claude-mem-lite 3.92.0 → 3.93.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "3.92.0",
+      "version": "3.93.0",
       "source": "./",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."
     }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.92.0",
+  "version": "3.93.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/README.md

@@ -895,6 +895,19 @@ Set by the tool or by the test harness. Setting these by hand is not supported:
 `CLAUDE_MEM_DB_PATH`, `CLAUDE_MEM_RUNTIME_DIR`, `MEM_DISABLE_SPAWN_LOG`.
 `CLAUDE_PLUGIN_ROOT` is set by Claude Code itself.
 
+The last two are worth one more sentence each, because they are the ones a harness reaches
+for. `CLAUDE_MEM_RUNTIME_DIR` relocates the runtime directory for hook-written state — markers,
+cooldowns, hook-error telemetry, the native-binding breakage marker, `metrics/`, episode
+buffers. Before v3.93.0 it was honoured by some readers and ignored by others, so setting it
+split the runtime rather than moving it. Installation-identity state (`install.lock`,
+`update-state.json`, update residue) deliberately stays under `CLAUDE_MEM_DIR`: two
+installers pointed at different override directories would otherwise each take their own
+lock and both proceed. **`CLAUDE_MEM_DB_PATH` still has the split shape**, and more narrowly
+than it looks: exactly ONE component reads it — `scripts/pre-tool-recall.js` — so setting it
+aims that single hook at one database and leaves the other four hook faces, the CLI and the
+MCP server on the default. Use `CLAUDE_MEM_DIR` — the only override
+every component respects, including the bash pre-filter — to isolate state.
+
 Three more are set by `vitest.config.mjs` / `tests/global-setup.mjs` and exist only to
 keep a test run off the live database: `CLAUDE_MEM_TEST_GUARD` (`1` arms the guard, `off`
 opts a test out), `CLAUDE_MEM_TEST_REALDIR` (the live data dir, captured before the suite

package/hash-utils.mjs

@@ -68,6 +68,18 @@ export function estimateJaccardFromMinHash(sig1, sig2) {
   if (sig1.length !== sig2.length) return 0;
   const numHashes = sig1.length / 8;
   if (numHashes === 0) return 0;
+  // NEGATIVE RESULT, kept so nobody re-proposes it (audit 2026-09-02 P2-13 suggested an
+  // "allocation-free comparison"). `slice()` does allocate two 8-char strings per band, and
+  // the caller is a full nested pair loop — ~125k pairs at the 500-row scan bound. A
+  // charCodeAt inner loop was written and measured against this form over all 124,750 pairs
+  // of a 500-title fixture: identical results (0 mismatches, so the rewrite was correct) and
+  // NO time difference — 0.77× / 1.08× / 1.03× across three passes, i.e. the first pass was
+  // slower and the rest were noise. V8 handles short slices well enough that the byte loop
+  // buys nothing, and the whole pass is 0.6 ms.
+  //
+  // So the slice form stays: it is the more readable of two equally fast implementations,
+  // and shipping the other would be churn with a performance claim behind it that the
+  // measurement does not support.
   let matches = 0;
   for (let i = 0; i < numHashes; i++) {
     const offset = i * 8;

package/hook-llm.mjs

@@ -1,8 +1,8 @@
 // claude-mem-lite: Background LLM workers for episode extraction and session summaries
 // Extracted from hook.mjs for testability and reduced complexity
 
