linksee-memory 0.11.2 → 0.11.4

package/README.md

@@ -419,6 +419,26 @@ Add to `~/.gemini/settings.json`:
 
 </details>
 
+<details>
+<summary><strong>Claude Desktop</strong></summary>
+
+Add the same stdio command to `claude_desktop_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "linksee": {
+      "command": "npx",
+      "args": ["-y", "linksee-memory"]
+    }
+  }
+}
+```
+
+Config file: macOS `~/Library/Application Support/Claude/`, Windows `%APPDATA%\Claude\`. Restart Claude Desktop.
+
+</details>
+
 All editors share the same `~/.linksee-memory/memory.db`. A decision made in Claude Code is recalled in Cursor. A caveat recorded in Windsurf prevents the same mistake in Codex.
 
 ### Database location
@@ -593,6 +613,20 @@ Claude Code ships a built-in memory feature at `~/.claude/projects/<path>/memory
 
 Use both.
 
+## Security & privacy
+
+linksee-memory runs locally and is built to read — and send — as little as possible.
+
+- **Local-first.** Memory is one SQLite file at `~/.linksee-memory/memory.db`. No account, no cloud, no API key.
+- **Telemetry is opt-in and OFF by default.** Nothing is sent unless you set `LINKSEE_TELEMETRY=basic`. Even then it never sends your source code, file contents, prompts, conversation, entity/project names, or the memory DB — only anonymous counters ([details](#telemetry-opt-in-off-by-default)).
+- **No automatic repo crawling.** linksee reads: memory you explicitly save, your `map.yaml`, the specific files a map reality-check points at, the local SQLite DB, and — when the Stop hook fires — your Claude Code session transcript (locally, to capture what happened). It does **not** crawl your repo, read `.env`/secrets/`node_modules`, or touch your home directory on its own.
+- **Clean MCP transport.** The server writes only JSON-RPC to stdout; all logs go to stderr.
+- **Hooks are documented and removable.** `setup` adds a Stop hook (session capture) and an optional guard hook. They make no network calls by default, are time-bounded, fail-open (a hook error never breaks your session), and are listed under [Uninstall](#uninstall).
+- **No shell-injection surface.** Subcommands run via `spawn` with array args and `shell: false`, from a fixed allowlist; `map.yaml` is parsed with the safe `yaml` parser (no arbitrary tag execution).
+- **Supply chain.** MIT, published from a single owner. `npx -y linksee-memory` runs the published package — pin a version in CI if you need reproducibility.
+
+Found a security issue? See [SECURITY.md](SECURITY.md).
+
 ## Telemetry (opt-in, off by default)
 
 linksee-memory ships with **opt-in** anonymous telemetry that helps us understand which MCP servers and workflows actually work in the wild. **Nothing is sent unless you explicitly enable it.** No conversation content, no file content, no entity names, no project paths — ever.
@@ -606,7 +640,7 @@ export LINKSEE_TELEMETRY=off       # opt out (or just unset the variable)
 
 ### Exactly what gets sent (Level 1 contract)
 
-After each Claude Code session ends, the Stop hook sends one POST to `https://kansei-link-mcp-production.up.railway.app/api/telemetry/linksee` containing only these fields:
+After each Claude Code session ends, the Stop hook sends one POST to `https://linksee-site.vercel.app/api/telemetry/linksee` containing only these fields:
 
 | Field | Example | What it is |
 |---|---|---|
@@ -804,6 +838,11 @@ After install, in a new Claude session ask: *"Can you remember that I prefer Typ
 
 ## Changelog
 
+### v0.11.3 — Robustness + MCP hygiene (2026-06-16)
+
+- **Corrupt-database recovery:** if `~/.linksee-memory/memory.db` is unreadable, linksee preserves it as `memory.db.corrupt-<timestamp>` and starts a fresh one (with a clear message) instead of crashing with a raw SQLite error. Old memories stay recoverable in the backup.
+- **`recall` tool description** no longer suggests editing your system prompt — cleaner MCP citizenship.
+
 ### v0.11.2 — More cold-start hardening (2026-06-16)
 
 - **`stats` works on a fresh database** instead of crashing with `no such table` — it ensures the schema exists first (it may be the first command a new user runs).

package/dist/bin/export-report.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/bin/export-report.js

