@gamaze/hicortex 0.20.7 → 0.20.10

package/dist/nightly.js

@@ -52,6 +52,7 @@ exports.runNightly = runNightly;
 const paths_js_1 = require("./paths.js");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
+const node_os_1 = require("node:os");
 let VERSION = "0.0.0";
 try {
     VERSION = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(__dirname, "..", "package.json"), "utf-8")).version;
@@ -59,12 +60,12 @@ try {
 catch { }
 const db_js_1 = require("./db.js");
 const config_read_js_1 = require("./config-read.js");
+const calibration_js_1 = require("./calibration.js");
 const llm_js_1 = require("./llm.js");
 const embedder_js_1 = require("./embedder.js");
 const storage = __importStar(require("./storage.js"));
 const consolidate_js_1 = require("./consolidate.js");
 const domain_classify_js_1 = require("./domain-classify.js");
-const nofit_js_1 = require("./nofit.js");
 const transcript_reader_js_1 = require("./transcript-reader.js");
 const hermes_transcript_reader_js_1 = require("./hermes-transcript-reader.js");
 const pi_transcript_reader_js_1 = require("./pi-transcript-reader.js");
@@ -76,6 +77,7 @@ const state_js_1 = require("./state.js");
 const identity_store_js_1 = require("./identity-store.js");
 const capture_cursors_js_1 = require("./capture-cursors.js");
 const capture_js_1 = require("./capture.js");
+const run_deadline_js_1 = require("./run-deadline.js");
 const dashboard_js_1 = require("./dashboard.js");
 const telemetry_js_1 = require("./telemetry.js");
 const init_js_1 = require("./init.js");
@@ -92,6 +94,19 @@ const HICORTEX_HOME = (0, paths_js_1.hicortexHome)();
  * count stays bounded.
  */
 const CONSOLIDATE_ONLY_BACKUP_MIN_AGE_MS = 20 * 60 * 60 * 1000;
+/**
+ * #421 machine × harness identity: the stamp every captured segment carries
+ * as `source_machine`. Config `machineName` wins when set (same style as
+ * `agentName` — an owner-set identity key); otherwise the hostname. Applies
+ * to BOTH capture paths (server-local and client-remote) — same package,
+ * same stamp.
+ */
+function resolveCaptureMachine(config) {
+    const v = config?.machineName;
+    if (typeof v === "string" && v.trim())
+        return v.trim().slice(0, 128);
+    return (0, node_os_1.hostname)();
+}
 function readNightlyConfig(stateDir) {
     const configPath = (0, node_path_1.join)(stateDir, "config.json");
     let loaded;
@@ -127,9 +142,9 @@ function readConfigLicenseKey(stateDir) {
 function readLastRun(stateDir = HICORTEX_HOME) {
     const ts = (0, state_js_1.loadState)(stateDir).lastNightly;
     if (!ts)
-        return new Date(0); // First run — process everything
+        return null; // First run — no watermark yet; #436 applies the lookback cap
     const d = new Date(ts);
-    return isNaN(d.getTime()) ? new Date(0) : d;
+    return isNaN(d.getTime()) ? null : d; // corrupt stamp → treated as first run
 }
 /**
  * Discovery watermark. Normally the last-nightly timestamp; with
@@ -141,6 +156,14 @@ function readLastRun(stateDir = HICORTEX_HOME) {
  * (#189 review, fix 3). Per-session cursors keep the wide re-scan cheap: an
  * already-captured session yields an empty delta.
  *
+ * First run (#436): with NO watermark yet, since = now − firstRunLookbackDays
+ * (default 7 — owner ruling 2026-09-14: full-history first-run ingestion is
+ * not feasible; a long-term AI user's entire session store must not be
+ * discovered night one). The widening-only invariant composes unchanged:
+ * min(now−7d, now−N) — a recapture window wider than the default widens, a
+ * narrower one leaves the floor. Installing more history is the deliberate
+ * `--recapture-window` act, not a default.
+ *
  * Clock-jump clamp (#327): a FUTURE-dated lastNightly (client clock error —
  * NTP not yet synced at write time) would, once the clock corrects, sit ahead
  * of every session mtime and permanently skip quiet sessions (their mtimes
@@ -148,10 +171,10 @@ function readLastRun(stateDir = HICORTEX_HOME) {
  * fires once per affected run (this function runs once per nightly).
  * `now` is injectable for tests.
