open-memex 0.7.0-alpha.1 → 0.7.0-alpha.13

package/dist/retrieve/display.js

@@ -0,0 +1,161 @@
+/**
+ * Display helpers (D68): how memory provenance, age, and state are
+ * rendered on the user-facing surfaces — the `memory_list` inventory an
+ * agent shows its user, and the `open-memex inventory` reports.
+ *
+ * Two rules from the 3-C design (v2) live here:
+ * - The list format is STRUCTURED data (number + id + created= + source=
+ *   + state tags). The plain-language renderings ("you said this",
+ *   "3 days ago") live in the guidance surfaces (tool descriptions,
+ *   SKILL.md, MCP handshake) so an agent rephrases them in the
+ *   conversation's language — the raw enums never get localized or
+ *   reworded inside the data itself.
+ * - Nothing truncates silently: callers pair these lines with the true
+ *   totals so a cut list says so.
+ */
+/** Human age for a saved memory: "just now", "3 days ago", else a date. */
+export function relativeTime(ts, now = Date.now()) {
+    if (!ts || Number.isNaN(ts))
+        return "";
+    const diff = now - ts;
+    if (diff < 0)
+        return "just now";
+    const minute = 60_000;
+    const hour = 60 * minute;
+    const day = 24 * hour;
+    if (diff < minute)
+        return "just now";
+    if (diff < hour) {
+        const n = Math.floor(diff / minute);
+        return `${n} minute${n === 1 ? "" : "s"} ago`;
+    }
+    if (diff < day) {
+        const n = Math.floor(diff / hour);
+        return `${n} hour${n === 1 ? "" : "s"} ago`;
+    }
+    if (diff < 30 * day) {
+        const n = Math.floor(diff / day);
+        return `${n} day${n === 1 ? "" : "s"} ago`;
+    }
+    const d = new Date(ts);
+    const mm = String(d.getMonth() + 1).padStart(2, "0");
+    const dd = String(d.getDate()).padStart(2, "0");
+    return `on ${d.getFullYear()}-${mm}-${dd}`;
+}
+/** Compact age token for the structured list format: `3d`, `12h`, `now`. */
+export function ageToken(ts, now = Date.now()) {
+    if (!ts || Number.isNaN(ts))
+        return "?";
+    const diff = now - ts;
+    if (diff < 60_000)
+        return "now";
+    if (diff < 3_600_000)
+        return `${Math.floor(diff / 60_000)}m`;
+    if (diff < 86_400_000)
+        return `${Math.floor(diff / 3_600_000)}h`;
+    if (diff < 60 * 86_400_000)
+        return `${Math.floor(diff / 86_400_000)}d`;
+    const d = new Date(ts);
+    const mm = String(d.getMonth() + 1).padStart(2, "0");
+    const dd = String(d.getDate()).padStart(2, "0");
+    return `${d.getFullYear()}-${mm}-${dd}`;
+}
+/**
+ * Provenance in the user's words (D68). Used by prose surfaces (HTML
+ * report); the structured list keeps the raw `source=` enum instead.
+ * The distinction that matters to the user is *whose words these were* —
+ * said outright, asked to be saved, auto-captured, or inferred by the
+ * agent and possibly wrong.
+ */
+export function sourceLabel(source) {
+    switch (source) {
+        case "user":
+            return "you said this";
+        case "cli":
+            return "you saved this from the command line";
+        case "tool":
+            return "you asked me to save this";
+        case "keyword":
+            return "auto-captured from your own wording";
+        case "inference":
+            return "I inferred this — not in your words, check me";
+        case "import":
+            return "imported from another machine";
+        default:
+            return source ? `saved (${source})` : "saved";
+    }
+}
+/**
+ * Review state in plain words for project scopes (D68). Personal
+ * memories are always `draft` by design; callers must not show this
+ * for them — "not yet shared" would be alarming noise there.
+ */
+export function reviewStateLabel(reviewState) {
+    switch (reviewState) {
+        case "draft":
+            return "still in your outbox — not in the repo yet";
+        case "proposed":
+            return "shared with the project, waiting for review";
+        case "approved":
+            return "approved, not yet published";
+        case "published":
+            return "published to the repo";
+        case "rejected":
+            return "reviewed and rejected";
+        default:
+            return reviewState ?? "draft";
+    }
+}
+/** Escape user content for HTML. Memory text is arbitrary user input. */
+export function escapeHtml(s) {
+    return s
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}
+/**
+ * One structured inventory line (D68):
+ *   3. [fact] id=01K6… created=3d source=user [draft] — body text
+ * Number and id always appear together: the number is for the user's
+ * mouth ("delete #3"), the id is the machine contract. `created=` is
+ * when the memory was learned; `updated=` appears only when it moved
+ * materially later (supersede/promote touch updated_at).
+ *
+ * D70: `index` must be a running counter across every section of one
+ * listing — a per-section counter produces two "#1"s in a single
+ * `scope: both` output, which makes "delete #3" a guess.
+ */
+export function formatInventoryLine(index, hit, personalKey, now = Date.now()) {
+    const parts = [
+        `${index + 1}.`,
+        `[${hit.type}]`,
+        `id=${hit.id}`,
+        `created=${ageToken(hit.created_at ?? hit.updated_at, now)}`,
+        `source=${hit.source || "?"}`,
+    ];
+    const created = hit.created_at ?? hit.updated_at ?? 0;
+    if (hit.updated_at && hit.updated_at - created >= 86_400_000) {
+        parts.push(`updated=${ageToken(hit.updated_at, now)}`);
+    }
+    if (hit.scope_key !== personalKey) {
+        const state = hit.review_state ?? "draft";
+        if (state !== "published")
+            parts.push(`[${state}]`);
+    }
+    if (hit.status !== "active")
+        parts.push(`[${hit.status}]`);
+    const body = hit.snippet.replace(/\s+/g, " ").trim();
+    return `${parts.join(" ")} — ${body}`;
+}
+/**
+ * Truncation disclosure (D68): a cut list always says so.
+ * D70: the wording names the surface that can show everything — the CLI —
+ * so a hidden entry is always reachable.
+ */
+export function truncationNote(shown, total, cli = "open-memex") {
+    if (total <= shown)
+        return null;
+    return `… and ${total - shown} more not shown (raise limit up to 100, run \`${cli} list --limit 100\`, or use memory_search to find something specific).`;
+}

