Open Second Brain

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

1.98.0 - 2026-11-02

Open Second Brain 1.98.0 is the agent-presence and self-improvement release: the vault states its usage where the agents that read it actually look, and its skills improve only under evidence. The install path closes its own gap - o2b install --target <host> --apply now writes the brain-usage block into the agent-instruction file the installed host reads at the vault root, through a shared managed-block writer that preserves every byte outside the block, refuses a hand-edited block by name, and records its ownership so uninstall removes exactly the pair the tool wrote. The dream pass gains an operator-approved exit into those same files: a lesson promotes into a managed lessons block only when the full qualification holds and a fresh approval pins the approved text, every non-member carries one named blocked reason, and the doctor grades every block state it can name. The skill lane gains a benchmark-gated rewrite loop where a skill is rewritten only after a candidate beats the incumbent on scored dev tasks with full coverage and survives the one held-out check - Open Second Brain never calls a model, the calling agent executes the task envelopes, the scorer reads structural predicates and nothing the agent claims about its own work, the accept stays an operator step on the command line, and the incumbent's bytes ride a content-restoring rollback journal until the sequence settles. And ChatGPT desktop is named where its operators look for it: it reads the shared Codex config, and the detect output and install docs say so.

Added

• The installer writes the brain-usage block into the agent rules files. o2b install --target <host> --apply for a target whose host reads an agent-instruction file now also writes the canonical write-gate managed block into that file at the vault root - AGENTS.md for codex, cursor, opencode and aider, GEMINI.md for gemini-cli (name-implied only, the open question the precedence table's docblock already carries) - mapped through the one HOST_INSTRUCTION_PRECEDENCE table, never a second host-to-file map; copilot-cli, grok, kiro, pi and generic install no instruction step and the plan says so with a named skip. The block body is the canonical gate-and-usage text the write-back contract audits - the same-turn atomic-fact write gate merged with the cross-project-pointer usage content - so the readiness probe grades exactly what install wrote, and a file with no block at all stays missing-block, graded skipped, not failed. Every byte goes through the shared rules-block writer, never a direct fs write: operator content outside the block is preserved byte-for-byte, the first write takes an exclusive-create backup, a re-apply is a byte no-op, and a hand-edited block refuses user-modified-block with exit 4 unless --force. The apply is bound to the approved preview - the apply re-derives the plan from the live disk and refuses preview-drift when anything the consent was shown has moved - and the instruction write rides the same consent verdict as the adapter's config writes: one prompt above both, nothing new to consent to twice. Ownership lands in <vault>/.open-second-brain/instruction-block.lock.json - per file, the block id, the begin marker and the applied time, the applied time being what makes a hand-edit refusable - and that lock is what o2b uninstall --target <name> --apply reads to remove exactly the recorded pair, never a hand-placed one; an absent pair is a named skip and the ownership entry is cleared either way.

• Operator-approved lesson promotion into the lessons block. o2b brain lessons candidates | approve <pref-id> | deny <pref-id> | refresh-blocks turns the dream pass's lessons into content the agents that read the rules files actually see, behind the operator's hand. A lesson qualifies only under the full conjunction: preference-derived (dead-end lessons never promote), the preference confirmed, the confidence band high, the lesson tier preferred in the current digest, an explicitly enabled promotion scope (lessons.promotion.scopes, env twin OPEN_SECOND_BRAIN_LESSONS_PROMOTION_SCOPES; absent or empty disables promotion entirely), and a fresh approval - the ledger pins the content hash of the text the operator approved, so the operator approves text and not an id, and a preference whose text has moved since drops from the block until it is approved again. Every non-member carries exactly one named blocked reason from a closed vocabulary with a pinned precedence, an operator denial dominating. The block body is a deterministic render - no timestamp ever appears, ordering is tier, then scope, then id, and every rendered lesson is provably one line that cannot forge a managed-block marker: a scope or id carrying a line break or a marker-shaped sequence refuses the render by name rather than being silently rewritten. approve writes through the same shared rules-block writer on its consent ladder (--apply, --yes, --force) into the named target files (--target AGENTS.md|CLAUDE.md|GEMINI.md, repeatable; defaulting to the ones that exist), and refresh-blocks re-renders existing blocks dry-run by default and never creates one. The approval ledger is machine state at <vault>/.open-second-brain/lessons-approvals.json, deliberately in the derived store and outside Brain/ so an agent cannot read its own approval state as a note surface - schema-versioned, fail-closed on damage, with the audit history in the lessons-approved, lessons-denied and lessons-promoted log events. The doctor's fail-soft, read-only readiness check grades each managed lessons block against the same derivation a refresh would render - absent, current, drifted, stale-lessons - a damaged ledger surfaces as lessons-approvals-unreadable, and every finding names the verb that heals it; the brain status snapshot carries the approval counts (approved, denied, stale) report-only, fail-soft with a generalized read error that names the doctor as the surface for the cause, because machine paths stay out of MCP output.

• Benchmark-gated skill rewrites: a skill is rewritten only under evidence. The task set lives vault-side at Brain/skill-benchmarks/<skill>/tasks.json with its frozen receipt (spec.json), and the loop runs kernel by kernel: o2b brain skill-proposals rewrite-plan <skill> verifies the task set against the receipt and prints it with the dev envelopes, the calling agent executes and submits the transcripts, and rewrite-score <skill> [--rounds-dir <dir>] grades them. Open Second Brain never calls a model - the envelopes are needs-llm-step payloads, dev members only until the single held-out check after a promote - and the scorer validates the submitted shape and grades structural predicates only, refusing a submission that carries a self-reported success field, so nothing the agent claims about its own work can move the metric. Every transcript is bound to the candidate body it was produced against: each envelope carries the candidate's sha-256, and the scorer refuses - by name - a transcript whose binding is missing or stale. Selection is the preregistered three arms, and coverage is part of the preregistration: the dev arms decide only when every dev member has a scored transcript on both arms - a short arm is not_enough_evidence, the honest outcome either way - a score for an id outside the receipt's membership is refused as what it is, and the held-out gate runs once, on the full held-out membership only, on the candidate that earned promotion; a miss downgrades it, and a refusal writes nothing, because a hold would record a verdict the one-shot check never earned and would leak which held-out tasks fail. The winning candidate stages as a scored_rewrite proposal whose acceptance is the operator's step: MCP never accepts one (a typed refusal points at the command line), the CLI accept requires --yes and re-verifies the live receipt and the scored contract at accept time, and the incumbent SKILL.md bytes are captured to a vault-side prior-content copy before the overwrite, so the accept journal's rollback restores content and not just existence; the journal parser refuses a marker whose materialized path the accept sequence cannot have produced. Modes: skill_rewrite.mode (gated, the default - one candidate per gate round; iterative - a bounded edit loop over the dev tasks, still gated before any write) and an optional skill_rewrite_judge_cmd judge that stays advisory - it never moves the tasks_passed_rate metric the gate decides on. A read-only brain_skill_rewrite_status MCP tool mirrors one skill's lane - the frozen receipt and whether it still verifies, the completed rounds' verdicts and rates, the staged rewrite's slug - ids and rates only, never task or transcript text, with an unknown skill answering as a named empty status; the skill_rewrite_eval_grade telemetry record is written once per completed gate run, and a run that stops before the gates complete writes nothing.

• ChatGPT desktop is named as a reader of the shared Codex config. ChatGPT desktop registers no MCP servers of its own; it reads the $CODEX_HOME/config.toml file the codex target writes, so one o2b install --target codex --apply serves both hosts and one o2b uninstall --target codex --apply undoes it for both. The codex adapter's merge-lane detect note - the CLI-absent lane, where an operator with only the desktop app would otherwise have no surface telling them this target is theirs - names ChatGPT desktop, the README and plugin host tables gain the row, and install/codex.md gains the ChatGPT desktop section. There is deliberately no ChatGPT install target id: a second target for one config file would claim bytes the codex target owns and report them as drift.

• Docs: docs/cli-reference.md gains the o2b brain lessons family and the rewrite-plan / rewrite-score forms on the skill-proposals row, states the instruction-block step on the install and uninstall rows and the lessons-block doctor checks on the doctor row; docs/mcp.md documents the brain_skill_rewrite_status tool; docs/observability.md names the lessons log events and the rewrite-eval metric; install/codex.md gains the ChatGPT desktop section; docs/cross-project-pointer.md names the installer as the managed way to keep the block written, with the manual snippet staying for hand-provisioned hosts; the README host tables name ChatGPT desktop.

1.97.0 - 2026-11-01

Open Second Brain 1.97.0 is the delivery-trust release: the surfaces that hand stored vault text to a remote agent now state whose words they are delivering, and the operator gains a signed way to vouch for the store state its surfaces stamp. Every MCP read that returns stored-record text - the search family, the report-shaped reads, the context and pinned-context tools and the osb:// preference, topic, active, lessons and backlinks resources - fences agent-origin or unverified text at remote reach inside the same wrapper the intake path uses, fails closed to the fence whenever provenance cannot be derived, and leaves local reads and the stored bytes untouched, with a doctor check naming the pages whose provenance nothing proves. Context receipts gain a verify face that re-hashes what a session was delivered against the vault it was drawn from, and a doctor check reports drift in recent receipts. The opencode lane closes most of its distance to the Claude Code lane: opt-in tool gating that blocks only on an explicit shim deny, and prompt-time recall, navigation and brief injection delivered exactly once per turn through the existing context hook, with a census pinning the surfaces that remain declared divergences. And the store can be signed: o2b brain attest measures the log heads and the state-surface stamps into an Ed25519-signed record under an operator-managed key - never auto-generated - with a read-only MCP mirror and a doctor check that reports stale or diverged attestations.

Added

• Tier-keyed quote fencing on remote read deliveries. Stored text that reaches a caller below local reach arrives wrapped in the explicit <untrusted_source origin="..."> fence the intake path already uses - same tag, same body neutralization, no second delimiter vocabulary - with the origin attribute naming the page's derived provenance: an untrusted_source marker, a content_class: prompt-derived class, or an origin_channel of mcp-tool or import reads agent-authored; origin_channel: cli with no other marker is the one operator-authored answer that ships plain. The derivation fails closed - a page with no stamps, the unset channel literal, or one that cannot be read resolves fenced, never trusted - because absence of a stamp is a statement about knowledge, not authorship. The fence lives inside the delivered field - snippet and content on the search family (search and expand), the report-shaped reads (query, agent query, agent diff, decisions, the claim graph's principles and the unlinked-mention contexts), brain_context and brain_pinned_context, and the osb:// preference, topic, active, lessons, digest and backlinks resources - so no output schema grows a marker field; withheld rows gain no fence and no count, and the Brain log and event bodies are the stated delivery-shaping boundary and stay verbatim. Read-time only: the fence itself never writes - local reach is byte-identical to the pre-wave bytes and the stored bytes the fence reads do not change (the one write-side change this release makes to stored bytes, the mutation channel restamp, is under Changed below). The fail-soft delivery-provenance-unknown doctor check is the widening made observable: one warning counting the delivered pages that carry no derivable provenance - the complement of what a stamp proves - naming up to five paths and counting the rest, excluding the system-rendered Brain-root pages and never naming a page the caller may not read; the remediation is stamping, which every write path already does going forward.

• Context-receipt verify: what a session was delivered, re-checked against the vault. o2b brain context-receipts verify <receipt-id> and a new verify operation on the brain_context_receipts MCP tool re-hash each item's recorded delivered-text digest against the live vault: the page is re-read, the delivery-time transforms re-applied - including the recorded per-item character budget, so an item delivered trimmed does not false-CHANGED - and each item answers match / changed / unavailable, the last with its reason (no_path, no_hash, file_missing, unreadable); a structural id, a hashless item and a pre_compress principle line are never guessed into a verdict. MATCH is a claim about delivered bytes, never liveness: a retired note verifies against its retired body. Private and redacted receipts are refused symmetrically with the session fold, the MCP face answers at local reach only with a typed refusal below it (reach, receipt_withheld), the CLI exits 1 naming the changed items, and nothing persists - no new capture machinery, the read is the product. The fail-soft receipt-content-drift doctor check rides the same kernel over a bounded recent window - the twenty most recent context receipts within thirty days - and reports one warning with per-verdict counts and the next command naming the newest drifted receipt; legacy hashless and session_inject receipts stay silent, and a window that cannot be read reaches the uncertain stream as receipt-content-drift-unmeasured rather than a clean bill.

• opencode lane parity: fail-soft tool gating and once-per-turn prompt injection. The native opencode plugin relays the opt-in pretool-orient (hook_strict_enabled) and pretool-host-backup (host_settings_backup, file-mutating tools only) shims through the host's tool.execute.before / tool.hook("execute.before") event with synthetic PreToolUse payloads carrying the opencode session id, so the vault hook-state stamps and the audit trail behave exactly as on the Claude Code lane; only an explicit structured permissionDecision: "deny" blocks the tool call, by throwing with the shim's reason - a flag that is off (which also means zero spawns), a missing binary, a spawn failure, a timeout or malformed shim output passes the call untouched. On the prompt event (chat.message / session.hook("prompt")) the plugin relays the opt-in recall-inject, nav-inject, counterparty-brief and reground-deliver shims with synthetic UserPromptSubmit payloads into a single-slot per-turn queue that the existing context delivery points drain on the first model request of the turn - exactly once per turn, so the injection ledger dedupes (recall once per session, brief on the first qualifying turn, reground's take-once cursor) exactly as on the Claude Code lane. All six flags are default-OFF, and with them off the lanes spawn nothing. A hook-parity census (tests/core/install/adapters/opencode-hook-parity.test.ts) pins the surface: every hooks/hooks.json row must be either carried by the plugin or a declared divergence with a written reason, and the declared-divergence table in install/opencode.md names the thirteen rows that stay opencode-specific with why.

• Ed25519 attestations: the operator signs the store. o2b brain attest keygen | sign | list | verify turns store verification into evidence instead of a live answer. keygen creates the operator keypair under .open-second-brain/keys/attestation/ (private half 0600, never synced; the optional passphrase arrives as an env var NAME via --passphrase-from-env or on stdin, never argv, and a lost key leaves every past attestation unverifiable); sign measures the store - the vault identity, one chain head per Brain log JSONL shard collected under the appender's own lock, a file-name inventory of every ledger directory the doctor sweeps, and the search index's recorded embedding-ABI stamp, hashed to one token because a live WAL makes raw bytes meaningless - seals and signs one attestation record, and writes it as one JSON file under .open-second-brain/attestations/; signing never creates a key. The signature covers exactly those surfaces and never raw note bytes: an out-of-band edit to an existing note's body that moves no log head, no ledger file name and no index stamp is not something an attestation can see - per-note content drift is the context-receipt verify's question. verify re-measures those surfaces against the newest attestation - per-shard intact / appended / diverged / missing, the signature, the store digest - and exits 0 with the attested state intact or legitimately appended, 1 on diverged or missing shards, an unexplained manifest drift (the vault identity or index stamp moved, an attested ledger entry is gone, a name the producer's grammar refuses, an addition to a strict directory such as Brain/preferences), a store it could not re-measure (a log lock held through the retries), or an invalid signature, 2 on usage errors; nothing here repairs a store. Post-signing ledger growth is the normal case and reads as such: a new file whose name parses under the swept directory's producer grammar and carries the kind the producer writes, and a known ledger subdirectory (a first continuity month, a first work-identity directory, a first per-preference trail), is growth rather than drift - removals, wrong kinds, non-grammar names and strict-directory additions stay drift. The MCP face is the brain_secrets split applied to signatures: a read-only brain_attestations tool mirrors list and verify and answers identically at every reach because it carries no note content, while keygen and sign have no tool surface anywhere - a key lifecycle is an operator decision, because an agent that could mint a signing key would attest nothing an operator vouches for. The fail-soft attestation-stale-or-diverged doctor check folds the facts that age badly into one warning naming the next command - the signing key gone while signed evidence exists, the newest attestation older than thirty days, a shard diverged or missing since it was signed, an unexplained manifest drift, or a signature that no longer verifies - while legitimately appended shards, a vault that never attests, and a clean fresh keyed attestation all stay silent; a store the check could not re-measure, and evidence that cannot be read, reach the uncertain stream rather than a clean bill.

• Docs: docs/cli-reference.md gains the o2b brain attest row, the verify form on the context-receipts row and the delivery-trust section naming the fenced surfaces and the two new doctor rows; docs/mcp.md documents the brain_attestations tool, the verify operation on brain_context_receipts and the fence contract on resource bodies delivered at remote reach; install/opencode.md documents tool gating, prompt-time injection, the live-verification steps and the declared-divergences table.

Changed

• A note mutation by a non-CLI lane re-stamps an inherited origin_channel: cli. Update and append operations coming from any lane other than the CLI - an MCP tool call, an import replay, an unclaimed process (stamped unset) - rewrite an inherited cli stamp to the writing lane's own channel; a CLI-lane mutation keeps the stamp, and a page with no stamp stays unstamped. Until now mutation never touched the stamp, so text an agent wrote through MCP kept shipping as plain, operator-authored cli prose from the first edit on; the restamp moves the page behind the delivery fence from that edit forward. Read roots are unchanged, and a page whose stamp already names a non-CLI lane is left alone.

• The shared frontmatter read cache refuses vault-escaping rels and folds Windows separators. readCachedFrontmatterEntry - the one seam every ownership and reachability verdict reads through - now judges the joined path's containment BEFORE any read or cache hit, so a vault-relative rel that resolves outside the vault (a traversal spelling or a caller-supplied path) fails closed to the unreadable verdict instead of opening and parsing a file beside the vault; and a rel handed to the cache with \ separators folds to its POSIX spelling where those are separators, so both spellings of one page share one cache entry and one read. Local reads that stay inside the vault are byte-identical; the refusal verdict is exactly the one every fail-open filter already handles.

1.96.0 - 2026-10-29

Open Second Brain 1.96.0 is the guarded seams and concurrent reads release: the places where other systems' text, other tools' state directories and the host's own instruction files meet the vault each state what they accept, and the stdio transport stops serializing what never needed to be. The write side gains an optional neutralization gate that escapes the structure-bearing markdown in imported third-party text at the capture and ingest seams - off by default as a deliberate operator choice, with a shadow mode that measures without writing and a read-only doctor audit naming the pages that already carry planted rows. The install side seeds a managed .gitignore block at o2b brain init so the derived state under .open-second-brain/ stays out of git, and a doctor error names every path git already tracks. The readiness probe fails a workspace whose write-back contract is installed into a file the operative host never reads. And the stdio MCP transport classifies every tool as read or write in the registry, runs reads concurrently up to four in flight, and keeps writes exclusive and arrival-ordered behind a dispatch-level gate.

Added

• Write-time markdown neutralization at the third-party seams, gated off/shadow/enforce. Third-party text that carries structure-bearing markdown - wikilinks, @osb inline markers, ```osb fence lines, ATX headings - lands in capture pages and untrusted-source ingest summaries as live vault structure: the link graph, the marker scanners and the section parsers read it as the vault's own. markdown_neutralize_mode (env OPEN_SECOND_BRAIN_MARKDOWN_NEUTRALIZE_MODE, off | shadow | enforce, default off) runs the gate at the two seams - capture writes (o2b brain capture and the capture kernel) and untrusted ingest summaries: enforce backslash-escapes the structure-bearing markdown in caller text before it is written, so no scanner treats it as the vault's own, and stamps a neutralized_markers frontmatter key naming the escaped families - a write that changes nothing adds nothing, and vault-authored sections appended after caller text are never touched; shadow leaves every write byte-identical and lets the would-be families surface through the doctor audit below; off - the default, a deliberate operator choice - runs no gate and every write stays byte-identical. The env twin wins over the config key and an invalid value is refused by name at the seam. Because capture identity hashes the persisted bytes, flipping the mode between captures of the same text yields an honest duplicate rather than a silent mutation.

• A read-only doctor audit names the pages that already carry planted rows. The o2b brain doctor pass gains the fail-soft planted-structure-rows warning: one finding counting the live structure rows third-party text planted in capture pages, untrusted-stamped pages, quarantined entity pages and source summaries, naming up to five paths and counting the rest, deduplicating Brain/pending/ staged copies against their publish targets and skipping pages the caller may not read, silent on a vault with none. Under markdown_neutralize_mode: shadow the finding appends the preview of what enforce would escape on the next capture or untrusted ingest of the same text. The audit is read-only by contract - the rows leave only by re-capturing the text with the gate in enforce or by a later repair pass - so the finding carries no o2b command.

• o2b brain init seeds a managed .gitignore block, and a doctor error names derived state git already tracks. A fresh init in a git repository now writes a managed guard block into the vault .gitignore covering /.open-second-brain/ - the derived runtime state, bench runs included - beside the identity stamp, so a fresh vault no longer leaves brain.sqlite visible to git status. The seeder merges with existing content and never clobbers a conforming block, checks exact-line membership first so an operator's own ignore line yields a skip, keeps CRLF endings, reports malformed markers as a named conflict and continues without writing, and --force never rewrites the guard block; the fresh-vault created count moves from seven to eight. The o2b brain doctor pass answers for existing vaults with the git-tracked-derived-state check: derived state under .open-second-brain/ that git actually tracks - measured by git ls-files, never inferred from status - is an ERROR naming one location-independent git -C <vault> rm -r --cached -- .open-second-brain command plus the missing /.open-second-brain/ ignore line; a present-but-unignored untracked store is a warning; the check is silent outside a git worktree, when the store directory is absent, and when git cannot answer, and it never edits anything - the ignore half is remediated by init's guard block and the untracking is git's own.

• o2b doctor --readiness fails a shadowed instruction contract. A workspace where the file the operative host reads carries no managed write-back block while another candidate file carries it has the contract installed where it never runs. The readiness probe now grades that placement as a fail from a pure resolver over the audit rows alone: per the host-to-file precedence table, claude-code reads CLAUDE.md, codex, cursor, opencode and aider read AGENTS.md, and gemini-cli reads GEMINI.md; the finding names the host, the file the host reads, the file carrying the contract and the same read-only recovery clause the per-file findings carry, and the fail census counts findings, not files. Symlinked candidates keep their refused unknown treatment, and a workspace with no instruction file at all stays skipped - nothing installed is not a contract violation.

• Parallel reads with exclusive writes on the stdio MCP transport. Read-classified tools/calls run concurrently, up to four in flight - a constant, not a knob, backpressured at the cap so the bound holds by construction - while write-classified calls run one at a time behind a dispatch-level FIFO gate and never beside a read: the loop reads no further line until a dispatched write has settled, and the write waits out the reads already in flight before it starts. The concurrency pays only where a handler awaits I/O: read handlers whose work runs synchronously between awaits (the measured SQLite, filesystem and scoring reads) finish no sooner than serialized dispatch, so a batch's total time does not shrink, its responses shift toward the end of the batch, and its first response can arrive later than arrival-order delivery would - time-to-first-response may grow - while write-classified tools still run one at a time (brain_search among them, write-classified by the write-mode-dominant rule). Every tool is classified read or write in the registry at registration - write-mode-dominant, so a tool that can write is write, decided per operation family and never from arguments at dispatch, and fail-soft telemetry appends do not make a tool write - and the classification is metadata only: it never reaches the tools/list wire payload, and a definition that arrives without one is treated as write, so it can only ever lose concurrency, never safety. Cross-request frame order is intentionally surrendered in one direction: responses may arrive out of arrival order, which is legal JSON-RPC - correlate by response id and progress by progressToken - while each request's own progress notifications all precede its response, every frame stays newline-terminated, and on EOF or drain the server still waits for every dispatched request before the process exits.

• Docs: docs/cli-reference.md documents the markdown_neutralize_mode write-side trust switch, the git-tracked-derived-state and planted-structure-rows doctor rows, the placement-shadowing failure on the doctor readiness row and the bench-runs ignore the init guard block seeds; docs/mcp.md documents the stdio request-ordering contract - concurrent reads, exclusive writes, out-of-order responses correlated by id; docs/observability.md names the guard block behind the bench-runs path.

Fixed

• Backslash-escaped wikilink brackets no longer produce links. The link readers (extractWikilinks, the backlink body walker, the page lint's link targets, the merged-link convergence and the Sources-section reader) now hold a [[ or ]] preceded by an odd backslash run to the same rule the write-time neutralizer's detector applies - escaped punctuation is literal text and opens or closes no link - so the escape-aware detection grammar and the readers that consume it answer with one truth, and the same shared helper serves both. Every link-graph input (backlinks, co-occurrence, portability, entity links, doctor checks) and the planted-rows audit inherit the rule.

• Digest maintenance actions now honor agent scope. The actions list in view: digest is collected vault-wide, and its rows were filtered by transport reach alone, so a caller delivering the digest under agent_scope could receive maintenance rows naming preferences the sections beside them had already withheld. The enforced ownership rule now joins the reach view for the actions rows - the same judgment brain_doctor's suggested_actions and the operator summary's top_actions already apply - and osb://digest/latest threads its resolved scope into the render the way osb://preferences/active does. Without integrity.owner_scope_delivery: fail, or with no scope requested, every output is byte-identical.

• The brief views and the digest's dream-parsed rows honor the enforced owner scope at every reach. The daily and weekly envelopes judged their rows by transport reach alone and stepped past the ownership rule at local reach, so under integrity.owner_scope_delivery: fail a caller with a resolved identity could receive another owner's preference ids, transition reasons and source pointers from status_transitions, retired and contradictions; those rows are now kept through the same enforced-rule view the digest's actions use, with the counts recomputed from the same selection. The digest's confidence-shift and contradiction rows - parsed from dream log lines whose preference id the log-level filter cannot resolve - are kept through the same view. And a caller the enforced scope narrows now takes no report snapshot and is shown no delta, since a per-caller render must not land under the shared date key for the next caller's delta to be diffed against. view=monthly, view=today and the operator summary were already scoped and are pinned by regression rows; without the gate, or under warn, every output is byte-identical.

