@gamaze/hicortex 0.20.7 → 0.20.10

package/dist/mcp-server.js

@@ -51,6 +51,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveDistillProbeGate = resolveDistillProbeGate;
 exports.createMcpServer = createMcpServer;
 exports.resolveBodyLimitMb = resolveBodyLimitMb;
+exports.resolveSearchSimilarityFloor = resolveSearchSimilarityFloor;
 exports.makeBodyLimitErrorHandler = makeBodyLimitErrorHandler;
 exports.makeContentLengthGate = makeContentLengthGate;
 exports.startServer = startServer;
@@ -76,6 +77,7 @@ const viz_js_1 = require("./viz.js");
 const dashboard_js_1 = require("./dashboard.js");
 const identity_store_js_1 = require("./identity-store.js");
 const retrieval = __importStar(require("./retrieval.js"));
+const CALIBRATION = __importStar(require("./calibration.js"));
 const recall_registry_js_1 = require("./recall-registry.js");
 const memory_instructions_js_1 = require("./memory-instructions.js");
 const recall_index_js_1 = require("./recall-index.js");
@@ -87,6 +89,8 @@ const distiller_js_1 = require("./distiller.js");
 const dedup_js_1 = require("./dedup.js");
 const reconsolidation_js_1 = require("./reconsolidation.js");
 const redact_js_1 = require("./redact.js");
+const capture_health_js_1 = require("./capture-health.js");
+const capture_pause_js_1 = require("./capture-pause.js");
 const init_js_1 = require("./init.js");
 // ---------------------------------------------------------------------------
 // Server state
@@ -180,7 +184,7 @@ function createMcpServer() {
     // -- hicortex_search --
     server.tool("hicortex_search", "Search shared long-term memory (all agents, all sessions). CALL THIS BEFORE assuming, guessing, or asking the user about anything that may have come up before: prior decisions, preferences, project facts, people, hardware, past incidents. If you are about to write 'I don't have information about…', search first.", {
         query: zod_1.z.string().describe("Search query text"),
-        limit: zod_1.z.coerce.number().optional().describe("Max results (default: server config searchLimit)"),
+        limit: zod_1.z.coerce.number().optional().describe("Max results (default: the server default)"),
         project: zod_1.z.string().optional().describe("Filter by project name"),
     }, async ({ query, limit, project }) => {
         if (!db)
@@ -214,7 +218,7 @@ function createMcpServer() {
     // -- hicortex_recent --
     server.tool("hicortex_recent", "Get recent memories, optionally filtered by project. CALL THIS AT THE START of substantive work on a project to catch up on its latest state — cheaper than asking the user what happened.", {
         project: zod_1.z.string().optional().describe("Filter by project name"),
-        limit: zod_1.z.coerce.number().optional().describe("Max results (default: server config recentLimit)"),
+        limit: zod_1.z.coerce.number().optional().describe("Max results (default: the server default)"),
     }, async ({ project, limit }) => {
         if (!db)
             return { content: [{ type: "text", text: "Hicortex not initialized" }], isError: true };
@@ -497,6 +501,25 @@ function resolveBodyLimitMb(configVal, hostedMode) {
         return cfg;
     return hostedMode ? 5 : 25;
 }
+/**
+ * Resolve the OPTIONAL /search relevance floor (`minSimilarity` query param,
+ * #409 console polish). Pure — exported for tests. Absent/blank/invalid →
+ * undefined = NO gate (byte-identical to every pre-existing caller: agents,
+ * plugins, MCP tools never send the param). A finite number in [0, 1] → that
+ * floor, clamped into range so a hostile `?minSimilarity=42` cannot widen or
+ * invert the gate. Applied AFTER retrieve() with the exported recall gate
+ * (passesRelevanceGate: FTS/`both` hits pass regardless — a token match is
+ * real evidence; vector-only hits must clear the floor) — the same post-hoc
+ * shape /recall-index uses, so the two recall surfaces gate identically.
