@gamaze/hicortex 0.16.10 → 0.17.1

package/dist/hermes-transcript-reader.js

@@ -15,10 +15,12 @@
  * readable here nightly. No runtime plugin capture is needed; the Hermes plugin
  * is recall-only.
  *
- * We process only ENDED sessions (ended_at set) that ended since the last run.
- * A live session is distilled after it ends — this avoids partial-session
- * distillation and keeps per-session dedup clean (chunks are stored as
- * `<sessionId>#<chunkIndex>`; see nightly.ts).
+ * We process ENDED sessions (ended_at set) that ended since the last run PLUS
+ * OPEN sessions (ended_at NULL) that have messages — a Discord conversation is
+ * one long-lived thread that stays open and accrues content, so gating only on
+ * ended_at would drop the whole interactive corpus (#240). Open sessions are
+ * delta-sliced by the per-session cursor; per-session dedup stays clean
+ * (chunks are stored as `<sessionId>#<chunkIndex>`; see nightly.ts).
  */
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
@@ -45,8 +47,15 @@ const NON_PRIMARY_SOURCES = new Set(["cron"]);
  */
 const NOISE_ROLES = new Set(["tool", "session_meta"]);
 /**
- * Read Hermes sessions that ended since `since`, across all profiles.
- * Returns one batch per session, parallel to readCcTranscripts().
+ * Read Hermes sessions across all profiles: ended sessions newer than `since`
+ * (the bulk watermark) PLUS open sessions (`ended_at IS NULL`) that have any
+ * message. Returns one batch per session, parallel to readCcTranscripts().
+ *
+ * Why open sessions are included (#240): in Hermes' Discord model a
+ * conversation is one long-lived thread = one session that stays open for
+ * days/weeks and accumulates the interactive content. The per-session cursor
+ * slices each such thread to its unseen delta across runs (same discover-
+ * broadly / delta-narrowly model as CC readers).
  *
  * @param cursors Per-session capture cursors (#189), keyed `hermes:<profile>:<sid>`.
  *   The cursor value is the max `messages.id` already captured; a resumed +
@@ -64,8 +73,24 @@ function readHermesSessions(since, hermesHome = HERMES_HOME, cursors = {}) {
             continue; // locked / unreadable / wrong owner — skip, retry next run
         }
         try {
+            // Discovery (#240): ended sessions past the watermark (bulk) PLUS open
+            // sessions (ended_at IS NULL) that have any message. In Hermes' Discord
+            // model a conversation is ONE long-lived thread = one session that stays
+            // open for days/weeks and accumulates essentially all the interactive
+            // content. Gating discovery only on `ended_at IS NOT NULL` meant those
+            // open threads were NEVER discovered → distilled — the entire interactive
+            // corpus was silently dropped. The per-session cursor below slices each
+            // open session to its unseen delta across runs (same model as CC: discover
+            // broadly, delta narrowly), and `rows.length === 0` skips an open session
+            // that is already current. The EXISTS probe is one cheap check per open
+            // session (typically one open thread per agent).
             const sessions = db
-                .prepare("SELECT id, ended_at, source FROM sessions WHERE ended_at IS NOT NULL AND ended_at > ? ORDER BY ended_at")
+                .prepare(`SELECT id, ended_at, source FROM sessions
+            WHERE (ended_at IS NOT NULL AND ended_at > ?)
+               OR (ended_at IS NULL AND EXISTS (
+                     SELECT 1 FROM messages WHERE messages.session_id = sessions.id
+                   ))
+            ORDER BY (ended_at IS NULL), ended_at`)
                 .all(sinceEpoch);
             // Cursor is a message id (INTEGER PRIMARY KEY AUTOINCREMENT — strictly
             // increasing, never reused), so `id > ?` returns exactly the rows added

package/dist/init.d.ts

@@ -262,6 +262,23 @@ export declare const GENERIC_DEFAULT_DOMAINS: DomainDef[];
 export declare function scaffoldDefaultDomains(configPath: string): {
     scaffolded: boolean;
 };
+/**
+ * Determine the npm package specifier used in the generated daemon/timer
+ * ExecStart (for npx-thin installs — global-binary installs use the absolute
+ * binary path and never call this). Tag-based so restarts pick up new versions.
