claude-mem-lite 4.0.4 → 5.1.0

package/commands/update.md

@@ -1,11 +1,11 @@
 ---
 name: update
-description: "Use when: search results seem noisy, after bulk imports, or for periodic memory/registry maintenance"
+description: "Use when: search results seem noisy or for periodic memory maintenance"
 ---
 
-# Memory & Registry Maintenance
+# Memory Maintenance
 
-Run intelligent maintenance on both the memory database and tool resource registry.
+Run intelligent maintenance on the memory database.
 
 ## Usage
 
@@ -22,17 +22,10 @@ When the user invokes `/mem:update`, perform the following maintenance cycle:
 3. Call `mem_maintain(action="execute", operations=["cleanup","decay","boost"])` to apply safe automatic changes
 4. If duplicates were found in scan, review them and call `mem_maintain(action="execute", operations=["dedup"], merge_ids=[[keepId, removeId1, ...], ...])` — keep the more important/recent observation in each pair
 5. Run `mem_compress(preview=false)` for old low-value observations
-6. **If pending purge items > 0**: Report the count to the user and ask for confirmation. If confirmed, call `mem_maintain(action="execute", operations=["purge_stale"])`. User may optionally specify `retain_days` (default 30) to control how many days of data to keep. Do NOT purge without explicit user confirmation.
+6. **If pending purge items > 0**: Report the count to the user and ask for confirmation. If confirmed, call `mem_maintain(action="execute", operations=["purge_stale"], confirm=true)`. **`confirm=true` is required:** without it the call returns a dry-run preview and deletes nothing while still succeeding, so you would report a purge that never happened. User may optionally specify `retain_days` (default 30, allowed range 7–365) to control how many days of data to keep. Do NOT purge without explicit user confirmation.
 
-### Phase 2: Registry Maintenance
-
-1. Call `mem_registry(action="stats")` to get registry overview
-2. Call `mem_registry(action="reindex")` to rebuild FTS5 search index
-3. Report updated stats
-
-### Phase 3: Summary
+### Phase 2: Summary
 
 Summarize all maintenance actions taken in zh-CN:
 - Memory: observations cleaned, decayed, boosted, deduplicated, compressed
-- Registry: total resources, adoption rates, reindex status
 - Overall health assessment

package/format-utils.mjs

@@ -125,27 +125,6 @@ export function neutralizeSkillDelimiters(s) {
   return defangToFixpoint(s, SKILL_BLOCK_RE);
 }
 
-// <skill-bridge> is the wrapper scripts/pre-skill-bridge.js puts around a managed
-// skill body it injects as PreToolUse additionalContext. The body comes from a
-// third-party repo (tools/adopt import) — an untrusted boundary — so a literal
-// `</skill-bridge>` inside it would close the wrapper early and spill the rest of
-// the payload (e.g. a forged <system-reminder>) as undelimited context (audit
-// 2026-08-14 M-4). Not in CONTEXT_DELIMITER_RE for the same reason <skill-loaded>
-// isn't: the bridge's OWN wrapper must stay live, so the defang is applied per
-// call site to the untrusted body only.
-const SKILL_BRIDGE_RE = /<\/?skill-bridge(?:\s[^>]*)?>/gi;
-
-/**
- * Defang a literal `<skill-bridge>` opener/closer in untrusted text that is about
- * to be wrapped in a real skill-bridge block. Same fixpoint treatment as the
- * classes above. Never apply to the wrapper itself.
- * @param {string} s Input string (any type; coerced)
- * @returns {string} Text with skill-bridge delimiters defanged
- */
-export function neutralizeSkillBridgeDelimiters(s) {
-  return defangToFixpoint(s, SKILL_BRIDGE_RE);
-}
-
 /**
  * Render the PostToolUse error-recall hint block (hook.mjs::triggerErrorRecall).
  * The single most-relevant hit (rows[0]) that carries a lesson_learned gets its

package/haiku-client.mjs

@@ -6,13 +6,40 @@
 // overridable via OPENROUTER_MODEL
 
 import { execFileSync, spawn } from 'child_process';
+import { mkdirSync } from 'fs';
 import { readFileSync } from 'fs';
 import { join } from 'path';
 import { randomUUID } from 'crypto';
 import { debugLog, debugCatch, parseJsonFromLLM } from './utils.mjs';
 import { DB_DIR } from './schema.mjs';
+import { resolveRuntimeDir } from './lib/resolve-data-dir.mjs';
 import { httpConnectProxyFor, postViaConnectProxy } from './lib/proxy-fetch.mjs';
 
