fix: close 13 real bugs from the architecture audit + split common.rs hotspot

Batch fix for CALM's own maintenance/graph/diff/memory/release subsystems,
following a line-by-line verification of a 28-finding external audit
against actual source (not docs/comments). Each item below was independently
confirmed as a real, reproducing bug before being fixed and covered by a
new regression test.

Transaction/graph correctness:
- txn::advance: close the check-then-act race (BEGIN IMMEDIATE before
  reading current_state); advance_many now surfaces a failed outer COMMIT
  instead of silently discarding it (Vec<Result> -> Result<Vec<Result>>).
- SCIP overlay: a discarded (stale-generation) ingest pass no longer commits
  its cache key, which was silently disabling re-runs of that provider.
- path tool: route confidence is no longer collapsed into a bare
  exists:true — routes now carry per-hop confidence and a `certain` flag.
- transitive_bfs: a node first seen via an ambiguous (unexpandable) edge
  can now be promoted to expandable by a later confirmed encounter, instead
  of being permanently poisoned by a flat visited-set.
- coreness: split into `coreness` (confirmed edges only, feeds is_hub/gate)
  and `possible_coreness` (old undifferentiated behavior, uncertainty-only).

Maintenance outbox (biggest item):
- run_all_coalesced now reports whether the caller actually led the
  coalesced pass or deferred to an in-flight one — only the leader may mark
  the durable job "done", closing a race where a deferred/no-op completion
  could mark real in-flight work as finished.
- mark_completed no longer silently drops a later, genuinely-real
  completion just because an earlier one already reached a terminal state.
- mark_running/reconcile_stale_at_startup now use a real lease
  (lease_owner/lease_expires_at, columns the schema already reserved) so a
  second process's startup no longer kills a sibling process's still-live
  job on a shared project.

diff_impact:
- A deleted file whose index row already converged away no longer defaults
  to "low" risk when there's no surviving evidence of its former callers.
- Unified-diff parsing now handles Git's C-style quoted paths (spaces,
  tabs, escaped quotes/backslashes, octal-escaped non-ASCII).
- Signature-change comparison is now language-aware: Python/Kotlin keyword
  arguments and Swift's one-identifier external-label shorthand are no
  longer stripped as "just a param rename".
- The syntax gate now rejects any parse error intersecting the edited
  region outright, instead of a gameable bare error-count comparison.
- reference_impact no longer suppresses independent textual hits in a file
  that also has an import edge.

Memory/session safety:
- remember() note upsert and ref replacement now share one transaction —
  a crash or ref-write failure can no longer leave new content paired with
  stale/partial refs.
- Ambient note surfacing fails closed (not open) when the MAC key is
  unavailable or the injection scan didn't finish.
- HTTP sessions (http.rs) now clean up their active_sessions registry
  entry on disconnect via an Arc-refcounted guard, closing a leak the
  unix-socket daemon already had a fix for but HTTP never got.

Release/CI hygiene:
- action.yml's default `version: latest` now resolves to the exact npm
  version matching the action's own tag instead of npm's floating latest,
  closing a real past release-skew incident.
- action.yml's shallow base-ref fetch (depth=1) shared no history with the
  checkout's own depth=1 HEAD, so `git merge-base` failed outright —
  reproduced live in calm-guard-dogfood CI; fixed with a deeper fetch plus
  an --unshallow fallback. Documented explicit promotion criteria for
  taking that job out of shadow mode (not done yet — no clean track record
  with the fix in place).
- Fixed 2 stale KNOWN_LIMITATIONS.md entries already resolved in code.

Also: split tools/common.rs (15 methods -> new tools/session_state.rs) to
bring its own hotspot_risk score back under the CI gate threshold, and
fixed a self-perpetuating state-corruption bug in the project's own
calm-nudge.sh dev-tooling hook (unvalidated JSON read before jq --argjson).

1351 unit tests pass (1000 calm-core + 351 calm-server), clippy -D warnings
clean across calm-core/calm-server/calm-cli.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: Your Name

