claude-mem-lite 6.25.0 → 6.25.2

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "6.25.0",
+      "version": "6.25.2",
       "source": "./",
       "homepage": "https://github.com/sdsrss/claude-mem-lite",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.25.0",
+  "version": "6.25.2",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/hook-shared.mjs

@@ -31,6 +31,7 @@ import {
 import { isDbUnusableError, DB_UNUSABLE_MARKER_PREFIX } from './lib/db-unusable.mjs';
 import { shouldRecordOnce } from './lib/record-once.mjs';
 import { backgroundWorkerEnv, workerDirGone } from './lib/worker-data-dir.mjs';
+import { LIVE_HOLDER_MAX_MS } from './lib/proc-lock.mjs';
 import { hookSessionId } from './lib/provenance.mjs';
 import { PROJECT_REKEY_MARKER_PREFIX } from './lib/project-rekey.mjs';
 // Audit 2026-09-05 P1-2 (carried from 2026-09-02 P2-9): `callLLM`, the quiet/adoption
@@ -67,12 +68,13 @@ export const STALE_SESSION_MS = 24 * 60 * 60 * 1000; // 24h
 export const STALE_LOCK_MS = 30000; // 30s
 
 // Backstop for cleanStaleLockFiles(): a lock whose recorded pid is ALIVE is kept until it
-// reaches this age, not STALE_LOCK_MS. Deliberately LONGER than proc-lock.mjs's own 5-min
-// steal window, so the sweeper is never the more aggressive of the two — whatever it
-// removes, the lock protocol itself would already have let the next caller steal. Its only
-// job is to garbage-collect a leaked file whose pid was recycled onto an unrelated live
-// process, which would otherwise pin the file forever. (A20260905-R5-P1-1)
-export const ABANDONED_LOCK_MS = 10 * 60 * 1000; // 10 min
+// reaches this age, not STALE_LOCK_MS. The same bound proc-lock.mjs steals a live holder's lock
+// at, so the sweeper is never the more aggressive of the two — whatever it removes, the lock
+// protocol itself would already have let the next caller steal. Its only job is to
+// garbage-collect a leaked file whose pid was recycled onto an unrelated live process, which
+// would otherwise pin the file forever. (A20260905-R5-P1-1) It was 10 min, shorter than an
+// update holds install.lock while its smoke gate builds the binding from source (D#294).
+export const ABANDONED_LOCK_MS = LIVE_HOLDER_MAX_MS;
 
 // The background-maintenance mutex, defined HERE next to the sweeper policy it has to
 // escape. cleanStaleLockFiles() sweeps every `*.lock` in RUNTIME_DIR; until
@@ -83,7 +85,8 @@ export const ABANDONED_LOCK_MS = 10 * 60 * 1000; // 10 min
 // probe, and pid checks are meaningless across a shared homedir. `tests/auto-maintain-proc-lock.test.mjs`
 // asserts that against THIS constant rather than a re-typed copy: the first version of that
 // test built its own path from a literal, so renaming the lock left it green with the hazard
-// back. proc-lock's own staleness policy (age OR provably-dead pid) is the correct one.
+// back. proc-lock's own staleness policy (a provably-dead pid at once, a live one only past
+// LIVE_HOLDER_MAX_MS) is the correct one.
 export const AUTO_MAINTAIN_LOCK = 'auto-maintain.proclock';
 export const DEDUP_WINDOW_MS = 5 * 60 * 1000; // 5 min (title dedup)
 export const RELATED_OBS_WINDOW_MS = 7 * DAY_MS; // 7 days

