argus-decision-mcp 1.0.0 → 1.2.0

package/dist/lib/due-note.js

@@ -1,49 +1,98 @@
+import fs from 'fs';
 import { replayLedger } from './ledger-replay.js';
-import { duePremises, groupDuePremises } from './premises.js';
 import { resolveToolArgusDir } from './argus-dir.js';
 import { resolveToday } from './resolve-today.js';
+import { configPath } from './layout.js';
+import { ambientDueFromState, ambientLine } from './ambient-due.js';
 /**
- * Dispatch-level due-note piggyback (plan v5 §5-2, restraint rules §3.4).
+ * Dispatch-level ambient due-note (plan v5 §5-2 · M1 §1.3, restraint rules §3.4).
  *
  * An MCP server is passive — nothing wakes it between seal and settle. The one
  * moment it reliably has is WHEN THE USER IS ALREADY HERE: any successful tool
- * call. So the dispatcher quietly annotates every ok-envelope with what is due.
+ * call. So the dispatcher quietly annotates every ok-envelope with what is due,
+ * on TWO channels sharing ONE due count (ambient-due.ts — single source, so this
+ * can never drift from check_in):
+ *
+ *  1. data.due_note — machine counts (host-choice; unchanged, back-compat).
+ *  2. surface tail  — ONE localized FACT line so a due item is not forgotten
+ *     mid-session (M1 §1.3). Appended LAST so it never obscures the tool's own
+ *     result; a fact + the argus_check_in handle, never a directive.
  *
  * Restraint, by construction:
- *  - counts only, in `data.due_note` — the surface line stays about the tool
- *    that was called; whether to raise the note is the HOST's choice
  *  - absent entirely at zero (an empty nag cannot be expressed)
+ *  - the surface line fires AT MOST ONCE per session/process (not on every tool
+ *    call) — the count channel still annotates each call for hosts that read it
+ *  - `ambient_mute: true` in config.yaml silences the surface line (the escape)
  *  - argus_check_in is skipped (it IS the due surface — no duplication)
  *  - never overwrites a due_note a tool set itself; never touches errors
  *  - any internal failure returns the result untouched (a broken note must
  *    never tax the tool call that succeeded)
  */
 const SKIP_TOOLS = new Set(['argus_check_in']);
+/** Session-once gate for the SURFACE line: one stdio process = one session, so a
+ *  process-lifetime Set keyed by argus_dir fires the ambient line only on the
+ *  first eligible tool call and stays quiet after (the count channel is not
+ *  gated). Reset for tests via resetAmbientSession(). */
+const ambientShownFor = new Set();
+export function resetAmbientSession() {
+    ambientShownFor.clear();
+}
+function ambientMuted(argusDir) {
+    try {
+        const cfg = fs.readFileSync(configPath(argusDir), 'utf8');
+        return /^ambient_mute:\s*true\b/m.test(cfg);
+    }
+    catch {
+        return false; // no config → not muted
+    }
+}
 export function appendDueNote(toolName, args, result) {
     try {
-        if (result.isError || SKIP_TOOLS.has(toolName))
+        if (result.isError)
+            return result;
+        if (SKIP_TOOLS.has(toolName)) {
+            // check_in IS the due surface — a session that saw it has had its ambient
+            // budget spent. Without this mark, the tail re-fired on the NEXT call and
+            // read as a debt count at the worst moment (experience loop: it rode the
+            // settle right after a check_in triage — "one done, here are your 2 left").
+            try {
+                ambientShownFor.add(resolveToolArgusDir(args['argus_dir']));
+            }
+            catch { /* unbound → nothing to mark */ }
             return result;
+        }
         const sc = result.structuredContent;
         if (!sc || sc['ok'] !== true)
             return result;
         const dir = resolveToolArgusDir(args['argus_dir']); // unbound → throws → untouched
         const today = resolveToday({ override: args['today_override'] });
         const state = replayLedger(dir, today);
-        const contractsDue = state.overdue.length;
-        const premiseFactsDue = groupDuePremises(duePremises(state)).length;
-        if (contractsDue === 0 && premiseFactsDue === 0)
+        const due = ambientDueFromState(state); // SINGLE SOURCE (shared with check_in via ambient-due)
+        if (due.contractsDue === 0 && due.premiseFactsDue === 0 && due.openQuestionsDue === 0)
             return result;
+        // ── channel 1: machine counts (host-choice; unchanged) ──
         const parts = [];
-        if (premiseFactsDue > 0)
-            parts.push(`${premiseFactsDue} premise fact(s) to re-check (argus_recheck)`);
-        if (contractsDue > 0)
-            parts.push(`${contractsDue} contract(s) to settle (argus_settle)`);
+        if (due.premiseFactsDue > 0)
+            parts.push(`${due.premiseFactsDue} premise fact(s) to re-check (argus_recheck)`);
+        if (due.openQuestionsDue > 0)
+            parts.push(`${due.openQuestionsDue} open question(s) to reconsider (argus_premises)`);
+        if (due.contractsDue > 0)
+            parts.push(`${due.contractsDue} contract(s) to settle (argus_settle)`);
         const data = (sc['data'] ??= {});
         if (!('due_note' in data))
             data['due_note'] = parts.join(' · ');
         const na = sc['next_actions'];
         if (Array.isArray(na) && !na.includes('argus_check_in'))
             na.push('argus_check_in');
+        // ── channel 2: the surface tail — session-once, mute-respecting, localized ──
+        if (!ambientShownFor.has(dir) && !ambientMuted(dir)) {
+            const line = ambientLine(dir, due, state); // state lends the ledger's own voice
+            if (line && typeof sc['surface'] === 'string') {
+                sc['surface'] = String(sc['surface']) + line;
+                data['ambient_shown'] = true;
+            }
+            ambientShownFor.add(dir); // once per session regardless (mute or empty line included)
+        }
         // Refresh the text mirror — envelope() serialized before this annotation.
         result.content = [{ type: 'text', text: JSON.stringify(sc, null, 2) }];
         return result;

