@gamaze/hicortex 0.20.9 → 0.20.10

package/dist/mcp-server.js

@@ -51,6 +51,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveDistillProbeGate = resolveDistillProbeGate;
 exports.createMcpServer = createMcpServer;
 exports.resolveBodyLimitMb = resolveBodyLimitMb;
+exports.resolveSearchSimilarityFloor = resolveSearchSimilarityFloor;
 exports.makeBodyLimitErrorHandler = makeBodyLimitErrorHandler;
 exports.makeContentLengthGate = makeContentLengthGate;
 exports.startServer = startServer;
@@ -88,6 +89,8 @@ const distiller_js_1 = require("./distiller.js");
 const dedup_js_1 = require("./dedup.js");
 const reconsolidation_js_1 = require("./reconsolidation.js");
 const redact_js_1 = require("./redact.js");
+const capture_health_js_1 = require("./capture-health.js");
+const capture_pause_js_1 = require("./capture-pause.js");
 const init_js_1 = require("./init.js");
 // ---------------------------------------------------------------------------
 // Server state
@@ -498,6 +501,25 @@ function resolveBodyLimitMb(configVal, hostedMode) {
         return cfg;
     return hostedMode ? 5 : 25;
 }
+/**
+ * Resolve the OPTIONAL /search relevance floor (`minSimilarity` query param,
+ * #409 console polish). Pure — exported for tests. Absent/blank/invalid →
+ * undefined = NO gate (byte-identical to every pre-existing caller: agents,
+ * plugins, MCP tools never send the param). A finite number in [0, 1] → that
+ * floor, clamped into range so a hostile `?minSimilarity=42` cannot widen or
+ * invert the gate. Applied AFTER retrieve() with the exported recall gate
+ * (passesRelevanceGate: FTS/`both` hits pass regardless — a token match is
+ * real evidence; vector-only hits must clear the floor) — the same post-hoc
+ * shape /recall-index uses, so the two recall surfaces gate identically.
+ */
+function resolveSearchSimilarityFloor(raw) {
+    if (typeof raw !== "string" || raw.trim() === "")
+        return undefined;
+    const v = Number(raw);
+    if (!Number.isFinite(v))
+        return undefined;
+    return Math.min(1, Math.max(0, v));
+}
 /**
  * Express error middleware (#7): translate express.json's default HTML 413
  * (entity.too.large) into a consistent JSON response. Catches body-parser
@@ -915,7 +937,7 @@ async function startServer(options = {}) {
             res.status(503).json({ error: "Server not initialized" });
             return;
         }
-        const { content, source_agent, source_agent_id, source_domain, project, memory_type, privacy, source_session, session_date, corrects, supersedes } = req.body ?? {};
+        const { content, source_agent, source_agent_id, source_domain, source_machine, project, memory_type, privacy, source_session, session_date, corrects, supersedes } = req.body ?? {};
         if (!content || typeof content !== "string") {
             res.status(400).json({ error: "Missing or invalid 'content' field" });
             return;
@@ -966,6 +988,7 @@ async function startServer(options = {}) {
                 // Attribution + provenance passthrough (0.16.x); null when absent.
                 sourceAgentId: typeof source_agent_id === "string" ? source_agent_id : null,
                 sourceDomain: typeof source_domain === "string" ? source_domain : null,
+                sourceMachine: storage.sanitizeSourceMachine(source_machine),
                 sourceSession: source_session ?? undefined,
                 project: project ?? undefined,
                 memoryType: normalizedType ?? "experience",
@@ -1007,8 +1030,16 @@ async function startServer(options = {}) {
         // clients/plugins still send it) but no longer read — retrieval ignores
         // privacy entirely (the column is vestigial, never filtered).
         warnDeprecatedPrivacyParamIfPresent(req.query, "search");
+        // #409 console polish: OPTIONAL relevance floor. Absent (every legacy
+        // caller) = ungated, byte-identical behavior. The console sends the
+        // recall floor (RECALL_MIN_SIMILARITY, via the /dashboard/field echo) so
+        // vector nearest-neighbor junk below it never renders as "results".
+        const minSimilarity = resolveSearchSimilarityFloor(req.query.minSimilarity);
         try {
-            const results = await retrieval.retrieve(db, embedder_js_1.embed, query, { limit, project });
+            let results = await retrieval.retrieve(db, embedder_js_1.embed, query, { limit, project });
+            if (minSimilarity !== undefined) {
+                results = results.filter((r) => (0, recall_index_js_1.passesRelevanceGate)(r, minSimilarity));
+            }
             res.json({ results });
         }
         catch (err) {
@@ -1171,6 +1202,35 @@ async function startServer(options = {}) {
             (0, health_js_1.logAndSendInternalError)(res, "context", err);
         }
     });
+    // PUT /identity/mode — switch ONE agent's identity scope (#423 phase 3).
