claude-mem-lite 6.8.1 → 6.8.3

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "6.8.1",
+      "version": "6.8.3",
       "source": "./",
       "homepage": "https://github.com/sdsrss/claude-mem-lite",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.8.1",
+  "version": "6.8.3",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/adopt-cli.mjs

@@ -425,6 +425,13 @@ function unadoptAll(args) {
       log(`[unadopt --all] ${dir} → cleaned partial residue (detail doc/state, no block)`);
       partial++;
     }
+    // OUTSIDE the branch, because residue is orthogonal to what happened to the block: a
+    // project can have its block removed AND still carry an unpaired sentinel. An orphan is
+    // the one kind of residue the sweep cannot finish — its block has no end marker, so its
+    // extent is unknowable — and the two lines above would otherwise imply the project is
+    // clean. Inside the else-branch it was also unreachable for the 'removed' case, which is
+    // how the print survived a mutation with the whole suite green (pre-ship review P2-2).
+    if (r.residue) log(`  ⚠ ${r.residue}`);
   }
 
   // 2. Legacy memory-dir cleanup across every memdir (foreign-content guarded).
@@ -481,4 +488,8 @@ export function cmdUnadopt(args = []) {
   const mig = migrateLegacyMemoryDir(cwd, PLUGIN_SLUG, { force });
   const migNote = mig.action === 'removed' ? ' (+cleaned legacy memdir)' : '';
   log(`[unadopt] ${cwd} → ${r.action}${migNote}`);
+  // 'partial' is the outcome that used to print as 'absent': the sidecar files are gone but
+  // an unpaired sentinel still holds steering text in the user's CLAUDE.md, and only they can
+  // decide where that text ends. Silence here is what let it survive every sweep.
+  if (r.residue) log(`  ⚠ ${r.residue}`);
 }

package/bash-utils.mjs

@@ -2,6 +2,13 @@
 // Extracted from utils.mjs for focused responsibility
 
 import { basename } from 'path';
+// One import into a module that had exactly one, and it buys the single home for
+// the file_path/notebook_path rule (lib/file-edge-match.mjs's own header: "a second
+// copy is exactly what produced R12 B-1"). No cycle: file-edge-match reaches only
+// project-utils + scrub-record -> secret-scrub -> private-strip, none of which
+// import this file. Cold-start scripts are unaffected — scripts/pre-tool-recall.js
+// deliberately imports nothing from the utils.mjs barrel that re-exports this.
+import { toolEditPath } from './lib/file-edge-match.mjs';
 
 // Read/search commands whose output legitimately contains "error"-like keywords without
 // being a failure. Matched against the PRIMARY command (see isReadOnlyCommand).
@@ -441,7 +448,16 @@ export function extractFilePaths(input) {
   // Direct fields (Edit/Write file_path) are kept unconditionally — an explicit edit to a
   // /tmp path is real work the user chose to make, unlike a /tmp path that merely appears as
   // a transient argument inside a Bash command (excluded as noise in the command branch below).
-  if (input.file_path) paths.push(input.file_path);
+  //
+  // `toolEditPath`, not a fourth hand-spelling of the same rule: this function knew
+  // file_path/path/filePath and not `notebook_path`, while hooks.json matches PostToolUse
+  // on `Edit|Write|NotebookEdit` and EDIT_TOOLS already counts NotebookEdit as significant.
+  // A notebook edit therefore produced a captured, significant episode entry carrying NO
+  // files, so the observation built from it got no observation_files edge and no file-keyed
+  // recall could reach it. Same root cause as R12 B-2; the fourth site, and the one its
+  // own follow-up note did not name.
+  const editedPath = toolEditPath(input);
+  if (editedPath) paths.push(editedPath);
   if (input.path) paths.push(input.path);
   if (input.filePath) paths.push(input.filePath);
   if (input.command) {

package/claudemd.mjs

@@ -59,8 +59,50 @@ function escapeRe(s) {
 // are `\r?\n` (not bare `\n`) so a CLAUDE.md re-saved with Windows CRLF endings
 // still matches — otherwise the block read as "absent" and a fresh LF copy got
 // appended every SessionStart, growing the file without bound (review C1/H2).
+// The body may not contain ANOTHER sentinel of the same slug. `[\s\S]*?` could, and that is
+// not a tidiness point — it is how a match stopped being one block. Drop the `:end` line by
+// hand (a merge resolution, an editor, another tool) and the next adopt appends a second
+// block below whatever the user has written since; the adopt after THAT matched from the
+// orphaned begin, lazily, to the only `:end` in the file — which now sits past the user's
+// text and past the second begin — so `raw.replace(m[0], section)` deleted all of it.
+// Measured 2026-09-13: a "## Deployment runbook" section appended after adoption was gone
+// after two further adopts, silently, with both runs reporting success.
+//
+// The tempered token below cannot span a sentinel, so the engine backtracks to the
+// WELL-FORMED pair and the orphan is simply left alone — which is the right answer for a
+// file we do not own: where the orphaned body ends is genuinely unknowable, so removeManaged
+// reports it (action 'partial') rather than guessing a span to delete.
+//
+// Safe by construction for legitimate blocks: the shipped body carries the slug twice and
+// never as a sentinel (measured: 1304 bytes — 1296 UTF-16 units, the body has em dashes —
+// with zero `:begin` / `:end` occurrences), and the
+// separators stay `\r?\n` for the CRLF reason below.
 function blockBody(esc) {
-  return `<!-- ${esc}:begin (v\\d+) -->\\r?\\n([\\s\\S]*?)\\r?\\n<!-- ${esc}:end -->`;
+  const sentinel = `<!-- ${esc}:(?:begin|end)`;
+  return `<!-- ${esc}:begin (v\\d+) -->\\r?\\n((?:(?!${sentinel})[\\s\\S])*?)\\r?\\n<!-- ${esc}:end -->`;
+}
+
+// Any sentinel LINE of our slug, paired or not. The pair regex above is deliberately blind to
+// an unpaired one; this is what lets residue reporting see what it cannot safely remove.
+function sentinelLineRegexG(slug) {
+  return new RegExp(`<!-- ${escapeRe(slug)}:(?:begin|end)\\b[^>]*-->`, 'g');
+}
+
+/**
+ * Sentinel lines of this slug left in `raw` that no well-formed block accounts for.
+ * Zero on a healthy file (every sentinel belongs to a matched pair) and on a clean one.
+ * @param {string} raw
+ * @param {string} slug
+ * @returns {number}
+ */
+function orphanSentinelCount(raw, slug) {
+  const total = (raw.match(sentinelLineRegexG(slug)) || []).length;
+  let paired = 0;
+  raw.replace(blockRegexG(slug), (whole) => {
+    paired += (whole.match(sentinelLineRegexG(slug)) || []).length;
+    return whole;
+  });
+  return total - paired;
 }
 function blockRegex(slug) {
   return new RegExp(blockBody(escapeRe(slug)));
@@ -137,13 +179,24 @@ export function isAdopted(cwd, slug) {
  * removed it. removeManaged cleans all three pieces, so sweep on any of them.
  */
 export function hasResidue(cwd, slug) {
-  return (
-    readBlock(cwd, slug).body !== null ||
-    existsSync(detailDocPath(cwd, slug)) ||
-    existsSync(stateFilePath(cwd, slug))
-  );
+  const blk = readBlock(cwd, slug);
+  return blk.body !== null || existsSync(detailDocPath(cwd, slug)) || existsSync(stateFilePath(cwd, slug));
 }
 
