open-memex 0.7.0-alpha.4 → 0.7.0-alpha.6

package/AGENTS.md

@@ -151,16 +151,19 @@ AGENTS.md hygiene footer, the MCP handshake, and the tool descriptions.
 
 - Statuses: `active → superseded | deprecated | retracted | archived`. Retrieval excludes `retracted`/`archived`, ranks `active` above `deprecated`.
 - Never hand-write `status: superseded` or half a chain. Use the `supersede` code path (`src/store/lifecycle.ts`): the old record keeps its file, flips to `superseded`, and both sides get `supersedes`/`superseded_by`. Only `active` memories can be superseded.
+- Superseding a memory that had entered review (proposed/approved/published/rejected) starts the replacement at `review_state: proposed` so `promote` can advance it (D64). Never reset it to `draft` — a draft in the repo dir is stranded (submit only moves outbox files).
+- `setStatus` refuses `retracted → active` (D64): retracted content must not silently return to recall. Save a new memory instead.
+- **Every memory-file write goes through `atomicWriteTextSync`** (markdown.ts; tmp + rename). The create path, supersede flips, review transitions, submit landings, migrate/v2migrate rewrites — no direct `fs.writeFileSync` on a memory file. A torn read mid-rewrite parses as a deletion and drops the memory from the index.
 - Chain integrity is self-healing: on read, a missing counterpart is auto-completed with a warning; a dangling pointer warns but is never fabricated. Don't "fix" chains by editing frontmatter directly — let the read path do it.
 - Frontmatter is `schema_version: 2`. The SQLite index schema is versioned separately and rebuilds automatically on version change — never hand-edit `index.db`.
 
-Keyword capture fires from `chat.message` on the user's message parts (`UserMessage`). Patterns live in `src/capture/keywords.ts` / config `keywordPatterns`; regex group 1 is the memory body. Scope routing: personal patterns (`cfg.keywordPersonalPatterns`) force the personal scope — the rule is 我 → personal (记住我/替我记/我觉得/我喜欢/remember for me), 我们 → current scope (我们认为/我们决定/帮我们记住); personal patterns run first and claim their line so a generic trigger can't double-fire.
+Keyword capture fires from `chat.message` on the user's message parts (`UserMessage`). Patterns live in `src/capture/keywords.ts` / config `keywordPatterns`; regex group 1 is the memory body. Scope routing: personal patterns (`cfg.keywordPersonalPatterns`) force the personal scope — the rule is 我 → personal (记住我/替我记/帮我记/我觉得/我喜欢/remember for me), 我们 → current scope (我们认为/我们决定/帮我们记住); personal patterns run first and claim their line so a generic trigger can't double-fire.
 
 Context injection happens exactly once per session in `experimental.chat.system.transform`, guarded by an in-memory `Set<sessionID>` in `src/index.ts`. It is not persisted — restarting opencode re-injects on the next first turn.
 
 ## Design constraints — read the frozen design first
 
-`docs/V2-DESIGN.md` is the frozen protocol v0.2 (zero open questions). Per its §12:
+`docs/V2-DESIGN.md` is the frozen protocol v0.2 (decisions D1–D64 settled; open questions tracked at the end of the doc). Per its §12:
 AGENTS.md answers "how should AI work here"; the design doc answers "why is it
 built this way" (principles, iron rules, D1–D49 decision log). Before changing
 architecture, scope semantics, lifecycle, or the protocol surface (frontmatter

package/CHANGELOG.md

@@ -9,6 +9,28 @@ the `@alpha` tag are development snapshots and are not listed individually.
 
 ## [Unreleased]
 
+## Keyword capture gaps (D65)
+
+The most natural phrasings were the ones that fell through:
+
+- `帮我记住…` / `帮我记一下…` now capture (personal scope, same 我-rule as 替我记； `帮我们记住…` still routes project).
+- A leading `请` no longer defeats capture: `请记住我…`, `请记住（个人）…`, and `请记住：…` all work.
+- English `remember to …` no longer leaves a stray "to" at the front of the captured body.
+
+Patterns are code defaults, so these apply automatically on upgrade — unless you hand-customized `keywordPatterns` / `keywordPersonalPatterns` in your config, in which case your lists win and you can port the additions by hand.
+
+## P1 fixes: stale answers and stranded files (D64)
+
+Second batch from the whole-project review — the index, the files, and the guidance can no longer quietly disagree:
+
+- The opencode plugin now re-syncs the index before every tool call (previously only at startup): memories added via the CLI or another client are visible right away instead of after a restart.
+- Superseding a published memory re-enters review as `proposed` instead of a stranded `draft` no command could advance; `promote` can move it forward again.
+- All memory-file rewrites are atomic (tmp + rename), not just creates.
+- A retracted memory can't be flipped back to `active` via status changes — save a new memory if the content is valid again.
+- Proposed copies of personal memories are `visibility: internal` (was: `private`, which export silently excluded from team bundles).
+- `uninstall` finds the real global opencode config (`.jsonc` included), and `doctor` checks all eleven MCP tools plus stranded v1 (`user`-scope) memories.
+- `memory_status` output is capped per section; `memory_list` accepts `scope: both`; `forget` notes when the deleted file was in the repo; `where` prints the config path.
+
 ## Correctness fixes from the whole-project review (D63)
 