+ *
+ * Priority:
+ *   1. `updateChannel` config key (e.g. "rc") → `@gamaze/hicortex@<channel>`.
+ *      Lets an install pin a release channel — the internal fleet sets "rc" so
+ *      its npx-thin hosts track the rc dist-tag through a pre-promotion soak
+ *      (otherwise the auto-detect below pins @next, which lags rc).
+ *   2. Auto-detect: bare `@gamaze/hicortex` if the running version matches the
+ *      npm `latest` tag, else `@gamaze/hicortex@next` (legacy pre-0.10 cron
+ *      installs follow @next).
+ *
+ * Exported + `configDir`-parametrised so the channel override is unit-testable.
+ */
+export declare function getPackageSpec(configDir?: string): string;
 /**
  * True if a resolved binary path lives in npm's ephemeral npx cache
  * (`~/.npm/_npx/<hash>/node_modules/.bin/…`). When `hicortex init` is itself
@@ -295,9 +312,31 @@ export declare function runInit(options?: {
     repairConfig?: boolean;
 }): Promise<void>;
 /**
- * Resolve the nightly hour (0–23, local time) for the generated schedule.
- * Priority: `nightlyHour` in ~/.hicortex/config.json → mode default.
- * Defaults: client 02:00, server 03:00 — staggered so that in mixed fleets
- * clients push their sessions before the server's capture + consolidation run.
+ * Resolve the CONSOLIDATION hours (the only slot-based timer in 0.17). The
+ * CAPTURE mechanism is the watchdog (an interval timer, not slots) — uniform
+ * across client + server/co-located — so this function no longer returns a
+ * capture schedule. Returns null in client mode (no local DB → no
+ * consolidation timer).
+ *
+ * Priority: `consolidationHours` array → legacy `nightlyHour` (single int, only
+ * when the array key is absent → one consolidation slot at H, preserving the
+ * pre-0.17 "one daily job" intent) → role default ([10, 22] server / null client).
+ */
+export declare function resolveConsolidationHours(mode: "server" | "client", configDir?: string): number[] | null;
+/**
+ * Legacy single-hour resolver (pre-0.17). Kept for backward compat + the
+ * existing tests; new scheduling goes through `resolveConsolidationHours`.
  */
 export declare function resolveNightlyHour(mode: "server" | "client", configDir?: string): number;
+/**
+ * One `OnCalendar=*-*-* HH:00:00` line per hour, newline-joined — systemd fires
+ * a timer at EACH OnCalendar entry (multi-slot in a single timer). Hours are
+ * sorted so the generated file is stable/diffable. Exported for testing.
+ */
+export declare function formatOnCalendarLines(hours: number[]): string;
+/**
+ * The launchd `StartCalendarInterval` ARRAY body — one `<dict>` per hour.
+ * launchd fires the job at each dict; a single dict is the 1-slot special case
+ * but the array form is uniform across 1..N. Exported for testing.
+ */
+export declare function formatLaunchdIntervals(hours: number[]): string;

package/dist/init.js

@@ -32,11 +32,15 @@ exports.decideAgentName = decideAgentName;
 exports.writeAgentNameConfig = writeAgentNameConfig;
 exports.writeClientConfig = writeClientConfig;
 exports.scaffoldDefaultDomains = scaffoldDefaultDomains;
+exports.getPackageSpec = getPackageSpec;
 exports.isEphemeralNpxPath = isEphemeralNpxPath;
 exports.installSessionStartHook = installSessionStartHook;
 exports.installRecallHooks = installRecallHooks;
 exports.runInit = runInit;
+exports.resolveConsolidationHours = resolveConsolidationHours;
 exports.resolveNightlyHour = resolveNightlyHour;
+exports.formatOnCalendarLines = formatOnCalendarLines;
+exports.formatLaunchdIntervals = formatLaunchdIntervals;
 const paths_js_1 = require("./paths.js");
 const telemetry_js_1 = require("./telemetry.js");
 const node_fs_1 = require("node:fs");
@@ -46,6 +50,7 @@ const node_child_process_1 = require("node:child_process");
 const node_readline_1 = require("node:readline");
 const node_crypto_1 = require("node:crypto");
 const claude_md_js_1 = require("./claude-md.js");
+const config_read_js_1 = require("./config-read.js");
 const context_store_js_1 = require("./context-store.js");
 const HICORTEX_HOME = (0, paths_js_1.hicortexHome)();
 /** This package's version, for the install lifecycle ping (0.15.2). */
@@ -238,15 +243,23 @@ function verifyCcMcp() {
     }
 }
 function allowHicortexTools() {
-    let settings = {};
-    if ((0, node_fs_1.existsSync)(CC_SETTINGS)) {
-        try {
-            settings = JSON.parse((0, node_fs_1.readFileSync)(CC_SETTINGS, "utf-8"));
-        }
-        catch {
-            console.log(`  ⚠ ${CC_SETTINGS} exists but is not valid JSON — skipping tool permissions. Fix the file, then re-run init or add "mcp__hicortex__*" to permissions.allow manually.`);
-            return;
-        }
+    // Only EDIT an existing CC settings file — never invent one. On a host with
+    // no CC client (a server, or a Hermes-only box) ~/.claude/settings.json is
+    // absent; creating a stub there is wrong, and the earlier mkdir+write was the
+    // ENOENT throw on bedrock's init. Without this entry CC just PROMPTS before
+    // tool use instead of auto-allowing — the MCP still works either way.
