claude-mem-lite 6.5.0 → 6.7.0

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "6.5.0",
+      "version": "6.7.0",
       "source": "./",
       "homepage": "https://github.com/sdsrss/claude-mem-lite",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.5.0",
+  "version": "6.7.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/README.md

@@ -549,7 +549,8 @@ node install.mjs install              # Install and configure
 node install.mjs uninstall            # Remove (keep data)
 node install.mjs uninstall --purge    # Remove and delete all data
 node install.mjs status               # Show current status
-node install.mjs doctor               # Diagnose issues
+node cli.mjs doctor                   # Diagnose issues  (cli.mjs, not install.mjs — see note)
+node cli.mjs repair                   # Recover a broken install from the latest signed release
 node install.mjs cleanup-hooks        # Remove only stale claude-mem-lite hooks from settings.json
 node install.mjs update               # Force-check for updates and install them (direct install / npx mode)
 
@@ -559,6 +560,13 @@ npx claude-mem-lite uninstall         # Remove (keep data)
 npx claude-mem-lite doctor            # Diagnose issues
 ```
 
+> `doctor` and `repair` are spelled `cli.mjs`, not `install.mjs`, on purpose. Those two are
+> the commands you reach for when the install is already broken, and `install.mjs` resolves
+> around a dozen static imports before its first line runs — one missing file and it exits
+> with a Node stack instead of telling you which file. `cli.mjs` has no static local imports
+> and catches that, naming the file and a repair command. Everything else in the list is
+> unaffected either way.
+
 Notes:
 - Plugin mode only reports available updates; it does not self-update plugin files.
   To upgrade an installed plugin to the latest published version, run **inside Claude Code**:
@@ -594,7 +602,7 @@ git fetch --tags && git checkout v3.62.0
 # 4. To leave the pin later: git checkout main, then the normal update flow.
 ```
 
-Your data directory (`~/.claude-mem-lite/`) is untouched by install/rollback; schema migrations are forward-only, so after rolling back more than one minor version check `node install.mjs doctor` before trusting search results.
+Your data directory (`~/.claude-mem-lite/`) is untouched by install/rollback; schema migrations are forward-only, so after rolling back more than one minor version check `node cli.mjs doctor` before trusting search results.
 
 ### doctor
 
@@ -896,7 +904,8 @@ benchmark and A/B harness are calibrated against — changing them invalidates t
 | `MEM_DISABLE_CITATION_DECAY` | `1` disables only the decay writes, keeping access-count bumps. | _(enabled)_ |
 | `CLAUDE_MEM_CITATION_ADOPTION_THRESHOLD` | **Removed — inert.** Tuned the per-project adoption gate, which is gone (D#204). Setting it warns on stderr and changes nothing. | _(n/a)_ |
 | `CLAUDE_MEM_NO_CITE_NUDGE` | `1` fully silences the cite-back nudge. | _(enabled)_ |
-| `CLAUDE_MEM_CITE_NUDGE_THRESHOLD` | Cite-rate below which the nudge fires. | `0.6` |
+| `CLAUDE_MEM_CITE_NUDGE_THRESHOLD` | Cite-rate below which the nudge fires. | `0.4` |
+| `CLAUDE_MEM_CITE_NUDGE_WIDE_DENOMINATOR` | `1` judges the wide cite-recall ratio (every `#NN`-shaped token the model saw) instead of the lessons the hooks injected. **Half of the revert**: the threshold moved too, so pre-v6.6.0 gating needs this **and** `CLAUDE_MEM_CITE_NUDGE_THRESHOLD=0.6`. This switch alone gives you the wide ratio judged at 0.4, which is neither release's behaviour. | unset |
 | `CLAUDE_MEM_CITE_NUDGE_MIN_INJECTED` | Minimum injection volume before the ratio gate is judged at all. | `5` |
 | `CLAUDE_MEM_CITE_NUDGE_SILENCE_AFTER` | Consecutive low-cite sessions before the nudge goes quiet; `0` = never silence. | `3` |
