memgineering 0.26.0 → 0.28.0

package/CHANGELOG.md

@@ -9,7 +9,243 @@ upgrade and by agents summarising a release, and both re-render it in whatever
 language the reader wants. The bilingual rule the monorepo applies to
 `@rayul/kordis` does not extend here.
 
-## [Unreleased]
+## [0.28.0] — 2026-11-01
+
+### Added
+
+- **`memgineering delete-account` deletes your account — the hosted brain
+  account and the registry account the same Google sign-in made — in one
+  command.** Brain first (every brain on it, every note, every token), then
+  the registry account (profile, stars, follows, comment text, sign-ins;
+  the account is renamed `deleted-…`, and its published packages and versions
+  stay at their existing addresses), then this machine is signed out. It is confirmed with the sentence `delete my account`: typed at
+  the prompt, or passed as `--confirm "delete my account"`. Without either and
+  with no terminal to ask in, it refuses; there is no dry run. Folders on this
+  disk are never touched.
+- **Before deleting anything it checks both sign-ins work and are one
+  person's** — the two accounts' emails, or, when either account has no email
+  on record, this machine's registry sign-in, which the brain sign-in issued. `--json` reports which as `matched` (`email`, `federation`, or
+  `earlier-run`). Two different people answer `account_mismatch`; a machine
+  signed in to a brain with no registry half answers `not_linked`; a machine
+  signed in to nothing answers `not_signed_in` (a brain kept in a folder has
+  no account). Each refusal says nothing was deleted and how to go on,
+  including mailing support@memgineering.com.
+- **A run that stops halfway can be finished.** If the registry fails after
+  the brain account is gone, the command answers `account_partly_deleted`
+  and keeps a progress file (`delete-account.json` in the memgineering home,
+  mode 600); running it again skips the brain and deletes only the registry
+  account, and the file is removed when both are done. An answer lost on the
+  way back is checked with the server rather than guessed. `--json` on success:
+  `{deleted, brain: {status, account_id, api_url}, registry: {status, user_id,
+  username, api_url}, matched, credentials_cleared, pointer_cleared,
+  local_folders, hint}`, where each `status` is `deleted` or `deleted-earlier`.
+- **`memgineering logout --all` reports what it ended in the registry.** On a
+  server with "disconnect everything", `--all` also ends every registry sign-in
+  of the same Google account, and anything approved before that moment can no
+  longer finish. `--json` passes the server's `registry_sessions` (`revoked`
+  with a count, `not_linked`, or `unreachable` with a `hint`) and
+  `revoked_before` on unchanged, and the human output gives the registry result
+  its own line (none when there were no live registry sign-ins to end). The existing `registry` field keeps its meaning: this machine's
+  registry session.
+- **`memgineering logout --all` with nothing signed in says how to do it** —
+  the website's "disconnect everything" button, or `memgineering login` and
+  then `logout --all` — in a `hint`, instead of only "nothing to do".
+
+### Changed
+
+- **`logout --all` no longer ends this machine's registry session separately
+  when the server already ended every registry session.** An older server, an
+  unreachable registry, or an account the server found no registry link for
+  still gets this machine's session ended as before.
+
+### Fixed
+
+- **`registry search` with nothing searchable in the query finds nothing**
+  (registry-side, every version). A query of only emoji or punctuation used to
+  return every package as a match; it now returns no results.
+
+### Known issue
+
+- **An older CLI can report `registry: revoke-failed-expires-on-its-own` after
+  `logout --all` against an updated server.** The server has already ended the
+  registry session, so the old CLI's own attempt finds it gone and reports a
+  failure that did not happen. Upgrading fixes the report; nothing is left
+  signed in.
+
+### Agent guidance
+
+- `memgineering-setup` describes `delete-account`: when to run it (only on an
+  explicit request), what it deletes and keeps, the refusals, and what to tell
+  the user after `account_partly_deleted`. Restart the agent session after
+  upgrading to pick it up.
+- `memgineering-setup` also points a person with no terminal to the "Delete my
+  account" section at the bottom of memgineering.com/brain (one tick), which
+  deletes the same two accounts. Restart the agent session after upgrading to
+  pick it up.
+- `memgineering-setup` now says a Google account that never opened a brain can
+  delete its registry account from the same page: the consent screen shows a
+  "Delete my account" section below the terms. Only an account that never
+  signed in with Google, and a brain account whose terms were never accepted,
+  are deleted by mail to support@memgineering.com. Restart the agent session
+  after upgrading to pick it up.
+- `memgineering-setup` describes `logout --all` as "disconnect everything" and
+  what to tell the user for each `registry_sessions` answer. Restart the agent