package/dist/retrieve/inject.js

@@ -20,6 +20,6 @@ export function buildContextBlock(scope, cfg) {
         for (const m of project)
             lines.push(`- [${m.type}]${hitStateLabel(m)} ${oneLine(m.snippet)}`);
     }
-    lines.push("", "Use the `memory_search` tool to look up more. Use `memory_add` to save new facts. Do not mention this block to the user unless asked.");
+    lines.push("", "Use the `memory_search` tool to look up more. Use `memory_add` to save new facts. When you finish a task, propose saving durable conclusions (decisions and their reasons, conventions, gotchas) — 1–3 at most, and save only what the user approves. Do not mention this block to the user unless asked.");
     return lines.join("\n");
 }

package/dist/retrieve/search.js

@@ -1,17 +1,28 @@
 import { db } from "../store/db.js";
 import { toFtsQuery } from "./query.js";
 function toHit(r) {
+    const aliases = r.aliases ? r.aliases.split(",").map((a) => a.trim()).filter(Boolean) : [];
+    let snippet = r.snippet ?? "";
+    // D61: the snippet highlights matches in the body column only. When the
+    // match came through an alias (body shows no highlight), say so — the
+    // hit otherwise looks unrelated to the query.
+    if (aliases.length > 0 && !/\[[^\]]+\]/.test(snippet)) {
+        snippet += ` (aka: ${aliases.join(", ")})`;
+    }
     return {
         id: r.id,
         scope_key: r.scope_key,
         project_name: r.project_name,
         type: r.type,
         tags: r.tags ? r.tags.split(",").filter(Boolean) : [],
-        snippet: r.snippet ?? "",
+        aliases,
+        snippet,
         score: r.score,
         updated_at: r.updated_at,
         status: r.status,
         review_state: r.review_state ?? "draft",
+        source: r.source ?? "",
+        created_at: r.created_at ?? r.updated_at ?? 0,
     };
 }
 /**
@@ -52,7 +63,7 @@ function resolveVisible(rows, limit, stats) {
             return cached;
         const r = db()
             .prepare(`SELECT id, scope_key, project_name, type, tags, updated_at, status,
-                superseded_by, review_state, substr(content, 1, 240) AS snippet
+                superseded_by, review_state, source, created_at, substr(content, 1, 240) AS snippet
          FROM memories WHERE id = ?`)
             .get(id);
         if (!r)
@@ -124,8 +135,8 @@ export function search(query, opts = {}) {
         : "";
     const typeFilter = opts.type ? ` AND m.type = ?` : "";
     const sql = `
-    SELECT m.id, m.scope_key, m.project_name, m.type, m.tags, m.updated_at,
-           m.status, m.superseded_by, m.review_state,
+    SELECT m.id, m.scope_key, m.project_name, m.type, m.tags, m.aliases, m.updated_at,
+           m.status, m.superseded_by, m.review_state, m.source, m.created_at,
            snippet(memories_fts, 0, '[', ']', ' ... ', 12) AS snippet,
            bm25(memories_fts) AS score
     FROM memories_fts
@@ -155,7 +166,7 @@ export function list(scopeKey, opts = {}) {
     const typeFilter = opts.type ? ` AND type = ?` : "";
     const sql = `
     SELECT id, scope_key, project_name, type, tags, updated_at, status,
-           superseded_by, review_state, substr(content, 1, 240) AS snippet
+           superseded_by, review_state, source, created_at, substr(content, 1, 240) AS snippet
     FROM memories
     WHERE scope_key = ?${typeFilter}
     ORDER BY updated_at DESC
@@ -169,5 +180,33 @@ export function list(scopeKey, opts = {}) {
         .prepare(sql)
         .all(...params);
     const raw = rows.map((r) => ({ ...r, score: 1 }));
+    if (opts.include === "all") {
+        // D68: the audit view — every row as stored (superseded versions,
+        // retracted, archived), no chain collapsing, capped at limit.
+        return raw.slice(0, limit).map(toHit);
+    }
     return resolveVisible(raw, limit);
 }
+/**
+ * True totals for the inventory's truncation disclosure (D68). Under
+ * `active` the visible set is the newest of each chain, which in a
+ * consistent store is exactly the rows whose status is active/deprecated.
+ *
+ * D70: one deliberate exception — a `superseded` row whose chain target is
+ * missing (a dangling pointer, which the read path self-heals with a
+ * warning) is returned as a visible hit by resolveVisible but is not
+ * counted here, so the total can read one low in that state. Not worth
+ * widening the query for a self-healing case; the disclosure stays honest
+ * in every state a user can reach deliberately.
+ */
+export function countList(scopeKey, opts = {}) {
+    const typeFilter = opts.type ? ` AND type = ?` : "";
+    const statusFilter = opts.include === "all" ? "" : ` AND status IN ('active', 'deprecated')`;
+    const params = [scopeKey];
+    if (opts.type)
+        params.push(opts.type);
+    const row = db()
+        .prepare(`SELECT COUNT(*) AS n FROM memories WHERE scope_key = ?${statusFilter}${typeFilter}`)
+        .get(...params);
+    return row.n;
+}

