claude-mem-lite 3.91.0 → 3.92.0

package/scripts/user-prompt-search.js

@@ -15,11 +15,10 @@ import { join, sep } from 'path';
 import { pathToFileURL } from 'url';
 import Database from 'better-sqlite3';
 import { shouldSkip, computeEffectiveLen, detectIntent, shouldSkipByDedup, extractFiles, extractErrorSignature, extractDeferredRefs, DEDUP_STALE_MS, matchRegistrySkillName, detectMemOverride } from './prompt-search-utils.mjs';
-import { injectedIdsFileName } from '../lib/injected-ids.mjs';
+import { injectedIdsFileName, mergeInjectedMarker } from '../lib/injected-ids.mjs';
 import { getDeferredByIds } from '../lib/deferred-work.mjs';
 import { recommendSkill } from '../registry-recommend.mjs';
 import { recordHookError } from '../lib/hook-telemetry.mjs';
-import { atomicWriteFileSync } from '../lib/atomic-write.mjs';
 
 import { DAY_MS } from '../lib/time-constants.mjs';
 // ─── Constants ──────────────────────────────────────────────────────────────
@@ -671,26 +670,12 @@ async function main() {
         // window skips re-injection. A later FTS-path write replaces ids wholesale
         // (accepted: worst case is one cheap re-injection after an obs-emitting
         // prompt inside the same 5-min window).
+        // union: the M-6 same-session/staleness gate + the atomic write live in
+        // lib/injected-ids.mjs (audit 2026-09-02 P1-2). `dedupIds` are `D<id>` strings, so
+        // the lib's union-side String() is the identity here — same bytes as before.
         try {
-          let prevIds = [];
-          let prevCount = 0;
-          try {
-            const prev = JSON.parse(readFileSync(injectedIdsFile, 'utf8'));
-            // M-6: inherit only same-session (or legacy) state — another session's
-            // ids/count must not carry over. Atomic write below: a torn concurrent
-            // write left the shared marker as invalid JSON (dedup silently off).
-            if (prev.ts && Date.now() - prev.ts < DEDUP_STALE_MS
-                && !(prev.session && hookData.session_id && prev.session !== hookData.session_id)) {
-              prevIds = Array.isArray(prev.ids) ? prev.ids : [];
-              prevCount = prev.count || 0;
-            }
-          } catch {}
-          atomicWriteFileSync(injectedIdsFile, JSON.stringify({
-            ids: [...new Set([...prevIds.map(String), ...dedupIds])],
-            ts: Date.now(),
-            count: prevCount + 1,
-            ...(hookData.session_id ? { session: hookData.session_id } : {}),
-          }));
+          mergeInjectedMarker(injectedIdsFile, dedupIds,
+            { sessionId: hookData.session_id, maxAgeMs: DEDUP_STALE_MS, mode: 'union' });
         } catch {}
       }
     }
@@ -932,22 +917,14 @@ async function main() {
     if (output) {
       process.stdout.write(output + '\n');
       // Write injected IDs for dedup with hook.mjs handleUserPrompt + self-dedup
+      // replace, NOT union: this leg writes the prompt's own result set wholesale, and it
+      // is the ONE writer that puts raw observation numbers (mixed with `P<id>` strings)
+      // into the marker. `mode:'replace'` writes `candidateIds` verbatim for exactly that
+      // reason — stringifying here would flip the D#213 exclude from inert to live, which
+      // is a behaviour change with its own ruler and its own decision to make.
       try {
-        let prevCount = 0;
-        try {
-          const prev = JSON.parse(readFileSync(injectedIdsFile, 'utf8'));
-          // M-6: same-session (or legacy) count only; atomic write (torn-write guard).
-          if (prev.ts && Date.now() - prev.ts < DEDUP_STALE_MS
-              && !(prev.session && hookData.session_id && prev.session !== hookData.session_id)) {
-            prevCount = prev.count || 0;
-          }
-        } catch {}
-        atomicWriteFileSync(injectedIdsFile, JSON.stringify({
-          ids: candidateIds,
-          ts: Date.now(),
-          count: prevCount + 1,
-          ...(hookData.session_id ? { session: hookData.session_id } : {}),
-        }));
+        mergeInjectedMarker(injectedIdsFile, candidateIds,
+          { sessionId: hookData.session_id, maxAgeMs: DEDUP_STALE_MS, mode: 'replace' });
       } catch {}
       // v26 P0: bump injection_count for obs-based emits only (prompt-corpus
       // rows have "P<id>" string IDs; skip those — they live in user_prompts).

