claude-mem-lite 6.25.1 → 6.25.2

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "6.25.1",
+      "version": "6.25.2",
       "source": "./",
       "homepage": "https://github.com/sdsrss/claude-mem-lite",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.25.1",
+  "version": "6.25.2",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/hook-shared.mjs

@@ -31,6 +31,7 @@ import {
 import { isDbUnusableError, DB_UNUSABLE_MARKER_PREFIX } from './lib/db-unusable.mjs';
 import { shouldRecordOnce } from './lib/record-once.mjs';
 import { backgroundWorkerEnv, workerDirGone } from './lib/worker-data-dir.mjs';
+import { LIVE_HOLDER_MAX_MS } from './lib/proc-lock.mjs';
 import { hookSessionId } from './lib/provenance.mjs';
 import { PROJECT_REKEY_MARKER_PREFIX } from './lib/project-rekey.mjs';
 // Audit 2026-09-05 P1-2 (carried from 2026-09-02 P2-9): `callLLM`, the quiet/adoption
@@ -67,12 +68,13 @@ export const STALE_SESSION_MS = 24 * 60 * 60 * 1000; // 24h
 export const STALE_LOCK_MS = 30000; // 30s
 
 // Backstop for cleanStaleLockFiles(): a lock whose recorded pid is ALIVE is kept until it
-// reaches this age, not STALE_LOCK_MS. Deliberately LONGER than proc-lock.mjs's own 5-min
-// steal window, so the sweeper is never the more aggressive of the two — whatever it
-// removes, the lock protocol itself would already have let the next caller steal. Its only
-// job is to garbage-collect a leaked file whose pid was recycled onto an unrelated live
-// process, which would otherwise pin the file forever. (A20260905-R5-P1-1)
-export const ABANDONED_LOCK_MS = 10 * 60 * 1000; // 10 min
+// reaches this age, not STALE_LOCK_MS. The same bound proc-lock.mjs steals a live holder's lock
+// at, so the sweeper is never the more aggressive of the two — whatever it removes, the lock
+// protocol itself would already have let the next caller steal. Its only job is to
+// garbage-collect a leaked file whose pid was recycled onto an unrelated live process, which
+// would otherwise pin the file forever. (A20260905-R5-P1-1) It was 10 min, shorter than an
+// update holds install.lock while its smoke gate builds the binding from source (D#294).
+export const ABANDONED_LOCK_MS = LIVE_HOLDER_MAX_MS;
 
 // The background-maintenance mutex, defined HERE next to the sweeper policy it has to
 // escape. cleanStaleLockFiles() sweeps every `*.lock` in RUNTIME_DIR; until
@@ -83,7 +85,8 @@ export const ABANDONED_LOCK_MS = 10 * 60 * 1000; // 10 min
 // probe, and pid checks are meaningless across a shared homedir. `tests/auto-maintain-proc-lock.test.mjs`
 // asserts that against THIS constant rather than a re-typed copy: the first version of that
 // test built its own path from a literal, so renaming the lock left it green with the hazard
-// back. proc-lock's own staleness policy (age OR provably-dead pid) is the correct one.
+// back. proc-lock's own staleness policy (a provably-dead pid at once, a live one only past
+// LIVE_HOLDER_MAX_MS) is the correct one.
 export const AUTO_MAINTAIN_LOCK = 'auto-maintain.proclock';
 export const DEDUP_WINDOW_MS = 5 * 60 * 1000; // 5 min (title dedup)
 export const RELATED_OBS_WINDOW_MS = 7 * DAY_MS; // 7 days

package/hook-update.mjs

@@ -954,6 +954,16 @@ function retireUnresolvedBackups(targetDir, names) {
   }
 }
 
+// Backup dirs still unresolved are undone like a stack, newest first (D#293), and their order is
+// carried in the dir NAME, `.update-backup-s<seq>-<ms>-<pid>`: a swap takes one more than the
+// highest seq among the unresolved dirs it finds. Neither the wall clock in the name nor a field in
+// the journal decides it: a clock can go back, and a journal can be unreadable at the moment the
+// order is needed (a scanner holding it on Windows), which made a replay lose a file (review P2-1).
+// A dir named before 6.25.2 has no seq and reads as 0, so it comes last.
+const BACKUP_SEQ_RE = /^\.update-backup-s(\d+)-/;
+const swapSeqOf = (name) => Number(BACKUP_SEQ_RE.exec(name)?.[1] ?? 0);
+const nextSwapSeq = (names) => Math.max(0, ...names.map(swapSeqOf)) + 1;
+
 // The `.update-backup-*` dirs in targetDir that carry no resolved marker.
 function unresolvedBackups(targetDir) {
   try {
@@ -969,8 +979,19 @@ function unresolvedBackups(targetDir) {
 
 // The backup dir is resolved before staging goes: removing a whole staging tree takes long enough
 // for a kill to land in, and a kill there left a committed swap's journal to be replayed.
-function discardSwapDirs(stagingDir, backupDir) {
-  discardBackupDir(backupDir);
+//
+// After a rollback, `notRestored` lists what it could not put back. The backup dir then holds the
+// only copy of each, so it stays whole with its journal, unresolved, and the next entry replays it
+// (D#293). The caller used to delete it. Nothing gates a later update on it: one that commits
+// retires it, so a restore that keeps failing cannot block updates (a2cf96a1's gate did).
+function discardSwapDirs(stagingDir, backupDir, notRestored = []) {
+  if (notRestored.length === 0) discardBackupDir(backupDir);
+  else
+    debugLog(
+      'WARN',
+      'hook-update',
+      `Kept ${backupDir}: could not put back ${notRestored.join(', ')}; the next update, install or cleanup tries again`,
+    );
   try {
     rmSync(stagingDir, { recursive: true, force: true });
   } catch (e) {
@@ -978,6 +999,18 @@ function discardSwapDirs(stagingDir, backupDir) {
   }
 }
 
