claude-mem-lite 6.17.1 → 6.19.0

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "6.17.1",
+      "version": "6.19.0",
       "source": "./",
       "homepage": "https://github.com/sdsrss/claude-mem-lite",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.17.1",
+  "version": "6.19.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/README.md

@@ -81,7 +81,7 @@ How claude-mem-lite differs from the major neighbors in the LLM-memory space (ve
 - **Episode batching** -- Groups related file operations into coherent episodes before LLM encoding
 - **Error-triggered recall** -- Automatically searches memory when Bash errors occur, surfacing relevant past fixes
 - **Proactive file history** -- When editing a file, automatically shows relevant past observations for that file
-- **Session summaries** -- written at every Stop (the assistant's final report when it has Done / Not done sections, else the first prompt and recent observation titles), then upgraded by a background model summary when the session has observations
+- **Session summaries** -- written at every Stop (the assistant's final report when it has Done / Not done sections, else — when the final reply has no report section at all — its first 120 characters, else the first prompt and recent observation titles), then upgraded by a background model summary when the session has observations
 - **Project-scoped context** -- Injects recent memory into `CLAUDE.md` and session startup for immediate context
 - **Observation types** -- Categorized as `decision`, `bugfix`, `feature`, `refactor`, `discovery`, or `change`
 - **Importance grading** -- LLM assigns 1-3 importance levels (routine / notable / critical) to each observation
@@ -237,6 +237,36 @@ rm -rf ~/claude-mem-lite/   # pre-v0.5 unhidden (if not auto-moved)
     repos/               # Shallow-cloned source repos
 ```
 
+## Upgrading to 6.19.0
+
+**Search output changes; no switch.** No schema change and no migration, so reverting is
+pinning `claude-mem-lite@6.18.0`.
+
+- **`search` / `mem_search` mark machine-written observations with `🤖`**, and `get` /
+  `mem_get` name them in the header. Hook-captured, imported and compressed rows carry it;
+  explicit saves and events do not. The result line explains the mark whenever a shown row
+  has it, and `search --json` adds `auto` to observation rows.
+- **`mem_search` shows a snippet line only when it adds to the title.**
+- Fixes: a lone search match in a new per-project store no longer sorts last; a Bash
+  step's stored description keeps the end of its output; the secret scrubber catches values
+  behind markdown labels and stays linear-time on crafted input.
+
+## Upgrading to 6.18.0
+
+**One default changes, with a switch.** No schema change and no migration. Pinning
+`claude-mem-lite@6.17.1` stops new lines; a line already written stays until that session's
+next observation titles replace it, and 6.17.1 keeps its unrecognised tag as text in the
+row's `notes`.
+
+- **Last Session shows how the previous session ended even without a report.** When the
+  final reply has no Done / Not done / Failed / Uncertain section, `Completed:` is its first
+  120 characters (code blocks and line-leading markers removed) where it used to be
+  observation titles, which are usually empty; the /clear handoff labels it
+  `<session-summary source="last-reply">`. A report or a model summary still takes
+  precedence. A later reply under 400 characters ("You're welcome!") does not replace an
+  earlier one, and a reply in which the secret scrubber finds anything writes no line at all.
+  `CLAUDE_MEM_SUMMARY_TAIL=0` restores the titles from the session's next turn on.
+
 ## Upgrading to 6.17.0
 
 **Two defaults change; one has a switch.** No schema change and no migration, so reverting
@@ -985,6 +1015,7 @@ claude-mem-lite.
 | `CLAUDE_MEM_DEBUG` | Enable debug logging (`1` to enable). | _(disabled)_ |
 | `MEM_QUIET_HOOKS` | Low-noise hooks. `1` drops the `File Lessons` / `Key Context` sections from SessionStart injection, the lesson suffix from `[mem] Related memories`, and the `WHEN TO USE` / `Decision rules` blocks from MCP server instructions. IDs and the `Recent` table still surface so `mem_get(ids=[…])` remains reachable. Intended for users running the invited-memory adopt path or who otherwise want minimal auto-injection. **Since v2.82.0 this env no longer gates auto-adopt — use `MEM_NO_AUTO_ADOPT=1` for that.** | _(disabled)_ |
 | `CLAUDE_MEM_SESSION_EVENTS` | `1`/`on` restores the SessionStart `### Key Events` section (recent high-importance rows from the `events` table). **Off by default since v6.13.0**: an audit of 30 events read 2 accurate and 16 wrong. The UserPromptSubmit events block and PreToolUse recall are query-matched and stay on; `mem_search` still reaches every event. | _(off)_ |
+| `CLAUDE_MEM_SUMMARY_TAIL` | `0`/`off` stops Stop from using the head of the final reply (first 120 characters, code blocks and line-leading markers removed) as a session's Completed line when that reply has no Done / Not done / Failed / Uncertain section; Completed then falls back to observation titles, as before v6.18.0; a line already written gives way to the titles at the session's next turn. A later reply under 400 characters does not replace an earlier one. | _(on)_ |
 | `CLAUDE_MEM_EPISODE_INPUT_FILTER` | What the episode summarizer may learn from. A subagent's tool calls stay out of the episode buffer unless they edit a file inside the project, and mutation probes (mutate → RED run → restore) and the agent's own failing inline scripts (a patch's `anchor not found`) are dropped before a window is saved or summarized — replayed over the 30 audited events, this removes 3 of the 16 that were wrong outright; with `CLAUDE_MEM_LESSON_GROUNDING` none of the 16 lessons is injected. `off` restores the unfiltered input. | _(on)_ |
 | `CLAUDE_MEM_BASH_RECALL` | File recall before a Bash command that views (`cat`, `sed -n`, `head`…) or writes (`sed -i`, `cat > f`, a python patch…) a file, like the Read / Edit recall. A bash prefilter keeps Node from starting for other commands. `off` disables this leg only. | _(on)_ |
 | `CLAUDE_MEM_LESSON_GROUNDING` | An auto-captured event keeps its lesson only when the lesson quotes the window's own diagnosis (a failing output line, a comment the edit added, or the commit message); otherwise the row is kept without it at importance 1, below every injection face. `off` keeps unquoted lessons. | _(on)_ |

package/README.zh-CN.md

@@ -60,7 +60,7 @@
 - **Episode 批处理** -- 将相关文件操作分组为连贯的 episode，再进行 LLM 编码
 - **错误触发回忆** -- Bash 出错时自动搜索记忆，浮现相关的历史修复方案
 - **主动文件历史** -- 编辑文件时，自动显示该文件相关的历史观察记录
-- **会话摘要** -- 每次 Stop 时写入（助手最终回复带 Done / Not done 段落时取其内容，否则取首条提示和最近的 observation 标题），会话有 observation 时再由后台模型摘要升级
+- **会话摘要** -- 每次 Stop 时写入（助手最终回复带 Done / Not done 段落时取其内容，否则——最终回复里没有任何报告段落时——取其前 120 个字符，再否则取首条提示和最近的 observation 标题），会话有 observation 时再由后台模型摘要升级
 - **项目作用域上下文** -- 将最近的记忆注入 `CLAUDE.md` 和会话启动上下文
 - **观察类型** -- 分类为 `decision`、`bugfix`、`feature`、`refactor`、`discovery` 或 `change`
 - **重要度分级** -- LLM 为每条观察分配 1-3 级重要度（日常/关注/关键）
@@ -199,6 +199,30 @@ rm -rf ~/claude-mem-lite/   # v0.5 前的非隐藏目录（如未自动迁移）
     repos/               # 浅克隆的源代码仓库
 ```
 