1.95.0 - 2026-10-27

Open Second Brain 1.95.0 is the verified delivery and honest write surfaces release: every surface that hands an agent context or writes on its behalf now states what it actually did - what was trimmed from a delivered pack, what was injected and never consulted by the answer, what a privacy reservation held back from an export, what failed part way through a multi-artifact write and how to finish it. The delivery side gains an opt-in score-aware tail trim that names every drop and offers the freed budget back by priority, and a reply-presence receipt that joins what a session injected to what its answer verifiably used. The capture side keeps its failures recoverable - the dead-letter record freezes the payload it failed on and one command re-runs it - and gains a standalone commit-blocking validation gate for writers no hook reaches. The organization side moves whole folders under the same occupancy-checked, failure-naming discipline the file surface set, every shared export names the pages a privacy reservation held back, and the operator surfaces state exactly what they can and cannot measure: the search writer lock reads held, free, or unknown - never a guessed free - and the doctor's client-version probe reports what it could not read instead of failing the machine.

Added

• Score-aware tail trim for delivered context-pack evidence. With tail_trim_context_pack: "true" in the machine-local main config (or the env override OPEN_SECOND_BRAIN_TAIL_TRIM_CONTEXT_PACK; default off), brain_context_pack - MCP only; the o2b brain context-pack verb never reads the gate - runs one score-aware trim over the unified tier-and-budget walk whenever the call carries a query: the top three delivered items are immune, any later item whose query-term coverage - the fraction of the query's tokens it carries - is at least 0.8 of the top delivered score is kept - it restates the question's terms nearly as fully as the top hit - and the rest drop whole with a tail-trim skip reason, never partially re-cut. The freed budget is then offered back to over-budget candidates in priority order, the only path by which a page can cross tiers, spending the tokens the trim freed and no more, and never reordering or dropping the synthesized attention item. The response carries a conditional tail_trim block (dropped, kept_by_query_terms, rescued, tokens_saved) only when the trim actually ran, counted over the items that actually ship; the same four counters ride the context_receipt's budget block and the context_pack telemetry record's metadata, and each dropped item's skip reason surfaces as the telemetry gap tail_trim. With the key off - the default - packs are byte-identical, and the packing_policy branch never trims.

• Reply-presence receipts join what was injected to what the answer used. The answer-quote-check Stop hook now folds one session-keyed reply_presence continuity record per checked turn, beside the annotation it already wrote: a verdict per injected note - verified when a reply span checked out against it, the strongest miss verdict otherwise, and absent for a note that was injected into context but that no reply span was ever measured against, the row this record exists to surface; a span that verifies records only the note that carries it, so an uncited span's other candidates are never named by a verdict that is not theirs. Exactly one record per checked turn, written even when every span verified, and only when the turn had injected candidates at all; the payload carries identifiers, the per-note verdicts, the reply-span count and a hash binding the verdicts to the exact answer text checked - never the answer text itself. The verdict vocabulary gains a sixth member, absent, which is per-note presence only: every span still gets one of the five original verdicts, so a consumer reading per-span outcomes never sees it. The receipt read surfaces join on it: o2b brain context-receipts show and the MCP brain_context_receipts show answer with a join matched by exact session_id and folded over every presence record the session wrote at or after the receipt's own creation, chronologically, with verified winning across turns - absent never upgrades or downgrades one - and the folded rows restricted to the notes the receipt itself injected; a receipt with no readable record in that window names the unjoined outcome honestly, saying which of the two it was: a receipt that names no session at all, or one whose session wrote no record at or after it. list stays a summary.

• session_inject receipts carry the session key. The SessionStart active-inject receipt records the payload's real session id as its session_id member - the join key the reply-presence read matches on - and stays absent when the host sent nothing real, never invented. Receipts written before this release carry no key and read as unjoined, which is what they are.

• Privacy-marker denials are named in every shared export. A preference the privacy deny markers reserve (visibility: private, or an informal marker saying the same) now leaves the o2b brain export json and llms-txt preference dumps and the o2b brain bank-export bundle before their bytes are composed, is blocked by the knowledge pack's selection step beside the existing visibility and owner blocks, and is withheld from the static o2b brain explorer --export HTML too: the export narrows its graph by the same denial judgment over its preference and retired nodes, the node count answers for what was actually written, and the same stderr notice names what stayed out - while the live server, the operator's own view, keeps every node. Every lane names what it held back: the json envelope carries an omitted field and the bundle a preferences_omitted report (the pack names the page in its blocked list), the stderr notice names each denied row with the frontmatter key that denied it (denied_by: visibility, access, confidentiality or sensitivity), and every field is absent when nothing was denied - a vault with no reservations produces byte-identical output, so a smaller export is never a silent one. bank-export --include-reserved is the one override for the reservation itself, for this verb's documented purpose - the one-file personal backup - and carries the reserved rows into the bundle whole, with an inclusion notice naming each carried row and the flag where the denial notice would have been; the default run is unchanged. And the SDK facade carries exportPreferencesLlmsTxtDetailed beside its string-only form, returning the same text beside the omission report the json envelope names, so an in-process caller no longer watches reserved rows leave the text silently; the string form is deprecated and keeps its exact bytes.

• o2b brain dead-letters: the failed extraction write gets an exit. A multi-artifact extraction write that failed part way already left a durable dead-letter record; the letters were write-only. The dead-letter schema moves to v2 and freezes the failing payload into the letter, so what the write meant to land survives the failure - each frozen item redacted at freeze time by the same redaction the write path runs, with the raw-text dedup hash stored beside it so a recovery still dedups against the original identity, and list --json rows carrying only has_payload, so the bulk surface agents and cron logs read never prints a payload (show --json keeps the frozen items for the operator's one-letter read); v1 letters (written before the payload was frozen) parse unchanged and classify re-extract. The new verb lists every letter with its classification - recover (the session is still capture-classified with undelivered missing items), pending (the items sit staged in the write-approval queue), re-extract, not_recoverable, resolved (every missing key exists on disk) - and the exact copy-paste command that resolves it; a letter whose every undelivered item the durability gate will never accept classifies not_recoverable before any command promises a re-run, with the gate and its denial named. show <id> prints one letter in full, missing keys and frozen payload named; recover <id> re-runs a schema-2 letter's frozen payload through the extraction commit at CURRENT vault state, where a v2 item counts as delivered on its stored hash or - the v1 topic measure, extended to v2 - when the session already holds a signal page on its topic, and a topic-delivered item is left out of the plan and the apply entirely, so a re-extract's reworded text is never replayed as a second signal while already-written items still dedup away. Recover is dry-run by default and previews the per-item verdicts; --apply performs the re-run and requires --yes under --json or a non-TTY stdin, and an apply that comes back with nothing written and nothing staged exits 1 naming the accounting instead of printing a green zero-write success; a frozen vault refuses and an unknown id is a usage error. NOTHING here deletes a letter: a recovered letter is retained, and removing it stays an operator's hand action on the named file.

• o2b brain validate: a standalone, commit-blocking validation gate for hook-less writers. A writer with no hook harness had no way to block its own commit - brain lint always exits 0. The new gate runs the exact write-receipt page lint over exactly one caller-named page set - --paths <path> (vault-relative, repeatable, one flag per page) or --dirty (every git-dirty Markdown note: modified, added and untracked) - and nothing else, so it is safe inside any gate. The exit code is the product, byte-for-byte the doctor contract: an error finding exits 1, warnings exit 2 under --strict, a named page the lint could not read exits 1, clean exits 0; a vault that is not inside a git worktree - or that its enclosing repository ignores, where git cannot measure dirt at all - refuses --dirty with exit 2 naming --paths as the remedy, and giving neither or both selectors is a usage error. Report-only: the fixes stay with brain doctor --repair --apply and brain lint --consolidate --apply, which every finding's next_command names.

• Whole-folder move and rename on the note-lifecycle surface. o2b brain note-lifecycle move-folder relocates a whole folder under a destination parent and rename-folder renames it within its parent - split for the same reason the file rename and move are split, so a caller that meant one and spells the other is refused wrong_action rather than moved by accident - and the MCP brain_note_lifecycle tool accepts both through the same action enum. The folder surface mirrors the file envelope rung for rung (vault-relative, no traversal, the Brain/ machinery root refused, the vault-identity write guard) minus the .md requirement, and every destination is checked free BEFORE the first rename - the closest thing to atomicity the operation honestly has - so an occupied destination refuses with nothing moved and the source untouched. The move set is the folder's Markdown only, judged by where a file really lives: a symlinked directory or note under the source is excluded and named in the receipt's residue instead of being pulled into the move or hard-linked into a dangling name, a source reached through an alias moves under its real name, and the destination-inside-source guard compares real paths, so an alias of the source is refused as nesting rather than linked into itself. The rename-intent reading applies only when the named destination directory does not exist - an existing sibling folder is a real move target, movable in one call. Because a folder move never changes a basename, the move set's inbound path-spelled wikilinks are rewritten in one pass over the successfully moved set, to the minimal spelling that still resolves; bare-basename links are untouched and keep resolving, and the receipt names the settled cost of a Markdown-only move: what stayed behind in the source folder (left_behind, absent when the folder emptied) and, per moved note, the relative Markdown links and images whose targets stayed behind (dangling_relative_links, absent when nothing dangles), so a zero rewrite count never reads as nothing broke. There is no rollback, on purpose and by name: a mid-set failure is named per file in moveFailures with the pairs computed from what actually moved, never a silently shorter move. Dry-run is the default.

• The operator surfaces state what they measure about the store and the clients. o2b brain status gains a store group: the search writer lock's three-state read - held (a live writer holds it, with its age), free (no live holder at the instant of the read), unknown (the probe could not be taken, with the reason) - a state that could not be measured is never rendered as free; thisCaller: "read-only" states the snapshot's own standing, and while a lock is held the line scopes its refusal warning to the writes the lock gates - an index write (o2b search index / reindex) would refuse with INDEX_LOCKED, while vault and memory writes serialize on the brain lane's own lock files and are not gated by it; and writerLockOwner is null while a lock is held because the lock record carries no identity - a measurement, not an omission, and the renderer says so. A held lock is informational and never flips the snapshot unhealthy, and the MCP brain_status withholds the resolved lock path below local reach while keeping every state field. o2b doctor --readiness gains the client_versions probe: each detected agent client is asked its version through its own version argv under the per-probe timeout, one row per target - pass with the raw first stdout line, unknown naming why (a thrown runner, a non-zero exit, a timeout, empty stdout), or skipped when the target has no version command. The ask settles on the child's own exit rather than on stdout closing, so a forked helper that inherits the pipe cannot turn an answered version into a timeout, and a client that outlives the cut is SIGKILLed after the TERM grace, so nothing the probe spawned outlives doctor. An all-unknown probe keeps doctor at exit 6, never 1, because a version it cannot read proves nothing broken.

• Docs: docs/cli-reference.md gains the o2b brain dead-letters and o2b brain validate rows, the move-folder/rename-folder actions on the note-lifecycle row, the tail trim on the context-pack row, the reply-presence join on the context-receipts row, the denial naming on the export and bank-export rows, the store group on the brain status row and the client_versions probe on the doctor row; docs/mcp.md documents the tail_trim block on brain_context_pack, the reply_presence join on brain_context_receipts show, the folder actions on brain_note_lifecycle, the brain_status store group and the CLI-only validate/dead-letters pointer for hook-less agents; docs/observability.md states the tail-trim telemetry counters; docs/how-it-works.md describes the trim engine; hooks/README.md documents the reply-presence record on the Stop row, the session key on the SessionStart receipt and the transcript-availability caveat; the CLI help surfaces (command manifest and o2b brain --help) name the folder actions.

1.94.0 - 2026-10-26

Open Second Brain 1.94.0 gives the continuity ledger its intended readback path. The Hermes provider's native memory writes have been mirrored into the ledger as durable, attributable records for some time, but the ledger was write-only for recall purposes: a fact the host wrote could be exported for audit and never recalled by the memory system itself. The new o2b brain continuity promote verb turns those records into ordinary preference pages, dry-run by default and sealed by an approval digest on apply, so a mirrored fact becomes recallable only through a review that says exactly what will land. The ledger itself stays write-only audit substrate, and the full-fidelity export keeps its job.

Added

• Mirrored host memory writes become recallable through an explicit, reviewable promotion verb. The Hermes provider's native memory writes are mirrored by the on_memory_write bridge into the continuity ledger as host_memory_write records (Brain/log/continuity/<YYYY-MM>[.<deviceId>].jsonl), and until now the only readback was the full-fidelity brain continuity export, because the ledger is write-only to the rest of the memory system: the search index admits only Markdown pages, the session grep keeps only session kinds, and the context pack reads the preferences and retired lanes only. o2b brain continuity promote (the documented answer to GitHub issue #277) renders each host_memory_write record as a preference page under Brain/preferences/pref-hostmem-<record-id12>.md, deterministic per record id, so the mirrored fact becomes ordinarily recallable - page search finds it, and the context pack and its confirm flow treat it like any imported host memory. The verb is dry-run by default: it prints the plan - create, update, recreate, skip-unchanged or conflict per record, skips named with reasons, private records dropped and counted, redacted records promoted in masked form and counted - plus a plan digest. A malformed ledger row (a non-canonical createdAt or record id) skips by name and never aborts the run, records with identical content promote once and their later duplicates skip by name, and every record is re-scanned at promotion time under the export door's strict redaction grade - vendor tokens, bare high-entropy tokens, URL credentials - so the masked text is what lands and a credential a host wrote into its memory cannot reach the search index or the context pack through promote. --apply writes: an --approval-digest <hex> mismatch refuses with nothing written and no snapshot, mirroring the approval semantics of o2b brain import-claude-memory; a matching digest takes a snapshot, writes the pages atomically, records the promotion manifest (Brain/.imports/host-memory-promotions.json, rewritten only when something was actually applied) and appends a log event, while an interactive apply without a digest lands the current plan and a non-interactive apply must carry the digest; a corrupt promotion manifest is reported by the dry run (manifest_corrupt: true under --json) and refuses every apply until the operator reconciles the file, and a conflict - a pref-hostmem-* page the promotion manifest does not record, left behind by another writer or by a lost manifest, not an edit to a landed page, which is kept and plans skip-unchanged - throws after the safe writes land and exits 2. Pages land under the trial window (dream.unconfirmed_window_days): promoted pages start unconfirmed and are confirmed like any other preference, so a poisoned host write never becomes a live rule just by being promoted. --month YYYY-MM narrows the source window to one ledger month. No supersession is inferred: a replace record promotes as its own page beside the one it superseded, because the ledger never says which record replaced which, and reconciling the pair is the confirm flow's job. The ledger itself stays write-only audit substrate, and the division of labor between the two verbs stays clean: brain continuity export answers "what happened", promote answers "make it recallable".

1.93.0 - 2026-10-23

Open Second Brain 1.93.0 closes the gap between what a configuration promises and what the model, the filesystem and the package manager actually do. The chunker now charges a long whitespace-free run such as a URL at a conservative token rate and splits it across chunks, so the declared budget bounds what the embedding model really receives. Retirement provenance lands in the log shard the device actually writes, so a fresh retirement no longer reads as a broken link. The decision model tries providers in a configured order with automatic fallback inside the existing budgets, and per-model enforce thresholds move out of the source tree into the installation, keyed by the model id the server reports and kept for every model ever tuned. The launchers repair a checkout that a Codex marketplace add or upgrade strips, so the documented install path starts the CLI. The release also closes all twenty-seven findings of the previous release's external review, among them two paths that let marker-private content leave the vault, a quadratic regex on the synchronous write path, a hold rule that withheld fitting chunks from embedding, and a ranking rule that let one entity match outrank higher-scoring results.

Fixed

• Chunks fit the model window when a page is one long URL. The token estimator counted any whitespace-free run as one word, so a page holding a single long link produced a chunk declared at 4 tokens that the embedding model reads as more than 1,700 - past its 512-token input window, where the serving stack silently truncated it. A whitespace-free run of 16 characters or more is now charged one token per 3 characters, and the splitter cuts inside such a run, so the text is distributed across chunks that each fit the budget and every character stays indexed. Reducing search_chunk_size therefore works for link-heavy pages, and the chunker version moves to 3, which schedules a one-time re-chunk of the index.

• Retirement provenance names the log shard the device writes. A merge retirement, a dream retirement and brain reject stamped retired_by: [[Brain/log/<date>]] while the log appender - for a vault with a configured device_id - writes Brain/log/<date>.<device>.md, so the doctor reported every fresh retirement as a broken link. All three now build the link through one helper that resolves the same shard id the appender resolves: sharded when a device id is configured, byte-identical to the historical shape when not. Historical records are untouched.

• A Codex marketplace add or upgrade leaves a launcher that starts. The marketplace flow replaces the checkout wholesale and takes node_modules with it, so the first launcher command died importing proper-lockfile before install-cli could repair anything. The bun launchers - o2b, o2b-mcp, o2b-aider, vault-log and their Windows twins - now probe for the dependency tree with one file stat and run bun install --frozen-lockfile once when it is missing, refusing with the manual command named if that install fails; a warm checkout pays nothing. A cold-checkout regression drives the real entry point end to end.

• A page carrying an informal privacy marker is now withheld at every egress, not only at the remote read roots. The decision-model gates - rerank, recall injection, label suggestions and advisories - and the shared knowledge-pack export treat a marker page exactly like a formally reserved one, a marker-private source's ingest summary is stamped reserved before its derived sections can copy its rows, and marker keys match case-insensitively, so an imported Access: private reserves like access: private. Existing search indexes re-measure the indexed visibility column of marker pages on upgrade (schema v16). The update_note guard refuses a marker-key write only when it would clear or forge the page's deny status - access: read-only and a public to team move are writable again - and brain privacy-marker-restamp now says that a stamped page also leaves default-scope local search and how to reach it again.

• Chunks are held out of embedding only when even a conservative lower-bound estimate puts them over the declared window. The hold trigger was an average-rate estimate, so ordinary English chunks that fit the model's window were held and never embedded. Chunks merely estimated over the window are embedded again and reported in the undecided band, search check no longer recommends a vector backfill for chunks that are held, a declined embedding provider is reported as decided instead of not-configured, decline refusals name only the keys that recorded the decline, and o2b doctor --readiness reports an unreadable consent record as unknown and lists registered-provider and rerank credential variables by name. The decline this feature covers is the embedding provider's; rerank and decision-model endpoints keep their own settings' declines, recorded as follow-up work.

• Entity ranking can no longer let a single entity match outrank higher-scoring results. The declared-over-derived rule now breaks only exact score ties, so a keyword-strong chunk stays first and a weak entity hit does not jump ahead. The usual spellings A. Lovelace and Lovelace, Ada resolve, short operator nicknames like al resolve (with the doctor naming any entry it still skips), a derived form that reaches two people is reported as ambiguous with its own remedy instead of silently expanding to both, and the nickname-derived index is built once per vault change, which turns the doctor's entity scan from seconds to milliseconds at five thousand people.

• The undated-quantity detector no longer stalls the write path and no longer fires on non-claims. A comma-joined digit run used to backtrack quadratically - about forty-five seconds on a 256 KiB body, on the synchronous write-receipt path; the scan is now linear. Numbers inside URLs, markdown link destinations and wikilink targets, dates inside code regions, and dimension spellings like 3D are no longer reported as undated claims, a date silences a page's quantities only where claims can stand, and the finding's offset now states that it is counted after frontmatter.

• The default OKF export no longer contradicts its own omissions. The export's log no longer carries entries the agent wrote over the MCP channel or entries naming the pages the class split left out, and kept pages' structured links, relations and citations to a left-out page - in the OKF manifest, the graph export, the bank bundle and the knowledge pack - are dropped and counted, with --include-prompt-derived carrying all of it back. Source summaries ingested over MCP are now stamped content_class: prompt-derived themselves.

Added

• Ordered decision-model providers with fallback, and per-model thresholds in the installation. decision_model_providers accepts an ordered list, with the single decision_model_provider kept as the one-entry form: the first provider that answers serves the call, a connection error or timeout falls through to the next entry within the same budget, and every decision_model_call record names the provider and model that actually answered, so reports never pool two models. o2b decision-model check shows the order and which entries answer. Per-model enforce thresholds move from the compiled DECISION_THRESHOLD_PROFILES table - now the hosted baseline family only - into decision-thresholds.json beside config.yaml, keyed by the model id the server reports rather than the provider preset, with the entries of every model ever tuned kept across switches and an optional per-vault override. A use with no stored thresholds for the active model runs as shadow and check/report say so explicitly, naming the tuning command; o2b decision-model thresholds fit --use <use> derives the threshold from the use's labelled report data against a false-action target and writes it for the answering model, and thresholds list / thresholds set round the flow out. Docs: docs/decision-models.md and docs/decision-models/providers.md.

1.92.0 - 2026-10-22

Open Second Brain 1.92.0 makes the write path and the egress path keep promises the rest of the system already made. Informal privacy markers in frontmatter - access: private, confidentiality: secret, sensitivity: confidential - now resolve to the reserved remote-deny token at every remote read root, and a preview-first verb stamps the formal token onto the pages that only ever carried the informal spelling. Chunks the declared embedding window cannot hold are held out of embedding under a persistent record instead of being truncated and indexed as something shorter, with the hold reported and released when its premise moves. People resolve through derived name forms - first initial plus surname, word order, and operator-supplied nicknames - while declared spellings keep precedence and ambiguity is reported rather than guessed. A fifth page-lint detector asks a count or an amount for its date, prompt-driven writes carry a server-stamped content class that shared exports honor by default, and a provider decline is a persisted decision honored before any network call. Review of the release closed four defects, among them an OKF bundle that left out its own reserved root files.

Fixed

• An OKF bundle carries its reserved root files, and an index that agrees with the manifest. o2b brain okf-export composes its bundle from the pages the content-class split kept, and index.md and log.md were not reaching the written directory, so a bundle arrived without the two files the rest of its layout assumes. Both now ride every bundle. The index is re-rendered from the filtered manifest by the same renderer the builder uses rather than copied from the source vault, so a page the export excluded is named neither in okf.json nor in index.md - an index listing pages the shipped manifest does not carry would make the bundle disagree with itself - and log.md stays whole, because its entries are day-keyed events rather than page content, while still passing the same scan as every page file.

• The relational arm reads the indexed visibility column at remote reach before it names a candidate. A remote answer from the relational arm joined its candidates through the page index and resolved them against the vault, leaving a window in which a page whose remote reservation had just been lifted could still be named from rows the previous index pass had written. The arm now consults the indexed visibility column at remote reach, so the answer holds at the joined view rather than at one of its two sources, and a page readable at local reach is unaffected.

• The undated-quantity exclusion scan is order-independent. The scan now settles its exclusions over the page as a whole before it reports, so the findings depend on what the page contains rather than on the order its regions were visited, and the same bytes yield the same findings on every run.

• A research report page now carries the prompt-derived class stamp. The write path applies it at creation beside the rest of the report's frontmatter, and the byte-identity fixture is updated to the stamped shape as the only byte change. A report page therefore reads as prompt-derived to the shared exports, and the report lane's output is subject to the same default exclusion as a session import or an MCP note write.

Added

• Informal privacy markers resolve to the reserved remote-deny token at every remote read root, and a preview-first verb writes the reservation the pages never carried. A page that says access: private, confidentiality: secret or sensitivity: confidential was already withheld from a remote caller, but every consumer that reads visibility: directly - a derived page stamped through the strictest-visibility fold, an export filtering on the token, an operator auditing reservations - could not see the claim. The three markers now resolve to the reserved token at every remote read root: search results, vault page lists and the indexed snippet column answer the same deny the formal key would. o2b brain privacy-marker-restamp makes the claim formal - dry run by default, --apply to write - unioning the token into visibility: additively and idempotently, re-reading each candidate immediately before its write so an edit that landed in between is honored, refusing by name (in the verb's skipped list) a page whose frontmatter cannot be rewritten losslessly instead of quietly absorbing it into a lower updated count, never removing a token and never re-embedding, with the write guard asserted at the applying entry point only. A doctor finding counts the marker pages that are still unstamped, and update_note refuses changes to the three marker keys exactly as it refuses changes to the reserved visibility key, so the informal spelling cannot be removed from a page whose reservation depends on it.

• A chunk that cannot fit the embedding model's declared input window is held out of embedding instead of silently truncated, under a record that says why. The serving stack used to cut such a chunk to the window, so the index held an embedding of text the page does not contain, with nothing on any surface saying so. A chunk provably over the declared window is now skipped and recorded under a persistent hold keyed by the model, the window and the chunk signature, so the same chunk under the same configuration stays held without re-deciding, and the record is released automatically when the model, the window or the signature changes - a moved premise reconsiders, a static one stays quiet. A held chunk is excluded from the pending-vectors census, so no backfill is recommended for text this configuration cannot embed, and the estimator's undecided band is reported rather than resolved to one side. o2b search status --json carries a bounded held_chunks report - position-ordered, capped at 20 with the whole named by total, present only while the active configuration holds something - and a doctor check counts the holds, so the state is visible without reading the index.

• Person entities resolve through derived name forms, with a declared spelling always outranking a derived one and ambiguity reported instead of guessed. Two derivation families join the resolver: forms computed from a declared name - a first-initial-plus-surname spelling, and the word-order variants of a multi-part name - and operator-supplied nicknames read from Brain/entities/person-nicknames.json; nothing ships a built-in word list, so a nickname exists only because the operator wrote it. The forms answer in query expansion and in registry lookups, and ranking is explicit: a match on a declared name or alias outranks a match that only a derived form reaches, so a derived form can widen recall but never displace the spelling the vault declares. Ambiguity is reported rather than resolved - a derived form that matches more than one person refuses and names the competing ids - write lanes stay exact-only, and a doctor warning names a derived variant that collides with another person's declared name.

• A fifth write-time page-lint detector warns when a count or an amount is written with no date it could come from. The recognized shapes are structural, never natural language: a currency amount by symbol or ISO code, a percentage, a number with a unit from the declared set, and a bare thousands-separated count. A page that supplies a date anywhere the quantity could take one stays quiet - a valid_from boundary in frontmatter, any ISO date in the body, or a [Source: <name>, YYYY-MM-DD] citation marker - and the finding carries the matched lexeme and its offset, never the authored line, so a receipt cannot repeat prose the caller did not ask it to carry. Each finding names o2b brain claims as the next command, where the quantity can be placed in time.

