claude-mem-lite 6.29.0 → 6.29.2

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "6.29.0",
+      "version": "6.29.2",
       "source": "./",
       "homepage": "https://github.com/sdsrss/claude-mem-lite",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.29.0",
+  "version": "6.29.2",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/commands/adopt.md

@@ -7,9 +7,9 @@ description: "Use when: user asks to put the claude-mem-lite steering block into
 
 Install the claude-mem-lite **steering block** into the current project's
 `CLAUDE.md` (the canonical home for project instructions — loaded by Claude Code
-at system-prompt authority). This replaces the pre-v3.13 scheme that seeded the
-project's memory-dir `MEMORY.md`; that polluted an index meant for the user's own
-memories, and `MEMORY.md` carries no more weight than `CLAUDE.md` anyway.
+at system-prompt authority). It does not go in the project's memory-dir
+`MEMORY.md`: that index belongs to the user's own memories, and it carries no
+more weight than `CLAUDE.md`.
 
 Auto-adopt does not add the block to `CLAUDE.md`: in a git repository it keeps the same block
 in `CLAUDE.local.md` at the repository root, excluded from git through `.git/info/exclude`.

package/commands/bug.md

@@ -10,8 +10,7 @@ Record a known bug + reproduction steps. Writes a searchable **observation**
 via `mem_search` and the PreToolUse recall hooks warn when the affected files
 are edited. Does NOT touch memdir. Useful for bugs you can't fix immediately
 but want future sessions (or yourself after `/clear`) to know about and avoid
-re-investigating. (Redirected v3.39: was the `events` table, which `mem_search`
-never read.)
+re-investigating.
 
 ## When to use
 

package/commands/lesson.md

@@ -9,9 +9,8 @@ Record a lesson / gotcha / workaround. Writes a searchable **observation**
 (`type=discovery` with the text as `lesson_learned`) so future sessions can
 find it via `mem_search` and the PreToolUse recall hooks surface it on the
 relevant files. Does NOT touch memdir — so lessons never end up in the L1
-system-prompt memory section and do not conflict with the `WHAT_NOT_TO_SAVE`
-semantics sdscc enforces. (Redirected v3.39: was the `events` table, which
-`mem_search` never read.)
+system-prompt memory section and do not conflict with Claude Code's auto-memory
+rules on what not to save there.
 
 ## When to use
 
@@ -23,7 +22,7 @@ After you (or the user) solve a tricky bug or discover a non-obvious behavior:
 
 Don't use for trivial fixes (typos, renames), for rules that belong in memdir
 (user preferences, project-wide conventions), or for general project notes
-(use `/mem:memory` or `mem_save` instead).
+(use `/claude-mem-lite:memory` or `mem_save` instead).
 
 ## Arguments
 

package/commands/mem.md

@@ -30,9 +30,9 @@ When the user invokes `/mem`, parse their intent:
 - `/mem save <text>` → call `mem_save` MCP tool with the text as content
 - `/mem stats` → run `node "${CLAUDE_PLUGIN_ROOT}/cli.mjs" stats` via Bash
 - `/mem get <ids>` → run `node "${CLAUDE_PLUGIN_ROOT}/cli.mjs" get <ids>` via Bash
-- `/mem cleanup` → run `mem_maintain(action="scan")`, report pending purge count and stale items to user, ask for confirmation, then run `mem_maintain(action="execute", operations=["purge_stale"], confirm=true)` if confirmed. **`confirm=true` is required and is not optional politeness:** without it the call returns a dry-run PREVIEW and deletes nothing, while still succeeding — so you would report a cleanup that never happened.
-- `/mem cleanup Nd` (e.g. `60d`) → same as above but add `retain_days=N` to only purge items older than N days. **`retain_days` must be between 7 and 365**; anything outside that range is rejected by the schema, so `/mem cleanup 3d` cannot be honoured — say so rather than silently substituting the default.
-- `/mem cleanup keep Nd` (e.g. `keep 14d`) → same as above with `retain_days=N`, same 7–365 range.
+- `/mem cleanup` → run `node "${CLAUDE_PLUGIN_ROOT}/cli.mjs" maintain scan` via Bash, report pending purge count and stale items to user, ask for confirmation, then run `node "${CLAUDE_PLUGIN_ROOT}/cli.mjs" maintain execute --ops purge_stale --confirm` via Bash if confirmed. **`--confirm` is required and is not optional politeness:** without it the command prints a dry-run PREVIEW and deletes nothing, while still succeeding — so you would report a cleanup that never happened.
+- `/mem cleanup Nd` (e.g. `60d`) → same as above but add `--retain-days N` to only purge items older than N days. **`--retain-days` must be between 7 and 365**; the CLI rejects anything outside that range, so `/mem cleanup 3d` cannot be honoured — say so rather than silently substituting the default.
+- `/mem cleanup keep Nd` (e.g. `keep 14d`) → same as above with `--retain-days N`, same 7–365 range.
 - `/mem <query>` (no subcommand) → treat as search, run `node "${CLAUDE_PLUGIN_ROOT}/cli.mjs" search <query>` via Bash
 