package/dist/lib/envelope.js

@@ -1,13 +1,28 @@
+import { sanitizeOutput } from './untrusted.js';
+/**
+ * Every tool's output funnels through these two functions, which makes them the
+ * one place a trust boundary can be enforced without relying on a dozen
+ * interpolation sites remembering to. Recorded text (a user's anchor, a premise
+ * lifted from a document, a `source_title` off the account API) is echoed into
+ * `surface` and `data`, and the host model reads all of it as trusted output.
+ *
+ * `sanitizeOutput` removes the MECHANICAL vectors — ANSI/terminal escapes,
+ * carriage-return overwrites, bidi overrides, zero-width smuggling — so the
+ * bytes the human sees and the bytes the model reads are the same bytes.
+ * Semantic injection is not solvable here; see lib/untrusted.ts.
+ */
 export function envelope(e) {
+    const safe = sanitizeOutput(e);
     return {
-        content: [{ type: 'text', text: JSON.stringify(e, null, 2) }],
-        structuredContent: e,
+        content: [{ type: 'text', text: JSON.stringify(safe, null, 2) }],
+        structuredContent: safe,
     };
 }
 export function toolError(e) {
+    const safe = sanitizeOutput(e);
     return {
-        content: [{ type: 'text', text: JSON.stringify(e, null, 2) }],
-        structuredContent: e,
+        content: [{ type: 'text', text: JSON.stringify(safe, null, 2) }],
+        structuredContent: safe,
         isError: true,
     };
 }

package/dist/lib/install-id.js

@@ -0,0 +1,53 @@
+import fs from 'fs';
+import path from 'path';
+import { randomBytes } from 'crypto';
+/**
+ * Ledger install id (BS-1, BLUEPRINT §9.4 두 기기 안전).
+ *
+ * Account rows used to be keyed `mcp_<slug>` — so two ledgers under one
+ * account (laptop + desktop, or two projects) that both sealed a naturally
+ * named decision ("migrate-db") silently collided on the same account row.
+ * Every ledger now carries a stable random id (`.argus/.install`, 8 hex),
+ * and the account key becomes `mcp_<install8>_<slug>`.
+ *
+ * Local decision ids are untouched — this namespaces only the account bridge.
+ * The id is not a device fingerprint: it is random, local, and never reused
+ * across ledgers.
+ */
+export function ledgerInstallId(argusDir) {
+    const p = path.join(argusDir, '.install');
+    try {
+        const raw = fs.readFileSync(p, 'utf8').trim();
+        if (/^[0-9a-f]{8}$/.test(raw))
+            return raw;
+    }
+    catch { /* first run */ }
+    const fresh = randomBytes(4).toString('hex');
+    try {
+        fs.mkdirSync(argusDir, { recursive: true });
+        fs.writeFileSync(p, fresh, 'utf8');
+    }
+    catch { /* read-only dir — fall through with the in-memory id */ }
+    return fresh;
+}
+/** The account-row id for a local decision: mcp_<install8>_<slug> (web adds the mcp_). */
+export function accountPushId(argusDir, localId) {
+    return `${ledgerInstallId(argusDir)}_${localId}`;
+}
+/**
+ * Reverse-map an account row id to OUR local id.
+ * `mcp_<our-install>_<slug>` → slug; legacy `mcp_<slug>` (pre-namespace rows)
+ * → slug; a row namespaced by ANOTHER ledger → null (it is not ours to settle).
+ */
+export function localIdFromAccountId(argusDir, accountId) {
+    if (!accountId.startsWith('mcp_'))
+        return null;
+    const rest = accountId.slice(4);
+    const own = `${ledgerInstallId(argusDir)}_`;
+    if (rest.startsWith(own))
+        return rest.slice(own.length);
+    // another ledger's namespaced row: 8-hex + '_' prefix that is not ours
+    if (/^[0-9a-f]{8}_/.test(rest))
+        return null;
+    return rest; // legacy un-namespaced row — historically ours
+}

