diff --git a/README.md b/README.md
index 56ed9b5..6dbb90a 100644
--- a/README.md
+++ b/README.md
@@ -11,7 +11,7 @@ and the lessons learned across every project — automatically.
 - 🧠 **Automatic recall** — relevant memories are injected for substantive prompts via
   the `UserPromptSubmit` hook, with short commands skipped and retrieval capped at 3 seconds.
 - 💾 **Automatic capture** — conversations are stored incrementally (every N turns) and
-  at session end via the `Stop` hook.
+  flushed after completed turns via the `Stop` hook.
 - 🏷️ **Shared Agents scoping** — Codex, Claude Code, and OpenCode use one collision-safe
   repository container.
 - 📦 **Custom container tags** — define custom memory containers (e.g., `work`, `personal`,
@@ -51,17 +51,20 @@ and the lessons learned across every project — automatically.
 ## How it works
 
 Codex CLI supports a hooks system that lets external scripts run at specific
-lifecycle events. `codex-supermemory` registers two hooks:
+lifecycle events. `codex-supermemory` registers four hooks:
 
 | Hook              | Event                  | What it does                                                        |
 | ----------------- | ---------------------- | ------------------------------------------------------------------- |
-| `recall`          | `UserPromptSubmit`     | Captures new turns (every N prompts), then searches Supermemory for relevant memories and your profile, injecting them into the prompt as `additionalContext`. |
-| `flush`           | `Stop`                 | Captures any remaining turns at session end so the final conversation turns are never lost. |
-
-**Incremental capture**: Memories are saved every N turns (default: 3) during the session.
-This means memories from earlier in your session are immediately available for recall
+| `recall`          | `UserPromptSubmit`     | Searches Supermemory for relevant memories and your profile, injecting them into the prompt as `additionalContext`. |
+| `capture-turn`    | `UserPromptSubmit`     | Captures new turns every N prompts in the background without delaying recall. |
+| `flush`           | `Stop`                 | Captures remaining turns in the background after a completed turn. |
+| `session-start`   | `SessionStart`         | Loads persistent and recent profile context for the session. |
+
+**Incremental capture**: When configured, memories are saved every N turns during the session
+(legacy installs retain their existing cadence; fresh installs rely on turn-stop capture).
+This background hook makes memories from earlier in your session available for recall
 in the same session. The flush hook ensures any trailing turns are captured when the
-session ends.
+current turn stops.
 
 The installer:
 
@@ -112,7 +115,7 @@ Drop this file in to override defaults:
 | `baseUrl`                | `string`   | `https://api.supermemory.ai` | Supermemory API base URL (`SUPERMEMORY_API_URL`/`SUPERMEMORY_BASE_URL` env vars take precedence). |
 | `similarityThreshold`    | `number`   | `0.6`          | Minimum similarity score for retrieved memories.                                             |
 | `maxMemories`            | `number`   | `5`            | Max memories injected per prompt.                                                            |
-| `maxProfileItems`        | `number`   | `5`            | Max profile items considered.                                                                |
+| `maxProfileItems`        | `number`   | `5`            | Max profile items considered from each persistent/recent section.                            |
 | `injectProfile`          | `boolean`  | `true`         | Whether to fetch and inject the user profile.                                                |
 | `containerTagPrefix`     | `string`   | `"codex"`      | Legacy prefix retained when reading containers created by older versions.                    |
 | `userContainerTag`       | `string`   | auto           | Legacy personal container retained for backward-compatible reads.                            |
diff --git a/build.mjs b/build.mjs
index ce5c4e6..7743032 100644
--- a/build.mjs
+++ b/build.mjs
@@ -24,7 +24,7 @@ const sharedConfig = {
 
 const executableEntries = [
   { in: "src/cli.ts", out: "dist/cli.js" },
-  ...["recall", "flush", "session-start"].map((n) => ({
+  ...["recall", "capture-turn", "flush", "session-start"].map((n) => ({
     in: `src/hooks/${n}.ts`,
     out: `dist/hooks/${n}.js`,
   })),
@@ -44,6 +44,9 @@ const libraryEntries = [
   { in: "src/services/factCache.ts", out: "dist/services/factCache.js" },
   { in: "src/services/recallPolicy.ts", out: "dist/services/recallPolicy.js" },
   { in: "src/services/hookRecallClient.ts", out: "dist/services/hookRecallClient.js" },
+  { in: "src/services/client.ts", out: "dist/services/client.js" },
+  { in: "src/services/context.ts", out: "dist/services/context.js" },
+  { in: "src/services/tracker.ts", out: "dist/services/tracker.js" },
 ];
 
 await Promise.all(
diff --git a/src/cli.ts b/src/cli.ts
index 699ae84..eb215c0 100644
--- a/src/cli.ts
+++ b/src/cli.ts
@@ -33,12 +33,14 @@ const CODEX_CONFIG_TOML = join(CODEX_DIR, "config.toml");
 const CODEX_HOOKS_JSON = join(CODEX_DIR, "hooks.json");
 const SUPERMEMORY_HOOKS_DIR = join(CODEX_DIR, "supermemory");
 const RECALL_SCRIPT = join(SUPERMEMORY_HOOKS_DIR, "recall.js");
+const TURN_CAPTURE_SCRIPT = join(SUPERMEMORY_HOOKS_DIR, "capture-turn.js");
 const FLUSH_SCRIPT = join(SUPERMEMORY_HOOKS_DIR, "flush.js");
 const SESSION_START_SCRIPT = join(SUPERMEMORY_HOOKS_DIR, "session-start.js");
 const CODEX_SKILLS_DIR = join(homedir(), ".codex", "skills");
-const RECALL_TIMEOUT_SECONDS = 90;
-const FLUSH_TIMEOUT_SECONDS = 60;
-const SESSION_START_TIMEOUT_SECONDS = 60;
+const RECALL_TIMEOUT_SECONDS = 5;
+const CAPTURE_TIMEOUT_SECONDS = 30;
+const FLUSH_TIMEOUT_SECONDS = 30;
+const SESSION_START_TIMEOUT_SECONDS = 30;
 
 // Skill metadata — single source of truth for install/uninstall/status.
 const SKILLS = [
@@ -135,6 +137,7 @@ interface HookEntry {
   command: string;
   timeout?: number;
   statusMessage?: string;
+  async?: boolean;
 }
 
 // Codex hooks.json schema: each event key maps to an array of MatcherGroup objects.
@@ -186,6 +189,7 @@ function ensureHookRegistered(
   command: string,
   timeout: number,
   statusMessage: string,
+  background = false,
 ): void {
   const exists = groups.some((g) => g.hooks.some((h) => h.command === command));
   if (exists) {
@@ -194,12 +198,20 @@ function ensureHookRegistered(
         if (hook.command === command) {
           hook.timeout = timeout;
           hook.statusMessage = statusMessage;
+          if (background) hook.async = true;
+          else delete hook.async;
         }
       }
     }
   } else {
     const globalGroup = groups.find((g) => !g.matcher);
-    const entry: HookEntry = { type: "command", command, timeout, statusMessage };
+    const entry: HookEntry = {
+      type: "command",
+      command,
+      timeout,
+      statusMessage,
+      ...(background ? { async: true } : {}),
+    };
     if (globalGroup) {
       globalGroup.hooks.push(entry);
     } else {
@@ -231,6 +243,7 @@ function mergeHooksJson(add: boolean) {
 
   if (add) {
     const recallCmd = `node ${RECALL_SCRIPT}`;
+    const turnCaptureCmd = `node ${TURN_CAPTURE_SCRIPT}`;
     const flushCmd = `node ${FLUSH_SCRIPT}`;
     const sessionStartCmd = `node ${SESSION_START_SCRIPT}`;
     const oldCaptureCmd = `node ${join(SUPERMEMORY_HOOKS_DIR, "capture.js")}`;
@@ -243,9 +256,17 @@ function mergeHooksJson(add: boolean) {
       "Loading memory profile...",
     );
 
