memgineering 0.12.0 → 0.13.0

package/CHANGELOG.md

@@ -11,6 +11,61 @@ language the reader wants. The bilingual rule the monorepo applies to
 
 ## [Unreleased]
 
+## [0.13.0] — 2026-08-28
+
+### Added
+
+- **Widening a boundary is one word, not a retyped list.**
+  `revise <ref> --claim "…" --never-store-add "therapy"` adds words to a
+  note's declared boundary while keeping every word already there —
+  `--never-store` REPLACES the list, so the old remedy was to retype it
+  and one transcription slip silently narrowed a boundary. Only the new
+  words are validated; the declared ones are grandfathered, so a list an
+  older rule set accepted can still be widened. Refused: a note that
+  declares no boundary (start one with `--never-store`), the flag beside
+  `--never-store` / `--no-never-store` / `--input`, and an addition
+  where every word is already held. After a hosted widening the CLI
+  reads the note back and warns loudly — on the human line and as
+  `never_store_dropped` in `--json` — if the words did not land; honest
+  framing: on today's servers that read is drift-defense (a server that
+  rewrites or partially accepts the list), not version-skew protection,
+  because a server too old for boundaries makes the no-declaration
+  refusal fire first. If the read-back itself fails after the write
+  landed, the command reports "could not confirm" instead of failing a
+  revision the server already holds.
+- **The semantic suggestion now recommends the additive form.** The
+  remedy command printed after a near-boundary write — human line and
+  `--json` hint alike — is built by the CLI and says `--never-store-add
+"<the word>"`, so following it can no longer delete the words already
+  declared. The regression pin is a negative match, because
+  `--never-store-add` contains `--never-store` and a substring check
+  would pass on the destructive form.
+
+### Fixed
+
+- **`proposals approve|reject|rebase --vault <path>` acts on the brain it
+  names.** The parent `proposals` command declares `--vault`/`--local`
+  for its own listing, and commander parses a parent's options out of
+  the whole argv — so the subcommands received nothing at ANY flag
+  position and fell through to the linked brain: on a machine signed in
+  to a hosted brain, an approval aimed at a folder went to the cloud.
+  The subcommands now hear the flags wherever they are written (the last
+  occurrence on the line binds), and the undo hint printed after an
+  approval names the brain the write actually landed on.
+- **The local `revise --input` door screens `claim.scope`.** It was the
+  one user-prose field reachable through `--input` that the boundary
+  screen did not see. Honest framing: the engine currently discards
+  scope on this path, so this shuts a door rather than plugs a leak —
+  it guards against that internal list ceasing to be true.
+
+### Agent guidance
+
+- The `memgineering-writing` skill's widening section changed: add a
+  word with `--never-store-add`, replace or narrow a list with
+  `--never-store`, and a repeated did-not-land warning means stop and
+  tell the user. Restart your agent session after upgrading so the new
+  guidance is what gets injected.
+
 ## [0.12.0] — 2026-08-28
 
 ### Added

package/assets/MEMGINEERING.md

@@ -2,7 +2,7 @@
 name: memgineering
 description: Use whenever the user refers to something they told you before, asks what was decided, tells you something worth keeping, or settles something that should hold next time. The memory lives in their own folder and outlives this session; check it before answering from guesswork, and write to it when you learn something durable.
 type: skill
-version: 0.12.0
+version: 0.13.0
 ---
 
 # memgineering

package/assets/memgineering-writing/SKILL.md

@@ -358,19 +358,28 @@ what they have declared.
 