+  session after upgrading to pick it up.
+- `memgineering-setup` no longer says consent is asked only once. The terms
+  are agreed once per account; connecting a chat app asks on every connection
+  for two consents — to giving what it reads and writes to the company that
+  runs it, and to that company being in the United States — and without both
+  ticks the app is not connected. It says what the connect screen tells the
+  person (what is sent, automatically at the start of every conversation and
+  without asking each time it records; the company's purpose, model training
+  included; how long it keeps it), that a program on their own computer asks
+  for no tick, that a refused unknown app (`unknown_connector_recipient`) is
+  answered by suggesting Claude or Gemini, and that a "notice changed" screen
+  is reloaded and approved again. Restart the agent session after upgrading to
+  pick it up.
+- `memgineering-setup` says **connecting ChatGPT is paused** for now
+  (`connector_recipient_paused`, while the notice about OpenAI is verified):
+  agents offer Claude or Gemini instead of walking the user through ChatGPT's
+  Developer mode. The hub and `memgineering setup --help` say the same beside
+  ChatGPT's route, which works again once the pause ends.
+
+## [0.27.0] — 2026-10-18
+
+### Added
+
+- **`recall --json` says why nothing the user wrote came back.** An answer
+  with no card the user wrote — no cards at all, or only cards still exactly
+  what `init` wrote (`scaffolding: true`) — had no `hint`: most of the advice
+  the terminal footer gives was left out, and so was a hosted brain's own
+  `hint`. It now carries `hint`, the single most specific next step, and an
+  answer of template cards only keeps its cards; `hint` is absent whenever a
+  card the user wrote came back. First, a brain with nothing to search. One
+  with no notes yet (for a hosted brain, as its account listing reports) gets
+  the `remember` command that writes the first one there — or, after `--brain`
+  named a brain this machine does not point at, the `memgineering use --brain`
+  that makes it the target, since `remember` has no `--brain`. A folder brain
+  that left out everything it had gets "Nothing in this brain could be
+  searched: …", described below. After that: notes in a script the question is
+  not in, other brains that were not read (a `--brain` or `--vault` command for
+  each), meaning that was not searched (with the server's reason), the hosted
+  server's own advice, and last, what was searched in this brain and what to
+  try there — fewer or broader words, `--depth standard` after
+  `--depth exact`, or dropping `--scope`.
+- **`reindex` and `push` name the symlinks they did not follow.** The walk
+  never follows a symlink, so notes in a folder behind one were counted
+  nowhere and named by nothing. `reindex`, and a `push` that has notes to
+  send, now list every symlink that is not itself a note — under `--json` as
+  the new `skipped_other_symlinks`, beside `excluded_folders` — and a left-out
+  count beside a non-empty one of either is a floor, not the whole answer. A
+  `push` with nothing to send still calls such a folder empty and names no
+  link.
+
+### Changed
+
+- **`recall` says when a brain in a folder left notes out of the search, in
+  the terminal as well as in `--json`.** The notes it counts were excluded by
+  the user's rules, listed in `.memgdeny`, held back because the name looks
+  private, refused because the content looks like a credential, or sit behind
+  a symlink. Notes inside a folder the rules exclude are not among them: the
+  walk never looks inside such a folder, so they are neither searched nor
+  counted. Whenever no card the user wrote came back — no cards at all, or
+  only cards still exactly what `init` wrote — and one of those notes was left
+  out, the answer says how many and why, lists beside them any excluded
+  folders and other symlinks nobody looked inside, and says that
+  `memgineering reindex` names each one: in the terminal under
+  `_Nothing matched._`, or under the "Nothing you have written matched this."
+  header above template cards, and under `--json` at the start of `hint`.
+  Excluded folders and other symlinks on their own, beside notes that were
+  searched, change nothing. When every note was left out — nothing indexed,
+  and the walk left out notes, or only folders and links it never looked
+  inside, which are not evidence of a note — the answer says "Nothing in this
+  brain could be searched: …" and nothing more about the brain: that sentence
+  and the `reindex` command are the whole `hint`, and the terminal no longer
+  adds "try fewer or broader words". When other notes were searched and one of
+  the counted notes was left out, `hint` starts with "Not every note in this
+  brain was searched: …" and goes on with the step it would otherwise give,
+  whose last-resort sentence then reads "Within the rest of this brain, …".
+  Recall never names a held-back note or shows its content. In the terminal, a
+  folder with no notes and nothing left out, answers with at least one card
+  the user wrote, and empty answers where notes were searched and none of the