-    // Register UserPromptSubmit hook for optional per-prompt recall / turn capture
+    // Recall must stay synchronous because its output is injected. Turn capture
+    // is a separate background hook so it can never delay prompt handling.
     if (!hooks.UserPromptSubmit) hooks.UserPromptSubmit = [];
     ensureHookRegistered(hooks.UserPromptSubmit, recallCmd, RECALL_TIMEOUT_SECONDS, "Searching memories...");
+    ensureHookRegistered(
+      hooks.UserPromptSubmit,
+      turnCaptureCmd,
+      CAPTURE_TIMEOUT_SECONDS,
+      "Saving turn to memory...",
+      true,
+    );
 
     // Remove old capture.js Stop hook from previous installs
     if (hooks.Stop) {
@@ -255,10 +276,17 @@ function mergeHooksJson(add: boolean) {
 
     // Register Stop hook for flush
     if (!hooks.Stop) hooks.Stop = [];
-    ensureHookRegistered(hooks.Stop, flushCmd, FLUSH_TIMEOUT_SECONDS, "Saving to memory...");
+    ensureHookRegistered(
+      hooks.Stop,
+      flushCmd,
+      FLUSH_TIMEOUT_SECONDS,
+      "Saving to memory...",
+      true,
+    );
   } else {
     // Remove our hooks from every MatcherGroup, then drop empty groups.
     const recallCmd = `node ${RECALL_SCRIPT}`;
+    const turnCaptureCmd = `node ${TURN_CAPTURE_SCRIPT}`;
     const flushCmd = `node ${FLUSH_SCRIPT}`;
     const sessionStartCmd = `node ${SESSION_START_SCRIPT}`;
     const oldCaptureCmd = `node ${join(SUPERMEMORY_HOOKS_DIR, "capture.js")}`;
@@ -268,7 +296,10 @@ function mergeHooksJson(add: boolean) {
       if (hooks.SessionStart.length === 0) delete hooks.SessionStart;
     }
     if (hooks.UserPromptSubmit) {
-      hooks.UserPromptSubmit = removeHookCommands(hooks.UserPromptSubmit, [recallCmd]);
+      hooks.UserPromptSubmit = removeHookCommands(
+        hooks.UserPromptSubmit,
+        [recallCmd, turnCaptureCmd],
+      );
       if (hooks.UserPromptSubmit.length === 0) delete hooks.UserPromptSubmit;
     }
     if (hooks.Stop) {
@@ -291,15 +322,22 @@ function install() {
 
   // Copy hook scripts
   const recallSrc = join(DIST_HOOKS_DIR, "recall.js");
+  const turnCaptureSrc = join(DIST_HOOKS_DIR, "capture-turn.js");
   const flushSrc = join(DIST_HOOKS_DIR, "flush.js");
   const sessionStartSrc = join(DIST_HOOKS_DIR, "session-start.js");
 
-  if (!existsSync(recallSrc) || !existsSync(flushSrc) || !existsSync(sessionStartSrc)) {
+  if (
+    !existsSync(recallSrc) ||
+    !existsSync(turnCaptureSrc) ||
+    !existsSync(flushSrc) ||
+    !existsSync(sessionStartSrc)
+  ) {
     console.error("Error: Hook scripts not found. Please reinstall the package.");
     process.exit(1);
   }
 
   copyFileSync(recallSrc, RECALL_SCRIPT);
+  copyFileSync(turnCaptureSrc, TURN_CAPTURE_SCRIPT);
   copyFileSync(flushSrc, FLUSH_SCRIPT);
   copyFileSync(sessionStartSrc, SESSION_START_SCRIPT);
 
@@ -342,7 +380,7 @@ You now have:
 
 ${hadExistingConfig
     ? "Existing recall/capture preferences were preserved in ~/.codex/supermemory.json.\nSet recallMode to direct, off, or advisory to change recall behavior.\n"
-    : "Fresh install: direct relevant-memory recall plus session-start profile and session-end flush.\nSet recallMode to off or advisory in ~/.codex/supermemory.json if preferred.\n"}
+    : "Fresh install: direct relevant-memory recall plus session-start profile and turn-stop flush.\nSet recallMode to off or advisory in ~/.codex/supermemory.json if preferred.\n"}
 
 Next steps:
   1. Start Codex — on your first prompt, a browser window will open to
@@ -398,6 +436,7 @@ function status() {
 
   const hooksInstalled =
     existsSync(RECALL_SCRIPT) &&
+    existsSync(TURN_CAPTURE_SCRIPT) &&
     existsSync(FLUSH_SCRIPT) &&
     existsSync(SESSION_START_SCRIPT);
   const hooksJsonExists = existsSync(CODEX_HOOKS_JSON);
@@ -408,18 +447,27 @@ function status() {
     try {
       const hooks = normalizeHookEvents(JSON.parse(readFileSync(CODEX_HOOKS_JSON, "utf-8")));
       const recallCmd = `node ${RECALL_SCRIPT}`;
+      const turnCaptureCmd = `node ${TURN_CAPTURE_SCRIPT}`;
       const flushCmd = `node ${FLUSH_SCRIPT}`;
       const sessionStartCmd = `node ${SESSION_START_SCRIPT}`;
       const recallRegistered = hooks.UserPromptSubmit?.some((g: MatcherGroup) =>
         g.hooks.some((h: HookEntry) => h.command === recallCmd)
       );
+      const turnCaptureRegistered = hooks.UserPromptSubmit?.some((g: MatcherGroup) =>
+        g.hooks.some((h: HookEntry) => h.command === turnCaptureCmd && h.async === true)
+      );
       const flushRegistered = hooks.Stop?.some((g: MatcherGroup) =>
-        g.hooks.some((h: HookEntry) => h.command === flushCmd)
+        g.hooks.some((h: HookEntry) => h.command === flushCmd && h.async === true)
       );
       const sessionStartRegistered = hooks.SessionStart?.some((g: MatcherGroup) =>
         g.hooks.some((h: HookEntry) => h.command === sessionStartCmd)
       );
-      hooksEnabled = !!(recallRegistered && flushRegistered && sessionStartRegistered);
+      hooksEnabled = !!(
+        recallRegistered &&
+        turnCaptureRegistered &&
+        flushRegistered &&
+        sessionStartRegistered
+      );
     } catch {
       // ignore
     }
diff --git a/src/config.ts b/src/config.ts
index 1e88f8c..997a726 100644
--- a/src/config.ts
+++ b/src/config.ts
@@ -298,7 +298,7 @@ export function getRecallModeSummary(): string {
     return "advisory: prompt the agent to search memory when needed";
   }
   if (CONFIG.captureEveryNTurns > 0) {
-    return `unified: session-start profile + capture every ${CONFIG.captureEveryNTurns} turns + session-end flush`;
+    return `unified: session-start profile + capture every ${CONFIG.captureEveryNTurns} turns + turn-stop flush`;
   }
-  return "unified: session-start profile + session-end flush only";
+  return "unified: session-start profile + turn-stop flush only";
 }
diff --git a/src/hooks/capture-turn.ts b/src/hooks/capture-turn.ts
new file mode 100644
index 0000000..6fec553
--- /dev/null
+++ b/src/hooks/capture-turn.ts
@@ -0,0 +1,47 @@
+import { readFileSync } from "node:fs";
+import { CONFIG, isConfigured } from "../config.js";
+import { SupermemoryClient } from "../services/client.js";
+import { captureEntries, resolveTranscriptPath } from "../services/capture.js";
+import { getSessionId } from "../services/session.js";
+import { getTags } from "../services/tags.js";
+import { log } from "../services/logger.js";
+
+interface CodexPromptPayload {
+  session_id?: string;
+  transcript_path?: string | null;
+  cwd?: string;
+  [key: string]: unknown;
+}
+
+async function main(): Promise<void> {
+  if (!isConfigured() || CONFIG.captureEveryNTurns <= 0) return;
+
+  let payload: CodexPromptPayload;
+  try {
+    payload = JSON.parse(readFileSync(0, "utf-8")) as CodexPromptPayload;
+  } catch {
+    return;
+  }
+
+  const cwd = payload.cwd || process.cwd();
+  const tags = getTags(cwd);
+  const sessionId = getSessionId(payload.session_id, tags.project);
+  const transcriptPath = resolveTranscriptPath(payload.transcript_path, sessionId);
+
+  log("capture-turn: start", { sessionId, transcriptPath });
+  await captureEntries(
+    "recall",
+    new SupermemoryClient(),
+    sessionId,
+    transcriptPath,
+    tags,
+    {
+      requireMinEntries: 2,
+      requireMinTurns: CONFIG.captureEveryNTurns,
+    },
+  );
+}
+
+main()
+  .catch(() => {})
+  .finally(() => process.exit(0));
diff --git a/src/hooks/recall.ts b/src/hooks/recall.ts
index 9fc53e9..e2ebefb 100644
--- a/src/hooks/recall.ts
+++ b/src/hooks/recall.ts
@@ -1,19 +1,15 @@
-import { readFileSync, existsSync, writeFileSync, unlinkSync, mkdirSync } from "node:fs";
-import { join, dirname } from "node:path";
+import { readFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
 import { homedir } from "node:os";
-import { isConfigured, CONFIG, reloadApiKey, getContainerCatalog } from "../config.js";
-import { SupermemoryClient } from "../services/client.js";
+import { isConfigured, CONFIG, getContainerCatalog } from "../config.js";
 import { getTags } from "../services/tags.js";
 import { formatCombinedContext } from "../services/context.js";
 import { log } from "../services/logger.js";
-import { startAuthFlow, AUTH_BASE_URL } from "../services/auth.js";
-import { captureEntries, resolveTranscriptPath } from "../services/capture.js";
 import { getSeenFacts, addSeenFacts } from "../services/factCache.js";
 import { getSessionId } from "../services/session.js";
 import { getHookProfileWithSearchMany } from "../services/hookRecallClient.js";
 import { prepareRecallQuery, shouldRecallPrompt } from "../services/recallPolicy.js";
 
