claude-mem-lite 6.3.0 → 6.4.0

package/.claude-plugin/marketplace.json

@@ -4,14 +4,14 @@
     "name": "sdsrss"
   },
   "metadata": {
-    "description": "Plugins by sdsrss",
-    "homepage": "https://github.com/sdsrss/claude-mem-lite"
+    "description": "Plugins by sdsrss"
   },
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "6.3.0",
+      "version": "6.4.0",
       "source": "./",
+      "homepage": "https://github.com/sdsrss/claude-mem-lite",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."
     }
   ]

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.3.0",
+  "version": "6.4.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/README.md

@@ -598,7 +598,12 @@ Your data directory (`~/.claude-mem-lite/`) is untouched by install/rollback; sc
 
 ### doctor
 
-Checks Node.js version, dependencies, server/hook files, database integrity, FTS5 indexes, and stale processes.
+Checks Node.js version, dependencies, server/hook files, database integrity, FTS5 indexes,
+stale processes, MCP registration, and whether the marketplace clone can still be updated.
+
+It runs `claude mcp list` to answer the registration question, and that **health-checks every
+MCP server you have configured** — i.e. briefly launches each one, including remote endpoints.
+`status` deliberately does not: on a plugin install it answers from the manifest instead.
 
 ### status
 
@@ -617,9 +622,11 @@ claude-mem-lite repair
 **If `repair` itself fails** (the bin is older than v2.84.0, or the bin is also broken), run this one-liner — it pulls a fresh tarball into a temp dir and runs *that* tarball's `install.mjs`, bypassing every file on your disk:
 
 ```bash
-T=$(mktemp -d) && curl -sL https://api.github.com/repos/sdsrss/claude-mem-lite/tarball | tar xz -C "$T" --strip-components=1 && node "$T/install.mjs" install
+T=$(mktemp -d) && U=$(curl -sL https://api.github.com/repos/sdsrss/claude-mem-lite/releases/latest | grep -o '"tarball_url"[^,]*' | cut -d'"' -f4) && curl -sL "$U" | tar xz -C "$T" --strip-components=1 && node "$T/install.mjs" install
 ```
 
+It resolves the latest **release** tag first. A shell one-liner cannot verify the release signature the way `repair` does, so running it is a trust decision you are making explicitly — that is why it is the last resort and not the first suggestion.
+
 After it finishes, `~/.claude-mem-lite/` is back in sync with the latest release and `claude-mem-lite repair` is available for next time.
 
 ## Uninstall
@@ -643,6 +650,19 @@ Data in `~/.claude-mem-lite/` is preserved by default. Delete manually if needed
 rm -rf ~/.claude-mem-lite/
 ```
 
+**`/plugin uninstall` does not delete the plugin cache.** Claude Code materializes each
+version under `~/.claude/plugins/cache/`, with its own `node_modules`. While the plugin is
+installed these get pruned to the newest three (SessionStart does it, and so does the update
+path), so the directory is bounded — measured at 241 MB — not unbounded. But `/plugin
+uninstall` removes the manifest and there is no uninstall hook a plugin can attach to, so the
+hooks stop firing and whatever is left is never reclaimed. `claude-mem-lite uninstall` does
+reclaim it, but after `/plugin uninstall` that command may no longer be on your PATH. Either
+run it **first**, or delete the directory yourself:
+
+```bash
+rm -rf ~/.claude/plugins/cache/sdsrss/claude-mem-lite
+```
+
 ### Mixed-install residue (read this if you've used multiple install methods)
 
 `/plugin uninstall` only removes the plugin manifest — it **does not touch `~/.claude/settings.json`**. If you've ever run `claude-mem-lite install` (npx or git-clone path), hook entries pointing at `~/.claude-mem-lite/hook.mjs` were written into your user-global settings, and they keep firing after `/plugin uninstall`. If `~/.claude-mem-lite/hook.mjs` still exists they double-fire alongside the plugin; if you also ran `rm -rf ~/.claude-mem-lite/` they error every session.

package/README.zh-CN.md

@@ -478,7 +478,11 @@ npx claude-mem-lite doctor            # 诊断问题
 
 ### doctor
 
-检查 Node.js 版本、依赖、服务器/钩子文件、数据库完整性、FTS5 索引和残留进程。
+检查 Node.js 版本、依赖、服务器/钩子文件、数据库完整性、FTS5 索引、残留进程、MCP 注册状态，
+以及 marketplace clone 是否还能被更新。
+
+它用 `claude mcp list` 回答注册状态那一问，而这会**对你配置的每个 MCP server 做健康检查**——
+也就是逐个短暂启动，包括远程 endpoint。`status` 刻意不这么做：插件形态下它从 manifest 回答。
 
 ### status
 
@@ -497,9 +501,11 @@ claude-mem-lite repair
 **如果 `repair` 自己也跑不起来**（bin 比 v2.84.0 旧，或 bin 也坏了），用这条单行命令——它把最新 tarball 拉到临时目录、跑 *那份* tarball 里的 `install.mjs`，完全不依赖你磁盘上的任何文件：
 
 ```bash
-T=$(mktemp -d) && curl -sL https://api.github.com/repos/sdsrss/claude-mem-lite/tarball | tar xz -C "$T" --strip-components=1 && node "$T/install.mjs" install
+T=$(mktemp -d) && U=$(curl -sL https://api.github.com/repos/sdsrss/claude-mem-lite/releases/latest | grep -o '"tarball_url"[^,]*' | cut -d'"' -f4) && curl -sL "$U" | tar xz -C "$T" --strip-components=1 && node "$T/install.mjs" install
 ```
 
+它会先解析出最新 **release** 的 tag。shell 单行命令无法像 `repair` 那样校验 release 签名，所以跑它等于你自己做了一次信任决定——这也是它排在最后、而不是被优先推荐的原因。
+
 跑完之后，`~/.claude-mem-lite/` 就和最新 release 对齐，`claude-mem-lite repair` 下次再遇到类似问题也能直接用了。
 
 ## 卸载
@@ -523,6 +529,17 @@ npx claude-mem-lite uninstall --purge
 rm -rf ~/.claude-mem-lite/
 ```
 
