claude-mem-lite 6.14.0 → 6.16.0

package/.claude-plugin/marketplace.json

@@ -9,10 +9,10 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "6.14.0",
+      "version": "6.16.0",
       "source": "./",
       "homepage": "https://github.com/sdsrss/claude-mem-lite",
-      "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."
+      "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."
     }
   ]
 }

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.14.0",
-  "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
+  "version": "6.16.0",
+  "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"
   },

package/README.md

@@ -237,6 +237,37 @@ rm -rf ~/claude-mem-lite/   # pre-v0.5 unhidden (if not auto-moved)
     repos/               # Shallow-cloned source repos
 ```
 
+## Upgrading to 6.16.0
+
+**Three defaults change; one has an off switch.** No schema change and no migration, so
+reverting everything is pinning `claude-mem-lite@6.15.0`.
+
+- **Each session gets one of two first lines on a file-recall block.** Half of sessions keep
+  "system-injected context, continue your planned action"; the other half get a plain
+  statement of where the notes come from, as Claude Code's hooks guide recommends. The two
+  are compared by cite-rate before one becomes the default. Off (old line everywhere):
+  `CLAUDE_MEM_RECALL_FRAMING=legacy`.
+- **Memory text longer than the host's 10,000-character hook limit is trimmed by whole
+  lines**, with a closing line naming the ids left out, instead of the host replacing it with
+  a 2,000-character preview. No switch; pin 6.15.0 to revert.
+- **Lessons shown after a failed Bash command now count in citation decay**, like every other
+  surface: ones never cited are ranked down over time. No switch; pin 6.15.0 to revert.
+
+## Upgrading to 6.15.0
+
+**Two defaults change; one has an off switch.** No schema change and no migration, so
+reverting everything is pinning `claude-mem-lite@6.14.0`.
+
+- **An auto-captured lesson that repeats text a tool printed is kept out of automatic
+  injection.** Whoever controls a command's output (a repository's test, a fetched page, an
+  MCP server) could otherwise get a sentence of their choosing stored as a lesson that later
+  sessions are shown. Such an event stays searchable at importance 1; a `change` observation
+  loses the lesson. Four shared words are enough, filler included, so an occasional lesson
+  of your own is demoted too. Off: `CLAUDE_MEM_LESSON_OUTPUT_CAP=off`.
+- **Last Session reads your own Done / Not done report when it uses markdown headings**
+  (`## Done`, `**Not done**`) instead of falling back to the model's summary. No switch; pin
+  6.14.0 to revert.
+
 ## Upgrading to 6.14.0
 
 **Five defaults change; three have an off switch.** No schema change and no migration: an
@@ -942,6 +973,7 @@ claude-mem-lite.
 | `CLAUDE_MEM_EPISODE_INPUT_FILTER` | What the episode summarizer may learn from. A subagent's tool calls stay out of the episode buffer unless they edit a file inside the project, and mutation probes (mutate → RED run → restore) and the agent's own failing inline scripts (a patch's `anchor not found`) are dropped before a window is saved or summarized — replayed over the 30 audited events, this removes 3 of the 16 that were wrong outright; with `CLAUDE_MEM_LESSON_GROUNDING` none of the 16 lessons is injected. `off` restores the unfiltered input. | _(on)_ |
 | `CLAUDE_MEM_BASH_RECALL` | File recall before a Bash command that views (`cat`, `sed -n`, `head`…) or writes (`sed -i`, `cat > f`, a python patch…) a file, like the Read / Edit recall. A bash prefilter keeps Node from starting for other commands. `off` disables this leg only. | _(on)_ |
 | `CLAUDE_MEM_LESSON_GROUNDING` | An auto-captured event keeps its lesson only when the lesson quotes the window's own diagnosis (a failing output line, a comment the edit added, or the commit message); otherwise the row is kept without it at importance 1, below every injection face. `off` keeps unquoted lessons. | _(on)_ |
+| `CLAUDE_MEM_LESSON_OUTPUT_CAP` | An auto-captured lesson that shares four consecutive words with TOOL OUTPUT (a command's printed text or a tool's response, which whoever controls that output can write) is kept off the injection faces: an event keeps its row and lesson, searchable, at importance 1; a `change` observation, whose importance later reads can raise, loses the lesson, and the lesson-less row is then dropped like any other (kept only with `CLAUDE_MEM_KEEP_LOW_SIGNAL=1`). Four shared words of filler ("is not in the") count too, so a lesson quoting your own comment or commit message is demoted when it also happens to share such a run with output in the same window. The row's title is not checked. `off` restores the model's importance and the lesson. | _(on)_ |
 | `MEM_NO_AUTO_ADOPT` | Global opt-out for auto-adopt (v2.82.0+). `1` prevents the per-SessionStart auto-write of the `CLAUDE.md` managed block across **all** projects. For per-project opt-out use `claude-mem-lite adopt --disable` instead (writes a durable `<memdir>/.mem-no-auto-adopt` sentinel that survives marker deletion). | _(disabled)_ |
 | `MEM_NO_ADOPT_HINT` | Silences the one-line "Invited-memory 未启用：`claude-mem-lite adopt`…" hint that SessionStart appends when the current project hasn't been adopted. Since v2.82.1 auto-adopt runs on every SessionStart for any install path, so this hint typically surfaces only when you've explicitly opted out (`MEM_NO_AUTO_ADOPT=1` or `claude-mem-lite adopt --disable`). | _(disabled)_ |
 
@@ -1039,6 +1071,7 @@ and names can change between releases.
 |----------|-------------|---------|
 | `CLAUDE_MEM_TASK_IMPERATIVE` | `on`/`1` injects the single most relevant lesson at prompt position under an imperative template. | _(off)_ |
 | `CLAUDE_MEM_SUBAGENT_INJECT` | Dispatch-time memory injection for subagents. | _(off)_ |
+| `CLAUDE_MEM_RECALL_FRAMING` | First line of a PreToolUse / PostToolUse recall block. `ab` gives each session one of two wordings, the older "system-injected context, continue your planned action" or a plain statement of source, so their cite-rates can be compared in one run (`benchmark/citation-live-replay.mjs --by-framing`); `legacy` / `factual` pin one. | `ab` |
 | `CLAUDE_MEM_SALIENCE` | Selects a comprehension-bridge arm (`bridge`, `bind`); unset = current default behavior. | _(unset)_ |
 | `CLAUDE_MEM_EDGE_DECAY` | Enables decay of file↔observation edges. | _(off)_ |
 | `CLAUDE_MEM_EDGE_DECAY_K` | Edge-decay threshold when the flag above is on (clamped to ≥1). | `3` |

package/README.zh-CN.md

@@ -199,6 +199,32 @@ rm -rf ~/claude-mem-lite/   # v0.5 前的非隐藏目录（如未自动迁移）
     repos/               # 浅克隆的源代码仓库
 ```
 
