v1.93.0 - Honest Budgets and Self-Healing Edges

Open Second Brain v1.93.0 - Honest Budgets and Self-Healing Edges

Open Second Brain v1.93.0 closes the gap between what a configuration promises and what the model, the filesystem and the package manager actually do. A page holding one long link produced a chunk declared at 4 tokens that the embedding model reads as more than 1,700, a retirement was stamped with a log link the device never writes, a decision-model call answered only if its single configured provider answered and kept its per-model enforce thresholds in the compiled source table, a Codex marketplace add or upgrade replaced the checkout and took the dependency tree with it, and the external review of v1.92.0 found two paths that let marker-private content leave the vault, a quadratic regex on the synchronous write-receipt path, a hold rule that withheld fitting chunks from embedding, and an entity-ranking rule that let one entity match outrank higher-scoring results. Now a long whitespace-free run is charged at a conservative token rate and split across chunks that each fit the budget, retirement provenance resolves the same log shard the appender writes, decision-model providers answer in a configured order with fallback inside the existing budgets and per-model thresholds live beside config.yaml keyed by the model the server reports, the launchers repair a stripped checkout before the first command runs, and all twenty-seven review findings are closed here with regressions.

What ships

• Chunks fit the model window when a page is one long URL. The chunker's token estimator counted any whitespace-free run as one word, so a page holding a single long link produced a chunk declared at 4 tokens that the embedding model reads as more than 1,700 - past its 512-token input window, where the serving stack silently truncated it. A whitespace-free run of 16 characters or more is now charged one token per 3 characters, and the splitter cuts inside such a run - never inside a [[wikilink]] when an alternative cut point exists - so the text is distributed across chunks that each fit the budget and every character stays indexed; reducing search_chunk_size therefore works for link-heavy pages, and the chunker version moves to 3, which schedules a one-time re-chunk of the index.
• Retirement provenance names the log shard the device writes. A merge retirement, a dream retirement and brain reject stamped retired_by: [[Brain/log/<date>]] while the log appender - for a vault with a configured device_id - writes Brain/log/<date>.<device>.md, so the doctor reported every fresh retirement as a broken link. All three now build the link through one helper that resolves the same shard id the appender resolves: sharded when a device id is configured, byte-identical to the historical shape when not, and historical records are untouched.
• Decision-model providers answer in a configured order with budgeted fallback, and per-model thresholds live in the installation. decision_model_providers accepts an ordered list, with the single decision_model_provider kept as the one-entry form: the first provider that answers serves the call, a connection error or timeout falls through to the next entry within the same timeout_ms / hook_budget_ms budget, so a dead local server never stalls a hook, and every decision_model_call record names the provider and model that actually answered, so reports never pool two models; o2b decision-model check shows the order and which entries answer. Per-model enforce thresholds move out of the compiled DECISION_THRESHOLD_PROFILES table - now the hosted baseline family only - into decision-thresholds.json beside config.yaml, keyed by the model id the server reports rather than the provider preset, with the entries of every model ever tuned kept across switches and an optional per-vault override; a use with no stored thresholds for the active model runs as shadow and check/report say so explicitly, naming the tuning command, and o2b decision-model thresholds fit --use <use> derives the threshold from the use's labelled report data against a false-action target, with thresholds list / thresholds set rounding the flow out.
• A Codex marketplace add or upgrade leaves a launcher that starts. The marketplace flow replaces the checkout wholesale and takes node_modules with it, so the first launcher command died importing proper-lockfile before install-cli could repair anything. The bun launchers - o2b, o2b-mcp, o2b-aider, vault-log and their Windows twins - now probe for the dependency tree with one file stat and run bun install --frozen-lockfile once when it is missing, refusing with the manual command named if that install fails; a warm checkout pays nothing, and a cold-checkout regression drives the real CLI entry point end to end.
• All twenty-seven findings of the previous release's external review are closed here, each with its regression. The external review of v1.92.0 raised 6 High and 21 Medium findings, among them two paths that let marker-private content leave the vault - the decision-model gates and the knowledge-pack export treated a marker page like any other - a comma-joined digit run that backtracked quadratically on the synchronous write-receipt path, about forty-five seconds on a 256 KiB body, a hold rule that withheld ordinary English chunks that fit the model's window from embedding, and an entity-ranking rule that let one entity match outrank higher-scoring results. A marker page is now withheld at every egress exactly like a formally reserved one, with marker keys matched case-insensitively, the indexed visibility column re-measured on upgrade (schema v16) and an update_note guard that refuses a marker-key write only when it would clear or forge the deny status; the undated-quantity scan is linear and no longer reports numbers inside URLs, markdown link destinations and wikilink targets, dates inside code regions, or 3D-style spellings; chunks are held only when even a conservative lower-bound estimate puts them over the window, search check no longer recommends a backfill for held chunks and reports a declined provider as decided instead of not-configured; the declared-over-derived rule breaks only exact score ties, the usual spellings A. Lovelace and Lovelace, Ada and short operator nicknames resolve, and the nickname-derived index is built once per vault change; and the default OKF export no longer carries prompt-derived entries or kept pages' links, relations and citations to a page it left out, with --include-prompt-derived carrying all of it back.

Process wins

• One source per fact: every What ships claim traces to the 1.93.0 CHANGELOG entry or the merged PR #274 description, and the quality numbers come from the local gate run at the merge-branch head, never estimates.
• Review debt from the previous release is closed here with regression tests before merge: all twenty-seven findings of the v1.92.0 external review - 6 High and 21 Medium - are fixed in this release, among them two paths that let marker-private content leave the vault, a quadratic regex on the synchronous write-receipt path, a hold rule that withheld fitting chunks from embedding, and an entity-ranking rule that let one entity match outrank higher-scoring results. The diff exceeds CodeRabbit's 100-file limit at 123 files, so CodeRabbit skips this change set; the pre-merge local gates and the review-repair wave are the compensating review.
• Quality record: 20,574 tests / 0 fail at head 6825cbf, the exact content this release tags, squash-merged as 3064def, the openclaw bundle rebuilt with the CI-pinned Bun 1.4.0 and byte-verified by the release workflow's verify job, TypeScript clean, lint at 0 errors, version synced, and all 20 CI checks green.

Notes

• The provider-decline consent record covers the embedding provider; rerank and decision-model endpoints keep the declines their own settings record, and routing both through the embedding decline is recorded follow-up work, not something this release claims.
• The knowledge pack takes the same --include-prompt-derived override the other shared exports take, carrying the class-marked material back when an operator asks for it.
• The era boundary is documented, never migrated: retirement links stamped before this release keep their historical shape, and pages written before the content-class stamp carry no mark and export exactly as they did, because a rewrite applied by a later pass would describe the pass and not the writer.
• The version bump to 1.93.0 shipped inside the PR (#274), per the project rule in CLAUDE.md.
• Release image: the canonical terminal style, here as an interaction diagram (animated GIF in this body; static PNG, 2x PNG and the SVG source attached as assets).