Mnemosyne OS 8.1.0 — memory formation layer + memory runtime layer

Mnemosyne OS 8.1.0 — the memory formation layer and the memory runtime layer

8.0.0 could find memories. 8.1.0 can form them — and feed them back.

8.0.0 brought retrieval to a world-class level: five-signal fusion, budgeted recall,
a calibrated relevance floor, capsule compression, and the memory exchange protocol.
Auditing that build against the AI Memory System Design Guide (2026) exposed two
structural skews:

8.0.0 is good at "bringing memories back". It is not good at "turning experience into
memory", nor at "assembling the right context for the model right now".

Seven gaps, each measured, each closed in 8.1.0:

Gap in 8.0.0	Closed by
No session summaries — only atomic facts, so "where did we leave off?" had no answer	session_summarize / session_recall
Conflicts detected but never resolved, and the detector false-positived badly	conflict_resolve — six classes, four actions, scope=audit
No task or experience structure — one-off effort could not compound	task_record / playbook_save / playbook_recall
No code-evolution memory — a coding agent saw only the current tree	code_change_record / code_archaeology
No sensitivity grading — secrets stored in plaintext and recalled normally	memory_policy, plus a policy gate on both recall exits
No way to assemble context for the model — recall returns facts, not a prompt	profile_card / memory_inject / recall_catalog / expand_memory
No lifecycle operations — memories were written once and never consolidated, measured, masked or rolled back	memory_envelope / memory_consolidate / memory_metrics / memory_cascade_delete / memory_mask

Tools 31 → 52 — 41 native + 11 client-compatible, i.e. 21 new native tools
(9 formation-layer + 12 runtime-layer), five new modules, two design documents.
No old tool signature changed. No data format changed. No existing record rewritten.

---

1. The memory formation layer (9 tools)

session ──► session_summarize ──► seven elements + verbatim anchors, open items split out
conflict ─► conflict_resolve  ──► six classes / four actions; scope=audit reports real conflicts only
task ─────► task_record       ──► append-only facts, retrievable by goal_type
playbook ─► playbook_save     ──► experience, preconditions (must / must_not / typical_env) mandatory
code ─────► code_change_record / code_archaeology
policy ───► memory_policy     ──► sensitivity grading, write admission, legacy-record audit

session_summarize keeps the seven elements (goal / constraints / decisions / pending /
artifacts / failures / preferences) with verbatim anchors, and splits open items into
stand-alone records so the next session can ask about them.

playbook_recall checks preconditions before returning a candidate, so a past solution
is never offered for a context where its assumptions do not hold — it answers
applicable / blocked_by instead of a bare similarity score.

code_archaeology returns the change chain for an anchor, the last three intents, whether
it was ever reverted, and the constraints that were in force — about 500 tokens per call.

---

2. The memory runtime layer (12 tools)

These are the read-side and lifecycle operations. They are the difference between a memory
store and a memory system — and in 8.0.0 they simply did not exist.

Assembling context for the model

Tool	What it does
profile_card	Three-tier user profile (stable identity / preferences & constraints / current situation) + open items, ready to splice into a system prompt. max_tokens is a hard ceiling that trims whole tiers in order (situation → pending → preferences) and never truncates a single fact — a half-sentence is worse than none.
memory_inject	The context-injection pipeline: query construction → four-path recall → RRF fusion → rerank → budgeted injection. Returns ready-to-inject text plus a four-bucket quota ledger (profile 30% / task-related 35% / playbook 20% / pending 15%). Over-budget items are dropped whole, not truncated.
recall_catalog	Progressive disclosure, catalog layer: titles + one-liners + expansion cost only. Judge which few matter, then expand_memory those.
expand_memory	Progressive disclosure, expansion: full text + unified envelope + graph neighbours + evidence chain. The neighbours are where the answer to "which modules did that decision affect" actually lives.

