@gamaze/hicortex 0.16.9 → 0.17.0

package/README.md

@@ -203,7 +203,7 @@ Config at `~/.hicortex/config.json`. Created by `init`. Key options:
 | `numCtx` | Context window for ollama (default 8192, one value for all phases). Scoring uses ~850 tokens, so 2048 is ample; distill/reflect/classify need more for `detectChunkSize`'s chunk sizing. |
 | `enableThinking` | Toggle the model's internal reasoning ("thinking") stream for OpenAI-compatible endpoints (default false). Only meaningful for local chat-template-aware servers (ollama, mlx-lm); leave unset for cloud OpenAI/OpenRouter/Groq endpoints (they 400 on the unknown `chat_template_kwargs` field). |
 | `maxTokens` | Max output tokens for all phases (default 8192). A ceiling, not a target — the model stops early when done. |
-| `ollamaFlushEvery` | Flush ollama's accumulated memory every N scoring calls (default 0 = off). Workaround for ollama's memory-growth bug (~171 MB/call). N=15 caps a cycle at ~2.5 GB. Scoped to the fast tier (scoring) only. |
+| `ollamaFlushEvery` | Flush ollama's accumulated memory every N scoring calls. **Off by default (0)** — opt-in only for an **ollama** install whose runner RSS growth (~171 MB/call) swap-thrashes long consolidations on a RAM-constrained box; N=15 caps a cycle at ~2.5 GB. Gated on the provider being ollama (local **or** remote) — no effect for non-ollama providers. Only you can judge whether your ollama endpoint actually suffers the growth (a managed/cloud ollama host may not), so it stays off until you set it. |
 | `ollamaFlushWaitMs` | Milliseconds to wait after an ollama flush for the runner to exit + release memory (default 180000 = 3 min). |
 | `authToken` | Bearer token for endpoint auth. Generated on first `init` in server mode. Find the active token with `hicortex status` or in `~/.hicortex/config.json`. |
 | `corsAllowedOrigins` | Browser origins allowed to read cross-origin responses, e.g. `["https://ui.example.com"]`. **Empty by default** — the server sends no `Access-Control-Allow-Origin` and never `Allow-Credentials`, so no external web page can read its data. The bundled `/viz` and `/context/ui` pages are same-origin and need no entry. |
@@ -215,8 +215,11 @@ Config at `~/.hicortex/config.json`. Created by `init`. Key options:
 | `contextClients` | Which harnesses inject the [context layer](#context-layer) at session start (default `["cc"]`; `"all"` or any subset of `cc`/`hermes`/`oc`) |
 | `contextAgents` | Per-agent context modes (0.13): `{ "<id>": "override" \| "global" \| "off" }`. Absent + no `agents/<id>/` dir → every agent gets the global set. Boot-time (restart to apply) — see [Per-agent context](#per-agent-context-013) |
 | `agentName` | This install's per-agent context id sent as `?agent=`. **Unset by default** (CC shares the global context — no `?agent=` sent). Explicit opt-in via `init --agent-name <name>`; `init --agent-name ""` clears it. An empty/whitespace value equals unset |
-| `nightlyHour` | Local hour (0–23) for the nightly job installed by `init` (defaults: client 2, server 3). Applied on fresh installs; existing schedules are never overwritten |
-| `preflightTimeoutMs` | **Client mode only.** Per-attempt timeout for the nightly's server-reachability check before it starts capturing (default: 15000 ms) |
+| `captureCooldownHours` | Success-cooldown (hours) for the **capture watchdog** (0.17). The capture timer polls every ~20 min; the watchdog captures only if more than this has elapsed since the last *successful* capture (`state.lastNightly`). Default `6` (≈4 captures/day). A failed preflight retries on the next poll (~20 min) — so a transient fire-instant network miss costs minutes, not a day (#239) |
+| `consolidationHours` | Hours (0–23, local) for the **consolidation** timer — the full nightly (capture + distill + score + reflect + link). Installed for **server/co-located only** (clients have no local DB). Default `[10, 22]`: the 22:00 evening slot runs after the day's capture waves (same-day results); the 10:00 morning slot runs *after* the morning capture so wake-up pushes are caught. Omitted on clients |
+| `consolidateMaxLlmCalls` | Ceiling on total LLM calls across all classify-tier consolidation stages (content-domain, link discovery, supersession) per run. A runaway **backstop**, not a throughput throttle — on a free local model the binding constraint is the nightly unit's wall-clock timeout, not call count. Default `5000` (was a hard-coded 200 that starved link/supersession during a classification backlog) |
+| `nightlyHour` | **Deprecated (0.17) single-slot fallback.** Local hour (0–23) honoured only when `consolidationHours` is absent — yields one daily consolidation slot at that hour (preserves the pre-0.17 "one daily job" intent). New installs should use `consolidationHours` |
+| `preflightTimeoutMs` | **Client mode only.** Per-attempt timeout for the nightly's server-reachability check before it starts capturing (default: 20000 ms, bumped from 15000 in 0.17 to absorb a cold Tailscale handshake on a roaming laptop) |
 | `preflightAttempts` | **Client mode only.** Reachability-check retries before the nightly aborts (default: 3; floored at 1). `1` = single try, no retry |
 | `preflightRetryGapMs` | **Client mode only.** Delay between reachability retries (default: 60000 ms). Note: timers don't advance while the machine is asleep, so on a sleeping laptop this gap counts awake-time, not wall-clock |
 | `scoreSimilarityWeight` | Weight of semantic similarity in the ranking score (default: 0.50) |

package/assets/dashboard.html

@@ -0,0 +1,454 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Hicortex — dashboard</title>
+<!--
+  Hicortex memory analytics dashboard (#224).