 Use Bash commands first. For detailed data, use `node "${CLAUDE_PLUGIN_ROOT}/cli.mjs" get <id>` via Bash.

package/commands/memory.md

@@ -9,12 +9,12 @@ Save important content to your long-term memory database.
 
 ## Commands
 
-- `/mem:memory <content>` — Save the given content directly to memory
-- `/mem:memory` (no args) — Auto-summarize recent session highlights and save key findings
+- `/claude-mem-lite:memory <content>` — Save the given content directly to memory
+- `/claude-mem-lite:memory` (no args) — Auto-summarize recent session highlights and save key findings
 
 ## Instructions
 
-When the user invokes `/mem:memory`, determine the intent:
+When the user invokes `/claude-mem-lite:memory`, determine the intent:
 
 ### With explicit content
 

package/commands/update.md

@@ -1,6 +1,7 @@
 ---
 name: update
 description: "Use when: search results seem noisy or for periodic memory maintenance"
+disable-model-invocation: true
 ---
 
 # Memory Maintenance
@@ -9,23 +10,25 @@ Run intelligent maintenance on the memory database.
 
 ## Usage
 
-- `/mem:update` — Run full maintenance cycle
+- `/claude-mem-lite:update` — Run full maintenance cycle
 
 ## Instructions
 
-When the user invokes `/mem:update`, perform the following maintenance cycle:
+When the user invokes `/claude-mem-lite:update`, perform the following maintenance cycle:
 
 ### Phase 1: Memory Maintenance
 
-1. Call `mem_maintain(action="scan")` to analyze maintenance candidates
+Run each command below via Bash; the CLI reaches the maintenance operations whether or not their MCP tools are in your tool list.
+
+1. Run `node "${CLAUDE_PLUGIN_ROOT}/cli.mjs" maintain scan` to analyze maintenance candidates
 2. Report scan results to the user (duplicates, stale items, broken items, boostable items, **pending purge** items)
-3. Call `mem_maintain(action="execute", operations=["cleanup","decay","boost"])` to apply safe automatic changes
-4. If duplicates were found in scan, review them and call `mem_maintain(action="execute", operations=["dedup"], merge_ids=[[keepId, removeId1, ...], ...])` — keep the more important/recent observation in each pair
-5. Run `mem_compress(preview=false)` for old low-value observations
-6. **If pending purge items > 0**: Report the count to the user and ask for confirmation. If confirmed, call `mem_maintain(action="execute", operations=["purge_stale"], confirm=true)`. **`confirm=true` is required:** without it the call returns a dry-run preview and deletes nothing while still succeeding, so you would report a purge that never happened. User may optionally specify `retain_days` (default 30, allowed range 7–365) to control how many days of data to keep. Do NOT purge without explicit user confirmation.
+3. **If pending purge items > 0**: first run the purge command below without `--confirm`: it prints how many rows it would delete and deletes nothing. Report that count to the user and ask for confirmation. If confirmed, run `node "${CLAUDE_PLUGIN_ROOT}/cli.mjs" maintain execute --ops purge_stale --confirm`. **`--confirm` is required:** without it the command prints a dry-run preview and deletes nothing while still succeeding, so you would report a purge that never happened. User may optionally add `--retain-days N` (default 30, allowed range 7–365) to both runs to control how many days of data to keep; the CLI rejects a value outside that range, so tell the user instead of substituting the default. Do NOT purge without explicit user confirmation. The purge comes before the next step on purpose: decay there queues more rows for purge, and those wait for a later run, so what gets deleted is what the user approved.
+4. Run `node "${CLAUDE_PLUGIN_ROOT}/cli.mjs" maintain execute` to apply safe automatic changes — with no `--ops` it runs the default set: cleanup, decay, boost, then demote_pinned (left out when `CLAUDE_MEM_SKIP_DEMOTE_PINNED=1`)
+5. If duplicates were found in scan, review them and run `node "${CLAUDE_PLUGIN_ROOT}/cli.mjs" maintain execute --ops dedup --merge-ids keepId:removeId,...` — keep the more important/recent observation in each pair. Groups are comma-separated and the first id in each is kept (`10:11,20:21:22`). For pairs similar enough to merge without review the scan prints a ready-made list after `--merge-ids`; pass it to the command above, since the command the scan prints uses a bare `claude-mem-lite`, which may not be installed
+6. Run `node "${CLAUDE_PLUGIN_ROOT}/cli.mjs" compress --execute` for old low-value observations (without `--execute` it only previews)
 