package/hook-update.mjs

@@ -828,11 +828,15 @@ export async function verifyReleaseAuthenticity(extractedDir, assets, publicKey
 // updater that was killed mid-swap (it applies the same staleness bound).
 const SWAP_MARKER = join(STATE_DIR, 'runtime', 'swap-in-progress'); // runtime-dir:stays-put — installation identity
 // Intent journal, written INSIDE the backup dir before each rename. On a hard kill
-// the backup dir survives (every normal exit deletes it) and this file says exactly
+// the backup dir survives (a normal exit deletes it, unless its journal cannot be
+// removed, D#283) and this file says exactly
 // which paths were in flight, so the next entry can finish the rollback at the right
 // granularity — a bare directory walk cannot tell a nested relPath from a directory
 // relPath like `node_modules`.
-const SWAP_JOURNAL = '.swap-journal.json';
+const SWAP_JOURNAL = '.swap-journal.json'; // doctor and cleanup spell it SWAP_JOURNAL_NAME (lib/doctor-stale-temp.mjs)
+// Written into the backup dir when its swap is over (committed, or rolled back): never replay it
+// (D#292 C). Doctor and cleanup spell it SWAP_RESOLVED_NAME.
+const SWAP_RESOLVED = '.swap-resolved';
 
 function markSwapStart() {
   try {
@@ -856,19 +860,164 @@ function clearSwapMarker() {
 // backup dir but nothing records it — recovery would then delete the backup dir with
 // the only copy of that file inside it. rollbackInstall guards every entry with
 // existsSync/force, so an intent that never happened is a harmless no-op.
+//
+// By temp file and rename, and it throws (D#289). writeFileSync truncates the journal before it
+// writes it, so a kill or ENOSPC in between left an empty journal, which recovery read as "nothing
+// moved" and then deleted the backups. A write error was swallowed, so the rename it was meant to
+// record went ahead unrecorded. Now the previous journal stays whole until the new one replaces
+// it, and a swap that cannot journal stops before the rename, through the rollback in the caller.
+//
+// Retried for a moment on EPERM/EBUSY/EACCES: the rename replaces a file just written, about twice
+// per switched path, and on Windows a scanner holding that file makes a rename over it fail
+// briefly. Each failure stopped the update and rolled it back, and a rollback is where a restore
+// can fail (D#292 A). Bounded at about 0.7 s, then it throws as before.
+const JOURNAL_RETRY_CODES = new Set(['EPERM', 'EBUSY', 'EACCES']);
 function journalSwap(backupDir, backedUp, installed) {
+  const data = JSON.stringify({ backedUp, installed });
+  for (let attempt = 1; ; attempt++) {
+    try {
+      atomicWriteFileSync(join(backupDir, SWAP_JOURNAL), data);
+      return;
+    } catch (e) {
+      if (attempt >= 8 || !JOURNAL_RETRY_CODES.has(e.code)) throw e;
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 25 * attempt);
+    }
+  }
+}
+
+// Clean up after a swap that is over: committed, or rolled back. Never throws, because a cleanup
+// that throws reaches the caller's catch, which rolls the swap back again (D#283; EBUSY is
+// ordinary on Windows and `force` does not suppress it).
+//
+// The dir is marked resolved first (D#292 C). A journal left behind (it could not be removed, or a
+// kill came first) was replayed by the next recovery: over a committed swap that put the previous
+// release back, and over a rolled-back one whose journal outlived a later swap it deleted a path
+// that swap had installed. Recovery, install, cleanup and doctor leave a resolved dir's journal
+// alone. The marker is a new empty file, so it needs no access to the journal a failed removal
+// could not get. With the marker written, a journal that stays is inert and the backups go anyway,
+// child by child around the journal and the marker: a recursive removal of the dir takes children
+// in directory order and stops at the first failure, so it could take the marker and then stop at
+// the journal (v6.25.1 delta review). If the marker cannot be written either, the journal still
+// goes before the backups, and if it stays, so do the backups, complete, so that a replay restores
+// one whole release.
+function discardBackupDir(backupDir) {
+  let resolved = false;
+  try {
+    writeFileSync(join(backupDir, SWAP_RESOLVED), '');
+    resolved = true;
+  } catch (e) {
+    debugCatch(e, 'mark-swap-resolved');