+**`/plugin uninstall` 不会删 plugin cache。** Claude Code 会把每个版本展开到
+`~/.claude/plugins/cache/` 下，各带一份 `node_modules`。插件还装着的时候，这些会被裁剪到最新
+三个版本（SessionStart 会做，更新路径也会做），所以这个目录是有上限的——实测 241 MB——而不是无限
+增长。但 `/plugin uninstall` 只移除 manifest，插件又没有可挂的卸载生命周期钩子，于是钩子停止触发，
+剩下的东西再也没人回收。`claude-mem-lite uninstall` 能回收它，但 `/plugin uninstall` 之后这个命令
+可能已经不在 PATH 上了。所以要么**先**跑它，要么自己删：
+
+```bash
+rm -rf ~/.claude/plugins/cache/sdsrss/claude-mem-lite
+```
+
 ### 混装残留（用过多种安装方式的话务必看一下）
 
 `/plugin uninstall` 只删 plugin manifest，**不会动 `~/.claude/settings.json`**。如果你曾经跑过 `claude-mem-lite install`（npx 或 git-clone 路径），指向 `~/.claude-mem-lite/hook.mjs` 的 hook 条目就被写进了你的 user-global settings；`/plugin uninstall` 之后它们还在每会话触发。如果 `~/.claude-mem-lite/hook.mjs` 还在 → 与 plugin 双触发；如果你又 `rm -rf ~/.claude-mem-lite/` → 每次会话报错。

package/hook-update.mjs

@@ -20,7 +20,12 @@ import {
 import { join, dirname, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { tmpdir, homedir } from 'node:os';
-import { DB_DIR, CODE_DIR } from './schema.mjs';
+// lib/data-paths.mjs, NOT schema.mjs: this module is what install.mjs::repair() imports to
+// reach the signature-verified release path, and schema.mjs statically imports
+// better-sqlite3 — so importing two path constants from there made the verified repair
+// unreachable on exactly the broken-install state it exists to repair (2026-09-08).
+// tests/repair-path-no-native-dep.test.mjs fails on any package edge reachable from here.
+import { DB_DIR, CODE_DIR } from './lib/data-paths.mjs';
 import { debugCatch, debugLog } from './utils.mjs';
 import { NATIVE_BINDING_SOURCE_BUILD_CMD } from './lib/binding-probe.mjs';
 // Local manifest is fallback only — the active manifest is loaded from the

package/install.mjs

@@ -54,7 +54,7 @@ const SERVER_PATH = join(INSTALL_DIR, 'server.mjs');
 const HOOK_PATH = join(INSTALL_DIR, 'hook.mjs');
 // P2-7: both constants and the predicate come from lib/plugin-key.mjs, which hook.mjs also
 // imports — this pair used to be typed out in each.
-import { MARKETPLACE_KEY, PLUGIN_KEY, isPluginExplicitlyDisabled } from './lib/plugin-key.mjs';
+import { MARKETPLACE_KEY, PLUGIN_KEY, PLUGIN_NAME, isPluginExplicitlyDisabled } from './lib/plugin-key.mjs';
 const NPM_INSTALL_CMD = 'npm install --omit=dev --no-audit --no-fund';
 
 import {
@@ -68,7 +68,9 @@ import {
   probeBetterSqlite3Binding,
   ensureBetterSqlite3Working,
   nativeBindingRepairHint,
+  isNativeBindingError,
 } from './lib/binding-probe.mjs';
+import { readSnapshots } from './lib/db-backup.mjs';
 import { detectInstallShape, probeRuntimeRoots } from './lib/install-shape.mjs';
 import { probeSchemaCompat, schemaSkewRemedy } from './lib/schema-skew.mjs';
 import { clearNativeBindingBreakage, readNativeBindingBreakage } from './lib/native-binding-hint.mjs';
@@ -333,6 +335,147 @@ function isDevInstall() {
   }
 }
 
