claude-mem-lite 6.8.1 → 6.8.2

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "6.8.1",
+      "version": "6.8.2",
       "source": "./",
       "homepage": "https://github.com/sdsrss/claude-mem-lite",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.8.1",
+  "version": "6.8.2",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/bash-utils.mjs

@@ -2,6 +2,13 @@
 // Extracted from utils.mjs for focused responsibility
 
 import { basename } from 'path';
+// One import into a module that had exactly one, and it buys the single home for
+// the file_path/notebook_path rule (lib/file-edge-match.mjs's own header: "a second
+// copy is exactly what produced R12 B-1"). No cycle: file-edge-match reaches only
+// project-utils + scrub-record -> secret-scrub -> private-strip, none of which
+// import this file. Cold-start scripts are unaffected — scripts/pre-tool-recall.js
+// deliberately imports nothing from the utils.mjs barrel that re-exports this.
+import { toolEditPath } from './lib/file-edge-match.mjs';
 
 // Read/search commands whose output legitimately contains "error"-like keywords without
 // being a failure. Matched against the PRIMARY command (see isReadOnlyCommand).
@@ -441,7 +448,16 @@ export function extractFilePaths(input) {
   // Direct fields (Edit/Write file_path) are kept unconditionally — an explicit edit to a
   // /tmp path is real work the user chose to make, unlike a /tmp path that merely appears as
   // a transient argument inside a Bash command (excluded as noise in the command branch below).
-  if (input.file_path) paths.push(input.file_path);
+  //
+  // `toolEditPath`, not a fourth hand-spelling of the same rule: this function knew
+  // file_path/path/filePath and not `notebook_path`, while hooks.json matches PostToolUse
+  // on `Edit|Write|NotebookEdit` and EDIT_TOOLS already counts NotebookEdit as significant.
+  // A notebook edit therefore produced a captured, significant episode entry carrying NO
+  // files, so the observation built from it got no observation_files edge and no file-keyed
+  // recall could reach it. Same root cause as R12 B-2; the fourth site, and the one its
+  // own follow-up note did not name.
+  const editedPath = toolEditPath(input);
+  if (editedPath) paths.push(editedPath);
   if (input.path) paths.push(input.path);
   if (input.filePath) paths.push(input.filePath);
   if (input.command) {

package/hook-context.mjs

@@ -496,6 +496,50 @@ export function cleanupClaudeMdLegacyBlock() {
   }
 }
 
+/**
+ * How many locally-selected observations count as a thick enough pool to skip the
+ * cross-project fallback. Named because the number appeared three times: the guard
+ * that DECIDES to run the fallback query and the two sites that consume it.
+ */
+const MIN_LOCAL_OBS = 3;
+
+/**
+ * The rows to render: everything `selectWithTokenBudget` chose, topped up with any
+ * fallback rows it does not already cover.
+ *
+ * R12 A2 — this used to be `observations.length >= 3 ? observations : fallbackObs`,
+ * written inline at BOTH consumer sites. The two row sets come from different windows
+ * (obsPool's low-speed tier1 is 48h/imp>=1; the fallback query is 24h/imp>=1 OR
+ * 7d/imp>=2) and neither contains the other, so a whole-set switch could hand back
+ * FEWER rows than it was given — measured on tests/hook-context.test.mjs's own `thin(n)`
+ * fixture: 2 rows in the DB, both selected, and a 0-byte context block, against 241 bytes
+ * and 3 table rows at n=3. Output was non-monotonic in corpus size, and the victims were
+ * exactly the thin/new projects the 60-day tier exists to serve. (An earlier revision of
+ * this line said 391 bytes, carried over from the audit's own differently-seeded fixture
+ * rather than measured here.)
+ *
+ * Top-up, not truncate-to-three: the union never renders fewer rows than the old
+ * expression did on any input, which a "fill to 3" fix would not hold — at 0 selected rows
+ * the fallback query's own LIMIT 5 already governs, and capping at 3 would have been a
+ * second, unrelated behaviour change. Growth is bounded: the union only runs below
+ * MIN_LOCAL_OBS, so the table gains at most two rows.
+ *
+ * The COUNT never shrinks; the composition can, and that is a ranking decision rather than
+ * an accident. At the uncapped table site this only adds. At the `.slice(0, MIN_LOCAL_OBS)`
+ * site the selected rows are PREPENDED, so with 1 local row and 3+ fallback rows the third
+ * fallback title is evicted — still three rows, one of them now local. Exhaustive
+ * enumeration over 42,436 ordered input pairs: 0 cases render fewer rows, 3,000 evict a
+ * fallback row that way, max gain 2. Preferring the project's own rows over cross-project
+ * ones inside a fixed window is the intended order, and saying so is the point: a new
+ * population entering a limit-bounded window without a stated ranking is this repo's
+ * recorded failure shape.
+ */
+function withFallbackTopUp(observations, fallbackObs) {
+  if (observations.length >= MIN_LOCAL_OBS) return observations;
+  const seen = new Set(observations.map((o) => o.id));
+  return [...observations, ...fallbackObs.filter((o) => !seen.has(o.id))];
+}
+
 /**
  * Assemble the full markdown body that goes inside the <claude-mem-context>
  * block emitted at session start. Same shape as the inline builder hook.mjs
@@ -536,7 +580,7 @@ export function buildSessionContextLines(
 