+## 升级到 6.16.0
+
+**三处默认行为改变，其中一处有开关。** 没有 schema 变更、不需要迁移，全部回退只需固定
+`claude-mem-lite@6.15.0`。
+
+- **文件召回块的第一行，每个会话分到两种写法之一。** 一半会话保留原来的 "system-injected context,
+  continue your planned action"，另一半改成说明这些笔记来自哪里的事实陈述（Claude Code 的 hooks
+  指南建议这样写）。两种写法先比较引用率，再决定默认用哪个。关闭（全部用旧写法）：
+  `CLAUDE_MEM_RECALL_FRAMING=legacy`。
+- **超过宿主 1 万字符 hook 上限的记忆文本会按整行裁剪**，末尾一行列出被略去的 id；以前宿主会把它换成
+  2,000 字符的预览。没有开关，回退请固定 6.15.0。
+- **Bash 命令失败后展示的教训，现在也计入引用衰减**，和其他注入面一致：一直没被引用的会逐渐排到后面。
+  没有开关，回退请固定 6.15.0。
+
+## 升级到 6.15.0
+
+**两处默认行为改变，其中一处有开关。** 没有 schema 变更、不需要迁移，全部回退只需固定
+`claude-mem-lite@6.14.0`。
+
+- **自动捕获的教训如果复述了工具打印的文字，不再自动注入。** 否则能控制命令输出的一方（仓库里的测试、
+  抓取的网页、MCP 服务）就能让自己写的一句话被存成教训，之后的会话都会看到。这样的 event 仍可搜索，
+  importance 降为 1；`change` 类 observation 则去掉教训。连续 4 个词相同就算，虚词也算，所以偶尔也会
+  误降你自己的教训。关闭：`CLAUDE_MEM_LESSON_OUTPUT_CAP=off`。
+- **Last Session 能读到你用 markdown 标题写的 Done / Not done 报告**（`## Done`、`**Not done**`），
+  不再退回模型写的摘要。没有开关，回退请固定 6.14.0。
+
 ## 升级到 6.14.0
 