package/dist/lib/layout.js

@@ -13,6 +13,7 @@ import { safeSegment, assertInside } from './safe-path.js';
 export const sessionsRoot = (argusDir) => path.join(argusDir, 'sessions');
 export const ledgerDir = (argusDir) => path.join(argusDir, 'ledger');
 export const ledgerPath = (argusDir) => path.join(ledgerDir(argusDir), 'ledger.jsonl');
+export const calendarDir = (argusDir) => path.join(argusDir, 'calendar');
 export const configPath = (argusDir) => path.join(argusDir, 'config.yaml');
 export const boundMarkerPath = (argusDir) => path.join(argusDir, '.bound');
 export function sessionDir(argusDir, id) {
@@ -27,6 +28,12 @@ export function bearingPath(argusDir, id) {
 export function receiptPath(argusDir, id) {
     return path.join(sessionDir(argusDir, id), 'receipt.json');
 }
+export function calendarPath(argusDir, id) {
+    const root = calendarDir(argusDir);
+    const file = path.join(root, `${safeSegment(id, 'id')}.ics`);
+    assertInside(root, file);
+    return file;
+}
 export function sessionFilePath(argusDir, id) {
     return path.join(sessionDir(argusDir, id), 'session.json');
 }

package/dist/lib/ledger-append.js

@@ -2,17 +2,117 @@ import fs from 'fs';
 import fsP from 'fs/promises';
 import { ledgerPath, ledgerDir } from './layout.js';
 import { SCHEMA_VERSION } from './spine.js';
-export async function appendLedger(argusDir, events, now) {
+import { mirrorV1Events } from '../v2/mirror.js';
+/**
+ * Cross-process critical section for read-check-append sequences (§9.4 두 기기
+ * 안전). The in-process dispatcher already serializes calls WITHIN one stdio
+ * server; this lockfile extends that to two concurrent sessions on one dir —
+ * without it, two settles could both replay 'sealed' and both append, double-
+ * counting the calibration record. O_EXCL create is the atomic primitive;
+ * a lock older than STALE_MS is treated as a crash leftover and stolen.
+ */
+const LOCK_STALE_MS = 5000;
+const LOCK_WAIT_MS = 25;
+const LOCK_TRIES = 120; // ~3s worst case
+export async function withLedgerLock(argusDir, fn) {
     await fsP.mkdir(ledgerDir(argusDir), { recursive: true });
+    const lockPath = ledgerPath(argusDir) + '.lock';
+    let acquired = false;
+    for (let i = 0; i < LOCK_TRIES && !acquired; i++) {
+        try {
+            const fd = fs.openSync(lockPath, fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_WRONLY);
+            fs.writeSync(fd, String(process.pid), null, 'utf8');
+            fs.closeSync(fd);
+            acquired = true;
+        }
+        catch {
+            try {
+                const st = fs.statSync(lockPath);
+                if (Date.now() - st.mtimeMs > LOCK_STALE_MS) {
+                    fs.unlinkSync(lockPath);
+                    continue;
+                } // crash leftover
+            }
+            catch {
+                continue;
+            } // lock vanished between attempts — retry immediately
+            await new Promise((r) => setTimeout(r, LOCK_WAIT_MS));
+        }
+    }
+    // Lock or no lock, the work proceeds (availability over strictness — a stuck
+    // lock must never brick the ledger; the steal above bounds the wait).
+    try {
+        return await fn();
+    }
+    finally {
+        if (acquired) {
+            try {
+                fs.unlinkSync(lockPath);
+            }
+            catch { /* already gone */ }
+        }
+    }
+}
+/**
+ * Does the ledger currently end in a newline? A crash or ENOSPC mid-write leaves
+ * a final line with no terminator; the next O_APPEND then writes its bytes
+ * directly onto those, fusing the torn remnant with the new first event into one
+ * invalid JSON line. Replay counts that as ONE dropped line — so the torn record
+ * silently EATS the next event too. If that event is a `settle`, the receipt file
+ * is written but the ledger settle is gone: the decision stays due forever and the
+ * outcome vanishes from the calibration record, with nothing turning red.
+ * Cheap to detect (read the last byte), so we heal instead of corrupting.
+ */
+function needsLeadingNewline(lPath) {
+    let fd;
+    try {
+        const size = fs.statSync(lPath).size;
+        if (size === 0)
+            return false;
+        fd = fs.openSync(lPath, fs.constants.O_RDONLY);
+        const buf = Buffer.alloc(1);