-import { basename } from 'path';
-import { existsSync, readFileSync, unlinkSync, readdirSync } from 'fs';
+import { basename, join } from 'path';
+import { existsSync, readFileSync, unlinkSync, readdirSync, statSync } from 'fs';
 import {
   jaccardSimilarity, truncate, clampImportance, computeRuleImportance,
   inferProject, parseJsonFromLLM, scrubSecrets,
@@ -16,7 +16,7 @@ import { vecTextForRow } from './tfidf.mjs';
 import { insertObservationRow, insertObservationFiles, insertObservationVector, upsertObservationVector, normalizeScope, SCOPE_PROMPT_LEGEND } from './lib/observation-write.mjs';
 import { DEDUP_JACCARD_THRESHOLD, AUTO_MERGE_THRESHOLD } from './lib/dedup-constants.mjs';
 import {
-  RUNTIME_DIR, DEDUP_WINDOW_MS, RELATED_OBS_WINDOW_MS,
+  RUNTIME_DIR, DEDUP_WINDOW_MS, RELATED_OBS_WINDOW_MS, ORPHAN_EPISODE_AGE_MS,
   sessionFile, getSessionId, openDb, callLLM, sleep,
 } from './hook-shared.mjs';
 import { EVENT_TYPES, saveEvent } from './lib/activity.mjs';
@@ -1147,13 +1147,44 @@ ${actionList}`;
 export async function handleLLMSummary() {
   const parsed = parseInt(process.env.CLAUDE_MEM_FLUSH_TIMEOUT, 10);
   const flushTimeout = Number.isNaN(parsed) ? 15 : parsed;
-  for (let i = 0; i < flushTimeout; i++) {
-    try {
-      const files = readdirSync(RUNTIME_DIR).filter(f => f.startsWith('ep-flush-'));
-      if (files.length === 0) break;
-    } catch { break; }
-    debugLog('DEBUG', 'llm-summary', `waiting for flush files (${i + 1}/15)`);
+
+  // Wait for a DEFINED SET of flush files, not for "the directory is empty" (audit
+  // 2026-09-02 P1-7). RUNTIME_DIR is shared by every project on the machine, and the old
+  // predicate was `readdirSync(RUNTIME_DIR).some(f => f.startsWith('ep-flush-'))` — so:
+  //
+  //   • ONE crashed llm-episode worker leaves a file nothing will ever delete, and from
+  //     then on EVERY project's summary burns the full 15 s on every Stop until the next
+  //     maintain run sweeps it. Orphan cleanup lives behind a 24 h gate, so "until then"
+  //     is up to a day.
+  //   • A flush spawned by an unrelated project WHILE this summary is waiting extends the
+  //     wait, for work this summary will never read.
+  //
+  // The set is snapshotted at entry and filtered to files young enough to belong to a live
+  // worker. A file that appears after this point is somebody else's; a file older than
+  // ORPHAN_EPISODE_AGE_MS is nobody's. Both were previously indistinguishable from work in
+  // progress.
+  //
+  // Not narrowed to this project: the flush filename is `ep-flush-<ts>-<rand>.json` and
+  // carries no project. Widening it is a marker-format change with in-flight files during
+  // an upgrade, and the two filters above already remove the unbounded cases — what is left
+  // is a bounded overlap with genuinely concurrent work.
+  let pending;
+  try {
+    const cutoff = Date.now() - ORPHAN_EPISODE_AGE_MS;
+    pending = readdirSync(RUNTIME_DIR)
+      .filter((f) => f.startsWith('ep-flush-'))
+      .filter((f) => {
+        try { return statSync(join(RUNTIME_DIR, f)).mtimeMs >= cutoff; } catch { return false; }
+      });
+  } catch { pending = []; }
+
+  for (let i = 0; i < flushTimeout && pending.length > 0; i++) {
     await sleep(1000);
+    pending = pending.filter((f) => existsSync(join(RUNTIME_DIR, f)));
+    debugLog('DEBUG', 'llm-summary', `waiting for ${pending.length} flush file(s) (${i + 1}/${flushTimeout})`);
+  }
+  if (pending.length > 0) {
+    debugLog('DEBUG', 'llm-summary', `gave up waiting on ${pending.length} flush file(s) after ${flushTimeout}s: ${pending.join(', ')}`);
   }
 
   const db = openDb();

package/hook-optimize.mjs

@@ -22,9 +22,12 @@ import { DB_DIR } from './schema.mjs';
 import { OBS_TYPE_SET } from './lib/obs-types.mjs';
 import { normalizeScope, SCOPE_PROMPT_LEGEND, upsertObservationVector } from './lib/observation-write.mjs';
 import { liveObsFilterSql } from './lib/inject-search-core.mjs';
+import { resolveRuntimeDir } from './lib/resolve-data-dir.mjs';
 
 import { DAY_MS } from './lib/time-constants.mjs';
-const RUNTIME_DIR = join(DB_DIR, 'runtime');
+// P1-14: same resolver as hook-shared.mjs — this was the second module that had never
+// heard of CLAUDE_MEM_RUNTIME_DIR, and a third hand-written copy of the join().
+const RUNTIME_DIR = resolveRuntimeDir(DB_DIR);
 
 // ─── Budget ─────────────────────────────────────────────────────────────────
 

package/hook-shared.mjs

@@ -8,6 +8,7 @@ import { existsSync, readFileSync, writeFileSync, mkdirSync, renameSync, readdir
 import { inferProject, debugCatch } from './utils.mjs';
 import { CITE_RECALL_FILE_PREFIX } from './lib/cite-recall-path.mjs';
 import { ensureDbWithWalRecovery, DB_DIR } from './schema.mjs';
+import { resolveRuntimeDir } from './lib/resolve-data-dir.mjs';
 // Pure-`node:`/local module (it imports only binding-probe + native-binding-hint, and
 // neither imports this file) — no cycle.
 import { recordHookError } from './lib/hook-telemetry.mjs';
@@ -22,7 +23,11 @@ import { PLUGIN_SLUG as _PLUGIN_SLUG } from './adopt-content.mjs';
 import { DAY_MS } from './lib/time-constants.mjs';
 // ─── Constants ────────────────────────────────────────────────────────────────
 