+  counted kinds was left out all look as they did.
+- **An answer of template cards only now names the brains the recall did not
+  read.** In the terminal it lists them under its header, with the command
+  that reads each, as an empty answer always has — except when the notes being
+  in another script is the reason: then, as for an empty answer, the script
+  notice prints instead of that block, and `hint` carries the script sentence
+  rather than the other-brains step, after the left-out count when a note was
+  also left out.
+
+### Fixed
+
+- **Two memgineering commands refreshing the registry sign-in at once no
+  longer cost one of them its link.** On a machine signed in to the registry,
+  a `memgineering registry` command refreshes that sign-in as it starts, and
+  the registry rotates the token on every refresh, so of two commands that
+  refresh together it refuses the second. That one used to report the link as
+  gone (`not_linked`, with "`memgineering login` re-links both"), or, for the
+  verbs that can read without an account — `registry search`, `read`, `pull`
+  and the like — carry on anonymously. It now waits up to about two seconds
+  for the token the winning command saved and retries once with it, never
+  with its own spent token. If the retry loses too — with three or more
+  commands started together, say — or no newer token turns up within those
+  two seconds, a command that needs the sign-in reports `not_authenticated`
+  with a hint to run it again, and one that can read without it reads
+  anonymously, as before. Running it again does not always work: when the
+  command that won was a `logout`, or its save never landed, the next run
+  finds no newer sign-in and reports `not_linked`.
+- **A busy or unreachable registry no longer reads as an expired link.** A
+  command that needs the registry sign-in, such as `registry publish`, turned
+  every failed refresh into `not_linked` and pointed at `memgineering login`,
+  which fixes neither. A refresh that meets a rate limit, a server error or no
+  network now reports that: `rate_limited`, the registry's own code, or
+  `server_unreachable`.
+- **The sign-in file is no longer briefly missing while it is written.**
+  `credentials.json` used to be deleted and then written again, so a command
+  that read it in between took this machine for signed out. Saving it now
+  writes a new file and renames it into place (still mode 600), and a stale
+  temp file left by a crash is swept by a later save; a sign-out still deletes
+  the file. Changes also take a lock, and a rotated registry token is saved
+  only while the file still holds the token its refresh spent, so a sign-in or
+  sign-out that lands while another command's refresh is out is kept rather
+  than overwritten. A change that cannot take the lock within two seconds goes
+  ahead without it, and a lock held for more than 30 seconds is taken over as
+  dead; in either case the two can still cross.
+- **`logout` revokes the registry session even when a command beside it has
+  just refreshed it.** It reads the sign-in file again right before revoking,
+  and its refresh retries a lost race the same way, where it used to give up
+  and leave the session to expire on its own
+  (`"registry": "revoke-failed-expires-on-its-own"` under `--json`).
+
+### Agent guidance
+
+- `memgineering-recall`: with `--json`, an answer with nothing the user wrote
+  in it — no cards, or only template cards (`scaffolding: true`), which are
+  what `init` wrote and not the user's notes — carries `hint`, the one next
+  step; read it before concluding anything from `cards: []` or from template
+  cards. A `memgineering use --brain` in a hint moves this machine's pointer
+  for every later command, so offer it to the user and run it only on their
+  yes. Held-back notes are counted in both modes. For a counted note, tell the
+  user that such a note exists and why — never that the brain is empty or that
+  they never wrote it down — and, to say where, run the printed `reindex` and
+  give them the path; do not open, print or read a held-back note unless they
+  ask what it says. An excluded folder or another symlink is a place nobody
+  looked inside, not evidence of a note: say that recall could not look inside
+  it and that `reindex` names it, and do not say a note was held back. An empty
+  answer is not proof that the user never wrote something: recall never looks
+  inside a folder their own rules exclude, so say what was searched and that
+  such folders were not, and do not open one yourself. An answer of template
+  cards only also names the brains it did not read; run that command before
+  saying the fact was never written down.
+- `memgineering-setup`: `reindex` and `push` list `skipped_other_symlinks`;
+  read their left-out count together with it and `excluded_folders`, because
+  beside a non-empty one the count is a floor. A `recall` that brings back
+  nothing the user wrote counts the same set by reason — beside notes it did
+  search, only when a note is among them — and prints the `reindex` command,
+  never a path.
+
+Restart your agent session after upgrading so it reads the new guidance.
 