+ */
+function resolveSearchSimilarityFloor(raw) {
+    if (typeof raw !== "string" || raw.trim() === "")
+        return undefined;
+    const v = Number(raw);
+    if (!Number.isFinite(v))
+        return undefined;
+    return Math.min(1, Math.max(0, v));
+}
 /**
  * Express error middleware (#7): translate express.json's default HTML 413
  * (entity.too.large) into a consistent JSON response. Catches body-parser
@@ -674,9 +697,10 @@ async function startServer(options = {}) {
         });
     }
     if (llmConfig) {
-        // Tuning (#220: maxTokens + enableThinking + numCtx + flush), validated +
-        // copied via the shared overlay (also applied in resolveSavedLlmConfig for
-        // the nightly). Wrong-typed values warn + drop.
+        // Tuning (#220: maxTokens + enableThinking; #408: the diagnostic env tier
+        // for numCtx + ollama flush), validated + resolved via the shared overlay
+        // (also applied in resolveSavedLlmConfig for the nightly — the ONE
+        // resolution point per process). Wrong-typed values warn + drop.
         (0, llm_js_1.applyTierTuningOverlay)(llmConfig, savedConfig);
         llm = new llm_js_1.LlmClient(llmConfig);
         console.log(`[hicortex] LLM (one model, all phases): ${llmConfig.provider}/${llmConfig.model}`);
@@ -749,34 +773,29 @@ async function startServer(options = {}) {
         console.warn("[hicortex] Config uses the legacy 'contextAgents' key — renamed to 'identityAgents' in 0.18 (#264). " +
             "The legacy key still works; update your config to silence this warning.");
     }
-    // #192 recall/decay alignment: decay speed + recall breadth + pushed-recall
-    // knobs, ALL from config (see retrieval.ts configureRecall for the key list)
-    // so calibration is a config edit + restart, never a release.
-    retrieval.configureDecay({ halfLifeDays: savedConfig?.decayHalfLifeDays });
-    const recallCfg = retrieval.configureRecall(savedConfig);
-    const scoringCfg = retrieval.configureScoring(savedConfig);
-    const sessionIntentCfg = retrieval.configureSessionIntent(savedConfig);
-    console.log(`[hicortex] Recall: k=${recallCfg.searchLimit}/recent=${recallCfg.recentLimit}` +
+    // #408: recall/decay calibration is RELEASE-MANAGED (calibration.ts) — no
+    // config keys are read here anymore. The plain configure*() calls pin this
+    // process to the shipped constants (they remain the eval/test seam; see
+    // retrieval.ts). The boot log still prints the active values — now sourced
+    // from the calibration constants via the configure*() returns.
+    retrieval.configureDecay();
+    const recallCfg = retrieval.configureRecall();
+    const scoringCfg = retrieval.configureScoring();
+    const sessionIntentCfg = retrieval.configureSessionIntent();
+    console.log(`[hicortex] Recall (release-managed calibration): k=${recallCfg.searchLimit}/recent=${recallCfg.recentLimit}` +
         `/window=${recallCfg.recentWindowDays}d/cold=${recallCfg.coldExposureSlots}` +
-        `/novelty=${(0, recall_index_js_1.resolveNoveltyFloorSlots)(savedConfig?.noveltyFloorSlots, savedConfig?.recallMaxItems)}` +
+        `/novelty=${CALIBRATION.NOVELTY_FLOOR_SLOTS}` +
         ` · ` +
         `score sim=${scoringCfg.similarity}/str=${scoringCfg.strength}/conn=${scoringCfg.connections}` +
         `/rec=${scoringCfg.recency}, fresh=${scoringCfg.freshnessBoostWeight}@${scoringCfg.freshnessBoostDays}d, ` +
         `superseded×${scoringCfg.supersededDemotion}` +
         `, intent w=${sessionIntentCfg.weight}` +
         (sessionIntentCfg.weight === 0 ? " (disabled)" : ""));
-    recallRegistry = new recall_registry_js_1.SessionRecallRegistry({
-        reshowTurns: savedConfig?.recallReshowTurns,
-    });
-    recallIndexOptions = {
-        minSimilarity: savedConfig?.recallMinSimilarity,
-        maxItems: savedConfig?.recallMaxItems,
-        minPromptLength: savedConfig?.recallMinPromptChars,
-        titleChars: savedConfig?.recallTitleChars,
-        // #324 novelty floor: slots of recallMaxItems guaranteed to the
-        // pure-prompt (unblended) search's top passing hit(s). 0 disables.