The memory lifecycle

Tool	What it does
memory_envelope	Unified envelope for a record: eight-way classification (semantic / episodic / procedural / working / resource / anti_pattern / meta / relational), four-dimension scope (user / project / agent / session), evidence chain, dual timeline (t_valid / t_invalid), TTL and SPO structure. Without memory_id it returns the whole-library eight-way distribution.
memory_consolidate	Three consolidation paths — episodic→semantic (same fact in ≥3 sessions), episodic→procedural (same task succeeded ≥2 times → a playbook with preconditions), failure→anti-pattern (failed / rolled_back / reverted → a prohibition entry). Idempotent: the same source batch never generates twice.
memory_metrics	Chat 5 + Working 4 + Coding 4 indicators. Honesty rule: an indicator without enough data returns {value: null, status: "insufficient_data", need: "..."} rather than 0 — because 0 and "no data" are different things.
memory_cascade_delete	Four actions: soft-delete the original → invalidate derived conclusions (confidence halved + superseded) → clear the retrieval cache → mark dependent summaries stale. Run dry_run=true first to see the dependents. reason is written to the audit trail.
memory_mask	Replaces the body with a placeholder but keeps the record skeleton — gentler than deletion, and it preserves context length and prefix, so KV-Cache reuse is not broken. Prefer this when the user says "don't remember that". action=unmask reverts it.
topic_summarize	L3 topic summary: merges the L2 session summaries under one project into "what state is this project in". Merge rules are deterministic — goal takes the newest, decisions accumulate, pending keeps only the newest.
memory_trace	Walks the pointer chain L3→L2→L1 and returns each level's content, the turn ranges it covers and the message_ids. Answers "which sentence did this conclusion come from". The memory store keeps no L0 text, so the caller resolves message_ids against its own conversation history.
memory_hot_path	Hot-path buffer: enable switches to async writes (the hot path only enqueues; extraction / conflict / consolidation run in the background), status shows queue and stats, flush drains the queue — a read-consistency barrier you must call before reading back something you just wrote.

---

Defects fixed

1. reflect conflict false positives — entity co-occurrence is no longer counted as a
   conflict. Detection now delegates to ConflictResolver.audit() with assertion-aligned
   criteria. Measured: 8.0.0's 14 false positives → 0; 7/7 positive/negative controls pass.
2. _detect_conflicts_at_write recorded but never resolved — results went into
   meta.write_conflicts and were never consumed. Now returns kind / action / reason
   and callers act on action.
3. Sensitivity gate was not on the default recall path — the first 8.1.0 build shipped
   only the memory_policy tool, so users who never called it were entirely unprotected.
   Brain.recall() and _budget_recall() both pass through _apply_policy_filter() now:
   secret never enters context, private passes in internal context, normal always passes.
4. Chinese entity extraction split words, hiding conflicts — "该方案是安全的" and
   "该方案是不安全的" were sliced into different fragments, so the two memories shared no
   entity and never paired. Added _ent_key() (predicate-based entity head) and
   _ent_bigram() bucketing.
5. recall_health instrumentation was incomplete — under namespace=default the metrics
   stayed at 0. Marked as a known issue in the 8.1.0 verification script, scheduled for 8.2.0.

---

Compatibility

• The old 20 native tools keep their parameters, return shapes and error codes. The
  11 client-compatible tools are unchanged too.
• New fields (sensitivity, task_id, goal_type, …) are all optional and default when absent.
• Existing data is not rewritten: sensitivity is recomputed at read time, the stored record
  is left untouched.
• Policy defaults are permissive: sensitivity defaults to normal, so existing writes behave as before.

---

Verification

Both suites run against the 8.1.0 source and pass with zero failures.

Check	Result
python scripts/verify_v810.py	40 / 40 passing
python scripts/verify_api.py	29 / 29 passing

verify_api.py also exercises the live REST surface (18 REST surface checks) and the CLI
envelope; it spins up an ephemeral local listener on 127.0.0.1 and tears it down.