+    // No /context/mode alias: this is a NEW endpoint with no legacy callers.
+    //
+    // Single-writer discipline: the daemon's boot-time identityAgents map is
+    // normally read-once-at-boot — THIS route is the one live writer. The
+    // adapter reads the FRESH config (not the boot snapshot) so two switches in
+    // a row can never drop each other's writes, then on success (1) persists
+    // the merged map as config `identityAgents` (survives restarts) and (2)
+    // sets the module-level map to the SAME map — the switch is live on the
+    // very next GET /identity?agent= (applies: "immediate"). Externally
+    // hand-edited config still needs a restart (pre-existing posture). Note
+    // the interplay: PUT /identity's black-hole guard 409s section writes while
+    // config forces off/global — switching to 'override' here first unblocks
+    // section editing. Bearer-only (standard auth middleware, no exemption).
+    app.put("/identity/mode", (req, res) => {
+        try {
+            const fresh = readConfigFile(stateDir) ?? {};
+            const r = (0, identity_store_js_1.handleIdentityModePut)(identityDir, req.body ?? null, req.query, (0, identity_store_js_1.resolveIdentityAgentsConfig)(fresh).agents);
+            if (r.status === 200 && r.agents) {
+                const merged = r.agents;
+                (0, init_js_1.persistConfigUpdates)((0, node_path_1.join)(stateDir, "config.json"), { identityAgents: merged });
+                identityAgents = merged;
+            }
+            res.status(r.status).json(r.body);
+        }
+        catch (err) {
+            (0, health_js_1.logAndSendInternalError)(res, "identity/mode", err);
+        }
+    });
     // REST /distill — canonical capture endpoint (0.9.0+).
     // Every machine (including the server itself) POSTs denoised session text here.
     // The server distills, embeds, stores. Body limit: see `distillBodyLimitMb`
@@ -1184,11 +1244,42 @@ async function startServer(options = {}) {
             res.status(503).json({ error: "Server not initialized" });
             return;
         }
+        // #422: destructured ABOVE the no-LLM guard (it used to sit below) so the
+        // attribution fields exist at EVERY exit incl. the 503 — capture-health
+        // accounting records held posts there too. Nothing else reads them before
+        // the guard, so semantics are unchanged.
+        const { text, messages, source_agent, source_agent_id, source_domain, source_machine, project, session_id, segment_id, session_date, privacy } = req.body ?? {};
+        // #422 capture health: normalize the wire fields ONCE so every exit below
+        // records with a one-liner (recordDistillActivity re-sanitizes machine/
+        // agent — the builder only forwards + picks the byte count). bytes = the
+        // resolved (post-redaction) conversationText length, 0 while unresolved.
+        const capEntry = (bytes, outcome) => ({
+            machine: source_machine,
+            agent: source_agent,
+            sessionId: session_id,
+            segmentId: segment_id,
+            bytes,
+            outcome,
+        });
+        // #423 phase 3 (D3): operator capture pause — server-side 200-skip. The
+        // pause table is read per POST, so a pause takes effect on the very next
+        // /distill (no restart). Deliberately ABOVE the no-LLM guard: a paused
+        // bundle must skip regardless of LLM state — a 503 there would hold the
+        // client's cursor on a box that is deliberately not capturing. The 200 is
+        // the point: capture.ts treats every 200 as confirmed and advances its
+        // cursor, so paused sessions are deliberately NOT captured and never
+        // re-sent/backfilled. Zero client changes.
+        const pause = (0, capture_pause_js_1.capturePauseKey)(source_machine, source_agent);
+        if ((0, capture_pause_js_1.isCapturePaused)(db, pause.machine, pause.harness)) {
+            (0, capture_health_js_1.recordDistillActivity)(db, capEntry(0, "paused"));
+            res.status(200).json({ skipped: true, paused: true, machine: pause.machine, harness: pause.harness });
+            return;
+        }
         if (!llm || !llmConfig) {
+            (0, capture_health_js_1.recordDistillActivity)(db, capEntry(0, "held"));
             res.status(503).json({ error: "No LLM configured — run npx @gamaze/hicortex init. Session will be retried." });
             return;
         }
-        const { text, messages, source_agent, source_agent_id, source_domain, project, session_id, segment_id, session_date, privacy } = req.body ?? {};
         // Resolve the conversation text from either the pre-denoised string or raw messages array.
         // `fromTextBranch` is captured once so the redaction gate below uses the SAME