-export const RUNTIME_DIR = join(DB_DIR, 'runtime');
+// P1-14: one resolver, so this module honours CLAUDE_MEM_RUNTIME_DIR like the five
+// standalone hook scripts already did. It did not, and hook.mjs / server.mjs /
+// hook-context.mjs / hook-episode.mjs all take RUNTIME_DIR from here — so the override
+// split the runtime dir in half instead of relocating it.
+export const RUNTIME_DIR = resolveRuntimeDir(DB_DIR);
 export const SCRIPT_PATH = process.argv[1];
 
 // Timing constants

package/hook.mjs

@@ -33,6 +33,8 @@ import {
 // backward-compat surface that knip already lists as unused; new shared symbols go to
 // their canonical module.
 import { inferProjectDir } from './project-utils.mjs';
+import { isPluginExplicitlyDisabled } from './lib/plugin-key.mjs';
+import { readHookStdin } from './lib/hook-stdin.mjs';
 // Aliased: `acquireLock` from hook-episode.mjs below is the episode buffer's own
 // (argument-less) lock — a different mutex with a different staleness policy.
 import { acquireLock as acquireProcLock } from './lib/proc-lock.mjs';
@@ -42,6 +44,7 @@ import {
   createEpisode, addFileToEpisode, planEpisodeFlush,
   writePendingEntry, mergePendingEntries, episodeHasSignificantContent, explainSignificance,
 } from './hook-episode.mjs';
+import { DB_DIR } from './schema.mjs';
 import { cleanupClaudeMdLegacyBlock, buildSessionContextLines } from './hook-context.mjs';
 import { entry as preCompactEntry } from './hook-precompact.mjs';
 import {
@@ -149,18 +152,22 @@ const BG_EVENTS = new Set(['llm-episode', 'llm-summary', 'auto-compress', 'llm-o
 // Respect Claude Code plugin disable state even when legacy settings.json hooks remain.
 // install.mjs writes direct hooks into ~/.claude/settings.json, so disabling the plugin
 // in Claude UI does not automatically remove them. Exit early to make disable actually work.
-const PLUGIN_KEY = 'claude-mem-lite@sdsrss';
-function isPluginExplicitlyDisabled() {
+// The KEY and the predicate live in lib/plugin-key.mjs (P2-7) — install.mjs branches on the
+// same decision, and a key that drifts on one side leaves the user with a plugin they
+// switched off and a settings.json hook set that never noticed. Reading the file stays here:
+// install.mjs already holds a parsed settings object when it asks, this process does not.
+function pluginDisabledHere() {
   try {
     const settingsPath = join(homedir(), '.claude', 'settings.json');
-    const settings = JSON.parse(readFileSync(settingsPath, 'utf8'));
-    return settings.enabledPlugins?.[PLUGIN_KEY] === false;
+    return isPluginExplicitlyDisabled(JSON.parse(readFileSync(settingsPath, 'utf8')));
   } catch {
+    // Missing or unparseable settings.json → not disabled. Fail OPEN: a corrupt file must
+    // not switch the plugin off for a user who never asked for that.
     return false;
   }
 }
 
-if (event && isPluginExplicitlyDisabled()) process.exit(0);
+if (event && pluginDisabledHere()) process.exit(0);
 if (process.env.CLAUDE_MEM_HOOK_RUNNING && !BG_EVENTS.has(event)) process.exit(0);
 
