claude-mem-lite 6.20.0 → 6.21.0

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "6.20.0",
+      "version": "6.21.0",
       "source": "./",
       "homepage": "https://github.com/sdsrss/claude-mem-lite",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.20.0",
+  "version": "6.21.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/README.md

@@ -88,7 +88,7 @@ How claude-mem-lite differs from the major neighbors in the LLM-memory space (ve
 - **Observation relations** -- Bidirectional links between related observations based on file overlap
 - **User prompt capture** -- Records user prompts via UserPromptSubmit hook for intent tracking
 - **Read file tracking** -- Tracks files read during sessions for richer episode context
-- **Zero data loss** -- If LLM fails, observations are saved with degraded (inferred) metadata instead of being discarded
+- **Degraded fallback when the LLM fails** -- An episode the deterministic rules already rate notable (an error fixed, a config or schema file changed) is saved with inferred metadata instead of being discarded. A routine edit the rules rate as noise (`Modified a.js, b.js` with no lesson) is dropped — as it is when the model answers without a lesson — so a failing provider loses those episodes; `claude-mem-lite doctor` warns when the `claude` CLI it would call does not resolve
 - **Two-tier dedup** -- Jaccard similarity (5-minute window) + MinHash signatures (7-day cross-session window) prevent duplicates
 - **Synonym expansion** -- Abbreviations like `K8s`, `DB`, `auth` automatically expand to full forms in FTS5 search (100+ pairs including CJK↔EN cross-language mappings)
 - **CJK synonym extraction** -- Unsegmented Chinese text is scanned for known vocabulary words (数据库→database, 搜索→search, etc.) enabling cross-language memory recall
@@ -237,6 +237,35 @@ rm -rf ~/claude-mem-lite/   # pre-v0.5 unhidden (if not auto-moved)
     repos/               # Shallow-cloned source repos
 ```
 
+## Upgrading to 6.21.0
+
+**Projects whose names are not plain ASCII get a new id, and what they stored moves once.** No
+schema-version change: 6.20.0 still opens the database after this release has. Pin
+`claude-mem-lite@6.20.0` before upgrading to avoid the move; after it, 6.20.0 names these
+directories by their old ids again, so their moved rows are listed only with
+`--project <new id>`.
+
+- **Which projects.** Every character outside ASCII letters, digits and `_.-` used to become `-`,
+  so `~/projects/博客` and `~/projects/商城` were both `projects----` and shared one memory.
+  Letters, marks and digits of every script are now kept (`projects--博客`). An id whose parent
+  and directory names are both plain ASCII keeps its id byte for byte; a name with letters,
+  marks or digits of another script, or with a character outside the Basic Multilingual Plane
+  such as `🚀`, changes id.
+- **At a project's first session start its data moves.** When no stored file path shows another
+  directory using the old id, the project takes everything under it, deferred items and session
+  history included. Otherwise only the memories whose file paths lie inside the directory move;
+  the rest stay under the old id. A one-time notice says what moved and how to list what stayed
+  (`claude-mem-lite recent 50 --project <old id>`).
+- **Not in this release:** directories with the same parent and name in different repositories
+  (`~/a/packages/api` and `~/b/packages/api`) still share one id.
+- **Also changed:** two sessions open in one project keep separate memory sessions (handoffs,
+  summaries and unsaved tool activity no longer mix); a session's follow-up prompts no longer
+  resume another session; maintenance hides idle memories for 7 days before queuing them for
+  deletion, in every project; an importance you set is no longer changed by reads, the access
+  boost or re-enrich; `recall` / `mem_recall` rank the current project and the exact path first
+  (`--project` / `project` keep one project); `<private>` fails closed on an unclosed, nested or
+  attributed tag. Full list: CHANGELOG.md.
+
 ## Upgrading to 6.19.0
 
 **Search output changes; no switch.** No schema change and no migration, so reverting is
@@ -580,8 +609,10 @@ Slash commands `/adopt` and `/unadopt` wrap the same CLI.
   `/exit` + fresh session is enough. Same caveat applies to `unadopt`.
 
 **Safety:**
-- Hash-guarded: editing the managed-block body yourself blocks automatic
-  rewrites unless you pass `--force`.
+- Regenerated, not hand-edit-safe: `adopt` rewrites the managed block to the shipped
+  template, and so does every SessionStart whenever the block differs from it — hand edits
+  included. Keep your own notes outside the `claude-mem-lite:begin…end` markers, or set
+  `CLAUDE_MEM_NO_TEMPLATE_REFRESH=1` to freeze the block.
 - Slug-scoped & dedup-guarded: only the `claude-mem-lite:begin…end` region is
   ever rewritten, and duplicate / CRLF-orphaned copies are collapsed to one.
   Unlike the legacy `MEMORY.md` scheme there is no line-budget gate — `CLAUDE.md`
@@ -708,7 +739,7 @@ Episodes are batched related operations (edits to the same file group) that get
 Episode buffer -> Flush to JSON -> claude -p --model haiku -> Structured observation -> SQLite
 ```
 