+    if (!(0, node_fs_1.existsSync)(CC_SETTINGS)) {
+        console.log(`  ℹ ${CC_SETTINGS} not found — skipping CC tool permissions (no CC client here; ` +
+            `the MCP works, CC will ask before tool use).`);
+        return;
+    }
+    let settings;
+    try {
+        settings = JSON.parse((0, node_fs_1.readFileSync)(CC_SETTINGS, "utf-8"));
+    }
+    catch {
+        console.log(`  ⚠ ${CC_SETTINGS} exists but is not valid JSON — skipping tool permissions. Fix the file, then re-run init or add "mcp__hicortex__*" to permissions.allow manually.`);
+        return;
     }
     if (!settings.permissions)
         settings.permissions = {};
@@ -257,7 +270,6 @@ function allowHicortexTools() {
     const rule = "mcp__hicortex__*";
     if (!allow.includes(rule)) {
         allow.push(rule);
-        (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(CC_SETTINGS), { recursive: true });
         (0, node_fs_1.writeFileSync)(CC_SETTINGS, JSON.stringify(settings, null, 2));
         console.log(`  ✓ Added Hicortex tool permissions to ${CC_SETTINGS}`);
     }
@@ -1064,14 +1076,38 @@ function scaffoldDefaultDomains(configPath) {
     return { scaffolded: true };
 }
 /**
- * Determine the npm package specifier for the daemon.
- * Uses tag-based resolution so restarts pick up new versions automatically.
+ * Determine the npm package specifier used in the generated daemon/timer
+ * ExecStart (for npx-thin installs — global-binary installs use the absolute
+ * binary path and never call this). Tag-based so restarts pick up new versions.
+ *
+ * Priority:
+ *   1. `updateChannel` config key (e.g. "rc") → `@gamaze/hicortex@<channel>`.
+ *      Lets an install pin a release channel — the internal fleet sets "rc" so
+ *      its npx-thin hosts track the rc dist-tag through a pre-promotion soak
+ *      (otherwise the auto-detect below pins @next, which lags rc).
+ *   2. Auto-detect: bare `@gamaze/hicortex` if the running version matches the
+ *      npm `latest` tag, else `@gamaze/hicortex@next` (legacy pre-0.10 cron
+ *      installs follow @next).
  *
- * Checks if the current version matches the npm `latest` tag.
- * If not (e.g. running from @next), uses @gamaze/hicortex@next.
- * If it does match latest, uses bare @gamaze/hicortex.
+ * Exported + `configDir`-parametrised so the channel override is unit-testable.
  */
-function getPackageSpec() {
+function getPackageSpec(configDir = HICORTEX_HOME) {
+    try {
+        const { config } = loadConfigStrict((0, node_path_1.join)(configDir, "config.json"));
+        const ch = config.updateChannel;
+        if (typeof ch === "string") {
+            const trimmed = ch.trim();
+            // A dist-tag (rc/next/latest) or an exact version — alphanumerics, dot,
+            // dash, underscore only. Reject anything else: a newline would break the
+            // systemd `ExecStart=` one-liner and `<`/`&` would break the launchd plist
+            // XML the timer writes. Fall through to auto-detect + warn.