 | `CLAUDE_MEM_CITATION_RELEVANCE_GATE` | Stop credits an `access_count` to a memory the session cited only when something made that memory relevant to the session — it was injected, or you typed its `#NN` yourself. `off` restores the pre-v3.84.0 behaviour of crediting every `#NN` the assistant wrote, which over-counts sessions that discuss memories in prose (release notes, audit reports): measured on real transcripts, 267 of 859 credited (id, session) pairs — 31.1% — were mentions nothing had put in front of the model. Superseded citations are redirected to their keeper on both settings. | _(on)_ |

package/README.zh-CN.md

@@ -461,7 +461,8 @@ node install.mjs install              # 安装并配置
 node install.mjs uninstall            # 移除（保留数据）
 node install.mjs uninstall --purge    # 移除并删除所有数据
 node install.mjs status               # 显示当前状态
-node install.mjs doctor               # 诊断问题
+node cli.mjs doctor                   # 诊断问题（用 cli.mjs 而非 install.mjs，见下方说明）
+node cli.mjs repair                   # 从最新签名发布恢复损坏的安装
 node install.mjs cleanup-hooks        # 只清理 settings.json 中残留的 claude-mem-lite hooks
 node install.mjs update               # 强制检查并安装更新（direct install / npx 模式）
 
@@ -472,6 +473,11 @@ npx claude-mem-lite doctor            # 诊断问题
 ```
 
 说明：
+- `doctor` 与 `repair` 写成 `cli.mjs` 而不是 `install.mjs`，是有意的。这两条恰恰是安装
+  已经坏掉时才会用到的命令，而 `install.mjs` 在执行第一行代码之前要解析十几个静态
+  import——少一个文件就直接吐一段 Node 栈，而不是告诉你少了哪个文件。`cli.mjs` 没有
+  任何本地静态 import，会捕获这种失败并说出缺失的文件和修复命令。列表中其余命令两种
+  写法都一样。
 - 插件模式只提示可用更新，不会自更新插件文件。
 - direct install / npx 模式保留自动更新，并使用 staged replacement；若依赖安装失败会回滚。
 - 如果你禁用了插件，但 `~/.claude/settings.json` 里还有旧的 mem hooks，可运行 `node install.mjs cleanup-hooks`。

package/cli.mjs

@@ -30,6 +30,77 @@ const CLI_COMMANDS = new Set([
 // Kept as a named set so a stale script or muscle-memory invocation gets the reason rather
 // than a bare "Unknown command" plus a misleading edit-distance suggestion.
 const REMOVED_COMMANDS = new Set(['registry', 'import', 'enrich']);
+
+// D#26 / R12 P1-1, second half. `doctor` and `repair` exist to tell a user which
+// file their install is missing. Until now, on exactly that install, they did not
+// run: install.mjs's ~13 static imports resolve BEFORE its first line executes, so
+// one absent module killed the command with a bare ERR_MODULE_NOT_FOUND and zero
+// bytes of stdout. A half-finished update, a trimmed tarball (this repo has
+// shipped three) or a hand-deleted file all land there — CLAUDE.md's "a recovery
+// path must not import the thing it recovers", on the startup edge.
+//
+// A static import cannot be caught inside the module that declares it, so the
+// catch lives one entry up. THIS file is the host because it is the published
+// `bin` and because its own static closure is one file — itself; every route
+// below is an `await import()`. Whatever this prints must therefore rely on
+// nothing but the language, the same charter scripts/hook-launcher.mjs follows:
+// no local import may appear here, or the fallback shares the fate it reports on.
+//
+// The remedy is deliberately NOT `install.mjs repair` — that is the file that
+// would not load. It has to come from outside the broken tree.
+// THREE shapes, not one. The first cut caught only ERR_MODULE_NOT_FOUND, and pre-ship
+// review pointed out that an interrupted write leaves a file PRESENT and truncated far
+// more often than it leaves it absent: that arrives as a SyntaxError, and a truncated
+// install.mjs arrives as neither — the module loads and simply has no `main`, which
+// died at the call site with "main is not a function". All three are the same fact
+// about the world (this install's files are not intact) and get the same answer.