-Each observation includes type, title, narrative, concepts, facts, importance (1-3), and is automatically deduplicated via two tiers: Jaccard similarity (>70% within 5 minutes) and MinHash signatures (>80% within 7 days across sessions). If the LLM call fails, a degraded observation is saved with inferred metadata (zero data loss). Related observations are linked via `related_ids` based on FTS5 title similarity and file overlap.
+Each observation includes type, title, narrative, concepts, facts, importance (1-3), and is automatically deduplicated via two tiers: Jaccard similarity (>70% within 5 minutes) and MinHash signatures (>80% within 7 days across sessions). If the LLM call fails, an episode the rules rate notable is saved with inferred metadata; a routine edit the rules rate as noise is dropped. Related observations are linked via `related_ids` based on FTS5 title similarity and file overlap.
 
 ## Management Commands
 

package/README.zh-CN.md

@@ -67,7 +67,7 @@
 - **观察关联** -- 基于文件重叠自动建立观察之间的双向链接
 - **用户提示捕获** -- 通过 UserPromptSubmit 钩子记录用户提示，追踪用户意图
 - **Read 文件追踪** -- 追踪会话中读取的文件，丰富 episode 上下文
-- **零数据丢失** -- LLM 失败时，使用推断的元数据保存降级记录，而非丢弃
+- **LLM 失败时的降级保存** -- 规则已判定为有价值的 episode（修掉了报错、改了配置或 schema 文件）用推断的元数据保存，而非丢弃；规则判为噪声的日常编辑（`Modified a.js, b.js` 且没有 lesson）会被丢掉——模型成功但没给 lesson 时也一样——所以 LLM 不可用期间这类 episode 会丢失。`claude-mem-lite doctor` 会在要调用的 `claude` CLI 不存在时告警
 - **两级去重** -- Jaccard 相似度（5 分钟窗口）+ MinHash 签名（7 天跨会话窗口）双重防重
 - **同义词扩展** -- 缩写如 `K8s`、`DB`、`auth` 在 FTS5 搜索时自动扩展为全称（48+ 对）
 - **伪相关反馈（PRF）** -- 首轮结果作为种子扩展查询，提升召回率
@@ -199,6 +199,27 @@ rm -rf ~/claude-mem-lite/   # v0.5 前的非隐藏目录（如未自动迁移）
     repos/               # 浅克隆的源代码仓库
 ```
 
+## 升级到 6.21.0
+
+**名字不是纯 ASCII 的项目会换一个新标识，它们存下的内容会搬一次。** 没有 schema 版本变更：
+本版本打开过的数据库，6.20.0 仍能打开。想避免搬迁，请在**升级之前**固定 `claude-mem-lite@6.20.0`；
+升级之后再回退，6.20.0 会按旧标识称呼这些目录，搬走的行只能用 `--project <新标识>` 列出。
+
+- **哪些项目。** 以前 ASCII 字母、数字和 `_.-` 以外的字符都变成 `-`，所以 `~/projects/博客` 和
+  `~/projects/商城` 都是 `projects----`，共用一份记忆。现在任何文字的字母、组合符和数字都会保留
+  （`projects--博客`）。父目录名和目录名都是纯 ASCII 的，标识逐字节不变；名字里有其他文字的字母、
+  组合符或数字，或有基本多文种平面以外的字符（如 `🚀`）时，标识会变。
+- **项目第一次启动会话时搬迁数据。** 如果旧标识下没有任何文件路径显示另一个同样使用该旧标识的目录，
+  就把旧标识下的全部内容搬过来，包括待办和会话历史。否则只搬文件路径落在本目录里的记忆，其余留在
+  旧标识下。会提示一次搬了什么，以及怎么列出留下的内容（`claude-mem-lite recent 50 --project <旧标识>`）。
+- **本版本不包含：** 不同仓库里父目录和目录名都相同的目录（`~/a/packages/api` 与 `~/b/packages/api`）
+  仍共用一个标识。
+- **其他变化：** 同一项目同时开两个会话，各自的交接、摘要和未保存的工具记录不再混在一起；会话里的
+  跟进提示不再续上别的会话；维护会先把闲置记忆隐藏 7 天，再排队删除，所有项目一致；你设置的 importance
+  不再被读取、访问提升或 re-enrich 改动；`recall` / `mem_recall` 当前项目和完全匹配的路径排在前面
+  （`--project` / `project` 只看一个项目）；`<private>` 在未闭合、嵌套或带属性时一律按私密处理。
+  完整列表见 CHANGELOG.md。
+
 ## 升级到 6.19.0
 
 **搜索输出有变化，没有开关。** 没有 schema 变更、不需要迁移，回退只需固定 `claude-mem-lite@6.18.0`。
@@ -479,9 +500,11 @@ Slash 命令 `/adopt` 和 `/unadopt` 是上述 CLI 的包装。
   同理。
 
 **安全性：**
-- Hash 守护：你手动改了 sentinel 段 → 下一次 adopt 报 `UserEditedError`，
-  除非显式 `--force`。
-- 预算门：MEMORY.md 已 >180 行时拒绝新增（避开 Claude Code 200 行截断）。
+- 托管块会被重新生成，不保留手改：`adopt` 会把它改写成出货模板，每次 SessionStart
+  只要它和模板不同也会改写——手动编辑的内容一样被覆盖。自己的笔记写在
+  `claude-mem-lite:begin…end` 标记之外，或设 `CLAUDE_MEM_NO_TEMPLATE_REFRESH=1` 冻结。
+- 按 slug 限定、去重：只改写 `claude-mem-lite:begin…end` 这一段，重复或 CRLF 残留的
+  副本会合并成一份。旧的 `MEMORY.md` 方案才有行数预算，`CLAUDE.md` 没有截断上限。
 - **任何安装路径每次 SessionStart 都自动 adopt，且不再把托管块加进 `CLAUDE.md`（6.19.4
   之后的下一个版本起）。** 没有托管块的 git 项目，引导写进 git 根目录的 `CLAUDE.local.md`
   （经 `.git/info/exclude` 排除在 git 之外），不在 git 里时注入 SessionStart 上下文；带
@@ -579,7 +602,7 @@ Episode 是一批相关操作（对同一组文件的编辑），由后台 LLM w
 Episode 缓冲区 -> 刷新为 JSON -> claude -p --model haiku -> 结构化观察 -> SQLite
 ```
 