package/dist/review.js

@@ -23,7 +23,7 @@ import * as path from "node:path";
 import { loadConfig } from "./config.js";
 import { inRepoMemoriesDirPath, projectRoot } from "./paths.js";
 import { resolveProjectScope } from "./scope.js";
-import { parse as parseMemory, serialize, ulid, writeMemoryFile, } from "./store/markdown.js";
+import { parse as parseMemory, serialize, atomicWriteTextSync, ulid, writeMemoryFile, } from "./store/markdown.js";
 import { findMemoryFile } from "./store/lifecycle.js";
 import { upsertFromFile } from "./store/sync.js";
 /** Best-effort author identity: git user.name, else the OS user. */
@@ -79,6 +79,12 @@ function copyPersonalToProject(sourceId, srcFm, srcBody, opts = {}) {
         id: ulid(),
         scope: "project",
         scope_key: project.key,
+        // D64: the copy is headed for the team. Source visibility (usually
+        // "private") must not ride along: export excludes private by default,
+        // so a private copy would silently vanish from every bundle the team
+        // builds. Proposing IS the act of sharing — the copy is internal;
+        // the personal original keeps its own visibility, untouched.
+        visibility: "internal",
         project_name: project.projectName,
         created_at: now,
         updated_at: now,
@@ -194,7 +200,7 @@ export function promoteMemory(id, opts = {}) {
             },
         ],
     };
-    fs.writeFileSync(mf.filePath, serialize(fm, mf.body), "utf8");
+    atomicWriteTextSync(mf.filePath, serialize(fm, mf.body));
     upsertFromFile({ fm, body: mf.body, filePath: mf.filePath, mtimeMs: Date.now() });
     return { id, from, to, history: fm.review_history };
 }
@@ -428,7 +434,7 @@ export function resolveConflict(target) {
     if (conflicts.length > 0)
         return { ok: false, filePath, conflicts };
     const fm = merged;
-    fs.writeFileSync(filePath, serialize(fm, mergedBody), "utf8");
+    atomicWriteTextSync(filePath, serialize(fm, mergedBody));
     upsertFromFile({ fm, body: mergedBody, filePath, mtimeMs: Date.now() });
     return { ok: true, filePath, autoMerged: [...new Set(autoMerged)] };
 }

package/dist/scope.js

@@ -57,6 +57,23 @@ export function resolveCwdScope(worktree) {
         projectName = "workspace";
     return scopeFromSeed(seed, projectName);
 }
+/** Pick the directory that seeds scope resolution from a host's candidate
+ *  roots. OpenCode v1 hands the plugin both `worktree` (the repo root — but
+ *  the filesystem root, e.g. `C:\` or `/`, when the opened folder is not a
+ *  git repo) and `directory` (the folder actually opened). Seeding on a
+ *  filesystem root collapses every non-git folder on a drive into one shared
+ *  `project__workspace__…` scope (D71), so prefer `worktree` only when it is
+ *  a real directory below the filesystem root. */
+export function pickScopeRoot(worktree, directory) {
+    const isFsRoot = (p) => path.parse(p).root === p;
+    if (worktree && !isFsRoot(worktree))
+        return worktree;
+    if (directory)
+        return directory;
+    if (worktree)
+        return worktree;
+    return process.cwd();
+}
 export function resolveProjectScope(worktree) {
     const target = worktree && worktree.length > 0 ? worktree : ".";
     const remote = tryGitRemote(target);

package/dist/store/db.js

@@ -26,6 +26,7 @@ CREATE TABLE IF NOT EXISTS memories (
   importance   TEXT NOT NULL DEFAULT 'normal',
   status       TEXT NOT NULL DEFAULT 'active',
   tags         TEXT NOT NULL DEFAULT '',
+  aliases      TEXT NOT NULL DEFAULT '',
   content      TEXT NOT NULL,
   cjk          TEXT NOT NULL DEFAULT '',
   content_hash TEXT NOT NULL DEFAULT '',
@@ -52,6 +53,7 @@ const FTS_SCHEMA = `
 CREATE VIRTUAL TABLE IF NOT EXISTS memories_fts USING fts5(
   content,
   tags,
+  aliases,
   type,
   cjk,
   scope_key UNINDEXED,
@@ -61,24 +63,24 @@ CREATE VIRTUAL TABLE IF NOT EXISTS memories_fts USING fts5(
 );
 