+// An unpaired sentinel is deliberately NOT in the list above (pre-ship review P2-3). A first
+// cut added it, reasoning that the sweep should see what the pair regex cannot. But
+// orphanSentinelCount counts sentinel-shaped TEXT, and a project the plugin never touched can
+// mention the marker in prose — documenting it, pasting half an example, a changelog line.
+// That one mention let `unadopt --all` into a stranger's project, where removeManaged
+// unconditionally deletes the detail doc and state sidecar and rmdir's an empty `.claude/`,
+// then printed "remove those lines by hand" at the user's own paragraph — and never
+// converged, because the mention is still there on the next sweep.
+//
+// The three entries above are all things the PLUGIN WROTE; a sentinel in prose is not. And
+// the sweep gains nothing by entering: removeManaged cannot clean an orphan anyway, by
+// design. The orphan is reported by removeManaged when unadopt genuinely runs — which is the
+// real failure case, where the doc and sidecar are still present and do bring it in.
+
 /**
  * Whether the installed block/doc has drifted from the shipped content — i.e.
  * a version bump or a template edit means we should refresh. Returns true when
@@ -232,11 +285,25 @@ export function writeManaged(cwd, { slug, version, block, doc }) {
  * Remove our managed block from CLAUDE.md (preserving all other content) and
  * delete the detail doc + state sidecar. Best-effort removes an emptied
  * .claude/ directory.
- * @returns {{action: 'removed'|'absent'}}
+ *
+ * THREE outcomes, not two — the same rule lib/db-unusable.mjs states about backups: "there
+ * is nothing to do" and "I could not finish" must not print in the same voice, because a
+ * green-sounding line ends the reader's search. `absent` used to cover both: with one
+ * sentinel line missing, the pair regex matched nothing, so this returned 'absent' — while
+ * having already deleted the detail doc and the state sidecar and left ~1.3 KB of managed
+ * steering text in the user's CLAUDE.md, which it is then loaded from on every session.
+ * `partial` is that case, and `residue` names what is left so the caller can say so.
+ *
+ * Deliberately does NOT delete an orphaned sentinel's body: where it ends is unknowable
+ * (that is the defect, not a detail), and guessing a span in a file we do not own is how the
+ * adopt side came to delete a user's runbook. Report, do not repair.
+ *
+ * @returns {{action: 'removed'|'partial'|'absent', residue?: string}}
  */
 export function removeManaged(cwd, slug) {
   const p = claudeMdPath(cwd);
   let action = 'absent';
+  let orphans = 0;
   if (existsSync(p)) {
     let raw = readFileSync(p, 'utf8');
     // H2: loop so ALL same-slug blocks are removed, not just the first (a
@@ -283,8 +350,17 @@ export function removeManaged(cwd, slug) {
         atomicWrite(p, raw);
       }
     }
+    // Counted on what is left AFTER the loop, so a healthy file (every sentinel consumed by
+    // a matched pair) reports zero and only a genuinely unpaired line survives the count.
+    orphans = orphanSentinelCount(raw, slug);
   }
+  // Captured BEFORE the deletions below, because they are what it asks about: is there any
+  // evidence the plugin ever wrote in this project? An unpaired sentinel is NOT such
+  // evidence — it is text, and a project that merely documents the marker in prose has one
+  // (pre-ship review P2-3). Reporting residue there means telling a stranger to delete their
+  // own paragraph, on a project this tool has never touched.
   const dp = detailDocPath(cwd, slug);
+  const wasOurs = action === 'removed' || existsSync(dp) || existsSync(stateFilePath(cwd, slug));
   if (existsSync(dp))
     try {
       unlinkSync(dp);
@@ -300,6 +376,18 @@ export function removeManaged(cwd, slug) {
   } catch {
     /* best-effort */
   }
+  // `action` answers ONE question — what happened to the block — and `residue` is an
+  // independent fact that rides alongside it. A first cut let an orphan override 'removed'
+  // too, on the reasoning that both are "unfinished". Pre-ship review P2-1: unadoptAll's
+  // else-branch prints "cleaned partial residue (detail doc/state, no block)" and counts
+  // `partial++`, so a sweep that DID remove a block reported "no block" and tallied zero
+  // removals. Two facts, two fields.
+  const residue =
+    orphans > 0 && wasOurs
+      ? `${orphans} unpaired \`${slug}\` sentinel line(s) remain in ${claudeMdPath(cwd)} — the block they opened has no matching end marker, so its extent cannot be determined safely. Remove those lines and the text they wrap by hand.`
+      : null;
+  if (action === 'removed') return residue ? { action, residue } : { action };
+  if (residue) return { action: 'partial', residue };
   return { action };
 }
 