 **五个默认行为变化，其中三个有关闭开关。** 没有 schema 变更、没有迁移：旧版本仍能打开数据库，
@@ -722,6 +748,7 @@ npm run benchmark:gate    # CI 门控：指标回退超过 5% 容差时失败
 | `CLAUDE_MEM_EPISODE_INPUT_FILTER` | 决定 episode 摘要器能从哪些输入里学。子代理的工具调用不进入 episode 缓冲（修改项目内文件的除外）；变异探针（改文件 → 跑红 → 还原）和 agent 自己失败的内联脚本（补丁的 `anchor not found`）在保存或摘要前被剔除——在 30 条已核验 event 上重放，这一项直接去掉 16 条错误中的 3 条；配合 `CLAUDE_MEM_LESSON_GROUNDING`，16 条错误教训一条都不会被注入。设为 `off` 恢复未过滤的输入。 | _(开启)_ |
 | `CLAUDE_MEM_BASH_RECALL` | 在查看（`cat`、`sed -n`、`head`…）或写入（`sed -i`、`cat > f`、python 补丁…）文件的 Bash 命令执行前做文件召回，与 Read / Edit 召回相同。bash 预过滤让其他命令不启动 Node。设为 `off` 只关闭这一路。 | _(开启)_ |
 | `CLAUDE_MEM_LESSON_GROUNDING` | 自动捕获的 event 只有在教训引用了本窗口自己的诊断文字（失败输出行、编辑新增的注释或提交信息）时才保留教训；否则保留这一行但去掉教训，importance 降为 1，低于所有注入面的门槛。设为 `off` 保留未引用原文的教训。 | _(开启)_ |
+| `CLAUDE_MEM_LESSON_OUTPUT_CAP` | 自动捕获的教训如果和**工具输出**（命令打印的文字或工具返回的内容，能控制这段输出的人就能写它）有连续 4 个词相同，就不会进入注入面：event 保留这一行和教训、仍可搜索，importance 降为 1；`change` 类 observation 的 importance 之后会被读取次数抬高，所以改为去掉教训，没有教训的这一行随后会像其他同类行一样被丢弃（只有设了 `CLAUDE_MEM_KEEP_LOW_SIGNAL=1` 才保留）。连续 4 个虚词（例如 "is not in the"）也算，所以引用你自己的注释或提交信息的教训，只要碰巧和同一窗口的输出共有这样一串词，也会被降级。这一行的标题不在检查范围内。设为 `off` 恢复模型给出的 importance 和教训。 | _(开启)_ |
 | `MEM_NO_AUTO_ADOPT` | auto-adopt 全局关闭开关（v2.82.0+）。设为 `1` 阻止每次 SessionStart 在**所有**项目自动写入 `CLAUDE.md` 托管块。项目级关闭走 `claude-mem-lite adopt --disable`（写 `<memdir>/.mem-no-auto-adopt` 哨兵，存活于 marker 删除）。 | _(禁用)_ |
 | `MEM_NO_ADOPT_HINT` | 静音当前项目未 adopt 时 SessionStart 追加的那一行 "Invited-memory 未启用…" 提示。v2.82.1 起任何安装路径每次 SessionStart 都自动 adopt，所以该提示一般只在你显式 opt out（`MEM_NO_AUTO_ADOPT=1` 或 `claude-mem-lite adopt --disable`）的项目才会出现。 | _(禁用)_ |
 

package/cli/common.mjs

@@ -326,6 +326,7 @@ export const KNOWN_CLI_FLAGS = new Set([
   'benchmark',
   'body',
   'branch',
+  'chars',
   'closes-deferred',
   'concepts',
   'confirm',
@@ -427,6 +428,7 @@ export const KNOWN_CLI_FLAGS = new Set([
  */
 export const COMMAND_SCOPED_FLAGS = new Map([
   ['apply', 'verify-apply'],
+  ['chars', 'context'],
   ['digest', 'verify-apply'],
   ['print-project', 'verify-apply'],
   ['undo', 'verify-apply'],

package/hook-llm.mjs

@@ -56,7 +56,12 @@ import { DAY_MS } from './lib/time-constants.mjs';
 import { liveObsFilterSql } from './lib/inject-search-core.mjs';
 import { recoverChildrenOf } from './lib/maintain-core.mjs';
 import { MEMORY_INPUT_GUARD } from './lib/memory-input-guard.mjs';
-import { isLessonGrounded, lessonGroundingEnabled } from './lib/episode-input-filter.mjs';
+import {
+  isLessonGrounded,
+  lessonGroundingEnabled,
+  lessonOutputCapEnabled,
+  quotedLines,
+} from './lib/episode-input-filter.mjs';
 
 /**
  * Retract a pre-saved observation this worker created moments ago, after the Haiku
@@ -118,6 +123,35 @@ export function episodeDiagnosis(episode) {
   return out;
 }
 
+/**
+ * The text that reached the episode ONLY as tool output, never as text the agent authored in
+ * any entry: an entry's \`diagOut\` lines, and the response snippet \`makeEntryDesc\` puts in
+ * a desc — after " → " for Bash and Grep, after "<tool>: " for its default arm (MCP servers,
+ * Skill, SendMessage, MultiEdit, anything unlisted) — which the prompt shows as the action.
+ * The form is chosen by TOOL, never by what the desc contains: a response is attacker text,
+ * so an arrow inside an MCP snippet must not decide where the snippet starts (delta reviews:
+ * the first repair read only the arrow form, the second read the arrow first for every
+ * tool). The other named cases (Edit, Write, NotebookEdit, Agent / Task, LSP, WebSearch,
+ * WebFetch) describe the agent's own input and match neither form. A Bash entry buffered
+ * before \`diagOut\` existed counts all its lines as output — over-capping one flush after an
+ * upgrade, never under-capping. Exported for tests.
+ */
+export function episodeOutputDiagnosis(episode) {
+  const output = new Set();
+  const authored = new Set();
+  for (const e of Array.isArray(episode?.entries) ? episode.entries : []) {
+    const diag = Array.isArray(e?.diag) ? e.diag : [];
+    const out = new Set(Array.isArray(e?.diagOut) ? e.diagOut : e?.tool === 'Bash' ? diag : []);
+    for (const l of diag) (out.has(l) ? output : authored).add(l);
+    if (typeof e?.desc !== 'string' || typeof e?.tool !== 'string') continue;
+    if (e.tool === 'Bash' || e.tool === 'Grep') {
+      const arrow = e.desc.indexOf(' → ');
+      if (arrow !== -1) output.add(e.desc.slice(arrow + 3).replace(/^ERROR: /, ''));
+    } else if (e.desc.startsWith(`${e.tool}: `)) output.add(e.desc.slice(e.tool.length + 2));
+  }
+  return [...output].filter((l) => l && !authored.has(l));
+}
+
 function diagnosisBlock(diag) {
   return diag.length
     ? `DIAGNOSIS (verbatim from this window — the only text a lesson may rest on):\n${diag.map((l, i) => `D${i + 1}. ${l}`).join('\n')}`
@@ -1163,6 +1197,20 @@ ${diagnosisBlock(diag)}`;
         }
       }
 