-const AUTH_ATTEMPTED_FILE = join(homedir(), ".codex", "supermemory", ".auth-attempted");
 const LOGGED_OUT_FILE = join(homedir(), ".codex", "supermemory", ".logged-out");
 
 interface CodexHookPayload {
@@ -25,14 +21,19 @@ interface CodexHookPayload {
   [key: string]: unknown;
 }
 
-function exitWithContext(additionalContext: string): never {
-  if (additionalContext) {
+function exitWithContext(additionalContext: string, systemMessage?: string): never {
+  if (additionalContext || systemMessage) {
     process.stdout.write(
       JSON.stringify({
-        hookSpecificOutput: {
-          hookEventName: "UserPromptSubmit",
-          additionalContext,
-        },
+        ...(systemMessage ? { systemMessage } : {}),
+        ...(additionalContext
+          ? {
+              hookSpecificOutput: {
+                hookEventName: "UserPromptSubmit",
+                additionalContext,
+              },
+            }
+          : {}),
       })
     );
   }
@@ -53,38 +54,12 @@ async function main() {
       exitWithContext("");
     }
 
-    const alreadyAttempted = existsSync(AUTH_ATTEMPTED_FILE);
-
-    if (!alreadyAttempted) {
-      try {
-        mkdirSync(dirname(AUTH_ATTEMPTED_FILE), { recursive: true });
-        writeFileSync(AUTH_ATTEMPTED_FILE, new Date().toISOString());
-      } catch {}
-
-      try {
-        log("recall: no API key, starting browser auth flow");
-        await startAuthFlow();
-        reloadApiKey();
-        try { unlinkSync(AUTH_ATTEMPTED_FILE); } catch {}
-        log("recall: auth flow completed");
-      } catch (authErr) {
-        const isTimeout =
-          authErr instanceof Error && authErr.message === "AUTH_TIMEOUT";
-        exitWithContext(
-          "[SUPERMEMORY] Memory is installed but NOT active — missing API key.\n" +
-          (isTimeout
-            ? "Authentication timed out. Please complete login in the browser.\n"
-            : "Authentication failed.\n") +
-          `If the browser did not open, visit: ${AUTH_BASE_URL}\n` +
-          "Run /supermemory-login to try again, or set SUPERMEMORY_CODEX_API_KEY manually."
-        );
-      }
-    } else {
-      exitWithContext(
-        "[SUPERMEMORY] Memory is installed but NOT active — missing API key.\n" +
-        "Run /supermemory-login to authenticate, or set SUPERMEMORY_CODEX_API_KEY in your shell profile."
-      );
-    }
+    // UserPromptSubmit has a 5s backstop and must never launch the interactive
+    // browser flow. SessionStart and /supermemory-login own authentication.
+    exitWithContext(
+      "[SUPERMEMORY] Memory is installed but NOT active — missing API key.\n" +
+      "Run /supermemory-login to authenticate, or set SUPERMEMORY_CODEX_API_KEY in your shell profile."
+    );
   }
 
   let payload: CodexHookPayload = {};
@@ -110,16 +85,6 @@ async function main() {
     recallMode: CONFIG.recallMode,
   });
 
-  const transcriptPath = resolveTranscriptPath(payload.transcript_path, sessionId);
-  const client = new SupermemoryClient();
-
-  if (CONFIG.captureEveryNTurns > 0) {
-    await captureEntries("recall", client, sessionId, transcriptPath, tags, {
-      requireMinEntries: 2,
-      requireMinTurns: CONFIG.captureEveryNTurns,
-    });
-  }
-
   if (CONFIG.recallMode === "off") {
     exitWithContext("");
   }
@@ -136,6 +101,10 @@ async function main() {
       prepareRecallQuery(query),
     );
 
+    if (!profileResult.success) {
+      exitWithContext("", "◪ supermemory · recall unavailable; continuing without recalled context");
+    }
+
     const seen = getSeenFacts(sessionId);
     const { text, newFacts } = formatCombinedContext(
       profileResult,
@@ -175,7 +144,7 @@ async function main() {
     }
   } catch (error) {
     log("recall: error", { error: String(error) });
-    exitWithContext("");
+    exitWithContext("", "◪ supermemory · recall unavailable; continuing without recalled context");
   }
 }
 
diff --git a/src/hooks/session-start.ts b/src/hooks/session-start.ts
index 9cd5152..4a2c986 100644
--- a/src/hooks/session-start.ts
+++ b/src/hooks/session-start.ts
@@ -2,7 +2,7 @@ import { readFileSync, existsSync, writeFileSync, unlinkSync, mkdirSync } from "
 import { join, dirname } from "node:path";
 import { homedir } from "node:os";
 import { isConfigured, CONFIG, PLUGIN_VERSION, reloadApiKey } from "../config.js";
-import { SupermemoryClient } from "../services/client.js";
+import { HOOK_API_TIMEOUT_MS, SupermemoryClient } from "../services/client.js";
 import { getTags } from "../services/tags.js";
 import { formatCombinedContext } from "../services/context.js";
 import { log } from "../services/logger.js";
@@ -13,6 +13,17 @@ import { checkNpmUpdate, formatUpdateNotice } from "../services/version-check.js
 const AUTH_ATTEMPTED_FILE = join(homedir(), ".codex", "supermemory", ".auth-attempted");
 const LOGGED_OUT_FILE = join(homedir(), ".codex", "supermemory", ".logged-out");
 const UPDATE_COMMAND = "npx codex-supermemory@latest install";
+const SESSION_START_HOOK_TIMEOUT_MS = 30_000;
+const SESSION_START_AUTH_TIMEOUT_MS = 25_000;
+
+function getSessionStartAuthTimeoutMs(): number {
+  const configured = Number(process.env.SUPERMEMORY_AUTH_TIMEOUT);
+  const requested = Number.isFinite(configured) && configured > 0
+    ? configured
+    : SESSION_START_AUTH_TIMEOUT_MS;
+  // Leave room for the hard-capped profile/update requests and hook teardown.
+  return Math.min(requested, SESSION_START_HOOK_TIMEOUT_MS - HOOK_API_TIMEOUT_MS - 2_000);
+}
 
 interface CodexHookPayload {
   session_id?: string;
@@ -20,14 +31,19 @@ interface CodexHookPayload {
   [key: string]: unknown;
 }
 