+  STRICTLY view-only — no actions, no queue, no mutation endpoints.
+  Self-contained: inline CSS/JS, hand-rolled inline SVG charts (owner
+  decision — no Chart.js, no CDN, zero external requests). CSP-safe.
+
+  Data source: GET /dashboard/data on this server (same origin, bearer-only).
+  The page SHELL is public (exempted in createAuthMiddleware, like /viz); the
+  /dashboard/data call is bearer-only with a localhost bypass, so on the
+  server box no token is needed. Remote browsers hand off a token via
+  ?token=<t> (stripped from the URL on load), localStorage, or a 401 prompt.
+
+  Memory entries link to /viz and /memory?id= (view-only drill-down).
+-->
+<style>
+  :root {
+    --bg: #0f1117;
+    --panel: #161a23;
+    --panel-border: #262c3a;
+    --text: #d5dae4;
+    --text-dim: #8b93a5;
+    --accent: #5b9dd9;
+    --accent-2: #61c98f;
+    --warn: #e0b055;
+    --danger: #e05555;
+  }
+  @media (prefers-color-scheme: light) {
+    :root {
+      --bg: #ffffff;
+      --panel: #f6f7f9;
+      --panel-border: #d9dce2;
+      --text: #1c1f26;
+      --text-dim: #656d7a;
+      --accent: #2f6fb0;
+      --accent-2: #2f8f4e;
+      --warn: #b08030;
+      --danger: #c0392b;
+    }
+  }
+  * { box-sizing: border-box; margin: 0; padding: 0; }
+  body {
+    background: var(--bg);
+    color: var(--text);
+    font: 14px/1.5 -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+    padding: 20px;
+  }
+  h1 { font-size: 20px; font-weight: 600; margin-bottom: 4px; }
+  h2 { font-size: 15px; font-weight: 600; color: var(--text-dim); margin-bottom: 10px; text-transform: uppercase; letter-spacing: 0.04em; }
+  .sub { color: var(--text-dim); margin-bottom: 24px; }
+  .controls { display: flex; gap: 12px; align-items: center; flex-wrap: wrap; margin-bottom: 20px; }
+  .controls label { color: var(--text-dim); font-size: 13px; }
+  select, input[type="date"] {
+    background: var(--panel); color: var(--text);
+    border: 1px solid var(--panel-border); border-radius: 4px;
+    padding: 4px 8px; font: inherit;
+  }
+  .grid { display: grid; grid-template-columns: 1fr 1fr; gap: 20px; margin-bottom: 24px; }
+  @media (max-width: 800px) { .grid { grid-template-columns: 1fr; } }
+  .panel { background: var(--panel); border: 1px solid var(--panel-border); border-radius: 8px; padding: 16px; }
+  .headline { display: flex; gap: 32px; flex-wrap: wrap; margin-bottom: 24px; }
+  .stat { display: flex; flex-direction: column; gap: 4px; }
+  .stat .v { font-size: 28px; font-weight: 600; color: var(--accent); }
+  .stat .v.warn { color: var(--warn); }
+  .stat .l { font-size: 12px; color: var(--text-dim); text-transform: uppercase; letter-spacing: 0.04em; }
+  svg { display: block; width: 100%; height: 200px; overflow: visible; }
+  .chart-x { fill: var(--text-dim); font-size: 10px; }
+  .legend { display: flex; gap: 16px; flex-wrap: wrap; font-size: 12px; color: var(--text-dim); margin-top: 8px; }
+  .legend span { display: inline-flex; align-items: center; gap: 6px; }
+  .legend i { width: 10px; height: 10px; border-radius: 2px; display: inline-block; }
+  .bar-row { display: flex; align-items: center; gap: 8px; margin: 4px 0; font-size: 13px; }
+  .bar-row .k { width: 140px; color: var(--text-dim); overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+  .bar-row .track { flex: 1; height: 14px; background: rgba(128,128,128,0.12); border-radius: 3px; overflow: hidden; }
+  .bar-row .fill { height: 100%; background: var(--accent); }
+  .bar-row .n { width: 50px; text-align: right; color: var(--text-dim); font-variant-numeric: tabular-nums; }
+  .line { font: 12px ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; color: var(--text); white-space: pre-wrap; word-break: break-word; }