package/hook-context.mjs

@@ -496,6 +496,50 @@ export function cleanupClaudeMdLegacyBlock() {
   }
 }
 
+/**
+ * How many locally-selected observations count as a thick enough pool to skip the
+ * cross-project fallback. Named because the number appeared three times: the guard
+ * that DECIDES to run the fallback query and the two sites that consume it.
+ */
+const MIN_LOCAL_OBS = 3;
+
+/**
+ * The rows to render: everything `selectWithTokenBudget` chose, topped up with any
+ * fallback rows it does not already cover.
+ *
+ * R12 A2 — this used to be `observations.length >= 3 ? observations : fallbackObs`,
+ * written inline at BOTH consumer sites. The two row sets come from different windows
+ * (obsPool's low-speed tier1 is 48h/imp>=1; the fallback query is 24h/imp>=1 OR
+ * 7d/imp>=2) and neither contains the other, so a whole-set switch could hand back
+ * FEWER rows than it was given — measured on tests/hook-context.test.mjs's own `thin(n)`
+ * fixture: 2 rows in the DB, both selected, and a 0-byte context block, against 241 bytes
+ * and 3 table rows at n=3. Output was non-monotonic in corpus size, and the victims were
+ * exactly the thin/new projects the 60-day tier exists to serve. (An earlier revision of
+ * this line said 391 bytes, carried over from the audit's own differently-seeded fixture
+ * rather than measured here.)
+ *
+ * Top-up, not truncate-to-three: the union never renders fewer rows than the old
+ * expression did on any input, which a "fill to 3" fix would not hold — at 0 selected rows
+ * the fallback query's own LIMIT 5 already governs, and capping at 3 would have been a
+ * second, unrelated behaviour change. Growth is bounded: the union only runs below
+ * MIN_LOCAL_OBS, so the table gains at most two rows.
+ *
+ * The COUNT never shrinks; the composition can, and that is a ranking decision rather than
+ * an accident. At the uncapped table site this only adds. At the `.slice(0, MIN_LOCAL_OBS)`
+ * site the selected rows are PREPENDED, so with 1 local row and 3+ fallback rows the third
+ * fallback title is evicted — still three rows, one of them now local. Exhaustive
+ * enumeration over 42,436 ordered input pairs: 0 cases render fewer rows, 3,000 evict a
+ * fallback row that way, max gain 2. Preferring the project's own rows over cross-project
+ * ones inside a fixed window is the intended order, and saying so is the point: a new
+ * population entering a limit-bounded window without a stated ranking is this repo's
+ * recorded failure shape.
+ */
+function withFallbackTopUp(observations, fallbackObs) {
+  if (observations.length >= MIN_LOCAL_OBS) return observations;
+  const seen = new Set(observations.map((o) => o.id));
+  return [...observations, ...fallbackObs.filter((o) => !seen.has(o.id))];
+}
+
 /**
  * Assemble the full markdown body that goes inside the <claude-mem-context>
  * block emitted at session start. Same shape as the inline builder hook.mjs
@@ -536,7 +580,7 @@ export function buildSessionContextLines(
 
   // 2. Fallback: recent across all projects with tiered windows (when local pool is thin)
   let fallbackObs = [];
-  if (observations.length < 3) {
+  if (observations.length < MIN_LOCAL_OBS) {
     const fbOneDayAgo = now.getTime() - STALE_SESSION_MS;
     const fbSevenDaysAgo = now.getTime() - RELATED_OBS_WINDOW_MS;
     fallbackObs = db
@@ -663,8 +707,8 @@ export function buildSessionContextLines(
     // Slice FIRST, then sort: the slice is the selection (top 3 by value density) and must
     // stay that way; only the order they are printed in is corrected, same as the Recent
     // table below. Sorting before the slice would silently change WHICH three are injected.
-    const recentObs = (observations.length >= 3 ? observations : fallbackObs)
-      .slice(0, 3)
+    const recentObs = withFallbackTopUp(observations, fallbackObs)
+      .slice(0, MIN_LOCAL_OBS)
       .sort((a, b) => Date.parse(b.created_at) - Date.parse(a.created_at) || b.id - a.id);
     if (recentObs.length > 0) {
       summaryLines.push('### Recent Activity');
@@ -784,7 +828,7 @@ export function buildSessionContextLines(
   // tests/hook-context.test.mjs). Tiebroken on id for the same reason D#9 gives — an
   // untiebroken tie flips direction, and two saves in one millisecond are common.
   const obsLines = [];
-  const obsToShow = [...(observations.length >= 3 ? observations : fallbackObs)].sort(
+  const obsToShow = [...withFallbackTopUp(observations, fallbackObs)].sort(
     (a, b) => Date.parse(b.created_at) - Date.parse(a.created_at) || b.id - a.id,
   );
   if (obsToShow.length > 0) {

package/hook-llm.mjs

@@ -24,7 +24,7 @@ import {
 } from './utils.mjs';
 import { acquireLLMSlot, releaseLLMSlot } from './hook-semaphore.mjs';
 import { BG_LLM_TIMEOUT_MS } from './haiku-client.mjs';
-import { scrubRecord } from './lib/scrub-record.mjs';
+import { scrubRecord, scrubFilePaths } from './lib/scrub-record.mjs';
 import {
   insertObservationRow,
   insertObservationFiles,
@@ -356,6 +356,13 @@ export function saveObservation(obs, projectOverride, sessionIdOverride, externa
       search_aliases: obs.searchAliases || null,
     });
 
+    // D#44: derive the scrubbed path arrays ONCE. `obs.files` feeds two sinks —
+    // the files_modified JSON column and the observation_files junction below —
+    // and the junction value is also the recall key, so a per-sink scrub is how
+    // the stored key and the indexed column drift apart.
+    const safeFiles = scrubFilePaths(obs.files || []);
+    const safeFilesRead = scrubFilePaths(obs.filesRead || []);
+
     // Atomic: observation INSERT + observation_files in one transaction.
     // Column list single-sourced in lib/observation-write (shared with manual mem_save).
     const savedId = db.transaction(() => {
@@ -369,8 +376,8 @@ export function saveObservation(obs, projectOverride, sessionIdOverride, externa
         narrative: safe.narrative,
         concepts: safe.concepts,
         facts: safe.facts,
-        files_read: JSON.stringify(obs.filesRead || []),
-        files_modified: JSON.stringify(obs.files || []),
+        files_read: JSON.stringify(safeFilesRead),
+        files_modified: JSON.stringify(safeFiles),
         importance: obs.importance ?? 1,
         minhash_sig: minhashSig,
         lesson_learned: safe.lesson_learned,
@@ -384,7 +391,7 @@ export function saveObservation(obs, projectOverride, sessionIdOverride, externa
         scope: normalizeScope(obs.scope),
       });
 
-      insertObservationFiles(db, id, obs.files);
+      insertObservationFiles(db, id, safeFiles);
 
       return id;
     })();

package/hook-memory.mjs

@@ -435,12 +435,11 @@ export function searchRelevantMemories(
       debugCatch(e, 'crossProjectSearch');
     }
 
-    // Merge and score: same-project full weight, cross-project (default 0.7x).
-    // v2.41: cross-project penalty is env-overridable via MEM_CROSS_PROJECT_BOOST
-    // (0..1). Default 0.7 — tuned for typical multi-project installs where
-    // transferable decisions/discoveries are a minority of matches. Set to 1.0
-    // for single-project users (no effective penalty); set lower to tighten
-    // same-project focus in noisy cross-project environments.
+    // Merge and score: same-project full weight, cross-project penalised by
+    // getCrossProjectBoost(). R12 A6 — this block used to restate that knob's default as
+    // 0.7 twice over, which v2.41 changed to 0.4 while updating only the comment at the
+    // function. The value and its rationale live at getCrossProjectBoost() and nowhere
+    // else; a second copy of a tuned number is a second answer to "what is the baseline".
     //
     // OR-fallback results get 0.4x penalty — they matched individual words, not the full intent
     // v26 P0: noise_penalty (from SQL) shrinks high-inject/low-cite rows.

package/lib/activity.mjs

@@ -5,7 +5,7 @@
 // so they don't pollute the L1 system-prompt memory section.
 