+/**
+ * cwd for every `claude -p` spawn. R10 P2-13.
+ *
+ * This was `/tmp`, which is world-writable. Claude Code loads a project-level CLAUDE.md
+ * and .claude/settings.json from its cwd, so on a shared host ANY local account could
+ * create /tmp/CLAUDE.md and inject instructions into every episode summary, session
+ * summary and optimize call this process makes — and the CLI leg is the fallback every
+ * keyed provider failure lands on, so it is not an exotic path.
+ *
+ * The original reason for /tmp was ghost sessions in the user's /resume list, and that is
+ * already solved by --no-session-persistence on the same spawns. A private directory under
+ * the runtime dir (whose parent is 0700) keeps that property and removes the injection
+ * surface. Created lazily; if creation fails we still do not fall back to /tmp — an
+ * unwritable cwd fails the spawn loudly, which is the better failure.
+ */
+function cliSpawnCwd() {
+  const dir = join(resolveRuntimeDir(DB_DIR), 'cli-cwd');
+  try {
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+  } catch {
+    /* already there, or unwritable — the spawn reports it */
+  }
+  return dir;
+}
+
 // ─── Model Resolution ────────────────────────────────────────────────────────
 
 // CLI name → API model ID mapping
@@ -237,7 +264,10 @@ export async function callHaikuJSON(prompt, opts) {
 
 /**
  * Non-blocking sibling of callHaikuJSON for callers reachable from an MCP request
- * handler (registry enrichment: mem_registry `enrich` / `import_url`). Same
+ * handler. R10 P3-28: this used to name `mem_registry enrich / import_url` as the caller,
+ * a tool removed in v5.0.0 — read as a live example, it sent readers looking for a handler
+ * that does not exist. The REASON is what still applies to whatever calls it next: an MCP
+ * request handler must not block the server event loop. Same
  * provider priority; the CLI leg — primary AND post-provider-failure fallback —
  * is the async spawn, so a keyed-provider outage cannot freeze the server event
  * loop for BG_LLM_TIMEOUT_MS (D#138 MEDIUM-3).
@@ -245,8 +275,9 @@ export async function callHaikuJSON(prompt, opts) {
  * `resolveModel().cli`, NOT the literal 'haiku': despite the name, callHaikuJSON
  * reaches the model through resolveModel() on ALL three legs (callHaikuAPI,
  * callOpenRouterAPI, callHaikuCLI), so it honours the documented CLAUDE_MEM_MODEL
- * knob. Pinning 'haiku' here would silently downgrade registry enrichment for
- * every user who set CLAUDE_MEM_MODEL=sonnet — pre-tag review finding, v3.68.0.
+ * knob. Pinning 'haiku' here would silently downgrade any caller's model for every user
+ * who set CLAUDE_MEM_MODEL=sonnet — pre-tag review finding, v3.68.0, when the caller in
+ * question was registry enrichment.
  *
  * Defaults also mirror callHaiku (10s / 500 tokens), not callModelJSONAsync's
  * 15s / 1000: a caller that omits opts must get the sync twin's budget.
@@ -565,7 +596,7 @@ export function execClaudeCliSync(modelName, { input, timeout }) {
     encoding: 'utf8',
     env: { ...process.env, CLAUDE_MEM_HOOK_RUNNING: '1', DISABLE_CLAUDEMD_HOOKS: '1' },
     stdio: ['pipe', 'pipe', 'pipe'],
-    cwd: '/tmp', // Prevent ghost sessions in the user's /resume list
+    cwd: cliSpawnCwd(), // private dir, not /tmp — see cliSpawnCwd (R10 P2-13)
   };
   const args = claudeArgs(modelName);
   const started = Date.now();
@@ -650,7 +681,7 @@ export async function callModelCLIAsync(prompt, model, { timeout }) {
         // Same headless-tax flags + flag-compat retry as callModelCLI (rationale there).
         child = spawn(getClaudePath(), args, {
           env: { ...process.env, CLAUDE_MEM_HOOK_RUNNING: '1', DISABLE_CLAUDEMD_HOOKS: '1' },
-          cwd: '/tmp',
+          cwd: cliSpawnCwd(), // private dir, not /tmp — see cliSpawnCwd (R10 P2-13)
           stdio: ['pipe', 'pipe', 'pipe'],
         });
       } catch (e) {

