claude-mem-lite 6.18.0 → 6.19.1

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "6.18.0",
+      "version": "6.19.1",
       "source": "./",
       "homepage": "https://github.com/sdsrss/claude-mem-lite",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.18.0",
+  "version": "6.19.1",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/README.md

@@ -237,6 +237,20 @@ rm -rf ~/claude-mem-lite/   # pre-v0.5 unhidden (if not auto-moved)
     repos/               # Shallow-cloned source repos
 ```
 
+## Upgrading to 6.19.0
+
+**Search output changes; no switch.** No schema change and no migration, so reverting is
+pinning `claude-mem-lite@6.18.0`.
+
+- **`search` / `mem_search` mark machine-written observations with `🤖`**, and `get` /
+  `mem_get` name them in the header. Hook-captured, imported and compressed rows carry it;
+  explicit saves and events do not. The result line explains the mark whenever a shown row
+  has it, and `search --json` adds `auto` to observation rows.
+- **`mem_search` shows a snippet line only when it adds to the title.**
+- Fixes: a lone search match in a new per-project store no longer sorts last; a Bash
+  step's stored description keeps the end of its output; the secret scrubber catches values
+  behind markdown labels and stays linear-time on crafted input.
+
 ## Upgrading to 6.18.0
 
 **One default changes, with a switch.** No schema change and no migration. Pinning

package/README.zh-CN.md

@@ -199,6 +199,17 @@ rm -rf ~/claude-mem-lite/   # v0.5 前的非隐藏目录（如未自动迁移）
     repos/               # 浅克隆的源代码仓库
 ```
 
+## 升级到 6.19.0
+
+**搜索输出有变化，没有开关。** 没有 schema 变更、不需要迁移，回退只需固定 `claude-mem-lite@6.18.0`。
+
+- **`search` / `mem_search` 用 `🤖` 标出机器写入的 observation**，`get` / `mem_get` 在标题行注明。
+  hook 采集、导入和压缩生成的行带这个标记；显式保存的和 events 不带。只要显示的行里有带标记的，
+  结果行就会解释它的含义；`search --json` 的 observation 行多一个 `auto` 字段。
+- **`mem_search` 只在摘录比标题多出信息时才显示摘录行。**
+- 修复：新的按项目存储里，单条搜索命中不再排在最后；Bash 步骤存下的描述会保留输出的结尾；
+  密钥擦除器能识别 markdown 标签后面的值，并且在构造输入下保持线性时间。
+
 ## 升级到 6.18.0
 
 **一处默认行为改变，有开关。** 没有 schema 变更、不需要迁移。固定 `claude-mem-lite@6.17.1`

package/format-utils.mjs

@@ -92,7 +92,9 @@ export function queryLabel(query) {
 
 // Two delimiter classes are defanged here:
 //   1. The blocks claude-mem-lite wraps injected context in (claude-mem-context /
-//      memory-context / session-handoff). User-derived text containing one LITERALLY
+//      memory-context / session-handoff / the handoff's inner session-summary — D#129: a
+//      summary carrying `</session-summary><session-summary source="report">` closed the
+//      real block and forged its provenance). User-derived text containing one LITERALLY
 //      would prematurely open/close the block it lands in, spilling the rest as
 //      undelimited context.
 //   2. Harness-authority + tool-call tags the runtime injects (system-reminder /
@@ -113,7 +115,7 @@ export function queryLabel(query) {
 // Reachable by editing files that contain these tokens \u2014 e.g. developing claude-mem-lite
 // itself, where source/observations carry the delimiter names.
 const CONTEXT_DELIMITER_RE =
-  /<\/?(?:claude-mem-context|memory-context|session-handoff|system-reminder|task-notification|(?:antml:)?function_calls|(?:antml:)?function_results|(?:antml:)?invoke|(?:antml:)?parameter)(?:\s[^>]*)?>/gi;
+  /<\/?(?:claude-mem-context|memory-context|session-handoff|session-summary|system-reminder|task-notification|(?:antml:)?function_calls|(?:antml:)?function_results|(?:antml:)?invoke|(?:antml:)?parameter)(?:\s[^>]*)?>/gi;
 
 // Pass cap for the fixpoint loop below. 32 nested layers of a forged delimiter is far past
 // anything prose produces; the cap exists only to bound the ADVERSARIAL cost (an unbounded

package/hook-llm.mjs

@@ -991,6 +991,7 @@ export async function handleLLMEpisode() {
   // events; treating them as a separate role + boundary marker reduces the
   // attack surface for memory poisoning via crafted file content.
   const SHARED_OBS_SCHEMA_TAIL = `${MEMORY_INPUT_GUARD}
+Grounding: state only outcomes the user message shows. An action description may be cut short ("…"); if its result is not visible, say what was run, not how it turned out. Never write that something passed, failed, was verified or confirmed unless that result appears in the user message.
 type: pick by strongest signal. decision = explicit tradeoff / "chose X over Y because Z" / rejected an approach (e.g. "Rejected schema migration — single-source module + sync test instead"; "Heterogeneous hook events → heterogeneous context budgets"). bugfix = prior-failing path fixed with a named root cause. feature = new user-visible capability. refactor = behavior unchanged but structure improved. discovery = learned how a system works (read-heavy, no writes). change = routine edit with no new principle (default if unsure and nothing else fits).
 Facts: each MUST be (1) atomic—one claim, (2) self-contained—no pronouns, include file/function name, (3) specific—"refreshToken() in auth.ts:45 uses 1h TTL" not "handles tokens"
 importance: Be strict — default to 1. 0=pure browsing with zero learning value. 1=routine file edits, standard changes, normal workflow (MOST episodes). 2=notable ONLY if it reveals something non-obvious: error fix with discovered root cause, architectural decision with explicit tradeoff, config change with unexpected side effects. 3=critical: breaking change affecting users, security vulnerability fix, data migration. Ask yourself: "would a future session benefit from knowing this?" — if not, it's importance=1.

package/hook-optimize.mjs

@@ -32,6 +32,7 @@ import { normalizeScope, SCOPE_PROMPT_LEGEND, insertObservationRow } from './lib
 import { liveObsFilterSql } from './lib/inject-search-core.mjs';
 import { resolveRuntimeDir } from './lib/resolve-data-dir.mjs';
 import { MEMORY_INPUT_GUARD } from './lib/memory-input-guard.mjs';
+import { MANUAL_SESSION_ID_PREFIX } from './lib/provenance.mjs';
 
 import { DAY_MS } from './lib/time-constants.mjs';
 // P1-14: same resolver as hook-shared.mjs — this was the second module that had never
@@ -1108,7 +1109,7 @@ export function findMergeCandidates(db, maxClusters = 5, { project } = {}) {
     -- keeper.search_aliases when it rebuilt the keeper's TF-IDF vector. Phase-2 removed that
     -- rebuild, so the column had no reader left and went with it. Do NOT re-add it on the
     -- strength of R10 P3-7 -- that finding is moot, not pending. executeMergeCluster reads
-    -- keeper.{id,importance,narrative,concepts,facts} and o.{id,title,type,narrative,
+    -- keeper.{id,project,importance,narrative,concepts,facts} and o.{id,title,type,narrative,
     -- importance,access_count,lesson_learned}, and nothing else off these rows.
     SELECT id, title, narrative, project, type, access_count, importance, created_at_epoch, minhash_sig, lesson_learned, concepts, facts
     FROM observations
@@ -1311,10 +1312,33 @@ Return ONLY valid JSON:
          SELECT ${snapColList}, ? FROM observations WHERE id = ?`,
       ).run(keeper.id, keeper.id);
 