• Prompt-driven writes now carry a server-stamped content_class: prompt-derived, and every shared export leaves those pages out by default. The stamp lands at creation on the deterministic prompt-driven paths - a note write that arrives over MCP, the session import, and the in-process report writers - and it is derived by the writer rather than accepted from the caller: a caller-supplied value is dropped, an operator-authored CLI write stays unmarked, and no path removes the stamp afterwards. The shared exports - bank, graph, OKF and knowledge packs - exclude class-marked pages by default and name every omission with the page's path and class, so a smaller export is never a silent one; the bank, graph and OKF verbs and the transcript export (o2b brain export --format transcripts-jsonl) take --include-prompt-derived, which carries the pages back in and says so on the run, while the knowledge pack always blocks class-marked pages and names them in its blocked list. Pages written before this release carry no mark and export exactly as they did; that era boundary is documented in docs/cli-reference.md and SECURITY.md rather than migrated, because a stamp applied by a later pass would describe the pass and not the writer.

• A provider decline is a persisted, fail-closed record honored before any network call. search_semantic_enabled=false and embedding_provider=disabled used to reach the same capability verdict as a machine that had never configured semantic search at all, so the two situations were indistinguishable to every surface that asked. A decline written in the configuration is now read as a record of its own, distinct from never-configured, and it is fail-closed: an unreadable or unparseable record is a decline, not consent. The decline is honored at provider construction, before a request is built, and the refusal names the keys that record it and the keys that would re-enable the provider. o2b doctor --readiness gains a consent probe that reports the decline as a decision rather than a fault, and lists the provider environment variables it found by NAME only, never by value. Beside the record, a new egress consent-stamp primitive ships with a presence-based kill switch, OPEN_SECOND_BRAIN_EGRESS_CONSENT_KILL; it declares no destination of its own, adds no egress registry row, and leaves every network path in this release unchanged.

1.91.0 - 2026-10-21

Open Second Brain 1.91.0 turns one-off promises into first-class memory. A promise made in prose becomes a pledge page under Brain/pledges/ - title, promise text, due date, the source page it was read from, and evidence quotes the kernel verified against that source at write time - with direct CRUD and a validate-everything-first extraction intake over MCP, a pledges section on the today dashboard, and two delivery surfaces for the moment of need: an opt-in context-pack rollup that groups what a query's entities already kept, and an opt-in counterparty brief that hands the agent at most three shareable facts about the person a prompt names, once per session. Both delivery surfaces are off by default and byte-identical when off, and nothing in the release calls a model.

Changed

• The today dashboard and brain_brief view="today" carry their new section additively. The rendered dashboard gains a ## Pledges block between obligations and open loops and the totals lines Pledges: and Pledges overdue:; the --json envelopes gain pledgesTotal and pledgesOverdue inside totals, and the brain_brief view="today" response gains a pledges member beside obligations. No existing key changed value or moved, and a pledge page the caller may not read drops from the section before totals are derived, identical to absent.

Added

• One-off pledge pages with evidence verified at write time. A pledge lives at Brain/pledges/<slug>.md with bare frontmatter - title, created_at, due, source, evidence, promised_to, fulfilled, agent - and the kernel refuses by name what would make one hollow: an empty evidence list, a source page the vault does not hold, and any quote that does not occur in the cited source (containment through the shared quote-span comparators, so a stored quote is one the source contained when the pledge was written; there is no unverified-evidence lane and no leniency knob - the agent re-quotes verbatim). fulfill stamps the fulfillment date once and a second stamp refuses; list sorts by due then slug with an overdue flag and whole days until due, open pledges only; remove retires the page into Brain/pledges/archive/ with a collision suffix, the obligations pattern. Counterparties ride the promised_to frontmatter key, a new promised_to relation token in the shared vocabulary, so the existing frontmatter-relations ingest projects the typed edges and search admits the new directory automatically - the page family adds no projection code of its own.

• brain_pledge and brain_intake_pledges. The first is direct CRUD over the family - add, fulfill, list, show, remove - mirroring the brain_obligation operation shape, with schemas that reject unknown properties and answers that carry the page path; the second is the extraction intake, where the agent posts typed pledge extractions (title, due, evidence quotes, optional text and counterparty names) citing one source page. The intake validates EVERY item before writing anything - source readability at the caller's reach, quote containment, valid dates - so a batch with one invalid item writes no page, and commits idempotently: a repeat with the same payload is a reported no-op, the same identity with a changed payload is a named mismatch refusal. Counterparty names are anchored server-side against canonical-scope entities and never trusted from the caller; a name that anchors nowhere is reported and stored nowhere - the pledge exists without edges rather than with fake ones - and re-posting the same payload after the entity registers adds the edge. The kernel never calls a model. Both tools answer at the caller's reach: below local reach a withheld pledge page reads exactly as an absent one.

• A pledges section on the today dashboard. o2b brain today and brain_brief view="today" now surface due-sorted open pledges beside obligations and open loops - title, slug, due date, and due today / due in N days / overdue by N days - inside the dashboard's fault isolation, so a failing pledges section reports an explicit error line and the rest of the dashboard still renders; an empty vault renders an empty section with no error. The section rides the same reach predicate as the obligations rows: a pledge page the caller may not read drops before anything counts it, so below local reach neither its text nor its totals cross. (See Changed for the additive envelope members.)

• An opt-in entity_facts section on brain_context_pack, a rollup over work the pack already did. With entity_facts_context_pack: "true" (machine-local config, or env OPEN_SECOND_BRAIN_ENTITY_FACTS_CONTEXT_PACK; default off), the pack response gains entity_facts: the canonical-scope entities anchored from the pack query, capped at three, each listing only the ids of candidates the pack already kept whose bodies anchor it - never a second recall lane, never an id the budget or the view dropped. An entity page that fails the caller's view is treated as absent, so a withheld entity never surfaces its rollup; entities sort by id and item ids follow the pack's own order. With the key off, every default pack is byte-identical and the other consumers of the same core are untouched.

• An opt-in counterparty brief at the moment of need, once per session. With counterparty_brief_enabled: "true" (machine-local config, or env OPEN_SECOND_BRAIN_COUNTERPARTY_BRIEF_ENABLED; default off) and a non-empty operator-declared counterparty_brief_triggers vocabulary (a comma-separated machine-local list key in the operator's own language; nothing ships a built-in word list, and an absent or malformed list keeps the brief inert), a UserPromptSubmit hook reads the submitted prompt and injects one dated brief about the counterparty it names: at most three shareable items - open pledges promised to that entity first, then recent non-private preference pages whose bodies anchor the entity - each carrying its source path. The gates are conjunctive and fail closed: at least one trigger token must occur in the prompt, exactly one canonical-scope entity must match by name or alias (zero or several matches abstain), it must be the session's first qualifying prompt (the injection ledger suppresses repeats; no real session id means no emission and no ledger write), and a page whose visibility carries the reserved private token never surfaces whatever the caller's reach, with items derived from several sources inheriting the strictest visibility. The known limit is disclosed, not claimed closed: a readable page may name a private page, and no per-page gate rewrites prose. Flag off keeps the hook's stdout byte-identical to an install without it.

1.90.0 - 2026-10-20

Open Second Brain 1.90.0 turns the dream pass into a rule promoter, teaches every context budget to read the host model's window instead of guessing it, and makes two benchmarks honest about what they measure. The dream pass can promote one recurring cross-topic rule per owner per day out of confirmed preferences that state the same principle in different topics, behind an opt-in config block whose absence changes nothing. Context packs, preset suggestions, pre-compress guidance and the anticipatory cache resolve their token budgets from a model-aware window resolver - operator declarations first, then a published exact-id table, then a trailing -1m suffix, then the 200,000-token default - and each surface discloses which channel decided. The decision model gains a preregistered per-use eval with a measured promotion gate: a promote verdict writes a machine-side tuning mark, fail-closed against the spec hash, the fixture hash and the pinned thresholds, and only a valid mark moves a shadow-only use to enforce. Search names how far behind a stale index actually is - a measured document count on the index-stale degradation and a new index_behind line in search status - and the memory bench refuses, by name and before any state is created or any score published, every damaged pre-run and pre-report state it used to fail late on or silently reset. The search query language ships as a versioned JSON Schema artifact with export and check verbs, and a wikilink's spelling stops reading as ambiguous because an out-of-scope twin shares its basename.

Fixed

• A wikilink's spelling stops reading as ambiguous because an out-of-scope twin shares its basename. Bridge discovery's basename census counted every vault page carrying the name, whatever the operator's scope rules say about it, so a note under an ignored directory - an ignore_paths entry, a frozen default ignore the narrow walk does not know, or outside the include_paths allowlist - forced the full-path spelling onto links to a uniquely-named in-scope target, and a bare [[basename]] resolved to neither. The census now resolves the vault scope once and skips pages whose vault-relative path fails it, beside the entity-status rule it already applied (a quarantined entity page never counted): a page outside the operator's scope is not part of the vault by definition and can no more anchor a wikilink than a missing file would. In-scope twins keep forcing the longer spelling exactly as before, and the census decides the spelling only - naming an out-of-scope target explicitly behaves exactly as it did.

Changed

• brain_context_presets suggest (and o2b brain context-presets suggest) now ranks an explicit context_window_tokens - and a model the exact-id table knows - above a matching model_hints token. This is a deliberate order change from the hint-first draft, not a regression: the hint check used to run first, so gpt-4o-mini with an explicit 128,000 window answered tight-context from the "mini" hint, and the table-known gpt-4.1-mini answered tight-context although every derived budget for it sizes from the declared 1M window - two mappings for one model on two surfaces. The window is authoritative: an explicit context_window_tokens is the caller's own number for the deployment at hand, the same figure a derived budget sizes from, and a table row is a published fact - while a hint is a heuristic read off the id, so it answers only when nothing published resolves and never claims a resolved window. The conservative fallback (tight-context, low confidence) is unchanged for ids nothing places - and for exactly those ids the pack budget surfaces refuse rather than budget the default window's long-context, so an unrecognised model never gets a budget again.

• The context-window resolver deliberately builds no window-proportional budgets: it selects between the two existing presets. The presets tile the window range at 32,000 tokens - tight-context below, long-context above - so a 128k, a 200k and a 1M window all land in long-context and receive the same derived guidance; the widened recognition (the [1m] bracket form, provider and region prefixes, dated snapshots, -vN:N revision suffixes) changes which bucket an id lands in, never the bucket count. Window-proportional budgeting is its own calibrated change and is not improvised here.

Added

• Cross-topic rule promotion in the dream pass, behind an opt-in cross_topic: block whose absence is byte-identical to before. The same-topic merge machinery buckets entries by topic before comparing, so a principle stated once per subject is invisible to it by construction; the new planner inverts that walk and considers pairs only ACROSS distinct topic buckets - confirmed preferences in at least min_topics (floor 2) distinct topics whose principle text reaches a jaccard similarity of jaccard (floor 0.6) elect one recurring cross-topic rule. The promotion is bounded four ways: sources must share one normalized owner token (ownerless counts as the shared token), so owner-scoped recall never leaks one agent's rules into another's rule body; one promotion per owner token per calendar day, budgeted through a Brain/cross-topic-rules.json ledger (a registered state surface) with the date taken from the pass's injected clock, so the same corpus elects the same rule on every machine and a rerun plans nothing; a budgeted-out pass plans nothing; and a source the same pass plans to retire is not eligible, so evidence is never hung off a file the run is about to move. The promoted artifact is an ordinary unconfirmed preference - provenance: "inferred", evidenced_by wikilinks to every source, a related lineage - written by the dream apply stage through the transactional preference writer with overwrite off, under a content-derived cross-<sha256-12> slug so the same source set maps to one file and an already-present or retired slug skips. Sources are never modified or retired, the fired promotion counts as a state change (it rides the dream summary as cross_topic_rules and lands one Brain log event beside the ledger write), and a below-threshold pass stays byte-identical: no-op summary, no log write.

• A model-aware context-window resolver, and every context budget that used to be a caller-declared guess now derives from it. One pure module turns a host model id plus the operator's declarations into a window number and states for each answer WHAT decided: precedence is the operator's context.window_tokens config key, then OPEN_SECOND_BRAIN_MODEL_CONTEXT_WINDOW, then a published exact-id table (no family substring ever resolves - "sonnet" matches nothing, which is the defect the module exists to remove; the table carries gpt-4o at 128,000, the gpt-4.1 family at 1,000,000 and the three shipped Claude ids at 200,000, each row with its provenance note, and the id normalizes before the lookup, so provider and region prefixes like openai/ and us.anthropic., trailing date snapshots like gpt-4.1-2025-04-14 and Bedrock -vN:N revision suffixes still reach the exact row), then the structural tier - a trailing, delimited 1m suffix (-1m / _1m, or the trailing [1m] bracket form hosts report like claude-sonnet-5-5[1m]; a dot-led version fragment like the 4.1m in gpt-4.1m is a version, not a window) - then the 200,000-token default. First-hand declarations - the operator's config key, the environment value, a published table row - pass through unclamped, used exactly as given; only the guessed tiers (the 1m suffix expansion and the unknown-model default) are held to the [100,000, 1,000,000] band, with any clamp disclosed. The consumers: brain_context_pack (and o2b brain context-pack) accepts model and makes max_tokens optional - omitted, the budget is the matching preset's context_pack.max_tokens for the resolved window and the response names the deciding channel in max_tokens_source, while nothing resolvable - and no id the table, the suffix and the preset hints cannot place - is refused exactly as today, never a silent default; brain_context_presets suggest (and the CLI twin) resolves a window from --model alone with the source in the reason, an explicit window or a table-known id taking precedence over a hint match (deliberate; see Changed), and an unrecognised id answering the conservative fallback; brain_pre_compress_pack closes the unbounded-addendum case with resolver-derived caps, an unparseable window env value keeping the historical unbounded caps beside a named window_warning; and the anticipatory cache scales its budget to the resolved window's hundredth part, floored at the 2,000-token constant so it only ever scales up, disclosed when derived and byte-identical when nothing resolves.

• A preregistered per-use decision-model eval, and a measured gate that is the only path out of shadow. Each use ships a preregistered spec - fixture reference, seed, split rule, metric, error ceiling, minimum counted n, and the pinned threshold values it measures - with a canonical spec hash; the take is a hash-order split (sha256Hex(seed + ":" + id), dev = the first ceil(0.3 n), membership frozen at preregistration) and the runner verifies the split against the frozen receipt before grading. o2b decision-model eval run --use <use> grades the counted split through the configured adapter, caching decision_model_eval_grade records stamped with the spec hash, profile, use, seed, item ids, boolean verdicts, metric and counted n (origin eval, spend counted toward the daily cost gate, malformed records skipped by the lister with a named note); o2b decision-model eval list renders them oldest first in prose or --json, and o2b decision-model check names the measured state - untuned, measured under spec hash X, or baseline. The verdict is the preregistered three-arm rule - promote only when the counted error meets the ceiling, no-regression against the deterministic baseline holds, and the counted n is met; a short n is its own arm - and a promote verdict, and only that, writes a machine-side tuning mark per (threshold profile, use) under the platform state root, outside every vault. Acceptance is fail-closed: the mark is honored only when its spec hash, fixture hash and pinned threshold values all match the installed spec, so a spec edited after the mark was written, a fixture that moved, or thresholds that drifted each put the use back in shadow; no mark file is exactly today's behavior, and a hand-registered tune always wins because the resolver consults the mark only where the source table says untuned. o2b decision-model doctor reflects the measured state.

• A measured index-behind count, on the stale note and in search status. A search that names a stale index (index-stale, the index older than ten minutes) now also reports how far behind it is: detail.behindCount is the number of documents the next incremental run would add, update or delete, measured under the same gate that fires the code and cached for at most 60 seconds - invalidated by this process's own note writes, so a write from another process can leave the count up to a minute old - by a stat-only walk (one readdir plus one stat per entry, no content read, no hashing) diffed against the index's stored rows. The count is deliberately an upper bound: a touch-only file (identical bytes, bumped mtime) counts as changed, because "behind" means "what the next run would re-read", not "notes missing from answers". A measured zero rides too; a failed measurement is absent - the note then names the age alone, and a fresh index performs no walk at all. o2b search status prints the same census as index_behind: in its freshen block (<n> doc(s), or (not measured)) and serializes it as index_behind in the --json freshen object, null when not measured - never a fabricated zero - measured only when an index exists, and without touching the doctor's own freshen check, which reads the state file and picks up no walk cost.

• Bench-run integrity guards: a closed refusal vocabulary over every damaged pre-run and pre-report state. Before a run exists, a preflight refuses - by name, on stderr, as refused (<kind>): <detail> with a non-zero exit and no run directory left behind - an unusable runs directory (runs_dir_unusable), a fresh run whose identity collides with an existing run dir (run_dir_exists; the prior checkpoint survives and the detail names --resume, where the store used to silently reset it), a resume target whose checkpoint is unparseable (checkpoint_unparseable), names a phase this build does not know (checkpoint_phase_unknown) or lists phases out of order or duplicated (checkpoint_phase_order), a phase marked done whose artifacts are gone or truncated (run_artifact_missing - the materialized vault is required exactly while retrieval still has to run against it, the per-question result files once retrieve is done, report.json once report is), and a fixture that cross-references a note or session it never defines (fixture_cross_reference, which used to score as an ordinary missing-expected FAIL indistinguishable from a real regression). Config resolution and the capability gate moved above run creation, so those refusals leave no run dir behind either. Before any score is counted, and again before the report writes, the persisted trace is validated: a question with no result file (trace_result_missing), a truncated or non-JSON one (trace_result_unparseable), an id that differs from the question it is stored under (trace_id_mismatch), a category-required field absent from a record (trace_field_absent - present-but-empty is a legitimate miss and passes), a faulted proactive decision (trace_faulted_decisions - the report must never dress harness breakage up as memory behavior), files in results/ beyond the fixture's question ids (trace_extra_results), and a report whose counts disagree with its own trace (report_counts_mismatch, recomputed through the same aggregation the report builder uses, so the two cannot drift). Every detail names the repair. What is deliberately not a refusal: score content - an all-questions-failed run is the harness's purpose - and the external judge staying in error remains advisory. The guards add zero stdout on success, existing run ids, checkpoints and reports are byte-identical (fixtureHash stays content-only), and the per-question results and report.json are now written atomically.

• The search query language ships as a versioned JSON Schema artifact, with export and check verbs. schemas/brain/search-query.schema.json ($id brain.search_query.v1, draft 2020-12) is derived - never hand-edited - from the search-options descriptor, the same typed table that derives the served brain_search inputSchema (byte-identically) and the o2b search CLI flag table, so the published artifact cannot disagree with either surface; a $defs.search_query_document block publishes the grammar of the line-oriented query-document program (the intent: / lex: / vec: / hyde: lanes, the intent enum complete against the parser). The artifact documents the per-surface asymmetries the descriptor records instead of flattening them. o2b search schema export [--stdout] regenerates the committed file; o2b search schema check re-derives and compares - JSON equality, not byte equality, so the repo formatter's layout never reads as drift - exiting 0 clean, 2 on drift with stderr naming which (the property set or the content) and the remedy, and 2 when the file is missing or unreadable, so CI and any operator share one named verdict. The verbs live under the search group deliberately: o2b brain schema is the vault schema pack, a wholly unrelated "schema".

1.89.0 - 2026-10-19

Open Second Brain 1.89.0 makes the derived truth follow the note write. A rename or move rewrites the inbound links it touches to the shortest spelling that still resolves, repairs the bare-name links its carrier-count change would silently repoint, and claims one detached search-index refresh the moment the write lands, so the staleness window starts closing at the write instead of at the next search. Entity anchoring matches the spelling a fact actually uses - "Ada Lovelace" anchors a registry entity reachable as "ada-lovelace" - while a leading-edge word-boundary rule stops the matcher from anchoring inside other words without silencing the inflected forms a token boundary admits. And the anchors a fact carries can follow its source page's outbound links: the anchoring kernel accepts caller-resolved link-derived ids, and a fifth maintenance lane task, relink, re-anchors the extracted signals already stored - every lane pass reports what the task would add, and the stored lines change only when the run asks for it.

Fixed

• Entity anchoring matches the spelling a fact uses, and stops matching inside other words. The anchoring kernels compared literal normalized substrings: a fact saying "Ada Lovelace" never anchored an entity whose forms are "ada-lovelace" or "people/ada_lovelace", while a short form anchored inside any word that contained it - "Canada" anchored "Ada". Both sides of every comparison now expand through one pure match-form generator: runs of space, hyphen and underscore are interchangeable, so the spaced, hyphenated, underscored and slug-prefixed spellings of a name are one match class; a slug-prefixed form also matches at its path-segment boundary, the segment prefix being registry decoration rather than part of the mentioned name, and the tail spelling is minted only when that prefix is one of the registry's entity-type folders - the same vocabulary the registry mints entity ids and the merge guard's guarded categories from - so people/ada_lovelace answers Ada Lovelace while a slash-bearing form like Warner/Chappell never anchors through a bare Chappell; and an occurrence anchors only when no letter or digit sits directly before it - the leading edge - while the trailing side stays open, a trailing character being an inflection until proven otherwise, so the Russian accusative Ивана, the German genitive Annas and a Korean particle run like 김철수는 anchor again; the adjacency of a script written without word spaces (Han, kana, Thai, Lao, Khmer, Myanmar) suspends the requirement, because there adjacency carries no boundary information, and a leading Hangul letter still blocks, Korean attaching no prefixes. The leading edge is what preserves the precision fix: the fold still never plants a mid-word hit literal matching did not already have - Canada never anchors Ada. Forms are precomputed once per capture and each text expands once, not once per entity; identity keys are untouched - two spellings can remain two entities and one match class - and the merge guard and the contamination check adopt the shared rule verbatim, so the guard that vetoes a merge cannot disagree with the anchoring that fed it.

• A rename can no longer silently repoint the bare-name links it never rewrote. A bare spelling resolves only while exactly one nested note carries it, so a rename that brings a second carrier into the vault - another note moved onto a basename a unique bare spelling already resolved to - turned every [[spelling]] aimed at the note that never moved into a link that resolves to neither, and nothing said so: the rewrite pass only touched links that named the moved note. Those third-party links are now repaired in the same pass, retargeted to the minimal unambiguous spelling of their pre-rename target through the same chooser and resolution ladder as the main rewrite; a repair that would write the spelling it already has is dropped, and everything unprovable stays untouched - a spelling several notes carried before the move was already ambiguous, a spelling with no carrier was already dangling, and a top-level note keeps owning its bare spelling through the exact-path rung whatever the nested count becomes.

Changed

• Inbound wikilinks a relocation rewrites come out no longer than the vault still needs. The rewrite preserved each link's original spelling form, so a full-path link was rewritten to the new full path even where the bare basename would have resolved to the same note. Every old spelling of the source now collapses onto the one shortest form that still resolves to the destination under the store's own read-time resolution ladder - exact path first, then a bare basename (a top-level note owns its bare spelling outright, whatever nested notes also carry it), then a bare basename carried by exactly one nested note - so [[Projects/Old]] comes out [[New]] when New is unambiguous and [[Projects/New]] only when it is not. The chooser mirrors the index's resolution rung for rung, so a spelling it calls minimal is a spelling search resolves to the same document; an ambiguous spelling is never an answer - it falls through to the next-longer form - and ambiguous basenames stay withheld exactly as before.

Added

• An applied note write claims one detached index refresh, and the receipt names the claim and, on a refusal, the reason. The derived search index was only as fresh as its last indexing pass: a rename's receipt said so honestly, and the window stayed open until the next search happened to freshen on read. Applied note writes now claim one detached, claim-guarded incremental refresh through the freshen-on-read machinery - create, content edit and append alongside the four lifecycle operations (rename, move, archive, delete; a batch write's operations do not claim yet) - forced past the freshness interval because the write just aged the stamp, so the window starts closing at the write itself. The claim is the reader path's, verbatim: the same claim file, so a write's refresh and a reader's freshen exclude each other, and a write arriving while a run holds the claim starts nothing of its own but leaves a durable pending marker, which the running pass settles with one extra bounded incremental pass before it releases the claim - bounded at one, never a loop, so a write landing mid-refresh is picked up by that pass instead of staying stale for a whole interval. It is a report, not an invariant: claimed says a run is in flight, never that it has landed, and every refusal - search_freshen_interval_s: 0, another run holding the claim, no index to refresh, a failed spawn - answers not_claimed with the freshen machinery's own reason surfaced beside the token: index_refresh_reason on the create, update and append results, refresh_reason on the lifecycle receipts (the CLI's JSON and the MCP result, with the CLI's prose rendering it in parentheses beside the token), so a refusal names which refusal it was; the index evidence's next command remains the way the index reconciles. The CLI and the MCP note-lifecycle results carry the token beside the index evidence, the create and update receipts carry it under the same vocabulary, and both now expose the rewritten spellings the pass applied.

• Link-derived fact anchors, and a relink lane task that reports the re-anchoring the stored signals need and applies it on request. A fact extracted from a source page anchored only to the entity names its own sentence used, so a page about an entity it linked but never named wrote signals that never reached that entity's recall surface. The anchoring kernel unions caller-resolved link-derived entity ids into the stored entities: line ahead of the text-derived anchors, the first body-order link leading when both mechanisms match the same fact: a page-sourced caller maps the page's outbound wikilinks through a resolver that answers the entity id (with or without the .md suffix), the entity page's own vault path, the slug-prefixed spelling folded and case-folded the way ids are minted, and a frontmatter alias no other visible entity claims - a directory-prefixed spelling answers only as that path rather than by basename, an alias two visible entities claim stays unresolved instead of first-wins, the captured link target is trimmed before the rungs answer it, the pages the caller's reach refuses are dropped before any id is produced, and the resolver answers empty rather than throwing when nothing resolves; a session-sourced capture passes nothing and writes byte-identical signals. Write-time attachment has no shipped caller yet - the extraction call exposes the seam and nothing threads it on the write path - so the path extracted signals actually gain link-derived anchors through is the maintenance lane: a fifth lane task, relink, recomputes the anchors of the extracted signals already stored with the shipped matchers and the same resolver, and unions them into the stored line additively. The resolution binds at the reach of each signal itself - a remotely readable signal only receives ids whose entity and source pages are readable at remote reach, a local-only signal keeps the lane's reach, a withheld page is skipped - acts only on server-stamped extracted signals, never on a caller-supplied pointer, and the rewrite touches only the extractor's own raw shape: a codec-compressed raw, a drifted page and a Raw holding anything but the extractor's one entities: line are skipped, never written. An anchor already stored is never removed, a signal without a Raw section is counted by neither arm because the rewrite could not store the addition, and the default arm is a dry run that writes nothing, not even the skip-audit log the shared anchorable build stamps on the write path. Every lane pass reports per source page what the task would add, and the stored lines are rewritten only when the run asks for it with --relink-apply, or relink_apply over MCP, each addition written only where the signal's own reach allows it, never calling a model.