-每条观察包含类型、标题、叙述、概念、事实和重要度（1-3），并通过两级机制自动去重：Jaccard 相似度（5 分钟内 >70%）和 MinHash 签名（7 天跨会话 >80%）。LLM 调用失败时，使用推断的元数据保存降级记录（零数据丢失）。相关观察通过 FTS5 标题相似度和文件重叠自动建立 `related_ids` 链接。
+每条观察包含类型、标题、叙述、概念、事实和重要度（1-3），并通过两级机制自动去重：Jaccard 相似度（5 分钟内 >70%）和 MinHash 签名（7 天跨会话 >80%）。LLM 调用失败时，规则判定有价值的 episode 用推断的元数据保存降级记录，规则判为噪声的日常编辑会被丢掉。相关观察通过 FTS5 标题相似度和文件重叠自动建立 `related_ids` 链接。
 
 ## 管理命令
 

package/cli/common.mjs

@@ -559,7 +559,17 @@ export function obsFieldLabel(field) {
  * @returns {string} the full indented line, identical on both surfaces.
  */
 export function formatPendingPurgeLine(n) {
-  return `  Pending purge (idle-marked): ${n} (live originals marked idle by decay — purge_stale deletes them)`;
+  return `  Pending purge (idle-marked): ${n} (rows maintenance queued: hidden and still idle 7 days later, or queued by an earlier version — purge_stale deletes them)`;
+}
+
+/**
+ * D12: the step before pending-purge. Maintenance HIDES an idle row first (kept, reachable by
+ * id) and queues it for purge only once it stays idle through the grace.
+ * @param {number} n stats.hidden
+ * @returns {string} the full indented line, identical on both surfaces.
+ */
+export function formatHiddenLine(n) {
+  return `  Hidden by maintenance: ${n} (idle rows kept for 7 days; still idle then → pending purge)`;
 }
 
 // Pure formatter — null/undefined/non-time pass through; integer time fields

package/hook-context.mjs

@@ -956,17 +956,23 @@ export function buildSummaryLines(latestSummary) {
   if (latestSummary.completed) lines.push(`Completed: ${truncate(latestSummary.completed, 120)}`);
   if (latestSummary.remaining_items) lines.push(`Remaining: ${truncate(latestSummary.remaining_items, 120)}`);
   if (latestSummary.next_steps) lines.push(`Next: ${truncate(latestSummary.next_steps, 120)}`);
-  if (latestSummary.lessons) {
+  // String items only: rows written before the summary worker filtered its reply can hold
+  // [123, null, {…}] and rendered as "Lessons: 123; ; [object Object]".
+  const textItems = (json) => {
     try {
-      const lessons = JSON.parse(latestSummary.lessons);
-      if (lessons.length > 0) lines.push(`Lessons: ${lessons.slice(0, 3).join('; ')}`);
-    } catch {}
+      const v = JSON.parse(json);
+      return Array.isArray(v) ? v.filter((x) => typeof x === 'string' && x.trim()) : [];
+    } catch {
+      return [];
+    }
+  };
+  if (latestSummary.lessons) {
+    const lessons = textItems(latestSummary.lessons);
+    if (lessons.length > 0) lines.push(`Lessons: ${lessons.slice(0, 3).join('; ')}`);
   }
   if (latestSummary.key_decisions) {
-    try {
-      const decisions = JSON.parse(latestSummary.key_decisions);
-      if (decisions.length > 0) lines.push(`Decisions: ${decisions.slice(0, 3).join('; ')}`);
-    } catch {}
+    const decisions = textItems(latestSummary.key_decisions);
+    if (decisions.length > 0) lines.push(`Decisions: ${decisions.slice(0, 3).join('; ')}`);
   }
   lines.push('');
   return lines;