---

Install

pip install mnemosyne-os        # zero third-party dependencies

from mnemosyne import Memory

m = Memory()
m.add("I prefer dark mode and use vim keybindings. My name is Alice.", user_id="alice")
m.search("what does alice prefer", user_id="alice")

MCP — 52 tools (41 native + 11 client-compatible) · REST — /v1, /v2, /v3 on the console's listener ·
CLI — compatible command set with --agent JSON envelopes ·
Python — Memory / AsyncMemory / MemoryClient

Full changelog: CHANGELOG.md

Mnemosyne OS 8.0.0

Mnemosyne OS 8.0.0

A complete memory API, on a core that still installs with zero third-party dependencies.

Memory systems usually force a choice between a clean, auditable core and a familiar API. 8.0.0 removes that choice.

pip install mnemosyne-os        # zero third-party dependencies

from mnemosyne import Memory

m = Memory()
m.add("I prefer dark mode and use a ThinkPad.", user_id="alice")
m.search("what laptop", user_id="alice")

---

The memory API

mnemosyne/api/ provides Memory, AsyncMemory and MemoryClient, re-exported from the package root so the documented entry point is simply from mnemosyne import Memory.

Surface	Methods
Core	add · get · get_all · search · update · delete · delete_all · history · reset · close
Extension	from_config · chat

Parameter names, defaults, keyword-only markers, return envelopes and error codes are all fixed contracts.

Four-dimensional scoping, physically enforced

user_id / agent_id / run_id / app_id. Each scope combination gets its own SQLite file, not a filter over shared rows. Namespaces are hashed over sorted, length-prefixed components, so (a, bc) and (ab, c) cannot collide and key order cannot change the result.

Complete filter language

AND / OR / NOT over eq, ne, gt, gte, lt, lte, in, nin, contains, icontains, startswith, endswith and wildcards.

Interoperable by design

The API also accepts the conventional agent-memory call shape, so code already written against that shape runs on Mnemosyne unchanged. See docs/COMPATIBILITY.md.

---

72 optional providers

Category	Count
LLM	20
Embedder	13
Vector store	28
Reranker	5
Graph store	6

Everything reachable over HTTP is implemented on the standard library's urllib, so the common providers need no third-party package. install_requires is still an empty list.

---

Service surface

• REST — /v1, /v2 and /v3 sharing the console's listener, with token auth and async event ids
• MCP — tools 20 → 31
• CLI — a compatible command set with --agent JSON envelopes
• Skills and plugins — manifests for Claude, Codex, Cursor and Kimi
• Integrations — LangChain, LlamaIndex, CrewAI, Dify, n8n, Vercel AI SDK

Graph memory, multimodal image input, reranking and temporal reasoning all run through the same optional-plugin path.

---

Defects fixed

Nine real defects surfaced while building this, each with regression coverage.

The most serious: meta was never persisted. It was absent from _MEMORIES_COLUMNS, so every INSERT silently dropped it — and _row_to_record then fabricated a replacement, which made the loss look like an empty value. A process-local cache hid the problem, so it only appeared after a restart, in the form of user metadata vanishing. meta is now a real column with an idempotent migration for existing databases.

Also fixed:

• The deterministic extractor discarded third-person declaratives — "I moved to Berlin in 2023" was silently dropped
• get() did not consult disk, so a restart looked like total data loss
• The immutable guard failed silently
• Provider construction raised network errors straight through the engine
• camelCase aliases on option objects were ignored
• An unbounded duplicate scan degraded a 100k-record store to a second per write

---

Verification

Check	Result
scripts/verify_api.py	29 / 29 passing, fully offline
py_compile, all 90 Python files	0 failures
Existing suites (lifecycle, precision/recall, verify.py)	0 failures
recall_quality	2 failures — reproduce identically on a clean 7.0.2 tree, confirming a pre-existing environment condition, not a regression

---

Breaking change

The client API moved to mnemosyne/api/ and its helper modules were renamed to match the rest of the package. The previous import paths and the legacy environment-variable aliases no longer resolve. The memory-store format, REST routes and MCP tool names are unaffected.