 ## [0.26.0] — 2026-10-10
 

package/README.md

@@ -185,6 +185,17 @@ automatically when a Claude Code session starts.
 | `brains`                             | list your hosted brains, and which one answers here |
 | `create` · `rename` · `delete-brain` | make, rename, or delete a hosted brain              |
 | `push` · `pull`                      | carry a brain to your account, and back down again  |
+| `delete-account`                     | delete your account — brain and registry — for good |
+
+`delete-account` deletes the hosted brain account (every brain, note and
+token on it) and then the registry account the same Google sign-in made
+(the account is renamed `deleted-…`; its published packages and versions
+stay at their existing addresses), and signs this machine out. It asks for the sentence `delete my account` — typed at the prompt, or
+`--confirm "delete my account"` — and checks first that both sign-ins work and
+belong to one person (their emails match; if either account has no email, the
+registry sign-in this machine got from the brain sign-in is the match). If it stops halfway, run it again: it finishes the side
+that is left. Folders on this disk are never touched. Without a sign-in you
+can use, mail support@memgineering.com from the address on the account.
 
 **System**
 

package/assets/MEMGINEERING.md

@@ -2,7 +2,7 @@
 name: memgineering
 description: Use whenever the user refers to something they told you before, asks what was decided, tells you something worth keeping, or settles something that should hold next time. The memory lives in their own folder and outlives this session; check it before answering from guesswork, and write to it when you learn something durable.
 type: skill
-version: 0.26.0
+version: 0.28.0
 ---
 
 # memgineering
@@ -81,13 +81,13 @@ at six skills, each of which loads on its own when its topic comes up:
 - `memgineering-rules` — decisions that bind, and the before-edit hook
 - `memgineering-setup` — installing, which tools this reaches, accounts, moving a brain
 - `memgineering-registry` — the public layer
-- `memgineering-installing` — putting a package in their project, and updating it
+- `memgineering-installing` — putting a package in a project, updating it
 
-Not shell-only: ChatGPT and Claude.ai reach a hosted brain via connector `https://mcp.memgineering.com/mcp`.
+Not shell-only: Claude.ai reaches a hosted brain via connector `https://mcp.memgineering.com/mcp`; ChatGPT is paused for now.
 
 A host short on room lists a skill by NAME ONLY, no description — measured on
 Claude Code. When you cannot see what it covers, READ
 `<tool-home>/skills/memgineering-<name>/SKILL.md` before deciding it is empty.
 
-If `memgineering: command not found`, install with `npm i -g memgineering`, then
+If `memgineering: command not found`, run `npm i -g memgineering`, then
 `memgineering setup --web`.

package/assets/memgineering-recall/SKILL.md

@@ -191,18 +191,72 @@ summary before you answer from it — never quote it back on the label alone.
 ## Two answers that are answers
 
 **Nothing matched.** Say so, and do not go read their folder yourself to
-compensate. At the default depth this has already searched every note body of
-**the brain it searched**, so "nothing" is real information about that brain
-rather than a hint to search harder — read `semantic` first, per above. Broader
-words are still worth one retry; `--depth exact` is not — it looks at strictly
-less.
+compensate. At the default depth this has already searched the body of every
+note recall could read in **the brain it searched**, so "nothing" is real
+information about those notes rather than a hint to search harder — read
+`semantic` first, per above. Broader words are still worth one retry;
+`--depth exact` is not — it looks at strictly less.
+
+In a brain in a folder, that is not a promise about every file. Notes it left
+out are counted below, but recall never looks inside a folder the user's own
+rules exclude (`.gitignore`, `.memgignore`, the rules file): notes in one are
+neither searched nor counted, and an answer where other notes were searched does
+not mention them. So an empty answer is not proof that the user never wrote
+something down. Say what was searched, and that folders their rules exclude
+were not, rather than telling them they never wrote it. Do not open such a
+folder yourself.
 