package/hook-episode.mjs

@@ -1,7 +1,7 @@
 // claude-mem-lite episode buffer management
 // Handles file-based episode storage with advisory locking and pending entry recovery
 
-import { join } from 'path';
+import { join, basename } from 'path';
 import {
   readFileSync,
   writeFileSync,
@@ -12,10 +12,13 @@ import {
   writeSync,
   renameSync,
   statSync,
+  existsSync,
   constants as fsConstants,
 } from 'fs';
 import { inferProject, isEditEntry } from './utils.mjs';
-import { RUNTIME_DIR } from './hook-shared.mjs';
+import { RUNTIME_DIR, hostScopeSuffix, deadHostFiles, isOtherLiveHost } from './hook-shared.mjs';
+import { inferProjectDir } from './project-utils.mjs';
+import { legacyProjectNameFromDir } from './lib/project-rekey.mjs';
 
 /**
  * Read the episode buffer WITHOUT holding the lock: the dying-process salvage in hook.mjs's
@@ -39,11 +42,70 @@ export function readEpisodeRaw() {
 }
 
 /**
- * Get the path to the current project's episode buffer file.
+ * Get the path to the episode buffer of this project AND this Claude Code process
+ * (`hostScopeSuffix`, D14): two sessions open in one project each buffer their own work.
+ * The parameters exist for orphanEpisodeFiles, which must name buffers of OTHER processes
+ * without a second spelling of the name; every other caller takes the defaults.
+ * @param {string} [host] a hostScopeSuffix() value; '' is the per-project name
+ * @param {string} [project]
  * @returns {string} Absolute path to the episode JSON file
  */
-export function episodeFile() {
-  return join(RUNTIME_DIR, `ep-${inferProject()}.json`);
+export function episodeFile(host = hostScopeSuffix(), project = inferProject()) {
+  return join(RUNTIME_DIR, `ep-${project}${host}.json`);
+}
+
+/**
+ * The file scripts/post-tool-use.sh appends a Read's path to, which the next saving flush
+ * collects into `files_read`. With a host pid it is the process's own and names no project
+ * (the process pins CLAUDE_PROJECT_DIR), which is what lets bash spell it for a project in any
+ * script; without one it is the project's. The bash spelling of the same rule is in
+ * post-tool-use.sh (tests/reads-file-name-cross-language.test.mjs).
+ * @param {string} [project]
+ * @returns {string}
+ */
+export function readsFile(project = inferProject(), host = hostScopeSuffix()) {
+  return join(RUNTIME_DIR, `reads-${host || project}.txt`);
+}
+
+/**
+ * The reads file that went with an orphan buffer (orphanEpisodeFiles), named by the same rule
+ * as readsFile: `ep-<id>@h<pid>.json` read into `reads-@h<pid>.txt`, a per-project
+ * `ep-<id>.json` into `reads-<id>.txt`. `@` never occurs in a project id.
+ * @param {string} orphanPath
+ * @returns {string}
+ */
+export function orphanReadsFile(orphanPath) {
+  const key = basename(orphanPath).slice('ep-'.length, -'.json'.length);
+  const at = key.indexOf('@h');
+  return at === -1 ? readsFile(key, '') : readsFile(key.slice(0, at), key.slice(at));
+}
+
+/**
+ * Episode buffers of this project that no live session will ever flush: the per-project
+ * buffer an older version wrote, and the buffer of a Claude Code process that has exited —
+ * a host closed mid-turn never reaches Stop. Before D14 the next session in the project
+ * flushed the one shared buffer at SessionStart; with per-process buffers nobody else reads
+ * these, so SessionStart adopts them instead of leaving them to the 7-day sweep.
+ *
+ * Without a host pid the per-project buffer is this process's own, so only the pre-D9 one is
+ * an orphan.
+ *
+ * @param {string} [project]
+ * @returns {string[]} absolute paths
+ */
+export function orphanEpisodeFiles(project = inferProject()) {
+  const own = hostScopeSuffix();
+  const out = [];
+  // Per-project buffers: this id's (an older version's, unless it is this process's own because
+  // there is no host pid), and the pre-D9 id's — a non-Latin project buffered under
+  // `ep-projects----.json` before its id changed, and nothing looks under that name again.
+  for (const id of new Set([project, legacyProjectNameFromDir(inferProjectDir())])) {
+    if (!own && id === project) continue;
+    const file = episodeFile('', id);
+    if (existsSync(file)) out.push(file);
+  }
+  if (own) out.push(...deadHostFiles(basename(episodeFile('', project)).slice(0, -'.json'.length), '.json'));
+  return out;
 }
 
