@staix/agent-mem 0.3.1 → 0.4.0

package/README.md

@@ -2,7 +2,7 @@
 
 Curated memory with append-only JSONL logs, a derived SQLite index, short- and long-term tiers, a typed graph, goals with leases, and git sync between machines. Extracted from [agent-hub](https://github.com/STAIxBWLB/agent-hub), with compatible storage and entry IDs.
 
-Version: 0.3.1. Requires Bun 1.4.2 or later; no runtime dependencies.
+Version: 0.4.0. Requires Bun 1.4.2 or later; no runtime dependencies.
 
 ## Install
 
@@ -32,11 +32,11 @@ amem goal new "Ship a release" --milestone "Review changes"
 
 `amem goal link` requires the host task boundary; use `ahub goal link` for board links.
 
-Memory commands: `list`, `search`, `show`, `graph`, `suggestions`, `confirm`, `reject`, `promote`, `demote`, `forget`, `supersede`, `rebuild`, `dedupe`, `sync`, `machine`, and `import`. Use `--json` where supported by the corresponding `ahub memory` command. `dedupe` previews candidates; `dedupe --apply` appends reconciliation operations.
+Memory commands: `list`, `search`, `show`, `graph`, `suggestions`, `confirm`, `reject`, `promote`, `demote`, `forget`, `supersede`, `rebuild`, `dedupe`, `sync`, `machine`, and `import`. Use `--json` where supported by the corresponding `ahub memory` command. `dedupe` previews candidates; `dedupe --apply` appends reconciliation operations. `amem alias add|list` manages person-reviewed project key aliases; `amem capacity` reports and proposes capture bounds (see below).
 
-`amem` is for the person. Every command is refused when an agent-session marker is present, including `AGENTHUB_PEER_ID`, `CLAUDECODE`, and `CODEX_THREAD_ID`. Agents read memory through the hub's `hub_memory_*` tools. Environment-marker detection is an honest-session guard, not authentication. Mutating commands also require a TTY on stdin.
+Ordinary `amem` commands are for the person and refuse agent-session markers, including `AGENTHUB_PEER_ID`, `CLAUDECODE`, and `CODEX_THREAD_ID`. `amem mcp` is the sole intentional session agent entrypoint; it supplies scoped reads and bounded candidate/work-list writes, never direct curated-note writes. Hosted agents can also use the hub's `hub_memory_*` read tools. Environment-marker detection is an honest-session guard, not authentication. Ordinary CLI mutations remain person-only and require a TTY on stdin.
 
-This package does not ship the host's privacy policy. Person reads show stored data without screening. Import and promotion retain the built-in secret screen. Commands that cross the privacy boundary require the person's explicit `--policy-free` choice:
+This package does not ship the host's privacy policy. Ordinary person reads show stored data without screening; the vault-candidate listing uses its current policy. Import and promotion retain the built-in secret screen. Commands that cross the privacy boundary require the person's explicit `--policy-free` choice:
 
 ```sh
 amem promote <id> --policy-free
@@ -131,6 +131,18 @@ These interactive checks remain unrun until a person checks them in each install
 
 The JSONL segments are authoritative. `index.db` is derived and can be rebuilt. Entries are immutable; changes append operations. The compatibility schema remains `agent-hub.memory/v1` because it participates in entry IDs.
 
+## Capture tier and full-text search
+
+From issue #13 (phase P1), the package carries a second, machine-local tier beside the curated store, born sharded (#15 T1): one capture shard per project key at `projects/<key-hash>/machine/<machine-id>/` under the memory home, with its own locks so two projects never contend. The capture tier records deterministic tool-event rows (project, agent, event, tool, paths, exit status and a bounded, secret-screened excerpt) in the shard's `capture.db`. It is never synced, never read as curated evidence, and never writes a curated log, so its maintenance can never evict notes, goals or work lists. Capture is bounded by a soft size cap and a retention window (defaults 512 MB per shard, 90 days), resolved at every invocation from the library options, then the shard's `config.json`, then the home default `capture-config.json`; eviction removes the oldest capture rows first in bounded batches. The 2026-10-17 owner decision keeps the P1 cap per shard; the machine-wide total is #15 T5. On lock contention a writer appends to an append-only spool and exits fast; the next uncontended writer replays the spool idempotently. The capture path makes no network or model call. The pre-T1 machine-wide `capture/` (an unreleased layout of this branch) is migrated per project on open and removed once empty.
+
+Project identity (#15 D2) keeps `memoryProjectKey`: a worktree, a submodule and the main checkout of one repository share its key; two unrelated same-named repositories without a remote get distinct path-hash keys, flagged `local` in the shard's `project.json` and the catalog. A no-remote key hashes the main working root (using the actual top-level for a separate git dir), so keys written from the repository root keep their pre-#15 value. Known limit: a linked worktree of a no-remote separate-git-dir repository gets its own key, because git does not record that repository's main working root (probe: `alpha` and `alpha/sub` share `alpha@<hash>`, `alpha-wt` gets `alpha-wt@<hash>`); the key stays as is for root-key compatibility, and a reviewed alias reconciles its capture. Keys written by older builds from a subdirectory or worktree still used that invocation's cwd hash; a person-reviewed alias maps such a key to its canonical one for capture, work lists and the CLI and MCP project binding. Curated rows written under the old key keep it and are not remapped, so the CLI and MCP stop showing that key's project-scoped notes, goals and candidates (the library still reads them by the raw key; shared rows stay visible). An alias can be retargeted but not removed, so add one only after checking the old key's private notes; curated row reconciliation is a later spec change. `amem alias add <from-key> <to-key>` appends an op to `aliases.jsonl` (latest wins, never chained, never automatic), `amem alias list` shows the ops. `catalog.db` in the memory home (#15 D3's storage part) is derived only from the shards and the alias log and rebuilds to the same rows; the D3 management commands are #15 T5 and not built.
+
+`store.search(query, filter)` searches the curated tier and the current project's capture shard with SQLite FTS5 and BM25 plus tier/recency weighting: natural multi-word queries match partial term sets (the substring filter required every word), and a curated row outranks the same text in the capture tier. Prefix terms match inflections and Korean particles in either direction by retaining the original query term and adding a common-particle-stripped alternative. The FTS copy of the curated rows lives in its own derived `search.db` (`index.db`'s table set is a frozen contract and gains nothing); it is written from the same apply path as the index, and a prune, crash or rebuild is detected and resynced, so the incremental FTS copy equals a full resync. Where FTS5 is unavailable the engine falls back to the substring filter and reports `engine: "substring"`; capture recall needs FTS5 and is skipped in the fallback. The library entry exports `CaptureStore`, `captureSearch`, `readCaptureConfig`, `writeCaptureConfig`, `SearchIndex`, `fts5Available`, the shard helpers (`resolveAlias`, `appendAlias`, `listAliases`, `shardKeyHash`), the catalog (`rebuildCatalog`, `readCatalog`, `scanCatalog`) and the capacity advisor (`capacityReport`).
+
+The R7 capacity advisor reports this machine's load and proposes capture bounds: `amem capacity [--json]` shows capture size and growth, disk, memory, the rolling `metrics.jsonl` readings and the proposal with its binding constraint; `amem capacity apply [--cap-mb N] [--retention-days N]` saves a preview, and only a matching later `--confirm` writes the home default config. Applying is person-only (agent markers refused, a terminal required); an agent may read the proposal through the library, never apply it. The 2026-10-17 owner decision keeps P1 shrink-only; growth proposals are a follow-up after the agent-hub release, while explicit person-directed growth remains available through `apply --cap-mb N`. Benchmark samples stay in the measuring script's synthetic home; only real hook and search invocations feed the advisor's rolling metrics.
+
+Resource budgets are acceptance criteria, measured by `bun scripts/measure-budget.ts` in CI on Ubuntu and macOS: a hook-like append (including the spool-and-exit path under contention) must stay under 150 ms p95 wall time and 100 MB peak RSS (R2), the search path under 100 MB idle and 200 MB peak RSS (R3), and no amem process may remain after exit (R1). The script prints a machine-readable verdict per budget and its CI log is also the FTS5 availability evidence for Linux (R5). The AC4 retrieval re-check of the frozen P0 query set is in [docs/p1-ac4-recheck.md](https://github.com/STAIxBWLB/agent-mem/blob/main/docs/p1-ac4-recheck.md).
+
 ## Library
 