-        noveltyFloorSlots: savedConfig?.noveltyFloorSlots,
-    };
+    // Defaults resolve inside recall-index.ts / recall-registry.ts from the
+    // calibration constants (#408) — the options objects stay as the seams the
+    // eval injects through.
+    recallRegistry = new recall_registry_js_1.SessionRecallRegistry();
+    recallIndexOptions = {};
     memoryInstructionsEnabled = savedConfig?.memoryInstructions !== false;
     if (resolvedAgents.dropped.length > 0) {
         console.warn(`[hicortex] Ignoring invalid identityAgents entries: ${resolvedAgents.dropped.join(", ")} ` +
@@ -918,7 +937,7 @@ async function startServer(options = {}) {
             res.status(503).json({ error: "Server not initialized" });
             return;
         }
-        const { content, source_agent, source_agent_id, source_domain, project, memory_type, privacy, source_session, session_date, corrects, supersedes } = req.body ?? {};
+        const { content, source_agent, source_agent_id, source_domain, source_machine, project, memory_type, privacy, source_session, session_date, corrects, supersedes } = req.body ?? {};
         if (!content || typeof content !== "string") {
             res.status(400).json({ error: "Missing or invalid 'content' field" });
             return;
@@ -969,6 +988,7 @@ async function startServer(options = {}) {
                 // Attribution + provenance passthrough (0.16.x); null when absent.
                 sourceAgentId: typeof source_agent_id === "string" ? source_agent_id : null,
                 sourceDomain: typeof source_domain === "string" ? source_domain : null,
+                sourceMachine: storage.sanitizeSourceMachine(source_machine),
                 sourceSession: source_session ?? undefined,
                 project: project ?? undefined,
                 memoryType: normalizedType ?? "experience",
@@ -1002,15 +1022,24 @@ async function startServer(options = {}) {
             res.status(400).json({ error: "Missing 'query'" });
             return;
         }
-        // No hardcoded default: absent limit → config-driven (searchLimit).
+        // No hardcoded default: absent limit → the release-managed calibration
+        // default (#408 — was the searchLimit config key).
         const limit = req.query.limit ? Number(req.query.limit) : undefined;
         const project = typeof req.query.project === "string" && req.query.project ? req.query.project : undefined;
         // 0.16.x: `privacy` query param is ACCEPTED for backward compat (old
         // clients/plugins still send it) but no longer read — retrieval ignores
         // privacy entirely (the column is vestigial, never filtered).
         warnDeprecatedPrivacyParamIfPresent(req.query, "search");
+        // #409 console polish: OPTIONAL relevance floor. Absent (every legacy
+        // caller) = ungated, byte-identical behavior. The console sends the
+        // recall floor (RECALL_MIN_SIMILARITY, via the /dashboard/field echo) so
+        // vector nearest-neighbor junk below it never renders as "results".
+        const minSimilarity = resolveSearchSimilarityFloor(req.query.minSimilarity);
         try {
-            const results = await retrieval.retrieve(db, embedder_js_1.embed, query, { limit, project });
+            let results = await retrieval.retrieve(db, embedder_js_1.embed, query, { limit, project });
+            if (minSimilarity !== undefined) {
+                results = results.filter((r) => (0, recall_index_js_1.passesRelevanceGate)(r, minSimilarity));
+            }
             res.json({ results });
         }
         catch (err) {
@@ -1074,7 +1103,8 @@ async function startServer(options = {}) {
             return;
         }
         const project = typeof req.query.project === "string" && req.query.project ? req.query.project : undefined;
-        // No hardcoded default: absent limit → config-driven (recentLimit).
+        // No hardcoded default: absent limit → the release-managed calibration
+        // default (#408 — was the recentLimit config key).