+      // The keeper now holds model text. Search reads authorship from memory_session_id, so an
+      // explicit save's `manual-` id would mark it as one (D#138); it moves to the compression
+      // writer's id. A machine-written keeper keeps its id, and so does the snapshot above, which
+      // is the original save. The writer's session row is best-effort: sdk_sessions refuses an id
+      // shaped like a uuid, which `compress-<project>` is for a 27-character project shaped
+      // xxxx-xxxx-xxxx-xxxxxxxxxxxx, and that refusal must not fail the merge (v6.19.1 pre-tag F5a).
+      let rewriteSessionId = null;
+      const keeperSession = db
+        .prepare('SELECT memory_session_id FROM observations WHERE id = ?')
+        .get(keeper.id);
+      if (keeperSession?.memory_session_id?.startsWith(MANUAL_SESSION_ID_PREFIX)) {
+        const compressSessionId = `compress-${keeper.project}`;
+        try {
+          db.prepare(
+            `INSERT OR IGNORE INTO sdk_sessions (content_session_id, memory_session_id, project, started_at, started_at_epoch, status)
+             VALUES (?, ?, ?, ?, ?, 'active')`,
+          ).run(compressSessionId, compressSessionId, keeper.project, new Date().toISOString(), Date.now());
+          rewriteSessionId = compressSessionId;
+        } catch (e) {
+          debugCatch(e, 'cluster-merge writer session');
+        }
+      }
       db.prepare(
         `
         UPDATE observations SET title=?, narrative=?, concepts=?, facts=?, text=?,
-          importance=?, lesson_learned=?, minhash_sig=?, optimized_at=?
+          importance=?, lesson_learned=?, minhash_sig=?, optimized_at=?,
+          memory_session_id = COALESCE(?, memory_session_id)
         WHERE id = ?
       `,
       ).run(
@@ -1327,6 +1351,7 @@ Return ONLY valid JSON:
         safe.lesson_learned,
         minhashSig,
         Date.now(),
+        rewriteSessionId,
         keeper.id,
       );
 

package/lib/activity.mjs

@@ -199,6 +199,8 @@ export function promoteInsightEvents(
       // manual-save contract) so it lands in the high-weight FTS field.
       lesson_learned: ev.body.slice(0, 500),
       now: new Date(ev.created_at_epoch),
+      // Event bodies are machine-written (episode summaries), so the row is not an explicit save.
+      sessionId: `promote-${ev.project}`,
     });
     mark.run(Date.now(), ev.id);
     return r;

package/lib/deferred-work.mjs

@@ -86,6 +86,30 @@ export function listOpenWithOrdinal(db, project, limit = 10) {
     .all(project, limit);
 }
 
+/**
+ * One open row's ordinal, numbered as listOpenWithOrdinal numbers it; null when the row is not
+ * open. `defer add` / `mem_defer` read it from a 50-row page before, so an item added past 50
+ * open printed `(item ?)` (D#123).
+ * @param {Database} db
+ * @param {string} project
+ * @param {number} id
+ * @returns {number|null}
+ */
+export function openOrdinalOf(db, project, id) {
+  const row = db
+    .prepare(
+      `
+    SELECT ordinal FROM (
+      SELECT id, ROW_NUMBER() OVER (ORDER BY priority DESC, created_at_epoch ASC, id ASC) AS ordinal
+      FROM deferred_work
+      WHERE project = ? AND status = 'open'
+    ) WHERE id = ?
+  `,
+    )
+    .get(project, id);
+  return row ? row.ordinal : null;
+}
+
 /**
  * How many open rows `defer list` / `mem_defer_list` left off their page, as a line to
  * print — '' when the page held them all. Without it a page one short of the open set

package/lib/fast-summary.mjs

@@ -110,8 +110,9 @@ function replyLines(text) {
 
 /**
  * Whether the scrubber finds a secret in `text` as written OR with inline markup (`, |, *)
- * removed. Markup can hide a secret from the scrubber — `**password**=…`, a key split by a
- * backtick or `*`, `gh|p_…` are all missed as written and caught stripped — and storing the
+ * removed. Markup can hide a secret from the scrubber — a key split by a backtick or `*`,
+ * `gh|p_…` are missed as written and caught stripped (a markup-wrapped LABEL such as
+ * `**password**=…` is caught as written since D#128) — and storing the
  * stripped text instead would leave a split key's tail behind. The caller asks it about the
  * exact text it stores, not the reply as written: a list or quote marker between a label and
  * its value hid the pair from a check on the raw reply, and removing the marker for storage

package/lib/lesson-bridge.mjs

@@ -26,7 +26,8 @@ export function buildBridgePrompt(lesson, hunk) {
 
 // { ok:true, check } when the bridge produced a usable, applicable check;
 // { ok:false } on N/A / empty / error / timeout. NEVER throws — the caller
-// falls back to the baseline ACK_DIRECTIVE on { ok:false }.
+// falls back to the arm's plain directive on { ok:false } (VERDICT_DIRECTIVE since 6.17.0,
+// scripts/pre-tool-recall.js ACTIVE_DIRECTIVE).
 export async function bridgeLesson({ lesson, hunk, timeoutMs = 2500, _callLLM = callLLM }) {
   try {
     const raw = await _callLLM(buildBridgePrompt(lesson, hunk), timeoutMs);

package/lib/provenance.mjs

@@ -0,0 +1,33 @@
+// Which writer produced an observation, read back from its memory_session_id. saveObservation
+// writes every explicit save under MANUAL_SESSION_ID_PREFIX. The hook capture (`hook-`),
+// transcript import (`import-`), compression summaries and cluster-merge keepers (`compress-`),
+// promoted events (`promote-`) and rows imported from older stores (a bare session uuid) are
+// machine-written.
+//
+// Search and get mark the machine-written side, because explicit saves are the large majority
+// of a typical store and a mark on nearly every line would carry no information. An unknown id
+// renders unmarked, as every row did before the mark existed.
+
+export const MANUAL_SESSION_ID_PREFIX = 'manual-';
+
+const AUTO_MARK = '🤖';
+const AUTO_TEXT = 'auto-written, not an explicit save';
+
+/** @param {string|null|undefined} memorySessionId */
+export function isAutoWritten(memorySessionId) {
+  return (
+    typeof memorySessionId === 'string' &&
+    memorySessionId !== '' &&
+    !memorySessionId.startsWith(MANUAL_SESSION_ID_PREFIX)
+  );
+}
+
+/** Search row tag; `auto` is set on obs rows by attachBodyTokens. */
+export const autoTag = (r) => (r.auto ? ` ${AUTO_MARK}` : '');
+
+/** Search result-line legend, shown only when a rendered row carries the tag. */
+export const autoLegend = (rows) => (rows.some((r) => r.auto) ? ` · ${AUTO_MARK} = ${AUTO_TEXT}` : '');
+
+/** Get header note for a full observation row. */
+export const autoHeaderNote = (row) =>
+  isAutoWritten(row.memory_session_id) ? ` · ${AUTO_MARK} ${AUTO_TEXT}` : '';

package/lib/save-observation.mjs

@@ -22,6 +22,7 @@ import { liveObsFilterSql } from './inject-search-core.mjs';
 // Imported, not injected: `allowStatuses` below is the POLICY this function exists to hold,
 // and a caller free to pass its own resolver could reinstate the one-way gate D#195 closed.
 import { resolveDeferredIds, closeDeferredItems } from './deferred-work.mjs';
+import { MANUAL_SESSION_ID_PREFIX } from './provenance.mjs';
 