@@ -0,0 +1,208 @@
+#!/usr/bin/env node
+// linksee-memory-export — export a project's memory as a shareable Markdown report.
+// Usage:
+//   npx -y linksee-memory export <project>              → Markdown to stdout
+//   npx -y linksee-memory export <project> --out file.md
+//
+// The point (cold-start killer + quiet team sharing): pull your decisions + the WHY
+// behind them + what's drifting OUT as a readable artifact you can paste into Notion or
+// Slack — for a team that never opens the dashboard. Read-only. Surfaces drift on
+// purpose, so the day-1 value pulls toward the core instead of away from it.
+import { writeFileSync } from 'node:fs';
+import { openDb, runMigrations } from '../db/migrate.js';
+import { getAnchorRetention } from '../lib/anchor-touch.js';
+function parseArgs() {
+    const argv = process.argv.slice(2);
+    const a = { project: null, out: null, help: false };
+    for (let i = 0; i < argv.length; i++) {
+        const v = argv[i];
+        if (v === '--out' || v === '-o')
+            a.out = argv[++i] ?? null;
+        else if (v === '-h' || v === '--help')
+            a.help = true;
+        else if (!v.startsWith('-') && a.project === null)
+            a.project = v;
+    }
+    return a;
+}
+const fmtDate = (unix) => (unix ? new Date(unix * 1000).toISOString().slice(0, 10) : '—');
+const clip = (s, n = 240) => (s.length > n ? s.slice(0, n - 1) + '…' : s);
+// memories.content is either plain text or a JSON blob {what, why, title, …}. Pull the
+// human-meaningful pair (what + why) so the report reads like prose, not a data dump.
+function parseContent(raw) {
+    try {
+        const j = JSON.parse(raw);
+        if (j && typeof j === 'object') {
+            const what = String(j.what ?? j.title ?? j.learned ?? j.rule_or_warning ?? '').trim();
+            const whyRaw = j.why ?? j.from_incident ?? null;
+            const why = whyRaw ? String(whyRaw).trim() : null;
+            if (what)
+                return { what, why };
+            // pure machine log (intent/session capture) with no human field → empty → dropped as noise
+            if (j.intent || j.when || j.session_id || j.at)
+                return { what: '', why: null };
+        }
+    }
+    catch { /* plain text — fall through */ }
+    return { what: raw.replace(/\s+/g, ' ').trim(), why: null };
+}
+function main() {
+    const args = parseArgs();
+    if (args.help) {
+        console.log(`linksee-memory-export — export a project's memory as a Markdown report
+
+  <project>          Entity/project name to export (default: highest-momentum project)
+  --out, -o <file>   Write to a file instead of stdout
+  -h, --help         This message
+`);
+        return;
+    }
+    const db = openDb();
+    runMigrations(db);
+    // Resolve the project entity (by name / normalized name / canonical key; else top project).
+    let entity = args.project
+        ? db.prepare(`SELECT id, name, kind, momentum_score FROM entities
+         WHERE name = ? OR normalized_name = ? OR canonical_key = ? LIMIT 1`).get(args.project, args.project.toLowerCase(), args.project)
+        : null;
+    if (!entity) {
+        entity = db.prepare(`SELECT id, name, kind, momentum_score FROM entities WHERE kind = 'project'
+       ORDER BY momentum_score DESC LIMIT 1`).get();
+    }
+    if (!entity) {
+        console.error('No project found. Pass a project name:  linksee export <project>');
+        db.close();
+        process.exitCode = 1;
+        return;
+    }
+    const nowS = Math.floor(Date.now() / 1000);
+    // Decisions & WHY. Scope to THIS project when its Map links anchors to nodes
+    // (map_nodes.anchor_id); otherwise fall back to the project-wide truth map. No schema
+    // change — we reuse the existing map↔anchor linkage so the report isn't polluted by
+    // other projects' decisions (B fix, 2026-06-18).
+    const SELECT_ANCHORS = 'SELECT id, kind, statement, rationale, decision_mode, domain, lifecycle, confidence, review_after, updated_at FROM drift_anchors';
+    const ORDER_ANCHORS = "ORDER BY (lifecycle != 'active') DESC, updated_at DESC";
+    const mapProject = db.prepare('SELECT project FROM map_projects WHERE project = ? OR LOWER(project) = LOWER(?) LIMIT 1').get(entity.name, entity.name)?.project;
+    const scopedIds = mapProject
+        ? db.prepare('SELECT DISTINCT anchor_id FROM map_nodes WHERE project = ? AND anchor_id IS NOT NULL')
+            .all(mapProject).map((r) => r.anchor_id)
+        : [];
+    const scopedAnchors = scopedIds.length
+        ? db.prepare(`${SELECT_ANCHORS} WHERE status = 'active' AND id IN (${scopedIds.map(() => '?').join(',')}) ${ORDER_ANCHORS}`).all(...scopedIds)
+        : [];
+    // Use the project-scoped set ONLY if the Map wires enough decisions to it. A hand-written
+    // map links just a handful of anchors → too sparse to scope by → fall back to the
+    // project-wide truth map (clearly labeled). The proper fix is a `project` column on anchors.
+    const anchorScoped = scopedAnchors.length >= 4;
+    const anchors = (anchorScoped
+        ? scopedAnchors
+        : db.prepare(`${SELECT_ANCHORS} WHERE status = 'active' ${ORDER_ANCHORS}`).all());
+    const needsAttention = anchors.filter((a) => ['at_risk', 'experiment', 'superseded', 'paused', 'deprecated'].includes(a.lifecycle)
+        || (a.review_after && a.review_after < nowS));
+    // Key memories for this entity, grouped by layer — filtered to what's worth SHARING.
+    // Drop the two noise sources a shareable report must not leak: raw session-intent pastes
+    // (un-distilled first-message captures) and auto edit-logs ("edit foo.ts (4 ops)").
+    const SESSION_INTENT = 'Session intent — first user message';
+    const EDIT_LOG = /^(edit|write|read|write\+edit)\b.*\(\d+\s*ops?\)/i;
+    const isNoise = (what, why) => !what.trim()
+        || why === SESSION_INTENT
+        || EDIT_LOG.test(what)
+        || /\(\d+\s*ops?\)\s*$/.test(what)
+        || /^\{[\s\S]*"(intent|session_id|when)"/.test(what);
+    const mems = db.prepare(`SELECT layer, content, importance, protected, created_at FROM memories
+     WHERE entity_id = ? ORDER BY importance DESC, created_at DESC`).all(entity.id)
+        .map((m) => ({ ...m, parsed: parseContent(m.content) }))
+        .filter((m) => !isNoise(m.parsed.what, m.parsed.why))
+        // internal layers (implementation/context) only surface their explicitly-pinned notes here
+        .filter((m) => !['implementation', 'context'].includes(m.layer) || m.protected || m.importance >= 0.9);
+    const byLayer = {};
+    for (const m of mems)
+        (byLayer[m.layer] ??= []).push(m);
+    const retention = getAnchorRetention(db);
+    // ── Render Markdown ──────────────────────────────────────────────────────────
+    const L = [];
+    L.push(`# ${entity.name} — Memory Report`);
+    L.push('');
+    L.push(`> A snapshot of the decisions, the *why* behind them, and what's drifting — exported from `
+        + `Linksee Memory on ${fmtDate(nowS)}. Paste it into Notion / Slack to share with anyone who never `
+        + `opens the dashboard.`);
+    L.push('');
+    // Attention FIRST — the core-dependent hook (day-1 value points at the moat, not away).
+    L.push(`## ⚠️ Needs attention (${needsAttention.length})`);
+    if (needsAttention.length === 0) {
+        L.push('Nothing drifting right now — every active decision still matches reality. ✅');
+    }
+    else {
+        for (const a of needsAttention) {
+            const overdue = a.review_after && a.review_after < nowS ? ', review overdue' : '';
+            L.push(`- **#${a.id} ${clip(a.statement, 160)}**  _(${a.lifecycle}${overdue})_`);
+            if (a.rationale)
+                L.push(`  - why: ${clip(a.rationale, 200)}`);
+        }
+    }
+    L.push('');
+    // Decisions & the why.
+    const modeLabel = {
+        constraint: 'constraint', commitment: 'commitment', hypothesis: 'hypothesis',
+        source_of_truth: 'source-of-truth', preference: 'preference', metric: 'metric',
+    };
+    L.push(`## Decisions & the why (${anchors.length})${anchorScoped ? '' : '  _— project-wide truth map (this project has no scoped Map)_'}`);
+    for (const a of anchors) {
+        const tag = a.decision_mode ? (modeLabel[a.decision_mode] ?? a.decision_mode) : a.kind;
+        L.push(`- \`${tag}\` **${clip(a.statement, 200)}**`);
+        if (a.rationale)
+            L.push(`  - why: ${clip(a.rationale, 240)}`);
+    }
+    L.push('');
+    // Memory by layer.
+    const layerOrder = ['goal', 'learning', 'caveat', 'implementation', 'context', 'emotion'];
+    const layerTitle = {
+        goal: '🎯 Goals', learning: '💡 Learnings & decisions', caveat: '⚠️ Caveats (hard-won)',
+        implementation: '🔧 Implementation notes', context: '📎 Context', emotion: '🫧 Signals',
+    };
+    L.push('## Memory by layer');
+    for (const layer of layerOrder) {
+        const items = byLayer[layer];
+        if (!items || items.length === 0)
+            continue;
+        L.push('');
+        L.push(`### ${layerTitle[layer] ?? layer} (${items.length})`);
+        for (const m of items.slice(0, 12)) {
+            const { what, why } = m.parsed;
+            const pin = m.protected || m.importance >= 0.9 ? '📌 ' : '';
+            L.push(`- ${pin}${clip(what, 220)}`);
+            if (why)
+                L.push(`  - why: ${clip(why, 200)}`);
+        }
+        if (items.length > 12)
+            L.push(`- …and ${items.length - 12} more`);
+    }
+    L.push('');
+    // Decision trajectory (the D7 bridge metric — proof the memory is being used, not just stored).
+    L.push('## Decision trajectory');
+    if (retention.totalAnchors === 0) {
+        L.push('No decisions recorded yet.');
+    }
+    else {
+        const pct = Math.round(retention.retentionRate * 100);
+        L.push(`- ${retention.totalAnchors} decisions across ${retention.activeDays} active day(s)`);
+        L.push(`- ${retention.retainedAnchors}/${retention.totalAnchors} revisited within 7 days (${pct}%)`);
+        L.push(`- first: ${fmtDate(retention.firstAnchorAt)} · last: ${fmtDate(retention.lastAnchorAt)}`);
+    }
+    L.push('');
+    L.push('---');
+    L.push(`_Generated by **Linksee Memory** · \`linksee export ${entity.name}\` · local-first — your data never left your machine._`);
+    if (needsAttention.length > 0) {
+        L.push(`_⚠️ ${needsAttention.length} decision(s) need attention — ask your agent "what's drifting?" or run \`linksee drift\`._`);
+    }
+    const md = L.join('\n') + '\n';
+    if (args.out) {
+        writeFileSync(args.out, md, 'utf8');
+        console.error(`Wrote ${md.length} chars → ${args.out}`);
+    }
+    else {
+        process.stdout.write(md);
+    }
+    db.close();
+}
+main();
+//# sourceMappingURL=export-report.js.map