         // discriminator as the resolution (avoids re-redacting the messages-derived
@@ -1238,6 +1329,7 @@ async function startServer(options = {}) {
         if (session_id && segment_id) {
             const existingCount = (0, dedup_js_1.countExistingSegment)(db, session_id, segment_id);
             if (existingCount > 0) {
+                (0, capture_health_js_1.recordDistillActivity)(db, capEntry(conversationText.length, "skipped"));
                 res.status(200).json({ skipped: true, existing_count: existingCount });
                 return;
             }
@@ -1249,6 +1341,7 @@ async function startServer(options = {}) {
         if (session_id && !segment_id) {
             const existingCount = (0, dedup_js_1.countExistingSession)(db, session_id);
             if (existingCount > 0) {
+                (0, capture_health_js_1.recordDistillActivity)(db, capEntry(conversationText.length, "skipped"));
                 res.status(200).json({ skipped: true, existing_count: existingCount });
                 return;
             }
@@ -1260,6 +1353,7 @@ async function startServer(options = {}) {
         // diagnosis — the capture client treats non-201/200 as transient and holds
         // its cursor (capture.ts), so the segment is retried next run, never lost.
         if (!(await resolveDistillProbeGate(llm, llmConfig))) {
+            (0, capture_health_js_1.recordDistillActivity)(db, capEntry(conversationText.length, "held"));
             res.status(503).json({ error: "LLM endpoint not generating — session will be retried" });
             return;
         }
@@ -1285,6 +1379,7 @@ async function startServer(options = {}) {
             // a skipped duplicate neither trips the gate nor consumes budget. The client
             // capture loop holds its cursor on 429 (dup-over-loss, capture.ts:303).
             if ((0, token_budget_js_1.isTokenBudgetExceeded)(stateDir)) {
+                (0, capture_health_js_1.recordDistillActivity)(db, capEntry(conversationText.length, "held"));
                 res.status(429).json({ error: "token budget exceeded", retry: "next billing period" });
                 return;
             }
@@ -1333,6 +1428,7 @@ async function startServer(options = {}) {
                         // filtered. Default null for older clients that don't send them.
                         sourceAgentId: typeof source_agent_id === "string" ? source_agent_id : null,
                         sourceDomain: typeof source_domain === "string" ? source_domain : null,
+                        sourceMachine: storage.sanitizeSourceMachine(source_machine),
                         // Per-chunk key: "<session_id>[#<segment_id>]#<i>". The prefix
                         // matches the dedup checks above, so a re-run is idempotent.
                         sourceSession: sourcePrefix ? `${sourcePrefix}#${i}` : undefined,
@@ -1351,6 +1447,7 @@ async function startServer(options = {}) {
                 return out;
             });
             const ids = insertAll();
+            (0, capture_health_js_1.recordDistillActivity)(db, capEntry(conversationText.length, "ok"));
             res.status(201).json({
                 ids,
                 distilled: ids.length,
@@ -1364,6 +1461,7 @@ async function startServer(options = {}) {
             });
         }
         catch (err) {
+            (0, capture_health_js_1.recordDistillActivity)(db, capEntry(conversationText.length, "held"));
             res.status(500).json({ error: "Distillation failed" });
             console.error(`[hicortex] /distill: ${err instanceof Error ? (err.stack ?? err.message) : String(err)}`);
         }
@@ -1446,6 +1544,52 @@ async function startServer(options = {}) {
         }
     });
     // -------------------------------------------------------------------------
+    // REST /enrich — owner corroboration (#423 phase 3).
+    //
+    // An enrich is EVIDENCE ABOUT IMPORTANCE: it bumps corroboration_count and
+    // base_strength (+the calibration delta, capped at 1.0) — the same anchor
+    // the nightly's LLM scoring and hub-boost write. It must NOT touch
+    // access_count (reserved for real recall use) or shown_count (index
+    // exposure) — faking either corrupts the uses-per-showing adoption metric.
+    // Never a stage write: stages are derived presentation (the E-reframe).
+    // An absorbed memory is invisible evidence and cannot be corroborated
+    // (409, same posture as /update).
+    // -------------------------------------------------------------------------
+    app.post("/enrich", (req, res) => {
+        if (!db) {
+            res.status(503).json({ error: "Server not initialized" });
+            return;
+        }
+        const { id } = req.body ?? {};
+        if (!id || typeof id !== "string") {
+            res.status(400).json({ error: "Missing or invalid 'id' field" });
+            return;