 ### Widening, narrowing, lifting
 
-`--never-store` **REPLACES** the list; it does not add to it. So to add a word,
-read the declaration first and name every word it should still hold:
+To add a word, name ONLY the new word — the note's words stay:
 
 ```bash
 memgineering revise <ref> \
   --claim "<the boundary, restated to cover the new word>" \
-  --never-store "health, hospital, clinic, diagnosis, symptom, medication, therapy"
+  --never-store-add "therapy"
 ```
 
 `--claim` is required, and an unchanged claim is refused — restate the boundary
-rather than copying the line already there. **Naming only the new word deletes
-the words already declared**, which is the opposite of what anybody asking for
-this wants.
+rather than copying the line already there. A note that declares no boundary
+refuses `-add` and points you at `--never-store` — that is also what you will
+see for every note on a hosted brain older than boundaries, where there is
+nothing to widen yet. After a hosted widening the CLI reads the note back and
+warns out loud if the words did not land; if that warning repeats on a retry,
+the server is not storing what it accepts — stop and tell the user.
+
+To narrow or rewrite the list, `--never-store` **REPLACES** it wholesale — name
+every word the note should still hold, because a word you leave out is a word
+the boundary loses. That is what makes it the narrowing verb and the wrong verb
+for adding: **with `--never-store`, naming only the new word deletes the words
+already declared.** The CLI refuses the two flags together rather than guessing
+which you meant.
 
 To lift a boundary entirely: `memgineering retire <the declaration>`. That is
 the un-declare path, and it is the user's decision, never yours.