-function exitWithContext(additionalContext: string): never {
-  if (additionalContext) {
+function exitWithContext(additionalContext: string, systemMessage?: string): never {
+  if (additionalContext || systemMessage) {
     process.stdout.write(
       JSON.stringify({
-        hookSpecificOutput: {
-          hookEventName: "SessionStart",
-          additionalContext,
-        },
+        ...(systemMessage ? { systemMessage } : {}),
+        ...(additionalContext
+          ? {
+              hookSpecificOutput: {
+                hookEventName: "SessionStart",
+                additionalContext,
+              },
+            }
+          : {}),
       })
     );
   }
@@ -60,7 +76,7 @@ async function main() {
       } catch {}
 
       try {
-        await startAuthFlow();
+        await startAuthFlow(getSessionStartAuthTimeoutMs());
         reloadApiKey();
         try { unlinkSync(AUTH_ATTEMPTED_FILE); } catch {}
       } catch {
@@ -95,7 +111,11 @@ async function main() {
   log("session-start: begin", { sessionId, tags });
 
   try {
-    const profileResult = await client.getProfileMany(tags.allReads);
+    const profileResult = await client.getProfileMany(
+      tags.allReads,
+      undefined,
+      { timeoutMs: HOOK_API_TIMEOUT_MS },
+    );
     const seen = getSeenFacts(sessionId);
     const { text, newFacts } = formatCombinedContext(
       {
@@ -108,6 +128,13 @@ async function main() {
       seen,
     );
 
+    if (!profileResult.success) {
+      exitWithContext(
+        await updateCheck ?? "",
+        "◪ supermemory · profile unavailable; continuing without recalled context",
+      );
+    }
+
     if (newFacts.length > 0) {
       addSeenFacts(sessionId, newFacts);
       const updateNotice = await updateCheck;
@@ -120,10 +147,16 @@ async function main() {
     exitWithContext(await updateCheck ?? "");
   } catch (error) {
     log("session-start: error", { error: String(error) });
-    exitWithContext(await updateCheck ?? "");
+    exitWithContext(
+      await updateCheck ?? "",
+      "◪ supermemory · profile unavailable; continuing without recalled context",
+    );
   }
 }
 
 main().catch(() => {
-  exitWithContext("");
+  exitWithContext(
+    "",
+    "◪ supermemory · profile unavailable; continuing without recalled context",
+  );
 });
diff --git a/src/services/auth.ts b/src/services/auth.ts
index 37e45cc..75a925a 100644
--- a/src/services/auth.ts
+++ b/src/services/auth.ts
@@ -17,7 +17,11 @@ export interface Credentials {
 
 const AUTH_BASE_URL =
   process.env.SUPERMEMORY_AUTH_URL || "https://app.supermemory.ai/auth/agent-connect";
-const AUTH_TIMEOUT = Number(process.env.SUPERMEMORY_AUTH_TIMEOUT) || 5 * 60_000;
+const configuredAuthTimeout = Number(process.env.SUPERMEMORY_AUTH_TIMEOUT);
+const AUTH_TIMEOUT =
+  Number.isFinite(configuredAuthTimeout) && configuredAuthTimeout > 0
+    ? configuredAuthTimeout
+    : 5 * 60_000;
 
 const AUTH_SUCCESS_HTML = `<!DOCTYPE html>
 <html><head><title>Connected - Supermemory</title><style>
@@ -86,7 +90,7 @@ function saveCredentials(apiKey: string, apiBaseUrl?: string): void {
   );
 }
 
-export function startAuthFlow(): Promise<string> {
+export function startAuthFlow(timeoutMs = AUTH_TIMEOUT): Promise<string> {
   return new Promise((resolve, reject) => {
     let resolved = false;
     const stateToken = randomBytes(16).toString("hex");
@@ -160,7 +164,7 @@ export function startAuthFlow(): Promise<string> {
         server.close();
         reject(new Error("AUTH_TIMEOUT"));
       }
-    }, AUTH_TIMEOUT);
+    }, timeoutMs);
   });
 }
 
diff --git a/src/services/capture.ts b/src/services/capture.ts
index b0a01c0..76ccf25 100644
--- a/src/services/capture.ts
+++ b/src/services/capture.ts
@@ -6,6 +6,7 @@
 import { existsSync } from "node:fs";
 import {
   SupermemoryClient,
+  HOOK_API_TIMEOUT_MS,
   USER_ENTITY_CONTEXT,
 } from "./client.js";
 import { log } from "./logger.js";
@@ -15,7 +16,11 @@ import {
   formatTranscript,
   findTranscriptPath,
 } from "./transcript.js";
-import { getLastCapturedIndex, setLastCapturedIndex } from "./tracker.js";
+import {
+  getLastCapturedIndex,
+  setLastCapturedIndex,
+  withSessionCaptureLock,
+} from "./tracker.js";
 import { filterBySignals, groupEntriesIntoTurns } from "./signals.js";
 import type { ResolvedTags } from "./tags.js";
 
@@ -57,13 +62,36 @@ export async function captureEntries(
   tags: Pick<ResolvedTags, "canonical" | "project" | "user" | "projectName" | "projectId">,
   options: CaptureOptions = {},
 ): Promise<void> {
-  const { requireMinEntries = 0, requireMinTurns = 0 } = options;
-
   if (!transcriptPath || !existsSync(transcriptPath)) {
     log(`${caller}: no transcript to capture from`, { sessionId, transcriptPath });
     return;
   }
 
+  const acquired = await withSessionCaptureLock(sessionId, async () => {
+    await captureEntriesLocked(
+      caller,
+      client,
+      sessionId,
+      transcriptPath,
+      tags,
+      options,
+    );
+  });
+  if (!acquired) {
+    log(`${caller}: capture lock timed out`, { sessionId });
+  }
+}
+
+async function captureEntriesLocked(
+  caller: string,
+  client: SupermemoryClient,
+  sessionId: string,
+  transcriptPath: string,
+  tags: Pick<ResolvedTags, "canonical" | "project" | "user" | "projectName" | "projectId">,
+  options: CaptureOptions,
+): Promise<void> {
+  const { requireMinEntries = 0, requireMinTurns = 0 } = options;
+
   const entries = parseTranscript(transcriptPath);
   if (entries.length === 0) {
     log(`${caller}: transcript empty`, { sessionId });
@@ -151,6 +179,7 @@ export async function captureEntries(
     const result = await client.addMemory(content, tags.canonical, metadata, {
       customId: sessionId,
       entityContext: USER_ENTITY_CONTEXT,
+      timeoutMs: HOOK_API_TIMEOUT_MS,
     });
 
     if (!result.success) {
diff --git a/src/services/client.ts b/src/services/client.ts
index dc85240..41ed7c5 100644
--- a/src/services/client.ts
+++ b/src/services/client.ts
@@ -4,13 +4,14 @@ import { CONFIG, isConfigured, getApiKeyValue, getBaseUrl, PLUGIN_VERSION } from
 import { log } from "./logger.js";
 import type { MemoryType } from "../types/index.js";
 import { mergeProfileResults, mergeSearchResponses } from "./resultMerge.js";
-import { boundedMemoryText, recallProvenance } from "./resultText.js";
+import { memoryText, recallProvenance } from "./resultText.js";
 
 type ProfileParamsWithFilters = ProfileParams & {
   filters?: ReturnType<typeof getScopeFilters>;
 };
 
 const TIMEOUT_MS = 30000;
+export const HOOK_API_TIMEOUT_MS = 3000;
 const SPACE_NAME_TIMEOUT_MS = 5000;
 const CODEX_SOURCE = "codex";
 
@@ -34,6 +35,33 @@ function withTimeout<T>(promise: Promise<T>, ms: number): Promise<T> {
   return Promise.race([promise, timeout]).finally(() => clearTimeout(id));
 }
 