+        }
+        const fullId = resolveMemoryId(db, id);
+        if (!fullId) {
+            res.status(404).json({ error: "Memory not found" });
+            return;
+        }
+        // Same absorbed guard as /update: corroborating an invisible row would
+        // strengthen evidence the store deliberately folded into another memory.
+        const target = storage.getMemory(db, fullId);
+        if (target?.status === "absorbed") {
+            res.status(409).json({ error: "Memory is absorbed — invisible evidence cannot be corroborated" });
+            return;
+        }
+        try {
+            const r = storage.enrichMemory(db, fullId, new Date().toISOString());
+            if (!r) {
+                res.status(404).json({ error: "Memory not found" });
+                return;
+            }
+            res.status(200).json({ id: fullId, corroboration_count: r.corroborationCount, base_strength: r.baseStrength });
+        }
+        catch (err) {
+            (0, health_js_1.logAndSendInternalError)(res, "enrich", err);
+        }
+    });
+    // -------------------------------------------------------------------------
     // REST /delete — permanently delete a memory and its links.
     //
     // NOTE for #124: returns {deleted: true, id} — clean JSON for future /viz.
@@ -1662,6 +1806,43 @@ async function startServer(options = {}) {
     // express adapter that injects the live db + config. STRICTLY view-only —
     // no mutation endpoints on the dashboard surface.
     app.get("/dashboard/data", (0, dashboard_js_1.dashboardDataHandler)(() => db, () => readConfigFile(stateDir)));
+    // GET /dashboard/field — the console flight-field payload (#409/#421
+    // Phase 1): the whole live store as minimal fields (titles ≤100 via the
+    // production memoryTitle, derived stage + effective strength, no content
+    // bodies) plus every link edge {a, b, rel}. Bearer-only (auth middleware,
+    // no shell exemption — it carries data); localhost bypass applies. Handler
+    // + gzip adapter live in src/dashboard.ts next to its /data sibling; the
+    // field is one row per memory, so Accept-Encoding: gzip clients get the
+    // compressed wire form.
+    app.get("/dashboard/field", (0, dashboard_js_1.dashboardFieldHandler)(() => db));
+    // GET /dashboard/events?days=N — the console replay ledger (#409/#421
+    // Phase 1): night-resolution synthesis over existing tables (created_at /
+    // memory_history / dedup_log / memory_links; no schema change, no
+    // event-sourcing store). ids only. Bearer-only like /dashboard/field;
+    // localhost bypass applies.
+    app.get("/dashboard/events", (0, dashboard_js_1.dashboardEventsHandler)(() => db));
+    // GET/PUT /dashboard/model — the console's model-settings surface (#422
+    // Phase 2): the ONE scoped writer on the dashboard (view-only everywhere
+    // else). GET echoes the config's model knobs raw (null = unset) + the
+    // boot-resolved provider from the daemon's in-memory llmConfig; api_key_set
+    // carries ONLY the key's presence — no key material on the wire, ever. PUT
+    // validates an allowlisted subset (null clears a config key) and persists
+    // via init.ts persistConfigUpdates — strict load, so a malformed config.json
+    // throws → 500 with the file untouched. Bearer-only (auth middleware, no
+    // shell exemption — it carries install config); localhost bypass applies.
+    // Applies on restart: the daemon resolves config at boot (llmConfig is the
+    // boot snapshot; the card footnotes this).
+    app.get("/dashboard/model", (0, dashboard_js_1.dashboardModelGetHandler)(() => readConfigFile(stateDir), () => llmConfig));
+    app.put("/dashboard/model", (0, dashboard_js_1.dashboardModelPutHandler)((updates) => (0, init_js_1.persistConfigUpdates)((0, node_path_1.join)(stateDir, "config.json"), updates), () => llmConfig));
+    // PUT /dashboard/capture-pause — the console's pause/resume toggle (#423
+    // phase 3, D3). Body {machine?, harness, paused}: a pause makes /distill
+    // 200-skip the bundle's posts — deliberate NON-capture, the sessions are
+    // not backfilled (the client cursor advances on the 200, by design). The
+    // effect is IMMEDIATE — no restart — because the /distill handler reads the
+    // capture_pauses table on every post. Bearer-only like /dashboard/model
+    // (auth middleware, no shell exemption — it mutates operator state);
+    // localhost bypass applies. Handler + adapter live in src/dashboard.ts.
+    app.put("/dashboard/capture-pause", (0, dashboard_js_1.dashboardCapturePausePutHandler)(() => db));
     // GET /account — account identity for the console nav (name/org/plan from
     // config). The LIGHTWEIGHT twin of the account block inside /dashboard/data:
     // the /viz and /identity/ui pages need only this, not the metric payload;