 CREATE TRIGGER IF NOT EXISTS memories_ai AFTER INSERT ON memories BEGIN
-  INSERT INTO memories_fts(rowid, content, tags, type, cjk, scope_key)
-  VALUES (new.rowid, new.content, new.tags, new.type, new.cjk, new.scope_key);
+  INSERT INTO memories_fts(rowid, content, tags, aliases, type, cjk, scope_key)
+  VALUES (new.rowid, new.content, new.tags, new.aliases, new.type, new.cjk, new.scope_key);
 END;
 
 CREATE TRIGGER IF NOT EXISTS memories_ad AFTER DELETE ON memories BEGIN
-  INSERT INTO memories_fts(memories_fts, rowid, content, tags, type, cjk, scope_key)
-  VALUES ('delete', old.rowid, old.content, old.tags, old.type, old.cjk, old.scope_key);
+  INSERT INTO memories_fts(memories_fts, rowid, content, tags, aliases, type, cjk, scope_key)
+  VALUES ('delete', old.rowid, old.content, old.tags, old.aliases, old.type, old.cjk, old.scope_key);
 END;
 
 CREATE TRIGGER IF NOT EXISTS memories_au AFTER UPDATE ON memories BEGIN
-  INSERT INTO memories_fts(memories_fts, rowid, content, tags, type, cjk, scope_key)
-  VALUES ('delete', old.rowid, old.content, old.tags, old.type, old.cjk, old.scope_key);
-  INSERT INTO memories_fts(rowid, content, tags, type, cjk, scope_key)
-  VALUES (new.rowid, new.content, new.tags, new.type, new.cjk, new.scope_key);
+  INSERT INTO memories_fts(memories_fts, rowid, content, tags, aliases, type, cjk, scope_key)
+  VALUES ('delete', old.rowid, old.content, old.tags, old.aliases, old.type, old.cjk, old.scope_key);
+  INSERT INTO memories_fts(rowid, content, tags, aliases, type, cjk, scope_key)
+  VALUES (new.rowid, new.content, new.tags, new.aliases, new.type, new.cjk, new.scope_key);
 END;
 `;
 /** Current index schema version. Bump when TABLE_SCHEMA/FTS_SCHEMA change. */
-const SCHEMA_VERSION = 6;
+const SCHEMA_VERSION = 7;
 function userVersion(d) {
     const row = d.prepare("PRAGMA user_version").get();
     return row.user_version;

