@oharness/engine 0.5.0 → 0.6.0

package/dist/runtime-plugins/builtin/memory.js

@@ -1,58 +1,126 @@
 import path from "node:path";
+import { existsSync } from "node:fs";
 import { createHash } from "node:crypto";
-import { MemoryStore, memoryNote, noteHash, validateNote, validMemoryId } from "../../agent/memory.js";
+import { AUTO_KINDS, reviewNotes } from "../../agent/memory-review.js";
+import { CONSOLIDATE_PROMPT, draftByHand, mergePrompt, parseMergeReply, planMerge } from "../../agent/memory-consolidate.js";
+import { rm } from "node:fs/promises";
+import { MemoryStore, loadScoped, memoryIndexSection, memoryNote, noteHash, recallFromStores, storeFor, validateNote, validMemoryId } from "../../agent/memory.js";
+import { DEFAULT_MEMORY_POLICY, MEMORY_SAFETY, consolidationEnabled, isMemoryType } from "../../agent/memory-limits.js";
+import { rankNotes } from "../../agent/memory-recall.js";
+import { findSecrets } from "../../agent/memory-redact.js";
+import { MemoryUsage } from "../../agent/memory-usage.js";
+import { backupNote, listBackups, restoreBackup } from "../../agent/memory-backup.js";
+import { mergeNotes } from "../../agent/memory-merge.js";
+import { MemoryError, memoryFailure } from "../../agent/memory-errors.js";
+import { userPath } from "../../paths.js";
+import { shortId } from "../../util/id.js";
+import { resolvePlaceholders } from "../../agent/memory-extract.js";
 import { createMemoryTools } from "../../tools/builtin/memory.js";
 import { readPluginFile, readUserFile, updateRuntimePluginConfig, writeUserFile } from "../../config-files.js";
 import { projectId } from "../../storage/project.js";
 import { resolveSyncUrl } from "../../sync/settings.js";
+import { MemorySyncCoordinator } from "./memory-coordinator.js";
 const digest = (x) => createHash("sha256").update(x).digest("hex");
 const object = (x) => !!x && typeof x === "object" && !Array.isArray(x);
-/** One project's local notes and explicit per-device/account sync consent. */
+const HASH = /^[a-f0-9]{64}$/;
+/** A refusal from the sync service: what to tell a person, and the server's own code. */
+class SyncRequestError extends MemoryError {
+    status;
+    serverCode;
+    retryAfterMs;
+    constructor(reason, status, serverCode, retryAfterMs) {
+        super(reason.code, reason.params);
+        this.status = status;
+        if (serverCode)
+            this.serverCode = serverCode;
+        if (retryAfterMs !== undefined)
+            this.retryAfterMs = retryAfterMs;
+    }
+}
+/** Retry-After as seconds or an HTTP date, bounded to something a background loop should wait. */
+function retryAfterMs(value) {
+    const clamp = (ms) => Math.min(10 * 60_000, Math.max(1_000, ms));
+    if (value) {
+        const seconds = Number(value);
+        if (Number.isFinite(seconds) && seconds >= 0)
+            return clamp(seconds * 1000);
+        const date = Date.parse(value);
+        if (!Number.isNaN(date))
+            return clamp(date - Date.now());
+    }
+    return 60_000;
+}
+function planLimitError(quota) {
+    return quota?.maxNotes && quota.maxNoteBytes
+        ? new MemoryError("planLimit", { notes: quota.maxNotes, kb: Math.max(1, Math.round(quota.maxNoteBytes / 1024)) })
+        : new MemoryError("planLimitPlain");
+}
+/** One scope's local notes and explicit per-device/account sync consent. */
 export class MemoryService {
     store;
+    scope;
     options;
     target;
+    coordinator;
+    syncTarget;
+    detach;
     controller;
-    timer;
     running;
     closed = false;
     disabling = false;
     conflicts = [];
     error;
     lastSync;
+    lastPull;
+    lastChanged = false;
     binding;
     settingsRevision = 0;
     retryAt = 0;
     snapshotCache;
+    quota;
+    /** The server predates `have`, so every snapshot carries every note. */
+    legacyServer = false;
     constructor(options) {
         this.options = options;
-        this.store = new MemoryStore(options.directory);
+        this.scope = options.scope ?? "project";
+        const policy = options.policy ?? DEFAULT_MEMORY_POLICY;
+        this.store = new MemoryStore(options.directory, {
+            maxNotes: policy.maxNotes, maxNoteBytes: policy.maxNoteBytes, scope: this.scope,
+            ...(options.onWarning ? { onWarning: options.onWarning } : {}),
+        });
         this.target = digest(path.resolve(options.directory));
+        this.coordinator = options.coordinator ?? MemorySyncCoordinator.shared;
+        this.syncTarget = {
+            scope: this.scope,
+            eligible: () => this.eligible(),
+            syncOnce: async () => { await this.sync(); return { changed: this.lastChanged }; },
+        };
     }
+    get isClosed() { return this.closed; }
     consent() {
         const plugin = readPluginFile()?.runtimePlugins?.find((p) => p.id === "memory");
         if (plugin?.enabled === false)
             return { userId: "", origin: "", enabled: false };
         const config = plugin?.config;
         if (config !== undefined && (!object(config) || config.syncTargets !== undefined && !object(config.syncTargets)))
-            throw new Error("Memory 同步配置无效；已停止同步。");
+            throw new MemoryError("configInvalid");
         const value = object(config) && object(config.syncTargets) ? config.syncTargets[this.target] : undefined;
         if (value === undefined)
             return undefined;
         if (!object(value) || typeof value.enabled !== "boolean" || typeof value.userId !== "string" || typeof value.origin !== "string")
-            throw new Error("Memory 同步配置无效；已停止同步。");
+            throw new MemoryError("configInvalid");
         return value;
     }
     stateFile(identity) { return "memory-sync/" + digest(identity.origin + ":" + identity.userId + ":" + this.target) + ".json"; }
     async allowed() {
         if (this.closed || this.disabling)
-            throw new Error("Memory 同步已停止。");
+            throw new MemoryError("stopped");
         const consent = this.consent();
         if (consent?.enabled === false)
-            throw new Error("此项目的云同步已手动关闭。");
+            throw new MemoryError("disabledHere");
         const identity = await this.options.identity();
         if (!identity || consent && (identity.userId !== consent.userId || identity.origin !== consent.origin))
-            throw new Error("登录账号或 Cloud 地址已改变，Memory 同步已暂停。");
+            throw new MemoryError("accountChanged");
         if (!consent) {
             await updateRuntimePluginConfig("memory", (config) => {
                 const targets = object(config.syncTargets) ? config.syncTargets : {};
@@ -63,39 +131,71 @@ export class MemoryService {
             });
             const pinned = this.consent();
             if (!pinned?.enabled || pinned.userId !== identity.userId || pinned.origin !== identity.origin)
-                throw new Error("Memory 同步设置已改变。");
+                throw new MemoryError("settingsChanged");
         }
         if (this.closed || this.disabling || this.consent()?.enabled === false)
-            throw new Error("Memory 同步已停止。");
+            throw new MemoryError("stopped");
         return identity;
     }
+    async eligible() {
+        // Conflicts do not stop background sync: they hold back only their own notes.
+        if (this.closed || this.disabling || Date.now() < this.retryAt)
+            return false;
+        try {
+            if (this.consent()?.enabled === false)
+                return false;
+        }
+        catch {
+            return false;
+        }
+        return !!(await this.options.identity());
+    }
+    /**
+     * Hand this directory to the coordinator. It is checked straight away, then
+     * as the coordinator decides; a local write brings the next check forward.
+     * Calling it again does nothing.
