@pinkpixel/memi 0.0.0-stage → 1.0.0

package/dist/ui/routes.js

@@ -0,0 +1,91 @@
+import { Hono } from "hono";
+import { z } from "zod";
+import { MemiError } from "../core/types.js";
+import { EmbedError } from "../embed/types.js";
+const Scope = z.enum(["both", "project", "global", "all"]);
+const Tags = z.array(z.string()).max(10);
+const ListQuery = z.object({
+    q: z.string().trim().optional(),
+    scope: Scope.default("all"),
+    project: z.string().optional(),
+    category: z.string().optional(),
+    minImportance: z.coerce.number().int().min(1).max(5).optional(),
+    pinned: z.enum(["true", "false"]).optional(),
+    order: z.enum(["recent", "oldest", "importance"]).default("recent"),
+    mode: z.enum(["hybrid", "semantic", "text"]).default("hybrid"),
+    limit: z.coerce.number().int().min(1).max(200).default(50),
+    offset: z.coerce.number().int().min(0).default(0),
+});
+const NewBody = z.object({
+    content: z.string(),
+    scope: z.enum(["project", "global"]).optional(),
+    project: z.string().nullable().optional(),
+    category: z.string().optional(),
+    importance: z.number().int().optional(),
+    tags: Tags.optional(),
+    pinned: z.boolean().optional(),
+});
+const PatchBody = z.object({
+    content: z.string().optional(),
+    scope: z.enum(["project", "global"]).optional(),
+    project: z.string().nullable().optional(),
+    category: z.string().optional(),
+    importance: z.number().int().optional(),
+    tags: Tags.optional(),
+    pinned: z.boolean().optional(),
+});
+const Id = z.coerce.number().int().positive();
+export function createApi({ store, currentProject }) {
+    const api = new Hono();
+    api.onError((err, c) => {
+        if (err instanceof z.ZodError)
+            return c.json({ error: err.issues.map((i) => `${i.path.join(".") || "request"}: ${i.message}`).join("; ") }, 400);
+        if (err instanceof SyntaxError)
+            return c.json({ error: "Body is not valid JSON." }, 400);
+        if (err instanceof MemiError || err instanceof EmbedError)
+            return c.json({ error: err.message }, 400);
+        console.error(err);
+        return c.json({ error: "Something went wrong. Check the terminal running memi ui." }, 500);
+    });
+    api.get("/status", (c) => c.json({
+        ...store.status(),
+        currentProject,
+        projects: store.projects(),
+        categories: store.categories(),
+    }));
+    api.get("/memories", async (c) => {
+        const q = ListQuery.parse(c.req.query());
+        const filters = {
+            scope: q.scope,
+            project: q.project ?? null,
+            category: q.category,
+            minImportance: q.minImportance,
+            pinned: q.pinned === undefined ? undefined : q.pinned === "true",
+        };
+        if (q.q) {
+            const r = await store.search({ ...filters, query: q.q, mode: q.mode, limit: Math.min(q.limit, 50) });
+            return c.json({
+                items: r.hits.map((h) => h.memory),
+                total: r.hits.length,
+                scores: Object.fromEntries(r.hits.map((h) => [h.memory.id, h.score])),
+                modeUsed: r.modeUsed,
+                note: r.note ?? null,
+            });
+        }
+        return c.json({ ...store.list({ ...filters, order: q.order, limit: q.limit, offset: q.offset }), scores: null, modeUsed: null, note: null });
+    });
+    api.post("/memories", async (c) => {
+        const body = NewBody.parse(await c.req.json());
+        return c.json(await store.add({ ...body, agent: "memi-ui" }), 201);
+    });
+    api.patch("/memories/:id", async (c) => {
+        const id = Id.parse(c.req.param("id"));
+        const result = await store.update(id, PatchBody.parse(await c.req.json()));
+        return result ? c.json(result) : c.json({ error: `No memory with id ${id}.` }, 404);
+    });
+    api.delete("/memories/:id", (c) => {
+        const id = Id.parse(c.req.param("id"));
+        return store.remove(id) ? c.body(null, 204) : c.json({ error: `No memory with id ${id}.` }, 404);
+    });
+    return api;
+}

