@gamaze/hicortex 0.16.9 → 0.17.0

package/dist/db.js

@@ -464,6 +464,30 @@ const MIGRATIONS = [
             }
         },
     },
+    {
+        version: 12,
+        name: "add_dashboard_snapshots",
+        up: (db) => {
+            // #224 memory analytics dashboard. One row per FULL nightly run (never
+            // capture-only — the snapshot reflects corpus state, so it is written
+            // from the same !dryRun && !captureOnly block that runs consolidation).
+            // `run_at` is the ISO timestamp of the run (PRIMARY KEY so a re-run for
+            // the same instant is idempotent — the nightly never retries within one
+            // process, and a manual re-run uses a fresh `now`). `metrics` is a JSON
+            // blob (not typed columns): the metric set is meant to evolve without a
+            // migration (add a key, ship), so the schema stays one column. The
+            // backfill (dashboard.ts:backfillSnapshots) also writes here, one row
+            // per derived day. Adoption fields are point-in-time and can't be
+            // reconstructed from created_at — backfilled rows leave them null.
+            // IF NOT EXISTS keeps it idempotent across partial migrations.
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS dashboard_snapshots (
+          run_at TEXT PRIMARY KEY,
+          metrics TEXT NOT NULL
+        )
+      `);
+        },
+    },
 ];
 /**
  * Run all pending migrations against the database.

package/dist/hermes-transcript-reader.d.ts

@@ -14,15 +14,24 @@
  * readable here nightly. No runtime plugin capture is needed; the Hermes plugin
  * is recall-only.
  *
- * We process only ENDED sessions (ended_at set) that ended since the last run.
- * A live session is distilled after it ends — this avoids partial-session
- * distillation and keeps per-session dedup clean (chunks are stored as
- * `<sessionId>#<chunkIndex>`; see nightly.ts).
+ * We process ENDED sessions (ended_at set) that ended since the last run PLUS
+ * OPEN sessions (ended_at NULL) that have messages — a Discord conversation is
+ * one long-lived thread that stays open and accrues content, so gating only on
+ * ended_at would drop the whole interactive corpus (#240). Open sessions are
+ * delta-sliced by the per-session cursor; per-session dedup stays clean
+ * (chunks are stored as `<sessionId>#<chunkIndex>`; see nightly.ts).
  */
 import type { TranscriptBatch, CursorMap } from "./transcript-reader.js";
 /**
- * Read Hermes sessions that ended since `since`, across all profiles.
- * Returns one batch per session, parallel to readCcTranscripts().
+ * Read Hermes sessions across all profiles: ended sessions newer than `since`
+ * (the bulk watermark) PLUS open sessions (`ended_at IS NULL`) that have any
+ * message. Returns one batch per session, parallel to readCcTranscripts().
+ *
+ * Why open sessions are included (#240): in Hermes' Discord model a
+ * conversation is one long-lived thread = one session that stays open for
+ * days/weeks and accumulates the interactive content. The per-session cursor
+ * slices each such thread to its unseen delta across runs (same discover-
+ * broadly / delta-narrowly model as CC readers).
  *
  * @param cursors Per-session capture cursors (#189), keyed `hermes:<profile>:<sid>`.
  *   The cursor value is the max `messages.id` already captured; a resumed +