 /**
@@ -237,7 +299,10 @@ export function writePendingEntry(entry, sessionId, project) {
   const pendingFile = join(RUNTIME_DIR, `pending-${ts}-${rand}.json`);
   const tmp = pendingFile + '.tmp';
   try {
-    writeFileSync(tmp, JSON.stringify({ entry, sessionId, project, ts }), { mode: 0o600 });
+    // `host`: the process whose buffer this entry belongs to (D14) — merged only into that one.
+    writeFileSync(tmp, JSON.stringify({ entry, sessionId, project, ts, host: hostScopeSuffix() }), {
+      mode: 0o600,
+    });
     renameSync(tmp, pendingFile);
   } catch {
     try {
@@ -282,8 +347,11 @@ export function mergePendingEntries(episode) {
         } catch {}
         continue;
       }
-      // Only merge entries belonging to the same project
+      // Only merge entries belonging to the same project, and not another RUNNING process's
+      // (D14): its own next flush takes those. A gone process's spill is merged here, as the
+      // shared buffer's was before D14. An entry written before `host` existed merges as ever.
       if (pending.project && episode.project && pending.project !== episode.project) continue;
+      if (typeof pending.host === 'string' && isOtherLiveHost(pending.host)) continue;
       if (pending.entry) {
         unlinkSync(fp);
         episode.entries.push(pending.entry);

package/hook-handoff.mjs

@@ -25,6 +25,7 @@ import {
   CONTINUE_KEYWORDS,
   UNCONSUMED_HANDOFF_SQL,
 } from './hook-shared.mjs';
+import { RESUME_PAST_KEYWORDS } from './lib/handoff-constants.mjs';
 // T10d: import the whole module (not a named export) so tests can spy on
 // gitStateModule.readGitState via vi.spyOn. Named-import bindings are
 // immutable in ESM and cannot be mocked after the fact.
@@ -704,6 +705,31 @@ export function detectContinuationIntent(db, promptText, project, currentCcSessi
   if (!promptText || typeof promptText !== 'string') return false;
   if (promptText.trim().length < 2) return false;
 
+  // A session's own follow-ups are not a resume of ANOTHER session. The stages below counted
+  // this session's OWN exit handoff (written by its previous Stop) as evidence, while
+  // pickHandoffToInject excludes own exit rows and returns another session's newest one — so
+  // `ok do it` after a `继续` injected (and consumed) a second, unrelated session's handoff,
+  // and a session that had started a new task got yesterday's on a short follow-up.
+  if (currentCcSessionId) {
+    const firstPromptAt = db
+      .prepare('SELECT MIN(created_at_epoch) AS m FROM user_prompts WHERE cc_session_id = ?')
+      .get(currentCcSessionId)?.m;
+    // One resume per session: a handoff consumed in this PROJECT since this session's first
+    // prompt ends this session's resumes — by this session, or by a concurrent one (the table has
+    // no consumed-by column; a known limit, deferred).
+    if (
+      typeof firstPromptAt === 'number' &&
+      db
+        .prepare('SELECT 1 FROM session_handoffs WHERE project = ? AND consumed_at >= ?')
+        .get(project, firstPromptAt)
+    )
+      return false;
+    const endedATurn = db
+      .prepare(`SELECT 1 FROM session_handoffs WHERE project = ? AND type = 'exit' AND session_id = ?`)
+      .get(project, currentCcSessionId);
+    if (endedATurn) return RESUME_PAST_KEYWORDS.test(promptText);
+  }
+
   // T10d Stage -1: Git-commit anchor — current HEAD == a stored
   // git_sha_at_handoff ⇒ working tree hasn't moved since the handoff.
   //