package/hash-utils.mjs

@@ -53,6 +53,27 @@ export function computeMinHash(text, numHashes = 64) {
     .replace(/[^a-z0-9\s]/g, ' ')
     .split(/\s+/)
     .filter((t) => t.length > 2);
+  // R10 P3-10: CJK fallback, and ONLY as a fallback. The tokenizer above deletes every
+  // non-ASCII character, so a title or narrative written entirely in Chinese or Japanese
+  // produced zero tokens and this returned null — and a null signature makes the row
+  // invisible to the MinHash prefilter that findDuplicates and selectFuzzyDedupeIds run,
+  // so CJK-only rows could never be deduplicated against anything.
+  //
+  // Confined to rows that get NOTHING from the ASCII path, which is the whole point.
+  // Signatures are STORED, and estimateJaccardFromMinHash compares a stored signature
+  // against a freshly computed one; widening the tokenization for text that already
+  // signs would make the entire existing corpus incomparable with everything written
+  // afterwards — dedup degrading everywhere, silently, until a full rebuild. Every text
+  // that signs today still produces the same bytes.
+  //
+  // Character bigrams rather than nlp.mjs's dictionary segmentation: this module is
+  // dependency-free on purpose, and bigrams are the standard CJK shingle for exactly this
+  // job — no vocabulary to maintain and no dependence on a dictionary that lags usage.
+  if (tokens.length === 0) {
+    for (const run of text.match(/[\u4e00-\u9fff\u3400-\u4dbf\u3040-\u30ff]{2,}/g) || []) {
+      for (let i = 0; i + 2 <= run.length; i++) tokens.push(run.slice(i, i + 2));
+    }
+  }
   // Require at least 3 tokens for meaningful signature (avoids high collision on short texts)
   if (tokens.length < 3) return null;
 

package/hook-episode.mjs

@@ -248,7 +248,13 @@ export function mergePendingEntries(episode) {
   let files;
   try {
     files = readdirSync(RUNTIME_DIR)
-      .filter((f) => f.startsWith('pending-'))
+      // R10 P3-4: `.json.tmp` is the WRITER's in-flight temp, not a pending entry.
+      // writePendingEntry writes `pending-<ts>-<rand>.json.tmp` then renames it into place;
+      // the bare `pending-` prefix matched the temp too, this loop's JSON.parse failed on a
+      // partial file, the catch deleted it as corrupt, and the writer's rename then failed
+      // ENOENT inside its own swallowed catch. One tool entry lost, silently, every time
+      // the two raced.
+      .filter((f) => f.startsWith('pending-') && f.endsWith('.json'))
       .sort();
   } catch {
     return;

package/hook-optimize.mjs

@@ -20,6 +20,7 @@ import {
   cjkBigrams,
   notLowSignalTitleClause,
   scrubSecrets,
+  getCurrentBranch,
 } from './utils.mjs';
 import { callModelJSONAsync, BG_LLM_TIMEOUT_MS } from './haiku-client.mjs';
 import { acquireLLMSlot, releaseLLMSlot } from './hook-semaphore.mjs';
@@ -28,7 +29,12 @@ import { getVocabulary, computeVector, cosineSimilarity } from './tfidf.mjs';
 import { MERGE_JACCARD_LOW, AUTO_MERGE_THRESHOLD } from './lib/dedup-constants.mjs';
 import { DB_DIR } from './schema.mjs';
 import { OBS_TYPE_SET } from './lib/obs-types.mjs';
-import { normalizeScope, SCOPE_PROMPT_LEGEND, upsertObservationVector } from './lib/observation-write.mjs';
+import {
+  normalizeScope,
+  SCOPE_PROMPT_LEGEND,
+  upsertObservationVector,
+  insertObservationRow,
+} from './lib/observation-write.mjs';
 import { liveObsFilterSql } from './lib/inject-search-core.mjs';
 import { resolveRuntimeDir } from './lib/resolve-data-dir.mjs';
 