 One brain is not the account. On a hosted account with more than one brain, an
-empty answer now names the brains that were NOT read and prints a runnable
-`--brain` command for each. Run it before you tell them the fact was never
-written down — four testers reached that conclusion about a note sitting in the
-next brain, and three of them said it out loud. Reading another brain does not
-move the machine's pointer.
+empty answer — or one of template cards only — names the brains that were NOT
+read and prints a runnable `--brain` command for each. Run it before you tell
+them the fact was never written down — four testers reached that conclusion
+about a note sitting in the next brain, and three of them said it out loud.
+Reading another brain does not move the machine's pointer.
+
+With `--json`, an answer with nothing the user wrote in it carries `hint`: no
+cards, or only template cards (`scaffolding: true`, below) — those are what
+`init` wrote, not the user's notes. `hint` is the one next step, the most
+specific that applies. First, the brain had nothing to search: it has no notes
+yet (the `remember` command that writes the first one into that brain — or,
+after `--brain` named a brain this machine does not point at, the
+`memgineering use --brain "<name>"` that makes it the target, since `remember`
+has no `--brain`), or it is a folder whose every note was left out (how many,
+why, and the `memgineering reindex` command that names each one). Then: its
+notes are in a script the question is not (ask again in that language), another
+brain was not read (the `--brain` or `--vault` command that reads it), meaning
+was not searched (and the server's reason), the hosted server's own advice, or
+fewer and broader words. Read it before you conclude anything from
+`cards: []` or from template cards. A `memgineering use --brain` in a hint
+moves this machine's pointer for every later command, not just the next one:
+offer it to the user and run it only on their yes. `hint` is absent whenever a
+card they wrote came back.
+
+**Held-back notes are counted in both modes.** When an answer has nothing the
+user wrote in it, recall counts what a brain in a folder left out, says why,
+and prints the `memgineering reindex` command that names each one: in the
+terminal right under `_Nothing matched._` or under the template cards' header,
+and at the front of `hint`. It opens with "Nothing in this brain could be
+searched: …" when no note could be searched at all, and with "Not every note in
+this brain was searched: …" when other notes were searched and at least one
+note of the first kind below was left out. Recall itself never names or shows a
+left-out note. The counts come in two kinds, and they mean different things:
+
+- **Notes**: excluded by the user's rules (`.gitignore`, `.memgignore`, the
+  rules file), listed in `.memgdeny`, held back because the name looks private,
+  refused because the content looks like a credential, or behind a symlink. A
+  note the user wrote exists and was left out on purpose. Do NOT tell them the
+  brain is empty or that they never wrote it down: tell them such a note exists,
+  and why; to say where it is, run that `reindex` — it lists each path and
+  changes no note — and give them the path. Do not open, print or read a
+  held-back note into the conversation unless they ask what it says: it was
+  held back because it may be private.
+- **Places nobody looked inside**: an excluded folder ("not looked inside"), or
+  another symlink, which is never followed. These are not evidence of a note —
+  an ignored `images/` or `.venv/` holds none. Say that recall could not look
+  inside them and that `reindex` names them; do not say a note was held back.
+  When "Nothing in this brain could be searched" lists only these, the brain may
+  hold no notes at all. Beside notes that were searched they are not counted at
+  all — see **Nothing matched** above.
 
 **Cards that are not answers.** A card marked `not filled in yet` is one of the
 five `01_BASE/` files, still exactly what `init` wrote (line endings aside). Nobody has answered