 ```ts
@@ -151,7 +163,7 @@ The entry point exports the store, types and identity helpers, sync and claude-m
 
 ## Contracts
 
-Shared segments retain the `agent-hub.memory/v1` profile. `OP_CONTRACTS` and `V1_OPS` keep the shared-v1 operation contract; both shared append paths refuse unknown or truth-changing operations. The separate `GENERATION_OP_CONTRACTS` enables only `prune` after an explicit generation selection. `correct`, `lift`, `consolidate` and `group` remain blocked. Reader announcements cannot authorize a new operation or relax generation isolation.
+Shared segments retain the `agent-hub.memory/v1` profile. `OP_CONTRACTS` and `V1_OPS` keep the shared-v1 operation contract; both shared append paths refuse unknown or truth-changing operations. The separate `GENERATION_OP_CONTRACTS` enables `prune` and local exact-entry `vault_link` after an explicit generation selection. `correct`, `lift`, `consolidate` and `group` remain blocked. Reader announcements cannot authorize a new operation or relax generation isolation.
 
 The shared-v1 contract suites run the published 0.1.1 reader and compare all six v1 derived tables after replay and rebuild; generation fixtures cover their expanded derived state separately. Privacy and evidence matrices test the core's actual callbacks and sidecar boundaries; model-facing reads, PII turns, staleness checks and capture remain the host's responsibility. Direct person reads remain unscreened. Expiry after a wall-clock rollback retains the existing C05 ceiling: a rebuild can restore a previously expired row until its deadline passes again. A generation can persist exact-entry prune; shared-v1 and unpruned entries retain their existing expiry limitations.
 
@@ -192,10 +204,66 @@ Only explicit serialized expiry is eligible: a note's `expires`, or an exact dem
 
 Standalone CLI prune is local-only, even over a synced target. No `--policy-free` escape enables public prune. A later policy-aware host integration must authenticate intent and attest the exact public payload and current policy revision; only verified public target/basis provenance may sync. Local masks, plans, journals, caches and sidecars never sync. Generation sync refuses public or unknown remote visibility. An interrupted apply resumes the same durable row IDs and exact partial tail; it never rewrites complete lines.
 
-Candidate/counter sidecars are not migrated. `amem review` currently refuses a selected generation rather than using an unbound legacy sidecar. A profile-aware host integration must handle that context explicitly.
+Candidate/counter sidecars are not migrated. `amem review list --kind memory` lists the new machine-local memory candidates under a selected generation; the default legacy review list retains its generation refusal. General memory candidates can be accepted by the person with `review accept --kind memory` into the current project store after current standalone screening; older correction/fail candidates still require profile-aware host integration for generation acceptance.
 
 Real migration remains blocked until the separately reviewed generation-capable amem release and exact-pinned agent-hub integration are installed and their running stores prove the same home/G/selector revision. Synthetic cross-writes and exact prune readbacks precede separately confirmed real migration; known local handles must be quiesced/closed and reopened through the supported session-preserving lifecycle. Release, deployment, real migration, host evidence/capture receipts and real multi-machine sync are not established by these source changes. Deactivation omits generation-only notes/prunes from the v1 view and is not a lossless rollback.
 