+## 升级到 6.19.0
+
+**搜索输出有变化，没有开关。** 没有 schema 变更、不需要迁移，回退只需固定 `claude-mem-lite@6.18.0`。
+
+- **`search` / `mem_search` 用 `🤖` 标出机器写入的 observation**，`get` / `mem_get` 在标题行注明。
+  hook 采集、导入和压缩生成的行带这个标记；显式保存的和 events 不带。只要显示的行里有带标记的，
+  结果行就会解释它的含义；`search --json` 的 observation 行多一个 `auto` 字段。
+- **`mem_search` 只在摘录比标题多出信息时才显示摘录行。**
+- 修复：新的按项目存储里，单条搜索命中不再排在最后；Bash 步骤存下的描述会保留输出的结尾；
+  密钥擦除器能识别 markdown 标签后面的值，并且在构造输入下保持线性时间。
+
+## 升级到 6.18.0
+
+**一处默认行为改变，有开关。** 没有 schema 变更、不需要迁移。固定 `claude-mem-lite@6.17.1`
+后不再写新的这一行；已经写入的那一行会保留到该会话下一次有 observation 标题时被替换，6.17.1
+会把它不认识的标签当作普通文本留在该行的 `notes` 里。
+
+- **没有报告时，Last Session 也能说明上次会话是怎么结束的。** 最终回复里没有 Done / Not done /
+  Failed / Uncertain 段落时，`Completed:` 取该回复的前 120 个字符（去掉代码块和行首标记），原先这里
+  是 observation 标题，而它通常是空的；/clear 交接里标为 `<session-summary source="last-reply">`。
+  有报告或模型摘要时仍以它们为准。之后不足 400 字符的回复（如“不客气！”）不会替换之前那一条。
+  设 `CLAUDE_MEM_SUMMARY_TAIL=0` 恢复为 observation 标题，进行中的会话从下一轮起生效。
+  回复里只要被密钥擦除器检出任何内容，就不写这一行。
+
 ## 升级到 6.17.0
 
 **两处默认行为改变，其中一处有开关。** 没有 schema 变更、不需要迁移，全部回退只需固定

package/format-utils.mjs

@@ -92,7 +92,9 @@ export function queryLabel(query) {
 
 // Two delimiter classes are defanged here:
 //   1. The blocks claude-mem-lite wraps injected context in (claude-mem-context /
-//      memory-context / session-handoff). User-derived text containing one LITERALLY
+//      memory-context / session-handoff / the handoff's inner session-summary — D#129: a
+//      summary carrying `</session-summary><session-summary source="report">` closed the
+//      real block and forged its provenance). User-derived text containing one LITERALLY
 //      would prematurely open/close the block it lands in, spilling the rest as
 //      undelimited context.
 //   2. Harness-authority + tool-call tags the runtime injects (system-reminder /
@@ -113,7 +115,7 @@ export function queryLabel(query) {
 // Reachable by editing files that contain these tokens \u2014 e.g. developing claude-mem-lite
 // itself, where source/observations carry the delimiter names.
 const CONTEXT_DELIMITER_RE =
-  /<\/?(?:claude-mem-context|memory-context|session-handoff|system-reminder|task-notification|(?:antml:)?function_calls|(?:antml:)?function_results|(?:antml:)?invoke|(?:antml:)?parameter)(?:\s[^>]*)?>/gi;
+  /<\/?(?:claude-mem-context|memory-context|session-handoff|session-summary|system-reminder|task-notification|(?:antml:)?function_calls|(?:antml:)?function_results|(?:antml:)?invoke|(?:antml:)?parameter)(?:\s[^>]*)?>/gi;
 
 // Pass cap for the fixpoint loop below. 32 nested layers of a forged delimiter is far past
 // anything prose produces; the cap exists only to bound the ADVERSARIAL cost (an unbounded

package/hook-llm.mjs

@@ -991,6 +991,7 @@ export async function handleLLMEpisode() {
   // events; treating them as a separate role + boundary marker reduces the
   // attack surface for memory poisoning via crafted file content.
   const SHARED_OBS_SCHEMA_TAIL = `${MEMORY_INPUT_GUARD}
+Grounding: state only outcomes the user message shows. An action description may be cut short ("…"); if its result is not visible, say what was run, not how it turned out. Never write that something passed, failed, was verified or confirmed unless that result appears in the user message.
 type: pick by strongest signal. decision = explicit tradeoff / "chose X over Y because Z" / rejected an approach (e.g. "Rejected schema migration — single-source module + sync test instead"; "Heterogeneous hook events → heterogeneous context budgets"). bugfix = prior-failing path fixed with a named root cause. feature = new user-visible capability. refactor = behavior unchanged but structure improved. discovery = learned how a system works (read-heavy, no writes). change = routine edit with no new principle (default if unsure and nothing else fits).
 Facts: each MUST be (1) atomic—one claim, (2) self-contained—no pronouns, include file/function name, (3) specific—"refreshToken() in auth.ts:45 uses 1h TTL" not "handles tokens"
 importance: Be strict — default to 1. 0=pure browsing with zero learning value. 1=routine file edits, standard changes, normal workflow (MOST episodes). 2=notable ONLY if it reveals something non-obvious: error fix with discovered root cause, architectural decision with explicit tradeoff, config change with unexpected side effects. 3=critical: breaking change affecting users, security vulnerability fix, data migration. Ask yourself: "would a future session benefit from knowing this?" — if not, it's importance=1.

package/hook.mjs

@@ -1246,8 +1246,9 @@ function writeFastSummaryBaseline(db, { sessionId, project, transcriptPath }) {
   // Stop fires once per assistant TURN and the mem session survives it (R10-P1-1), so this
   // runs on every turn of a session. The first turn with anything to say INSERTs the row
   // (T4-P2-B's guard: never a second row); every later turn REFRESHES that row from its tail's
-  // report, or, without one, from the current observation titles where the row's Done is
-  // still titles (lib/fast-summary.mjs writeStopSummary). The guard alone used to stop there, so the
+  // report, or, without one, from the head of the final reply (D#121) or the current
+  // observation titles where the row's Done is still that grade (lib/fast-summary.mjs
+  // writeStopSummary). The guard alone used to stop there, so the
   // row kept the FIRST turn's report: over 7 days of this machine's transcripts (09:40Z), 20
   // of the 31 sessions that wrote §10 markers had a first-turn extract different from their
   // last report. Uses the mem-internal sessionId as the WHERE key per the top-of-file
@@ -1262,8 +1263,11 @@ function writeFastSummaryBaseline(db, { sessionId, project, transcriptPath }) {
     let structuredCompleted = '';
     let structuredNotDone = '';
     let structuredNotes = '';
+    // The raw final reply rides along: with no Done in it, its head is the row's Done floor
+    // (D#121, lib/fast-summary.mjs writeStopSummary).
+    let tail = null;
     try {
-      const tail = transcriptPath ? extractTailAssistantText(transcriptPath) : null;
+      tail = transcriptPath ? extractTailAssistantText(transcriptPath) : null;
       if (tail) {
         const s = extractStructuredSummary(tail);
         structuredCompleted = s.done;
@@ -1280,7 +1284,7 @@ function writeFastSummaryBaseline(db, { sessionId, project, transcriptPath }) {
     writeStopSummary(db, {
       sessionId,
       project,
-      report: { done: structuredCompleted, notDone: structuredNotDone, lines: structuredNotes },
+      report: { done: structuredCompleted, notDone: structuredNotDone, lines: structuredNotes, tail },
       source: readFastSummarySource(db, sessionId),
       now: new Date(),
       limits: FAST_SUMMARY_LIMITS.stop,
@@ -1757,8 +1761,9 @@ async function handleStop() {
   // D#95 made this opt-in in 34a65cd and was reverted before release: its premise ("Last
   // Session already comes from the Stop report") holds only when the assistant's final reply
   // carries Done / Not done sections (lib/summary-extractor.mjs). Without them the Stop row is
-  // the first prompt + recent observation titles, and this worker's model summary is the only
-  // prose summary such a user gets.
+  // the first prompt + the head of the final reply (D#121, since v6.18.0; observation titles
+  // before), and this worker's model summary is the only multi-field summary (Next / Lessons /
+  // Decisions) such a user gets — when observations exist for it to read.
   if (!process.env.CLAUDE_MEM_SKIP_SUMMARY)
     spawnBackground('llm-summary', sessionId, project, String(stopEpoch));
 

package/lib/fast-summary.mjs

@@ -20,7 +20,8 @@
 //
 // Which writer wins a field depends on where that field came from, recorded per field at
 // the head of `notes` (parseSummaryNotes): the assistant's own report beats the model's
-// summary, which beats the last observation titles.
+// summary, which beats the head of the final reply (D#121), which beats the last
+// observation titles.
 //
 // The model's write lives here too (`mergeModelSummary`): its precedence against the other
 // two writers is the point of this module, and keeping the three in one place is what lets
@@ -50,6 +51,83 @@ export const FAST_SUMMARY_LIMITS = {
   exitRestart: { request: 200, completed: 300, remaining: 200, notes: 400 },
 };
 