 Six silent-wrong-answer bugs found by an external three-lens review, each fixed with a regression test:

package/README.md

@@ -222,9 +222,10 @@ open-memex init --client vscode
 ```
 
 Writes the MCP server entry; reload the window afterwards and confirm the
-`open-memex` server is started in Copilot Chat's MCP panel. By default the
-server entry goes to VS Code's *user-level* config (works in every project);
-`init` can also write a project-level `.vscode/mcp.json` if you prefer.
+`open-memex` server is started in Copilot Chat's MCP panel. By default this
+writes a project-level `.vscode/mcp.json` (an interactive run asks which
+level you want); add `--global` for VS Code's *user-level* config instead —
+one setup that works in every project.
 
 **Cursor:**
 
@@ -232,8 +233,8 @@ server entry goes to VS Code's *user-level* config (works in every project);
 open-memex init --client cursor
 ```
 
-Same shape as VS Code: user-level MCP config by default, project-level
-`.cursor/mcp.json` on request, plus Copilot-style instructions.
+Same shape as VS Code: project-level `.cursor/mcp.json` by default,
+user-level MCP config with `--global`, plus Copilot-style instructions.
 
 **opencode** (native plugin — recommended):
 
@@ -367,7 +368,7 @@ Three ways memories get in:
   `记住…` / `记一下` / `记录一下` / `别忘了…` — and the sentence is captured
   without any tool call. Captures land in the current **project** by default;
   phrases that signal "this is about me" — `remember for me …`, `记住我…`,
-  `替我记…`, `我觉得…`, `我喜欢…` — go to **personal** instead, and
+  `替我记…`, `帮我记…`, `我觉得…`, `我喜欢…` — go to **personal** instead, and
   team-context phrases (`我们决定…`, `帮我们记住…`) stay in project.
 - **The agent saves it**: in any editor, ask your agent to remember something
   (or it saves on its own when you state a fact worth keeping) — it calls
@@ -378,7 +379,7 @@ Three ways memories get in:
   conventions, gotchas, approaches tried and abandoned — and saves only the
   ones you approve. Nothing is written silently: no draft is created behind
   your back.
-- **The CLI**: `open-memex add "…"` with optional `--scope` / `--tags` / `--type`
+- **The CLI**: `open-memex add "…"` with optional `--scope` / `--tag` / `--type`
   / `--aliases`.
 
 **Aliases.** Each saved memory can carry up to 4 alternate phrasings
@@ -409,7 +410,7 @@ they only matter once you share memories through Git.
 |---|---|
 | ● `memory_add`       | Save a fact, preference, decision, note |
 | ● `memory_search`    | Keyword search (BM25) across project + personal memories |
-| ● `memory_list`      | List memories in a scope, newest first |
+| ● `memory_list`      | List memories in a scope (`project`, `personal`, or `both`), newest first |
 | ● `memory_supersede` | Replace a memory with a newer version (keeps a supersede chain) |
 | ● `memory_forget`    | Delete a memory by id |
 | `memory_status`      | Show the sync queue: outbox drafts, repo review states, uncommitted files |
@@ -605,7 +606,7 @@ open-memex config set sync.autoPull true   # best-effort pull at MCP session sta
 ```
 
 Settable keys: `maxProjectMemories`, `maxProfileItems`, `injectOnFirstTurn`,
-`keywordCaptureEnabled`, `logLevel`, `memoryDir`, and `sync.autoPull` (a dotted
+`keywordCaptureEnabled`, `captureAliases`, `logLevel`, `memoryDir`, and `sync.autoPull` (a dotted
 key that writes into the nested `sync` object). Full design:
 [docs/V2-DESIGN.md](./docs/V2-DESIGN.md).
 

package/README.zh-CN.md

@@ -162,7 +162,7 @@ npx -y open-memex init --yes
 open-memex init --client vscode
 ```
 
-写入 MCP 服务器配置并可干净重载；重载窗口，确认 Copilot Chat 的 MCP 面板里 `open-memex` 服务器已启动。默认把配置写到 VS Code 的*用户级*配置（每个项目都生效）；也可以写到项目级 `.vscode/mcp.json`。
+写入 MCP 服务器配置；重载窗口，确认 Copilot Chat 的 MCP 面板里 `open-memex` 服务器已启动。默认写到项目级 `.vscode/mcp.json`（交互式运行会问你选哪一级）；加 `--global` 改写 VS Code 的*用户级*配置——一次设置，每个项目都生效。
 