 // Crash-safe: flush episode buffer on unexpected termination to prevent data loss
@@ -395,7 +402,7 @@ function flushEpisodeWithDb(db, episode, hookEventName) {
   // and with the flag on that case is strictly better than before, because the reads file
   // was never touched and the retry still finds it.
   // Off unless CLAUDE_MEM_METRICS=1, like every other row in this sink.
-  recordMetric(join(RUNTIME_DIR, '..'), {
+  recordMetric(DB_DIR, {
     event: 'episode_reads',
     readsConsumed: (episode.filesRead || []).length,
     readsHeld,
@@ -459,7 +466,7 @@ function flushEpisodeGroup(ep, db) {
   // episodes are kept ONLY because of their Greps — and demoting what the product
   // remembers on a deduction is how work disappears silently. This is that counter.
   // Off unless CLAUDE_MEM_METRICS=1, like every other row in this sink.
-  recordMetric(join(RUNTIME_DIR, '..'), {
+  recordMetric(DB_DIR, {
     event: 'episode_significance',
     rule: verdict.rule,
     significant: isSignificant,
@@ -682,7 +689,7 @@ function triggerErrorRecall(db, toolInput, response, opts = {}) {
       // G13: this surface feeds the citation denominator but had zero metering —
       // the G8 gate change (isError→isHardError) could not be volume-verified
       // from metrics. Counter only; no latency (query is bundled in the hook).
-      recordMetric(join(RUNTIME_DIR, '..'), { event: metricEvent, returned: rows.length });
+      recordMetric(DB_DIR, { event: metricEvent, returned: rows.length });
       // MED-3 (full audit 2026-07-16): go through the envelope, NOT raw stdout —
       // a raw multi-line write corrupts a co-emitted episode-flush receipt.
       // The follow-up correction (2026-08-17): "two separate JSON lines each parse
@@ -1485,7 +1492,13 @@ function runSessionStartAutoMaintain(db, project) {
       // Auto-dedup (fuzzy): catches near-identical titles that exact-match
       // misses across larger time windows — e.g. episode-batch titles like
       // "Modified A.mjs, B.mjs" vs "Modified B.mjs, A.mjs" written days apart.
-      // MinHash pre-filter (≥0.7) cuts the O(N²) scan; Jaccard ≥0.95 stays
+      // MinHash pre-filter (≥0.7) makes each PAIR cheap; it does not reduce the number of
+      // pairs. Said precisely because the comment here used to read "cuts the O(N²) scan",
+      // which is false and reads as an algorithmic bound (audit 2026-09-02 P2-13): the
+      // estimate is evaluated INSIDE the inner loop of a full nested scan in
+      // `lib/maintain-core.mjs`, so every pair is still visited — what it skips is the
+      // expensive exact Jaccard behind it. Measured, the whole pair pass is ~0.6 ms at
+      // n=500. Jaccard ≥0.95 stays
       // well clear of legit "two updates same area" pairs (those typically
       // score 0.7–0.85, surfaced via `maintain scan` for manual review).
       // Bounded by ${SCAN_LIMIT} recent rows × ${FUZZY_MAX_MERGES}-merge cap.
@@ -1835,9 +1848,9 @@ async function handleSessionStart() {
   try { sweepStaleProjectMarkers(RUNTIME_DIR); } catch { /* best-effort */ }
   // Bound the shadow-recommendation log (daily JSONL shards, no GC at write time).
   try { const { gcOldShadowShards } = await import('./registry-recommend.mjs'); gcOldShadowShards(); } catch { /* best-effort, never blocks SessionStart */ }
-  // Same for the opt-in metrics sink (RUNTIME_DIR's parent is DB_DIR). Runs even when
+  // Same for the opt-in metrics sink, which lives under DB_DIR. Runs even when
   // metrics are disabled, so shards left by a since-toggled-off run still get pruned.
-  try { gcOldMetricShards(join(RUNTIME_DIR, '..')); } catch { /* best-effort */ }
+  try { gcOldMetricShards(DB_DIR); } catch { /* best-effort */ }
 
   // Plugin cache self-heal: Claude Code auto-updates the marketplace plugin can
   // re-populate cache/<ver>/hooks/hooks.json, reintroducing duplicate hook
@@ -2213,8 +2226,11 @@ async function handleUserPrompt() {
       // (inject, maybe duplicate) rather than fail closed (suppress).
       const keyContextIds = [];
       try {
-        const raw = readFileSync(join(RUNTIME_DIR, keyContextIdsFileName(project, ccSessionId)), 'utf8');
-        const { ids, session } = JSON.parse(raw);
+        // `keyCtxRaw`, not `raw`: this function already binds `raw` to the stdin payload
+        // ~120 lines up, and a second `raw` holding a marker FILE's contents reads as that
+        // one (audit 2026-09-02 P2-17 — the one hit in the tree worth a rename).
+        const keyCtxRaw = readFileSync(join(RUNTIME_DIR, keyContextIdsFileName(project, ccSessionId)), 'utf8');
+        const { ids, session } = JSON.parse(keyCtxRaw);
         if (Array.isArray(ids) && !(session && ccSessionId && session !== ccSessionId)) {
           keyContextIds.push(...ids);
         }
@@ -2402,7 +2418,7 @@ async function handleUserPrompt() {
       // counterfactual search and the second lesson selection off a stock install.
       try {
         if (meterCoerced) {
-          recordPathAExclude(join(RUNTIME_DIR, '..'), {
+          recordPathAExclude(DB_DIR, {
             markerIds: pathAInjectedIds,
             emitted: memories,
             after: meterArmB,
@@ -2437,14 +2453,14 @@ async function handleEnrichSave(rawId) {
     // work" was invisible (32% alias coverage with 3 indistinguishable failure
     // causes). reason 'filled-concurrently' = txn ran but a concurrent optimize/
     // update had already filled every empty field.
-    recordMetric(join(RUNTIME_DIR, '..'), {
+    recordMetric(DB_DIR, {
       event: 'enrich_save',
       id,
       enriched: result.enriched,
       reason: result.reason ?? (result.enriched ? 'enriched' : 'filled-concurrently'),
     });
   } catch (e) {
-    recordMetric(join(RUNTIME_DIR, '..'), { event: 'enrich_save', id, enriched: false, reason: 'worker-error' });
+    recordMetric(DB_DIR, { event: 'enrich_save', id, enriched: false, reason: 'worker-error' });
     debugCatch(e, 'enrich-save');
   } finally {
     try { db.close(); } catch {}
@@ -2487,22 +2503,20 @@ function handleAutoCompress() {
 