package/dist/hermes-transcript-reader.js

@@ -15,10 +15,12 @@
  * readable here nightly. No runtime plugin capture is needed; the Hermes plugin
  * is recall-only.
  *
- * We process only ENDED sessions (ended_at set) that ended since the last run.
- * A live session is distilled after it ends — this avoids partial-session
- * distillation and keeps per-session dedup clean (chunks are stored as
- * `<sessionId>#<chunkIndex>`; see nightly.ts).
+ * We process ENDED sessions (ended_at set) that ended since the last run PLUS
+ * OPEN sessions (ended_at NULL) that have messages — a Discord conversation is
+ * one long-lived thread that stays open and accrues content, so gating only on
+ * ended_at would drop the whole interactive corpus (#240). Open sessions are
+ * delta-sliced by the per-session cursor; per-session dedup stays clean
+ * (chunks are stored as `<sessionId>#<chunkIndex>`; see nightly.ts).
  */
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
@@ -45,8 +47,15 @@ const NON_PRIMARY_SOURCES = new Set(["cron"]);
  */
 const NOISE_ROLES = new Set(["tool", "session_meta"]);
 /**
- * Read Hermes sessions that ended since `since`, across all profiles.
- * Returns one batch per session, parallel to readCcTranscripts().
+ * Read Hermes sessions across all profiles: ended sessions newer than `since`
+ * (the bulk watermark) PLUS open sessions (`ended_at IS NULL`) that have any
+ * message. Returns one batch per session, parallel to readCcTranscripts().
+ *
+ * Why open sessions are included (#240): in Hermes' Discord model a
+ * conversation is one long-lived thread = one session that stays open for
+ * days/weeks and accumulates the interactive content. The per-session cursor
+ * slices each such thread to its unseen delta across runs (same discover-
+ * broadly / delta-narrowly model as CC readers).
  *
  * @param cursors Per-session capture cursors (#189), keyed `hermes:<profile>:<sid>`.
  *   The cursor value is the max `messages.id` already captured; a resumed +
@@ -64,8 +73,24 @@ function readHermesSessions(since, hermesHome = HERMES_HOME, cursors = {}) {
             continue; // locked / unreadable / wrong owner — skip, retry next run
         }
         try {
+            // Discovery (#240): ended sessions past the watermark (bulk) PLUS open
+            // sessions (ended_at IS NULL) that have any message. In Hermes' Discord
+            // model a conversation is ONE long-lived thread = one session that stays
+            // open for days/weeks and accumulates essentially all the interactive
+            // content. Gating discovery only on `ended_at IS NOT NULL` meant those
+            // open threads were NEVER discovered → distilled — the entire interactive
+            // corpus was silently dropped. The per-session cursor below slices each
+            // open session to its unseen delta across runs (same model as CC: discover
+            // broadly, delta narrowly), and `rows.length === 0` skips an open session
+            // that is already current. The EXISTS probe is one cheap check per open
+            // session (typically one open thread per agent).
             const sessions = db
-                .prepare("SELECT id, ended_at, source FROM sessions WHERE ended_at IS NOT NULL AND ended_at > ? ORDER BY ended_at")
+                .prepare(`SELECT id, ended_at, source FROM sessions
+            WHERE (ended_at IS NOT NULL AND ended_at > ?)
+               OR (ended_at IS NULL AND EXISTS (
+                     SELECT 1 FROM messages WHERE messages.session_id = sessions.id
+                   ))
+            ORDER BY (ended_at IS NULL), ended_at`)
                 .all(sinceEpoch);
             // Cursor is a message id (INTEGER PRIMARY KEY AUTOINCREMENT — strictly
             // increasing, never reused), so `id > ?` returns exactly the rows added

package/dist/init.d.ts

@@ -295,9 +295,31 @@ export declare function runInit(options?: {
     repairConfig?: boolean;
 }): Promise<void>;
 /**
- * Resolve the nightly hour (0–23, local time) for the generated schedule.
- * Priority: `nightlyHour` in ~/.hicortex/config.json → mode default.
- * Defaults: client 02:00, server 03:00 — staggered so that in mixed fleets
- * clients push their sessions before the server's capture + consolidation run.
+ * Resolve the CONSOLIDATION hours (the only slot-based timer in 0.17). The
+ * CAPTURE mechanism is the watchdog (an interval timer, not slots) — uniform
+ * across client + server/co-located — so this function no longer returns a
+ * capture schedule. Returns null in client mode (no local DB → no
+ * consolidation timer).
+ *
+ * Priority: `consolidationHours` array → legacy `nightlyHour` (single int, only
+ * when the array key is absent → one consolidation slot at H, preserving the
+ * pre-0.17 "one daily job" intent) → role default ([10, 22] server / null client).
+ */
+export declare function resolveConsolidationHours(mode: "server" | "client", configDir?: string): number[] | null;
+/**
+ * Legacy single-hour resolver (pre-0.17). Kept for backward compat + the
+ * existing tests; new scheduling goes through `resolveConsolidationHours`.
  */
 export declare function resolveNightlyHour(mode: "server" | "client", configDir?: string): number;
+/**
+ * One `OnCalendar=*-*-* HH:00:00` line per hour, newline-joined — systemd fires
+ * a timer at EACH OnCalendar entry (multi-slot in a single timer). Hours are
+ * sorted so the generated file is stable/diffable. Exported for testing.
+ */
+export declare function formatOnCalendarLines(hours: number[]): string;
+/**
+ * The launchd `StartCalendarInterval` ARRAY body — one `<dict>` per hour.
+ * launchd fires the job at each dict; a single dict is the 1-slot special case
+ * but the array form is uniform across 1..N. Exported for testing.
+ */
+export declare function formatLaunchdIntervals(hours: number[]): string;