package/search-scoring.mjs

@@ -308,6 +308,13 @@ export function runIdleCleanup(db) {
       const marked = db.prepare(`
         UPDATE observations SET compressed_into = ${COMPRESSED_PENDING_PURGE}
         WHERE importance <= 1 AND COALESCE(access_count, 0) = 0
+          -- injection_count=0, the second half of decayAndMarkIdle's engagement guard
+          -- (audit 2026-09-02 P0-4). Since v2.56 an injected-but-never-accessed row counts
+          -- as PROVEN RELEVANT and decay protects it; this MCP sibling carried the lesson
+          -- guard (CHANGELOG "the sixth enforcement site") and not this one, so a row the
+          -- CLI/hook paths preserve was pending-purge'd 5 minutes into an idle server —
+          -- the same guard-on-one-path shape the docblock below claims was consolidated.
+          AND COALESCE(injection_count, 0) = 0
           AND type IN (${types})
           AND created_at_epoch < ? AND COALESCE(compressed_into, 0) = 0
           -- Never auto-mark a lesson-bearing row for purge. This idle path is the
@@ -321,6 +328,9 @@ export function runIdleCleanup(db) {
       const compressed = db.prepare(`
         UPDATE observations SET compressed_into = ${COMPRESSED_AUTO}
         WHERE COALESCE(compressed_into, 0) = 0 AND importance = 1
+          -- Same engagement guard as the mark-idle pass above: COMPRESSED_AUTO also hides
+          -- the row from every retrieval surface, so an injected row must not reach it.
+          AND COALESCE(injection_count, 0) = 0
           AND type IN (${types})
           AND created_at_epoch < ?
           -- Same lesson guard: auto-compress (-1) hides the row from all retrieval and

package/server.mjs

@@ -15,13 +15,11 @@ import { selectCompressionCandidates, groupByProjectWeek, compressGroup } from '
 import { resolveAnchorToken, formatAnchorError, resolveQueryAnchor, fetchRecentTimeline, fetchTimelineWindow } from './lib/timeline-core.mjs';
 import { buildSearchFtsQuery, parseDateBounds, parseDuration, coreRunSearchPipeline } from './lib/search-core.mjs';
 import {
-  cleanupBroken, decayAndMarkIdle, boostAccessed, demotePinned, mergeDuplicates,
-  recoverOrphanedChildren, recoverBuriedLessons, sweepDeferredWorkOrphans,
-  purgeStale, purgeStalePreview, findDuplicates, maintenanceStats, rebuildVectors, vacuum,
-  hardDeleteCandidateCount,
+  runMaintainOps, findDuplicates, maintenanceStats,
   OP_CAP, STALE_AGE_MS, resolveDefaultMaintainOps, DEFAULT_MAINTAIN_OPS,
 } from './lib/maintain-core.mjs';
-import { snapshotDb } from './lib/db-backup.mjs';
+// snapshotDb left with maintain-core: the pre-maintain snapshot is part of the op ORDER
+// (it must see the pre-existing pending rows), so it moved into runMaintainOps (P1-5).
 import { deleteObservations, previewDeleteRows } from './lib/delete-core.mjs';
 import { fetchObsDetail, fetchPromptDetail, fetchEventDetail, OBS_FIELDS, SESSION_DETAIL_FIELDS, PROMPT_DETAIL_FIELDS, EVENT_DETAIL_FIELDS, supersededNotice } from './lib/get-core.mjs';
 import { collectBrowseTiers, getActiveMemorySessionId, BROWSE_TIERS, BROWSE_TIER_LABELS } from './lib/browse-core.mjs';
@@ -47,10 +45,10 @@ import { optimizePreview, optimizeRun } from './hook-optimize.mjs';
 import { join, sep } from 'path';
 import { homedir } from 'os';
 import { ensureRegistryDb, collectRegistryStats, listResourcesRanked, formatRegistryListLine } from './registry.mjs';
-import { IMPORT_STRING_FIELDS, importResource, removeResource, reindexResources } from './lib/registry-core.mjs';
+import { IMPORT_STRING_FIELDS, importResource, removeResource, reindexResources, enrichImportedResources, enrichNamedResource } from './lib/registry-core.mjs';
 import { searchResources } from './registry-retriever.mjs';
 import { probeOtherSources as probeIdSources, bucketIdTokens, splitDeferredTokens } from './lib/id-routing.mjs';
-import { saveObservation, formatSupersedeSkipped, formatSupersededNote } from './lib/save-observation.mjs';
+import { saveWithClosures, formatSupersedeSkipped, formatSupersededNote } from './lib/save-observation.mjs';
 import { applyObsUpdate } from './lib/observation-write.mjs';
 import { EXPORT_COLUMNS_SQL } from './lib/export-columns.mjs';
 import { liveObsFilterSql } from './lib/inject-search-core.mjs';
@@ -59,7 +57,7 @@ import { fetchRecent } from './lib/recent-core.mjs';
 import { AUTO_MERGE_THRESHOLD } from './lib/dedup-constants.mjs';
 import {
   insertDeferred, listOpenWithOrdinal, dropDeferred, formatDropReasonHint,
-  resolveDeferredIds, closeDeferredItems,
+  resolveDeferredIds,
   getDeferredByIds, formatDeferredDetail,
   searchDeferredWork, formatDeferredSearchTrailer,
   formatDeferListRow, countStaleOpen, formatDeferStaleHint,
@@ -833,33 +831,23 @@ server.registerTool(
     if (args.project) args = { ...args, project: resolveProject(args.project) };
     const project = args.project || inferProject();
 