+// Whether a path is there, by lstat: a symlink counts whatever it points to, and an error other
+// than "no such path" counts as there. existsSync follows the link and answers false on EACCES, so
+// a backup that was a dangling symlink read as already put back, and was deleted (review r2 F11).
+function present(p) {
+  try {
+    lstatSync(p);
+    return true;
+  } catch (e) {
+    return e.code !== 'ENOENT' && e.code !== 'ENOTDIR';
+  }
+}
+
 /**
  * Finish any swap a previous process was killed in the middle of, then clear its
  * residue. Called on every install entry, under the install lock, BEFORE a new
@@ -995,6 +1028,7 @@ export function recoverInterruptedSwaps(targetDir = INSTALL_DIR) {
   }
 
   let recovered = 0;
+  const pending = [];
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
     const dir = join(targetDir, entry.name);
@@ -1017,42 +1051,63 @@ export function recoverInterruptedSwaps(targetDir = INSTALL_DIR) {
       recovered++;
       continue;
     }
+    pending.push(entry.name);
+  }
 
+  // Several dirs are unresolved only when a rollback could not put every file back (D#293), and
+  // they are undone like a stack: newest first by the seq in the name, and none older while a newer
+  // one is unfinished or cannot be read. An older journal replayed first puts back a file that a
+  // newer journal, which installed that path, then deletes; with nothing left to restore it from.
+  pending.sort((a, b) => swapSeqOf(b) - swapSeqOf(a) || b.localeCompare(a));
+  for (const name of pending) {
+    const dir = join(targetDir, name);
     // No journal: the swap is over and its journal is gone (or it was killed before its first
     // rename), so there is nothing to replay and the dir is residue. A journal that is there but
     // cannot be read, or not as one (an in-place write of 6.25.0 or older torn by a kill), says
-    // nothing about what moved, and the dir may hold the only copy of it: leave it. It used to be
-    // read as "nothing moved" and deleted (v6.25.1 review). doctor and cleanup name it; the next
-    // swap that commits, or an install, retires it.
-    let journal = { backedUp: [], installed: [] };
-    let raw = null;
+    // nothing about what moved, and the dir may hold the only copy of it: leave it, and everything
+    // older with it. It used to be read as "nothing moved" and deleted (v6.25.1 review). doctor and
+    // cleanup name it; the next swap that commits, or an install, retires it.
+    let raw;
     try {
       raw = readFileSync(join(dir, SWAP_JOURNAL), 'utf8');
     } catch (e) {
-      if (e.code !== 'ENOENT') {
-        debugCatch(e, 'recover-read-journal');
+      if (e.code === 'ENOENT') {
+        discardBackupDir(dir);
+        recovered++;
         continue;
       }
+      debugCatch(e, 'recover-read-journal');
+      break;
     }
-    if (raw !== null) {
-      try {
-        journal = JSON.parse(raw);
-      } catch {
-        journal = null;
-      }
-      if (!Array.isArray(journal?.backedUp) || !Array.isArray(journal?.installed)) {
-        debugLog('WARN', 'hook-update', `Left ${entry.name} in place: its swap journal cannot be read`);
-        continue;
-      }
+    let journal;
+    try {
+      journal = JSON.parse(raw);
+    } catch {
+      journal = null;
+    }
+    if (!Array.isArray(journal?.backedUp) || !Array.isArray(journal?.installed)) {
+      debugLog(
+        'WARN',
+        'hook-update',
+        `Left ${name} in place, and any older one: its swap journal cannot be read`,
+      );
+      break;
+    }
+    const notRestored = rollbackInstall(journal.installed, journal.backedUp, dir, targetDir);
+    if (notRestored.length > 0) {
+      debugLog(
+        'WARN',
+        'hook-update',
+        `Could not finish ${name}: ${notRestored.join(', ')} not put back; left, with any older one, for the next entry`,
+      );
+      break;
     }
-    const { backedUp, installed } = journal;
-    rollbackInstall(installed, backedUp, dir, targetDir);
     discardBackupDir(dir);
     recovered++;
     debugLog(
       'WARN',
       'hook-update',
-      `Recovered an interrupted update swap: restored ${backedUp.length} path(s) from ${entry.name}`,
+      `Recovered an interrupted update swap: restored ${journal.backedUp.length} path(s) from ${name}`,
     );
   }
   return recovered;
@@ -1069,10 +1124,12 @@ export function recoverInterruptedSwaps(targetDir = INSTALL_DIR) {
 // when the journal cannot be removed, the resolved marker keeps it from being replayed. A backup
 // dir 6.25.0 or older left half deleted beside its journal can still replay to a mix.
 // The arrays are copied, not reversed in place, so a caller's journal is left as it was.
+//
+// Returns the backed-up paths it could not put back, still in the backup dir (D#293).
 function rollbackInstall(installed, backedUp, backupDir, targetDir) {
   markSwapStart();
   try {
-    const restored = new Set(backedUp.filter((relPath) => !existsSync(join(backupDir, relPath))));
+    const restored = new Set(backedUp.filter((relPath) => !present(join(backupDir, relPath))));
     for (const relPath of [...installed].reverse()) {
       if (restored.has(relPath)) continue;
       try {
@@ -1085,7 +1142,7 @@ function rollbackInstall(installed, backedUp, backupDir, targetDir) {
       const backupPath = join(backupDir, relPath);
       const targetPath = join(targetDir, relPath);
       try {
-        if (existsSync(backupPath)) {
+        if (present(backupPath)) {
           mkdirSync(dirname(targetPath), { recursive: true });
           renameSync(backupPath, targetPath);
         }
@@ -1096,6 +1153,7 @@ function rollbackInstall(installed, backedUp, backupDir, targetDir) {
   } finally {
     clearSwapMarker();
   }
+  return backedUp.filter((relPath) => present(join(backupDir, relPath)));
 }
 
 // MED-5 post-install health gate: load-test the freshly-switched code in a SEPARATE
@@ -1194,7 +1252,8 @@ export async function installExtractedRelease(sourceDir, targetDir = INSTALL_DIR
   }
   const ts = `${Date.now()}-${process.pid}`;
   const stagingDir = join(targetDir, `.update-staging-${ts}`);
-  const backupDir = join(targetDir, `.update-backup-${ts}`);
+  // Named once the seq is known, below; until then nothing has been written into it.
+  let backupDir = join(targetDir, `.update-backup-${ts}`);
   const backedUp = [];
   const installed = [];
   let committed = false;
@@ -1207,9 +1266,11 @@ export async function installExtractedRelease(sourceDir, targetDir = INSTALL_DIR
     // one — otherwise this install stacks on top of a mixed-version tree and its
     // own backup can no longer restore a coherent state.
     recoverInterruptedSwaps(targetDir);
-    // What recovery left unfinished (a journal it cannot read right now) is retired if this swap
-    // commits, and left for the next entry if it rolls back.
+    // What recovery left unfinished (a journal it cannot read right now, or a replay that could not
+    // put every file back, D#293) is retired if this swap commits, and left for the next entry if it
+    // rolls back. Nothing here waits on it: a gate on it blocked every later update (a2cf96a1).
     const leftUnresolved = unresolvedBackups(targetDir);
+    backupDir = join(targetDir, `.update-backup-s${nextSwapSeq(leftUnresolved)}-${ts}`);
 
     mkdirSync(stagingDir, { recursive: true });
     mkdirSync(backupDir, { recursive: true });
@@ -1238,7 +1299,7 @@ export async function installExtractedRelease(sourceDir, targetDir = INSTALL_DIR
         mkdirSync(dirname(targetPath), { recursive: true });
         mkdirSync(dirname(backupPath), { recursive: true });
 