+interface BoundedRequestOptions {
+  timeoutMs: number;
+}
+
+/**
+ * Hook requests need both SDK-level cancellation and a local backstop. Passing
+ * timeout/maxRetries/signal makes the SDK abort the real fetch rather than only
+ * abandoning its promise, while the race still protects us from SDK regressions.
+ */
+function withBoundedSdkRequest<T>(
+  request: (signal: AbortSignal) => Promise<T>,
+  timeoutMs: number,
+): Promise<T> {
+  const controller = new AbortController();
+  let timeout: ReturnType<typeof setTimeout>;
+  const backstop = new Promise<T>((_, reject) => {
+    timeout = setTimeout(() => {
+      controller.abort();
+      reject(new Error(`Timeout after ${timeoutMs}ms`));
+    }, timeoutMs);
+  });
+  const requestPromise = Promise.resolve().then(() => request(controller.signal));
+  return Promise.race([requestPromise, backstop]).finally(() => {
+    clearTimeout(timeout);
+  });
+}
+
 /** Canonical search result item used across the codebase. */
 export interface SearchResultItem {
   id?: string;
@@ -70,6 +98,7 @@ export interface ProfileWithSearchResult {
     results: Array<{
       id?: string;
       memory: string;
+      score?: number;
       similarity?: number;
       title?: string;
       filepath?: string;
@@ -134,17 +163,25 @@ export class SupermemoryClient {
     containerTag: string,
     query?: string,
     scope?: MemoryScope,
+    requestOptions?: BoundedRequestOptions,
   ): Promise<ProfileWithSearchResult> {
     log("getProfileWithSearch: start", { containerTag, hasQuery: !!query });
     try {
-      const result = await withTimeout(
-        this.getClient().profile({
-          containerTag,
-          q: query,
-          filters: scope ? getScopeFilters(scope) : undefined,
-        } satisfies ProfileParamsWithFilters as ProfileParams),
-        TIMEOUT_MS
-      );
+      const profileParams = {
+        containerTag,
+        q: query,
+        filters: scope ? getScopeFilters(scope) : undefined,
+      } satisfies ProfileParamsWithFilters as ProfileParams;
+      const result = requestOptions
+        ? await withBoundedSdkRequest(
+            (signal) => this.getClient().profile(profileParams, {
+              timeout: requestOptions.timeoutMs,
+              maxRetries: 0,
+              signal,
+            }),
+            requestOptions.timeoutMs,
+          )
+        : await withTimeout(this.getClient().profile(profileParams), TIMEOUT_MS);
 
       // Dedupe across static, dynamic, and search results
       const seen = new Set<string>();
@@ -166,7 +203,8 @@ export class SupermemoryClient {
             const provenance = recallProvenance(r);
             return {
               id: r.id,
-              memory: boundedMemoryText(r),
+              memory: memoryText(r),
+              score: r.score,
               similarity: r.similarity,
               title: provenance.title,
               filepath: provenance.filepath,
@@ -203,10 +241,13 @@ export class SupermemoryClient {
   async getProfileWithSearchMany(
     containerTags: string[],
     query?: string,
+    requestOptions?: BoundedRequestOptions,
   ): Promise<ProfileWithSearchResult> {
     const uniqueTags = [...new Set(containerTags.filter(Boolean))];
     const results = await Promise.all(
-      uniqueTags.map((containerTag) => this.getProfileWithSearch(containerTag, query)),
+      uniqueTags.map((containerTag) =>
+        this.getProfileWithSearch(containerTag, query, undefined, requestOptions)
+      ),
     );
     return mergeProfileResults(results, CONFIG.maxMemories);
   }
@@ -316,8 +357,12 @@ export class SupermemoryClient {
     }
   }
 
-  async getProfileMany(containerTags: string[], query?: string): Promise<ProfileWithSearchResult> {
-    return this.getProfileWithSearchMany(containerTags, query);
+  async getProfileMany(
+    containerTags: string[],
+    query?: string,
+    requestOptions?: BoundedRequestOptions,
+  ): Promise<ProfileWithSearchResult> {
+    return this.getProfileWithSearchMany(containerTags, query, requestOptions);
   }
 
   async getProfileScopedMany(
@@ -338,7 +383,7 @@ export class SupermemoryClient {
     content: string,
     containerTag: string,
     metadata?: { type?: MemoryType; tool?: string; [key: string]: unknown },
-    options?: { customId?: string; entityContext?: string }
+    options?: { customId?: string; entityContext?: string; timeoutMs?: number }
   ) {
     log("addMemory: start", {
       containerTag,
@@ -374,10 +419,16 @@ export class SupermemoryClient {
       if (options?.entityContext) {
         payload.entityContext = options.entityContext;
       }
-      const result = await withTimeout(
-        this.getClient().memories.add(payload),
-        TIMEOUT_MS
-      );
+      const result = options?.timeoutMs
+        ? await withBoundedSdkRequest(
+            (signal) => this.getClient().memories.add(payload, {
+              timeout: options.timeoutMs,
+              maxRetries: 0,
+              signal,
+            }),
+            options.timeoutMs,
+          )
+        : await withTimeout(this.getClient().memories.add(payload), TIMEOUT_MS);
       log("addMemory: success", { id: result.id });
       return { success: true as const, ...result };
     } catch (error) {
diff --git a/src/services/context.ts b/src/services/context.ts
index 97a24ab..9e2d2dc 100644
--- a/src/services/context.ts
+++ b/src/services/context.ts
@@ -1,6 +1,9 @@
 import type { ProfileWithSearchResult, SearchResponse } from "./client.js";
 import { factKey } from "./factCache.js";
-import { memoryText } from "./resultText.js";
+import { boundedMemoryText, memoryText } from "./resultText.js";
+
+const ATTRIBUTION_GUIDANCE =
+  "Items marked ◪ were recalled from supermemory. Use them when relevant; if you mention the source, say \"from supermemory\".";
 
 interface ProfileShape {
   static?: string[];
@@ -54,21 +57,29 @@ export function formatCombinedContext(
 
   // Collect profile items, filtering out already-seen facts
   if (result.success && result.profile) {
-    const profileKeys = new Set(currentFactKeys);
-    const items = [...(result.profile.static ?? []), ...(result.profile.dynamic ?? [])]
-      .map((s) => s.trim())
-      .filter((s) => {
-        if (!s) return false;
-        const key = factKey(s);
-        if (profileKeys.has(key)) return false;
-        profileKeys.add(key);
-        return true;
-      })
-      .slice(0, maxProfileItems);
+    const takeFresh = (facts: string[]): string[] => {
+      if (maxProfileItems <= 0) return [];
+      const items: string[] = [];
+      for (const fact of facts) {
+        const item = fact.trim();
+        if (!item) continue;
+        const key = factKey(item);
+        if (currentFactKeys.has(key)) continue;
+        currentFactKeys.add(key);
+        items.push(item);
+        if (items.length >= maxProfileItems) break;
+      }
+      return items;
+    };
+    // Match Claude's profile budget: maxProfileItems applies independently to
+    // persistent and recent facts so one section cannot starve the other.
+    const items = [
+      ...takeFresh(result.profile.static ?? []),
+      ...takeFresh(result.profile.dynamic ?? []),
+    ];
     if (items.length > 0) {
-      for (const item of items) currentFactKeys.add(factKey(item));
       parts.push(
-        `[Memory Profile]\n${items.map((s, i) => `${i + 1}. ${s}`).join("\n")}`
+        `[Memory Profile]\n${items.map((s, i) => `${i + 1}. ◪ ${s}`).join("\n")}`
       );
       newFacts.push(...items);
     }
@@ -97,7 +108,9 @@ export function formatCombinedContext(
           .filter((label): label is string => typeof label === "string" && label.trim().length > 0);
         allMemories.push({
           text,
-          display: labels.length > 0 ? `[${labels.join(" — ")}] ${text}` : text,
+          display: labels.length > 0
+            ? `◪ [${labels.join(" — ")}] ${boundedMemoryText(r)}`
+            : `◪ ${boundedMemoryText(r)}`,
         });
       }
     }
@@ -115,7 +128,10 @@ export function formatCombinedContext(
     }
   }
 
-  return { text: parts.join("\n\n"), newFacts };
+  return {
+    text: parts.length > 0 ? `${ATTRIBUTION_GUIDANCE}\n\n${parts.join("\n\n")}` : "",
+    newFacts,
+  };
 }
 