+## Curated shard migration (#15 T2)
+
+`amem migrate --shards` moves the curated single home into `projects/<key-hash>/` and `user/` through a resumable generation journal. The original single-home log bytes are never rewritten. A populated selected generation is supported and keeps its generation ID. Each shard keeps private legacy inputs in read-only `legacy/`, public-main inputs in read-only `legacy-main/`, and generation-born rows in its own `log/` and `local/`. It has its own `index.db`, `search.db` and mutation lock; original IDs, hashes, placement and own/local/public provenance are preserved. The source generation bytes stay unchanged. Immutable prune proofs are validated before effects; a multi-shard prune is translated into one deterministic row per shard, with a receipt naming the original row. Existing capture and `work/` directories are not migration inputs and are left untouched. `catalog.db` remains derived and rebuildable, now including curated entry counts and last use. Per-shard sync refs are T3 and are not built.
+
+Before splitting a live home, every installed host must open it through `openShardStore({ project })` or the explicit user shard. Plain `new MemoryStore()` refuses any split marker, including an interrupted split, so it cannot silently keep writing the old layout. No host capability registry currently exists; migration preflight output states that limitation. Do not release T2 for agent-hub use until its memory factory is integrated with `openShardStore` and that host version is installed. Existing unannounced older builds remain the documented unchanged-source ceiling.
+
+Use the same synthetic-home and person-authority boundaries as generation migration:
+
+```sh
+AMEM_HOME=/path/to/synthetic-memory amem migrate --shards --dry-run
+AMEM_HOME=/path/to/synthetic-memory amem migrate --shards
+AMEM_HOME=/path/to/synthetic-memory amem status
+# Later old-layout appends are reported by status and carried in idempotently:
+AMEM_HOME=/path/to/synthetic-memory amem migrate --resume
+```
+
+Every ordinary build that reads the single-home layout holds a cooperating lease in `readers/<pid>-<start-signature>.json`, renewed within 30 seconds and removed on close. Apply and resume refuse a live or unverifiable lease and remove only leases whose pid is confirmed gone. Removed lease filenames and times are recorded in the migration journal and status; registration also refuses while the profile lock is held. Published builds without leases cannot be detected: no process scan proves their absence, and their safety rests only on unchanged legacy bytes. Old-format writers may still append after the split; `amem status` reports those rows and resume carries them into the proper shards. A resume with pending work marks the split incomplete before copying; reads and writes through new or existing shard handles refuse until complete activation. `amem status` then reports the captured phase and pending rows, and `migrate --resume` finishes it idempotently.
+
+Library callers open an already sealed shard directly with `openShardStore({ home, project })` or `openShardStore({ home, user: true })`; these opens do not scan the legacy home or walk the catalog. A project handle reads its own shard plus the user overlay, merging lifecycle metadata before applying visibility; it never reads another project's private text. Shared notes and goals written through a project handle go to `user/`, including their lifecycle operations. Project entries accept only their own project key, while the user shard accepts shared entries. `store.dir` names the selected shard; `store.profile.home` remains the base memory directory. Library callers with a direct base path can use `memoryDir` instead of the historical parent `home` option. Two project shards have independent writer locks, and each incremental index equals its rebuild. `bun scripts/measure-shard-ac8.ts` builds 20 projects and 200,000 entries, poisons the other 19 indexes, and measures open plus ten searches on one shard against the R3 idle/peak RSS limits.
+
+Dry run reports v1, generation-owned/local, prune and translated-prune counts, plus refused relations. A private-to-private replacement across projects refuses before effects. A shared entry superseded by a private entry also refuses: the dry run reports `shared superseded by private: N` and entry IDs only. Un-supersede it, or promote the replacement to shared, then rerun. `ponytail:` supporting that direction requires a body-free lifecycle witness; revisit when a read-only dry run on a copy of the person's home reports a nonzero count, never by probing or migrating the live home here. Private-to-shared replacements remain supported. See [the T2 contract](docs/curated-shard-migration.md).
+
+After a split, ordinary generation `amem migrate` modes (including `--deactivate`) refuse without changing the selector. Use `amem migrate --shards --resume` to finish the split. General memory candidates can be accepted with `review accept --kind memory` into the selected project shard after standalone screening; correction/fail candidates still refuse pending shard-aware host integration. Default `prune` selects the current project's shard; use the person-only `amem prune --user --cutoff <UTC> --dry-run` and `amem prune --user --apply --plan <file>` for shared/user entries. The actor and current-project authorization checks are unchanged.
+
+A native shard crash tail is left to its original writer's recovery. Migration checks planned copy tails and translation-receipt tails before changing activation; matching copies finish append-only and mismatches give an inspection hint. Dangling lifecycle/suggestion metadata is carried as ids-only user data and counted, so a target arriving later retains its intent. Cross-private replacements have their own ids-only count and the un-supersede/promote-to-shared remedy. During interruption the catalog keeps capture information available while `curatedEntries` is `null` and `curatedAvailable` is `false`; its cached capture counts may still lag.
+
+## Session MCP and work lists (#13 P2)
+
+Run `amem mcp` as a stdio child of the agent CLI. It binds the working directory, canonical project key, exact memory home and selected profile once, accepts no project/home overrides in tool arguments, and closes all stores on stdin EOF. It has no listener, daemon, watcher or model call. Ordinary person commands retain their agent-marker refusal and mutation TTY checks; `mcp` is the sole agent entry point.
+
+The frozen nine-tool contract for dotfiles#255 and maru#458:
+
+| Tool | Purpose |
+| --- | --- |
+| `amem_search` | Screened project search, FTS5/BM25 with tier/recency ranking |
+| `amem_show` | Exact or unique-prefix curated note; explicit `capture:<id>` recall |
+| `amem_timeline` | Screened notes and labelled capture near an id or time |
+| `amem_graph` | Screened curated note neighbourhood, excluding capture and candidate data |
+| `amem_work_state_read` | Project work lists, optional closed lists/items |
+| `amem_work_state_write` | Append scalar fields, null clears, task selects an item |
+| `amem_remember` | General memory candidate only, awaiting person acceptance |
+| `amem_vault_candidates` | Read-only screened durable curated notes |
+| `amem_capacity` | Numeric machine capacity proposal; no apply capability |
+
