Context
From the 2026-07-13 mnemon competitive review (red-team validated — Recall memory breadcrumb #3984, learning #668). These three install-lifecycle hardening items survived adversarial review as the top 'steal now' tier: small, bounded, no new abstractions, directly serving daily-driver reliability.
Sibling of #112 (closed — doctor --fix config-write robustness) and #124 (open — atomic config-write parity in lib/install-lib.sh). This issue extends that same hardening cluster; implementation should reuse the patterns established there, not duplicate them.
The three items
1. JSON5-tolerant settings parsing
When install/update/doctor read ~/.claude/settings.json (or other host config), tolerate hand-edited files containing // comments and trailing commas by stripping them before parse instead of failing. mnemon reference implementation: internal/setup/settings.go:33-87 (strip comments + trailing commas, then strict parse). Note the tradeoff: comments are lost on write-back — acceptable, but document it.
2. $HOME degenerate-path collision guard
If a project-scoped operation ever runs from $HOME, the apparent project-local .claude/ IS the user-global ~/.claude/ directory. mnemon detects this (internal/setup/claude.go:108-140, collidesWithUserConfig, symlink- and CLAUDE_CONFIG_DIR-aware) and switches hook commands to absolute paths with a printed warning. Audit whether Recall's per-file symlink install has the same degenerate case and add the equivalent guard.
3. Remove emptied settings file on uninstall
When uninstall removes the last Recall-owned entries from a host config file, delete the file rather than leaving {} / empty-array husks. mnemon reference: WriteOrRemoveJSONFile (internal/setup/settings.go:177-185). Cleaner uninstall footprint; only applies to files Recall would otherwise leave semantically empty.
Acceptance criteria
Context
From the 2026-07-13 mnemon competitive review (red-team validated — Recall memory breadcrumb #3984, learning #668). These three install-lifecycle hardening items survived adversarial review as the top 'steal now' tier: small, bounded, no new abstractions, directly serving daily-driver reliability.
Sibling of #112 (closed — doctor --fix config-write robustness) and #124 (open — atomic config-write parity in
lib/install-lib.sh). This issue extends that same hardening cluster; implementation should reuse the patterns established there, not duplicate them.The three items
1. JSON5-tolerant settings parsing
When install/update/doctor read
~/.claude/settings.json(or other host config), tolerate hand-edited files containing//comments and trailing commas by stripping them before parse instead of failing. mnemon reference implementation:internal/setup/settings.go:33-87(strip comments + trailing commas, then strict parse). Note the tradeoff: comments are lost on write-back — acceptable, but document it.2. $HOME degenerate-path collision guard
If a project-scoped operation ever runs from
$HOME, the apparent project-local.claude/IS the user-global~/.claude/directory. mnemon detects this (internal/setup/claude.go:108-140,collidesWithUserConfig, symlink- andCLAUDE_CONFIG_DIR-aware) and switches hook commands to absolute paths with a printed warning. Audit whether Recall's per-file symlink install has the same degenerate case and add the equivalent guard.3. Remove emptied settings file on uninstall
When uninstall removes the last Recall-owned entries from a host config file, delete the file rather than leaving
{}/ empty-array husks. mnemon reference:WriteOrRemoveJSONFile(internal/setup/settings.go:177-185). Cleaner uninstall footprint; only applies to files Recall would otherwise leave semantically empty.Acceptance criteria
lib/install-lib.sh/ existing doctor paths per DRY rule — no per-script duplicationbash -npasses on touched lifecycle scripts; existing install-lifecycle tests extended