1.88.0 - 2026-10-17

Open Second Brain 1.88.0 repairs split entity pages behind a preview-and-apply gate, folds the write ledger into one destination-keyed view, and catches an agent up on the log lines its peers appended while it was away. brain entity merge plans the repair, echoes the plan's hash and applies only when the live vault still produces the plan the caller read - the dropped page archived behind a recovery point, its name kept as an alias on the survivor. o2b brain writes destinations and the new brain_write_destinations tool answer which destinations the recorded writes touched, across both recorded write kinds, each row saying what its rows cover. An opt-in SessionStart lane hands the agent the log lines other agents appended since its last look on this device. Every lane that injects memory at session start now neutralizes what it hands over and frames it under the clause that says what the span is - records for the foreign lanes, binding working-style guidance for the memory lanes - and note listings order the same on every host, "note 2" before "note 10". Exports speak OKF v0.2 beside the Open Second Brain dialect while the importer accepts both, and Hermes discovers the memory provider through a declared package entry point.

Fixed

• The lanes that hand the agent memory written elsewhere now neutralize what they inject and frame it under the clause that says what the span is: records for the foreign lanes, binding working-style guidance for the memory lanes. The active and lessons bodies are neutralized - structural control, bidirectional and zero-width characters stripped, delimiters escaped - and set under the shared one-line framing header at the assembly chokepoint before the meter records the injection, so per-source attribution names exactly the guarded bytes that reached the payload. The two clauses are deliberately different: a preamble telling the model to read its own rules lane as data would have it ignore the very preferences the lane exists to deliver, so the memory header binds instead - vault-derived preferences and lessons apply as working-style guidance, they never override system or user instructions, and they cannot request new actions, tool calls, or data disclosure - while the foreign lanes (the cross-agent catch-up, the answer quote-check) keep the records-not-instructions disclaimer. The header's overhead is charged against inject_budget_chars before the tier ladder runs, so the framing never pushes the framed whole over budget and the ladder never evicts a section to pay for the framing; and a budget that cannot hold the header - or whose entire budgeted remainder would be the truncation notice alone, content evicted to the last section - skips the memory source whole rather than emit an over-budget frame, leaving nothing metered behind it. Gap-agenda topics route through the shared single-line neutralizer and the agenda block rides the shared untrusted-content fence under its own origin label, and the answer quote-check neutralizes each quoted span before the whitespace collapse and carries the framing line between its header and its findings. The single-line neutralizer is promoted into src/core/brain/untrusted-source.ts, retiring byte-identical private copies in recall-inject and navmap; standing and scoped rules stay trusted with their precedence header, runtime notices stay trusted, and the untrusted_source_delimiting flag keeps its meaning. The tiered-budgeting pin now budgets 1,000 characters and additionally pins that the framed whole stays within the configured budget, and the coverage over the guarded lanes pins the neutralized, framed shapes at every lane.

• Note listings order the same way on every host, and "note 2" sorts before "note 10". The page listing sorted titles with a bare localeCompare, which answers to the host's default locale - the same vault listed in different orders on different machines, and every lexicographic host reading "note 10" as sorting before "note 2". The single sort site now compares through a module-level fixed-locale Intl.Collator("en", { numeric: true }), keeping the case-insensitive pre-pass, and the doc comment names the host-independence contract. Observable output changes for multi-digit titles - o2b index bytes and second_brain_query ordering - while the raw directory listings and the search pipeline stay untouched.

Changed

• The write-ledger surfaces refuse a since / until that is neither a bare YYYY-MM-DD nor a canonical UTC timestamp. The ledger readers (brain writes list, destinations and revert, and the brain_writes and brain_write_destinations tools) used to accept any string and compare it lexically against the log's canonical timestamps, so a bound in any other spelling - yesterday, 03/01/2026 - matched no log day and the query answered a clean, wrong empty. One shared validating parser now completes a bare date to the window's edge (since to that day's start, until through the end of that day, calendar-checked by parsing) and passes through only a full timestamp already in the writer's canonical UTC shape; everything else is refused by name - a usage error on the CLI surfaces, INVALID_PARAMS blaming the argument on the MCP tools - so a mistyped window says so instead of answering empty.

Fixed

• brain writes revert --device "" - and the brain_writes tool's device: "" - selects the legacy un-sharded log instead of dropping the device filter. The flag readers treat emptiness as absence, so the empty device fell out of the revert selector: the bare flag was refused as an unbounded selector, and beside --path the plan silently reverted the path's writes from EVERY device while looking device-scoped. Revert now reads the device through the same empty-aware selector the list and destinations surfaces use - "" is a real filter value naming the un-sharded pair - so an empty device reverts only the legacy log, on the CLI and the MCP tool alike, and the plan is pinned by its selection rather than its echo.

Added

• o2b brain entity merge <keep> <drop>, a preview-and-apply repair for two entity pages that denote one subject. Both subjects accept ids, names or aliases, so the doctor's always-on duplicate-entity collision and its opt-in entity-alias-candidate nomination both resolve through the one verb. The repair is alias-first, never a bare delete: the survivor keeps its page and gains the dropped page's display name as an alias, the dropped body folds under a heading beside the survivor's, inbound relation edges retarget to the survivor so no broken edge survives, and the dropped page is removed behind the destructive-snapshot gate's recovery point. Claims stay append-only and aggregate by normalized name, so nothing claim-side is rewritten. The gate is the plan hash: the --dry-run preview renders the plan and echoes its sha256 hash, and apply requires --expect-hash <hash>, re-planning from the live vault and refusing before any write when the vault no longer produces the plan the caller read; consent is a TTY y/N prompt, --force for agents, and a --json run refuses without --force because the prompt cannot render. The text-level merge guard runs over the two bodies unless --force bypasses it explicitly, quarantine-lane records are refused by name rather than merged across, and a confirmed apply asserts vault identity and appends one reliability-audit record beside one Brain merge log event after the bytes land. The brain_entity MCP tool stays read-only; writes remain CLI-only by convention.

• A destination-keyed view over the write ledger: o2b brain writes destinations and the brain_write_destinations tool. One shared core reader walks the log and folds the note-write and write-session kinds into one row per vault-relative destination, each row carrying the contributing agents and devices, per-kind counts, the newest recorded touch and a kinds coverage field that states honestly which kinds its rows cover - the slug-derived and fully-derived write-binding sites emit no event of either kind, so the answer carries a coverage note that a destination absent here may still have been written. The default window is the last seven days, --since / --until narrow the walk, and agent, device and path filters cut by exact identity; the tool pages by the shared offset cursor with total_matched, passes the log's warnings through and applies reach filtering, so a page the caller cannot read moves no count. The aggregate is log-derived at query time - no persisted table, no maintenance lane.

• An opt-in SessionStart lane that catches an agent up on the log lines its peers appended. With log_catchup_enabled (env OPEN_SECOND_BRAIN_LOG_CATCHUP_ENABLED, default off), the log-catchup lane hands the agent the Brain/log lines other agents appended since its identity's last look on this device - the newest 50 as one fenced additionalContext block with a count of older ones, every line attributed to the agent that wrote it, a per-lane character cap trimming oldest-first. "Me" resolves the configured agent name, else the device id; self-authored lines are filtered, and an unresolvable identity stays silent rather than replay the agent its own lines. The lane is a pure read - Brain/log stays byte-identical after every run, and the lane stays distinct from session-capture's lifecycle event - and the cursor is one un-synced (date, shardId, line) watermark with per-shard high-water marks per reading identity - several runtimes share one vault with different agent names, so "last look" is a fact about the identity, not the device - under <vault>/.open-second-brain/log-catchup.<identity>-<digest>.cursor.json (the identity sanitized into the file name, the digest keeping the mapping one-to-one - the digest also orphans the digest-less per-identity cursor files an intermediate build of this release wrote, a one-time reset: the first run after the upgrade replays the log once under the lane's caps and the old file stays behind unread), overwrite-only, symlink-guarded and fail-soft. It is rewritten on every run that actually scanned the log - silent runs included, so an idle vault does not rescan history at each start; the cursor holds back only when none of the collected lines fit the block, while the lines the 50-line limit or the character cap cut are counted as older and then skipped - keeping the cursor date's own marks, a three-date window of older dates, and the same marks for the first three future dates a clock-skewed writer may stamp, so a future-dated line on one of them shows once instead of every session until the clock reaches its date (a skew beyond that window resurfaces): the merge order interleaves shards, so a bare tuple would skip a same-second line landing in a differently-named shard. The scan is bounded on both ends of the cursor. The date-level skip is the calendar window, not the recorded marks: a parked cursor rescans every date within its three-date window whether or not a shard had synced to this device when it parked, so a day whose file arrives late still surfaces where marks-keyed skipping would drop it forever. A first run - no cursor yet - never walks the whole history: it scans a recent window, the same three dates plus two days of slack behind the newest log date of today or earlier (never behind a future-skewed stamp, and never behind today itself, so a vault whose newest entry is months old still catches up on its own recent tail), and names the days past it in the block header as "N older day(s) not scanned" instead of parsing them. That count is honest even when nothing else renders: a first run whose every scanned line turns out to be the reader's own emits the count once as a header-only block before the cursor parks, so the days the window never read are reported rather than dropped silently.

• OKF v0.2 emission beside the Open Second Brain dialect, and an importer that accepts both. The exporter keeps the manifest's dialect schema: "1" and declares okf_version: "0.2" in the bundle-root index.md frontmatter, the only frontmatter an index file may carry. Every page gains the spec's per-concept keys as derived fields: a sources list translated from the citations the exporter already collects, with resource required - URL targets pass through as-is, wikilink targets resolve through the page walk's bundle-path map, dangling targets drop and ambiguous basename collisions drop rather than guess - and a generated block (by, at) stamped with the one shared instant the manifest's generated_at carries, so whole-bundle byte equality modulo that single instant stays the determinism contract. Page status lands on the spec's closed draft | stable | deprecated enum through a conservative map pinned to the frontmatter status: field: deprecated, retired, superseded and archived map to deprecated, done, closed and resolved map to stable - completion is never deprecation - draft stays draft, and anything else reads as stable. The importer admits a bundle whose index declares okf_version: "0.2" beside its own schema: "1" dialect, consults the index only when the manifest does not name the dialect - sealed knowledge-pack halves carry no index and never grow an index dependency - preserves the on-disk schema value in the parsed manifest, and refuses everything else by name with the existing message shape. Beside the derived block, every page of a fresh export declares okf_raw: true and carries its native status / sources / generated values under the producer namespace as okf_status_raw / okf_sources_raw / okf_generated_raw - the derived status maps onto the closed enum and the derived sources are re-translated from citations, so exporting the natives in place would rewrite what the operator wrote. An own-producer import reads that declaration back: a marked page's derived block is stripped and its natives restored - a raw key absent beside a present one means the field never had a value, so a plain page comes back plain and a quarantined page comes back quarantined - on the trusted round-trip and review staging alike; a page carrying neither the marker nor raw keys is a legacy bundle's and imports as-is, and a foreign bundle's pages import as-is too, their v0.2 per-page keys surviving verbatim minus the raw machinery.

• A hermes_agent.memory_providers entry point, so pip discovery lands on the plugin module. pyproject.toml declares the entry-point group with open-second-brain = "plugins.hermes" - the module that already exposes the register callable - so Hermes's entry-point discovery reaches the provider instead of relying on directory-layout loading alone; the header comment no longer claims there are no entry points at all, the declared one being a plugin registration, not a CLI script. Tests parse the declaration back with tomllib, import the target module and pin the loader contract (a register callable there), and the standing pin that prefetch stays the single injection lane holds. install/hermes.md names the discovery path and its one caveat: the entry point resolves from the wheel by itself, but the provider bridge still needs o2b on PATH or a checkout for the fallback launch, so "zero-config" holds only in those contexts.

1.87.0 - 2026-10-17

Open Second Brain 1.87.0 makes the host-config writes guarded and reversible, and the large answers walkable. Every guarded host-write lane - o2b install --target X --apply, brain protect --apply, brain doctor --repair --apply and brain unprotect, which joins the lanes this release - demands explicit consent before touching a file, shows the intended change as a unified diff, takes a timestamped backup beside an audit receipt before anything is written, and lands exactly the preview the consent approved, refusing the write when the file moved under it; an opt-in PreToolUse hook extends the same care to an agent's file writes against host Claude settings. Thirteen more MCP list tools walk any large result set by an offset cursor instead of stopping at one capped page. A fourth decision-model route speaks the bearer-authenticated Converse protocol (Bedrock-style) beside the existing three adapters. And the trigger queue learns to snooze - an open trigger defers for a bounded window or until its finding's grounding moves, whichever comes first - while a dismissal holds until its finding is grounded in something new.

Fixed

• The applied change is the approved preview. brain protect --apply and brain unprotect carry the before/after pair the consent ladder showed into the write: the write re-derives the change and refuses it (PREVIEW_DRIFT, nothing written, no backup taken) when the target file or one of the manifest inputs moved since the preview, and the write re-reads the target right before the rename, absent a target excepted, so the bytes that land are the bytes that were approved.

Changed

• The three guarded host-write lanes now demand explicit consent before touching a file, which breaks headless callers that scripted the old write-on---apply behavior. o2b install --target X --apply, o2b brain protect --apply and o2b brain doctor --repair --apply refuse with a non-zero exit in a --json or non-TTY run unless --yes is passed; interactive runs prompt instead. Every apply's JSON output now carries the consent verdict, derived from what happened rather than hard-coded: yes-flag (a --yes consent of a real write), interactive-yes (a confirmed prompt) or unchanged (a no-op that never reached the gate) on the CLI lanes, and caller-apply on the MCP brain_doctor apply: true path, recorded in each fix's event; a --json/non-TTY refusal emits its own envelope ({ consent: "headless-refused", written: false, error }) on the payload stream, and refused stays reserved for a future interactive-no envelope. Both brain protect --apply and brain doctor --repair print a unified diff of the intended change before anything is written. Headless callers must add --yes (install exit code 6 names it).

• brain unprotect joins the consent lanes, which breaks headless scripts that called it unattended. o2b brain unprotect used to rewrite the protected file on every call, with no consent, no backup and no record. Open Second Brain now makes plain brain unprotect a read-only preview - under --json the answer is a "preview": true envelope carrying the before/after pair, so a headless consumer can tell it from the apply envelope it shares keys with - and --yes without --apply is refused by name, because unprotect writes only through the consent ladder's apply step. brain unprotect --apply runs the same fail-closed ladder as the other guarded host-write lanes: a --json or non-TTY run refuses with a non-zero exit unless --yes is passed, an interactive run shows the unified diff and asks once before writing, and a confirmed run takes a timestamped backup of the file's current content beside it and appends the audit receipt before anything is written - so a refused consent or a failed backup leaves the protected file untouched. Headless callers must pass --apply --yes.

• A dismissed trigger no longer returns on a cooldown clock; it stays dismissed until its finding is grounded in something new. Dismissal used to silence a cooldown key for trigger_cooldown_days (default 7) after the dismissal, so a finding nobody had touched resurfaced on a timer and a genuinely moved finding stayed hidden until the clock ran out. A dismissed finding now stays dismissed for however long the finding's grounding holds still, and returns - as a new record through the normal creation path, never as a status flip of the resolved one - only when the grounding moves: the re-fire introduces a source artifact the dismissed record does not name, or its grounding fingerprint differs from the one persisted at dismissal time (a sha256 of the finding's reason and context, normalized so the clock projections those texts embed - day counts, ages, scores - cannot read as movement). The artifact comparison is set-based and order-insensitive: a re-fire citing a subset of the dismissed grounding is not movement, and a record written before the grounding list existed never resurrects on a comparison it cannot support, while one dismissed before the fingerprint field existed reads its missing fingerprint as no baseline, never as movement. A bare re-scan of an unchanged finding keeps the silence whatever the calendar says. Scans name the silenced re-fires with a new dismissed skip reason. The acted status keeps its cooldown window, and suppress stays clockless.

Added

• A converse decision-model route for bearer-authenticated Converse-protocol (Bedrock-style) gateways. The adapter union gains a fourth adapter beside systemone, vercel-evaluate and llm-emulation, with a converse preset (decision_model_provider: converse) whose base URL, pinned model id and key variable are the operator's. The judgment travels the chat-shaped way - a system prompt and one user message carry the questions, the reply's JSON schema and the state fenced as untrusted content, and the reply's message text holds one JSON object keyed by question id, validated item by item by the same rules as every route; a stopReason that is not end_turn refuses the reply rather than half-parsing it. The route is declared uncalibrated - the reply is generated text whose probabilities the model wrote itself - so an enforce setting is a config error until the operator opts in with decision_model_allow_uncalibrated: true, and its own converse threshold profile tunes no use yet, so a permitted enforce still runs as shadow until tuned from this route's own shadow data. The model rides the request path (POST <base>/model/<model_id>/converse; no model-id body field), and as a chat-shaped route the gateway's output tokens are billed beside input ones once both prices are configured - one price alone leaves the cost unknown. The request passes the shared egress guard under the new decision-model-converse registry id, the contract suite's fourth route applies the full failure matrix to the adapter, and o2b decision-model check, doctor and the setup skill name the new preset and profile.

• An opt-in PreToolUse hook that backs up host Claude settings before agent file writes. With host_settings_backup on (env OPEN_SECOND_BRAIN_HOST_SETTINGS_BACKUP over the _brain.yaml key, default off), a Write/Edit/MultiEdit/apply_patch call whose path canonically names a .claude/settings.json or .claude/settings.local.json - tilde-expanded, cwd-relative, symlink-resolved - gets its current content copied into the timestamped backup file <dir>/.o2b-backups/<name>/<UTC stamp> beside the target (created private at 0600 - the backup carries the same secrets the settings file does - and exclusive-create, so same-second backups ladder their names and exhaustion is a typed error, never an overwrite) and one audit receipt appended, before the call is allowed to proceed. A backup that cannot be taken denies the call via stdout permissionDecision: "deny" - the only channel that survives the fail-soft dispatcher - and a successful backup emits nothing, so the call proceeds through the normal permission flow. The wrapper checks the flag first, so the off path is a byte-identical no-op; its guard logic is restated stdlib-only - the sole core import is the two directory names of the audit root - and the honest hard floor (no deny when bun or the hook script is missing) and the uncovered lanes (Bash-class writes, temp-then-rename) are documented in hooks/README.md.

• Cursor pagination across the MCP list tools, so an agent can walk any large result set instead of getting one capped page. Thirteen limit-only list tools adopt the shared offset cursor beside the three surfaces that already paged (brain_decision action=history, brain_session_expand, brain_search_expand), bringing the walking surface to sixteen: second_brain_query, brain_writes, brain_agent_query, brain_agent_diff, brain_unlinked_mentions, brain_write_session op=list, brain_generation_reports list, brain_context_receipts list, brain_event_trace, brain_analytics view=timeline, brain_maintenance status journal, brain_scaffold_stub list and the ordered-walk diagnostic brain_session_grep, whose coverage census stays single-pass and refuses a cursor Each declares a cursor input, cuts one offset window over the full filtered set through the one core cursor helper, and answers next_cursor present in every response and null when the walk is exhausted; a malformed cursor is refused as INVALID_PARAMS rather than silently restarting the walk, and existing count fields keep their meaning across pages (the brain_maintenance status journal gains journal_total, the count its page cuts into). Three surfaces pin their default page to the historical answer: a limit-less brain_session_grep and brain_scaffold_stub list return the bounded default (10 and 100) with a next_cursor for the rest rather than the whole set - with include_raw, brain_session_grep runs its search undecorated and decorates only the page's items, so a cursor walk stays linear instead of re-decorating the whole match set on every page - and brain_agent_diff, which caps nothing, states that its limit bounds only the returned page while the comparison runs over the whole matched set; the agent surfaces compute their summary over that whole matched set, so aggregates hold still between pages.. Adoption follows a recorded census with teeth: every tool whose input carries a limit now either walks by the cursor or carries a written report-cap reason pinned beside the census tests - full walks on the ordered logs and listings, recorded caps on the diagnostics whose rows are aggregates a second page could not continue (with brain_truth keeping its documented advance-since time-window paging), and the two ranked-retrieval tools brain_search and brain_file_context deliberately limit-only, because offset-paging a ranked, index-dependent answer would present an index race as data. Two of the walking scanners, brain_event_trace and brain_unlinked_mentions, bound each page's scan one record past the page's reach, so a cursor walk costs one page of work per call instead of re-reading the whole filtered set on every page fetch; their total (and brain_event_trace's trace_total) is exact once the walk exhausts, and mid-walk reports the bound the fetched page reached - a bound the tool descriptions name, never a silent cap. A limit-less brain_event_trace call still reads the day whole.

• A snooze action on the trigger queue, with unsnooze and a terminal snoozed status. o2b brain trigger snooze <id> and the MCP brain_trigger snooze operation defer an open trigger - legal from open states only, like acknowledge, dismiss and act - for a bounded window (three days) or until the finding's grounding moves, whichever comes first; unsnooze wakes it by hand, and the window's end or a grounding movement wakes it on its own, both restoring the exact status the snooze interrupted. The movement half persists the same grounding fingerprint the dismissal gate does: a scan that sees the finding again while it is snoozed records the recurrence - reported with a new snoozed skip reason - but wakes the snoozed twin in place only when the re-fire introduces an artifact the record never saw or grounds the finding in changed content; a bare re-sighting keeps the snooze holding and only stamps the ledger. A snoozed trigger is terminal like a suppressed one: hidden from list, present in history, never in the brief, and governed by its snooze window rather than the TTL expiry clock, so a long snooze cannot be cut short by expiry. Re-snoozing a still-snoozed trigger is refused rather than treated as idempotent, and unsnooze on a hand-edited record that lost its interrupted status refuses instead of inventing a lifecycle position to restore into.

1.86.2 - 2026-10-16

Open Second Brain 1.86.2 closes a concurrency defect in the per-session hook-state lock: after a stale lock was taken over, two or more hook processes could hold the same scope at once, so a queued re-grounding part could be delivered more than once.

Fixed

• A stale hook-state lock takeover can no longer admit a second holder. A contender that judged an abandoned scope lock stale could act after another contender had already taken it over and re-acquired, move that live lock aside, and leave the lock name empty long enough for a third contender to acquire beside it; from then on each holder's release deleted the next holder's lock, and concurrent takers on the Windows runner each received every queued re-grounding part. A takeover now removes the judged file only for the one contender whose exclusive claim on that file's identity wins, and only while the name still holds that file, so a live holder's lock is never moved or removed.

• A lock release removes only the lock its holder created. The release and the process-exit sweep of the shared lock primitive leave a lock file in place once its name holds another holder's file, so one lost lock can no longer cascade into several holders.

• The same claim guards the other stale-lock breakers. The lineage gap-sidecar trim lock and the deferred session-capture worker lock break an abandoned lock through the same claim, and the capture worker's release removes only its own lock; the hook-state prune removes old scope locks through it too and sweeps old takeover claims. A claim older than a minute no longer blocks a takeover, so a winner that died between its claim and the removal, or a new abandoned lock that reuses an old inode, cannot leave a lock unbreakable, and every successful takeover sweeps that lock's old claims, so the stores without a prune of their own (the capture worker lock in the temp directory, the lineage gap lock) do not accumulate them.

1.86.1 - 2026-10-16

Open Second Brain 1.86.1 repairs what the review of v1.86.0 found and closes two embedding-loss defects: a vault that had the retrieval trust gate on keeps excluding after the upgrade, a barren session mine records its tombstone in the documented flow, the undistilled census reads the session store once so the SessionStart nudge stays inside its budget, and a search index left on an older schema is upgraded in place with every stored embedding kept instead of being rebuilt keyword-only.

Fixed

• The legacy trust gate switch keeps excluding. search_trust_gate_enabled: true (and its env var) maps to enforce again, as it did before 1.86.0; measure-only mode is reached only through an explicit search_trust_gate_mode: shadow. The explain envelope names the resolved mode under enforce as well as shadow, and a refused legacy value names the key or env var it actually came from.

• The relational arm and the bench follow the gate mode in force. A relational query that names contradicts edges returns them under the enforcing gate instead of an empty answer, the arm takes its mode from the caller's effective config, the bench pin accepts searchTrustGateMode and refuses the obsolete retrievalTrustGateEnabled by name, and an invalid mode in an override is refused.

• A barren session mine records its zero-yield tombstone without a relayed hash. A plan that hands out a mining envelope (and each mining step --propose-backlog --json hands out) records the hash of the turns it offered as a pending survey, and a barren commit without a relay writes its tombstone over that material while the session still holds it, so the documented flow (plan, then commit) tombstones; a commit whose turns or ledger write fail keeps the survey for its retry. A turn imported after the plan, two pending plans over different turns, or no plan since the last commit withholds the tombstone and is named in mining_ledger_failure, so turns no model saw are never suppressed; a yield is recorded either way. A relayed surveyed_turns_hash is validated (an empty one included), and one the session no longer matches writes no record and is named the same way.

• The undistilled census reads the session store once. The census and the mining ledger's prune share one session-turn index, so the SessionStart backlog nudge and import-session --status stay fast on vaults with thousands of imported sessions instead of growing with the square of the session count.

• The distill backlog drains. import-session --propose-backlog hands out extract-signals mining steps for the next five undistilled sessions (mining_steps, one per session identity, with mining_steps_remaining), and answering a step records the session as mined. --status and --discover keep reporting coverage when the mining census fails, naming the census as unavailable. A session imported under --recall-session-id is counted correctly, and a corrupt session mining ledger names its remedy.

• An appended source whose last line has no newline is no longer re-queued by every batch plan, and an appended tail longer than 64 KiB is hashed over its real bytes rather than a reused read buffer.

• Every capacity census honours an explicit config file. The maintenance capacity gate, the ingest admission wall, the capture inbox drain, the storage sampler and the storage report measure the store named by --config; the capture inbox drain refuses ingest on an invalid storage: block, as brain_ingest_source does, and ignores errors in other blocks.