-        if (existsSync(targetPath)) {
+        if (present(targetPath)) {
           backedUp.push(relPath);
           journalSwap(backupDir, backedUp, installed);
           renameSync(targetPath, backupPath);
@@ -1257,8 +1318,7 @@ export async function installExtractedRelease(sourceDir, targetDir = INSTALL_DIR
     // If it can't, restore the backup and report failure — the running (old) version
     // keeps working rather than leaving a broken install with no way back.
     if (!opts.skipSmoke && !smokeInstalledRelease(targetDir)) {
-      rollbackInstall(installed, backedUp, backupDir, targetDir);
-      discardSwapDirs(stagingDir, backupDir);
+      discardSwapDirs(stagingDir, backupDir, rollbackInstall(installed, backedUp, backupDir, targetDir));
       return false;
     }
 
@@ -1354,8 +1414,7 @@ export async function installExtractedRelease(sourceDir, targetDir = INSTALL_DIR
     // Past the commit point the backups are gone and the new release IS the install: a rollback
     // would delete the paths it added and restore nothing (D#283).
     if (committed) return true;
-    rollbackInstall(installed, backedUp, backupDir, targetDir);
-    discardSwapDirs(stagingDir, backupDir);
+    discardSwapDirs(stagingDir, backupDir, rollbackInstall(installed, backedUp, backupDir, targetDir));
     return false;
   } finally {
     release();

package/hook.mjs

@@ -2287,10 +2287,12 @@ function scheduleSessionStartAutoMaintain(project) {
 // to minutes (VACUUM INTO snapshot, purge, decay, dedup over the whole DB). It now spares a
 // live holder (A20260905-R5-P1-1), but this escape stays: not being swept is a stronger
 // guarantee than being spared by a pid probe, and pids are meaningless across a shared
-// homedir. proc-lock brings its own staleness policy (age OR provably-dead pid), which is
-// the correct one here.
-// Generous upper bound on one pass; a crashed holder is normally reclaimed sooner via the
-// dead-pid check, so this only matters for a holder killed on another host.
+// homedir. proc-lock brings its own staleness policy (a provably-dead pid at once, a live one
+// only past LIVE_HOLDER_MAX_MS), which is the correct one here.
+// Since D#294 this bound applies only to a lock that records no pid, which acquireLock never
+// writes: a crashed holder is reclaimed through its dead pid, and a pid that looks alive (a
+// recycled one, or one from another host on a shared homedir) holds the lock for
+// LIVE_HOLDER_MAX_MS, 1 h, not 10 min.
 const AUTO_MAINTAIN_LOCK_STALE_MS = 10 * 60 * 1000;
 
 // Detached `auto-maintain` worker entry: opens its own DB and runs the maintenance
@@ -2448,7 +2450,8 @@ function saveHandoffAndFastSummary(
  *
  * Liveness of the two real lock families does not depend on this sweeper, so tightening it
  * cannot wedge either: hook-episode.acquireLock() preempts a >30s episode lock itself at
- * acquire time, and proc-lock.acquireLock() steals on age OR dead pid at 5 min.
+ * acquire time, and proc-lock.acquireLock() steals on a dead pid at once and on age only past
+ * LIVE_HOLDER_MAX_MS (D#294), the same bound as ABANDONED_LOCK_MS here.
  */
 function cleanStaleLockFiles() {
   try {

package/install.mjs

@@ -16,7 +16,6 @@ import {
   readdirSync,
   statSync,
   lstatSync,
-  accessSync,
   constants as fsConstants,
 } from 'fs';
 import { join, resolve, dirname, basename, sep } from 'path';
@@ -98,9 +97,10 @@ import {
 import { detectInstallShape, probeRuntimeRoots, hasAnyManagedCode } from './lib/install-shape.mjs';
 import { probeSchemaCompat, schemaSkewRemedy } from './lib/schema-skew.mjs';
 import { clearNativeBindingBreakage, readNativeBindingBreakage } from './lib/native-binding-hint.mjs';
-import { acquireLock } from './lib/proc-lock.mjs';
+import { acquireLock, lockHeld } from './lib/proc-lock.mjs';
 import { atomicWriteFileSync, atomicCopyFileSync } from './lib/atomic-write.mjs';
 import { shellWord } from './cli-path.mjs';
+import { dirAccessError, walOpenBlocked, dataDirRemedy, WAL_BLOCKED_WHY } from './lib/wal-open-blocked.mjs';
 import {
   claudeConfigDir,
   claudeConfigDirFor,
@@ -1328,8 +1328,10 @@ function listUpdateResidue() {
  * tree is written, or for a later entry that can replay it).
  * @param {{f: string, kind: string}[]} found entries from listUpdateResidue
  * @returns {Promise<{finished: string[], removed: string[], kept: string[], deferred: string[],
- *   left: string[]}>} kept: left on purpose because its journal cannot be read; deferred: an
- *   unfinished swap left because hook-update could not load; left: anything else still there
+ *   unfinished: string[], left: string[]}>} kept: left on purpose because its journal cannot be
+ *   read; deferred: an unfinished swap left because hook-update could not load; unfinished: one the
+ *   replay did not finish, because a file could not be put back from it, or a later one that must be
+ *   finished first could not be finished or read (D#293); left: anything else
  */
 async function recoverUpdateResidue(found) {
   let replayed = true;
@@ -1350,11 +1352,13 @@ async function recoverUpdateResidue(found) {
       /* reported below as left */
     }
   }
-  const out = { finished: [], removed: [], kept: [], deferred: [], left: [] };
+  const out = { finished: [], removed: [], kept: [], deferred: [], unfinished: [], left: [] };
   for (const { f, kind } of found) {
     if (!pathPresent(join(INSTALL_DIR, f))) (kind === 'unfinished-swap' ? out.finished : out.removed).push(f);
     else if (kind === 'unreadable-journal') out.kept.push(f);
     else if (kind === 'unfinished-swap' && !replayed) out.deferred.push(f);
+    else if (kind === 'unfinished-swap' && classifyUpdateResidue(INSTALL_DIR, f) === 'unfinished-swap')
+      out.unfinished.push(f);
     else out.left.push(f);
   }
   return out;
@@ -1375,7 +1379,11 @@ async function finishInterruptedSwaps() {
   const r = await recoverUpdateResidue(found);
   if (r.finished.length > 0)
     ok(`Finished ${r.finished.length} interrupted update(s) before installing: ${r.finished.join(', ')}`);
-  // A swap left unfinished here (deferred, kept) is retired once the tree is written.
+  // A swap left unfinished here (deferred, kept, unfinished) is retired once the tree is written.
+  for (const f of r.unfinished)
+    warn(
+      `Could not finish the interrupted update ${f}: a file it moved aside could not be put back, or a later one that must be finished first could not be. This install writes over it and then retires it.`,
+    );
   for (const f of r.left) warn(`Could not remove ${f} from ${INSTALL_DIR}`);
 }
 