+// Last-resort recovery command, printed when the signature-verified repair path itself
+// fails. It resolves the latest RELEASE tarball via the GitHub API rather than fetching
+// `/tarball`, which serves the DEFAULT BRANCH — unreleased WIP. That mattered: repair()
+// exists because the old auto-path ran main HEAD unverified, and until 2026-09-08 the
+// fallback it printed on failure handed the user exactly that behaviour back. A shell
+// one-liner cannot check an Ed25519 signature, so this remains a trust decision the user
+// makes explicitly; pinning it to a release at least removes the unreleased-WIP half.
+//
+// FOUR surfaces carry this string — here, scripts/hook-launcher.mjs (pure-`node:` charter,
+// cannot import lib/), README.md and README.zh-CN.md. Exported so
+// tests/manual-fallback-sync.test.mjs can pin the other three to this one and fail if a
+// fifth appears; a string kept in sync by a comment is a string that drifts.
+export const MANUAL_TARBALL_FALLBACK =
+  'T=$(mktemp -d) && U=$(curl -sL https://api.github.com/repos/sdsrss/claude-mem-lite/releases/latest | grep -o \'"tarball_url"[^,]*\' | cut -d\'"\' -f4) && curl -sL "$U" | tar xz -C "$T" --strip-components=1 && node "$T/install.mjs" install';
+
+/**
+ * Whether the local marketplace clone can still be fast-forwarded.
+ *
+ * This is the near cause of the failure v6.3.0 shipped a detector for. Claude Code updates a
+ * git-source marketplace by pulling that clone; a DIRTY working tree blocks the pull, the
+ * plugin silently stops updating, and eventually the database is written by a newer
+ * claude-mem-lite than the code that has to open it. On this machine the clone was pinned 22
+ * commits behind while everything reported green.
+ *
+ * It gets dirty on its own: with a DIRECTORY-source marketplace, `${CLAUDE_PLUGIN_ROOT}`
+ * resolves inside the clone, and `scripts/launch.mjs` runs `npm install` there whenever
+ * `node_modules/better-sqlite3` is missing — which is every materialization of a new version.
+ * That install rewrites **`package-lock.json`**, which IS tracked, and that is what blocks the
+ * pull. So the plugin's own launcher can create the state that stops the plugin updating.
+ *
+ * **Do not add a `node_modules` special case here.** A first cut did, and pre-ship review
+ * measured it dead: the clone is a clone of THIS repo, whose `.gitignore` carries
+ * `/node_modules`, so `git status --porcelain` never sees it — the branch was reachable only
+ * from a fixture that omitted the `.gitignore` the real clone always has. An ignored
+ * `node_modules` also does not block a fast-forward, so reporting it would have been noise
+ * even if it were visible. The tracked-file dirt is the whole signal.
+ *
+ * Five outcomes, and `unknown` is one of them on purpose: "I could not run git" must not be
+ * reported in the same voice as "the tree is clean".
+ *
+ * Exported for tests/marketplace-clone-health.test.mjs.
+ */
+export function marketplaceCloneHealth(
+  dir,
+  run = (args) => execFileSync('git', args, { encoding: 'utf8', timeout: 20000 }),
+) {
+  if (!existsSync(dir)) return { kind: 'absent' };
+  if (!existsSync(join(dir, '.git'))) return { kind: 'not-git' };
+  let porcelain;
+  try {
+    porcelain = run(['-C', dir, 'status', '--porcelain']);
+  } catch (e) {
+    return { kind: 'unknown', reason: e?.code || e?.message || 'git failed' };
+  }
+  const entries = String(porcelain)
+    .split('\n')
+    .filter((l) => l.trim());
+  if (entries.length === 0) return { kind: 'clean' };
+  return { kind: 'dirty', count: entries.length };
+}
+
+/**
+ * The `mem-lite` / `mem` registrations in `claude mcp list` output that are NOT provided by
+ * a plugin manifest.
+ *
+ * `claude mcp list` prints one `<name>: <command>` line per server, and a plugin-provided
+ * one is named `plugin:<plugin>:<server>`. The old test — `list.includes('mem-lite:')` —
+ * matched inside `plugin:claude-mem-lite:mem-lite:`, so it could not tell the two apart and
+ * always answered "registered" for a plugin user.
+ *
+ * Deliberately named for what it MEASURES: a bare-name registration, whatever its scope.
+ * `mcp list` does not label user vs project scope on the line itself, so calling this
+ * "user-scope" would claim more than the output supports.
+ *
+ * Exported for tests/mcp-registration-parse.test.mjs.
+ */
+export function nonPluginMemRegistrations(listOutput) {
+  const names = [];
+  for (const line of String(listOutput ?? '').split('\n')) {
+    // Anchored, no leading whitespace: the diagnostics block below the list is indented, and
+    // its `└ [Warning] [mem-lite] mcpServers.mem-lite: …` lines are not registrations.
+    const m = /^(\S+):\s+\S/.exec(line);
+    if (!m) continue;
+    const name = m[1];
+    if (name.startsWith('plugin:')) continue;
+    if (name === 'mem-lite' || name === 'mem') names.push(name);
+  }
+  return names;
+}
+
+/**
+ * The remedy line for a `doctor` database check that threw — or null when the failure is
+ * one this cannot classify.
+ *
+ * Returning null is deliberate and is the case worth defending: a diagnostic that always
+ * prints a fix eventually prints the wrong one, and the bare error message is a better
+ * answer than a confident irrelevance. The three CLASSIFIED outcomes are kept apart for the
+ * same reason — "restore this snapshot", "there is no snapshot", and "I could not read the
+ * directory to find out" are three different situations, and collapsing the last two ends
+ * the reader's search with a fact nobody checked.
+ *
+ * Shell commands only, no `claude-mem-lite <cmd>`: the remedy for a broken store must not
+ * itself depend on which install shape the user has (the plugin cache has no CLI on PATH).
+ *
+ * Exported for tests/doctor-db-remedy.test.mjs, which also drives the shipped doctor over a
+ * corrupt file — a pure function nothing calls is the wiring gap this repo keeps finding.
+ */
+export function dbCheckRemedy(dbPath, err) {
+  if (isNativeBindingError(err)) return `Repair: ${nativeBindingRepairHint(PROJECT_DIR)}`;
+  const msg = String(err?.message ?? err ?? '');
+  // SQLite's own spellings for "this file is not a usable database".
+  if (!/not a database|disk image is malformed|file is not a database/i.test(msg)) return null;
+
+  const clear = `rm -f "${dbPath}-wal" "${dbPath}-shm"`;
+  const snap = readSnapshots(dbPath);
+  if (!snap.ok) {
+    return (
+      `Could not read ${dirname(dbPath)} to look for a backup snapshot (${snap.reason}) — ` +
+      `fix that directory first, then look for ${basename(dbPath)}.*.bak beside the database.`
+    );
+  }
+  if (snap.snapshots.length === 0) {
+    return (
+      `No backup snapshot exists beside the database. Set the broken file aside so a fresh ` +
+      `store is created on the next session: ${clear} && mv "${dbPath}" "${dbPath}.corrupt" ` +
+      `— memories in that file are not recoverable without a backup.`
+    );
+  }
+  // Newest by mtime. Ties are broken by name, which carries an ISO stamp, so the answer is
+  // total rather than dependent on which of two same-millisecond files readdir returned
+  // first (the D#9 shape).
+  const newest = snap.snapshots
+    .slice()
+    .sort((a, b) => b.mtimeMs - a.mtimeMs || (a.path < b.path ? 1 : -1))[0];
+  return (
+    `Restore the newest of ${snap.snapshots.length} backup snapshot(s): ` +
+    `${clear} && cp "${newest.path}" "${dbPath}" ` +
+    `— move the broken file aside first if you want to keep it for inspection.`
+  );
+}
+
 // ─── Install ────────────────────────────────────────────────────────────────
 
 // Dynamic-import helpers, resolved against the installed copy at INSTALL_DIR
@@ -1136,11 +1279,23 @@ async function uninstall() {
     ok('Marketplace directory removed');
   }
 
-  // 5b. Remove cache directory
+  // 5b. Remove cache directories — OURS unconditionally, the marketplace-wide one gated.
+  //
+  // The gate exists so uninstalling this plugin does not delete a sibling plugin published
+  // under the same marketplace. That reasoning covers `cache/<marketplace>/`; it does not
+  // cover `cache/<marketplace>/claude-mem-lite/`, which is ours alone. Because only the
+  // gated branch existed, a user with any other sdsrss plugin installed kept every cached
+  // version of THIS one — measured at 241 MB on a machine where `/plugin uninstall` had
+  // already removed the manifest, i.e. bytes belonging to a plugin that was gone.
+  const ownCacheDir = join(pluginsDir, 'cache', marketplaceKey, PLUGIN_NAME);
+  if (existsSync(ownCacheDir)) {
+    rmSync(ownCacheDir, { recursive: true, force: true });
+    ok('Plugin cache removed');
+  }
   const cacheDir = join(pluginsDir, 'cache', marketplaceKey);
   if (canRemoveMarketplaceArtifacts && existsSync(cacheDir)) {
     rmSync(cacheDir, { recursive: true, force: true });
-    ok('Plugin cache removed');
+    ok('Marketplace cache directory removed');
   }
 