package/dist/nightly.d.ts

@@ -20,6 +20,14 @@
  * (#189 review, fix 3). Per-session cursors keep the wide re-scan cheap: an
  * already-captured session yields an empty delta.
  *
+ * First run (#436): with NO watermark yet, since = now − firstRunLookbackDays
+ * (default 7 — owner ruling 2026-09-14: full-history first-run ingestion is
+ * not feasible; a long-term AI user's entire session store must not be
+ * discovered night one). The widening-only invariant composes unchanged:
+ * min(now−7d, now−N) — a recapture window wider than the default widens, a
+ * narrower one leaves the floor. Installing more history is the deliberate
+ * `--recapture-window` act, not a default.
+ *
  * Clock-jump clamp (#327): a FUTURE-dated lastNightly (client clock error —
  * NTP not yet synced at write time) would, once the clock corrects, sit ahead
  * of every session mtime and permanently skip quiet sessions (their mtimes
@@ -27,7 +35,7 @@
  * fires once per affected run (this function runs once per nightly).
  * `now` is injectable for tests.
  */
-export declare function computeSince(stateDir: string, recaptureWindowDays?: number, now?: Date): Date;
+export declare function computeSince(stateDir: string, recaptureWindowDays?: number, now?: Date, firstRunLookbackDays?: number): Date;
 /**
  * Parse a `Retry-After` header into ms (#327). Handles both RFC forms —
  * delay-seconds (`"30"`) and HTTP-date — and returns undefined for anything