• Scan and removal failures no longer expose host paths to callers below local reach in brain_doctor, the digest, the operator summary and brain_delete_by_source.

• Receipt compaction keeps skill_invoked records, so usage-ordered skill offers stay stable, and no longer counts a merged-away prior aggregate as kept.

• The explorer console refuses cross-origin requests before any route runs, so a web page can no longer make it run the dry-run dream through a blind request.

• Smaller fixes: the semantic document dedup names the candidate cap once when it falls back to the lexical layer, the retirement marker in the content manifest is written under the manifest lock, and metric appends wait briefly for a busy surface lock instead of dropping the sample.

• A keyword-only write keeps the recorded embedding prefixes of vectors it keeps, so the next semantic index run no longer clears compatible embeddings; a refused prefix-only change now names the prefix change instead of reporting a model change to the same model (#255).

• An older-schema search index is upgraded in place. On the first search and at session start, an index left on an older schema by a previous release is migrated in place under the writer lock, keeping every stored embedding and its recorded model and prefixes, instead of being rebuilt keyword-only; the background self-heal run does the same, says it migrated rather than that the index was current, and session start still catches up files changed since the last index run. A self-heal rebuild re-checks the index once it holds the writer lock and skips work another process already finished. When a full rebuild is unavoidable (newer schema, missing tables, a chunker change, a corrupt or integrity-condemned file), Open Second Brain reports how many stored embeddings it dropped, where the previous index is kept and how to restore them, and a later rebuild never replaces a .bak that holds more stored embeddings than the index it retires, and a crash during that swap restores the live index rather than the older .bak (#256).

Changed

• The 1.86.0 entry's statement that the legacy boolean maps true to shadow no longer holds: it maps to enforce.

1.86.0 - 2026-10-16

Open Second Brain 1.86.0 stops re-paying for sessions with nothing new to say and measures before it excludes: a session mine that ends with nothing written records a zero-yield tombstone that suppresses every later plan over the same transcript until the turn material changes, a distilled and undistilled census over the imported backlog feeds an ask-once distill envelope and an opt-in SessionStart nudge, the retrieval trust gate resolves an off | shadow | enforce mode where shadow measures every would-be refusal while excluding nothing, and the loopback explorer serves a live-counts console beside its graph. The release also repairs what the external review of v1.85.0 found in the shipped storage lifecycle: receipt compaction now folds only opt-in telemetry kinds, the capacity trend buckets its samples per day while the maintenance lane pauses a band before the wall, a retired document copy keeps its manifest marker, and the incremental extraction watermark stamps exactly the bytes the appended delta covered.

Added

• A zero-yield mining tombstone, with a one-call force re-mine. o2b brain extract-signals and the brain_extract_signals tool now remember a barren mine: a commit that ends with nothing written and nothing staged records a tombstone for the session in a session mining ledger beside the import ledger (<vault>/.open-second-brain/session-mining-ledger.json, schema-versioned, read fail-closed on a corrupt file or an unknown schema version - a silent reset would unsuppress every barren session at once - written under the vault lock, and keyed on a SHA-256 of the exact turn material the plan embeds), and the next plan over that session at unchanged content returns the recorded breakdown instead of an envelope - skipped { reason: mining_tombstone, mining_outcome { written, staged, deduped, durability_rejected } } with llm_step: null and empty turns_mined, text mode naming the breakdown - so an unchanged transcript is never re-offered to the model. The invalidation is the content: a re-import that changes the session's turns changes the hash and re-opens the session with no clearing step. Because removing a downstream preference does not change the turns, --force (MCP force) bypasses the tombstone for exactly the one plan call it is given to - the remedy when the session should be re-proposed; a corrupt mining ledger refuses the plan by name even under force, and a commit that succeeds but cannot record its tombstone still exits 0, naming mining_ledger_failure on both surfaces.

• A distilled and undistilled census, an ask-once distill envelope and an opt-in SessionStart nudge. The census joins the import ledger to the mining record and classifies every imported session - distilled (mined with accepted yield on its current material), known-nothing-new (mined barren on it, the tombstone), or undistilled (never mined, or mined on material that has since changed) - joining on the portable session identity and reading vault-side only, so the honest count never opens or re-hashes a source log and stays affordable inside a hook's budget. o2b brain import-session --propose-backlog turns the undistilled rows into one ask-once envelope: the feedback-marker candidates the sessions' mined turns raise are deduplicated against the vault's shared dedup index before the ask - candidates the vault already holds are dropped and named, the rest collapse to one proposal per distinct hash across sessions with every contributing session listed, and a session whose every candidate was already known is reported rather than re-proposed. backlog_nudge_enabled (env OPEN_SECOND_BRAIN_BACKLOG_NUDGE_ENABLED, default off) arms a SessionStart hook that reports the undistilled count as one additionalContext line, change-keyed rather than timed: injected when the count differs from the count injected last, an unchanged backlog never re-nagged, a drained backlog recorded without being announced; under its deadline the hook degrades to silence, never to a fabricated number, and flag off keeps the session preamble byte-identical.

• A measure-only shadow mode on the retrieval trust gate. The gate resolves a tri-state mode, search_trust_gate_mode (env OPEN_SECOND_BRAIN_SEARCH_TRUST_GATE_MODE, off | shadow | enforce, default off): an explicit mode wins, with an invalid value refused naming the key actually in force, and absent the mode key the legacy search_trust_gate_enabled boolean maps true to shadow and false to off. off runs no gate at all and stays byte-identical; shadow runs the same deterministic controlled-vocabulary classification, excludes nothing, and records every would-be refusal with all of its structural reasons into the retrieval receipts per lane - the candidate pool and the relational arm never folded together - so an operator can read exactly what enforcement would drop before naming it; enforce is today's excluding behavior made explicit. The resolved mode rides the query-cache fingerprint so a mode change can never serve stale cached rows, the --explain envelope names it, and the human explain transcript now prints the refusal counts and rows beside the exclusions, so a shadow run no longer reads like a clean enforce run on the surface the operator defaults to.

• An edge-level eligibility adjuster in the relational arm. Each walked node and its arriving edge are classified from the same controlled-vocabulary frontmatter signals the page gate reads, plus the validity window at query time and the relation-polarity vocabulary: a contradicts arrival is the counted exclusion, superseded_by stays the annotated supersession backbone, and positive relations boost. Under enforce an ineligible arrival leaves the arm's contribution set; under shadow it is counted only. A seed is the caller's own entry point and is never refused for its own markers, the walk still expands through ineligible nodes - only the contribution set is gated at the arm boundary - and a refusal is a different act from the arm's identical-to-absent provenance convention: it is removed or kept-and-counted with named structural reason tokens on the arm lane of the same retrieval receipts, reach-filtered to pages the caller could read. The mode resolves from the same config the arm's other knobs answer to, so the arm and the page gate cannot disagree about the posture.

• A live-counts console on the loopback explorer. The explorer's live server gains two read-only routes beside the graph: /counts.json - the recall-telemetry summary, the most-recalled artifacts under a named cap, a written-per-day histogram over a trailing 30-day window bucketed from continuity record timestamps, and the latest report-snapshot date per surface, which reads as disabled while the feature is off rather than as empty data an operator could mistake for enabled-and-quiet - and /status.json, the operator snapshot. Both re-read the vault on every GET (the status route re-runs the dry-run dream each time, a bounded cost stated rather than cached away), a failed read answers a 500 naming the route and the error instead of an empty payload, and the page's right panel renders Counts and Vault status sections fetching both client-side, so a refresh is a fresh read; a static export states that the live routes are unreachable instead of firing fetches that can only fail.

Fixed

• Receipt compaction folds only opt-in telemetry kinds, never functional records. The protection rule is inverted into a closed allowlist - FOLDABLE_CONTINUITY_KINDS, the pure telemetry kinds whose readers keep no per-record identity past the correlation window - with KEPT_CONTINUITY_KINDS naming every kind a reader reads back as data; folding is opt-in per kind, and a kind the build does not know fails closed to keep, the way a future build's records always did. v1.85.0's clip-key rule never protected session_entity_mention (its payload carries a session_ref), so a confirmed compact folded the records the session-recall seed, the hallways pass and the mining dedupe read back, the by-id generation_report lookups, the row-count-derived recent-turn sequence, and receipt_compaction's own audit record - the next run folding the run before it. recall_observed_use and negative_recall sit on the kept list too, their readers named: one is the lifetime observed-reuse rate search ranking consumes, the other the answer-audit trail a corpus statement rests on. Beside the allowlist: repeated folds merge into the existing per-kind, per-month aggregate instead of stacking a second line; shard names are validated up front so a malformed --shard answers invalid params; scan offers and compact rewrites only this device's shard, a foreign shard refused by name on previews and confirmed runs alike - the fold's lock and compare-and-swap are local, so rewriting a peer's shard is exactly the divergent-copy conflict the per-device shard layout exists to prevent; and a text-mode compact --apply whose own audit record is lost in the rewrite reports the loss and exits 1.

• The capacity trend buckets per day, and the maintenance lane pauses a band before the wall. The forecast's slope is day-based: samples bucket to one point per UTC day (the day's last sample wins), a sample whose census was partial drops out of the fit entirely - an incomplete census understates the vault by exactly the surfaces it could not read, and the jump when they become readable again would otherwise fit as growth - and the fit needs three distinct days inside a trailing 30-day window before any daysToCap figure exists, so two calls a minute apart around one ordinary write no longer extrapolate the burst into a full vault, and a season-old slope (including a season-old reclamation) stops steering the line once the window slides past. The lane's capacity gate carries storage.pause_percent (template-documented, defaulting to the warn band, validated strictly below critical_percent - a pause at or past the refuse line could never pause anything): a measured percent at or past the line skips the pass with the skipped:capacity verdict while interactive ingest still works until the critical refusal. And the gate records its census as a storage_usage sample on every run where it evaluated, skip or proceed, so a vault where nobody runs the storage report still grows a trend the day-based tiers can fire on.

• A retired document copy keeps its manifest marker, and a copy that cannot retire cleanly stays in place. v1.85.0 dropped the retired copy's content-manifest entry as its resurrect guard, which re-classified the unchanged source as new and let the next batch plan quietly re-ingest it, undoing the retirement. The entry now stays, marked retired_into the canonical page (additive, the manifest schema stays at 3): an unchanged marked source answers a retired bucket and queues out onto skipped_retired, a real byte change re-admits it as modified, and a deliberate re-ingest re-records the entry without the marker. A copy whose inbound-link rewrite failed is refused before the removal - one locked citing note no longer leaves its [[stale-copy]] link pointing at a deleted page - and the apply detail carries the per-copy rewritten and failed link counts. A page elsewhere in Brain/ carrying the same basename refuses the copy outright instead of retiring it, so no leftover [[basename]] is silently re-pointed to the namesake. The detector's bounds are named too: a candidate cap that bound the read set emits a review-only finding carrying the scanned and total counts instead of silently truncating, and the census that reads a retired-and-unchanged source reports it as found, never as a gap.

• The extraction watermark stamps exactly the bytes the delta announced, and the ingest answer reports the appended range. The v1.85.0 stamp always advanced extracted_bytes to the full file size while the tail cut ended at the last complete newline, so an unterminated trailing fragment fell out of every delta: the stamp claimed bytes no delta ever announced, and the next append's delta started past the fragment instead of stitching it in. On a proven append the stamp now lands at the delta's boundary-safe toByte and records the digest of exactly those leading bytes, so the prefix proof stays consistent with the watermark the delta series announced and the fragment rides the next delta; every other shape - first ingest, rewrite, shrink - stays a whole-source pass stamped at the full current file. brain_ingest_source now carries extraction_delta - the named kind beside the boundary-safe byte range - absent on every shape that is not a proven append; extraction itself stays whole-source, so the field is a report of what the append added, never a claim that only the tail was processed. Beside the boundary: a first ingest no longer walks its source for a delta that cannot exist, an append past the read ceiling is named instead of answered like a rewrite, and the watermark's stat-and-hash happens inside the manifest lock.

• The censuses measure the vault they were pointed at, and every front door carries what its core collected. The storage census counts the derived store's directory as a surface - the hook audit, the dead letters, the checkpoints, the session ledgers and the maintenance journal all accumulated outside the meter, and on a busy vault the forecast read ok while the disk filled - with the store files on their own surface so no byte lands in two, and the directory's non-regenerable contents (secret custody, lockfiles) counted as vault-content, the dangerous direction being to overstate the deletable side. It measures the store the configured location (search_db_path when set) points at rather than the default, so the lane gate, the ingest refusal and the doctor check agree about the same vault. appendMetric takes the shard's per-file lock the continuity appender holds, so a receipt fold's compare-and-swap rewrite can no longer move the shard out from under a concurrent append and silently drop the sample - including the storage_usage samples the gate and doctor read. deleteBySource's per-file failed list now reaches both front doors - the forget-source verb's JSON payload and text report, and the MCP answer - with the confirmed run exiting 1 when a file stayed behind, matching the page-dedup verb's rule. The maintenance collectors' error observer is passed by all three production callers - digest, operator summary and doctor - so an absorbed scan failure renders as a named collect_errors row on every surface instead of a thin report that reads as healthy. And the live explorer routes refuse a non-loopback Host header by name.

Changed

• Docs: docs/cli-reference.md states the five storage thresholds with the pause_percent band, the day-bucketed three-day-minimum trend and the whole-derived-store census, names the pause line in the maintenance-lane gate prose, states receipt compaction's opt-in-per-kind allowlist and this-device shard rule, documents the --propose-backlog mode with its conflicts, adds the backlog_nudge_enabled hook flag, and extends the o2b brain explorer entry with the console routes; docs/how-it-works.md states the pause line beside the five gates; the README's "What is new" names the release; the shipped 1.85.0 entry is reworded where this review proved the claim false at ship - the document-dedup bullet names the lexical layer as the wired one and the semantic layer as unreachable wiring, and the incremental-extraction bullet and opening paragraph report the appended byte range instead of claiming the new text is extracted without a full reprocess.

1.85.0 - 2026-10-15

Open Second Brain 1.85.0 gives a long-lived vault the means to watch its own storage and to keep its append-only ledgers in shape: a measured per-surface byte census with a days-to-capacity forecast that warns in graduated tiers, background producers that pause behind a fifth maintenance gate before the wall while interactive writes keep working until a hard, validated refusal at the critical tier, receipt ledgers that compact behind an explicit preview-bound apply, near-duplicate document copies that retire behind the hygiene review gate keeping the newest copy, bulk removals that report per-file failures instead of aborting, and large appended sources whose re-ingest proves a pure append and reports the exact appended byte range. No cap is configured by default: an uncapped vault reads unbounded, nothing pauses and nothing refuses.

Added

• A measured storage report: o2b brain storage and brain_storage. One builder feeds both surfaces, and each invocation takes one census and appends one storage_usage sample, so the forecast series accumulates precisely because the report was asked for. The report answers three questions in one pass: what the vault's storage holds per surface (brain_tree, and the dot-directories .snapshots/, .artifacts/, .archives/, .payloads/, .state/, plus the derived store with its WAL/SHM sidecars - each measured or refused by name), where it is heading against the configured cap - a tier (ok, warn or critical, or unbounded, unmeasurable, no_forecast) with the percent-used and days-to-cap figures it rests on, the trend linear over the recorded samples from two up - and which sample this invocation recorded, appended or named when it could not be. The verb is a report and never fails on a finding: a critical tier still exits 0, because enforcement lives at the gates that consume the tier. Below local reach the census is not taken: the answer names the reason and carries no figures.

• A storage policy block. storage: joins Brain/_brain.yaml through the config template and the resolver: cap_bytes plus four thresholds (warn_percent, critical_percent, warn_days, critical_days, defaulting to 80 and 95 percent of the cap and 30 and 7 days to it at the measured trend), with the critical band required to sit past the warn band - a larger percent, a smaller day horizon. An absent cap_bytes means the vault is unbounded; setting a cap is what turns on the forecast tiers, the capacity gate and the storage-capacity doctor check.

• The maintenance lane's fifth gate. A configured cap arms the lane's capacity gate, evaluated last because it is the most expensive - a fresh byte census of the whole vault - and it decides from that fresh census at decision time, never the stored aggregate: a sample taken yesterday says nothing about a vault an agent wrote into this morning. Only a measured critical tier closes it - an unmeasurable store leaves the gate open with its own capacity:unmeasurable journal row, the same honesty the host-pressure gate practices - and a closed gate skips the pass with its own skipped:capacity verdict, the journal row carrying the tier and the reading behind it while the skipped run still appends its usage sample first, so the forecast series keeps accumulating exactly while producers pause. The lane's front doors carry the verdict and its remedy, and where the caller has no local reach the reading stays behind: brain_maintenance status renders the tier word and the unmeasurable reason without the three byte-and-percent figures. --force (MCP force) bypasses the four soft gates - window, busy, pressure and capacity - and every streak refusal; it never bypasses the lease.

• Interactive writes keep working until the wall. The lane's gate pauses background producers; it does not pause a session. brain_ingest_source refuses with capacity_exhausted once a fresh census measures the vault at the critical tier, and the check sits in the validate phase before the write path opens, so a refused ingest leaves the vault byte-identical. The refusal names the tier and the remedy at every reach; the whole-vault figures ride only where the census itself may be read.

• Receipt compaction: o2b brain receipts and brain_receipts. The continuity and metrics ledgers grow one record per event and never shrink; compaction gives them a drain. scan (the CLI's default mode) inventories both ledgers read-only, per shard: records, foldable, protected, unparseable, aggregates, bytes. compact folds expired records into per-kind, per-month aggregates inside the named shards - the mode and the family:name shard spelling are one shared vocabulary, so the verb and the tool cannot drift - and never runs without explicit shard ids from a scan. A compact previews unless --apply (MCP apply) is passed, takes a recovery-point snapshot before a confirmed run, rewrites each shard atomically, and honors a count guard: --expect N (MCP expect) asserts exactly N records will fold and aborts without writing on a mismatch, and --strict refuses a confirmed compact that carries no guard at all. Only records older than the age threshold (--older-than-days / older_than_days, default 30) and in no protected class fold; the protected classes never fold whatever their age - the source_invalidation audit trail and the two context-compaction kinds, whose vocabulary a storage operation must not collide with - so their lines stay verbatim, and one receipt_compaction audit record closes a confirmed run. Below local reach compact is refused by name; scan stays readable at any reach, and the receipt-ledger-growth doctor check reports ledger growth the same way.

• Near-duplicate document retirement. The opt-in document-dedup hygiene detector nominates near-duplicate copies of ingest summary pages - a lexical similarity of 0.8; the semantic embedding layer (the 0.97 threshold) ships exported and tested but reaches no scan caller yet, because the synchronous scan registry cannot call it, so no surface reaches it until that wiring lands - and selects the newest created_at as the canonical, a page without created_at being ineligible rather than guessed at by mtime. apply routes a selected retire finding through the retirement core: every inbound [[stale-copy]] wikilink inside the detector's scope retargets to the canonical spelling (a same-basename page elsewhere in Brain/ keeps its links untouched, and the report names the skip), the copy is removed, its content-manifest entry is dropped - which is the resurrect guard, since with the entry gone the source can only return as a deliberate full re-ingest - and one source_invalidation audit record per copy names the canonical, the retired id, the dropped manifest key and the retained source-archive hash. The whole span sits behind the destructive-snapshot gate, and it fails soft per copy: one copy's failure is collected and named while the remaining copies still retire.

• Incremental extraction of appended sources. The content manifest's entries gain an optional extraction watermark (extracted_bytes, extracted_at - how many leading bytes the last extracting pass covered, strictly additive, the manifest schema stays at 3, and an entry without the fields reprocesses fully the next time it actually changes, so nothing forces an eager mass reprocess). When a re-ingest meets a watermarked record, the delta proof first shows the growth is a pure append - the SHA-256 of the leading watermark bytes must still equal the recorded digest, read through one non-blocking descriptor - and only then is the tail read through a UTF-8-safe from-offset read whose start snaps forward past a partial multi-byte sequence, bounded by a ceiling; the appended {fromByte, toByte} range rides the ingest result and the CLI extract preview as a report of what the append added - extraction itself stays whole-source, so the range is honest reporting, never a claim that only the tail was processed. A rewritten source - even one that happens to grow - fails the prefix proof and answers no delta, and the full reprocess is the safe direction. The extraction contract stays at version 2.

• Two doctor checks join the lifecycle. storage-capacity reports fullness for a capped vault - tier, percent and trend where the census can be taken, and below local reach it answers in the uncertain stream that the reading was not taken, no figures - and skips its own gate when the vault already measures critical. receipt-ledger-growth reads both receipt ledgers and reports their foldable share before compaction becomes the remedy worth running.

Fixed

• A bulk source removal no longer aborts on the first blocked file. A confirmed deleteBySource - the cleanup o2b brain forget-source and the brain_delete_by_source tool run - removed derived entries one at a time and threw away the whole run on the first removal it could not complete, leaving the vault half-cleaned with no record of what stayed. Each derived entry and included original now removes through a collecting wrapper: the remaining entries still land, the result carries a failed array of path and message records naming what stayed on disk, and the source_invalidation audit counts both sides honestly - removed N, failed M with the paths. The partial-progress counts persist even when the manifest write itself fails and the run rethrows.

• Page-dedup merges and maintenance collections fail soft per item. A page-dedup --apply was a bare loop where one refused merge or one blocked wikilink write aborted every cluster queued behind it; the loop now collects each refused merge as a key-and-message pair, still applies the later clusters, reports the failures beside the merged and wikilink counts, and the CLI exits 1 when the failure list is non-empty. The maintenance action collection behind the doctor, digest and health surfaces absorbs one scan's failure as a named collected error while the remaining signals still collect, so a thin report because a scan refused is distinguishable from a thin report because the vault is healthy.

Changed

• Docs: docs/cli-reference.md corrects the maintenance-lane prose to the five-gate reality and the actual --force semantics, gains a storage-lifecycle section documenting o2b brain storage and o2b brain receipts with their flags and exit codes, and adds the opt-in document-dedup detector to the hygiene row; docs/mcp.md raises its advertised tool count to 117 and adds brain_storage and brain_receipts to the Tool Highlights table; docs/how-it-works.md states the lane's five gates; docs/metrics.md documents the storage_usage sample surface; the README's "What is new" names the release.

1.84.1 - 2026-10-15

Fixed

• A stored comma-separated scope no longer aborts the dream pass. parsePreference reads scope: alpha,beta back verbatim, and records written before the v1.78.0 tag hardening can carry that shape, but the refresh writer composed the whole value as one brain/scope/... tag, the shared tag rule refused the comma, and dream threw TagSyntaxError on a record the reader accepts - whether the stored tag was the valid original or a legacy comma-bearing one. A comma-separated scope is now a list at the tag boundary: each trimmed, non-empty segment composes its own brain/scope/<segment> tag, duplicates collapse, and the scope field stays verbatim, so the record keeps its meaning. Preferences and signals share the one rule (scopeTagValues). New caller input stays strict: a segment that fails the tag rule (a space, a special character) is refused unrewritten, and a preference write names the record (fix the scope field of pref-<slug>). Records the dream pass rewrites from disk - a refreshed preference, or a new preference promoted from stored signals - and the keep record of brain merge compose leniently instead, because a vault written before v1.78.0 can hold a scope such as front end: a failing segment is slugified the way a topic is (brain/scope/front-end), a segment whose slug still fails the rule composes no tag, and the scope field stays verbatim either way. Reported by @Padde86 in #253.

• The MCP identity tests no longer read the developer's real config. Two test files cleared OPEN_SECOND_BRAIN_CONFIG after they ran instead of restoring it, so every later file in the same process lost the test preload's throwaway config and config discovery reached the real user config; the owner-scope fallback-identity test then saw a configured agent name instead of the unresolved placeholder and failed whenever it ran after them. Both files now restore the prior value, and the fallback-identity test pins its own config with no agent_name and no VAULT_AGENT_NAME.

• The iterative-recall deadline test no longer races wall time. It simulated an expired deadline by shifting Date.now a constant 10 s, but the search reads its own start instant through the same clock, so the offset cancelled out and expiry still depended on real elapsed time; on a fast enough run the looped search reached the loop gate before the 1 ms budget lapsed and ran a round the plain search never runs. The stub now steps the clock forward on every read, so every check after the start is expired regardless of load. The search code was already correct.

• The overlap fallback test asserts the interval it can actually measure. For a provider that never reports a dispatch (the offline local embedder) the embed interval is the whole awaited call, and its resolution stamp is written only after the synchronous keyword lanes yield, so the interval encloses the keyword interval and overlapped_ms is that interval's length - 0 or 1 ms on the wall clock depending on whether the lanes crossed a tick. The test expected exactly 0 and failed under load; it now steps the clock the request reads and asserts the ordering (pre-call start before the keyword lanes, resolution after them) and that the overlap equals the keyword interval.

1.84.0 - 2026-10-14

Open Second Brain 1.84.0 hides the recall lane's embed round trip behind the keyword work and accounts for the overlap: hybrid search now starts the semantic lane before the keyword lanes run and joins it where the serial await stood, search --explain reports the overlapped milliseconds, and the bench latency family carries the same figure per question and in aggregate. Every surface is byte-identical when the new option is absent, and no configuration changes.

Added

• The semantic lane starts before the keyword lanes. Hybrid search's one caller wait - the query embed - is now put in flight before runKeywordLane runs: the lane starts through a join seam that attaches its rejection handler in the same tick, and the join stands where the serial await stood, in both deadline arms. The lane start stays after the query-cache probe, so cached answers still cost nothing; an already-expired composite deadline starts no embed at all (the never-start rule moved to the start site); and a keyword-step throw with the embed in flight can no longer strand an unhandled rejection - with a deadline the lane's late, non-abort failure is named by the hybrid deadline: an abandoned lane failed after the answer: sentence, without one it is defused. The keyword pool size reaches the lane as a supplier read at lane completion, so the hybrid_degraded signal keeps grading the same snapshot the serial pipeline captured; the post-join void and every later deadline checkpoint are untouched. Results, warning order and the query-cache keys are byte-identical: the deadline-degraded answer stays keyword-only, and the wall-clock budget is neither started earlier nor extended.