 const DEDUP_WINDOW_MS = 5 * 60 * 1000;
 const DEDUP_RECENT_LIMIT = 50;
@@ -143,6 +144,7 @@ export function formatSupersedeSkipped(skipped) {
  * @param {string|null} [params.lesson_learned]   Caller validates ≤500 chars.
  * @param {boolean} [params.force=false]          Skip the near-duplicate window (below).
  * @param {Date}   [params.now]                   Override for tests.
+ * @param {string} [params.sessionId]             Writer id; default `manual-<project>` (an explicit save).
  * Both result shapes carry `supersededIds` (observations actually tombstoned) and
  * `supersedeSkipped` (requested but NOT tombstoned, each with a `reason`:
  * `malformed-id` | `no-such-observation` | `no-such-event` | `other-project` |
@@ -197,7 +199,9 @@ export function saveObservation(db, params) {
   const safeTitle = scrubSecrets(rawTitle);
   const safeLesson = rawLesson ? scrubSecrets(rawLesson) : null;
 
-  const sessionId = `manual-${project}`;
+  // An explicit save by default; a caller storing machine-written text names its own writer
+  // (lib/provenance.mjs reads authorship from this id).
+  const sessionId = params.sessionId || `${MANUAL_SESSION_ID_PREFIX}${project}`;
 
   // Ensure session exists (FK constraint). INSERT OR IGNORE makes this safe
   // under concurrent calls.

package/lib/search-core.mjs

@@ -409,6 +409,20 @@ const SINGLE_MATCH_BANDS = [
   [0, -0.25],
 ];
 
+// #36: the ratio above assumes the lone hit's magnitude says how well it matched. It does not
+// when FTS5 clamped the IDF: a term in at least half of a table's rows gets idf <= 0, which
+// FTS5 replaces with 1e-6, so the raw bm25 is at most 1e-6 × (k1+1 = 2.2) per phrase whatever
+// the match. A new per-project store reaches it on every query (2 observations, term in 1:
+// idf = ln(1.5/1.5) = 0). Such a lone row is scored the way a multi-row source's best already
+// is (-1): of two clamped rows the better was normalized to -1; a single one was sunk to -0.25.
+// The test reads the RAW bm25 on the obs leg (rawScore): FULL_SCORE's multipliers go down to
+// 0.5 × 0.5 × 0.2 × 0.4 = 0.02, so a demoted row with an informative IDF (0.18) scored 1.35e-4
+// and was lifted from last to first when the final score was tested (v6.19.0 pre-tag review
+// P3-3). Session and event multipliers are >= 1 and prompts carry raw bm25, so their final
+// score is tested. An obs row without rawScore keeps the bands. A near-zero IDF that FTS5 did not
+// clamp (a term in very nearly half the rows) can land below the scale too, and says as little.
+const CLAMPED_IDF_SCALE = 1e-4;
+
 /**
  * Normalize each source's BM25 scores to [-1, 0] before cross-source merge.
  * Prevents observations (BM25 can reach -40) from systematically outranking
@@ -437,6 +451,11 @@ export function normalizeCrossSourceScores(results, sourceKey) {
     );
     if (srcResults.length === 0) continue;
     if (srcResults.length === 1) {
+      const magnitude = src === 'obs' ? srcResults[0].rawScore : srcResults[0].score;
+      if (typeof magnitude === 'number' && Math.abs(magnitude) < CLAMPED_IDF_SCALE) {
+        srcResults[0].score = -1;
+        continue;
+      }
       const ratio = globalMaxAbs > 0 ? Math.abs(srcResults[0].score) / globalMaxAbs : 0;
       srcResults[0].score = SINGLE_MATCH_BANDS.find(([floor]) => ratio >= floor)[1];
       continue;

package/mem-cli.mjs

@@ -25,6 +25,7 @@ import { resolveProject } from './project-utils.mjs';
 import { resolveCliProject as cliProject } from './lib/cli-project.mjs';
 import { reRankWithContext } from './search-scoring.mjs';
 import { searchObservationsHybrid } from './search-engine.mjs';
+import { autoHeaderNote, autoLegend, autoTag } from './lib/provenance.mjs';
 import {
   fetchObsDetail,
   fetchPromptDetail,
@@ -162,6 +163,7 @@ import { aggregateMetrics, readMetrics } from './lib/metrics.mjs';
 import {
   insertDeferred,
   listOpenWithOrdinal,
+  openOrdinalOf,
   dropDeferred,
   formatDropReasonHint,
   resolveDeferredIds,
@@ -565,6 +567,8 @@ async function cmdSearch(db, args, { llm } = {}) {
         importance: r.importance ?? null,
         files_modified: r.files_modified || null,
         body_tokens: r.bodyTokens ?? null,
+        // Events carry no session id, so only observations can say who wrote them.
+        ...(r.source === 'obs' ? { auto: r.auto === true } : {}),
       };
     });
     out(
@@ -588,7 +592,7 @@ async function cmdSearch(db, args, { llm } = {}) {
   // Pluralize on total — "Found 1 of 44 result" reads wrong; the population (44) drives
   // grammatical number, not the page slice (1).
   out(
-    `[mem] Found ${countLabel} result${total !== 1 ? 's' : ''} for "${queryLabel(query)}"${fallbackHint}:${hasMixed ? ' (# observation, S# session, P# prompt, E# event)' : ''}`,
+    `[mem] Found ${countLabel} result${total !== 1 ? 's' : ''} for "${queryLabel(query)}"${fallbackHint}:${hasMixed ? ' (# observation, S# session, P# prompt, E# event)' : ''}${autoLegend(paged)}`,
   );
   // `~Nt` = est. tokens to fetch this row's full body via mem_get (attachBodyTokens, paired with
   // MCP). Conditional so a row that skipped enrichment renders cleanly, not "~undefinedt".
@@ -614,7 +618,7 @@ async function cmdSearch(db, args, { llm } = {}) {
     } else {
       const date = fmtDateShort(r.created_at);
       const title = truncate(r.title || r.subtitle || '(untitled)', 80);
-      out(`#${r.id} ${typeIcon(r.type)} ${date}${timeStr} ${title}${tok(r)}`);
+      out(`#${r.id} ${typeIcon(r.type)}${autoTag(r)} ${date}${timeStr} ${title}${tok(r)}`);
       if (r.lesson_learned) {
         out(`  -> ${truncate(r.lesson_learned, 80)}`);
       }
@@ -793,7 +797,7 @@ function renderObsRows(db, ids, requestedFields) {
   const fields = requestedFields || OBS_FIELDS;
   const parts = [];
   for (const r of rows) {
-    const lines = [`#${r.id} [${r.type}] ${fmtDateShort(r.created_at)}`];
+    const lines = [`#${r.id} [${r.type}] ${fmtDateShort(r.created_at)}${autoHeaderNote(r)}`];
     // Retraction first (shared with mem_get via get-core) — see supersededNotice.
     const retracted = supersededNotice(r);
     if (retracted) lines.push(retracted);
@@ -1445,9 +1449,8 @@ function cmdDeferAdd(db, args) {
     return;
   }
   // Compute the freshly-inserted row's ordinal for an immediately-actionable
-  // response ("ok, deferred this as item N"). Mirrors server.mjs:980.
-  const open = listOpenWithOrdinal(db, project, 50);
-  const ord = open.find((o) => o.id === r.id)?.ordinal ?? '?';
+  // response ("ok, deferred this as item N"), as mem_defer does.
+  const ord = openOrdinalOf(db, project, r.id) ?? '?';
   out(`[mem] Deferred as D#${r.id} (item ${ord}) in project "${project}".`);
 }
 