@@ -1896,10 +1904,12 @@ async function status() {
       // SQLite creates beside the DB: in a directory it cannot write, a closed store cannot be opened
       // in place (a copy elsewhere could be read) — 6.24.0 could not open it either. Say so rather than relay "attempt to write a readonly database".
       // The errno stands in for SQLite's message only where the directory is the cause.
-      const walBlocked = dataDirDenied && e.code === 'SQLITE_READONLY_DIRECTORY';
+      const walBlocked = walOpenBlocked(e.code, dataDirDenied, DB_PATH);
       const why = walBlocked
-        ? 'exists, but SQLite cannot open a WAL database without creating its -wal/-shm files beside it'
-        : 'exists but check failed — ' + e.message;
+        ? `exists, but ${WAL_BLOCKED_WHY}`
+        : bindingMissing(e)
+          ? `exists, but not checked — ${BINDING_MISSING_WHY}`
+          : 'exists but check failed — ' + e.message;
       push(dataDirDenied ? 'fail' : 'warn', 'database', `Database: ${why}${unwritable}`, {
         exists: true,
         error: walBlocked ? dataDirDenied : e.message,
@@ -2138,10 +2148,10 @@ async function doctor() {
   // create the -wal/-shm files beside it, so every check that opens the DB fails, for the fault the
   // Data directory line names and counts. Those checks say they did not look, in the words status
   // uses (D#287, the D#199 shape). Keyed on SQLite's code: its message is shared with other faults.
-  const walBlocked = (code) => Boolean(dataDirDenied) && code === 'SQLITE_READONLY_DIRECTORY';
+  const walBlocked = (code) => walOpenBlocked(code, dataDirDenied, DB_PATH);
   const notCheckedWal = (what, scope = '') =>
     dwarn(
-      `${what}: not checked${scope} — SQLite cannot open a WAL database without creating its -wal/-shm files beside it, and ${MEM_DATA_DIR} cannot be written (see Data directory above)`,
+      `${what}: not checked${scope} — ${WAL_BLOCKED_WHY}, and ${MEM_DATA_DIR} cannot be written (see Data directory above)`,
     );
   // The code dir is the data dir in the default shape; under CLAUDE_MEM_DIR it is checked apart.
   const codeIsDataDir = sameDir(INSTALL_DIR, MEM_DATA_DIR);
@@ -2501,9 +2511,17 @@ async function doctor() {
   // with require-error noise every session. README's Uninstall section warns
   // about the right ordering; this check flags the broken state so it surfaces
   // even when the user skipped the README.
-  const orphanPaths = settings === null ? null : collectOrphanHookPaths(settings);
+  const unreadableHookPaths = [];
+  const orphanPaths =
+    settings === null ? null : collectOrphanHookPaths(settings, INSTALL_DIR, unreadableHookPaths);
   if (orphanPaths === null) {
     dwarn('Orphan hooks: not checked (settings.json unreadable)');
+  } else if (orphanPaths.length === 0 && unreadableHookPaths.length > 0) {
+    // A hook that points into a code home this user cannot enter is not an orphan: the file may
+    // well be there, and the Entry points line names and counts the locked dir (D#297).
+    dwarn(
+      `Orphan hooks: not checked — ${unreadableHookPaths.length} hook target(s) cannot be read (${unreadableHookPaths[0]}${unreadableHookPaths.length > 1 ? ', …' : ''})`,
+    );
   } else if (orphanPaths.length > 0) {
     fail(
       `Orphan hooks: ${orphanPaths.length} settings.json entr${orphanPaths.length === 1 ? 'y references a missing file' : 'ies reference missing files'}`,
@@ -2643,6 +2661,8 @@ async function doctor() {
     } catch (e) {
       if (walBlocked(e.code)) {
         notCheckedWal('Database');
+      } else if (bindingMissing(e)) {
+        dwarn(`Database: not checked — ${BINDING_MISSING_WHY}`);
       } else {
         fail('Database: ' + e.message);
         // Every other ✗ on this screen carries a remedy; this one used to be the exception,
@@ -3004,21 +3024,22 @@ async function doctor() {
   // file. Counting is all that differs here; the classification is shared, so "what doctor
   // calls stale" and "what cleanup removes" agree on the age gate and on the directory, the
   // axes they diverged on (the third time, D#289: both looked for update residue in the data
-  // dir, which CLAUDE_MEM_DIR moves away from the code dir it lives in). Not on every axis:
-  // cleanup skips update residue entirely while install.lock is held and the scanner has no
-  // such gate, so mid-self-update doctor still counts what cleanup will decline. That one is
-  // milder than D#53 — cleanup SAYS it is skipping — and the unfinished-update line says a
-  // running update looks the same.
+  // dir, which CLAUDE_MEM_DIR moves away from the code dir it lives in). And on the lock: while
+  // install.lock is held, cleanup skips update residue (a running update's own staging and backup
+  // dirs among it), so doctor does not count it either, and says it did not look (D#297). The holder
+  // may be any installer: an update, install, repair, a binding rebuild. It asks without taking it.
   try {
+    const lockHeldNow = lockHeld(join(MEM_DATA_DIR, 'runtime', 'install.lock')); // runtime-dir:stays-put — install lock serialises real installers
     const { stale, inFlight, unfinishedSwaps, unreadableJournals, notChecked } = scanStaleTempFiles({
       codeDir: INSTALL_DIR,
       runtimeDir: MEM_RUNTIME_DIR,
       legacyDir: codeIsDataDir ? undefined : MEM_DATA_DIR,
+      installLockHeld: lockHeldNow,
     });
     const installer = `node ${shellWord(join(PROJECT_DIR, 'install.mjs'))}`;
     if (unfinishedSwaps > 0) {
       dwarn(
-        `Unfinished update: ${unfinishedSwaps} backup dir(s) in ${INSTALL_DIR} still hold a swap journal — an update was interrupted, or is running right now (run: ${installer} cleanup — it finishes an interrupted one, and skips while an update holds install.lock)`,
+        `Unfinished update: ${unfinishedSwaps} backup dir(s) in ${INSTALL_DIR} still hold a swap journal — an update was interrupted, or could not put back every file it moved aside (run: ${installer} cleanup — it finishes them newest first, and stops at one it cannot read or put back)`,
       );
     }
     if (unreadableJournals > 0) {
@@ -3026,14 +3047,20 @@ async function doctor() {
         `Unfinished update: ${unreadableJournals} backup dir(s) in ${INSTALL_DIR} whose journal cannot be read, so nothing can finish that update; they hold the files it moved aside (run: ${installer} repair — it reinstalls over them; cleanup then removes them)`,
       );
     }
+    const skipped = lockHeldNow
+      ? `update residue not checked — install.lock is held (by a running install, update, repair or binding rebuild, or as a lock file this user cannot read), and cleanup skips it too`
+      : '';
     if (notChecked.length > 0) {
       const where = notChecked.map((n) => `${n.dir} is not accessible (${n.code})`).join('; ');
       dwarn(
         `Stale temp files: not checked — ${where}` +
-          (stale > 0 ? `; ${stale} found elsewhere (run: ${installer} cleanup)` : ''),
+          (stale > 0 ? `; ${stale} found elsewhere (run: ${installer} cleanup)` : '') +
+          (skipped ? `; ${skipped}` : ''),
       );
     } else if (stale > 0) {
-      dwarn(`Stale temp files: ${stale} found (run: ${installer} cleanup)`);
+      dwarn(`Stale temp files: ${stale} found (run: ${installer} cleanup)${skipped ? `; ${skipped}` : ''}`);
+    } else if (skipped) {
+      dwarn(`Stale temp files: ${skipped}`);
     } else {
       ok('Stale temp files: none');
     }
@@ -3076,6 +3103,7 @@ async function doctor() {
       else ok(stats);
     } catch (e) {
       if (walBlocked(e.code)) notCheckedWal('DB stats');
+      else if (bindingMissing(e)) dwarn(`DB stats: not checked — ${BINDING_MISSING_WHY}`);
       else dwarn('DB stats: ' + e.message);
     }
   }
@@ -3201,9 +3229,31 @@ function looksLikeHookPath(p) {
   return HOOK_PATH_EXTS.some((ext) => p.endsWith(ext));
 }
 