+// Anything else is rethrown: this is a classifier, not a swallow.
+function explainBrokenInstall(what) {
+  const w = (s) => process.stderr.write(`[claude-mem-lite] ${s}\n`);
+  w(`This install is incomplete — ${what}`);
+  w('That is why this command cannot run: these files load before any of their code executes.');
+  w('Repair: npm install -g claude-mem-lite@latest --force');
+  w('Or, in Claude Code: /plugin uninstall claude-mem-lite && /plugin install claude-mem-lite@sdsrss');
+  process.exit(1);
+}
+
+/**
+ * Absolute path out of an error that carries one, or null.
+ *
+ * ERR_MODULE_NOT_FOUND carries `url`. An ESM SyntaxError carries NOTHING —
+ * measured on Node 26: `url` and `code` both undefined, message a bare
+ * "Unexpected end of input", every stack frame a node-internal loader. So the
+ * caller must be able to say its piece without a filename rather than printing
+ * "undefined", and naming the damaged file would take a `node --check` scan of
+ * the install, which is a bigger thing than this line.
+ */
+function fileFromError(e) {
+  const m = String(e?.url || e?.stack || e?.message || '').match(/file:\/\/(\/[^\s:)'"]+)/);
+  if (m) return m[1];
+  const quoted = String(e?.message || '').match(/'([^']+\.mjs)'/);
+  return quoted ? quoted[1] : null;
+}
+
+async function loadInstaller() {
+  let mod;
+  try {
+    mod = await import('./install.mjs');
+  } catch (e) {
+    if (e?.code === 'ERR_MODULE_NOT_FOUND') {
+      explainBrokenInstall(`it is missing: ${fileFromError(e) || 'a module'}`);
+    }
+    // Never reprint the parser's own output: the stack is what this exists to replace.
+    if (e instanceof SyntaxError) {
+      const at = fileFromError(e);
+      explainBrokenInstall(`this file is damaged or truncated: ${at || 'one of its modules'}`);
+    }
+    throw e;
+  }
+  if (typeof mod?.main !== 'function') {
+    explainBrokenInstall('install.mjs loaded but exports no `main` — it is truncated');
+  }
+  return mod;
+}
 const INSTALL_COMMANDS = new Set([
   'install',
   'uninstall',
@@ -90,11 +161,11 @@ if (cmd === '--version' || cmd === '-v' || cmd === '-V' || cmd === 'version') {
     const { run } = await import('./mem-cli.mjs');
     await run(['help']);
   } else {
-    const { main } = await import('./install.mjs');
+    const { main } = await loadInstaller();
     await main([]);
   }
 } else if (INSTALL_COMMANDS.has(cmd)) {
-  const { main } = await import('./install.mjs');
+  const { main } = await loadInstaller();
   await main(process.argv.slice(2));
 } else if (REMOVED_COMMANDS.has(cmd)) {
   // Released-artifact discoverability signal for the skill-registry removal. Deliberately

package/hook-context.mjs

@@ -336,6 +336,69 @@ export function selectWithTokenBudget(db, project, budget = 2000) {
  * removes the paired hint comment if present, and normalizes residual whitespace
  * at the seam. Uses atomic tmp+rename write.
  */
+/**
+ * Half-open [start, end) ranges of every fenced code span in a markdown document.
+ *
+ * A fence opens on a line whose first non-space run is three or more backticks or tildes,
+ * and closes on the next line opening with at least as many of the SAME character — CommonMark's
+ * rule, and the reason a ```` ```` ```` block can contain a ``` line. An unterminated fence
+ * runs to EOF.