+/**
+ * D#121 — the final reply as a Done floor. A session whose last assistant message carries
+ * no report (in 30 headless sessions without that convention, Stop found one in none:
+ * docs/audits/20260927-d114-default-user-corpus.md) had its opening prompt and observation
+ * titles, usually empty, as Last Session. The first TAIL_FLOOR_CHARS of that message
+ * is the measured length and position (blind labels: mean 1.73 of 2, none wrong; the LAST
+ * 120 chars scored 0.03 — 29 of 30 uninformative: offers, questions, trailing detail).
+ * Longer heads were not labelled, so the floor stores exactly this much. The labelled text
+ * also had inline markup stripped; the shipped one keeps it (see replyLines).
+ */
+export const TAIL_FLOOR_CHARS = 120;
+/**
+ * A later reply shorter than this does not replace an existing tail floor. In the
+ * supplementary corpus (docs/audits/20260927-d114-default-user-corpus.md) closing replies to
+ * "thanks" / "好的，谢谢" ran 15–187 chars and task replies 801+; 400 sits near the geometric
+ * middle, about 2× clear of both. Replacing with a closing reply loses the floor; keeping an
+ * older floor over a short real answer only ages it — so the cut leans high. A short reply
+ * may still create the first floor, which beats having none.
+ */
+export const TAIL_MIN_REPLACE = 400;
+
+/** Opt-out: CLAUDE_MEM_SUMMARY_TAIL=0 restores the 6.17 titles fallback. Read per call. */
+function tailFloorEnabled() {
+  return !['0', 'off', 'false', 'no'].includes(
+    String(process.env.CLAUDE_MEM_SUMMARY_TAIL || '').toLowerCase(),
+  );
+}
+
+/**
+ * How much of the reply the floor examines. Only its head is stored, and the secret check
+ * scrubs what it examines: scrubbing a whole 200k-char reply reached two pre-existing
+ * quadratic scrub patterns and ran Stop past its 5 s timeout (v6.18.0 security review P2-1).
+ * A PEM block can be longer than that; see PEM_HEADER_RE.
+ */
+const TAIL_EXAMINE_CHARS = 8000;
+/**
+ * A PEM header anywhere in the examined head writes no floor. The scrubber matches a PEM block
+ * by its BEGIN and END lines; a key body longer than the window leaves the END outside it,
+ * and ~70 chars of key material after the header would be stored (v6.18.0 re-check P3-a).
+ */
+const PEM_HEADER_RE = /-----BEGIN [A-Z0-9 ]+-----/;
+
+/**
+ * The reply's lines with fenced code blocks turned into a space and line-leading markdown
+ * markers (#, >, list bullets, numbered items) removed — nothing inside a token is rewritten.
+ * Two review rounds found that every in-token rewrite (stripping backticks, `**`, `*`, `|`)
+ * either ate identifiers such as `*.mjs` or moved a secret out of a scrub pattern's shape.
+ * The stored floor is this text with its whitespace collapsed.
+ */
+function replyLines(text) {
+  return String(text || '')
+    .replace(/```[\s\S]*?(?:```|$)/g, ' ')
+    .split('\n')
+    .map((l) => l.replace(/^\s*(?:#{1,6}\s+|>\s?|[-*+]\s+|\d+[.)]\s+)/, ''))
+    .join('\n');
+}
+
+/**
+ * Whether the scrubber finds a secret in `text` as written OR with inline markup (`, |, *)
+ * removed. Markup can hide a secret from the scrubber — a key split by a backtick or `*`,
+ * `gh|p_…` are missed as written and caught stripped (a markup-wrapped LABEL such as
+ * `**password**=…` is caught as written since D#128) — and storing the
+ * stripped text instead would leave a split key's tail behind. The caller asks it about the
+ * exact text it stores, not the reply as written: a list or quote marker between a label and
+ * its value hid the pair from a check on the raw reply, and removing the marker for storage
+ * brought them together (security review P1-1). Both views are checked: the lines-kept one
+ * is required (without it the re-check fuzz stored 164 of 10,829 cases the raw reply scrubs,
+ * e.g. `creds\npassword: <v>\nDone`); the joined one caught nothing the first missed and is
+ * kept for a pattern that stops at a newline. Likewise the as-written arm: no current pattern
+ * needs it (mutation-checked), one with a markup character would.
+ */
+function carriesSecret(raw) {
+  const scrub = (v) => scrubRecord('session_summaries', { completed: v }).completed;
+  const stripped = raw.replace(/[`|*]/g, '');
+  return scrub(raw) !== raw || scrub(stripped) !== stripped;
+}
+
 /**
  * The two reads every fast summary is built from: the session's opening prompt, and the
  * titles of its most recent observations.
@@ -125,14 +203,15 @@ export function insertFastSummary(db, { sessionId, project, values, limits, now
 /**
  * Where a row's Done and Not done came from, stored as the head of `notes`:
  *
- *   `done<report|model|titles> left<report|other>[ <Failed / Uncertain lines>]`
+ *   `done<report|model|tail|titles> left<report|other>[ <Failed / Uncertain lines>]`
  *
- *  - done: `report` = the assistant's own Done; `model` = the LLM summary; `titles` = the last
- *    observation titles, a fallback.
+ *  - done: `report` = the assistant's own Done; `model` = the LLM summary; `tail` = the head
+ *    of the final reply when it carried no report (D#121); `titles` = the last observation
+ *    titles, a fallback.
  *  - left: `report` = the assistant's own Not done, where '' means "nothing left"; `other` =
  *    the model's inference or the handoff's unfinished list, which only fill a gap.
  *
- * Precedence per field: report > model > titles / other. It is recorded per FIELD because one
+ * Precedence per field: report > model > tail > titles / other. It is recorded per FIELD because one
  * report can carry a Not done and no Done, or only Failed lines; a single per-row tag read
  * those as a full report and froze stale titles as its Done (v6.13.5 delta review P2-1,
  * P2-2). Rows written before this carry older values: `fast` and bare Failed / Uncertain
@@ -144,7 +223,7 @@ export function insertFastSummary(db, { sessionId, project, values, limits, now
  */
 export function parseSummaryNotes(notes) {
   const text = typeof notes === 'string' ? notes : '';
-  const m = /^done(report|model|titles) left(report|other)(?: ([\s\S]*))?$/.exec(text);
+  const m = /^done(report|model|tail|titles) left(report|other)(?: ([\s\S]*))?$/.exec(text);
   if (m) return { done: m[1], left: m[2], lines: m[3] || '' };
   if (text === '' || text === 'llm') return { done: 'model', left: 'other', lines: '' };
   if (text === 'fast') return { done: 'titles', left: 'other', lines: '' };
@@ -154,13 +233,14 @@ export function parseSummaryNotes(notes) {
 /**
  * The `source` attribute the /clear handoff puts on `<session-summary>`: who wrote the row's
  * Done text — `haiku` (the model worker), `report` (the assistant's own final report,
- * extracted at Stop) or `titles` (observation titles, the fast fallback).
+ * extracted at Stop), `last-reply` (the head of the final reply, D#121) or `titles`
+ * (observation titles, the fast fallback).
  * @param {string|null|undefined} notes session_summaries.notes
- * @returns {'haiku'|'report'|'titles'}
+ * @returns {'haiku'|'report'|'last-reply'|'titles'}
  */
 export function summarySourceLabel(notes) {
   const { done } = parseSummaryNotes(notes);
-  return done === 'model' ? 'haiku' : done;
+  return done === 'model' ? 'haiku' : done === 'tail' ? 'last-reply' : done;
 }
 
 /** Inverse of parseSummaryNotes. `lines` must already be scrubbed. */
@@ -200,10 +280,15 @@ function clean(field, value, max) {
 