package/dist/nightly.js

@@ -52,6 +52,7 @@ exports.runNightly = runNightly;
 const paths_js_1 = require("./paths.js");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
+const node_os_1 = require("node:os");
 let VERSION = "0.0.0";
 try {
     VERSION = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(__dirname, "..", "package.json"), "utf-8")).version;
@@ -59,6 +60,7 @@ try {
 catch { }
 const db_js_1 = require("./db.js");
 const config_read_js_1 = require("./config-read.js");
+const calibration_js_1 = require("./calibration.js");
 const llm_js_1 = require("./llm.js");
 const embedder_js_1 = require("./embedder.js");
 const storage = __importStar(require("./storage.js"));
@@ -92,6 +94,19 @@ const HICORTEX_HOME = (0, paths_js_1.hicortexHome)();
  * count stays bounded.
  */
 const CONSOLIDATE_ONLY_BACKUP_MIN_AGE_MS = 20 * 60 * 60 * 1000;
+/**
+ * #421 machine × harness identity: the stamp every captured segment carries
+ * as `source_machine`. Config `machineName` wins when set (same style as
+ * `agentName` — an owner-set identity key); otherwise the hostname. Applies
+ * to BOTH capture paths (server-local and client-remote) — same package,
+ * same stamp.
+ */
+function resolveCaptureMachine(config) {
+    const v = config?.machineName;
+    if (typeof v === "string" && v.trim())
+        return v.trim().slice(0, 128);
+    return (0, node_os_1.hostname)();
+}
 function readNightlyConfig(stateDir) {
     const configPath = (0, node_path_1.join)(stateDir, "config.json");
     let loaded;
@@ -127,9 +142,9 @@ function readConfigLicenseKey(stateDir) {
 function readLastRun(stateDir = HICORTEX_HOME) {
     const ts = (0, state_js_1.loadState)(stateDir).lastNightly;
     if (!ts)
-        return new Date(0); // First run — process everything
+        return null; // First run — no watermark yet; #436 applies the lookback cap
     const d = new Date(ts);
-    return isNaN(d.getTime()) ? new Date(0) : d;
+    return isNaN(d.getTime()) ? null : d; // corrupt stamp → treated as first run
 }
 /**
  * Discovery watermark. Normally the last-nightly timestamp; with
@@ -141,6 +156,14 @@ function readLastRun(stateDir = HICORTEX_HOME) {
  * (#189 review, fix 3). Per-session cursors keep the wide re-scan cheap: an
  * already-captured session yields an empty delta.
  *
+ * First run (#436): with NO watermark yet, since = now − firstRunLookbackDays
+ * (default 7 — owner ruling 2026-09-14: full-history first-run ingestion is
+ * not feasible; a long-term AI user's entire session store must not be
+ * discovered night one). The widening-only invariant composes unchanged:
+ * min(now−7d, now−N) — a recapture window wider than the default widens, a
+ * narrower one leaves the floor. Installing more history is the deliberate
+ * `--recapture-window` act, not a default.
+ *
  * Clock-jump clamp (#327): a FUTURE-dated lastNightly (client clock error —
  * NTP not yet synced at write time) would, once the clock corrects, sit ahead
  * of every session mtime and permanently skip quiet sessions (their mtimes
@@ -148,10 +171,10 @@ function readLastRun(stateDir = HICORTEX_HOME) {
  * fires once per affected run (this function runs once per nightly).
  * `now` is injectable for tests.
  */
-function computeSince(stateDir, recaptureWindowDays, now = new Date()) {
+function computeSince(stateDir, recaptureWindowDays, now = new Date(), firstRunLookbackDays = calibration_js_1.DEFAULT_FIRST_RUN_LOOKBACK_DAYS) {
     const lastRun = readLastRun(stateDir);
-    let effective = lastRun;
-    if (lastRun.getTime() > now.getTime()) {
+    let effective = lastRun ?? new Date(now.getTime() - firstRunLookbackDays * 24 * 60 * 60 * 1000);
+    if (lastRun && lastRun.getTime() > now.getTime()) {
         console.warn(`[hicortex] state lastNightly (${lastRun.toISOString()}) is ahead of the clock ` +
             `(${now.toISOString()}) — clamping discovery to now. A future watermark permanently ` +
             `skips quiet sessions once the clock corrects; check the machine's clock/NTP. ` +
@@ -565,7 +588,7 @@ async function runNightly(options = {}) {
                     // Step 1: Read new transcripts (CC + Hermes + Pi + OpenClaw). Discovery
                     // is whole-session by mtime/ended_at; per-session cursors slice each
                     // discovered session down to its unseen delta (#189).
-                    const since = computeSince(stateDir, recaptureWindowDays);
+                    const since = computeSince(stateDir, recaptureWindowDays, undefined, (0, config_read_js_1.readPositiveConfig)(savedConfig ?? {}, "firstRunLookbackDays", calibration_js_1.DEFAULT_FIRST_RUN_LOOKBACK_DAYS));
                     if (recaptureWindowDays) {
                         console.log(`[hicortex] --recapture-window ${recaptureWindowDays}d: reading transcripts since ${since.toISOString()}`);
                     }
@@ -614,6 +637,7 @@ async function runNightly(options = {}) {
                         dryRun,
                         sourceAgentId: savedConfig?.agentId,
                         sourceDomain: savedConfig?.sourceDomain,
+                        sourceMachine: resolveCaptureMachine(savedConfig),
                         deadline,
                     });
                     memoriesIngested = result.memoriesIngested;