+ */
+function fencedRanges(content) {
+  const ranges = [];
+  let open = null;
+  let offset = 0;
+  for (const line of content.split('\n')) {
+    const m = /^ {0,3}(`{3,}|~{3,})/.exec(line);
+    if (m) {
+      if (!open) {
+        open = { char: m[1][0], len: m[1].length, start: offset };
+      } else if (m[1][0] === open.char && m[1].length >= open.len) {
+        ranges.push([open.start, offset + line.length]);
+        open = null;
+      }
+    }
+    offset += line.length + 1; // +1 for the '\n' split removed
+  }
+  if (open) ranges.push([open.start, content.length]);
+  return ranges;
+}
+
+/** True when `idx` sits inside a backtick-delimited inline code span on its own line. */
+function insideInlineCode(content, idx) {
+  const lineStart = content.lastIndexOf('\n', idx - 1) + 1;
+  // Count backtick RUNS before the position; an odd count means the position is inside a
+  // span. Runs, not characters: ``code with ` inside`` is one span opened by two ticks.
+  const before = content.slice(lineStart, idx);
+  const runs = before.match(/`+/g);
+  return runs !== null && runs.length % 2 === 1;
+}
+
+/**
+ * The last index of `needle` that is a real block's tag, or -1.
+ *
+ * Three exclusions, and the pre-ship review is why there are three rather than one. A
+ * legacy block written by the old `updateClaudeMd` put its tags at COLUMN 0 on their own
+ * lines, so anything else is prose ABOUT the tag:
+ *   - inside a fenced code span (```/~~~)          — the first cut, and only a third of it
+ *   - not at the start of a line                    — an inline mention mid-sentence
+ *   - indented four or more spaces                  — CommonMark's other code block
+ * Measured before the widening, with the shipped function: an inline span went 101 -> 55
+ * bytes and an indented block 95 -> 33, atomically, with no backup.
+ */
+function lastIndexOutsideFences(content, needle, ranges) {
+  let idx = content.lastIndexOf(needle);
+  while (idx !== -1) {
+    const lineStart = content.lastIndexOf('\n', idx - 1) + 1;
+    const indent = content.slice(lineStart, idx);
+    const atLineStart = indent.length === 0;
+    const inFence = ranges.some(([a, b]) => idx >= a && idx < b);
+    if (atLineStart && !inFence && !insideInlineCode(content, idx)) return idx;
+    idx = content.lastIndexOf(needle, idx - 1);
+  }
+  return -1;
+}
+
 export function cleanupClaudeMdLegacyBlock() {
   // v2.48 P2-4: idempotent marker. First run (whether it finds a block or not,
   // whether CLAUDE.md exists or not) drops a project-scoped marker in RUNTIME_DIR.
@@ -369,10 +432,21 @@ export function cleanupClaudeMdLegacyBlock() {
   const startTag = '<claude-mem-context>';
   const endTag = '</claude-mem-context>';
 
-  // Use lastIndexOf so documentation references to the tag earlier in the file
-  // (e.g. inside a code block in architecture notes) are not accidentally swept.
-  const startIdx = content.lastIndexOf(startTag);
-  const endIdx = content.lastIndexOf(endTag);
+  // A4 (audit 2026-09-08): `lastIndexOf` alone was NOT the protection the old comment
+  // here claimed. It shields a documentation reference only when a real block sits AFTER
+  // it; when the file's only occurrence IS the reference — the ordinary case for someone
+  // who wrote down what this plugin emits — both searches land on it, `startIdx < endIdx`
+  // holds, and the user's fenced sample is deleted with its two fences spliced into a
+  // broken ``````. Atomic write, no backup, once per project, so it shows up as a small
+  // stray diff days later. Measured on a plain 226-byte CLAUDE.md: 226 → 145.
+  //
+  // "The tag is alone on its line" does not discriminate — inside a fence it usually is.
+  // The fence itself is the signal, so fenced spans are excluded before the search, and an
+  // UNTERMINATED fence is treated as running to EOF: that errs toward leaving the file
+  // alone, which is the safe direction for a write into someone's own notes.
+  const fenced = fencedRanges(content);
+  const startIdx = lastIndexOutsideFences(content, startTag, fenced);
+  const endIdx = lastIndexOutsideFences(content, endTag, fenced);
   if (startIdx === -1 || endIdx === -1 || startIdx >= endIdx) {
     dropMarker();
     return;

package/hook-llm.mjs

@@ -279,7 +279,7 @@ export function saveObservation(obs, projectOverride, sessionIdOverride, externa
         `
       SELECT title FROM observations
       WHERE project = ? AND created_at_epoch > ?