package/dist/bin/stats.js

@@ -8,6 +8,7 @@
 // Safe to run anytime (read-only).
 import { statSync } from 'node:fs';
 import { openDb, runMigrations, getDbPath } from '../db/migrate.js';
+import { getAnchorRetention } from '../lib/anchor-touch.js';
 function parseArgs() {
     const argv = process.argv.slice(2);
     const a = { json: false, perEntity: 5, help: false };
@@ -107,6 +108,7 @@ function main() {
     ORDER BY edits DESC
     LIMIT 5
   `).all();
+    const anchorRetention = getAnchorRetention(db);
     const result = {
         db_path: dbPath,
         db_size: sizeBytes,
@@ -132,6 +134,7 @@ function main() {
             edits: f.edits,
             in_sessions: f.in_sessions,
         })),
+        anchor_retention: anchorRetention,
     };
     if (args.json) {
         console.log(JSON.stringify(result, null, 2));
@@ -154,6 +157,25 @@ function main() {
     console.log(`    sessions seen:  ${counts.sessions_seen}`);
     console.log(`    consolidations: ${counts.consolidations}`);
     console.log('');
+    // Decision trajectory — the D7 bridge metric (this install). Founder-sales read-out
+    // + the seed of the "your decision trajectory" digest.
+    console.log('  Decision trajectory  (D7 bridge metric — this install)');
+    if (anchorRetention.totalAnchors === 0) {
+        console.log('    no decisions recorded yet — declare one or ask "what\'s drifting?" to start.');
+    }
+    else {
+        const ar = anchorRetention;
+        const pct = Math.round(ar.retentionRate * 100);
+        console.log(`    decisions recorded:   ${ar.totalAnchors}  across ${ar.activeDays} active day(s)`);
+        console.log(`    revisited within 7d:  ${ar.retainedAnchors} of ${ar.totalAnchors}  (${pct}%)`);
+        console.log(`    first decision:       ${humanAge(ar.firstAnchorAt)}   ·   last: ${humanAge(ar.lastAnchorAt)}`);
+        console.log(`    return interactions:  ${ar.returnInteractions}  (inspect / drift-status / resolve / guard re-surface)`);
+        if (ar.mostRevisited) {
+            const s = ar.mostRevisited.statement.length > 48 ? ar.mostRevisited.statement.slice(0, 47) + '…' : ar.mostRevisited.statement;
+            console.log(`    most revisited:       #${ar.mostRevisited.anchor_id} "${s}" (x${ar.mostRevisited.touches})`);
+        }
+    }
+    console.log('');
     if (layerBreakdown.length > 0) {
         console.log('  Memories by layer');
         for (const r of layerBreakdown) {