• overlapped_ms on search --explain. The overlap of the embed and keyword intervals - max(0, min(embedEnd, keywordEnd) - max(embedStart, keywordStart)), zero whenever the embed never ran - rides a per-call timing sink on the search options, never the outcome: the query cache persists whole outcomes, so an outcome field would freeze one call's timings into every cached row served afterwards. With --explain, the JSON payload carries an integer overlapped_ms beside semantic_attempted, and the human transcript prints the overlapped line in the explain block; without the flag the payload is byte-identical (off means absent). A cross-vault union captures no timing, because a union merges one search per origin and no honest single figure exists for it.

• A caller-selectable packing policy over the pack's two candidate populations. brain_context_pack gains packing_policy (facts_first or retired_first), strictly opt-in and byte-identical when omitted: inside one pack the preference-derived pages and the retired pages already share the single max_tokens budget, and the policy names which lane claims it first - facts_first claims for the distilled facts lane before the pages lane fills the exact remainder, retired_first hands the first claim to the retired pages lane - query-ordered in the ranked and semantic query modes, tier-then-recency ordered in the default substring mode, where the query filtered rather than ranked. Neither member is the omitted default: the omitted pack interleaves both populations by tier, while a named policy orders whole lanes - every preference before every retired page under facts_first - reserves the attention charge up front instead of drawing it last, and refuses a vault where one lane holds no candidate in reach, a call the omitted pack succeeds on. Claiming is strictly sequential with no minimum-page floor, the total never grows, the per-memory character cap stays lane-internal, and the synthesized attention block stays a reserved charge neither lane draws; lane overflow keeps the shipped over-budget skip reason. The pure allocateRecallBudget primitive lands beside the shared applyCharBudget (frozen vocabulary, narrowing guard, lane allocations plus any reserved charge always summing to the total), and the report's packing accounting - the policy name, the reserved attention charge, plus each lane's allocation, delivered spend, candidate count and item count - is wired through the one finalize funnel, so the char-budget path agrees with it; a zero budget with a policy named gets no accounting at all, because that call is refused before anything is returned. The refusals all fire by name and before any receipt or telemetry is written: a non-member value, a policy without a query (inert), a policy against a one-lane vault (INVALID_PARAMS naming the lane and the member, and both lanes when both are empty), a zero budget with a policy named, and a reserved attention charge that consumes the whole budget. The MCP argument mirrors query_mode argument for argument: the schema enum derives from the frozen tuple, the query pairing is declared dependentRequired style, and every refusal arrives on the wire as INVALID_PARAMS carrying the named message; the response gains packing only when the policy was named. Receipt and telemetry budget metadata and the prompt-prefix metric segment carry the policy as a closed-vocabulary member under the same only-when-named rule. No CLI flag (the query_mode MCP-first precedent) and no recall-inject or hook change - the hook runs a single lane, where a policy would be inert by the design's own refusal rule.

• overlapped_ms in the bench latency family. The bench passes the per-call timing sink for every retrieval question, so a run whose suite declares the embeddings capability and pins the semantic lane reports overlapped_ms per question and its mean in the aggregate latency_ms family - both present only when at least one question attempted the embed. Keyword-only runs (the default pin) add no key anywhere: the report JSON, the committed failure-modes baseline and the human output stay byte-identical, and the human overlapped_ms: avg N line prints only when the aggregate carries the figure.

• Opt-in standing-instruction facets with first-mention provenance. The standing_query attention action gains a standingInstructionFacets option: unset, every emitted string is the legacy pref-<slug> (scope) output byte for byte and sections carry no facet data; set, a surfaced preference whose provenance join resolves gains a first-mention annotation on its item string ( [first mention turn <session>#<turn>], or [first mention event ...] for a capture-lifecycle origin, which is not guaranteed to be a turn id) plus a structured StandingInstructionFacet entry - the preference-corpus sibling of ThreadFacet, same contract shape (stable pref:<id> key, ordered origins, pure derivation), distinct name so the coverage lane's meaning of facet stays unambiguous. The join is a new pure read-time module (src/core/brain/preference-provenance.ts, no I/O, the signal lookup injected) over evidenced_by wikilinks and producer-aware session_ref parsing: import-session basename#turn resolves as a turn, capture-lifecycle session:<id>#<event> as an origin event labeled as what it is, and the bare session:<id> the auto-extract path persists resolves to nothing - the never-guess rule covers every other shape, so an unknown ref yields no provenance rather than an invented coordinate. The option changes annotations, never membership: ownership and retirement exclusions apply before annotation, so a facet cannot surface a preference the plain lane withholds; a preference whose join does not resolve keeps the plain string and is absent from the facets - an honest zero, never an implied provenance; and the whole lane performs zero writes, standing-rules opacity and the vault-identity guard unchanged.

• A standing_instruction bench category gates the facet lane. The new category joins BENCH_CATEGORIES and drives the shipped surfacing call with the facet option on over the fixture vault, so the lane ships measured: evaluateQuestion asserts the expected facet keys - pref:<preference id>, the preference id itself - and the expected first-mention annotation, whose kind word keeps an event-annotated origin from satisfying a turn expectation; a surfaced preference whose join does not resolve is a named failure, never an implied provenance. BenchPinnedKnobs gains the lane's identity marker: it changes no behavior - the category is armed by the fixture - but folds into the checkpoint hash, so a resumed run that would mix a facet-gate arm with a plain one fails the identity guard, while the default pin serializes byte-for-byte unchanged. Reports without the category keep their bytes, and the human standing_instruction: <passed>/<total> (pass rate <n>) line prints only when the quality buckets carry the category; the exit code stays all-pass-or-nonzero with the category in play.

1.83.0 - 2026-10-13

Open Second Brain 1.83.0 wires four shipped seams, each opt-in and byte-identical when off: a per-source-session cap on the search candidate pool, usage-ordered skill offers on skills_attach, seeded question-type-proportional sampling for the LongMemEval bench suite, and the OpenCode V2 config shape for the opencode install. No new MCP tools, no new continuity record kinds, no new external dependencies.

Added

• A per-source-session cap on the search candidate pool. search_pool_max_per_session (OPEN_SECOND_BRAIN_SEARCH_POOL_MAX_PER_SESSION, integer, default 0 - off) bounds how many rows one source import session may contribute to the reranker-facing candidate pool. A row's session identity is a non-empty session_ref frontmatter value (imported signal notes), else a non-empty session_id (handoff notes), read through the same frontmatter cache the pool filters already use; rows without identity, and rows whose frontmatter is unreadable, pass through uncapped. When the cap is active it sits after the relevance floor and before the MMR diversity rerank and joins the pool-width widening, so the cap spreads the window across sessions instead of merely truncating it sooner. The backfill trigger is unchanged - the cap never adds a reason for the second assemble pass, and when that pass runs for its own pre-existing reasons the cap is re-applied over the wider pool, with the reported trail being the final pass's. Drops carry the new retrieval-trail code source-session-capped-rows (detail.dropped against detail.cap), noted once per answer. The knob rides the search_mmr_lambda plumbing exactly: parsed in resolveSearchConfig, range-validated in validateResolvedConfig (a negative value is refused), surfaced as the optional ResolvedRecallConfig.poolMaxPerSession spread-omitted at 0 so exact-shape resolved-config assertions keep holding, with a per-query SearchOptions.poolMaxPerSession override and both results-affecting folds - the search config fingerprint and the per-query cache key - so a knob change can never serve stale cached rows. A bench --pin accepts the knob by name ({"recall":{"poolMaxPerSession":N}}). Off (0 or absent), results and query-cache keys are byte-identical and no frontmatter reads are added; with the knob on, the resolved value folds into the search fingerprint so cached rows can never go stale, while in a vault with no session identity the results alone stay byte-identical at any value.

• Usage-ordered skill offers on skills_attach. With skills_attach_usage_ordering (OPEN_SECOND_BRAIN_SKILLS_ATTACH_USAGE_ORDERING, default off) on, observed skill_invoked usage reorders the survivors of the discriminating-term floor by the bounded composite score * (1 + 0.5 * weight) - SKILL_USAGE_ORDERING_MAX_BOOST = 0.5, weight the usage store's decay value in (0, 1] - with equal composites resolving by name ascending, so a skill an agent invokes daily can rise over a slightly hotter one-off while a wide relevance gap stays decisive, the floor is never crossed by weight, and every returned score stays the untouched lexical score. The pure skillUsageWeights(usage, knownNames) builder joins usage onto discovered names without rewriting any record: exact names join first, plugin-qualified keys (vendor:name, the shape the Claude Code Skill tool records) join through the longest suffix after a colon that names a discovered skill, keys matching nothing are dropped, and the higher weight wins when several rows join one name. Private records never count: the continuity read drops private rows the same way every reader does. The tool derives usage exactly once per attach call only when the flag is on and feeds the same weight map to both build paths, so the deterministic and decision-model offers stay coherent; the tool description names the knob in one clause. Flag off - or on, in a vault with no usage records - the offer is byte-identical to the lexical order.

• Seeded LongMemEval sampling. o2b brain bench memory --suite longmemeval --sample-seed <value> --sample-cap <n> scores a deterministic, question-type-proportional subset of the dataset instead of running it wholesale. The flags are a pair (either alone is refused by name), the cap must be a positive integer (otherwise refused naming the value), and both together require a suite whose registration declares the new sampling capability - longmemeval is the only one - otherwise refused naming the suite, so the flags can never be silently ignored by a loader that cannot honor them. The pure sampler (src/core/bench/longmemeval-sample.ts) excludes abstention entries first (both spellings; their count still lands in abstention_excluded), stratifies the survivors by their present question_type values sorted ascending, apportions the cap across strata by largest-remainder (Hamilton) apportionment clamped to the population with fractional ties broken by stratum name, and draws within a stratum by a seeded Fisher-Yates over its own mulberry32 PRNG keyed by sha256Hex(seed) - no Math.random, no wall clock - over entries sorted by q_id, so dataset file order cannot change the subset; the selection re-sorts by q_id, and a population of zero after abstention exclusion raises the named LongMemEvalSampleError. Sampling happens before conversion, so a sampled run materializes fixture notes and continuity records only for the questions it scores; the receipt gains sample_population, sample_selected and the per-stratum sample_strata beside abstention_excluded, and the report line gains sample_selected N only on a sampled run. The seed and cap fold into benchRunIdentityHash spread-omitted: run ids of runs without sampling are byte-stable (the committed pins hold unchanged), two runs differing only in seed or in cap get different ids even when the sampled fixture would be identical, and a resumed run whose sampling options changed fails the identity guard by name. Without the flags the loader path is byte-identical, and the frozen locomo and sample fixtures stay untouched.

• The opencode install learns the OpenCode V2 config shape. The adapter now detects, through one shared function used by apply, verify, detect and plan, whether the config carries the native V2 mcp.servers object - and registers there - or keeps the legacy top-level mcp key every earlier release wrote. When only opencode.jsonc exists it is the resolved config path, and a vendored minimal JSONC editor (src/core/install/jsonc.ts, token-offset splices, no new dependency) edits comment-bearing files so comments and formatting survive byte for byte outside the changed entry; duplicate top-level keys are a named JsoncEditError refusal, and a BOM is stripped on read and restored on write. An existing healthy top-level registration is never migrated when mcp.servers appears (V2 hosts keep reading a legacy declaration, so migration would churn installs for zero benefit); the manifest records the key actually written (mcp.servers.<entry> or mcp.<entry>), and uninstall removes exactly those keys under either shape. When the host adds mcp.servers to a config the adapter previously owned, the first --check reports drift once and the first re-apply is refused through the user-modified-block guard; a forced re-apply (--force) registers at the native path and cleans the shadowed legacy copies of its own two keys, never user keys. V1-shaped plain-JSON configs keep the previous write path byte for byte, and the doctor's registered-command probe learned the nested mcp.servers key so a healthy V2 install passes o2b doctor.

Changed

• Docs: docs/cli-reference.md gains the search_pool_max_per_session row in the recall-quality config table, the source-session-capped-rows row in the retrieval-trail vocabulary, a per-source-session pool cap section, and the bench sampling flags with their selection semantics and the resume-guard consequence; docs/how-it-works.md covers the cap in the recall-layers ranking paragraph; docs/mcp.md adds skills_attach_usage_ordering to the skills_attach opt-in list with the name-normalization rule, the private-records note and the per-call cost; docs/observability.md documents the sampling flags, the stratified selection, the receipt fields and the identity fold; install/opencode.md documents the V2 shape, the .jsonc path, shape-aware uninstall and the one-time drift; docs/updating.md gains the 1.83.0 upgrade note for that drift, following the 1.50.0 convention; the README names the release and extends the search capability (mirrored into plugins/codex/README.md by the mirror sync).

1.82.0 - 2026-10-12

Open Second Brain 1.82.0 is the recall-quality release: it widens what recall can reach on a hard question and makes every surfacing decision measurable. A bounded iterative recall loop keeps querying after the single self-correcting second pass and, when coverage gaps survive, pauses mid-answer with a plan the caller executes and commits back; session recall gains a coverage-first selection that answers for a whole thread instead of a keyword's hits; recall admission moves onto one shared graded surfacing key that the recall-inject hook and the recall gate grade identically; and the bench grows the harness to score all of it - a suite registry, a LongMemEval lane with a strict recall_all@5 receipt, and a surfacing-replay suite that measures the graded gate itself. The default posture of every surface is byte-identity: with the knobs off, every response and every query-cache key is exactly what it was.

Added

• A bounded iterative recall loop behind brain_search's plan/commit round-trip. With the operator knob search_iterative_recall_enabled on (OPEN_SECOND_BRAIN_SEARCH_ITERATIVE; the round cap search_iterative_recall_max_rounds / OPEN_SECOND_BRAIN_SEARCH_ITERATIVE_MAX_ROUNDS defaults to 2 and clamps to 8), a query marked iterative: true runs gap-driven rounds past the single second pass: each round re-measures pool coverage, emits follow-up sub-queries from the uncovered rare-term groups, and merges what they recover into the same ranked pool, stopping on coverage completeness, a round that recovers nothing, the marginal-value stop extracted from the retrieval advisor, the round cap or the composite deadline. The deterministic k-group coverage planner is the always-available floor - the mode is useful with no model in the loop - and the decider rounds are additive: when measurable gaps survive the deterministic budget, the call pauses with an iterative marker at phase: "needs-llm-step" carrying the decider envelope, the candidate pool ids, the uncovered gaps and an opaque single-use round token, and the caller re-invokes with iterative_token plus iterative_payload ({evidence, subQueries}), validated in full before any pull runs - unknown chunk ids, oversized or over-limit sub-queries, sub-queries carrying no significant terms, a replayed token (token_used), a mismatched one (token_mismatch) and a fully-formed commit arriving while the loop is disabled are typed refusals surfaced as caller errors. The round-trip runs on the single-vault path only: any iterative field combined with global: true is refused by name at the argument layer, so no iterative field ever reaches the federated legs. Every loop that ran at least one round - a committed call, or a plain final - answers with the same marker at phase: "final", carrying the per-round records (terms, groups, added, elapsed, and whether the deterministic floor or the decider authored the sub-queries) and the stop_reason (coverage_complete, no_sub_query, no_progress, round_cap, marginal_value, deadline, decider_round); with the knob off, and on any call the mode did nothing for, the response and the query-cache keys are byte-identical, because the cache suffix that separates iterative rows exists only in the opt-in mode.

• Coverage-first session recall on brain_session_grep, with CLI parity. operation: "coverage" replaces the grep's term matching with thread coverage over the same lineage-scoped record set: facets are the thread's own - distinct mined entity keys and depth-1 summary clusters, never a word list - and fan out under the adaptive topic budget clamp(distinct facets, floor 12, cap 16), the selection returns in chronological order under the required char_budget beside recomputable diagnostics that report the realized topic count honestly, and entity_key optionally seeds the fan-out from the session_entity_mention rows an import already mined - no new mining, no new record kind - with an entity no record mentions refused by name instead of answered with an empty result. The operations keep their arguments to themselves: char_budget under match, and query, since, before, limit, snippet_chars, include_raw and raw_budget_chars under coverage, are each refused as not applicable. A budget that cannot hold the floor-weighted selection is a typed infeasibility mapped to INVALID_PARAMS, naming the requested topics, the kept ones and the required characters - a retry bound, never a silent truncation, with the floor enforced again after the real budget pass so a crowded-out floor topic cannot slip through the pre-check. brain_session_describe accepts topics: true, adding the topic_report the coverage operation fans out under (detected facets, the budget, the realized topics); without it the response is byte-identical. The CLI mirrors both surfaces: o2b brain session-grep --operation coverage --char-budget <n> [--entity-key <key>] and o2b brain session-describe --topics, with the same refusals.

• A bench suite registry, with LongMemEval and surfacing-replay suites. o2b brain bench memory --suite <name> resolves through a registry mapping each suite name to its loader plus a declared capability set ({embeddings: boolean}), so what a suite may do is explicit in code rather than flag-implied; omitting --suite stays the byte-identical default path. --suite longmemeval adds the benchmark the memory field reports recall_all@5 on: a fail-fast parser over the official dataset shape with named parse errors, a converter into the unchanged bench fixture that drops abstention questions at conversion with the count recorded and joins gold sessions by direct id membership (an unknown id is a named parse error, and expected_text is never set, so nothing silently scores nothing), a committed sample fixture certifying CI with the full dataset an operator-supplied path that is never downloaded at run time, and the strict named report family longmemeval: {recall_all_at_5, abstention_excluded} beside the untouched quality, latency and context_cost families. The judge glue reuses bench_judge_cmd: when the suite provides them, the stdin payload's questions carry question, answer, gold and the evidence the run actually injected (path plus a bounded excerpt per retrieved note, in rank order) beside the usual result fields, and the judge prompts are house-written in the spirit of upstream's evaluate_qa.py rather than transcribed from it, so the external command stays a dumb model call; suites without judge input keep the payload byte for byte. Embeddings are a per-suite capability: the semantic lane is reachable only for a suite that declared it, the index builds through the apply-gated embedding path with the spend plan surfaced and never silently bypassed, a shared vector cache under the runs dir keyed by provider, model, dimension, prefixes and text hash lets both arms compare byte-identical vectors, and --pin <json> plus --recall-floor <n> expose pinning and the admission floor from the CLI. --suite surfacing-replay replays a recorded prompt corpus - a committed session fixture in the replay shape, carrying each prompt's recorded predecessor for the structural gate - through the shipped decision core and scores the graded surfacing gate's know_to_ask and false_fire rates under the same denominations the proactive-recall metric uses, with per-turn injected_tokens, checkpoint and resume, and the abstain-costs-zero invariant asserted: the calibration becomes a measured number a re-run re-measures.

• Bench runs carry their configuration in the run identity. A SearchConfigOverrides-shaped knob pin applies last through resolveSearchConfig and folds into the checkpoint hash beside the fixture hash and the proactive-recall admission floor, so a resumed run that would mix configurations fails the identity guard by name instead of silently comparing two pipelines, and two runs with different pins get different run ids. The default pin is the semantic-off override the harness always applied, so locomo report numbers stay identical; the one-time consequence is that in-flight runs started before this change fail the resume guard loudly and restart.

Changed

• Recall admission is one graded, channel-aware key. The recall gate's binary prompt-structural predicate stays the structural pre-tier with its named short-circuits (empty prompt, verbatim repeat, slash command, shell command) and keeps projecting the binary {retrieve, reason} contract unchanged; admission now rides one shared calculator that grades absolute match quality - the IDF-weighted coverage a search outcome already reports, the quantity recall-adequacy grades - calibrated per transport channel, and orders by the existing fused composite, which is never a threshold basis. brain_recall_gate and the recall-inject hook's floor branches consume the same {key, tier, admit, reason} decision, so a tier boundary surfaces the same reason on every channel, and a measured brain_recall_gate call returns key and tier beside the binary decision, absent - byte-identical - without a measurement. Per-channel admission floors ship as exported module constants at the hook's 0.35, the hook's RECALL_INJECT_CONFIDENCE_FLOOR now derived from that single source, with no new config knobs. Gate telemetry under the existing recall_gate_telemetry opt-in records optional key, tier and channel on measured decisions and summarizes counts by tier; the opt-in-off path records nothing, and no new record kind exists.

• Docs: docs/mcp.md documents the iterative round-trip, the coverage operation with its argument partition, the graded surfacing key on brain_recall_gate and the widened gate telemetry; docs/cli-reference.md documents the coverage flags with their CLI parity, the iterative-recall and graded-key sections, and the bench suites with the run identity; docs/observability.md covers the gate-telemetry key, tier and channel fields and the suite registry; the README names the release and extends the search and session-recall capabilities.

Fixed

• The iterative loop answers to the reach rule everywhere. The round records counted raw pull hits, so at non-local reach a probing caller could read recovery counts for terms only withheld pages match - the same boundary the pause pool already honors; the reach filter now governs the loop's working set, so withheld candidates never enter the pool, the round accounting or the coverage gaps. An expired composite deadline at block entry also skipped the commit refusal, handing the caller a plain answer and an unspent token with no error; the commit is refused by name like every other half-executable commit, and the round token is claimed atomically so two racing commits cannot both spend it.

• Coverage selection refuses honestly instead of silently degrading. The private-row rule the entity-seed resolver applies now covers the coverage facets too, so a private mention can no longer seed a facet whose key surfaces in the diagnostics or the topic report; the entity seed and its typed unknown-entity refusal reach both shipped surfaces (they were core-API only); and the echoed entity key is capped at the sibling argument bound.

• The bench refuses the identities it cannot honor. A run id of dots passed the charset check and resolved into the runs-dir root, writing the checkpoint and vault beside the shared vector cache, and is refused by name; distinct LongMemEval session ids that sanitize to one evidence note are a named parse error instead of silently merging both sessions' evidence; and the embedding cost gate prices the misses census, so a second arm the shared cache serves whole is no longer refused under a positive gate against the zero-provider-contact purpose the cache exists for.

1.81.1 - 2026-10-12

Fixed

• The snapshot exclusion no longer depends on the shape of a directory entry. createSnapshot lists the top-level Brain/ entries with readdirSync(dir, { encoding: "buffer" }) and drops .snapshots and .artifacts by name. The name was read with toString(), which is right for a Buffer but renders a bare Uint8Array as comma-joined byte values ("46,100,..."); on a runtime that returns that shape nothing matched, .snapshots was packed into every archive, and each dream snapshot carried its predecessors until a run outgrew its timeout. Entries now decode through Buffer.from, which reads either shape, and tests pin both the archive members and the bare Uint8Array decode. Bun 1.4.0 and 1.4.2 on Linux return Buffer entries, so vaults there were not affected. Reported and fixed by @Iversondwx in #243.

• The explorer's port-in-use test no longer collides on busy runners. It held a random port and failed when another process already owned it; it now holds a port the OS assigns.

Changed

• Dependencies: oxfmt 0.72.0, oxlint 1.87.0, @types/node 22.20.5 and @node-rs/jieba 2.0.4; CI actions actions/upload-artifact 7.0.2 and hashgraph-online/ai-plugin-scanner-action 1.2.772.

1.81.0 - 2026-10-11

Open Second Brain 1.81.0 is the answer-trust release: it narrows the gap between what an agent was given and what its answer can be believed on. A Stop-hook step now checks the quotations in the assistant's own answer against the note cited for them or the evidence the injection ledger actually delivered, a stated claim can name the context-pack sample it drew on and read the receipt and outcome provenance back, trusted local-file ingest keeps the source's bytes in a durable content-addressed archive instead of trusting a file to stay where it was, and a record with no session is read as no-session everywhere instead of pooling into one phantom bucket. A repair lane closes the outstanding review findings: attribute narrowing in search no longer silently excludes documents whose indexed snapshot has gone stale, and the wave's own review hardened the annotation channel, the provenance reach and the archive's write path.

Added

• Answer-time quote verification, shadow by default. A new Stop-hook step registered after the stop-log guardrail walks the last assistant messages of the turn, finds quoted spans with the distill lane's quote helpers (imported, never forked), resolves each span's evidence - a note named in the span's context by wikilink or vault-relative path, else membership in the injection ledger's delivered notes for the phases actually running - and checks it through a pure module over five verdicts: verified, not-in-note, source-truncated, note-unavailable and not-text. Degradation never upgrades a verdict: a note whose body reached context truncated is matched against the prefix that was delivered, and a miss there is source-truncated, never not-in-note; a note that cannot be read is note-unavailable, because "we could not check" is a finding, not an all-clear. One additionalContext annotation per turn lists the unverified spans as flattened, capped previews; Claude Code renders it and the other registered runtimes stay silent. The step never blocks, never edits a transcript, and reads a bounded message window under character and wall-clock caps, failing open with exit 0. Configuration is per phase in the quote_check block of Brain/_brain.yaml - recall, active and subagent, each off|shadow|enforce, default shadow (annotate-only), scoped to the phases whose injection the vault enabled - and enforce additionally appends exactly one Brain-log note event per turn carrying the counts and the finding lines, so findings survive the session.

• Statement-level claim attribution. brain_truth state and o2b brain truth state accept an optional opaque sample_id (CLI --sample-id) frozen on the committed claim event - schema version unchanged, omitted when absent, never invented - and claim reads hydrate the provenance behind it: the named context receipt's items plus the context-pack outcome row, joined read-only, one ledger read per report. Provenance is shaped by the caller's reach - below local reach, receipt items whose injections came from operator rules and item paths the caller cannot read stay hidden, so a claim's sample_id never leaks what the receipts surface refuses to say directly - and the join is omit-don't-invent in both directions: a claim whose outcome never arrived reports "receipt known, outcome unknown", a claim timestamped before its claimed receipt is flagged as an inversion rather than silently joined, and a row without a sample_id renders byte-identically to before.

• A durable source archive behind trusted local ingest. Ingesting a trusted local source now reads the file once and archives its bytes content-addressed at Brain/.archives/<sha256>.txt - redacted before persist so credentials never land in a second file, refused past a 1 MiB ceiling rather than truncated (an oversized source is simply not captured, and absence on the page still means exactly "not captured"), deduplicated by its own hash, and never TTL-pruned: evidence, not scratch. Success stamps source_archive_hash and source_archive_bytes on the summary page and returns source_archive_hash on the ingest result; visibility tokens hold, so a source whose digest is refused to remote readers is never archived and remote reach never reads archived bytes. The capture-scope hygiene detector names a page whose archive is missing or no longer matches its stamp, o2b brain doctor prints a count-only archive section (entries, bytes, missing, mismatched, uncited - no fix verb, pruning and recapture are operator calls), brain_hygiene gains archive_get, which resolves a summary page's stamp to its archived bytes at local reach only, and delete-by-source cleanup removes the source's orphaned entries best-effort.