   // 5c. Clean known_marketplaces.json
@@ -1224,35 +1379,52 @@ async function status() {
   // configured` at a correctly-installed plugin user — two red marks describing
   // the intended state.
   const shape = detectInstallShape({ home: homedir(), projectDir: PROJECT_DIR, installDir: INSTALL_DIR });
-  const pluginProvides = !!shape.activePluginVersion;
-
-  // MCP
-  try {
-    const list = execFileSync('claude', ['mcp', 'list'], { encoding: 'utf8' });
-    // Accept either the current "mem-lite" registration or the legacy "mem"
-    // name (pre-v2.78) so a user mid-upgrade still sees a green status until
-    // setup.sh / install.mjs purges the legacy entry on next run.
-    // v2.79.1: dropped a `/\bmem\b\s/` fallback regex — the `\b` word boundary
-    // also matched "mem-lite" (because `-` is a non-word char), so the regex
-    // was always-true noise (benign only because the mem-lite checks short-
-    // circuited first). `claude mcp list` formats as `<name>: <command>`, so
-    // the two colon-form checks below cover every shape.
-    const registered = list.includes('mem-lite:') || list.includes('mem:');
-    if (registered) {
-      push('ok', 'mcp', 'MCP server: registered', { registered });
-    } else if (pluginProvides) {
-      push(
-        'ok',
-        'mcp',
-        `MCP server: provided by the plugin manifest (v${shape.activePluginVersion.version} .mcp.json) — no user-scope registration expected`,
-        { registered: false, via: 'plugin' },
-      );
-    } else {
-      push('fail', 'mcp', 'MCP server: not registered', { registered });
+  // A cache DIRECTORY is not an installed plugin — `/plugin uninstall` leaves version dirs
+  // behind (this project's own README documents that), and `activePluginVersion` falls back to
+  // "newest cache dir" when nothing recorded an install. Both branches below credit the
+  // manifest with providing something, so both need the registration, not the directory.
+  const pluginProvides =
+    !!shape.activePluginVersion && pluginIsRegistered({ home: homedir(), settings: readSettings() });
+
+  // MCP. A plugin install answers this from the manifest and does NOT shell out.
+  //
+  // Two reasons, and the first is correctness rather than speed. `claude mcp list` prints a
+  // plugin server as `plugin:claude-mem-lite:mem-lite: …`, and the old substring test
+  // `list.includes('mem-lite:')` matched INSIDE that name — so a plugin user was reported as
+  // having a user-scope registration they do not have, and the branch written for them below
+  // was unreachable. That is the same accidental-match class as the `\bmem\b` regex this
+  // comment block used to describe. Second: the official help says approved servers are
+  // "health-checked", i.e. the call STARTS every MCP server configured on the machine —
+  // measured 2026-09-08 at 2.546s wall for three servers, one of them a remote HTTP endpoint.
+  // A status command should not pay that, and a plugin user gains nothing from it.
+  //
+  // `doctor` GAINS the exec instead (it had none before this change) and runs it
+  // unconditionally: it is the deep check, and it is where the duplicate/legacy registration
+  // the README's "Mixed-install residue" section describes now gets detected — nothing
+  // detected it before. That means `doctor` now health-checks every MCP server on the
+  // machine; both READMEs say so under their `doctor` sections.
+  if (pluginProvides) {
+    push(
+      'ok',
+      'mcp',
+      `MCP server: provided by the plugin manifest (v${shape.activePluginVersion.version} .mcp.json) — no user-scope registration expected`,
+      { registered: false, via: 'plugin' },
+    );
+  } else
+    try {
+      const list = execFileSync('claude', ['mcp', 'list'], { encoding: 'utf8', timeout: 60000 });
+      // Accept either the current "mem-lite" registration or the legacy "mem" name
+      // (pre-v2.78) so a user mid-upgrade still sees a green status until setup.sh /
+      // install.mjs purges the legacy entry on next run.
+      const registered = nonPluginMemRegistrations(list).length > 0;
+      if (registered) {
+        push('ok', 'mcp', 'MCP server: registered', { registered });
+      } else {
+        push('fail', 'mcp', 'MCP server: not registered', { registered });
+      }
+    } catch {
+      push('warn', 'mcp', 'Could not check MCP status', { registered: null });
     }
-  } catch {
-    push('warn', 'mcp', 'Could not check MCP status', { registered: null });
-  }
 
   // Hooks
   const settings = readSettings();
@@ -1707,6 +1879,65 @@ async function doctor() {
     ok('Orphan hooks: none (all hook targets present)');
   }
 
+  // MCP registration. This lives in doctor, not status: `claude mcp list` health-checks —
+  // i.e. STARTS — every MCP server configured on the machine (2.546s wall for three servers,
+  // measured 2026-09-08), which is a cost the deep check can carry and a status line cannot.
+  //
+  // What it buys beyond status: the DUPLICATE. The README's "Mixed-install residue" section
+  // has warned since v3 that a plugin user who once ran the npx/git-clone installer keeps a
+  // bare-name registration that double-registers the server — and nothing in the tool
+  // detected it. Orphan hooks had a check; its MCP twin did not.
+  try {
+    const list = execFileSync('claude', ['mcp', 'list'], { encoding: 'utf8', timeout: 60000 });
+    const bare = nonPluginMemRegistrations(list);
+    // Registration, not directory — see pluginIsRegistered. Crediting a leftover cache dir
+    // here told a working npm-channel install to delete its ONLY MCP registration.
+    const viaPlugin =
+      !!shape?.activePluginVersion && pluginIsRegistered({ home: homedir(), settings: readSettings() });
+    if (viaPlugin && bare.length > 0) {
+      dwarn(
+        `MCP registration: the plugin manifest provides the server AND a bare "${bare.join('", "')}" registration exists — the server is registered twice`,
+      );
+      // No `-s` flag, deliberately: `nonPluginMemRegistrations`'s own docblock says `mcp list`
+      // does not label scope, and this repo's tracked `.mcp.json` registers a bare `mem-lite`
+      // at PROJECT scope, which `-s user` cannot remove. `claude mcp remove` without the flag
+      // removes from whichever scope the entry is in. Every name, not just the first.
+      for (const name of bare) log(`    Fix: claude mcp remove ${name}`);
+    } else if (viaPlugin) {
+      ok('MCP registration: provided by the plugin manifest only (no duplicate)');
+    } else if (bare.length > 0) {
+      ok(`MCP registration: "${bare.join('", "')}" registered`);
+    } else {
+      dwarn('MCP registration: no claude-mem-lite MCP server is registered and no plugin provides one');
+    }
+  } catch (e) {
+    // Third outcome, kept apart from "none found" on purpose: the `claude` CLI may not be on
+    // PATH at all, and a green "no duplicate" would end the reader's search on a check that
+    // never ran.
+    dwarn(`MCP registration: could not run \`claude mcp list\` (${e.code || e.message}) — not checked`);
+  }
+
+  // Marketplace clone updatability — see marketplaceCloneHealth for why this is the
+  // precondition behind the schema-skew lock-in v6.3.0 shipped a detector for.
+  const marketplaceClone = join(homedir(), '.claude', 'plugins', 'marketplaces', MARKETPLACE_KEY);
+  const clone = marketplaceCloneHealth(marketplaceClone);
+  if (clone.kind === 'dirty') {
+    dwarn(`Marketplace clone: ${clone.count} uncommitted change(s) in ${marketplaceClone}`);
+    log(
+      '    Claude Code updates a git-source marketplace by pulling this clone, and a dirty tree blocks the pull —',
+    );
+    log(
+      '    the plugin then stops updating silently, which is how a machine ends up running code older than its DB.',
+    );
+    log(`    Inspect: git -C ${marketplaceClone} status`);
+  } else if (clone.kind === 'unknown') {
+    dwarn(`Marketplace clone: could not check ${marketplaceClone} (${clone.reason}) — not checked`);
+  } else if (clone.kind === 'clean') {
+    ok('Marketplace clone: clean (the marketplace updater can fast-forward it)');
+  }
+  // 'absent' / 'not-git' are silent: an npm-channel or npx user has no marketplace clone,
+  // and a check that reports on a thing you do not have is noise.
+
   // Database
   if (existsSync(DB_PATH)) {
     try {
@@ -1750,6 +1981,11 @@ async function doctor() {
       }
     } catch (e) {
       fail('Database: ' + e.message);
+      // Every other ✗ on this screen carries a remedy; this one used to be the exception,
+      // and a corrupt store is the failure a user is least able to diagnose unaided.
+      // dbCheckRemedy returns null rather than invent one for an error it cannot classify.
+      const remedy = dbCheckRemedy(DB_PATH, e);
+      if (remedy) log(`    ${remedy}`);
       issues++;
     }
   } else {
@@ -2356,6 +2592,41 @@ export function hasOtherMarketplacePlugins(
   return Object.keys(plugins).some((key) => key !== pluginKey && key.endsWith(`@${marketplaceKey}`));
 }
 