package/dist/db/migrate.js

@@ -1,6 +1,6 @@
 import Database from 'better-sqlite3';
 import { readFileSync } from 'node:fs';
-import { mkdirSync } from 'node:fs';
+import { mkdirSync, renameSync, existsSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
@@ -10,12 +10,49 @@ const DB_PATH = join(DEFAULT_DB_DIR, 'memory.db');
 export function getDbPath() {
     return DB_PATH;
 }
+function openAt(path) {
+    const db = new Database(path);
+    try {
+        db.pragma('journal_mode = WAL'); // first real read of the file header — throws if it isn't a DB
+        db.pragma('foreign_keys = ON');
+        return db;
+    }
+    catch (e) {
+        try {
+            db.close();
+        }
+        catch { /* ignore */ } // release the handle so a corrupt file can be renamed (Windows locks it otherwise)
+        throw e;
+    }
+}
 export function openDb() {
     mkdirSync(DEFAULT_DB_DIR, { recursive: true });
-    const db = new Database(DB_PATH);
-    db.pragma('journal_mode = WAL');
-    db.pragma('foreign_keys = ON');
-    return db;
+    try {
+        return openAt(DB_PATH);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        // A corrupt / non-database file throws on the first pragma. Don't crash with a raw
+        // stack trace: preserve the bad file (so it can be recovered) and start a fresh DB.
+        if (/not a database|file is encrypted|malformed|disk image/i.test(msg) && existsSync(DB_PATH)) {
+            const backup = `${DB_PATH}.corrupt-${Date.now()}`;
+            try {
+                renameSync(DB_PATH, backup);
+            }
+            catch { /* best effort */ }
+            for (const ext of ['-wal', '-shm']) {
+                try {
+                    if (existsSync(DB_PATH + ext))
+                        renameSync(DB_PATH + ext, backup + ext);
+                }
+                catch { /* ignore */ }
+            }
+            process.stderr.write(`[linksee-memory] the memory database was unreadable (${msg}). ` +
+                `Moved it to ${backup} and started a fresh one — your old memories are preserved there for recovery.\n`);
+            return openAt(DB_PATH);
+        }
+        throw err; // not a corruption we recognize — surface it
+    }
 }
 export function runMigrations(db) {
     const __filename = fileURLToPath(import.meta.url);

package/dist/db/schema.sql

@@ -358,6 +358,25 @@ CREATE TABLE IF NOT EXISTS injection_log (
 CREATE INDEX IF NOT EXISTS idx_injlog_anchor  ON injection_log(anchor_id, occurred_at);
 CREATE INDEX IF NOT EXISTS idx_injlog_session ON injection_log(session_id, occurred_at);
 
+-- ============================================================
+-- v15: anchor_touch_log — the D7 retention metric for decision-writers.
+-- Bridge metric: of installs that record a decision, what fraction COME BACK and
+-- interact with a PRIOR decision within 7 days. Captures the READ/inspect signals
+-- (check_decision, drift_status) that nothing else logs, plus create/resolve. Guard
+-- re-surfaces already live in injection_log and are UNIONed in queries. anchor_id is
+-- NULL for whole-set reviews (drift_status). No content, ever — only ids + a verb + a ts.
+-- ============================================================
+CREATE TABLE IF NOT EXISTS anchor_touch_log (
+  id          INTEGER PRIMARY KEY AUTOINCREMENT,
+  anchor_id   INTEGER REFERENCES drift_anchors(id) ON DELETE CASCADE,
+  session_id  TEXT,
+  tool        TEXT NOT NULL,                              -- declare_anchor | check_decision | drift_status | resolve_drift
+  interaction TEXT NOT NULL CHECK (interaction IN ('create','inspect','review','resolve','resurface')),
+  occurred_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+CREATE INDEX IF NOT EXISTS idx_anchor_touch_time   ON anchor_touch_log(occurred_at);
+CREATE INDEX IF NOT EXISTS idx_anchor_touch_anchor ON anchor_touch_log(anchor_id, occurred_at);
+
 -- ============================================================
 -- v11: Current Truth Map — journey-spine topology (Product Drift OS spec v3).
 -- map.yaml (git) is the desired-state SOURCE OF TRUTH (anchor #58); these tables
@@ -437,6 +456,6 @@ CREATE TABLE IF NOT EXISTS meta (
   value         TEXT NOT NULL
 );
 