+      const quotesToolOutput =
+        Boolean(lessonLearned) &&
+        lessonOutputCapEnabled() &&
+        quotedLines(lessonLearned, episodeOutputDiagnosis(episode), 1, { anyWord: true }).length > 0;
+      if (quotesToolOutput)
+        debugLog('DEBUG', 'llm-episode', 'lesson quotes tool output: importance capped at 1');
+      // An observation's importance does not stay where this worker puts it — two mem_get
+      // reads (autoBoostIfNeeded) or four accesses (boostAccessed) lift 1 to 2 (pre-ship
+      // review P2-1). Only \`change\` lands in \`observations\` (no writer raises an event's
+      // importance), so there the lesson itself is dropped; the row then meets the
+      // lesson-less-change rule like any other.
+      if (quotesToolOutput && (validTypes.has(parsed.type) ? parsed.type : 'change') === 'change')
+        lessonLearned = null;
+
       const searchAliases = Array.isArray(parsed.search_aliases)
         ? parsed.search_aliases.slice(0, 6).join(' ')
         : null;
@@ -1203,8 +1251,12 @@ ${diagnosisBlock(diag)}`;
         // two are equal with grounding off). A lesson the grounding check dropped caps
         // `decision` too: its body falls back to the model's narrative, which is exactly
         // as unanchored as the lesson it replaces.
+        // D#100(3): a lesson quoting a line that reached the window only as tool OUTPUT
+        // carries text whoever controls that output wrote — reproduced on real Haiku,
+        // 3 of 6 hostile windows stored the directive at importance 2. The row and
+        // lesson stay searchable; only the automatic injection faces lose them.
         importance:
-          !lessonLearned && (groundingDropped || parsed.type !== 'decision')
+          (!lessonLearned && (groundingDropped || parsed.type !== 'decision')) || quotesToolOutput
             ? Math.min(ruleImportance, 1)
             : Math.max(Math.min(ruleImportance, 2), clampImportance(parsed.importance)),
         lessonLearned,

package/hook-precompact.mjs

@@ -9,6 +9,7 @@ import { buildSessionContextLines } from './hook-context.mjs';
 import { inferProject, debugCatch, debugLog } from './utils.mjs';
 import { RUNTIME_DIR } from './hook-shared.mjs';
 import { recordKeyContextInjection } from './lib/keyctx-marker.mjs';
+import { writeCappedHookText } from './lib/hook-text-cap.mjs';
 
 /**
  * Build + emit the memory context block on stdout. Writes the Key Context ids
@@ -27,7 +28,7 @@ export function handlePreCompact({ db, project, sessionId, runtimeDir = RUNTIME_
     const body = buildSessionContextLines(db, project, new Date(), sessionId || null, collector);
     const rendered = body && String(body).trim() !== '';
     if (rendered) {
-      process.stdout.write(`<claude-mem-context>\n${body}\n</claude-mem-context>\n`);
+      writeCappedHookText(`<claude-mem-context>\n${body}\n</claude-mem-context>`);
     }
     // Recorded even when NOTHING was re-rendered, matching handleSessionStart — the two
     // callers must describe the same set (keyctx-marker.mjs header), and the marker is an

package/hook.mjs

@@ -99,10 +99,11 @@ import {
 import { formatHookError } from './lib/native-binding-hint.mjs';
 import { recordHookError } from './lib/hook-telemetry.mjs';
 import { queueHookContext, queueHookSystemMessage, flushHookStdout } from './lib/hook-stdout.mjs';
+import { writePlainHookText, resetPlainHookText } from './lib/hook-text-cap.mjs';
 import { shouldRecallOnFailure } from './lib/tool-refusal.mjs';
 import {
   entryInputTags,
-  extractDiagnosisLines,
+  extractDiagnosis,
   filterSummaryInput,
   episodeInputFilterEnabled,
 } from './lib/episode-input-filter.mjs';
@@ -725,16 +726,22 @@ async function handlePostToolUse() {
   // regex-scanned on every PostToolUse.
   const respWindow = resp.length > 65536 ? resp.slice(0, 32768) + '\n' + resp.slice(-32768) : resp;
 