 // ─── Utilities ──────────────────────────────────────────────────────────────
 
+// P1-9: the mechanism is shared (lib/hook-stdin.mjs); the CALIBER stays this entry point's
+// own. 256 KB because a tool response is the largest payload the host sends here, and
+// `rejectOnTimeout` because this reader's callers treat a timeout as "drop the event" — the
+// alternative, acting on a partial payload, means writing a truncated tool response into
+// memory as if it were the whole thing. The other four hook processes are advisory and
+// resolve instead; those are different decisions about different payloads, not drift.
 function readStdin() {
-  const MAX_STDIN = MAX_HOOK_STDIN_BYTES; // large tool responses are truncated (shared tier, utils.mjs)
-  return new Promise((resolve, reject) => {
-    let data = '';
-    const timeout = setTimeout(() => { debugLog('WARN', 'readStdin', 'stdin timeout after 3s — event dropped'); process.stdin.destroy(); reject(new Error('timeout')); }, 3000);
-    process.stdin.setEncoding('utf8');
-    process.stdin.on('data', chunk => {
-      data += chunk;
-      if (data.length > MAX_STDIN) {
-        process.stdin.destroy(); clearTimeout(timeout);
-        resolve({ text: data.slice(0, MAX_STDIN), truncated: true });
-      }
-    });
-    process.stdin.on('end', () => { clearTimeout(timeout); resolve({ text: data, truncated: false }); });
-    process.stdin.on('error', err => { clearTimeout(timeout); reject(err); });
-    process.stdin.resume();
+  return readHookStdin({
+    timeoutMs: 3000,
+    maxBytes: MAX_HOOK_STDIN_BYTES, // shared tier, utils.mjs
+    rejectOnTimeout: true,
+  }).catch((err) => {
+    if (err?.message === 'timeout') debugLog('WARN', 'readStdin', 'stdin timeout after 3s — event dropped');
+    throw err;
   });
 }
 

package/install.mjs

@@ -7,7 +7,7 @@ import { join, resolve, dirname, isAbsolute, basename } from 'path';
 import { homedir, tmpdir } from 'os';
 import { fileURLToPath, pathToFileURL } from 'url';
 import { createRequire } from 'node:module';
-import { resolveDataDir } from './lib/resolve-data-dir.mjs';
+import { resolveDataDir, resolveRuntimeDir } from './lib/resolve-data-dir.mjs';
 
 const PROJECT_DIR = resolve(import.meta.dirname ?? dirname(fileURLToPath(import.meta.url)));
 const SETTINGS_PATH = join(homedir(), '.claude', 'settings.json');
@@ -22,6 +22,11 @@ const DATA_DIR = join(homedir(), '.claude-mem-lite');
 // the relocated dir → preinstalled skills silently vanished, doctor read the wrong
 // DB). Equals DATA_DIR when CLAUDE_MEM_DIR is unset (the common case).
 const MEM_DATA_DIR = resolveDataDir(process.env.CLAUDE_MEM_DIR);
+// Hook-WRITTEN runtime state (breakage markers, ep-flush/pending buffers) lives here.
+// Installation-identity state — install.lock, update-state.json, update residue — stays
+// under MEM_DATA_DIR on purpose: those are about the one real installation, and moving
+// them with a per-harness override would let two concurrent installs take separate locks.
+const MEM_RUNTIME_DIR = resolveRuntimeDir(MEM_DATA_DIR);
 const DB_PATH = join(MEM_DATA_DIR, 'claude-mem-lite.db');
 const OLD_DATA_DIR = join(homedir(), '.claude-mem');
 
@@ -33,8 +38,9 @@ const IS_NPX = process.env.npm_command === 'exec' ||
 const INSTALL_DIR = DATA_DIR;
 const SERVER_PATH = join(INSTALL_DIR, 'server.mjs');
 const HOOK_PATH = join(INSTALL_DIR, 'hook.mjs');
-const MARKETPLACE_KEY = 'sdsrss';
-const PLUGIN_KEY = `claude-mem-lite@${MARKETPLACE_KEY}`;
+// P2-7: both constants and the predicate come from lib/plugin-key.mjs, which hook.mjs also
+// imports — this pair used to be typed out in each.
+import { MARKETPLACE_KEY, PLUGIN_KEY, isPluginExplicitlyDisabled } from './lib/plugin-key.mjs';
 const NPM_INSTALL_CMD = 'npm install --omit=dev --no-audit --no-fund';
 