   // 2. Fallback: recent across all projects with tiered windows (when local pool is thin)
   let fallbackObs = [];
-  if (observations.length < 3) {
+  if (observations.length < MIN_LOCAL_OBS) {
     const fbOneDayAgo = now.getTime() - STALE_SESSION_MS;
     const fbSevenDaysAgo = now.getTime() - RELATED_OBS_WINDOW_MS;
     fallbackObs = db
@@ -663,8 +707,8 @@ export function buildSessionContextLines(
     // Slice FIRST, then sort: the slice is the selection (top 3 by value density) and must
     // stay that way; only the order they are printed in is corrected, same as the Recent
     // table below. Sorting before the slice would silently change WHICH three are injected.
-    const recentObs = (observations.length >= 3 ? observations : fallbackObs)
-      .slice(0, 3)
+    const recentObs = withFallbackTopUp(observations, fallbackObs)
+      .slice(0, MIN_LOCAL_OBS)
       .sort((a, b) => Date.parse(b.created_at) - Date.parse(a.created_at) || b.id - a.id);
     if (recentObs.length > 0) {
       summaryLines.push('### Recent Activity');
@@ -784,7 +828,7 @@ export function buildSessionContextLines(
   // tests/hook-context.test.mjs). Tiebroken on id for the same reason D#9 gives — an
   // untiebroken tie flips direction, and two saves in one millisecond are common.
   const obsLines = [];
-  const obsToShow = [...(observations.length >= 3 ? observations : fallbackObs)].sort(
+  const obsToShow = [...withFallbackTopUp(observations, fallbackObs)].sort(
     (a, b) => Date.parse(b.created_at) - Date.parse(a.created_at) || b.id - a.id,
   );
   if (obsToShow.length > 0) {

package/hook-llm.mjs

@@ -24,7 +24,7 @@ import {
 } from './utils.mjs';
 import { acquireLLMSlot, releaseLLMSlot } from './hook-semaphore.mjs';
 import { BG_LLM_TIMEOUT_MS } from './haiku-client.mjs';
-import { scrubRecord } from './lib/scrub-record.mjs';
+import { scrubRecord, scrubFilePaths } from './lib/scrub-record.mjs';
 import {
   insertObservationRow,
   insertObservationFiles,
@@ -356,6 +356,13 @@ export function saveObservation(obs, projectOverride, sessionIdOverride, externa
       search_aliases: obs.searchAliases || null,
     });
 
+    // D#44: derive the scrubbed path arrays ONCE. `obs.files` feeds two sinks —
+    // the files_modified JSON column and the observation_files junction below —
+    // and the junction value is also the recall key, so a per-sink scrub is how
+    // the stored key and the indexed column drift apart.
+    const safeFiles = scrubFilePaths(obs.files || []);
+    const safeFilesRead = scrubFilePaths(obs.filesRead || []);
+
     // Atomic: observation INSERT + observation_files in one transaction.
     // Column list single-sourced in lib/observation-write (shared with manual mem_save).
     const savedId = db.transaction(() => {
@@ -369,8 +376,8 @@ export function saveObservation(obs, projectOverride, sessionIdOverride, externa
         narrative: safe.narrative,
         concepts: safe.concepts,
         facts: safe.facts,
-        files_read: JSON.stringify(obs.filesRead || []),
-        files_modified: JSON.stringify(obs.files || []),
+        files_read: JSON.stringify(safeFilesRead),
+        files_modified: JSON.stringify(safeFiles),
         importance: obs.importance ?? 1,
         minhash_sig: minhashSig,
         lesson_learned: safe.lesson_learned,
@@ -384,7 +391,7 @@ export function saveObservation(obs, projectOverride, sessionIdOverride, externa
         scope: normalizeScope(obs.scope),
       });
 
-      insertObservationFiles(db, id, obs.files);
+      insertObservationFiles(db, id, safeFiles);
 
       return id;
     })();

package/hook-memory.mjs

@@ -435,12 +435,11 @@ export function searchRelevantMemories(
       debugCatch(e, 'crossProjectSearch');
     }
 