 /**
@@ -140,7 +156,7 @@ export function formatContextForPrompt(
   if (searchResult.success && searchResult.results && searchResult.results.length > 0) {
     const memories = searchResult.results
       .slice(0, maxMemories)
-      .map((r, i) => `${i + 1}. ${memoryText(r)}`)
+      .map((r, i) => `${i + 1}. ${boundedMemoryText(r)}`)
       .filter((m) => m.trim().length > 2)
       .join("\n");
     if (memories) {
diff --git a/src/services/hookRecallClient.ts b/src/services/hookRecallClient.ts
index a7ad494..d247b33 100644
--- a/src/services/hookRecallClient.ts
+++ b/src/services/hookRecallClient.ts
@@ -1,7 +1,7 @@
 import { CONFIG, getApiKeyValue, getBaseUrl } from "../config.js";
 import type { ProfileWithSearchResult, SearchResultItem } from "./client.js";
 import { mergeProfileResults } from "./resultMerge.js";
-import { boundedMemoryText, recallProvenance } from "./resultText.js";
+import { memoryText, recallProvenance } from "./resultText.js";
 
 export const HOOK_RECALL_TIMEOUT_MS = 3000;
 
@@ -35,7 +35,8 @@ function normalizeProfileResponse(raw: unknown): ProfileWithSearchResult {
       const provenance = recallProvenance(result);
       return {
         id: result.id,
-        memory: boundedMemoryText(result),
+        memory: memoryText(result),
+        score: result.score,
         similarity: result.similarity,
         title: provenance.title,
         filepath: provenance.filepath,
diff --git a/src/services/resultMerge.ts b/src/services/resultMerge.ts
index 5121e1f..c06a9fe 100644
--- a/src/services/resultMerge.ts
+++ b/src/services/resultMerge.ts
@@ -4,7 +4,6 @@ import type {
   SearchResultItem,
 } from "./client.js";
 import {
-  boundedMemoryText,
   memoryText,
   recallProvenance,
   RECALL_MAX_RESULTS,
@@ -32,7 +31,18 @@ function searchKey(result: SearchResultItem): string {
 }
 
 function score(result: SearchResultItem): number {
-  return result.similarity ?? result.score ?? -1;
+  if (Number.isFinite(result.similarity)) return result.similarity as number;
+  if (Number.isFinite(result.score)) return result.score as number;
+  return -1;
+}
+
+function passesRecallThreshold(result: SearchResultItem): boolean {
+  const relevance = Number.isFinite(result.similarity)
+    ? result.similarity as number
+    : Number.isFinite(result.score)
+      ? result.score as number
+      : null;
+  return relevance === null || relevance >= RECALL_MIN_SIMILARITY;
 }
 
 export function mergeSearchResponses(
@@ -95,7 +105,7 @@ export function mergeProfileResults(
       success: true,
       results: (response.searchResults?.results ?? []).filter(
         (result) =>
-          score(result) >= RECALL_MIN_SIMILARITY && memoryText(result).length > 0,
+          passesRecallThreshold(result) && memoryText(result).length > 0,
       ),
       total: response.searchResults?.total ?? 0,
       timing: response.searchResults?.timing,
@@ -113,7 +123,8 @@ export function mergeProfileResults(
               const provenance = recallProvenance(result);
               return {
                 id: result.id,
-                memory: boundedMemoryText(result),
+                memory: memoryText(result),
+                score: result.score,
                 similarity: result.similarity,
                 title: provenance.title,
                 filepath: provenance.filepath,
diff --git a/src/services/tracker.ts b/src/services/tracker.ts
index 4118589..d0bad30 100644
--- a/src/services/tracker.ts
+++ b/src/services/tracker.ts
@@ -1,8 +1,27 @@
-import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import {
+  closeSync,
+  existsSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  renameSync,
+  statSync,
+  unlinkSync,
+  writeFileSync,
+} from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
 
 const TRACKER_DIR = join(homedir(), ".codex-supermemory", "trackers");
+const LOCK_RETRY_MS = 5;
+const LOCK_ATTEMPTS = 100;
+const STALE_LOCK_MS = 60_000;
+const WAIT_ARRAY = new Int32Array(new SharedArrayBuffer(4));
+const CAPTURE_LOCK_RETRY_MS = 20;
+const CAPTURE_LOCK_WAIT_MS = 25_000;
+// Background capture hooks are capped at 30s by Codex. Keep the absolute stale
+// age beyond that lifetime so a healthy hook cannot have its lock stolen.
+const CAPTURE_LOCK_STALE_MS = 35_000;
 
 function ensureTrackerDir(): void {
   if (!existsSync(TRACKER_DIR)) {
@@ -24,5 +43,111 @@ export function getLastCapturedIndex(sessionId: string): number | null {
 export function setLastCapturedIndex(sessionId: string, index: number): void {
   ensureTrackerDir();
   const trackerFile = join(TRACKER_DIR, `${sessionId}.txt`);
-  writeFileSync(trackerFile, String(index));
+  const lockFile = `${trackerFile}.lock`;
+
+  for (let attempt = 0; attempt < LOCK_ATTEMPTS; attempt++) {
+    let lockFd: number | null = null;
+    try {
+      lockFd = openSync(lockFile, "wx");
+      const current = getLastCapturedIndex(sessionId);
+      if (current !== null && current >= index) return;
+
+      const tempFile = `${trackerFile}.${process.pid}.${Date.now()}.tmp`;
+      writeFileSync(tempFile, String(index));
+      renameSync(tempFile, trackerFile);
+      return;
+    } catch (error) {
+      const code = (error as NodeJS.ErrnoException).code;
+      if (code !== "EEXIST") throw error;
+
+      // A crashed background hook must not leave the tracker locked forever.
+      try {
+        if (Date.now() - statSync(lockFile).mtimeMs > STALE_LOCK_MS) {
+          unlinkSync(lockFile);
+          continue;
+        }
+      } catch {}
+
+      Atomics.wait(WAIT_ARRAY, 0, 0, LOCK_RETRY_MS);
+    } finally {
+      if (lockFd !== null) {
+        closeSync(lockFd);
+        try { unlinkSync(lockFile); } catch {}
+      }
+    }
+  }
+  // Another process still owns the lock. Leaving the existing cursor intact is
+  // safer than risking a backwards write; a later capture will advance it.
+}
+
+function delay(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+function getCaptureLockOwnerState(lockFile: string): "alive" | "dead" | "unknown" {
+  try {
+    const [pidText] = readFileSync(lockFile, "utf-8").split(":", 1);
+    const pid = Number(pidText);
+    if (!Number.isSafeInteger(pid) || pid <= 0) return "unknown";
+
+    try {
+      process.kill(pid, 0);
+      return "alive";
+    } catch (error) {
+      return (error as NodeJS.ErrnoException).code === "ESRCH" ? "dead" : "alive";
+    }
+  } catch {
+    return "unknown";
+  }
+}
+
+/**
+ * Serialize the complete read/upload/commit capture transaction for a session.
+ * Background prompt and Stop hooks can overlap, so the later hook waits, then
+ * re-reads the cursor after the earlier upload has committed.
+ */
+export async function withSessionCaptureLock(
+  sessionId: string,
+  action: () => Promise<void>,
+  waitMs = CAPTURE_LOCK_WAIT_MS,
+): Promise<boolean> {
+  ensureTrackerDir();
+  const lockFile = join(TRACKER_DIR, `${sessionId}.capture.lock`);
+  const deadline = Date.now() + waitMs;
+
+  while (Date.now() <= deadline) {
+    let lockFd: number | null = null;
+    const owner = `${process.pid}:${Date.now()}:${Math.random()}`;
+    try {
+      lockFd = openSync(lockFile, "wx");
+      writeFileSync(lockFd, owner);
+      await action();
+      return true;
+    } catch (error) {
+      const code = (error as NodeJS.ErrnoException).code;
+      if (lockFd !== null || code !== "EEXIST") throw error;
+
+      try {
+        const ownerState = getCaptureLockOwnerState(lockFile);
+        const lockAge = Date.now() - statSync(lockFile).mtimeMs;
+        // PID reuse must not make a lock immortal. The age ceiling remains
+        // beyond the owning hook's full lifetime so healthy locks are retained.
+        if (ownerState === "dead" || lockAge > CAPTURE_LOCK_STALE_MS) {
+          unlinkSync(lockFile);
+          continue;
+        }
+      } catch {}
+
+      await delay(CAPTURE_LOCK_RETRY_MS);
+    } finally {
+      if (lockFd !== null) {
+        closeSync(lockFd);
+        try {
+          if (readFileSync(lockFile, "utf-8") === owner) unlinkSync(lockFile);
+        } catch {}
+      }
+    }
+  }
+
+  return false;
 }
diff --git a/src/skills/login.ts b/src/skills/login.ts
index e64385b..13a36e2 100644
--- a/src/skills/login.ts
+++ b/src/skills/login.ts
@@ -18,7 +18,7 @@ async function main(): Promise<void> {
     process.exit(0);
   }
 