 /**
  * Stop's write, on every turn. `report` is this turn's tail extract ({done, notDone, lines}
- * — lines are its Failed / Uncertain lines, raw); `source` is readFastSummarySource's output.
+ * — lines are its Failed / Uncertain lines, raw — plus `tail`, the raw final reply);
+ * `source` is readFastSummarySource's output.
  * The session's first write INSERTs; every later one updates that row:
- *  - a Done in the report replaces `completed` (done = report); without one, a `titles` row
- *    takes the current titles;
+ *  - a Done in the report replaces `completed` (done = report). A reply with no report
+ *    section at all (no Done, Not done, Failed or Uncertain) and no secret gives its head,
+ *    which replaces a `titles` or empty Done, or a `tail` one when the reply is at least
+ *    TAIL_MIN_REPLACE chars as written (done = tail); with the floor switched off, a `tail`
+ *    Done gives way to the titles, empty or not. Otherwise a `titles` row takes the current
+ *    titles;
  *  - any Done or Not done makes `remaining_items` this report's Not done, '' included
  *    (left = report) — a Done with no Not done says nothing is left;
  *  - Failed / Uncertain lines replace the previous report's whenever the tail carries a
@@ -217,10 +302,26 @@ export function writeStopSummary(db, { sessionId, project, report, source, now,
   const lines = scrubRecord('session_summaries', { notes: report.lines || '' }).notes;
   const titles = clean('completed', source.completed, limits.completed);
   const hasReport = Boolean(done || notDone);
+  // The floor is taken only from a reply with no report at all: a Not done, Failed or
+  // Uncertain section alone is still a report, and its head would repeat that section as a
+  // Done (v6.18.0 pre-tag review). A reply whose examined head the scrubber finds a secret in
+  // writes no floor (carriesSecret, on the stored text); clean() scrubs again before the cut.
+  const tailOn = tailFloorEnabled();
+  const rawTail = !hasReport && !lines && tailOn ? String(report.tail || '').trim() : '';
+  const lined = rawTail ? replyLines(rawTail).slice(0, TAIL_EXAMINE_CHARS) : '';
+  const flat = lined.replace(/\s+/g, ' ').trim();
+  const safe =
+    flat && !PEM_HEADER_RE.test(lined) && !carriesSecret(lined) && !carriesSecret(flat) ? flat : '';
+  // The cut is checked as well: dropping the tail of a line can complete a shape the scrubber
+  // flags (`password=<value>(x)` → `password=<value>…`), and the stored text should be one a
+  // later re-scrub leaves alone.
+  const cut = safe ? clean('completed', safe, Math.min(TAIL_FLOOR_CHARS, limits.completed)) : '';
+  const tail = cut && !carriesSecret(cut) ? cut : '';
+  const tailReplaces = rawTail.length >= TAIL_MIN_REPLACE;
   db.transaction(() => {
     const id = newestSummaryId(db, sessionId);
     if (id === null) {
-      const completed = done || titles;
+      const completed = done || tail || titles;
       if (!(source.request || completed || notDone)) return;
       db.prepare(INSERT_SQL).run(
         sessionId,
@@ -229,7 +330,11 @@ export function writeStopSummary(db, { sessionId, project, report, source, now,
         completed,
         notDone,
         formatSummaryNotes(
-          { done: done ? 'report' : 'titles', left: hasReport ? 'report' : 'other', lines },
+          {
+            done: done ? 'report' : tail ? 'tail' : 'titles',
+            left: hasReport ? 'report' : 'other',
+            lines,
+          },
           limits.notes,
         ),
         now.toISOString(),
@@ -246,6 +351,18 @@ export function writeStopSummary(db, { sessionId, project, report, source, now,
     if (done) {
       completed = done;
       prov.done = 'report';
+    } else if (
+      tail &&
+      (prov.done === 'titles' || !nonEmpty(row.completed) || (prov.done === 'tail' && tailReplaces))
+    ) {
+      completed = tail;
+      prov.done = 'tail';
+    } else if (prov.done === 'tail' && !tailOn) {
+      // With the floor switched off, a floor written earlier gives way to the titles even
+      // when they are empty — the usual case for a user without observations — so the
+      // opt-out takes effect from the next turn.
+      completed = titles;
+      prov.done = 'titles';
     } else if (titles && (prov.done === 'titles' || !nonEmpty(row.completed))) {
       // A titles Done follows the current titles, and an EMPTY Done takes them whatever its
       // tag: a model-created row without a Done, or a legacy '' / NULL notes row (third

package/lib/provenance.mjs

@@ -0,0 +1,32 @@
+// Which writer produced an observation, read back from its memory_session_id. saveObservation
+// writes every explicit save under MANUAL_SESSION_ID_PREFIX. The hook capture (`hook-`),
+// transcript import (`import-`), compression summaries (`compress-`) and rows imported from
+// older stores (a bare session uuid) are machine-written.
+//
+// Search and get mark the machine-written side, because explicit saves are the large majority
+// of a typical store and a mark on nearly every line would carry no information. An unknown id
+// renders unmarked, as every row did before the mark existed.
+
+export const MANUAL_SESSION_ID_PREFIX = 'manual-';
+
+const AUTO_MARK = '🤖';
+const AUTO_TEXT = 'auto-written, not an explicit save';
+
+/** @param {string|null|undefined} memorySessionId */
+export function isAutoWritten(memorySessionId) {
+  return (
+    typeof memorySessionId === 'string' &&
+    memorySessionId !== '' &&
+    !memorySessionId.startsWith(MANUAL_SESSION_ID_PREFIX)
+  );
+}
+
+/** Search row tag; `auto` is set on obs rows by attachBodyTokens. */
+export const autoTag = (r) => (r.auto ? ` ${AUTO_MARK}` : '');
+
+/** Search result-line legend, shown only when a rendered row carries the tag. */
+export const autoLegend = (rows) => (rows.some((r) => r.auto) ? ` · ${AUTO_MARK} = ${AUTO_TEXT}` : '');
+
+/** Get header note for a full observation row. */
+export const autoHeaderNote = (row) =>
+  isAutoWritten(row.memory_session_id) ? ` · ${AUTO_MARK} ${AUTO_TEXT}` : '';

package/lib/save-observation.mjs

@@ -22,6 +22,7 @@ import { liveObsFilterSql } from './inject-search-core.mjs';
 // Imported, not injected: `allowStatuses` below is the POLICY this function exists to hold,
 // and a caller free to pass its own resolver could reinstate the one-way gate D#195 closed.
 import { resolveDeferredIds, closeDeferredItems } from './deferred-work.mjs';
+import { MANUAL_SESSION_ID_PREFIX } from './provenance.mjs';
 
 const DEDUP_WINDOW_MS = 5 * 60 * 1000;
 const DEDUP_RECENT_LIMIT = 50;
@@ -197,7 +198,7 @@ export function saveObservation(db, params) {
   const safeTitle = scrubSecrets(rawTitle);
   const safeLesson = rawLesson ? scrubSecrets(rawLesson) : null;
 
-  const sessionId = `manual-${project}`;
+  const sessionId = `${MANUAL_SESSION_ID_PREFIX}${project}`;
 
   // Ensure session exists (FK constraint). INSERT OR IGNORE makes this safe
   // under concurrent calls.

package/lib/search-core.mjs

@@ -409,6 +409,20 @@ const SINGLE_MATCH_BANDS = [
   [0, -0.25],
 ];
 
+// #36: the ratio above assumes the lone hit's magnitude says how well it matched. It does not
+// when FTS5 clamped the IDF: a term in at least half of a table's rows gets idf <= 0, which
+// FTS5 replaces with 1e-6, so the raw bm25 is at most 1e-6 × (k1+1 = 2.2) per phrase whatever
+// the match. A new per-project store reaches it on every query (2 observations, term in 1:
+// idf = ln(1.5/1.5) = 0). Such a lone row is scored the way a multi-row source's best already
+// is (-1): of two clamped rows the better was normalized to -1; a single one was sunk to -0.25.
+// The test reads the RAW bm25 on the obs leg (rawScore): FULL_SCORE's multipliers go down to
+// 0.5 × 0.5 × 0.2 × 0.4 = 0.02, so a demoted row with an informative IDF (0.18) scored 1.35e-4
+// and was lifted from last to first when the final score was tested (v6.19.0 pre-tag review
+// P3-3). Session and event multipliers are >= 1 and prompts carry raw bm25, so their final
+// score is tested. An obs row without rawScore keeps the bands. A near-zero IDF that FTS5 did not
+// clamp (a term in very nearly half the rows) can land below the scale too, and says as little.
+const CLAMPED_IDF_SCALE = 1e-4;
+
 /**
  * Normalize each source's BM25 scores to [-1, 0] before cross-source merge.
  * Prevents observations (BM25 can reach -40) from systematically outranking
@@ -437,6 +451,11 @@ export function normalizeCrossSourceScores(results, sourceKey) {
     );
     if (srcResults.length === 0) continue;
     if (srcResults.length === 1) {
+      const magnitude = src === 'obs' ? srcResults[0].rawScore : srcResults[0].score;
+      if (typeof magnitude === 'number' && Math.abs(magnitude) < CLAMPED_IDF_SCALE) {
+        srcResults[0].score = -1;
+        continue;
+      }
       const ratio = globalMaxAbs > 0 ? Math.abs(srcResults[0].score) / globalMaxAbs : 0;
       srcResults[0].score = SINGLE_MATCH_BANDS.find(([floor]) => ratio >= floor)[1];
       continue;

