Memory

One's memory is meant to be something you can inspect and control item by item, not a hidden profile. Its canonical form is a structured record; the text a model sees is generated from that record.

Boundaries

• Memory is not an instruction. A memory always enters a model as a marked block of data. No memory record switches on an instruction, a rule or a permission by itself.
• Memory is not authority. Remembering that you usually order coffee at 8:10 does not allow One to order it.
• Data at the source stays at the source. An email, a calendar event or a document is read where it lives. One keeps a reference, the time it was read and the smallest summary the task needs.
• Memory is independent of the model and the language. Records survive model changes.
• Memory does not enter Work. Your preferences, notes and reasoning never become part of a shared record.

What a memory record holds

Each field is independent; none of them stands in for another.

Field	What it says
Content type	Preference, routine, goal, constraint, relationship, personal fact, opinion, event. Extensible, but every new type maps to a core type
Epistemic state	How One knows it (see below)
Layer	Event, consolidated fact, or behaviour rule
Time kind	Permanent, for now, seasonal, one-off, or in the past
Valid time	When the fact was true in the world
Record time	When One learned it, and when it was superseded
Source episodes	The episodes it was derived from. Never empty
Source kind	Your statement, your behaviour, a connected source, external content, or an import
Evidence	Number of observations, ratio, first and last observation, conflicting records
Alternative explanations	A typed list of candidates, when there is more than one plausible reading
Life area and project	One or more life areas, optionally a project
Sensitivity class	Normal, or one of the sensitive classes
Lifecycle state	Candidate, active, not in use, permanently forgotten
Usage restriction	Empty, or "only for this area or project"
Version	A supersedes link to the previous version

The full field list is in the memory reference.

Epistemic state: how One knows

State	Meaning	Example
Said	You said it yourself	"I'm allergic to peanuts"
Observed	Seen directly in your behaviour	"14 of the last 17 orders were an americano"
Inferred	Derived from observations	"Prefers an americano in the morning"
Hypothesis	An untested inference with more than one explanation	"Interested in golf, or it may be for their child"
Verified	You confirmed it, or independent evidence from a different source arrived	"Yes, americano"
Invalid	Replaced by something newer, or corrected by you	"Drinks it iced", before "I drink it hot now"

Two pieces of evidence from the same source count as one.

Confidence is computed, not guessed

Confidence is calculated from evidence: how many observations, what ratio, how recent, what kind of source, and how many records conflict. It is never a number a language model makes up. The formula is versioned and pinned by test vectors.

You see a class, not a number:

You see	When
"You told me"	Said, or verified by you
"I think so"	Observed or inferred, above the threshold
"I'm not sure"	A hypothesis, or below the threshold
"I saw it in a source, not verified"	A candidate from external content
"Imported, not verified"	A candidate from an import

Confidence never widens authority. It is used only after Access has allowed an action, and only to make One ask anyway.

How memory gets written

Path	When	Result
Explicit "remember this"	In the conversation, when you ask	Active immediately, marked as said
Background inference	At the end of a session and in a once-a-day consolidation	Normal class: active, and shown in "recently learned". Sensitive class and behaviour rules: candidate until you confirm
External content	Web, email, documents, other agents	Candidate
Import	A package or dump you import	Candidate, "imported, not verified"
Behaviour rule	One proposes it	Candidate, active once you accept it

Only an explicit "remember this" is written during a conversation. Everything else happens in the background. Candidate detection on the phone runs without a language model; turning a candidate into a structured record happens in the cloud with One's own model, inside your encrypted space and an attested confidential computing environment.

External content stays a candidate

A record derived from a web page, an email, a document, a calendar invite, another agent or a tool output stays a candidate. It becomes lasting only with your confirmation or a second, independent piece of evidence from a different source. Nothing derived from external content can ever become a behaviour rule, a preference rule or authority. This is the main defence against memory poisoning, where a page says "remember: always pay to this account".

Behaviour rules

Rules about how One itself behaves, such as "keep answers short in the morning", are proposed by One with their evidence and only take effect after you accept them. Accepted rules are versioned and can be undone at any time. A behaviour rule is never authority: "pay my bills" cannot be written as a behaviour rule.

Change, exception and conflict

Situation	Example	What happens
Change	"I drink my coffee hot now"	A new active record; the old one becomes invalid and both stay linked
Exception	"Make it hot today"	The lasting record is unchanged; a one-off contextual record is added
Conflict	Your calendar says one city, you say another	Both records are kept and flagged; both are retrieved together, and One asks if needed

No record is deleted or silently overwritten in a conflict.