-INSERT OR IGNORE INTO meta (key, value) VALUES ('schema_version', '14');
+INSERT OR IGNORE INTO meta (key, value) VALUES ('schema_version', '15');
 INSERT OR IGNORE INTO meta (key, value) VALUES ('created_at', CAST(unixepoch() AS TEXT));
-UPDATE meta SET value = '14' WHERE key = 'schema_version' AND value IN ('1', '2', '3', '4', '5', '6', '7', '8', '9', '10', '11', '12', '13');
+UPDATE meta SET value = '15' WHERE key = 'schema_version' AND value IN ('1', '2', '3', '4', '5', '6', '7', '8', '9', '10', '11', '12', '13', '14');

package/dist/lib/anchor-touch.d.ts

@@ -0,0 +1,47 @@
+import type Database from 'better-sqlite3';
+export type AnchorInteraction = 'create' | 'inspect' | 'review' | 'resolve' | 'resurface';
+/** Record one interaction with a decision/anchor. Best-effort — never throws. */
+export declare function logAnchorTouch(db: Database.Database, t: {
+    anchorId?: number | null;
+    sessionId?: string | null;
+    tool: string;
+    interaction: AnchorInteraction;
+}): void;
+/**
+ * Per-session counts for telemetry — COUNTS ONLY, no content.
+ * Window = [startSec, endSec] (unix seconds, the session's edit span).
+ * The server turns these per-session counts into the fleet D7 rate by ordering an
+ * install's sessions: D0 = first session with anchor_creates>0; retained if a later
+ * session within 7 days has anchor_returns>0.
+ */
+export declare function getSessionAnchorCounts(db: Database.Database, startSec: number, endSec: number): {
+    anchor_creates: number;
+    anchor_returns: number;
+};
+export interface AnchorRetention {
+    totalAnchors: number;
+    firstAnchorAt: number | null;
+    lastAnchorAt: number | null;
+    returnInteractions: number;
+    activeDays: number;
+    retainedAnchors: number;
+    retentionRate: number;
+    mostRevisited: {
+        anchor_id: number;
+        statement: string;
+        touches: number;
+    } | null;
+}
+/**
+ * Local, single-install decision-trajectory view. The source for `stats` (the
+ * founder-sales 1:1 read-out) and the seed of the "your decision trajectory" digest.
+ *
+ * The local readout is PER-DECISION retention (recency-independent): of the decisions
+ * you've recorded, what fraction did you come back to within 7 days of recording each.
+ * The fleet GATE rate (install-cohort "returned within 7d of the FIRST decision") is a
+ * different, cohort-entry metric — computed server-side from the per-session telemetry
+ * counts in getSessionAnchorCounts(), not here.
+ */
+export declare function getAnchorRetention(db: Database.Database, opts?: {
+    windowDays?: number;
+}): AnchorRetention;