  */
-function computeSince(stateDir, recaptureWindowDays, now = new Date()) {
+function computeSince(stateDir, recaptureWindowDays, now = new Date(), firstRunLookbackDays = calibration_js_1.DEFAULT_FIRST_RUN_LOOKBACK_DAYS) {
     const lastRun = readLastRun(stateDir);
-    let effective = lastRun;
-    if (lastRun.getTime() > now.getTime()) {
+    let effective = lastRun ?? new Date(now.getTime() - firstRunLookbackDays * 24 * 60 * 60 * 1000);
+    if (lastRun && lastRun.getTime() > now.getTime()) {
         console.warn(`[hicortex] state lastNightly (${lastRun.toISOString()}) is ahead of the clock ` +
             `(${now.toISOString()}) — clamping discovery to now. A future watermark permanently ` +
             `skips quiet sessions once the clock corrects; check the machine's clock/NTP. ` +
@@ -167,7 +190,7 @@ function computeSince(stateDir, recaptureWindowDays, now = new Date()) {
 }
 /** POST /distill transport for server mode — localhost. Sends authToken so
  *  self-capture works regardless of the localhost-bypass marker (#271 root-cause fix). */
-function makeLocalPost(port, authToken) {
+function makeLocalPost(port, authToken, deadline) {
     return async (body) => {
         const resp = await fetch(`http://127.0.0.1:${port}/distill`, {
             method: "POST",
@@ -177,13 +200,16 @@ function makeLocalPost(port, authToken) {
             },
             body: JSON.stringify(body),
             // Synchronous 35B distillation of a large segment can take minutes.
-            signal: AbortSignal.timeout(20 * 60 * 1000),
+            // #405: never wait past the run deadline — the capture loop's
+            // between-segments check is the clean stop; this is the hard bound
+            // for the POST in flight when the deadline expires mid-wait.
+            signal: AbortSignal.timeout(postTimeoutMs(deadline)),
         });
         return normalizePostResult(resp);
     };
 }
 /** POST /distill transport for client mode — remote URL + optional bearer token. */
-function makeRemotePost(serverUrl, authToken) {
+function makeRemotePost(serverUrl, authToken, deadline) {
     return async (body) => {
         const resp = await fetch(`${serverUrl}/distill`, {
             method: "POST",
@@ -192,11 +218,20 @@ function makeRemotePost(serverUrl, authToken) {
                 ...(authToken ? { Authorization: `Bearer ${authToken}` } : {}),
             },
             body: JSON.stringify(body),
-            signal: AbortSignal.timeout(20 * 60 * 1000),
+            signal: AbortSignal.timeout(postTimeoutMs(deadline)),
         });
         return normalizePostResult(resp);
     };
 }
+/**
+ * Per-POST timeout: 20 min (synchronous distillation of a large segment can
+ * take minutes), clamped to the run deadline's remaining time when one is in
+ * force (#405) — a POST launched near expiry never outlives the deadline.
+ */
+function postTimeoutMs(deadline) {
+    const CAP_MS = 20 * 60 * 1000;
+    return Math.max(1, Math.min(CAP_MS, deadline ? deadline.remainingMs() : Infinity));
+}
 async function normalizePostResult(resp) {
     if (resp.status === 201) {
         const data = (await resp.json().catch(() => ({})));
@@ -272,9 +307,6 @@ function captureLockWaitMs() {
     const env = Number(process.env.HICORTEX_CAPTURE_LOCK_WAIT_MS);
     return Number.isFinite(env) && env >= 0 ? env : CAPTURE_LOCK_WAIT_MS;
 }
-// readPositiveConfig moved to ./config-read.ts (shared with the distill-tier
-// overlay in llm.ts / mcp-server.ts). Validates positive-number config knobs
-// at the disk→runtime boundary with a warn-on-rejected-value.
 const NIGHTLY_LOG_MAX_BYTES = 1024 * 1024; // 1 MB — years of normal runs
 /**
  * Keep ~/.hicortex/nightly.log bounded. The launchd plist and systemd unit
@@ -320,10 +352,11 @@ function runEvictionOnly(options = {}) {
     const stateDir = options.stateDir ?? HICORTEX_HOME;
     const savedConfig = readNightlyConfig(stateDir);
     // Same clock as the full nightly (see runNightly's identical trio) — the
-    // eviction ranker reads these module knobs.
-    (0, retrieval_js_1.configureDecay)({ halfLifeDays: savedConfig?.decayHalfLifeDays });
-    (0, retrieval_js_1.configureRecall)(savedConfig);
-    (0, retrieval_js_1.configureScoring)(savedConfig);
+    // eviction ranker reads these module knobs. #408: calibration constants,
+    // never user config — the calls just pin the process to the shipped values.