package/dist/ui/security.js

@@ -0,0 +1,47 @@
+const LOCAL_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
+// Memory text is untrusted (an agent can save anything), so the page may only load its own files.
+const CSP = [
+    "default-src 'none'",
+    "script-src 'self'",
+    "style-src 'self'",
+    "font-src 'self'",
+    "img-src 'self' data:",
+    "connect-src 'self'",
+    "base-uri 'none'",
+    "form-action 'none'",
+    "frame-ancestors 'none'",
+].join("; ");
+const forbidden = (message, status) => Response.json({ error: message }, { status });
+/**
+ * The UI can delete memories, so a web page you happen to have open must not be able to drive it.
+ * - Host check: stops DNS rebinding, where evil.example resolves to 127.0.0.1.
+ * - Origin check and JSON-only bodies: stops cross-site writes. A cross-origin JSON request needs a
+ *   CORS preflight, and this server never answers one.
+ */
+export const guard = async (c, next) => {
+    const url = new URL(c.req.url);
+    if (!LOCAL_HOSTS.has(url.hostname))
+        return forbidden("Forbidden host.", 403);
+    if (c.req.method !== "GET" && c.req.method !== "HEAD") {
+        const origin = c.req.header("origin");
+        if (origin) {
+            let originHost = null;
+            try {
+                originHost = new URL(origin).host;
+            }
+            catch {
+                // "null" and other unparseable origins are rejected below.
+            }
+            if (originHost !== url.host)
+                return forbidden("Forbidden origin.", 403);
+        }
+        if (c.req.method !== "DELETE" && !c.req.header("content-type")?.toLowerCase().startsWith("application/json")) {
+            return forbidden("Send JSON.", 415);
+        }
+    }
+    await next();
+    c.header("Content-Security-Policy", CSP);
+    c.header("X-Content-Type-Options", "nosniff");
+    c.header("Referrer-Policy", "no-referrer");
+    c.header("X-Frame-Options", "DENY");
+};

package/dist/ui/server.js

@@ -0,0 +1,33 @@
+import { serve } from "@hono/node-server";
+import { Hono } from "hono";
+import { resolveProject } from "../core/project.js";
+import { MemiError } from "../core/types.js";
+import { readAsset } from "./assets.js";
+import { createApi } from "./routes.js";
+import { guard } from "./security.js";
+export function createApp(rt, cwd = process.cwd()) {
+    const app = new Hono();
+    app.use("*", guard);
+    app.route("/api", createApi({ store: rt.store, currentProject: resolveProject({ agent: rt.agent, cwd })?.project ?? null }));
+    app.get("*", async (c) => {
+        const asset = await readAsset(new URL(c.req.url).pathname);
+        if (!asset)
+            return c.text("Not found", 404);
+        return c.body(new Uint8Array(asset.body), 200, { "Content-Type": asset.type, "Cache-Control": asset.cache });
+    });
+    return app;
+}
+/** Starts the UI on 127.0.0.1 only. Pass port 0 to let the system pick one. */
+export function startUi(rt, opts) {
+    const app = createApp(rt, opts.cwd);
+    return new Promise((resolve, reject) => {
+        // Without a createServer option, serve() returns a plain HTTP/1 server.
+        const server = serve({ fetch: app.fetch, port: opts.port, hostname: "127.0.0.1" }, (info) => {
+            resolve({
+                url: `http://localhost:${info.port}`,
+                close: () => new Promise((done) => (server.close(() => done()), server.closeAllConnections())),
+            });
+        });
+        server.once("error", (err) => reject(err.code === "EADDRINUSE" ? new MemiError(`Port ${opts.port} is already in use. Pick another with --port.`) : err));
+    });
+}

package/package.json

@@ -1,6 +1,65 @@
 {
   "name": "@pinkpixel/memi",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.0",
+  "description": "Local-first memory for AI agents. SQLite, hybrid search, MCP server, and a small local UI.",
+  "type": "module",
+  "license": "Apache-2.0",
+  "author": "Pink Pixel <admin@pinkpixel.dev> (https://pinkpixel.dev)",
+  "homepage": "https://pinkpixel.dev",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pinkpixel-dev/memi.git"
+  },
+  "bin": {
+    "memi": "dist/cli/index.js"
+  },
+  "files": [
+    "dist",
+    "ui",
+    "skills",
+    "LICENSE",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "prepublishOnly": "npm run typecheck && npm run build",
+    "dev": "tsx src/cli/index.ts",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  },
+  "keywords": [
+    "mcp",
+    "memory",
+    "agents",
+    "sqlite",
+    "embeddings",
+    "ollama",
+    "openai"
+  ],
+  "dependencies": {
+    "@hono/node-server": "^2.1.3",
+    "@modelcontextprotocol/sdk": "^1.32.0",
+    "better-sqlite3": "^13.0.3",
+    "commander": "^15.0.0",
+    "hono": "^4.13.13",
+    "sqlite-vec": "^0.1.9",
+    "zod": "^4.6.5"
+  },
+  "devDependencies": {
+    "@types/better-sqlite3": "^9.6.0",
+    "@types/node": "^26.6.4",
+    "happy-dom": "^20.14.5",
+    "tsx": "^4.23.15",
+    "typescript": "^7.0.2",
+    "vitest": "^5.0.3"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "bugs": {
+    "url": "https://github.com/pinkpixel-dev/memi/issues"
+  }
+}