+/**
+ * Whether Claude Code actually has this plugin INSTALLED — as opposed to a leftover version
+ * directory sitting in its cache.
+ *
+ * `detectInstallShape`'s `activePluginVersion` is not that question. Its own comment calls its
+ * third tier — the newest cache directory — "a guess, and after a rollback the wrong one", and
+ * a terminal has neither of the first two tiers (`CLAUDE_PLUGIN_ROOT`, `installed_plugins.json`)
+ * after `/plugin uninstall`. `/plugin uninstall` leaves the version dirs behind, which this
+ * project's own README now documents — so "a cache directory exists" is true on machines that
+ * have no plugin at all.
+ *
+ * Using it as "the plugin provides the MCP server" was measured to tell a working npm-channel
+ * install that its server was registered twice, with a remedy that removes its ONLY
+ * registration. Read from the two places that RECORD an installation instead.
+ *
+ * Deliberately NOT `!shape.managed`: a mixed install has both, and that is precisely the state
+ * the duplicate check exists for. Over-narrowing here is safe by construction — the caller
+ * falls back to asking `claude mcp list`, which is the pre-fix behaviour and correct.
+ *
+ * Exported for tests/mcp-registration-parse.test.mjs.
+ */
+export function pluginIsRegistered({ home = homedir(), settings = {} } = {}) {
+  if (isPluginExplicitlyDisabled(settings)) return false;
+  if (settings?.enabledPlugins?.[PLUGIN_KEY] === true) return true;
+  try {
+    const installed = JSON.parse(
+      readFileSync(join(home, '.claude', 'plugins', 'installed_plugins.json'), 'utf8'),
+    );
+    return PLUGIN_KEY in getInstalledPluginEntries(installed);
+  } catch {
+    // Missing or unparseable registry: not evidence of an installation.
+    return false;
+  }
+}
+
 /** Thrown when settings.json exists but is not parseable. Never a reason to write. */
 class SettingsUnparseableError extends Error {}
 
@@ -2624,9 +2895,7 @@ async function repair() {
     console.log('  Automatic repair fails closed rather than run unverified code.');
     console.log('  Manual fallback — run this in any shell (you are choosing to trust it):');
     console.log('');
-    console.log(
-      '  T=$(mktemp -d) && curl -sL https://api.github.com/repos/sdsrss/claude-mem-lite/tarball | tar xz -C "$T" --strip-components=1 && node "$T/install.mjs" install',
-    );
+    console.log(`  ${MANUAL_TARBALL_FALLBACK}`);
     console.log('');
     process.exit(1);
   } finally {

package/lib/data-paths.mjs

@@ -0,0 +1,33 @@
+/**
+ * The three location constants, in a leaf module.
+ *
+ * They lived in `schema.mjs`, which statically imports `better-sqlite3`. That made the
+ * native driver a LOAD-TIME dependency of anything that wanted a path — including
+ * `hook-update.mjs`, which `install.mjs::repair()` imports to reach the Ed25519-verified
+ * release path. Measured 2026-09-08: on a tree with no `node_modules`, that import threw
+ * `ERR_MODULE_NOT_FOUND` from `schema.mjs`, repair() caught it, refused to auto-install
+ * unverified code, and printed the unverified default-branch tarball instead. So the
+ * signature check was unreachable on the one install state the self-heal exists to fix.
+ *
+ * Keep this module free of package imports — `node:` builtins and `lib/resolve-data-dir.mjs`
+ * only. `tests/repair-path-no-native-dep.test.mjs` walks the static import graph from
+ * `hook-update.mjs` and fails on ANY package edge, so a future import here has to argue
+ * with a test rather than silently disarm the repair path.
+ *
+ * `schema.mjs` re-exports all three names, so every existing importer keeps working and
+ * this is not a contract change.
+ */
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { resolveDataDir } from './resolve-data-dir.mjs';
+
+// DATA location — DB, managed resources, registry DB, runtime/. Honors
+// CLAUDE_MEM_DIR so users can relocate state to a larger/faster volume.
+export const DB_DIR = resolveDataDir(process.env.CLAUDE_MEM_DIR);
+export const DB_PATH = join(DB_DIR, 'claude-mem-lite.db');
+// CODE / install location — server.mjs, hook.mjs, cli.mjs, package.json live
+// here. ALWAYS homedir-rooted: Claude Code's settings.json + MCP registration
+// bake ABSOLUTE paths to server.mjs/hooks, so the code must NOT follow the
+// CLAUDE_MEM_DIR relocation env var (mirrors install.mjs INSTALL_DIR). Equals
+// DB_DIR when CLAUDE_MEM_DIR is unset — the common, non-relocated case.
+export const CODE_DIR = join(homedir(), '.claude-mem-lite');

package/lib/db-backup.mjs

@@ -43,26 +43,51 @@ export const BACKUP_EVICTION_GRACE_MS = 7 * DAY_MS;
 // user's hand-made `cp db db.before-upgrade.bak` must never be auto-unlinked.
 const SNAPSHOT_STAMP_RE = /-\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-\d{3}Z-\d+-\d+\.bak$/;
 