package/dist/init.js

@@ -36,7 +36,10 @@ exports.isEphemeralNpxPath = isEphemeralNpxPath;
 exports.installSessionStartHook = installSessionStartHook;
 exports.installRecallHooks = installRecallHooks;
 exports.runInit = runInit;
+exports.resolveConsolidationHours = resolveConsolidationHours;
 exports.resolveNightlyHour = resolveNightlyHour;
+exports.formatOnCalendarLines = formatOnCalendarLines;
+exports.formatLaunchdIntervals = formatLaunchdIntervals;
 const paths_js_1 = require("./paths.js");
 const telemetry_js_1 = require("./telemetry.js");
 const node_fs_1 = require("node:fs");
@@ -46,6 +49,7 @@ const node_child_process_1 = require("node:child_process");
 const node_readline_1 = require("node:readline");
 const node_crypto_1 = require("node:crypto");
 const claude_md_js_1 = require("./claude-md.js");
+const config_read_js_1 = require("./config-read.js");
 const context_store_js_1 = require("./context-store.js");
 const HICORTEX_HOME = (0, paths_js_1.hicortexHome)();
 /** This package's version, for the install lifecycle ping (0.15.2). */
@@ -1452,10 +1456,13 @@ async function runInit(options = {}) {
             console.log(`  ✓ Agent name set to '${decision.value}'`);
         }
     }
-    // Install the nightly job (capture via localhost /distill + consolidation).
-    // Without it a server-mode install never captures or consolidates — the
-    // daemon only serves recall + /distill. Skips if a schedule already exists.
-    installNightlyCron(resolveNightlyHour("server"));
+    // Install the scheduling timers (0.17): a CAPTURE WATCHDOG (short-interval
+    // poll, success-cooldown-throttled — uniform with clients) + a CONSOLIDATION
+    // timer (the full nightly, fixed slots). Re-init rewrites both; customize the
+    // consolidation slots via consolidationHours in config.json (capture cadence
+    // via captureCooldownHours).
+    installCaptureWatchdogTimer();
+    installConsolidationTimer(resolveConsolidationHours("server") ?? DEFAULT_CONSOLIDATION_HOURS);
     // Install daemon if needed
     if (!d.localServer && !d.remoteServer) {
         installDaemon();
@@ -1657,8 +1664,12 @@ async function runClientInit(serverUrl, agentName) {
     if ((0, claude_md_js_1.removeLessonsBlock)(claudeMdPath)) {
         console.log(`  ✓ Removed old static lessons block from CLAUDE.md — lessons now injected at session start`);
     }
-    // Step 7: Install nightly cron (denoise locally, POST to server /distill)
-    installNightlyCron(resolveNightlyHour("client"));
+    // Step 7: Install the CAPTURE WATCHDOG (denoise locally, POST to server
+    // /distill, throttled + preflight-gated) — the same capture mechanism every
+    // install gets. Clients have no local DB → no consolidation timer; also
+    // remove any legacy full-nightly timer a pre-0.17 install left behind.
+    installCaptureWatchdogTimer();
+    removeConsolidationTimer();
     // Step 8: Setup Hermes if detected
     if ((0, node_fs_1.existsSync)(HERMES_HOME)) {
         console.log("\nHermes detected — installing plugin...");
@@ -1686,59 +1697,164 @@ async function runClientInit(serverUrl, agentName) {
     console.log("Restart your agents to activate.");
 }
 /**
- * Resolve the nightly hour (0–23, local time) for the generated schedule.
- * Priority: `nightlyHour` in ~/.hicortex/config.json → mode default.
- * Defaults: client 02:00, server 03:00 — staggered so that in mixed fleets
- * clients push their sessions before the server's capture + consolidation run.
+ * Scheduling (0.17): one UNIFORM capture mechanism + one role-specific
+ * consolidation timer, replacing the old single daily full-nightly.
+ *
+ *   - CAPTURE WATCHDOG (`hicortex-capture`): a short-interval timer fires
+ *     `nightly --capture-only --watchdog`. The watchdog throttles by a
+ *     success-cooldown (`captureCooldownHours`, default 6 ≈ 4 captures/day) and
+ *     preflights before capturing, so a transient fire-instant network miss
+ *     retries in minutes, not at the next daily slot (#239: a once-daily client
+ *     fire that caught a slow/flaky link lost ~24h of capture). Installed
+ *     UNIFORMLY for client AND server/co-located — one capture code path, no
+ *     per-topology branch. A failed preflight retries on the next tick; a
+ *     successful capture waits the cooldown (success-based cooldown — the
+ *     better semantics; the custom server watchdog used trigger-based).
+ *   - CONSOLIDATION timer (`hicortex-nightly`): full `nightly` (capture +
+ *     distill + score + reflect + link). Server/co-located ONLY — clients have
+ *     no local DB, so no consolidation timer is installed (and a legacy one
+ *     left by a pre-0.17 install is removed). Fixed slots (default [10, 22]).