         // 0.16.x: `privacy` query param accepted but ignored (vestigial column).
         const limit = req.query.limit ? Number(req.query.limit) : undefined;
         warnDeprecatedPrivacyParamIfPresent(req.query, "recent");
@@ -1172,6 +1202,35 @@ async function startServer(options = {}) {
             (0, health_js_1.logAndSendInternalError)(res, "context", err);
         }
     });
+    // PUT /identity/mode — switch ONE agent's identity scope (#423 phase 3).
+    // No /context/mode alias: this is a NEW endpoint with no legacy callers.
+    //
+    // Single-writer discipline: the daemon's boot-time identityAgents map is
+    // normally read-once-at-boot — THIS route is the one live writer. The
+    // adapter reads the FRESH config (not the boot snapshot) so two switches in
+    // a row can never drop each other's writes, then on success (1) persists
+    // the merged map as config `identityAgents` (survives restarts) and (2)
+    // sets the module-level map to the SAME map — the switch is live on the
+    // very next GET /identity?agent= (applies: "immediate"). Externally
+    // hand-edited config still needs a restart (pre-existing posture). Note
+    // the interplay: PUT /identity's black-hole guard 409s section writes while
+    // config forces off/global — switching to 'override' here first unblocks
+    // section editing. Bearer-only (standard auth middleware, no exemption).
+    app.put("/identity/mode", (req, res) => {
+        try {
+            const fresh = readConfigFile(stateDir) ?? {};
+            const r = (0, identity_store_js_1.handleIdentityModePut)(identityDir, req.body ?? null, req.query, (0, identity_store_js_1.resolveIdentityAgentsConfig)(fresh).agents);
+            if (r.status === 200 && r.agents) {
+                const merged = r.agents;
+                (0, init_js_1.persistConfigUpdates)((0, node_path_1.join)(stateDir, "config.json"), { identityAgents: merged });
+                identityAgents = merged;
+            }
+            res.status(r.status).json(r.body);
+        }
+        catch (err) {
+            (0, health_js_1.logAndSendInternalError)(res, "identity/mode", err);
+        }
+    });
     // REST /distill — canonical capture endpoint (0.9.0+).
     // Every machine (including the server itself) POSTs denoised session text here.
     // The server distills, embeds, stores. Body limit: see `distillBodyLimitMb`
@@ -1185,11 +1244,42 @@ async function startServer(options = {}) {
             res.status(503).json({ error: "Server not initialized" });
             return;
         }
+        // #422: destructured ABOVE the no-LLM guard (it used to sit below) so the
+        // attribution fields exist at EVERY exit incl. the 503 — capture-health
+        // accounting records held posts there too. Nothing else reads them before
+        // the guard, so semantics are unchanged.
+        const { text, messages, source_agent, source_agent_id, source_domain, source_machine, project, session_id, segment_id, session_date, privacy } = req.body ?? {};
+        // #422 capture health: normalize the wire fields ONCE so every exit below
+        // records with a one-liner (recordDistillActivity re-sanitizes machine/
+        // agent — the builder only forwards + picks the byte count). bytes = the
+        // resolved (post-redaction) conversationText length, 0 while unresolved.
+        const capEntry = (bytes, outcome) => ({
+            machine: source_machine,
+            agent: source_agent,
+            sessionId: session_id,
+            segmentId: segment_id,
+            bytes,
+            outcome,
+        });
+        // #423 phase 3 (D3): operator capture pause — server-side 200-skip. The
+        // pause table is read per POST, so a pause takes effect on the very next
+        // /distill (no restart). Deliberately ABOVE the no-LLM guard: a paused
+        // bundle must skip regardless of LLM state — a 503 there would hold the
+        // client's cursor on a box that is deliberately not capturing. The 200 is
+        // the point: capture.ts treats every 200 as confirmed and advances its
+        // cursor, so paused sessions are deliberately NOT captured and never
+        // re-sent/backfilled. Zero client changes.