-      ORDER BY created_at_epoch DESC LIMIT 10
+      ORDER BY created_at_epoch DESC, id DESC LIMIT 10
     `,
       )
       .all(project, fiveMinAgo);
@@ -313,7 +313,7 @@ export function saveObservation(obs, projectOverride, sessionIdOverride, externa
           `
         SELECT title FROM observations
         WHERE project = ? AND created_at_epoch > ? AND created_at_epoch <= ?
-        ORDER BY created_at_epoch DESC LIMIT 60
+        ORDER BY created_at_epoch DESC, id DESC LIMIT 60
       `,
         )
         .all(project, threeDaysAgo, fiveMinAgo);
@@ -331,7 +331,7 @@ export function saveObservation(obs, projectOverride, sessionIdOverride, externa
           `
         SELECT minhash_sig FROM observations
         WHERE project = ? AND created_at_epoch > ? AND minhash_sig IS NOT NULL
-        ORDER BY created_at_epoch DESC LIMIT 200
+        ORDER BY created_at_epoch DESC, id DESC LIMIT 200
       `,
         )
         .all(project, sevenDaysAgo);
@@ -1383,7 +1383,7 @@ export async function handleLLMSummary() {
       FROM observations
       WHERE memory_session_id = ?
         AND ${notLowSignalTitleClause('')}
-      ORDER BY created_at_epoch DESC
+      ORDER BY created_at_epoch DESC, id DESC
       LIMIT 30
     `,
       )
@@ -1585,28 +1585,33 @@ ${obsList}`;
 // spinning up the full LLM dispatcher. Lets the e2e leak test verify that
 // the observations INSERT path scrubs all configured text fields.
 export const __insertObservationForTest = (db, obs) => {
+  // R11 C-P3-3: this used to hand-spell an 18-column INSERT of its own while the
+  // shipping writer above went through insertObservationRow's 19-column list, so the
+  // secret-scrub leak test asserted on a REPLICA of the write point rather than the
+  // write point. Column-list drift between the two is exactly what
+  // lib/observation-write.mjs exists to make impossible, and a test copy is the one
+  // caller that can drift without anyone noticing — it has no user.
   const safe = scrubRecord('observations', obs);
-  db.prepare(
-    `INSERT INTO observations (memory_session_id, project, text, type, title, subtitle, narrative, concepts, facts, files_read, files_modified, importance, minhash_sig, lesson_learned, search_aliases, branch, created_at, created_at_epoch)
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-  ).run(
-    obs.session_id,
-    obs.project,
-    safe.text,
-    'change',
-    safe.title,
-    safe.subtitle,
-    safe.narrative,
-    safe.concepts,
-    safe.facts,
-    obs.files_read,
-    obs.files_modified,
-    obs.importance,
-    obs.minhash_sig,
-    safe.lesson_learned,
-    safe.search_aliases,
-    obs.branch,
-    new Date().toISOString(),
-    Date.now(),
-  );
+  const now = new Date();
+  return insertObservationRow(db, {
+    memory_session_id: obs.session_id,
+    project: obs.project,
+    text: safe.text,
+    type: 'change',
+    title: safe.title,
+    subtitle: safe.subtitle,
+    narrative: safe.narrative,
+    concepts: safe.concepts,
+    facts: safe.facts,
+    files_read: obs.files_read,
+    files_modified: obs.files_modified,
+    importance: obs.importance,
+    minhash_sig: obs.minhash_sig,
+    lesson_learned: safe.lesson_learned,
+    search_aliases: safe.search_aliases,
+    branch: obs.branch,
+    created_at: now.toISOString(),
+    created_at_epoch: now.getTime(),
+    scope: normalizeScope(obs.scope),
+  });
 };

package/hook-memory.mjs

@@ -8,12 +8,9 @@ import {
   OBS_BM25,
   notLowSignalTitleClause,
   noisePenaltyClause,
-  tokenizeHandoff,
-  HANDOFF_STOP_WORDS,
-  extractCjkKeywords,
   neutralizeContextDelimiters,
 } from './utils.mjs';
-import { upsFtsQuery } from './lib/ups-query.mjs';
+import { upsFtsQuery, upsQueryTerms } from './lib/ups-query.mjs';
