git:20260809.a216552 to git:20260809.3d30a47

+ One binary, `subrosa`. The plugin (`.claude-plugin/`, `hooks/hooks.json`) wires Claude Code's SessionStart/SessionEnd/UserPromptSubmit/PreCompact/Stop events to `hooks/run.sh`, which finds (or bootstraps) the binary and runs `subrosa hook <event>`. SessionStart catch-up-ingests changed transcripts and prints the checkpoint nudge; SessionEnd archives the ended session, queues it for checkpointing, and takes a throttled backup; both then spawn the detached semantic indexer (`embed --auto`) and return without waiting on it; UserPromptSubmit injects relevant past-session hits into context (and, while sessions are queued for checkpoint, a per-prompt directive to run the backlog — the one-shot SessionStart nudge gets scrolled past once the first task lands); PreCompact archives the conversation before compaction summarizes it away and resets recall dedup so post-compact prompts can re-inject; Stop incrementally ingests just the in-progress transcript after each assistant turn — resuming from a saved byte offset so per-turn cost stays flat as the session grows — so the live session is searchable before it ends (no checkpoint enqueue or backup — those stay on SessionEnd). On top of the archive sit curated facts: `subrosa fact` mutates them, `subrosa generate` renders a byte-budgeted MEMORY.md, and the bundled `/subrosa:checkpoint` + `/subrosa:checkpoint-backlog` skills (in `skills/`) drive the distillation workflow. `subrosa search` queries the archive; bare `subrosa` is the dashboard.

+ | paths.rs | data locations, env overrides, KEY=VALUE config file (incl. `semantic` on/off and the indexer's `embed.state`) |

+ | search.rs | FTS5 query building + result output (incl. `--after`/`--before`/`--tag` filters), plus `--semantic` ranking and the `subrosa embed` backfill (newest-first slabs, deduped, one thread per core — half of them for `--auto`, floored at 2 and capped at the core count, so a 2-core box uses both and a 1-core box uses its one — over a shared `Embedder`, main thread the only DB writer) |

+ | stats.rs | dashboard (also the bare `subrosa` default), incl. the semantic-index progress line |

+ | embed.rs | the bundled model (bge-small-en-v1.5 on candle, CPU): pinned revision, one-time download via a system curl child, per-file sha256 checked on download only (later runs just stat the pinned sizes — rehashing the weights per search cost more than it bought), CLS pooling, cosine/normalize; `embed(&self)` is Send+Sync so one loaded model serves every backfill worker. Also the automatic indexer's plumbing: `spawn_if_due` (gate + detached spawn), the `embed.lock` run lock, and the `embed.state` retry backoff |

+ | hook.rs | hook entrypoints: stdin JSON in, log to file, always exit 0; SessionStart/SessionEnd also spawn the detached indexer |

+ - **The binary opens no sockets.** The one-time model download runs through a system curl child (`embed.rs`), pinned to one revision and sha256-verified as it lands — nothing else in the tree reaches the network, and no text of yours is ever uploaded. A hook never downloads or embeds anything itself: SessionStart/SessionEnd spawn `embed --auto` detached (own process group, stdio null, no wait — Claude Code kills a hook at 120s, and a first backfill takes minutes), and that process is the only downloader. `semantic=off` (config or `SUBROSA_SEMANTIC`) stops the spawn AND the download itself — `ensure_model` refuses before curl, so a typed `subrosa embed` can't fetch either; loading a model already on disk stays allowed. A config that can't be read counts as off (fail closed), so an unreadable file never defaults to downloading. A failed run writes `embed.state` and the next spawn is skipped until its retry window passes, so an offline machine never re-downloads every session. Embedding runs in-process on the CPU. Only `subrosa embed` and `search --semantic` construct an `Embedder`, lazily, so recall, hooks and ingest keep their startup cost; `--semantic` fails loudly rather than falling back to keyword. Text is redacted before it reaches the model (turns at ingest, the query through `redact::redact`). Its store (`turn_embeddings`) is a lazy table like the trigram index — created on first use, outside `migrate()`, so SCHEMA_VERSION stays put; vectors under any other model key are deleted at the start of a backfill, since nothing can rank or resume from them.

+ - **System tools are absolute, never PATH.** `curl` (the model download), `stty` (the passphrase prompt) and `git` (the dashboard's repo label) resolve through `paths::system_tool` against fixed absolute paths — hooks run with whatever PATH the session had. `SUBROSA_CURL` is the deliberate override for a curl that lives elsewhere. Missing means the feature degrades (no download / echoing prompt / no repo label), never a PATH lookup.

+ - **Small control files get `paths::read_control_file`.** config, `embed.state`, the checkpoint queue, `.budget`, the recall dedup log, MEMORY.md: regular files only, symlinks resolved by hand, size-capped. Most are read inside a hook, where a FIFO blocks the session forever and a dangling symlink reads as ENOENT — which is how an evicted cloud-synced `semantic=off` used to come back on. `Ok(None)` is "nothing there", `Err` is "something is there and it's unusable", and callers must never collapse the two.

+ - Smoke recipe: write a synthetic transcript `.jsonl` under `/tmp/x/projects/-tmp-demo/`, then `init` → `ingest` → `search` (try `--after`/`--before`/`--tag`) → `sessions --tag tool:bash` → `session <id> --tags` → `fact upsert --memdir /tmp/x/memdir --leaf note.md` → `fact doctor --memdir /tmp/x/memdir` → `generate --memdir /tmp/x/memdir --dry-run` → pipe `{"prompt":"...","cwd":"...","session_id":"..."}` into `hook user-prompt-submit` → pipe `{"transcript_path":"…","session_id":"…"}` into `hook stop` (mid-session live ingest) then `hook session-end` (export `SUBROSA_SEMANTIC=off` unless you mean to test the indexer — otherwise the hooks start a real model download) → check `hook.log`, `pending`, the nudge from `hook session-start`, that secrets in the stored turns are redacted, and that tags were derived.

+ 4. **Smoke** — `scripts/smoke.sh` (takes the built binary; runs a throwaway end-to-end pipeline). Proves on the real binary what the unit tests prove in isolation: redaction actually masks stored turns, the encrypted-mirror + restore paths work, the budget override fails closed, and the hooks exit 0. A green unit suite is not a substitute — run this on the shipped binary. `scripts/detach-test.sh` is the separate one, run by hand on any change to the spawn path: it proves the background indexer survives the session that started it (needs a shell with job control, and it is not part of `release-check.sh`).