package/hook-llm.mjs

@@ -1601,24 +1601,25 @@ ${obsList}`;
     // empty request: INSERT writes '' and the UPDATE keeps the row's own request (or an older row's)
     // when the reply's is empty. Use asText in the gate so a non-string / empty-array field can't falsely
     // trigger it.
+    // Items are kept only when they are non-empty strings. Array.isArray alone stored a reply of
+    // [123, null, {…}, "real lesson"] as-is, and SessionStart then injected
+    // "Lessons: 123; ; [object Object]", pushing the real lesson out of its 3-item window.
+    const textItems = (v) =>
+      Array.isArray(v) ? v.filter((x) => typeof x === 'string' && x.trim()).map((x) => x.trim()) : [];
+    const lessons = llmParsed ? textItems(llmParsed.lessons) : [];
+    const keyDecisions = llmParsed ? textItems(llmParsed.key_decisions) : [];
     const hasSummaryContent =
       llmParsed &&
       (asText(llmParsed.request) ||
         asText(llmParsed.completed) ||
         asText(llmParsed.remaining_items) ||
         asText(llmParsed.next_steps) ||
-        (Array.isArray(llmParsed.lessons) && llmParsed.lessons.length > 0) ||
-        (Array.isArray(llmParsed.key_decisions) && llmParsed.key_decisions.length > 0));
+        lessons.length > 0 ||
+        keyDecisions.length > 0);
     if (hasSummaryContent) {
       const now = new Date();
-      const lessonsJson =
-        Array.isArray(llmParsed.lessons) && llmParsed.lessons.length > 0
-          ? JSON.stringify(llmParsed.lessons)
-          : null;
-      const decisionsJson =
-        Array.isArray(llmParsed.key_decisions) && llmParsed.key_decisions.length > 0
-          ? JSON.stringify(llmParsed.key_decisions)
-          : null;
+      const lessonsJson = lessons.length > 0 ? JSON.stringify(lessons) : null;
+      const decisionsJson = keyDecisions.length > 0 ? JSON.stringify(keyDecisions) : null;
 
       // Upgrade the session's summary row instead of creating another. This worker runs after
       // EVERY Stop (one per assistant turn) and again from SessionStart's /clear path; selecting

package/hook-memory.mjs

@@ -11,6 +11,7 @@ import {
   neutralizeContextDelimiters,
 } from './utils.mjs';
 import { upsFtsQuery, upsQueryTerms } from './lib/ups-query.mjs';
+import { meetsRecallLengthFloor } from './lib/prompt-admission.mjs';
 import { citeFactorJs, TYPE_QUALITY, TYPE_QUALITY_DEFAULT } from './scoring-sql.mjs';
 import { liveObsFilterSql } from './lib/inject-search-core.mjs';
 import { recordMetric } from './lib/metrics.mjs';
@@ -280,14 +281,9 @@ export function searchRelevantMemories(
   excludeIds = [],
   { counterfactual = false } = {},
 ) {
-  // Min-length guard is English-centric: 5 chars ≈ one short English word. A CJK
-  // query is meaningful at 2 chars (状态/架构) and most real Chinese queries are
-  // 2-4 chars (状态管理, 召回率, 熔断降级) — the bare `.length < 5` silently
-  // rejected ALL of them, so a Chinese-primary user got zero memory injection.
-  // Apply the 5-char floor only to non-CJK queries; CJK needs ≥2.
-  if (!db || !userPrompt) return [];
-  const queryHasCjk = /[一-鿿㐀-䶿]/.test(userPrompt);
-  if (userPrompt.length < (queryHasCjk ? 2 : 5)) return [];
+  // Min-length guard: 5 chars for non-CJK, 2 for CJK. The rationale and the one definition
+  // are in lib/prompt-admission.mjs, shared with hook.mjs's events arm (issue #39).
+  if (!db || !meetsRecallLengthFloor(userPrompt)) return [];
   // CJK-DOMINANT (not merely CJK-containing) gates the OR-fallback bypass below.
   // A substring test would let one incidental CJK char — an IME-leaked particle,
   // a 中文 noun in an otherwise-English prompt — flip OR-fallback on and inject