 **Cursor**：
 
@@ -170,7 +170,7 @@ open-memex init --client vscode
 open-memex init --client cursor
 ```
 
-形态和 VS Code 一样：默认用户级 MCP 配置，可选项目级 `.cursor/mcp.json`，外加 Copilot 风格的指令文件。
+形态和 VS Code 一样：默认项目级 `.cursor/mcp.json`，`--global` 改为用户级 MCP 配置，外加 Copilot 风格的指令文件。
 
 **opencode**（原生插件——推荐）：
 
@@ -252,10 +252,10 @@ open-memex uninstall --yes
 
 三种存入方式：
 
-- **关键词触发**（仅 opencode 原生插件）：说 `remember …`、`note that …`、`don't forget …`、`TIL …`、`save this …`——中文 `记住…` / `记一下` / `记录一下` / `别忘了…`——这句话就被存下来，不需要任何工具调用。捕获默认进当前 **project**；`remember for me …`、`记住我…`、`替我记…`、`我觉得…`、`我喜欢…` 这类"这是关于我"的信号会改为进 **personal**；`我们决定…`、`帮我们记住…` 等团队语境仍留在项目里。
+- **关键词触发**（仅 opencode 原生插件）：说 `remember …`、`note that …`、`don't forget …`、`TIL …`、`save this …`——中文 `记住…` / `记一下` / `记录一下` / `别忘了…`——这句话就被存下来，不需要任何工具调用。捕获默认进当前 **project**；`remember for me …`、`记住我…`、`替我记…`、`帮我记…`、`我觉得…`、`我喜欢…` 这类"这是关于我"的信号会改为进 **personal**；`我们决定…`、`帮我们记住…` 等团队语境仍留在项目里。
 - **助手主动保存**：在任何编辑器里，你让助手记住某件事（或者你陈述了一个值得记的事实、它自己判断该保存），它会调用 `memory_add`。上面的路由是启发式规则；你可以明说"存到我的个人记忆"，或用 CLI 加 `--scope` 明确指定。
 - **检查点提议**：一个任务收尾时，助手会提议 1–3 条从这轮工作里提炼的候选记忆——决定及其理由、约定、踩过的坑、走过又放弃的路——只有你点头的那几条才存。不会有任何东西在你不知情时被写下来。
-- **CLI**：`open-memex add "…"`，可选 `--scope` / `--tags` / `--type` / `--aliases`。
+- **CLI**：`open-memex add "…"`，可选 `--scope` / `--tag` / `--type` / `--aliases`。
 
 **别名。** 每条记忆可以带最多 4 个换一种说法（同义词、另一种语言的对应词），和记忆一起进索引，这样问法不同也能找到——比如搜 "vacation days" 能找到假期政策那条。`init` 时会问一次是否开启（默认开）；随时可用 `open-memex config set captureAliases false` 关掉。
 
@@ -275,7 +275,7 @@ MCP 服务器暴露十一个工具；opencode 原生插件暴露其中五个核
 |---|---|
 | ● `memory_add`       | 保存一条事实、偏好、决策、笔记 |
 | ● `memory_search`    | 关键词搜索（BM25），横跨项目 + 个人记忆 |
-| ● `memory_list`      | 列出某个作用域的记忆，最新在前 |
+| ● `memory_list`      | 列出某个作用域（`project`、`personal` 或 `both`）的记忆，最新在前 |
 | ● `memory_supersede` | 用新版本替换一条记忆（保留 supersede 链） |
 | ● `memory_forget`    | 按 id 删除一条记忆 |
 | `memory_status`      | 显示同步队列：outbox 草稿、仓库评审状态、未提交文件 |
@@ -323,7 +323,7 @@ MCP 服务器暴露十一个工具；opencode 原生插件暴露其中五个核
 4. **PR 评审**——记忆是纯 Markdown；评审者走正常分支/PR 流程批准、要求修改或拒绝。
 5. **回想**——已发布的记忆在会话开始时注入，平时也能随时搜，人和助手都一样。
 
-看护共享记忆的人遵循 [维护者约定](./docs/CURATOR.md)：什么该批准、什么该打回、哪些卫生规则让共享记忆不腐烂。
+看护共享记忆的人遵循 [维护者约定](./docs/CURATOR.md)（英文）：什么该批准、什么该打回、哪些卫生规则让共享记忆不腐烂。
 
 ## 回想：记忆是怎么回来的
 
@@ -414,7 +414,7 @@ open-memex config set maxProjectMemories 12
 open-memex config set sync.autoPull true   # MCP 会话开始时尽力而为地 pull
 ```
 
-可设置的键：`maxProjectMemories`、`maxProfileItems`、`injectOnFirstTurn`、`keywordCaptureEnabled`、`logLevel`、`memoryDir`，以及 `sync.autoPull`（带点的键，写入嵌套的 `sync` 对象）。完整设计：[docs/V2-DESIGN.md](./docs/V2-DESIGN.md)。
+可设置的键：`maxProjectMemories`、`maxProfileItems`、`injectOnFirstTurn`、`keywordCaptureEnabled`、`captureAliases`、`logLevel`、`memoryDir`，以及 `sync.autoPull`（带点的键，写入嵌套的 `sync` 对象）。完整设计：[docs/V2-DESIGN.md](./docs/V2-DESIGN.md)（英文）。
 