+            if (/^[\w.\-]+$/.test(trimmed))
+                return `@gamaze/hicortex@${trimmed}`;
+            console.warn(`[hicortex] config "updateChannel" = ${JSON.stringify(ch)} is not a valid dist-tag/version ` +
+                `(use e.g. "rc", "next", or "0.17.1") — ignored.`);
+        }
+    }
+    catch { /* no config yet, or malformed — fall through to auto-detect */ }
     try {
         const currentVersion = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(__dirname, "..", "package.json"), "utf-8")).version;
         const latestVersion = (0, node_child_process_1.execSync)("npm view @gamaze/hicortex version 2>/dev/null", {
@@ -1452,10 +1488,13 @@ async function runInit(options = {}) {
             console.log(`  ✓ Agent name set to '${decision.value}'`);
         }
     }
-    // Install the nightly job (capture via localhost /distill + consolidation).
-    // Without it a server-mode install never captures or consolidates — the
-    // daemon only serves recall + /distill. Skips if a schedule already exists.
-    installNightlyCron(resolveNightlyHour("server"));
+    // Install the scheduling timers (0.17): a CAPTURE WATCHDOG (short-interval
+    // poll, success-cooldown-throttled — uniform with clients) + a CONSOLIDATION
+    // timer (the full nightly, fixed slots). Re-init rewrites both; customize the
+    // consolidation slots via consolidationHours in config.json (capture cadence
+    // via captureCooldownHours).
+    installCaptureWatchdogTimer();
+    installConsolidationTimer(resolveConsolidationHours("server") ?? DEFAULT_CONSOLIDATION_HOURS);
     // Install daemon if needed
     if (!d.localServer && !d.remoteServer) {
         installDaemon();
@@ -1657,8 +1696,12 @@ async function runClientInit(serverUrl, agentName) {
     if ((0, claude_md_js_1.removeLessonsBlock)(claudeMdPath)) {
         console.log(`  ✓ Removed old static lessons block from CLAUDE.md — lessons now injected at session start`);
     }
-    // Step 7: Install nightly cron (denoise locally, POST to server /distill)
-    installNightlyCron(resolveNightlyHour("client"));
+    // Step 7: Install the CAPTURE WATCHDOG (denoise locally, POST to server
+    // /distill, throttled + preflight-gated) — the same capture mechanism every
+    // install gets. Clients have no local DB → no consolidation timer; also
+    // remove any legacy full-nightly timer a pre-0.17 install left behind.
+    installCaptureWatchdogTimer();
+    removeConsolidationTimer();
     // Step 8: Setup Hermes if detected
     if ((0, node_fs_1.existsSync)(HERMES_HOME)) {
         console.log("\nHermes detected — installing plugin...");
@@ -1686,59 +1729,164 @@ async function runClientInit(serverUrl, agentName) {
     console.log("Restart your agents to activate.");
 }
 /**
- * Resolve the nightly hour (0–23, local time) for the generated schedule.
- * Priority: `nightlyHour` in ~/.hicortex/config.json → mode default.
- * Defaults: client 02:00, server 03:00 — staggered so that in mixed fleets
- * clients push their sessions before the server's capture + consolidation run.
+ * Scheduling (0.17): one UNIFORM capture mechanism + one role-specific
+ * consolidation timer, replacing the old single daily full-nightly.
+ *
+ *   - CAPTURE WATCHDOG (`hicortex-capture`): a short-interval timer fires
+ *     `nightly --capture-only --watchdog`. The watchdog throttles by a
+ *     success-cooldown (`captureCooldownHours`, default 6 ≈ 4 captures/day) and
+ *     preflights before capturing, so a transient fire-instant network miss
+ *     retries in minutes, not at the next daily slot (#239: a once-daily client
+ *     fire that caught a slow/flaky link lost ~24h of capture). Installed
+ *     UNIFORMLY for client AND server/co-located — one capture code path, no
+ *     per-topology branch. A failed preflight retries on the next tick; a
+ *     successful capture waits the cooldown (success-based cooldown — the
+ *     better semantics; the custom server watchdog used trigger-based).
+ *   - CONSOLIDATION timer (`hicortex-nightly`): full `nightly` (capture +
+ *     distill + score + reflect + link). Server/co-located ONLY — clients have
+ *     no local DB, so no consolidation timer is installed (and a legacy one
+ *     left by a pre-0.17 install is removed). Fixed slots (default [10, 22]).