+     */
     start() {
-        const tick = async () => {
-            if (this.closed || this.consent()?.enabled === false || this.conflicts.length || Date.now() < this.retryAt)
-                return;
-            const identity = await this.options.identity();
-            if (identity)
-                await this.sync().catch(() => { });
-        };
-        this.timer = setInterval(() => { void tick().catch(() => { }); }, this.options.pollMs ?? 15000);
-        this.timer.unref();
-        void tick().catch(() => { });
+        if (this.detach || this.closed)
+            return;
+        const pollMs = Math.max(1, this.options.pollMs ?? 60_000);
+        const unregister = this.coordinator.add(this.syncTarget, {
+            baseMs: pollMs,
+            maxMs: Math.max(pollMs, this.options.maxPollMs ?? pollMs * 5),
+            debounceMs: this.options.debounceMs ?? Math.min(3_000, pollMs),
+            // A user's own notes matter in every project, so they are always kept current.
+            activeWindowMs: this.scope === "user" ? Infinity : this.options.activeWindowMs ?? 30 * 60_000,
+        });
+        const unsubscribe = this.store.onChange((change) => {
+            if (change.origin === "local")
+                this.coordinator.touch(this.syncTarget, "local-change");
+        });
+        this.detach = () => { unregister(); unsubscribe(); };
+    }
+    /** These notes are in use: check the cloud soon, if it has been a while. */
+    activity() {
+        if (this.detach)
+            this.coordinator.touch(this.syncTarget, "activity");
     }
     async status() {
         const identity = await this.options.identity(), consent = this.consent();
         const matching = !!identity && (!consent?.userId || identity.userId === consent.userId && identity.origin === consent.origin);
         const persisted = identity && matching ? readUserFile(this.stateFile(identity)) : undefined;
-        let entries = [], localError;
+        let entries = [], omitted = 0, localFailure;
         try {
-            entries = (await this.store.load()).map((entry) => ({ ...memoryNote(entry), hash: noteHash(entry) }));
+            const snapshot = await this.store.snapshot();
+            entries = snapshot.entries.map((entry) => ({ ...memoryNote(entry), hash: noteHash(entry) }));
+            omitted = snapshot.omitted;
         }
         catch {
-            localError = "本地记忆文件无法读取或格式无效；请检查记忆目录。同步已暂停，原文件未改动。";
+            localFailure = memoryFailure(new MemoryError("localUnreadable"));
         }
-        return { signedIn: !!identity, enabled: consent?.enabled !== false, ready: matching && consent?.enabled !== false,
-            syncing: !!this.running, lastSync: persisted?.lastSync ?? this.lastSync, error: localError ?? this.error,
+        const lastPull = this.lastPull ?? persisted?.lastPull;
+        return { scope: this.scope, signedIn: !!identity, enabled: consent?.enabled !== false, ready: matching && consent?.enabled !== false,
+            syncing: !!this.running, lastSync: persisted?.lastSync ?? this.lastSync, error: (localFailure ?? this.error)?.message, failure: localFailure ?? this.error,
             accountChanged: !!identity && !!consent?.userId && !matching, conflicts: this.conflicts,
-            location: this.store.location, entries };
+            location: this.store.location, entries, omitted, ...(this.quota ? { quota: this.quota } : {}),
+            ...(lastPull ? { lastPull } : {}) };
     }
     async enable(enabled) {
         const revision = ++this.settingsRevision;
@@ -117,18 +217,18 @@ export class MemoryService {
         }
         const identity = await this.options.identity();
         if (!identity)
-            throw new Error("请先登录 OHarness。");
+            throw new MemoryError("signInFirst");
         const previous = this.consent();
         if (previous?.userId && (previous.userId !== identity.userId || previous.origin !== identity.origin)) {
-            throw new Error("此目录已绑定另一账号或 Cloud；请使用独立的本地记忆目录，避免跨账号上传。");
+            throw new MemoryError("boundElsewhere");
         }
         // Explicit opt-in verifies identity remotely, but uploads no content yet.
         const verified = await this.request("identity", {}, identity, new AbortController().signal, false);
         if (verified.principal !== identity.userId)
-            throw new Error("账号校验失败。");
+            throw new MemoryError("verifyFailed");
         await updateRuntimePluginConfig("memory", (config) => {
             if (this.closed || revision !== this.settingsRevision)
-                throw new Error("Memory 同步设置已改变。");
+                throw new MemoryError("settingsChanged");
             return { ...config, syncTargets: {
                     ...(object(config.syncTargets) ? config.syncTargets : {}), [this.target]: { ...identity, enabled: true },
                 } };
@@ -136,130 +236,521 @@ export class MemoryService {
         this.disabling = false;
         this.error = undefined;
         this.retryAt = 0;
+        this.activity();
     }
     sync() {
         if (this.running)
             return this.running;
-        const job = this.perform().catch((error) => {
-            this.error = error instanceof Error ? error.message : "同步失败";
-            this.retryAt = Date.now() + 60000;
+        const job = this.perform().then((changed) => { this.lastChanged = changed; }).catch((error) => {
+            this.error = memoryFailure(error);
+            this.retryAt = Date.now() + (error instanceof SyncRequestError && error.retryAfterMs ? error.retryAfterMs : 60000);
             throw error;
         }).finally(() => { this.running = undefined; this.controller = undefined; });
         this.running = job;
         return job;
     }
+    /**
+     * One reconciliation. Resolves with whether anything went up or came down.
+     *
+     * A note both sides changed since the last sync is merged field by field
+     * when the changes do not touch (memory-merge.ts), and held back as a
+     * conflict only when they do. A held note stops nothing else: every other
+     * note still goes up and comes down, and the held one keeps its baseline
+     * until someone chooses.
+     */
     async perform() {
         const controller = this.controller = new AbortController();
         const identity = await this.allowed();
         controller.signal.throwIfAborted();
         this.binding = this.stateFile(identity);
-        const project = await projectId(this.options.cwd);
+        const baseDir = this.baseDir(identity);
+        const where = this.scope === "user" ? { scope: "user" } : { project: await projectId(this.options.cwd) };
         const state = readUserFile(this.binding);
         const base = state?.base ?? {};
         const local = new Map((await this.store.load()).map((entry) => [entry.id, memoryNote(entry)]));
-        let remote = await this.request("snapshot", { project, ...(this.snapshotCache?.etag ? { knownEtag: this.snapshotCache.etag } : {}) }, identity, controller.signal);
-        if (remote.unchanged) {
-            if (!this.snapshotCache || remote.etag !== this.snapshotCache.etag)
-                throw new Error("无效同步版本。");
-            remote = this.snapshotCache;
+        // What this machine already holds. The server leaves those bodies out of
+        // its reply, so a sync where little changed downloads little.
+        const have = {};
+        for (const [id, note] of local)
+            have[id] = noteHash(note);
+        let remote = await this.snapshot(where, have, identity, controller.signal, true);
+        // A cached manifest carries only the bodies the reply it came from carried.
+        // When one that is needed now is missing, ask again in full.
+        if (remote.entries.some((entry) => entry.hash !== null && !entry.note && entry.hash !== (have[entry.id] ?? null))) {
+            remote = await this.snapshot(where, have, identity, controller.signal, false);
         }
-        this.validateSnapshot(remote);
-        this.snapshotCache = remote;
         const cloud = new Map(remote.entries.map((entry) => [entry.id, entry]));
         const changes = [], nextBase = { ...base };
-        this.conflicts = [];
+        const conflicts = [];
+        const held = new Set();
+        const pull = { at: Date.now(), created: [], updated: [], deleted: [], merged: [] };
+        const merged = pull.merged;
+        const ref = (note) => ({ id: note.id, summary: note.summary });
+        const maxBytes = Math.min(this.store.maxNoteBytes, this.quota?.maxNoteBytes ?? Number.MAX_SAFE_INTEGER);
         for (const id of new Set([...Object.keys(base), ...local.keys(), ...cloud.keys()])) {
             const l = local.get(id), r = cloud.get(id), lh = noteHash(l), rh = r?.hash ?? null, old = base[id] ?? null;
             if (lh === rh) {
-                nextBase[id] = rh;
+                if (rh === null)
+                    delete nextBase[id];
+                else
+                    nextBase[id] = rh;
+                continue;
+            }
+            // One side changed: it goes up here, or comes down below.