@@ -364,8 +370,25 @@ scope: ${SCOPE_PROMPT_LEGEND}`;
         Array.isArray(parsed.search_aliases) && parsed.search_aliases.length
           ? parsed.search_aliases.slice(0, 6).join(' ')
           : cand.search_aliases || null;
-      const title = truncate(scrubSecrets(parsed.title || ''), 120);
-      const narrative = truncate(scrubSecrets(parsed.narrative || cand.narrative || ''), 500);
+      // R10 P1-4. `wide` is the lesson-backfill pass by definition — its WHERE selects rows
+      // that already have a substantive narrative and only lack a lesson. Rewriting their
+      // title and cutting their narrative at 500 chars is not enrichment, it is content
+      // loss: this UPDATE also stamps optimized_at, which evicts the row from all three
+      // re-enrich pools permanently, and unlike applyObsUpdate there is no snapshot to
+      // restore from. The affected rows are exactly the hand-written ones (mem_save,
+      // mem_update --narrative, import-jsonl); hook-llm caps its own writes at 500, which
+      // is why this stayed invisible. So wide carries the stored values through unchanged.
+      //
+      // For `narrow`, the truncate stays on LLM output but NOT on the preserve-on-empty
+      // fallback — truncating the row's own stored narrative to buy nothing was the same
+      // bug in miniature.
+      const isWide = scope === 'wide';
+      const title = isWide ? cand.title : truncate(scrubSecrets(parsed.title || ''), 120);
+      const narrative = isWide
+        ? cand.narrative
+        : parsed.narrative
+          ? truncate(scrubSecrets(parsed.narrative), 500)
+          : cand.narrative || '';
       // Floor at the stored importance: re-enrich adds a lesson, it must never silently downgrade
       // a user-set/promoted importance (the UPDATE also sets optimized_at → the loss is permanent).
       // Upgrades are still honored.
@@ -386,31 +409,44 @@ scope: ${SCOPE_PROMPT_LEGEND}`;
         lesson_learned: lessonLearned,
         search_aliases: searchAliases,
       });
-      db.prepare(
-        `
+      // R10 P3-3: the live-row guard on the WHERE. The LLM round-trip above is up to 45 s,
+      // and a concurrent hook can supersede or auto-compress this row inside that window —
+      // without the guard the dead row was rewritten with stale content AND stamped
+      // optimized_at, which resurrects it into every pool that filters on the stamp. The
+      // scopes branch already guards with `AND scope IS NULL`; this is the same idea.
+      // 0 changes is a skip, not a success: it must not count as processed and must not
+      // rebuild a vector for a row that is no longer live.
+      const res = db
+        .prepare(
+          `
         UPDATE observations SET type=?, title=?, narrative=?, concepts=?, facts=?,
           text=?, importance=?, lesson_learned=?, search_aliases=?, minhash_sig=?, optimized_at=?,
           scope=COALESCE(?, scope)
-        WHERE id = ?
+        WHERE id = ? AND ${liveObsFilterSql('')}
       `,
-      ).run(
-        type,
-        safe.title,
-        safe.narrative,
-        safe.concepts,
-        safe.facts,
-        safe.text,
-        importance,
-        safe.lesson_learned,
-        safe.search_aliases,
-        minhashSig,
-        Date.now(),
-        // COALESCE (mirrors the hook-llm upgrade path): a re-enrich that omits
-        // scope, or emits an off-enum value, must never blank an existing label —
-        // and THIS update stamps optimized_at, so the loss would be permanent.
-        normalizeScope(parsed.scope),
-        cand.id,
-      );
+        )
+        .run(
+          type,
+          safe.title,
+          safe.narrative,
+          safe.concepts,
+          safe.facts,
+          safe.text,
+          importance,
+          safe.lesson_learned,
+          safe.search_aliases,
+          minhashSig,
+          Date.now(),
+          // COALESCE (mirrors the hook-llm upgrade path): a re-enrich that omits
+          // scope, or emits an off-enum value, must never blank an existing label —
+          // and THIS update stamps optimized_at, so the loss would be permanent.
+          normalizeScope(parsed.scope),
+          cand.id,
+        );
+      if (res.changes === 0) {
+        skipped++;
+        continue;
+      }
 
       rebuildVector(db, cand.id, {
         title,
@@ -544,8 +580,15 @@ export function applyNormalization(db, groups, { project = null } = {}) {
     .all(project, project);
 
   let updated = 0;
+  // R10 P2-2: normalize does NOT stamp optimized_at. That column is the "re-enrich has
+  // seen this row" marker read by all three re-enrich pools (:156, :177) and by
+  // cluster-merge (:634); writing it here evicted a row from lesson backfill because a
+  // synonym replacement touched one concept term — two unrelated passes sharing one flag.
+  // Nothing in normalize needs it: its own re-run gate is the 7-day NORMALIZE_GATE_FILE
+  // timer, and the pass is idempotent anyway because a canonicalized term stops matching
+  // an alias, so `changed` stays false on the second run.
   const updateStmt = db.prepare(`
-    UPDATE observations SET concepts = ?, search_aliases = ?, optimized_at = ? WHERE id = ?
+    UPDATE observations SET concepts = ?, search_aliases = ? WHERE id = ?
   `);
 