 import { citeFactorJs, TYPE_QUALITY, TYPE_QUALITY_DEFAULT } from './scoring-sql.mjs';
 import { liveObsFilterSql } from './lib/inject-search-core.mjs';
 import { recordMetric } from './lib/metrics.mjs';
@@ -169,17 +166,6 @@ function getCrossProjectBoost() {
   const n = parseFloat(raw);
   return Number.isFinite(n) && n >= 0 && n <= 1 ? n : 0.4;
 }
-function extractQueryTerms(text) {
-  if (!text) return [];
-  const ascii = tokenizeHandoff(text).filter((t) => !HANDOFF_STOP_WORDS.has(t));
-  let cjk = [];
-  try {
-    cjk = extractCjkKeywords(text) || [];
-  } catch {
-    /* CJK extraction best-effort */
-  }
-  return [...new Set([...ascii, ...cjk.map((t) => String(t).toLowerCase())])];
-}
 // v2.41: hay spans every FTS column whose BM25 weight is >=5 in OBS_BM25
 // (title=10, subtitle=5, narrative=5, lesson_learned=8). Pre-v2.41 was only
 // title + lesson_learned — rows that matched on narrative but happened to
@@ -509,7 +495,16 @@ export function searchRelevantMemories(
     let coverageFiltered = aboveThreshold;
     const coverageThreshold = getCoverageThreshold();
     if (coverageThreshold > 0) {
-      const queryTerms = extractQueryTerms(userPrompt);
+      // A1: the denominator is the terms the query was actually BUILT from, via the one
+      // source (lib/ups-query.mjs -> nlp.mjs::ftsQueryTokens). Counting anything else
+      // counts terms that were never searched, so no matched row can cover them and the
+      // ratio falls with prompt length until the whole surface goes silent.
+      //
+      // The first cut of this fix shared only maxChars and the pre-ship review measured
+      // the hole it left: sanitizeFtsQuery also caps at maxTokens = 64, so a 1511-character
+      // prompt — under the char cap, where the shared cut is a no-op — still returned []
+      // against a row whose narrative was the entire prompt.
+      const queryTerms = upsQueryTerms(userPrompt);
       if (queryTerms.length >= COVERAGE_MIN_QUERY_TERMS) {
         coverageFiltered = aboveThreshold.filter(
           (r) => candidateCoverage(r, queryTerms) >= coverageThreshold,

package/hook-optimize.mjs

@@ -1517,6 +1517,13 @@ export async function executeSmartCompressCluster(db, observations, project) {
       //
       // optimized_at is not in OBS_COLUMNS, so it stays a separate UPDATE below — the
       // summary must be marked processed so the re-enrich pools do not pick it up.
+      //
+      // R11 C-P3-2 read the three-item list above as a completeness claim and asked why
+      // the fourth OBS_COLUMNS entry, `scope`, is absent. It is absent on purpose: the
+      // merge prompt does not ask for one, so there is no value to pass, and NULL is the
+      // `scopes` backfill pool's own predicate (findReenrichCandidates, scope==='scopes')
+      // — which is deliberately NOT gated on optimized_at, so stamping this row processed
+      // does not evict it. Writing a guessed scope here would.
       const newId = insertObservationRow(db, {
         memory_session_id: sessionId,
         project,

package/hook.mjs

@@ -1406,6 +1406,34 @@ function trackCitationsAtStop(db, { sessionId, project, ccSessionId, transcriptP
       // which was ~all of the cost.)
       try {
         const stats = computeCiteRecall(transcriptPath);
+        // D#19: the RATIO GATE's own denominator, alongside the wide one. `stats` counts
+        // every `#NN`-shaped token in non-assistant text — tool_result bodies, file
+        // contents, CLI output, pasted reports — which is the right caliber for "what has
+        // the model seen" and the wrong one for "did it cite back what the hooks gave it"
+        // (measured 11.2x inflation, R11-B-P2-2). Both are persisted; buildCiteRecallNudge
+        // gates on this pair and falls back to the wide one for older payloads.