 import { sanitizeFtsQuery } from '../utils.mjs';
-import { scrubRecord } from './scrub-record.mjs';
+import { scrubRecord, scrubFilePaths } from './scrub-record.mjs';
 import { saveObservation } from './save-observation.mjs';
 // Pure title-only builder: this query runs on the EVENTS table, which has no
 // lesson_learned column — the lesson-escape variant would be a SQL error here.
@@ -67,6 +67,11 @@ export function saveEvent(
   // paths are covered — title/body otherwise land verbatim and are FTS-indexed,
   // searchable, and exportable (HIGH-2 at-rest leak).
   const safe = scrubRecord('events', { title, body });
+  // D#44: `file_paths` is a JSON array, so scrubRecord deliberately skips it —
+  // element-level pre-scrub is the prescribed remedy. Measured on the
+  // maintainer's live DB before the fix: 3 of 2140 stored elements carried a
+  // credential-shaped segment, and all 3 were in THIS column.
+  const safeFilePaths = scrubFilePaths(file_paths);
   const info = db
     .prepare(
       `
@@ -79,7 +84,7 @@ export function saveEvent(
       event_type,
       safe.title,
       safe.body,
-      file_paths ? JSON.stringify(file_paths) : null,
+      safeFilePaths ? JSON.stringify(safeFilePaths) : null,
       git_sha,
       importance,
       created_at_epoch,

package/lib/db-unusable.mjs

@@ -67,6 +67,49 @@ export function isFtsCorruptionError(err) {
   return /SQLITE_CORRUPT_VTAB/i.test(`${err?.code || ''}`);
 }
 
+/**
+ * What to do about a damaged FTS5 INDEX — the query-time half of isFtsCorruptionError.
+ *
+ * R10 P3-9 wired the classifier into `ensureDbWithWalRecovery`, which rebuilds and retries.
+ * That covers OPEN time. A structure record damaged inside the index opens fine — nothing
+ * reads it until the first MATCH — so the fault surfaces at QUERY time, and there the two
+ * faces that carry it to a reader (the CLI catch-all, the MCP safeHandler) passed SQLite's
+ * own sentence through with no next step. `recent` / `recall` / `browse` / `context` never
+ * touch FTS and keep answering, which makes that dead end easy to misread as "search found
+ * nothing" rather than "search is broken".
+ *
+ * ONE STRING FOR BOTH CHANNELS, unlike the file-level family below. The split there exists
+ * because that remedy OVERWRITES the database and must not be handed ready-to-run to an
+ * agent holding Bash. This one re-derives every index from its own content table: the rows
+ * are never read from the index, so a rebuild is lossless and idempotent, and `doctor`
+ * already runs it unprompted. Naming "intact" is load-bearing — the reading this line
+ * exists to prevent is "my memories are corrupt".
+ *
+ * SCOPE, measured rather than assumed: a damaged index does not always reach the caller as
+ * SQLITE_CORRUPT_VTAB. `observations_fts_data` holds three rows on a one-observation store —
+ * id=1 (averages), id=10 (the STRUCTURE record) and one leaf page — and which row the damage
+ * lands on decides the code. Over 100 trials each:
+ *
+ *   UPDATE … SET block = randomblob(32) WHERE id > 1   (structure + leaf)  98 VTAB, 2 NOMEM
+ *   UPDATE … SET block = randomblob(32) WHERE id > 10  (leaf only)        100 VTAB, 0 NOMEM
+ *   DELETE … WHERE id > 10                             (leaf only)        100 VTAB, 0 NOMEM
+ *
+ * So NOMEM comes from a mangled STRUCTURE record, where SQLite reads a corrupt varint and asks
+ * for an absurd allocation — not from leaf damage. (A first draft of this paragraph said
+ * "leaf pages", which would send anyone re-measuring `WHERE id > 10` to 0/N and make the
+ * boundary below look vacuous. Caught by the pre-ship claims audit.) That case gets no
+ * remedy, on purpose:
+ * isFtsCorruptionError is what isDbCorruptionError and isDbUnusableError consult, so
+ * admitting SQLITE_NOMEM would answer a real out-of-memory with a full FTS rebuild, and
+ * would tell a user their index is damaged when it may be their RAM. The code cannot
+ * discriminate the two, so this covers the fault it can name.
+ * `tests/fts-corruption-query-time-remedy.test.mjs` pins that boundary.
+ */
+export const FTS_CORRUPTION_REMEDY =
+  'The FTS5 search index is damaged; the stored observations are intact. ' +
+  'Rebuild it losslessly with `claude-mem-lite fts-check rebuild` ' +
+  '(`claude-mem-lite doctor` rebuilds it too, and re-checks everything else).';
+
 /**
  * True when `err` means "this file exists and SQLite cannot use it as a database".
  *

package/lib/deferred-work.mjs

@@ -1,5 +1,5 @@
 import { DAY_MS } from './time-constants.mjs';
-import { scrubRecord } from './scrub-record.mjs';
+import { scrubRecord, scrubFilePaths } from './scrub-record.mjs';
 // claude-mem-lite — deferred_work data layer
 // Pure-data CRUD + ordinal resolver + transactional closure helper.
 // Decoupled from observations table: different lifecycle, different scoring.
@@ -49,7 +49,12 @@ export function insertDeferred(db, args) {
     Date.now(),
     source_session_id,
     source_prompt_id,
-    files ? JSON.stringify(files) : null,
+    // The SIXTH path column. `files` is agent-writable on two live faces (MCP
+    // `mem_defer(files=…)`, CLI `defer add --files`) and was stringified raw beside a
+    // title scrubRecord had already cleaned — the same asymmetry the D#44 round is named
+    // after, on the column scrub-record.mjs's header names explicitly. A non-array falls
+    // through untouched, so a null stays null rather than becoming '[]'.
+    files ? JSON.stringify(scrubFilePaths(files)) : null,
   );
   return { id: Number(r.lastInsertRowid) };
 }

package/lib/file-edge-match.mjs

@@ -48,6 +48,11 @@
 // The one import below does not cost that: project-utils.mjs is a leaf over
 // `node:path`, and pre-tool-recall.js already imports it for inferProject.
 import { likeLiteral } from '../project-utils.mjs';
+// The second import, and it costs no more than the first: scrub-record.mjs ->
+// secret-scrub.mjs -> lib/private-strip.mjs are three regex-only leaves — no
+// node builtins, no DB handle, nothing child_process-shaped. Checked rather
+// than asserted, because the dependency note in this file has been wrong twice.
+import { scrubFilePath } from './scrub-record.mjs';
 
 /**
  * SQL boolean expression for the four-arm match. Placeholder order matches
@@ -233,8 +238,47 @@ export function toolEditPath(input) {
   return input.file_path ?? input.notebook_path;
 }
 