package/mem-cli.mjs

@@ -25,6 +25,7 @@ import { resolveProject } from './project-utils.mjs';
 import { resolveCliProject as cliProject } from './lib/cli-project.mjs';
 import { reRankWithContext } from './search-scoring.mjs';
 import { searchObservationsHybrid } from './search-engine.mjs';
+import { autoHeaderNote, autoLegend, autoTag } from './lib/provenance.mjs';
 import {
   fetchObsDetail,
   fetchPromptDetail,
@@ -565,6 +566,8 @@ async function cmdSearch(db, args, { llm } = {}) {
         importance: r.importance ?? null,
         files_modified: r.files_modified || null,
         body_tokens: r.bodyTokens ?? null,
+        // Events carry no session id, so only observations can say who wrote them.
+        ...(r.source === 'obs' ? { auto: r.auto === true } : {}),
       };
     });
     out(
@@ -588,7 +591,7 @@ async function cmdSearch(db, args, { llm } = {}) {
   // Pluralize on total — "Found 1 of 44 result" reads wrong; the population (44) drives
   // grammatical number, not the page slice (1).
   out(
-    `[mem] Found ${countLabel} result${total !== 1 ? 's' : ''} for "${queryLabel(query)}"${fallbackHint}:${hasMixed ? ' (# observation, S# session, P# prompt, E# event)' : ''}`,
+    `[mem] Found ${countLabel} result${total !== 1 ? 's' : ''} for "${queryLabel(query)}"${fallbackHint}:${hasMixed ? ' (# observation, S# session, P# prompt, E# event)' : ''}${autoLegend(paged)}`,
   );
   // `~Nt` = est. tokens to fetch this row's full body via mem_get (attachBodyTokens, paired with
   // MCP). Conditional so a row that skipped enrichment renders cleanly, not "~undefinedt".
@@ -614,7 +617,7 @@ async function cmdSearch(db, args, { llm } = {}) {
     } else {
       const date = fmtDateShort(r.created_at);
       const title = truncate(r.title || r.subtitle || '(untitled)', 80);
-      out(`#${r.id} ${typeIcon(r.type)} ${date}${timeStr} ${title}${tok(r)}`);
+      out(`#${r.id} ${typeIcon(r.type)}${autoTag(r)} ${date}${timeStr} ${title}${tok(r)}`);
       if (r.lesson_learned) {
         out(`  -> ${truncate(r.lesson_learned, 80)}`);
       }
@@ -793,7 +796,7 @@ function renderObsRows(db, ids, requestedFields) {
   const fields = requestedFields || OBS_FIELDS;
   const parts = [];
   for (const r of rows) {
-    const lines = [`#${r.id} [${r.type}] ${fmtDateShort(r.created_at)}`];
+    const lines = [`#${r.id} [${r.type}] ${fmtDateShort(r.created_at)}${autoHeaderNote(r)}`];
     // Retraction first (shared with mem_get via get-core) — see supersededNotice.
     const retracted = supersededNotice(r);
     if (retracted) lines.push(retracted);

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.17.1",
+  "version": "6.19.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "claude-mem-lite",
-      "version": "6.17.1",
+      "version": "6.19.0",
       "os": [
         "darwin",
         "linux",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.17.1",
+  "version": "6.19.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",
@@ -82,6 +82,7 @@
     "lib/stats-quality.mjs",
     "lib/low-signal-patterns.mjs",
     "lib/private-strip.mjs",
+    "lib/provenance.mjs",
     "lib/citation-tracker.mjs",
     "lib/edge-attribution.mjs",
     "lib/file-edge-match.mjs",

package/search-engine.mjs

@@ -21,6 +21,7 @@ import {
 import { citeFactorClause } from './scoring-sql.mjs';
 import { extractPRFTerms, expandQueryByConcepts } from './search-scoring.mjs';
 import { liveObsFilterSql, recencyDecaySql } from './lib/inject-search-core.mjs';
+import { isAutoWritten } from './lib/provenance.mjs';
 
 // Scoring expressions — full adds project boost + access bonus; simple is for
 // expansion paths where boost would over-amplify already-loose matches.
@@ -69,7 +70,8 @@ export function buildObsFtsQuery(scoring, { multiplier, withSnippet, withOffset,
     SELECT o.id, o.type, o.title, o.subtitle, o.project, o.created_at, o.created_at_epoch, o.importance,
            o.files_modified, o.lesson_learned,
            ${withSnippet ? "snippet(observations_fts, 2, '»', '«', '…', 10) as match_snippet," : ''}
-           ${scoreExpr}${mult} as score
+           ${scoreExpr}${mult} as score,
+           ${OBS_BM25} as raw_bm25
     FROM observations_fts
     JOIN observations o ON observations_fts.rowid = o.id
     WHERE observations_fts MATCH ?
@@ -330,6 +332,19 @@ export function countSearchTotal(
   return total;
 }
 
+/**
+ * True when an FTS excerpt says something the title does not. snippet() wraps matches in »« and
+ * cuts with …, and a save's title is the start of its narrative, so an excerpt that is only a
+ * piece of the title repeats it once markers and ellipses are stripped.
+ * @param {string|null|undefined} snippet
+ * @param {string|null|undefined} title
+ */
+export function snippetAddsInfo(snippet, title) {
+  if (typeof snippet !== 'string' || snippet.length <= 10) return false;
+  const bare = snippet.replace(/[»«]/g, '').replace(/^…|…$/g, '').trim();
+  return !(title || '').includes(bare);
+}
+
 export function ftsRowToResult(r, { scoreMultiplier, snippet } = {}) {
   return {
     source: 'obs',
@@ -346,6 +361,9 @@ export function ftsRowToResult(r, { scoreMultiplier, snippet } = {}) {
     created_at: r.created_at,
     created_at_epoch: r.created_at_epoch,
     score: scoreMultiplier ? r.score * scoreMultiplier : r.score,
+    // bm25 before FULL_SCORE's multipliers, which can shrink it 50x: only this can say whether
+    // FTS5 clamped the IDF (normalizeCrossSourceScores, CLAMPED_IDF_SCALE).
+    rawScore: r.raw_bm25,
     files_modified: r.files_modified,
     importance: r.importance,
     lesson_learned: r.lesson_learned,
@@ -362,7 +380,8 @@ export function ftsRowToResult(r, { scoreMultiplier, snippet } = {}) {
 // heavy obs fields are batch-fetched by id HERE rather than carried on every result. The source
 // key is read as `source || _source` because the two render paths disagree (#8654): MCP sets
 // `source`+`text`, CLI sets `_source`+`prompt_text`. estimateTokens floors at 1, so a missing row
-// or empty body yields 1 — never 0/NaN.
+// or empty body yields 1 — never 0/NaN. The same by-id read sets `auto` (lib/provenance.mjs) on
+// the rendered page only, so no result producer has to carry memory_session_id.
 export function attachBodyTokens(db, results) {
   if (!Array.isArray(results) || results.length === 0) return results;
   const obsIds = results
@@ -373,7 +392,7 @@ export function attachBodyTokens(db, results) {
     try {
       const ph = obsIds.map(() => '?').join(',');
       const rows = db
-        .prepare(`SELECT id, narrative, facts, text FROM observations WHERE id IN (${ph})`)
+        .prepare(`SELECT id, narrative, facts, text, memory_session_id FROM observations WHERE id IN (${ph})`)
         .all(...obsIds);
       for (const row of rows) bodyById.set(row.id, row);
     } catch (e) {
@@ -385,6 +404,7 @@ export function attachBodyTokens(db, results) {
     let parts;
     if (src === 'obs') {
       const row = bodyById.get(r.id) || {};
+      r.auto = isAutoWritten(row.memory_session_id);
       parts = [r.title, r.subtitle, r.lesson_learned, row.narrative, row.facts, row.text];
     } else if (src === 'session') {
       parts = [r.request, r.completed, r.working_on];