+  .line a { color: var(--accent); text-decoration: none; }
+  .line a:hover { text-decoration: underline; }
+  .lesson { background: var(--bg); border: 1px solid var(--panel-border); border-radius: 4px; padding: 10px; margin: 6px 0; white-space: pre-wrap; word-break: break-word; }
+  .muted { color: var(--text-dim); }
+  .err { color: var(--danger); }
+  table.digest { width: 100%; border-collapse: collapse; font-size: 13px; }
+  table.digest td { padding: 4px 8px; border-bottom: 1px solid var(--panel-border); vertical-align: top; }
+  table.digest td.k { color: var(--text-dim); width: 180px; }
+  .stage-pill { display: inline-block; padding: 1px 6px; border-radius: 10px; background: rgba(128,128,128,0.18); font-size: 11px; color: var(--text-dim); margin-right: 4px; }
+  .empty { color: var(--text-dim); font-style: italic; padding: 12px 0; }
+</style>
+</head>
+<body>
+<h1>Hicortex — memory dashboard</h1>
+<div class="sub">View-only analytics. All metrics derived from the live corpus + nightly snapshots.</div>
+
+<div class="controls">
+  <label>Range
+    <select id="range">
+      <option value="7d">7 days</option>
+      <option value="30d" selected>30 days</option>
+      <option value="90d">90 days</option>
+      <option value="all">All time</option>
+    </select>
+  </label>
+  <label>Split growth by
+    <select id="split">
+      <option value="total">Total memories (cumulative)</option>
+      <option value="captures">Captures / day</option>
+    </select>
+  </label>
+  <label>Filter
+    <select id="filter"></select>
+  </label>
+  <label>Digest date
+    <input type="date" id="date" />
+  </label>
+  <button id="reload" type="button" style="background:var(--panel);color:var(--text);border:1px solid var(--panel-border);border-radius:4px;padding:4px 12px;font:inherit;cursor:pointer;">Refresh</button>
+</div>
+
+<div class="headline" id="headline"></div>
+
+<div class="grid">
+  <div class="panel">
+    <h2>Growth trends</h2>
+    <svg id="growth" aria-label="Growth chart"></svg>
+    <div class="legend" id="growth-legend"></div>
+  </div>
+  <div class="panel">
+    <h2>Composition</h2>
+    <div id="composition-tabs" style="margin-bottom:10px;">
+      <button class="ctab" data-k="by_type" style="background:var(--accent);color:#fff;border:none;border-radius:4px;padding:3px 10px;cursor:pointer;font:inherit;">Type</button>
+      <button class="ctab" data-k="by_domain" style="background:var(--panel);color:var(--text-dim);border:1px solid var(--panel-border);border-radius:4px;padding:3px 10px;cursor:pointer;font:inherit;margin-left:4px;">Domain</button>
+      <button class="ctab" data-k="by_source_agent" style="background:var(--panel);color:var(--text-dim);border:1px solid var(--panel-border);border-radius:4px;padding:3px 10px;cursor:pointer;font:inherit;margin-left:4px;">Source</button>
+    </div>
+    <div id="composition"></div>
+  </div>
+</div>
+
+<div class="panel" style="margin-bottom:24px;">
+  <h2>Nightly activity digest — <span id="digest-date" class="muted"></span></h2>
+  <div id="digest-stages" style="margin-bottom:12px;"></div>
+  <h2 style="margin-top:16px;">New memories (sample, rendered as in recall)</h2>
+  <div id="digest-sample"></div>
+  <h2 style="margin-top:16px;">New lessons</h2>
+  <div id="digest-lessons"></div>
+  <h2 style="margin-top:16px;">Dedup merges</h2>
+  <div id="digest-dedup"></div>
+</div>
+
+<div class="sub muted" style="margin-top:24px;">
+  Entries link to <a href="/viz" style="color:var(--accent);">/viz</a> and
+  <code>/memory?id=</code> for view-only drill-down. No data leaves this server
+  through this page.