 import { RESOURCE_METADATA } from './install-metadata.mjs';
@@ -1616,7 +1622,7 @@ async function doctor() {
   // broken install to exit 0 so it never spams a Node stack trace on every hook
   // fire. That silence is intentional but hides failure — it drops a breakage
   // marker so this check can surface the otherwise-invisible degraded state.
-  const brokenMarker = join(MEM_DATA_DIR, 'runtime', 'hook-launcher-broken');
+  const brokenMarker = join(MEM_RUNTIME_DIR, 'hook-launcher-broken');
   if (existsSync(brokenMarker)) {
     let detail = '';
     try {
@@ -1634,7 +1640,7 @@ async function doctor() {
   // is 6h-rate-limited stderr nobody reads), the live probe says "is it broken
   // right now". A Node upgrade breaks every DB-touching path at once, so this is
   // the single highest-value line in doctor when it fires.
-  const breakage = readNativeBindingBreakage(join(MEM_DATA_DIR, 'runtime'));
+  const breakage = readNativeBindingBreakage(MEM_RUNTIME_DIR);
   // Reuses the per-root probes above — same trees, same question, and doctor
   // should not pay for another round of child spawns to ask it twice.
   if (brokenRoots.length > 0) {
@@ -2210,9 +2216,7 @@ function cleanupMemHooksFromSettings(settings) {
   return removed;
 }
 
-function isPluginExplicitlyDisabled(settings) {
-  return settings?.enabledPlugins?.[PLUGIN_KEY] === false;
-}
+
 
 function getInstalledPluginEntries(installed) {
   if (installed?.plugins && typeof installed.plugins === 'object') return installed.plugins;
@@ -2273,8 +2277,8 @@ function cleanup() {
     }
   }
 
-  // Clean pending-* / ep-flush-* in runtime/ (under the env-aware data dir)
-  const runtimeDir = join(MEM_DATA_DIR, 'runtime');
+  // Clean pending-* / ep-flush-* in runtime/ (env-aware, and honouring the runtime override)
+  const runtimeDir = MEM_RUNTIME_DIR;
   if (existsSync(runtimeDir)) {
     for (const f of readdirSync(runtimeDir)) {
       if (f.startsWith('pending-') || f.startsWith('ep-flush-')) {
@@ -2592,7 +2596,7 @@ async function rebuildBinding() {
       process.exitCode = 1;
     } else {
       // Every tree is loadable → drop the marker so session-start stops retrying.
-      clearNativeBindingBreakage(join(MEM_DATA_DIR, 'runtime'));
+      clearNativeBindingBreakage(MEM_RUNTIME_DIR);
     }
   } finally {
     release();

package/lib/export-columns.mjs

@@ -24,6 +24,8 @@
 // LIVE row and turned up in search results next to the weekly-summary keeper that
 // already absorbed it. Restore does not remap it (the keeper's id is meaningless in
 // the target store); it REJECTS marked rows instead — see cmdRestore.
+import { liveObsFilterSql } from './inject-search-core.mjs';
+
 export const EXPORT_COLUMNS = [
   'id', 'memory_session_id', 'project', 'type', 'title', 'subtitle', 'narrative', 'text',
   'concepts', 'facts', 'files_read', 'files_modified', 'lesson_learned', 'search_aliases',
@@ -34,3 +36,46 @@ export const EXPORT_COLUMNS = [
 
 // The SELECT column fragment (comma-joined) — drop into `SELECT ${EXPORT_COLUMNS_SQL} FROM …`.
 export const EXPORT_COLUMNS_SQL = EXPORT_COLUMNS.join(', ');
+
+/**
+ * Assemble the `WHERE` predicate both export faces share.
+ *
+ * Audit 2026-09-02 P2-5. The COLUMN set above has been shared since v3.42 (HIGH-2, when the
+ * MCP handler was found carrying a narrower 16-column SELECT and silently dropping
+ * text/aliases/citation-signals from the advertised backup→restore flow). The PREDICATE was
+ * still typed out twice — `mem-cli.mjs cmdExport` and `server.mjs runExport` — which is the
+ * half-collapsed shape that lets a `WHERE` drift while the columns stay in step, on the one
+ * command whose output people restore from.
+ *
+ * Only the SQL is shared. Everything the two faces genuinely disagree about stays with them,
+ * because each disagreement is a decision rather than an accident:
+ *   - PARSING and validation: the CLI `fail()`s with a usage message on a bad date and
+ *     rejects an unknown `--type`; the MCP tool throws, and its type arrives through a
+ *     schema enum. Callers pass epochs, already parsed.
+ *   - The LIMIT: the CLI defaults to the complete matching set (it is the documented backup
+ *     half of backup/restore); MCP defaults to 200 and probes limit+1, because an MCP result
+ *     is model context and a bare exploratory call must not dump a store into a transcript.
+ *   - The inverted-range note, which only the CLI has a stderr channel for.
+ *
+ * @param {object} o
+ * @param {boolean} [o.includeCompressed]  Include compressed rows. Superseded rows are
+ *   excluded EITHER WAY — exporting tombstones is opt-in, exporting retractions never is.
+ * @param {string|null} [o.project]        Already resolved to a canonical project name.
+ * @param {string|null} [o.type]           Already validated by the caller.
+ * @param {number|null} [o.fromEpoch]      Inclusive lower bound, ms.
+ * @param {number|null} [o.toEpoch]        Inclusive upper bound, ms (callers push it to
+ *   end-of-day themselves when the user gave a bare date).
+ * @returns {{wheres: string[], params: Array<string|number>, where: string}}
+ *   `wheres`/`params` for a caller that composes its own clause; `where` is the ready
+ *   `WHERE …` string (never empty — the live-row predicate is always present).
+ */
+export function buildExportWhere({ includeCompressed = false, project = null, type = null, fromEpoch = null, toEpoch = null } = {}) {
+  const wheres = [];
+  const params = [];
+  wheres.push(includeCompressed ? 'superseded_at IS NULL' : liveObsFilterSql(''));
+  if (project) { wheres.push('project = ?'); params.push(project); }
+  if (type) { wheres.push('type = ?'); params.push(type); }
+  if (fromEpoch !== null && fromEpoch !== undefined) { wheres.push('created_at_epoch >= ?'); params.push(fromEpoch); }
+  if (toEpoch !== null && toEpoch !== undefined) { wheres.push('created_at_epoch <= ?'); params.push(toEpoch); }
+  return { wheres, params, where: 'WHERE ' + wheres.join(' AND ') };
+}