package/dist/index.js

@@ -220,7 +220,10 @@ function undoHint(opId, vault) {
   return vault ? `memgineering undo ${opId} --vault ${quoteArg(vault)}` : `memgineering undo ${opId}`;
 }
 function widenBoundaryHint(path) {
-  return `memgineering revise ${quoteArg(oneLineWhole(path))} --claim "<the boundary, restated to cover the new word>" --never-store "<every word it should hold, including the new one>"`;
+  return `memgineering revise ${quoteArg(oneLineWhole(path))} --claim "<the boundary, restated to cover the new word>" --never-store-add "<the word>"`;
+}
+function boundarySuggestionHint(path) {
+  return `This WAS stored and nothing was refused \u2014 no boundary of yours was broken. It only reads as though it might belong with the boundary declared in \`${oneLineWhole(path)}\`, which lists no word this note carries. Tell the person whose brain this is and let them decide, rather than acting on it: if it should not have been stored, \`undo\` on the \`op_id\` in this response takes it back. To close the gap for next time, add the missing word to that declaration \u2014 this keeps the words it already holds: \`${widenBoundaryHint(path)}\`. The word list is what refuses; this check only notices SOME of what it misses, so silence from it is not permission.`;
 }
 function quoteArg(value) {
   return /^[A-Za-z0-9._\/-]+$/.test(value) ? value : `'${value.replace(/'/g, "'\\''")}'`;
@@ -11584,7 +11587,21 @@ function rememberCommand() {
             // always, and is also what a server too old to send it looks
             // like. Those two are not worth telling apart: neither one
             // means anything was dropped.
-            ...written.boundary_suggestion == null ? {} : { boundary_suggestion: written.boundary_suggestion }
+            //
+            // The hint is REBUILT here, never forwarded. The server's own
+            // sentence embeds a remedy command, and the flags in it belong
+            // to this binary — a command travelling as a string between two
+            // separately deployed programs goes stale with nothing on
+            // either side able to see it, and that one already had. What
+            // comes from the server is the declaration and the score;
+            // neither is a sentence. `boundarySuggestionHint` has the rest.
+            ...written.boundary_suggestion == null ? {} : {
+              boundary_suggestion: {
+                declared_in: written.boundary_suggestion.declared_in,
+                similarity: written.boundary_suggestion.similarity,
+                hint: boundarySuggestionHint(written.boundary_suggestion.declared_in)
+              }
+            }
           },
           human: () => {
             printHuman(`Remembered in ${oneLine(target.name, WIDTH.title)}.
@@ -11639,8 +11656,8 @@ function rememberCommand() {
                 c.gray(
                   `close: this might belong with a boundary you declared \u2014 \`${oneLine(suggestion.declared_in, WIDTH.path)}\`
   Nothing was refused; none of the words you listed are in it. Take this note back
-  with the undo above \u2014 or widen that boundary. \`--never-store\` REPLACES the whole
-  list, so read that note first and name every word it should keep:
+  with the undo above \u2014 or widen that boundary. \`--never-store-add\` keeps the words
+  that note already declares, so only the missing one is named here:
   \`${widenBoundaryHint(suggestion.declared_in)}\``
                 )
               );
@@ -11783,7 +11800,7 @@ function parseKind(raw) {
     `Nothing was written. Use one of: ${MemoryKindSchema.options.join(", ")} \u2014 or leave --kind off, which is fine and common. Your own word for it belongs in the note's \`type\`.`
   );
 }
-function parseNeverStore(raw) {
+function parseNeverStore(raw, flag = "--never-store") {
   if (raw === void 0) return [];
   const out = [];
   for (const piece of raw.split(",")) {
@@ -11801,8 +11818,8 @@ function parseNeverStore(raw) {
   if (out.length === 0) {
     throw memgError(
       "invalid_input",
-      "--never-store was given no usable words",
-      'Nothing was written. Pass the words you mean \u2014 `--never-store "\uBCD1\uC6D0, \uC6B0\uC6B8\uC99D"`. To REMOVE a declaration instead, that is `revise <ref> --no-never-store`, which is a different flag on purpose.'
+      `${flag} was given no usable words`,
+      `Nothing was written. Pass the words you mean \u2014 \`${flag} "\uBCD1\uC6D0, \uC6B0\uC6B8\uC99D"\`. To REMOVE a declaration instead, that is \`revise <ref> --no-never-store\`, which is a different flag on purpose.`
     );
   }
   return out;
@@ -11824,7 +11841,10 @@ function reviseCommand() {
   return new Command6("revise").description("change a memory's conclusion, and record how to undo it").argument("<ref>", "handle, id, path, or exact title").option("--claim <text>", "what is now true").option("--summary <text>", "the one line recall will show (defaults to the claim)").option("--title <text>", "the heading recall shows above it (unchanged when omitted)").option(
     "--valid-from <iso>",