• Explicit no-session identity. A missing or non-string session_id is treated as no-session explicitly at every reader: scoped recall excludes the record, grouping sites skip it instead of lumping it into a shared bucket, and the session-summary digest omits the key rather than answering "" - dissolving the phantom session that quietly collected every unattributed record from every unrelated lane. A new count-only, fail-soft doctor check, blank-session-identity, reports one issue per affected record kind with a count; no payload is rewritten and no repair verb ships, because the continuity store is append-only and repair belongs to a backup-gated posture.

Changed

• Docs: docs/cli-reference.md documents the truth events/truth state verbs with --sample-id and provenance-hydrated reads, the widened capture-scope detector and the doctor's archive section; docs/mcp.md covers archive_get on brain_hygiene, the archive stamp on the ingest result and the claim provenance hydration; docs/observability.md documents the quote-check surface and the no-session rule with its doctor count; hooks/README.md gains the new Stop step; the README names the release and extends the claim-ledger capability.

Fixed

• A stale attribute snapshot no longer silently excludes a document from search. The property pushdown narrowed the candidate pool against the indexed document_attributes snapshot while advertising the live file as the final judge, so a document whose indexed snapshot no longer matched its file - a draft flipped to done - dropped out of a status=done query before the live post-rank filter ever saw it. A store-level freshness gate now compares a candidate's indexed snapshot against the live document during narrowing: a proven-fresh candidate keeps its SQL exclusion without touching the filesystem, a stale one falls through to the lane read without the exclusion fragment and is judged by the live filter, and absent filters still compile byte-identical SQL.

• Review hardening across the wave. The external reviews of this wave hardened what landed: the annotation's findings render as flattened previews under a character cap, the cited-note read is bounded and the transcript tail-window read advances in pages instead of scanning whole files, the archive stats path resolves its root through the containment check before it stats anything, and the archive stamp's single-writer assumption is pinned as an architecture census beside the claim-attribution one.

• Two damaged CHANGELOG entries read as written again. Whitespace that had collapsed inside the v1.72.0 cost entry (words running together around estimated_cost_usd and search status) and the v1.19.0 post-compact-audit block (a lost indent) is repaired; prose only, no claim changed.

1.80.0 - 2026-10-11

Open Second Brain 1.80.0 raises what recall can reach and what the store can answer for itself, on both ends of the pipeline: what enters the graph is gated by what the vault itself has learned, and what the store can filter is answered by the index instead of by per-row file reads. Entity creation consults a store-learned lexicon with two new structural verdicts, session imports mine precision mentions into a hallways graph an operator reviews before anything is promoted, the search store's v14 migration pushes kind and promoted frontmatter keys into SQL on both lanes and hydrates in two tiers, the rerank eval reports per language, and recall telemetry names its dead weight. A repair lane closes every outstanding operator-review finding from the two previous release reviews, and two release-note claims those reviews falsified are corrected here.

Added

• A store-learned entity lexicon behind the admission gate. o2b brain entity lexicon rebuild [--apply] folds the vault's own pages (vault user pages only - the Brain root and session transcripts are excluded, and the artifact header binds that scope) into Brain/entities/lexicon.json: schema-versioned, dataset-hashed, written through one shared derived-artifact helper, and fail-open - a stale, torn or expired artifact reads as absent, so admission degrades to the previous structural behavior and never mis-rejects. No word list ships with the binary; the vocabulary is the vault's own.

• Two tightened creation verdicts, advisory after admission. Entity creation (upsertEntity, the one choke point every minter shares) now refuses a multi-token all-caps label with no prior stored occurrence (shouted-heading) and a caseful label whose every token the lexicon learned as a common word (function-word-run), while structural code shapes (a _, ., /, a digit, or internal uppercase - the symbols the session miner exists for) bypass both case rules, and caseless-script labels admit on the structural gate alone. The verdicts feed the existing heal triangle - the doctor's entity-label-malformed findings and the snapshot-gated, dry-run-default o2b brain entity prune - so already-admitted records are repair candidates, never auto-removed, and anchoring (buildAnchorables, anchorEntityForms) resolves the same handle so junk forms stop anchoring facts.

• Session hallways. Session import mines a precision-mention side ledger - code symbols from spans, fences and qualified-identifier shapes, URLs, file paths in both slash directions, qualified identifiers - refusing secret-shaped tokens outright and deduplicating at (family, key, session) granularity with provenance keyed on the transcript basename, never a host absolute path. o2b brain hallways mine|show|promote|dismiss folds that ledger into pairwise-PMI associations written to Brain/link-graph/hallways.json beside, never merged into, the vault-derived co-occurrence graph, with a reviewable proposals file and cross-run dismissals. Mining itself never writes an entity: promote is the only bridge into the registry, offered solely for keys seen in at least N distinct sessions (--min-sessions, default 3), and a promoted label still answers to the tightened admission gate.

• The v14 store migration. One crash-safe first-open transaction adds a virtual generated chunks.chunk_kind column (page for chunk 0, else section) with taxonomy indexes, a bounded document_attributes side table backfilled from chunk 0 (64 keys per document, 16 values per key, 256 bytes per value; overflow decrements the set and never fails the index; the promoted keys are skipped, so none of them gains a second source of truth), and sargable path-prefix predicates (path >= prefix AND path < prefix || U+FFFF over the canonical POSIX spelling, which also fixes a latent Windows backslash prefix mismatch). The migration never rewrites the embedding tables.

• Kind and property filter pushdown on the query path. A kind filter (page/section, MCP argument and CLI --kind) pushes into the SQL of both lanes - before ORDER BY/LIMIT on the keyword lane, inside the overfetch window on the semantic lane - and the promoted frontmatter keys compile to SQL against their dedicated indexed storage where the push is faithful to the live filter's verdict: type pushes the scalar declared values as the one normalized token the index stores, pinned pushes only for true, and visibility pushes its normalized tokens. tags and every non-scalar shape stay post-rank filters judged against the live file, because the indexed tag corpus and a single token column cannot answer for what the frontmatter array says. Other property keys narrow the candidate pool in SQL against the bounded document_attributes snapshot - only a provable mismatch drops out, since the bounded table can be silent about an over-bound document - and the live filter still judges every surfaced row, so answers stay identical to the post-rank filter alone while a filtered query hydrates and reranks fewer candidates. Pushed filters answer AS INDEXED, a documented divergence from the file on disk, and absent filters compile byte-identical SQL.

• A two-tier hydration cut. The candidate pool hydrates metadata only; content hydrates for the rank cap after assembly, with final results byte-identical and peak hydration bounded by the rank cap rather than the pool.

• Per-language rerank eval. Benchmark dataset queries may carry a lang field (default en, validated like answer), and o2b search rerank-eval reports a per-language split beside the overall aggregates, each language folded with the same reduce over its per-query rows, so a bilingual dataset shows per-script lifts the blended number would average away. A bundled self-authored ZH fixture (separate from the untouched EN fixture, whose denominators and pins are preserved) gates Chinese tokenization, indexing and rerank ordering in CI on the offline stack.

• The dead-weight telemetry view. brain_recall_telemetry grows a seventh operation, dead_weight (CLI o2b brain recall-telemetry dead-weight), reporting pages currently in scope that no recorded recall within the telemetry window ever surfaced. The denominator is the vault walk's included paths - current on-disk truth, never the stale document table - so a deleted-but-indexed page is never reported; the retrieved set is the union of recorded recall artifacts and observed-use references, since/until-windowed; the payload carries the window, the counts, a capped dead list behind the usual vault_path envelope, and the gate caveat: telemetry is opt-in and records only surfaced top rows, so the report claims "no recorded retrieval surface within telemetry history", never absolute never. No new MCP tool - the tool-count pin holds.

Changed

• Permission-rule targets canonicalize. A rule target written with backslashes or .\\ segments (Notes\a.md) matches the stored POSIX spelling via the same path canonicalization the write paths use, and an unnormalized target in the document draws a warning, so a Windows-spelled rule no longer silently matches nothing.

• Custody-flow documentation. The unlock flow prints an export-before-wrap nudge (a wrapped store's entries are unreachable to secret export until the keyfile is unwrapped), and the ingest-manifest documentation states that the schema-3 content-manifest move is one-way for older binaries.

• Bundle allowlists warn on *. Importing a bundle whose exec allowlist contains the wildcard emits a named warning - an allow-everything allowlist is almost never what an operator meant - while bundle authentication (AAD) still refuses tampering, and non-wildcard allowlists behave exactly as before.

• Docs: docs/cli-reference.md documents the hallways verb, the lexicon rebuild, the dead-weight verb and a kind-and-property-pushdown section stating the as-indexed semantics; docs/mcp.md covers the kind argument, the promoted-key pushdown and the dead_weight operation; docs/observability.md documents the dead-weight fold; the README names the release.

Fixed

• A staged ingest no longer registers itself as done. On a stage verdict the ingest staged only the summary page while publishing the rest of the write's records: the intake's created entity pages landed straight in the canonical registry and the manifest row recorded the source as ingested current - so review approved half of what had already happened, and an operator rejection left a manifest claiming a done ingest no re-ingest would redo. The intake's disposition contract now covers every page and registration row of the write: created entity pages stage into the review queue beside the summary page (staged first, removed from the canonical tree second, so a crash leaves both copies and never a lost one), and the manifest row stays unrecorded until a publish arm lands. The deny arm still refuses before any write, and the update arm is untouched - the review boundary is entry, not mutation.

• delete_by_source and schema mutations consult the permissions document. A confirmed source cleanup destroyed the derived entries and the ingest manifest entry with no document consult, and a schema batch reshaped the vocabulary every later write validates against, so a caller a document had closed could still do both. Both lanes now resolve the document against the credential subject and refuse on deny through the same discipline as update and append - the same typed refusal, one decision-ledger row, before anything is read for destruction or written; the dry-run preview stays a read and stays ungated, an absent document changes nothing, and the store-integrity doctor's deny-consulted-lanes finding names all the covered lanes. This entry also corrects two stale release-note claims the repairs falsified: v1.79.0's "denied agents cannot update or append to published notes" named the first two consult lanes only (delete_by_source and the schema-mutation lane were uncovered until now), and v1.78.0's research-pool claim ("research names the refusal instead of quietly yielding an empty pool") described a use site that had not been wired to the vault-resolved configuration - what ships here is the ownership measurement behind install and onboarding: it resolves a $secret: reference through the vault's own configuration by metadata alone, never a decrypt, so a raw reference no longer counts as a configured key, an unresolved one is reported unchecked with a reason naming it, and a store the process cannot read (locked, or missing its keyfile) reads as unchecked instead of aborting the statement; the research call site itself is not wired to the vault-resolved configuration yet, so that claim is not yet true on the live research path.

1.79.0 - 2026-10-10

Open Second Brain 1.79.0 gives an operator who lets agents write into a vault the answers the write paths never recorded: who made a given write, what rule allowed or refused it, and how to stop the next one. Agents authenticate as themselves through named per-agent MCP tokens, one operator-edited permissions document resolves allow/ask/deny at a single chokepoint, a queryable decision ledger records which rule decided, every gated write stages into a review queue that recall cannot see until an operator applies it, an owner-write gate keeps callers from publishing under a foreign owner, open questions get a durable artifact of their own, and the ambient extraction lane answers to operator consent and a time-to-live. The default posture is byte-identity: no tokens, no document, no gate keys and no flags means every existing write path behaves exactly as before.

Added

• Named per-agent MCP tokens, hash at rest. o2b mcp token mint|rotate|revoke|list manages one token per agent in .open-second-brain/secrets/mcp-tokens.json beside the custody store: the store keeps only the sha-256 hash of the material plus a non-secret prefix, verification compares hashes in constant time, the plaintext material is printed exactly once with a shown-once notice and never persisted, writes serialize under the secrets lock, names use the mcp_token_<slug> spelling the $secret: grammar can address, and every mint, rotation and revocation appends a no-values custody audit record.

• Token authentication and request-scoped identity on the HTTP transport. A request whose credential matches a stored token authenticates as that token's agent for that one request - identity threads as a parameter through the dispatch path, never as server state, so concurrent callers with different tokens never observe each other's identity. The token map is consulted before the shared key, the shared --api-key stays valid as the operator master credential with the process's configured identity, and a revoked or unknown token gets the same generic 401 body as a missing credential, so no oracle distinguishes them. Rotation and revocation take effect on the next request with no server restart. The new mcp_tokens_required device key (default false, env twin OPEN_SECOND_BRAIN_MCP_TOKENS_REQUIRED) makes the endpoint refuse credential-less requests while a non-empty token map exists; the non-loopback bind rule accepts a key or a non-empty token map, and stdio identity stays config-derived. A token mints identity only, never reach.

• One bootstrap command. o2b bootstrap --target <harness> runs the harness adapter's existing idempotent apply, optionally mints and prints the harness token once (--token, never on argv and never in a harness config), and writes a receipt at <vault>/.open-second-brain/bootstrap.lock.json recording the owned entries, the token name and prefix, and the applied time. A second identical run is a byte-identical no-op, --rotate re-mints under the same name and reprints once with the new material authenticating on the next request, --check verifies drift, and unsupported targets are refused naming the available list. The config-writing adapters (codex, grok, opencode) apply directly, generic prints the payload plus manual steps, and the plugin runtimes stay verify-only.

• One permissions document. Brain/_permissions.yaml - an operator-edited vault file that rides vault sync like the freeze marker - resolves allow/ask/deny per agent, operator-defined role and target-scoped entry for the write, ingest and owner_write actions. The loader is strict: default_action is required, unknown keys warn, a version other than 1 hard-refuses naming the file, and a present-but-unreadable document fails closed with a field-named error instead of falling back to permissive. Resolution order is target entry, then agent override, then role, then default, with deny over ask over allow at equal specificity; when a document exists it is the only disposition source, so one write has exactly one deciding rule. With the file absent every check behaves exactly as today.

• A queryable decision ledger. Every ask/deny verdict plus the owner-write gate's warn rows lands as one JSONL row in the month/device shards under Brain/logs/decisions/, carrying actor, via, action, target, verdict, the deciding source (entry, agent, role, default or gate key), the reason token and optional tool and correlation_id; allow rows are written only when the document asks for them (ledger.record_allows: true). The append never throws - a failed write returns an audit reason for the caller to surface instead of blocking the verdict it records. o2b brain permissions show prints the effective document plus a dry-run decision table over the declared agents, ledger reads the filtered rows, and o2b brain doctor reports an unreadable document as the permissions-unreadable finding with the show verb as the exit.

• Staged review for every writer lane. Beyond the existing signals queue, note creates stage at Brain/pending/notes/<id>.md (the id carrying a reversible percent-encoding of the publish target, round-trip safe over CJK, spaces and dots, over-long targets refused by name) and ingest summary pages stage at Brain/pending/ingest/, while registration completes and cleanup removes the staged page. The signal gate now resolves inside writeSignal, so every ungated caller - MCP and CLI feedback, inline scan, session import, lifecycle and checkpoint - inherits it without per-tool wiring; batch create ops stage per operation and report receipt status staged with a pending_id, and staged receipts on the writer tools carry the next command o2b brain pending apply <pending-id>. o2b brain pending list shows every lane sorted with --lane filtering and named-unreadable entries, apply is an exclusive create with a typed conflict on an occupied target, and --dry-run runs every check and writes nothing. Toggles are per lane: write_approval.notes and write_approval.ingest each fall back to the write_approval.enabled master (default off) when absent.

• Staged documents leave recall. Brain/pending/ is excluded from search-index admission (reason review-pending), so brain_search and recall-inject cannot surface a document no operator has admitted, while gate-off vaults without a pending directory are unaffected.

• The owner-write gate. integrity.owner_scope_writes (off | warn | fail, default off, unreadable config fails closed to fail) refuses a caller-named owner that differs from the caller's resolved identity: on the preference lane at the explicit-owner arm, and on the note lane where owner joins the refused frontmatter keys for creates and batch updates under fail. The refusal carries the owner-write-refused token (owner_write_refused on the write-batch and note-creation error vocabularies) naming both the named and the resolved owner and the fix - name your own identity or omit the owner. warn allows and appends exactly one decision-ledger row carrying the gate key as its source, and a document's owner_write verdict composes most-restrictive-wins with the gate in both directions. Gate off, behavior is byte-identical.

• Open decisions. o2b brain decision open --title <t> --question <q> --option <o> [--option <o>...] [--context <c>] parks a question with enumerated options at Brain/decisions/open-<slug>.md - a frozen key table, JSON-quoted free text, a ## Question/## Options/## Context body, a directory lock around transitions, and a typed duplicate refusal naming the existing id. list_open partitions by status with unreadable records named, show_open reads one back, resolve <id> --choice <c> mints the real type: decision page through the ordinary record path and stamps the open record resolved with a [[decision-<slug>]] pointer plus exactly one open-resolved receipt, and discard <id> --reason <r> closes without deciding. Terminal records stay in place, the morning brief renders at most five open records plus an unreadable block and never mutates them, and the decision-open, decision-resolved and decision-discarded log kinds keep the lifecycle in the Brain log timeline.

• Consent and a TTL for ambient capture. guardrails.ambient_writeback: false suppresses the ambient extraction lane with a counted, logged ambient-withheld event per capture and no signal written (absent keeps today's behavior, since the lane already writes on capture); guardrails.ambient_ttl_days stamps expiration_date at creation on ambient-extracted signals, which the expiration filter then drops at read. A TTL-stamped signal still stages when the review gate is on, and the expiration survives apply verbatim.

Changed

• Document-backed dispositions close the force_confirmed gap. With a permissions document present, force_confirmed writes a confirmed preference only when the caller's write verdict resolves to allow; otherwise the refusal answers with the force-confirmed-requires-allow token and the o2b brain permissions show exit, and document-absent behavior is unchanged. A document deny refuses the write before any filesystem effect with the typed write-refused error naming the principal, the action, the deciding rule and the next command, the lane keys cannot bypass a document in either direction, and each stage or refuse disposition appends exactly one ledger row naming the rule that decided.

• Docs: docs/cli-reference.md documents o2b bootstrap, o2b mcp token, o2b brain permissions, the widened o2b brain pending and the open-decision actions; docs/mcp.md documents the per-agent token authentication, the new refusal tokens with their next commands and the open-decision actions on brain_decision (no new MCP tool - the advertised surface is unchanged); docs/observability.md gains the decision-ledger section and the new Brain log kinds; the README control section states every new gate with its config key and default-off posture.

Fixed

• The passphrase-wrapped store is reachable again. Every key-bearing verb (set, rm, run, export, import) ingests the passphrase through --passphrase-from-env or stdin exactly as unlock does; the MCP server unlocks once from OPEN_SECOND_BRAIN_SECRETS_PASSPHRASE at its first key use and drops the variable; o2b brain secret unwrap restores the raw keyfile; and the wrap path verifies the envelope against the key and writes it durably before replacing the only copy, and a failed post-write restore reports the original read-back refusal beside a named warning instead of the restore's own error.

• Credential bundles authenticate their metadata. Each entry's value is sealed against its name, env mapping, allow patterns, the bundle version and the KDF parameters, so an edited or swapped bundle refuses on import before any write; the bundle schema moves to 2 and older bundles refuse naming the re-export remedy.

• Approval digests bind the content that lands. The import plan seals each row's source and rendered-body hashes, so a file edited after the dry run fails the apply; brain upgrade --apply accepts --approval-digest, required when non-interactive and verified against the freshly computed plan.

• The ingest manifest carries the extraction contract per entry. Ingesting one source no longer cancels the owed reprocess of the others; a manifest without per-entry contracts degrades toward reprocessing, never toward skipping.

• Tags accept the Obsidian grammar. Unicode letters and digit-led tags (2fa, 2024-notes) pass; only bare numbers refuse; legacy scopes carrying such tags stop breaking dream rewrites and preference writes.

• A refused capture no longer crash-loops the Telegram daemon. Contract refusals are recorded per update, the offset advances, and the run continues with the messages behind the refusal.

• Session-summary divergence is a signal again. Records dedupe by content hash on read, divergent fires only when distinct hashes coexist at one instant, and the revision count is reported separately.

• Secret references resolve the names the store holds. Hyphenated and mixed-case names resolve through the store leg while the env fallback keeps its case rules, and redaction covers env-resolved values without blanking error text on one- or two-character values.

• The HTTP transport survives a corrupt token store. A store read error falls through to the shared-key compare with a named warning, while token enforcement that was requested by config stays on (an unreadable map refuses credential-less requests rather than reading as empty); a presented credential matching nothing is refused outright rather than read as anonymous; and revoking the last token on a keyless network bind no longer re-opens anonymous access.

• Request identity reaches every write decision. A token caller's writes are judged as the token's agent: document deny entries refuse them, cross-owner claims are checked against the credential identity, a caller-supplied agent that differs from the token refuses by name, and the decision ledger names the true actor. A run launched with an explicit config path is consulted as the agent that config declares even when no transport identity is present, so a document rule naming that agent refuses it and the ledger row names it. The signal lane consults the permissions document like every other writer, denied agents cannot update or append to published notes, and the review door appends one resolution row per apply and reject.

• Staging the same target twice refuses by name instead of silently replacing the earlier entry's bytes - and the retried brain_create_note, brain_write_batch create op or brain_ingest_source answers the pending-stage-conflict code carrying the queue entry that holds the target, not a generic internal error - and a failed decision-ledger append surfaces its audit reason instead of vanishing.

• Open decisions stay resolvable. Same-titled questions resolve into distinct decision pages even when the title's slug fills the 64-character cap - the per-record fallback candidates keep their distinguishing id inside the cap, so resolving one never spins forever against a foreign page at that slug - a resolved or discarded question can be parked again with the same wording, adversarial headings in question text round-trip byte-faithfully, callers below the record's reach cannot resolve or discard what they cannot list, and the CLI help says non-Latin titles hash to an unnamed id.

• Bootstrap tells the truth about tokens. The minted token authenticates hand-configured HTTP clients while the registered harness keeps its config-derived identity (stated in the output and the docs); a failure anywhere in the registration half - the payload build refusing, the apply throwing - no longer loses the minted material; placeholder agent names refuse at mint; rotation keeps a ten-minute grace window for the previous material; and o2b bootstrap --remove tears a provisioning down through the receipt.

• The doctor sees a document that denies the locally configured agent, and sessions import reports the ambient-withheld count when consent suppresses capture.

• Expired transient facts cannot consolidate. The dream topic and promotion planning readers drop signals past their ambient time-to-live before clustering, matching the recall path.

1.78.0 - 2026-10-09

Open Second Brain now puts credential custody under an operator passphrase and routes it by name: the vault's secrets keyfile wraps into an opt-in scrypt envelope behind a lock/unlock lifecycle, $secret:NAME references resolve through the custody store at every credential use site, one passphrase-encrypted bundle moves the store between installs, and every resolved credential literal is redacted at the error and config-mapping boundaries. The vault's own declarations bind its writers - composed tags must parse as Obsidian tags and a declared page vocabulary gates capture writes - and the plans an operator approves are sealed: a Claude-memory import or a brain upgrade applies exactly the approved plan or nothing. Reads name divergent session summaries, the model-answer verbs strip and name a leading think block before parsing, and a changed extraction contract reprocesses the sources it covers instead of absorbing the change as unchanged.

Added

• A passphrase-wrapped keyfile with a lock/unlock lifecycle. o2b brain secret unlock wraps the store's raw 32-byte keyfile in place under a passphrase - read from stdin or --passphrase-from-env, never argv - into a versioned scrypt envelope (per-envelope random salt, parameters bounded to the build's cost curve) and holds the unwrapped key in memory for that one process only; lock clears the holder and refuses a store that was never wrapped by name, instead of recording a protection that does not exist. There is no daemon: every other invocation and the MCP server stay locked, a key-bearing operation over a locked store refuses with a named error whose prose carries no paths and whose remedy is the unlock command, and a store that still holds entries but has lost its keyfile refuses the read-only resolve by name instead of minting a fresh key over the surviving ciphertext. Both lifecycle verbs land no-values custody records and sit behind vault identity, and the help and manifest state the loss warning: a lost passphrase is unrecoverable, and every stored value stays unreadable forever.

• Passphrase-encrypted credential bundles. o2b brain secret export --out FILE re-encrypts every entry under a key the passphrase derives through the envelope KDF (fresh salt, the parameters recorded inside the bundle) and writes one file an operator can carry between installs - names, env-var mappings and allow patterns travel in the clear past the shared egress redactor, the values do not. secret import FILE verifies and decrypts every value before writing anything, reuses the store's own name, env-var and allow-pattern validation, and refuses a name the store already holds unless --replace; both operations land no-values custody records and run behind vault identity.

• $secret:NAME references resolve at the use sites. The custody-store-backed named-secret provider answers credential consumers store-first with environment fallback - byte-identical when no reference is used, opt-in via the vault that joins the store: the embedding registry's provider probes, the decision-model key from config resolution through the provider factory (extract pre-filter, labels, recall-inject, skills, rerank), the research pool env, the Telegram capture token and the installation secret behind the vault_path MCP field. A locked store or an unresolvable reference surfaces the named refusal - the decision-model key degrades into errors with no request leaving, the Telegram run fails naming the secret instead of handing the raw reference to the API, research names the refusal instead of quietly yielding an empty pool - and resolution stays read-only: no last_used_at stamp, no exec custody record, no store mutation. o2b secrets list and status accept --vault <path> and report availability from the merged provider, metadata only, a locked store still counting.

• Resolved credential literals are redacted at the guarded boundaries. The MCP error boundary scrubs every occurrence of a value the vault resolved from a reference - longest value first, ahead of the truncation guard, so no cut leaves a partial credential - and the OpenClaw status tool's config mapping takes the same values into its scan; a boundary whose store is absent, empty, unreadable or locked contributes nothing and answers byte-identically to the shape-only redactor.