package/lib/get-core.mjs

@@ -34,6 +34,23 @@ export function fetchPromptDetail(db, ids) {
   return db.prepare(`SELECT * FROM user_prompts WHERE id IN (${ph}) ORDER BY created_at_epoch ASC`).all(...ids);
 }
 
+/**
+ * Fetch session-summary detail rows, oldest-first.
+ *
+ * Audit 2026-09-02 P2-4: the session leg was the one detail source with no shared fetch.
+ * Its FIELD SET already came from `SESSION_DETAIL_FIELDS` here, so the twin was down to the
+ * query itself — typed out in `mem-cli.mjs renderSessionRows` and in `server.mjs mem_get`.
+ * A shared field list over two hand-copied SELECTs is the half-collapsed shape that lets a
+ * `WHERE` clause drift while the columns stay in step.
+ *
+ * No access bump, matching `fetchPromptDetail`: session summaries are not ranked, so
+ * reading one is not a usage signal.
+ */
+export function fetchSessionDetail(db, ids) {
+  const ph = ids.map(() => '?').join(',');
+  return db.prepare(`SELECT * FROM session_summaries WHERE id IN (${ph}) ORDER BY created_at_epoch ASC`).all(...ids);
+}
+
 /**
  * Fetch event detail rows, oldest-first.
  *