   for (const row of rows) {
@@ -574,7 +617,7 @@ export function applyNormalization(db, groups, { project = null } = {}) {
         concepts: uniqueConcepts,
         search_aliases: newAliases,
       });
-      updateStmt.run(safe.concepts, safe.search_aliases, Date.now(), row.id);
+      updateStmt.run(safe.concepts, safe.search_aliases, row.id);
       // V-F3: normalize mutated concepts + search_aliases (both vector fields) — rebuild the
       // vector so it reflects the canonicalized terms (no-op when the vector arm is disabled).
       rebuildVector(db, row.id, {
@@ -628,7 +671,11 @@ export function findMergeCandidates(db, maxClusters = 5, { project } = {}) {
   const cutoff = Date.now() - MERGE_TIME_WINDOW_MS;
   const projectClause = project ? 'AND project = ?' : '';
   const stmt = db.prepare(`
-    SELECT id, title, narrative, project, type, access_count, importance, created_at_epoch, minhash_sig, lesson_learned, concepts, facts
+    -- R10 P3-7: search_aliases is in the list because the merge path reads
+    -- keeper.search_aliases when it rebuilds the keeper's vector. Without the column it was
+    -- always undefined, so a merge silently dropped the keeper's aliases from its vector
+    -- text. No effect while the vector arm is off by default, which is why it went unseen.
+    SELECT id, title, narrative, project, type, access_count, importance, created_at_epoch, minhash_sig, lesson_learned, concepts, facts, search_aliases
     FROM observations
     WHERE ${liveObsFilterSql('')}
       AND optimized_at IS NULL
@@ -1039,29 +1086,35 @@ JSON: {"title":"descriptive summary ≤120 chars","narrative":"comprehensive sum
         lesson_learned: lessonLearned,
         search_aliases: searchAliases,
       });
-      const result = db
-        .prepare(
-          `INSERT INTO observations
-        (memory_session_id, project, text, type, title, subtitle, narrative, concepts, facts,
-         files_read, files_modified, importance, lesson_learned, search_aliases, optimized_at,
-         created_at, created_at_epoch)
-        VALUES (?,?,?,?,?,'',?,?,?,'[]','[]',2,?,?,?,?,?)`,
-        )
-        .run(
-          sessionId,
-          project,
-          safe.text,
-          'discovery',
-          safe.title,
-          safe.narrative,
-          safe.concepts,
-          safe.facts,
-          safe.lesson_learned,
-          safe.search_aliases,
-          Date.now(),
-          new Date(medianEpoch).toISOString(),
-          medianEpoch,
-        );
+      // R10 P3-8: through the shared writer, not a fourth hand-spelled INSERT. The copy
+      // this replaces had already drifted from OBS_COLUMNS in three ways — no minhash_sig
+      // (so the summary was invisible to the MinHash prefilter that findDuplicates and
+      // selectFuzzyDedupeIds run, and could never be deduplicated against anything), no
+      // branch, and subtitle written as '' instead of the schema's NULL. That is exactly
+      // the drift lib/observation-write.mjs's docblock says the shared column list exists
+      // to make impossible.
+      //
+      // optimized_at is not in OBS_COLUMNS, so it stays a separate UPDATE below — the
+      // summary must be marked processed so the re-enrich pools do not pick it up.
+      const newId = insertObservationRow(db, {
+        memory_session_id: sessionId,
+        project,
+        text: safe.text,
+        type: 'discovery',
+        title: safe.title,
+        narrative: safe.narrative,
+        concepts: safe.concepts,
+        facts: safe.facts,
+        importance: 2,
+        minhash_sig: computeMinHash(`${title || ''} ${narrative || ''}`),
+        lesson_learned: safe.lesson_learned,
+        search_aliases: safe.search_aliases,
+        branch: getCurrentBranch(),
+        created_at: new Date(medianEpoch).toISOString(),
+        created_at_epoch: medianEpoch,
+      });
+      db.prepare('UPDATE observations SET optimized_at = ? WHERE id = ?').run(Date.now(), newId);
+      const result = { lastInsertRowid: newId };
 
       const sId = Number(result.lastInsertRowid);
 

package/hook-shared.mjs

@@ -233,8 +233,11 @@ export const STALE_PROJECT_MARKER_AGE_MS = 30 * 24 * 60 * 60 * 1000;
 export const GC_PROJECT_MARKER_PREFIXES = Object.freeze([
   'session-', // project → memory-session-id pointer
   CITE_RECALL_FILE_PREFIX, // last session's cite-recall snapshot (nudge input)
-  '.skill-cooldown-', // suggestion throttle timestamp
-  '.skill-reco-cooldown-', // recommendation throttle timestamp
+  // R10 P3-5: the auto-compressible 24h gate. One file per project, regenerated on demand,
+  // and it was in NEITHER list — so a project the user stops working on kept its marker
+  // forever. `.skill-cooldown-` / `.skill-reco-cooldown-` left with the skill registry in
+  // v5.0.0; a prefix for files nothing writes any more is dead weight in a hot-path loop.
+  'last-mark-compressible-', // per-project auto-compress 24h gate
 ]);
 