+Search/show/timeline label capture as recall with `evidence: false`; capture never enters the curated graph. Policy screens complete rows before selection, limits or graph construction. The standalone secret screen, private flags, PII patterns and deny paths compose with a host's stricter policy through `createMemoryMcp({cwd, base, policy})`. Screening errors fail closed. `base` is the exact memory root; historical library `home` options still name its parent. Scope and profile changes refuse further access instead of silently reopening another store. Reads refuse above 5,000 rows per curated/capture tier; work-list reads use the same 5,000-entry scan ceiling. Count-first admission refuses an oversized work-list corpus before loading or parsing its fields, rather than returning an incomplete screened result. These are operational ceilings, not exposed counts of unscreened data. Graphs cover curated-note relationships, not goal/suggestion tables.
+
+`WorkListStore` writes `projects/<key-hash>/work/` with its own append log, derived index and lock. Scalar fields reduce by latest value, null clears, list status `done` closes, and item status is `todo|doing|done|dropped`. Work lists are outside generation selection and capture eviction. `amem import claude-mem` additionally imports `work_state_entries` only through persisted person-reviewed D2 aliases, preserving source DB bytes and stable replay receipts; JSON keeps observation fields and adds `work` counts/cursor.
+
+`amem vault-candidates --json` and the MCP read tool select durable long-term notes under current policy, excluding task/review/PR/CI progress and already-linked entries. The deterministic status filter covers English status phrases and can miss paraphrased or other-language status text; candidates require person review. No vault is opened, indexed or written. Library `recordVaultLink` records an exact-entry hash and relative Markdown path in a generation-only local append op; it survives index rebuild and shard migration, stays machine-local, and does not change shared-v1 schemas or sync semantics. There is no MCP link writer.
+
+Do not record vault links on a home shared with a host using published agent-mem 0.3.1, including agent-hub while its exact pin stays at 0.3.1. That reader can keep listing from a shared derived index already advanced by the P2 writer, but its next full rebuild refuses the unknown operation. An independent unadvanced index refuses on refresh too. The compatibility fixture omits derived indexes and therefore forces this rebuild refusal on open. Upgrade the sharing host to a pin that includes P2 vault-link support before recording the first link; an ordinary successful list is not rollout readiness. See [the vault-link compatibility contract](docs/contracts.md#generation-only-vault-links).
+
+General memory candidates are separate from curated evidence. `amem review accept <id> --kind memory --policy-free` remains person-only and rechecks the current standalone privacy policy before the accepted note append. Machine capacity reports numeric aggregate use across shards, as R7 requires; it does not return foreign project names or text.
+
+`bun scripts/measure-mcp-budget.ts` exercises an actual stdio session with 200 curated notes, 2,000 capture rows and 2,000 work-list operations reduced into 100 items. It checks the R3 idle RSS limit of 100 MB, peak RSS limit of 200 MB across searches and work-list reads, and child reaping after EOF. CI runs the harness on macOS and Linux. All harness data is synthetic; live P6 measurements remain separate.
+
 ## Development
 
 ```sh

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-mem",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "Curated, shared memory for coding agents: append-only logs, a derived index, tiers and a typed graph.",
   "license": "MIT",
   "type": "module",
@@ -15,14 +15,15 @@
     "@types/bun": "^1.3.0",
     "typescript": "^5.8.0",
     "@staix/agent-mem-v1": "npm:@staix/agent-mem@0.1.1",
-    "@staix/agent-mem-v02": "npm:@staix/agent-mem@0.2.0"
+    "@staix/agent-mem-v02": "npm:@staix/agent-mem@0.2.0",
+    "@staix/agent-mem-pre-vault": "npm:@staix/agent-mem@0.3.1"
   },
   "exports": {
     ".": "./src/index.ts",
     "./platform": "./src/memory/platform.ts"
   },
   "bin": {
-    "amem": "./bin/amem.js"
+    "amem": "bin/amem.js"
   },
   "files": [
     "src/",

package/src/cli.ts

@@ -1,14 +1,24 @@
-import { closeSync, constants, fstatSync, openSync, readFileSync, readSync } from "node:fs";
-import { MemoryStore, looksSecret } from "./memory/store.ts";
+import { createMemoryMcp } from "./mcp-memory.ts";
+import { serveMcp } from "./mcp.ts";
+import { createStandalonePolicy } from "./memory/policy.ts";
+import { vaultCandidates } from "./memory/vault.ts";
+import { importClaudeMemWorkState } from "./memory/import.ts";
+import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync, readSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { MemoryStore, looksSecret, machineId, openShardStore, type StoreOptions } from "./memory/store.ts";
 import { rawMemoryCommand, rawGoalCommand } from "./memory/commands.ts";
 import { memoryProjectKey } from "./memory/project.ts";
 import { CandidateStore, type CandidateFilter } from "./memory/candidates.ts";
+import { appendAlias, listAliases, readShardedSelection, resolveAlias } from "./memory/shard.ts";
+import { capacityReport, capacityText } from "./memory/capacity.ts";
+import { readCaptureConfigFile, writeCaptureConfigFile, type CaptureConfig } from "./memory/capture.ts";
 
 import { commandHelp, parseCommand } from "./commands-table.ts";
 import { completionScript } from "./completion.ts";
 import { memoryHome } from "./memory/home.ts";
 import { resolveProfile } from "./memory/generation.ts";
 import { migrate } from "./memory/migrate.ts";
+import { migrateShards, shardMigrationStatus } from "./memory/shard-migration.ts";
 import { applyPrune, planPrune, PRUNE_PLAN_MAX_BYTES } from "./memory/prune.ts";
 
 export const PERSON_ONLY = "amem is for the person; agents read memory through the hub's hub_memory_* tools";
@@ -55,7 +65,25 @@ export function agentMarked(env: Readonly<Record<string, string | undefined>>):
   return ["AGENTHUB_PEER_ID", "CLAUDECODE", "CLAUDE_CODE_SESSION_ID", "CODEX_THREAD_ID"].some(key => env[key] !== undefined);
 }
 
+function shardStatePresent(): boolean {
+  try { lstatSync(join(memoryHome(), "shards.json")); return true; }
+  catch (error) { if ((error as NodeJS.ErrnoException).code === "ENOENT") return false; throw error; }
+}
+
+function curatedStore(project: string, opts: StoreOptions): MemoryStore {
+  if (shardStatePresent()) {
+    readShardedSelection(memoryHome());
+    return openShardStore({ ...opts, project });
+  }
+  return new MemoryStore(opts);
+}
+
 export async function runCli(argv: readonly string[], context: CliContext = {}): Promise<string> {
+  if (argv.length === 1 && argv[0] === "mcp") {
+    const memory = createMemoryMcp({ cwd: context.cwd ?? process.cwd(), base: memoryHome(context.env ?? process.env) });
+    await serveMcp({ tools: memory.tools, close: memory.close, version: VERSION });
+    return "";
+  }
   if (agentMarked(context.env ?? process.env)) throw new Error(PERSON_ONLY);
   if (argv[0] === "--version" || argv[0] === "version") return `amem ${VERSION}`;
   if (argv[0] === "--help" || argv[0] === "help" || argv.includes("--help")) return commandHelp();
@@ -79,30 +107,48 @@ export async function runCli(argv: readonly string[], context: CliContext = {}):
   if (definition.policyFree && !policyFree) {
     throw new Error(review ? "review accept requires --policy-free; use ahub memory to apply the host's privacy policy" : `${sub} requires --policy-free; use ahub memory ${sub} to apply the host's privacy policy`);
   }
+  let canonicalProject: string | undefined;
+  const boundProject = () => canonicalProject ??= resolveAlias(memoryHome(), memoryProjectKey(context.cwd ?? process.cwd()));