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.18.0",
+  "version": "6.19.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "claude-mem-lite",
-      "version": "6.18.0",
+      "version": "6.19.1",
       "os": [
         "darwin",
         "linux",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.18.0",
+  "version": "6.19.1",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",
@@ -82,6 +82,7 @@
     "lib/stats-quality.mjs",
     "lib/low-signal-patterns.mjs",
     "lib/private-strip.mjs",
+    "lib/provenance.mjs",
     "lib/citation-tracker.mjs",
     "lib/edge-attribution.mjs",
     "lib/file-edge-match.mjs",

package/search-engine.mjs

@@ -21,6 +21,7 @@ import {
 import { citeFactorClause } from './scoring-sql.mjs';
 import { extractPRFTerms, expandQueryByConcepts } from './search-scoring.mjs';
 import { liveObsFilterSql, recencyDecaySql } from './lib/inject-search-core.mjs';
+import { isAutoWritten } from './lib/provenance.mjs';
 
 // Scoring expressions — full adds project boost + access bonus; simple is for
 // expansion paths where boost would over-amplify already-loose matches.
@@ -69,7 +70,8 @@ export function buildObsFtsQuery(scoring, { multiplier, withSnippet, withOffset,
     SELECT o.id, o.type, o.title, o.subtitle, o.project, o.created_at, o.created_at_epoch, o.importance,
            o.files_modified, o.lesson_learned,
            ${withSnippet ? "snippet(observations_fts, 2, '»', '«', '…', 10) as match_snippet," : ''}
-           ${scoreExpr}${mult} as score
+           ${scoreExpr}${mult} as score,
+           ${OBS_BM25} as raw_bm25
     FROM observations_fts
     JOIN observations o ON observations_fts.rowid = o.id
     WHERE observations_fts MATCH ?
@@ -330,6 +332,19 @@ export function countSearchTotal(
   return total;
 }
 
+/**
+ * True when an FTS excerpt says something the title does not. snippet() wraps matches in »« and
+ * cuts with …, and a save's title is the start of its narrative, so an excerpt that is only a
+ * piece of the title repeats it once markers and ellipses are stripped.
+ * @param {string|null|undefined} snippet
+ * @param {string|null|undefined} title
+ */
+export function snippetAddsInfo(snippet, title) {
+  if (typeof snippet !== 'string' || snippet.length <= 10) return false;
+  const bare = snippet.replace(/[»«]/g, '').replace(/^…|…$/g, '').trim();
+  return !(title || '').includes(bare);
+}
+
 export function ftsRowToResult(r, { scoreMultiplier, snippet } = {}) {
   return {
     source: 'obs',
@@ -346,6 +361,9 @@ export function ftsRowToResult(r, { scoreMultiplier, snippet } = {}) {
     created_at: r.created_at,
     created_at_epoch: r.created_at_epoch,
     score: scoreMultiplier ? r.score * scoreMultiplier : r.score,
+    // bm25 before FULL_SCORE's multipliers, which can shrink it 50x: only this can say whether
+    // FTS5 clamped the IDF (normalizeCrossSourceScores, CLAMPED_IDF_SCALE).
+    rawScore: r.raw_bm25,
     files_modified: r.files_modified,
     importance: r.importance,
     lesson_learned: r.lesson_learned,
@@ -362,7 +380,8 @@ export function ftsRowToResult(r, { scoreMultiplier, snippet } = {}) {
 // heavy obs fields are batch-fetched by id HERE rather than carried on every result. The source
 // key is read as `source || _source` because the two render paths disagree (#8654): MCP sets
 // `source`+`text`, CLI sets `_source`+`prompt_text`. estimateTokens floors at 1, so a missing row
-// or empty body yields 1 — never 0/NaN.
+// or empty body yields 1 — never 0/NaN. The same by-id read sets `auto` (lib/provenance.mjs) on
+// the rendered page only, so no result producer has to carry memory_session_id.
 export function attachBodyTokens(db, results) {
   if (!Array.isArray(results) || results.length === 0) return results;
   const obsIds = results
@@ -373,7 +392,7 @@ export function attachBodyTokens(db, results) {
     try {
       const ph = obsIds.map(() => '?').join(',');
       const rows = db
-        .prepare(`SELECT id, narrative, facts, text FROM observations WHERE id IN (${ph})`)
+        .prepare(`SELECT id, narrative, facts, text, memory_session_id FROM observations WHERE id IN (${ph})`)
         .all(...obsIds);
       for (const row of rows) bodyById.set(row.id, row);
     } catch (e) {
@@ -385,6 +404,7 @@ export function attachBodyTokens(db, results) {
     let parts;
     if (src === 'obs') {
       const row = bodyById.get(r.id) || {};
+      r.auto = isAutoWritten(row.memory_session_id);
       parts = [r.title, r.subtitle, r.lesson_learned, row.narrative, row.facts, row.text];
     } else if (src === 'session') {
       parts = [r.request, r.completed, r.working_on];