+            if (lh === old || rh === old) {
+                if (lh !== old)
+                    changes.push({ id, hash: lh, ...(l ? { note: l } : {}) });
                 continue;
             }
-            if (lh !== old && rh !== old) {
-                this.conflicts.push({ id, local: l ?? null, cloud: r?.note ?? null, localHash: lh, cloudHash: rh });
+            // Both sides changed since the last sync.
+            const theirs = r?.note;
+            if (!l || !theirs) {
+                // A deletion against an edit keeps the edit. Deleting again is one
+                // click; an edit lost to a deletion is gone. A local edit goes up; a
+                // cloud edit comes down with the pull below.
+                if (l) {
+                    changes.push({ id, hash: lh, note: l });
+                    merged.push(ref(l));
+                }
+                continue;
             }
-            else if (lh !== old)
-                changes.push({ id, hash: lh, ...(l ? { note: l } : {}) });
+            const lastSynced = this.readBase(baseDir, id, old);
+            let outcome = mergeNotes(lastSynced, l, theirs);
+            if ("note" in outcome) {
+                // A merge the service would refuse to store is not a merge.
+                try {
+                    validateNote(outcome.note, maxBytes);
+                }
+                catch {
+                    outcome = { conflict: ["body"] };
+                }
+            }
+            if (!("note" in outcome)) {
+                conflicts.push({ id, local: l, cloud: theirs, base: lastSynced ?? null, localHash: lh, cloudHash: rh, fields: outcome.conflict });
+                held.add(id);
+                continue;
+            }
+            const note = outcome.note, mh = noteHash(note);
+            await this.allowed();
+            controller.signal.throwIfAborted();
+            if (mh !== lh) {
+                await backupNote(this.store, l, "auto-merge");
+                await this.store.apply(id, note, lh, "sync");
+                local.set(id, note);
+                have[id] = mh;
+            }
+            if (mh !== rh) {
+                await backupNote(this.store, theirs, "auto-merge");
+                changes.push({ id, hash: mh, note });
+            }
+            merged.push(ref(note));
         }
-        if (this.conflicts.length)
-            throw new Error("存在冲突，双方版本均已保留；请选择保留本地或采用云端。");
-        if (changes.length) {
-            remote = await this.request("commit", { project, etag: remote.etag, changes }, identity, controller.signal);
-            this.validateSnapshot(remote);
-            this.snapshotCache = remote;
+        for (const batch of this.batches(changes)) {
+            for (const change of batch) {
+                if (change.hash)
+                    have[change.id] = change.hash;
+                else
+                    delete have[change.id];
+            }
+            remote = await this.commit(where, remote.etag, batch, have, identity, controller.signal);
         }
         // No writes/merges after a disable or account switch observed during the request.
         await this.allowed();
         controller.signal.throwIfAborted();
+        const listed = new Set();
         for (const r of remote.entries) {
-            const expected = noteHash(local.get(r.id));
+            listed.add(r.id);
+            if (held.has(r.id))
+                continue;
+            const current = local.get(r.id);
+            const expected = noteHash(current);
             if (expected !== r.hash) {
+                if (r.hash !== null && !r.note)
+                    throw new MemoryError("invalidVersion");
                 await this.allowed();
                 controller.signal.throwIfAborted();
-                await this.store.apply(r.id, r.note, expected);
+                // Kept before an automatic pull replaces or removes it. Nobody looked
+                // at the change, and the cloud's old revisions have no way back.
+                if (current)
+                    await backupNote(this.store, current, r.note ? "sync-update" : "sync-delete");
+                await this.store.apply(r.id, r.note, expected, "sync");
+                if (r.note) {
+                    (current ? pull.updated : pull.created).push(ref(r.note));
+                    local.set(r.id, r.note);
+                }
+                else if (current) {
+                    pull.deleted.push(ref(current));
+                    local.delete(r.id);
+                }
+            }
+            if (r.hash === null)
+                delete nextBase[r.id];
+            else
+                nextBase[r.id] = r.hash;
+        }
+        // The server drops tombstones once they are old enough. A note this machine
+        // last saw in sync, unchanged here, that the manifest no longer lists at
+        // all was deleted elsewhere long enough ago for its tombstone to be gone.
+        for (const [id, old] of Object.entries(base)) {
+            if (listed.has(id) || held.has(id))
+                continue;
+            const current = local.get(id);
+            if (old !== null && current && noteHash(current) === old) {
+                await this.allowed();
+                controller.signal.throwIfAborted();
+                await backupNote(this.store, current, "sync-delete");
+                await this.store.apply(id, undefined, old, "sync");
+                pull.deleted.push(ref(current));
+                local.delete(id);
+                delete nextBase[id];
+                continue;
             }
-            nextBase[r.id] = r.hash;
+            if (!local.has(id))
+                delete nextBase[id];
         }
         await this.allowed();
         controller.signal.throwIfAborted();
+        // A baseline directory written before copies were kept is filled in full, once.
+        await this.writeBases(baseDir, state?.baseContent === true ? base : {}, nextBase, local, remote);
+        const pulled = pull.created.length + pull.updated.length + pull.deleted.length + merged.length;
+        if (pulled)
+            this.lastPull = pull;
+        this.conflicts = conflicts;
         this.lastSync = Date.now();
-        this.error = undefined;
         this.retryAt = 0;
-        await writeUserFile(this.binding, { base: nextBase, lastSync: this.lastSync });
+        this.error = conflicts.length ? memoryFailure(new MemoryError("conflictsPending", { count: conflicts.length })) : undefined;
+        const lastPull = this.lastPull ?? state?.lastPull;
+        await writeUserFile(this.binding, { base: nextBase, lastSync: this.lastSync, baseContent: true, ...(lastPull ? { lastPull } : {}) });
+        return changes.length > 0 || pulled > 0;
+    }
+    /** Where copies of notes at their baseline are kept, beside the baseline file. */
+    baseDir(identity) { return this.stateFile(identity).replace(/\.json$/, "-base"); }
+    /** The last synced version of a note, only when it is exactly the one the baseline records. */
+    readBase(dir, id, hash) {
+        if (hash === null || !validMemoryId(id))
+            return undefined;
+        try {
+            const note = readUserFile(`${dir}/${id}.json`);
+            if (!note)
+                return undefined;
+            validateNote(note, MEMORY_SAFETY.maxNoteBytesCeiling);
+            return noteHash(note) === hash ? note : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    async writeBaseNote(dir, id, note) {
+        if (!validMemoryId(id))
+            return;
+        if (note)
+            await writeUserFile(`${dir}/${id}.json`, note);
+        else
+            await rm(userPath(`${dir}/${id}.json`), { force: true });
+    }
+    /** Keep the baseline copies in step with the baseline hashes, writing only what moved. */
+    async writeBases(dir, before, after, local, remote) {
+        const fromCloud = new Map();
+        for (const entry of remote.entries)
+            if (entry.note)
+                fromCloud.set(entry.id, entry.note);
+        for (const id of new Set([...Object.keys(before), ...Object.keys(after)])) {
+            const hash = after[id] ?? null;
+            if (hash === null) {
+                if ((before[id] ?? null) !== null)
+                    await this.writeBaseNote(dir, id, undefined);
+                continue;
+            }
+            if (before[id] === hash)
+                continue;
+            // A copy that does not match its hash is worse than none, so an unknown one is removed.
+            await this.writeBaseNote(dir, id, [local.get(id), fromCloud.get(id)].find((note) => noteHash(note) === hash));
+        }
+    }
+    /**
+     * Write a batch cloud first, for changes made without anyone reviewing each
+     * note (consolidation).