+ *
+ * Customize: `consolidationHours` (the consolidation slots) and
+ * `captureCooldownHours` (the watchdog throttle) in config.json. Re-init
+ * rewrites the timers to the resolved standard (the pre-0.17 "never overwrite"
+ * contract is intentionally relaxed so the fleet adopts the standard). The
+ * legacy single `nightlyHour` is honoured as a one-slot consolidation fallback
+ * only when `consolidationHours` is absent (preserves "one daily job at H").
+ */
+const DEFAULT_CONSOLIDATION_HOURS = [10, 22];
+/**
+ * Capture-watchdog poll interval (minutes). The capture timer fires
+ * `nightly --capture-only --watchdog` this often; the watchdog itself throttles
+ * by the success-cooldown (`captureCooldownHours`, read at runtime). Short so a
+ * transient fire-instant network miss retries in minutes, not at the next daily
+ * slot (#239). Cheap: a tick against a down server is one 5s preflight.
+ */
+const CAPTURE_WATCHDOG_INTERVAL_MIN = 20;
+/**
+ * Resolve the CONSOLIDATION hours (the only slot-based timer in 0.17). The
+ * CAPTURE mechanism is the watchdog (an interval timer, not slots) — uniform
+ * across client + server/co-located — so this function no longer returns a
+ * capture schedule. Returns null in client mode (no local DB → no
+ * consolidation timer).
+ *
+ * Priority: `consolidationHours` array → legacy `nightlyHour` (single int, only
+ * when the array key is absent → one consolidation slot at H, preserving the
+ * pre-0.17 "one daily job" intent) → role default ([10, 22] server / null client).
+ */
+function resolveConsolidationHours(mode, configDir = HICORTEX_HOME) {
+    let config = {};
+    try {
+        config = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(configDir, "config.json"), "utf-8"));
+    }
+    catch { /* no config yet — use the standard default */ }
+    if (mode === "client")
+        return null; // clients have no local DB → no consolidation timer
+    const arr = (0, config_read_js_1.parseHours)(config, "consolidationHours");
+    if (arr)
+        return arr;
+    const legacy = readLegacyNightlyHour(config);
+    if (legacy !== null)
+        return [legacy];
+    return DEFAULT_CONSOLIDATION_HOURS;
+}
+/** Read the legacy `nightlyHour` (single int 0–23) if validly set, else null. */
+function readLegacyNightlyHour(config) {
+    const h = config.nightlyHour;
+    if (typeof h === "number" && Number.isInteger(h) && h >= 0 && h <= 23)
+        return h;
+    return null;
+}
+/**
+ * Legacy single-hour resolver (pre-0.17). Kept for backward compat + the
+ * existing tests; new scheduling goes through `resolveConsolidationHours`.
  */
 function resolveNightlyHour(mode, configDir = HICORTEX_HOME) {
     try {
         const config = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(configDir, "config.json"), "utf-8"));
-        const h = config.nightlyHour;
-        if (typeof h === "number" && Number.isInteger(h) && h >= 0 && h <= 23)
-            return h;
+        const legacy = readLegacyNightlyHour(config);
+        if (legacy !== null)
+            return legacy;
     }
     catch { /* no config yet — use the default */ }
     return mode === "server" ? 3 : 2;
 }
-function installNightlyCron(hour) {
+/**
+ * One `OnCalendar=*-*-* HH:00:00` line per hour, newline-joined — systemd fires
+ * a timer at EACH OnCalendar entry (multi-slot in a single timer). Hours are
+ * sorted so the generated file is stable/diffable. Exported for testing.
+ */
+function formatOnCalendarLines(hours) {
+    return [...hours]
+        .sort((a, b) => a - b)
+        .map((h) => `OnCalendar=*-*-* ${String(h).padStart(2, "0")}:00:00`)
+        .join("\n");
+}
+/**
+ * The launchd `StartCalendarInterval` ARRAY body — one `<dict>` per hour.
+ * launchd fires the job at each dict; a single dict is the 1-slot special case
+ * but the array form is uniform across 1..N. Exported for testing.
+ */
+function formatLaunchdIntervals(hours) {
+    return [...hours]
+        .sort((a, b) => a - b)
+        .map((h) => `    <dict>
+      <key>Hour</key>
+      <integer>${h}</integer>
+      <key>Minute</key>
+      <integer>0</integer>
+    </dict>`)
+        .join("\n");
+}
+/**
+ * Write + enable one schedule unit (timer + service on Linux, plist on macOS),
+ * multi-slot. Shared by the capture and consolidation installers. Always
+ * rewrites both files (the 0.17 migration decision: re-init brings an install
+ * up to the resolved standard; customization is via config keys, not hand-
+ * edited unit files). Logs the resolved slots.
+ */
+function writeScheduleUnit(opts) {
     const binaryArgs = resolveBinaryArgs();
     const os = (0, node_os_1.platform)();
-    const hh = String(hour).padStart(2, "0");
