OpenClaw Main Protects Private Memory Wiki Recall and Handwritten Notes

OpenClaw has merged two Memory Wiki corrections at a boundary operators should treat as security-sensitive: search results must remain inside the requesting conversation’s protected recall visibility, and damaged generated pages must not erase handwritten notes during repair.

A related QMD fix keeps search available when filesystem watches fail, while new documentation explains why hook and transcript indexing can overlap without giving the two paths identical authority.

These are merged main changes. The supplied evidence does not identify a containing package.

Search must filter before returning private memory

PR #118265 keeps wiki_search inside protected recall visibility. The upstream record says searchable rows now retain the conversation’s SQLite identity so private-session rules can be applied to results.

The dangerous failure mode is not that indexing stored a private fact. Search systems normally store data so it can be retrieved. The fault is returning a result to a session that is not allowed to recall that source conversation.

PR #118375 adds further stress protection around private recall. The operator test must therefore use two genuinely separate visibility domains, not two queries from the same privileged session.

Interpretation: retrieval authorization belongs at the result boundary and must use durable source identity. Prompt instructions asking the model to ignore an unrelated memory are not an access-control substitute.

Damaged rebuilds must preserve human-authored notes

The same PR #118375 protects handwritten notes when compiled Memory Wiki pages are damaged or missing generated markers. The upstream summary describes repair logic that strips generated sections conservatively while preserving human text.

A rebuild that produces a syntactically valid page can still be data loss if it overwrites operator notes. Generated output and handwritten material need separate ownership even when they share one Markdown file.

Before any repair or re-index operation, take a protected backup of the memory workspace and its associated index state. Do not test recovery against the only copy of a user’s notes.

Filesystem-watch failure becomes degraded service, not total failure

PR #118171 keeps QMD running when filesystem watches fail. A watcher is an update mechanism, not the search engine’s entire availability contract.

Operators should distinguish:

• search unavailable — queries cannot run;
• index stale — queries run but recent writes may be absent; and
• visibility unsafe — results may cross a protected boundary.

Only the first two are availability problems. The third requires disabling affected recall until the boundary is proven.

Hook and transcript indexing can overlap

PR #118299 documents overlapping hook and transcript recall. Duplicate indexing paths can be intentional when one captures prompt-time state and another captures durable conversation history, but operators still need provenance to understand why two results exist and which visibility rules apply.

Deduplication must not erase the source identity needed for authorization. A single merged fact with no conversation provenance can be harder to secure than two clearly attributed copies.

Security and recovery test

Use synthetic secrets that have no real value:

1. write a unique marker into a private conversation and index it;
2. confirm the owning conversation can retrieve it;
3. query from an unrelated session, agent and channel context and confirm the marker is absent;
4. repeat through every exposed wiki search and recall path;
5. create a page containing distinct generated text and handwritten notes;
6. damage or remove only the generated markers in a disposable copy;
7. run the supported repair path and verify handwritten text is byte-for-byte preserved;
8. simulate watcher failure, then confirm search reports degraded freshness while preserving visibility; and
9. rebuild the index and prove new writes appear without duplicate unauthorized results.

Record query identities and result provenance, but never place production secrets into test fixtures or logs.

If exposure or note loss is suspected

Stop affected recall paths, preserve the workspace and database, and identify which sessions queried the index. Rotate credentials only when evidence shows real secret material was exposed; do not destroy provenance with a blind rebuild first.

For note damage, recover to a separate location and compare generated versus handwritten regions before merging. A restored old page can reintroduce stale generated claims even when its human notes are correct.

Evidence and limits

Official merged PR, commit and documentation records supplied by the repository collector establish the reported defects and fixes. GitHub page extraction returned HTTP 403 and the configured search backend was unavailable. OpenClaw Academy did not query a live private memory store or corrupt a real Memory Wiki page.

Relevant collector IDs are 34718/34608, 34924/34814, 34414/34304 and 34753/34643/34709.

Bottom line

Treat Memory Wiki search as a protected data service, not a convenience layer. Adopt a containing build, prove private markers cannot cross sessions, back up handwritten notes before repair and monitor watcher failure as stale-index degradation without weakening recall visibility.