-    // Merge and score: same-project full weight, cross-project (default 0.7x).
-    // v2.41: cross-project penalty is env-overridable via MEM_CROSS_PROJECT_BOOST
-    // (0..1). Default 0.7 — tuned for typical multi-project installs where
-    // transferable decisions/discoveries are a minority of matches. Set to 1.0
-    // for single-project users (no effective penalty); set lower to tighten
-    // same-project focus in noisy cross-project environments.
+    // Merge and score: same-project full weight, cross-project penalised by
+    // getCrossProjectBoost(). R12 A6 — this block used to restate that knob's default as
+    // 0.7 twice over, which v2.41 changed to 0.4 while updating only the comment at the
+    // function. The value and its rationale live at getCrossProjectBoost() and nowhere
+    // else; a second copy of a tuned number is a second answer to "what is the baseline".
     //
     // OR-fallback results get 0.4x penalty — they matched individual words, not the full intent
     // v26 P0: noise_penalty (from SQL) shrinks high-inject/low-cite rows.

package/lib/activity.mjs

@@ -5,7 +5,7 @@
 // so they don't pollute the L1 system-prompt memory section.
 
 import { sanitizeFtsQuery } from '../utils.mjs';
-import { scrubRecord } from './scrub-record.mjs';
+import { scrubRecord, scrubFilePaths } from './scrub-record.mjs';
 import { saveObservation } from './save-observation.mjs';
 // Pure title-only builder: this query runs on the EVENTS table, which has no
 // lesson_learned column — the lesson-escape variant would be a SQL error here.
@@ -67,6 +67,11 @@ export function saveEvent(
   // paths are covered — title/body otherwise land verbatim and are FTS-indexed,
   // searchable, and exportable (HIGH-2 at-rest leak).
   const safe = scrubRecord('events', { title, body });
+  // D#44: `file_paths` is a JSON array, so scrubRecord deliberately skips it —
+  // element-level pre-scrub is the prescribed remedy. Measured on the
+  // maintainer's live DB before the fix: 3 of 2140 stored elements carried a
+  // credential-shaped segment, and all 3 were in THIS column.
+  const safeFilePaths = scrubFilePaths(file_paths);
   const info = db
     .prepare(
       `
@@ -79,7 +84,7 @@ export function saveEvent(
       event_type,
       safe.title,
       safe.body,
-      file_paths ? JSON.stringify(file_paths) : null,
+      safeFilePaths ? JSON.stringify(safeFilePaths) : null,
       git_sha,
       importance,
       created_at_epoch,

package/lib/deferred-work.mjs

@@ -1,5 +1,5 @@
 import { DAY_MS } from './time-constants.mjs';
-import { scrubRecord } from './scrub-record.mjs';
+import { scrubRecord, scrubFilePaths } from './scrub-record.mjs';
 // claude-mem-lite — deferred_work data layer
 // Pure-data CRUD + ordinal resolver + transactional closure helper.
 // Decoupled from observations table: different lifecycle, different scoring.
@@ -49,7 +49,12 @@ export function insertDeferred(db, args) {
     Date.now(),
     source_session_id,
     source_prompt_id,
-    files ? JSON.stringify(files) : null,
+    // The SIXTH path column. `files` is agent-writable on two live faces (MCP
+    // `mem_defer(files=…)`, CLI `defer add --files`) and was stringified raw beside a
+    // title scrubRecord had already cleaned — the same asymmetry the D#44 round is named
+    // after, on the column scrub-record.mjs's header names explicitly. A non-array falls
+    // through untouched, so a null stays null rather than becoming '[]'.
+    files ? JSON.stringify(scrubFilePaths(files)) : null,
   );
   return { id: Number(r.lastInsertRowid) };
 }

package/lib/file-edge-match.mjs

@@ -48,6 +48,11 @@
 // The one import below does not cost that: project-utils.mjs is a leaf over
 // `node:path`, and pre-tool-recall.js already imports it for inferProject.
 import { likeLiteral } from '../project-utils.mjs';
+// The second import, and it costs no more than the first: scrub-record.mjs ->
+// secret-scrub.mjs -> lib/private-strip.mjs are three regex-only leaves — no
+// node builtins, no DB handle, nothing child_process-shaped. Checked rather
+// than asserted, because the dependency note in this file has been wrong twice.
+import { scrubFilePath } from './scrub-record.mjs';
 
 /**
  * SQL boolean expression for the four-arm match. Placeholder order matches
@@ -233,8 +238,47 @@ export function toolEditPath(input) {
   return input.file_path ?? input.notebook_path;
 }
 