-/** Bind values for fileMatchClause, in placeholder order. */
-export function fileMatchParams(filePath) {
+/**
+ * Bind values for fileMatchClause, in placeholder order.
+ *
+ * D#44: the query path is scrubbed with the SAME helper the writers use, because
+ * `observation_files.filename` is a stored value AND the key matched against it.
+ * Once the write side pre-scrubs each element, a raw query path derives a
+ * different key from the row it is looking for — and only for the one shape that
+ * matters: a credential in the BASENAME rewrites the token arms 2-4 bind
+ * (`/repo/ghp_….mjs` -> `/repo/***.mjs`), so the lesson about that file becomes
+ * unreachable through the file itself. A credential confined to a directory
+ * segment is invisible to this, which is why the guard for it uses the basename
+ * shape; a case built on the directory shape passes with the reader unscrubbed.
+ *
+ * That second sentence is true BY CONSTRUCTION and was not, for one commit. Whole-path
+ * scrubbing let the eight KV-shaped patterns eat the separator, so
+ * `/repo/token=<secret>/notes.mjs` derived `/repo/token=***` — basename destroyed, and
+ * every file under that directory sharing one key. `scrubFilePath` splits on the separator
+ * first, which bounds every pattern to its own segment; the pre-ship review caught the
+ * window between.
+ *
+ * One consequence is deliberate and stays: a row written BEFORE 6.8.2 holds a raw path,
+ * and the query key is now derived. For a directory-segment credential the basename is
+ * untouched on both sides, so arms 2-4 still reach it (measured: 4 of 5 shapes). A row
+ * whose BASENAME is itself a credential is the exception — it is unreachable by its raw
+ * name until D#49 backfills the stored value, and it is by definition one of the leaking
+ * rows that backfill exists for.
+ *
+ * Doing it HERE rather than in each caller is this module's whole premise: the
+ * header above requires pre-tool-recall.js and edge-attribution.mjs to stay in
+ * byte-identical agreement, and recall-core.mjs + searchByFile bind the same
+ * clause. FIVE call sites across four modules — recall-core.mjs has two,
+ * recallByFile and countRecallableByFile — and one derivation. Counted by call
+ * site, because that is the unit an auditor asking "did every consumer move?"
+ * actually walks; the same change described it as four elsewhere.
+ *
+ * Not measurable on the maintainer's corpus — 0 of 2340 stored path values, and
+ * 0 of 100 junction rows, change under scrubSecrets (readonly census,
+ * 2026-09-13). That is a property of that corpus on that date, not of the code.
+ */
+export function fileMatchParams(rawFilePath) {
+  const filePath = scrubFilePath(rawFilePath);
   const fname = basenameAnySep(filePath);
   const escaped = likeLiteral(fname);
   // `%\\` before the basename: under ESCAPE '\', a literal backslash is

package/lib/import-jsonl.mjs

@@ -17,7 +17,7 @@
 import { readFileSync, statSync } from 'fs';
 import { createHash } from 'crypto';
 import { scrubSecrets } from '../secret-scrub.mjs';
-import { scrubRecord } from './scrub-record.mjs';
+import { scrubRecord, scrubFilePaths } from './scrub-record.mjs';
 import { toolEditPath } from './file-edge-match.mjs';
 import { insertObservationFiles } from './observation-write.mjs';
 
@@ -160,15 +160,22 @@ function importToolPair(db, toolUse, toolResult, project) {
   // while being unable to fire for it, and every imported notebook edit built
   // no (obs,file) edge. `toolEditPath` is the single home for that rule.
   const editedPath = toolEditPath(toolUse.input);
-  const filesModified =
+  // D#44: scrubbed at the derivation, so the files_modified JSON column and the
+  // observation_files junction (both fed from this one array below) cannot
+  // disagree. The title built from this same path was already scrubbed via
+  // scrubRecord — that asymmetry was the defect.
+  const filesModified = scrubFilePaths(
     (toolName === 'Edit' || toolName === 'Write' || toolName === 'NotebookEdit') && editedPath
       ? [editedPath]
-      : [];
+      : [],
+  );
   // `file_path`, not the shared `editedPath`: `toolEditPath` answers "which path did this
   // tool WRITE", and falls back to `notebook_path` for NotebookEdit's sake. Routing the read
   // column through it too gave a `Read` carrying only `notebook_path` a files_read entry —
   // a shape no tool emits, and a behaviour change D#35 made without declaring it (P3-5).
-  const filesRead = toolName === 'Read' && toolUse.input?.file_path ? [toolUse.input.file_path] : [];
+  const filesRead = scrubFilePaths(
+    toolName === 'Read' && toolUse.input?.file_path ? [toolUse.input.file_path] : [],
+  );
 
   // `narrative` carries the body and `text` is the derived search blob
   // (lib/observation-write.mjs rebuildObservationDerived). Writing the payload to `text`

package/lib/injected-ids.mjs

@@ -72,18 +72,27 @@ export function injectedIdsFileName(project, sessionId) {
  * false and the next person to diff the two would have had to rediscover why.
  */
 export function readInjectedMarker(file, { sessionId, maxAgeMs } = {}) {
-  const empty = { ids: [], count: 0, fresh: false };
+  const empty = { ids: [], count: 0, upsCount: 0, upsTs: 0, fresh: false };
   try {
-    const { ids, ts, count, session } = JSON.parse(readFileSync(file, 'utf8'));
+    const { ids, ts, count, upsCount, upsTs, session } = JSON.parse(readFileSync(file, 'utf8'));
     if (session && sessionId && session !== sessionId) return empty;
     if (!ts || Date.now() - ts > maxAgeMs) return empty;
     if (!Array.isArray(ids)) return empty;
-    return { ids, count: count || 0, fresh: true };
+    return { ids, count: count || 0, upsCount: upsCount || 0, upsTs: upsTs || 0, fresh: true };
   } catch {
     return empty;
   }
 }
 