+ *
+ * Customize: `consolidationHours` (the consolidation slots) and
+ * `captureCooldownHours` (the watchdog throttle) in config.json. Re-init
+ * rewrites the timers to the resolved standard (the pre-0.17 "never overwrite"
+ * contract is intentionally relaxed so the fleet adopts the standard). The
+ * legacy single `nightlyHour` is honoured as a one-slot consolidation fallback
+ * only when `consolidationHours` is absent (preserves "one daily job at H").
+ */
+const DEFAULT_CONSOLIDATION_HOURS = [10, 22];
+/**
+ * Capture-watchdog poll interval (minutes). The capture timer fires
+ * `nightly --capture-only --watchdog` this often; the watchdog itself throttles
+ * by the success-cooldown (`captureCooldownHours`, read at runtime). Short so a
+ * transient fire-instant network miss retries in minutes, not at the next daily
+ * slot (#239). Cheap: a tick against a down server is one 5s preflight.
+ */
+const CAPTURE_WATCHDOG_INTERVAL_MIN = 20;
+/**
+ * Resolve the CONSOLIDATION hours (the only slot-based timer in 0.17). The
+ * CAPTURE mechanism is the watchdog (an interval timer, not slots) — uniform
+ * across client + server/co-located — so this function no longer returns a
+ * capture schedule. Returns null in client mode (no local DB → no
+ * consolidation timer).
+ *
+ * Priority: `consolidationHours` array → legacy `nightlyHour` (single int, only
+ * when the array key is absent → one consolidation slot at H, preserving the
+ * pre-0.17 "one daily job" intent) → role default ([10, 22] server / null client).
+ */
+function resolveConsolidationHours(mode, configDir = HICORTEX_HOME) {
+    let config = {};
+    try {
+        config = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(configDir, "config.json"), "utf-8"));
+    }
+    catch { /* no config yet — use the standard default */ }
+    if (mode === "client")
+        return null; // clients have no local DB → no consolidation timer
+    const arr = (0, config_read_js_1.parseHours)(config, "consolidationHours");
+    if (arr)
+        return arr;
+    const legacy = readLegacyNightlyHour(config);
+    if (legacy !== null)
+        return [legacy];
+    return DEFAULT_CONSOLIDATION_HOURS;
+}
+/** Read the legacy `nightlyHour` (single int 0–23) if validly set, else null. */
+function readLegacyNightlyHour(config) {
+    const h = config.nightlyHour;
+    if (typeof h === "number" && Number.isInteger(h) && h >= 0 && h <= 23)
+        return h;
+    return null;
+}
+/**
+ * Legacy single-hour resolver (pre-0.17). Kept for backward compat + the
+ * existing tests; new scheduling goes through `resolveConsolidationHours`.
  */
 function resolveNightlyHour(mode, configDir = HICORTEX_HOME) {
     try {
         const config = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(configDir, "config.json"), "utf-8"));
-        const h = config.nightlyHour;
-        if (typeof h === "number" && Number.isInteger(h) && h >= 0 && h <= 23)
-            return h;
+        const legacy = readLegacyNightlyHour(config);
+        if (legacy !== null)
+            return legacy;
     }
     catch { /* no config yet — use the default */ }
     return mode === "server" ? 3 : 2;
 }
-function installNightlyCron(hour) {
+/**
+ * One `OnCalendar=*-*-* HH:00:00` line per hour, newline-joined — systemd fires
+ * a timer at EACH OnCalendar entry (multi-slot in a single timer). Hours are
+ * sorted so the generated file is stable/diffable. Exported for testing.
+ */
+function formatOnCalendarLines(hours) {
+    return [...hours]
+        .sort((a, b) => a - b)
+        .map((h) => `OnCalendar=*-*-* ${String(h).padStart(2, "0")}:00:00`)
+        .join("\n");
+}
+/**
+ * The launchd `StartCalendarInterval` ARRAY body — one `<dict>` per hour.
+ * launchd fires the job at each dict; a single dict is the 1-slot special case
+ * but the array form is uniform across 1..N. Exported for testing.