+  // `diagOut` = the diagnosis lines read from tool OUTPUT: a lesson quoting one stays
+  // under every injection floor (D#100(3)). Always present on a Bash entry, [] included, so
+  // the worker can tell a new entry with no output lines from one buffered before the field.
+  const diagnosis = extractDiagnosis(tool_name, toolInput, respWindow, {
+    isError: bashSig?.isError || false,
+    writesFiles: tool_name === 'Bash' && bashWrites.length > 0,
+    scrub: scrubSecrets,
+  });
+
   // Build episode entry
   const entry = {
     tool: tool_name,
     desc: scrubSecrets(makeEntryDesc(tool_name, toolInput, resp, bashSig)),
     inputTags: entryInputTags(tool_name, toolInput, respWindow),
-    diag: extractDiagnosisLines(tool_name, toolInput, respWindow, {
-      isError: bashSig?.isError || false,
-      writesFiles: tool_name === 'Bash' && bashWrites.length > 0,
-      scrub: scrubSecrets,
-    }),
+    diag: diagnosis.lines,
+    ...(tool_name === 'Bash' ? { diagOut: diagnosis.output } : {}),
     files,
     ...(tool_name === 'Bash' && bashWrites.length ? { bashWrites } : {}),
     ts: Date.now(),
@@ -3034,7 +3041,7 @@ function injectHandoffIfEarly(db, { project, promptText, promptNumber, ccSession
         const picked = pickHandoffToInject(db, project, ccSessionId);
         if (picked) {
           const injection = renderHandoffInjection(db, project, ccSessionId);
-          if (injection) process.stdout.write(injection + '\n');
+          if (injection) writePlainHookText(injection);
           // Consume ONLY the row we just injected — leave other projects' exit
           // handoffs intact so future sessions can still resume from them.
           // Pre-v2.46 wiped every exit handoff for the project on any continuation
@@ -3245,7 +3252,7 @@ async function injectSemanticMemory(db, { project, promptText, ccSessionId }) {
         const lines = ['<memory-context relevance="high">'];
         for (const m of memories) lines.push(formatMemoryLine(m));
         lines.push('</memory-context>');
-        process.stdout.write(lines.join('\n') + '\n');
+        writePlainHookText(lines.join('\n'));
       }
       // HIGH-1 (full audit 2026-07-16): surface FTS-matched events — the canonical
       // store for promoted bugfix/decision/lesson memories that persistHaikuSummary
@@ -3266,7 +3273,7 @@ async function injectSemanticMemory(db, { project, promptText, ccSessionId }) {
           const elines = ['<memory-context relevance="events">'];
           for (const e of events) elines.push(`- ${renderInjectableEvent(e)}`);
           elines.push('</memory-context>');
-          process.stdout.write(elines.join('\n') + '\n');
+          writePlainHookText(elines.join('\n'));
         }
       } catch (e) {
         debugCatch(e, 'handleUserPrompt-events');
@@ -3275,7 +3282,7 @@ async function injectSemanticMemory(db, { project, promptText, ccSessionId }) {
         // Guard the write on a non-empty return — formatTaskImperative yields '' for a
         // lesson that strips to empty (e.g. "."), which would otherwise emit a bare line.
         const imperativeLine = formatTaskImperative(imperativePick.lesson_learned, imperativePick.id);
-        if (imperativeLine) process.stdout.write(imperativeLine + '\n');
+        if (imperativeLine) writePlainHookText(imperativeLine);
       }
 
       // D#214's ruler, second half: arm B was computed above, before anything was
@@ -3306,6 +3313,7 @@ async function injectSemanticMemory(db, { project, promptText, ccSessionId }) {
 }
 
 async function handleUserPrompt() {
+  resetPlainHookText();
   const input = await readUserPromptInput();
   if (!input) return;
   const { promptText, hookData } = input;

package/lib/bash-file-targets.mjs

@@ -429,10 +429,11 @@ function elementHeads(body) {
  * The body of a helper defined at \`at\`: python by indentation, JS by brackets (a block
  * \`{…}\`, or an expression up to the first \`;\` / newline at bracket depth 0).
  */
-function helperBody(text, at, isPython) {
+function helperBody(text, at, isPython, headerAt = at) {
   if (isPython) {
-    // `at` sits just past the `:`, often ON the newline that ends the def line.
-    const lineStart = text.lastIndexOf('\n', at - 1) + 1;
+    // `at` sits just past the `:`, often ON the newline that ends the def line. The suite's
+    // indent is the HEADER's, which starts on an earlier line when a loop's list wraps.
+    const lineStart = text.lastIndexOf('\n', headerAt - 1) + 1;
     const indent = /^[ \t]*/.exec(text.slice(lineStart))[0].length;
     const bodyStart = text.indexOf('\n', at);
     if (bodyStart === -1) return text.slice(at);
@@ -443,7 +444,9 @@ function helperBody(text, at, isPython) {
       let eol = text.indexOf('\n', pos);
       if (eol === -1) eol = text.length;
       const line = text.slice(pos, eol);
-      if (line.trim() && /^[ \t]*/.exec(line)[0].length <= indent) break;
+      // A comment at any indent does not end a python suite.
+      const t = line.trim();
+      if (t && !t.startsWith('#') && /^[ \t]*/.exec(line)[0].length <= indent) break;
       pos = eol + 1;
     }
     return text.slice(bodyStart + 1, pos);
@@ -469,6 +472,35 @@ function helperBody(text, at, isPython) {
   return text.slice(i);
 }
 