     "when this became true (defaults: supersede = now, otherwise unchanged)"
-  ).option("--action <kind>", "reinforce | supersede | conflict", "supersede").option("--rule", "this memory is now a decision that binds, not a fact to look up").option("--no-rule", "it no longer binds \u2014 an ordinary memory again").option("--never-store <words>", "replace this note\u2019s boundary words (comma-separated)").option("--no-never-store", "this note no longer declares a boundary").option("--contradicts <ids...>", "memories this disagrees with").option("--reason <text>", "why this change is right").option("--because <text>", "the passage from the note that justifies it").option("--input <json>", "the whole change as JSON (file path, `-`, or inline)").option("--dry-run", "show the diff and write nothing").option("--vault <path>", "which brain to write to").option("--local", "use the brain on this machine, even when signed in to a hosted one").addHelpText(
+  ).option("--action <kind>", "reinforce | supersede | conflict", "supersede").option("--rule", "this memory is now a decision that binds, not a fact to look up").option("--no-rule", "it no longer binds \u2014 an ordinary memory again").option("--never-store <words>", "replace this note\u2019s boundary words (comma-separated)").option("--no-never-store", "this note no longer declares a boundary").option(
+    "--never-store-add <words>",
+    "add words to this note\u2019s boundary, keeping the ones already there"
+  ).option("--contradicts <ids...>", "memories this disagrees with").option("--reason <text>", "why this change is right").option("--because <text>", "the passage from the note that justifies it").option("--input <json>", "the whole change as JSON (file path, `-`, or inline)").option("--dry-run", "show the diff and write nothing").option("--vault <path>", "which brain to write to").option("--local", "use the brain on this machine, even when signed in to a hosted one").addHelpText(
     "after",
     [
       "",
@@ -11840,12 +11860,13 @@ function reviseCommand() {
       "always true, you have only just been told it. `supersede` would date it today."
     ].join("\n")
   ).action(async (ref, opts) => {
+    const added = boundaryAddition(opts);
     const where = await resolveTarget({
       ...opts.local === void 0 ? {} : { local: opts.local },
       ...opts.vault === void 0 ? {} : { vault: opts.vault }
     });
     if (where.kind === "cloud") {
-      await reviseHosted(where, ref, opts);
+      await reviseHosted(where, ref, opts, added);
       return;
     }
     const { brain } = await resolveBrain(opts.vault);
@@ -11855,7 +11876,8 @@ function reviseCommand() {
     });
     const built = await openIndex(adapter, brain.root);
     const entry = resolveRef(built.entries, ref);
-    const input = await buildCommitInput(entry, opts);
+    const widened = widenedBoundary(entry.memory.never_store, added, ref);
+    const input = await buildCommitInput(entry, opts, widened);
     const rationale = sanitizeRationale(
       input.reason === NO_REASON_GIVEN ? null : input.reason ?? null
     );
@@ -11865,6 +11887,28 @@ function reviseCommand() {
         input.claim?.summary,
         input.claim?.title,
         input.claim?.valid_from,
+        // Free prose, and the last field on this door that was not read.
+        // No flag sets it — only `--input` can.
+        //
+        // What this screens is what the write CARRIES, not what today's
+        // patch happens to keep: `computePatch` currently drops `scope` via
+        // `NEVER_WRITTEN_KEYS`, so on this path the word reaches neither the
+        // note nor the ledger. Screening it anyway, because that list is not
+        // a boundary and has never been treated as one — `title` moved off
+        // it into `PATCHABLE_KEYS` once already — and `scope` is search-
+        // scored by design, so the day it becomes writable is the day the
+        // user's word is stored and findable by the phrase they asked never
+        // to keep. A boundary that holds only while an unrelated list stays
+        // the way it is, is one the user tested once and is wrong about
+        // afterwards.
+        //
+        // Guarded on the type rather than trusted, because `readInput` is a
+        // bare `JSON.parse` with no schema in front of it: a malformed
+        // `--input` puts whatever it likes here, and a screen that threw a
+        // TypeError on it would refuse to say what was actually wrong.
+        // Anything that is not a string falls through to `commit`, which
+        // parses this input properly and reports it as malformed.
+        ...typeof input.claim?.scope === "string" ? [input.claim.scope] : [],
         input.source_excerpt
       ],
       ...input.claim?.never_store != null && input.claim.never_store.length > 0 ? { declares: input.claim.never_store } : (entry.memory.never_store?.length ?? 0) > 0 ? { declares: entry.memory.never_store } : {}
@@ -12025,7 +12069,7 @@ Undo: \`${undoHint(applied.record.op_id, opts.vault)}\``));
     });
   });
 }