package/dist/store/lifecycle.js

@@ -5,7 +5,7 @@ import { db } from "./db.js";
 import { paths, projectRoot, inRepoMemoriesDirPath, } from "../paths.js";
 import { loadConfig } from "../config.js";
 import { cjkIndexText } from "../retrieve/cjk.js";
-import { parse, serialize, ulid, msToRfc3339, } from "./markdown.js";
+import { parse, serialize, atomicWriteTextSync, ulid, msToRfc3339, } from "./markdown.js";
 /**
  * Dedup + lifecycle (V2-DESIGN §3.3, §3.4).
  *
@@ -111,7 +111,7 @@ export function findMemoryFile(id) {
     return { fm: parsed.fm, body: parsed.body, filePath, mtimeMs: st.mtimeMs };
 }
 export function rewriteMemoryFile(mf) {
-    fs.writeFileSync(mf.filePath, serialize(mf.fm, mf.body), "utf8");
+    atomicWriteTextSync(mf.filePath, serialize(mf.fm, mf.body));
 }
 /**
  * Chain integrity (§3.3): supersedes/superseded_by must be pairwise
@@ -171,13 +171,21 @@ export function supersede(oldId, input) {
         id: ulid(),
         type: input.type ?? oldMf.fm.type,
         tags: input.tags ?? oldMf.fm.tags,
+        // D61: aliases carry forward unless the caller replaces them.
+        aliases: input.aliases ?? oldMf.fm.aliases,
         source: input.source ?? oldMf.fm.source,
         status: "active",
         created_at: now,
         updated_at: now,
         supersedes: oldId,
         superseded_by: null,
-        review_state: "draft",
+        // D64: the replacement inherits the old memory's place in the review
+        // flow. A draft stays a draft; anything that had entered review
+        // (proposed/approved/published/rejected) re-enters at "proposed" so
+        // promote can advance it — resetting to "draft" would strand the new
+        // file in the repo, where submit cannot reach it (not the outbox)
+        // and promote refuses drafts.
+        review_state: (oldMf.fm.review_state ?? "draft") === "draft" ? "draft" : "proposed",
         proposed_by: null,
         approved_by: null,
         derived_from: null,
@@ -185,7 +193,7 @@ export function supersede(oldId, input) {
     };
     const dir = path.dirname(oldMf.filePath);
     const newPath = path.join(dir, `${newFm.id}.md`);
-    fs.writeFileSync(newPath, serialize(newFm, input.body), "utf8");
+    atomicWriteTextSync(newPath, serialize(newFm, input.body));
     const st = fs.statSync(newPath);
     const newMf = {
         fm: newFm,
@@ -222,6 +230,14 @@ export function setStatus(id, status) {
     if (mf.fm.status === "superseded") {
         throw new Error(`memory ${id} is superseded (chain-managed); supersede it again instead of changing status directly`);
     }
+    // D64: retraction is a one-way door through this path. A retracted
+    // memory was withdrawn on purpose (wrong, sensitive, superseded by
+    // policy); silently flipping it back to active would return it to
+    // recall (retrieval excludes retracted) with no review. Save a new
+    // memory if the content is valid again.
+    if (mf.fm.status === "retracted" && status === "active") {
+        throw new Error(`memory ${id} is retracted and cannot return to active; save the content as a new memory if it is valid again`);
+    }
     mf.fm.status = status;
     mf.fm.updated_at = msToRfc3339(Date.now());
     rewriteMemoryFile(mf);

package/dist/store/markdown.js

@@ -155,6 +155,12 @@ export function normalizeFrontmatter(raw) {
         tags: Array.isArray(raw.tags)
             ? raw.tags.filter((t) => typeof t === "string")
             : [],
+        ...(Array.isArray(raw.aliases)
+            ? (() => {