+        const pause = (0, capture_pause_js_1.capturePauseKey)(source_machine, source_agent);
+        if ((0, capture_pause_js_1.isCapturePaused)(db, pause.machine, pause.harness)) {
+            (0, capture_health_js_1.recordDistillActivity)(db, capEntry(0, "paused"));
+            res.status(200).json({ skipped: true, paused: true, machine: pause.machine, harness: pause.harness });
+            return;
+        }
         if (!llm || !llmConfig) {
+            (0, capture_health_js_1.recordDistillActivity)(db, capEntry(0, "held"));
             res.status(503).json({ error: "No LLM configured — run npx @gamaze/hicortex init. Session will be retried." });
             return;
         }
-        const { text, messages, source_agent, source_agent_id, source_domain, project, session_id, segment_id, session_date, privacy } = req.body ?? {};
         // Resolve the conversation text from either the pre-denoised string or raw messages array.
         // `fromTextBranch` is captured once so the redaction gate below uses the SAME
         // discriminator as the resolution (avoids re-redacting the messages-derived
@@ -1239,6 +1329,7 @@ async function startServer(options = {}) {
         if (session_id && segment_id) {
             const existingCount = (0, dedup_js_1.countExistingSegment)(db, session_id, segment_id);
             if (existingCount > 0) {
+                (0, capture_health_js_1.recordDistillActivity)(db, capEntry(conversationText.length, "skipped"));
                 res.status(200).json({ skipped: true, existing_count: existingCount });
                 return;
             }
@@ -1250,6 +1341,7 @@ async function startServer(options = {}) {
         if (session_id && !segment_id) {
             const existingCount = (0, dedup_js_1.countExistingSession)(db, session_id);
             if (existingCount > 0) {
+                (0, capture_health_js_1.recordDistillActivity)(db, capEntry(conversationText.length, "skipped"));
                 res.status(200).json({ skipped: true, existing_count: existingCount });
                 return;
             }
@@ -1261,6 +1353,7 @@ async function startServer(options = {}) {
         // diagnosis — the capture client treats non-201/200 as transient and holds
         // its cursor (capture.ts), so the segment is retried next run, never lost.
         if (!(await resolveDistillProbeGate(llm, llmConfig))) {
+            (0, capture_health_js_1.recordDistillActivity)(db, capEntry(conversationText.length, "held"));
             res.status(503).json({ error: "LLM endpoint not generating — session will be retried" });
             return;
         }
@@ -1286,6 +1379,7 @@ async function startServer(options = {}) {
             // a skipped duplicate neither trips the gate nor consumes budget. The client
             // capture loop holds its cursor on 429 (dup-over-loss, capture.ts:303).
             if ((0, token_budget_js_1.isTokenBudgetExceeded)(stateDir)) {
+                (0, capture_health_js_1.recordDistillActivity)(db, capEntry(conversationText.length, "held"));
                 res.status(429).json({ error: "token budget exceeded", retry: "next billing period" });
                 return;
             }
@@ -1334,6 +1428,7 @@ async function startServer(options = {}) {
                         // filtered. Default null for older clients that don't send them.
                         sourceAgentId: typeof source_agent_id === "string" ? source_agent_id : null,
                         sourceDomain: typeof source_domain === "string" ? source_domain : null,
+                        sourceMachine: storage.sanitizeSourceMachine(source_machine),
                         // Per-chunk key: "<session_id>[#<segment_id>]#<i>". The prefix
                         // matches the dedup checks above, so a re-run is idempotent.
                         sourceSession: sourcePrefix ? `${sourcePrefix}#${i}` : undefined,
@@ -1352,6 +1447,7 @@ async function startServer(options = {}) {
                 return out;
             });
             const ids = insertAll();
+            (0, capture_health_js_1.recordDistillActivity)(db, capEntry(conversationText.length, "ok"));
             res.status(201).json({
                 ids,
                 distilled: ids.length,
@@ -1365,6 +1461,7 @@ async function startServer(options = {}) {
             });
         }
         catch (err) {
+            (0, capture_health_js_1.recordDistillActivity)(db, capEntry(conversationText.length, "held"));
             res.status(500).json({ error: "Distillation failed" });
             console.error(`[hicortex] /distill: ${err instanceof Error ? (err.stack ?? err.message) : String(err)}`);
         }
@@ -1447,6 +1544,52 @@ async function startServer(options = {}) {
         }
     });
     // -------------------------------------------------------------------------
+    // REST /enrich — owner corroboration (#423 phase 3).