+</div>
+
+<script>
+"use strict";
+// ---------------------------------------------------------------------------
+// Token handling — mirror /viz + /context/ui: ?token= handoff (stripped on
+// load), localStorage persistence, 401 prompt. Same-origin fetch only.
+// ---------------------------------------------------------------------------
+const TOKEN_KEY = "hicortex-dashboard-token";
+function getToken() {
+  const u = new URL(location.href);
+  const tParam = u.searchParams.get("token");
+  if (tParam) {
+    localStorage.setItem(TOKEN_KEY, tParam);
+    u.searchParams.delete("token");
+    history.replaceState(null, "", u.toString());
+    return tParam;
+  }
+  return localStorage.getItem(TOKEN_KEY);
+}
+let token = getToken();
+async function fetchData(path) {
+  const headers = {};
+  if (token) headers["Authorization"] = "Bearer " + token;
+  const resp = await fetch(path, { headers });
+  if (resp.status === 401) {
+    token = prompt("Hicortex auth token:") || "";
+    if (token) {
+      localStorage.setItem(TOKEN_KEY, token);
+      return fetchData(path); // retry once
+    }
+    throw new Error("Unauthorized");
+  }
+  if (!resp.ok) throw new Error("HTTP " + resp.status + ": " + (await resp.text()));
+  return resp.json();
+}
+
+// ---------------------------------------------------------------------------
+// State
+// ---------------------------------------------------------------------------
+let state = null;
+let compKey = "by_type";
+
+const $ = (id) => document.getElementById(id);
+
+// ---------------------------------------------------------------------------
+// Render: headline
+// ---------------------------------------------------------------------------
+function renderHeadline(h) {
+  const ups = h.uses_per_showing === null || h.uses_per_showing === undefined
+    ? "—"
+    : (h.uses_per_showing * 100).toFixed(1) + "%";
+  $("headline").innerHTML = `
+    <div class="stat"><div class="v">${h.total_memories}</div><div class="l">Total memories</div></div>
+    <div class="stat"><div class="v">${ups}</div><div class="l">Uses per showing (headline)</div></div>
+    <div class="stat"><div class="v warn">${h.cold_count}</div><div class="l">Cold long-tail (never shown/used)</div></div>
+  `;
+}
+
+// ---------------------------------------------------------------------------
+// Render: growth chart (hand-rolled inline SVG line chart)
+//
+// The filter select splits the series by `agent:<name>` or `domain:<name>` —
+// every snapshot carries by_source_agent / by_domain (cumulative in backfill
+// rows, point-in-time in real ones), so plotting that one key across the
+// series yields a per-scope growth curve. "(all)" plots the corpus total.
+// ---------------------------------------------------------------------------
+const SERIES_COLORS = ["#5b9dd9", "#61c98f", "#e0b055", "#b97fe0", "#e05555", "#7fc4d9"];
+function renderGrowth(series, split, filter) {
+  const svg = $("growth");
+  const W = svg.clientWidth || 600, H = 200, P = 28;
+  svg.setAttribute("viewBox", `0 0 ${W} ${H}`);
+  svg.innerHTML = "";
+  if (series.length === 0) {
+    svg.innerHTML = `<text x="${W/2}" y="${H/2}" text-anchor="middle" class="chart-x">No snapshots in range. Snapshots are written by the full nightly; a fresh install gets a backfill from created_at.</text>`;
+    $("growth-legend").innerHTML = "";
+    return;
+  }
+
+  // Resolve the filter to a per-snapshot value extractor.
+  // filter values: "" (all), "agent:<name>", "domain:<name>".
+  let extract;
+  let label = split === "captures" ? "Captures / day" : "Total memories (cumulative)";
+  if (filter && filter.startsWith("agent:")) {
+    const agent = filter.slice("agent:".length);
+    // `agent` is the DECODED filter value (HTMLSelectElement.value un-escapes
+    // the option attribute), i.e. the raw source_agent — attacker-controlled.
+    // Use it RAW as the object key (metrics keys are the real source_agent
+    // strings), but escapeHtml it for the legend LABEL, which lands in
+    // innerHTML (line ~299). Escaping the <option> alone is not sufficient
+    // precisely because the round-trip decodes.
+    extract = (m) => (m.by_source_agent || {})[agent] ?? 0;
+    label += ` — agent:${escapeHtml(agent)}`;
+  } else if (filter && filter.startsWith("domain:")) {
+    const dom = filter.slice("domain:".length);
+    // domain is LLM-constrained to the config vocabulary, but escape for
+    // consistency with the agent branch (same innerHTML sink).
