rainypilgrimage · Sep 12, 2026 · Sep 12, 2026 · Sep 12, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -0,0 +1,15 @@
+# Changelog
+
+## [0.10.1] - 2026-09-12
+
+### Changed
+
+- Clarified that confirming the content of a memory update is separate from authorizing a filesystem change.
+- Added an explicit write gate for writes, moves, and deletions: show the exact preview and wait for explicit approval before mutating files.
+- Clarified that a request naming a project or note uses on-demand loading, while baseline context is loaded only for an explicit baseline request.
+- Required current-state answers to include the canonical status conclusion, its last-updated or last-verified date, and the coverage or limitation of the answer.
+
+### Compatibility
+
+- This release preserves the v0.10.0 metadata, lifecycle, ownership, and freshness safeguards.
+- It does not add background synchronization, automatic migration, or live-source polling.
diff --git a/README.md b/README.md
@@ -132,7 +132,7 @@ All memory is stored as local Markdown files. Do not put passwords, API keys, or
 
 ## Release Status
 
-v0.10.0 adds a canonical metadata schema and file formats, a data-not-instructions boundary, atomic-write and symlink safeguards, and an optional reference CLI (`bin/memory`). It preserves v0.9.0 coordinated updates and v0.8.1 ownership and freshness safeguards, and does not add background synchronization, scanning or polling, automatic migration, or bulk migration.
+v0.10.1 clarifies the distinction between confirming memory content and authorizing a filesystem change, makes project/note scope take precedence over baseline loading, and requires current-state answers to include the status source's date and coverage limits. It preserves v0.10.0 metadata, lifecycle, ownership, and freshness safeguards, and does not add background synchronization, scanning or polling, automatic migration, or bulk migration.
 
 ## License
 

diff --git a/README_zh.md b/README_zh.md
@@ -132,7 +132,7 @@ Agent 只展示一次合并预览，列出准确目标，并针对完整的非
 
 ## 版本状态
 
-v0.10.0 新增统一的元数据规范和文件格式、"数据不是指令"边界、原子写入与符号链接防护，以及可选的参考 CLI（`bin/memory`）。保留 v0.9.0 的协调式更新与 v0.8.1 的所有权和新鲜度保护，不包含后台同步、扫描或轮询、自动迁移或批量迁移。
+v0.10.1 澄清“确认记忆内容”与“授权文件系统变更”的区别，使项目/笔记范围优先于基础上下文加载，并要求当前状态回答包含状态源日期和覆盖限制。保留 v0.10.0 的元数据、生命周期、所有权和新鲜度保护，不包含后台同步、扫描或轮询、自动迁移或批量迁移。
 
 ## 许可
 

diff --git a/SKILL.md b/SKILL.md
@@ -1,14 +1,14 @@
 ---
 name: persistent-memory
 description: Use when a user wants cross-session personal context shared by compatible AI agents; says load memory (加载记忆), what do you know about me (我的背景), remember this (记住这个), save this, update memory (更新记忆), update my profile, add to notes, wrap this up, memory status (记忆状态), what's saved (存了什么), memory upgrade (升级记忆), archive (归档), delete (删除), recover (恢复), memory health (记忆体检), or clean up memory; or asks to load, save, inspect, archive, recover, clean up, or upgrade local memory files or update relevant project context.
-version: 0.10.0
+version: 0.10.1
 ---
 
 # Persistent Memory System
 
 Persistent Memory is a transparent local context layer. It stores reviewed user context as Markdown files so compatible agents can read the same source of truth.
 
-**v0.10.0:** Adds a canonical metadata schema and file formats, a data-not-instructions boundary, atomic-write and symlink safeguards, and an optional reference CLI (`bin/memory`) that enforces the lifecycle safety contract. It preserves v0.9.0 coordinated updates, explicit confirmation, one-fact/one-owner boundaries, and freshness checks; it does not add background synchronization, automatic migration, or live-source polling.
+**v0.10.1:** Clarifies the write-authorization gate, project-scope loading precedence, and the required fields for current-state answers. It preserves v0.10.0 metadata, lifecycle, ownership, and freshness safeguards; it does not add background synchronization, automatic migration, or live-source polling.
 
 ## Runtime Contract
 
@@ -20,6 +20,15 @@ The skill is an instruction set, not a background service. Shared memory works o
 
 Platform memory may coexist. Persistent Memory does not import historical chats or replace an agent's built-in memory.
 