@@ -649,6 +673,14 @@ async function runNightly(options = {}) {
         // snapshot). 0 is a real value (under cap), so this stays undefined only
         // when consolidation didn't run at all (capture-only / no_llm / skipped).
         let evictedCount;
+        // #427: reconsolidation scout counters (hoisted for the dashboard
+        // snapshot). Flat snake_case on the wire, mirroring the stage report.
+        // Undefined only when consolidation didn't run; quiet-night zeros are
+        // REAL values from the stage's quiet-night report shape (the scan doesn't
+        // run on a quiet night — that's a fact about the night, not a gap).
+        let scoutScanned;
+        let scoutCorrectionShaped;
+        let scoutCandidatesFound;
         // Resolved cap (#245) for the dashboard snapshot. Hoisted so the snapshot
         // writer (outside the consolidation block) can stamp `capacity` even when
         // consolidation was skipped (the cap is still "in force" config-wise).
@@ -787,6 +819,13 @@ async function runNightly(options = {}) {
                         // stage always returns `evicted` (0 when under cap / disabled); report
                         // it as 0 (a real value), not undefined, when the stage ran.
                         evictedCount = report.stages.memory_cap?.evicted ?? 0;
+                        // #427: forward the scout counters whenever the stage ran. The
+                        // stage report always carries them (quiet-night shape = zeros),
+                        // so `?.` only falls through when the whole stage is absent
+                        // (skipped run) — same skip-keys style as lessonsGenerated.
+                        scoutScanned = report.stages.reconsolidation?.scout_scanned;
+                        scoutCorrectionShaped = report.stages.reconsolidation?.scout_correction_shaped;
+                        scoutCandidatesFound = report.stages.reconsolidation?.scout_candidates_found;
                         // Only set when reflection actually RAN (not skipped). A skipped stage
                         // (e.g. endpoint offline, #232 fail-soft) must NOT collapse to 0 — that
                         // would make "endpoint down" indistinguishable from "prompt too tight"
@@ -803,6 +842,13 @@ async function runNightly(options = {}) {
                             tokensThisRun = tokensTotal.total;
                             tokensByStage = report.budget?.tokens_by_stage;
                         }
+                        // #427 observability: calls happened but ZERO tokens metered —
+                        // the endpoint returned no usage objects (recordUsage no-ops by
+                        // design). The snapshot would carry token nulls for such a run;
+                        // make the blind spot GREPPABLE in journald instead of silent,
+                        // the same structured-event style as budget_exhausted.
+                        if (report.budget)
+                            (0, consolidate_js_1.warnUnmeteredTokensRun)(report.budget);
                         // #255: budget exhaustion — always populated when consolidation ran
                         // (report.budget.exhausted is a boolean). The dashboard + telemetry
                         // treat true as a quality-degradation health signal. The
@@ -984,6 +1030,11 @@ async function runNightly(options = {}) {
                     dedup,
                     supersession,
                     evicted: evictedCount,
+                    // #427: scout counters — forwarded whenever consolidation ran
+                    // (writeSnapshot omits the keys when undefined).
+                    scoutScanned,
+                    scoutCorrectionShaped,
+                    scoutCandidatesFound,
                     // #246: token accounting from this run's consolidation (undefined
                     // when consolidation didn't run or made no metered calls).
                     tokensThisRun,
@@ -1196,7 +1247,7 @@ async function runClientNightly(config, dryRun, stateDir = HICORTEX_HOME, recapt
         // logs, denoises, and POSTs the denoised text to the server's /distill
         // endpoint. All readers no-op when their harness isn't installed. Per-session
         // cursors slice each discovered session to its unseen delta (#189).
-        const since = computeSince(stateDir, recaptureWindowDays);
+        const since = computeSince(stateDir, recaptureWindowDays, undefined, (0, config_read_js_1.readPositiveConfig)(config ?? {}, "firstRunLookbackDays", calibration_js_1.DEFAULT_FIRST_RUN_LOOKBACK_DAYS));
         if (recaptureWindowDays) {
             console.log(`[hicortex] --recapture-window ${recaptureWindowDays}d: reading transcripts since ${since.toISOString()}`);
         }
@@ -1234,6 +1285,7 @@ async function runClientNightly(config, dryRun, stateDir = HICORTEX_HOME, recapt
                 // server stores these alongside source_agent; nothing filters on them.
                 sourceAgentId: config.agentId,
                 sourceDomain: config.sourceDomain,
+                sourceMachine: resolveCaptureMachine(config),
             });
             memoriesIngested = result.memoriesIngested;
             sessionsSent = result.sessionsSent;