package/secret-scrub.mjs

@@ -28,9 +28,41 @@ export const SECRET_PATTERNS = [
   // keyword. Allowing a leading `_` catches those while the prose lookbehind still
   // excludes "Marker token: …". `secret` added so a bare SECRET=… with a mixed-alnum
   // value is covered (the hex-only assignment pattern below misses non-hex values).
+  //
+  // MARKDOWN AROUND A LABEL (D#128). `- **Password**: \`<v>\`` put `**` between the noun and
+  // its separator, so no label pattern matched and the value was stored. Models write labels
+  // that way all the time. So a label may carry up to three markup characters after the noun
+  // (`[*_~\`]`), and up to two of `*_~` between the separator and the value
+  // (`**Password:** <v>`). Three rules keep this from widening what counts as a value:
+  //   - no backtick after the separator: `` `password:` <next word> `` names the label and
+  //     then goes on in prose, and the next word (or a CJK run with no spaces) was scrubbed;
+  //   - at most two characters there, so the scrubber's own `***` is never taken for markup
+  //     (`password=*** token=abc` would scrub `token=abc` on the second pass);
+  //   - the prose check looks through emphasis (`the **password**: …` is prose) but not a
+  //     backtick, since `` word `token: <v>` `` is code, not prose. A label wrapped in code
+  //     (`` `GH_TOKEN`: <v> ``) has its own branch, whose prose check looks past the opening
+  //     backtick. That branch starts with a cheap lookahead: without it the 40-char lookbehind
+  //     ran at every position, and a 500k-char input went from 407 ms to 3,387 ms.
+  // Measured 2026-09-27 over 831,328 unique lines (this repo's tracked text plus local
+  // transcripts: prompts, replies, tool output), old and new run back to back: 28 lines
+  // differ. All the catches are fixtures quoted from the D#128 audit; the rest are
+  // `- **token**:assistant …` and `` `PGPASSWORD`=PG+password ``, which the same text with
+  // no markup scrubs too, plus a JSON-escaped `\n` taken as a value. Idempotence failures: 0
+  // and 0. A 13,770-case ground-truth fuzz (labels × 8 wrappings × separators × values ×
+  // positions): leaks 12,580 → 421, none newly opened. All 421 are `<word> token|secret|bearer:`
+  // in prose, left open by design (below).
+  //
+  // ACCEPTED GAPS (D#131). This scrubber stops ACCIDENTAL persistence; an author who wants a
+  // secret stored can always encode it. So shapes only an adversary writes stay open:
+  // zero-width characters inside a label, fullwidth letters. Shapes that occur naturally but
+  // cannot be told from prose stay open too: `password is <v>` and `<word> token: <v>` (the
+  // guard below). A pattern that caught them would also rewrite ordinary sentences, and
+  // v3.61.0 already had to undo exactly that. `| password | <v> |` table rows stay open for a
+  // different reason: those 831k lines held 1 such row and none with a credential-shaped
+  // value, so a table pattern's false-positive rate cannot be measured here.
   //   1a. `=` assignment → ALWAYS scrub (config syntax, never prose):
   [
-    /((?:\b|_)(?:password|passwd|passphrase|token|bearer|secret)\s*=\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi,
+    /((?:\b|_)(?:password|passwd|passphrase|token|bearer|secret)(?:[*_~`]{1,3})?\s*=(?:[*_~]{1,2}(?=\s))?\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi,
     '$1***',
   ],
   //   1b. `:` separator, PASSWORD nouns. Position decides how permissive the value
@@ -71,16 +103,16 @@ export const SECRET_PATTERNS = [
   //       Both arms emit `***` (3 chars, under the {6,} floor), so they cannot
   //       double-apply.
   [
-    /((?<![A-Za-z][ \t])(?:\b|_)(?:password|passwd|passphrase)\s*:\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi,
+    /((?:(?<![A-Za-z][ \t][*_~]{0,3})(?:\b|_)(?:password|passwd|passphrase)(?:[*_~]{1,3})?|(?=_?(?:password|passwd|passphrase)`)(?<![A-Za-z][ \t]`[\w-]{0,40})(?<=`[\w-]{0,40})(?:\b|_)(?:password|passwd|passphrase)`)\s*[:：](?:[*_~]{1,2}(?=\s))?\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi,
     '$1***',
   ],
   [
-    /((?:\b|_)(?:password|passwd|passphrase)\s*:\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)(?![A-Za-z]{1,15}(?=[\s,;'"}\]]|$))[^\s,;'"}\]]{6,}/gi,
+    /((?:\b|_)(?:password|passwd|passphrase)(?:[*_~`]{1,3})?\s*[:：](?:[*_~]{1,2}(?=\s))?\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)(?![A-Za-z]{1,15}(?=[`*~]*(?:[\s,;'"}\]]|$)))[^\s,;'"}\]]{6,}/gi,
     '$1***',
   ],
   //   1c. `:` separator, prose-ambiguous nouns → keep the lookbehind ("the token: alicebob"):
   [
-    /((?<![A-Za-z][ \t])(?:\b|_)(?:token|bearer|secret)\s*:\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi,
+    /((?:(?<![A-Za-z][ \t][*_~]{0,3})(?:\b|_)(?:token|bearer|secret)(?:[*_~]{1,3})?|(?=_?(?:token|bearer|secret)`)(?<![A-Za-z][ \t]`[\w-]{0,40})(?<=`[\w-]{0,40})(?:\b|_)(?:token|bearer|secret)`)\s*[:：](?:[*_~]{1,2}(?=\s))?\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi,
     '$1***',
   ],
   // access_token / refresh_token are the canonical OAuth2 field names — they were
@@ -95,7 +127,7 @@ export const SECRET_PATTERNS = [
   // low-FP decision that `topsecret=` / `access_token_count:` are non-credentials
   // (#8283 + utils.test.mjs:1089-1100); bare `pwd` is omitted so `PWD=` (a path) survives.
   [
-    /((?:\b|_)(?:api[_-]?key|api[_-]?secret|secret[_-]?key|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|access[_-]?token|refresh[_-]?token|pgpassword|pgpass|mysql_pwd)\s*[=:]\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi,
+    /((?:\b|_)(?:api[_-]?key|api[_-]?secret|secret[_-]?key|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|access[_-]?token|refresh[_-]?token|pgpassword|pgpass|mysql_pwd)(?:[*_~`]{1,3})?\s*[=:：](?:[*_~]{1,2}(?=\s))?\s*)(?!process\.env\.)(?!new\s)(?!\w+\()(?!(?:null|undefined|true|false|None|nil|empty|""|''|0)\b)[^\s,;'"}\]]{6,}/gi,
     '$1***',
   ],
   // Space-separated credential CLI flag: `--password <value>` (long-form). The KV
@@ -118,19 +150,28 @@ export const SECRET_PATTERNS = [
   //   (a) bare credential nouns: `=` always scrubs; `:` keeps the prose lookbehind
   //       (mirrors the unquoted 1a/1b split — a quoted value doesn't turn `:` prose
   //       into config, but `<word> password="x"` is still a leak):
-  [/((?:\b|_)(?:password|passwd|passphrase|token|bearer|secret)\s*=\s*)(['"])[^'"]{6,}\2/gi, '$1$2***$2'],
-  [/((?:\b|_)(?:password|passwd|passphrase)\s*:\s*)(['"])[^'"]{6,}\2/gi, '$1$2***$2'],
-  [/((?<![A-Za-z][ \t])(?:\b|_)(?:token|bearer|secret)\s*:\s*)(['"])[^'"]{6,}\2/gi, '$1$2***$2'],
+  [
+    /((?:\b|_)(?:password|passwd|passphrase|token|bearer|secret)(?:[*_~`]{1,3})?\s*=(?:[*_~]{1,2}(?=\s))?\s*)(['"])[^'"]{6,}\2/gi,
+    '$1$2***$2',
+  ],
+  [
+    /((?:\b|_)(?:password|passwd|passphrase)(?:[*_~`]{1,3})?\s*[:：](?:[*_~]{1,2}(?=\s))?\s*)(['"])[^'"]{6,}\2/gi,
+    '$1$2***$2',
+  ],
+  [
+    /((?:(?<![A-Za-z][ \t][*_~]{0,3})(?:\b|_)(?:token|bearer|secret)(?:[*_~]{1,3})?|(?=_?(?:token|bearer|secret)`)(?<![A-Za-z][ \t]`[\w-]{0,40})(?<=`[\w-]{0,40})(?:\b|_)(?:token|bearer|secret)`)\s*[:：](?:[*_~]{1,2}(?=\s))?\s*)(['"])[^'"]{6,}\2/gi,
+    '$1$2***$2',
+  ],
   //   (b) structured keys + named env vars are unambiguous config even after a word
   //       (`see api_key: "x"` DOES scrub, mirroring the unquoted structured-key path):
   [
-    /((?:\b|_)(?:pgpassword|pgpass|mysql_pwd|api[_-]?key|api[_-]?secret|secret[_-]?key|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|access[_-]?token|refresh[_-]?token)\s*[=:]\s*)(['"])[^'"]{6,}\2/gi,
+    /((?:\b|_)(?:pgpassword|pgpass|mysql_pwd|api[_-]?key|api[_-]?secret|secret[_-]?key|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|access[_-]?token|refresh[_-]?token)(?:[*_~`]{1,3})?\s*[=:：](?:[*_~]{1,2}(?=\s))?\s*)(['"])[^'"]{6,}\2/gi,
     '$1$2***$2',
   ],
   // AWS access keys: AKIA (long-term) + ASIA (STS temp) + AROA (role) + AIDA
   // (user) + ANPA/ANVA/AGPA (other principal types). All share the 4-letter
   // prefix + exactly 16 base32 chars shape — specific enough for near-zero FP.
-  [/\b(?:AKIA|ASIA|AROA|AIDA|ANPA|ANVA|AGPA)[A-Z0-9]{16}\b/g, '***'],