   if (sub === "migrate") {
     const modes = ["--dry-run", "--resume", "--deactivate"].filter(key => options[key] === true);
     if (modes.length > 1) throw new Error("migration modes are mutually exclusive");
     const mode = options["--dry-run"] ? "dry-run" : options["--resume"] ? "resume" : options["--deactivate"] ? "deactivate" : "apply";
-    return JSON.stringify(await migrate({ memoryDir: memoryHome(), mode, ...(options["--generation"] ? { generation: String(options["--generation"]) } : {}), authorizedPerson: true, tty: true }), null, 2);
+    const common = { memoryDir: memoryHome(), ...(options["--generation"] ? { generation: String(options["--generation"]) } : {}), authorizedPerson: true, tty: true };
+    const shardRequested = options["--shards"] === true || (mode === "resume" && shardStatePresent());
+    if (shardRequested) {
+      if (mode === "deactivate") throw new Error("--deactivate is not a shard migration mode");
+      return JSON.stringify(await migrateShards({ ...common, mode }), null, 2);
+    }
+    return JSON.stringify(await migrate({ ...common, mode }), null, 2);
   }
+  if (sub === "status") return JSON.stringify(shardMigrationStatus(memoryHome()), null, 2);
   if (sub === "prune") {
     const applying = options["--apply"] === true;
-    if (applying ? options["--dry-run"] || options["--cutoff"] || !options["--plan"] : !options["--dry-run"] || !options["--cutoff"] || options["--plan"]) throw new Error("usage: amem prune --cutoff <UTC> --dry-run | --apply --plan <file>");
+    if (applying ? options["--dry-run"] || options["--cutoff"] || !options["--plan"] : !options["--dry-run"] || !options["--cutoff"] || options["--plan"]) throw new Error("usage: amem prune [--user] --cutoff <UTC> --dry-run | [--user] --apply --plan <file>");
     let input: string | undefined;
     if (applying) {
       input = readPrunePlanFile(String(options["--plan"]));
     }
-    const store = new MemoryStore({ deferPromotions: true });
+    const project = boundProject();
+    if (options["--user"] === true) {
+      if (!shardStatePresent()) throw new Error("prune --user requires an active curated shard migration; the default prune command selects the current project");
+      readShardedSelection(memoryHome());
+    }
+    const store = options["--user"] === true
+      ? openShardStore({ memoryDir: memoryHome(), user: true, deferPromotions: true })
+      : curatedStore(project, { deferPromotions: true });
     try {
-      const auth = { project: memoryProjectKey(context.cwd ?? process.cwd()), actor: "person" as const, authorize: () => true };
+      const auth = { project, actor: "person" as const, authorize: () => true };
       return JSON.stringify(applying ? applyPrune(store.prunePort(), input, auth) : planPrune(store.prunePort(), { cutoff: String(options["--cutoff"]) }, auth), null, 2);
     } finally { store.close(); }
   }
   if (review) {
-    if (resolveProfile(memoryHome()).kind === "generation") throw new Error("candidate review is not yet integrated with this generation; use the profile-aware host after its integration");
+    if (sub === "accept" && options["--kind"] !== "memory" && shardStatePresent()) throw new Error("candidate acceptance requires shard-aware review integration; use --kind memory only for a general memory candidate");
+    if (sub === "accept" && options["--kind"] !== "memory" && resolveProfile(memoryHome()).kind === "generation") throw new Error("candidate review is not yet integrated with this generation; use --kind memory only for a general memory candidate");
+    if (sub === "list" && options["--kind"] !== "memory" && resolveProfile(memoryHome()).kind === "generation") throw new Error("candidate review is not yet integrated with this generation; select --kind memory for the standalone memory candidate surface");
     const id = parsed.positionals[0];
     if (sub !== "list" && (!id || !/^[a-f0-9]{64}$/.test(id))) throw new Error("review accept/reject requires a full 64-character candidate id");
-    const project = memoryProjectKey(context.cwd ?? process.cwd()), candidates = new CandidateStore();
+    const project = boundProject(), candidates = new CandidateStore();
     try {
       if (sub === "list") {
         const rows = candidates.list({ project, ...(options["--status"] ? { status: options["--status"] as CandidateFilter["status"] } : {}),
@@ -115,34 +161,89 @@ export async function runCli(argv: readonly string[], context: CliContext = {}):
       }
       const candidate = candidates.get(id!, project);
       if (!candidate) throw new Error("candidate unavailable");
+      if (options["--kind"] === "memory" && candidate.input.kind !== "memory") throw new Error("--kind memory accepts only a general memory candidate");
       if (candidate.input.kind === "decay") throw new Error("decay candidates are listing-only; use ahub memory demote or forget after review");
+      if (candidate.input.kind !== "memory" && (shardStatePresent() || resolveProfile(memoryHome()).kind === "generation")) throw new Error("candidate acceptance requires shard-aware and profile-aware host integration for this candidate kind; the candidate remains pending");
+      const standalone = createStandalonePolicy();
+      if (!await standalone.screen(candidate.input)) throw new Error("candidate refused by current host policy; current standalone privacy policy declined it");
       // Candidate acceptance uses the actual secret screen; the core defers unrelated automatic promotions.
-      const store = new MemoryStore({ deferPromotions: true, screen: note => looksSecret(`${note.title ?? ""}\n${note.text}`) ? "keep" : "promote" });
+      const store = curatedStore(project, { deferPromotions: true, screen: note => looksSecret(`${note.title ?? ""}\n${note.text}`) ? "keep" : "promote" });
       try {
         const result = candidates.accept(id!, { project, actor: "person", verdict: "public", store,
           policy: (proposal, _target, note) => !looksSecret(JSON.stringify(proposal.input)) && !looksSecret(JSON.stringify(note)),
         });
-        return options["--json"] ? JSON.stringify(result, null, 2) : `accepted candidate ${id} as ordinary v1 note ${result.noteId}`;
+        return options["--json"] ? JSON.stringify(result, null, 2) : `accepted candidate ${id} as ordinary note ${result.noteId}`;
       } finally { store.close(); }
     } finally { candidates.close(); }
   }
+  if (sub === "vault-candidates") {
+    const project = boundProject(), store = curatedStore(project, { deferPromotions: true });
+    try {
+      const result = await vaultCandidates(store, { project, policy: createStandalonePolicy(), ...(options["--limit"] ? { limit: Number(options["--limit"]) } : {}) });
+      return JSON.stringify(result, null, 2);
+    } finally { store.close(); }
+  }
+  if (sub === "capacity") {
+    const share = options["--disk-share"];
+    if (share !== undefined && (!Number.isFinite(Number(share)) || Number(share) <= 0 || Number(share) > 1)) throw new Error("--disk-share must be a number in (0, 1]");
+    const report = capacityReport({ ...(share !== undefined ? { diskShare: Number(share) } : {}) });
+    if (parsed.path[1] !== "apply") return options["--json"] ? JSON.stringify(report, null, 2) : capacityText(report);
+    // Person-only (agent marker and TTY are refused above): preview first, --confirm writes the home default config.
+    const file = join(memoryHome(), "capture-config.json");
+    const target: CaptureConfig = {
+      capMb: options["--cap-mb"] ? Number(options["--cap-mb"]) : report.proposal.capMb,