-  // Clear the auth-attempted marker so the recall hook will try browser auth again.
+  // Clear the marker so a later SessionStart can offer browser auth again.
   try {
     if (existsSync(AUTH_ATTEMPTED_FILE)) unlinkSync(AUTH_ATTEMPTED_FILE);
   } catch {}
diff --git a/test/unit.mjs b/test/unit.mjs
index 7e9a81c..a052e73 100644
--- a/test/unit.mjs
+++ b/test/unit.mjs
@@ -245,7 +245,7 @@ describe("cross-container result merging", () => {
     assert.deepEqual(JSON.parse(result.stdout), ["best", "new"]);
   });
 
-  test("normalizes and bounds high-quality profile recall hits", () => {
+  test("normalizes high-quality profile recall hits", () => {
     const script = `
       import { mergeProfileResults } from ${JSON.stringify(mergeModule)};
       const long = "x".repeat(360);
@@ -276,7 +276,158 @@ describe("cross-container result merging", () => {
     ]);
     assert.equal(results[0].title, "Decision");
     assert.equal(results[0].filepath, "src/a.ts");
-    assert.ok(results.every((item) => item.memory.length <= 300));
+  });
+
+  test("keeps full recall identities and accepts score-only hits", () => {
+    const script = `
+      import { mergeProfileResults } from ${JSON.stringify(mergeModule)};
+      const prefix = "x".repeat(300);
+      const first = prefix + " first ending";
+      const second = prefix + " second ending";
+      const merged = mergeProfileResults([{
+        success: true,
+        profile: { static: [], dynamic: [] },
+        searchResults: { results: [
+          { memory: "score only", score: 0.95 },
+          { memory: first, similarity: 0.9 },
+          { memory: second, similarity: 0.8 },
+          { memory: "missing similarity" },
+          { memory: "weak score only", score: 0.2 },
+          { memory: "too weak", similarity: 0.54 }
+        ], total: 6 }
+      }], 5);
+      console.log(JSON.stringify(merged.searchResults.results));
+    `;
+    const result = spawnSync("node", ["--input-type=module", "-e", script], {
+      encoding: "utf-8",
+    });
+    assert.equal(result.status, 0, result.stderr);
+    const results = JSON.parse(result.stdout);
+    assert.deepEqual(results.map((item) => item.memory.slice(-13)), [
+      "score only",
+      " first ending",
+      "second ending",
+      "ng similarity",
+    ]);
+    assert.equal(results[0].score, 0.95);
+    assert.ok(results[1].memory.length > 300);
+    assert.notEqual(results[1].memory, results[2].memory);
+    assert.ok(!results.some((item) => item.memory === "weak score only"));
+  });
+});
+
+describe("capture tracker", () => {
+  const trackerModule = new URL("../dist/services/tracker.js", import.meta.url).href;
+
+  test("serializes overlapping capture transactions and keeps the cursor monotonic", (t) => {
+    const homeDir = makeTmpDir();
+    t.after(() => rmSync(homeDir, { recursive: true, force: true }));
+    const script = `
+      import { mkdirSync, utimesSync, writeFileSync } from "node:fs";
+      import { homedir } from "node:os";
+      import { join } from "node:path";
+      import {
+        getLastCapturedIndex,
+        setLastCapturedIndex,
+        withSessionCaptureLock,
+      } from ${JSON.stringify(trackerModule)};
+      const order = [];
+      const first = withSessionCaptureLock("session", async () => {
+        order.push("first-start");
+        await new Promise((resolve) => setTimeout(resolve, 40));
+        setLastCapturedIndex("session", 20);
+        order.push("first-end");
+      });
+      await new Promise((resolve) => setTimeout(resolve, 5));
+      const second = withSessionCaptureLock("session", async () => {
+        order.push("second");
+        setLastCapturedIndex("session", 10);
+      });
+      const acquired = await Promise.all([first, second]);
+
+      const trackerDir = join(homedir(), ".codex-supermemory", "trackers");
+      mkdirSync(trackerDir, { recursive: true });
+      const staleLock = join(trackerDir, "stale.capture.lock");
+      writeFileSync(staleLock, process.pid + ":0:reused-pid");
+      const staleTime = new Date(Date.now() - 40_000);
+      utimesSync(staleLock, staleTime, staleTime);
+      const reclaimed = await withSessionCaptureLock("stale", async () => {}, 250);
+
+      console.log(JSON.stringify({ acquired, order, index: getLastCapturedIndex("session"), reclaimed }));
+    `;
+    const result = spawnSync("node", ["--input-type=module", "-e", script], {
+      env: { ...process.env, HOME: homeDir, USERPROFILE: homeDir },
+      encoding: "utf-8",
+    });
+    assert.equal(result.status, 0, result.stderr);
+    assert.deepEqual(JSON.parse(result.stdout), {
+      acquired: [true, true],
+      order: ["first-start", "first-end", "second"],
+      index: 20,
+      reclaimed: true,
+    });
+  });
+});
+
+describe("hook SDK request bounds", () => {
+  const clientModule = new URL("../dist/services/client.js", import.meta.url).href;
+
+  test("aborts the SDK fetch without retries", () => {
+    const script = `
+      import { SupermemoryClient } from ${JSON.stringify(clientModule)};
+      let calls = 0;
+      let aborted = false;
+      globalThis.fetch = (_url, { signal }) => new Promise((_resolve, reject) => {
+        calls += 1;
+        signal.addEventListener("abort", () => {
+          aborted = true;
+          reject(new Error("aborted"));
+        }, { once: true });
+      });
+      const started = Date.now();
+      const result = await new SupermemoryClient().getProfileMany(
+        ["repo_test"], undefined, { timeoutMs: 20 },
+      );
+      console.log(JSON.stringify({ success: result.success, calls, aborted, elapsed: Date.now() - started }));
+    `;
+    const result = spawnSync("node", ["--input-type=module", "-e", script], {
+      env: { ...process.env, SUPERMEMORY_CODEX_API_KEY: "sm_test" },
+      encoding: "utf-8",
+      timeout: 1_000,
+    });
+    assert.equal(result.status, 0, result.stderr);
+    const output = JSON.parse(result.stdout);
+    assert.equal(output.success, false);
+    assert.equal(output.calls, 1);
+    assert.equal(output.aborted, true);
+    assert.ok(output.elapsed < 500, `bounded request took ${output.elapsed}ms`);
+  });
+});
+
+describe("combined recall formatting", () => {
+  const contextModule = new URL("../dist/services/context.js", import.meta.url).href;
+
+  test("budgets both profile sections and truncates only display text", () => {
+    const script = `
+      import { formatCombinedContext } from ${JSON.stringify(contextModule)};
+      const long = "z".repeat(320) + " durable ending";
+      const result = formatCombinedContext({
+        success: true,
+        profile: { static: ["s1", "s2", "s3"], dynamic: ["d1", "d2", "d3"] },
+        searchResults: { results: [{ memory: long, similarity: 0.9 }], total: 1 },
+      }, 5, 2);
+      console.log(JSON.stringify(result));
+    `;
+    const result = spawnSync("node", ["--input-type=module", "-e", script], {
+      encoding: "utf-8",
+    });
+    assert.equal(result.status, 0, result.stderr);
+    const output = JSON.parse(result.stdout);
+    assert.match(output.text, /1\. ◪ s1/);
+    assert.match(output.text, /3\. ◪ d1/);
+    assert.doesNotMatch(output.text, /s3|d3|durable ending/);
+    assert.match(output.text, /from supermemory/);
+    assert.equal(output.newFacts.at(-1).endsWith("durable ending"), true);
   });
 });
 