+/**
+ * The body of a loop whose header starts at \`start\` and whose iterated token sits at
+ * \`tokAt\` — a python suite (the rest of the header line, then the indented block) or a
+ * JS statement / block after \`for (…)\`. Null when the header does not close.
+ */
+function loopBody(text, start, tokAt, tok, pythonish) {
+  let after = tokAt + 1;
+  if (tok === '[' || tok === '(' || tok === '{') {
+    after = closeBracket(text, tokAt);
+    if (after === -1) return null;
+  }
+  let eol = text.indexOf('\n', after);
+  if (eol === -1) eol = text.length;
+  const colon = pythonish ? text.slice(after, eol).search(/:(?!\w)/) : -1;
+  if (colon !== -1) {
+    const at = after + colon + 1;
+    return text.slice(at, eol) + helperBody(text, at, true, start);
+  }
+  // A python comprehension (\`[open(f, 'w') for f in files]\`) has no suite: its body is the
+  // line around it.
+  if (pythonish && !/^for\s*\(/.test(text.slice(start, start + 8))) {
+    return text.slice(text.lastIndexOf('\n', start) + 1, eol);
+  }
+  const open = text.indexOf('(', start);
+  if (open === -1 || open > tokAt) return null;
+  const close = closeBracket(text, open);
+  return close === -1 ? null : helperBody(text, close, false);
+}
+
 /** Identifiers (resolved or not) that a write call in \`text\` targets, plus literal targets. */
 function writeTargetsIn(text) {
   const idents = new Set();
@@ -530,8 +562,12 @@ function scriptTargets(text, cwd) {
     const helperRe =
       /\bdef\s+([A-Za-z_]\w*)\s*\(\s*([A-Za-z_]\w*)[^)\n]{0,200}\)\s*:|\bfunction\s+([A-Za-z_$][\w$]*)\s*\(\s*([A-Za-z_$][\w$]*)[^)\n]{0,200}\)\s*|\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:async\s*)?(?:\(\s*([A-Za-z_$][\w$]*)[^)\n]{0,200}\)|([A-Za-z_$][\w$]*))\s*=>\s*/g;
     // Bounded: a real patch script defines a handful of helpers; a pathological program
-    // defining thousands must not hold the hook past its timeout.
+    // defining thousands must not hold the hook past its timeout. The price is deliberate:
+    // writes through a 65th distinct helper are dropped (round-3 P3-2: 200 KB of distinct
+    // defs records 64 writes, not 2710). The most any of 10,389 distinct Bash commands in
+    // this repo's transcripts defines is 12 (2026-09-26, upper bound: every def counted).
     const seenHelpers = new Set();
+    const writers = [];
     while ((m = helperRe.exec(text)) && seenHelpers.size < 64) {
       const name = m[1] || m[3] || m[5];
       const param = m[2] || m[4] || m[6] || m[7];
@@ -539,6 +575,7 @@ function scriptTargets(text, cwd) {
       seenHelpers.add(name);
       const body = helperBody(text, m.index + m[0].length, Boolean(m[1]));
       if (!writeTargetsIn(body).idents.has(param)) continue;
+      writers.push(name.replace(/\$/g, '\\$'));
       const callRe = new RegExp(
         String.raw`(?<![\w$.])${name.replace(/\$/g, '\\$')}\(\s*(['"])([^'"\n]+)\1`,
         'g',
@@ -561,19 +598,38 @@ function scriptTargets(text, cwd) {
       }
       return lists.get(tok) ?? null;
     };
-    for (const re of loopRes) {
+    // The variable must be written inside the loop's OWN body — matching it by name alone
+    // made a read-only loop reusing a written variable's name a write (round-3 P3-1) — by a
+    // write call, or by a call to a helper found above to write its first parameter
+    // (\`for p, a, b in edits: patch(p, a, b)\`; pre-ship review P3-4).
+    const writerCallRe = writers.length
+      ? new RegExp(String.raw`(?<![\w$.])(?:${writers.join('|')})\(\s*([A-Za-z_$][\w$]*)`, 'g')
+      : null;
+    const writesVar = (body, v) => {
+      if (body === null) return false;
+      if (writeTargetsIn(body).idents.has(v)) return true;
+      if (!writerCallRe) return false;
+      writerCallRe.lastIndex = 0;
+      let c;
+      while ((c = writerCallRe.exec(body))) if (c[1] === v) return true;
+      return false;
+    };
+    const candidate = (v) => unresolved.has(v) || writers.length > 0;
+    for (const [k, re] of loopRes.entries()) {
       re.lastIndex = 0;
       let sites = 0;
       while (sites++ < MAX_INDIRECT && (m = re.exec(text))) {
-        if (!unresolved.has(m[1])) continue;
-        const body = listBodyAt(m[2], m.index + m[0].length - 1);
-        if (body) for (const h of elementHeads(body)) addLit(h);
+        if (!candidate(m[1])) continue;
+        const tokAt = m.index + m[0].length - 1;
+        const list = listBodyAt(m[2], tokAt);
+        if (!list || !writesVar(loopBody(text, m.index, tokAt, m[2], k === 0), m[1])) continue;
+        for (const h of elementHeads(list)) addLit(h);
       }
     }
     const forEachRe = /([A-Za-z_$][\w$]*|\])\s*\.forEach\(\s*(?:async\s*)?\(?\s*\[?\s*([A-Za-z_$][\w$]*)/g;
     let forEachSites = 0;
     while (forEachSites++ < MAX_INDIRECT && (m = forEachRe.exec(text))) {
-      if (!unresolved.has(m[2])) continue;
+      if (!candidate(m[2])) continue;
       let body = null;
       if (m[1] === ']') {
         // walk back to the matching '[' of the literal array
@@ -586,7 +642,10 @@ function scriptTargets(text, cwd) {
           }
         }
       } else body = lists.get(m[1]) ?? null;
-      if (body) for (const h of elementHeads(body)) addLit(h);
+      const call = m.index + m[0].indexOf('.forEach(') + '.forEach'.length;
+      const callEnd = closeBracket(text, call);
+      if (!body || callEnd === -1 || !writesVar(text.slice(call, callEnd), m[2])) continue;
+      for (const h of elementHeads(body)) addLit(h);
     }
   }
   return { writes: [...written], reads: literals.filter((p) => !written.has(p)) };

