refactor: minor audit-driven cleanups

- I-1 already landed in the LRU commit (singleSession resolveProjectIdentity
  threaded through transform.ts).

- I-2: Reuse sessionMetaEarly read in system-prompt-hash.ts. The handler
  was calling getOrCreateSessionMeta twice per system-prompt transform —
  once early for isSubagent detection, again later for hash comparison.
  Nothing between the two reads mutates session_meta for that session, so
  the second read is redundant. Now short-circuits to the early read.

- M-2: Broaden hasSuccessfulTask's post-task exclusion set in dreamer/
  runner.ts. The filter only excluded "smart-notes" from the success
  gate, but `user memories` and `key files` post-task phases also run
  unconditionally after the main task loop. A project whose configured
  tasks (consolidate/verify/archive-stale/...) all failed but whose
  post-task phases succeeded would have last_dream_at advanced, silently
  suppressing re-scheduling of the failed tasks. Now all three post-task
  phase names are excluded from the success gate.

Addresses audit findings I-2 and M-2.

Author: ualtinok

packages/plugin/src/features/magic-context/dreamer/runner.ts

@@ -730,9 +730,15 @@ export async function runDream(args: {
     });
     // Only update dream timestamps when at least one task succeeded — failed runs
     // should not block re-scheduling for the project.
-    // Only count configured dream tasks for success — smart-note evaluation is supplementary
-    // and should not mask failures of real tasks like consolidate/verify/archive-stale
-    const hasSuccessfulTask = result.tasks.some((t) => !t.error && t.name !== "smart-notes");
+    //
+    // Only count configured dream tasks (consolidate / verify / archive-stale /
+    // improve / maintain-docs) for success. Post-task phases (smart-notes,
+    // user memories, key files) run unconditionally after the main task loop
+    // and must NOT mask failures of the configured tasks — otherwise a
+    // successful key-file evaluation would suppress re-scheduling a project
+    // whose consolidate/verify/archive tasks all failed.
+    const POST_TASK_NAMES = new Set(["smart-notes", "user memories", "key files"]);
+    const hasSuccessfulTask = result.tasks.some((t) => !t.error && !POST_TASK_NAMES.has(t.name));
     if (hasSuccessfulTask) {
         setDreamState(args.db, `last_dream_at:${args.projectIdentity}`, String(result.finishedAt));
         setDreamState(args.db, "last_dream_at", String(result.finishedAt));

packages/plugin/src/hooks/magic-context/system-prompt-hash.ts

@@ -359,14 +359,16 @@ export function createSystemPromptHashHandler(deps: {
         // causing precision loss on read-back and infinite hash-change flushes.
         const currentHash = new Bun.CryptoHasher("md5").update(systemContent).digest("hex");
 
-        let sessionMeta: import("../../features/magic-context/types").SessionMeta | undefined;
-        try {
-            sessionMeta = getOrCreateSessionMeta(deps.db, sessionId);
-        } catch (error) {
-            sessionLog(sessionId, "system-prompt-hash DB update failed:", error);
+        // Reuse sessionMetaEarly from Step 1 — no code path between that read
+        // and here mutates session_meta for this session, so a second DB read
+        // would return identical data. If Step 1's read failed (sessionMetaEarly
+        // is undefined), bail rather than re-attempting: we already logged the
+        // error and can't make an informed hash-change decision without the
+        // previous hash.
+        if (!sessionMetaEarly) {
             return;
         }
-
+        const sessionMeta = sessionMetaEarly;
         const previousHash = sessionMeta.systemPromptHash;
         if (previousHash !== "" && previousHash !== "0" && previousHash !== currentHash) {
             sessionLog(