     // PATH must start with the binary's own directory (see installLaunchd for rationale).
     const binDir = (0, node_path_1.dirname)(binaryArgs[0]);
     // One canonical nightly log path across platforms — status output, docs,
     // and support instructions all reference this single location.
     const logPath = (0, node_path_1.join)(HICORTEX_HOME, "nightly.log");
+    const isInterval = typeof opts.intervalSec === "number";
+    if (!isInterval && (!opts.hours || opts.hours.length === 0)) {
+        throw new Error("writeScheduleUnit: provide either hours or intervalSec");
+    }
+    // Human-readable schedule label for the log line.
+    const slotLabel = isInterval
+        ? `every ${Math.round(opts.intervalSec / 60)} min`
+        : [...opts.hours].sort((a, b) => a - b).map((h) => `${String(h).padStart(2, "0")}:00`).join(", ");
     if (os === "darwin") {
         const plistDir = (0, node_path_1.join)((0, node_os_1.homedir)(), "Library", "LaunchAgents");
-        const plistPath = (0, node_path_1.join)(plistDir, "com.gamaze.hicortex-nightly.plist");
-        // Never overwrite an existing schedule — users tune these (multi-slot
-        // capture windows, quiet hours). Fresh installs only.
-        if ((0, node_fs_1.existsSync)(plistPath)) {
-            console.log(`  ✓ Nightly cron already installed — leaving existing schedule as-is`);
-            return;
-        }
-        const programArgs = [...binaryArgs, "nightly"]
+        const plistPath = (0, node_path_1.join)(plistDir, `${opts.plistLabel}.plist`);
+        const programArgs = [...binaryArgs, ...opts.nightlyArgs]
             .map((a) => `    <string>${a}</string>`)
             .join("\n");
+        // Schedule block: StartInterval (seconds) for the watchdog poll, or
+        // StartCalendarInterval as an ARRAY of dicts (one per hour) for slots.
+        // RunAtLoad ONLY on the interval (watchdog) plist — so a Mac that reboots
+        // gets a first capture tick on load (~parity with systemd's OnBootSec=2min),
+        // not 20 min later. The cooldown gate makes a load-time fire a cheap no-op
+        // if a capture ran recently.
+        const scheduleBlock = isInterval
+            ? `  <key>StartInterval</key>\n  <integer>${opts.intervalSec}</integer>\n  <key>RunAtLoad</key>\n  <true/>`
+            : `  <key>StartCalendarInterval</key>\n  <array>\n${formatLaunchdIntervals(opts.hours)}\n  </array>`;
         const plist = `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
   <key>Label</key>
-  <string>com.gamaze.hicortex-nightly</string>
+  <string>${opts.plistLabel}</string>
   <key>ProgramArguments</key>
   <array>
 ${programArgs}
   </array>
-  <key>StartCalendarInterval</key>
-  <dict>
-    <key>Hour</key>
-    <integer>${hour}</integer>
-    <key>Minute</key>
-    <integer>0</integer>
-  </dict>
+${scheduleBlock}
   <key>StandardOutPath</key>
   <string>${logPath}</string>
   <key>StandardErrorPath</key>
@@ -1756,63 +1872,146 @@ ${programArgs}
             try {
                 (0, node_child_process_1.execSync)(`launchctl unload ${plistPath} 2>/dev/null`, { stdio: "pipe" });
             }
-            catch { }
+            catch { /* not loaded */ }
             (0, node_child_process_1.execSync)(`launchctl load ${plistPath}`, { stdio: "pipe" });
-            console.log(`  ✓ Installed nightly cron (runs daily at ${hh}:00)`);
+            console.log(`  ✓ Installed ${opts.timerDesc} (${slotLabel})`);
         }
         catch {
-            console.log(`  ⚠ Could not load nightly plist. Load manually: launchctl load ${plistPath}`);
+            console.log(`  ⚠ Could not load plist. Load manually: launchctl load ${plistPath}`);
         }
     }
     else if (os === "linux") {
         const configDir = (0, node_path_1.join)((0, node_os_1.homedir)(), ".config", "systemd", "user");
-        const servicePath = (0, node_path_1.join)(configDir, "hicortex-nightly.service");
-        const timerPath = (0, node_path_1.join)(configDir, "hicortex-nightly.timer");
-        const execStart = [...binaryArgs, "nightly"].join(" ");
+        const servicePath = (0, node_path_1.join)(configDir, `${opts.unitBase}.service`);
+        const timerPath = (0, node_path_1.join)(configDir, `${opts.unitBase}.timer`);
+        const execStart = [...binaryArgs, ...opts.nightlyArgs].join(" ");
         // File logging, not journal: oneshot runs on machines with a volatile
         // journal (e.g. Raspberry Pi defaults) otherwise fail without a trace.
         // Same log path as the macOS plist. append: needs systemd ≥ 240 (2018).
         const service = `[Unit]
-Description=Hicortex Nightly (distill + POST)
+Description=${opts.serviceDesc}
 
