Privacy prefix: bare ~ or ~ (tilde-space) hides text and media from Barvis. Journal keeps the real text; model context and media cache never see it. Identity guard prevents model/provider name leaks. Config-loading fixed: file model settings no longer overwritten by env defaults. Full observability: per-request model, timing, tokens; turn summary; startup config dump. Docs in plain prose. Tests: 481 pass, 3 skip. Zig 0.16.0.