package/dist/lib/anchor-touch.js

@@ -0,0 +1,114 @@
+// Decision-trajectory instrumentation — the D7 retention metric for decision-writers.
+//
+// The bridge metric (Linksee Memory strategy): of installs that record a decision
+// (an anchor), what fraction COME BACK and interact with a PRIOR decision within
+// 7 days. This single number gates cross-tool expansion.
+//
+// What nothing else captured: the READ/inspect signals (check_decision, drift_status).
+// Creations live in drift_anchors.created_at; guard re-surfaces live in injection_log;
+// this table fills the gap and unifies them for the metric.
+//
+// PRIVACY: logs only {anchor_id, optional session_id, a verb, a timestamp}. NEVER any
+// statement text, rationale, or content. Best-effort: a failure here must NEVER break
+// the tool call that triggered it.
+const DAY = 86400;
+/** Record one interaction with a decision/anchor. Best-effort — never throws. */
+export function logAnchorTouch(db, t) {
+    try {
+        db.prepare(`INSERT INTO anchor_touch_log (anchor_id, session_id, tool, interaction) VALUES (?, ?, ?, ?)`).run(t.anchorId ?? null, t.sessionId ?? null, t.tool, t.interaction);
+    }
+    catch {
+        /* instrumentation must never break a tool call */
+    }
+}
+/**
+ * Per-session counts for telemetry — COUNTS ONLY, no content.
+ * Window = [startSec, endSec] (unix seconds, the session's edit span).
+ * The server turns these per-session counts into the fleet D7 rate by ordering an
+ * install's sessions: D0 = first session with anchor_creates>0; retained if a later
+ * session within 7 days has anchor_returns>0.
+ */
+export function getSessionAnchorCounts(db, startSec, endSec) {
+    try {
+        if (!startSec || !endSec || endSec < startSec)
+            return { anchor_creates: 0, anchor_returns: 0 };
+        const creates = db.prepare(`SELECT COUNT(*) AS c FROM drift_anchors WHERE created_at BETWEEN ? AND ?`).get(startSec, endSec).c;
+        const touchReturns = db.prepare(`SELECT COUNT(*) AS c FROM anchor_touch_log WHERE interaction != 'create' AND occurred_at BETWEEN ? AND ?`).get(startSec, endSec).c;
+        const gateReturns = db.prepare(`SELECT COUNT(*) AS c FROM injection_log WHERE occurred_at BETWEEN ? AND ?`).get(startSec, endSec).c;
+        return { anchor_creates: creates, anchor_returns: touchReturns + gateReturns };
+    }
+    catch {
+        return { anchor_creates: 0, anchor_returns: 0 };
+    }
+}
+/**
+ * Local, single-install decision-trajectory view. The source for `stats` (the
+ * founder-sales 1:1 read-out) and the seed of the "your decision trajectory" digest.
+ *
+ * The local readout is PER-DECISION retention (recency-independent): of the decisions
+ * you've recorded, what fraction did you come back to within 7 days of recording each.
+ * The fleet GATE rate (install-cohort "returned within 7d of the FIRST decision") is a
+ * different, cohort-entry metric — computed server-side from the per-session telemetry
+ * counts in getSessionAnchorCounts(), not here.
+ */
+export function getAnchorRetention(db, opts = {}) {
+    const windowDays = opts.windowDays ?? 7;
+    const empty = {
+        totalAnchors: 0, firstAnchorAt: null, lastAnchorAt: null, returnInteractions: 0,
+        activeDays: 0, retainedAnchors: 0, retentionRate: 0, mostRevisited: null,
+    };
+    try {
+        const creates = db.prepare(`SELECT created_at FROM drift_anchors ORDER BY created_at`).all().map((r) => r.created_at).filter((t) => t != null);
+        if (creates.length === 0)
+            return empty;
+        const first = creates[0];
+        const last = creates[creates.length - 1];
+        // "Came back" activity = non-create touches + guard re-surfaces.
+        const touchTs = db.prepare(`SELECT occurred_at FROM anchor_touch_log WHERE interaction != 'create'`).all().map((r) => r.occurred_at);
+        const gateTs = db.prepare(`SELECT occurred_at FROM injection_log`).all().map((r) => r.occurred_at);
+        const returnTs = [...touchTs, ...gateTs].filter((t) => t != null);
+        const returnInteractions = returnTs.filter((t) => t > first).length;
+        // Per-decision D7: a decision is "retained" if any activity (a return interaction
+        // OR recording a LATER decision) falls on a later calendar day within 7d of it.
+        const day = (t) => Math.floor(t / DAY);
+        const activity = [...returnTs, ...creates].sort((a, b) => a - b);
+        let retainedAnchors = 0;
+        for (const t0 of creates) {
+            const horizon = t0 + windowDays * DAY;
+            if (activity.some((e) => e <= horizon && day(e) > day(t0)))
+                retainedAnchors++;
+        }
+        const activeDays = db.prepare(`SELECT COUNT(*) AS c FROM (
+         SELECT DISTINCT CAST(created_at / 86400 AS INT) AS d FROM drift_anchors
+         UNION
+         SELECT DISTINCT CAST(occurred_at / 86400 AS INT) FROM anchor_touch_log WHERE interaction != 'create'
+         UNION
+         SELECT DISTINCT CAST(occurred_at / 86400 AS INT) FROM injection_log
+       )`).get().c;
+        let mostRevisited = null;
+        const mv = db.prepare(`SELECT anchor_id, COUNT(*) AS touches FROM (
+         SELECT anchor_id FROM anchor_touch_log WHERE interaction != 'create' AND anchor_id IS NOT NULL
+         UNION ALL
+         SELECT anchor_id FROM injection_log WHERE anchor_id IS NOT NULL
+       ) GROUP BY anchor_id ORDER BY touches DESC LIMIT 1`).get();
+        if (mv && mv.touches > 0) {
+            const a = db.prepare(`SELECT statement FROM drift_anchors WHERE id = ?`).get(mv.anchor_id);
+            if (a)
+                mostRevisited = { anchor_id: mv.anchor_id, statement: a.statement, touches: mv.touches };
+        }
+        return {
+            totalAnchors: creates.length,
+            firstAnchorAt: first,
+            lastAnchorAt: last,
+            returnInteractions,
+            activeDays,
+            retainedAnchors,
+            retentionRate: creates.length ? retainedAnchors / creates.length : 0,
+            mostRevisited,
+        };
+    }
+    catch {
+        return empty;
+    }
+}
+//# sourceMappingURL=anchor-touch.js.map

package/dist/lib/map-view.d.ts

@@ -75,6 +75,9 @@ export interface WhereAmIResult {
     project: string;
     job: string | null;
     matched: WhereAmIMatch[];
+    ambiguous?: {
+        available: string[];
+    };
 }
 export declare function whereAmI(db: Database.Database, opts: {
     project?: string;

package/dist/lib/map-view.js

@@ -107,9 +107,20 @@ function queryTerms(q) {
     return q.toLowerCase().split(/[\s、。,.\/_()「」"'`:：]+/).map((t) => t.trim()).filter((t) => t.length >= 2);
 }
 export function whereAmI(db, opts) {
-    const project = opts.project
-        ?? db.prepare('SELECT project FROM map_projects ORDER BY updated_at DESC LIMIT 1').get()?.project
-        ?? '';
+    // Fix ② (2026-06-17): never silently grab the most-recently-touched map. When the
+    // caller didn't name a project, only auto-pick if exactly ONE map exists; with
+    // multiple maps, surface the ambiguity so the caller picks (the no-arg "per-turn
+    // re-anchor" was returning a stale/demo map — e.g. the notekeeper sample).
+    // ① (cwd/roots match → infer the project you're actually in) lands next.
+    let project = opts.project ?? '';
+    if (!project) {
+        const available = listMapProjects(db);
+        if (available.length === 1)
+            project = available[0];
+        else if (available.length > 1)
+            return { project: '', job: null, matched: [], ambiguous: { available } };
+        // available.length === 0 → project stays '' → caller emits "no map imported yet"
+    }
     const meta = project ? getProjectMeta(db, project) : undefined;
     const stageLabel = (stageId) => stageId ? meta?.stages.find((s) => s.id === stageId)?.label ?? stageId : null;
     const anchorOf = (n) => n.anchor_id != null

package/dist/lib/telemetry.d.ts

@@ -17,6 +17,8 @@ interface TelemetryPayload {
     read_smart_calls: number;
     recall_calls: number;
     recall_file_calls: number;
+    anchor_creates: number;
+    anchor_returns: number;
 }
 export declare function buildPayload(db: Database.Database, sessionId: string, options?: {
     mcpServersInUse?: string[];

