Record a point-in-time fact into the mnema chain, attributed to this agent and pinned to the current session. Optionally pick the scope it lands in: public (team-visible), private (this machine, this project), or global (personal, cross-project); omitted, it follows the session default (private for an agent in a project, global outside one). Optionally pick the project it lands in, when the workspace holds more than one. The reply says which tree it landed in. RECORDING IS PERMANENT: mnema is append-only and nothing deletes a fact. A record in the public scope is committed to the repository and reaches every machine that clones it (published, if that repository is public). So do NOT record credentials here. Values in a recognized format (cloud keys, API tokens, private keys, a password inside a URL) are replaced with a typed placeholder before anything is written and the reply says what was replaced, but a format mnema does not recognize is written verbatim and cannot be taken back. Do not record personal data either: an email address is replaced with and reported, and the mnid already says who wrote. Each text field holds at most 65536 bytes; a longer one is refused, not truncated.

Record an observation ABOUT an entity (a task, decision, …) into the mnema chain, attributed to this agent and pinned to the current session. It carries the observed entity id (about), a short topic, and the observation text. The about id is NOT checked to exist: a reference to an entity in another tree is honest and resolved on read. Optionally pick the scope and the project it lands in; omitted, both follow the session default (private for an agent in a project, global outside one). Returns the observation’s own minted id, and says which tree it landed in. RECORDING IS PERMANENT: mnema is append-only and nothing deletes a fact. A record in the public scope is committed to the repository and reaches every machine that clones it (published, if that repository is public). So do NOT record credentials here. Values in a recognized format (cloud keys, API tokens, private keys, a password inside a URL) are replaced with a typed placeholder before anything is written and the reply says what was replaced, but a format mnema does not recognize is written verbatim and cannot be taken back. Do not record personal data either: an email address is replaced with and reported, and the mnid already says who wrote. Each text field holds at most 65536 bytes; a longer one is refused, not truncated.

Take back a memory or an observation that turned out to be wrong or stale. The note is NOT erased: a signed retraction carrying the reason is appended, the note stops being served by the opening read and the search, and reading it by id still returns it, saying when, by whom and why it was retracted. It follows the note to the tree it was written in. Only notes are retracted: a decision is rejected or superseded, a pattern rejected or deprecated. Only the identity that wrote a note retracts it; a note of another identity, or one already retracted, is refused. RECORDING IS PERMANENT: mnema is append-only and nothing deletes a fact. A record in the public scope is committed to the repository and reaches every machine that clones it (published, if that repository is public). So do NOT record credentials here. Values in a recognized format (cloud keys, API tokens, private keys, a password inside a URL) are replaced with a typed placeholder before anything is written and the reply says what was replaced, but a format mnema does not recognize is written verbatim and cannot be taken back. Do not record personal data either: an email address is replaced with and reported, and the mnid already says who wrote. Each text field holds at most 65536 bytes; a longer one is refused, not truncated.

Take back a link that was recorded by mistake: a governs on the wrong path, a relation that does not hold. Name the edge exactly as link_knowledge took it. The link is NOT erased: a signed retraction carrying the reason is appended, and every read that applies a link stops seeing the edge when nobody else asserts it, so a rule it addressed at a path stops acting there; references still shows it, marked retracted. It follows the link to the first tree that holds that edge. Only the identity that recorded a link retracts it; a link of another identity, or one already retracted, is refused. RECORDING IS PERMANENT: mnema is append-only and nothing deletes a fact. A record in the public scope is committed to the repository and reaches every machine that clones it (published, if that repository is public). So do NOT record credentials here. Values in a recognized format (cloud keys, API tokens, private keys, a password inside a URL) are replaced with a typed placeholder before anything is written and the reply says what was replaced, but a format mnema does not recognize is written verbatim and cannot be taken back. Do not record personal data either: an email address is replaced with and reported, and the mnid already says who wrote. Each text field holds at most 65536 bytes; a longer one is refused, not truncated.