package/skills/memi-curate/SKILL.md

@@ -0,0 +1,89 @@
+---
+name: memi-curate
+version: 1.0.0
+description: |
+  Review and clean up memories stored in memi: find duplicates, contradictions,
+  stale or vague entries, wrong scope or category, inflated importance, and
+  accidentally saved secrets, then fix them with the user's approval. Use when
+  the user asks to "clean up", "review", "organize", or "audit" memories, when
+  recall keeps returning noise or contradictory results, or when list_memories
+  shows a large pile of low-value entries.
+license: Apache-2.0
+compatibility: claude-code cursor codex gemini-cli opencode
+---
+
+# Curating memi memories
+
+Memories pile up. Over time a store collects near-duplicates, decisions that were later reversed, vague notes nobody can interpret, and categories that drifted. A messy store makes `recall` worse, because contradictory or noisy results waste attention and can lead the next session wrong.
+
+This skill is a careful review. The rule that matters most: **deleting is permanent, so you propose first and the user approves.**
+
+If the user would rather look through memories themselves, `memi ui` opens a browser view where they can search, edit, and delete.
+
+## 1. Survey
+
+1. `list_categories` for the shape of the store.
+2. `list_memories` with `scope: "all"` and `limit: 50`, paging with `offset` until `total` is covered. Use `order: "importance"` to see what is loaded at session start first, then `order: "oldest"` for the stale tail.
+3. If the user only cares about one project, use `scope: "project"` with that `project`. Include `scope: "global"` separately.
+
+Read everything before you judge anything. A "duplicate" is easy to misjudge from one memory.
+
+## 2. Look for these problems
+
+| Problem | How to spot it | Fix |
+|---|---|---|
+| **Duplicate** | Two memories say the same thing | Keep the clearer one (`update_memory` to merge in any detail from the other), `forget` the rest |
+| **Contradiction** | Two memories disagree | Decide which is current. Check the repo or ask the user if unsure. Update or keep that one, `forget` the other |
+| **Stale** | Names a file, flag, host, or version that may no longer exist | Verify against the repo. If it changed, `update_memory`. If it is gone, `forget` |
+| **Vague** | Cannot be understood without the original conversation ("use the second approach") | Rewrite so it stands alone if you can tell what it meant. Otherwise `forget` |
+| **Wrong category** | Lots of `context` that is really a decision, preference, or fact | `update_memory` with the right `category` |
+| **Wrong scope** | A project memory that is really a global preference, or the reverse | `update_memory` with `scope` (and `project` if moving to a project) |
+| **Inflated importance** | A pile of 4s and 5s, or more than about five pinned memories per scope | Lower importance, unpin the rest |
+| **Category sprawl** | Near-identical custom names (`ci`, `cicd`, `ci-cd`) | Move the memories into one category |
+| **Secret** | An API key, token, password, or private key | Tell the user straight away, `forget` it, and tell them the secret should be rotated since it was stored |
+
+Do not fix what is not broken. A short, plain memory that is correct is fine.
+
+## 3. Propose before you change anything
+
+Present a list the user can approve in one pass. Group by action, and give the id, the reason, and the new wording when you rewrite:
+
+```
+Delete (3)
+  #14  duplicate of #9
+  #31  vague: "use the second approach"
+  #40  stale: refers to scripts/old-deploy.sh, which no longer exists
+
+Update (2)
+  #22  fact -> decision; reword: "Auth uses signed cookies, not JWTs, because sessions must be revocable."
+  #27  scope project -> global (it is a tooling preference)
+
+Lower importance (1)
+  #8   5 -> 3
+
+Secrets (0)
+```
+
+Then wait. Apply only what the user approves. If they approve some items, do those and leave the rest.
+
+A secret is the one case where you should say so immediately and not wait for the end of the review. You still need approval before deleting.
+
+## 4. Apply
+
+- `update_memory` for rewording, recategorizing, rescoping, importance, tags, pinning. Changing `content` or scope re-embeds the memory.
+- `forget` for deletions, one id at a time.
+- Merging: update the best memory with the combined content, then `forget` the others.
+
+Note that `update_memory` with `tags` **replaces** the existing tags. Pass the full list you want.
+
+## 5. Report
+
+End with plain counts: how many deleted, updated, left alone, and anything you were unsure about and skipped. If you could not check something against the repo, say so.
+
+## Rules
+
+- Never delete without approval.
+- Never change the meaning of a memory while rewording it. If you are not sure what it meant, ask or leave it.
+- Verify stale-looking details against the repo before calling them stale.
+- Keep the user's own words where they are clear. Do not polish for the sake of it.
+- If a warning like `Saved without a vector` appears while updating, mention it once and carry on.