v7.0.2 — 精准记忆/召回/极限压缩

Mnemosyne OS 7.0.2 — 精准记忆 / 精准召回 / 极限上下文精确压缩

这一版的唯一目标：让「精准记忆 · 精准召回 · 极短上下文下的精确压缩」从声称的能力
变成可复现、可断言的事实。

为什么要出这一版

7.0.1 已经把向量模型与向量库接上了，但精准仍然达不到"可以承诺"的程度。深查之后确认：
问题不在参数没调好，而在机制本身——以下几条让"100% 精准"在结构上不可能达成：

#	症状	根因
P0-1	长会话「越聊越偏」，正确答案从 rank1 掉到 rank3	access_boost 是加性且上限 +0.20（与整路权重同量级），而计数对"凡进入结果列表"无条件累加
P0-2	无关查询也返回高分；一切"分数阈值"规则失效	五路打分各自 x/max(x) 归一化 → 最高分恒为 1.0 → 融合分没有绝对含义（实测无关查询 top1 1.0200 > 相关查询 0.6922），且旧行为无论如何填满 k 条
D1	graph_query("用户") 恒为空	抽取器把 用户的显卡是 RTX 4090 的主语抽成 用户的显卡 → 图节点永远不是 用户；5 路融合里权重 0.10 的图通道长期空转
D3	budget_tokens=40 实际塞进 150+ token	无分词器时兜底用「4 字符 ≈ 1 token」（英文经验值），中文被低估 3~4 倍 → 压缩降级路径永不触发
D6	同一条偏好被反复重述 → 库里堆多条 0.98+ 重复	写入侧无语义去重（只有事后 dedup）
D7	熔断窗口内的向量写入被静默丢弃，那批记忆永久失去语义索引且无人察觉	插件 add() 裸 return（返回 None），调用方无法区分"成功 / 真失败 / 被丢弃"
D8	正确答案因"多了一个字"丢掉图通道的分	记录侧图节点取自 entities 的中文滑窗碎片，切出什么高度依赖字数对齐 —— 本质是抽签
D9	边的 memory_id 全是 NULL → "这条记忆连了哪些图节点"永远查不到	add_edges(memory_id=…) 对 dict 型边完全忽略该参数
D10	正文里写了日期反而被扣分	时间通道用正文抽出的 event_time："购于 2026-03-15"被衰减到 ≈0.24，而"备用显卡"（无日期）拿 1.00
D11	纯改写问句被相关性下限误杀（问"我喜欢什么"得到"没有相关记忆"）	改写对余弦 0.4900 与无关项 top1 0.5275 分布重叠 → 单一阈值无法两全，必须靠结构化标签通道兜住

新增：AIC 记忆胶囊（Adaptive Information Capsule）

问题的本质：用户端上下文常常只有 1~2 轮、几百 token。传统做法把"压缩"等同于
"丢记忆"（模型看不到信息）或"生成式摘要"（有损改写，会凭空造出原文没有的数字/时间/
结论）——两者都让"精准"变成概率事件。

这一版的做法：把压缩重新定义为「分层 + 可寻址」。压缩产物不是更短的近似文本，而是

{稳定指针 ref} + {结构化事实} + {内容原子} [+ {抽取式要点}]

由此同时满足三条可断言的硬性质：

性质	含义
无损可逆	ref 指回原文；expand(ref) 逐字取回，并校验内容哈希（错指针/被改写的记录不会被静默交付）
零幻觉	要点是抽取式的（句子必须逐字来自原文），事实来自规则三元组，全程不做任何生成
事实守恒	数字 / 日期 / 金额 / 型号 / URL / 邮箱 / 引号原话（"原子"）在所有压缩层级都完整保留

分层阶梯：full（原文）→ gist → facts → pointer → atoms（仅指针+原子）。
指针与原子永不裁剪——它们分别是"可逆"与"事实不丢"的唯一凭据。
于是"预算不够"不再是"信息消失"，而是"精度分层"：预算再小，可被追问的事实
（多少钱、什么时候、哪个型号）依然在场。

