v0.9.1

Four silent-failure leaks closed (tags, FTS syntax, batch PDFs, cache-busting date)

• Tag filtering: frontmatter tags are now lowercased before the alias lookup and before storage, matching the lowercase alias keys and the lowercasing SearchFilters does on the query side — --tag llm now finds notes tagged LLM, including through aliases.
• FTS queries: stray unbalanced double-quotes in bare words are stripped instead of raising an FTS5 syntax error that the caller saw as zero results. Hyphenated words are left intact — they were already valid inside the emitted quoted phrase tokens.
• Batch PDF fetches: in fetch_many, a PDF whose direct download fails (parser failure, non-PDF body at a .pdf URL) now falls back to the browser path, mirroring single-fetch behaviour instead of being silently dropped. fetch-batch also falls back to per-URL fetches when a whole batch fails, and reports failed_urls in its output instead of losing them silently.
• Prompt-cache-busting date: the vault CLAUDE.md blurb no longer interpolates Today is YYYY-MM-DD, which busted Claude Code's prompt cache once per day.

Fetched note bodies are wrapped as untrusted data (core/untrusted.py)

• Prompt-injection fence: note bodies fetched from the web (http/https source, non-summary type) now arrive wrapped in <untrusted-source url="..."> … </untrusted-source> delimiters with an inline treat-as-data preamble, on BOTH body-serving paths: note show (single, batch, -j) and search with bodies included. Notes produced by our own pipeline subagents (interim, source-analysis, moc, index) pass through unwrapped.
• Fence hardening: forged fence tags inside a fetched body — opening or closing, any case, any internal whitespace — are neutralized to untrusted-source-inner (kept visible for forensics), and the url attribute is HTML-escaped with control characters stripped, so neither the body nor a crafted source URL can plant text outside the fence. In search, wrapping runs after token-budget truncation so the closing fence is never severed.
• Agent prompts updated: the researcher, depth-investigator, draft-orchestrator, and source-analyst prompts and the vault CLAUDE.md blurb gained an "Untrusted content policy" block instructing agents to treat fenced content as data, never instructions, and not to launder its directives into trusted outputs.