Record a handoff on a task (work passed from one agent to another) into the mnema chain, attributed to this agent and pinned to the current session. It carries the task and the two agent labels (from, to); from == to is legitimate (a chat restart). The task id is NOT checked to exist. Optionally pick the scope and the project; omitted, the handoff follows the task to the tree that holds it (a private task keeps its brief private) and lands PUBLIC (global outside a project) only when no tree holds the task, which the reply says. A handoff has no id of its own: its subject is the task. Optionally give a brief (up to 64 KiB of text, refused beyond it): what the next agent must read, recorded in the same call as an observation about the task (topic brief) whose id the reply names. The reply says which tree it landed in. RECORDING IS PERMANENT: mnema is append-only and nothing deletes a fact. A record in the public scope is committed to the repository and reaches every machine that clones it (published, if that repository is public). So do NOT record credentials here. Values in a recognized format (cloud keys, API tokens, private keys, a password inside a URL) are replaced with a typed placeholder before anything is written and the reply says what was replaced, but a format mnema does not recognize is written verbatim and cannot be taken back. Do not record personal data either: an email address is replaced with and reported, and the mnid already says who wrote. Each text field holds at most 65536 bytes; a longer one is refused, not truncated.

Link one piece of knowledge to another: a directed edge from a subject entity to a target entity, labeled by a relation rel. The relation is an OPEN string (recommended: supersedes, relates-to, derived-from, contradicts, governs, asks-for-a-person, refuses-a-write; any label is accepted). An ADR-<n> label is recorded as the id of the one decision it names, and refused when several carry it or none does. Neither endpoint is checked to exist: a link is legitimately cross-tree, resolved on read. Optionally pick the scope and the project the EDGE is recorded in; omitted, a link asserts a relation between the project’s records and lands PUBLIC (global outside a project). A link has no id of its own: it is an edge. The reply says which tree it landed in. RECORDING IS PERMANENT: mnema is append-only and nothing deletes a fact. A record in the public scope is committed to the repository and reaches every machine that clones it (published, if that repository is public). So do NOT record credentials here. Values in a recognized format (cloud keys, API tokens, private keys, a password inside a URL) are replaced with a typed placeholder before anything is written and the reply says what was replaced, but a format mnema does not recognize is written verbatim and cannot be taken back. Do not record personal data either: an email address is replaced with and reported, and the mnid already says who wrote. Each text field holds at most 65536 bytes; a longer one is refused, not truncated.

Open a task in the mnema chain, attributed to this agent and pinned to the current session. A task needs a title; it starts in the workflow’s initial state and is moved from there with task_transition. Optionally pick the scope it lands in: public (team-visible), private (this machine, this project), or global (personal, cross-project); omitted, a task is the team’s work board and lands PUBLIC: committed, so a clone has the board (global outside a project). Optionally pick the project it lands in, when the workspace holds more than one. Optionally give a description (up to 64 KiB of text, refused beyond it): what the task is, recorded in the same call as an observation about it (topic description) whose id the reply names. Returns the minted id (the key to move it), the short alias a human reads, and which tree it landed in. RECORDING IS PERMANENT: mnema is append-only and nothing deletes a fact. A record in the public scope is committed to the repository and reaches every machine that clones it (published, if that repository is public). So do NOT record credentials here. Values in a recognized format (cloud keys, API tokens, private keys, a password inside a URL) are replaced with a typed placeholder before anything is written and the reply says what was replaced, but a format mnema does not recognize is written verbatim and cannot be taken back. Do not record personal data either: an email address is replaced with and reported, and the mnid already says who wrote. Each text field holds at most 65536 bytes; a longer one is refused, not truncated.