+      retentionDays: options["--retention-days"] ? Number(options["--retention-days"]) : report.proposal.retentionDays,
+    };
+    if (!Number.isFinite(target.capMb) || target.capMb <= 0 || !Number.isFinite(target.retentionDays) || target.retentionDays <= 0) throw new Error("capacity apply needs positive --cap-mb and --retention-days");
+    const preview = { file, current: readCaptureConfigFile(file), target, reason: report.proposal.reason };
+    const previewFile = join(memoryHome(), "capture-config.preview.json");
+    if (options["--confirm"] !== true) {
+      writeFileSync(previewFile, JSON.stringify(preview) + "\n", { mode: 0o600 });
+      return JSON.stringify({ preview, confirm: "re-run with --confirm to write" }, null, 2);
+    }
+    let approved: { file?: string; current?: unknown; target?: CaptureConfig };
+    try { approved = JSON.parse(readFileSync(previewFile, "utf8")) as typeof approved; }
+    catch { throw new Error("capacity apply needs a preview first; re-run without --confirm"); }
+    if (approved.file !== file || JSON.stringify(approved.current) !== JSON.stringify(preview.current)
+      || approved.target?.capMb !== target.capMb || approved.target?.retentionDays !== target.retentionDays) {
+      throw new Error("capacity preview changed; re-run without --confirm");
+    }
+    const written = writeCaptureConfigFile(file, target);
+    rmSync(previewFile, { force: true });
+    return JSON.stringify({ preview, written: { cap_mb: written.capMb, retention_days: written.retentionDays } }, null, 2);
+  }
+  if (sub === "alias") {
+    if (parsed.path[1] === "add") {
+      const [from, to] = parsed.positionals;
+      if (!from || !to) throw new Error("usage: amem alias add <from-key> <to-key>");
+      const op = appendAlias(memoryHome(), { alias: from, key: to, actor: "person", machine: machineId(memoryHome()).id });
+      return options["--json"] ? JSON.stringify(op, null, 2) : `alias ${op.alias} -> ${op.key}`;
+    }
+    const ops = listAliases(memoryHome());
+    return options["--json"] ? JSON.stringify(ops, null, 2) : ops.length ? ops.map((op) => `${op.at}  ${op.alias} -> ${op.key}  (${op.actor})`).join("\n") : "no aliases recorded";
+  }
   // ponytail: board task links need the host's authenticated task boundary; add a host bridge before supporting them here.
   if (goal && sub === "link") throw new Error("goal link needs host integration; use ahub goal link");
   const crosses = definition.policyFree === true && policyFree;
-  // Reads can trigger held-note reconciliation. Defer it unless this terminal explicitly authorized crossing policy.
-  const open = () => new MemoryStore({ screen: note => !crosses ? "skip" : looksSecret(`${note.title ?? ""}\n${note.text}`) ? "keep" : "promote" });
   const cwd = context.cwd ?? process.cwd();
+  // Reads can trigger held-note reconciliation. Defer it unless this terminal explicitly authorized crossing policy.
+  const open = () => curatedStore(boundProject(), { screen: note => !crosses ? "skip" : looksSecret(`${note.title ?? ""}\n${note.text}`) ? "keep" : "promote" });
   // A person's reads are unscreened. Writes crossing the boundary remain secret-screened without host policy.
-  if (goal) return rawGoalCommand(args, cwd, { open, clean: (title, milestones) => !mutating || !looksSecret(`${title}\n${milestones.join("\n")}`) });
+  if (goal) return rawGoalCommand(args, cwd, { project: boundProject(), open, clean: (title, milestones) => !mutating || !looksSecret(`${title}\n${milestones.join("\n")}`) });
   const receipt: { bridgeStatus?: { skippedRows: number } } = {};
-  const output = await rawMemoryCommand(args, cwd, { open, readable: notes => notes, importPolicy: () => () => false,
+  const output = await rawMemoryCommand(args, cwd, { project: boundProject(), open, readable: notes => notes, importPolicy: () => () => false,
     onBridgeStatus: status => { receipt.bridgeStatus = status; } });
+  if (sub === "import" && parsed.path[1] === "claude-mem") {
+    const policy = createStandalonePolicy();
+    const work = await importClaudeMemWorkState({ base: memoryHome(), project: boundProject(), policy: row => policy.screen(row), ...(options["--db"] ? { db: String(options["--db"]) } : {}), ...(options["--limit"] ? { limit: Number(options["--limit"]) } : {}), restart: options["--restart"] === true });
+    return options["--json"] ? JSON.stringify({ ...JSON.parse(output), work }, null, 2) : `${output}\nwork lists: ${JSON.stringify(work)}`;
+  }
   return !options["--json"] && receipt.bridgeStatus
     ? `${output}\n(legacy malformed lines skipped: ${receipt.bridgeStatus.skippedRows})` : output;
 }
 
 export async function main(argv = process.argv.slice(2)): Promise<void> {
-  try { console.log(await runCli(argv)); }
+  try { const output = await runCli(argv); if (output) console.log(output); }
   catch (error) { console.error(`amem: ${(error as Error).message}`); process.exitCode = (error as { exitCode?: number }).exitCode ?? 1; }
 }
 

package/src/commands-table.ts

@@ -21,6 +21,8 @@ const filters = { ...json, "--tier": { description: "Memory tier", value: ["shor
 export const GLOBAL_OPTIONS = { "--help": flag("Show help") };
 export const ROOT_OPTIONS = { "--version": flag("Show version"), ...json };
 export const COMMANDS: Record<string, CommandDefinition> = {
+  mcp: { description: "Run the project-bound MCP stdio server for this session" },
+  "vault-candidates": { description: "List screened durable curated vault candidates", options: { ...json, "--limit": text("Maximum candidates (1..100)") } },
   list: { description: "List memory", options: filters },
   search: { description: "Search memory", options: filters, args: [{ name: "words", variadic: true }] },
   show: { description: "Show a note", options: json, args: [{ name: "id" }] },
@@ -50,19 +52,30 @@ export const COMMANDS: Record<string, CommandDefinition> = {
   review: { description: "Review machine-local non-evidentiary candidates", options: json, defaultCommand: "list", commands: {
     list: { description: "List review candidates", options: {
       "--status": { description: "Candidate status", value: ["pending", "accepting", "accepted", "rejected", "all"] },
-      "--kind": { description: "Candidate kind", value: ["correction", "fail", "decay"] }, "--limit": text("Maximum candidates (1..500)"),
+      "--kind": { description: "Candidate kind", value: ["correction", "fail", "decay", "memory"] }, "--limit": text("Maximum candidates (1..500)"),
     } },
-    accept: { description: "Accept one candidate through the current memory policy", options: policy, args: [{ name: "full-candidate-id" }], mutates: true, policyFree: true },
+    accept: { description: "Accept one candidate through the current memory policy", options: { ...policy, "--kind": { description: "Explicit standalone candidate kind for selected profiles", value: ["memory"] } }, args: [{ name: "full-candidate-id" }], mutates: true, policyFree: true },
     reject: { description: "Reject one candidate", args: [{ name: "full-candidate-id" }], mutates: true },
   } },
   migrate: { description: "Select a person-approved generation or deactivate it", mutates: true, options: {
     ...json, "--dry-run": flag("Read-only migration receipt"), "--generation": text("Explicit 32-hex generation ID"),
     "--resume": flag("Resume the recorded migration"), "--deactivate": flag("Select shared v1 without deleting a generation"),
+    "--shards": flag("Migrate the curated home into project and user shards"),
   } },
+  status: { description: "Report shard migration and pending old-layout appends", options: json },
   prune: { description: "Plan or apply exact-entry durable expiry in a generation", mutates: true, options: {