+    (0, retrieval_js_1.configureDecay)();
+    (0, retrieval_js_1.configureRecall)();
+    (0, retrieval_js_1.configureScoring)();
     const dbPath = (0, db_js_1.resolveDbPath)(options.dbPath);
     console.log(`[hicortex] evict-only run${options.dryRun ? " (dry run)" : ""} — DB: ${dbPath}`);
     const db = (0, db_js_1.initDb)(dbPath);
@@ -460,16 +493,31 @@ async function runNightly(options = {}) {
     }
     const dbPath = (0, db_js_1.resolveDbPath)(options.dbPath);
     // #192: consolidation's decay/prune stage must score with the same clock as
-    // the server's retrieval path (config decayHalfLifeDays, default 365).
-    (0, retrieval_js_1.configureDecay)({ halfLifeDays: savedConfig?.decayHalfLifeDays });
-    (0, retrieval_js_1.configureRecall)(savedConfig);
-    (0, retrieval_js_1.configureScoring)(savedConfig);
+    // the server's retrieval path. #408: that clock is the calibration constant
+    // set (calibration.ts) — both processes resolve identically by construction.
+    (0, retrieval_js_1.configureDecay)();
+    (0, retrieval_js_1.configureRecall)();
+    (0, retrieval_js_1.configureScoring)();
     const modeLabel = consolidateOnly ? " (consolidate-only)" : captureOnly ? " (capture-only)" : dryRun ? " (dry run)" : "";
     console.log(`[hicortex] Nightly pipeline starting${modeLabel}`);
     if (captureOnly) {
         console.log(`[hicortex] capture-only run — consolidation skipped`);
     }
     console.log(`[hicortex] DB: ${dbPath}`);
+    // #405: the ONE pipeline deadline. Full and consolidate-only runs create
+    // it at start and share it across capture + every consolidation stage
+    // (checked at safe boundaries; a hit defers cleanly — see run-deadline.ts).
+    // Capture-only/watchdog runs do NOT: they keep their 30-min systemd
+    // backstop (capture is no-LLM and short). Dry-run is exempt (writes
+    // nothing, spends nothing). 0/invalid config → the 240 default — a
+    // deadline always exists (the old reconsolidationMaxMinutes 0=off is gone).
+    const deadline = !dryRun && !captureOnly
+        ? (0, run_deadline_js_1.createRunDeadline)((0, run_deadline_js_1.resolveNightlyTimeBudgetMinutes)(savedConfig))
+        : undefined;
+    if (deadline) {
+        console.log(`[hicortex] Nightly time budget: ${Math.round((deadline.deadlineAt - Date.now()) / 60_000)} min ` +
+            `(deadline at ${new Date(deadline.deadlineAt).toISOString()})`);
+    }
     // Init DB — consolidation reads the DB directly; capture goes via HTTP.
     const db = (0, db_js_1.initDb)(dbPath);
     try {
@@ -515,8 +563,11 @@ async function runNightly(options = {}) {
         else {
             // Full nightly waits out a transient --capture-only overlap (each segment
             // POST can block up to 20 min); capture-only fails fast. dry-run writes
-            // nothing so it needs no lock.
-            const lockWaitMs = captureLockWaitMs();
+            // nothing so it needs no lock. #405: the wait never outlives the run
+            // deadline — waiting the full 30 min with 5 min left would burn the
+            // whole pipeline on a lock queue. captureLockWaitMs() keeps its env
+            // override (tests); min() clamps to whatever remains.
+            const lockWaitMs = Math.max(0, Math.min(captureLockWaitMs(), deadline ? deadline.remainingMs() : Infinity));
             const releaseLock = dryRun
                 ? (() => { })
                 : await (0, capture_js_1.acquireCaptureLock)(stateDir, captureOnly ? 0 : lockWaitMs);
@@ -537,7 +588,7 @@ async function runNightly(options = {}) {
                     // Step 1: Read new transcripts (CC + Hermes + Pi + OpenClaw). Discovery
                     // is whole-session by mtime/ended_at; per-session cursors slice each
                     // discovered session down to its unseen delta (#189).
-                    const since = computeSince(stateDir, recaptureWindowDays);
+                    const since = computeSince(stateDir, recaptureWindowDays, undefined, (0, config_read_js_1.readPositiveConfig)(savedConfig ?? {}, "firstRunLookbackDays", calibration_js_1.DEFAULT_FIRST_RUN_LOOKBACK_DAYS));
                     if (recaptureWindowDays) {
                         console.log(`[hicortex] --recapture-window ${recaptureWindowDays}d: reading transcripts since ${since.toISOString()}`);
                     }
@@ -581,11 +632,13 @@ async function runNightly(options = {}) {
                     // source_agent_id / source_domain are per-client provenance from
                     // config.json (agentId / sourceDomain) — attribution only, no filtering.