Move an existing task to a new state (submit, start, block, unblock, submit_review, request_changes, approve, complete, cancel, reopen). The workflow gate decides whether the move is legal and carries the proof it requires: block/cancel/reopen need a reason, approve/complete a note, request_changes a feedback; an illegal move or missing proof is refused. The task is looked for in EVERY project of this workspace and the move lands in the project that holds it, so no project is taken here: the id decides where the move goes. RECORDING IS PERMANENT: mnema is append-only and nothing deletes a fact. A record in the public scope is committed to the repository and reaches every machine that clones it (published, if that repository is public). So do NOT record credentials here. Values in a recognized format (cloud keys, API tokens, private keys, a password inside a URL) are replaced with a typed placeholder before anything is written and the reply says what was replaced, but a format mnema does not recognize is written verbatim and cannot be taken back. Do not record personal data either: an email address is replaced with and reported, and the mnid already says who wrote. Each text field holds at most 65536 bytes; a longer one is refused, not truncated.

Record a decision into the mnema chain, attributed to this agent and pinned to the current session. A decision needs both a title and a rationale (why it was made). Optionally record what you considered and turned down, and why not (alternatives): the reasoning a later reader needs when somebody proposes the thing you already rejected; it is searchable, so search answers "did we already turn this down?". A decision is immutable, so it is recorded now: an option rejected later is a new decision, or supersedes this one. Optionally pick the scope it lands in: public (team-visible), private (this machine, this project), or global (personal, cross-project); omitted, a decision is a declaration about the project and lands PUBLIC: committed, so the team gets it on clone (global outside a project); it is born proposed, so recording one proposes it rather than settling it. Optionally pick the project it lands in, when the workspace holds more than one. Returns the citable ADR- label (a decision has no short alias) and which tree it landed in. RECORDING IS PERMANENT: mnema is append-only and nothing deletes a fact. A record in the public scope is committed to the repository and reaches every machine that clones it (published, if that repository is public). So do NOT record credentials here. Values in a recognized format (cloud keys, API tokens, private keys, a password inside a URL) are replaced with a typed placeholder before anything is written and the reply says what was replaced, but a format mnema does not recognize is written verbatim and cannot be taken back. Do not record personal data either: an email address is replaced with and reported, and the mnid already says who wrote. Each text field holds at most 65536 bytes; a longer one is refused, not truncated.

Move an existing decision to a new state. accept and reject a proposed decision (each needs a note); supersede a proposed or accepted decision with a later one: supersede needs the successor decision id in by and a reason. by applies ONLY to supersede; accept and reject REFUSE it. An illegal move or missing proof is refused with the gate’s reason. The decision is looked for in EVERY project of this workspace and the move lands in the project that holds it: the id decides, so no project is taken. An acceptance made through this tool is recorded as an agent’s, says so in the reply, and is marked as such wherever the decision is read. The switch agent-accepts turns it off, and then an accept is refused. RECORDING IS PERMANENT: mnema is append-only and nothing deletes a fact. A record in the public scope is committed to the repository and reaches every machine that clones it (published, if that repository is public). So do NOT record credentials here. Values in a recognized format (cloud keys, API tokens, private keys, a password inside a URL) are replaced with a typed placeholder before anything is written and the reply says what was replaced, but a format mnema does not recognize is written verbatim and cannot be taken back. Do not record personal data either: an email address is replaced with and reported, and the mnid already says who wrote. Each text field holds at most 65536 bytes; a longer one is refused, not truncated.

Propose a reusable pattern (a skill) into the mnema chain, attributed to this agent and pinned to the current session. A skill needs both a name (a short title) and a body (the reusable pattern itself). Optionally pick the scope it lands in: public (team-visible), private (this machine, this project), or global (personal, cross-project); omitted, a pattern states how the work is done here and lands PUBLIC: committed, so the team gets it on clone (global outside a project); it is born proposed, so creating one proposes it rather than adopting it. Optionally pick the project it lands in, when the workspace holds more than one. Returns the minted id (the key to move it), the name, and which tree it landed in. RECORDING IS PERMANENT: mnema is append-only and nothing deletes a fact. A record in the public scope is committed to the repository and reaches every machine that clones it (published, if that repository is public). So do NOT record credentials here. Values in a recognized format (cloud keys, API tokens, private keys, a password inside a URL) are replaced with a typed placeholder before anything is written and the reply says what was replaced, but a format mnema does not recognize is written verbatim and cannot be taken back. Do not record personal data either: an email address is replaced with and reported, and the mnid already says who wrote. Each text field holds at most 65536 bytes; a longer one is refused, not truncated.