+    //
+    // An enrich is EVIDENCE ABOUT IMPORTANCE: it bumps corroboration_count and
+    // base_strength (+the calibration delta, capped at 1.0) — the same anchor
+    // the nightly's LLM scoring and hub-boost write. It must NOT touch
+    // access_count (reserved for real recall use) or shown_count (index
+    // exposure) — faking either corrupts the uses-per-showing adoption metric.
+    // Never a stage write: stages are derived presentation (the E-reframe).
+    // An absorbed memory is invisible evidence and cannot be corroborated
+    // (409, same posture as /update).
+    // -------------------------------------------------------------------------
+    app.post("/enrich", (req, res) => {
+        if (!db) {
+            res.status(503).json({ error: "Server not initialized" });
+            return;
+        }
+        const { id } = req.body ?? {};
+        if (!id || typeof id !== "string") {
+            res.status(400).json({ error: "Missing or invalid 'id' field" });
+            return;
+        }
+        const fullId = resolveMemoryId(db, id);
+        if (!fullId) {
+            res.status(404).json({ error: "Memory not found" });
+            return;
+        }
+        // Same absorbed guard as /update: corroborating an invisible row would
+        // strengthen evidence the store deliberately folded into another memory.
+        const target = storage.getMemory(db, fullId);
+        if (target?.status === "absorbed") {
+            res.status(409).json({ error: "Memory is absorbed — invisible evidence cannot be corroborated" });
+            return;
+        }
+        try {
+            const r = storage.enrichMemory(db, fullId, new Date().toISOString());
+            if (!r) {
+                res.status(404).json({ error: "Memory not found" });
+                return;
+            }
+            res.status(200).json({ id: fullId, corroboration_count: r.corroborationCount, base_strength: r.baseStrength });
+        }
+        catch (err) {
+            (0, health_js_1.logAndSendInternalError)(res, "enrich", err);
+        }
+    });
+    // -------------------------------------------------------------------------
     // REST /delete — permanently delete a memory and its links.
     //
     // NOTE for #124: returns {deleted: true, id} — clean JSON for future /viz.
@@ -1663,6 +1806,43 @@ async function startServer(options = {}) {
     // express adapter that injects the live db + config. STRICTLY view-only —
     // no mutation endpoints on the dashboard surface.
     app.get("/dashboard/data", (0, dashboard_js_1.dashboardDataHandler)(() => db, () => readConfigFile(stateDir)));
+    // GET /dashboard/field — the console flight-field payload (#409/#421
+    // Phase 1): the whole live store as minimal fields (titles ≤100 via the
+    // production memoryTitle, derived stage + effective strength, no content
+    // bodies) plus every link edge {a, b, rel}. Bearer-only (auth middleware,
+    // no shell exemption — it carries data); localhost bypass applies. Handler
+    // + gzip adapter live in src/dashboard.ts next to its /data sibling; the
+    // field is one row per memory, so Accept-Encoding: gzip clients get the
+    // compressed wire form.
+    app.get("/dashboard/field", (0, dashboard_js_1.dashboardFieldHandler)(() => db));
+    // GET /dashboard/events?days=N — the console replay ledger (#409/#421
+    // Phase 1): night-resolution synthesis over existing tables (created_at /
+    // memory_history / dedup_log / memory_links; no schema change, no
+    // event-sourcing store). ids only. Bearer-only like /dashboard/field;
+    // localhost bypass applies.