+/**
+ * Hard ceiling on the marker's `ids` array, applied to BOTH arms.
+ *
+ * 2x the largest seen-set this repo has measured in the wild (16, histogram at
+ * scripts/pre-tool-recall.js:92-93). See mergeInjectedMarker for why an unbounded set is
+ * not merely a size problem.
+ */
+export const MAX_MARKER_IDS = 32;
+
 /**
  * Write `newIds` into a marker, unioning with a fresh same-session payload or replacing it.
  *
@@ -92,12 +101,21 @@ export function readInjectedMarker(file, { sessionId, maxAgeMs } = {}) {
  *   - `union`   stringifies the whole result. Both union callers already did
  *               (`prev.ids.map(String)` plus new ids that are `D<id>` strings anyway), so
  *               this is their behaviour, not a new normalisation.
- *   - `replace` writes `newIds` verbatim. The UPS main leg passes `candidateIds`, a MIX of
- *               raw observation numbers and `P<id>` strings, and writing those unchanged is
- *               exactly the state D#213 measures. Stringifying here would change it.
+ *   - `replace` writes `newIds` verbatim and carries every OTHER id forward as a string.
+ *               The UPS main leg passes `candidateIds`, a MIX of raw observation numbers
+ *               and `P<id>` strings, and writing those unchanged is exactly the state
+ *               D#213 measures. Stringifying them here would change it. It replaces the
+ *               caller's own slice, not the file (R12 B-6 — see mergeInjectedMarker).
  * Keeping both under one function is the point: the next writer picks a mode instead of
  * copying a fifth predicate and inventing a fifth typing rule.
  *
+ * TWO counters, and they answer different questions (R12 B-5). `count` is "how many times
+ * has anything written this marker" and stays as it was. `upsCount` is "how many times has
+ * the UPS face injected", and ONLY the caller that owns `MAX_SESSION_INJECTIONS` opts into
+ * bumping it. They were one field, so pre-tool-recall — which writes once per triggered
+ * Edit/Read and shares this file — spent the fyi face's entire per-session budget without
+ * the fyi face emitting a line. A budget has to be charged to the spender.
+ *
  * The write is atomic for the reason M-6 recorded: a plain write torn by a concurrent hook
  * left the shared marker as invalid JSON, silently disabling cross-hook dedup for the window.
  *
@@ -108,15 +126,56 @@ export function readInjectedMarker(file, { sessionId, maxAgeMs } = {}) {
  * @param {number} opts.maxAgeMs
  * @param {'union'|'replace'} opts.mode
  */
-export function mergeInjectedMarker(file, newIds, { sessionId, maxAgeMs, mode } = {}) {
+export function mergeInjectedMarker(file, newIds, { sessionId, maxAgeMs, mode, bumpUpsCount = false } = {}) {
   const prev = readInjectedMarker(file, { sessionId, maxAgeMs });
-  const ids = mode === 'union' ? [...new Set([...prev.ids.map(String), ...newIds.map(String)])] : newIds;
+  // R12 B-6. `replace` used to write `newIds` as the WHOLE array, so the UPS main leg's
+  // one write per prompt erased everything pre-tool-recall had accumulated in the window
+  // and that face re-injected lessons it had already shown. It now replaces the CALLER's
+  // slice and carries the rest.
+  //
+  // The carried ids are stringified and the caller's are not, and that asymmetry is the
+  // load-bearing part rather than an oversight: D#213's exclude is inert BECAUSE
+  // `new Set(excludeIds).has(<number from SQLite>)` misses a string key, and the UPS leg's
+  // raw numbers are the one population that is NOT inert. Writing `newIds` verbatim keeps
+  // that population byte-identical to what it was, and everything carried in arrives as a
+  // string, so this cannot widen the live exclude. Repairing D#213 is a separate decision
+  // with its own ruler (lib/patha-exclude-meter.mjs).
+  const newKeys = new Set(newIds.map(String));
+  const carried = [...new Set(prev.ids.map(String))].filter((id) => !newKeys.has(id));
+  // Both arms are built NEWEST-FIRST and then capped. Until B-6, `replace` overwriting the
+  // whole array was the only thing that ever shrank this file — `union` has always
+  // accumulated, and `ts` is refreshed on every write, so the staleness gate never fires in
+  // a session where any hook writes inside the window. Making replace carry the other
+  // hook's ids therefore removed a bound nobody had written down: measured 520 ids after 40
+  // rounds of 5 pre-tool-recall triggers plus one prompt, linear and unbounded.
+  //
+  // A large seen-set does not just cost bytes, it starves the face it exists to help.
+  // scripts/pre-tool-recall.js sizes its over-fetch as `min(seenSize, 5)` and then drops
+  // every fetched row that is IN the set, so past a handful of entries a Read can fetch six
+  // candidates and filter all six. That failure is described at pre-tool-recall.js:100-105,
+  // derived at a seen-set of 16 — which is the largest this repo has measured in the wild
+  // (`pre-tool-recall.js:92-93`, histogram 1x9 2x1 3x2 16x1 over n=13).
+  //
+  // So the cap is 2x the largest observed set, not a round number pulled from nowhere. It
+  // BOUNDS that failure; it does not remove it — six candidates can still all be seen — and
+  // removing it is ALGO-4's problem, not this one.
+  const ids = (
+    mode === 'union'
+      ? [...new Set([...newIds.map(String), ...prev.ids.map(String)])]
+      : [...newIds, ...carried]
+  ).slice(0, MAX_MARKER_IDS);
   atomicWriteFileSync(
     file,
     JSON.stringify({
       ids,
       ts: Date.now(),
       count: prev.count + 1,
+      upsCount: prev.upsCount + (bumpUpsCount ? 1 : 0),
+      // The UPS face's budget needs the UPS face's CLOCK, not the shared one. `ts` is
+      // refreshed by every writer, and readInjectedMarker zeroes upsCount off `ts`, so a
+      // tool-heavy session kept the fyi face's spent budget alive across gaps that should
+      // have released it — B-5 moved the counter to the spender and left the clock shared.
+      upsTs: bumpUpsCount ? Date.now() : prev.upsTs,
       ...(sessionId ? { session: sessionId } : {}),
     }),
   );

package/lib/save-observation.mjs

@@ -13,6 +13,7 @@
 
 import { jaccardSimilarity, scrubSecrets, computeMinHash, cjkBigrams, getCurrentBranch } from '../utils.mjs';
 import { DEDUP_JACCARD_THRESHOLD } from './dedup-constants.mjs';
+import { scrubFilePaths } from './scrub-record.mjs';
 import { insertObservationRow, insertObservationFiles } from './observation-write.mjs';
 // The SAME predicate every read path uses. Imported rather than re-typed: a hand-written
 // `superseded_at IS NULL` here would drift from the read side on the next column change,
@@ -174,9 +175,12 @@ export function saveObservation(db, params) {
     throw new Error('mem_save: content is empty or whitespace-only');
   }
   const importance = params.importance ?? 2;
-  const files = Array.isArray(params.files)
-    ? params.files.filter((f) => typeof f === 'string' && f.length > 0)
-    : [];
+  // D#44: scrub HERE, at the derivation, not at the two sinks below — this one
+  // array feeds both `files_modified` (JSON column) and the observation_files
+  // junction, and scrubbing at each sink separately is how they drift apart.
+  const files = scrubFilePaths(
+    Array.isArray(params.files) ? params.files.filter((f) => typeof f === 'string' && f.length > 0) : [],
+  );
   const rawLesson =
     typeof params.lesson_learned === 'string' && params.lesson_learned.length > 0
       ? params.lesson_learned

package/lib/scrub-record.mjs

@@ -10,7 +10,13 @@
 // session_handoffs.match_keywords-when-array) are NOT listed here — running
 // scrubSecrets over the JSON string can rewrite quoted values and break
 // downstream JSON.parse. Pre-scrub each element upstream of the
-// JSON.stringify call instead.
+// JSON.stringify call instead, via `scrubFilePaths` below.
+//
+// D#44: that instruction sat here for four releases and exactly ONE call site
+// followed it (hook-handoff.mjs, session_handoffs.key_files). observations
+// .files_modified / .files_read, observation_files.filename and events
+// .file_paths all stored raw paths while the title DERIVED FROM THE SAME PATH
+// was scrubbed. A prescription in a comment is not a mechanism; the helper is.
 