• Digest-sealed approval for import and upgrade plans. o2b brain import-claude-memory --dry-run seals the adoption plan - plans, skipped entries, conflicts, unchanged rows, no wall-clock fields - and prints its digest; a non-interactive --apply must carry --approval-digest (exit 2 otherwise, mirroring the --yes guard, while an interactive terminal keeps the escape hatch) and lands exactly the approved plan or nothing: a stale digest refuses naming approved and current digests and stating that nothing was written, and a digest paired with --dry-run refuses, because a dry run computes one and does not consume one. o2b brain upgrade seals its plan the same way and verifies the seal first at apply, so a plan object edited after it was measured is refused before the error rows, the no-op return or the snapshot; the CLI and the self-heal worker, which apply the plan they just planned, are unchanged.

• Divergent session summaries are named on reads. The single-session read (CLI and MCP) answers the latest digest plus digest_count, and when one session id holds several content-differing digests reports divergent: true beside a bounded newest-first-count, oldest-first sample of id / created_at / content_hash rows - never a payload echo. Divergence is reported, never merged, deleted or reconciled.

• A named think-block strip before CLI JSON parses. The four model-answer verbs (extract-signals, design-note, skill-proposals page-draft, distill) parse plainly first and, on failure, strip one leading <think>...</think> block and retry; every strip is named on the result - a note on the ok envelope under --json, a note line in text - and a payload that still refuses keeps the named exit-1 refusal with the attempt named. Clean JSON is byte-identical and genuinely malformed JSON is never rescued.

• The extraction contract fingerprint rides in the source-ingest manifest. The manifest records the fingerprint of the extraction contract (the schema-extractable allowlist plus the hand-bumped contract version), schema 2 with a v1 read path, and batch planning compares it against the live one: on a mismatch - a v1 manifest with no recorded contract included - byte-identical sources reprocess once under the distinct contract-changed status (contract_changed and contract_changed_files on the wire, an info line in text) instead of being absorbed as unchanged, reconcile names those sources as the gap, and the fingerprint folds into the plan id so a stale checkpoint cannot resume-skip work extracted under a different contract.

Changed

• Composed tags must parse as Obsidian tags. Every tag the core composes into frontmatter - a preference's topic, scope and extra tags, a signal's topic and scope, the Claude-memory import's derived topic and scope - is validated against the one rule the search index and the inline detector already read (starts with a letter or underscore, continues with letters, digits, dashes, underscores or slashes, never purely numeric), and a segment that fails it refuses the write with the offending field and the rule named. Existing content cannot be refused retroactively, so an opt-in frontmatter-tags hygiene detector reports what the write-time gate would have rejected - one finding class, grouped per distinct value, informational, never auto-fixed.

• A declared page vocabulary gates capture writes. A vault that declares schema.page_types in Brain/_brain.yaml refuses a capture whose kind it does not declare - staged captures, every inbox-drain route and the Telegram path - with a typed error naming the kind, the declared set and the remedy, before any filesystem effect: no directory is created and no allocator name is consumed. The idea route consults the gate at plan time, so a dry run previews the same refusal apply would land, and a vault with no declaration behaves byte-identically to before.

• Docs: docs/cli-reference.md documents the lock/unlock/export/import verbs, the --vault join on o2b secrets list/status, --approval-digest on the import and the contract-changed batch-plan report; docs/how-it-works.md states the passphrase envelope, the references and the bundles under the custody model; the README names the release and the custody capability. The plugin mirrors follow.

Fixed

• Same-instant continuity records read in append order. The store tie-broke rows sharing a timestamp by content-hash id, which says nothing about which of two same-instant writes landed first, so a latest-wins reader - the session-summary read among them - could answer the older take arbitrarily. Within one shard the append-only file is now the authority; ties across shards still order by shard id, because two devices' arrival orders genuinely cannot be known.

1.77.0 - 2026-10-08

Open Second Brain now keeps its claim ledger in time and correctable: a claim can carry a validity window frozen from its source at ingest, the events recall reads the ledger over an assertion-time slice, an agent's stated claims commit only when they anchor in their assertion text, and two same-slot claims with disjoint windows stand in a succession channel instead of a conflict. One correct verb discovers a correction's blast radius and retires what it touches, and every serving surface serves a retired-but-serveable record only beside its resolved, readable chain-tip correction, fail-closed. The deep relational recall arm runs under width budgets with hub skipping, walks entity co-occurrence bridges, reports per-node path provenance gated at the caller's reach, and never lets a traversal-only row outrank what the lanes matched.

Added

• Validity windows on the claim ledger. A claim event can carry optional valid_from / valid_until (half-open [valid_from, valid_until), a bare ISO date or a canonical UTC timestamp; bare dates day-snap, relative phrases never parse, and a windowless line serializes byte-identically to before, so an old binary reads new lines on the assertion-time axis it knows). o2b brain truth ingest and the brain_truth ingest operation accept the window (--valid-from/--valid-until; a malformed or inverted bound is refused by name, as INVALID_PARAMS on MCP and exit 2 on the CLI), and with the flags absent each open bound is resolved from the source record's frontmatter valid_from / valid_until and frozen verbatim onto the event at ingest - explicit input wins outright, resolution is per bound, an unreadable or windowless source stores a windowless event, a malformed source bound resolves as absent so it can never refuse an ingest, and mtime is never consulted (an assertion-time proxy is not validity).

• Windowed truth events recall. The brain_truth events operation and o2b brain truth events recall a slice of the ledger through one shared report, so shape, ascending-ts ordering, gating and paging cannot drift between the surfaces. entity filters by canonical name (display spellings accepted), since / until bound the assertion time through the shared time-range grammar (a claim's validity window is a different axis and rides on the rows verbatim; since floors into its second so tail-following pagination re-sees a boundary event but never skips one), and paging defaults to 200 rows under a hard 1,000-row cap. Every row passes the same owner/reach gate brain_claims asks.

• Grounded agent-stated claims. The brain_truth state operation and o2b brain truth state commit an agent's stated claims - subject / relation / object plus the assertion text they came from - into the ledger. The payload boundary refuses a whole call (unknown relation, missing text or source, malformed ts, empty agent) before anything is written, and the anchoring verdict is per claim: subject and object must both anchor in the text through the quality-gated match-form kernel, so a grounded claim commits as an agent_stated ledger event while an ungrounded one is reported back with machine reason codes. The extractor tag is annotation only - conflict detection reads the ledger exactly as before.

• A succession channel beside conflicts. Two same-slot claims with present, non-intersecting validity windows classify as successions (the predecessor is the representative claim whose window closes first) and never as conflicts; intersecting windows or any windowless claim keeps the assertion-time contest rule verbatim, and an expired window never suppresses contestation on its own. The channel is a separate, presence-gated field on the truth state - never a conflict kind - so ask_user semantics, hygiene findings and conflict priority are structurally unreachable from it, and windowless output stays byte-identical.

• One correct verb. brain_lifecycle gains the correct action and o2b brain lifecycle correct <target> the matching subcommand. The dry run - the default - discovers the blast radius within the caller's reach and writes nothing: the claim-graph closure over replaced and contesting records, a wikilink mention scan, and the same-entity/aspect ledger claims, each row reach-gated by its source record. --apply retires each target through the end-state policy - validity closes at the explicit --window-end when the correction is time-scoped, else at the correction instant, while --flatly-wrong tombstones instead, for a claim that was never true - appends ledger correction events under the corrected record's own source (a same-source value change reads as self-correction in the fold, never a conflict), retargets mentions with per-write failures carried (the log and the receipt lines are testimony and never rewritten), and issues bundle-correlated receipts (correction_bundle:<id> in evidence_triggers, the existing supersede / tombstone reason codes). Replay converges: an already-applied correction is a no-op with appended: false. A target the caller may not read is refused as missing before anything is written.

• Width budgets for deep relational recall. The relational arm's traversal runs under width budgets - 8 seeds, 4 expansions per node, 16 nodes in total, and a node whose walked-edge degree exceeds 12 is reached but not expanded - and abandons the frontier deterministically once the composite recall deadline fires, keeping every node already reached. Each budget is a named constant overridable through an OPEN_SECOND_BRAIN_SEARCH_TRAVERSAL_* environment variable or its search_traversal_* config key, and an invalid value is refused naming the key in force.

• Entity co-occurrence bridges. Two documents that mention the same normalized entity gain one bridge edge over the index's chunk_entities, so the walk follows co-occurrence beside the declared typed edges (labelled entity, machine-derived, never part of the query edge-type vocabulary). On by default, off through OPEN_SECOND_BRAIN_SEARCH_ENTITY_BRIDGES or search_entity_bridges_enabled; the budgets, the transport reach and the bridges are wired through to the production search call site, byte-identical with the arm disabled.

• Per-node path provenance in the retrieval trail. A relational row's trail entry carries the ordered path of documents that reached it, each node gated at the caller's reach and owner scope, so the trail names only pages the caller can read and the reason string renders the walk shape alone.

• Relational-only rows stay below the organic tail. A row the traversal found and no lane matched is admitted below the organic tail in the fused order, and a structural rung makes it impossible for a relational-only row to outrank a deep keyword direct hit: the traversal widens the pool, it never outranks what the lanes matched. With the arm off, the rung never fires.

Changed

• A retired record is served only beside its correction. A validity-closed predecessor stays serveable inside its window and a superseded non-tip stays readable; only a tombstoned record drops out of recall everywhere. Every surface that serves memory - the search pool after ranking, recall by topic, context packs, the Brain/active.md digest and the dream scan - applies one rule to a serveable retired row: it is served only beside its chain-tip correction, resolved and readable at the caller's reach, and dropped otherwise. The drop is fail-closed: a chain walk that dangles, cycles, stops at the depth cap or answers the row itself is unresolved, and a correction pulled in beside its predecessor re-runs the caller's full filter set - status, visibility scope, agent scope, reach, and the property, degree and composite filters - because a successor the caller could not read on its own must not enter through the correction door. A pulled-in correction enters as a link-type row carrying a share of its predecessor's score, provenance-stamped correction_for:. Records with no pointer, and pools with neither pull-in nor retired row, are byte-identical to before.

• Docs: the README gains the claim-ledger and corrections capability bullets and the deep-relational-recall note with the budget keys and defaults, and docs/architecture.md states the serve-with-correction rule and the agent-scope matrix's new recipe row (234 recipes over 101 tools). The plugin mirrors follow.

Fixed

• Withheld rows no longer surface as counts. The events account covers only the rows that passed the gate (total is the gated count and no withheld key exists beside it), the relational path provenance carries the readable document ids alone, and its reason string renders the walk shape only, so a filtered answer is byte-identical to the answer over a vault that never held the withheld rows.

• A source page the caller cannot read answers exactly like an absent one. The truth ingest and state window resolution now runs through the caller's readable predicate: an unreadable source stores a windowless claim with no validity keys and a byte-identical response. The CLI verb runs at operator reach and resolves ungated.

• Extensionless page references resolve only to files that exist. The .md-twin resolution no longer answers with the twin when neither candidate exists and no longer accepts a directory as a page, so a slug convention in a log payload no longer drops the rows carrying it and the Brain/inbox directory no longer resolves as a page; in the events gate, a slash-bearing extensionless spelling resolves through the same first-existing rule, so both spellings of one page answer as one.

• Slot claims gate on the extension-bearing source path. The correct verb's claims gate was asked over a fenced or extensionless path spelling it could never answer readable, so in-reach claims dropped from a remote caller's blast radius; the gate now hears the same path shape as the sibling callers, and a source naming no page under its literal spelling stays withheld.

• The correct verb validates its window end before writing. A malformed --window-end is refused with the same check the ledger append boundary applies - a bare ISO date or a canonical UTC instant - before anything is written, including the frontmatter-only correction that appends no ledger event.

• The coupling tip is probed through the caller's full filter set. With the opt-in property, degree or composite-scope filters active, a correction could pass the coupling verdict and then fall to the pool's re-filter, leaving its predecessor served bare; the tip candidate is now probed through the same pipeline the re-filter runs, and a tip the probe drops counts as unresolved, so the predecessor drops with it.

• A self-pointing chain walk is unresolved. A blocked or stale superseded_by index edge left the post-rank walk no first hop and answered the start page as its own chain tip, the one corner where the serve-with-correction coupling failed open; a walk tip that is not distinct from the start page now classifies as unresolved and the retired row drops.

• Malformed validity windows answer as invalid params. A malformed or inverted valid_from / valid_until answers INVALID_PARAMS on MCP and exit 2 on the CLI like every sibling mistyped input, and a stated-claims payload with a malformed ts or an empty agent is refused whole before the first write.

1.76.0 - 2026-10-08

Open Second Brain now keeps its search index current without a scheduler: a search or a session start that finds the index more than a minute old answers from it as it is and starts one low-priority background incremental run, so the next read sees the current vault. Nothing stays resident and nothing runs while no agent works. Two indexer changes make those frequent runs cheap: a run that changed no document writes almost nothing, and a changed document rewrites only the chunks that changed, so an edit to a 1 MB daily log costs about 0.2 MB of writes instead of about 9 MB.

Added

• Freshen on read. search() (every reading MCP tool, the recall-inject hook, o2b search query) and ensureVaultCurrent (SessionStart and MCP start) start a detached o2b search index --freshen <token> when last_indexed_at is older than search_freshen_interval_s (default 60, 0 turns it off, env OPEN_SECOND_BRAIN_SEARCH_FRESHEN_INTERVAL_S). The reader never waits for the run. An exclusive claim next to the index (freshen.claim) keeps concurrent readers from starting a run each; a dead run's claim is taken over after ten minutes by exactly one reader, under an exclusive takeover lock. A held writer lock or an index directory that refuses the claim (read-only mount, no permission) skips the spawn, a run that still meets another writer ends as a skip rather than a failure, and the child is told where its state lives (--freshen-state), so even a failure before it resolves its config is recorded and releases the claim; and a read-only open (cross-vault, recall sources) never starts one. The child lowers its CPU priority and runs under ionice -c3 on Linux or taskpolicy -b on macOS when the tool exists. It is keyword-only unless search_freshen_embeddings is on.

• Backoff and visibility. The child records its outcome in the per-device freshen-state.json beside the index (a new state surface that follows OPEN_SECOND_BRAIN_SEARCH_DB / search_db_path, so o2b state status and o2b state migrate report and leave it where a relocated index keeps it); a failed run backs off one minute, doubling to an hour. o2b search status prints freshen, index_age, last_freshen and an active freshen_backoff: until <time> (freshen object under --json); o2b doctor warns with the new code freshen-failing after three failures in a row; runs that changed documents or failed append one row to the new index_freshen metrics surface.

• Trail code index-stale. A search over an index more than ten minutes old names it on the retrieval trail with detail.ageSeconds. The code is added at read time, also to a query-cache hit, and never stored in the cache, so a cached answer reports the index age it is served at and an operator who reindexes on a schedule keeps the cache.

Changed

• A no-change index run skips link and alias resolution. Both are a pure function of the documents and their links; rewriting every link row on every run was the only write a no-change run made. The relation-constraint and tier passes still run, so a schema-pack edit alone still takes effect. IndexStats.linkResolutionSkipped reports it. A run killed between its document writes and link resolution leaves a pending marker (link_resolution_pending), so the next run resolves even if it changes nothing itself.

• Re-indexing a changed document keeps its unchanged chunks in place. A chunk at the same position with the same content hash, lines, token count, heading and stored full-text form keeps its row, id, full-text entry, entities and vector; only changed chunks are deleted and inserted, and moved ones still carry their vectors. Measured on a 5,812-note vault: one edit to a 1 MB daily log went from 9.3 MB written and 2.1 s to 0.2 MB and 0.17 s; 200 edited notes from 57 MB and 1.8 s to 28 MB and 0.58 s.

• The doctor's repair plan sees the index. o2b brain doctor --repair and brain_doctor with repair now hand the doctor the resolved index path, so freshen-failing and tier-drift are listed as not auto-repairable, as the report already listed them. tier-drift is counted over the pages the caller may read, so below local reach a drifted page the caller cannot read moves the count no more than an absent one, in the report and the repair plan alike.

• Docs: docs/cli-reference.md gains "Freshen on read", the two keys, the --freshen flag, the status fields and the index-stale row; docs/how-it-works.md "Keeping the index current"; docs/architecture.md states that background work starts only from agent activity; docs/hermes-cron.md and docs/updating.md say a scheduled reindex is now only needed for embeddings; docs/metrics.md lists index_freshen. The README names this release.

1.75.0 - 2026-10-07

Open Second Brain now reaches the two moments the session-start injection never could: the delegated subagent that performs the writes, and the end of the turn. A carrier hands the operator's context to every delegated subagent once, on the SubagentStart event, before the subagent's first prompt, with the write-shaped PostToolUse registration kept as the fallback for runtimes without that event; an opt-in Stop-hook digest surfaces pending Brain hygiene findings as one line, once per change, on the runtimes whose Stop channel is non-blocking and stays silent elsewhere; and an injection body over its budget degrades its sections to headline tiers - the top three ranked bullets each - least important section first, until the body fits, before it drops a whole section.

Added

• The operator's context reaches delegated subagents. A carrier (hooks/subagent-inject.ts) delivers the operator's context payload into a delegated subagent's turn. The primary channel is the SubagentStart event, which fires when the host spawns the sub-agent: the payload is in place before the subagent's first prompt, and the host re-injects it if the subagent compacts. Runtimes without that event keep the fallback registration on the write-shaped PostToolUse matcher (Write|Edit|MultiEdit|apply_patch), which delivers at the subagent's first write-shaped tool call. Both registrations feed one delivery ledger (osb.subagent_inject.delivered, the most recent 200 agent ids, 24 h TTL), recorded after the stdout write in the lose-not-duplicate direction, so a host with both events delivers exactly once and a crash between write and record re-delivers rather than loses. The payload is the session-start composition, not the standing rules alone: the standing-rules block, the scoped operator rules for this project and device, and the budgeted Brain/active.md + Brain/lessons.md digest under the same active.inject_budget_chars - assembled by the shared hooks/lib/active-context.ts (extracted from the session-start lane), so the two surfaces cannot drift. The main thread gets nothing, and the carrier stays silent only when the entire payload is empty; a failed rules read still delivers the explicit failure block naming the path, so a subagent never mistakes "no rules were written" for "the rules could not be read". Every runtime receives the hookSpecificOutput.additionalContext envelope, with hookEventName naming the event the payload rode in on (SubagentStart or PostToolUse); decision: "block" is never a context channel on these events. The block renderer is extracted to hooks/lib/standing-block.ts, so the session-start lane and the carrier render the operator's rules through exactly one code path with one cap policy.

• An end-of-turn hygiene digest, opt-in. With hygiene_digest_enabled in the machine config (env OPEN_SECOND_BRAIN_HYGIENE_DIGEST_ENABLED, default off), the Stop hook runs after a turn that wrote an artifact and folds the default hygiene sweep plus the index-backed dangling-link count into ONE line: warning- and action-severity findings as per-detector counts (informational findings never emit), under a hard 300-character cap that degrades by dropping whole count segments. The line is counts-only by design - it names no targets; the detail lives behind the pointer, which names both actionable surfaces honestly: o2b brain hygiene scan lists the detector findings, while the dangling-link count is measured from the search index and reported only by the MCP brain_hygiene tool, a number the scan never prints. A hash ledger beside the hook-state directory (<vault>/.open-second-brain/hygiene-digest.hash, one overwrite-only SHA-256) keeps an unchanged finding set silent, so the line lands once per change, not once per turn, and re-arms in a new session; zero eligible findings and flag-off installs emit nothing. The flag resolves before the vault, so the per-turn cost when off is one config read. The line is delivered only where the runtime has a non-blocking Stop channel - Claude Code's hookSpecificOutput.additionalContext; on runtimes where a Stop block would force a continuation turn (Codex, Grok Build, unrecognised) the hook exits silently before any transcript work, because an opt-in digest never buys a continuation.

• Oversized sections degrade to headlines before they drop. When the injected body exceeds active.inject_budget_chars, the shared budget core compacts sections below the keep-guard priority to a headline tier - its heading, its lead-in lines and its top three bullets, ranked by the inline application/confidence tags, with lines that carry no parseable tags kept in render order. The tier runs sequentially in the drop order, least important section first and the same selection the drop pass makes, recomputing the total after each compaction and stopping as soon as the body fits; only when no tierable section remains does the tiered body go to the drop pass. The keep-guard sections (the preamble and the confirmed rules) are exempt from tiering and still tail-trim as the ladder's last resort. The one-line budget notice names the sections reduced to headlines and those dropped, names as tiered only the sections the tier actually left behind, and quotes the original body size in its kept-of pair, so a body tiered before dropping still reports how much of what the vault holds survived. The doctor pressure probe mirrors the step through the same shared code, exemptions and top-N: tierFires marks the exact overflow condition under which the reactive tier runs, each eviction candidate carries tieredBytes, the byte footprint the tier would first degrade it to, and the warning says when headlines cannot help - every non-guard section already at or below the top-N, or keep-guard content alone over the budget - naming the drop-or-trim outcome instead of promising a reduction that cannot happen.

Changed

• Grok installs register both new hooks. The grok asset registry adds subagent-inject to the write-shaped PostToolUse matcher - grok has no SubagentStart event, so the fallback registration is its carrier, and the parity suite declares the divergence - and hygiene-digest to the Stop group, where the registration stands but the digest emits on Claude Code only.

• Docs: docs/how-it-works.md gains the subagent carrier and the hygiene digest and rewrites the budget paragraph around the headline tier, hooks/README.md gains rows for the new SubagentStart hook, the PostToolUse fallback carrier and the Stop digest, docs/cli-reference.md the hygiene_digest_enabled flag with its Claude Code-only emission, and docs/mcp.md notes that brain_hygiene's pull surface doubles as a push channel when the digest is on.

1.74.1 - 2026-10-07

The bundled opencode plugin loads and works on OpenCode V2 hosts from the same installed file that already served V1. Contributed by @jkoelker in #190, with the maintainer-side completion of the V2 event names against the released 2.0.24 build.

Fixed

• The opencode plugin supports the V1 and V2 plugin APIs from one file. The module now default-exports { id, server, setup }: OpenCode V1 keeps calling server() exactly as before, and OpenCode V2 loads the same installed copy through setup(), which feature-detects every capability it needs (location.directory, session.hook / get / context, tool.hook, event.subscribe) and does nothing when one is missing, so hosts without a hook stay unaffected. Under V2, active-context injection rides the session context hook, the post-write reminder rides tool.hook("execute.after"), and session capture subscribes to the event stream and merges each snapshot with the earlier turns so history survives compactions; a committed revert removes the saved boundary and the turns after it, rebuilding from active context when the boundary was never captured. Verified live against opencode 2.0.24: plugin load, context hook, capture spool and post-write reminder.

• V2 capture listens on the turn-end events a released opencode emits. opencode 2.0.24 never fires session.idle; a finished turn emits session.execution.succeeded (failed and interrupted runs likewise). The capture set now covers those names alongside the v2-tree names, plus session.compaction.failed, so a turn that ends or fails on a released V2 host still lands its spool snapshot.

1.74.0 - 2026-10-07

Open Second Brain now defends against near-duplicate memory at the points a fact enters or leaves the vault: one reach-aware near-duplicate kernel scores the note-write receipt hint, the feedback advisory and a new retire-sibling list, so a context-driven retire names the active paraphrases that would otherwise survive it; the receipt hint can look beyond the written page's directory through the keyword index; every receipt lint finding answers at the caller's reach; extract-signals grounds time bounds in each turn's timestamp and refuses a payload that repeats a topic; and route metrics time each write stage without carrying any content.

Added

• A reach-aware near-duplicate kernel. One pure lookup (src/core/brain/near-duplicate.ts) scores the write-receipt hint, the brain_feedback write-conflict advisory and the retire siblings over one named threshold table. Its readable predicate is required and runs before anything else, so a page the caller may not read is neither scored nor counted.

• Retire siblings. A context-driven retire (superseded-by-context, rebutted, quarantine-violated, user-rejected) now nominates the active preferences that resemble it, at 0.7 Jaccard or above on the principle. brain_review_candidates returns them as an additive retire_siblings array of { retiring_id, sibling_id, score, method } pairs, the dream run summary carries the same key, and o2b brain reject lists the siblings of the rejected preference with the command that rejects each (--json adds retire_siblings). The list is advisory and accept-gated: nothing is retired by it, and each pair is accepted through brain_apply_evidence with result: outdated or o2b brain reject. Decay retires, merges and retires the confirmed-evidence gate holds back nominate nothing, and a pair is kept only when the caller may read both preferences.

• A stored-vector tier for retire siblings. With a search config, brain_review_candidates also compares the stored content vectors of the retiring and sibling preferences and adds pairs at 0.92 cosine or above as method: "embedding", with zero embedding spend. retire_siblings_semantic reports the tier's outcome (used, index_missing, vec_unavailable, not_embedded, model_mismatch), and the tier probes only the retires the answer keeps.

• near_duplicate_retire_siblings_enabled. The key (env OPEN_SECOND_BRAIN_NEAR_DUPLICATE_RETIRE_SIBLINGS_ENABLED, default off) gates every retire-sibling surface; off, the dream summary, brain_review_candidates and o2b brain reject are unchanged.

• A wider near-duplicate receipt hint. With near_duplicate_write_widening_enabled (env OPEN_SECOND_BRAIN_NEAR_DUPLICATE_WRITE_WIDENING_ENABLED, default off), the advisory near-duplicate hint on note-write receipts also compares the written pages with candidates from other directories, pulled from the keyword index (the top 20 chunks per written page) and re-read from disk, at no embedding spend. An index that cannot be opened or queried never fails the write: the lint report carries widening: "index_unavailable" and a widening_detail code naming the failure, and the same-directory hint still runs.

• Turn timestamps in extract-signals. Every turns_mined entry carries the turn's stored timestamp ("" when the source has none), and each prompt line names it. The envelope asks for a time bound as an ISO 8601 date or interval resolved against the stating turn's timestamp, in language-neutral terms, and the dream pass turns that bound into the preference's valid_from / valid_until.

• Write-stage timings on route metrics. mcp_route_latency records gain an optional stages array of { name, ms } entries from a closed allowlist of nine stage names (validate, idempotency_lookup, near_duplicate_lookup, document_write, idempotency_remember, log_append, preference_write, write_receipt, lint); any other name and any negative or non-finite value is dropped, so no content reaches the record. Stages appear only in the continuity record, never in a tool response, and brain_route_metrics summary rolls them up per route (count, average and p95 per stage).