 [Service]
 Type=oneshot
 ExecStart=${execStart}
-StandardOutput=append:${logPath}
+${opts.timeoutMin ? `TimeoutStartSec=${opts.timeoutMin}min\n` : ""}StandardOutput=append:${logPath}
 StandardError=append:${logPath}
 Environment=PATH=${binDir}:/usr/local/bin:/usr/bin:/bin
 Environment=HOME=${(0, node_os_1.homedir)()}
 WorkingDirectory=${(0, node_os_1.homedir)()}`;
+        // Timer body: OnUnitActiveSec (interval, watchdog) or one OnCalendar line
+        // per hour (multi-slot). systemd ORs multiple OnCalendar entries.
+        const timerBody = isInterval
+            ? `OnBootSec=2min\nOnUnitActiveSec=${Math.round(opts.intervalSec / 60)}min`
+            : formatOnCalendarLines(opts.hours);
         const timer = `[Unit]
-Description=Hicortex Nightly Timer
+Description=${opts.timerDesc}
 
 [Timer]
-OnCalendar=*-*-* ${hh}:00:00
+${timerBody}
 Persistent=true
 
 [Install]
 WantedBy=timers.target`;
         (0, node_fs_1.mkdirSync)(configDir, { recursive: true });
-        // The .service file is ours — always refresh it so fixes (like file
-        // logging) reach existing installs. The .timer holds the user-tuned
-        // schedule and is never overwritten.
+        // Always rewrite both .service and .timer (0.17 migration: re-init adopts
+        // the resolved standard schedule; the config keys are the tuning surface).
         (0, node_fs_1.writeFileSync)(servicePath, service);
-        if ((0, node_fs_1.existsSync)(timerPath)) {
-            try {
-                (0, node_child_process_1.execSync)("systemctl --user daemon-reload", { stdio: "pipe" });
-            }
-            catch { /* fine */ }
-            console.log(`  ✓ Nightly service refreshed — existing timer schedule kept as-is`);
-            return;
-        }
         (0, node_fs_1.writeFileSync)(timerPath, timer);
         try {
             (0, node_child_process_1.execSync)("systemctl --user daemon-reload", { stdio: "pipe" });
-            (0, node_child_process_1.execSync)("systemctl --user enable --now hicortex-nightly.timer", { stdio: "pipe" });
-            console.log(`  ✓ Installed nightly timer (runs daily at ${hh}:00)`);
+            (0, node_child_process_1.execSync)(`systemctl --user enable --now ${opts.unitBase}.timer`, { stdio: "pipe" });
+            console.log(`  ✓ Installed ${opts.unitBase}.timer (${slotLabel})`);
         }
         catch {
-            console.log(`  ⚠ Could not enable nightly timer. Enable manually: systemctl --user enable --now hicortex-nightly.timer`);
+            console.log(`  ⚠ Could not enable ${opts.unitBase}.timer. Enable manually: ` +
+                `systemctl --user enable --now ${opts.unitBase}.timer`);
+        }
+    }
+}
+/**
+ * Install the CAPTURE WATCHDOG timer — a short-interval poll that fires
+ * `nightly --capture-only --watchdog`. The watchdog itself throttles by the
+ * success-cooldown (`captureCooldownHours`) and preflights, so a transient
+ * fire-instant network miss retries in minutes, not at the next daily slot
+ * (#239). Installed UNIFORMLY for client + server/co-located (one capture
+ * mechanism everywhere — no per-topology branch).
+ */
+function installCaptureWatchdogTimer() {
+    writeScheduleUnit({
+        unitBase: "hicortex-capture",
+        plistLabel: "com.gamaze.hicortex-capture",