+ */
+function formatLaunchdIntervals(hours) {
+    return [...hours]
+        .sort((a, b) => a - b)
+        .map((h) => `    <dict>
+      <key>Hour</key>
+      <integer>${h}</integer>
+      <key>Minute</key>
+      <integer>0</integer>
+    </dict>`)
+        .join("\n");
+}
+/**
+ * Write + enable one schedule unit (timer + service on Linux, plist on macOS),
+ * multi-slot. Shared by the capture and consolidation installers. Always
+ * rewrites both files (the 0.17 migration decision: re-init brings an install
+ * up to the resolved standard; customization is via config keys, not hand-
+ * edited unit files). Logs the resolved slots.
+ */
+function writeScheduleUnit(opts) {
     const binaryArgs = resolveBinaryArgs();
     const os = (0, node_os_1.platform)();
-    const hh = String(hour).padStart(2, "0");
     // PATH must start with the binary's own directory (see installLaunchd for rationale).
     const binDir = (0, node_path_1.dirname)(binaryArgs[0]);
     // One canonical nightly log path across platforms — status output, docs,
     // and support instructions all reference this single location.
     const logPath = (0, node_path_1.join)(HICORTEX_HOME, "nightly.log");
+    const isInterval = typeof opts.intervalSec === "number";
+    if (!isInterval && (!opts.hours || opts.hours.length === 0)) {
+        throw new Error("writeScheduleUnit: provide either hours or intervalSec");
+    }
+    // Human-readable schedule label for the log line.
+    const slotLabel = isInterval
+        ? `every ${Math.round(opts.intervalSec / 60)} min`
+        : [...opts.hours].sort((a, b) => a - b).map((h) => `${String(h).padStart(2, "0")}:00`).join(", ");
     if (os === "darwin") {
         const plistDir = (0, node_path_1.join)((0, node_os_1.homedir)(), "Library", "LaunchAgents");
-        const plistPath = (0, node_path_1.join)(plistDir, "com.gamaze.hicortex-nightly.plist");
-        // Never overwrite an existing schedule — users tune these (multi-slot
-        // capture windows, quiet hours). Fresh installs only.
-        if ((0, node_fs_1.existsSync)(plistPath)) {
-            console.log(`  ✓ Nightly cron already installed — leaving existing schedule as-is`);
-            return;
-        }
-        const programArgs = [...binaryArgs, "nightly"]
+        const plistPath = (0, node_path_1.join)(plistDir, `${opts.plistLabel}.plist`);
+        const programArgs = [...binaryArgs, ...opts.nightlyArgs]
             .map((a) => `    <string>${a}</string>`)
             .join("\n");
+        // Schedule block: StartInterval (seconds) for the watchdog poll, or
+        // StartCalendarInterval as an ARRAY of dicts (one per hour) for slots.
+        // RunAtLoad ONLY on the interval (watchdog) plist — so a Mac that reboots
+        // gets a first capture tick on load (~parity with systemd's OnBootSec=2min),
+        // not 20 min later. The cooldown gate makes a load-time fire a cheap no-op
+        // if a capture ran recently.
+        const scheduleBlock = isInterval
+            ? `  <key>StartInterval</key>\n  <integer>${opts.intervalSec}</integer>\n  <key>RunAtLoad</key>\n  <true/>`
+            : `  <key>StartCalendarInterval</key>\n  <array>\n${formatLaunchdIntervals(opts.hours)}\n  </array>`;
         const plist = `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
   <key>Label</key>
-  <string>com.gamaze.hicortex-nightly</string>
+  <string>${opts.plistLabel}</string>
   <key>ProgramArguments</key>
   <array>
 ${programArgs}
   </array>
-  <key>StartCalendarInterval</key>
-  <dict>
-    <key>Hour</key>
-    <integer>${hour}</integer>
-    <key>Minute</key>
-    <integer>0</integer>
-  </dict>
+${scheduleBlock}
   <key>StandardOutPath</key>
   <string>${logPath}</string>
   <key>StandardErrorPath</key>
@@ -1756,63 +1904,146 @@ ${programArgs}
             try {
                 (0, node_child_process_1.execSync)(`launchctl unload ${plistPath} 2>/dev/null`, { stdio: "pipe" });
             }
-            catch { }
+            catch { /* not loaded */ }
             (0, node_child_process_1.execSync)(`launchctl load ${plistPath}`, { stdio: "pipe" });
-            console.log(`  ✓ Installed nightly cron (runs daily at ${hh}:00)`);
+            console.log(`  ✓ Installed ${opts.timerDesc} (${slotLabel})`);
         }
         catch {
-            console.log(`  ⚠ Could not load nightly plist. Load manually: launchctl load ${plistPath}`);
+            console.log(`  ⚠ Could not load plist. Load manually: launchctl load ${plistPath}`);
         }
     }
     else if (os === "linux") {
         const configDir = (0, node_path_1.join)((0, node_os_1.homedir)(), ".config", "systemd", "user");
-        const servicePath = (0, node_path_1.join)(configDir, "hicortex-nightly.service");
-        const timerPath = (0, node_path_1.join)(configDir, "hicortex-nightly.timer");
-        const execStart = [...binaryArgs, "nightly"].join(" ");
+        const servicePath = (0, node_path_1.join)(configDir, `${opts.unitBase}.service`);
+        const timerPath = (0, node_path_1.join)(configDir, `${opts.unitBase}.timer`);
+        const execStart = [...binaryArgs, ...opts.nightlyArgs].join(" ");
         // File logging, not journal: oneshot runs on machines with a volatile
         // journal (e.g. Raspberry Pi defaults) otherwise fail without a trace.