@@ -436,12 +587,20 @@ describe("stripPrivateContent", () => {
 });
 
 describe("browser auth opener", () => {
-  test("login bundle uses Windows-safe URL opener", () => {
+  test("login keeps a long auth window while SessionStart uses a bounded one", () => {
     const content = readFileSync(new URL("../dist/skills/login.js", import.meta.url), "utf-8");
     assert.ok(content.includes("Refusing to open non-http URL"));
     assert.ok(content.includes("rundll32.exe"));
     assert.ok(content.includes("url.dll,FileProtocolHandler"));
     assert.ok(!content.includes("explorer.exe"));
+
+    const authSource = readFileSync(new URL("../src/services/auth.ts", import.meta.url), "utf-8");
+    const sessionStartSource = readFileSync(new URL("../src/hooks/session-start.ts", import.meta.url), "utf-8");
+    const loginSource = readFileSync(new URL("../src/skills/login.ts", import.meta.url), "utf-8");
+    assert.ok(authSource.includes("5 * 60_000"), "explicit login keeps its long default");
+    assert.ok(authSource.includes("startAuthFlow(timeoutMs = AUTH_TIMEOUT)"));
+    assert.ok(sessionStartSource.includes("startAuthFlow(getSessionStartAuthTimeoutMs())"));
+    assert.ok(loginSource.includes("await startAuthFlow();"));
   });
 });
 
@@ -487,8 +646,8 @@ describe("hooks.json format", () => {
 
     const hooksJson = {
       hooks: {
-        UserPromptSubmit: [{ hooks: [{ type: "command", command: `node ${recallScript}`, timeout: 90 }] }],
-        Stop: [{ hooks: [{ type: "command", command: `node ${flushScript}`, timeout: 60 }] }],
+        UserPromptSubmit: [{ hooks: [{ type: "command", command: `node ${recallScript}`, timeout: 5 }] }],
+        Stop: [{ hooks: [{ type: "command", command: `node ${flushScript}`, timeout: 30, async: true }] }],
       },
     };
     const json = JSON.stringify(hooksJson, null, 2);
@@ -497,9 +656,10 @@ describe("hooks.json format", () => {
     assert.ok(parsed.hooks, "must have top-level hooks key");
     assert.ok(!parsed.UserPromptSubmit, "must NOT have UserPromptSubmit at top level");
     assert.ok(Array.isArray(parsed.hooks.UserPromptSubmit), "hooks.UserPromptSubmit must be an array");
-    assert.equal(parsed.hooks.UserPromptSubmit[0].hooks[0].timeout, 90);
+    assert.equal(parsed.hooks.UserPromptSubmit[0].hooks[0].timeout, 5);
     assert.ok(Array.isArray(parsed.hooks.Stop), "hooks.Stop must be an array");
     assert.equal(parsed.hooks.Stop[0].hooks[0].type, "command");
+    assert.equal(parsed.hooks.Stop[0].hooks[0].async, true);
   });
 
   test("dedup: adding same command twice results in exactly one entry", () => {
@@ -604,6 +764,44 @@ describe("integration: install/uninstall", () => {
     assert.equal(config.recallMode, "direct");
   });
 
+  test("install upgrades capture hooks to background handlers", (t) => {
+    const { tmpDir, codexDir } = setupCodexHome(t);
+    const hooksPath = join(codexDir, "hooks.json");
+    const flushCmd = `node ${join(codexDir, "supermemory", "flush.js")}`;
+    writeFileSync(hooksPath, JSON.stringify({
+      hooks: {
+        Stop: [{ hooks: [{ type: "command", command: flushCmd, timeout: 60 }] }],
+      },
+    }));
+
+    const result = runCli(cliBin, "install", tmpDir);
+    assert.equal(result.status, 0, result.stderr);
+
+    const hooks = JSON.parse(readFileSync(hooksPath, "utf-8")).hooks;
+    const stop = hooks.Stop.flatMap((group) => group.hooks)
+      .find((hook) => hook.command === flushCmd);
+    const turnCaptureCmd = `node ${join(codexDir, "supermemory", "capture-turn.js")}`;
+    const turnCapture = hooks.UserPromptSubmit.flatMap((group) => group.hooks)
+      .find((hook) => hook.command === turnCaptureCmd);
+    const recall = hooks.UserPromptSubmit.flatMap((group) => group.hooks)
+      .find((hook) => hook.command.endsWith("/recall.js"));
+    const sessionStart = hooks.SessionStart.flatMap((group) => group.hooks)
+      .find((hook) => hook.command.endsWith("/session-start.js"));
+
+    assert.deepEqual(
+      { async: stop.async, timeout: stop.timeout },
+      { async: true, timeout: 30 },
+    );
+    assert.deepEqual(
+      { async: turnCapture.async, timeout: turnCapture.timeout },
+      { async: true, timeout: 30 },
+    );
+    assert.equal(recall.async, undefined);
+    assert.equal(recall.timeout, 5);
+    assert.equal(sessionStart.async, undefined);
+    assert.equal(sessionStart.timeout, 30);
+  });
+
   test("uninstall removes skill directories", (t) => {
     const { tmpDir, codexDir } = setupCodexHome(t);
 
@@ -728,28 +926,32 @@ describe("integration: install/uninstall", () => {
 describe("recall hook output envelope", () => {
   const recallBin = fileURLToPath(new URL("../dist/hooks/recall.js", import.meta.url));
 
-  // Helper: run recall hook with an isolated HOME. Pre-create the auth marker
-  // so the unit test exercises the hook envelope without launching a browser.
+  // Recall must return login guidance without starting browser authentication.
   function runRecallUnconfigured(t, input) {
     const tmpDir = makeTmpDir();
-    const supermemoryDir = join(tmpDir, ".codex", "supermemory");
-    mkdirSync(supermemoryDir, { recursive: true });
-    writeFileSync(join(supermemoryDir, ".auth-attempted"), new Date().toISOString());
     t.after(() => rmSync(tmpDir, { recursive: true, force: true }));
-    return spawnSync("node", [recallBin], {
+    const result = spawnSync("node", [recallBin], {
       input,
       env: { ...process.env, HOME: tmpDir, USERPROFILE: tmpDir, SUPERMEMORY_CODEX_API_KEY: "" },
       encoding: "utf-8",
       timeout: 5_000,
     });
+    return { result, tmpDir };
   }
 
   test("outputs hookSpecificOutput envelope when not configured", (t) => {
-    const result = runRecallUnconfigured(t, JSON.stringify({ session_id: "s1", prompt: "hello" }));
+    const { result, tmpDir } = runRecallUnconfigured(
+      t,
+      JSON.stringify({ session_id: "s1", prompt: "hello" }),
+    );
     const parsed = JSON.parse(result.stdout);
     assert.ok("hookSpecificOutput" in parsed, "must have hookSpecificOutput key");
     assert.equal(parsed.hookSpecificOutput.hookEventName, "UserPromptSubmit");
     assert.equal(typeof parsed.hookSpecificOutput.additionalContext, "string");
+    assert.equal(
+      existsSync(join(tmpDir, ".codex", "supermemory", ".auth-attempted")),
+      false,
+    );
   });
 
   test("exits silently after explicit logout marker", (t) => {
@@ -791,12 +993,7 @@ describe("recall hook output envelope", () => {
   });
 
   test("never outputs bare additionalContext at top level (old wrong shape)", (t) => {
-    // When .auth-attempted already exists (second invocation), the hook exits quickly.
-    // Create it ahead of time so this test doesn't incur the 25s auth timeout.
     const tmpDir = makeTmpDir();
-    const supermemoryDir = join(tmpDir, ".codex", "supermemory");
-    mkdirSync(supermemoryDir, { recursive: true });
-    writeFileSync(join(supermemoryDir, ".auth-attempted"), new Date().toISOString());
     t.after(() => rmSync(tmpDir, { recursive: true, force: true }));
 
     const result = spawnSync("node", [recallBin], {
@@ -809,11 +1006,7 @@ describe("recall hook output envelope", () => {
   });
 
   test("exits with code 0", (t) => {
-    // Pre-create .auth-attempted so the hook returns quickly without the 25s timeout.
     const tmpDir = makeTmpDir();
-    const supermemoryDir = join(tmpDir, ".codex", "supermemory");
-    mkdirSync(supermemoryDir, { recursive: true });
-    writeFileSync(join(supermemoryDir, ".auth-attempted"), new Date().toISOString());
     t.after(() => rmSync(tmpDir, { recursive: true, force: true }));
 
     const result = spawnSync("node", [recallBin], {