+     *
+     * Every note in the batch must be fully in sync, the same here, in the cloud
+     * and in the baseline, or the batch is refused before anything is written.
+     * The commit carries the manifest version those checks read, so a change
+     * from another device in between is refused by the server rather than
+     * becoming a conflict. Only once the cloud has accepted the batch is it
+     * written here. It needs the network; there is no offline fallback.
+     */
+    async commitFirst(edits, reason) {
+        if (!edits.length)
+            return;
+        await this.running?.catch(() => { });
+        if (this.running)
+            throw new MemoryError("waitForSync");
+        const job = (async () => {
+            const controller = this.controller = new AbortController();
+            const identity = await this.allowed();
+            this.binding = this.stateFile(identity);
+            const baseDir = this.baseDir(identity);
+            const where = this.scope === "user" ? { scope: "user" } : { project: await projectId(this.options.cwd) };
+            const base = readUserFile(this.binding)?.base ?? {};
+            const local = new Map((await this.store.load()).map((entry) => [entry.id, memoryNote(entry)]));
+            const have = {};
+            for (const [id, note] of local)
+                have[id] = noteHash(note);
+            const remote = await this.snapshot(where, have, identity, controller.signal, false);
+            const cloud = new Map(remote.entries.map((entry) => [entry.id, entry.hash]));
+            const maxBytes = Math.min(this.store.maxNoteBytes, this.quota?.maxNoteBytes ?? Number.MAX_SAFE_INTEGER);
+            const seen = new Set();
+            for (const edit of edits) {
+                if (!validMemoryId(edit.id) || seen.has(edit.id) || (edit.note && edit.note.id !== edit.id))
+                    throw new MemoryError("invalidBatch");
+                seen.add(edit.id);
+                const lh = noteHash(local.get(edit.id));
+                if (lh !== edit.expectedHash || (cloud.get(edit.id) ?? null) !== lh || (base[edit.id] ?? null) !== lh)
+                    throw new MemoryError("stale");
+                if (edit.note)
+                    validateNote(edit.note, maxBytes);
+            }
+            const changes = edits.map((edit) => ({ id: edit.id, hash: noteHash(edit.note), ...(edit.note ? { note: edit.note } : {}) }));
+            if (this.batches(changes).length > 1)
+                throw new MemoryError("batchTooLarge");
+            for (const change of changes) {
+                if (change.hash)
+                    have[change.id] = change.hash;
+                else
+                    delete have[change.id];
+            }
+            try {
+                await this.commit(where, remote.etag, changes, have, identity, controller.signal);
+            }
+            catch (error) {
+                if (error instanceof SyncRequestError && error.status === 409)
+                    throw new MemoryError("stale");
+                throw error;
+            }
+            await this.allowed();
+            controller.signal.throwIfAborted();
+            for (const edit of edits) {
+                const current = local.get(edit.id);
+                if (current)
+                    await backupNote(this.store, current, reason);
+                await this.store.apply(edit.id, edit.note, edit.expectedHash, "sync");
+                await this.writeBaseNote(baseDir, edit.id, edit.note);
+            }
+            const latest = readUserFile(this.binding);
+            const nextBase = { ...latest?.base };
+            for (const edit of edits) {
+                const hash = noteHash(edit.note);
+                if (hash === null)
+                    delete nextBase[edit.id];
+                else
+                    nextBase[edit.id] = hash;
+            }
+            await writeUserFile(this.binding, { ...latest, base: nextBase });
+        })().finally(() => { this.running = undefined; this.controller = undefined; });
+        this.running = job;
+        return job;
+    }
+    /**
+     * Whether changes here should go through the cloud first: sync is on and
+     * bound to the account signed in now. Otherwise they are ordinary local
+     * edits that a later sync uploads.
+     */
+    async syncReady() {
+        if (this.closed || this.disabling)
+            return false;
+        let consent;
+        try {
+            consent = this.consent();
+        }
+        catch {
+            return false;
+        }
+        if (!consent?.enabled || !consent.userId)
+            return false;
+        const identity = await this.options.identity();
+        return !!identity && identity.userId === consent.userId && identity.origin === consent.origin;
+    }
+    /** The plan the sync service last announced for this account, if any. */
+    get tier() { return this.quota?.tier; }
+    /** Largest note body this machine and the sync service will both accept. */
+    noteBytesLimit() {
+        return Math.min(this.store.maxNoteBytes, this.quota?.maxNoteBytes ?? Number.MAX_SAFE_INTEGER);
+    }
+    /** Changes grouped to fit the server's announced change quota and a request size its body limit accepts. */
+    batches(changes) {
+        const maxChanges = Math.max(1, this.quota?.maxChanges ?? MEMORY_SAFETY.syncCommitBatchChanges);
+        const batches = [];
+        let current = [], bytes = 0;
+        for (const change of changes) {
+            const size = Buffer.byteLength(JSON.stringify(change));
+            if (current.length && (current.length >= maxChanges || bytes + size > MEMORY_SAFETY.syncCommitBatchBytes)) {
+                batches.push(current);
+                current = [];
+                bytes = 0;
+            }
+            current.push(change);
+            bytes += size;
+        }
+        if (current.length)
+            batches.push(current);
+        return batches;
+    }
+    async snapshot(where, have, identity, signal, useCache) {
+        const knownEtag = useCache ? this.snapshotCache?.etag : undefined;
+        let remote = await this.call("snapshot", { ...where, ...(knownEtag ? { knownEtag } : {}) }, have, identity, signal);
+        if (remote.unchanged) {
+            if (!this.snapshotCache || remote.etag !== this.snapshotCache.etag)
+                throw new MemoryError("invalidVersion");
+            if (object(remote.quota))
+                this.readQuota(remote.quota);
+            remote = this.snapshotCache;
+        }
+        this.validateSnapshot(remote);
+        this.snapshotCache = remote;
+        return remote;
     }
-    async resolve(id, choice) {
+    async commit(where, etag, changes, have, identity, signal) {
+        const remote = await this.call("commit", { ...where, etag, changes }, have, identity, signal);
+        this.validateSnapshot(remote);
+        this.snapshotCache = remote;
+        return remote;
+    }
+    /** A request carrying `have`, retried without it once against a server that predates the field. */
+    async call(action, input, have, identity, signal) {
+        if (!this.legacyServer) {
+            try {
+                return await this.request(action, { ...input, have }, identity, signal);
+            }
+            catch (error) {
+                if (!(error instanceof SyncRequestError) || error.serverCode !== "unknown_field")
+                    throw error;
+                if (this.scope === "user")
+                    throw new MemoryError("serverTooOld");
+                this.legacyServer = true;
+            }
+        }
+        return this.request(action, input, identity, signal);
+    }
+    /**
+     * Settle a conflict. Whatever is set aside is backed up first, whichever side
+     * it came from, and the baseline moves to the cloud's version so the next
+     * sync uploads the outcome.
+     *
+     * `local` keeps this machine's version. `cloud` takes the cloud's. `both`
+     * keeps this machine's version under the note's id and the cloud's as a new
+     * note beside it. `manual` saves `merged`, written by a person from all three.
+     */
+    async resolve(id, choice, merged) {
         if (this.running)
-            throw new Error("请等待同步结束。");
+            throw new MemoryError("waitForSync");
         const identity = await this.allowed();
         if (this.stateFile(identity) !== this.binding)
-            throw new Error("账号已改变。");
+            throw new MemoryError("accountSwitched");
         const conflict = this.conflicts.find((entry) => entry.id === id);
-        if (!conflict || !["local", "cloud"].includes(choice))
-            throw new Error("无效冲突选择。");
+        if (!conflict || !["local", "cloud", "both", "manual"].includes(choice))
+            throw new MemoryError("invalidChoice");
         const current = (await this.store.load()).find((entry) => entry.id === id);
         if (noteHash(current) !== conflict.localHash)
-            throw new Error("本地记忆已改变，请重新同步。");
-        // Save the losing local version before adopting Cloud (also for cloud deletion).