package/secret-scrub.mjs

@@ -28,9 +28,41 @@ export const SECRET_PATTERNS = [
   // keyword. Allowing a leading `_` catches those while the prose lookbehind still
   // excludes "Marker token: …". `secret` added so a bare SECRET=… with a mixed-alnum
   // value is covered (the hex-only assignment pattern below misses non-hex values).
+  //
+  // MARKDOWN AROUND A LABEL (D#128). `- **Password**: \`<v>\`` put `**` between the noun and
+  // its separator, so no label pattern matched and the value was stored. Models write labels
+  // that way all the time. So a label may carry up to three markup characters after the noun
+  // (`[*_~\`]`), and up to two of `*_~` between the separator and the value
+  // (`**Password:** <v>`). Three rules keep this from widening what counts as a value:
+  //   - no backtick after the separator: `` `password:` <next word> `` names the label and
+  //     then goes on in prose, and the next word (or a CJK run with no spaces) was scrubbed;
+  //   - at most two characters there, so the scrubber's own `***` is never taken for markup
+  //     (`password=*** token=abc` would scrub `token=abc` on the second pass);
+  //   - the prose check looks through emphasis (`the **password**: …` is prose) but not a
+  //     backtick, since `` word `token: <v>` `` is code, not prose. A label wrapped in code
+  //     (`` `GH_TOKEN`: <v> ``) has its own branch, whose prose check looks past the opening
+  //     backtick. That branch starts with a cheap lookahead: without it the 40-char lookbehind
+  //     ran at every position, and a 500k-char input went from 407 ms to 3,387 ms.
+  // Measured 2026-09-27 over 831,328 unique lines (this repo's tracked text plus local
+  // transcripts: prompts, replies, tool output), old and new run back to back: 28 lines
+  // differ. All the catches are fixtures quoted from the D#128 audit; the rest are
+  // `- **token**:assistant …` and `` `PGPASSWORD`=PG+password ``, which the same text with
+  // no markup scrubs too, plus a JSON-escaped `\n` taken as a value. Idempotence failures: 0
+  // and 0. A 13,770-case ground-truth fuzz (labels × 8 wrappings × separators × values ×
+  // positions): leaks 12,580 → 421, none newly opened. All 421 are `<word> token|secret|bearer:`
+  // in prose, left open by design (below).
+  //
+  // ACCEPTED GAPS (D#131). This scrubber stops ACCIDENTAL persistence; an author who wants a
+  // secret stored can always encode it. So shapes only an adversary writes stay open:
+  // zero-width characters inside a label, fullwidth letters. Shapes that occur naturally but
+  // cannot be told from prose stay open too: `password is <v>` and `<word> token: <v>` (the
+  // guard below). A pattern that caught them would also rewrite ordinary sentences, and
+  // v3.61.0 already had to undo exactly that. `| password | <v> |` table rows stay open for a
+  // different reason: those 831k lines held 1 such row and none with a credential-shaped
+  // value, so a table pattern's false-positive rate cannot be measured here.
   //   1a. `=` assignment → ALWAYS scrub (config syntax, never prose):
   [
-    /((?:\b|_)(?:password|passwd|passphrase|token|bearer|secret)\s*=\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi,
+    /((?:\b|_)(?:password|passwd|passphrase|token|bearer|secret)(?:[*_~`]{1,3})?\s*=(?:[*_~]{1,2}(?=\s))?\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi,
     '$1***',
   ],
   //   1b. `:` separator, PASSWORD nouns. Position decides how permissive the value
@@ -71,16 +103,16 @@ export const SECRET_PATTERNS = [
   //       Both arms emit `***` (3 chars, under the {6,} floor), so they cannot
   //       double-apply.
   [
-    /((?<![A-Za-z][ \t])(?:\b|_)(?:password|passwd|passphrase)\s*:\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi,
+    /((?:(?<![A-Za-z][ \t][*_~]{0,3})(?:\b|_)(?:password|passwd|passphrase)(?:[*_~]{1,3})?|(?=_?(?:password|passwd|passphrase)`)(?<![A-Za-z][ \t]`[\w-]{0,40})(?<=`[\w-]{0,40})(?:\b|_)(?:password|passwd|passphrase)`)\s*[:：](?:[*_~]{1,2}(?=\s))?\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi,
     '$1***',
   ],
   [
-    /((?:\b|_)(?:password|passwd|passphrase)\s*:\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)(?![A-Za-z]{1,15}(?=[\s,;'"}\]]|$))[^\s,;'"}\]]{6,}/gi,
+    /((?:\b|_)(?:password|passwd|passphrase)(?:[*_~`]{1,3})?\s*[:：](?:[*_~]{1,2}(?=\s))?\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)(?![A-Za-z]{1,15}(?=[`*~]*(?:[\s,;'"}\]]|$)))[^\s,;'"}\]]{6,}/gi,
     '$1***',
   ],
   //   1c. `:` separator, prose-ambiguous nouns → keep the lookbehind ("the token: alicebob"):
   [
-    /((?<![A-Za-z][ \t])(?:\b|_)(?:token|bearer|secret)\s*:\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi,
+    /((?:(?<![A-Za-z][ \t][*_~]{0,3})(?:\b|_)(?:token|bearer|secret)(?:[*_~]{1,3})?|(?=_?(?:token|bearer|secret)`)(?<![A-Za-z][ \t]`[\w-]{0,40})(?<=`[\w-]{0,40})(?:\b|_)(?:token|bearer|secret)`)\s*[:：](?:[*_~]{1,2}(?=\s))?\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi,
     '$1***',
   ],
   // access_token / refresh_token are the canonical OAuth2 field names — they were
@@ -95,7 +127,7 @@ export const SECRET_PATTERNS = [
   // low-FP decision that `topsecret=` / `access_token_count:` are non-credentials
   // (#8283 + utils.test.mjs:1089-1100); bare `pwd` is omitted so `PWD=` (a path) survives.
   [
-    /((?:\b|_)(?:api[_-]?key|api[_-]?secret|secret[_-]?key|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|access[_-]?token|refresh[_-]?token|pgpassword|pgpass|mysql_pwd)\s*[=:]\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi,
+    /((?:\b|_)(?:api[_-]?key|api[_-]?secret|secret[_-]?key|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|access[_-]?token|refresh[_-]?token|pgpassword|pgpass|mysql_pwd)(?:[*_~`]{1,3})?\s*[=:：](?:[*_~]{1,2}(?=\s))?\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi,
     '$1***',
   ],
   // Space-separated credential CLI flag: `--password <value>` (long-form). The KV
@@ -118,19 +150,28 @@ export const SECRET_PATTERNS = [
   //   (a) bare credential nouns: `=` always scrubs; `:` keeps the prose lookbehind
   //       (mirrors the unquoted 1a/1b split — a quoted value doesn't turn `:` prose
   //       into config, but `<word> password="x"` is still a leak):
-  [/((?:\b|_)(?:password|passwd|passphrase|token|bearer|secret)\s*=\s*)(['"])[^'"]{6,}\2/gi, '$1$2***$2'],
-  [/((?:\b|_)(?:password|passwd|passphrase)\s*:\s*)(['"])[^'"]{6,}\2/gi, '$1$2***$2'],
-  [/((?<![A-Za-z][ \t])(?:\b|_)(?:token|bearer|secret)\s*:\s*)(['"])[^'"]{6,}\2/gi, '$1$2***$2'],
+  [
+    /((?:\b|_)(?:password|passwd|passphrase|token|bearer|secret)(?:[*_~`]{1,3})?\s*=(?:[*_~]{1,2}(?=\s))?\s*)(['"])[^'"]{6,}\2/gi,
+    '$1$2***$2',
+  ],
+  [
+    /((?:\b|_)(?:password|passwd|passphrase)(?:[*_~`]{1,3})?\s*[:：](?:[*_~]{1,2}(?=\s))?\s*)(['"])[^'"]{6,}\2/gi,
+    '$1$2***$2',
+  ],
+  [
+    /((?:(?<![A-Za-z][ \t][*_~]{0,3})(?:\b|_)(?:token|bearer|secret)(?:[*_~]{1,3})?|(?=_?(?:token|bearer|secret)`)(?<![A-Za-z][ \t]`[\w-]{0,40})(?<=`[\w-]{0,40})(?:\b|_)(?:token|bearer|secret)`)\s*[:：](?:[*_~]{1,2}(?=\s))?\s*)(['"])[^'"]{6,}\2/gi,