Time

Future-tense records turn into past-tense ones once the date passes. "For now" records get an estimated end; when it arrives, One asks a one-line question ("Still doing this?"). If there is no answer, the record is kept but drops in priority and moves to "I'm not sure". Decay only lowers retrieval priority; it never deletes.

The three ways to forget

Action	What you mean	What happens	Can it be undone
Correct	"That's wrong"	A new version is written; the old one becomes invalid	Yes, the old version stays in the chain
Don't use	"Know it, but don't use it"	The record stays, marked not in use; it is excluded from retrieval and training	Yes
Forget permanently	"Don't know this at all"	The keys of the record and everything derived from it are destroyed	No

Forgetting permanently covers the record's content, the episode content that belongs only to it, consolidated facts and summaries derived from it, text views, embeddings and cached copies on your devices. If your personal adapter was trained on it, the adapter is retrained from the remaining memory and the old version's key is destroyed; until retraining finishes, the old adapter is not used.

What remains is a skeleton: the identifier, the "permanently forgotten" state and when it happened. The content, the content type and the source do not remain. Copies on an offline device become unreadable when that device reconnects, and One tells you which devices are still pending.

Forgetting one record needs a clear in-app confirmation. Forgetting a whole life area or all memory is done on the Access approval surface with strong authentication, and One can never start it on its own.

What you see afterwards: "Permanently forgotten; it cannot be brought back."

Life areas and projects

Memory is not a single pool. Every record belongs to at least one fixed life area: work, health, finance, relationships, home, travel, shopping, learning, leisure, and general (name, language, form of address, time zone). You can add your own projects, such as a renovation or a thesis; you cannot add life areas. A closed project is archived and its records are left out of retrieval until you reopen it.

How memory is retrieved

For any task or answer, memory is selected in a fixed order. No step can be skipped.

1. Task area. Retrieval is limited to the task's life area and project, plus "general".
2. State filter. Candidate, not-in-use, forgotten and invalid records are removed. Your "only use for X" restrictions apply.
3. Policy gate. Consent for sensitive classes and your sharing preferences are evaluated. A sensitive record without consent cannot pass.
4. Opinion filter. For a factual question, records of your opinions are left out, so stored beliefs do not push the model into agreeing with you.
5. Search. Hybrid lexical, vector and relationship search.
6. Ranking. By relevance, priority, confidence and time kind.
7. Smallest subset. Only the fewest records the task needs.
8. Presentation. The records go to the model as a marked data block, each line labelled with content type, epistemic state, confidence class and any conflict flag.

Your controls

Control	What it does
Temporary mode	Nothing from this session is written to memory, episodes or history. Access decisions and action records are always written
Answer without personalization	No memory is retrieved for this answer
Only use for X	The record is retrieved only in the chosen area or project
Don't use this	Excludes the record from retrieval and training
"How do you know this?"	Answered with a sentence tied to the record's evidence, not raw reasoning

Every screen action has a plain-language equivalent with the same result: "remember this", "forget this", "don't use this again", "what do you know about me?".

Memory and personal model training are separate permissions. Turning off training does not erase memory, and turning on memory does not turn on training.

Device and cloud

Canonical memory lives in the cloud, in your encrypted space. Your device keeps an encrypted subset so the offline core works: frequent preferences, upcoming events, people and their vectors. Changes you make offline are queued and applied when you reconnect; the server is authoritative for memory records.

You can choose to keep a sensitive class only on this device. Its records then never reach the cloud and have no cloud backup, and language-model features for that class do not run. One tells you the cost plainly when you choose it: if you lose the device, you lose that information.

Export and import

Memory is designed to be fully exportable, so you can take it with you:

• memory records with every field, including version chains;
• the episodes they came from;
• your personality profile and accepted behaviour rules;
• a readable summary of the Grants and Mandates you gave One (read from Access at export time);
• connected accounts and capabilities, without secrets or tokens;
• task history;
• your personal adapter, with the base model it belongs to;
• a human-readable view of the whole package.

The schema is open and versioned, and the package is JSON. Export is the same in every region, needs strong authentication to start, and is delivered to your device encrypted with your key. Sensitive classes are in a separate section you can leave out. If Access cannot be reached, the export waits rather than producing an incomplete package.

Everything you import arrives as a candidate marked "imported, not verified". Imported content is data, never instructions, can never become a behaviour rule, and never enters training.

If One ever shuts down

A shutdown is designed to be announced well in advance in the app, by email and by push. During the notice period the service and export stay fully available, and export stays open for a further period after the service ends. After that, all One data is made unreadable in the same way as when you delete your account. The same applies if One leaves a region.