Move an existing skill to a new state: review a proposed skill, adopt a reviewed one as a live pattern, reject a proposed or reviewed one, or deprecate an adopted one that fell out of use. review/adopt/reject each need a note; deprecate needs a reason. An illegal move or missing proof is refused with the gate’s reason. The skill is looked for in EVERY project of this workspace and the move lands in the project that holds it: the id decides, so no project is taken. RECORDING IS PERMANENT: mnema is append-only and nothing deletes a fact. A record in the public scope is committed to the repository and reaches every machine that clones it (published, if that repository is public). So do NOT record credentials here. Values in a recognized format (cloud keys, API tokens, private keys, a password inside a URL) are replaced with a typed placeholder before anything is written and the reply says what was replaced, but a format mnema does not recognize is written verbatim and cannot be taken back. Do not record personal data either: an email address is replaced with and reported, and the mnid already says who wrote. Each text field holds at most 65536 bytes; a longer one is refused, not truncated.

The opening context for this session's actor: where they left off, the LIVE work, the patterns, the DECISIONS IN FORCE (settled here and not replaced) and what is AWAITING A JUDGEMENT. Derived from the chain. Every list is NAMES, never bodies: a task as id, title and state, a pattern as id and name, a decision as id, title and its ADR- label. For the rest, by id: next_actions for a task’s moves, skills for a pattern (asking records the consultation), read_record for a decision’s argument and its label. Only a decision IN FORCE is listed: proposed, rejected or superseded is left out. awaitingJudgement is one list of all three; kind says which, state what is owed: proposed the first ruling, reviewed the adoption call, IN_REVIEW the approve-or-send-back. A DONE or CANCELED task is on NEITHER list; ask search (kind task). Three lists are CUT to the freshest; workTotal, decisionsTotal and awaitingJudgementTotal say how many in all, so a total larger than its list means more is not shown, and search reaches past every cut. Every adopted pattern is listed, so it has no total. EVERY LIST HERE IS ABOUT A TASK, A DECISION OR A PATTERN, so empty lists do NOT mean the record is empty: unread names each kind not looked at, with how much, to pass to search; it is ABSENT when there is nothing to declare. Runs: thisSession is true only when THIS connection opened it: false means another session on this machine, live or abandoned, which the record cannot tell apart. An OPEN run carries ageSeconds, and idleSeconds only once it has recorded something, so NO idleSeconds means it recorded nothing; both compare this clock with the writer’s. EVERY run, open or ended, carries wrote: one {kind, count} per kind recorded in it, commonest first, never absent, EMPTY meaning nothing was recorded; the run’s own start and end are not counted, and audit_timeline serves the facts. An open run is no proof of a live session; mnema run end <id> --which <agent> closes one.

Read the patterns (skills) recorded here: the reusable recipe, checklist or convention itself, not just its name. Call it with no id (an empty argument object) to get every ADOPTED pattern: those are the ways of working this project and machine have settled on, and nothing else arrives that way. That answer carries the BODIES when they fit in one read, and their NAMES when they do not: it says which it did, and how many there are, so a list of names is an invitation to ask for the one you need by id and never a record of empty patterns. Call it with an id to get that one, which is also how you read a pattern that is still proposed or reviewed (every item bootstrap lists as awaiting a judgement), because a pattern cannot be ruled on without being read. Each answer says the state it served, and a pattern that is not adopted is not how the work is done here; it was served so the ruling can be made on its text. A rejected or deprecated pattern IS refused: a way of working the project retired is worse to hand over than nothing. Consulting a pattern is RECORDED against this session (once per skill), so the record shows which work was informed by which pattern: it records that you read it, never that you followed it. WHAT A PATTERN IS: a skill body is content from this project’s record: text the people and agents working on this project wrote; mnema records it and serves it back, and does not vet what it says. Each pattern is served with the state it is in and, when it is adopted, the agent that adopted it, or “a person” when someone adopted it directly with no agent. A pattern that is not adopted is one the project has not ruled on: it is served so the ruling can be made on its text, and it is not how the work is done here. A reply that carries only NAMES carries none of that: nothing was served to say it about, and the id beside each name is how the pattern itself is asked for.