+  [/\b(?:AKIA|ASIA|AROA|AIDA|ANPA|ANVA|AGPA)[A-Z0-9]{16}(?![A-Za-z0-9])/g, '***'],
   // OpenAI / Anthropic keys (sk-...) — specific prefixes have lower length threshold
   [/\bsk-(?:proj|ant|ant-api\d{2})-[a-zA-Z0-9_-]{8,}\b/g, '***'],
   [/\bsk-[a-zA-Z0-9_-]{20,}\b/g, '***'],
@@ -143,15 +184,50 @@ export const SECRET_PATTERNS = [
   [/\b(?:xox[bpasr]|xapp|xoxe)-[a-zA-Z0-9-]{10,}\b/g, '***'],
   // Slack incoming-webhook URL — the path after /services/ is the shared secret.
   [/(https:\/\/hooks\.slack\.com\/services\/)[A-Za-z0-9/]+/g, '$1***'],
-  // JWT tokens (eyJ...eyJ...)
-  [/\beyJ[a-zA-Z0-9_-]{10,}\.eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]+\b/g, '***'],
+  // JWT tokens (eyJ...eyJ...), from any `eyJ`: one glued to a prefix (`my-sess-eyJ…`,
+  // `session-<uuid>-eyJ…`, `tok_eyJ…`) is still a JWT. Every `eyJ` of one dotless run used to be a
+  // fresh start that rescanned the run to its end — quadratic, 9.6 s on 200k chars of `eyJ-`
+  // (D#130) — and v6.19.0's bounded lookbehind that fixed it missed a prefix over 40 characters
+  // (round-3 review P3-2). Here a failed start consumes its run instead (`|eyJ[\w-]*`, returned
+  // unchanged), so the scan resumes after it. Nothing is lost: the first segment cannot contain a
+  // `.`, so every later `eyJ` of the same run reaches the same run end and fails the same way.
+  [
+    /eyJ[a-zA-Z0-9_-]{10,}\.eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]+\b|eyJ[a-zA-Z0-9_-]*/g,
+    (m) => (m.includes('.') ? '***' : m),
+  ],
   // PEM private key blocks. `[A-Z0-9 ]*` covers every armor label — RSA/EC/DSA/
   // OPENSSH plus ENCRYPTED and PGP (… PRIVATE KEY BLOCK) — that the fixed
   // alternation missed; the block delimiters make FP impossible.
+  // The body stops at the next `-----BEGIN ` (D#130): with `[\s\S]*?` every header with no END
+  // scanned to the end of the text, on each of scrubSecrets' passes — quadratic, 8.3 s on 500k
+  // chars. A block whose END is missing is left to the next pattern.
+  [
+    /-----BEGIN [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----(?:(?!-----BEGIN [A-Z0-9 ]*PRIVATE KEY)[\s\S])*?-----END [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----/g,
+    '***PEM_KEY***',
+  ],
+  // A cut-off key (`head id_rsa`, a tool output cut mid-key): the header and the WHOLE lines of
+  // base64 (or RFC 1421 headers) that follow it. Stored whole through v6.19.0 when no later key
+  // header followed. Whole lines only, so prose naming a header mid-sentence keeps its text
+  // (v6.19.0 round-3 P3-3: ending the block at the next key header erased the prose between two).
+  // A body line starts with 16+ base64 characters, and one shorter whole line may follow the last
+  // of them (a key's last line): a line of one word or number is prose (v6.19.1 pre-tag review F3),
+  // so the body needs a long line, and blank lines count only between long ones. A long line need
+  // not be whole, so a key cut mid-line loses the cut line too. A line break may be JSON-escaped
+  // (`\n` as two characters) and a quote may end the last line (v6.19.1 claims review F1). A header
+  // value may hold a backslash that does not start an escaped break (a Windows path), and it does
+  // not share its whitespace with a second quantifier, which was quadratic (delta review P1).
   [
-    /-----BEGIN [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----/g,
+    /-----BEGIN [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----(?:[ \t]*(?:\r?\n|\\r\\n|\\n)(?=[ \t]*(?:\r?\n|\\r\\n|\\n)))*(?:[ \t]*(?:\r?\n|\\r\\n|\\n)[ \t]*(?:[A-Za-z0-9+/=]{16,}|(?:Proc-Type|DEK-Info|Version|Comment|Hash|Charset):(?:[^\r\n\\]|\\(?![rn]))*(?=\r?\n|\\[rn]|["']|$)))(?:(?:[ \t]*(?:\r?\n|\\r\\n|\\n)(?=[ \t]*(?:\r?\n|\\r\\n|\\n)))*(?:[ \t]*(?:\r?\n|\\r\\n|\\n)[ \t]*(?:[A-Za-z0-9+/=]{16,}|(?:Proc-Type|DEK-Info|Version|Comment|Hash|Charset):(?:[^\r\n\\]|\\(?![rn]))*(?=\r?\n|\\[rn]|["']|$))))*(?:[ \t]*(?:\r?\n|\\r\\n|\\n)[ \t]*[A-Za-z0-9+/=]{1,15}[ \t]*(?=\r?\n|\\[rn]|["']|$))?/g,
     '***PEM_KEY***',
   ],
+  // The other end (`tail key.pem`): whole base64 lines ending in a private-key END, the same line
+  // rule as above but with two shorter lines allowed before the END (an armored PGP key's last data
+  // line and its `=XXXX` checksum; delta review P2). A line may start after a quote. A run of lines
+  // that does not end there is consumed and returned unchanged, so no line starts a second scan.
+  [
+    /(?:(?<![^\n])|(?<=\\n|["']))(?:[ \t]*[A-Za-z0-9+/=]{16,}[ \t]*(?:\r?\n|\\r\\n|\\n))+(?:[ \t]*[A-Za-z0-9+/=]{1,15}[ \t]*(?:\r?\n|\\r\\n|\\n)){0,2}(?:-----END [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----)?/g,
+    (m) => (m.endsWith('-----') ? '***PEM_KEY***' : m),
+  ],
   // Long hex strings in credential assignments (e.g. SECRET_KEY=abc123def456...).
   // `hash` deliberately excluded: `hash: <40hex>` / `hash=<md5>` are git SHAs and
   // checksums (real, preserved data in this hash-heavy repo), not credentials.
@@ -160,7 +236,10 @@ export const SECRET_PATTERNS = [
   [/\bAIza[A-Za-z0-9_-]{35}\b/g, '***'],
   // Authorization header credentials — Bearer (opaque), Basic (base64 user:pass),
   // and GitHub's `token` scheme all carry secrets after the scheme word.
-  [/(Authorization:\s*(?:Bearer|Basic|token)\s+)[^\s,;'"}\]]+/gi, '$1***'],
+  [
+    /(Authorization(?:[*_~`]{1,3})?[:：](?:[*_~]{1,2}(?=\s))?\s*(?:Bearer|Basic|token)\s+)[^\s,;'"}\]]+/gi,
+    '$1***',
+  ],
   // R10 P1-6: the same header as a QUOTED KEY — `{"Authorization":"Bearer …"}`. The
   // pattern above needs `Authorization:` literally, and in JSON a quote sits between the
   // name and the colon, so a `curl -v` / fetch header dump walked straight through. The
@@ -194,10 +273,10 @@ export const SECRET_PATTERNS = [
     '$1$2://***',
   ],
   // npm tokens (npm_...)
-  [/\bnpm_[a-zA-Z0-9]{36,}\b/g, '***'],
+  [/\bnpm_[a-zA-Z0-9]{36,}(?![A-Za-z0-9])/g, '***'],
   // Stripe keys (sk_live_, rk_live_, pk_live_, sk_test_, pk_test_) + webhook signing secret (whsec_)
-  [/\b[srp]k_(?:live|test)_[a-zA-Z0-9]{20,}\b/g, '***'],
-  [/\bwhsec_[a-zA-Z0-9]{20,}\b/g, '***'],
+  [/\b[srp]k_(?:live|test)_[a-zA-Z0-9]{20,}(?![A-Za-z0-9])/g, '***'],
+  [/\bwhsec_[a-zA-Z0-9]{20,}(?![A-Za-z0-9])/g, '***'],
   // SendGrid API keys: SG.<22>.<43> — two dots at fixed offsets make this
   // structurally unmistakable; near-zero false-positive risk.
   [/\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b/g, '***'],
@@ -224,8 +303,11 @@ export const SECRET_PATTERNS = [
   // (password|secret|api_key|auth_token|access_token|private_key) so a benign
   // `"token_count"` value (numeric, <6 non-quote chars after scrub) and prose
   // keys stay low-FP; over-scrub is the safe direction for at-rest memory.
+  // `\w{0,64}`, not `\w*`, on both sides of the noun here and in the next pattern (D#130): from
+  // one quote, `\w*` ran to the end of a word run and backtracked through every keyword in it,
+  // each rescanning the run — `"` + `secret` x 33k took 4.6 s. 64 is far past any key name.
   [
-    /("\w*(?:password|passwd|secret|api[_-]?key|auth[_-]?token|access[_-]?token|private[_-]?key)\w*"\s*:\s*")[^"]{6,}(")/gi,
+    /("\w{0,64}(?:password|passwd|secret|api[_-]?key|auth[_-]?token|access[_-]?token|private[_-]?key)\w{0,64}"\s*:\s*")[^"]{6,}(")/gi,
     '$1***$2',
   ],
   // Quoted-KEY credential values — Python dict reprs `{'api_key': '...'}`, single-quoted
@@ -241,7 +323,7 @@ export const SECRET_PATTERNS = [
   // `'token_count': 123456`); `passphrase` added here too (double-quoted JSON passphrase is
   // subsumed by this pattern since `['"]` matches `"`). Over-scrub is the safe direction.
   [
-    /(['"]\w*(?:password|passwd|passphrase|secret|api[_-]?key|auth[_-]?token|access[_-]?token|private[_-]?key)\w*['"]\s*:\s*)(['"])[^'"]{6,}\2/gi,
+    /(['"](?:\w{0,64}(?:password|passwd|passphrase|secret|api[_-]?key|auth[_-]?token|access[_-]?token|private[_-]?key)\w{0,64}|\w{1,64}_token)['"]\s*:\s*)(['"])[^'"]{6,}\2/gi,
     '$1$2***$2',
   ],
   // Session cookies in headers / urlencoded bodies (sessionid=, session_id=, JSESSIONID=, PHPSESSID=).