+    app.get("/dashboard/events", (0, dashboard_js_1.dashboardEventsHandler)(() => db));
+    // GET/PUT /dashboard/model — the console's model-settings surface (#422
+    // Phase 2): the ONE scoped writer on the dashboard (view-only everywhere
+    // else). GET echoes the config's model knobs raw (null = unset) + the
+    // boot-resolved provider from the daemon's in-memory llmConfig; api_key_set
+    // carries ONLY the key's presence — no key material on the wire, ever. PUT
+    // validates an allowlisted subset (null clears a config key) and persists
+    // via init.ts persistConfigUpdates — strict load, so a malformed config.json
+    // throws → 500 with the file untouched. Bearer-only (auth middleware, no
+    // shell exemption — it carries install config); localhost bypass applies.
+    // Applies on restart: the daemon resolves config at boot (llmConfig is the
+    // boot snapshot; the card footnotes this).
+    app.get("/dashboard/model", (0, dashboard_js_1.dashboardModelGetHandler)(() => readConfigFile(stateDir), () => llmConfig));
+    app.put("/dashboard/model", (0, dashboard_js_1.dashboardModelPutHandler)((updates) => (0, init_js_1.persistConfigUpdates)((0, node_path_1.join)(stateDir, "config.json"), updates), () => llmConfig));
+    // PUT /dashboard/capture-pause — the console's pause/resume toggle (#423
+    // phase 3, D3). Body {machine?, harness, paused}: a pause makes /distill
+    // 200-skip the bundle's posts — deliberate NON-capture, the sessions are
+    // not backfilled (the client cursor advances on the 200, by design). The
+    // effect is IMMEDIATE — no restart — because the /distill handler reads the
+    // capture_pauses table on every post. Bearer-only like /dashboard/model
+    // (auth middleware, no shell exemption — it mutates operator state);
+    // localhost bypass applies. Handler + adapter live in src/dashboard.ts.
+    app.put("/dashboard/capture-pause", (0, dashboard_js_1.dashboardCapturePausePutHandler)(() => db));
     // GET /account — account identity for the console nav (name/org/plan from
     // config). The LIGHTWEIGHT twin of the account block inside /dashboard/data:
     // the /viz and /identity/ui pages need only this, not the metric payload;
@@ -1789,7 +1969,8 @@ function readConfigFile(stateDir) {
     }
     catch (e) {
         console.warn(`[hicortex] ${configPath} exists but could not be parsed — server booting degraded ` +
-            `(config-driven LLM/decay/recall knobs and agentId self-heal will not apply). ` +
+            `(config-driven LLM knobs and agentId self-heal will not apply; decay/recall ` +
+            `calibration is release-managed and unaffected). ` +
             `Fix the JSON and restart. Cause: ${e instanceof Error ? e.message : String(e)}`);
         return null;
     }

package/dist/nightly.d.ts

@@ -20,6 +20,14 @@
  * (#189 review, fix 3). Per-session cursors keep the wide re-scan cheap: an
  * already-captured session yields an empty delta.
  *
+ * First run (#436): with NO watermark yet, since = now − firstRunLookbackDays
+ * (default 7 — owner ruling 2026-09-14: full-history first-run ingestion is
+ * not feasible; a long-term AI user's entire session store must not be
+ * discovered night one). The widening-only invariant composes unchanged:
+ * min(now−7d, now−N) — a recapture window wider than the default widens, a
+ * narrower one leaves the floor. Installing more history is the deliberate
+ * `--recapture-window` act, not a default.
+ *
  * Clock-jump clamp (#327): a FUTURE-dated lastNightly (client clock error —
  * NTP not yet synced at write time) would, once the clock corrects, sit ahead
  * of every session mtime and permanently skip quiet sessions (their mtimes
@@ -27,7 +35,7 @@
  * fires once per affected run (this function runs once per nightly).
  * `now` is injectable for tests.
  */
-export declare function computeSince(stateDir: string, recaptureWindowDays?: number, now?: Date): Date;
+export declare function computeSince(stateDir: string, recaptureWindowDays?: number, now?: Date, firstRunLookbackDays?: number): Date;
 /**
  * Parse a `Retry-After` header into ms (#327). Handles both RFC forms —
  * delay-seconds (`"30"`) and HTTP-date — and returns undefined for anything