+    extract = (m) => (m.by_domain || {})[dom] ?? 0;
+    label += ` — domain:${escapeHtml(dom)}`;
+  } else {
+    extract = (m) => m.totals.mem;
+  }
+
+  // Points: run_at → {date, value (cumulative), added (per-day delta)}.
+  // For "captures/day" the filter is informational (per-day deltas aren't
+  // keyed by agent/domain in the snapshot), so the split always reads
+  // new_this_run.added regardless of filter.
+  const pts = series.map((s) => ({
+    d: s.run_at,
+    value: extract(s.metrics),
+    added: s.metrics.new_this_run ? s.metrics.new_this_run.added : 0,
+  }));
+  const xMin = new Date(pts[0].d).getTime();
+  const xMax = new Date(pts[pts.length - 1].d).getTime() || xMin + 1;
+  const xs = (t) => P + ((t - xMin) / (xMax - xMin || 1)) * (W - 2 * P);
+
+  let yMax;
+  if (split === "captures") yMax = Math.max(1, ...pts.map((p) => p.added));
+  else yMax = Math.max(1, ...pts.map((p) => p.value));
+  const ys = (v) => H - P - (v / yMax) * (H - 2 * P);
+
+  // Axis lines + gridlines.
+  const grid = [0, 0.25, 0.5, 0.75, 1].map((f) => {
+    const y = P + f * (H - 2 * P);
+    return `<line x1="${P}" y1="${y}" x2="${W - P}" y2="${y}" stroke="rgba(128,128,128,0.15)" stroke-width="1"/>`;
+  }).join("");
+  const ylabels = [0, 0.5, 1].map((f) => {
+    const y = P + f * (H - 2 * P);
+    const v = Math.round((1 - f) * yMax);
+    return `<text x="${P - 6}" y="${y + 3}" text-anchor="end" class="chart-x">${v}</text>`;
+  }).join("");
+  const fmt = (iso) => iso.slice(5, 10); // MM-DD
+  const xlabels = [pts[0].d, pts[Math.floor(pts.length / 2)].d, pts[pts.length - 1].d]
+    .map((d, i) => `<text x="${xs(new Date(d).getTime())}" y="${H - P + 14}" text-anchor="${i === 0 ? 'start' : i === 2 ? 'end' : 'middle'}" class="chart-x">${fmt(d)}</text>`)
+    .join("");
+
+  let body = "";
+  if (split === "captures") {
+    // Per-day delta bars.
+    pts.forEach((p) => {
+      const x = xs(new Date(p.d).getTime());
+      const y0 = ys(0), y1 = ys(p.added);
+      if (p.added > 0) body += `<line x1="${x}" y1="${y0}" x2="${x}" y2="${y1}" stroke="${SERIES_COLORS[0]}" stroke-width="2"/>`;
+    });
+  } else {
+    const d = pts.map((p, i) => `${i === 0 ? "M" : "L"} ${xs(new Date(p.d).getTime())} ${ys(p.value)}`).join(" ");
+    body = `<path d="${d}" fill="none" stroke="${SERIES_COLORS[0]}" stroke-width="2"/>`;
+    const last = pts[pts.length - 1];
+    body += `<circle cx="${xs(new Date(last.d).getTime())}" cy="${ys(last.value)}" r="3" fill="${SERIES_COLORS[0]}"/>`;
+  }
+  svg.innerHTML = grid + ylabels + xlabels + body;
+  $("growth-legend").innerHTML = `<span><i style="background:${SERIES_COLORS[0]}"></i>${label}</span>`;
+}
+
+// ---------------------------------------------------------------------------
+// Render: composition (horizontal bars)
+// ---------------------------------------------------------------------------
+function renderComposition(comp, key) {
+  const obj = comp[key] || {};
+  const entries = Object.entries(obj).sort((a, b) => b[1] - a[1]);
+  const max = Math.max(1, ...entries.map((e) => e[1]));
+  const host = $("composition");
+  if (entries.length === 0) {
+    host.innerHTML = `<div class="empty">No data.</div>`;
+    return;
+  }
+  host.innerHTML = entries.map(([k, v]) => {
+    const pct = (v / max) * 100;
+    // escapeHtml is mandatory: k is memory_type/domain/source_agent, which is
+    // attacker-influenced (any authenticated /distill client sets source_agent
+    // verbatim). Injected into both a title="..." attribute and text — close
+    // the attribute and add an on* handler otherwise.