胶囊是内容寻址的：同一记忆在同一预算下产出逐字节相同的胶囊 →
上游 LLM 的前缀/KV 缓存能稳定命中。省钱与"精准"在这里不冲突。

新增 MCP 工具

• capsule：取单条记忆的胶囊（预算内），返回 text / ref / level /
  atoms / tokens / min_tokens / lossless / over_budget + 自检结果。
• expand：按指针逐字取回原文，返回 verified（哈希校验）。
• recall_health：召回质量只读指标 —— 空结果率 / top1 分趋势 / 相关性下限剔除量 /
  置信带与通道分布 / 延迟分位 / 向量后端成败 / 胶囊缓存命中率 / 图边规模 / 最近 20 轮明细。
• 工具数 18 → 20（7.0.1 为 14）。

修复清单

• P0-1 access_boost：加性 +0.20 → 乘性、封顶 +5%；计数语义收窄为"融合分 ≥ top1 的
  90% 才 +1"、上限 5。实测对照：仅因"先前问过 6 个无关问题"，干扰项 +0.12
  （= 6 × 0.02，与公式逐位吻合）——这是"越聊越偏"的直接机制，上下文再大也救不了。
• P0-2 相关性下限：阈值由实测标定（相关簇 cosine min 0.5222 / 无关簇 max 0.4064
  → REL_MIN_SEMANTIC=0.45），未过线者在排序之后剔除（不动候选下标，避免与倒排/doc_tf
  的下标语义错位）。允许返回空结果：对 Agent 而言"没找到相关记忆"比"给 5 条无关记忆"安全得多。
  边界：目标定位（forget / 更正 / dedup）走 apply_floor=False —— 用户描述天然含糊，
  返回空等于"无法遗忘"；安全性改由 dry_run 先行 + 报告带置信带保证。
• 置信带跨调用污染（本轮新发现）：_relevance_band 挂在跨调用共享的索引记录 dict 上，
  导致"取完结果 A 后再发一次无关查询 B"会把 A 的置信带静默改写（实测复现）。
  修法：输出边界做快照（返回副本）+ 每轮打分前清标记 + 缓存命中重贴 + sync_record 保持
  访问计数会话内一致。
• 图通道：模式化正则优先（A的B是C → 主语取 A、属性进 qualifier）+ 主语去定语归一 +
  查询侧代词归一（我/我的→用户）+ 邻接图多跳。实测 graph_query('用户') 由空 →
  10 个邻居节点；并新增存量数据图边懒回填（幂等）——只修抽取器只能让新写入有图，
  老记忆仍然查不到，"改好了"必须真的能被用户看到。
• budget_tokens 真正参与取舍：continue → prefix packing；装不下原文时
  降级为胶囊而非丢弃，装不进正文的进 precision_index（指针+原子，不占正文预算）。
• 预算口径诚实：改用 CJK 感知的保守估算（CJK 逐字计 1、拉丁按词计 1），
  避免"预算 40 却塞进 150+ token"的假通过。
• 写入侧语义去重 + 原子守恒硬约束：近似重复（≥0.95）并入既有记忆（内容以最新为准、
  tags 取并集、置信度取高者、version+1）；但凡"改一个字就是另一个事实"的片段不同者，
  相似度再高也绝不合并 —— 否则"用户的年假是 5 天"会吃掉"…15 天"，数据没丢但事实被改错，
  且用户与审计都看不出发生了什么。方向取舍：宁可漏合并，绝不误合并。
• 编码单一收口：sanitize_str() 成为唯一实现（sqlite_backend._sanitize 委托调用），
  带按来源计数；订正 encode(errors='replace') 用 ?(U+003F) 而非 U+FFFD。
• 向量写丢弃可见化：插件 add() 返回布尔，丢弃原因分开计数
  （dropped_breaker 可重试 / dropped_unavailable / dropped_no_collection）；
  doctor 新增 vector_ops / vector_backend（含熔断器剩余时间）/ graph 三段。
• F9-b 确证修复：recall 输出投影带出 superseded_by（实测）。
• 内容原子补 num3 / ident 两条规则：6333、1024、bge-m3、gpt-4o、H100
  这类"取值与身份标识"过去不算原子（"嵌入模型是多少维"的答案 1024 会被丢掉）；
  并把计数归一为"原文里的字面出现次数"，消除多规则命中同一片段的计数膨胀。