package/assets/memgineering-setup/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: memgineering-setup
-description: Use when installing or configuring memgineering, when moving a brain between a machine and an account, when renaming or deleting a hosted brain, or whenever the user asks WHICH of their AI tools can see this memory. Triggers include "set up memgineering", "connect my notes", "rename my brain", "delete that brain", "does my other AI see this too", "which of my tools can read this", "will it work in the app on my phone", "can I use this in ChatGPT", "does it work in Claude.ai", "no brain is linked".
+description: Use when installing or configuring memgineering, when moving a brain between a machine and an account, when renaming or deleting a hosted brain, when the user wants their whole account deleted, or whenever the user asks WHICH of their AI tools can see this memory. Triggers include "set up memgineering", "connect my notes", "rename my brain", "delete that brain", "delete my account", "close my account", "does my other AI see this too", "which of my tools can read this", "will it work in the app on my phone", "can I use this in ChatGPT", "does it work in Claude.ai", "no brain is linked".
 type: skill
 allowed-tools: Bash(memgineering:*)
 ---
@@ -25,11 +25,15 @@ guessing from a list.
 So when someone names a tool and asks whether it remembers too, work it out from
 those rows and answer plainly — not a hedge, not a promise:
 
-- **ChatGPT** — Settings → **Developer mode** → add an MCP server with
-  `https://mcp.memgineering.com/mcp`, then sign in with Google when it asks.
 - **Claude.ai, Claude Desktop, Cowork** — **Customize** → **Connectors** →
-  **Add custom connector** → the same URL. One connector covers all three, and
-  custom connectors are on every plan, the free one included.
+  **Add custom connector** → `https://mcp.memgineering.com/mcp`. One connector
+  covers all three, and custom connectors are on every plan, the free one
+  included. Then sign in with Google when it asks and tick both consents on the
+  connect screen (below).
+- **ChatGPT** — **paused for now.** The connect screen refuses it with
+  `connector_recipient_paused` while the notice about OpenAI is verified. Say so
+  plainly, and offer Claude or Gemini instead, or trying again later; do not
+  walk them through Developer mode in the meantime.
 - It reaches the brain **on their account**. A brain that lives only as a folder
   on this machine is out of its reach until it is moved up (see "Moving a brain
   between this machine and their account").
@@ -110,8 +114,35 @@ the brain identity and a `registry:` line with the username. If the registry
 line says "not linked", the link simply did not happen at sign-in time (older
 server, registry briefly down); a fresh `logout` + `login` links it. Never
 treat a missing registry line as a failed brain sign-in — the brain token
-stands on its own. Consent is asked exactly once, when an account is first
-created.
+stands on its own. Consent to the terms is asked once, when an account is
+first created. Two other consents are asked on every chat-app connection
+instead. Connecting Claude or Gemini gives the company that runs it what the app
+reads from the brain — brain names, the questions asked, note titles,
+summaries, claims and sources, the rules in force, opened notes in full — and
+what it writes, automatically at the start of every conversation and without
+asking each time it records; that company is in the United States. So the
+connect screen names who receives it and how to reach them, what it is used for
+(that company's model training included, as the app's own settings allow) and
+how long it is kept, and asks for two ticks: one to the provision to that
+company, one to the transfer abroad. Without both the app is not connected, and
+nothing else changes; to connect, the user starts again from the app and ticks
+both. If the screen says the notice changed, the user reloads it (or starts
+again from the app) and approves again. A program on their own computer (a
+connector redirecting to 127.0.0.1 or localhost) asks for no tick — what it
+sends onward follows that program's own terms. An app whose recipient
+memgineering has no notice for is refused (`unknown_connector_recipient`):
+suggest Claude or Gemini.
+
+**`logout --all` is "disconnect everything".** It ends every brain token on
+the account (every machine, ChatGPT and Claude connections, the website), and
+anything approved before that moment — a sign-in nobody collected yet, a half-
+finished connection — can no longer finish. It also ends every registry
+sign-in of the same Google account. `--json` carries `registry_sessions`:
+`revoked` (with a count), `not_linked`, or `unreachable` with a `hint` — on
+that one, tell the user the brain side is done and relay the hint (it names
+`kordis logout`). Signing in again afterwards works as usual. With nothing
+signed in on this machine, it says how to do it instead: the website's button,
+or `login` first.
 
 **When the setup finishes, say what is true and no more.** Commands work
 immediately — `recall`, `remember`, the session hook. What waits is the
@@ -284,6 +315,45 @@ person to retype the brain's name; with no terminal it refuses rather than
 deciding. `unlink --brain` is the gentle sibling: it only stops this machine
 reading a brain and deletes nothing.
 