package/lib/citation-tracker.mjs

@@ -18,6 +18,7 @@ import { readTranscriptEntries } from './transcript-scan.mjs';
 // The emitter's own prefix — see SURFACE_MATCHERS.task_imperative. Importing it rather
 // than re-typing the framing is what keeps emit and extract from becoming two lists.
 import { TASK_IMPERATIVE_PREFIX } from './task-imperative.mjs';
+import { classifyRecallFraming } from './recall-framing.mjs';
 
 import { DAY_MS } from './time-constants.mjs';
 /**
@@ -743,8 +744,13 @@ const SURFACE_MATCHERS = {
     // post-tool-use.sh. High-volume surface that NO extractor matched before
     // v3.47 — error-recall'd obs accrued injection_count but never reached
     // applyCitationDecay, so they could neither promote nor demote.
+    // TWO deliveries: post-tool-use.sh (PostToolUse) and `hook.mjs post-tool-failure`
+    // (PostToolUseFailure — where a host-flagged failure goes, not PostToolUse). Keyed on
+    // the first alone until 2026-09-27, which kept every failure-path recall out of decay
+    // and every cite-rate ruler (C1 denominator count: 158 attachments carrying 389 ids).
     accepts: ({ command, text }) =>
-      command.includes('post-tool-use') && text.includes('Related memories found for this error'),
+      (command.includes('post-tool-use') || command.includes('post-tool-failure')) &&
+      text.includes('Related memories found for this error'),
     collect: (text, add) => {
       // Per-line anchored: match only a row that STARTS with `#NN [type]` (after its
       // indent), NOT every such token in the block. The inlined lesson body (v3.16.x)
@@ -857,6 +863,32 @@ export function countInjectedBySurface(transcriptPath, opts = {}) {
   return out;
 }
 
+/**
+ * Which recall framing arm(s) this transcript's PreToolUse blocks carried (A1 A/B).
+ *
+ * Read from the injected text, not recomputed from the session id: a session that ran
+ * before the A/B shipped saw the legacy line whatever its id hashes to, and only the text
+ * knows. Same walk and same `pretool` matcher as every other face.
+ *
+ * @param {string|null|undefined} transcriptPath
+ * @param {{mainOnly?: boolean}} [opts]
+ * @returns {'legacy'|'factual'|'mixed'|null} null when no PreToolUse block carried a framing line.
+ */
+export function pretoolFramingOf(transcriptPath, opts = {}) {
+  const seen = new Set();
+  eachHookAttachment(
+    transcriptPath,
+    (ctx) => {
+      if (!SURFACE_MATCHERS.pretool.accepts(ctx)) return;
+      const arm = classifyRecallFraming(ctx.text);
+      if (arm) seen.add(arm);
+    },
+    opts,
+  );
+  if (seen.size === 0) return null;
+  return seen.size > 1 ? 'mixed' : [...seen][0];
+}
+
 // Per-face extractors: thin wrappers over the shared table, kept as named
 // exports because callers and tests address individual faces.
 function extractOneSurface(face, transcriptPath, opts) {