 ### Phase 2: Summary
 
-Summarize all maintenance actions taken in zh-CN:
-- Memory: observations cleaned, decayed, boosted, deduplicated, compressed
+Summarize all maintenance actions taken in the user's language:
+- Memory: observations cleaned, decayed, boosted, demoted, deduplicated, compressed
 - Overall health assessment

package/hook-llm.mjs

@@ -1429,8 +1429,8 @@ export async function handleLLMEpisode() {
         // returns 3 for any entry touching schema./migration/prisma/.env/.key paths; via the
         // Math.max below that force-promoted ordinary has-lesson episodes to "critical" imp=3
         // even when Haiku judged them 1-2 (audit: auto imp=3 = 34.8%, e.g. a thin-lesson edit
-        // to schema.mjs). Haiku's OWN importance can still reach 3 (genuine judgment); only the
-        // path heuristic is capped. The isLessonLowSignal branch still floors no-lesson
+        // to schema.mjs). Only the path heuristic was capped then; D#414 below caps the model's own
+        // score too. The isLessonLowSignal branch still floors no-lesson
         // non-decision autos at ≤1; manual mem_save uses a different path and is unaffected.
         // D#69: `!lessonLearned` is the old `isLessonLowSignal && !retryRecovered` (the
         // two are equal with grounding off). A lesson the grounding check dropped caps
@@ -1440,10 +1440,16 @@ export async function handleLLMEpisode() {
         // carries text whoever controls that output wrote — reproduced on real Haiku,
         // 3 of 6 hostile windows stored the directive at importance 2. The row and
         // lesson stay searchable; only the automatic injection faces lose them.
+        // D#414: the model's own score is capped at 2 as well, as re-enrich's is (D#376). The window
+        // carries tool output, text whoever controls a file or a command's output wrote, and 3 is
+        // Key Context's top tier; benign episodes did not use it: 72 real sub-episodes from this
+        // machine's transcripts through this prompt (claude -p haiku, 2026-10-17) scored 1 x42,
+        // 2 x30, 3 x0. (A rule-based row, buildImmediateObservation's, saved before the call or when
+        // it fails, can still be 3 after a failing test or build command: that is no model output.)
         importance:
           (!lessonLearned && (groundingDropped || parsed.type !== 'decision')) || quotesToolOutput
             ? Math.min(ruleImportance, 1)
-            : Math.max(Math.min(ruleImportance, 2), clampImportance(parsed.importance)),
+            : Math.min(Math.max(ruleImportance, clampImportance(parsed.importance)), 2),
         lessonLearned,
         searchAliases,
         // P3 (D#78): lesson applicability scope — whitelist-validated, invalid → null.