-        if (choice === "cloud") {
-            if (current)
-                await writeUserFile("memory-backups/" + digest(this.binding + id + Date.now()) + ".json", memoryNote(current));
-            await this.store.apply(id, conflict.cloud ?? undefined, conflict.localHash);
+            throw new MemoryError("localChanged");
+        const mine = current ? memoryNote(current) : undefined;
+        const maxBytes = Math.min(this.store.maxNoteBytes, this.quota?.maxNoteBytes ?? Number.MAX_SAFE_INTEGER);
+        if (choice === "local") {
+            // The cloud side is usually what another device just wrote. Keeping this
+            // machine's version must not make that unrecoverable.
+            if (conflict.cloud)
+                await backupNote(this.store, conflict.cloud, "conflict-cloud");
+        }
+        else if (choice === "cloud") {
+            if (mine)
+                await backupNote(this.store, mine, "conflict");
+            await this.store.apply(id, conflict.cloud ?? undefined, conflict.localHash, "sync");
+        }
+        else if (choice === "both") {
+            if (!conflict.cloud || !mine)
+                throw new MemoryError("oneSideDeleted");
+            const copyId = `${id.slice(0, 120)}-${shortId(3)}`;
+            await this.store.apply(copyId, { ...conflict.cloud, id: copyId, updatedAt: Date.now() }, null, "local");
+        }
+        else {
+            const basis = mine ?? conflict.cloud;
+            if (!basis || !object(merged))
+                throw new MemoryError("mergedMissing");
+            const note = {
+                ...basis, id,
+                summary: typeof merged.summary === "string" ? merged.summary.trim() : basis.summary,
+                body: typeof merged.body === "string" ? merged.body.trim() : basis.body,
+                tags: Array.isArray(merged.tags) ? merged.tags.filter((tag) => typeof tag === "string") : basis.tags,
+                createdAt: basis.createdAt, updatedAt: Date.now(),
+            };
+            if (isMemoryType(merged.type))
+                note.type = merged.type;
+            else if (merged.type === "" || merged.type === null)
+                delete note.type;
+            if (findSecrets(`${note.summary}\n${note.body}`).length)
+                throw new MemoryError("secret");
+            validateNote(note, maxBytes);
+            if (mine)
+                await backupNote(this.store, mine, "conflict");
+            if (conflict.cloud)
+                await backupNote(this.store, conflict.cloud, "conflict-cloud");
+            await this.store.apply(id, note, conflict.localHash, "local");
         }
         const file = this.stateFile(identity), state = readUserFile(file);
-        await writeUserFile(file, { base: { ...state?.base, [id]: conflict.cloudHash } });
+        await writeUserFile(file, { ...state, base: { ...state?.base, [id]: conflict.cloudHash } });
+        await this.writeBaseNote(this.baseDir(identity), id, conflict.cloud ?? undefined);
         this.conflicts = this.conflicts.filter((entry) => entry.id !== id);
-        this.error = this.conflicts.length ? "还有冲突需要处理。" : undefined;
+        this.error = this.conflicts.length ? memoryFailure(new MemoryError("conflictsRemain")) : undefined;
+        // What was chosen, if not the cloud's version, is a change the cloud has not seen.
+        if (this.detach)
+            this.coordinator.touch(this.syncTarget, "local-change");
+    }
+    readQuota(raw) {
+        const quota = {};
+        for (const key of ["maxNotes", "maxChanges", "maxNoteBytes", "tombstoneDays"]) {
+            const n = raw[key];
+            if (typeof n === "number" && Number.isSafeInteger(n) && n > 0)
+                quota[key] = n;
+        }
+        if (raw.tier === "free" || raw.tier === "paid")
+            quota.tier = raw.tier;
+        this.quota = quota;
     }
     validateSnapshot(value) {
-        if (!object(value) || !Array.isArray(value.entries) || value.entries.length > 500 || !(value.etag === null || typeof value.etag === "string"))
-            throw new Error("无效同步清单。");
+        if (!object(value) || !Array.isArray(value.entries) || value.entries.length > MEMORY_SAFETY.maxNotesCeiling * 4 || !(value.etag === null || typeof value.etag === "string"))
+            throw new MemoryError("invalidResponse");
         const seen = new Set();
         for (const entry of value.entries) {
             if (!object(entry) || !validMemoryId(entry.id) || seen.has(entry.id))
-                throw new Error("无效同步条目。");
+                throw new MemoryError("invalidResponse");
             seen.add(entry.id);
+            if (!(entry.hash === null || typeof entry.hash === "string" && HASH.test(entry.hash)))
+                throw new MemoryError("invalidResponse");
             if (entry.note) {
-                validateNote(entry.note);
+                validateNote(entry.note, MEMORY_SAFETY.maxNoteBytesCeiling);
                 if (entry.note.id !== entry.id)
-                    throw new Error("记忆 ID 不匹配。");
+                    throw new MemoryError("invalidResponse");
+                if (noteHash(entry.note) !== entry.hash)
+                    throw new MemoryError("invalidResponse");
             }
-            if (noteHash(entry.note) !== entry.hash)
-                throw new Error("记忆校验失败。");
+            // A live entry without a body is one this machine said it already has.
         }
+        if (object(value.quota))
+            this.readQuota(value.quota);
     }
     async request(action, input, identity, signal, gated = true) {
         if (gated)
             await this.allowed();
         const current = await this.options.identity();
         if (!current || current.userId !== identity.userId || current.origin !== identity.origin)
-            throw new Error("账号已改变。");
+            throw new MemoryError("accountSwitched");
         const token = await this.options.token();
         if (!token)
-            throw new Error("请重新登录 OHarness。");
+            throw new MemoryError("signInAgain");
         if (gated)
             await this.allowed();
         signal.throwIfAborted();
         let response;
         const endpoint = resolveSyncUrl({ url: this.options.syncUrl?.() ?? resolveSyncUrl() });
+        this.coordinator.noteRequest();
         try {
             response = await (this.options.fetch ?? fetch)(endpoint + "/v1/memory/" + action, {
                 method: "POST", redirect: "error", headers: { "content-type": "application/json", authorization: "Bearer " + token },
@@ -268,15 +759,38 @@ export class MemoryService {
             });
         }
         catch {
-            throw new Error("Memory 云同步请求失败或已取消；可手动重试。");
+            throw new MemoryError("requestFailed");
         }
         if (!response.ok) {
-            await response.body?.cancel();
-            throw new Error(response.status === 409 ? "云端版本已改变，请重新同步。" : response.status === 503 ? "Sync 服务尚未配置 Memory 鉴权或 R2 存储。" : "同步请求被拒绝，请检查账号和 Sync 配置。");
+            // The error body is a short code chosen by the server, read to tell an
+            // old server rejecting a new field, or a plan limit, from other refusals.
+            let code;
+            try {
+                const text = await response.text();
+                if (text.length < 4096) {
+                    const parsed = JSON.parse(text);
+                    if (typeof parsed?.code === "string")
+                        code = parsed.code;
+                }
+            }
+            catch { /* not JSON */ }
+            let wait;
+            if (response.status === 429) {
+                wait = retryAfterMs(response.headers.get("retry-after"));
+                // The limit is the account's, so every directory waits, not only this one.