-export function collectOrphanHookPaths(settings, installDir = INSTALL_DIR) {
+// 'missing' when the path is not there, 'unreadable' when it cannot be looked at (a directory on the
+// way this user cannot enter). existsSync answers false to both, so hooks pointing into a locked code
+// home were orphans, a second ✗ beside the Entry points line that names the lock (D#297).
+function hookTargetState(p) {
+  try {
+    statSync(p);
+    return 'present';
+  } catch (e) {
+    return e.code === 'ENOENT' || e.code === 'ENOTDIR' ? 'missing' : 'unreadable';
+  }
+}
+
+/**
+ * @param {string[]|null} [unreadable] collects the targets that could not be looked at, which are
+ *   not returned as missing
+ */
+export function collectOrphanHookPaths(settings, installDir = INSTALL_DIR, unreadable = null) {
   if (!settings?.hooks) return [];
   const out = [];
+  const judge = (p) => {
+    if (out.includes(p) || unreadable?.includes(p)) return;
+    const state = hookTargetState(p);
+    if (state === 'missing') out.push(p);
+    else if (state === 'unreadable') unreadable?.push(p);
+  };
   for (const configs of Object.values(settings.hooks)) {
     if (!Array.isArray(configs)) continue;
     for (const cfg of configs) {
@@ -3220,7 +3270,7 @@ export function collectOrphanHookPaths(settings, installDir = INSTALL_DIR) {
         // ERR_MODULE_NOT_FOUND — and doctor went back to printing "Orphan hooks: none".
         // Both files have to exist for the hook to run, so both are reportable.
         const entry = launcherEntryPath(cmd, installDir);
-        if (entry && !existsSync(entry) && !out.includes(entry)) out.push(entry);
+        if (entry) judge(entry);
         // v2.80: scan ALL quoted tokens (was: only the first), prefer ones
         // that look like a hook path. Fixes a footgun where a wrapper command
         // like `bash -c "some inline" "/real/path.sh"` would pick "some inline"
@@ -3239,7 +3289,7 @@ export function collectOrphanHookPaths(settings, installDir = INSTALL_DIR) {
           path = parts.find((p) => looksLikeHookPath(p)) || null;
         }
         if (!path) continue;
-        if (!existsSync(path) && !out.includes(path)) out.push(path);
+        judge(path);
       }
     }
   }
@@ -3452,7 +3502,10 @@ async function cleanup() {
   // and doctor tells the user to run cleanup. Non-blocking: if an installer holds the lock we skip
   // only the update residue, not the rest of cleanup.
   let finished = 0;
-  const updateLock = acquireLock(join(MEM_DATA_DIR, 'runtime', 'install.lock')); // runtime-dir:stays-put — install lock serialises real installers
+  // --dry-run writes nothing, so it asks whether the lock is held instead of taking it: taking it
+  // created the data dir, its runtime dir and the lock on a machine with nothing installed (D#297).
+  const lockPath = join(MEM_DATA_DIR, 'runtime', 'install.lock'); // runtime-dir:stays-put — install lock serialises real installers
+  const updateLock = dryRun ? (lockHeld(lockPath) ? null : () => {}) : acquireLock(lockPath);
   if (!updateLock) {
     warn('Update residue skipped: install in progress (install.lock held)');
   } else {
@@ -3484,6 +3537,10 @@ async function cleanup() {
           warn(
             `Left in place: ${f} — its journal cannot be read, so nothing can finish that update, and it holds the files the update moved aside. repair reinstalls over it; cleanup removes it after that.`,
           );
+        for (const f of r.unfinished)
+          warn(
+            `Could not finish the interrupted update ${f}: a file it moved aside could not be put back (held open, or in a directory that cannot be emptied), or a later one that must be finished first could not be. It stays in place holding what it moved aside; cleanup tries again, and repair reinstalls over it instead.`,
+          );
         for (const f of r.left) warn(`Failed to remove ${f}`);
         finished += r.finished.length;
         removed += r.removed.length;
@@ -3936,12 +3993,7 @@ function dataDirAccessError(
   dir = MEM_DATA_DIR,
   mode = fsConstants.R_OK | fsConstants.W_OK | fsConstants.X_OK,
 ) {
-  try {
-    accessSync(dir, mode);
-    return null;
-  } catch (e) {
-    return e.code === 'ENOENT' ? null : e.code || 'EACCES';
-  }
+  return dirAccessError(dir, mode);
 }
 