 ## CLI 参考
 
@@ -462,7 +462,7 @@ open-memex submit <id...> [--branch <name>] [--base <branch>]
 # 把你点名的草稿移进 .ai/open-memex/，标为 "proposed"：
 # 复制、翻转 review_state、在当前分支本地 git 提交。
 # 永不自己建分支——建分支是你（或拿到完整链路明确许可的助手）的事。
-# 全有全無；冲突（同 id 不同内容）干净地中止。
+# 全有全无；冲突（同 id 不同内容）干净地中止。
 # 打印 push + gh pr 命令；持有你 Yes 的助手可以一并执行 push/PR。
 # --branch <name> 先建分支（助手全链路路径）。PR base 默认是当前分支
 # （记忆 PR 叠在你的工作分支上）；--base 可改指到 main 或你的评审分支。
@@ -473,7 +473,7 @@ open-memex pr-status [--apply]
 # 要求修改 → 只给建议。默认只报告；--apply 在本地执行映射的迁移（不推送）。
 
 open-memex pull
-# 从 git 远程拉共享记忆：fetch + 純 fast-forward。
+# 从 git 远程拉共享记忆：fetch + 纯 fast-forward。
 # 分支分叉则明确报错失败——open-memex 永不强制合并；手工解决后再 pull。
 # 成功后本地索引重新同步。pull 默认显式触发；设置
 # `open-memex config set sync.autoPull true` 可在 MCP 会话开始时尽力拉一次
@@ -502,7 +502,7 @@ open-memex distill-agents [--scope project|personal] [--type t1,t2] [--limit N]
 
 open-memex propose <id...> --to project [--local-approve]
 # 一次提议一条或多条个人记忆（一个分支、一个 PR）；
-# 每条复制并生成新 id。全有全無：任何一条 id 出错，整批中止，绝不半途。
+# 每条复制并生成新 id。全有全无：任何一条 id 出错，整批中止，绝不半途。
 # 把一条个人记忆复制到项目作用域作为评审候选
 # （是复制不是移动——个人原件保留）。结果落进 outbox；
 # 准备进仓库时再跑 sync-status / submit。
@@ -547,7 +547,7 @@ npx -y open-memex mcp        # 无需安装
 - **project（项目）**——限定在当前仓库，键由 git origin URL 的 hash 派生（所以同一仓库的多个 clone 共享一个作用域），没有远程时退回到当前工作目录路径。新记忆的默认作用域。
 - **personal（个人）**——横跨你的所有项目，仅限本机，永不向外同步。放个人偏好用。（v1 里叫 `user`；`migrate --to-v2` 会改名。）
 
-完整的 scope 模型（键派生、迁移、可见性、保留名）见 [docs/SCOPES.md](./docs/SCOPES.md)。[概念指南](./docs/CONCEPTS.zh-CN.md)把心智模型完整走了一遍。
+完整的 scope 模型（键派生、迁移、可见性、保留名）见 [docs/SCOPES.md](./docs/SCOPES.md)（英文）。[概念指南](./docs/CONCEPTS.zh-CN.md)把心智模型完整走了一遍。
 
 ## 故障排查
 
@@ -602,7 +602,7 @@ Windows 上已加载的 DLL 是锁定的：如果 open-memex 的 MCP 服务器
 
 ## 项目状态
 
-open-memex 是稳定且日常在用的；当前稳定线以 `latest` 发到 npm 上，`alpha` 构建给测试者。发版历史在 [GitHub Releases](https://github.com/stoneskin/open-memex/releases)；设计决策记录在只追加的日志 [docs/V2-DESIGN.md](./docs/V2-DESIGN.md) 里。
+open-memex 是稳定且日常在用的；当前稳定线以 `latest` 发到 npm 上，`alpha` 构建给测试者。发版历史在 [GitHub Releases](https://github.com/stoneskin/open-memex/releases)；设计决策记录在只追加的日志 [docs/V2-DESIGN.md](./docs/V2-DESIGN.md) 里（英文）。
 
 在望的方向（不承诺版本号）：更多编辑器的原生助手插件（作为在同一组 MCP 工具之上的增强路径）；本地 embedding 作为可选择开启的实验（没经询问，永不下载任何模型）；只有在真实多仓库共享、ACL 或合规需求出现时才做 org 层。
 

package/dist/cli.js

@@ -11,7 +11,7 @@ import { getSyncStatus, formatSyncStatus, submitMemories } from "./submit.js";
 import { getPrStatus, formatPrStatus, applyPrStatus } from "./github.js";
 import { search, list, hitStateLabel } from "./retrieve/search.js";
 import { writeMemoryFile, readMemoryFile, ulid, msToRfc3339, normalizeAliases, } from "./store/markdown.js";
-import { loadConfig } from "./config.js";
+import { loadConfig, configSource } from "./config.js";
 import { paths, projectRoot } from "./paths.js";
 import { redact } from "./redact.js";
 import { resolveMcpCommand } from "./init.js";
@@ -752,6 +752,7 @@ async function main() {
     if (cmd === "where") {
         const p = paths();
         console.log(`root:      ${p.root}`);
+        console.log(`config:    ${configSource() ?? "(built-in defaults)"}`);
         console.log(`memories:  ${p.memories}`);
         console.log(`index:     ${p.indexDb}`);
         console.log(`project:   ${project.key}`);