                     const result = await (0, capture_js_1.captureBatches)(batches, {
-                        post: makeLocalPost(port, savedConfig?.authToken),
+                        post: makeLocalPost(port, savedConfig?.authToken, deadline),
                         cursorStore,
                         dryRun,
                         sourceAgentId: savedConfig?.agentId,
                         sourceDomain: savedConfig?.sourceDomain,
+                        sourceMachine: resolveCaptureMachine(savedConfig),
+                        deadline,
                     });
                     memoriesIngested = result.memoriesIngested;
                     distillUsage = result.distillUsage;
@@ -620,6 +673,14 @@ async function runNightly(options = {}) {
         // snapshot). 0 is a real value (under cap), so this stays undefined only
         // when consolidation didn't run at all (capture-only / no_llm / skipped).
         let evictedCount;
+        // #427: reconsolidation scout counters (hoisted for the dashboard
+        // snapshot). Flat snake_case on the wire, mirroring the stage report.
+        // Undefined only when consolidation didn't run; quiet-night zeros are
+        // REAL values from the stage's quiet-night report shape (the scan doesn't
+        // run on a quiet night — that's a fact about the night, not a gap).
+        let scoutScanned;
+        let scoutCorrectionShaped;
+        let scoutCandidatesFound;
         // Resolved cap (#245) for the dashboard snapshot. Hoisted so the snapshot
         // writer (outside the consolidation block) can stamp `capacity` even when
         // consolidation was skipped (the cap is still "in force" config-wise).
@@ -633,10 +694,12 @@ async function runNightly(options = {}) {
         // nothing-to-do short-circuit (zero LLM calls), NOT a failure.
         // "throttled" (#246) = the llmTokensPerMonth fair-use cap was projected to
         // be exceeded, so consolidation was skipped before any LLM call.
-        // "endpoint_down" (#337) = the pre-consolidation readiness probe failed, or
-        // the LLM circuit breaker was open after the run — transient (retried next
-        // run), and NEVER "completed": the stages fail soft, so without this
-        // override a dead-endpoint run would report clean.
+        // "endpoint_down" (#337) = the LLM circuit breaker was open after the run —
+        // transient (retried next run), and NEVER "completed": the stages fail
+        // soft, so without this override a dead-endpoint run would report clean.
+        // "deferred" (#405) = the run-wide wall-clock deadline fired — at least one
+        // stage stopped at a safe boundary and drains next run (lastConsolidated
+        // held, exactly like endpoint_down).
         let consolidationStatus;
         // #246: total consolidation tokens consumed this run (hoisted for telemetry
         // + the dashboard snapshot). Undefined when consolidation didn't run at all
@@ -688,12 +751,11 @@ async function runNightly(options = {}) {
                         // estimate so the next month starts clean.
                         if (!dryRun) {
                             (0, state_js_1.updateState)((s) => {
-                                const now = new Date();
-                                const cur = s.llmTokensThisPeriod;
-                                const startD = cur?.periodStart ? new Date(cur.periodStart) : now;
-                                if (startD.getUTCFullYear() !== now.getUTCFullYear() ||
-                                    startD.getUTCMonth() !== now.getUTCMonth()) {
-                                    s.llmTokensThisPeriod = { prompt: 0, completion: 0, total: 0, periodStart: now.toISOString() };
+                                // #405: the ONE monthly-reset staleness helper — shared by
+                                // shouldThrottleTokens, this file's post-consolidation
+                                // accrual write, and token-budget.ts recordDistillUsage.
+                                if ((0, consolidate_js_1.isStaleTokenPeriod)(s.llmTokensThisPeriod?.periodStart)) {
+                                    s.llmTokensThisPeriod = { prompt: 0, completion: 0, total: 0, periodStart: new Date().toISOString() };
                                     s.llmTokensLastRun = 0;
                                     console.log("[hicortex] Token fair-use period reset (new month) — throttle cleared.");
                                 }
@@ -702,59 +764,41 @@ async function runNightly(options = {}) {
                     }
                 }
                 if (consolidationStatus !== "throttled") {
-                    // #337: readiness probe — ONE minimal generation request before any
-                    // consolidation phase. This REPLACES the #231 no-preflight decision
-                    // (its premise "a failed phase costs latency, not data" was falsified
-                    // by the 2026-08-23/24 incident: the gateway answered /v1/models —
-                    // liveness — while generation was dead, and the nightly retried into
-                    // it for ~5 h, making the wedge monotonically worse). A failed probe
-                    // skips consolidation entirely with the diagnosis "LLM endpoint not
-                    // generating" (not-generating, not slow) and status endpoint_down —
-                    // a transient outcome: consolidation has resumable cursors, the
-                    // nightly re-runs 2-4×/day, and capture is unaffected (the daemon's
-                    // /distill path has its own probe). Zero LLM phases run when the
-                    // probe fails — one fast failure is the whole cost.