 // Same directory however it is spelled (a trailing slash, a symlinked HOME). stat works on a
@@ -3956,13 +4008,16 @@ function sameDir(a, b) {
   }
 }
 
-// The fix for a data dir this user cannot use, chosen by the error code. EROFS is the file system,
-// not the mode bits: accessSync(W_OK) on a read-only mount fails with it, and chmod cannot help
-// there (D#287).
-export const dataDirAccessRemedy = (code) =>
-  code === 'EROFS'
-    ? `the file system holding ${shellWord(MEM_DATA_DIR)} is mounted read-only — remount it read-write`
-    : `chmod u+rwx ${shellWord(MEM_DATA_DIR)} (or chown it back to your user if a sudo run created it)`;
+// The fix for a data dir this user cannot use, chosen by the error code (lib/wal-open-blocked.mjs).
+export const dataDirAccessRemedy = (code) => dataDirRemedy(code, MEM_DATA_DIR);
+
+// This process cannot load better-sqlite3: none installed where it runs (a checkout, or a plugin
+// cache before its first launch installed node_modules), or one that will not load (a stale ABI, a
+// damaged prebuild). The better-sqlite3 line names and counts that; a line that would open the DB
+// says it did not look, rather than count the same fault again (D#297, pre-ship review P3-4).
+const bindingMissing = (e) =>
+  (e?.code === 'ERR_MODULE_NOT_FOUND' && /'better-sqlite3'/.test(e.message)) || isNativeBindingError(e);
+const BINDING_MISSING_WHY = `better-sqlite3 cannot be loaded from ${PROJECT_DIR}`;
 
 async function runLockedInstall() {
   const denied = dataDirAccessError();

package/lib/doctor-stale-temp.mjs

@@ -64,8 +64,9 @@ export const isEpisodeResidue = (name) => EPISODE_RESIDUE_PREFIXES.some((p) => n
  * is residue. A dir from 6.25.0 or older carries no marker; one whose journal survived a finished
  * swap there still reads as unfinished.
  *
- * A swap running right now looks the same as one that was killed; cleanup tells them apart by
- * install.lock, doctor cannot, and says so.
+ * A swap running right now looks the same as one that was killed, and nothing tells them apart:
+ * while install.lock is held, cleanup and doctor both leave all update residue alone (doctor asks
+ * without taking the lock, through `installLockHeld` below).
  *
  * 'unreadable-journal' is an unresolved backup dir whose journal is there but cannot be read now,
  * or not as one (a write of 6.25.0 or older torn by a kill). Recovery cannot replay it and it may
@@ -164,22 +165,31 @@ export function classifyEpisodeFile(
  *
  * `stale` is the number doctor may recommend cleanup for; `inFlight` is reported as a
  * detail rather than a warning, because a file that is supposed to exist right now is not
- * a fault. Note the asymmetry, which is deliberate and is NOT the age gate being applied
- * inconsistently: update residue is guarded by install.lock in cleanup, not by age, so
- * there is no age gate here for it to mirror. `unfinishedSwaps` are backup dirs with a readable
+ * a fault. Update residue has no age gate: cleanup guards it by install.lock, and so does this
+ * count, through `installLockHeld`. `unfinishedSwaps` are backup dirs with a readable
  * journal and no resolved marker: cleanup finishes those swaps rather than removing them, and
  * `unreadableJournals` it leaves (classifyUpdateResidue).
  *
- * @param {{codeDir: string, runtimeDir: string, legacyDir?: string, now?: number, episodeAgeMs?: number}} args
+ * @param {{codeDir: string, runtimeDir: string, legacyDir?: string, installLockHeld?: boolean,
+ *   now?: number, episodeAgeMs?: number}} args
  *   codeDir is where update residue lives; runtimeDir is where episode files live. legacyDir is a
  *   data dir CLAUDE_MEM_DIR keeps apart from the code dir: update residue there was left by an
  *   updater older than v2.90.0, which swapped into it, so all of it is stale and none of it is
- *   replayed. (It holds no journal either: journals came in v3.57.0.)
+ *   replayed. (It holds no journal either: journals came in v3.57.0.) installLockHeld: some
+ *   installer holds install.lock, so update residue is not counted at all, as cleanup skips it
+ *   (D#297).
  * @returns {{stale: number, inFlight: number, unfinishedSwaps: number, unreadableJournals: number,
  *   notChecked: Array<{dir: string, code: string}>}} A directory that exists but cannot be listed
  *   goes in notChecked, never counted as empty, and the others are still counted.
  */
-export function scanStaleTempFiles({ codeDir, runtimeDir, legacyDir, now = Date.now(), episodeAgeMs }) {
+export function scanStaleTempFiles({
+  codeDir,
+  runtimeDir,
+  legacyDir,
+  installLockHeld = false,
+  now = Date.now(),
+  episodeAgeMs,
+}) {
   let stale = 0;
   let inFlight = 0;
   let unfinishedSwaps = 0;
@@ -194,13 +204,13 @@ export function scanStaleTempFiles({ codeDir, runtimeDir, legacyDir, now = Date.
     }
   };
 