+  }
+  try {
+    rmSync(join(backupDir, SWAP_JOURNAL), { force: true });
+  } catch (e) {
+    debugCatch(e, 'discard-swap-journal');
+    if (resolved) removeBackupsBeside(backupDir);
+    return;
+  }
+  try {
+    rmSync(backupDir, { recursive: true, force: true });
+  } catch (e) {
+    debugCatch(e, 'discard-backup-dir');
+  }
+}
+
+function removeBackupsBeside(backupDir) {
+  let names = [];
   try {
-    writeFileSync(join(backupDir, SWAP_JOURNAL), JSON.stringify({ backedUp, installed }));
+    names = readdirSync(backupDir);
   } catch (e) {
-    debugCatch(e, 'journalSwap');
+    debugCatch(e, 'discard-backups-list');
+  }
+  for (const name of names) {
+    if (name === SWAP_JOURNAL || name === SWAP_RESOLVED) continue;
+    try {
+      rmSync(join(backupDir, name), { recursive: true, force: true });
+    } catch (e) {
+      debugCatch(e, 'discard-backup');
+    }
+  }
+}
+
+// Mark resolved the backup dirs a swap found left over and unfinished (recovery leaves one whose
+// journal it cannot read right now). Called once that swap has committed: it replaced every path
+// it switches, so a later replay of an older journal, once it can be read, would only mix the
+// releases back (v6.25.1 delta review). The same retirement install does after writing the tree.
+function retireUnresolvedBackups(targetDir, names) {
+  for (const name of names) {
+    try {
+      writeFileSync(join(targetDir, name, SWAP_RESOLVED), '');
+      debugLog('WARN', 'hook-update', `Retired ${name}: the committed swap replaced what its journal names`);
+    } catch (e) {
+      debugCatch(e, 'retire-unresolved-backup');
+    }
+  }
+}
+
+// Backup dirs still unresolved are undone like a stack, newest first (D#293), and their order is
+// carried in the dir NAME, `.update-backup-s<seq>-<ms>-<pid>`: a swap takes one more than the
+// highest seq among the unresolved dirs it finds. Neither the wall clock in the name nor a field in
+// the journal decides it: a clock can go back, and a journal can be unreadable at the moment the
+// order is needed (a scanner holding it on Windows), which made a replay lose a file (review P2-1).
+// A dir named before 6.25.2 has no seq and reads as 0, so it comes last.
+const BACKUP_SEQ_RE = /^\.update-backup-s(\d+)-/;
+const swapSeqOf = (name) => Number(BACKUP_SEQ_RE.exec(name)?.[1] ?? 0);
+const nextSwapSeq = (names) => Math.max(0, ...names.map(swapSeqOf)) + 1;
+
+// The `.update-backup-*` dirs in targetDir that carry no resolved marker.
+function unresolvedBackups(targetDir) {
+  try {
+    return readdirSync(targetDir, { withFileTypes: true })
+      .filter((e) => e.isDirectory() && e.name.startsWith('.update-backup-'))
+      .map((e) => e.name)
+      .filter((name) => !existsSync(join(targetDir, name, SWAP_RESOLVED)));
+  } catch (e) {
+    debugCatch(e, 'list-unresolved-backups');
+    return [];
+  }
+}
+
+// The backup dir is resolved before staging goes: removing a whole staging tree takes long enough
+// for a kill to land in, and a kill there left a committed swap's journal to be replayed.
+//
+// After a rollback, `notRestored` lists what it could not put back. The backup dir then holds the
+// only copy of each, so it stays whole with its journal, unresolved, and the next entry replays it
+// (D#293). The caller used to delete it. Nothing gates a later update on it: one that commits
+// retires it, so a restore that keeps failing cannot block updates (a2cf96a1's gate did).
+function discardSwapDirs(stagingDir, backupDir, notRestored = []) {
+  if (notRestored.length === 0) discardBackupDir(backupDir);
+  else
+    debugLog(
+      'WARN',
+      'hook-update',
+      `Kept ${backupDir}: could not put back ${notRestored.join(', ')}; the next update, install or cleanup tries again`,
+    );
+  try {
+    rmSync(stagingDir, { recursive: true, force: true });
+  } catch (e) {
+    debugCatch(e, 'discard-staging-dir');
+  }
+}
+
+// Whether a path is there, by lstat: a symlink counts whatever it points to, and an error other
+// than "no such path" counts as there. existsSync follows the link and answers false on EACCES, so
+// a backup that was a dangling symlink read as already put back, and was deleted (review r2 F11).
+function present(p) {
+  try {
+    lstatSync(p);
+    return true;
+  } catch (e) {
+    return e.code !== 'ENOENT' && e.code !== 'ENOTDIR';
   }
 }
 