+        //
+        // Cost is an array iteration, not a parse: this block runs after the decay loop's
+        // own extractInjectedBySurface on the same path, and lib/transcript-scan.mjs memoizes
+        // the parse. mainOnly mirrors the decay loop — an id injected only inside a subagent
+        // would otherwise enter the denominator while its citation lands in another
+        // transcript, scoring a miss the main thread never had a chance to avoid.
+        let gate = { gateInjected: null, gateRecalled: null, gateRatio: null };
+        try {
+          const gateInjectedIds = unionSurfaces(extractInjectedBySurface(transcriptPath, { mainOnly: true }));
+          const gateCited = extractCitationsFromTranscript(transcriptPath, { mainOnly: true });
+          let hit = 0;
+          for (const id of gateInjectedIds) if (gateCited.has(id)) hit++;
+          gate = {
+            gateInjected: gateInjectedIds.size,
+            gateRecalled: hit,
+            gateRatio: gateInjectedIds.size > 0 ? hit / gateInjectedIds.size : 0,
+          };
+        } catch (e) {
+          // Leaving the gate* keys null is the defined fallback, not a silent loss: the
+          // reader treats a payload without them exactly like a pre-release one.
+          debugCatch(e, 'handleStop-cite-recall-gate-denominator');
+        }
         // B2 (v2.83.1): also persist the bugfix-shape nudge/save delta so
         // the next SessionStart can surface "N unsaved bugfix-shape edits"
         // alongside cite-recall. Same scan target (transcript already in OS
@@ -1422,11 +1450,13 @@ function trackCitationsAtStop(db, { sessionId, project, ccSessionId, transcriptP
         // always said. Stop fires once per assistant TURN, so incrementing here silenced
         // the nudge inside the first session — this machine read lowStreak 58 against 26
         // transcripts before the fix.
-        const { lowStreak, streakBase, lastStreakSession } = nextCiteStreakState(
-          prevPayload,
-          ccSessionId,
-          stats,
-        );
+        // D#19: the streak advances on the SAME gate the nudge fires on, so the merged
+        // stats go in. Handing it the wide triple alone would let the streak climb on a
+        // verdict the SessionStart surface never reached — two policies, one counter.
+        const { lowStreak, streakBase, lastStreakSession } = nextCiteStreakState(prevPayload, ccSessionId, {
+          ...stats,
+          ...gate,
+        });
         // G3: finalized-in-conversation + zero deliberate persistence →
         // decisionSignal rides the payload; next SessionStart reminds once.
         let decisionSignal = null;
@@ -1449,6 +1479,7 @@ function trackCitationsAtStop(db, { sessionId, project, ccSessionId, transcriptP
         }
         const payload = {
           ...stats,
+          ...gate,
           ...bugfixStats,
           lowStreak,
           streakBase,
@@ -1593,8 +1624,9 @@ async function handleStop() {
 
 // Build the SessionStart nudge line shown when the prior session's cite-recall
 // fell below threshold. Empty string = no surface (insufficient signal, recall
-// already healthy, or feature opted-out via env). Default threshold 0.6,
-// min injected 5 — both env-overridable for ops tuning + tests.
+// already healthy, or feature opted-out via env). Default threshold 0.4 against the
+// HOOK-INJECTED denominator (v6.6.0, D#19), min injected 5 — both env-overridable for
+// ops tuning + tests; CLAUDE_MEM_CITE_NUDGE_WIDE_DENOMINATOR=1 restores the wide one.
 // Thin wrapper: lib/cite-back-hint.mjs owns the logic so it stays unit-tested.
 // Passing module-level RUNTIME_DIR keeps the call site identical to pre-v2.83.1.
 function buildCiteRecallNudge(project) {