-/** Bind values for fileMatchClause, in placeholder order. */
-export function fileMatchParams(filePath) {
+/**
+ * Bind values for fileMatchClause, in placeholder order.
+ *
+ * D#44: the query path is scrubbed with the SAME helper the writers use, because
+ * `observation_files.filename` is a stored value AND the key matched against it.
+ * Once the write side pre-scrubs each element, a raw query path derives a
+ * different key from the row it is looking for — and only for the one shape that
+ * matters: a credential in the BASENAME rewrites the token arms 2-4 bind
+ * (`/repo/ghp_….mjs` -> `/repo/***.mjs`), so the lesson about that file becomes
+ * unreachable through the file itself. A credential confined to a directory
+ * segment is invisible to this, which is why the guard for it uses the basename
+ * shape; a case built on the directory shape passes with the reader unscrubbed.
+ *
+ * That second sentence is true BY CONSTRUCTION and was not, for one commit. Whole-path
+ * scrubbing let the eight KV-shaped patterns eat the separator, so
+ * `/repo/token=<secret>/notes.mjs` derived `/repo/token=***` — basename destroyed, and
+ * every file under that directory sharing one key. `scrubFilePath` splits on the separator
+ * first, which bounds every pattern to its own segment; the pre-ship review caught the
+ * window between.
+ *
+ * One consequence is deliberate and stays: a row written BEFORE 6.8.2 holds a raw path,
+ * and the query key is now derived. For a directory-segment credential the basename is
+ * untouched on both sides, so arms 2-4 still reach it (measured: 4 of 5 shapes). A row
+ * whose BASENAME is itself a credential is the exception — it is unreachable by its raw
+ * name until D#49 backfills the stored value, and it is by definition one of the leaking
+ * rows that backfill exists for.
+ *
+ * Doing it HERE rather than in each caller is this module's whole premise: the
+ * header above requires pre-tool-recall.js and edge-attribution.mjs to stay in
+ * byte-identical agreement, and recall-core.mjs + searchByFile bind the same
+ * clause. FIVE call sites across four modules — recall-core.mjs has two,
+ * recallByFile and countRecallableByFile — and one derivation. Counted by call
+ * site, because that is the unit an auditor asking "did every consumer move?"
+ * actually walks; the same change described it as four elsewhere.
+ *
+ * Not measurable on the maintainer's corpus — 0 of 2340 stored path values, and
+ * 0 of 100 junction rows, change under scrubSecrets (readonly census,
+ * 2026-09-13). That is a property of that corpus on that date, not of the code.
+ */
+export function fileMatchParams(rawFilePath) {
+  const filePath = scrubFilePath(rawFilePath);
   const fname = basenameAnySep(filePath);
   const escaped = likeLiteral(fname);
   // `%\\` before the basename: under ESCAPE '\', a literal backslash is

package/lib/import-jsonl.mjs

@@ -17,7 +17,7 @@
 import { readFileSync, statSync } from 'fs';
 import { createHash } from 'crypto';
 import { scrubSecrets } from '../secret-scrub.mjs';
-import { scrubRecord } from './scrub-record.mjs';
+import { scrubRecord, scrubFilePaths } from './scrub-record.mjs';
 import { toolEditPath } from './file-edge-match.mjs';
 import { insertObservationFiles } from './observation-write.mjs';
 
@@ -160,15 +160,22 @@ function importToolPair(db, toolUse, toolResult, project) {
   // while being unable to fire for it, and every imported notebook edit built
   // no (obs,file) edge. `toolEditPath` is the single home for that rule.
   const editedPath = toolEditPath(toolUse.input);
-  const filesModified =
+  // D#44: scrubbed at the derivation, so the files_modified JSON column and the
+  // observation_files junction (both fed from this one array below) cannot
+  // disagree. The title built from this same path was already scrubbed via
+  // scrubRecord — that asymmetry was the defect.
+  const filesModified = scrubFilePaths(
     (toolName === 'Edit' || toolName === 'Write' || toolName === 'NotebookEdit') && editedPath
       ? [editedPath]
-      : [];
+      : [],
+  );
   // `file_path`, not the shared `editedPath`: `toolEditPath` answers "which path did this
   // tool WRITE", and falls back to `notebook_path` for NotebookEdit's sake. Routing the read
   // column through it too gave a `Read` carrying only `notebook_path` a files_read entry —
   // a shape no tool emits, and a behaviour change D#35 made without declaring it (P3-5).
-  const filesRead = toolName === 'Read' && toolUse.input?.file_path ? [toolUse.input.file_path] : [];
+  const filesRead = scrubFilePaths(
+    toolName === 'Read' && toolUse.input?.file_path ? [toolUse.input.file_path] : [],
+  );
 