 // Records of a completed side effect — never age out. `ep-`/`ep-flush-`/
@@ -312,6 +315,9 @@ export function sweepStaleProjectMarkers(
   // Kill switch (naming mirrors SKIP_COMPRESS / SKIP_OPTIMIZE / SKIP_SAVE_ENRICH):
   // this is the only sweep that deletes files a user might want to inspect, so a
   // released default that reclaims state needs a documented way back out.
+  // R10 P3-6: exact '1', not a truthy check, and that is on purpose — the truthy form the
+  // sibling CLAUDE_MEM_SKIP_* flags use makes `=0` mean "skip", the opposite of intent.
+  // README documents the difference; do not "align" this without aligning the others too.
   if (env.CLAUDE_MEM_SKIP_MARKER_GC === '1') return 0;
   let entries;
   try {

package/hook-update.mjs

@@ -7,7 +7,6 @@ import {
   readFileSync,
   writeFileSync,
   copyFileSync,
-  cpSync,
   readdirSync,
   existsSync,
   lstatSync,
@@ -404,11 +403,11 @@ export function getCurrentVersion() {
 }
 
 // SWITCHABLE_PATHS = everything in SOURCE_FILES plus the recursive dirs that
-// install.mjs copies as whole subtrees (scripts, registry, node_modules). It's
+// install.mjs copies as whole subtrees (scripts, node_modules). It's
 // built per-call from the *tarball's* manifest, not the locally-imported one —
 // see loadReleaseManifest comment for why.
 function buildSwitchablePaths(sourceFiles) {
-  return [...sourceFiles, 'scripts', 'registry', 'node_modules'];
+  return [...sourceFiles, 'scripts', 'node_modules'];
 }
 
 // Load the SOURCE_FILES / HOOK_SCRIPT_FILES manifest from the *extracted
@@ -473,7 +472,11 @@ async function downloadAndInstall(tarballUrl, expectedVersion, assets = []) {
     const tarballPath = join(tmpDir, 'release.tar.gz');
     execFileSync(
       'curl',
-      ['-sL', '-H', 'Accept: application/vnd.github+json', tarballUrl, '-o', tarballPath],
+      // R10 P3-18: `-f` makes curl exit non-zero on an HTTP error instead of writing the
+      // error BODY to the output file. Without it a 404 or a rate-limit page was saved as
+      // release.tar.gz, tar failed on it, and the debug log reported "tarball corrupt" for
+      // what was really a network or auth problem — the wrong thing to go debug.
+      ['-fsL', '-H', 'Accept: application/vnd.github+json', tarballUrl, '-o', tarballPath],
       { timeout: 30000, stdio: 'pipe' },
     );
     execFileSync('tar', ['xzf', tarballPath, '-C', tmpDir, '--strip-components=1'], {
@@ -989,6 +992,41 @@ export async function installExtractedRelease(sourceDir, targetDir = INSTALL_DIR
     rmSync(stagingDir, { recursive: true, force: true });
     rmSync(backupDir, { recursive: true, force: true });
 