-                    const probeOk = await llm.probe();
-                    if (!probeOk) {
-                        console.error("[hicortex] LLM endpoint not generating — consolidation skipped " +
-                            "(endpoint_down, will retry next run). See the ops runbook's " +
-                            "known failure signatures; llmProbeTimeoutMs tunes the probe's patience.");
-                        consolidationStatus = "endpoint_down";
-                    }
-                    else {
+                    // #405: the pre-consolidation readiness probe gate is DELETED. The
+                    // breaker's first-fast-failure semantics took over its job: a
+                    // wedged endpoint costs at most 3 ladder-exhausted logical calls
+                    // (~31 min at the 900 s ceiling, once per dead night, bounded by
+                    // the run deadline) before the post-run breakerOpen override below
+                    // reports endpoint_down. The probe SURVIVES in the daemon's
+                    // /distill gate (mcp-server.ts resolveDistillProbeGate) — a
+                    // different process with a different job.
+                    {
                         const cfgDomains = (0, domain_classify_js_1.parseConfigDomains)(savedConfig);
                         console.log(`[hicortex] Running consolidation...`);
                         const report = await (0, consolidate_js_1.runConsolidation)(db, llm, embedder_js_1.embed, dryRun, false, undefined, {
                             domains: cfgDomains,
                             contentDomainsReady: true,
-                            weakPrimaryFloor: (0, nofit_js_1.resolveWeakPrimaryFloor)(savedConfig),
+                            // #408: weakPrimaryFloor is a release-managed calibration
+                            // constant now — no config threading; the Options field stays
+                            // as the eval/test seam.
                         }, {
-                            minSimilarity: savedConfig?.supersessionMinSimilarity,
-                            maxCalls: savedConfig?.supersessionMaxCalls,
+                        // #405: no supersessionMaxCalls — the ONE run budget is the
+                        // only call cap. #408: minSimilarity defaults to the
+                        // calibration constant (seam only).
                         }, 
-                        // #241: config-driven total LLM-call ceiling (default 5000, was 200).
-                        (0, config_read_js_1.readPositiveConfig)(savedConfig ?? {}, "consolidateMaxLlmCalls", consolidate_js_1.CONSOLIDATE_MAX_LLM_CALLS), 
+                        // #405: the ONE per-run LLM-call ceiling (default 5000;
+                        // consolidateMaxLlmCalls honored as a deprecated alias).
+                        (0, consolidate_js_1.resolveNightlyLlmCallBudget)(savedConfig), 
                         // #245: soft cap on the corpus (default 10000; 0 disables eviction).
                         memorySoftCapResolved, {
-                            // #384 reconsolidation knobs — threaded exactly like the
-                            // supersession pair above; the stage validates and falls back
-                            // to its defaults (0.75 / 0.80) on invalid/absent values.
-                            minSimilarity: savedConfig?.correctionMinSimilarity,
-                            rewriteMinConfidence: savedConfig?.correctionRewriteMinConfidence,
-                            // #392 unified-resolution knobs: the deterministic-merge
-                            // ceiling (legacy dedupMergeThreshold honored when the new
-                            // key is absent) and the pacing cap. Same validation posture
-                            // — the stage defaults to 0.92 / 250.
-                            autoMergeThreshold: (savedConfig?.dedupAutoMergeThreshold ??
-                                savedConfig?.dedupMergeThreshold),
-                            maxMerges: savedConfig?.dedupNightlyMaxMerges,
-                            // #401 runtime bounds: the wall-clock deadline (default 120
-                            // min, 0 disables) and the per-run classify-call ceiling
-                            // (default 600, 0 disables). Same posture — the stage
-                            // validates and falls back on invalid/absent values.
-                            maxMinutes: savedConfig?.reconsolidationMaxMinutes,
-                            maxCalls: savedConfig?.reconsolidationMaxCalls,
-                        });
+                        // #384/#392 reconsolidation knobs — eval/test seams since
+                        // #408 (release-managed calibration constants; nothing is
+                        // threaded from config). The stage validates and falls back
+                        // to its calibration defaults on invalid/absent values.
+                        }, 
+                        // #405: the ONE run-wide deadline — capture and every
+                        // consolidation stage check this same handle.
+                        deadline);
                         console.log(`[hicortex] Consolidation ${report.status} in ${report.elapsed_seconds}s` +
                             (report.stages.reflection ? ` (${report.stages.reflection.lessons_generated} lessons)` : ""));
                         consolidationStatus = report.status;
@@ -775,6 +819,13 @@ async function runNightly(options = {}) {
                         // stage always returns `evicted` (0 when under cap / disabled); report
                         // it as 0 (a real value), not undefined, when the stage ran.