+                this.coordinator.pause(Date.now() + wait);
+            }
+            const reason = response.status === 409 ? new MemoryError("cloudChanged")
+                : response.status === 429 ? new MemoryError("rateLimited")
+                    : code === "memory_plan_limit" ? planLimitError(this.quota)
+                        : response.status === 503 ? new MemoryError("serverNotConfigured")
+                            : response.status === 413 ? new MemoryError("quotaExceeded")
+                                : new MemoryError("rejected");
+            throw new SyncRequestError(reason, response.status, code, wait);
         }
         const reader = response.body?.getReader();
         if (!reader)
-            throw new Error("同步响应为空。");
+            throw new MemoryError("invalidResponse");
         const chunks = [];
         let length = 0;
         try {
@@ -285,9 +799,9 @@ export class MemoryService {
                 if (done)
                     break;
                 length += value.length;
-                if (length > 4 * 1024 * 1024) {
+                if (length > MEMORY_SAFETY.syncResponseBytes) {
                     await reader.cancel();
-                    throw new Error("同步响应过大。");
+                    throw new MemoryError("responseTooLarge");
                 }
                 chunks.push(value);
             }
@@ -297,63 +811,453 @@ export class MemoryService {
         }
         const result = JSON.parse(Buffer.concat(chunks).toString("utf8"));
         if (result.principal !== identity.userId)
-            throw new Error("同步用户身份不匹配。");
+            throw new MemoryError("principalMismatch");
         return result;
     }
-    async close() { this.closed = true; clearInterval(this.timer); this.controller?.abort(); await this.running?.catch(() => { }); }
+    async close() {
+        this.closed = true;
+        this.detach?.();
+        this.detach = undefined;
+        this.controller?.abort();
+        await this.running?.catch(() => { });
+    }
+}
+/**
+ * One service per notes directory in a process.
+ *
+ * A local web server builds a harness per project, and every one of them has
+ * the same user-level notes. Separate services for one directory would each
+ * reconcile against the same baseline file and the same cloud manifest, and
+ * trip over each other's commits. The first harness to ask supplies the
+ * options; the service stops when the last one lets go.
+ */
+const sharedServices = new Map();
+export function acquireMemoryService(options) {
+    const key = `${options.scope ?? "project"}${path.resolve(options.directory)}`;
+    let held = sharedServices.get(key);
+    if (!held || held.service.isClosed) {
+        held = { service: new MemoryService(options), refs: 0 };
+        sharedServices.set(key, held);
+    }
+    const lease = held;
+    lease.refs++;
+    let released = false;
+    return {
+        service: lease.service,
+        async release() {
+            if (released)
+                return;
+            released = true;
+            if (--lease.refs > 0)
+                return;
+            if (sharedServices.get(key) === lease)
+                sharedServices.delete(key);
+            await lease.service.close();
+        },
+    };
+}
+/** Recall counts per directory, shared for the same reason services are: one file, one writer. */
+const sharedUsage = new Map();
+function usageFor(location) {
+    const key = path.resolve(location);
+    let usage = sharedUsage.get(key);
+    if (!usage) {
+        usage = new MemoryUsage(location);
+        sharedUsage.set(key, usage);
+    }
+    return usage;
+}
+/**
+ * Write what an extraction pass proposed. New notes first, so every
+ * `[[new:N]]` placeholder has an id to become; then the notes that used a
+ * placeholder are rewritten with it.
+ */
+export async function commitExtracted(stores, notes) {
+    const created = [], updated = [];
+    const summaries = [];
+    const ids = new Map();
+    const written = [];
+    for (const note of notes) {
+        if (findSecrets(`${note.summary}\n${note.body}`).length)
+            continue;
+        let store;
+        try {
+            store = storeFor(stores, note.scope);
+        }
+        catch {
+            store = stores.project;
+        }
+        try {
+            if (note.action === "update") {
+                const current = note.id ? (await store.load()).find((entry) => entry.id === note.id) : undefined;
+                if (!current)
+                    continue;
+                // An extractor's rewrite replaces a note nobody reviewed, so the version
+                // it replaces is kept where a deleted note would be.
+                await backupNote(store, memoryNote(current), "extract-update");
+            }
+            const entry = await store.remember({
+                summary: note.summary, body: note.body, tags: note.tags,
+                ...(note.type ? { type: note.type } : {}),
+                ...(note.action === "update" && note.id ? { id: note.id } : {}),
+            });
+            (note.action === "update" ? updated : created).push(entry.id);
+            summaries.push({ id: entry.id, summary: entry.summary, scope: store.scope, action: note.action === "update" ? "updated" : "created" });
+            if (note.ref !== undefined)
+                ids.set(note.ref, entry.id);
+            written.push({ store, id: entry.id, note });
+        }
+        catch { /* one bad proposal does not stop the rest */ }
+    }
+    for (const item of written) {
+        if (!/\[\[new:\d+\]\]/.test(item.note.body))
+            continue;
+        await item.store.remember({
+            id: item.id, summary: item.note.summary, body: resolvePlaceholders(item.note.body, ids), tags: item.note.tags,
+            ...(item.note.type ? { type: item.note.type } : {}),
+        }).catch(() => { });
+    }
+    return { created, updated, notes: summaries };
 }
 export function createMemoryPlugin(options, onReady) {
-    return { id: "memory", version: "1.0.0", apiVersion: 1, description: "Local Markdown memory with account Cloud sync and a persistent off switch",
+    return { id: "memory", version: "1.2.0", apiVersion: 1, description: "Local Markdown memory with recall, account Cloud sync and a persistent off switch",
         parseConfig(raw) { if (raw !== undefined && !object(raw))
             throw new Error("Invalid memory config"); return {}; },
         setup(ctx) {
-            const service = new MemoryService(options);
-            onReady(service);
-            const stop = () => { void service.close(); };
+            const policy = options.policy ?? DEFAULT_MEMORY_POLICY;
+            const warn = options.onWarning ?? ((message) => ctx.logger.warn(message));
+            const projectLease = acquireMemoryService({ ...options, scope: "project", policy, onWarning: warn });
+            const userLease = options.userDirectory
+                ? acquireMemoryService({ ...options, directory: options.userDirectory, scope: "user", policy, onWarning: warn })
+                : undefined;
+            const project = projectLease.service, user = userLease?.service;
+            onReady(project, user);
+            const services = [project, ...(user ? [user] : [])];
+            const stores = { project: project.store, ...(user ? { user: user.store } : {}) };
+            const usage = { project: usageFor(project.store.location), ...(user ? { user: usageFor(user.store.location) } : {}) };
+            let closing;
+            const closeAll = () => closing ??= (async () => {
+                await Promise.all([projectLease.release(), userLease?.release()]);
+                await Promise.all([usage.project.flush(), usage.user?.flush()]);
+            })();
+            const stop = () => { void closeAll(); };
             ctx.signal.addEventListener("abort", stop, { once: true });
-            ctx.onDispose(async () => { ctx.signal.removeEventListener("abort", stop); await service.close(); });
-            for (const tool of createMemoryTools(service.store))
+            ctx.onDispose(async () => { ctx.signal.removeEventListener("abort", stop); await closeAll(); });
+            for (const tool of createMemoryTools(stores))
                 ctx.tools.register(tool);
             ctx.prompts.register(async () => {
                 try {
-                    return await service.store.promptSection();
+                    return memoryIndexSection((await loadScoped(stores)).notes, policy.indexChars, { showScope: !!user });
                 }
                 catch {
                     ctx.logger.warn("Memory prompt unavailable; check local note files");
                     return undefined;
                 }
             });
-            ctx.pages.register({ id: "memory", title: "Memory", renderer: "memory", read: () => service.status(),
+            const inUse = () => { for (const one of services)
+                one.activity(); };
+            const provider = {
+                recall: (input) => {
+                    // A message is being sent in this project: its notes should be current.
+                    inUse();
+                    return recallFromStores(stores, input, policy.recall, usage);
+                },
+                extraction: {
+                    policy: () => policy.autoExtract,
+                    async candidates(text, limit) {
+                        const { notes } = await loadScoped(stores);
+                        const chosen = new Map(rankNotes(notes, text.slice(-8_000)).slice(0, limit).map((entry) => [entry.note.id, entry.note]));
+                        // Few matches still leaves the extractor needing to see what
+                        // exists, or it re-creates notes it could have updated.