-  for (const f of list(codeDir)) {
+  for (const f of installLockHeld ? [] : list(codeDir)) {
     const kind = classifyUpdateResidue(codeDir, f);
     if (kind === 'unfinished-swap') unfinishedSwaps++;
     else if (kind === 'unreadable-journal') unreadableJournals++;
     else if (kind === 'stale') stale++;
   }
-  if (legacyDir) {
+  if (legacyDir && !installLockHeld) {
     for (const f of list(legacyDir)) if (isUpdateResidue(f)) stale++;
   }
 

package/lib/proc-lock.mjs

@@ -10,21 +10,30 @@
 // a real cross-process gate.
 //
 // Semantics: acquireLock() atomically creates the lock file with O_EXCL. If it
-// already exists it is stolen only when STALE (holder's timestamp older than
-// staleMs, or the recorded pid is provably dead on this host). A live holder →
-// acquire returns null and the caller no-ops (someone else is already doing the
-// write). Release unlinks the file. Crash-safe: a crashed holder's lock ages
-// out via staleMs so the next session reclaims it.
+// already exists it is stolen only when STALE: the recorded pid is provably dead on
+// this host, or the lock is older than LIVE_HOLDER_MAX_MS (staleMs when it records no
+// pid). A live holder → acquire returns null and the caller no-ops (someone else is
+// already doing the write). Release unlinks the file. Crash-safe: a crashed holder's
+// pid is gone, so the next session reclaims its lock at once.
 
-import { writeFileSync, readFileSync, unlinkSync, mkdirSync, renameSync, linkSync } from 'node:fs';
+import { writeFileSync, readFileSync, unlinkSync, mkdirSync, renameSync, linkSync, lstatSync } from 'node:fs';
 import { dirname } from 'node:path';
 import { workerDirGone } from './worker-data-dir.mjs';
 
-// 5 min: comfortably longer than any install/update write phase (npm install in
-// staging is timeout-capped at 60s) but short enough that a crashed holder does
-// not block self-heal for long.
+// The age bound for a lock whose holder cannot be checked: it records no pid. A holder that
+// records one is reclaimed at once when the pid is gone, and otherwise waits for
+// LIVE_HOLDER_MAX_MS below.
 const DEFAULT_STALE_MS = 5 * 60 * 1000;
 
+// Age past which a lock whose recorded pid is ALIVE is reclaimed anyway: by then that pid is
+// taken to be recycled onto an unrelated process, or to belong to another host on a shared
+// homedir. It is not a bound on the critical section, which has none: an update holds
+// install.lock through npm install and a smoke gate that can rebuild the binding twice and from
+// source (about 12 min in all), and a direct `install` runs npm with no timeout. staleMs used to
+// apply to a live holder too, so the next entry took the lock after 5 min and replayed the
+// running swap's journal (D#294). hook.mjs's lock sweeper spares a live holder for the same span.
+export const LIVE_HOLDER_MAX_MS = 60 * 60 * 1000;
+
 function pidAlive(pid) {
   if (typeof pid !== 'number' || pid <= 0) return false;
   try {
@@ -40,11 +49,12 @@ function pidAlive(pid) {
 function isStale(lockPath, staleMs, now) {
   try {
     const { pid, ts } = JSON.parse(readFileSync(lockPath, 'utf8'));
-    if (typeof ts === 'number' && now() - ts > staleMs) return true;
-    // Same-host fast reclaim: holder pid is gone. Cross-host (shared homedir)
-    // the pid is meaningless, but ts-staleness above still reclaims it.
-    if (typeof pid === 'number' && !pidAlive(pid)) return true;
-    return false;
+    const aged = (bound) => typeof ts === 'number' && now() - ts > bound;
+    if (typeof pid !== 'number') return aged(staleMs);
+    // Same-host fast reclaim: holder pid is gone. Cross-host (shared homedir) the pid is
+    // meaningless, and a live-looking one is reclaimed by age below.
+    if (!pidAlive(pid)) return true;
+    return aged(Math.max(staleMs, LIVE_HOLDER_MAX_MS));
   } catch {
     return true; // unparseable / unreadable lock → treat as stale and reclaim
   }
@@ -115,7 +125,8 @@ function makeRelease(lockPath, payload) {
  * Try to acquire an advisory lock. Non-blocking.
  * @param {string} lockPath  Absolute path to the lock file.
  * @param {object} [opts]
- * @param {number} [opts.staleMs]  Age after which a held lock is stolen.
+ * @param {number} [opts.staleMs]  Age after which a lock that records no pid is stolen. A live pid
+ *   holds it until LIVE_HOLDER_MAX_MS, or staleMs if that is longer.
  * @param {() => number} [opts.now]  Clock injection seam (tests).
  * @returns {(() => void)|null}  A release() fn, or null if a live peer holds it, the lock file
  *   could not be created, or this is a background worker whose lock directory was removed.
@@ -201,6 +212,29 @@ export function acquireLock(lockPath, { staleMs = DEFAULT_STALE_MS, now = Date.n
   }
 }
 
+/**
+ * Whether acquireLock would refuse `lockPath` now because a peer holds it. Read-only: it creates
+ * nothing, so a command that must not write (`cleanup --dry-run`) or only reports (`doctor`) can
+ * ask without taking the lock (D#297). A lock file that is there but cannot be read is held:
+ * acquireLock cannot steal what it cannot read, so it refuses (pre-ship review P3-1). One whose
+ * directory cannot be looked into is not known to be held by anyone; the caller names that
+ * directory on its own.
+ * @returns {boolean}
+ */
+export function lockHeld(lockPath, { staleMs = DEFAULT_STALE_MS, now = Date.now } = {}) {
+  try {
+    lstatSync(lockPath);
+  } catch {
+    return false;
+  }
+  try {
+    readFileSync(lockPath);
+  } catch (e) {
+    return e.code !== 'ENOENT'; // released between the two calls: acquireLock would take it
+  }
+  return !isStale(lockPath, staleMs, now);
+}
+
 /**
  * Run `fn` while holding the lock; release in a finally. No-op if not acquired.
  * @returns {{acquired: boolean, result?: any}}