 import { scrubSecrets } from '../secret-scrub.mjs';
 
@@ -62,11 +68,69 @@ export const TEXT_FIELDS_BY_TABLE = {
   // the unknown-table failsafe ever ran. title/detail are written verbatim by the agent
   // ("rotate ghp_… before release", a connection string in detail) and replayed into
   // model context by the SessionStart dashboard, mem_defer_list and mem_get D#N.
-  //   files — JSON.stringify(array); pre-scrub elements at the call site if ever needed.
+  //   files — JSON.stringify(array); pre-scrubbed element-wise at insertDeferred via
+  //           `scrubFilePaths`. It needed to be: `mem_defer` and `defer add --files` both
+  //           take agent-supplied paths, and this line prescribed the remedy for four
+  //           releases while the call site stored them raw.
   //   project / status — identifiers and an enum.
   deferred_work: ['title', 'detail', 'drop_reason'],
 };
 
+/**
+ * Scrub one filesystem path — for PERSISTENCE and for KEY DERIVATION, which is
+ * why this is a named export and not an inline `scrubSecrets(f)` at each site.
+ *
+ * `observation_files.filename` is both a stored value and the recall key
+ * (lib/file-edge-match.mjs binds it four ways). If the write side scrubs and the
+ * read side does not, the two derive different keys from the same path and a
+ * lesson becomes unreachable through the very file it is about. Both sides call
+ * THIS, so they cannot drift apart — the same rule this repo already enforces
+ * for `fileMatchClause`'s two consumers.
+ *
+ * Total by construction: it never throws, because one caller is a hook on the
+ * PreToolUse path. Nullish becomes '' (`p ?? ''`); anything else becomes its
+ * String() form, so 42 yields '42', not ''.
+ */
+export function scrubFilePath(p) {
+  // SEGMENT-WISE, and that is the whole point rather than a micro-optimisation.
+  // Eight SECRET_PATTERNS carry a value class that does not exclude `/`
+  // (secret-scrub.mjs:33/74/78/83/98/109/259/260). On prose that is correct; run
+  // whole-path, the match eats the separator and everything after it, so
+  // `/repo/token=<secret>/notes.mjs` became `/repo/token=***` — the filename
+  // destroyed at WRITE time and unrecoverable, and every file under such a
+  // directory collapsing onto one recall key (measured: an untouched `gamma.mjs`
+  // recalled another file's observations). Splitting first bounds every pattern to
+  // the segment it matched in.
+  //
+  // The trade, stated rather than glossed: a credential whose own syntax spans a
+  // separator is no longer caught here — the Slack webhook path and the
+  // `scheme://user:pass@host` arms both need their `/` characters. Those are URL
+  // shapes, and these columns hold filesystem paths; `scrubSecrets` still runs
+  // whole-string on every prose field, which is where a URL actually lands.
+  // Preserving path structure wins because the path IS the recall key.
+  //
+  // The capture group keeps the separators in the split output, so join()
+  // reconstructs the original byte-for-byte when nothing matches.
+  return String(p ?? '')
+    .split(/([/\\])/)
+    .map((part) => (part === '/' || part === '\\' ? part : scrubSecrets(part)))
+    .join('');
+}
+
+/**
+ * Element-wise scrub for a path ARRAY, to be called upstream of the
+ * `JSON.stringify` / junction INSERT this module's header points at.
+ *
+ * A non-array flows through UNTOUCHED, mirroring scrubRecord's own contract for
+ * non-string fields. That is load-bearing rather than defensive: call sites pass
+ * `undefined` on purpose (`JSON.stringify(undefined)` is `undefined`, which is
+ * how a column stays NULL), and coercing it to `[]` here would quietly rewrite
+ * NULL to '[]' in columns other code tests with `IS NULL` / `NOT IN (NULL,'[]')`.
+ */
+export function scrubFilePaths(paths) {
+  return Array.isArray(paths) ? paths.map(scrubFilePath) : paths;
+}
+
 /**
  * Scrub the text fields of a record before INSERT.
  * Returns a shallow copy with string text-fields scrubbed; the input object

package/mem-cli.mjs

@@ -5,6 +5,7 @@
 import { homedir } from 'os';
 import { ensureDbWithWalRecovery, DB_PATH, DB_DIR, CODE_DIR } from './schema.mjs';
 import { resolveRuntimeDir } from './lib/resolve-data-dir.mjs';
+import { isFtsCorruptionError, FTS_CORRUPTION_REMEDY } from './lib/db-unusable.mjs';
 import { truncate, typeIcon, inferProject, scrubSecrets, COMPRESSED_PENDING_PURGE } from './utils.mjs';
 import { resolveProject } from './project-utils.mjs';
 // READ commands resolve the project DB-aware: a subdirectory whose own name holds no rows
@@ -3847,6 +3848,12 @@ export async function run(argv) {
     // agent runs the CLI, the model's context — got a raw Node stack trace. Print the
     // message, keep the stack behind CLAUDE_MEM_DEBUG for whoever is actually debugging.
     process.stderr.write(`[mem] ${cmd || 'command'} failed: ${(e && e.message) || e}\n`);
+    // A damaged FTS5 index reaches here as SQLITE_CORRUPT_VTAB from the first MATCH.
+    // `fts-check` and `doctor` touch the index too — and both already explain themselves —
+    // so `search` is the one command that DEAD-ENDS on SQLite's sentence, while `recent` /
+    // `recall` / `browse` / `context` / `stats` never read the index and keep working.
+    // The remedy is lossless (see FTS_CORRUPTION_REMEDY); the exit code stays 1.
+    if (isFtsCorruptionError(e)) process.stderr.write(`[mem] ${FTS_CORRUPTION_REMEDY}\n`);
     if (process.env.CLAUDE_MEM_DEBUG) process.stderr.write(`${(e && e.stack) || ''}\n`);
     process.exitCode = 1;
   } finally {