-    let closesIds = null;
-    let result;
+    let closesIds, result;
     try {
-      result = db.transaction(() => {
-        const r = saveObservation(db, {
-          // Size ceiling applied here rather than in lib/save-observation.mjs so the
-          // shared pipeline keeps its "caller validates" contract (see its header).
-          content: clampSaveText(args.content, SAVE_TEXT_LIMITS.content),
-          title: clampSaveText(args.title, SAVE_TEXT_LIMITS.title),
-          type: args.type || 'discovery',
-          importance: args.importance,
-          project,
-          files: args.files || [],
-          lesson_learned: clampSaveText(args.lesson_learned, SAVE_TEXT_LIMITS.lesson_learned),
-          supersedes: args.supersedes,
-        });
-        if (r.kind === 'duplicate') return r; // dedup short-circuits BEFORE resolver — replay is idempotent
-        // Resolve INSIDE tx + after dedup check so duplicate replays don't throw on
-        // already-closed items. Mirrors mem-cli.mjs cmdSave shape.
-        if (args.closes_deferred && args.closes_deferred.length > 0) {
-          // D#195: 'dropped' is closable by the close verb (kept in sync with
-          // mem-cli.mjs cmdSave — same policy, both faces).
-          closesIds = resolveDeferredIds(db, project, args.closes_deferred, { allowStatuses: ['open', 'dropped'] });
-          closeDeferredItems(db, closesIds, r.id);
-        }
-        return r;
-      })();
+      // The transaction body — dedup short-circuit BEFORE the resolver, and D#195's
+      // allowStatuses — is lib/save-observation.mjs's (audit 2026-09-02 P1-6). Both faces
+      // used to write it out and each carried a "kept in sync with the other" comment.
+      ({ result, closesIds } = saveWithClosures(db, {
+        // Size ceiling applied here rather than in lib/save-observation.mjs so the
+        // shared pipeline keeps its "caller validates" contract (see its header).
+        content: clampSaveText(args.content, SAVE_TEXT_LIMITS.content),
+        title: clampSaveText(args.title, SAVE_TEXT_LIMITS.title),
+        type: args.type || 'discovery',
+        importance: args.importance,
+        project,
+        files: args.files || [],
+        lesson_learned: clampSaveText(args.lesson_learned, SAVE_TEXT_LIMITS.lesson_learned),
+        supersedes: args.supersedes,
+      }, { closesTokens: args.closes_deferred, project }));
     } catch (e) {
       if (args.closes_deferred && args.closes_deferred.length > 0) {
         // Re-throw with a clearer prefix so MCP error response names the
@@ -1164,7 +1152,6 @@ server.registerTool(
       if (args.operations && args.operations.length === 0) {
         return { content: [{ type: 'text', text: `operations array is empty. Pass a non-empty list (e.g. ${JSON.stringify(DEFAULT_MAINTAIN_OPS)}) or omit operations to use the default set.` }], isError: true };
       }
-      const results = [];
       const staleAge = Date.now() - STALE_AGE_MS;
       const mctx = { projectFilter, baseParams, staleAge, opCap: OP_CAP };
 