+        serviceDesc: "Hicortex Capture Watchdog (denoise + POST /distill, throttled)",
+        timerDesc: "Hicortex Capture Watchdog",
+        nightlyArgs: ["nightly", "--capture-only", "--watchdog"],
+        intervalSec: CAPTURE_WATCHDOG_INTERVAL_MIN * 60,
+        timeoutMin: 30, // backstop only — capture is no-LLM, bounded; 30min catches a stuck POST
+    });
+}
+/**
+ * Install the CONSOLIDATION timer (full `nightly`). Reuses the existing
+ * `hicortex-nightly` unit name (repurposed from the pre-0.17 single full-nightly).
+ */
+function installConsolidationTimer(hours) {
+    writeScheduleUnit({
+        unitBase: "hicortex-nightly",
+        plistLabel: "com.gamaze.hicortex-nightly",
+        serviceDesc: "Hicortex Nightly (capture + consolidate)",
+        timerDesc: "Hicortex Consolidation Timer",
+        nightlyArgs: ["nightly"],
+        hours,
+        // Backstop only (NOT an operating limit) — set well above the longest
+        // legitimate run so it catches a true hang, never a slow-but-progressing
+        // one. ~5000 LLM calls × ~1–3s/call ≈ 1.4–4.2h → 6h clears it with margin.
+        // Coupled to the consolidateMaxLlmCalls budget (#241): raise together.
+        timeoutMin: 360,
+    });
+}
+/**
+ * Remove the consolidation timer + service (and the macOS plist). Used on
+ * CLIENT installs: clients have no local DB, so a pre-0.17 `hicortex-nightly`
+ * timer (which auto-capture-onlys on clients) is redundant with the new capture
+ * timer — remove it so it doesn't double-fire.
+ */
+function removeConsolidationTimer() {
+    const os = (0, node_os_1.platform)();
+    if (os === "darwin") {
+        const plistPath = (0, node_path_1.join)((0, node_os_1.homedir)(), "Library", "LaunchAgents", "com.gamaze.hicortex-nightly.plist");
+        if ((0, node_fs_1.existsSync)(plistPath)) {
+            try {
+                (0, node_child_process_1.execSync)(`launchctl unload ${plistPath} 2>/dev/null`, { stdio: "pipe" });
+            }
+            catch { /* not loaded */ }
+            try {
+                (0, node_fs_1.rmSync)(plistPath);
+                console.log("  ✓ Removed legacy nightly timer (client mode — capture-only)");
+            }
+            catch { /* leave it */ }
+        }
+    }
+    else if (os === "linux") {
+        try {
+            (0, node_child_process_1.execSync)("systemctl --user disable --now hicortex-nightly.timer 2>/dev/null", { stdio: "pipe" });
+        }
+        catch { /* not installed */ }
+        const unitDir = (0, node_path_1.join)((0, node_os_1.homedir)(), ".config", "systemd", "user");
+        let removed = false;
+        for (const name of ["hicortex-nightly.timer", "hicortex-nightly.service"]) {
+            const p = (0, node_path_1.join)(unitDir, name);
+            if ((0, node_fs_1.existsSync)(p)) {
+                try {
+                    (0, node_fs_1.rmSync)(p);
+                    removed = true;
+                }
+                catch { /* leave it */ }
+            }
+        }
+        if (removed) {
+            try {
+                (0, node_child_process_1.execSync)("systemctl --user daemon-reload 2>/dev/null", { stdio: "pipe" });
+            }
+            catch { /* fine */ }
+            console.log("  ✓ Removed legacy nightly timer (client mode — capture-only)");
         }
     }
 }