   // `narrative` carries the body and `text` is the derived search blob
   // (lib/observation-write.mjs rebuildObservationDerived). Writing the payload to `text`

package/lib/injected-ids.mjs

@@ -72,18 +72,27 @@ export function injectedIdsFileName(project, sessionId) {
  * false and the next person to diff the two would have had to rediscover why.
  */
 export function readInjectedMarker(file, { sessionId, maxAgeMs } = {}) {
-  const empty = { ids: [], count: 0, fresh: false };
+  const empty = { ids: [], count: 0, upsCount: 0, upsTs: 0, fresh: false };
   try {
-    const { ids, ts, count, session } = JSON.parse(readFileSync(file, 'utf8'));
+    const { ids, ts, count, upsCount, upsTs, session } = JSON.parse(readFileSync(file, 'utf8'));
     if (session && sessionId && session !== sessionId) return empty;
     if (!ts || Date.now() - ts > maxAgeMs) return empty;
     if (!Array.isArray(ids)) return empty;
-    return { ids, count: count || 0, fresh: true };
+    return { ids, count: count || 0, upsCount: upsCount || 0, upsTs: upsTs || 0, fresh: true };
   } catch {
     return empty;
   }
 }
 
+/**
+ * Hard ceiling on the marker's `ids` array, applied to BOTH arms.
+ *
+ * 2x the largest seen-set this repo has measured in the wild (16, histogram at
+ * scripts/pre-tool-recall.js:92-93). See mergeInjectedMarker for why an unbounded set is
+ * not merely a size problem.
+ */
+export const MAX_MARKER_IDS = 32;
+
 /**
  * Write `newIds` into a marker, unioning with a fresh same-session payload or replacing it.
  *
@@ -92,12 +101,21 @@ export function readInjectedMarker(file, { sessionId, maxAgeMs } = {}) {
  *   - `union`   stringifies the whole result. Both union callers already did
  *               (`prev.ids.map(String)` plus new ids that are `D<id>` strings anyway), so
  *               this is their behaviour, not a new normalisation.
- *   - `replace` writes `newIds` verbatim. The UPS main leg passes `candidateIds`, a MIX of
- *               raw observation numbers and `P<id>` strings, and writing those unchanged is
- *               exactly the state D#213 measures. Stringifying here would change it.
+ *   - `replace` writes `newIds` verbatim and carries every OTHER id forward as a string.
+ *               The UPS main leg passes `candidateIds`, a MIX of raw observation numbers
+ *               and `P<id>` strings, and writing those unchanged is exactly the state
+ *               D#213 measures. Stringifying them here would change it. It replaces the
+ *               caller's own slice, not the file (R12 B-6 — see mergeInjectedMarker).
  * Keeping both under one function is the point: the next writer picks a mode instead of
  * copying a fifth predicate and inventing a fifth typing rule.
  *
+ * TWO counters, and they answer different questions (R12 B-5). `count` is "how many times
+ * has anything written this marker" and stays as it was. `upsCount` is "how many times has
+ * the UPS face injected", and ONLY the caller that owns `MAX_SESSION_INJECTIONS` opts into
+ * bumping it. They were one field, so pre-tool-recall — which writes once per triggered
+ * Edit/Read and shares this file — spent the fyi face's entire per-session budget without
+ * the fyi face emitting a line. A budget has to be charged to the spender.
+ *
  * The write is atomic for the reason M-6 recorded: a plain write torn by a concurrent hook
  * left the shared marker as invalid JSON, silently disabling cross-hook dedup for the window.
  *
@@ -108,15 +126,56 @@ export function readInjectedMarker(file, { sessionId, maxAgeMs } = {}) {
  * @param {number} opts.maxAgeMs
  * @param {'union'|'replace'} opts.mode
  */
-export function mergeInjectedMarker(file, newIds, { sessionId, maxAgeMs, mode } = {}) {
+export function mergeInjectedMarker(file, newIds, { sessionId, maxAgeMs, mode, bumpUpsCount = false } = {}) {
   const prev = readInjectedMarker(file, { sessionId, maxAgeMs });
-  const ids = mode === 'union' ? [...new Set([...prev.ids.map(String), ...newIds.map(String)])] : newIds;
+  // R12 B-6. `replace` used to write `newIds` as the WHOLE array, so the UPS main leg's
+  // one write per prompt erased everything pre-tool-recall had accumulated in the window
+  // and that face re-injected lessons it had already shown. It now replaces the CALLER's
+  // slice and carries the rest.
+  //
+  // The carried ids are stringified and the caller's are not, and that asymmetry is the
+  // load-bearing part rather than an oversight: D#213's exclude is inert BECAUSE
+  // `new Set(excludeIds).has(<number from SQLite>)` misses a string key, and the UPS leg's
+  // raw numbers are the one population that is NOT inert. Writing `newIds` verbatim keeps
+  // that population byte-identical to what it was, and everything carried in arrives as a
+  // string, so this cannot widen the live exclude. Repairing D#213 is a separate decision
+  // with its own ruler (lib/patha-exclude-meter.mjs).
+  const newKeys = new Set(newIds.map(String));
+  const carried = [...new Set(prev.ids.map(String))].filter((id) => !newKeys.has(id));
+  // Both arms are built NEWEST-FIRST and then capped. Until B-6, `replace` overwriting the
+  // whole array was the only thing that ever shrank this file — `union` has always
+  // accumulated, and `ts` is refreshed on every write, so the staleness gate never fires in
+  // a session where any hook writes inside the window. Making replace carry the other
+  // hook's ids therefore removed a bound nobody had written down: measured 520 ids after 40
+  // rounds of 5 pre-tool-recall triggers plus one prompt, linear and unbounded.
+  //
+  // A large seen-set does not just cost bytes, it starves the face it exists to help.
+  // scripts/pre-tool-recall.js sizes its over-fetch as `min(seenSize, 5)` and then drops
+  // every fetched row that is IN the set, so past a handful of entries a Read can fetch six
+  // candidates and filter all six. That failure is described at pre-tool-recall.js:100-105,
+  // derived at a seen-set of 16 — which is the largest this repo has measured in the wild
+  // (`pre-tool-recall.js:92-93`, histogram 1x9 2x1 3x2 16x1 over n=13).
+  //
+  // So the cap is 2x the largest observed set, not a round number pulled from nowhere. It
+  // BOUNDS that failure; it does not remove it — six candidates can still all be seen — and
+  // removing it is ALGO-4's problem, not this one.
+  const ids = (
+    mode === 'union'
+      ? [...new Set([...newIds.map(String), ...prev.ids.map(String)])]
+      : [...newIds, ...carried]
+  ).slice(0, MAX_MARKER_IDS);
   atomicWriteFileSync(
     file,
     JSON.stringify({
       ids,
       ts: Date.now(),
       count: prev.count + 1,
+      upsCount: prev.upsCount + (bumpUpsCount ? 1 : 0),
+      // The UPS face's budget needs the UPS face's CLOCK, not the shared one. `ts` is
+      // refreshed by every writer, and readInjectedMarker zeroes upsCount off `ts`, so a
+      // tool-heavy session kept the fyi face's spent budget alive across gaps that should
+      // have released it — B-5 moved the counter to the spender and left the clock shared.
+      upsTs: bumpUpsCount ? Date.now() : prev.upsTs,
       ...(sessionId ? { session: sessionId } : {}),
     }),
   );