+                const aliases = normalizeAliases(raw.aliases.filter((a) => typeof a === "string"));
+                return aliases.length > 0 ? { aliases } : {};
+            })()
+            : {}),
         source: typeof raw.source === "string" ? raw.source : "",
         created_at: msToRfc3339(timeToMs(raw.created_at)),
         updated_at: msToRfc3339(timeToMs(raw.updated_at)),
@@ -170,11 +176,43 @@ export function normalizeFrontmatter(raw) {
         review_history: asReviewHistory(raw.review_history),
     };
 }
+/**
+ * D61: normalize capture-time aliases — trim, drop empties, dedupe
+ * (case-insensitive), cap at 4. Bad aliases are noise, never an error.
+ * Shared by the tool ops, the CLI, and frontmatter parsing.
+ */
+export function normalizeAliases(input) {
+    if (!input)
+        return [];
+    const seen = new Set();
+    const out = [];
+    for (const a of input) {
+        const t = a.trim();
+        if (!t)
+            continue;
+        const k = t.toLowerCase();
+        if (seen.has(k))
+            continue;
+        seen.add(k);
+        out.push(t);
+        if (out.length >= 4)
+            break;
+    }
+    return out;
+}
 export function isTaxonomyType(t) {
     return TAXONOMY.has(t);
 }
 export function serialize(fm, body) {
-    const yml = yaml.dump(fm, { lineWidth: -1, quotingType: '"' });
+    // D61: an empty aliases list is noise in the file — drop the key entirely
+    // rather than relying on the YAML dumper to skip an undefined value
+    // (parse only sets the field when non-empty; keep both ends consistent).
+    let out = fm;
+    if (fm.aliases && fm.aliases.length === 0) {
+        out = { ...fm };
+        delete out.aliases;
+    }
+    const yml = yaml.dump(out, { lineWidth: -1, quotingType: '"' });
     return `---\n${yml}---\n\n${body.trimEnd()}\n`;
 }
 /** Raw frontmatter parse (no normalization) — for migration tooling. */
@@ -199,18 +237,26 @@ export function parse(raw) {
         return null;
     return { fm: normalizeFrontmatter(parsed.rawFm), body: parsed.body };
 }
+/**
+ * Atomic text publish: write a sibling tmp file and rename over the
+ * target, so a concurrent reader (another process mid-sync) never sees a
+ * torn half-written file. Same-directory rename is atomic on one fs.
+ * Every memory-file write/rewrite must go through here (D57 for creates,
+ * D64 extended to all rewrites: supersede flips, review transitions,
+ * submit landings, status changes).
+ */
+export function atomicWriteTextSync(filePath, text) {
+    const tmpPath = `${filePath}.tmp-${process.pid}`;
+    fs.writeFileSync(tmpPath, text, "utf8");
+    fs.renameSync(tmpPath, filePath);
+}
 export function writeMemoryFile(fm, body) {
     // 2B/D26: project drafts live in appdata (the outbox) — the in-repo dir
     // only ever holds submitted memories (proposed/approved/published).
     // Personal stays in appdata and never leaves the machine.
     const dir = memoriesDirFor(fm.scope_key);
     const filePath = path.join(dir, `${fm.id}.md`);
-    // Atomic publish (D57): write a sibling tmp file and rename over the
-    // target, so a concurrent reader (another process mid-sync) never sees a
-    // torn half-written memory. Same-directory rename is atomic on one fs.
-    const tmpPath = `${filePath}.tmp-${process.pid}`;
-    fs.writeFileSync(tmpPath, serialize(fm, body), "utf8");
-    fs.renameSync(tmpPath, filePath);
+    atomicWriteTextSync(filePath, serialize(fm, body));
     const st = fs.statSync(filePath);
     return { filePath, mtimeMs: st.mtimeMs };
 }