-/** All `<db>.<tag>-<ts>.bak` snapshots for `dbPath`, any tag, with size + mtime. */
-export function listSnapshots(dbPath) {
+/**
+ * Snapshots for `dbPath`, keeping "there are none" and "I could not look" APART.
+ *
+ * `listSnapshots` below collapses both into `[]`, which is fine for its callers (a budget
+ * sweep has nothing to do either way) and wrong for anything that REPORTS to a human: a
+ * diagnostic that says "no backup exists" when it actually could not read the directory
+ * ends the reader's search with a false fact. Same rule the doctor bash-hook check
+ * settled on — "nothing to check" and "I could not look" are different answers.
+ *
+ * @returns {{ok: true, snapshots: Array<{path:string,size:number,mtimeMs:number}>}
+ *          | {ok: false, reason: string}}
+ */
+export function readSnapshots(dbPath) {
+  let names;
+  let dir;
+  let prefix;
+  // dirname/basename inside the try, not outside it: `listSnapshots` below has always been
+  // total (it returned [] for any input), and one of this function's callers runs inside
+  // `doctor`'s DB catch block, where the repo's openDb precedent says nothing may throw.
+  // Computing the path outside would make listSnapshots(undefined) a TypeError.
   try {
-    const dir = dirname(dbPath);
-    const prefix = `${basename(dbPath)}.`;
-    const out = [];
-    for (const n of readdirSync(dir)) {
-      if (!n.startsWith(prefix) || !n.endsWith('.bak')) continue;
-      const full = join(dir, n);
-      try {
-        const st = statSync(full);
-        out.push({ path: full, size: st.size, mtimeMs: st.mtimeMs });
-      } catch {
-        /* raced away */
-      }
+    dir = dirname(dbPath);
+    prefix = `${basename(dbPath)}.`;
+    names = readdirSync(dir);
+  } catch (e) {
+    return { ok: false, reason: e?.code || e?.message || 'unreadable' };
+  }
+  const snapshots = [];
+  for (const n of names) {
+    if (!n.startsWith(prefix) || !n.endsWith('.bak')) continue;
+    const full = join(dir, n);
+    try {
+      const st = statSync(full);
+      snapshots.push({ path: full, size: st.size, mtimeMs: st.mtimeMs });
+    } catch {
+      /* raced away */
     }
-    return out;
-  } catch {
-    return [];
   }
+  return { ok: true, snapshots };
+}
+
+/** All `<db>.<tag>-<ts>.bak` snapshots for `dbPath`, any tag, with size + mtime. */
+export function listSnapshots(dbPath) {
+  const r = readSnapshots(dbPath);
+  return r.ok ? r.snapshots : [];
 }
 
 /**

package/lib/plugin-key.mjs

@@ -24,8 +24,11 @@
 /** Marketplace this plugin is published under. */
 export const MARKETPLACE_KEY = 'sdsrss';
 
+/** This plugin's own name — the directory Claude Code materializes versions under. */
+export const PLUGIN_NAME = 'claude-mem-lite';
+
 /** The key Claude Code writes under `enabledPlugins` in `~/.claude/settings.json`. */
-export const PLUGIN_KEY = `claude-mem-lite@${MARKETPLACE_KEY}`;
+export const PLUGIN_KEY = `${PLUGIN_NAME}@${MARKETPLACE_KEY}`;
 
 /**
  * Whether the user has EXPLICITLY switched the plugin off.

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.3.0",
+  "version": "6.4.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "claude-mem-lite",
-      "version": "6.3.0",
+      "version": "6.4.0",
       "os": [
         "darwin",
         "linux",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.3.0",
+  "version": "6.4.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",
@@ -24,6 +24,7 @@
     "format": "prettier --write \"**/*.{mjs,js}\"",
     "format:check": "prettier --check \"**/*.{mjs,js}\"",
     "dead-code": "knip",
+    "validate:manifests": "node scripts/validate-plugin-manifests.mjs",
     "audit:metrics": "node scripts/audit-metrics.mjs --md",
     "audit:baseline": "node scripts/audit-metrics.mjs --run-tests --md",
     "test": "vitest run",
@@ -89,6 +90,7 @@
     "lib/err-sampler.mjs",
     "lib/hook-telemetry.mjs",
     "lib/resolve-data-dir.mjs",
+    "lib/data-paths.mjs",
     "lib/export-columns.mjs",
     "lib/file-intel.mjs",
     "lib/reread-guard.mjs",

package/schema.mjs

@@ -7,22 +7,20 @@ import { homedir } from 'os';
 import { join } from 'path';
 import { existsSync, mkdirSync, readdirSync, renameSync, rmSync, chmodSync } from 'fs';
 import { OBS_FTS_COLUMNS, debugCatch } from './utils.mjs';
-import { resolveDataDir } from './lib/resolve-data-dir.mjs';
 // Imported, never re-declared: a hand-copied marker string is this repo's twin-drift
 // class, and every consumer of the forward-incompat throw keys on this exact value.
 // schema-skew.mjs imports nothing local, so this closes no cycle.
 import { SCHEMA_SKEW_CODE } from './lib/schema-skew.mjs';
 
-// DATA location — DB, managed resources, registry DB, runtime/. Honors
-// CLAUDE_MEM_DIR so users can relocate state to a larger/faster volume.
-export const DB_DIR = resolveDataDir(process.env.CLAUDE_MEM_DIR);
-export const DB_PATH = join(DB_DIR, 'claude-mem-lite.db');
-// CODE / install location — server.mjs, hook.mjs, cli.mjs, package.json live
-// here. ALWAYS homedir-rooted: Claude Code's settings.json + MCP registration
-// bake ABSOLUTE paths to server.mjs/hooks, so the code must NOT follow the
-// CLAUDE_MEM_DIR relocation env var (mirrors install.mjs INSTALL_DIR). Equals
-// DB_DIR when CLAUDE_MEM_DIR is unset — the common, non-relocated case.
-export const CODE_DIR = join(homedir(), '.claude-mem-lite');
+// The three location constants now live in lib/data-paths.mjs — a leaf module with no
+// package imports — and are re-exported here so every existing importer is unchanged.
+// This file statically imports better-sqlite3, so holding a path constant here made the
+// native driver a load-time dependency of anything that wanted one; that is what put the
+// Ed25519-verified repair path out of reach on a tree with no node_modules. Imported AND
+// re-exported (not `export … from`) because schema.mjs uses DB_DIR / DB_PATH itself.
+// See lib/data-paths.mjs and tests/repair-path-no-native-dep.test.mjs.
+import { DB_DIR, DB_PATH, CODE_DIR } from './lib/data-paths.mjs';
+export { DB_DIR, DB_PATH, CODE_DIR };
 