-async function reviseHosted(where, ref, opts) {
+async function reviseHosted(where, ref, opts, added) {
   if (opts.input) {
     throw memgError(
       "invalid_input",
@@ -12040,8 +12084,11 @@ async function reviseHosted(where, ref, opts) {
       'Pass `--claim "<the new conclusion>"`.'
     );
   }
-  const boundary = boundaryIntent(opts.neverStore);
+  const replaced = boundaryIntent(opts.neverStore);
   const brain = await openCloudBrain(where);
+  const declared = added === void 0 ? void 0 : declaredWords(await cloudOpen(brain, ref));
+  const widened = widenedBoundary(declared, added, ref);
+  const boundary = widened ?? replaced;
   const result = await cloudRevise(brain, {
     ref,
     claim: opts.claim,
@@ -12062,8 +12109,22 @@ async function reviseHosted(where, ref, opts) {
     ...boundary === void 0 ? {} : { neverStore: boundary },
     ...opts.dryRun === true ? { dryRun: true } : {}
   });
+  let dropped = [];
+  let unconfirmed = false;
+  if (widened !== void 0 && result.dry_run !== true) {
+    try {
+      dropped = missingWords(widened, declaredWords(await cloudOpen(brain, ref)));
+    } catch {
+      unconfirmed = true;
+    }
+  }
   printDual({
-    json: { brain: where.name, ...result },
+    json: {
+      brain: where.name,
+      ...result,
+      ...dropped.length === 0 ? {} : { never_store_dropped: dropped },
+      ...unconfirmed ? { never_store_unconfirmed: true } : {}
+    },
     human: () => {
       if (result.dry_run) {
         printHuman(`## revise (dry run) \u2014 ${oneLine(where.name, WIDTH.title)}
@@ -12099,6 +12160,25 @@ async function reviseHosted(where, ref, opts) {
           )
         );
       }
+      if (dropped.length > 0) {
+        printHuman(
+          c.yellow("\n\u26A0 this brain's server did not store the widened boundary") + c.gray(
+            `
+  Missing from the declaration: ${dropped.map((t) => `\`${t}\``).join(", ")}
+  The revision itself is saved, but the note read back without these words, so
+  it refuses exactly what it refused before. Run this again; if it repeats,
+  the server is not storing what it accepts \u2014 check \`memgineering open\` and
+  tell your owner. Nothing here needs undoing first.`
+          )
+        );
+      }
+      if (unconfirmed) {
+        printHuman(
+          c.gray(
+            "\nCould not read the note back to confirm the widened boundary \u2014 the revision\nitself is saved. Check with `memgineering open` when the connection recovers."
+          )
+        );
+      }
       if (result.critical_target) {
         printHuman(
           c.yellow(
@@ -12123,6 +12203,67 @@ ${oneLine(result.reverse.hint, WIDTH.text)}`));
     }
   });
 }
+function boundaryAddition(opts) {
+  if (opts.neverStoreAdd === void 0) return void 0;
+  if (opts.neverStore === false) {
+    throw memgError(
+      "invalid_input",
+      "--never-store-add and --no-never-store contradict each other",
+      "Nothing was written. One widens this note\u2019s boundary and the other removes it entirely; there is no order in which both are what you meant. Pass whichever one you did."
+    );
+  }
+  if (opts.neverStore !== void 0) {
+    throw memgError(
+      "invalid_input",
+      "--never-store-add and --never-store contradict each other",
+      'Nothing was written. `--never-store` REPLACES the whole list and `--never-store-add` keeps it, so together they decide the same field twice. To widen the declaration: `--never-store-add "<the new word>"`. To set the list outright: `--never-store "<every word it should hold>"`.'
+    );
+  }
+  if (opts.input !== void 0) {
+    throw memgError(
+      "invalid_input",
+      "--never-store-add cannot be combined with --input",
+      "Nothing was written. An `--input` document carries its own `claim.never_store`, and that field REPLACES the list \u2014 so the JSON and the flag would be answering the same question differently. Put the whole list in the JSON, or drop `--input` and widen with the flag."
+    );
+  }
+  return parseNeverStore(opts.neverStoreAdd, "--never-store-add");
+}
+function widenedBoundary(declared, added, ref) {
+  if (added === void 0) return void 0;
+  const existing = [...declared ?? []];
+  if (existing.length === 0) {
+    throw memgError(
+      "invalid_input",
+      `${ref} declares no boundary to add to`,
+      `Nothing was written. \`--never-store-add\` keeps the words a note already declares, and this one declares none. Start the declaration with the flag that sets it:
+  memgineering revise ${ref} --claim "<what this brain must never hold>" --never-store "${added.join(", ")}"
+To see what this note says now: \`memgineering open ${ref}\``
+    );
+  }
+  const fresh = added.filter((term) => !existing.some((word) => sameBoundaryWord(word, term)));
+  if (fresh.length === 0) {
+    const words = added.map((term) => `\`${term}\``).join(", ");
+    throw memgError(
+      "nothing_to_change",
+      `${ref} already declares ${words} \u2014 nothing was written`,