package/lib/save-observation.mjs

@@ -13,6 +13,7 @@
 
 import { jaccardSimilarity, scrubSecrets, computeMinHash, cjkBigrams, getCurrentBranch } from '../utils.mjs';
 import { DEDUP_JACCARD_THRESHOLD } from './dedup-constants.mjs';
+import { scrubFilePaths } from './scrub-record.mjs';
 import { insertObservationRow, insertObservationFiles } from './observation-write.mjs';
 // The SAME predicate every read path uses. Imported rather than re-typed: a hand-written
 // `superseded_at IS NULL` here would drift from the read side on the next column change,
@@ -174,9 +175,12 @@ export function saveObservation(db, params) {
     throw new Error('mem_save: content is empty or whitespace-only');
   }
   const importance = params.importance ?? 2;
-  const files = Array.isArray(params.files)
-    ? params.files.filter((f) => typeof f === 'string' && f.length > 0)
-    : [];
+  // D#44: scrub HERE, at the derivation, not at the two sinks below — this one
+  // array feeds both `files_modified` (JSON column) and the observation_files
+  // junction, and scrubbing at each sink separately is how they drift apart.
+  const files = scrubFilePaths(
+    Array.isArray(params.files) ? params.files.filter((f) => typeof f === 'string' && f.length > 0) : [],
+  );
   const rawLesson =
     typeof params.lesson_learned === 'string' && params.lesson_learned.length > 0
       ? params.lesson_learned

package/lib/scrub-record.mjs

@@ -10,7 +10,13 @@
 // session_handoffs.match_keywords-when-array) are NOT listed here — running
 // scrubSecrets over the JSON string can rewrite quoted values and break
 // downstream JSON.parse. Pre-scrub each element upstream of the
-// JSON.stringify call instead.
+// JSON.stringify call instead, via `scrubFilePaths` below.
+//
+// D#44: that instruction sat here for four releases and exactly ONE call site
+// followed it (hook-handoff.mjs, session_handoffs.key_files). observations
+// .files_modified / .files_read, observation_files.filename and events
+// .file_paths all stored raw paths while the title DERIVED FROM THE SAME PATH
+// was scrubbed. A prescription in a comment is not a mechanism; the helper is.
 
 import { scrubSecrets } from '../secret-scrub.mjs';
 