+    // Post-update migration: reconcile settings.json against the release we just
+    // swapped in. `configureHooks()` already strips stale mem entries — but its only
+    // caller is `install()`, and this path never runs it, while `buildSwitchablePaths`
+    // replaces `scripts/` wholesale. So an upgrade that REMOVES a hook script deletes
+    // the file and leaves settings.json pointing at it; the launcher then reports a
+    // broken install on every fire, for a file that is not coming back (R9 review P1-1,
+    // first hit by the `PreToolUse:Skill` removal). Plugin-channel installs are
+    // unaffected — hooks/hooks.json is replaced wholesale — so this is npm-channel only.
+    //
+    // The reconciler lives in lib/hook-prune.mjs, not install.mjs: install.mjs already
+    // imports THIS file, so importing it back would close a cycle the repo's import-graph
+    // guard rejects. Failure is non-fatal — a stale entry is noisy, not broken, and must
+    // never roll back an otherwise-good update.
+    try {
+      const settingsPath = join(homedir(), '.claude', 'settings.json');
+      if (existsSync(settingsPath)) {
+        const { pruneDanglingMemHooks } = await import('./lib/hook-prune.mjs');
+        const before = JSON.parse(readFileSync(settingsPath, 'utf8'));
+        const { settings, removed } = pruneDanglingMemHooks(before, targetDir);
+        if (removed.length > 0) {
+          // Through the shared writer: settings.json is user-owned config and may be a
+          // symlink into a dotfiles repo, which a bare temp+rename would sever (P0-5).
+          const { atomicWriteFileSync } = await import('./lib/atomic-write.mjs');
+          atomicWriteFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n', { backup: true });
+          debugLog(
+            'INFO',
+            'update',
+            `pruned ${removed.length} dangling hook entr(ies): ${removed.join(', ')}`,
+          );
+        }
+      }
+    } catch (e) {
+      debugCatch(e, 'pruneDanglingMemHooks');
+    }
+
     // Post-update migration: clean stale global MCPs if plugin handles it.
     // Both "mem" (legacy, pre-v2.78) and "mem-lite" (current) are purged so a
     // user who manually ran `claude mcp add` in either era doesn't end up with
@@ -1182,7 +1220,7 @@ function copyReleaseIntoStaging(
   // scripts/ is curated to HOOK_SCRIPT_FILES — settings.json hook commands
   // resolve only to these 5 files, and plugin mode does not consume this
   // directory at all. Pre-v2.55 used cpSync({recursive:true}) which silently
-  // shipped dev-only files (mock-claude.mjs, extract-repos.mjs, p0-forward-probe.mjs…)
+  // shipped dev-only files (mock-claude.mjs, extract-repos.mjs…)
   // from the GitHub Releases tarball into every user's data dir.
   const stagingScripts = join(stagingDir, 'scripts');
   const sourceScripts = join(sourceDir, 'scripts');
@@ -1194,15 +1232,6 @@ function copyReleaseIntoStaging(
     }
   }
 
-  // registry/ stays recursive — preinstalled.json is the only current entry
-  // but the directory is consumed wholesale by the registry indexer and may
-  // grow subtrees. Pre-v2.55 readdirSync+copyFileSync would EISDIR-throw on
-  // any subdir and silently roll back the entire update.
-  const sourceRegistry = join(sourceDir, 'registry');
-  if (existsSync(sourceRegistry)) {
-    cpSync(sourceRegistry, join(stagingDir, 'registry'), { recursive: true });
-  }
-
   const stagedScripts = join(stagingDir, 'scripts');
   if (existsSync(stagedScripts)) {
     for (const sf of readdirSync(stagedScripts).filter((n) => n.endsWith('.sh'))) {
@@ -1345,12 +1374,25 @@ export function prunePluginCache() {
   // it is not among the newest 3 — so keep-latest-3 rm -rf'd the tree the running hooks and
   // MCP server import from. scripts/setup.sh step 8 carries the same guard for the same
   // reason; the two prune the same directory and must agree.
+  //
+  // R10 P2-9: CLAUDE_PLUGIN_ROOT alone is not enough, because prune also runs from a
+  // TERMINAL — `self-update` — where Claude Code never sets it. There the guard was
+  // vacuous and keep-latest-3 deleted the recorded live version outright. detectInstallShape
+  // now consults installed_plugins.json as well, so ask it rather than the env var, and
+  // keep the env var as the first-hand answer inside a hook.
   const runningRoot = process.env.CLAUDE_PLUGIN_ROOT;
+  let recordedRoot = null;
+  try {
+    recordedRoot = detectInstallShape({ home: homedir() }).activePluginVersion?.root || null;
+  } catch {
+    /* best-effort — a failure here must not stop pruning entirely */
+  }
   const toRemove = entries.slice(PLUGIN_CACHE_KEEP);
   let removed = 0;
   for (const ver of toRemove) {
     const dir = join(cacheBase, ver);
     if (isSameDir(dir, runningRoot)) continue;
+    if (isSameDir(dir, recordedRoot)) continue;
     try {
       rmSync(dir, { recursive: true, force: true });
       removed++;