 // Increment when schema changes (tables, columns, indexes, FTS, migrations)
 //

package/scripts/hook-launcher.mjs

@@ -31,6 +31,7 @@ import { spawn, spawnSync } from 'node:child_process';
 import { dirname, join, isAbsolute } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { homedir } from 'node:os';
+import { createHash } from 'node:crypto';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const INSTALL_DIR = join(__dirname, '..');
@@ -65,7 +66,16 @@ const DATA_DIR = MEM_DIR && isAbsolute(MEM_DIR) ? MEM_DIR : join(homedir(), '.cl
 // `tests/runtime-dir-single-home.test.mjs` asserts this file still carries the rule.
 const RUNTIME_DIR = join(DATA_DIR, 'runtime'); // runtime-dir:stays-put — serves swap-in-progress only; HOOK_RUNTIME_DIR carries the hook markers
 const HOOK_RUNTIME_DIR = process.env.CLAUDE_MEM_RUNTIME_DIR || RUNTIME_DIR;
-const HEAL_MARKER = join(HOOK_RUNTIME_DIR, 'hook-launcher-lastheal');
+// Per CODE HOME, not per machine. The runtime dir is data-dir-relative and therefore SHARED
+// by every install shape on this box — a plugin cache version, a managed ~/.claude-mem-lite,
+// a dev checkout. With one global name, a failed heal attempt for root A silenced root B's
+// heal for the next six hours, and the two are repaired by different commands. The suffix is
+// derived from INSTALL_DIR, which is what `cli.mjs repair` below actually acts on.
+//
+// node:crypto only — the pure-`node:` charter above still holds. No migration: a pre-6.4.0
+// unsuffixed marker is simply ignored, which costs at most one extra heal attempt once.
+const INSTALL_KEY = createHash('sha256').update(INSTALL_DIR).digest('hex').slice(0, 12);
+const HEAL_MARKER = join(HOOK_RUNTIME_DIR, `hook-launcher-lastheal-${INSTALL_KEY}`);
 const HEAL_COOLDOWN_MS = 6 * 60 * 60 * 1000;
 // Observable breakage state: written when the launcher degrades a broken install
 // to exit 0, cleared once the install is confirmed healthy. `doctor` reads it so
@@ -89,6 +99,14 @@ const BROKEN_MARKER = join(HOOK_RUNTIME_DIR, 'hook-launcher-broken');
 // SESSION-START only — never on the per-tool hot path, where an npm run would
 // stall the user's edit.
 // Marker dir: HOOK_RUNTIME_DIR (see its definition above for why it is override-aware).
+// BOTH stay machine-wide, unlike HEAL_MARKER above, and the difference is the SUBJECT of the
+// repair. HEAL_MARKER gates `cli.mjs repair`, which fixes THIS install dir. This pair gates
+// the native-binding rebuild, and `install.mjs rebuildBinding()` iterates
+// `shape.runtimeRoots` — "Every code home on this machine, not just the one this file sits
+// in", as its own comment puts it, which is also what install.mjs tells the user. Keying it
+// per code home would let N homes each spawn npm within one 6h window for a repair that
+// already covered all of them. A first cut of this change did exactly that; pre-ship review
+// caught that the justifying comment was false for the command it gates.
 const NB_BROKEN_MARKER = join(HOOK_RUNTIME_DIR, 'native-binding-broken');
 const NB_HEAL_MARKER = join(HOOK_RUNTIME_DIR, 'native-binding-lastheal');
 // Literal, not imported: the pure-`node:` charter above forbids importing lib/
@@ -111,10 +129,13 @@ const CLI_REPAIR = `node ${join(INSTALL_DIR, 'cli.mjs')} repair`;
 
 // Last-resort recovery string for users whose `cli.mjs repair` path
 // itself failed (install.mjs missing / repair errored / retry still drifting).
-// Duplicated in install.mjs::repair() catch; both are reachable when local
-// scripts are broken, so neither can import a shared constant.
+// Duplicated from install.mjs::MANUAL_TARBALL_FALLBACK — the pure-`node:` charter above
+// forbids importing it, and this path is reachable exactly when local scripts are broken.
+// Pinned to that constant by tests/manual-fallback-sync.test.mjs, which also fails if a
+// fifth surface starts hardcoding its own. Resolves the latest RELEASE tag rather than
+// `/tarball` (the default branch, i.e. unreleased WIP).
 const TARBALL_FALLBACK =
-  'T=$(mktemp -d) && curl -sL https://api.github.com/repos/sdsrss/claude-mem-lite/tarball | tar xz -C "$T" --strip-components=1 && node "$T/install.mjs" install';
+  'T=$(mktemp -d) && U=$(curl -sL https://api.github.com/repos/sdsrss/claude-mem-lite/releases/latest | grep -o \'"tarball_url"[^,]*\' | cut -d\'"\' -f4) && curl -sL "$U" | tar xz -C "$T" --strip-components=1 && node "$T/install.mjs" install';
 