package/lib/wal-open-blocked.mjs

@@ -0,0 +1,69 @@
+// lib/wal-open-blocked.mjs — a closed WAL store in a data dir this user cannot write (D#287, D#296).
+//
+// The store is WAL (schema.mjs), and even a read-only open has to create the -wal and -shm files
+// beside the DB. In a directory SQLite cannot write, a store that was closed cleanly (so those
+// files are gone) cannot be opened in place, and SQLite answers "attempt to write a readonly
+// database", a message it uses for other faults too. doctor, status and every command that opens
+// the DB through mem-cli say instead what is wrong and how to fix it, keyed on SQLite's code and the
+// directory's own access error, never on the message.
+//
+// A leaf (node:fs and cli-path.mjs): mem-cli opens the DB on every command and must not load
+// install.mjs to word one error.
+import { accessSync, lstatSync, constants as fsConstants } from 'node:fs';
+import { shellWord } from '../cli-path.mjs';
+
+export const WAL_BLOCKED_WHY =
+  'SQLite cannot open a WAL database without creating its -wal/-shm files beside it';
+
+/**
+ * The access error code for `dir` under `mode` (read, write and search by default), or null when
+ * it is usable or absent.
+ */
+export function dirAccessError(dir, mode = fsConstants.R_OK | fsConstants.W_OK | fsConstants.X_OK) {
+  try {
+    accessSync(dir, mode);
+    return null;
+  } catch (e) {
+    return e.code === 'ENOENT' ? null : e.code || 'EACCES';
+  }
+}
+
+/**
+ * Whether an open of `dbPath` that failed with SQLite error `code` is that store, given its dir's
+ * access error. A dir the user cannot write (EACCES) gives SQLITE_READONLY_DIRECTORY. A read-only
+ * mount (EROFS) gives SQLITE_CANTOPEN "unable to open database file" instead, when the -shm file is
+ * missing and SQLite cannot create it (D#295, measured on a kernel read-only mount: a cleanly
+ * closed store, and one with a -wal but no -shm; with both files there it opens and reads).
+ * CANTOPEN has other causes, a missing database among them, so it counts only on a read-only
+ * mount, with the database there and no -shm beside it.
+ */
+export function walOpenBlocked(code, dirDenied, dbPath) {
+  if (!dirDenied) return false;
+  if (code === 'SQLITE_READONLY_DIRECTORY') return true;
+  return (
+    code === 'SQLITE_CANTOPEN' &&
+    dirDenied === 'EROFS' &&
+    Boolean(dbPath) &&
+    pathPresent(dbPath) &&
+    !pathPresent(`${dbPath}-shm`)
+  );
+}
+
+function pathPresent(p) {
+  try {
+    lstatSync(p);
+    return true;
+  } catch (e) {
+    return e.code !== 'ENOENT';
+  }
+}
+
+/**
+ * The fix for a data dir this user cannot use, chosen by its access error. EROFS is the file
+ * system, not the mode bits: accessSync(W_OK) on a read-only mount fails with it, and chmod cannot
+ * help there (D#287).
+ */
+export const dataDirRemedy = (code, dir) =>
+  code === 'EROFS'
+    ? `the file system holding ${shellWord(dir)} is mounted read-only — remount it read-write`
+    : `chmod u+rwx ${shellWord(dir)} (or chown it back to your user if a sudo run created it)`;

package/mem-cli.mjs

@@ -3,6 +3,7 @@
 // No MCP SDK or heavy deps — only imports schema.mjs and utils.mjs
 
 import { ensureDbWithWalRecovery, refreshPlannerStats, DB_PATH, DB_DIR, CODE_DIR } from './schema.mjs';
+import { dirAccessError, walOpenBlocked, dataDirRemedy, WAL_BLOCKED_WHY } from './lib/wal-open-blocked.mjs';
 import { resolveRuntimeDir } from './lib/resolve-data-dir.mjs';
 import { isFtsCorruptionError, FTS_CORRUPTION_REMEDY } from './lib/db-unusable.mjs';
 import {
@@ -3877,6 +3878,21 @@ async function runDispatch(argv) {
       process.exitCode = 1;
       return;
     }
+    // A closed WAL store in a data dir this user cannot write: name the cause and its fix rather
+    // than relay "attempt to write a readonly database", or "unable to open database file" on a
+    // read-only mount (D#296, D#295; doctor and status say the same).
+    const dirDenied = /^SQLITE_(READONLY_DIRECTORY|CANTOPEN)$/.test(e.code ?? '')
+      ? dirAccessError(DB_DIR)
+      : null;
+    if (walOpenBlocked(e.code, dirDenied, DB_PATH)) {
+      out(
+        `[mem] Error: Cannot open database: ${WAL_BLOCKED_WHY}, and ${DB_DIR} cannot be written (${dirDenied})`,
+      );
+      out(`[mem] Fix: ${dataDirRemedy(dirDenied, DB_DIR)}`);
+      out(`[mem] DB path: ${DB_PATH}`);
+      process.exitCode = 1;
+      return;
+    }
     out(`[mem] Error: Cannot open database: ${e.message}`);
     out(`[mem] DB path: ${DB_PATH}`);
     process.exitCode = 1;

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.25.1",
+  "version": "6.25.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "claude-mem-lite",
-      "version": "6.25.1",
+      "version": "6.25.2",
       "os": [
         "darwin",
         "linux",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.25.1",
+  "version": "6.25.2",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",
@@ -67,6 +67,7 @@
     "adopt-cli.mjs",
     "haiku-client.mjs",
     "lib/activity.mjs",
+    "lib/wal-open-blocked.mjs",
     "lib/bash-file-targets.mjs",
     "lib/cli-flags.mjs",
     "lib/git-state.mjs",

package/source-files.mjs

@@ -162,6 +162,9 @@ export const SOURCE_FILES = [
   // + auto-update lock). Must ship or a partial install/update skips them.
   'lib/proc-lock.mjs',
   'lib/atomic-write.mjs',
+  // A closed WAL store in an unwritable data dir: one classification for doctor, status and
+  // mem-cli's DB open (D#296), so the CLI does not load install.mjs to word one error.
+  'lib/wal-open-blocked.mjs',
   // Dynamically imported by scripts/launch.mjs BEFORE `npm install` runs, to answer
   // EBADPLATFORM with both sides of the mismatch instead of a guessed cause (issue #28).
   // The import is guarded, so omitting this file would not crash the launcher — it would