@@ -1180,116 +1167,33 @@ server.registerTool(
       // runs unconfirmed on either surface now or before).
       const purgeConfirmed = args.confirm === true;
 
-      // MED-2: snapshot the DB before the irreversible cleanup/purge hard-deletes —
-      // only when rows will actually be removed, and OUTSIDE the transaction below
-      // (VACUUM cannot run inside one). Best-effort; snapshotDb never throws.
-      if (hardDeleteCandidateCount(db, mctx, { cleanup: ops.includes('cleanup'), purge: ops.includes('purge_stale') && purgeConfirmed }) > 0) {
-        snapshotDb(db, { tag: 'pre-maintain' });
-      }
-
-      db.transaction(() => {
-        // PURGE FIRST — matches the auto-maintain hook order (hook.mjs:766) and the CLI
-        // cmdMaintain. Running decay BEFORE purge in one transaction marked a stale row
-        // pending-purge AND deleted it in the SAME call (zero grace), while the pre-txn
-        // snapshot guard counts only PRE-EXISTING pending rows so it skipped the backup →
-        // permanent loss of notable imp-2/3 memories (audit HIGH-1). Purging first deletes
-        // only rows a PRIOR run marked (backed up); rows decay marks below wait one cycle.
-        if (ops.includes('purge_stale')) {
-          const retainDays = args.retain_days ?? 30;
-          const retainCutoff = Date.now() - retainDays * DAY_MS;
-          if (!purgeConfirmed) {
-            // Dry-run preview (parity with CLI `maintain` without --confirm): the other
-            // requested non-destructive ops still run below.
-            const previewRow = purgeStalePreview(db, mctx, retainCutoff);
-            const lines = [
-              'purge_stale preview (confirm=false):',
-              `  Candidates (pending-purge, older than ${retainDays}d): ${previewRow.candidates}`,
-            ];
-            if (previewRow.candidates > 0) {
-              lines.push(`  Oldest: ${new Date(previewRow.oldest).toISOString().slice(0, 10)}`);
-              lines.push(`  Newest: ${new Date(previewRow.newest).toISOString().slice(0, 10)}`);
-            }
-            lines.push('  Nothing was deleted. To delete, re-run with confirm=true:');
-            lines.push(`  mem_maintain(action="execute", operations=${JSON.stringify(ops)}, confirm=true${args.retain_days ? `, retain_days=${args.retain_days}` : ''}${args.project ? `, project="${args.project}"` : ''})`);
-            results.push(lines.join('\n'));
-          } else {
-            const purged = purgeStale(db, mctx, retainCutoff);
-            results.push(`Purged ${purged} stale observations (retained last ${retainDays} days)` + (purged >= OP_CAP ? ' (cap reached, re-run for more)' : ''));
+      // The op ORDER, the pre-transaction snapshot and the three post-transaction ops all
+      // live in maintain-core (audit 2026-09-02 P1-5) — this face keeps only what is
+      // genuinely MCP-shaped: how `merge_ids` is spelled in a warning, and what the purge
+      // preview tells the caller to type next. Before the extraction this block rendered
+      // `inj>=8` as a literal while the CLI twin interpolated PINNED_INJ_THRESHOLD.
+      const results = runMaintainOps(db, mctx, ops, {
+        retainDays: args.retain_days ?? 30,
+        retainCutoff: Date.now() - (args.retain_days ?? 30) * DAY_MS,
+        confirmed: purgeConfirmed,
+        mergeGroups: args.merge_ids || null,
+        mergeIdsProvided: Boolean(args.merge_ids),
+        mergeIdsFlagName: 'merge_ids',
+        onError: debugCatch,
+        renderPurgePreview: (previewRow, retainDays) => {
+          const lines = [
+            'purge_stale preview (confirm=false):',
+            `  Candidates (pending-purge, older than ${retainDays}d): ${previewRow.candidates}`,
+          ];
+          if (previewRow.candidates > 0) {
+            lines.push(`  Oldest: ${new Date(previewRow.oldest).toISOString().slice(0, 10)}`);
+            lines.push(`  Newest: ${new Date(previewRow.newest).toISOString().slice(0, 10)}`);
           }
-        }
-
-        if (ops.includes('cleanup')) {
-          const deleted = cleanupBroken(db, mctx);