package/dist/config.js

@@ -8,12 +8,12 @@ export const DEFAULT_CONFIG = {
     keywordCaptureEnabled: true,
     captureAliases: true,
     keywordPatterns: [
-        "^\\s*remember(?!\\s+for\\s+me)(?:\\s+that)?[:,]?\\s+(.+)$",
+        "^\\s*remember(?!\\s+for\\s+me)(?:\\s+that|\\s+to)?[:,]?\\s+(.+)$",
         "^\\s*(?:please\\s+)?(?:note|don'?t\\s+forget)(?:\\s+that)?[:,]?\\s+(.+)$",
         "^\\s*TIL[:,]?\\s+(.+)$",
         "^\\s*save\\s+(?:this|to\\s+memory)[:,]?\\s+(.+)$",
         // Chinese equivalents
-        "^\\s*记住(?!（个人）)[：:,，]?\\s*(.+)$",
+        "^\\s*(?:请)?记住(?!（个人）)[：:,，]?\\s*(.+)$",
         "^\\s*(?:请)?(?:记一下|记录一下)[：:,，]?\\s*(.+)$",
         "^\\s*别忘了[：:,，]?\\s*(.+)$",
         // First-person plural: team/project context, NOT personal
@@ -23,10 +23,11 @@ export const DEFAULT_CONFIG = {
     ],
     keywordPersonalPatterns: [
         "^\\s*remember\\s+for\\s+me(?:\\s+that)?[:,]?\\s+(.+)$",
-        "^\\s*记住（个人）[：:,，]?\\s*(.+)$",
+        "^\\s*(?:请)?记住（个人）[：:,，]?\\s*(.+)$",
         // First-person singular: personal scope ("我" → 个人, "我们" → 项目)
-        "^\\s*记住我(?!们)[：:,，]?\\s*(.+)$",
+        "^\\s*(?:请)?记住我(?!们)[：:,，]?\\s*(.+)$",
         "^\\s*替我记(?:住|一下)?[：:,，]?\\s*(.+)$",
+        "^\\s*帮我记(?:住|一下)?[：:,，]?\\s*(.+)$",
         "^\\s*我觉得[：:,，]?\\s*(.+)$",
         "^\\s*我喜欢[：:,，]?\\s*(.+)$",
     ],

package/dist/distill-agents.js

@@ -57,7 +57,12 @@ export function distillAgentsMarkdown(opts) {
     // (D53: the checkpoint mechanism is gone).
     lines.push(`### Memory hygiene (open-memex)`);
     lines.push(``);
-    lines.push(`- When you finish a task the user would describe in one sentence, distill`, `  the session: propose 1–3 short memories capturing the useful`, `  conclusion — what was learned or decided, how an issue was resolved, what`, `  to avoid, where the authoritative doc lives — not the raw transcript.`, `  Save nothing without user approval.`, `  Worth keeping: decisions and their reasons, preferences, conventions,`, `  gotchas, approaches tried and abandoned. Not worth keeping: one-off task`, `  details or anything re-derivable from the code.`, `- If the knowledge already lives in project docs, save a \`reference\` memory`, `  pointing at the doc instead of copying it.`, `- When saving via \`memory_add\`, attach 2–4 aliases (alternate phrasings,`, `  synonyms, equivalents in the user's other language) when the install has`, `  capture aliases enabled — they make reworded questions find the memory.`);
+    lines.push(`- When you finish a task the user would describe in one sentence, distill`, `  the session: propose 1–3 short memories capturing the useful`, `  conclusion — what was learned or decided, how an issue was resolved, what`, `  to avoid, where the authoritative doc lives — not the raw transcript.`, `  Save nothing without user approval.`, `  Worth keeping: decisions and their reasons, preferences, conventions,`, `  gotchas, approaches tried and abandoned. Not worth keeping: one-off task`, `  details or anything re-derivable from the code.`, `- If the knowledge already lives in project docs, save a \`reference\` memory`, `  pointing at the doc instead of copying it.`, `- When saving via \`memory_add\`, attach 2–4 aliases (alternate phrasings,`, `  synonyms, equivalents in the user's other language) when the install has`, `  capture aliases enabled — they make reworded questions find the memory.`, 
+    // D64: the skills runbook and the MCP handshake both teach marking
+    // inferred captures source: "inference"; this footer omitted it, so
+    // opencode agents saved distilled conclusions as if the user had
+    // stated them ("tool"). Keep the rubric one voice across surfaces.
+    `- Mark captures you infer (rather than the user stating) with`, `  \`source: "inference"\` — provenance matters more than polish.`);
     lines.push(``);
     return lines.join("\n");
 }