@@ -62,11 +68,69 @@ export const TEXT_FIELDS_BY_TABLE = {
   // the unknown-table failsafe ever ran. title/detail are written verbatim by the agent
   // ("rotate ghp_… before release", a connection string in detail) and replayed into
   // model context by the SessionStart dashboard, mem_defer_list and mem_get D#N.
-  //   files — JSON.stringify(array); pre-scrub elements at the call site if ever needed.
+  //   files — JSON.stringify(array); pre-scrubbed element-wise at insertDeferred via
+  //           `scrubFilePaths`. It needed to be: `mem_defer` and `defer add --files` both
+  //           take agent-supplied paths, and this line prescribed the remedy for four
+  //           releases while the call site stored them raw.
   //   project / status — identifiers and an enum.
   deferred_work: ['title', 'detail', 'drop_reason'],
 };
 
+/**
+ * Scrub one filesystem path — for PERSISTENCE and for KEY DERIVATION, which is
+ * why this is a named export and not an inline `scrubSecrets(f)` at each site.
+ *
+ * `observation_files.filename` is both a stored value and the recall key
+ * (lib/file-edge-match.mjs binds it four ways). If the write side scrubs and the
+ * read side does not, the two derive different keys from the same path and a
+ * lesson becomes unreachable through the very file it is about. Both sides call
+ * THIS, so they cannot drift apart — the same rule this repo already enforces
+ * for `fileMatchClause`'s two consumers.
+ *
+ * Total by construction: it never throws, because one caller is a hook on the
+ * PreToolUse path. Nullish becomes '' (`p ?? ''`); anything else becomes its
+ * String() form, so 42 yields '42', not ''.
+ */
+export function scrubFilePath(p) {
+  // SEGMENT-WISE, and that is the whole point rather than a micro-optimisation.
+  // Eight SECRET_PATTERNS carry a value class that does not exclude `/`
+  // (secret-scrub.mjs:33/74/78/83/98/109/259/260). On prose that is correct; run
+  // whole-path, the match eats the separator and everything after it, so
+  // `/repo/token=<secret>/notes.mjs` became `/repo/token=***` — the filename
+  // destroyed at WRITE time and unrecoverable, and every file under such a
+  // directory collapsing onto one recall key (measured: an untouched `gamma.mjs`
+  // recalled another file's observations). Splitting first bounds every pattern to
+  // the segment it matched in.
+  //
+  // The trade, stated rather than glossed: a credential whose own syntax spans a
+  // separator is no longer caught here — the Slack webhook path and the
+  // `scheme://user:pass@host` arms both need their `/` characters. Those are URL
+  // shapes, and these columns hold filesystem paths; `scrubSecrets` still runs
+  // whole-string on every prose field, which is where a URL actually lands.
+  // Preserving path structure wins because the path IS the recall key.
+  //
+  // The capture group keeps the separators in the split output, so join()
+  // reconstructs the original byte-for-byte when nothing matches.
+  return String(p ?? '')
+    .split(/([/\\])/)
+    .map((part) => (part === '/' || part === '\\' ? part : scrubSecrets(part)))
+    .join('');
+}
+
+/**
+ * Element-wise scrub for a path ARRAY, to be called upstream of the
+ * `JSON.stringify` / junction INSERT this module's header points at.
+ *
+ * A non-array flows through UNTOUCHED, mirroring scrubRecord's own contract for
+ * non-string fields. That is load-bearing rather than defensive: call sites pass
+ * `undefined` on purpose (`JSON.stringify(undefined)` is `undefined`, which is
+ * how a column stays NULL), and coercing it to `[]` here would quietly rewrite
+ * NULL to '[]' in columns other code tests with `IS NULL` / `NOT IN (NULL,'[]')`.
+ */
+export function scrubFilePaths(paths) {
+  return Array.isArray(paths) ? paths.map(scrubFilePath) : paths;
+}
+
 /**
  * Scrub the text fields of a record before INSERT.
  * Returns a shallow copy with string text-fields scrubbed; the input object

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.8.1",
+  "version": "6.8.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "claude-mem-lite",
-      "version": "6.8.1",
+      "version": "6.8.2",
       "os": [
         "darwin",
         "linux",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.8.1",
+  "version": "6.8.2",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",