package/dist/prompts.d.ts

@@ -10,6 +10,16 @@
  */
 /**
  * Importance scoring prompt. Takes a {memories_block} with indexed memories.
+ *
+ * RE-ANCHORED (#425): the pre-fix anchors put "useful context" at 0.3-0.5 —
+ * but the distiller's ephemera gate already removes trivia before anything
+ * reaches this scorer, so the model only ever saw curated material and the
+ * distribution compressed upward (measured on the production snapshot via
+ * eval:importance: median base 0.8, ~11% at exactly 1.0, which the decay
+ * model never forgets). The anchors now place routine-but-curated content
+ * LOW and add an explicit distribution instruction (owner decision D2,
+ * 2026-09-13: target median 0.30-0.40, p90 <= 0.75; 1.0 is never a valid
+ * score). The strict JSON-array response contract is unchanged.
  */
 export declare function importanceScoring(memoriesBlock: string): string;
 /**

package/dist/prompts.js

@@ -16,23 +16,46 @@ exports.distillation = distillation;
 exports.domainCuration = domainCuration;
 /**
  * Importance scoring prompt. Takes a {memories_block} with indexed memories.
+ *
+ * RE-ANCHORED (#425): the pre-fix anchors put "useful context" at 0.3-0.5 —
+ * but the distiller's ephemera gate already removes trivia before anything
+ * reaches this scorer, so the model only ever saw curated material and the
+ * distribution compressed upward (measured on the production snapshot via
+ * eval:importance: median base 0.8, ~11% at exactly 1.0, which the decay
+ * model never forgets). The anchors now place routine-but-curated content
+ * LOW and add an explicit distribution instruction (owner decision D2,
+ * 2026-09-13: target median 0.30-0.40, p90 <= 0.75; 1.0 is never a valid
+ * score). The strict JSON-array response contract is unchanged.
  */
 function importanceScoring(memoriesBlock) {
     return `You are a memory importance scorer. Rate each memory's long-term value.
 
 Score each memory from 0.0 (trivial/ephemeral) to 1.0 (critical/foundational).
+These memories are pre-filtered for durability, so ordinary competent work is
+the NORMAL case — use the full scale and keep the bulk of a batch in the lower
+half. When torn between two bands, choose the LOWER.
 
 Scoring guide:
-- 0.0-0.2: Routine actions, transient state, trivial fixes
-- 0.3-0.5: Useful context, minor decisions, standard patterns
-- 0.6-0.8: Important decisions, debugging breakthroughs, architectural choices
-- 0.9-1.0: Foundational principles, critical constraints, core identity facts
+- 0.0-0.2: Ephemeral state, routine actions, one-off fixes
+- 0.2-0.4: Useful context, ordinary decisions, standard patterns — THE DEFAULT
+  BAND; most memories belong here
+- 0.4-0.6: Notable decisions, recurring patterns, project-shaping context —
+  only rows that clearly stand above ordinary work
+- 0.6-0.8: Important decisions, debugging breakthroughs, architectural
+  choices — rare; at most one or two in a typical batch
+- 0.8-0.95: ONLY genuinely foundational principles, critical constraints, core
+  identity facts — material that would be serious to lose. Never score 1.0.
+
+Distribution: a typical batch should have a median around 0.35 — half the
+batch sits at 0.2-0.4. A score of 0.5 or more says "among the more important
+quarter of everything in long-term memory"; a score above 0.8 must be rare
+and immediately defensible as costly to lose.
 
 MEMORIES:
 ${memoriesBlock}
 
 Respond with ONLY a JSON array of scores in the same order, e.g.:
-[0.3, 0.7, 0.5, 0.9]
+[0.3, 0.4, 0.2, 0.7]
 
 No explanations. Just the JSON array.`;
 }