.claude/hooks/calm-nudge.sh

@@ -266,7 +266,21 @@ save_state() {
   # them, silently zeroing the tally.
   acquire_state_lock
   local prev='{}'
-  [ -f "$state_file" ] && prev=$(cat "$state_file" 2>/dev/null || echo '{}')
+  if [ -f "$state_file" ]; then
+    prev=$(cat "$state_file" 2>/dev/null || echo '{}')
+    # Self-heal a corrupted/empty state file instead of perpetuating it:
+    # bash's `>` redirect below truncates $state_file the instant the `jq
+    # -n` command starts, BEFORE jq has produced any output -- so if that
+    # jq call ever fails (bad $1/$2/$3 JSON, OOM, killed mid-run) the file
+    # is left at 0 bytes with nothing written back. Every later
+    # save_state/bump call then reads that empty file into $prev, which is
+    # NOT valid JSON, so --argjson/<<< again fails the exact same way —
+    # once corrupted, permanently corrupted for the rest of the session
+    # (confirmed live: a real session's state file was still 0 bytes after
+    # 200+ tool calls). Validating $prev here and falling back to '{}' on
+    # a parse failure makes the very next successful call recover instead.
+    jq -e . >/dev/null 2>&1 <<<"$prev" || prev='{}'
+  fi
   jq -n --argjson prev "$prev" --argjson ecf "$1" --argjson nd "$2" --argjson nc "$3" \
     '$prev + {edit_context_files: $ecf, needs_diff_impact: $nd, nudge_counts: $nc}' \
     >"$state_file" 2>/dev/null || true
@@ -279,7 +293,12 @@ save_state() {
 bump() {
   acquire_state_lock
   local prev='{}'
-  [ -f "$state_file" ] && prev=$(cat "$state_file" 2>/dev/null || echo '{}')
+  if [ -f "$state_file" ]; then
+    prev=$(cat "$state_file" 2>/dev/null || echo '{}')
+    # Same self-heal as save_state — see its comment for the corruption
+    # mechanism this guards against.
+    jq -e . >/dev/null 2>&1 <<<"$prev" || prev='{}'
+  fi
   jq -c --arg k "$1" '.[$k] = ((.[$k] // 0) + 1)' <<<"$prev" >"$state_file" 2>/dev/null || true
   release_state_lock
 }
@@ -465,6 +484,18 @@ maybe_nudge_session_context() {
   acquire_state_lock
   local prev
   prev=$(cat "$state_file" 2>/dev/null || echo '{}')
+  # Same self-heal as save_state/bump (see save_state's comment for the
+  # corruption mechanism): this function is its own independent
+  # read-modify-write path on $state_file, so it needs its own guard, not
+  # just save_state's/bump's -- a corrupted/empty $prev here used to make
+  # `n=$(jq -r ... <<<"$prev")` fail silently (empty $n), which bash's
+  # arithmetic then read as 0, so `$((n % SESSION_CONTEXT_REMINDER_EVERY))
+  # -eq 0` was ALWAYS true -- the "possibly_stuck" reminder fired on every
+  # single call instead of every Nth one, and the write right after it
+  # re-truncated $state_file to empty again on every call, permanently
+  # undoing save_state's/bump's own fix moments after either one ran (this
+  # function runs last in every dispatch branch).
+  jq -e . >/dev/null 2>&1 <<<"$prev" || prev='{}'
   if [ "$tool_name" = "mcp__calm__session_context" ]; then
     if [ "$(jq -r '.since_session_context // 0' <<<"$prev")" != "0" ]; then
       jq -c '.since_session_context = 0' <<<"$prev" >"$state_file" 2>/dev/null || true

.claude/hooks/test-calm-nudge.sh

@@ -94,17 +94,23 @@ fi
 #    must still unlock that file for a later native Edit, by falling back to
 #    a read-only lookup against .calm/index.db mirroring resolve_symbol's own
 #    "exactly one row named X" criterion. Uses a real symbol from this repo
-#    (crates/calm-server/src/tools/common.rs::resolve_symbol_candidates) so
+#    (crates/calm-server/src/tools/common.rs::apply_personalization_boost) so
 #    the DB lookup has something real to find -- this is the exact regression
 #    a prior session hit editing crates/calm-cli/src/main.rs (see memory
-#    calm-two-tooling-bugs-root-cause-2026-07-14).
+#    calm-two-tooling-bugs-root-cause-2026-07-14). NOTE 2026-08-06: this used
+#    to reference resolve_symbol_candidates, but that symbol moved to
+#    outcome.rs in the 2026-07-28 hotspot split and this fixture was never
+#    updated -- it was silently testing "does the DB fallback correctly
+#    resolve to wherever the symbol REALLY is" (outcome.rs) while asserting
+#    the OLD location (common.rs), which fails now that the two disagree.
+#    apply_personalization_boost is verified to still live in common.rs.
 run_hook_symbol_only() {
   jq -nc --arg session "$session_id_test" --arg tool "$1" --arg symbol "$2" \
     '{session_id: $session, tool_name: $tool, tool_input: {symbol: $symbol}}' \
     | bash .claude/hooks/calm-nudge.sh
 }
 if [ -f .calm/index.db ]; then
-  run_hook_symbol_only "mcp__calm__edit_context" "resolve_symbol_candidates" >/dev/null
+  run_hook_symbol_only "mcp__calm__edit_context" "apply_personalization_boost" >/dev/null
   out=$(run_hook "Edit" "crates/calm-server/src/tools/common.rs")
   if echo "$out" | jq -e '.hookSpecificOutput.permissionDecision == "deny"' >/dev/null 2>&1; then
     fail "expected allow for common.rs after edit_context(symbol-only) resolved it via the DB fallback, got deny: $out"