+### Deleting the whole account
+
+`memgineering delete-account --confirm "delete my account"` deletes the
+hosted brain account (every brain on it, every note, every token) and the
+registry account the same Google sign-in made (profile, stars, follows,
+comment text, sign-ins; the account is renamed `deleted-…`, and its
+published packages and versions stay at their existing addresses), in that
+order, then signs this machine out. Nothing comes back. Run it ONLY
+when the person has explicitly asked for their account to be deleted, and
+pass the sentence exactly as written; without `--confirm` in a real terminal
+it asks them to type it, and with no terminal it refuses rather than
+deciding. There is no dry run.
+
+A person with no terminal can delete the same two accounts on the website:
+signed in at memgineering.com/brain, the "Delete my account" section at the
+bottom of the page, confirmed with one tick (there is no sentence to type). Point
+them there when they ask; you cannot press it for them. A deletion that stopped
+half way is finished from the same page ("Finish deleting"). A Google account
+that never opened a brain can delete its registry account from the same page too:
+signed in, the consent screen shows a "Delete my account" section below the terms,
+with the same single tick. Only an account that never signed in with Google, and a
+brain account whose terms were never accepted, are deleted by mail to
+support@memgineering.com.
+
+- **Before deleting anything** it checks both sign-ins work and belong to one
+  person: the two accounts' emails, or — when either account has no email on
+  record — this machine's registry sign-in, which the brain sign-in issued. `--json` says which in `matched`. Different people answer
+  `account_mismatch` and nothing is deleted.
+- **It refuses rather than deleting half**: a machine signed in to a brain
+  with no registry half answers `not_linked` (`memgineering logout`, then
+  `memgineering login`, links it). A machine signed in to nothing answers
+  `not_signed_in`: a brain kept in a folder has no account, and this command
+  never touches folders on this disk.
+- **Stopped halfway** — `account_partly_deleted` means the brain account is
+  gone and the registry account is not. Tell the person exactly that, then
+  run the same command again: it skips the brain and finishes the registry.
+- Somebody who cannot sign in, or whose account never used Google, writes to
+  support@memgineering.com from the address on the account.
+
 **They already keep notes in a folder on this machine** — carry them up
 instead of starting empty:
 
@@ -506,17 +576,23 @@ by hand in the ordinary case — writes keep the index in step on their own.
 what is missing and clears stored rows for notes the brain has since been told
 not to read, reporting both; `--local` forces the folder brain. On a brain in a
 FOLDER it also names what it left out — notes a deny name, a `.memgignore` rule
-or a symlink kept from the index, and any folder a rule excluded whole — so "3
-notes rebuilt" is never the whole answer when a fourth was dropped. A hosted
-reindex cannot say that: the rules are applied on the machine that pushed, so
-the server only ever saw what arrived.
+or a symlink kept from the index, any folder a rule excluded whole, and any other
+symlink, which is never followed — so "3 notes rebuilt" is never the whole
+answer when a fourth was dropped. A hosted reindex cannot say that: the rules are
+applied on the machine that pushed, so the server only ever saw what arrived.
 
 Under `--json` that is `not_indexed` with `denied_by_name`, `denied_explicitly`,
-`excluded_by_rule`, `skipped_symlinks` and `excluded_folders`. **Read the count
-together with `excluded_folders`**: a rule that names a folder stops the walk at
-the folder, so nothing inside it is ever counted — `not_indexed: 0` beside a
-non-empty `excluded_folders` means the count is a floor, not the answer. `push`
-reports the same set with its total under `not_sent`. `--rebuild`
+`excluded_by_rule`, `skipped_symlinks`, `excluded_folders` and
+`skipped_other_symlinks`. **Read the count together with the last two**: a rule
+that names a folder stops the walk at the folder, and a symlink is never
+followed, so the notes in such a folder are never counted — `not_indexed: 0`
+beside a non-empty `excluded_folders` or `skipped_other_symlinks` means the count
+is a floor, not the answer. `push` reports the same set with its total under
+`not_sent`. A `recall` that brings back nothing the user wrote — no cards, or
+only templates — counts the same set by reason in both modes (beside notes it
+did search, only when a note is among them) and prints this command, never a
+path; what to tell the user then is in `memgineering-recall`.
+`--rebuild`
 exists for one situation only, where an embedding model changed the shape of its
 answers without changing its name and the index has to be laid down again.