package/hook.mjs

@@ -165,10 +165,10 @@ async function loadCacheGuard() {
 // Audit 2026-09-02 P1-8. `hook.mjs` is ONE entry point for seven events, so every static
 // import is paid by every event — PostToolUse, the highest-frequency one, was loading 85
 // modules (1.37 MB) to use a handful. The six modules below are loaded inside the handler
-// that needs them instead: registry-recommend, patha-exclude-meter, hook-update,
-// hook-optimize, adopt-cli, upgrade-banner. Measured marginal cost of the four largest,
-// same process: hook-update 9.4 ms, registry-recommend 5.1, hook-optimize 5.9, the rest
-// 0.5-2.4 each.
+// that needs them instead: patha-exclude-meter, hook-update, hook-optimize, adopt-cli,
+// upgrade-banner. Measured marginal cost of the largest, same process: hook-update
+// 9.4 ms, hook-optimize 5.9, the rest 0.5-2.4 each. (registry-recommend, 5.1 ms, was a
+// sixth entry until the skill-registry subsystem was removed — see docs/audits/20260906-145304.md.)
 //
 // A failing dynamic import lands in the dispatcher's tail catch -> recordHookError, the
 // same place a failing static import would have landed the whole process; each site keeps
@@ -240,10 +240,26 @@ if (process.env.CLAUDE_MEM_HOOK_RUNNING && !BG_EVENTS.has(event)) process.exit(0
 // Uses flag-based approach to avoid calling file I/O inside signal handlers,
 // which can deadlock if the signal fires during a main-thread file operation.
 let _shutdownRequested = false;
+// R10 P3-2: the salvage belongs to the INTERACTIVE hook only. It was installed for every
+// invocation, background workers included — and the seven of them (llm-episode, llm-summary,
+// auto-compress, llm-optimize, auto-maintain, enrich-save, update-check) do not own the
+// live `ep-<project>.json` buffer. A `pkill node` or a machine shutdown therefore had every
+// running worker flush AND DELETE the buffer an interactive session was still appending to,
+// none of them holding the episode lock. Workers still exit promptly on a signal; they just
+// do not touch a buffer that is not theirs.
+const SALVAGES_EPISODE_ON_SIGNAL = !BG_EVENTS.has(event);
 for (const sig of ['SIGTERM', 'SIGINT']) {
   process.on(sig, () => {
     if (_shutdownRequested) process.exit(0); // Double-signal = force exit
     _shutdownRequested = true;
+    if (!SALVAGES_EPISODE_ON_SIGNAL) {
+      try {
+        flushHookStdout();
+      } catch {
+        /* never change the exit code for a receipt */
+      }
+      process.exit(0);
+    }
     // Schedule flush on next tick to avoid re-entering file I/O
     setTimeout(() => {
       try {
@@ -642,23 +658,6 @@ async function handlePostToolUse() {
   if (SKIP_TOOLS.has(tool_name)) return;
   if (SKIP_PREFIXES.some((p) => tool_name.startsWith(p))) return;
 
-  // Shadow skill-adoption telemetry. mem_use is pre-filtered above, so the Skill tool is
-  // the only visible adoption signal (v1). Placed before the resp-length gate because a
-  // skill load's response shape varies. Never throws.
-  if (tool_name === 'Skill') {
-    const ti = typeof tool_input === 'string' ? tryParseJson(tool_input) : tool_input || {};
-    // hookData.session_id (CC UUID) pairs this adoption to the would-be reco from the
-    // UserPromptSubmit hook earlier in the same session (matched precision, B1).
-    // Lazy: only a `Skill` tool call needs this module, which is a small fraction of
-    // PostToolUse fires.
-    try {
-      const { recordSkillAdoption } = await import('./registry-recommend.mjs');
-      recordSkillAdoption('Skill', ti, inferProject(), hookData.session_id);
-    } catch {
-      /* telemetry only — never blocks capture */
-    }
-  }
-
   const resp = normalizeToolResponse(tool_response);
   if (!resp || resp.length < 10) return;
 
@@ -2254,14 +2253,7 @@ async function handleSessionStart() {
   } catch {
     /* best-effort */
   }
-  // Bound the shadow-recommendation log (daily JSONL shards, no GC at write time).
-  try {
-    const { gcOldShadowShards } = await import('./registry-recommend.mjs');
-    gcOldShadowShards();
-  } catch {
-    /* best-effort, never blocks SessionStart */
-  }
-  // Same for the opt-in metrics sink, which lives under DB_DIR. Runs even when
+  // Bound the opt-in metrics sink, which lives under DB_DIR. Runs even when
   // metrics are disabled, so shards left by a since-toggled-off run still get pruned.
   try {
     gcOldMetricShards(DB_DIR);