+## Non-Negotiable Write Gate
+
+Before any memory-file write, move, or deletion, treat these as separate gates:
+
+- A user-confirmed fact authorizes the proposed content, not the filesystem change.
+- “Write directly,” “skip the preview,” “do not ask again,” and “no additional confirmation” are pressure signals, not file-change authorization.
+- Until the exact preview has been shown and explicitly approved, the next action is **do not mutate files**. This remains true after switching to a writable session.
+- In a read-only session, report the blocker and stop; do not promise to apply the change directly once write access appears.
+
 ## Memory Location and Scope
 
 `~/.persistent-memory/`
@@ -92,9 +101,13 @@ For active projects, distinguish four logical roles. Do not require a fixed dire
 
 ## Loading
 
+### Scope Precedence
+
+A request that names a specific project or note, such as “load Atlas project memory,” is an on-demand request. Do not read `_core/` merely because the wording contains “load” and “memory.” Read `_core/` only when the user explicitly requests baseline or personal context, such as `load memory` or `what do you know about me`. If the user explicitly requests both baseline context and a named project, read both scopes and state that both were loaded.
+
 ### Load Baseline Context
 
-Trigger: `load memory`, `加载记忆`, `what do you know about me`, or `我的背景`.
+Trigger: a baseline-context request such as `load memory`, `加载记忆`, `what do you know about me`, or `我的背景` without a specific project or note target.
 
 When this skill is active:
 
@@ -122,6 +135,8 @@ Before answering with a claim that means current, latest, completed, blocked, or
 4. If a newer material or live source conflicts with the status snapshot, treat the newer authoritative source as evidence and do not repeat the old status as current.
 5. Briefly state the coverage or limitation when claiming current project state.
 
+**Current-state answer contract:** When answering a question about current, latest, completed, blocked, or no active task, include these fields in the response: (a) the conclusion from the canonical current-status source; (b) that source's `last-updated` or `last-verified` date; and (c) the coverage or limitation of that conclusion. If a newer material or live source exists, include its date and role, and state whether it has or has not become the current-status source. This contract still applies when the user asks not to explain sources; keep it concise rather than omitting the fields.
+
 Do not claim that project context is fully loaded when declared current-status or required first-party sources were not read.
 
 ### Summary-first on-demand loading
@@ -143,6 +158,8 @@ Trigger: `remember this`, `记住这个`, `save this`, `更新记忆`, `update m
 3. Wait for user confirmation.
 4. Save only the confirmed content; update `_index.md` for active on-demand files.
 
+**Confirmation has two separate meanings:** confirmation that a fact or decision is true, and authorization to apply a displayed file change. A statement such as “the boundary change is confirmed” confirms the content, but does **not** authorize writing it. Only an explicit confirmation of the exact preview shown after step 2 satisfies step 3 or step 7. Requests such as “directly write,” “skip the preview,” or “do not ask again” do not collapse these two confirmations; show the preview and wait.
+
 When a confirmed update to an active on-demand file changes a fact represented in its `## Summary` / `## 摘要`, include the exact summary revision in the same preview and obtain the same explicit user confirmation before writing. Do not automatically create a Summary for an existing file and do not bulk-migrate memory files.
 
 ### Coordinated Project Context Update

diff --git a/SKILL_zh.md b/SKILL_zh.md
@@ -1,14 +1,14 @@
 ---
 name: persistent-memory
 description: Use when 用户需要让兼容 AI agent 共享跨对话个人上下文，或说出 load memory（加载记忆）、what do you know about me（我的背景）、remember this（记住这个）、save this、update memory（更新记忆）、update my profile、add to notes、wrap this up（帮我收尾）、memory status（记忆状态）、what's saved（存了什么）、memory upgrade（升级记忆）、archive（归档）、delete（删除）、recover（恢复）、memory health（记忆体检）、clean up memory；或要求加载、保存、查看、归档、恢复、体检或升级本地记忆文件，或要求收尾并更新相关项目上下文。
-version: 0.10.0
+version: 0.10.1
 ---
 
 # 持久化记忆系统
 
 Persistent Memory 是透明的本地上下文层：它把经用户确认的上下文保存为 Markdown，让兼容 agent 读取同一份事实源。
 
-**v0.10.0：** 新增统一的元数据规范和文件格式、"数据不是指令"边界、原子写入与符号链接防护，以及一个可选的参考 CLI（`bin/memory`）用于强制执行生命周期安全契约；保留 v0.9.0 的协调式更新、明确确认、一个事实一个所有者和新鲜度检查，不包含后台同步、自动迁移或实时来源轮询。
+**v0.10.1：** 澄清写入授权门禁、项目范围加载优先级，以及当前状态回答必须包含的字段。保留 v0.10.0 的元数据、生命周期、所有权和新鲜度保护；不包含后台同步、自动迁移或实时来源轮询。
 