package/dist/doctor.js

@@ -12,12 +12,20 @@ import { paths, homeOverride } from "./paths.js";
 import { resolveCwdScope } from "./scope.js";
 import { db, backendName } from "./store/db.js";
 import { LEGACY_PACKAGE_NAME, opencodeGlobalConfigPath, userMcpConfigPath } from "./init.js";
+// D64: the MCP server exposes eleven tools; checking only the five the
+// opencode plugin carries let a half-registered server pass as healthy.
 const EXPECTED_TOOLS = [
     "memory_add",
     "memory_search",
     "memory_list",
     "memory_supersede",
     "memory_forget",
+    "memory_status",
+    "memory_submit",
+    "memory_propose",
+    "memory_promote",
+    "memory_resolve",
+    "memory_pr_status",
 ];
 function nodeCheck() {
     const [major, minor] = process.versions.node.split(".").map(Number);
@@ -535,6 +543,19 @@ function legacyCheck() {
     const legacyDir = path.join(path.dirname(root), LEGACY_PACKAGE_NAME);
     if (fs.existsSync(legacyDir) && fs.statSync(legacyDir).isDirectory())
         found.push(`legacy data dir ${legacyDir} — merge it with \`open-memex migrate --to-v2\``);
+    // D64: v1 stored personal memories under the scope dir "user"; v2 reads
+    // only "personal". Files left there are invisible to every read path —
+    // an upgrader silently sees an empty personal scope. Surface them here;
+    // the migration itself stays explicit (no silent moves).
+    try {
+        const userDir = path.join(root, "memories", "user");
+        if (fs.existsSync(userDir) &&
+            fs.readdirSync(userDir).some((f) => f.endsWith(".md")))
+            found.push("v1 personal memories under " + userDir + " are invisible to v2 reads — convert them with `open-memex migrate --to-v2` (it moves them to the personal scope; preview with --dry-run)");
+    }
+    catch {
+        /* unreadable — not this check's problem */
+    }
     for (const f of [opencodeGlobalConfigPath(), userMcpConfigPath("vscode"), userMcpConfigPath("cursor")]) {
         try {
             if (fs.existsSync(f) && fs.readFileSync(f, "utf8").includes(LEGACY_PACKAGE_NAME))

package/dist/init.js

@@ -56,11 +56,12 @@ You have a local memory MCP server (\`open-memex\`). Its tools are
 these full names.
 
 - The server tells you when project outbox drafts are waiting for review — in
-  tool results. At session start, call \`memory_status\` once to check. When
-  drafts are waiting, summarize them (one line each) and ask the user which
-  ones to sync into the repo; sync NOTHING the user did not name. If you
-  already asked about these drafts this session, don't ask again. When the
-  server reports none waiting, do nothing.
+  tool results. When it does (or when the user asks), call \`memory_status\`
+  to see them; don't call it blindly at session start. When drafts are
+  waiting, summarize them (one line each) and ask the user which ones to
+  sync into the repo; sync NOTHING the user did not name. If you already
+  asked about these drafts this session, don't ask again. When the server
+  reports none waiting, do nothing.
 - BE PROACTIVE about facts the user states directly: when the user shares a
   decision, preference, project convention, or fix-and-cause worth remembering
   across sessions, call \`memory_add\` without being asked. Keep each memory to
@@ -286,7 +287,17 @@ function opencodePluginDir() {
  * loads open-memex in every project with no per-project init.
  */
 export function opencodeGlobalConfigPath(home = os.homedir()) {
-    return path.join(opencodeConfigDir(home, process.env.XDG_CONFIG_HOME), "opencode.json");
+    const dir = opencodeConfigDir(home, process.env.XDG_CONFIG_HOME);
+    // D64: init writes into whichever of .json/.jsonc already exists
+    // (writeOpencodeGlobalPlugin), so readers must resolve the same file.
+    // Hardcoding .json made uninstall report "nothing to remove" on
+    // .jsonc-only setups and left the plugin entry behind.
+    for (const name of ["opencode.jsonc", "opencode.json"]) {
+        const candidate = path.join(dir, name);
+        if (fs.existsSync(candidate))
+            return candidate;
+    }
+    return path.join(dir, "opencode.json");
 }
 /**
  * Pure merge of the open-memex plugin URL into a parsed opencode config doc.

package/dist/review.js

@@ -23,7 +23,7 @@ import * as path from "node:path";
 import { loadConfig } from "./config.js";
 import { inRepoMemoriesDirPath, projectRoot } from "./paths.js";
 import { resolveProjectScope } from "./scope.js";
-import { parse as parseMemory, serialize, ulid, writeMemoryFile, } from "./store/markdown.js";
+import { parse as parseMemory, serialize, atomicWriteTextSync, ulid, writeMemoryFile, } from "./store/markdown.js";
 import { findMemoryFile } from "./store/lifecycle.js";
 import { upsertFromFile } from "./store/sync.js";
 /** Best-effort author identity: git user.name, else the OS user. */
@@ -79,6 +79,12 @@ function copyPersonalToProject(sourceId, srcFm, srcBody, opts = {}) {
         id: ulid(),
         scope: "project",
         scope_key: project.key,
+        // D64: the copy is headed for the team. Source visibility (usually
+        // "private") must not ride along: export excludes private by default,
+        // so a private copy would silently vanish from every bundle the team
+        // builds. Proposing IS the act of sharing — the copy is internal;
+        // the personal original keeps its own visibility, untouched.
+        visibility: "internal",
         project_name: project.projectName,
         created_at: now,
         updated_at: now,
@@ -194,7 +200,7 @@ export function promoteMemory(id, opts = {}) {
             },
         ],
     };
-    fs.writeFileSync(mf.filePath, serialize(fm, mf.body), "utf8");
+    atomicWriteTextSync(mf.filePath, serialize(fm, mf.body));
     upsertFromFile({ fm, body: mf.body, filePath: mf.filePath, mtimeMs: Date.now() });
     return { id, from, to, history: fm.review_history };
 }
@@ -428,7 +434,7 @@ export function resolveConflict(target) {
     if (conflicts.length > 0)
         return { ok: false, filePath, conflicts };
     const fm = merged;
-    fs.writeFileSync(filePath, serialize(fm, mergedBody), "utf8");
+    atomicWriteTextSync(filePath, serialize(fm, mergedBody));
     upsertFromFile({ fm, body: mergedBody, filePath, mtimeMs: Date.now() });
     return { ok: true, filePath, autoMerged: [...new Set(autoMerged)] };
 }