-          results.push(`Cleaned up ${deleted} broken observations` + (deleted >= OP_CAP ? ' (cap reached, re-run for more)' : ''));
-          // Self-heal legacy orphans (keeper hard-deleted pre-recoverChildrenOf):
-          // resurface unreachable children. Non-destructive — un-hide only, no delete.
-          const orphans = recoverOrphanedChildren(db, mctx);
-          if (orphans > 0) results.push(`Recovered ${orphans} orphaned compression children`);
-          // Heal lesson rows citation-decay buried at importance 0 (pre floor=1). 0→1 on
-          // lesson-bearing rows only; idempotent no-op once none remain.
-          const lessonsHealed = recoverBuriedLessons(db, mctx);
-          if (lessonsHealed > 0) results.push(`Healed ${lessonsHealed} lesson rows buried at importance 0`);
-          // Heal deferred_work rows whose closing obs / source prompt was deleted while FK was
-          // OFF (dangling ref foreign_key_check flags). Applies the ON DELETE SET NULL the FK would.
-          const deferredHealed = sweepDeferredWorkOrphans(db, mctx);
-          if (deferredHealed > 0) results.push(`Healed ${deferredHealed} deferred-work rows with dangling references`);
-        }
-
-        if (ops.includes('decay')) {
-          // injection_count>0 protected (maintain-core; unifies with CLI + hook —
-          // the MCP copy previously lacked this clause and decayed/purged injected memories).
-          const { decayed, idleMarked } = decayAndMarkIdle(db, mctx);
-          results.push(`Decayed ${decayed} stale observations, marked ${idleMarked} idle as pending-purge` + ((decayed >= OP_CAP || idleMarked >= OP_CAP) ? ' (cap reached, re-run for more)' : ''));
-        }
-
-        if (ops.includes('boost')) {
-          const boosted = boostAccessed(db, mctx);
-          results.push(`Boosted ${boosted} frequently-accessed observations` + (boosted >= OP_CAP ? ' (cap reached, re-run for more)' : ''));
-        }
-
-        if (ops.includes('demote_pinned')) {
-          const demoted = demotePinned(db, mctx);
-          results.push(`Demoted ${demoted} pinned-but-uncited observations (inj>=8, cited=0; no lesson → importance 1, lesson → 2)` + (demoted >= OP_CAP ? ' (cap reached, re-run for more)' : ''));
-        }
-
-        if (ops.includes('dedup') && args.merge_ids) {
-          const totalMerged = mergeDuplicates(db, args.merge_ids);
-          results.push(`Merged ${totalMerged} duplicate observations`);
-        }
-
-        if (!ops.includes('dedup') && args.merge_ids) {
-          results.push('Warning: merge_ids provided but "dedup" not in operations — merge_ids ignored');
-        }
-      })();
-
-      // FTS5 optimize (outside transaction)
-      db.exec("INSERT INTO observations_fts(observations_fts) VALUES('optimize')");
-      results.push('FTS5 index optimized');
-
-      // rebuild_vectors: outside main transaction (maintain-core, shared with CLI).
-      if (ops.includes('rebuild_vectors')) {
-        try {
-          const r = rebuildVectors(db);
-          results.push(r.ok
-            ? `Vectors: rebuilt vocabulary (${r.terms} terms), updated ${r.updated}/${r.total} vectors`
-            : `Vectors: ${r.reason}`);
-        } catch (e) {
-          debugCatch(e, 'rebuild_vectors');
-          results.push(`Vectors: rebuild failed — ${e.message}`);
-        }
-      }
-
-      // vacuum: reclaim freelist dead space left by DELETEs. Whole-DB, outside any
-      // transaction. maintain-core, shared with CLI.
-      if (ops.includes('vacuum')) {
-        try {
-          const v = vacuum(db);
-          results.push(`VACUUM: reclaimed ~${v.reclaimedMB}MB (freelist ${v.freeBefore} → ${v.freeAfter} pages)`);
-        } catch (e) {
-          debugCatch(e, 'vacuum');
-          results.push(`VACUUM failed — ${e.message}`);
-        }
-      }
+          lines.push('  Nothing was deleted. To delete, re-run with confirm=true:');
+          lines.push(`  mem_maintain(action="execute", operations=${JSON.stringify(ops)}, confirm=true${args.retain_days ? `, retain_days=${args.retain_days}` : ''}${args.project ? `, project="${args.project}"` : ''})`);
+          return lines.join('\n');
+        },
+      });
 