                         evictedCount = report.stages.memory_cap?.evicted ?? 0;
+                        // #427: forward the scout counters whenever the stage ran. The
+                        // stage report always carries them (quiet-night shape = zeros),
+                        // so `?.` only falls through when the whole stage is absent
+                        // (skipped run) — same skip-keys style as lessonsGenerated.
+                        scoutScanned = report.stages.reconsolidation?.scout_scanned;
+                        scoutCorrectionShaped = report.stages.reconsolidation?.scout_correction_shaped;
+                        scoutCandidatesFound = report.stages.reconsolidation?.scout_candidates_found;
                         // Only set when reflection actually RAN (not skipped). A skipped stage
                         // (e.g. endpoint offline, #232 fail-soft) must NOT collapse to 0 — that
                         // would make "endpoint down" indistinguishable from "prompt too tight"
@@ -791,6 +842,13 @@ async function runNightly(options = {}) {
                             tokensThisRun = tokensTotal.total;
                             tokensByStage = report.budget?.tokens_by_stage;
                         }
+                        // #427 observability: calls happened but ZERO tokens metered —
+                        // the endpoint returned no usage objects (recordUsage no-ops by
+                        // design). The snapshot would carry token nulls for such a run;
+                        // make the blind spot GREPPABLE in journald instead of silent,
+                        // the same structured-event style as budget_exhausted.
+                        if (report.budget)
+                            (0, consolidate_js_1.warnUnmeteredTokensRun)(report.budget);
                         // #255: budget exhaustion — always populated when consolidation ran
                         // (report.budget.exhausted is a boolean). The dashboard + telemetry
                         // treat true as a quality-degradation health signal. The
@@ -812,27 +870,18 @@ async function runNightly(options = {}) {
                             (0, state_js_1.updateState)((s) => {
                                 const now = new Date();
                                 const cur = s.llmTokensThisPeriod;
-                                let periodStart = cur?.periodStart ?? now.toISOString();
-                                let prompt = cur?.prompt ?? 0;
-                                let completion = cur?.completion ?? 0;
-                                let total = cur?.total ?? 0;
-                                // Monthly reset: if periodStart is in a previous calendar month,
-                                // zero the accrual before adding this run's contribution.
-                                const startD = new Date(periodStart);
-                                if (startD.getUTCFullYear() !== now.getUTCFullYear() ||
-                                    startD.getUTCMonth() !== now.getUTCMonth()) {
-                                    periodStart = now.toISOString();
-                                    prompt = 0;
-                                    completion = 0;
-                                    total = 0;
-                                }
-                                if (tokensTotal) {
-                                    prompt += tokensTotal.prompt;
-                                    completion += tokensTotal.completion;
-                                    total += tokensTotal.total;
-                                }
+                                // Monthly reset — the ONE staleness helper (#405): zero the
+                                // accrual before adding this run's contribution when
+                                // periodStart sits in a previous UTC calendar month. Shared
+                                // with shouldThrottleTokens, this file's throttle-branch
+                                // reset, and token-budget.ts recordDistillUsage.
+                                const stale = (0, consolidate_js_1.isStaleTokenPeriod)(cur?.periodStart, now);
+                                const prompt = (stale ? 0 : cur?.prompt ?? 0) + (tokensTotal?.prompt ?? 0);
+                                const completion = (stale ? 0 : cur?.completion ?? 0) + (tokensTotal?.completion ?? 0);
+                                const total = (stale ? 0 : cur?.total ?? 0) + (tokensTotal?.total ?? 0);
                                 s.llmTokensThisPeriod = {
-                                    prompt, completion, total, periodStart,
+                                    prompt, completion, total,
+                                    periodStart: stale ? now.toISOString() : cur.periodStart,
                                 };
                                 s.llmTokensLastRun = tokensTotal?.total ?? 0;
                             }, stateDir);
@@ -981,6 +1030,11 @@ async function runNightly(options = {}) {
                     dedup,
                     supersession,
                     evicted: evictedCount,
+                    // #427: scout counters — forwarded whenever consolidation ran
+                    // (writeSnapshot omits the keys when undefined).
+                    scoutScanned,
+                    scoutCorrectionShaped,
+                    scoutCandidatesFound,
                     // #246: token accounting from this run's consolidation (undefined
                     // when consolidation didn't run or made no metered calls).
                     tokensThisRun,
@@ -1089,13 +1143,12 @@ async function runClientNightly(config, dryRun, stateDir = HICORTEX_HOME, recapt
     // the whole run — the pre-flight only needs the link back, which can take
     // ~1 min after wake.