     ...json, "--cutoff": text("Canonical UTC expiry cutoff"), "--dry-run": flag("Print a local sealed plan without writes"),
+    "--user": flag("Select the user shard explicitly after a curated split (default: current project)"),
     "--apply": flag("Apply the exact local plan"), "--plan": { description: "Sealed local plan JSON file", value: "path" },
   } },
+  capacity: { description: "Report capture use and propose R6 bounds (R7)", options: { ...json, "--disk-share": text("Disk-share bound for the proposal (default 0.02)") }, commands: {
+    apply: { description: "Write the proposed (or given) bounds to the home capture config", mutates: true, options: {
+      ...json, "--cap-mb": text("Capture cap in MB"), "--retention-days": text("Capture retention in days"), "--confirm": flag("Write after the preview") } },
+  } },
+  alias: { description: "Person-reviewed project key aliases (#15 D2)", options: json, defaultCommand: "list", commands: {
+    list: { description: "List alias ops" },
+    add: { description: "Map one key onto its canonical key (append-only op)", args: [{ name: "from-key" }, { name: "to-key" }], mutates: true },
+  } },
   completion: { description: "Print static shell completion", args: [{ name: "shell", values: ["zsh", "bash", "fish"] }] },
   help: { description: "Show help" }, version: { description: "Show version" },
 };

package/src/index.ts

@@ -1,4 +1,10 @@
 export * from "./memory/store.ts";
+export * from "./memory/capture.ts";
+export { fts5Available, ftsTerms, SearchIndex, captureSearch } from "./memory/search-fts.ts";
+export type { CuratedDoc, RankedRef } from "./memory/search-fts.ts";
+export * from "./memory/shard.ts";
+export * from "./memory/catalog.ts";
+export * from "./memory/capacity.ts";
 export * from "./memory/sync.ts";
 export * from "./memory/import.ts";
 export * from "./memory/project.ts";
@@ -10,3 +16,10 @@ export * from "./memory/ops-contract.ts";
 export * from "./memory/generation.ts";
 export * from "./memory/migrate.ts";
 export * from "./memory/prune.ts";
+export * from "./memory/shard-migration.ts";
+
+export * from "./mcp.ts";
+export * from "./mcp-memory.ts";
+export * from "./memory/policy.ts";
+export * from "./memory/work-lists.ts";
+export * from "./memory/vault.ts";

package/src/mcp-memory.ts

@@ -0,0 +1,151 @@
+import { lstatSync } from "node:fs";
+import { join } from "node:path";
+import type { McpHandlers } from "./mcp.ts";
+import { CandidateStore } from "./memory/candidates.ts";
+import { capacityReport } from "./memory/capacity.ts";
+import { CaptureStore } from "./memory/capture.ts";
+import { readSelector } from "./memory/generation.ts";
+import { memoryHome } from "./memory/home.ts";
+import { canonicalPath, realPath } from "./memory/platform.ts";
+import { createStandalonePolicy, type StandalonePolicyOptions } from "./memory/policy.ts";
+import { memoryProjectKey } from "./memory/project.ts";
+import { registerReaderLease } from "./memory/reader-lease.ts";
+import { SearchIndex } from "./memory/search-fts.ts";
+import { readShardedSelection, resolveAlias } from "./memory/shard.ts";
+import { MemoryStore, openShardStore, type Graph, type View } from "./memory/store.ts";
+import { vaultCandidates } from "./memory/vault.ts";
+import { WorkListStore, type WorkListFields } from "./memory/work-lists.ts";
+
+// ponytail: 5000 rows per tier per operation; above this ceiling refuse rather than select on an incomplete privacy-filtered corpus. Upgrade to screened streaming pagination.
+export const MCP_SCAN_LIMIT = 5000;
+export interface MemoryMcpOptions { cwd: string; base?: string; project?: string; policy?: StandalonePolicyOptions }
+export interface MemoryMcp { tools: McpHandlers; close(): void }
+const unavailable = (): never => { throw new Error("memory operation unavailable"); };
+const bound = (args: Record<string, unknown>, keys: string[]) => { if (Object.keys(args).some(key => !keys.includes(key))) unavailable(); };
+const limitOf = (args: Record<string, unknown>): number => args.limit === undefined ? 20 : Number.isSafeInteger(args.limit) && Number(args.limit) >= 1 && Number(args.limit) <= 100 ? Number(args.limit) : unavailable();
+const textOf = (args: Record<string, unknown>, key: string, optional = false): string | undefined => {
+  const value = args[key]; if (value === undefined && optional) return undefined;
+  return typeof value === "string" && value.trim() && !value.includes("\0") ? value : unavailable();
+};
+const sinceOf = (args: Record<string, unknown>): string | undefined => { const since = textOf(args, "since", true); if (since !== undefined && !Number.isFinite(Date.parse(since))) unavailable(); return since; };
+
+/** All identities are resolved once. Per-call arguments cannot change projects, homes, profiles or policy. */
+export function createMemoryMcp(options: MemoryMcpOptions): MemoryMcp {
+  const cwd = realPath(options.cwd), base = canonicalPath(options.base ?? memoryHome());
+  const requested = options.project ?? memoryProjectKey(cwd), project = resolveAlias(base, requested);
+  const policy = createStandalonePolicy(options.policy), release = registerReaderLease(base);
+  const closers: (() => void)[] = [release]; let closed = false;
+  const close = () => { if (closed) return; closed = true; let failure: unknown; for (const closer of closers.reverse()) { try { closer(); } catch (error) { failure ??= error; } } if (failure) throw failure; };
+  try {
+    const selection = readSelector(base).revision;
+    const sharded = !!lstatSync(join(base, "shards.json"), { throwIfNoEntry: false });
+    const shardSelection = sharded ? JSON.stringify(readShardedSelection(base)) : undefined;
+    const store = sharded ? openShardStore({ memoryDir: base, project, deferPromotions: true }) : new MemoryStore({ memoryDir: base, deferPromotions: true });
+    closers.push(() => store.close());
+    const capture = new CaptureStore({ memoryDir: base, project }); closers.push(() => capture.close());
+    const candidates = new CandidateStore({ memoryDir: base }); closers.push(() => candidates.close());
+    const work = new WorkListStore({ base, project, policy: async row => { const permitted = await policy.screen(row); guard(); return permitted; } }); closers.push(() => work.close());
+    const guard = () => {
+      if (closed) unavailable();
+      release.verify();
+      if (resolveAlias(base, requested) !== project || readSelector(base).revision !== selection) unavailable();
+      const split = !!lstatSync(join(base, "shards.json"), { throwIfNoEntry: false });
+      if (split !== sharded || split && JSON.stringify(readShardedSelection(base)) !== shardSelection) unavailable();
+    };
+    const screen = async <T>(rows: T[]): Promise<T[]> => {
+      if (rows.length > MCP_SCAN_LIMIT) unavailable();
+      const publicRows: T[] = []; for (const row of rows) if (await policy.screen(row)) publicRows.push(row); return publicRows;
+    };
+    const curated = async (superseded = false) => {
+      guard();
+      // list() includes shared rows: remove other projects before screening or selection.
+      const rows = store.list({ project, includeSuperseded: superseded, limit: MCP_SCAN_LIMIT + 1 });
+      if (rows.length > MCP_SCAN_LIMIT) unavailable();
+      return screen(rows.filter(row => row.project === project));
+    };
+    const captures = async () => screen(capture.rows({ project, limit: MCP_SCAN_LIMIT + 1 }));
+    const find = (rows: View[], id: string): View | null => { const found = rows.filter(row => row.id === id || row.id.startsWith(id.replace(/^mem:/, ""))); return found.length === 1 ? found[0]! : null; };