+                        for (const note of [...notes].sort((a, b) => (b.updatedAt ?? b.createdAt) - (a.updatedAt ?? a.createdAt))) {
+                            if (chosen.size >= limit)
+                                break;
+                            chosen.set(note.id, note);
+                        }
+                        // The most relevant notes come with their bodies, within a budget,
+                        // and only those may be updated; the rest are there to link to.
+                        let editable = 0, budget = MEMORY_SAFETY.extractBodyBudgetChars;
+                        return [...chosen.values()].map((note) => {
+                            const shown = editable < MEMORY_SAFETY.extractEditableNotes &&
+                                note.body.length <= MEMORY_SAFETY.extractEditableBodyChars && note.body.length <= budget;
+                            if (shown) {
+                                editable++;
+                                budget -= note.body.length;
+                            }
+                            return { id: note.id, summary: note.summary, scope: note.scope, ...(note.type ? { type: note.type } : {}), ...(shown ? { body: note.body } : {}) };
+                        });
+                    },
+                    commit: (notes) => commitExtracted(stores, notes),
+                },
+            };
+            ctx.memory.register(provider);
+            // --- consolidation -------------------------------------------------
+            const reviewFile = `memory-review/${digest(`${project.store.location}\0${user?.store.location ?? ""}`)}.json`;
+            const readReview = () => { try {
+                return readUserFile(reviewFile) ?? {};
+            }
+            catch {
+                return {};
+            } };
+            const serviceFor = (scope) => (scope === "user" && user ? user : project);
+            const lifetime = new AbortController();
+            let proposal;
+            let autoTimer;
+            const allNotes = async () => (await loadScoped(stores)).notes.map((note) => ({ ...memoryNote(note.entry), scope: note.scope }));
+            const review = async () => {
+                const notes = (await allNotes()).map((note) => ({ ...note, hash: noteHash(note) }));
+                return reviewNotes(notes, {
+                    dismissed: new Set(readReview().dismissed ?? []),
+                    unusedDays: policy.consolidate.unusedDays,
+                    usage: (scope, id) => usage[scope]?.get(id),
+                    pathExists: (relative) => existsSync(path.resolve(options.cwd, relative)),
+                });
+            };
+            /** The notes of a merge, in the order given, each at its current hash. */
+            const groupOf = async (scope, ids) => {
+                const all = await allNotes();
+                const group = ids.map((id) => all.find((note) => note.id === id && note.scope === scope));
+                if (group.length < 2 || group.length > 6 || group.some((note) => !note) || new Set(ids).size !== ids.length) {
+                    throw new MemoryError("mergeGone");
+                }
+                return group;
+            };
+            const propose = async (scope, ids, useModel) => {
+                const group = await groupOf(scope, ids);
+                let draft, source = "manual";
+                if (useModel && options.generate) {
+                    const reply = await options.generate(CONSOLIDATE_PROMPT, mergePrompt(group), lifetime.signal);
+                    draft = parseMergeReply(reply);
+                    if (!draft)
+                        throw new MemoryError("modelNoDraft");
+                    source = "model";
+                }
+                return {
+                    scope, ids: group.map((note) => note.id), source,
+                    hashes: Object.fromEntries(group.map((note) => [note.id, noteHash(note)])),
+                    draft: draft ?? draftByHand(group),
+                };
+            };
+            /**
+             * Apply a merge. With cloud sync on, the scope is synced first and the
+             * merge is committed to the cloud before it is written here, so another
+             * device's edit in between refuses the merge rather than conflicting
+             * with it. Links from the other scope are relinked as ordinary edits.
+             */
+            const applyMerge = async (scope, ids, draft, expected) => {
+                if (findSecrets(`${draft.summary}\n${draft.body}`).length)
+                    throw new MemoryError("mergedSecret");
+                const service = serviceFor(scope);
+                const cloudFirst = await service.syncReady();
+                if (cloudFirst)
+                    await service.sync();
+                const group = await groupOf(scope, ids);
+                if (group.some((note) => noteHash(note) !== expected[note.id]))
+                    throw new MemoryError("mergeStale");
+                const edits = planMerge({ all: await allNotes(), scope, ids, draft, hash: noteHash });
+                for (const edit of edits)
+                    if (edit.note)
+                        validateNote(edit.note, serviceFor(edit.scope).noteBytesLimit());
+                const own = edits.filter((edit) => edit.scope === scope);
+                if (cloudFirst) {
+                    await service.commitFirst(own.map(({ id, note, expectedHash }) => ({ id, expectedHash, ...(note ? { note } : {}) })), "consolidate");
+                }
+                for (const edit of cloudFirst ? edits.filter((one) => one.scope !== scope) : edits) {
+                    const store = serviceFor(edit.scope).store;
+                    const current = (await store.load()).find((entry) => entry.id === edit.id);
+                    if (noteHash(current) !== edit.expectedHash)
+                        throw new MemoryError("mergeStale");
+                    if (current)
+                        await backupNote(store, memoryNote(current), "consolidate");
+                    await store.apply(edit.id, edit.note, edit.expectedHash, "local");
+                }
+            };
+            const autoOn = () => consolidationEnabled(policy.consolidate.auto, services.map((one) => one.tier));
+            /** The background pass: duplicates only, merged by the model, within a cooldown. */
+            const autoConsolidate = async () => {
+                const settings = policy.consolidate;
+                if (!autoOn() || !options.generate || settings.maxMerges === 0 || lifetime.signal.aborted)
+                    return;
+                const state = readReview();
+                if (Date.now() - (state.lastAuto ?? 0) < settings.cooldownHours * 3_600_000)
+                    return;
+                // Recorded before the pass, so a pass that crashes waits out the cooldown too.
+                await writeUserFile(reviewFile, { ...state, lastAuto: Date.now() });
+                const merged = [];
+                for (const finding of (await review()).filter((one) => AUTO_KINDS.has(one.kind)).slice(0, settings.maxMerges)) {
+                    if (lifetime.signal.aborted)
+                        break;
+                    try {
+                        const next = await propose(finding.scope, finding.ids, true);
+                        await applyMerge(finding.scope, next.ids, next.draft, next.hashes);
+                        merged.push({ scope: finding.scope, id: next.ids[0], summary: next.draft.summary, count: next.ids.length });
+                    }
+                    catch (error) {
+                        ctx.logger.warn("memory consolidation skipped a group", { error: error instanceof Error ? error.message : String(error) });
+                    }
+                }
+                if (merged.length)
+                    await writeUserFile(reviewFile, { ...readReview(), autoResult: { at: Date.now(), merged } });
+            };
+            const status = async () => {
+                inUse();
+                const [projectStatus, userStatus] = await Promise.all([project.status(), user?.status()]);
+                const scoped = userStatus ? [projectStatus, userStatus] : [projectStatus];
+                let links;
+                try {
+                    links = (await loadScoped(stores)).links;
+                }
+                catch {
+                    links = undefined;
+                }
+                const decorate = (entries, scope) => entries.map((entry) => ({
+                    ...entry, scope,
+                    links: { out: links?.outgoing.get(entry.id) ?? [], in: links?.incoming.get(entry.id) ?? [], dangling: links?.dangling.get(entry.id) ?? [] },
+                }));
+                const synced = scoped.map((one) => one.lastSync);
+                const backups = await listBackups(50).catch(() => []);
+                const findings = await review().catch(() => []);
+                const reviewState = readReview();
+                return {
+                    review: findings.slice(0, 100),
+                    reviewTotal: findings.length,
+                    ...(proposal ? { proposal } : {}),
+                    consolidate: {
+                        auto: autoOn() && !!options.generate, modelAvailable: !!options.generate,
+                        ...(reviewState.autoResult ? { lastAuto: reviewState.autoResult } : {}),
+                    },
+                    ...projectStatus,
+                    // Both scopes, not the project alone: the page's one switch and one
+                    // "last synced" line speak for every note it lists.