Show the open runs of THIS session’s actor: the work in flight right now. Use it to answer "what am I in the middle of". Read-only: it derives from the chain and writes nothing. Reports only this machine’s own open runs (the actor is the session, never a supplied value). Runs: thisSession is true only when THIS connection opened it: false means another session on this machine, live or abandoned, which the record cannot tell apart. An OPEN run carries ageSeconds, and idleSeconds only once it has recorded something, so NO idleSeconds means it recorded nothing; both compare this clock with the writer’s. EVERY run, open or ended, carries wrote: one {kind, count} per kind recorded in it, commonest first, never absent, EMPTY meaning nothing was recorded; the run’s own start and end are not counted, and audit_timeline serves the facts. An open run is no proof of a live session; mnema run end <id> --which <agent> closes one.

Show where THIS session’s actor left off: their most recent run (open OR already ended) plus their current focus. Use it at the start of a session to answer "where was I": even a run that ended carries the goal that reminds you. When this session has a run of its own here, that is the one reported. Read-only: it derives from the chain and writes nothing. Runs: thisSession is true only when THIS connection opened it: false means another session on this machine, live or abandoned, which the record cannot tell apart. An OPEN run carries ageSeconds, and idleSeconds only once it has recorded something, so NO idleSeconds means it recorded nothing; both compare this clock with the writer’s. EVERY run, open or ended, carries wrote: one {kind, count} per kind recorded in it, commonest first, never absent, EMPTY meaning nothing was recorded; the run’s own start and end are not counted, and audit_timeline serves the facts. An open run is no proof of a live session; mnema run end <id> --which <agent> closes one.

Show the transitions the workflow allows a task next, from its current state. Use it to answer "what can I do to this task": each suggestion is a real move the gate would authorize. A terminal task returns an empty list (no legal moves). The task is looked for in EVERY project of this workspace; an id no tree of it holds is refused, naming the projects searched. After the list, a line says who has the task and one the last thing that happened to it, when the record has either. Read-only.

Simulate whether a task transition would be permitted BEFORE trying it: a dry-run of the workflow gate that writes NOTHING. Use it to answer "may I approve/complete/… this task, and if not, why?" without making the move. It reads the task’s current state and returns the gate’s own verdict: ALLOWED (with the state the move would reach) or REFUSED (with the gate’s reason: an illegal move, missing proof, or who == which). Pass the same proof you would carry (note/reason/feedback) to see if that proof suffices. It also refuses, with the write’s own code and words, what this machine’s key would be refused in the task’s tree: a key protected by a passphrase that is not set, an agent that tree does not enrol where the person’s key that would sign instead is not at hand, an agent retired (AGENT_NOT_ENROLLED, REVOKED_KEY, KEY_IS_PROTECTED, AGENT_NAME_REFUSED, AMBIGUOUS_MEMBERSHIP). It cannot know a wrong passphrase, a record busy at that moment, or another write changing the task before your move; and with no key on the machine yet it says who is missing, though the first write makes the key. The verdict is paired with your current focus. The task is looked for in EVERY project of this workspace, as task_transition looks; an id no tree of it holds is refused, naming the projects searched. Read-only. Runs: thisSession is true only when THIS connection opened it: false means another session on this machine, live or abandoned, which the record cannot tell apart. An OPEN run carries ageSeconds, and idleSeconds only once it has recorded something, so NO idleSeconds means it recorded nothing; both compare this clock with the writer’s. EVERY run, open or ended, carries wrote: one {kind, count} per kind recorded in it, commonest first, never absent, EMPTY meaning nothing was recorded; the run’s own start and end are not counted, and audit_timeline serves the facts. An open run is no proof of a live session; mnema run end <id> --which <agent> closes one.

