v1.2.0 — installing changes nothing you did not ask for; distill keeps more decisions; fewer confident wrong answers

What you will notice

• Installing changes nothing you did not ask for. The one-line install is lookup only, asks nothing and sends
  nothing; bootstrap.py --ask turns remembering on. A logged-in Codex, which can read the whole account, is no
  longer picked as the nightly writer unless you name it.
• Session distill writes down more of what was decided, changes of mind first: on the registered measurement set,
  missed 52% → 41% and changes of mind 11 → 15 of 24.
• A new session no longer starts from an answer you already changed.
• Fewer confident wrong answers: a question that names something no page mentions is refused, and one that matches
  a single word of a page says so. This release ships the refusal change before the registered real-traffic blind
  judge (it waits for 50 fresh queries); its result will be logged in bench/memory_honesty/HELDOUT.md against 1.0.3.
• Outside numbers: on LongMemEval (questions and labels by its authors, scored without a model), KRouter cites an
  answer session for 439 of 470 answerable questions and the latest update for 70 of 72, level with plain BM25. See
  HELDOUT.md, set 7.

Details

• Session distill writes down more of what was decided, changes of mind first. A long session-day is distilled
  in segments of about 6 000 characters, plus one pass over the whole excerpt for changes of mind (decided early,
  changed later, often in different segments); near-duplicates are merged; changes come first; up to 24 lines per page
  (a new session still gets 8, changes first). The prompt says what is not a decision (steps, discussion, one-offs) and
  that a proposal the user accepted counts. On ten tuning sessions (not the measurement set): missed 44% → 22%,
  changes of mind 13 → 15 of 17, steps-or-fabricated share 29% → 31% (fabricated 1 → 7 of 202). More model calls per
  page (one per segment, plus one). On the
  registered measurement set (set 6: 22 session-days never used for tuning, scored by Grok against the same
  131-item reference): missed 51.9% → 40.5%, changes of mind 11 → 15 of 24, steps-or-fabricated 21.7% → 17.1%;
  all three registered criteria met.
• The one-line install is lookup only and asks nothing. It makes or finds the vault, installs the router,
  connects the agents, and stops: no session import, no nightly job, nothing leaves the machine. Its last lines say
  how to turn remembering on: bootstrap.py --ask puts the two questions it used to put at install (import recent
  sessions? install the nightly job?), with the same preview of what is sent; --import, --import-distill and
  --timer still say yes in advance. An upgrade where you said yes before (session import consent, or a nightly job
  on disk) keeps it and is not told it is off.
• Codex is no longer picked as the nightly writer on its own. It writes only the vault but can read the
  whole account, keys file included. It is used when you name it (KROUTER_WRITER, KROUTER_LEARN_CLI) or set
  KROUTER_ALLOW_CODEX=1; otherwise a logged-in grok or claude, both limited to the vault, is used instead, and a
  Codex-only machine is told why distilling was skipped (codex:reads-account).
• A question that names something the vault never mentions is refused (shipped before the real-traffic blind judge; see above).
  "Which did I start first, the Ferrari model or the Porsche model?" on a vault that has never mentioned a Porsche was
  answered from the Ferrari page. Now a capitalised word in mid-sentence (Porsche, Seattle, iPad) that no page
  contains refuses the question; sentence-initial capitals, two-letter words such as OK, and month and day names do
  not count. Tuned on LongMemEval S's 30 unanswerable questions (now a development set: refused 3 → 9, answerable
  questions refused 12 → 14 of 470) and dev3 (one more neighbour refused, nothing lost). heldout3, run once: wrong
  citations 26.6% → 26.1%, neighbours refused 46 → 47 of 80, answerable right 102 of 120 unchanged.
• A question that matches one word of a page now says so. On a 20-page vault, "小红书的笔记几点发？" was answered at
  medium confidence from a page about sealing days, on the single word 笔记: the score floors scale with vault size,
  so a new vault lets a one-word match through. On the dev sets such answers are right half the time and the score
  does not tell which half, so whether to answer is unchanged (dev, dev2, dev3 identical). What changes: confidence is
  low, the receipt carries a recall_note: line (only one word matched; say the vault may not cover the question),
  and no generated answer is attached. Alias hints no longer come from scattered characters or question words
  ("剪辑" was offered "剪藏原件"; "标题有什么讲究" was offered a page on 什么): a hint needs a shared two-character word.
• Docs: retrieval described as it is. PROTOCOL, ARCHITECTURE, DETAILS (en, zh) and VERIFY still called it "a lock on short
  nouns" and quoted "25/25 paraphrases miss" without saying that tests the alias lock alone; outside agents read that
  as "you must maintain an alias table and any rewording misses". Ranked recall answers most questions; the alias lock
  is an optional fast path that needs no upkeep. FOR-AGENTS gains "Common misreadings" (no alias upkeep, rewording,
  what leaves the machine, the earlier names Runtime36 and DSH-KRouter and what pages about them describe, stale
  version numbers).
• A new session no longer starts from an answer you already changed. The SessionStart hook injected a
  decision next to the later correction that replaced it ("本地 API 端口用 8080" beside "原来 8080 → 改成 9090"), so
  the agent saw both. Lines are ordered by page date, then their (HH:MM), then their place on the page; a line is left
  out when a later correction replaced the value it still holds ("8080", not just the shared words "本地 API") on the
  same subject, unless an even later correction restores it (same-day revert); chains (30 → 10, then 10 → 5) keep only
  the newest; unrelated decisions, and the same value on another subject, stay. A line that holds the replaced value
  but only part of the correction's subject ("测试环境 API 端口用 8080" against "本地 API 端口 8080 → 9090") is kept and
  marked "可能已被上面的「→」改过，先核对" instead of dropped. Found while designing the injection bench; an outside
  review caught two regressions in the first version and one remaining case in the second, now tests.
  tests/test_stale_injection.py.
• Docs: 1.1.x is the stable line (fixes only until 2026-11-12, at most one patch a week); DETAILS lists what the
  stability promise covers (core) and what is best-effort (extras); FOR-AGENTS and the status block name the smallest
  install, router only with nothing in the background.
• Docs: what outside reviews misread, checked against the code (FOR-AGENTS "Common misreadings": Obsidian is optional,
  no writer skips permission prompts, an existing vault or router is left alone, not only for code); ARCHITECTURE no
  longer says the claude and grok writers skip permission prompts (untrue since 0.12.0).
• Docs: docs/img/demo-content.gif, the same story as demo.gif for short-video work, recorded the same way; plugin,
  skill and package text call Obsidian optional.
• Bench: sets 7 (LongMemEval, scored from its authors' labels; bench/longmemeval/lme.py), 8 (answers over the
  vault's own git history) and 9 (written by people: corrections and their neighbours) registered before any run; set
  7 run and amended (S's unanswerable questions became a development set).