         // Same log path as the macOS plist. append: needs systemd ≥ 240 (2018).
         const service = `[Unit]
-Description=Hicortex Nightly (distill + POST)
+Description=${opts.serviceDesc}
 
 [Service]
 Type=oneshot
 ExecStart=${execStart}
-StandardOutput=append:${logPath}
+${opts.timeoutMin ? `TimeoutStartSec=${opts.timeoutMin}min\n` : ""}StandardOutput=append:${logPath}
 StandardError=append:${logPath}
 Environment=PATH=${binDir}:/usr/local/bin:/usr/bin:/bin
 Environment=HOME=${(0, node_os_1.homedir)()}
 WorkingDirectory=${(0, node_os_1.homedir)()}`;
+        // Timer body: OnUnitActiveSec (interval, watchdog) or one OnCalendar line
+        // per hour (multi-slot). systemd ORs multiple OnCalendar entries.
+        const timerBody = isInterval
+            ? `OnBootSec=2min\nOnUnitActiveSec=${Math.round(opts.intervalSec / 60)}min`
+            : formatOnCalendarLines(opts.hours);
         const timer = `[Unit]
-Description=Hicortex Nightly Timer
+Description=${opts.timerDesc}
 
 [Timer]
-OnCalendar=*-*-* ${hh}:00:00
+${timerBody}
 Persistent=true
 
 [Install]
 WantedBy=timers.target`;
         (0, node_fs_1.mkdirSync)(configDir, { recursive: true });
-        // The .service file is ours — always refresh it so fixes (like file
-        // logging) reach existing installs. The .timer holds the user-tuned
-        // schedule and is never overwritten.
+        // Always rewrite both .service and .timer (0.17 migration: re-init adopts
+        // the resolved standard schedule; the config keys are the tuning surface).
         (0, node_fs_1.writeFileSync)(servicePath, service);
-        if ((0, node_fs_1.existsSync)(timerPath)) {
-            try {
-                (0, node_child_process_1.execSync)("systemctl --user daemon-reload", { stdio: "pipe" });
-            }
-            catch { /* fine */ }
-            console.log(`  ✓ Nightly service refreshed — existing timer schedule kept as-is`);
-            return;
-        }
         (0, node_fs_1.writeFileSync)(timerPath, timer);
         try {
             (0, node_child_process_1.execSync)("systemctl --user daemon-reload", { stdio: "pipe" });
-            (0, node_child_process_1.execSync)("systemctl --user enable --now hicortex-nightly.timer", { stdio: "pipe" });
-            console.log(`  ✓ Installed nightly timer (runs daily at ${hh}:00)`);
+            (0, node_child_process_1.execSync)(`systemctl --user enable --now ${opts.unitBase}.timer`, { stdio: "pipe" });
+            console.log(`  ✓ Installed ${opts.unitBase}.timer (${slotLabel})`);
         }
         catch {
-            console.log(`  ⚠ Could not enable nightly timer. Enable manually: systemctl --user enable --now hicortex-nightly.timer`);
+            console.log(`  ⚠ Could not enable ${opts.unitBase}.timer. Enable manually: ` +
+                `systemctl --user enable --now ${opts.unitBase}.timer`);
+        }
+    }
+}
+/**
+ * Install the CAPTURE WATCHDOG timer — a short-interval poll that fires
+ * `nightly --capture-only --watchdog`. The watchdog itself throttles by the
+ * success-cooldown (`captureCooldownHours`) and preflights, so a transient
+ * fire-instant network miss retries in minutes, not at the next daily slot
+ * (#239). Installed UNIFORMLY for client + server/co-located (one capture
+ * mechanism everywhere — no per-topology branch).