验收（全部实测，三套缺一不可）

验收	结果
scripts/verify_recall_quality.py（端到端质量对照，需真实向量栈）	10/10 通过
— precision@1	8/8（冷启动）· 8/8（预热后）· 8/8（先问 4 个无关问题后）· 8/8（先问 28 个无关问题后）← 7.0.1 同类实验退化到 6/8
— 假阳性	无关查询返回 0 条（7.0.1 行为是无论如何填满 5 条）
— 极短上下文	30 token 预算下 8/8 问句的关键取值仍可见
— 延迟	召回 p50 0.21 ms
scripts/verify_memory_lifecycle.py（MCP stdio，需真实向量栈）	35/35 通过
scripts/verify_precision_recall.py（离线回归，不连外部服务）	94/94 通过
分层阶梯	实测 full → gist → pointer → atoms 随预算收缩逐级降级
expand 可逆性	逐字往返字节一致（116/116）；错哈希被拒（verified=false）
py_compile	60 文件 / 0 失败
文档完整性	96 处版本声明升级；含 127.0.0.1 的行零破损

为什么必须三套都跑：只有离线跑通，不代表 MCP 面可用；只有 MCP 跑通，
也不代表机制没退化（"分数全塌到常数底"时 MCP 断言仍可能全绿）；
而前两者都通过，也不代表排序正确 —— D8–D10 就是这样躲过前两套、
最终被"端到端质量对照"照出来的。

兼容性

记忆库格式、MCP 协议版本、CLI 命令面、配置文件全部不变，已有记忆库可直接沿用。
存量数据会在首次 recall / graph_query 时自动补齐图边（幂等）。

相关性下限的复标定（0.45 → 0.55）

初版 0.45 在8 条记忆（无关项与查询毫无话题交集）上标定，太乐观；补上同主题干扰项
（"备用显卡"/"病假天数"/"备用端口"）后复标定：

阈值	无关查询放过的条数	相关查询正确答案保留
0.45	5	8/8
0.55	0	8/8
0.60	0	7/8（丢掉那条真答案）

已知边界：相关簇下沿（0.5708）与无关簇上沿（0.5275）只差 0.043，该阈值对语料分布
敏感。因此 recall_health 新增 sem_top1 / sem_background 供发现"整库同主题"
后复标定。

已知未做（诚实标注）

• 词表/键控注入式数据投毒、跨用户推理数据泄漏（memory/claim 的信任边界）
  仍属 7.0.1 已标注的开放项，本版未触碰。
• 纯改写且与库内内容无词面/标签锚点的问句，可能被判为"无相关记忆"（实测该情形余弦
  0.4900 与无关项 top1 0.5275 分布重叠，单一阈值无法两全）。本版用标签通道兜住了
  偏好/意图类（最常见的一类），更泛化的改写仍可能落空 —— 这是刻意的保守取舍
  （返回空比给错证据安全）。
• 图通道仍为规则抽取（无 LLM 参与）：中文复杂句（多从句、省略主语）的召回率有限，
  它只是 5 路融合中权重 0.10 的一路，不承担主要召回职责。

---

English summary: 7.0.2 turns "precise memory / precise recall / precise compression under
tiny context" from a claim into an assertable fact. It fixes the mechanisms that made it
structurally impossible (access-count feedback loop, missing relevance floor, dead graph
channel, no-op token budget, dishonest token accounting, silent vector-write drops) and adds
AIC memory capsules: compression is redefined as layered + addressable — a stable
pointer plus structured facts plus "atoms" (numbers, dates, amounts, model IDs, URLs) that are
preserved at every level, with expand(ref) returning the original verbatim and
hash-verified. Extractive only, so zero hallucination; content-addressed, so byte-identical
capsules keep upstream KV caches warm. Acceptance: 34/34 lifecycle assertions (real vector
stack) and 94/94 offline precision assertions. Backward compatible; existing stores keep working.