package/dist/mcp-server.js

@@ -57,11 +57,13 @@ const zod_1 = require("zod");
 const db_js_1 = require("./db.js");
 const llm_js_1 = require("./llm.js");
 const features_js_1 = require("./features.js");
+const config_read_js_1 = require("./config-read.js");
 const state_js_1 = require("./state.js");
 const embedder_js_1 = require("./embedder.js");
 const storage = __importStar(require("./storage.js"));
 const graph_js_1 = require("./graph.js");
 const viz_js_1 = require("./viz.js");
+const dashboard_js_1 = require("./dashboard.js");
 const context_store_js_1 = require("./context-store.js");
 const retrieval = __importStar(require("./retrieval.js"));
 const recall_registry_js_1 = require("./recall-registry.js");
@@ -373,6 +375,9 @@ async function startServer(options = {}) {
     // If nothing is configured: start recall-only with an unmissable warning.
     // One model serves all phases (#231) — no per-tier overlay here.
     const savedConfig = readConfigFile(stateDir);
+    // 0.16.8 upgrade guard: per-stage keys are silently ignored now. Warn loudly
+    // so a carried-over distill/reflect model doesn't silently downgrade quality.
+    (0, config_read_js_1.warnIgnoredConfigKeys)(savedConfig);
     // 0.16.2 activation gap: self-heal the agentId provenance field for
     // pre-0.16.2 server installs on first boot after upgrade. The server's own
     // nightly captures its sessions to localhost:8787/distill and needs this id;
@@ -1172,6 +1177,22 @@ async function startServer(options = {}) {
     // bypass). The page collects the token client-side: ?token= URL param
     // (stripped on load) or an in-page prompt on 401, persisted in localStorage.
     app.get("/context/ui", (0, viz_js_1.contextUiHandler)());
+    // GET /dashboard — view-only memory analytics page (#224).
+    //
+    // Self-contained HTML (inline CSS/JS, hand-rolled inline SVG charts, zero
+    // external requests) served from assets/dashboard.html. Fetches
+    // /dashboard/data from its own origin. The page SHELL is public (exempted
+    // in createAuthMiddleware, like /viz and /context/ui — it carries no data);
+    // the /dashboard/data fetch is bearer-only (localhost bypass). The page
+    // collects the token client-side: ?token= URL param (stripped on load) or an
+    // in-page prompt on 401, persisted in localStorage.
+    app.get("/dashboard", (0, viz_js_1.dashboardHandler)());
+    // GET /dashboard/data — the metric payload (series, composition, digest).
+    // Bearer-only (the auth middleware is installed at app boot); no separate
+    // exemption. The handler lives in src/dashboard.ts (pure); this is the thin
+    // express adapter that injects the live db + config. STRICTLY view-only —
+    // no mutation endpoints on the dashboard surface.
+    app.get("/dashboard/data", (0, dashboard_js_1.dashboardDataHandler)(() => db, () => readConfigFile(stateDir)));
     // SSE endpoint — each connection gets its own McpServer + transport
     app.get("/sse", async (req, res) => {
         const transport = new sse_js_1.SSEServerTransport("/messages", res);

package/dist/nightly.d.ts

@@ -17,4 +17,12 @@ export declare function runNightly(options?: {
     stateDir?: string;
     /** #189 Tier-2 recovery: override discovery to now−N days for one run. */
     recaptureWindowDays?: number;
+    /**
+     * Watchdog mode (0.17, #239): the capture timer fires `nightly --watchdog`
+     * on a short interval so a transient fire-instant network miss retries in
+     * minutes, not at the next daily slot. The gate throttles (success-cooldown)
+     * and preflights BEFORE capture; the watchdog never consolidates (it forces
+     * capture-only). Uniform across client + server/co-located.
+     */
+    watchdog?: boolean;
 }): Promise<void>;