package/skills/memi-memory/SKILL.md

@@ -0,0 +1,141 @@
+---
+name: memi-memory
+version: 1.0.0
+description: |
+  Use memi, a local long-term memory for AI agents, so knowledge survives between
+  sessions. Use whenever the memi MCP tools (get_context, recall, remember,
+  update_memory, forget, list_memories, list_categories) are available: at the
+  start of a session, before making a decision that earlier sessions may have
+  settled, when the user says "remember", "save this", "do you remember", "what
+  did we decide", "last time", "forget that", or "don't do that again", and after
+  you learn something durable such as a decision, a preference, a fact, or a
+  mistake worth avoiding.
+license: Apache-2.0
+compatibility: claude-code cursor codex gemini-cli opencode
+---
+
+# Using memi memory
+
+memi stores memories in a local SQLite file and finds them by meaning and by keyword. Memories last across sessions, and the same store is shared by every agent on this machine. That makes you responsible for what goes in. A good memory saves the next session real time. A bad one is noise that someone will have to find and delete.
+
+Seven tools do all the work: `get_context`, `recall`, `remember`, `update_memory`, `forget`, `list_memories`, `list_categories`.
+
+## The loop
+
+1. **Start of a session:** call `get_context` once. It returns the pinned and high-importance (4 or 5) memories for this project plus global ones. Treat them as background. Do not read them back to the user.
+2. **While working:** call `recall` when earlier knowledge might change what you do (see below).
+3. **After you learn something durable:** call `remember`.
+4. **When a memory turns out to be wrong:** call `update_memory` or `forget`. Do not leave known-wrong memories behind.
+
+## Recall
+
+Recall before you:
+
+- choose a library, pattern, or architecture
+- answer a question about how this user or project does things
+- start debugging something that might have been hit before
+- act on something the user refers to from the past ("like we did before", "as I said")
+
+Recall tips:
+
+- Describe what you want in plain language: `how does the user want commit messages written`. Searching by meaning works, so you do not need to guess exact words.
+- The default scope `both` covers global memories plus the current project. Use `scope: "all"` only when the user asks about another project.
+- Add `min_importance: 4` when you only want what matters most. Add `category` to narrow down.
+- One or two searches per task is normal. Do not search on every message.
+
+Reading results: each memory starts with `#id | category | importance N | scope | ...`. The score is only useful for comparing results within one search.
+
+**Memories can be stale.** Specific details such as file paths, flags, function names, and versions may have changed since the memory was written. Check against the current code before you act on one. If it is wrong, fix it with `update_memory` or remove it with `forget`.
+
+If a result ends with `Note:`, read it. It usually means search fell back to keywords only. See "Warnings" below.
+
+## Remember
+
+### What belongs
+
+- **Decisions and the reason for them.** "Use SQLite, not Postgres, because the app is local-first and the data is small."
+- **User preferences and corrections.** "Prefers tabs. Wants short answers without a summary at the end."
+- **Durable facts that are not obvious from the code.** "Staging deploys need the VPN."
+- **Mistakes worth not repeating, with the fix.** "Running migrations before the seed script fails. Seed first."
+- **Work the user explicitly deferred.** "Add rate limiting to the upload route later."
+
+### What does not belong
+
+- **Secrets of any kind:** API keys, tokens, passwords, private keys. Never.
+- Anything you can read from the code, the git history, or the docs.
+- Task progress that only matters in this session.
+- Guesses. Save what you verified, or what the user said.
+- Long dumps. One memory is one idea in a few sentences. The hard limit is 8000 characters, and you should rarely come close.
+
+### Write it so it stands alone
+
+A future session will see the memory without this conversation. So:
+
+- Lead with the fact, then the reason.
+- Name things exactly (file, tool, command).
+- Use absolute dates, not "yesterday" or "last week".
+- No pronouns that point back at the conversation ("it", "that approach").
+
+Before: `We decided to go with the second option.`
+After: `Auth uses signed cookies, not JWTs, because sessions must be revocable. Decided 2026-10-04.`
+
+More examples are in `references/examples.md`.
+
+### Choose the fields
+
+| Field | How to choose |
+|---|---|
+| `scope` | `project` for things about this codebase. `global` for things about the user or how they work everywhere. If unsure, project. |
+| `category` | `decision`, `preference`, `fact`, `error`, `todo`, or `context`. Run `list_categories` before inventing a new one. |
+| `importance` | 1 to 5, default 3. See `references/rubrics.md`. Most memories are 2 or 3. |
+| `pinned` | Loaded at the start of every session. Use rarely, for rules where forgetting would cost real time or trust. |
+| `tags` | A few keywords you would search for. Optional. |
+
+`project` is worked out for you. Do not pass it unless the user is talking about a different project by name.
+
+### Handle duplicates
+
+`remember` checks for close matches in the same scope. If the result says `Similar memories already exist`:
+
+- **Same fact:** keep the better one. Call `update_memory` on the older memory with the improved wording, then `forget` the new id you just created.
+- **Related but different** (a new detail, a changed decision): keep both, or update the old one if the new one replaces it.
+
+For anything you suspect is already saved, a quick `recall` first is cheaper than cleaning up later.
+
+### Tell the user, briefly
+
+When you save a preference or a decision on your own initiative, say so in one short line ("Saved a note that you prefer tabs.") so they can correct you. Do not announce routine facts.
+
+## When the user asks directly
+
+- **"Remember X"**: save it right away, then confirm with the id.
+- **"Forget X"**: `recall` to find it. If more than one memory matches, show them and ask which. Then `forget`. Deleting is permanent.
+- **"What do you remember about X"**: `recall`, then summarize in your own words.
+
+## Projects and scope
+
+memi works out the project automatically: the folder name of the git repo you are in. With no git repo, it uses the agent name (`MEMI_AGENT`), stored as `agent:<name>`. With neither, saving a project memory fails with an error that says what to set.
+
+If you hit that error, either save the memory as `global` (if it truly is global) or ask the user for a project name or tell them to set `MEMI_AGENT`. Do not make up a project name.
+
+## Warnings
+
+| You see | What it means | What to do |
+|---|---|---|
+| `Saved without a vector` | Saved, but the embedder was unreachable. It can only be found by keyword for now. | Mention it once. The user can run `memi reindex --missing` when Ollama is back. |
+| `The embedder changed from ...` | The configured embedder no longer matches the stored vectors, so semantic search is off. Keyword search still works. | Tell the user to run `memi reindex`. It asks for confirmation, rebuilds the vectors, and keeps all memories. Do not run it yourself unless asked, because it re-embeds everything. |
+| `No embedder configured` / `No vectors yet` | Keyword search only. | Nothing needed. |
+| Tool error | Bad arguments or a bad id. | Read the message, fix the arguments, retry once. |
+
+## If the memi tools are not available
+
+If the MCP server is not connected but the `memi` command exists, use it from the shell: `memi search "query"`, `memi add "text" -c fact`, `memi list`. If neither is available, say so. Do not claim to remember something you cannot save.
+
+## Quick rules
+
+- `get_context` at the start. `recall` before deciding. `remember` after learning.
+- Never save secrets.
+- Write memories that make sense with no context.
+- Update or forget what is wrong. Do not stack contradictions.
+- Verify stale details before acting on them.
+- When unsure whether something is worth saving, ask: would the next session be worse off without it?