     //
-    // Config-overridable (#163): a wired/well-connected client vs one whose link
-    // is slow to re-establish after wake want different values. Defaults: 20s
-    // per-attempt timeout, 3 attempts, 60s gap. The 20s per-attempt (bumped from
-    // 15s in 0.17) absorbs a slow link coming back after the client wakes — a
-    // remote server reached over a mesh/VPN link can take several seconds to
-    // answer on the first request. For a genuinely DOWN link (`fetch failed`) no
-    // timeout length helps — the capture watchdog's frequent retry handles that (#239).
+    // #163/#405: constants (the preflightTimeoutMs/preflightAttempts/
+    // preflightRetryGapMs config keys are removed — no incident in the #403
+    // inventory ever required tuning them). 20s per attempt absorbs a slow link
+    // re-establishing after the client wakes (bumped from 15s in 0.17); for a
+    // genuinely DOWN link no timeout length helps — the capture watchdog's
+    // frequent retry handles that (#239).
     //
     // WALL-CLOCK NOTE: setTimeout and AbortSignal.timeout do NOT advance while
     // macOS is asleep, so the ~3m worst case (3×20s + 2×60s) is wall-clock-
@@ -1103,9 +1156,9 @@ async function runClientNightly(config, dryRun, stateDir = HICORTEX_HOME, recapt
     // elapsed time can exceed it. Not a defect: the capture lock isn't held
     // during the retry and the cursor design is dup-over-loss, so a late success
     // is harmless. Just don't treat 3m as a hard wall-clock bound.
-    const PREFLIGHT_TIMEOUT_MS = (0, config_read_js_1.readPositiveConfig)(config, "preflightTimeoutMs", 20_000);
-    const PREFLIGHT_ATTEMPTS = Math.max(1, Math.floor((0, config_read_js_1.readPositiveConfig)(config, "preflightAttempts", 3)));
-    const PREFLIGHT_RETRY_GAP_MS = (0, config_read_js_1.readPositiveConfig)(config, "preflightRetryGapMs", 60_000);
+    const PREFLIGHT_TIMEOUT_MS = 20_000;
+    const PREFLIGHT_ATTEMPTS = 3;
+    const PREFLIGHT_RETRY_GAP_MS = 60_000;
     let reachable = false;
     for (let attempt = 1; attempt <= PREFLIGHT_ATTEMPTS; attempt++) {
         try {
@@ -1194,7 +1247,7 @@ async function runClientNightly(config, dryRun, stateDir = HICORTEX_HOME, recapt
         // logs, denoises, and POSTs the denoised text to the server's /distill
         // endpoint. All readers no-op when their harness isn't installed. Per-session
         // cursors slice each discovered session to its unseen delta (#189).
-        const since = computeSince(stateDir, recaptureWindowDays);
+        const since = computeSince(stateDir, recaptureWindowDays, undefined, (0, config_read_js_1.readPositiveConfig)(config ?? {}, "firstRunLookbackDays", calibration_js_1.DEFAULT_FIRST_RUN_LOOKBACK_DAYS));
         if (recaptureWindowDays) {
             console.log(`[hicortex] --recapture-window ${recaptureWindowDays}d: reading transcripts since ${since.toISOString()}`);
         }
@@ -1232,6 +1285,7 @@ async function runClientNightly(config, dryRun, stateDir = HICORTEX_HOME, recapt
                 // server stores these alongside source_agent; nothing filters on them.
                 sourceAgentId: config.agentId,
                 sourceDomain: config.sourceDomain,
+                sourceMachine: resolveCaptureMachine(config),
             });
             memoriesIngested = result.memoriesIngested;
             sessionsSent = result.sessionsSent;

package/dist/nofit.d.ts

@@ -54,21 +54,14 @@ import type { DomainDef } from "./types.js";
  * Default weak-primary floor: minimum cosine(memory embedding, best domain
  * prototype) for a no-fit memory to earn a weak primary.
  *
- * TUNING: 0.45 is a starting point for bge-small-en-v1.5 embeddings — it
- * should be tuned from the actual corpus weight distribution (e.g. inspect
- * the memory_tags.weight histogram of LLM-tagged rows and set the floor
- * near its lower tail). Override per install via `weakPrimaryFloor` in
- * ~/.hicortex/config.json.
+ * #408: RELEASE-MANAGED — the constant (and its provenance: a starting point
+ * for bge-small-en-v1.5 embeddings) lives in calibration.ts. There is no
+ * config override anymore; the DomainStageOptions.weakPrimaryFloor field
+ * stays as the eval/test seam.
