BINDING = `node ${fileURLToPath(new URL('../cli.mjs', import.meta.url))} rebuild-binding`;
+// D#207: join(), not `new URL('../cli.mjs', …)` — that form makes knip drop the named
+// module out of its unused-export report. cli.mjs is a knip entry point so nothing was
+// lost here, but the rule is enforced for the class rather than per-file.
+const CLI_REBUILD_BINDING = `node ${join(dirname(fileURLToPath(import.meta.url)), '..', 'cli.mjs')} rebuild-binding`;
 
 // Stable-ish identity of a fault so DISTINCT failures get DISTINCT cooldown
 // windows: the same fault → same key (suppressed within the window), a different