+    const tools: McpHandlers = {
+      async amem_search(args) {
+        bound(args, ["query", "limit", "since", "includeCapture"]); const query = textOf(args, "query")!, limit = limitOf(args), since = sinceOf(args);
+        if (args.includeCapture !== undefined && typeof args.includeCapture !== "boolean") unavailable();
+        if (!await policy.screen({ query })) unavailable();
+        const notes = await curated(), recalls = args.includeCapture === false ? [] : await captures();
+        const hits = [...notes.map(view => ({ source: "curated" as const, evidence: true, view, ref: view.id, at: view.at, tier: view.tier, body: `${view.title ?? ""}\n${view.text}\n${view.about.join(" ")}` })),
+          ...recalls.map(row => ({ source: "capture" as const, evidence: false, capture: row, ref: `capture:${row.id}`, at: row.at, tier: "capture", body: `${row.excerpt}\n${row.paths.join(" ")}\n${row.event}` }))].filter(hit => !since || Date.parse(hit.at) >= Date.parse(since));
+        const index = new SearchIndex(":memory:");
+        try {
+          index.resync(() => hits.map(hit => ({ id: hit.ref, at: hit.at, project, tier: hit.tier, scope: "project", body: hit.body })));
+          if (index.available && index.needsResync(hits.length)) unavailable();
+          const ranks = new Map(index.query(query, MCP_SCAN_LIMIT * 2, project).map(row => [row.ref, row.rank]));
+          const words = query.toLowerCase().split(/\s+/).filter(Boolean);
+          const selected = hits.flatMap(hit => {
+            const rank = ranks.get(hit.ref);
+            if (index.available ? rank === undefined : !words.every(word => hit.body.toLowerCase().includes(word))) return [];
+            const weight = hit.tier === "long" ? 1 : hit.tier === "capture" ? 0.5 : 0.9;
+            const score = -(rank ?? -1) * weight / (1 + Math.max(0, Date.now() - Date.parse(hit.at)) / (30 * 86400_000));
+            return [{ source: hit.source, evidence: hit.evidence, ...(hit.source === "curated" ? { view: hit.view } : { capture: hit.capture }), score }];
+          }).sort((a, b) => b.score - a.score).slice(0, limit);
+          guard(); return { engine: index.available ? "fts5" : "substring", hits: selected };
+        } finally { index.close(); }
+      },
+      async amem_show(args) {
+        bound(args, ["id"]); guard(); const id = textOf(args, "id")!;
+        if (/^capture:[1-9][0-9]*$/.test(id)) { const row = (await captures()).find(row => `capture:${row.id}` === id); guard(); return row ? { source: "capture", evidence: false, capture: row } : null; }
+        const result = find(await curated(true), id); guard(); return result;
+      },
+      async amem_timeline(args) {
+        bound(args, ["id", "since", "limit"]); const rows = await curated(true), recalls = await captures(), id = textOf(args, "id", true), since = sinceOf(args), limit = limitOf(args);
+        const entries = [...rows.map(row => ({ at: row.at, value: row as unknown })), ...recalls.map(row => ({ at: row.at, value: { source: "capture", evidence: false, capture: row } as unknown }))];
+        let selected = entries.filter(row => !since || Date.parse(row.at) >= Date.parse(since));
+        if (id) {
+          const anchor = id.startsWith("capture:") ? recalls.find(row => `capture:${row.id}` === id) : find(rows, id);
+          if (!anchor) return []; selected = selected.sort((a, b) => Math.abs(Date.parse(a.at) - Date.parse(anchor.at)) - Math.abs(Date.parse(b.at) - Date.parse(anchor.at)));
+        } else selected.sort((a, b) => b.at.localeCompare(a.at));
+        guard(); return selected.slice(0, limit).map(row => row.value);
+      },
+      async amem_graph(args) {
+        bound(args, ["start", "hops", "limit"]); const start = textOf(args, "start")!, cap = limitOf(args), hops = args.hops ?? 1;
+        if (hops !== 1 && hops !== 2) unavailable();
+        const rows = await curated(true); const result = screenedGraph(rows, start, Number(hops), cap); guard(); return result;
+      },
+      async amem_work_state_read(args) {
+        bound(args, ["list", "includeClosed"]); guard();
+        if (args.includeClosed !== undefined && typeof args.includeClosed !== "boolean") unavailable();
+        // Reduce complete views before policy: individually public appends can compose into private state.
+        const result = await work.read(textOf(args, "list", true), true);
+        const permitted: typeof result = [];
+        for (const view of result) if (await policy.screen(view)) permitted.push(view);
+        guard();
+        return args.includeClosed === true ? permitted : permitted.filter(view => !view.closed).map(view => ({ ...view, items: view.items.filter(item => item.fields.status !== "done" && item.fields.status !== "dropped") }));
+      },
+      async amem_work_state_write(args) { bound(args, ["list", "fields"]); guard(); const result = await work.write(textOf(args, "list")!, args.fields as WorkListFields); guard(); return result; },
+      async amem_remember(args) {
+        bound(args, ["text", "title", "kind"]); guard();
+        const kind = args.kind ?? "finding"; if (!["decision", "finding", "contract", "fail"].includes(String(kind))) unavailable();
+        const input = { project, kind: "memory" as const, text: textOf(args, "text")!, ...(args.title === undefined ? {} : { title: textOf(args, "title")! }), noteKind: kind as "decision" | "finding" | "contract" | "fail" };
+        if (!await policy.screen(input)) unavailable(); guard(); return { id: candidates.put(input, "public") };
+      },
+      async amem_vault_candidates(args) { bound(args, ["limit"]); guard(); const result = await vaultCandidates(store, { project, policy, limit: limitOf(args) }); guard(); return result; },
+      async amem_capacity(args) { bound(args, []); guard(); const report = capacityReport({ memoryDir: base }); if (!await policy.screen(report)) unavailable(); guard(); return report; },
+    };
+    return { tools, close };
+  } catch (error) { close(); throw error; }
+}
+
+/** Build only from screened project rows; even an absent starting node does not leak its label. */
+function screenedGraph(rows: View[], start: string, hops: number, cap: number): Graph {
+  const nodes = new Map<string, Graph["nodes"][number]>(), edges: Graph["edges"] = [];
+  const views = new Map(rows.map(row => [`mem:${row.id}`, row]));
+  for (const [id, row] of views) {
+    nodes.set(id, { id, type: "memory", label: (row.title ?? row.text).slice(0, 60), kind: row.kind, tier: row.tier });
+    for (const [other, rel] of [...row.about.map(node => [node, row.kind === "fail" ? "rules_out" : "about"] as const), [`peer:${row.peer}`, "by"], [`machine:${row.machine}`, "by"], [`project:${row.project}`, "in"]]) {
+      nodes.set(other!, { id: other!, type: other!.split(":")[0]!, label: other!.slice(other!.indexOf(":") + 1) }); edges.push({ from: id, to: other!, rel: rel! });
+    }
+    for (const old of row.supersedes) if (views.has(`mem:${old}`)) edges.push({ from: id, to: `mem:${old}`, rel: "supersedes" });
+  }
+  if (!nodes.has(start)) return { nodes: [], edges: [] };
+  const selected = new Set([start]); let frontier = [start];
+  for (let hop = 0; hop < hops; hop++) { const next: string[] = []; for (const id of frontier) for (const edge of edges) { const other = edge.from === id ? edge.to : edge.to === id ? edge.from : undefined; if (other && !selected.has(other) && selected.size < cap) { selected.add(other); next.push(other); } } frontier = next; }
+  return { nodes: [...selected].map(id => nodes.get(id)!), edges: edges.filter(edge => selected.has(edge.from) && selected.has(edge.to)) };
+}