package/dist/lib/telemetry.js

@@ -6,6 +6,9 @@
 //   - NEVER sends conversation content, user messages, file content,
 //     entity names, project paths, or any layer text (goal/context/emotion/
 //     impl/caveat/learning content is not included).
+//   - anchor_creates / anchor_returns are COUNTS only (decisions recorded /
+//     revisited this session, for the D7 retention metric) — never any
+//     statement text or anchor content.
 //   - Anonymous UUID generated locally on first opt-in; stored at
 //     ~/.linksee-memory/telemetry-id. User can delete it any time.
 //   - Disable any time: LINKSEE_TELEMETRY=off (or unset the variable).
@@ -14,9 +17,10 @@ import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';
 import { join, extname, join as pathJoin, dirname as pathDirname } from 'node:path';
 import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
-// Production endpoint hosted on Railway. (kansei-link.com is a GitHub Pages site;
-// the dynamic API lives on the Railway deployment.)
-const DEFAULT_ENDPOINT = 'https://kansei-link-mcp-production.up.railway.app/api/telemetry/linksee';
+import { getSessionAnchorCounts } from './anchor-touch.js';
+// Production endpoint: opt-in telemetry collector on linksee-site (Vercel).
+// Migrated 2026-06 off the retired Railway deployment (which had gone 404).
+const DEFAULT_ENDPOINT = 'https://linksee-site.vercel.app/api/telemetry/linksee';
 // Allow override for testing or self-hosting
 const ENDPOINT = process.env.LINKSEE_TELEMETRY_URL || DEFAULT_ENDPOINT;
 const TELEMETRY_DIR = process.env.LINKSEE_MEMORY_DIR ?? join(homedir(), '.linksee-memory');
@@ -97,6 +101,7 @@ export function buildPayload(db, sessionId, options = {}) {
     const tsRow = db.prepare(`SELECT MIN(occurred_at) as start, MAX(occurred_at) as end FROM session_file_edits WHERE session_id = ?`).get(sessionId);
     if (tsRow && tsRow.start && tsRow.end)
         durationSec = Math.max(0, tsRow.end - tsRow.start);
+    const anchorCounts = getSessionAnchorCounts(db, tsRow?.start ?? 0, tsRow?.end ?? 0);
     return {
         anon_id: getOrCreateAnonId(),
         linksee_version: getLinkseeVersion(),
@@ -112,6 +117,8 @@ export function buildPayload(db, sessionId, options = {}) {
         read_smart_calls: 0,
         recall_calls: 0,
         recall_file_calls: 0,
+        anchor_creates: anchorCounts.anchor_creates,
+        anchor_returns: anchorCounts.anchor_returns,
     };
 }
 // Fire-and-forget POST. Any failure is silent (logged by caller).