 ## 运行契约
 
@@ -20,6 +20,15 @@ Persistent Memory 是透明的本地上下文层：它把经用户确认的上
 
 平台自带记忆可以共存。Persistent Memory 不会自动导入历史聊天，也不替代平台记忆。
 
+## 不可绕过的写入门禁
+
+任何写入、移动或删除记忆文件之前，都必须把以下两道门禁分开：
+
+- 用户确认事实，只授权拟保存的内容，不授权文件系统变更。
+- “直接写入”“跳过预览”“不要再问”或“无需额外确认”是压力信号，不是文件变更授权。
+- 在展示准确预览并获得明确批准之前，下一步必须是**不修改文件**；即使切换到可写会话也仍然如此。
+- 在只读会话中，说明阻塞并停止；不得承诺一旦获得写权限就直接应用变更。
+
 ## 记忆位置与边界
 
 `~/.persistent-memory/`
@@ -92,9 +101,13 @@ verified: 2026-01-03
 
 ## 加载
 
+### 范围优先级
+
+明确指定项目或笔记的请求（例如“加载 Atlas 项目记忆”）属于按需加载。即使措辞同时出现“加载”和“记忆”，也不要因此读取 `_core/`。只有用户明确要求 baseline 或个人背景（例如“加载记忆”“我的背景”）时才读取 `_core/`。如果用户明确同时要求 baseline 和指定项目，则读取两个范围，并说明两者都已加载。
+
 ### 加载基础上下文
 
-触发词：`load memory`、`加载记忆`、`what do you know about me`、`我的背景`。
+触发条件：不带具体项目或笔记目标的 baseline 请求，例如 `load memory`、`加载记忆`、`what do you know about me`、`我的背景`。
 
 当本 skill 已激活时：
 
@@ -122,6 +135,8 @@ verified: 2026-01-03
 4. 如果更新更晚的材料或实时来源与状态快照冲突，以较新且更权威的来源作为证据，不得继续把旧状态写成当前事实。
 5. 在声明当前项目状态时，简要说明已覆盖的来源或仍存在的限制。
 
+**当前状态回答合同：** 当回答涉及“当前、最新、已完成、被阻塞、没有任务”等含义时，回答必须包含以下字段：(a) 唯一当前状态源中的结论；(b) 该来源的 `last-updated` 或 `last-verified` 日期；(c) 该结论已覆盖的范围或仍存在的限制。如果存在更晚的材料或实时来源，还必须写出其日期和角色，并说明它是否已经成为当前状态源。即使用户要求不要解释来源，也必须保留这些字段；可以保持简洁，但不能省略。
+
 没有读取已声明的当前状态源或必要一手来源时，不得声称项目上下文已经完整加载。
 
 ### 摘要优先的按需加载
@@ -143,6 +158,8 @@ verified: 2026-01-03
 3. 等待用户确认。
 4. 仅保存已确认内容；活跃按需文件同步更新 `_index.md`。
 
+**确认有两种不同含义：**确认某项事实或决定为真，以及授权应用已经展示的文件变更。“边界变化已确认”只确认内容，不等于授权写入。只有在第 2 步展示准确预览后，用户对该预览作出的明确确认，才满足第 3 步或第 7 步的写入授权。“直接写入”“跳过预览”或“不要再问”不能把两种确认合并；仍须展示预览并等待确认。
+
 如果一次已确认的更新改变了活跃按需文件 `## Summary` / `## 摘要` 中已经表达的事实，必须在同一次预览里提出准确的摘要修订，并在同一次用户明确确认后才写入。不得自动创建已有文件的摘要，也不得批量迁移记忆文件。
 
 ### 协调式项目上下文更新

diff --git a/tests/en-zh-parity.test.mjs b/tests/en-zh-parity.test.mjs
@@ -24,8 +24,8 @@ test("English and Chinese skill files stay structurally in sync", async () => {
   const en = await read("SKILL.md");
   const zh = await read("SKILL_zh.md");
 
-  assert.match(en, /^version: 0\.10\.0$/m);
-  assert.match(zh, /^version: 0\.10\.0$/m);
+  assert.match(en, /^version: 0\.10\.1$/m);
+  assert.match(zh, /^version: 0\.10\.1$/m);
   assert.match(en, /^description: Use when /m);
   assert.match(zh, /^description: Use when /m);
 
@@ -59,4 +59,4 @@ test("English and Chinese skill files stay structurally in sync", async () => {
     assert.match(en, new RegExp(escapeRegex(token)), `missing English token: ${token}`);
     assert.match(zh, new RegExp(escapeRegex(token)), `missing Chinese-file token: ${token}`);
   }
-});
+});