.github/workflows/ci.yml

@@ -36,8 +36,31 @@ jobs:
   # end, not just that `cargo test` passes against the Rust source directly.
   # continue-on-error: shadow mode while this is new (matches this repo's
   # own rollout convention for new gates -- elicit_hub_confirm, verification,
-  # etc. all default off/observe-only at first) -- promote to blocking once
-  # it's run clean across enough real PRs.
+  # etc. all default off/observe-only at first).
+  #
+  # Audit 11.4 (2026-08-06): reviewed this job's run history before
+  # considering promotion. Found two real infra failure modes, not false
+  # positives from the guard's own risk analysis -- neither is "the gate
+  # doing its job":
+  #   1. `error: unrecognized subcommand 'guard'` -- ran against a commit
+  #      from before this job's build-from-source+alias steps existed
+  #      (older npm-install-only version of this job). Self-resolved by
+  #      the current job definition; not expected to recur.
+  #   2. `fatal: origin/main...HEAD: no merge base` -- action.yml's
+  #      shallow-fetch fix only fetched the base ref at depth=1, sharing no
+  #      history with this checkout's own depth=1 HEAD. Fixed in the same
+  #      commit as this comment (action.yml's "Resolve review scope" step
+  #      now fetches depth=100 + falls back to `--unshallow`).
+  # Promotion criteria (remove `continue-on-error` once ALL of these hold):
+  #   - 10 consecutive PRs where this job actually ran (not skipped) with
+  #     zero infra-category failures (subcommand/merge-base/install/
+  #     timeout) -- a real "aggregate_risk >= fail-on" block is NOT an
+  #     infra failure and doesn't reset this count.
+  #   - At least one of those 10 was a PR this job correctly blocked or
+  #     would have blocked (fail-on triggered), confirmed by manual review
+  #     to be a genuine high-risk change, not a false positive.
+  #   - No open false-positive report against calm guard's risk model
+  #     older than 7 days.
   calm-guard-dogfood:
     runs-on: ubuntu-latest
     timeout-minutes: 15

KNOWN_LIMITATIONS.md

@@ -94,16 +94,6 @@ genuinely absent: per-IP rate limiting, backoff, or request queueing.
 `docs/http-transport.md` is explicit this remains defense-in-depth only;
 put a real reverse proxy in front if you need actual rate limiting.
 
-## Shared daemon has one capability ceiling for every connection
-
-A daemon's tool-preset ceiling is fixed at whichever process first
-spawned it (`crates/calm-server/src/daemon.rs`); `calm connect --preset`
-only takes effect if that connection is the one doing the spawning. Two
-MCP clients attached to the same project daemon share the same ceiling —
-there's no per-connection handshake negotiating a narrower profile per
-client. Each connection *does* get its own session state (`oriented`,
-`enabled_toolsets`, `session_log`), just not its own ceiling.
-
 ## Malicious/pathological-repo indexing DoS has partial mitigations
 
 `SECURITY.md` still calls resource-exhaustion-via-huge-repo out of scope
@@ -129,22 +119,3 @@ native/GitHub-release path doesn't. Renaming the native binary is a
 breaking change for anyone who's already scripted against `calm` and
 needs a deliberate decision (and probably a compatibility-alias
 transition period), not a silent rename — not done here.
-
-## No Git/CI-native integration path
-
-Everything above mostly assumes an MCP client calling CALM's tools
-directly. A first step now exists: `calm guard --project-root .`
-(`crates/calm-cli/src/main.rs`) runs the exact same `diff_impact` tool
-an MCP agent's own Stage-7 pre-commit gate uses, against the staged diff
-(`git diff --cached`) by default, and exits non-zero when the resulting
-`aggregate_risk` is at or above `--fail-on` (default `high`) — usable
-directly as a pre-commit hook or CI step for a change made outside any
-MCP session (a teammate's native editor, a bot PR), which was previously
-invisible to CALM entirely. `calm guard --base origin/main`-style
-PR-range analysis now also exists (`--base <ref>`, sugar for the
-merge-base-relative `<ref>...HEAD` commits range; `--commits <range>`
-for raw passthrough when that convention isn't what's wanted) — this
-was indeed mostly CLI plumbing onto `diff_impact`'s pre-existing
-`commits` param, as this section previously predicted. What's still
-missing: no publishable GitHub Action wrapping `calm guard` for
-one-line CI adoption.