package/skills/memi-memory/references/examples.md

@@ -0,0 +1,50 @@
+# Examples
+
+## Rewriting vague memories
+
+| Before | After | What changed |
+|---|---|---|
+| `Use the new approach.` | `Search runs FTS5 and vector KNN, merged with reciprocal rank fusion, because either alone missed too much.` | Named the approach and gave the reason. |
+| `User likes it short.` | `Prefers short answers with no closing summary. Said so on 2026-10-04.` | Said what "it" is, added a date. |
+| `Fixed the bug with the thing.` | `Uploads over 10MB failed because the proxy limit is 10MB. Raised it in nginx.conf to 50MB.` | Named the symptom, the cause, and the fix. |
+| `Don't forget to test on mobile.` | `Every UI change must be checked at 375px width. The app is used mostly on phones.` | Made the rule concrete. |
+
+## What not to save
+
+| Candidate | Why not |
+|---|---|
+| `The project uses TypeScript.` | Visible from the repo. |
+| `Currently refactoring the auth module.` | Session progress. It will be wrong tomorrow. |
+| `The API key is sk-...` | A secret. Never. |
+| `Maybe we should use Redis?` | A guess, not a decision. |
+| A pasted 300-line stack trace | Too long. Save the cause and the fix in two sentences. |
+
+## A duplicate, handled
+
+You call `remember` with `The user prefers tabs over spaces`. The result says:
+
+```
+Saved memory #14 (global, preference, importance 3).
+
+Similar memories already exist. If one covers this, call update_memory on it and forget #14:
+#9 | preference | importance 4 | global | 2026-09-12
+The user prefers tabs over spaces for indentation
+```
+
+Memory #9 already says it, and with more detail. So delete the new one:
+
+1. `forget` with `{ "id": 14 }`
+
+If the new wording were better, you would first call `update_memory` on #9 with the improved `content`, then forget #14.
+
+## Session start
+
+1. Call `get_context`. It returns, say, four memories: two pinned rules, two important decisions.
+2. Use them silently. If the user asks to change something a decision covers, mention the decision and why it was made.
+3. Later the user says "let's add caching". Call `recall` with `caching decisions and constraints` before proposing anything.
+
+## A memory that turned out wrong
+
+`recall` returns `#22 | fact | ... | The staging database is at db-staging-1.` While working you find the host is now `db-staging-2`.
+
+Call `update_memory` with `{ "id": 22, "content": "The staging database is at db-staging-2 (moved from db-staging-1 on 2026-10-04)." }`. Do not save a second memory next to it.

package/skills/memi-memory/references/rubrics.md

@@ -0,0 +1,44 @@
+# Rubrics for memi memories
+
+Use these when the choice of importance, category, scope, or pinning is not obvious.
+
+## Importance
+
+| Level | Meaning | Examples |
+|---|---|---|
+| 1 | Minor. Nice to know, harmless to forget. | "The old build script is in `scripts/legacy/`." |
+| 2 | Useful detail. | "Dev server runs on port 5174 because 5173 is taken." |
+| 3 | Normal. Default. Worth having next session. | "API errors use the `{ error, code }` shape." |
+| 4 | Important. Getting it wrong costs real time. Loaded by `get_context`. | "Never run migrations on the shared staging database without asking." |
+| 5 | Critical. A rule or fact that must never be missed. Loaded by `get_context`. | "Production deploys are manual. Never trigger one from a script." |
+
+Most memories should be 2 or 3. If everything is a 4 or 5, `get_context` stops being useful. Search results are also nudged by importance, so inflating it distorts ranking.
+
+## Pinning
+
+Pinned memories load at the start of every session whatever their importance. Pin only what would hurt if a session started without it. A reasonable ceiling is about five pinned memories per scope. If you want to pin a sixth, unpin or merge one first.
+
+Pinning and importance 4 or 5 do the same job for `get_context`. Use importance for "this matters" and pinning for "this must always be loaded". In practice you rarely need both.
+
+## Categories
+
+| Category | Use for | Not for |
+|---|---|---|
+| `decision` | A choice that was made, with the reason, and ideally what was rejected | Preferences with no trade-off |
+| `preference` | How the user likes things done | Facts about the system |
+| `fact` | Durable truth about the project, system, or user | Anything that will be false next week |
+| `error` | Something that failed, what caused it, and the fix | Bugs that are already fixed and will not recur |
+| `todo` | Work explicitly deferred | Your own in-session task list |
+| `context` | Background that helps orient a future session (the default) | Anything that fits a more specific category |
+
+Custom categories are created the first time you use a name. Keep them short and lowercase (letters, numbers, dashes, underscores, up to 32 characters). Run `list_categories` first, because `ci` and `cicd` splitting the same topic helps nobody. Prefer a built-in category unless a custom one will hold several memories.
+
+## Scope
+
+| Question | If yes |
+|---|---|
+| Is it about the user, how they work, or their tools across projects? | `global` |
+| Would it be wrong or confusing in a different project? | `project` |
+| Is it a coding convention for one repo? | `project` |
+| Is it a personal preference that applies to every repo (tabs, tone, tools)? | `global` |
+| Not sure? | `project`. It is easier to promote later (`update_memory` with `scope: "global"`) than to find a stray global memory. |