+      `Nothing was added and nothing was changed: every word passed is already on this note\u2019s list, so the write would have recorded an operation that moved nothing and an \`undo\` that reversed nothing.
+To see the declaration as it stands: \`memgineering open ${ref}\`
+To change what the note CONCLUDES without touching the words, leave \`--never-store-add\` off.`
+    );
+  }
+  return [...existing, ...fresh];
+}
+function sameBoundaryWord(a, b) {
+  const shape = (value) => value.normalize("NFC").replace(/\s+/gu, " ").trim().toLowerCase();
+  return shape(a) === shape(b);
+}
+function missingWords(intended, stored) {
+  return intended.filter((term) => !stored.some((word) => sameBoundaryWord(word, term)));
+}
+function declaredWords(note) {
+  const raw = note.memory["never_store"];
+  return Array.isArray(raw) ? raw.filter((term) => typeof term === "string") : [];
+}
 function boundaryIntent(raw) {
   if (raw === void 0) return void 0;
   return raw === false ? [] : parseNeverStore(raw);
@@ -12140,7 +12281,7 @@ function checkedTerms(terms2) {
     return checked.term;
   });
 }
-async function buildCommitInput(entry, opts) {
+async function buildCommitInput(entry, opts, widened) {
   if (opts.input) {
     const raw = await readInput(opts.input);
     return {
@@ -12164,7 +12305,7 @@ async function buildCommitInput(entry, opts) {
       'Pass `--claim "<the new conclusion>"`, or `--input` with the whole change as JSON.'
     );
   }
-  const boundary = boundaryIntent(opts.neverStore);
+  const boundary = widened ?? boundaryIntent(opts.neverStore);
   const action = opts.action;
   if (action !== "reinforce" && action !== "supersede" && action !== "conflict") {
     throw memgError(
@@ -12323,12 +12464,13 @@ function renderSummary(p) {
 function decisionCommand(decision) {
   return new Command7(decision).description(
     decision === "approve" ? "apply a proposal to the note \u2014 recorded in the ledger, reversible with undo" : "decline a proposal; the note is not touched"
-  ).argument("<id>", "proposal id, or enough of it to be unambiguous").option("--reason <text>", "why \u2014 kept in the ledger").option("--vault <path>", "which brain the proposal belongs to").option("--local", "use the brain on this machine, even when signed in to a hosted one").action(async (id, opts) => {
-    const rationale = sanitizeRationale(opts.reason);
-    const where = await whichBrain(opts);
+  ).argument("<id>", "proposal id, or enough of it to be unambiguous").option("--reason <text>", "why \u2014 kept in the ledger").option("--vault <path>", "which brain the proposal belongs to").option("--local", "use the brain on this machine, even when signed in to a hosted one").action(async (id, opts, cmd) => {
+    const merged = { ...cmd.parent?.opts() ?? {}, ...opts };
+    const rationale = sanitizeRationale(merged.reason);
+    const where = await whichBrain(merged);
     if (where.kind === "cloud") {
       const brain2 = await openCloudBrain(where);
-      const args = { id, ...opts.reason === void 0 ? {} : { reason: opts.reason } };
+      const args = { id, ...merged.reason === void 0 ? {} : { reason: merged.reason } };
       if (decision === "reject") {
         const rejected = await cloudReject(brain2, args);
         renderRejection(rejected.proposal_id, rejected.state, rejected.target);
@@ -12346,7 +12488,7 @@ function decisionCommand(decision) {
           before: applied2.before,
           after: applied2.after
         },
-        opts.vault
+        merged.vault
       );
       return;
     }
@@ -12421,7 +12563,7 @@ function decisionCommand(decision) {
         before: preview.before,
         after: preview.after
       },
-      opts.vault
+      merged.vault
     );
   });
 }
@@ -12459,8 +12601,9 @@ function renderRejection(id, state, target) {
   });
 }
 function rebaseCommand() {
-  return new Command7("rebase").description("recompute a stale proposal against the note as it is now").argument("<id>", "proposal id, or enough of it to be unambiguous").option("--vault <path>", "which brain the proposal belongs to").option("--local", "use the brain on this machine, even when signed in to a hosted one").action(async (id, opts) => {
-    const where = await whichBrain(opts);
+  return new Command7("rebase").description("recompute a stale proposal against the note as it is now").argument("<id>", "proposal id, or enough of it to be unambiguous").option("--vault <path>", "which brain the proposal belongs to").option("--local", "use the brain on this machine, even when signed in to a hosted one").action(async (id, opts, cmd) => {
+    const merged = { ...cmd.parent?.opts() ?? {}, ...opts };
+    const where = await whichBrain(merged);
     if (where.kind === "cloud") {
       const rebased = await cloudRebase(await openCloudBrain(where), { id });
       renderRebase(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memgineering",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "private": false,
   "description": "One memory for the AI you connect. Recall, remember, and revise a brain your agents share \u2014 stored in your own folder.",
   "license": "Apache-2.0",