Search everything recorded in EVERY project of this workspace and on this machine (memories, observations, decisions, tasks and skills) by the words a person wrote in them. Use it to answer "have we written about X?" or "what did we decide about Y?" BEFORE assuming nothing is recorded. With NO term it lists the most recent records instead ("what has been going on here": call it with an empty argument object). Narrow with kind, scope, state or a time window. Returns an INDEX (id, kind, tree, project, when, and one line each), not the bodies; take an id to read_record for the whole thing. It searches every tree it can see (the team’s, this machine’s, your own) in every project you have open, and each hit says which project and which tree hold it. Two limits worth knowing: each tree ranks its own matches against its own words, so the merged order is a good approximation and not one global ranking; and limit can fill the answer from one project: when it leaves another project’s matches out entirely, the reply names that project under hidden, and asking again with a larger limit reaches them. The order is when each was RECORDED, not when it last moved, and kind is the catalog’s own name, taken verbatim, the one unread hands you. Read-only.

Read ONE record in full (a memory’s content, a decision’s rationale and what it turned down, an observation’s text, a task) by the id an index gave you: search, or the decisions bootstrap lists (which carry the title and not the argument). This is the second half of a search: the index tells you what exists, this tells you what it says. It looks in EVERY project of this workspace, not only the one you are working in (an id is minted once and lives in one place) and the answer says which project and which tree hold it. A skill id is refused here and pointed at the skills tool, which serves a pattern’s body and records the consultation. An id no project holds is refused, in a reply that names where it looked. A decision’s ADR- label is a display name a person cites, numbered within one tree and never an identity: two trees can each hold an ADR-1, and only the id tells them apart. Read-only.

Show the complete history of one entity (a task, decision, skill, …) across ALL trees of ALL projects in this workspace: every event where it is the subject, plus events that refer to it (an observation about it, a link whose target is it), which may live in another tree, or in another project. Use it to answer "tell me the whole story of this entity", including the part that happened in a sibling codebase; each entry says which project it came from. An id no event touches returns an empty history (a valid answer). Read-only.

Show what one entity is connected to across ALL trees of ALL projects in this workspace: the observations about it, the links into and out of it, the decision that superseded it. Use it after search to pull on a thread: "what else is tied to this?". By default it is the NEIGHBOURHOOD (one hop, either direction); set direction to "out" (what it points at) or "in" (what points at it) with a larger depth to follow a lineage, such as a decision’s supersede chain. direction: "in" is how you answer "have I already applied this in my other projects?": the things that point at it are in THEIR records, and every edge says which project asserts it. A far end no visible tree holds comes back marked unresolved (that is legitimate, not an error), and the answer says when the depth cut it. Give it a PATH a link ends in and the answer also carries file: whether that file exists in the working tree today and the SHA-256 of its bytes. Read-only.

Show which rules of THIS project’s record are addressed at a path: a decision or a pattern linked to it with rel: "governs", most specific first. Use it before changing a file, to find the decisions that already apply to it; the id it returns is what you cite when you follow one. An address is a PREFIX by path segment: a rule on src/collate governs src/collate/fold.ts and does NOT govern src/collate_test.rb. Every answer carries three counts, zeroes included: how many rules cover this path, how many address this project at all, and how many address something the working tree no longer holds: a rule whose file was moved or deleted has stopped governing, and the third count is how you find out. It reports each rule’s state and decides nothing: it refuses nothing, blocks nothing, and does not judge whether a rule still holds. Addresses come from THIS project only, because an address is relative to a project root. A relative path is resolved against the project root, not a working directory. Read-only.