+    '$1$2***$2',
+  ],
   //   (b) structured keys + named env vars are unambiguous config even after a word
   //       (`see api_key: "x"` DOES scrub, mirroring the unquoted structured-key path):
   [
-    /((?:\b|_)(?:pgpassword|pgpass|mysql_pwd|api[_-]?key|api[_-]?secret|secret[_-]?key|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|access[_-]?token|refresh[_-]?token)\s*[=:]\s*)(['"])[^'"]{6,}\2/gi,
+    /((?:\b|_)(?:pgpassword|pgpass|mysql_pwd|api[_-]?key|api[_-]?secret|secret[_-]?key|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|access[_-]?token|refresh[_-]?token)(?:[*_~`]{1,3})?\s*[=:：](?:[*_~]{1,2}(?=\s))?\s*)(['"])[^'"]{6,}\2/gi,
     '$1$2***$2',
   ],
   // AWS access keys: AKIA (long-term) + ASIA (STS temp) + AROA (role) + AIDA
   // (user) + ANPA/ANVA/AGPA (other principal types). All share the 4-letter
   // prefix + exactly 16 base32 chars shape — specific enough for near-zero FP.
-  [/\b(?:AKIA|ASIA|AROA|AIDA|ANPA|ANVA|AGPA)[A-Z0-9]{16}\b/g, '***'],
+  [/\b(?:AKIA|ASIA|AROA|AIDA|ANPA|ANVA|AGPA)[A-Z0-9]{16}(?![A-Za-z0-9])/g, '***'],
   // OpenAI / Anthropic keys (sk-...) — specific prefixes have lower length threshold
   [/\bsk-(?:proj|ant|ant-api\d{2})-[a-zA-Z0-9_-]{8,}\b/g, '***'],
   [/\bsk-[a-zA-Z0-9_-]{20,}\b/g, '***'],
@@ -143,13 +184,30 @@ export const SECRET_PATTERNS = [
   [/\b(?:xox[bpasr]|xapp|xoxe)-[a-zA-Z0-9-]{10,}\b/g, '***'],
   // Slack incoming-webhook URL — the path after /services/ is the shared secret.
   [/(https:\/\/hooks\.slack\.com\/services\/)[A-Za-z0-9/]+/g, '$1***'],
-  // JWT tokens (eyJ...eyJ...)
-  [/\beyJ[a-zA-Z0-9_-]{10,}\.eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]+\b/g, '***'],
+  // JWT tokens (eyJ...eyJ...). A JWT begins its own token, so the start is `(?<![\w-])`, not
+  // `\b`: `-` is a base64url character, and `\b` let every `-eyJ` inside one dotless run be a
+  // fresh start that rescans the run to its end — quadratic, 9.6 s on 200k chars of `eyJ-`
+  // (D#130). A `-eyJ` start is the middle of a run, never a JWT's first character.
+  // A JWT glued by a hyphen to up to 40 characters of hyphenated words (`my-sess-eyJ…`,
+  // `X-Auth-Token-eyJ…`) is a start too. `\b` allowed any length; past 40 characters it is missed. The lookbehind needs a token
+  // boundary within those 41 characters, so a hyphen run has at most ~10 starts, not one per
+  // `-eyJ` (v6.19.0 pre-tag reviews P3-2, delta P3-1).
+  [
+    /(?:(?<![\w-])|(?<=(?:^|[^\w-])[\w-]{1,40}-))eyJ[a-zA-Z0-9_-]{10,}\.eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]+\b/g,
+    '***',
+  ],
   // PEM private key blocks. `[A-Z0-9 ]*` covers every armor label — RSA/EC/DSA/
   // OPENSSH plus ENCRYPTED and PGP (… PRIVATE KEY BLOCK) — that the fixed
   // alternation missed; the block delimiters make FP impossible.
+  // The body stops at the next `-----BEGIN ` (D#130): with `[\s\S]*?` every header with no END
+  // scanned to the end of the text, on each of scrubSecrets' passes — quadratic, 8.3 s on 500k
+  // chars. A block whose END is missing ends where the next private-key BEGIN starts, so a cut-off
+  // key's body is scrubbed too (v6.19.0 pre-tag review P2-1: requiring the END there stored that
+  // body); any other BEGIN (a certificate) does not end it, so a bare header in prose does not
+  // erase the text up to one (delta review P3-2). A header with no END and no later key header
+  // is left as it was in v6.18.0.
   [
-    /-----BEGIN [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----/g,
+    /-----BEGIN [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----(?:(?!-----BEGIN [A-Z0-9 ]*PRIVATE KEY)[\s\S])*?(?:-----END [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----|(?=-----BEGIN [A-Z0-9 ]*PRIVATE KEY))/g,
     '***PEM_KEY***',
   ],
   // Long hex strings in credential assignments (e.g. SECRET_KEY=abc123def456...).
@@ -160,7 +218,10 @@ export const SECRET_PATTERNS = [
   [/\bAIza[A-Za-z0-9_-]{35}\b/g, '***'],
   // Authorization header credentials — Bearer (opaque), Basic (base64 user:pass),
   // and GitHub's `token` scheme all carry secrets after the scheme word.
-  [/(Authorization:\s*(?:Bearer|Basic|token)\s+)[^\s,;'"}\]]+/gi, '$1***'],
+  [
+    /(Authorization(?:[*_~`]{1,3})?[:：](?:[*_~]{1,2}(?=\s))?\s*(?:Bearer|Basic|token)\s+)[^\s,;'"}\]]+/gi,
+    '$1***',
+  ],
   // R10 P1-6: the same header as a QUOTED KEY — `{"Authorization":"Bearer …"}`. The
   // pattern above needs `Authorization:` literally, and in JSON a quote sits between the
   // name and the colon, so a `curl -v` / fetch header dump walked straight through. The
@@ -194,10 +255,10 @@ export const SECRET_PATTERNS = [
     '$1$2://***',
   ],
   // npm tokens (npm_...)
-  [/\bnpm_[a-zA-Z0-9]{36,}\b/g, '***'],
+  [/\bnpm_[a-zA-Z0-9]{36,}(?![A-Za-z0-9])/g, '***'],
   // Stripe keys (sk_live_, rk_live_, pk_live_, sk_test_, pk_test_) + webhook signing secret (whsec_)
-  [/\b[srp]k_(?:live|test)_[a-zA-Z0-9]{20,}\b/g, '***'],
-  [/\bwhsec_[a-zA-Z0-9]{20,}\b/g, '***'],
+  [/\b[srp]k_(?:live|test)_[a-zA-Z0-9]{20,}(?![A-Za-z0-9])/g, '***'],
+  [/\bwhsec_[a-zA-Z0-9]{20,}(?![A-Za-z0-9])/g, '***'],
   // SendGrid API keys: SG.<22>.<43> — two dots at fixed offsets make this
   // structurally unmistakable; near-zero false-positive risk.
   [/\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b/g, '***'],
@@ -224,8 +285,11 @@ export const SECRET_PATTERNS = [
   // (password|secret|api_key|auth_token|access_token|private_key) so a benign
   // `"token_count"` value (numeric, <6 non-quote chars after scrub) and prose
   // keys stay low-FP; over-scrub is the safe direction for at-rest memory.
+  // `\w{0,64}`, not `\w*`, on both sides of the noun here and in the next pattern (D#130): from
+  // one quote, `\w*` ran to the end of a word run and backtracked through every keyword in it,
+  // each rescanning the run — `"` + `secret` x 33k took 4.6 s. 64 is far past any key name.
   [
-    /("\w*(?:password|passwd|secret|api[_-]?key|auth[_-]?token|access[_-]?token|private[_-]?key)\w*"\s*:\s*")[^"]{6,}(")/gi,
+    /("\w{0,64}(?:password|passwd|secret|api[_-]?key|auth[_-]?token|access[_-]?token|private[_-]?key)\w{0,64}"\s*:\s*")[^"]{6,}(")/gi,
     '$1***$2',
   ],
   // Quoted-KEY credential values — Python dict reprs `{'api_key': '...'}`, single-quoted
@@ -241,7 +305,7 @@ export const SECRET_PATTERNS = [
   // `'token_count': 123456`); `passphrase` added here too (double-quoted JSON passphrase is
   // subsumed by this pattern since `['"]` matches `"`). Over-scrub is the safe direction.
   [
-    /(['"]\w*(?:password|passwd|passphrase|secret|api[_-]?key|auth[_-]?token|access[_-]?token|private[_-]?key)\w*['"]\s*:\s*)(['"])[^'"]{6,}\2/gi,
+    /(['"](?:\w{0,64}(?:password|passwd|passphrase|secret|api[_-]?key|auth[_-]?token|access[_-]?token|private[_-]?key)\w{0,64}|\w{1,64}_token)['"]\s*:\s*)(['"])[^'"]{6,}\2/gi,
     '$1$2***$2',
   ],
   // Session cookies in headers / urlencoded bodies (sessionid=, session_id=, JSESSIONID=, PHPSESSID=).