package/hook-optimize.mjs

@@ -13,6 +13,7 @@ import {
   debugLog,
   debugCatch,
   COMPRESSED_AUTO,
+  NOT_COMPRESSION_KEEPER_SQL,
   computeMinHash,
   estimateJaccardFromMinHash,
   jaccardSimilarity,
@@ -481,7 +482,24 @@ scope: ${SCOPE_PROMPT_LEGEND}`;
       // reachable by no auto-recovery pass — so one Haiku "importance 0" misjudgment would
       // hide a real observation until manual surgery. In wide scope, fall through and let
       // clampImportance floor it to 1 (kept visible, low-ranked) instead of hiding.
-      if ((parsed.importance === 0 || parsed.importance === '0') && scope !== 'wide') {
+      // A compression keeper is never hidden: hiding it hides every member compressed into it
+      // (the same rule NOT_COMPRESSION_KEEPER_SQL enforces on the maintenance writers). It falls
+      // through to the normal update instead: floored to importance 1 and stamped, so it is not
+      // re-sent. In narrow scope that update still replaces its title and narrative.
+      const isKeeper = !!db
+        .prepare('SELECT 1 FROM observations WHERE compressed_into = ? LIMIT 1')
+        .get(cand.id);
+      // D10: an importance a person set (importance_set_at) is theirs — neither hidden on a
+      // model's 0 nor re-scored below.
+      const humanSet =
+        (db.prepare('SELECT importance_set_at FROM observations WHERE id = ?').get(cand.id)
+          ?.importance_set_at ?? null) !== null;
+      if (
+        (parsed.importance === 0 || parsed.importance === '0') &&
+        scope !== 'wide' &&
+        !isKeeper &&
+        !humanSet
+      ) {
         // D#12, and this one is not a stale-write guard — it is a POINTER guard.
         // `compressed_into` is the child -> keeper link, and COMPRESSED_AUTO is -1. If a
         // concurrent cluster-merge or smart-compress adopts this row during the 45 s Haiku
@@ -493,7 +511,7 @@ scope: ${SCOPE_PROMPT_LEGEND}`;
         const res = db
           .prepare(
             `UPDATE observations SET compressed_into = ${COMPRESSED_AUTO}, optimized_at = ?
-             WHERE id = ? AND ${liveObsFilterSql('')} AND optimized_at IS NULL`,
+             WHERE id = ? AND ${liveObsFilterSql('')} AND optimized_at IS NULL AND ${NOT_COMPRESSION_KEEPER_SQL}`,
           )
           .run(Date.now(), cand.id);
         if (res.changes === 0) {
@@ -552,8 +570,10 @@ scope: ${SCOPE_PROMPT_LEGEND}`;
           : cand.narrative || '';
       // Floor at the stored importance: re-enrich adds a lesson, it must never silently downgrade
       // a user-set/promoted importance (the UPDATE also sets optimized_at → the loss is permanent).
-      // Upgrades are still honored.
-      const importance = Math.max(clampImportance(parsed.importance), cand.importance || 1);
+      // Upgrades are still honored — except over an importance a person set (D10), which stays.
+      const importance = humanSet
+        ? cand.importance
+        : Math.max(clampImportance(parsed.importance), cand.importance || 1);
 
       const bigramText = cjkBigrams((title || '') + ' ' + (narrative || ''));
       const textField = [conceptsText, factsText, searchAliases || '', bigramText].filter(Boolean).join(' ');
@@ -1250,7 +1270,9 @@ Return ONLY valid JSON:
     const factsText = facts.length ? facts.join(' ') : keeper.facts || '';
     // Scrub BEFORE truncate (see re-enrich note): keep the boundary cut on
     // already-scrubbed text so a straddling secret can't leak a sub-floor head.
-    const title = truncate(scrubSecrets(parsed.merged_title || ''), 120);
+    // Preserve-on-empty for the title too, like narrative/concepts/facts: `{"should_merge":true}`
+    // alone blanked the keeper's title and it listed as "(untitled)".
+    const title = truncate(scrubSecrets(parsed.merged_title || keeper.title || ''), 120);
     const narrative = truncate(scrubSecrets(parsed.merged_narrative || keeper.narrative || ''), 800);
     // Preserve-on-empty. The merge overwrites the keeper in place and hides every non-keeper
     // member (compressed_into=keeper.id), so if the LLM returns merged_lesson:null (the prompt

package/hook-shared.mjs

@@ -31,6 +31,7 @@ import {
 import { isDbUnusableError, DB_UNUSABLE_MARKER_PREFIX } from './lib/db-unusable.mjs';
 import { shouldRecordOnce } from './lib/record-once.mjs';
 import { hookSessionId } from './lib/provenance.mjs';
+import { PROJECT_REKEY_MARKER_PREFIX } from './lib/project-rekey.mjs';
 // Audit 2026-09-05 P1-2 (carried from 2026-09-02 P2-9): `callLLM`, the quiet/adoption
 // predicates and the handoff constants moved into `lib/` because two lib modules
 // imported them from here and dragged this file's whole import graph — haiku-client,
@@ -265,6 +266,8 @@ export const GC_PRESERVED_MARKER_PREFIXES = Object.freeze([
   '.adopt-offered-',
   // r3: the one-time note that CLAUDE.local.md was written. Deleting it would repeat the note.
   '.local-steering-noted-',
+  // D9: the one-time re-key of a project's rows off its pre-D9 id, and its one-time note.
+  PROJECT_REKEY_MARKER_PREFIX,
   '.deferred-block-migrated-',
   '.legacy-claude-md-cleaned-',
   // v3.66.1: these two shipped in the GC list for one release and had to come
@@ -376,8 +379,89 @@ try {
 