 /**
  * Finish any swap a previous process was killed in the middle of, then clear its
  * residue. Called on every install entry, under the install lock, BEFORE a new
- * staging/backup pair is created.
- * @returns {number} number of interrupted swaps rolled back
+ * staging/backup pair is created; and by install.mjs, under the same lock, before
+ * `install` (and so `repair`) writes the tree and from `cleanup` (D#289).
+ * @returns {number} number of backup dirs processed, with a journal or without; one left in place
+ *   because its journal cannot be read is not counted
  */
 export function recoverInterruptedSwaps(targetDir = INSTALL_DIR) {
   let entries;
@@ -879,6 +1028,7 @@ export function recoverInterruptedSwaps(targetDir = INSTALL_DIR) {
   }
 
   let recovered = 0;
+  const pending = [];
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
     const dir = join(targetDir, entry.name);
@@ -895,26 +1045,69 @@ export function recoverInterruptedSwaps(targetDir = INSTALL_DIR) {
     }
     if (!entry.name.startsWith('.update-backup-')) continue;
 
+    // Its swap is over and only its cleanup failed: remove what is left, never replay it (D#292 C).
+    if (existsSync(join(dir, SWAP_RESOLVED))) {
+      discardBackupDir(dir);
+      recovered++;
+      continue;
+    }
+    pending.push(entry.name);
+  }
+
+  // Several dirs are unresolved only when a rollback could not put every file back (D#293), and
+  // they are undone like a stack: newest first by the seq in the name, and none older while a newer
+  // one is unfinished or cannot be read. An older journal replayed first puts back a file that a
+  // newer journal, which installed that path, then deletes; with nothing left to restore it from.
+  pending.sort((a, b) => swapSeqOf(b) - swapSeqOf(a) || b.localeCompare(a));
+  for (const name of pending) {
+    const dir = join(targetDir, name);
+    // No journal: the swap is over and its journal is gone (or it was killed before its first
+    // rename), so there is nothing to replay and the dir is residue. A journal that is there but
+    // cannot be read, or not as one (an in-place write of 6.25.0 or older torn by a kill), says
+    // nothing about what moved, and the dir may hold the only copy of it: leave it, and everything
+    // older with it. It used to be read as "nothing moved" and deleted (v6.25.1 review). doctor and
+    // cleanup name it; the next swap that commits, or an install, retires it.
+    let raw;
+    try {
+      raw = readFileSync(join(dir, SWAP_JOURNAL), 'utf8');
+    } catch (e) {
+      if (e.code === 'ENOENT') {
+        discardBackupDir(dir);
+        recovered++;
+        continue;
+      }
+      debugCatch(e, 'recover-read-journal');
+      break;
+    }
     let journal;
     try {
-      journal = JSON.parse(readFileSync(join(dir, SWAP_JOURNAL), 'utf8'));
+      journal = JSON.parse(raw);
     } catch {
       journal = null;
     }
-    const backedUp = Array.isArray(journal?.backedUp) ? journal.backedUp : [];
-    const installed = Array.isArray(journal?.installed) ? journal.installed : [];
-    // Copies: rollbackInstall reverses the arrays in place.
-    rollbackInstall([...installed], [...backedUp], dir, targetDir);
-    try {
-      rmSync(dir, { recursive: true, force: true });
-    } catch (e) {
-      debugCatch(e, 'recover-backup');
+    if (!Array.isArray(journal?.backedUp) || !Array.isArray(journal?.installed)) {
+      debugLog(
+        'WARN',
+        'hook-update',
+        `Left ${name} in place, and any older one: its swap journal cannot be read`,
+      );
+      break;
+    }
+    const notRestored = rollbackInstall(journal.installed, journal.backedUp, dir, targetDir);
+    if (notRestored.length > 0) {
+      debugLog(
+        'WARN',
+        'hook-update',
+        `Could not finish ${name}: ${notRestored.join(', ')} not put back; left, with any older one, for the next entry`,
+      );
+      break;
     }
+    discardBackupDir(dir);
     recovered++;
     debugLog(
       'WARN',
       'hook-update',
-      `Recovered an interrupted update swap: restored ${backedUp.length} path(s) from ${entry.name}`,
+      `Recovered an interrupted update swap: restored ${journal.backedUp.length} path(s) from ${name}`,
     );
   }
   return recovered;
@@ -923,21 +1116,33 @@ export function recoverInterruptedSwaps(targetDir = INSTALL_DIR) {
 // A rollback swaps a file SET back just as the install swapped it in, so it holds the same
 // marker for the same reason (D#239 g). After the MED-5 smoke gate the loop has already cleared
 // it; after a throw inside the loop it is still set, and this call takes it over.
+//
+// Safe to run twice over one journal (D#283). A backed-up path whose backup is gone holds the OLD
+// file already, restored by an earlier rollback or never moved out, so it is not deleted: a
+// second rollback used to delete every installed path, by then the only copy of the old install.
+// That holds for a journal this code wrote: its cleanup removes the journal before any backup, and
+// when the journal cannot be removed, the resolved marker keeps it from being replayed. A backup
+// dir 6.25.0 or older left half deleted beside its journal can still replay to a mix.
+// The arrays are copied, not reversed in place, so a caller's journal is left as it was.
+//
+// Returns the backed-up paths it could not put back, still in the backup dir (D#293).
 function rollbackInstall(installed, backedUp, backupDir, targetDir) {
   markSwapStart();
   try {
-    for (const relPath of installed.reverse()) {
+    const restored = new Set(backedUp.filter((relPath) => !present(join(backupDir, relPath))));
+    for (const relPath of [...installed].reverse()) {
+      if (restored.has(relPath)) continue;
       try {
         rmSync(join(targetDir, relPath), { recursive: true, force: true });
       } catch {
         /* best-effort */
       }
     }
-    for (const relPath of backedUp.reverse()) {
+    for (const relPath of [...backedUp].reverse()) {
       const backupPath = join(backupDir, relPath);
       const targetPath = join(targetDir, relPath);
       try {
-        if (existsSync(backupPath)) {
+        if (present(backupPath)) {
           mkdirSync(dirname(targetPath), { recursive: true });
           renameSync(backupPath, targetPath);
         }
@@ -948,6 +1153,7 @@ function rollbackInstall(installed, backedUp, backupDir, targetDir) {
   } finally {
     clearSwapMarker();
   }
+  return backedUp.filter((relPath) => present(join(backupDir, relPath)));
 }
 