+    const ek = escapeHtml(k);
+    return `<div class="bar-row"><span class="k" title="${ek}">${ek}</span><span class="track"><span class="fill" style="width:${pct}%"></span></span><span class="n">${v}</span></div>`;
+  }).join("");
+}
+
+// ---------------------------------------------------------------------------
+// Render: digest
+// ---------------------------------------------------------------------------
+function linkId(id) {
+  // Short id prefix links to /memory?id= for view-only drill-down. NOTE: a
+  // plain <a> navigation does not attach the bearer header, so /memory (a JSON
+  // API) 401s for remote browsers — drill-down is localhost-only in v1. The id
+  // is a server hex token but escape the text anyway (defense-in-depth).
+  return `<a href="/memory?id=${encodeURIComponent(id)}" title="Open memory">${escapeHtml(id.slice(0, 8))}</a>`;
+}
+function renderDigest(digest) {
+  $("digest-date").textContent = digest.date || "—";
+  const s = digest.stages;
+  const stages = [
+    s.added !== undefined ? `<span class="stage-pill">added: ${s.added}</span>` : "",
+    s.lessonsGenerated !== undefined ? `<span class="stage-pill">lessons: ${s.lessonsGenerated}</span>` : "",
+    `<span class="stage-pill">dedup: ${s.dedup}</span>`,
+    `<span class="stage-pill">supersession: ${s.supersession}</span>`,
+  ].join(" ");
+  $("digest-stages").innerHTML = stages;
+
+  if (digest.sample.length === 0) {
+    $("digest-sample").innerHTML = `<div class="empty">No new memories that day.</div>`;
+  } else {
+    $("digest-sample").innerHTML = digest.sample.map((s) =>
+      `<div class="line">- [<a href="/memory?id=${encodeURIComponent(s.id)}">${escapeHtml(s.id.slice(0,8))}</a>] ${escapeHtml(s.line.replace(/^-\s*\[[^\]]+\]\s*/, ""))}</div>`
+    ).join("");
+  }
+
+  if (digest.lessons.length === 0) {
+    $("digest-lessons").innerHTML = `<div class="empty">No new lessons that day.</div>`;
+  } else {
+    $("digest-lessons").innerHTML = digest.lessons.map((l) =>
+      `<div class="lesson">${escapeHtml(l.content)}</div>`
+    ).join("");
+  }
+
+  if (digest.dedup_merges.length === 0) {
+    $("digest-dedup").innerHTML = `<div class="empty">No dedup merges that day.</div>`;
+  } else {
+    $("digest-dedup").innerHTML = `<table class="digest">${
+      digest.dedup_merges.map((m) =>
+        `<tr><td class="k">${m.merged_at.slice(0, 19).replace("T", " ")}</td>` +
+        `<td>${linkId(m.loser_id)} → ${linkId(m.canonical_id)}` +
+        (m.content_head ? `<div class="muted">${escapeHtml(m.content_head)}</div>` : "") +
+        `</td></tr>`
+      ).join("")
+    }</table>`;
+  }
+}
+
+function escapeHtml(s) {
+  return String(s).replace(/[&<>"']/g, (c) => ({
+    "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;",
+  })[c]);
+}
+
+// ---------------------------------------------------------------------------
+// Load + wire controls
+// ---------------------------------------------------------------------------
+async function load() {
+  const range = $("range").value;
+  const date = $("date").value || "";
+  try {
+    state = await fetchData("/dashboard/data?range=" + encodeURIComponent(range) +
+      (date ? "&date=" + encodeURIComponent(date) : ""));
+  } catch (e) {
+    document.body.insertAdjacentHTML("afterbegin",
+      `<div class="panel err">Failed to load dashboard data: ${escapeHtml(e.message)}</div>`);
+    return;
+  }
+  renderHeadline(state.headline);
+  renderGrowth(state.series, $("split").value, $("filter").value);
+  renderComposition(state.composition, compKey);
+  renderDigest(state.digest);
+
+  // Populate the growth-filter from source_agent + domain union (best-effort —
+  // a v1 affordance; the series already carries per-day totals, so the filter
+  // is informational for now and does not split the line).
+  const agents = new Set();
+  const domains = new Set();
+  state.series.forEach((s) => {
+    Object.keys(s.metrics.by_source_agent || {}).forEach((k) => agents.add(k));
+    Object.keys(s.metrics.by_domain || {}).forEach((k) => domains.add(k));
+  });
+  const sel = $("filter");
+  const prev = sel.value;
+  // escapeHtml on both the value attribute and the text: agents/domains are
+  // attacker-influenced column values (source_agent/domain), same risk as the
+  // composition renderer.