Mnemosyne OS 7.0.1

Mnemosyne OS 7.0.1

针对记忆栈的一轮缺陷修复与可验证性补强。核心引擎改动集中在记忆生命周期语义与语义检索索引两条线上；记忆库格式、MCP 协议版本与 CLI 命令面均保持向后兼容，已有记忆库可直接沿用。

A defect-fix and verifiability-hardening release for the memory stack. The engine changes concentrate on two axes — memory lifecycle semantics and semantic retrieval indexing. The memory-store format, MCP protocol version and CLI surface are all backward compatible; existing memory stores can be used as-is.

---

新增 / New

• MCP forget 工具（工具数 13 → 14）：按 memory_id 或自然语言 query 遗忘一条记忆。默认软遗忘——confidence 归零 + status=deleted，审计链与可信度轨迹保留、可回溯；evict=true 才做物理删除。支持 dry_run=true 先返回候选供确认。
  MCP forget tool (tool count 13 → 14): forget a memory by memory_id or a natural-language query. Soft-forget by default — confidence set to 0 and status=deleted, with the audit chain and confidence trail preserved and traceable; physical deletion requires evict=true. dry_run=true returns candidates for confirmation first.

• 记忆更正（supersedes）：retain(supersedes=<旧记忆id>) 可在写入新说法的同时把旧记忆标为 verification=superseded（标记而非删除，历史可完整回溯）。recall 结果回传 verification 与 superseded_by。
  Memory correction (supersedes): retain(supersedes=<old_id>) marks the superseded memory as verification=superseded while writing the new claim (a mark, not a delete — full history retained). recall returns verification and superseded_by.

• MNEMOSYNE_PLUGINS 环境变量：MemoryBrain 在 plugins=None 时读取该变量（逗号分隔），无需改动 CLI / MCP Server / WebUI 三个入口即可启用插件。未设置时行为与 7.0.0 完全一致。
  MNEMOSYNE_PLUGINS env var: MemoryBrain reads it (comma-separated) when plugins=None, so plugins can be enabled without touching any of the CLI / MCP server / WebUI entry points. Unset → identical to 7.0.0.

• 官方插件 mnemosyne_plugins/qdrant_backend：Qdrant ANN 向量后端（BGE-M3 嵌入，OpenAI 兼容 /v1/embeddings）。相对 numpy_vector 的进程内内存字典，提供跨进程持久的向量索引；内置熔断器、代理绕过、warmup() 预建集合与 health() 诊断。见 docs/plugins/qdrant.md。
  Official plugin mnemosyne_plugins/qdrant_backend: Qdrant ANN vector backend (BGE-M3 embeddings via OpenAI-compatible /v1/embeddings). Unlike the in-process dict of numpy_vector, it provides a cross-process persistent vector index, with a built-in circuit breaker, proxy bypass, warmup() collection pre-creation and health() diagnostics. See docs/plugins/qdrant.md.

• 文档与脚本 / Docs & scripts：

  • docs/KNOWN_DEFECTS.md —— 11 项已确证缺陷，逐项给出事实、实测证据、影响面与修法。
  • docs/RECALL_STRATEGY.md —— 召回通路拓扑、四路打分构成、"每轮召回"的代价评估。
  • docs/ACCEPTANCE_GUIDE.md —— 验收指南：握手与工具面、子进程环境对齐、冷热延迟预算、命名空间隔离、审计链、生命周期闭环、假失败速查。
  • scripts/verify_memory_lifecycle.py —— 参数化的 20 项断言生命周期验收脚本。

---

修复 / Fixed

• retain() 显式 confidence 不再被覆盖：Notary 评估此前无条件改写 record["confidence"]，导致调用方显式传入的值（包括 0，即撤回语义）被静默丢弃。现改为显式值优先，Notary 的原始判断留档于 meta["notary_confidence"]。
  Explicit confidence in retain() is no longer overwritten. Previously the Notary evaluation unconditionally rewrote record["confidence"], silently discarding caller-supplied values (including 0, i.e. retraction semantics). Explicit values now take precedence; the Notary's own judgement is preserved in meta["notary_confidence"].