 // MED-5 post-install health gate: load-test the freshly-switched code in a SEPARATE
@@ -1046,9 +1252,11 @@ export async function installExtractedRelease(sourceDir, targetDir = INSTALL_DIR
   }
   const ts = `${Date.now()}-${process.pid}`;
   const stagingDir = join(targetDir, `.update-staging-${ts}`);
-  const backupDir = join(targetDir, `.update-backup-${ts}`);
+  // Named once the seq is known, below; until then nothing has been written into it.
+  let backupDir = join(targetDir, `.update-backup-${ts}`);
   const backedUp = [];
   const installed = [];
+  let committed = false;
 
   const manifest = await loadReleaseManifest(sourceDir);
   const switchablePaths = buildSwitchablePaths(manifest.SOURCE_FILES);
@@ -1058,6 +1266,11 @@ export async function installExtractedRelease(sourceDir, targetDir = INSTALL_DIR
     // one — otherwise this install stacks on top of a mixed-version tree and its
     // own backup can no longer restore a coherent state.
     recoverInterruptedSwaps(targetDir);
+    // What recovery left unfinished (a journal it cannot read right now, or a replay that could not
+    // put every file back, D#293) is retired if this swap commits, and left for the next entry if it
+    // rolls back. Nothing here waits on it: a gate on it blocked every later update (a2cf96a1).
+    const leftUnresolved = unresolvedBackups(targetDir);
+    backupDir = join(targetDir, `.update-backup-s${nextSwapSeq(leftUnresolved)}-${ts}`);
 
     mkdirSync(stagingDir, { recursive: true });
     mkdirSync(backupDir, { recursive: true });
@@ -1086,7 +1299,7 @@ export async function installExtractedRelease(sourceDir, targetDir = INSTALL_DIR
         mkdirSync(dirname(targetPath), { recursive: true });
         mkdirSync(dirname(backupPath), { recursive: true });
 