package/dist/store/lifecycle.js

@@ -5,7 +5,7 @@ import { db } from "./db.js";
 import { paths, projectRoot, inRepoMemoriesDirPath, } from "../paths.js";
 import { loadConfig } from "../config.js";
 import { cjkIndexText } from "../retrieve/cjk.js";
-import { parse, serialize, ulid, msToRfc3339, } from "./markdown.js";
+import { parse, serialize, atomicWriteTextSync, ulid, msToRfc3339, } from "./markdown.js";
 /**
  * Dedup + lifecycle (V2-DESIGN §3.3, §3.4).
  *
@@ -111,7 +111,7 @@ export function findMemoryFile(id) {
     return { fm: parsed.fm, body: parsed.body, filePath, mtimeMs: st.mtimeMs };
 }
 export function rewriteMemoryFile(mf) {
-    fs.writeFileSync(mf.filePath, serialize(mf.fm, mf.body), "utf8");
+    atomicWriteTextSync(mf.filePath, serialize(mf.fm, mf.body));
 }
 /**
  * Chain integrity (§3.3): supersedes/superseded_by must be pairwise
@@ -179,7 +179,13 @@ export function supersede(oldId, input) {
         updated_at: now,
         supersedes: oldId,
         superseded_by: null,
-        review_state: "draft",
+        // D64: the replacement inherits the old memory's place in the review
+        // flow. A draft stays a draft; anything that had entered review
+        // (proposed/approved/published/rejected) re-enters at "proposed" so
+        // promote can advance it — resetting to "draft" would strand the new
+        // file in the repo, where submit cannot reach it (not the outbox)
+        // and promote refuses drafts.
+        review_state: (oldMf.fm.review_state ?? "draft") === "draft" ? "draft" : "proposed",
         proposed_by: null,
         approved_by: null,
         derived_from: null,
@@ -187,7 +193,7 @@ export function supersede(oldId, input) {
     };
     const dir = path.dirname(oldMf.filePath);
     const newPath = path.join(dir, `${newFm.id}.md`);
-    fs.writeFileSync(newPath, serialize(newFm, input.body), "utf8");
+    atomicWriteTextSync(newPath, serialize(newFm, input.body));
     const st = fs.statSync(newPath);
     const newMf = {
         fm: newFm,
@@ -224,6 +230,14 @@ export function setStatus(id, status) {
     if (mf.fm.status === "superseded") {
         throw new Error(`memory ${id} is superseded (chain-managed); supersede it again instead of changing status directly`);
     }
+    // D64: retraction is a one-way door through this path. A retracted
+    // memory was withdrawn on purpose (wrong, sensitive, superseded by
+    // policy); silently flipping it back to active would return it to
+    // recall (retrieval excludes retracted) with no review. Save a new
+    // memory if the content is valid again.
+    if (mf.fm.status === "retracted" && status === "active") {
+        throw new Error(`memory ${id} is retracted and cannot return to active; save the content as a new memory if it is valid again`);
+    }
     mf.fm.status = status;
     mf.fm.updated_at = msToRfc3339(Date.now());
     rewriteMemoryFile(mf);

package/dist/store/markdown.js

@@ -237,18 +237,26 @@ export function parse(raw) {
         return null;
     return { fm: normalizeFrontmatter(parsed.rawFm), body: parsed.body };
 }
+/**
+ * Atomic text publish: write a sibling tmp file and rename over the
+ * target, so a concurrent reader (another process mid-sync) never sees a
+ * torn half-written file. Same-directory rename is atomic on one fs.
+ * Every memory-file write/rewrite must go through here (D57 for creates,
+ * D64 extended to all rewrites: supersede flips, review transitions,
+ * submit landings, status changes).
+ */
+export function atomicWriteTextSync(filePath, text) {
+    const tmpPath = `${filePath}.tmp-${process.pid}`;
+    fs.writeFileSync(tmpPath, text, "utf8");
+    fs.renameSync(tmpPath, filePath);
+}
 export function writeMemoryFile(fm, body) {
     // 2B/D26: project drafts live in appdata (the outbox) — the in-repo dir
     // only ever holds submitted memories (proposed/approved/published).
     // Personal stays in appdata and never leaves the machine.
     const dir = memoriesDirFor(fm.scope_key);
     const filePath = path.join(dir, `${fm.id}.md`);
-    // Atomic publish (D57): write a sibling tmp file and rename over the
-    // target, so a concurrent reader (another process mid-sync) never sees a
-    // torn half-written memory. Same-directory rename is atomic on one fs.
-    const tmpPath = `${filePath}.tmp-${process.pid}`;
-    fs.writeFileSync(tmpPath, serialize(fm, body), "utf8");
-    fs.renameSync(tmpPath, filePath);
+    atomicWriteTextSync(filePath, serialize(fm, body));
     const st = fs.statSync(filePath);
     return { filePath, mtimeMs: st.mtimeMs };
 }