• retain_batch() 逐项元数据透传：原实现把每项第三个元素写死为 {}，confidence / tags / importance 全部被丢弃，批量路径上的元数据设定静默失效。
  Per-item metadata passthrough in retain_batch(). The implementation hard-coded the third element of each item to {}, dropping confidence / tags / importance entirely.

• fast 写入路径补上向量索引：快速路径此前把 embedding 固定置 None 且从不调用向量后端 add()，导致经该路径写入的记忆完全无法参与语义召回。现在一次 encode() 同时喂给 SQLite 与向量后端。
  Vector indexing restored on the fast write path. It previously pinned embedding=None and never called the backend's add(), so memories written that way could not participate in semantic recall at all. A single encode() now feeds both SQLite and the vector backend.

• retain_batch() 的 fast=False 分支补上 add()：该分支此前只把 embedding 写进 record，从不调用向量后端 add()，因此经 retain_batch 写入的记忆从未真正进入向量索引（MCP 与 Python SDK 两条路径都受影响）。
  add() restored on the fast=False branch of retain_batch() — memories written via retain_batch never actually entered the vector index (affecting both MCP and Python SDK paths).

• 遗忘/撤回的记忆输出前硬过滤：retrieval.py 在打分排序之后剔除 confidence 归零的输出项。位置刻意选在候选池之外，避免破坏 records 与 _doc_tf_cache 的下标对齐。
  Hard filter for forgotten/retracted memories before output — items with zero confidence are dropped after scoring, deliberately outside the candidate pool to avoid breaking index alignment between records and _doc_tf_cache.

• 遗忘后检索缓存显式失效：_invalidate_retrieval_index() 强制下一次 recall 重建索引，避免已遗忘内容从旧缓存继续被召回。
  Explicit retrieval-cache invalidation after forgetting, so forgotten content cannot keep surfacing from a stale cache.

• MCP namespace 报告修正：retain_batch / list_projects / audit / confidence_history / export / import / claim 此前把命名空间报成字面量 "default"，现改为报告实际生效的命名空间。
  MCP namespace reporting corrected — these seven tools reported the literal "default"; they now report the namespace actually in effect.

• MCP recall 回传 memory_id：原实现不回传 id，调用方拿到结果也无法对其执行遗忘或更正；同时补充回传 tags。retain 工具面补齐 tags / confidence / importance / supersedes，mtype 枚举由 3 类扩至 8 类。
  MCP recall now returns memory_id (previously callers could not act on results) plus tags. The retain tool surface gains tags / confidence / importance / supersedes, and mtype expands from 3 to 8 values.

• 9 种语言 README 与工具面对齐：工具数由 13 更正为 14，补充 forget 说明与 qdrant_backend 插件名。
  All 9 language READMEs aligned with the tool surface (13 → 14 tools, forget documented, qdrant_backend listed).

---

升级须知 / Upgrade notes

• 无破坏性变更：记忆库格式、MCP 协议版本（2024-11-05）与 CLI 命令面均不变。
  No breaking changes: memory-store format, MCP protocol version (2024-11-05) and the CLI surface are unchanged.
• forget 为纯增量工具，旧客户端忽略未知工具即可。
  forget is purely additive; older clients can simply ignore the unknown tool.
• qdrant_backend 为可选插件，需要本机可用的 Qdrant 与嵌入服务；未启用时行为与 7.0.0 一致。
  qdrant_backend is optional and requires a reachable Qdrant and embedding service; when unused, behaviour matches 7.0.0.
• 若此前依赖"批量写入时 confidence 被 Notary 覆盖"的行为，请注意该行为已按"显式值优先"修正。
  If you relied on confidence being overwritten by the Notary during batch writes, note that it now follows "explicit value wins".

---

完整变更记录 / Full changelog: CHANGELOG.md
已知缺陷清单 / Known defects: docs/KNOWN_DEFECTS.md
验收指南 / Acceptance guide: docs/ACCEPTANCE_GUIDE.md