package/server.mjs

@@ -17,7 +17,8 @@ import {
   formatSchemaSkewNotice,
 } from './lib/schema-skew.mjs';
 import { reRankWithContext, runIdleCleanup, buildServerInstructions } from './search-scoring.mjs';
-import { searchObservationsHybrid } from './search-engine.mjs';
+import { searchObservationsHybrid, snippetAddsInfo } from './search-engine.mjs';
+import { autoHeaderNote, autoLegend, autoTag } from './lib/provenance.mjs';
 import {
   deepSearch,
   resolveDeepMode,
@@ -124,6 +125,7 @@ import { AUTO_MERGE_THRESHOLD } from './lib/dedup-constants.mjs';
 import {
   insertDeferred,
   listOpenWithOrdinal,
+  openOrdinalOf,
   dropDeferred,
   formatDropReasonHint,
   resolveDeferredIds,
@@ -461,7 +463,7 @@ function formatSearchOutput(
   // explicitly requested OR semantics — there's no "fallback" in that path.
   const fallbackHint = orFallbackFired && !args.or ? ' (relaxed AND→OR)' : '';
   lines.push(
-    `Found ${countLabel} result(s)${qLabel}${fallbackHint}:${hasMixed ? ' (# observation, S# session, P# prompt, E# event)' : ''}\n`,
+    `Found ${countLabel} result(s)${qLabel}${fallbackHint}:${hasMixed ? ' (# observation, S# session, P# prompt, E# event)' : ''}${autoLegend(paginatedResults)}\n`,
   );
 
   // `~Nt` = estimated tokens to fetch this row's full body via mem_get (attachBodyTokens).
@@ -470,9 +472,9 @@ function formatSearchOutput(
   for (const r of paginatedResults) {
     if (r.source === 'obs') {
       lines.push(
-        `#${r.id} ${typeIcon(r.type)} [${r.type}] ${truncate(r.title || r.subtitle || '(untitled)')} | ${r.project} | ${fmtDate(r.date)}${tok(r)}`,
+        `#${r.id} ${typeIcon(r.type)} [${r.type}]${autoTag(r)} ${truncate(r.title || r.subtitle || '(untitled)')} | ${r.project} | ${fmtDate(r.date)}${tok(r)}`,
       );
-      if (r.snippet && r.snippet.length > 10 && r.snippet !== r.title) {
+      if (snippetAddsInfo(r.snippet, r.title)) {
         lines.push(`     ${truncate(r.snippet, 100)}`);
       }
     } else if (r.source === 'session') {
@@ -900,7 +902,7 @@ server.registerTool(
       const renderFields = obsFieldFilter || OBS_FIELDS;
       for (const row of rows) {
         foundBySource.obs.add(row.id);
-        const lines = [`── #${row.id} ──`];
+        const lines = [`── #${row.id}${autoHeaderNote(row)} ──`];
         // Retraction first (shared with the CLI `get` via get-core) — see supersededNotice.
         const retracted = supersededNotice(row);
         if (retracted) lines.push(retracted);
@@ -1220,8 +1222,7 @@ server.registerTool(
     });
     // Compute the ordinal for the freshly-inserted row so the response is
     // immediately actionable ("ok, I deferred this as item 1").
-    const open = listOpenWithOrdinal(db, project, 50);
-    const ord = open.find((o) => o.id === r.id)?.ordinal ?? null;
+    const ord = openOrdinalOf(db, project, r.id);
     return {
       content: [
         {

package/source-files.mjs

@@ -81,6 +81,8 @@ export const SOURCE_FILES = [
   'lib/stats-quality.mjs',
   'lib/low-signal-patterns.mjs',
   'lib/private-strip.mjs',
+  // Which writer produced an observation (explicit save vs machine-written); search + get marks.
+  'lib/provenance.mjs',
   'lib/citation-tracker.mjs',
   // v3.47 (D#78 P1): per-(obs,file) edge attribution. Imported by hook.mjs
   // (handleStop edge resolution). Missing from manifest → tarball hook.mjs

package/utils.mjs

@@ -56,7 +56,8 @@ export {
 } from './bash-utils.mjs';
 