package/dist/store/migrate.js

@@ -2,8 +2,9 @@ import fs from "node:fs";
 import path from "node:path";
 import { memoriesDirFor, memoriesDirPath } from "../paths.js";
 import { db } from "./db.js";
-import { iterMemoryFiles, readMemoryFile, serialize, } from "./markdown.js";
+import { iterMemoryFiles, readMemoryFile, serialize, timeToMs, atomicWriteTextSync, } from "./markdown.js";
 import { syncScope } from "./sync.js";
+import { PERSONAL_SCOPE } from "../scope.js";
 /** True if this scope has at least one `.md` file on disk. Does not create
  *  the directory if it doesn't already exist. */
 export function scopeHasFiles(scopeKey) {
@@ -60,7 +61,10 @@ export function migrateScope(fromKey, toKey, opts = {}) {
             else if (strategy === "overwrite") {
                 log(`conflict: overwriting destination (--on-conflict=overwrite): ${dstPath}`);
             }
-            else if (dst.fm.updated_at >= mf.fm.updated_at) {
+            else if (timeToMs(dst.fm.updated_at) >= timeToMs(mf.fm.updated_at)) {
+                // Compare parsed instants, not RFC-3339 strings: lexicographic
+                // order breaks around fractional seconds ("…:00Z" > "…:00.005Z"),
+                // letting the older file win.
                 action = "skip";
                 log(`conflict: kept destination (newer updated_at): ${dstPath}`);
             }
@@ -72,14 +76,21 @@ export function migrateScope(fromKey, toKey, opts = {}) {
             stats.skipped++;
             continue;
         }
+        // Re-key AND re-scope: scope/visibility must follow the destination
+        // (P0 review, 2026-10-03). Rewriting only scope_key produced files
+        // submit rejects ("scope is personal") or personal memories carrying
+        // visibility: internal into exports.
+        const toPersonal = toKey === PERSONAL_SCOPE.key;
         const newFm = {
             ...mf.fm,
             scope_key: toKey,
+            scope: toPersonal ? "personal" : "project",
+            visibility: toPersonal ? "private" : "internal",
             project_name: opts.toProjectName ?? mf.fm.project_name,
         };
         const raw = serialize(newFm, mf.body);
         if (!dryRun) {
-            fs.writeFileSync(dstPath, raw, "utf8");
+            atomicWriteTextSync(dstPath, raw);
             // Only unlink source if it's a different path (paths differ because
             // scope dir differs; belt-and-suspenders check).
             if (path.resolve(srcPath) !== path.resolve(dstPath)) {