 // ─── Session ID Management ───────────────────────────────────────────────────
 
+/**
+ * The Claude Code process this hook runs under, as a file-name suffix: `@h<pid>`, or '' when
+ * the host did not say.
+ *
+ * D14: the session file and the episode buffer were keyed by PROJECT, so a second session opened
+ * in the same project overwrote the first one's session file, and every later hook of the first
+ * session ran under the second one's id — its handoff "Working On" was the other session's
+ * prompt, one summary row stood for two sessions, and one session's Stop flushed the other's
+ * work in progress. The host PROCESS is the key, not the host session_id, because /clear rotates
+ * session_id inside the same process and SessionStart's /clear branch has to find the session
+ * that was just cleared: that is this process's file.
+ *
+ * `CLAUDE_PID` is set by Claude Code on hook subprocesses (observed 2026-09-29: the hooks of two
+ * concurrent sessions each saw their own host's pid, and it is inherited by spawnBackground
+ * workers). It is not in the documented hook contract, so absent or malformed it degrades to ''
+ * — the per-project names this replaced, byte for byte. `@` cannot occur in a project id
+ * (projectNameFromDir keeps only letters, marks, digits and `_.-`), so a suffixed name never
+ * collides with another project's plain one. scripts/post-tool-use.sh mirrors this rule for
+ * the reads file.
+ *
+ * @param {Record<string, string|undefined>} [env]
+ * @returns {string}
+ */
+export function hostScopeSuffix(env = process.env) {
+  const pid = env.CLAUDE_PID;
+  return typeof pid === 'string' && /^[1-9]\d{0,9}$/.test(pid) ? `@h${pid}` : '';
+}
+
 export function sessionFile() {
-  return join(RUNTIME_DIR, `session-${inferProject()}`);
+  return join(RUNTIME_DIR, `session-${inferProject()}${hostScopeSuffix()}`);
+}
+
+/** True unless `pid` is certainly gone (ESRCH); EPERM means it exists under another user. */
+function processAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return e.code !== 'ESRCH';
+  }
+}
+
+/**
+ * True when `suffix` (a hostScopeSuffix() value) names a Claude Code process other than this one
+ * that is still running — whose buffer, and lock-contention spill, are its own to flush. False
+ * for this process, for a gone one, and for '' (a writer that had no host pid).
+ *
+ * @param {string} suffix
+ * @returns {boolean}
+ */
+export function isOtherLiveHost(suffix) {
+  const m = /^@h([1-9]\d{0,9})$/.exec(String(suffix));
+  return !!m && suffix !== hostScopeSuffix() && processAlive(Number(m[1]));
+}
+
+/**
+ * Runtime files `<stem>@h<pid><ext>` left by a Claude Code process that has exited — files no
+ * live session will read again (D14). Never this process's own, and none at all when this
+ * process has no host pid. A recycled pid reads as alive, so such a file waits for the
+ * age-based sweeps instead: the error is towards keeping.
+ *
+ * @param {string} stem e.g. `ep-<project>`
+ * @param {string} [ext] e.g. `.json`
+ * @returns {string[]} absolute paths
+ */
+export function deadHostFiles(stem, ext = '') {
+  const own = hostScopeSuffix();
+  if (!own) return [];
+  let names;
+  try {
+    names = readdirSync(RUNTIME_DIR);
+  } catch {
+    return [];
+  }
+  const prefix = `${stem}@h`;
+  const out = [];
+  for (const f of names) {
+    if (!f.startsWith(prefix) || !f.endsWith(ext)) continue;
+    const pid = f.slice(prefix.length, f.length - ext.length);
+    if (!/^[1-9]\d{0,9}$/.test(pid) || `@h${pid}` === own || processAlive(Number(pid))) continue;
+    out.push(join(RUNTIME_DIR, f));
+  }
+  return out;
 }
 
 export function getSessionId() {

package/hook-update.mjs

@@ -2,6 +2,7 @@
 // Checks for new versions on SessionStart, downloads and installs automatically.
 // Skips in dev mode (symlinked installs). Silent on network failure.
 
+import { isOurMcpRegistration } from './lib/mcp-ownership.mjs';
 import { execSync, execFileSync } from 'node:child_process';
 import {
   readFileSync,
@@ -1053,14 +1054,16 @@ export async function installExtractedRelease(sourceDir, targetDir = INSTALL_DIR
     // Post-update migration: clean stale global MCPs if plugin handles it.
     // Both "mem" (legacy, pre-v2.78) and "mem-lite" (current) are purged so a
     // user who manually ran `claude mcp add` in either era doesn't end up with
-    // duplicate global + plugin registrations after the rename.
+    // duplicate global + plugin registrations after the rename — "mem" only when it runs
+    // our server (lib/mcp-ownership.mjs): the name is generic, and a user's own `mem`
+    // server was deleted on every plugin update that re-synced a direct install.
     try {
       if (isPluginMode()) {
         const claudeJsonPath = join(homedir(), '.claude.json');
         const cfg = JSON.parse(readFileSync(claudeJsonPath, 'utf8'));
         let changed = false;
         for (const k of ['mem', 'mem-lite']) {
-          if (cfg.mcpServers?.[k]) {
+          if (cfg.mcpServers?.[k] && isOurMcpRegistration(k, cfg.mcpServers[k])) {
             delete cfg.mcpServers[k];
             changed = true;
             debugLog('DEBUG', 'hook-update', `Post-update: removed stale global MCP "${k}"`);