package/scripts/pre-tool-recall.js

@@ -27,6 +27,7 @@ import {
   jsonArrayLikeNeedle,
   toolEditPath,
 } from '../lib/file-edge-match.mjs';
+import { scrubFilePath } from '../lib/scrub-record.mjs';
 import { fileIntelFor } from '../lib/file-intel.mjs';
 import { shouldWarnReread, buildRereadWarning, readFileMeta } from '../lib/reread-guard.mjs';
 import { recordMetric } from '../lib/metrics.mjs';
@@ -538,7 +539,14 @@ try {
     // needs the same key, and host-native `basename` gave it the whole path for a
     // Windows-shaped payload. Fixing the observations leg alone would have left this
     // hook recalling lessons but no events.
-    const fname = basenameAnySep(filePath);
+    // D#44: the KEY derivation is scrubbed; `filePath` itself is NOT reused for
+    // this, because the same variable is still handed to readFileMeta and friends
+    // to stat a real file on disk — a globally scrubbed path would point nowhere.
+    // events.file_paths is now written pre-scrubbed (lib/activity.mjs), and the
+    // observations leg below scrubs inside fileMatchParams, so both legs of this
+    // hook keep deriving the same key — which is what the note above requires.
+    const keyPath = scrubFilePath(filePath);
+    const fname = basenameAnySep(keyPath);
     // Needle for the events leg's JSON-array column — see jsonArrayLikeNeedle for
     // why the JSON escape has to run before the LIKE one. The observations leg
     // below matches a plain column and gets its params from fileMatchParams.
@@ -652,7 +660,7 @@ try {
     // patterns match both basename and full-path entries. JSON quoting
     // (`"<name>"`) prevents partial-match false positives like "foo.mjs"
     // matching "myfoo.mjs".
-    const fullPathNeedle = jsonArrayLikeNeedle(filePath);
+    const fullPathNeedle = jsonArrayLikeNeedle(keyPath);
     // v2.34.6: Read also tightens the events query — only rows with a non-empty
     // body (= lesson equivalent). Edit path keeps a wider net, but P0 (D#78)
     // closes the parallel-path drift vs the observations query: a bodyless row

package/scripts/prompt-search-utils.mjs

@@ -225,9 +225,26 @@ export function shouldSkipByDedup(newIds, injectedFile, sessionId) {
   if (!newIds || newIds.length === 0) return true;
   try {
     const raw = readFileSync(injectedFile, 'utf8');
-    const { ids: prevIds, ts, count = 0, session } = JSON.parse(raw);
+    const { ids: prevIds, ts, upsCount = 0, upsTs = 0, session } = JSON.parse(raw);
     if (session && sessionId && session !== sessionId) return false;
-    if (count >= MAX_SESSION_INJECTIONS) return true;
+    // R12 B-5, two defects on these two lines, and they had to be fixed together.
+    //
+    // (1) The cap reads `upsCount`, not the shared `count`. `count` is bumped by every
+    // hook that writes this marker — pre-tool-recall does so once per triggered Edit/Read
+    // — so a session that touched 15 lesson-bearing files had already spent this face's
+    // whole budget before it injected anything. Markers written before this field existed
+    // read 0, which releases a cap that should never have been charged.
+    //
+    // (2) Freshness is judged FIRST. The cap used to sit above it, so once `count` hit the
+    // ceiling the marker suppressed injection even after it went stale — and nothing
+    // lowers it again, since the reset only happens on the next WRITE and the write never
+    // comes. The only escape was a new session id.
+    // (3) The cap is judged on `upsTs`, the UPS face's OWN clock. `ts` moves on every
+    // writer's write, so judging the budget against it let another hook's activity keep a
+    // spent budget alive indefinitely — the same spender/charged mismatch as (1), arriving
+    // through the clock instead of the counter. A marker with no `upsTs` (anything written
+    // before this field existed) reads 0 and never caps, matching upsCount's default.
+    if (upsTs && Date.now() - upsTs <= DEDUP_STALE_MS && upsCount >= MAX_SESSION_INJECTIONS) return true;
     if (!ts || Date.now() - ts > DEDUP_STALE_MS) return false;
     if (!Array.isArray(prevIds) || prevIds.length === 0) return false;
     // Normalize both sides to strings before comparing: UPS writes obs ids as numbers

package/scripts/user-prompt-search.js

@@ -798,6 +798,12 @@ async function main() {
             sessionId: hookData.session_id,
             maxAgeMs: DEDUP_STALE_MS,
             mode: 'union',
+            // This leg is GATED by shouldSkipByDedup, so it has to charge the cap it reads.
+            // Before B-5 it did, because the cap was the shared `count` this write bumps;
+            // moving the cap to `upsCount` left the gated population {main leg, D#N leg}
+            // larger than the charged population {main leg}. Same spender/charged mismatch
+            // B-5 fixed, on the sibling call site.
+            bumpUpsCount: true,
           });
         } catch {}
       }
@@ -1083,6 +1089,10 @@ async function main() {
           sessionId: hookData.session_id,
           maxAgeMs: DEDUP_STALE_MS,
           mode: 'replace',
+          // R12 B-5: this is the leg MAX_SESSION_INJECTIONS budgets, so it is the only
+          // one that charges against it. The shared `count` is bumped by every hook that
+          // touches this file and is no longer what the cap reads.
+          bumpUpsCount: true,
         });
       } catch {}
       // v26 P0: bump injection_count for obs-based emits only (prompt-corpus