package/lib/episode-input-filter.mjs

@@ -343,13 +343,24 @@ function addedCommentBlocks(newText, oldText) {
  *   BEFORE it is clipped, so a secret cannot straddle the cut (SEC-3).
  * @returns {string[]}
  */
-export function extractDiagnosisLines(
+export function extractDiagnosisLines(tool, input, resp, opts) {
+  return extractDiagnosis(tool, input, resp, opts).lines;
+}
+
+/**
+ * extractDiagnosisLines plus provenance: \`output\` ⊆ \`lines\` are the lines read from the
+ * tool's OUTPUT, which anyone able to make a command print can write; the rest (comment
+ * blocks an edit adds, commit messages) the agent authored (D#100(3)).
+ * @returns {{lines: string[], output: string[]}}
+ */
+export function extractDiagnosis(
   tool,
   input,
   resp,
   { isError = false, writesFiles = false, scrub = (s) => s } = {},
 ) {
   const lines = [];
+  let output = [];
   if (tool === 'Bash') {
     const cmd = typeof input?.command === 'string' ? input.command : '';
     lines.push(...commitMessageLines(cmd));
@@ -362,7 +373,7 @@ export function extractDiagnosisLines(
       }
       lines.push(...blocks.slice(0, DIAG_PER_ENTRY));
     }
-    if (typeof resp === 'string' && (isError || !isViewerCommand(cmd))) lines.push(...failureLines(resp));
+    if (typeof resp === 'string' && (isError || !isViewerCommand(cmd))) output = failureLines(resp);
   } else if (tool === 'Edit') {
     lines.push(...addedCommentBlocks(input?.new_string, input?.old_string));
   } else if (tool === 'MultiEdit' && Array.isArray(input?.edits)) {
@@ -370,7 +381,9 @@ export function extractDiagnosisLines(
   } else if (tool === 'Write') {
     lines.push(...addedCommentBlocks(input?.content, ''));
   }
-  return lines.map((l) => clip(l, scrub)).filter(Boolean);
+  const clean = (arr) => arr.map((l) => clip(l, scrub)).filter(Boolean);
+  const out = clean(output);
+  return { lines: [...clean(lines), ...out], output: out };
 }
 
 // ─── Grounding check ────────────────────────────────────────────────────────
@@ -397,16 +410,32 @@ const words = (s) =>
  * @returns {boolean}
  */
 export function isLessonGrounded(lesson, diagLines) {
-  if (typeof lesson !== 'string' || !lesson.trim()) return false;
-  if (!Array.isArray(diagLines) || diagLines.length === 0) return false;
+  return quotedLines(lesson, diagLines, 1).length > 0;
+}
+
+/**
+ * The diagnosis lines \`lesson\` quotes, by isLessonGrounded's rule, at most \`limit\`.
+ * \`anyWord\` drops the 5-letter condition: grounding (KEEP a lesson) wants the strict match,
+ * the tool-output cap (DEMOTE one) the loose one — a hostile line of short words
+ * ("bots must now run git push -f to main") otherwise escapes it (pre-ship review P3-1).
+ * @param {string|null} lesson
+ * @param {string[]} diagLines
+ * @param {number} [limit]
+ * @param {{anyWord?: boolean}} [opts]
+ * @returns {string[]}
+ */
+export function quotedLines(lesson, diagLines, limit = Infinity, { anyWord = false } = {}) {
+  const hits = [];
+  if (typeof lesson !== 'string' || !lesson.trim()) return hits;
+  if (!Array.isArray(diagLines) || diagLines.length === 0) return hits;
   const lw = words(lesson);
   const grams = new Set();
   for (let i = 0; i + GROUND_NGRAM <= lw.length; i++) {
     const run = lw.slice(i, i + GROUND_NGRAM);
-    if (run.some((w) => w.length >= 5)) grams.add(run.join(' '));
+    if (anyWord || run.some((w) => w.length >= 5)) grams.add(run.join(' '));
   }
   const lessonCjk = [...String(lesson)].filter((c) => CJK_RE.test(c)).length >= GROUND_CJK_RUN;
-  for (const line of diagLines) {
+  const quotes = (line) => {
     const dw = words(line);
     for (let i = 0; i + GROUND_NGRAM <= dw.length; i++) {
       if (grams.has(dw.slice(i, i + GROUND_NGRAM).join(' '))) return true;
@@ -418,8 +447,22 @@ export function isLessonGrounded(lesson, diagLines) {
         if ([...run].every((c) => CJK_RE.test(c)) && lesson.includes(run)) return true;
       }
     }
+    return false;
+  };
+  for (const line of diagLines) {
+    if (hits.length >= limit) break;
+    if (quotes(line)) hits.push(line);
   }
-  return false;
+  return hits;
+}
+
+/**
+ * \`CLAUDE_MEM_LESSON_OUTPUT_CAP=off\` lets a lesson that quotes tool output keep the model's
+ * importance (the v6.14.0 behaviour, which a hostile failing line could ride into every
+ * injection face — D#100(3)).
+ */
+export function lessonOutputCapEnabled(env = process.env) {
+  return !['0', 'off', 'false', 'no'].includes(String(env.CLAUDE_MEM_LESSON_OUTPUT_CAP ?? '').toLowerCase());
 }
 
 /** `CLAUDE_MEM_LESSON_GROUNDING=off` keeps an unquoted lesson (the pre-D#69 behaviour). */