package/hook.mjs

@@ -78,7 +78,7 @@ import {
 } from './hook-episode.mjs';
 // CODE_DIR, not DB_DIR: the schema-skew notice asks which CODE homes exist, and those are
 // always homedir-rooted even when CLAUDE_MEM_DIR relocates the data.
-import { DB_DIR, DB_PATH, CODE_DIR, refreshPlannerStats } from './schema.mjs';
+import { DB_DIR, DB_PATH, CODE_DIR, refreshPlannerStats, recheckObservationIndexTerms } from './schema.mjs';
 import { cleanupClaudeMdLegacyBlock, buildSessionContextLines } from './hook-context.mjs';
 import { entry as preCompactEntry } from './hook-precompact.mjs';
 import {
@@ -2335,6 +2335,19 @@ function runSessionStartAutoMaintain(db, project) {
         debugCatch(e, 'auto-maintain-handoff-gc');
       }
 
+      // The CJK index terms an older build still writing this store left out (D#413).
+      try {
+        const { appended } = recheckObservationIndexTerms(db);
+        if (appended > 0)
+          debugLog(
+            'DEBUG',
+            'auto-maintain',
+            `appended index terms to ${appended} observations an older build wrote`,
+          );
+      } catch (e) {
+        debugCatch(e, 'auto-maintain-recheck-index-terms');
+      }
+
       // Planner statistics, the "once a day" half of SQLite's recommendation (#41). Last, so
       // the purge/dedup above have already moved the row counts it compares. Never throws.
       refreshPlannerStats(db);

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.29.0",
+  "version": "6.29.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "claude-mem-lite",
-      "version": "6.29.0",
+      "version": "6.29.2",
       "os": [
         "darwin",
         "linux",
@@ -15,7 +15,7 @@
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.30.0",
         "better-sqlite3": "^13.0.3",
-        "zod": "^4.6.5"
+        "zod": "^4.6.7"
       },
       "bin": {
         "claude-mem-lite": "cli.mjs"
@@ -23,12 +23,12 @@
       "devDependencies": {
         "@eslint/js": "^10.0.1",
         "@vitest/coverage-v8": "^5.0.3",
-        "acorn": "8.18.0",
-        "eslint": "^10.11.0",
+        "acorn": "8.19.0",
+        "eslint": "^10.12.0",
         "fast-check": "^4.10.2",
-        "knip": "^6.38.0",
+        "knip": "^6.41.0",
         "picomatch": "^4.0.4",
-        "prettier": "3.9.9",
+        "prettier": "3.9.10",
         "vitest": "^5.0.3"
       },
       "engines": {
@@ -1197,9 +1197,9 @@
       "license": "ISC"
     },
     "node_modules/zod": {
-      "version": "4.6.5",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.5.tgz",
-      "integrity": "sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q==",
+      "version": "4.6.7",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.7.tgz",
+      "integrity": "sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.29.0",
+  "version": "6.29.2",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",
@@ -237,7 +237,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
     "better-sqlite3": "^13.0.3",
-    "zod": "^4.6.5"
+    "zod": "^4.6.7"
   },
   "overrides": {
     "hono": ">=4.12.31",
@@ -250,12 +250,12 @@
   "devDependencies": {
     "@eslint/js": "^10.0.1",
     "@vitest/coverage-v8": "^5.0.3",
-    "acorn": "8.18.0",
-    "eslint": "^10.11.0",
+    "acorn": "8.19.0",
+    "eslint": "^10.12.0",
     "fast-check": "^4.10.2",
-    "knip": "^6.38.0",
+    "knip": "^6.41.0",
     "picomatch": "^4.0.4",
-    "prettier": "3.9.9",
+    "prettier": "3.9.10",
     "vitest": "^5.0.3"
   }
 }