package/lib/hook-stdin.mjs

@@ -0,0 +1,134 @@
+// lib/hook-stdin.mjs — one bounded stdin reader for every hook entry point.
+//
+// Audit 2026-09-02 P1-9. Six hook processes read the host's JSON payload off stdin and they
+// did it six ways, in two groups:
+//
+//   BOUNDED, three different calibers: hook.mjs (3 s / 256 KB / `{text, truncated}`),
+//   scripts/user-prompt-search.js (2 s / 64 KB / bare string), scripts/pre-agent-inject.js
+//   (1.5 s / 262144 / never rejects).
+//
+//   UNBOUNDED, three copies of `for await (const chunk of process.stdin) input += chunk`:
+//   pre-tool-recall.js, pre-skill-bridge.js, post-tool-recall.js. No cap and no timeout.
+//   That matters most on `PreToolUse:Write`, whose `tool_input.content` is the ENTIRE file
+//   being written: writing a multi-megabyte file made pre-tool-recall buffer all of it and
+//   `JSON.parse` all of it, to read `file_path`. The only bound was the host's own 3 s
+//   fail-open — i.e. the hook silently did nothing, which is indistinguishable from the
+//   hook having nothing to say.
+//
+// ZERO DEPENDENCIES, deliberately: the importers are latency-sensitive hook processes whose
+// whole cost is module loading, and one of them (`pre-agent-inject.js`) exists to be the
+// cheap default-off path. Nothing here imports from the repo.
+//
+// The calibers are NOT unified. Each caller passes its own, because those numbers are
+// decisions about different payloads — a user prompt is not a tool response — and quietly
+// giving one caller another's limits is a behaviour change wearing a refactor's clothes.
+// What is shared is the mechanism: cap, timer, teardown, and the guarantee that the promise
+// settles exactly once.
+
+/** Default cap: matches the host's own full-payload tier. */
+export const DEFAULT_STDIN_MAX_BYTES = 256 * 1024;
+/**
+ * Cap for a payload that carries a WHOLE FILE: `PreToolUse`/`PostToolUse` on `Write` puts the
+ * entire file being written in `tool_input.content`. Exported and named rather than typed at
+ * each call site because two entry points see that same payload class, and two hand-written
+ * numbers for one class is the drift shape this module exists to remove — this is NOT the
+ * calibers being unified, which the note above rules out: a caller with a different payload
+ * class still passes its own.
+ *
+ * Sized as a MEMORY backstop, not a functional gate. The v3.93.0 pre-tag review measured the
+ * 256 KB default silently dropping `pretool` recall for any Write over that size, on the
+ * reasoning that a truncated payload matched what the host's 3 s fail-open already did —
+ * `JSON.parse` is 2.99 ms at 5 MB and 10.8 ms at 10 MB, so it did not.
+ */
+export const TOOL_INPUT_FILE_MAX_BYTES = 8 * 1024 * 1024;
+
+/**
+ * Recover the scalar fields a hook needs from a TRUNCATED JSON payload prefix.
+ *
+ * Mirrors `hook.mjs handlePostToolUse`'s salvage of `tool_name`. Returns null when the
+ * prefix does not carry a `file_path` — the caller then behaves exactly as it did before
+ * salvage existed, so this can only add recalls, never remove one.
+ *
+ * Lives here rather than in the one script that calls it because it is about a payload this
+ * module bounded: the cap and the recovery from the cap are one decision, and a helper that
+ * only the truncating module's caller can reach is a helper nothing can unit-test.
+ *
+ * Deliberately regex over the prefix rather than a streaming parser: the fields are flat
+ * string scalars, and a partial-JSON parser is a dependency and a failure mode for a path
+ * whose entire budget is the host's fail-open window.
+ *
+ * @param {string} prefix Truncated payload text.
+ * @returns {{filePath: string, sessionId: string|null, toolName: string|null} | null}
+ */
+export function salvageTruncatedHookEvent(prefix) {
+  const fp = prefix.match(/"file_path"\s*:\s*"((?:[^"\\]|\\.)*)"/);
+  if (!fp) return null;
+  let filePath;
+  // The captured group is still JSON-escaped (Windows paths arrive as `C:\\x`).
+  try { filePath = JSON.parse(`"${fp[1]}"`); } catch { return null; }
+  if (!filePath) return null;
+  const sid = prefix.match(/"session_id"\s*:\s*"([^"\\]*)"/);
+  const tn = prefix.match(/"tool_name"\s*:\s*"([^"\\]*)"/);
+  return { filePath, sessionId: sid ? sid[1] : null, toolName: tn ? tn[1] : null };
+}
+
+
+/** Default timeout: under the host's ~3 s fail-open, so we decide rather than get killed. */
+export const DEFAULT_STDIN_TIMEOUT_MS = 3000;
+
+/**
+ * Read the hook payload from a stream, bounded in both bytes and time.
+ *
+ * @param {object}  [opts]
+ * @param {number}  [opts.timeoutMs]  Give up after this long.
+ * @param {number}  [opts.maxBytes]   Stop reading past this many characters.
+ * @param {boolean} [opts.rejectOnTimeout=false]  `true` reproduces hook.mjs's contract, where
+ *   a timeout drops the event rather than acting on a partial payload. `false` resolves with
+ *   whatever arrived and `timedOut: true` — the right call for a path that is advisory and
+ *   must never throw into a host hook.
+ * @param {NodeJS.ReadableStream} [opts.stream=process.stdin]  Injectable for tests; nothing
+ *   else about this module is observable without it.
+ * @returns {Promise<{text: string, truncated: boolean, timedOut: boolean}>}
+ */
+export function readHookStdin({
+  timeoutMs = DEFAULT_STDIN_TIMEOUT_MS,
+  maxBytes = DEFAULT_STDIN_MAX_BYTES,
+  rejectOnTimeout = false,
+  stream = process.stdin,
+} = {}) {
+  return new Promise((resolve, reject) => {
+    let data = '';
+    // Every path below routes through settle(), and settle() is a no-op after the first
+    // call. The hand-written copies each had to get this right on four separate paths
+    // (cap hit, end, error, timer) and the `.destroy()` in the cap branch can itself emit
+    // 'error' — so "resolve twice" and "resolve then reject" were both reachable shapes.
+    let done = false;
+    const settle = (fn, arg) => {
+      if (done) return;
+      done = true;
+      clearTimeout(timer);
+      try { stream.destroy(); } catch { /* already gone */ }
+      fn(arg);
+    };
+
+    const timer = setTimeout(() => {
+      if (rejectOnTimeout) settle(reject, new Error('timeout'));
+      else settle(resolve, { text: data, truncated: false, timedOut: true });
+    }, timeoutMs);
+
+    try {
+      stream.setEncoding('utf8');
+      stream.on('data', (chunk) => {
+        data += chunk;
+        if (data.length > maxBytes) {
+          settle(resolve, { text: data.slice(0, maxBytes), truncated: true, timedOut: false });
+        }
+      });
+      stream.on('end', () => settle(resolve, { text: data, truncated: false, timedOut: false }));
+      stream.on('error', (err) => settle(reject, err));
+      stream.resume();
+    } catch (err) {
+      settle(reject, err);
+    }
+  });
+}