-        if (existsSync(targetPath)) {
+        if (present(targetPath)) {
           backedUp.push(relPath);
           journalSwap(backupDir, backedUp, installed);
           renameSync(targetPath, backupPath);
@@ -1105,14 +1318,14 @@ export async function installExtractedRelease(sourceDir, targetDir = INSTALL_DIR
     // If it can't, restore the backup and report failure — the running (old) version
     // keeps working rather than leaving a broken install with no way back.
     if (!opts.skipSmoke && !smokeInstalledRelease(targetDir)) {
-      rollbackInstall(installed, backedUp, backupDir, targetDir);
-      rmSync(stagingDir, { recursive: true, force: true });
-      rmSync(backupDir, { recursive: true, force: true });
+      discardSwapDirs(stagingDir, backupDir, rollbackInstall(installed, backedUp, backupDir, targetDir));
       return false;
     }
 
-    rmSync(stagingDir, { recursive: true, force: true });
-    rmSync(backupDir, { recursive: true, force: true });
+    // Committed: from here on the catch below must not roll back (D#283).
+    committed = true;
+    retireUnresolvedBackups(targetDir, leftUnresolved);
+    discardSwapDirs(stagingDir, backupDir);
 
     // Post-update migration: reconcile settings.json against the release we just
     // swapped in. `configureHooks()` already strips stale mem entries — but its only
@@ -1198,17 +1411,10 @@ export async function installExtractedRelease(sourceDir, targetDir = INSTALL_DIR
     return true;
   } catch (err) {
     debugCatch(err, 'installExtractedRelease');
-    rollbackInstall(installed, backedUp, backupDir, targetDir);
-    try {
-      rmSync(stagingDir, { recursive: true, force: true });
-    } catch {
-      /* best-effort */
-    }
-    try {
-      rmSync(backupDir, { recursive: true, force: true });
-    } catch {
-      /* best-effort */
-    }
+    // Past the commit point the backups are gone and the new release IS the install: a rollback
+    // would delete the paths it added and restore nothing (D#283).
+    if (committed) return true;
+    discardSwapDirs(stagingDir, backupDir, rollbackInstall(installed, backedUp, backupDir, targetDir));
     return false;
   } finally {
     release();

package/hook.mjs

@@ -2287,10 +2287,12 @@ function scheduleSessionStartAutoMaintain(project) {
 // to minutes (VACUUM INTO snapshot, purge, decay, dedup over the whole DB). It now spares a
 // live holder (A20260905-R5-P1-1), but this escape stays: not being swept is a stronger
 // guarantee than being spared by a pid probe, and pids are meaningless across a shared
-// homedir. proc-lock brings its own staleness policy (age OR provably-dead pid), which is
-// the correct one here.
-// Generous upper bound on one pass; a crashed holder is normally reclaimed sooner via the
-// dead-pid check, so this only matters for a holder killed on another host.
+// homedir. proc-lock brings its own staleness policy (a provably-dead pid at once, a live one
+// only past LIVE_HOLDER_MAX_MS), which is the correct one here.
+// Since D#294 this bound applies only to a lock that records no pid, which acquireLock never
+// writes: a crashed holder is reclaimed through its dead pid, and a pid that looks alive (a
+// recycled one, or one from another host on a shared homedir) holds the lock for
+// LIVE_HOLDER_MAX_MS, 1 h, not 10 min.
 const AUTO_MAINTAIN_LOCK_STALE_MS = 10 * 60 * 1000;
 
 // Detached `auto-maintain` worker entry: opens its own DB and runs the maintenance
@@ -2448,7 +2450,8 @@ function saveHandoffAndFastSummary(
  *
  * Liveness of the two real lock families does not depend on this sweeper, so tightening it
  * cannot wedge either: hook-episode.acquireLock() preempts a >30s episode lock itself at
- * acquire time, and proc-lock.acquireLock() steals on age OR dead pid at 5 min.
+ * acquire time, and proc-lock.acquireLock() steals on a dead pid at once and on age only past
+ * LIVE_HOLDER_MAX_MS (D#294), the same bound as ABANDONED_LOCK_MS here.
  */
 function cleanStaleLockFiles() {
   try {