package/schema.mjs

@@ -1303,12 +1303,13 @@ const OBS_DOC_SQL = OBS_FTS_COLUMNS.map((c) => `COALESCE(${c}, '')`).join(` || '
  * appended to and whether the walk is finished.
  *
  * @param {import('better-sqlite3').Database} db
- * @param {{ budgetMs?: number, batchSize?: number }} [opts]
+ * @param {{ budgetMs?: number, batchSize?: number, cursor?: string }} [opts] `cursor`: the name of
+ *   the walk's row in migration_cursors (recheckObservationIndexTerms walks on its own)
  * @returns {{ appended: number, done: boolean }}
  */
 export function backfillObservationIndexTerms(
   db,
-  { budgetMs = OBS_TERMS_BUDGET_MS, batchSize = OBS_TERMS_BATCH } = {},
+  { budgetMs = OBS_TERMS_BUDGET_MS, batchSize = OBS_TERMS_BATCH, cursor = OBS_TERMS_CURSOR } = {},
 ) {
   const start = performance.now();
   const prior = db.pragma('busy_timeout', { simple: true });
@@ -1318,8 +1319,7 @@ export function backfillObservationIndexTerms(
       const table = db
         .prepare(`SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'migration_cursors'`)
         .get();
-      const row =
-        table && db.prepare(`SELECT below_id FROM migration_cursors WHERE name = ?`).get(OBS_TERMS_CURSOR);
+      const row = table && db.prepare(`SELECT below_id FROM migration_cursors WHERE name = ?`).get(cursor);
       return row ? row.below_id : Number.MAX_SAFE_INTEGER;
     };
     const pick = db.prepare(
@@ -1356,7 +1356,7 @@ export function backfillObservationIndexTerms(
       db.prepare(
         `INSERT INTO migration_cursors (name, below_id) VALUES (?, ?)
            ON CONFLICT(name) DO UPDATE SET below_id = excluded.below_id`,
-      ).run(OBS_TERMS_CURSOR, below);
+      ).run(cursor, below);
       return n;
     });
     let appended = 0;
@@ -1385,6 +1385,54 @@ export function backfillObservationIndexTerms(
   }
 }
 
+/** How long recheckObservationIndexTerms keeps walking after its first run (D#413). */
+const OBS_TERMS_RECHECK_WINDOW_MS = 7 * 24 * 3600 * 1000;
+/** Its budget per run: the maintain worker has no host deadline, and its lock goes stale at 10 min. */
+const OBS_TERMS_RECHECK_BUDGET_MS = 30_000;
+/** Its cursor and done marker; the window's start is stored as `<name>-opened`. */
+const OBS_TERMS_RECHECK = 'recheck-cjk-index-terms';
+
+/**
+ * Walk the observations again for the CJK index terms an older build left out (D#413), once a day
+ * from the auto-maintain worker, for OBS_TERMS_RECHECK_WINDOW_MS from this function's first run on
+ * the store, then mark itself done. The open-time pass is marked done once, but an older build can
+ * go on writing the store for as long as a session started before the update lives: it inserts
+ * rows without these terms (live store 2026-10-17: 8 of the 36 rows its 6.27.0 code wrote after
+ * the fill) and rewrites a filled row's text without them (6.28.x mem_update), and no column says
+ * which rows a writer touched. The window starts at the first run, not at the open-time pass's
+ * marker, so a store whose pass finished long before this build arrived still gets a whole walk.
+ * Waits for the open-time pass to be done, so the two never walk at once. The walk is
+ * backfillObservationIndexTerms on a cursor of its own: a finished walk drops the cursor, so the
+ * next run starts from the top again; one cut short by its budget or another writer's lock keeps
+ * it, and the next run continues below it. Returns how many rows it appended to and whether it
+ * walked.
+ *
+ * @param {import('better-sqlite3').Database} db
+ * @param {{ now?: number, budgetMs?: number }} [opts]
+ * @returns {{ appended: number, ran: boolean }}
+ */
+export function recheckObservationIndexTerms(
+  db,
+  { now = Date.now(), budgetMs = OBS_TERMS_RECHECK_BUDGET_MS } = {},
+) {
+  const doneAt = db.prepare(`SELECT done_at_epoch FROM migration_cleanups WHERE name = ?`).pluck();
+  const mark = db.prepare(`INSERT OR IGNORE INTO migration_cleanups (name, done_at_epoch) VALUES (?, ?)`);
+  // 'backfill-cjk-index-terms' is the open-time pass's marker (DEFERRED_CLEANUPS).
+  if (doneAt.get('backfill-cjk-index-terms') === undefined || doneAt.get(OBS_TERMS_RECHECK) !== undefined)
+    return { appended: 0, ran: false };
+  mark.run(`${OBS_TERMS_RECHECK}-opened`, now);
+  if (now - doneAt.get(`${OBS_TERMS_RECHECK}-opened`) >= OBS_TERMS_RECHECK_WINDOW_MS) {
+    mark.run(OBS_TERMS_RECHECK, now);
+    return { appended: 0, ran: false };
+  }
+  const { appended, done } = backfillObservationIndexTerms(db, { budgetMs, cursor: OBS_TERMS_RECHECK });
+  const cursors = db
+    .prepare(`SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'migration_cursors'`)
+    .get();
+  if (done && cursors) db.prepare(`DELETE FROM migration_cursors WHERE name = ?`).run(OBS_TERMS_RECHECK);
+  return { appended, ran: true };
+}
+
 /**
  * How long backfillEventSearchTerms runs per open, checked after each row it segments (its reads,
  * segmentation and the writes before; the last batch's write comes on top):
@@ -1737,9 +1785,11 @@ export function refreshPlannerStats(db, { busyTimeoutMs } = {}) {
 