+  sel.innerHTML = '<option value="">(all)</option>' +
+    [...agents].map((a) => { const e = escapeHtml(a); return `<option value="agent:${e}">${e}</option>`; }).join("") +
+    [...domains].map((d) => { const e = escapeHtml(d); return `<option value="domain:${e}">${e}</option>`; }).join("");
+  if (prev) sel.value = prev;
+}
+
+document.addEventListener("DOMContentLoaded", () => {
+  // Seed the date picker to the digest date from the first load (today).
+  $("reload").addEventListener("click", load);
+  $("range").addEventListener("change", load);
+  $("split").addEventListener("change", () => renderGrowth(state.series, $("split").value, $("filter").value));
+  $("filter").addEventListener("change", () => renderGrowth(state.series, $("split").value, $("filter").value));
+  $("date").addEventListener("change", load);
+  document.querySelectorAll(".ctab").forEach((b) => {
+    b.addEventListener("click", () => {
+      compKey = b.dataset.k;
+      document.querySelectorAll(".ctab").forEach((x) => {
+        x.style.background = "var(--panel)";
+        x.style.color = "var(--text-dim)";
+        x.style.border = "1px solid var(--panel-border)";
+      });
+      b.style.background = "var(--accent)";
+      b.style.color = "#fff";
+      b.style.border = "none";
+      renderComposition(state.composition, compKey);
+    });
+  });
+  load();
+});
+</script>
+</body>
+</html>

package/dist/cli.js

@@ -69,6 +69,17 @@ switch (command) {
         else {
             const dryRun = args.includes("--dry-run");
             const captureOnly = args.includes("--capture-only");
+            const watchdog = args.includes("--watchdog");
+            // Timestamp every log line. The nightly writes to a file (launchd /
+            // systemd StandardOutput append) with NO per-line timestamp, which made
+            // diagnosing capture gaps impossible (the #239 investigation couldn't
+            // tell when a fire aborted). The daemon is unaffected — it logs to
+            // journald, which already timestamps. Scoped to this process only.
+            const origLog = console.log, origWarn = console.warn, origErr = console.error;
+            const ts = () => `[${new Date().toISOString()}]`;
+            console.log = (...a) => origLog(ts(), ...a);
+            console.warn = (...a) => origWarn(ts(), ...a);
+            console.error = (...a) => origErr(ts(), ...a);
             // #189 Tier-2 recovery: re-discover sessions that went quiet before the
             // upgrade by widening the discovery window to now−N days for one run.
             let recaptureWindowDays;
@@ -81,7 +92,7 @@ switch (command) {
                 }
             }
             import("./nightly.js").then(({ runNightly }) => {
-                runNightly({ dryRun, captureOnly, recaptureWindowDays }).catch((err) => {
+                runNightly({ dryRun, captureOnly, watchdog, recaptureWindowDays }).catch((err) => {
                     console.error("[hicortex] Nightly pipeline failed:", err);
                     process.exit(1);
                 });

package/dist/config-read.d.ts

@@ -29,3 +29,23 @@ export declare function readStrictBoolean(config: Record<string, unknown>, key:
  * value (e.g. ollamaFlushEvery).
  */
 export declare function readNonNegativeConfig(config: Record<string, unknown>, key: string, def: number): number;
+/**
+ * Read + validate an array of scheduling hours (integers 0–23, local time) for
+ * the capture/consolidation timers (0.17). Returns the validated, de-duped,
+ * ASC-sorted array; `null` when the key is absent (caller applies the role
+ * default) OR present-but-invalid (with a warn in the latter case).
+ *
+ * One invalid element rejects the WHOLE list (→ null → default) rather than
+ * silently dropping a slot: a `25` is a typo the user should notice, and a
+ * partial schedule like [9, 25→drop, 21] = [9, 21] would quietly change
+ * cadence. Matches the readPositiveConfig "reject invalid → default" boundary
+ * posture, and the parseConfigDomains leniency contract for the absent case.
+ */
+export declare function parseHours(config: Record<string, unknown> | null | undefined, key: string): number[] | null;
+/**
+ * Warn if the saved config carries keys that 0.16.8+ ignores. Call at every
+ * config read (daemon boot + nightly). The warning clears once the keys are
+ * removed and (for the model keys) the model is consolidated into
+ * llmModel/llmBaseUrl/llmProvider.
+ */
+export declare function warnIgnoredConfigKeys(savedConfig: Record<string, unknown> | null | undefined): void;

package/dist/config-read.js

@@ -16,6 +16,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.readPositiveConfig = readPositiveConfig;
 exports.readStrictBoolean = readStrictBoolean;
 exports.readNonNegativeConfig = readNonNegativeConfig;
+exports.parseHours = parseHours;
+exports.warnIgnoredConfigKeys = warnIgnoredConfigKeys;
 /**
  * Read a positive finite number from a config object. Returns `def` when the
  * key is absent OR present-but-invalid (with a warn in the latter case).