action.yml

@@ -42,7 +42,13 @@ inputs:
     required: false
     default: 'false'
   version:
-    description: 'Which @eilodon/calm-mcp npm version to install. Defaults to the latest published release.'
+    description: >-
+      Which @eilodon/calm-mcp npm version to install. Defaults to 'latest',
+      which the install step resolves to the exact npm version matching
+      THIS action instance's own tag (release.yml publishes the action and
+      the npm package from the same tag in one coordinated workflow) rather
+      than npm's floating `latest` dist-tag -- set this explicitly only to
+      deliberately override that pinning.
     required: false
     default: 'latest'
   skip-install:
@@ -60,11 +66,47 @@ inputs:
 runs:
   using: 'composite'
   steps:
+    # Audit 11.3 (release-skew hazard): `action.yml`'s implementation comes
+    # from whatever ref the caller's `uses: eilodon/calm-mcp-action@X`
+    # checked out, but a bare npm `latest` install is a SEPARATE, floating
+    # identity that can drift out of sync with it -- a real past incident
+    # (see .github/workflows/ci.yml's calm-guard-dogfood job comment): this
+    # action called a subcommand that existed in source but hadn't been
+    # published to npm yet under `latest`, so CI had to switch to building
+    # calm-cli from source + skip-install to work around it. Since
+    # release.yml stamps the crate version from the release tag and
+    # publishes the matching npm version from that SAME tag in one
+    # coordinated workflow, `github.action_ref` (the tag THIS action
+    # instance was invoked at, e.g. "v0.6.0") is exactly the npm version
+    # guaranteed to match what this copy of action.yml expects -- resolved
+    # here instead of trusting npm's independently-moving `latest` dist-tag.
+    - name: Resolve calm version
+      if: inputs.skip-install != 'true'
+      id: calm_version
+      shell: bash
+      env:
+        INPUT_VERSION: ${{ inputs.version }}
+        ACTION_REF: ${{ github.action_ref }}
+      run: |
+        set -euo pipefail
+        version="$INPUT_VERSION"
+        if [ "$version" = "latest" ]; then
+          if [[ "$ACTION_REF" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            version="${ACTION_REF#v}"
+          else
+            # Not invoked at a release tag (e.g. a branch ref during this
+            # action's own development) -- no fixed release point to pin
+            # to, so fall back to real npm latest rather than guessing.
+            version="latest"
+          fi
+        fi
+        echo "version=$version" >> "$GITHUB_OUTPUT"
+
     - name: Install calm
       if: inputs.skip-install != 'true'
       shell: bash
       env:
-        CALM_VERSION: ${{ inputs.version }}
+        CALM_VERSION: ${{ steps.calm_version.outputs.version }}
       run: npm install --global "@eilodon/calm-mcp@$CALM_VERSION"
 
     # All `github.*`/`inputs.*` context values are threaded in via `env:`
@@ -105,8 +147,23 @@ runs:
         # so `calm guard --base` would fail to resolve it. Fetch it
         # explicitly rather than requiring every caller to remember
         # `fetch-depth: 0` in their own checkout step.
+        #
+        # Audit 11.4: a plain `--depth=1` fetch of the base ref (the prior
+        # version of this fix) has NO history shared with this checkout's
+        # OWN also-depth=1 HEAD -- `calm guard --base` builds a
+        # merge-base-relative `<base>...HEAD` range, and `git merge-base`
+        # then fails outright ("fatal: <base>...HEAD: no merge base")
+        # unless the two single commits happen to coincide. Reproduced for
+        # real in calm-guard-dogfood CI. `--depth=100` covers the
+        # overwhelming common case (most branches diverge by a handful of
+        # commits from their base); the `--unshallow` fallback guarantees a
+        # merge-base is found for anything that diverged further, at the
+        # cost of a slower fetch only in that rarer case.
         if [ -n "$fetch_ref" ]; then
-          git fetch --no-tags --depth=1 origin "$fetch_ref" || true
+          git fetch --no-tags --depth=100 origin "$fetch_ref" || true
+          if ! git merge-base "origin/$fetch_ref" HEAD >/dev/null 2>&1; then
+            git fetch --no-tags --unshallow origin || true
+          fi
         fi
 
         echo "commits=$commits" >> "$GITHUB_OUTPUT"