+                    enabled: scoped.every((one) => one.enabled),
+                    ready: scoped.every((one) => one.ready),
+                    accountChanged: scoped.some((one) => one.accountChanged),
+                    syncing: scoped.some((one) => one.syncing),
+                    lastSync: synced.every((at) => typeof at === "number") ? Math.min(...synced) : undefined,
+                    error: scoped.find((one) => one.error)?.error,
+                    errors: scoped.filter((one) => one.failure).map((one) => ({ scope: one.scope, ...one.failure })),
+                    recent: scoped.filter((one) => one.lastPull).map((one) => ({ scope: one.scope, ...one.lastPull })),
+                    conflicts: [
+                        ...projectStatus.conflicts.map((conflict) => ({ ...conflict, scope: "project" })),
+                        ...(userStatus?.conflicts ?? []).map((conflict) => ({ ...conflict, scope: "user" })),
+                    ],
+                    locations: { project: projectStatus.location, ...(userStatus ? { user: userStatus.location } : {}) },
+                    entries: [...decorate(projectStatus.entries, "project"), ...(userStatus ? decorate(userStatus.entries, "user") : [])],
+                    omitted: projectStatus.omitted + (userStatus?.omitted ?? 0),
+                    limits: { maxNotes: policy.maxNotes },
+                    quota: projectStatus.quota ?? userStatus?.quota,
+                    userAvailable: !!user,
+                    backups: backups.map((backup) => ({
+                        file: backup.file, backedUpAt: backup.backedUpAt, id: backup.note.id, summary: backup.note.summary,
+                        ...(backup.reason ? { reason: backup.reason } : {}), ...(backup.scope ? { scope: backup.scope } : {}),
+                    })),
+                };
+            };
+            ctx.pages.register({ id: "memory", title: "Memory", renderer: "memory", read: status,
                 async act(input) {
-                    if (input.action === "sync")
-                        await service.sync();
-                    else if (input.action === "enable" && typeof input.enabled === "boolean")
-                        await service.enable(input.enabled);
-                    else if (input.action === "resolve" && typeof input.id === "string" && typeof input.choice === "string")
-                        await service.resolve(input.id, input.choice);
+                    const scope = input.scope === "user" && user ? "user" : "project";
+                    const service = scope === "user" ? user : project;
+                    if (input.action === "sync") {
+                        const results = await Promise.allSettled(services.map((one) => one.sync()));
+                        const failed = results.find((result) => result.status === "rejected");
+                        if (failed)
+                            throw failed.reason;
+                    }
+                    else if (input.action === "enable" && typeof input.enabled === "boolean") {
+                        // One switch for both scopes: a person turning cloud sync off means
+                        // all of their notes, not the half the page happened to show first.
+                        for (const one of services)
+                            await one.enable(input.enabled);
+                    }
+                    else if (input.action === "resolve" && typeof input.id === "string" && typeof input.choice === "string") {
+                        await service.resolve(input.id, input.choice, object(input.note) ? input.note : undefined);
+                    }
                     else if (input.action === "save" && object(input.note)) {
+                        const note = input.note;
+                        const secrets = findSecrets(`${String(note.summary ?? "")}\n${String(note.body ?? "")}`);
+                        if (secrets.length)
+                            throw new MemoryError("secretFound", { kinds: secrets.join(", ") });
+                        const type = isMemoryType(note.type) ? note.type : undefined;
+                        const clearType = note.type === "" || note.type === null;
                         if (input.id) {
                             const id = String(input.id), current = (await service.store.load()).find((entry) => entry.id === id);
                             if (!current || input.expectedHash !== noteHash(current))
-                                throw new Error("记忆已改变，请刷新后编辑。");
-                            await service.store.apply(id, { ...current, ...input.note, id, createdAt: current.createdAt }, noteHash(current));
+                                throw new MemoryError("editStale");
+                            const next = {
+                                ...memoryNote(current),
+                                ...(typeof note.summary === "string" ? { summary: note.summary } : {}),
+                                ...(typeof note.body === "string" ? { body: note.body } : {}),
+                                ...(Array.isArray(note.tags) ? { tags: note.tags } : {}),
+                                id, createdAt: current.createdAt, updatedAt: Date.now(),
+                            };
+                            if (type)
+                                next.type = type;
+                            else if (clearType)
+                                delete next.type;
+                            await service.store.apply(id, next, noteHash(current));
+                        }
+                        else {
+                            await service.store.remember({
+                                summary: String(note.summary ?? ""), body: String(note.body ?? ""),
+                                ...(Array.isArray(note.tags) ? { tags: note.tags } : {}),
+                                ...(type ? { type } : {}),
+                            });
                         }
-                        else
-                            await service.store.remember(input.note);
                     }
                     else if (input.action === "delete" && typeof input.id === "string") {
                         const entry = (await service.store.load()).find((one) => one.id === input.id);
                         if (!entry || input.expectedHash !== noteHash(entry))
-                            throw new Error("记忆已改变，请刷新。");
-                        await writeUserFile("memory-backups/" + digest(service.store.location + entry.id + Date.now()) + ".json", memoryNote(entry));
+                            throw new MemoryError("deleteStale");
+                        await backupNote(service.store, memoryNote(entry), "delete");
                         await service.store.apply(entry.id, undefined, noteHash(entry));
                     }
+                    else if (input.action === "restore" && typeof input.file === "string") {
+                        await restoreBackup(stores, input.file);
+                    }
+                    else if (input.action === "dismiss" && typeof input.key === "string" && /^[a-z-]+:[a-f0-9]{24}$/.test(input.key)) {
+                        const state = readReview();
+                        const dismissed = [...new Set([...(state.dismissed ?? []), input.key])].slice(-2000);
+                        await writeUserFile(reviewFile, { ...state, dismissed });
+                    }
+                    else if (input.action === "propose" && Array.isArray(input.ids) && input.ids.every((id) => typeof id === "string")) {
+                        proposal = await propose(scope, input.ids, input.model === true);
+                    }
+                    else if (input.action === "cancelMerge") {
+                        proposal = undefined;
+                    }
+                    else if (input.action === "merge" && proposal && object(input.note)) {
+                        const note = input.note;
+                        const draft = {
+                            summary: typeof note.summary === "string" ? note.summary.replace(/[\r\n]+/g, " ").trim() : "",
+                            body: typeof note.body === "string" ? note.body.trim() : "",
+                            tags: Array.isArray(note.tags) ? note.tags.filter((tag) => typeof tag === "string") : [],
+                            ...(isMemoryType(note.type) ? { type: note.type } : {}),
+                        };
+                        if (!draft.summary || !draft.body)
+                            throw new MemoryError("mergeEmpty");
+                        await applyMerge(proposal.scope, proposal.ids, draft, proposal.hashes);
+                        proposal = undefined;
+                    }
                     else
-                        throw new Error("未知 Memory 操作。");
-                    return service.status();
+                        throw new MemoryError("unknownAction");
+                    return status();
                 },
             });
-            ctx.onStart(() => service.start());
+            ctx.onStart(() => {
+                for (const one of services)
+                    one.start();
+                // Not at startup itself: a pass syncs and calls a model, and the first
+                // minutes of a session are when the person is waiting on both. By then
+                // the first sync has also said whether the account is a subscriber.
+                if (policy.consolidate.auto !== false && options.generate) {
+                    autoTimer = setTimeout(() => {
+                        void autoConsolidate().catch((error) => ctx.logger.warn("memory consolidation failed", { error: error instanceof Error ? error.message : String(error) }));
+                    }, 2 * 60_000);
+                    autoTimer.unref?.();
+                }
+            });
+            ctx.onDispose(() => { lifetime.abort(); if (autoTimer)
+                clearTimeout(autoTimer); });
         },
     };
 }