 const [, , entryArg, ...rest] = process.argv;
 if (!entryArg) {

package/server.mjs

@@ -7,7 +7,15 @@ import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
 import { ListToolsRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 import { truncate, typeIcon, inferProject, fmtDate, debugLog, debugCatch } from './utils.mjs';
 import { resolveProject as _resolveProjectShared } from './project-utils.mjs';
-import { ensureDbWithWalRecovery, DB_PATH, DB_DIR } from './schema.mjs';
+import { ensureDbWithWalRecovery, DB_PATH, DB_DIR, CODE_DIR } from './schema.mjs';
+// schema.mjs already imports this module for SCHEMA_SKEW_CODE, so it is in the graph before
+// the DB is touched — a static import here adds no cold-start cost.
+import {
+  isSchemaSkewError,
+  schemaSkewFromError,
+  schemaSkewRemedy,
+  formatSchemaSkewNotice,
+} from './lib/schema-skew.mjs';
 import { reRankWithContext, runIdleCleanup, buildServerInstructions } from './search-scoring.mjs';
 import { searchObservationsHybrid } from './search-engine.mjs';
 import {
@@ -153,6 +161,54 @@ try {
     info: (m) => debugLog('INFO', 'server', m),
   });
 } catch (err) {
+  // Schema skew gets the same treatment as the CLI (mem-cli.mjs) and for the same reason:
+  // the raw message ends in `npm i -g claude-mem-lite@latest`, which repairs nothing on the
+  // plugin-cache install that actually hits this.
+  //
+  // This branch has to live HERE rather than in scripts/launch.mjs, which already knows how
+  // to format the notice. server.mjs opens the DB while it is being imported, so the throw
+  // is caught by this block and `process.exit(1)` runs before the launcher's own catch can
+  // ever see it — the launcher's handler is unreachable for this one error. Re-throwing
+  // instead would fix the plugin path and break the npm one, because install.mjs registers
+  // `claude mcp add ... -- node <SERVER_PATH>`, launching this file with no launcher above
+  // it to catch anything. Emitting from here covers both, and the launcher's copy stays as
+  // the handler for failures that happen before this module is reached.
+  if (isSchemaSkewError(err)) {
+    const skew = schemaSkewFromError(err) || { dbVersion: null, binaryVersion: null };
+    let shape = { managed: false, activePluginVersion: null };
+    let dev = false;
+    try {
+      const [shapeMod, updateMod] = await Promise.all([
+        import('./lib/install-shape.mjs'),
+        import('./hook-update.mjs'),
+      ]);
+      // CODE_DIR, not DB_DIR: `hasManagedCodeInstall` looks for server.mjs + hook.mjs inside
+      // whatever it is handed, and DB_DIR follows CLAUDE_MEM_DIR. Handing it the relocated DATA
+      // dir reports `managed: false` for a machine that has a managed install, so the remedy
+      // came out as "could not identify this install" or, with any plugin cache present, the
+      // plugin commands printed under a line naming ~/.claude-mem-lite. The three sibling call
+      // sites (mem-cli.mjs, hook.mjs, scripts/launch.mjs) all pass the CODE dir.
+      shape = shapeMod.detectInstallShape({ installDir: CODE_DIR });
+      dev = updateMod.isDevMode();
+    } catch {
+      /* shape unknown → schemaSkewRemedy answers 'unknown', which is its job */
+    }
+    const codeHome = process.env.CLAUDE_PLUGIN_ROOT || import.meta.dirname;
+    console.error(
+      formatSchemaSkewNotice({
+        dbVersion: skew.dbVersion,
+        binaryVersion: skew.binaryVersion,
+        remedy: schemaSkewRemedy({
+          managed: shape.managed,
+          activePluginVersion: shape.activePluginVersion,
+          dev,
+          root: codeHome,
+        }),
+        codeHome,
+      }),
+    );
+    process.exit(1);
+  }
   // Fatal: log and exit with descriptive message (Claude Code shows stderr)
   console.error(`[claude-mem-lite] FATAL: Database cannot be opened: ${err.message}`);
   if (err.walRecoveryAttempted) {

package/source-files.mjs

@@ -55,6 +55,11 @@ export const SOURCE_FILES = [
   // AND hook scripts (pre-tool-recall / post-tool-recall) — ship it
   // or auto-update leaves schema + every hook with ERR_MODULE_NOT_FOUND on each fire.
   'lib/resolve-data-dir.mjs',
+  // DB_DIR / DB_PATH / CODE_DIR. Statically imported by schema.mjs (which re-exports all
+  // three) and by hook-update.mjs, which takes them from HERE so the verified repair path
+  // stays loadable without better-sqlite3. Missing from the manifest → auto-update leaves
+  // schema.mjs and the repair path with ERR_MODULE_NOT_FOUND on every fire.
+  'lib/data-paths.mjs',
   // lib/ — statically imported by hook-llm.mjs (activity) + hook-handoff.mjs (git-state, task-reader);
   // dynamically imported by hook.mjs (startup-dashboard) + mem-cli.mjs (doctor-benchmark, plan-reader).
   'lib/activity.mjs',

package/tool-schemas.mjs

@@ -256,7 +256,15 @@ export const memGetSchema = {
 };
 
 export const memDeleteSchema = {
-  ids: coerceIntArray.pipe(z.array(z.number().int()).min(1).max(50)).describe('Observation IDs to delete'),
+  // `.nonoptional()` is not a runtime change — zod already rejected an omitted `ids` here.
+  // It is what keeps the field in the PUBLISHED JSON Schema's `required` array: zod 4's
+  // toJSONSchema({io:'input'}) reads a ZodPipe's input side as accepting `undefined` and
+  // drops the key, so the advertised contract said optional while the server said required.
+  // See tests/tool-schemas.test.mjs, which grades every field against runtime ground truth.
+  ids: coerceIntArray
+    .pipe(z.array(z.number().int()).min(1).max(50))
+    .nonoptional()
+    .describe('Observation IDs to delete'),
   confirm: coerceBool.describe('false=preview what will be deleted, true=execute deletion'),
 };
 
@@ -433,7 +441,8 @@ export const memMaintainSchema = {
 };
 
 export const memUpdateSchema = {
-  id: coerceInt.pipe(z.number().int().positive()).describe('Observation ID to update'),
+  // `.nonoptional()` for the published-`required` reason documented on memDeleteSchema.ids.
+  id: coerceInt.pipe(z.number().int().positive()).nonoptional().describe('Observation ID to update'),
   // CLI parity (cmdUpdate): empty/whitespace title would render as `(untitled)`
   // in every listing — reject here like the CLI does, instead of persisting it.
   title: z
@@ -541,6 +550,10 @@ export const memDeferDropSchema = {
       coerceInt.pipe(z.number().int().positive()),
       z.string().regex(/^D#\d+$/, 'expected D#N or positive integer'),
     ])
+    // `.nonoptional()` for the published-`required` reason documented on memDeleteSchema.ids.
+    // This is the CORE tool of the three — it ships in tools/list, so the drift was visible
+    // to every agent, and the tool's own description already calls the reason "required".
+    .nonoptional()
     .describe('Deferred item id — accepts D#N (raw id) or positive integer (ordinal-within-project)'),
   reason: z.string().min(1).max(500).describe('Why this item is being dropped (required for audit trail)'),
   project: z.string().optional().describe('Project name (default: inferred from CWD)'),