+ */
+function installCaptureWatchdogTimer() {
+    writeScheduleUnit({
+        unitBase: "hicortex-capture",
+        plistLabel: "com.gamaze.hicortex-capture",
+        serviceDesc: "Hicortex Capture Watchdog (denoise + POST /distill, throttled)",
+        timerDesc: "Hicortex Capture Watchdog",
+        nightlyArgs: ["nightly", "--capture-only", "--watchdog"],
+        intervalSec: CAPTURE_WATCHDOG_INTERVAL_MIN * 60,
+        timeoutMin: 30, // backstop only — capture is no-LLM, bounded; 30min catches a stuck POST
+    });
+}
+/**
+ * Install the CONSOLIDATION timer (full `nightly`). Reuses the existing
+ * `hicortex-nightly` unit name (repurposed from the pre-0.17 single full-nightly).
+ */
+function installConsolidationTimer(hours) {
+    writeScheduleUnit({
+        unitBase: "hicortex-nightly",
+        plistLabel: "com.gamaze.hicortex-nightly",
+        serviceDesc: "Hicortex Nightly (capture + consolidate)",
+        timerDesc: "Hicortex Consolidation Timer",
+        nightlyArgs: ["nightly"],
+        hours,
+        // Backstop only (NOT an operating limit) — set well above the longest
+        // legitimate run so it catches a true hang, never a slow-but-progressing
+        // one. ~5000 LLM calls × ~1–3s/call ≈ 1.4–4.2h → 6h clears it with margin.
+        // Coupled to the consolidateMaxLlmCalls budget (#241): raise together.
+        timeoutMin: 360,
+    });
+}
+/**
+ * Remove the consolidation timer + service (and the macOS plist). Used on
+ * CLIENT installs: clients have no local DB, so a pre-0.17 `hicortex-nightly`
+ * timer (which auto-capture-onlys on clients) is redundant with the new capture
+ * timer — remove it so it doesn't double-fire.
+ */
+function removeConsolidationTimer() {
+    const os = (0, node_os_1.platform)();
+    if (os === "darwin") {
+        const plistPath = (0, node_path_1.join)((0, node_os_1.homedir)(), "Library", "LaunchAgents", "com.gamaze.hicortex-nightly.plist");
+        if ((0, node_fs_1.existsSync)(plistPath)) {
+            try {
+                (0, node_child_process_1.execSync)(`launchctl unload ${plistPath} 2>/dev/null`, { stdio: "pipe" });
+            }
+            catch { /* not loaded */ }
+            try {
+                (0, node_fs_1.rmSync)(plistPath);
+                console.log("  ✓ Removed legacy nightly timer (client mode — capture-only)");
+            }
+            catch { /* leave it */ }
+        }
+    }
+    else if (os === "linux") {
+        try {
+            (0, node_child_process_1.execSync)("systemctl --user disable --now hicortex-nightly.timer 2>/dev/null", { stdio: "pipe" });
+        }
+        catch { /* not installed */ }
+        const unitDir = (0, node_path_1.join)((0, node_os_1.homedir)(), ".config", "systemd", "user");
+        let removed = false;
+        for (const name of ["hicortex-nightly.timer", "hicortex-nightly.service"]) {
+            const p = (0, node_path_1.join)(unitDir, name);
+            if ((0, node_fs_1.existsSync)(p)) {
+                try {
+                    (0, node_fs_1.rmSync)(p);
+                    removed = true;
+                }
+                catch { /* leave it */ }
+            }
+        }
+        if (removed) {
+            try {
+                (0, node_child_process_1.execSync)("systemctl --user daemon-reload 2>/dev/null", { stdio: "pipe" });
+            }
+            catch { /* fine */ }
+            console.log("  ✓ Removed legacy nightly timer (client mode — capture-only)");
         }
     }
 }