       return { content: [{ type: 'text', text: results.join('\n') }] };
     }
@@ -1500,16 +1404,8 @@ server.registerTool(
         let enrichMsg = '';
         if (args.enrich) {
           const { enrichResource } = await import('./registry-enricher.mjs');
-          let ok = 0;
-          for (const r of results) {
-            const row = rdb.prepare('SELECT local_path FROM resources WHERE id = ?').get(r.id);
-            if (!row?.local_path) continue;
-            try {
-              const content = readFileSync(row.local_path, 'utf8');
-              if (await enrichResource(rdb, r.name, r.type, content)) ok++;
-            } catch {}
-          }
-          enrichMsg = `\nEnriched: ${ok}/${results.length}`;
+          const { ok, denied } = await enrichImportedResources(rdb, results, { confineTo: DB_DIR, enrichResource });
+          enrichMsg = `\nEnriched: ${ok}/${results.length}` + (denied ? ` (${denied} refused: path outside managed directory)` : '');
         }
 
         const lines = results.map(r => `${r.type === 'skill' ? 'S' : 'A'} ${r.name} (id=${r.id})`);
@@ -1523,25 +1419,27 @@ server.registerTool(
       if (!args.name) {
         return { content: [{ type: 'text', text: 'enrich requires a name parameter' }], isError: true };
       }
-      const row = rdb.prepare("SELECT name, type, local_path FROM resources WHERE name = ? AND status = 'active'").get(args.name);
-      if (!row) {
-        return { content: [{ type: 'text', text: `Resource not found: ${args.name}` }], isError: true };
-      }
-      if (!row.local_path) {
-        return { content: [{ type: 'text', text: `No local_path for ${args.name}` }], isError: true };
-      }
       // Confine to the env-aware data dir (managed/ relocates with CLAUDE_MEM_DIR, D#29);
-      // === homedir when the env is unset, so non-relocated confinement is unchanged.
-      const enrichBase = DB_DIR;
-      if (!isPathConfined(row.local_path, enrichBase)) {
-        return { content: [{ type: 'text', text: `Access denied: path outside managed directory` }], isError: true };
-      }
-
+      // === homedir when the env is unset, so non-relocated confinement is unchanged. The
+      // gate itself now lives in lib/registry-core.mjs so all four enrichment legs share it.
       const { enrichResource } = await import('./registry-enricher.mjs');
       try {
-        const content = readFileSync(row.local_path, 'utf8');
-        const ok = await enrichResource(rdb, row.name, row.type, content);
-        return { content: [{ type: 'text', text: ok ? `Enriched: ${args.name}` : `Enrichment failed for ${args.name}` }] };
+        const { status, error } = await enrichNamedResource(rdb, args.name, { confineTo: DB_DIR, enrichResource });
+        if (status === 'not-found') {
+          return { content: [{ type: 'text', text: `Resource not found: ${args.name}` }], isError: true };
+        }
+        if (status === 'no-path') {
+          return { content: [{ type: 'text', text: `No local_path for ${args.name}` }], isError: true };
+        }
+        if (status === 'denied') {
+          return { content: [{ type: 'text', text: `Access denied: path outside managed directory` }], isError: true };
+        }
+        if (status === 'unreadable') {
+          // Pre-refactor this threw out of readFileSync into the catch below and rendered
+          // `Enrich error: <errno>`. Keep the errno: a stale local_path is the common cause.
+          return { content: [{ type: 'text', text: `Enrich error: ${error?.message || 'cannot read local_path'}` }], isError: true };
+        }
+        return { content: [{ type: 'text', text: status === 'enriched' ? `Enriched: ${args.name}` : `Enrichment failed for ${args.name}` }] };
       } catch (e) {
         return { content: [{ type: 'text', text: `Enrich error: ${e.message}` }], isError: true };
       }

package/source-files.mjs

@@ -63,6 +63,8 @@ export const SOURCE_FILES = [
   'lib/cite-back-hint.mjs',
   // The one definition of the pre-recall cooldown path — shared by its writer
   // (scripts/pre-tool-recall.js) and both readers (cite-back-hint, edge-attribution).
+  'lib/cite-recall-path.mjs',
+  'lib/frontmatter.mjs',
   'lib/cooldown-path.mjs',
   // v2.85: stale test-fixture sweeper. Imported by install.mjs (cleanup) + cli.mjs.
   // Missing from manifest → tarball ships install.mjs that ERR_MODULE_NOT_FOUND on cleanup.