package/server.mjs

@@ -17,7 +17,8 @@ import {
   formatSchemaSkewNotice,
 } from './lib/schema-skew.mjs';
 import { reRankWithContext, runIdleCleanup, buildServerInstructions } from './search-scoring.mjs';
-import { searchObservationsHybrid } from './search-engine.mjs';
+import { searchObservationsHybrid, snippetAddsInfo } from './search-engine.mjs';
+import { autoHeaderNote, autoLegend, autoTag } from './lib/provenance.mjs';
 import {
   deepSearch,
   resolveDeepMode,
@@ -461,7 +462,7 @@ function formatSearchOutput(
   // explicitly requested OR semantics — there's no "fallback" in that path.
   const fallbackHint = orFallbackFired && !args.or ? ' (relaxed AND→OR)' : '';
   lines.push(
-    `Found ${countLabel} result(s)${qLabel}${fallbackHint}:${hasMixed ? ' (# observation, S# session, P# prompt, E# event)' : ''}\n`,
+    `Found ${countLabel} result(s)${qLabel}${fallbackHint}:${hasMixed ? ' (# observation, S# session, P# prompt, E# event)' : ''}${autoLegend(paginatedResults)}\n`,
   );
 
   // `~Nt` = estimated tokens to fetch this row's full body via mem_get (attachBodyTokens).
@@ -470,9 +471,9 @@ function formatSearchOutput(
   for (const r of paginatedResults) {
     if (r.source === 'obs') {
       lines.push(
-        `#${r.id} ${typeIcon(r.type)} [${r.type}] ${truncate(r.title || r.subtitle || '(untitled)')} | ${r.project} | ${fmtDate(r.date)}${tok(r)}`,
+        `#${r.id} ${typeIcon(r.type)} [${r.type}]${autoTag(r)} ${truncate(r.title || r.subtitle || '(untitled)')} | ${r.project} | ${fmtDate(r.date)}${tok(r)}`,
       );
-      if (r.snippet && r.snippet.length > 10 && r.snippet !== r.title) {
+      if (snippetAddsInfo(r.snippet, r.title)) {
         lines.push(`     ${truncate(r.snippet, 100)}`);
       }
     } else if (r.source === 'session') {
@@ -900,7 +901,7 @@ server.registerTool(
       const renderFields = obsFieldFilter || OBS_FIELDS;
       for (const row of rows) {
         foundBySource.obs.add(row.id);
-        const lines = [`── #${row.id} ──`];
+        const lines = [`── #${row.id}${autoHeaderNote(row)} ──`];
         // Retraction first (shared with the CLI `get` via get-core) — see supersededNotice.
         const retracted = supersededNotice(row);
         if (retracted) lines.push(retracted);

package/source-files.mjs

@@ -81,6 +81,8 @@ export const SOURCE_FILES = [
   'lib/stats-quality.mjs',
   'lib/low-signal-patterns.mjs',
   'lib/private-strip.mjs',
+  // Which writer produced an observation (explicit save vs machine-written); search + get marks.
+  'lib/provenance.mjs',
   'lib/citation-tracker.mjs',
   // v3.47 (D#78 P1): per-(obs,file) edge attribution. Imported by hook.mjs
   // (handleStop edge resolution). Missing from manifest → tarball hook.mjs

package/utils.mjs

@@ -56,7 +56,8 @@ export {
 } from './bash-utils.mjs';
 
 // Internal imports for functions that remain in this module
-import { truncate } from './format-utils.mjs';
+import { normalizeInline, truncate } from './format-utils.mjs';
+import { stripPrivate } from './lib/private-strip.mjs';
 import { stripTestSuffix } from './bash-utils.mjs';
 // Static, and deliberately the dependency-free resolver (node:os + node:path only) —
 // debugCatch's sampler must not pull in the DB layer. See its comment below.
@@ -282,9 +283,56 @@ export function isRelatedToEpisode(episode, newFiles) {
 // magnitude above the longest cut here, so a secret that begins before the cut is still
 // seen whole by the patterns, at bounded cost.
 const DESC_SCRUB_WINDOW = 4096;
+
+// Every field is cut strictly around private spans: closed `<private>` spans are redacted across
+// the WHOLE input first (one linear pass; hook input is capped at 256 KiB), then the window stops
+// before the first remaining `<private>` or private-key BEGIN, so no field shows a span whose end
+// is out of view. Before v6.19.0 an unclosed opener in the window (a Grep line
+// `notes.md:3:<private>bank pin 4412`) was shown as written (v6.19.0 pre-tag reviews P3-1, r3 P2-1).
+// The PEM half is case-sensitive, like the scrubber's PEM pattern.
+const PRIVATE_OPENER_RE = /<[Pp][Rr][Ii][Vv][Aa][Tt][Ee]>|-----BEGIN [A-Z0-9 ]*PRIVATE KEY/;
 function scrubTruncate(str, max) {
   if (typeof str !== 'string' || str === '') return truncate(str, max);
-  return truncate(_scrubSecrets(str.slice(0, DESC_SCRUB_WINDOW)), max);
+  let win = stripPrivate(str).slice(0, DESC_SCRUB_WINDOW);
+  const at = win.search(PRIVATE_OPENER_RE);
+  if (at >= 0) win = win.slice(0, at);
+  // The window edge can split a surrogate pair; truncate only guards a cut it makes itself.
+  if (/[\uD800-\uDBFF]$/.test(win)) win = win.slice(0, -1);
+  return truncate(_scrubSecrets(win), max);
+}
+
+// Head+tail cut for command output. A check usually prints its verdict last ("...parsed: 0",
+// "3 passed"); a head-only cut hands the episode summarizer an unresolved-looking fragment,
+// and it has written a bugfix narrative for a check that passed. The tail comes from its own
+// scrub window at the END of the original string: taking it from the head window would drop
+// the verdict of any output longer than DESC_SCRUB_WINDOW.
+//
+// Output with a private span anywhere in it (a `<private>` tag or a PEM private-key marker) shows
+// no tail, only v6.18.0's 60-character head (cut as above). The tail is scrubbed in its own
+// window, which cannot see a span that crosses its edge, and pairing the markers per window
+// stored span text two ways in the v6.19.0 pre-tag review (a cut inside a closed `<private>`, a
+// key with no END more than 4096 characters back).
+const PRIVATE_TAG_HINT_RE = /<\/?private>/i;
+const HEAD_ONLY_MAX = 60;
+// The early return needs the WHOLE output inside the head window: a long output whose first
+// 4096 characters collapse to a few (whitespace) still has a tail to show (v6.19.0 pre-tag
+// claims review F2).
+function scrubTruncateEnds(str, max) {
+  if (typeof str === 'string' && (str.includes('PRIVATE KEY') || PRIVATE_TAG_HINT_RE.test(str))) {
+    return scrubTruncate(str, HEAD_ONLY_MAX);
+  }
+  const flat = scrubTruncate(str, DESC_SCRUB_WINDOW);
+  const whole = typeof str !== 'string' || str.length <= DESC_SCRUB_WINDOW;
+  if (whole && flat.length <= max) return flat;
+  const tailLen = Math.floor(max / 2) - 1;
+  const tailSrc = whole ? flat : normalizeInline(_scrubSecrets(str.slice(-DESC_SCRUB_WINDOW)));
+  // Drop a lone low surrogate the tail's cut may start on.
+  const tail = tailSrc.slice(-tailLen).replace(/^[\uDC00-\uDFFF]/, '');
+  // A head short enough to escape truncate's own "…" still gets one before the tail.
+  const budget = max - tailLen;
+  let head = truncate(flat, budget);
+  if (!head.endsWith('…')) head = head.length < budget ? `${head}…` : truncate(flat, budget - 1);
+  return head + tail;
 }
 
 export function makeEntryDesc(toolName, input, resp, opts) {
@@ -302,7 +350,7 @@ export function makeEntryDesc(toolName, input, resp, opts) {
       const isErr =
         opts?.isError ??
         (/\berror\b|\bfail(ed|ure)?\b|\bexception\b|\bpanic\b/i.test(resp) && resp.length > 30);
-      const snippet = scrubTruncate(resp, 60);
+      const snippet = scrubTruncateEnds(resp, 100);
       return isErr ? `${cmd} → ERROR: ${snippet}` : `${cmd} → ${snippet}`;
     }
     case 'Grep':