  */
 export declare const DEFAULT_WEAK_PRIMARY_FLOOR = 0.45;
 /** Halving never takes base_strength below this (survivable, not zeroed). */
 export declare const NO_ASSOCIATION_MIN_STRENGTH = 0.05;
-/**
- * Resolve the weak-primary floor from a raw config object. Accepts a finite
- * number in (0, 1); anything else (absent, wrong type, out of range) falls
- * back to DEFAULT_WEAK_PRIMARY_FLOOR with a warning for invalid values.
- */
-export declare function resolveWeakPrimaryFloor(config: Record<string, unknown> | null | undefined): number;
 /** Outcome of resolving a no-fit memory against the domain prototypes. */
 export type NoFitResolution = {
     kind: "weak_primary";

package/dist/nofit.js

@@ -84,41 +84,24 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.NO_ASSOCIATION_MIN_STRENGTH = exports.DEFAULT_WEAK_PRIMARY_FLOOR = void 0;
-exports.resolveWeakPrimaryFloor = resolveWeakPrimaryFloor;
 exports.resolveNoFit = resolveNoFit;
 exports.applyWeakPrimary = applyWeakPrimary;
 exports.applyNoAssociationDecay = applyNoAssociationDecay;
 const storage = __importStar(require("./storage.js"));
 const schema_prototypes_js_1 = require("./schema-prototypes.js");
+const CALIBRATION = __importStar(require("./calibration.js"));
 /**
  * Default weak-primary floor: minimum cosine(memory embedding, best domain
  * prototype) for a no-fit memory to earn a weak primary.
  *
- * TUNING: 0.45 is a starting point for bge-small-en-v1.5 embeddings — it
- * should be tuned from the actual corpus weight distribution (e.g. inspect
- * the memory_tags.weight histogram of LLM-tagged rows and set the floor
- * near its lower tail). Override per install via `weakPrimaryFloor` in
- * ~/.hicortex/config.json.
+ * #408: RELEASE-MANAGED — the constant (and its provenance: a starting point
+ * for bge-small-en-v1.5 embeddings) lives in calibration.ts. There is no
+ * config override anymore; the DomainStageOptions.weakPrimaryFloor field
+ * stays as the eval/test seam.
  */
-exports.DEFAULT_WEAK_PRIMARY_FLOOR = 0.45;
+exports.DEFAULT_WEAK_PRIMARY_FLOOR = CALIBRATION.WEAK_PRIMARY_FLOOR;
 /** Halving never takes base_strength below this (survivable, not zeroed). */
 exports.NO_ASSOCIATION_MIN_STRENGTH = 0.05;
-/**
- * Resolve the weak-primary floor from a raw config object. Accepts a finite
- * number in (0, 1); anything else (absent, wrong type, out of range) falls
- * back to DEFAULT_WEAK_PRIMARY_FLOOR with a warning for invalid values.
- */
-function resolveWeakPrimaryFloor(config) {
-    const raw = config?.weakPrimaryFloor;
-    if (raw === undefined || raw === null)
-        return exports.DEFAULT_WEAK_PRIMARY_FLOOR;
-    if (typeof raw === "number" && Number.isFinite(raw) && raw > 0 && raw < 1) {
-        return raw;
-    }
-    console.warn(`[hicortex] invalid weakPrimaryFloor in config (${JSON.stringify(raw)}) — ` +
-        `must be a number in (0, 1); using default ${exports.DEFAULT_WEAK_PRIMARY_FLOOR}`);
-    return exports.DEFAULT_WEAK_PRIMARY_FLOOR;
-}
 /**
  * Decide what happens to a no-fit memory (READ-ONLY — no writes, so callers
  * batching writes into a transaction can decide during the scan phase):

package/dist/prompts.d.ts

@@ -10,6 +10,16 @@
  */
 /**
  * Importance scoring prompt. Takes a {memories_block} with indexed memories.
+ *
+ * RE-ANCHORED (#425): the pre-fix anchors put "useful context" at 0.3-0.5 —
+ * but the distiller's ephemera gate already removes trivia before anything
+ * reaches this scorer, so the model only ever saw curated material and the
+ * distribution compressed upward (measured on the production snapshot via
+ * eval:importance: median base 0.8, ~11% at exactly 1.0, which the decay
+ * model never forgets). The anchors now place routine-but-curated content
+ * LOW and add an explicit distribution instruction (owner decision D2,
+ * 2026-09-13: target median 0.30-0.40, p90 <= 0.75; 1.0 is never a valid
+ * score). The strict JSON-array response contract is unchanged.
  */
 export declare function importanceScoring(memoriesBlock: string): string;
 /**