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.8.1",
+  "version": "6.8.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "claude-mem-lite",
-      "version": "6.8.1",
+      "version": "6.8.3",
       "os": [
         "darwin",
         "linux",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.8.1",
+  "version": "6.8.3",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",

package/scripts/pre-tool-recall.js

@@ -27,6 +27,7 @@ import {
   jsonArrayLikeNeedle,
   toolEditPath,
 } from '../lib/file-edge-match.mjs';
+import { scrubFilePath } from '../lib/scrub-record.mjs';
 import { fileIntelFor } from '../lib/file-intel.mjs';
 import { shouldWarnReread, buildRereadWarning, readFileMeta } from '../lib/reread-guard.mjs';
 import { recordMetric } from '../lib/metrics.mjs';
@@ -538,7 +539,14 @@ try {
     // needs the same key, and host-native `basename` gave it the whole path for a
     // Windows-shaped payload. Fixing the observations leg alone would have left this
     // hook recalling lessons but no events.
-    const fname = basenameAnySep(filePath);
+    // D#44: the KEY derivation is scrubbed; `filePath` itself is NOT reused for
+    // this, because the same variable is still handed to readFileMeta and friends
+    // to stat a real file on disk — a globally scrubbed path would point nowhere.
+    // events.file_paths is now written pre-scrubbed (lib/activity.mjs), and the
+    // observations leg below scrubs inside fileMatchParams, so both legs of this
+    // hook keep deriving the same key — which is what the note above requires.
+    const keyPath = scrubFilePath(filePath);
+    const fname = basenameAnySep(keyPath);
     // Needle for the events leg's JSON-array column — see jsonArrayLikeNeedle for
     // why the JSON escape has to run before the LIKE one. The observations leg
     // below matches a plain column and gets its params from fileMatchParams.
@@ -652,7 +660,7 @@ try {
     // patterns match both basename and full-path entries. JSON quoting
     // (`"<name>"`) prevents partial-match false positives like "foo.mjs"
     // matching "myfoo.mjs".
-    const fullPathNeedle = jsonArrayLikeNeedle(filePath);
+    const fullPathNeedle = jsonArrayLikeNeedle(keyPath);
     // v2.34.6: Read also tightens the events query — only rows with a non-empty
     // body (= lesson equivalent). Edit path keeps a wider net, but P0 (D#78)
     // closes the parallel-path drift vs the observations query: a bodyless row

package/scripts/prompt-search-utils.mjs

@@ -225,9 +225,26 @@ export function shouldSkipByDedup(newIds, injectedFile, sessionId) {
   if (!newIds || newIds.length === 0) return true;
   try {
     const raw = readFileSync(injectedFile, 'utf8');
-    const { ids: prevIds, ts, count = 0, session } = JSON.parse(raw);
+    const { ids: prevIds, ts, upsCount = 0, upsTs = 0, session } = JSON.parse(raw);
     if (session && sessionId && session !== sessionId) return false;
-    if (count >= MAX_SESSION_INJECTIONS) return true;
+    // R12 B-5, two defects on these two lines, and they had to be fixed together.
+    //
+    // (1) The cap reads `upsCount`, not the shared `count`. `count` is bumped by every
+    // hook that writes this marker — pre-tool-recall does so once per triggered Edit/Read
+    // — so a session that touched 15 lesson-bearing files had already spent this face's
+    // whole budget before it injected anything. Markers written before this field existed
+    // read 0, which releases a cap that should never have been charged.
+    //
+    // (2) Freshness is judged FIRST. The cap used to sit above it, so once `count` hit the
+    // ceiling the marker suppressed injection even after it went stale — and nothing
+    // lowers it again, since the reset only happens on the next WRITE and the write never
+    // comes. The only escape was a new session id.
+    // (3) The cap is judged on `upsTs`, the UPS face's OWN clock. `ts` moves on every
+    // writer's write, so judging the budget against it let another hook's activity keep a
+    // spent budget alive indefinitely — the same spender/charged mismatch as (1), arriving
+    // through the clock instead of the counter. A marker with no `upsTs` (anything written
+    // before this field existed) reads 0 and never caps, matching upsCount's default.
+    if (upsTs && Date.now() - upsTs <= DEDUP_STALE_MS && upsCount >= MAX_SESSION_INJECTIONS) return true;
     if (!ts || Date.now() - ts > DEDUP_STALE_MS) return false;
     if (!Array.isArray(prevIds) || prevIds.length === 0) return false;
     // Normalize both sides to strings before comparing: UPS writes obs ids as numbers

package/scripts/user-prompt-search.js

@@ -798,6 +798,12 @@ async function main() {
             sessionId: hookData.session_id,
             maxAgeMs: DEDUP_STALE_MS,
             mode: 'union',
+            // This leg is GATED by shouldSkipByDedup, so it has to charge the cap it reads.
+            // Before B-5 it did, because the cap was the shared `count` this write bumps;
+            // moving the cap to `upsCount` left the gated population {main leg, D#N leg}
+            // larger than the charged population {main leg}. Same spender/charged mismatch
+            // B-5 fixed, on the sibling call site.
+            bumpUpsCount: true,
           });
         } catch {}
       }
@@ -1083,6 +1089,10 @@ async function main() {
           sessionId: hookData.session_id,
           maxAgeMs: DEDUP_STALE_MS,
           mode: 'replace',
+          // R12 B-5: this is the leg MAX_SESSION_INJECTIONS budgets, so it is the only
+          // one that charges against it. The shared `count` is bumped by every hook that
+          // touches this file and is no longer what the cap reads.
+          bumpUpsCount: true,
         });
       } catch {}
       // v26 P0: bump injection_count for obs-based emits only (prompt-corpus

package/server.mjs

@@ -118,6 +118,7 @@ import { saveWithClosures, formatSupersedeSkipped, formatSupersededNote } from '
 import { applyObsUpdate } from './lib/observation-write.mjs';
 import { EXPORT_COLUMNS_SQL, buildExportWhere } from './lib/export-columns.mjs';
 import { recallByFile } from './lib/recall-core.mjs';
+import { isFtsCorruptionError, FTS_CORRUPTION_REMEDY } from './lib/db-unusable.mjs';
 import { fetchRecent } from './lib/recent-core.mjs';
 import { AUTO_MERGE_THRESHOLD } from './lib/dedup-constants.mjs';
 import {
@@ -374,7 +375,17 @@ function safeHandler(fn, { verbatim = false } = {}) {
       const result = await fn(args, extra);
       return verbatim ? result : defangResult(result, { skillBlocks: true });
     } catch (err) {
-      return defangResult({ content: [{ type: 'text', text: `Error: ${err.message}` }], isError: true });
+      // A damaged FTS5 index arrives here as SQLITE_CORRUPT_VTAB from the first MATCH.
+      // Without this the model got SQLite's own sentence and nothing else, on a fault it
+      // could have had fixed in one command — and mem_recent / mem_recall / mem_browse
+      // keep answering, so the dead end reads as "nothing matched". Both channels carry the
+      // same string here, deliberately: unlike the file-level remedy this one is lossless
+      // (see FTS_CORRUPTION_REMEDY in lib/db-unusable.mjs).
+      const hint = isFtsCorruptionError(err) ? `\n${FTS_CORRUPTION_REMEDY}` : '';
+      return defangResult({
+        content: [{ type: 'text', text: `Error: ${err.message}${hint}` }],
+        isError: true,
+      });
     }
   };
 }