package/dist/store/sync.js

@@ -7,8 +7,8 @@ import { iterMemoryFiles, iterInRepoMemoryFiles, readMemoryFile, timeToMs, } fro
 import { projectRoot, paths } from "../paths.js";
 import { loadConfig } from "../config.js";
 const UPSERT_SQL = `
-  INSERT INTO memories (id, scope_key, scope, visibility, project_name, type, role, importance, status, tags, content, cjk, content_hash, superseded_by, source, file_path, mtime_ms, created_at, updated_at, review_state)
-  VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+  INSERT INTO memories (id, scope_key, scope, visibility, project_name, type, role, importance, status, tags, aliases, content, cjk, content_hash, superseded_by, source, file_path, mtime_ms, created_at, updated_at, review_state)
+  VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
   ON CONFLICT(id) DO UPDATE SET
     scope_key    = excluded.scope_key,
     scope        = excluded.scope,
@@ -19,6 +19,7 @@ const UPSERT_SQL = `
     importance   = excluded.importance,
     status       = excluded.status,
     tags         = excluded.tags,
+    aliases      = excluded.aliases,
     content      = excluded.content,
     cjk          = excluded.cjk,
     content_hash = excluded.content_hash,
@@ -53,7 +54,8 @@ export function upsertFromFile(mf) {
 function writeRow(mf, mtimeMs) {
     const { fm, body, filePath } = mf;
     const tags = (fm.tags ?? []).join(",");
-    db().prepare(UPSERT_SQL).run(fm.id, fm.scope_key, fm.scope, fm.visibility, fm.project_name, fm.type, fm.role, fm.importance, fm.status, tags, body, cjkIndexText(body + "\n" + tags), contentHash(body), fm.superseded_by ?? null, fm.source ?? "", filePath, mtimeMs, timeToMs(fm.created_at), timeToMs(fm.updated_at), fm.review_state ?? "draft");
+    const aliases = (fm.aliases ?? []).join(",");
+    db().prepare(UPSERT_SQL).run(fm.id, fm.scope_key, fm.scope, fm.visibility, fm.project_name, fm.type, fm.role, fm.importance, fm.status, tags, aliases, body, cjkIndexText(body + "\n" + tags + "\n" + aliases), contentHash(body), fm.superseded_by ?? null, fm.source ?? "", filePath, mtimeMs, timeToMs(fm.created_at), timeToMs(fm.updated_at), fm.review_state ?? "draft");
 }
 export function deleteFromIndex(id) {
     db().prepare(`DELETE FROM memories WHERE id = ?`).run(id);

package/dist/store/v2migrate.js

@@ -1,7 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { paths } from "../paths.js";
-import { parseRawFrontmatter, normalizeFrontmatter, isTaxonomyType, serialize, } from "./markdown.js";
+import { parseRawFrontmatter, normalizeFrontmatter, isTaxonomyType, serialize, atomicWriteTextSync, } from "./markdown.js";
 /**
  * v1 → v2 file migration (V2-DESIGN §19). Explicit only — run via
  * `open-memex migrate --to-v2`. Converts frontmatter in place:
@@ -174,7 +174,7 @@ function planDir(dir, memoriesRoot, result) {
 function applyPlans(result) {
     for (const plan of result.plans) {
         fs.mkdirSync(path.dirname(plan.toPath), { recursive: true });
-        fs.writeFileSync(plan.toPath, serialize(plan.fm, plan.body), "utf8");
+        atomicWriteTextSync(plan.toPath, serialize(plan.fm, plan.body));
         if (plan.toPath !== plan.fromPath)
             fs.unlinkSync(plan.fromPath);
     }