 /**
  * Whether an open/init error carries a genuine corruption signature. WAL-delete
- * recovery is ONLY safe for these: on a transient error (SQLITE_BUSY) or the
+ * recovery runs ONLY for these: on a transient error (SQLITE_BUSY) or the
  * forward-version guard throw, deleting the WAL would discard committed-but-
- * uncheckpointed transactions — silent data loss.
+ * uncheckpointed transactions — silent data loss. A corruption signature does not
+ * make the delete safe either while another connection has the file open (it loses
+ * that connection's commits the same way), so ensureDbWithWalRecovery retries first.
  */
 export function isDbCorruptionError(err) {
   // R10 P3-9: SQLITE_CORRUPT_VTAB is EXCLUDED. It means a damaged FTS5 index over an
@@ -1764,7 +1814,8 @@ export { isFtsCorruptionError };
  * serves all three openers.
  *
  * Non-corruption failure → rethrows the original error, WAL/SHM left intact.
- * Corruption → deletes -wal/-shm, retries once; a still-failing retry rethrows
+ * Corruption → retries once with the files untouched; corruption again → deletes
+ * -wal/-shm, retries once more; a still-failing retry rethrows
  * with `err.walRecoveryAttempted = true` so callers can word their fatal hint
  * accurately (recovery already tried vs WAL deliberately preserved).
  *
@@ -1783,6 +1834,9 @@ export function ensureDbWithWalRecovery({ warn, info } = {}) {
       let raw = null;
       try {
         raw = new Database(DB_PATH);
+        // D#415: otherwise better-sqlite3's 5000 ms per statement, four rebuilds, in a hook
+        // the host kills at 2 s or 5 s.
+        if (busyDeadline !== null) capBusyWaits(raw);
         const { errors } = rebuildFTS(raw);
         if (errors.length) warn?.(`FTS rebuild reported: ${errors.join('; ')}`);
       } catch (rebuildErr) {
@@ -1808,7 +1862,23 @@ export function ensureDbWithWalRecovery({ warn, info } = {}) {
       }
     }
     if (!isDbCorruptionError(firstErr)) throw firstErr;
-    warn?.(`DB corruption detected, attempting WAL recovery: ${firstErr.message}`);
+    // D#427: retry once with the files untouched before deleting anything. A corruption error
+    // that does not come from the file exists (3 of 43 first opens by 6.28.1 of fresh copies of one
+    // intact store threw one on one host, D#424; the other 40 did not), and for it the delete below
+    // is the only thing that loses data: with another connection open (the MCP server keeps one all
+    // session) it can discard what that connection committed since its last checkpoint, and until
+    // it closes the two connections overwrite each other's pages.
+    warn?.(`DB corruption reported, retrying the open with the WAL kept: ${firstErr.message}`);
+    let walErr;
+    try {
+      const db = ensureDb();
+      info?.('DB opened on the retry, WAL kept');
+      return db;
+    } catch (retryErr) {
+      if (!isDbCorruptionError(retryErr)) throw retryErr;
+      walErr = retryErr;
+    }
+    warn?.(`DB corruption detected, attempting WAL recovery: ${walErr.message}`);
     try {
       rmSync(DB_PATH + '-wal', { force: true });
     } catch {