package/dist/store/migrate.js

@@ -2,7 +2,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { memoriesDirFor, memoriesDirPath } from "../paths.js";
 import { db } from "./db.js";
-import { iterMemoryFiles, readMemoryFile, serialize, timeToMs, } from "./markdown.js";
+import { iterMemoryFiles, readMemoryFile, serialize, timeToMs, atomicWriteTextSync, } from "./markdown.js";
 import { syncScope } from "./sync.js";
 import { PERSONAL_SCOPE } from "../scope.js";
 /** True if this scope has at least one `.md` file on disk. Does not create
@@ -90,7 +90,7 @@ export function migrateScope(fromKey, toKey, opts = {}) {
         };
         const raw = serialize(newFm, mf.body);
         if (!dryRun) {
-            fs.writeFileSync(dstPath, raw, "utf8");
+            atomicWriteTextSync(dstPath, raw);
             // Only unlink source if it's a different path (paths differ because
             // scope dir differs; belt-and-suspenders check).
             if (path.resolve(srcPath) !== path.resolve(dstPath)) {

package/dist/store/v2migrate.js

@@ -1,7 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { paths } from "../paths.js";
-import { parseRawFrontmatter, normalizeFrontmatter, isTaxonomyType, serialize, } from "./markdown.js";
+import { parseRawFrontmatter, normalizeFrontmatter, isTaxonomyType, serialize, atomicWriteTextSync, } from "./markdown.js";
 /**
  * v1 → v2 file migration (V2-DESIGN §19). Explicit only — run via
  * `open-memex migrate --to-v2`. Converts frontmatter in place:
@@ -174,7 +174,7 @@ function planDir(dir, memoriesRoot, result) {
 function applyPlans(result) {
     for (const plan of result.plans) {
         fs.mkdirSync(path.dirname(plan.toPath), { recursive: true });
-        fs.writeFileSync(plan.toPath, serialize(plan.fm, plan.body), "utf8");
+        atomicWriteTextSync(plan.toPath, serialize(plan.fm, plan.body));
         if (plan.toPath !== plan.fromPath)
             fs.unlinkSync(plan.fromPath);
     }

package/dist/submit.js

@@ -25,7 +25,7 @@ import { loadConfig } from "./config.js";
 import { inRepoMemoriesDir, memoriesDirPath, projectRoot } from "./paths.js";
 import { resolveProjectScope } from "./scope.js";
 import { contentHash } from "./store/lifecycle.js";
-import { msToRfc3339, parse as parseMemory, readMemoryFile, serialize, } from "./store/markdown.js";
+import { msToRfc3339, parse as parseMemory, readMemoryFile, serialize, atomicWriteTextSync, } from "./store/markdown.js";
 import { upsertFromFile, recordSync, readSyncState } from "./store/sync.js";
 import { db } from "./store/db.js";
 import { currentAuthor } from "./review.js";
@@ -138,19 +138,24 @@ export function formatSyncStatus(st) {
     else {
         lines.push(`last sync: never`);
     }
+    const CAP = 20;
     lines.push(`outbox (appdata, pending sync): ${st.outbox.length}`);
-    for (const e of st.outbox) {
+    for (const e of st.outbox.slice(0, CAP)) {
         lines.push(`  ${e.id}  [${e.reviewState}] ${e.title}`);
     }
+    if (st.outbox.length > CAP)
+        lines.push(`  … and ${st.outbox.length - CAP} more`);
     const byState = new Map();
     for (const e of st.inRepo)
         byState.set(e.reviewState, (byState.get(e.reviewState) ?? 0) + 1);
     const breakdown = [...byState.entries()].map(([s, n]) => `${n} ${s}`).join(", ") || "none";
     lines.push(`repo .ai/open-memex: ${st.inRepo.length} (${breakdown})`);
-    for (const e of st.inRepo) {
+    for (const e of st.inRepo.slice(0, CAP)) {
         const u = e.gitState === "uncommitted" ? " (uncommitted)" : "";
         lines.push(`  ${e.id}  [${e.reviewState}]${u} ${e.title}`);
     }
+    if (st.inRepo.length > CAP)
+        lines.push(`  … and ${st.inRepo.length - CAP} more`);
     if (st.uncommitted.length > 0) {
         lines.push(`note: ${st.uncommitted.length} repo file(s) not yet committed — they ride with the working tree until you commit.`);
     }
@@ -279,7 +284,7 @@ export function submitMemories(ids, opts = {}) {
             ],
         };
         const text = serialize(fm, parsed.body);
-        fs.writeFileSync(destPath, text, "utf8");
+        atomicWriteTextSync(destPath, text);
         written.push({ id: v.id, srcPath: v.srcPath, destPath, hash: contentHash(parsed.body) });
         submitted.push({ id: v.id, filePath: destPath, reviewState: destState });
     }