 // Internal imports for functions that remain in this module
-import { truncate } from './format-utils.mjs';
+import { normalizeInline, truncate } from './format-utils.mjs';
+import { stripPrivate } from './lib/private-strip.mjs';
 import { stripTestSuffix } from './bash-utils.mjs';
 // Static, and deliberately the dependency-free resolver (node:os + node:path only) —
 // debugCatch's sampler must not pull in the DB layer. See its comment below.
@@ -282,9 +283,97 @@ export function isRelatedToEpisode(episode, newFiles) {
 // magnitude above the longest cut here, so a secret that begins before the cut is still
 // seen whole by the patterns, at bounded cost.
 const DESC_SCRUB_WINDOW = 4096;
-function scrubTruncate(str, max) {
+
+// Every field is cut strictly around private spans: closed `<private>` spans are redacted across
+// the WHOLE input first (one linear pass; hook input is capped at 256 KiB), then the window stops
+// before the first remaining `<private>` or private-key BEGIN, so no field shows a span whose end
+// is out of view. Before v6.19.0 an unclosed opener in the window (a Grep line
+// `notes.md:3:<private>bank pin 4412`) was shown as written (v6.19.0 pre-tag reviews P3-1, r3 P2-1).
+// A `</private>` or private-key END that comes first is a span whose START is out of view (a
+// nested span, `tail key.pem`), so everything before it may be its inside: the field shows nothing
+// (round-3 P3-1). The PEM half is case-sensitive, like the scrubber's PEM pattern.
+const PRIVATE_MARK_RE = /<\/?[Pp][Rr][Ii][Vv][Aa][Tt][Ee]>|-----(?:BEGIN|END) [A-Z0-9 ]*PRIVATE KEY/;
+// A window edge that cuts a token leaves a fragment shorter than its pattern needs (`ghp_` and 12
+// of its 36 characters), and whitespace collapsing can bring it into view: the cut token is
+// dropped (defect review P3-6, round-3 P3-4/P3-6). A head window with no whitespace keeps it: its
+// start is intact and it is the only part shown. A tail window with no whitespace is all one cut token.
+const isWs = (c) => c === ' ' || c === '\n' || c === '\t' || c === '\r' || /\s/.test(c);
+function dropCutTokenAtEnd(win, next) {
+  if (next === undefined || isWs(next)) return win;
+  let i = win.length;
+  while (i > 0 && !isWs(win[i - 1])) i--;
+  return i > 0 ? win.slice(0, i) : win;
+}
+function dropCutTokenAtStart(win, prev) {
+  if (prev === undefined || isWs(prev)) return win;
+  let i = 0;
+  while (i < win.length && !isWs(win[i])) i++;
+  return win.slice(i);
+}
+function scrubTruncate(str, max, window = DESC_SCRUB_WINDOW) {
   if (typeof str !== 'string' || str === '') return truncate(str, max);
-  return truncate(_scrubSecrets(str.slice(0, DESC_SCRUB_WINDOW)), max);
+  const stripped = stripPrivate(str);
+  let win = stripped.slice(0, window);
+  const mark = PRIVATE_MARK_RE.exec(win);
+  if (mark) win = mark[0][1] === '/' || mark[0].startsWith('-----END') ? '' : win.slice(0, mark.index);
+  else win = dropCutTokenAtEnd(win, stripped[window]);
+  // The window edge can split a surrogate pair; truncate only guards a cut it makes itself.
+  if (/[\uD800-\uDBFF]$/.test(win)) win = win.slice(0, -1);
+  return truncate(_scrubSecrets(win), max);
+}
+
+// Head+tail cut for command output. A check usually prints its verdict last ("...parsed: 0",
+// "3 passed"); a head-only cut hands the episode summarizer an unresolved-looking fragment,
+// and it has written a bugfix narrative for a check that passed. The tail comes from its own
+// scrub window at the END of the original string: taking it from the head window would drop
+// the verdict of any output longer than DESC_SCRUB_WINDOW.
+//
+// Output with a private span anywhere in it (a `<private>` tag or a PEM private-key marker) shows
+// no tail, only v6.18.0's 60-character head (cut as above). The tail is scrubbed in its own
+// window, which cannot see a span that crosses its edge, and pairing the markers per window
+// stored span text two ways in the v6.19.0 pre-tag review (a cut inside a closed `<private>`, a
+// key with no END more than 4096 characters back).
+const PRIVATE_TAG_HINT_RE = /<\/?private>/i;
+const HEAD_ONLY_MAX = 60;
+// The tail window is scrubbed with TAIL_CONTEXT characters before it, which are then dropped: a
+// label cut by the window's edge (`pass|word: <value>`) is seen whole, so its value is not left
+// unlabelled at the window's start, where whitespace collapsing can bring it into view (v6.19.1
+// pre-tag review F1). A replacement inside the context moves the cut by its length change; the
+// token the cut lands in is dropped either way.
+const TAIL_CONTEXT = 256;
+function scrubTailWindow(str, window) {
+  const scrubbed = _scrubSecrets(str.slice(-(window + TAIL_CONTEXT)));
+  return dropCutTokenAtStart(scrubbed.slice(TAIL_CONTEXT), scrubbed[TAIL_CONTEXT - 1]);
+}
+const oneSpace = (s) => s.replace(/\s+/g, ' ');
+// The early return needs the WHOLE output inside the head window: a long output whose first
+// 4096 characters collapse to a few (whitespace) still has a tail to show (v6.19.0 pre-tag
+// claims review F2).
+function scrubTruncateEnds(str, max) {
+  if (typeof str === 'string' && (str.includes('PRIVATE KEY') || PRIVATE_TAG_HINT_RE.test(str))) {
+    return scrubTruncate(str, HEAD_ONLY_MAX);
+  }
+  // Up to two windows long, one window covers the whole output: two overlapping windows showed
+  // the same text twice (delta review P3-4).
+  const window =
+    typeof str === 'string' && str.length <= 2 * DESC_SCRUB_WINDOW
+      ? 2 * DESC_SCRUB_WINDOW
+      : DESC_SCRUB_WINDOW;
+  // Whitespace runs are one space: a blank-line run no longer spends the budget (or, before the
+  // one-window rule, hid behind the window edge).
+  const flat = oneSpace(scrubTruncate(str, window, window));
+  const whole = typeof str !== 'string' || str.length <= window;
+  if (whole && flat.length <= max) return flat;
+  const tailLen = Math.floor(max / 2) - 1;
+  const tailSrc = whole ? flat : oneSpace(normalizeInline(scrubTailWindow(str, window)));
+  if (tailSrc === '') return truncate(flat, max);
+  // Drop a lone low surrogate the tail's cut may start on.
+  const tail = tailSrc.slice(-tailLen).replace(/^[\uDC00-\uDFFF]/, '');
+  // A head short enough to escape truncate's own "…" still gets one before the tail.
+  const budget = max - tailLen;
+  let head = truncate(flat, budget);
+  if (!head.endsWith('…')) head = head.length < budget ? `${head}…` : truncate(flat, budget - 1);
+  return head + tail;
 }
 
 export function makeEntryDesc(toolName, input, resp, opts) {
@@ -302,7 +391,7 @@ export function makeEntryDesc(toolName, input, resp, opts) {
       const isErr =
         opts?.isError ??
         (/\berror\b|\bfail(ed|ure)?\b|\bexception\b|\bpanic\b/i.test(resp) && resp.length > 30);
-      const snippet = scrubTruncate(resp, 60);
+      const snippet = scrubTruncateEnds(resp, 100);
       return isErr ? `${cmd} → ERROR: ${snippet}` : `${cmd} → ${snippet}`;
     }
     case 'Grep':