@@ -58,3 +60,85 @@ function readNonNegativeConfig(config, key, def) {
     console.warn(`[hicortex] config "${key}" = ${String(v)} is not a non-negative finite number — using default ${def}.`);
     return def;
 }
+/**
+ * Read + validate an array of scheduling hours (integers 0–23, local time) for
+ * the capture/consolidation timers (0.17). Returns the validated, de-duped,
+ * ASC-sorted array; `null` when the key is absent (caller applies the role
+ * default) OR present-but-invalid (with a warn in the latter case).
+ *
+ * One invalid element rejects the WHOLE list (→ null → default) rather than
+ * silently dropping a slot: a `25` is a typo the user should notice, and a
+ * partial schedule like [9, 25→drop, 21] = [9, 21] would quietly change
+ * cadence. Matches the readPositiveConfig "reject invalid → default" boundary
+ * posture, and the parseConfigDomains leniency contract for the absent case.
+ */
+function parseHours(config, key) {
+    if (!config)
+        return null;
+    const v = config[key];
+    if (v === undefined)
+        return null;
+    if (!Array.isArray(v)) {
+        console.warn(`[hicortex] config "${key}" is not an array — ignored.`);
+        return null;
+    }
+    const seen = new Set();
+    const out = [];
+    for (const el of v) {
+        if (typeof el !== "number" || !Number.isInteger(el) || el < 0 || el > 23) {
+            console.warn(`[hicortex] config "${key}" has an invalid hour (${String(el)}; must be an integer 0–23) — ignoring the list, using the default.`);
+            return null;
+        }
+        if (!seen.has(el)) {
+            seen.add(el);
+            out.push(el);
+        }
+    }
+    return out.length > 0 ? out.sort((a, b) => a - b) : null;
+}
+/**
+ * Config keys that ≤0.16.7 accepted and 0.16.8+ IGNORES. Two groups:
+ *  - per-stage model keys + the nested `models` block (#231): one model now
+ *    serves all phases, so distillation/reflection/classification silently run
+ *    on `llmModel` — a quality downgrade if a larger model was on a distill/
+ *    reflect tier.
+ *  - `distillFallback` (#232): removed; strict mode is default. A `"local"`
+ *    value no longer falls back — failures retry next run.
+ * Both were public (documented in the README config table). Warn loudly at the
+ * config boundary so neither change is silent.
+ *
+ * NOTE: this list is deliberately WIDER than the `HicortexConfig` type. In
+ * ≤0.16.7 most of these keys (the flat `distill*`/`reflect*` set and
+ * `distillFallback`) were NEVER declared in the interface — they were
+ * accepted-but-untyped, read loosely off the config object, with the README
+ * config table as their only public contract. So deriving this list from the
+ * type would miss them. The list is the README's documented keys; don't trim it
+ * to match the interface (a future audit that did so would silently re-introduce
+ * the ignored-key gap this warning exists to close).
+ */
+const IGNORED_CONFIG_KEYS = [
+    "distillModel", "distillBaseUrl", "distillApiKey", "distillProvider",
+    "reflectModel", "reflectBaseUrl", "reflectApiKey", "reflectProvider",
+    "classifyModel", "classifyBaseUrl", "classifyApiKey", "classifyProvider",
+    "distillFallback",
+];
+/**
+ * Warn if the saved config carries keys that 0.16.8+ ignores. Call at every
+ * config read (daemon boot + nightly). The warning clears once the keys are
+ * removed and (for the model keys) the model is consolidated into
+ * llmModel/llmBaseUrl/llmProvider.
+ */
+function warnIgnoredConfigKeys(savedConfig) {
+    if (!savedConfig)
+        return;
+    const present = IGNORED_CONFIG_KEYS.filter((k) => savedConfig[k] !== undefined);
+    const hasModelsBlock = savedConfig.models !== undefined;
+    if (present.length === 0 && !hasModelsBlock)
+        return;
+    const detail = [...present, ...(hasModelsBlock ? ["models"] : [])].join(", ");
+    console.warn(`[hicortex] config has keys IGNORED since 0.16.8 (${detail}). They have no effect now. ` +
+        `Per-stage model keys / the \`models\` block: one model serves all phases — set ` +
+        `llmModel/llmBaseUrl/llmProvider (+ llmApiKey) to your intended model. ` +
+        `distillFallback: removed (strict mode is default — a failed distill retries next run). ` +
+        `Remove these keys to clear this warning. See the 0.16.8 changelog.`);
+}