The HOST calls this one, as a PreToolUse hook, before a file is written: it hands the session the rules of this project’s record that are addressed at that path AND still in force, as one short text that lands beside the result of that write: each rule’s name, the address that matched, and the id you cite. You may call it yourself; what you get back is a HOOK REPLY, because that is the only shape this host reads, and {} when there is nothing to say. Where a rule of the record is linked to the path with rel: "asks-for-a-person", the reply also carries permissionDecision: "ask", and the host holds the write until a PERSON decides, citing that rule’s id. It cannot refuse, allow, or rewrite your input: none of the three is representable in what it returns. It WRITES: every asking is appended to the record as a fact citing the rule and the path you named, before the reply is composed, and the first service of a session is appended too. For the whole answer (every address whatever its state, whose file no longer exists, and the counts for each relation) ask governing_rules instead; this one is deliberately thin, because it is paid for on every edit. RECORDING IS PERMANENT: mnema is append-only and nothing deletes a fact. A record in the public scope is committed to the repository and reaches every machine that clones it (published, if that repository is public). So do NOT record credentials here. Values in a recognized format (cloud keys, API tokens, private keys, a password inside a URL) are replaced with a typed placeholder before anything is written and the reply says what was replaced, but a format mnema does not recognize is written verbatim and cannot be taken back. Do not record personal data either: an email address is replaced with and reported, and the mnid already says who wrote. Each text field holds at most 65536 bytes; a longer one is refused, not truncated.

Show who authorized what and which agent executed it, across ALL trees of ALL projects in this workspace. Use it to answer "who did what" over the whole record: with no filter it accounts for everything (like git shortlog). Optionally narrow by a time window (from/to), a single author (who), or a single executing agent (which). The answer is ONE ACCOUNT PER PROJECT (plus the machine-global tree, which belongs to none), each with its own total and per-author breakdown (counts by kind and by executing agent) and, beside each author, foundedBeside: every tree of that record where the identity was founded after others already were, with when and which identities were there (somebody new to the record, or one person under a second key); empty when it founded first or was vouched for. There is deliberately no combined total: a count belongs to a record, and adding several projects up answers "how much have I written anywhere" under the name of "how much is in this record". Add them yourself if that is your question. A project with nothing to report is listed at zero rather than left out. Read-only.

Show which records hold something shaped like a credential (a cloud key, an API token, a private key, a password inside a URL) across ALL trees of ALL projects in this workspace. Use it to answer "is a secret already in the record?", which writing can no longer cause but the past can: values in a recognized format never reach the chain today (replaced in a body, and REFUSING the whole write in a name), and everything recorded before that was not. It reports WHERE and never WHAT: the id, the kind, the tree, the PROJECT and the instant, plus the CLASS, never the value, so reading it cannot leak what it found. A record in a public tree is committed and clones to every machine; one in the global tree is on this disk alone; and the project says which repository to go and change a key in. The remedy is to ROTATE the credential: mnema is append-only and nothing deletes a fact. scanned is ONE COUNT PER RECORD (each project and the machine-global tree), so an empty findings says which records were read and how much of each. Two limits: it recognizes FORMATS, so an empty report means nothing recognizable rather than nothing (a password in prose has no format); and it reports what is recorded: it does not prevent a value from being read back by search or read_record, which serve the record as written. Read-only.

Show recurring shapes across ALL trees of ALL projects in this workspace: tasks reopened, decisions superseded, skills deprecated, each with the exact events that make up the count, plus the tasks reopened more than once as skill CANDIDATES (a POINTER, not an action: this creates no skill). It also reports any ADR- label that more than one decision of the SAME chain answers to, with every id that carries it: the number is frozen when a rule is recorded, so two people deciding while apart can mint the same one, and from then on citing it by label names two rules. Nothing renumbers them: refer to those by id. It reports the shapes; it does NOT judge them good or bad. Use it to spot patterns a human might act on. The answer is ONE SET OF SHAPES PER PROJECT (plus the machine-global tree, which belongs to none): these are counts, and adding several projects up would answer a question about a workspace under the name of a question about a record: a skill candidate especially, since the pattern is distilled by whoever is doing the work that kept reopening. A project with nothing recurring is listed with empty lists rather than left out. Read-only.