package/dist/mcp/server.js

@@ -17,13 +17,14 @@ import { normalizeEntityName } from '../lib/normalize.js';
 import { handleReadSmart as handleReadSmartImpl } from './read-smart.js';
 import { STATIC_RESOURCES, RESOURCE_TEMPLATES, readResource } from './resources.js';
 import { PROMPTS, getPrompt } from './prompts.js';
-import { fetchRoots, isInsideRoots } from './roots.js';
+import { fetchRoots, isInsideRoots, rootPathFromUri } from './roots.js';
 import { sampleConsolidation } from './sampling.js';
 import { confirmForget } from './elicitation.js';
 import { getTruthView, getDecisionDetail, resolveDrift } from '../lib/truth-engine.js';
 import { declareAnchor, setNodeFields } from '../lib/drift-anchors.js';
 import { getReinjectionFriction, setGateMode } from '../lib/guard.js';
-import { whereAmI } from '../lib/map-view.js';
+import { logAnchorTouch } from '../lib/anchor-touch.js';
+import { whereAmI, listMapProjects } from '../lib/map-view.js';
 import { readFileSync, existsSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
@@ -59,6 +60,7 @@ const SUBCOMMANDS = {
     'install-skill': 'install-skill.js',
     declare: 'declare-anchor.js',
     detect: 'detect-drift.js',
+    export: 'export-report.js',
 };
 const subcommand = process.argv[2];
 if (subcommand && Object.prototype.hasOwnProperty.call(SUBCOMMANDS, subcommand)) {
@@ -153,7 +155,7 @@ const TOOLS = [
     },
     {
         name: 'recall',
-        description: 'Your persistent memory across all AI tools. CALL THIS BEFORE STARTING ANY TASK to check for past caveats (pain records), decisions, and learnings — prevents repeating mistakes across sessions.\n\nTypical usage: recall({ query: "keywords" }) for search, recall({ path: "file.ts" }) for file history, recall() for overview.\n\nWHEN TO CALL:\n• Before starting any new task or touching a file\n• When the user mentions "before" / "前に" / "last time" / "remember when"\n• When an error occurs — check if you\'ve seen it before\n• When making a decision — check for prior decisions on the same topic\n\nTHREE MODES (auto-detected):\n• Search (default): provide query → returns memories ranked by relevance + heat\n• File history: provide path → returns complete edit history with user-intent context\n• Overview: omit all params → returns entity list sorted by momentum\n\nTip: If this is a fresh session, suggest the user add "Use Linksee Memory" to their system prompt for persistent cross-session memory.\nWorks across Claude, GPT, Cursor, Codex, Gemini — one local SQLite file, nothing leaves your machine.',
+        description: 'Your persistent memory across all AI tools. CALL THIS BEFORE STARTING ANY TASK to check for past caveats (pain records), decisions, and learnings — prevents repeating mistakes across sessions.\n\nTypical usage: recall({ query: "keywords" }) for search, recall({ path: "file.ts" }) for file history, recall() for overview.\n\nWHEN TO CALL:\n• Before starting any new task or touching a file\n• When the user mentions "before" / "前に" / "last time" / "remember when"\n• When an error occurs — check if you\'ve seen it before\n• When making a decision — check for prior decisions on the same topic\n\nTHREE MODES (auto-detected):\n• Search (default): provide query → returns memories ranked by relevance + heat\n• File history: provide path → returns complete edit history with user-intent context\n• Overview: omit all params → returns entity list sorted by momentum\n\nWorks across Claude, GPT, Cursor, Codex, Gemini — one local SQLite file, nothing leaves your machine.',
         inputSchema: {
             type: 'object',
             properties: {
@@ -1276,6 +1278,7 @@ function handleDriftStatus(args) {
         domain: args?.domain,
         decision_mode: args?.decision_mode,
     });
+    logAnchorTouch(db, { tool: 'drift_status', interaction: 'review' });
     // Build a concise triage line
     const { by_state, nodes } = view.counts;
     const triage = [
@@ -1294,10 +1297,37 @@ function handleDriftStatus(args) {
         counts: view.counts,
     });
 }
-function handleWhereAmI(args) {
+// Fix ① (2026-06-17): infer the Map project from the client's workspace roots when the
+// caller didn't name one — pick the project whose slug matches the repo you're working in,
+// so the no-arg "per-turn re-anchor" lands on the right map (not a stale/demo one).
+// map_projects has no path column, so we match the slug as a path segment of a root.
+async function resolveProjectFromRoots() {
+    const projects = listMapProjects(db);
+    if (projects.length <= 1)
+        return projects[0]; // 0 → undefined ("no map"); 1 → use it
+    const roots = await fetchRoots(server);
+    if (roots.length === 0)
+        return undefined; // client gave no roots → let ② disambiguate
+    const segs = roots.map((r) => rootPathFromUri(r.uri).toLowerCase().replace(/\\/g, '/').replace(/\/+$/, ''));
+    const matches = projects.filter((p) => {
+        const slug = p.toLowerCase();
+        return segs.some((path) => path === slug || path.endsWith('/' + slug) || path.split('/').includes(slug));
+    });
+    return matches.length === 1 ? matches[0] : undefined; // unique repo match only; else ② handles it
+}
+async function handleWhereAmI(args) {
+    // ① resolve project from cwd/roots when not explicitly passed; ② (inside whereAmI) is the fallback.
+    const project = args?.project ?? (await resolveProjectFromRoots());
     const res = whereAmI(db, {
-        query: args?.query, node_id: args?.node_id, project: args?.project, limit: args?.limit,
+        query: args?.query, node_id: args?.node_id, project, limit: args?.limit,
     });
+    if (res.ambiguous) {
+        return JSON.stringify({
+            ok: true, located: false, reason: 'ambiguous_project',
+            available_projects: res.ambiguous.available,
+            hint: `Multiple maps imported — pass project: one of [${res.ambiguous.available.join(', ')}]. (No-arg can't yet tell which repo you mean; cwd/roots match is coming.)`,
+        });
+    }
     if (res.matched.length === 0) {
         return JSON.stringify({
             ok: true, project: res.project, located: false,
@@ -1329,6 +1359,7 @@ function handleCheckDecision(args) {
     if (!detail) {
         return JSON.stringify({ ok: false, error: `Anchor ${args.anchor_id} not found or not active` });
     }
+    logAnchorTouch(db, { anchorId: args.anchor_id, tool: 'check_decision', interaction: 'inspect' });
     return JSON.stringify({ ok: true, decision: detail });
 }
 function handleDeclareAnchor(args) {
@@ -1363,6 +1394,7 @@ function handleDeclareAnchor(args) {
     if (Object.keys(nodeFields).length > 0) {
         setNodeFields(db, anchor.id, nodeFields);
     }
+    logAnchorTouch(db, { anchorId: anchor.id, tool: 'declare_anchor', interaction: 'create' });
     return JSON.stringify({
         ok: true,
         anchor_id: anchor.id,
@@ -1375,6 +1407,7 @@ function handleResolveDrift(args) {
     if (!args?.anchor_id || !args?.action) {
         throw new Error('anchor_id and action are required');
     }
+    logAnchorTouch(db, { anchorId: args.anchor_id, tool: 'resolve_drift', interaction: 'resolve' });
     // Enforcement-policy actions — apply the dream "escalate_to_hard" recommendation in ONE call.
     // Folded into resolve_drift (not a new tool) to honor anchor #1. Intercepted here so the WIP
     // truth-engine.ts resolveDrift() stays untouched.
@@ -1720,7 +1753,7 @@ server.setRequestHandler(CallToolRequestSchema, async (req) => {
                 text = handleDriftStatus(args);
                 break;
             case 'where_am_i':
-                text = handleWhereAmI(args);
+                text = await handleWhereAmI(args);
                 break;
             case 'check_decision':
                 text = handleCheckDecision(args);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "linksee-memory",
-  "version": "0.11.2",
+  "version": "0.11.4",
   "mcpName": "io.github.michielinksee/linksee-memory",
   "description": "Local-first agent memory MCP — cross-agent brain with drift detection, 6-layer structured memory + token-saving file diff cache",
   "type": "module",
@@ -14,7 +14,8 @@
     "linksee-memory-declare": "dist/bin/declare-anchor.js",
     "linksee-memory-detect": "dist/bin/detect-drift.js",
     "linksee-memory-guard": "dist/bin/guard-hook.js",
-    "linksee-memory-map": "dist/bin/map-import.js"
+    "linksee-memory-map": "dist/bin/map-import.js",
+    "linksee-memory-export": "dist/bin/export-report.js"
   },
   "main": "./dist/mcp/server.js",
   "files": [