+        fs.readSync(fd, buf, 0, 1, size - 1);
+        return buf[0] !== 0x0a; // '\n'
+    }
+    catch {
+        return false; // no file yet (or unreadable) — the append creates it
+    }
+    finally {
+        if (fd !== undefined) {
+            try {
+                fs.closeSync(fd);
+            }
+            catch { /* already closed */ }
+        }
+    }
+}
+export async function appendLedger(argusDir, events, now, hints) {
+    const dir = ledgerDir(argusDir);
+    await fsP.mkdir(dir, { recursive: true });
     const lPath = ledgerPath(argusDir);
-    const lines = events
+    const body = events
         .map((ev) => JSON.stringify({ v: SCHEMA_VERSION, ts: ev.ts || now, ...ev }))
         .join('\n') + '\n';
+    // Heal a torn tail so it can only ever cost the ONE line it tore, never the
+    // next event. The torn remnant still counts as dropped_lines (disclosed), but
+    // the events we are writing now survive.
+    const lines = (needsLeadingNewline(lPath) ? '\n' : '') + body;
+    // fsync of the file makes its CONTENTS durable, but the very first append also
+    // creates the directory ENTRY — and that entry can be lost on a crash unless
+    // the parent directory is itself synced. Only matters on first create.
+    const isFirstCreate = !fs.existsSync(lPath);
     await new Promise((resolve, reject) => {
         let fd;
         try {
             fd = fs.openSync(lPath, fs.constants.O_APPEND | fs.constants.O_CREAT | fs.constants.O_WRONLY);
             fs.writeSync(fd, lines, null, 'utf8');
+            // The ledger is the product's only durable asset. A rename-based atomic
+            // write can't be used on an append, so fsync is the one thing standing
+            // between a power loss and a lost settlement.
+            try {
+                fs.fsyncSync(fd);
+            }
+            catch { /* fsync unsupported on this fs — the write still landed */ }
             resolve();
         }
         catch (e) {
@@ -23,5 +123,36 @@ export async function appendLedger(argusDir, events, now) {
                 fs.closeSync(fd);
         }
     });
-    return { written: events.length };
+    if (isFirstCreate) {
+        // Persist the new file's directory entry, consistent with the file fsync above.
+        let dfd;
+        try {
+            dfd = fs.openSync(dir, fs.constants.O_RDONLY);
+            fs.fsyncSync(dfd);
+        }
+        catch { /* directory fsync unsupported (e.g. Windows) — best effort */ }
+        finally {
+            if (dfd !== undefined) {
+                try {
+                    fs.closeSync(dfd);
+                }
+                catch { /* already closed */ }
+            }
+        }
+    }
+    // ── v2 미러 (단일 관문) — v1 쓰기가 성공한 뒤에만, 그리고 반드시 여기서.
+    // 툴별 dual-write 호출을 없애 배선 누락을 구조적으로 불가능하게 만든 지점이다
+    // (src/v2/mirror.ts 헤더 참조). mirrorV1Events는 절대 던지지 않지만, 만에
+    // 하나를 위해 한 번 더 감싼다 — 미러가 v1 쓰기 성공을 오염하면 안 된다.
+    let v2_mirror;
+    try {
+        v2_mirror = mirrorV1Events(argusDir, events, now, hints);
+    }
+    catch (e) {
+        v2_mirror = {
+            bound: false, mirrored: 0, skipped_unmapped: [],
+            errors: [], reason: `mirror crashed: ${e instanceof Error ? e.message : String(e)}`,
+        };
+    }
+    return { written: events.length, v2_mirror };
 }

package/dist/lib/ledger-replay.js

@@ -3,6 +3,9 @@ import { deBom } from './deBom.js';
 import { ledgerPath, sessionsRoot, bearingPath } from './layout.js';
 import { asDate } from './resolve-today.js';
 import { safeSegment } from './safe-path.js';
+function normalizePremiseSource(source) {
+    return source === 'user' || source === 'user_stated' ? 'user_stated' : 'ai_surfaced';
+}
 function freshEntry(id) {
     return { id, status: 'candidate', text: '', amend_history: [], premises: [] };
 }
@@ -16,17 +19,18 @@ export function replayLedger(argusDir, today) {
     const map = new Map();
     const stats = {
         total_sealed: 0, total_settled: 0,
-        held: 0, avoided: 0, partial: 0, still_pending: 0,
+        held: 0, avoided: 0, partial: 0, still_pending: 0, missed: 0,
     };
     let dropped = 0;
     let skippedUnknown = 0;
     let oldestTs;
+    const watch = { anchors: new Map(), captures: [] };
     let raw;
     try {
         raw = deBom(fs.readFileSync(ledgerPath(argusDir), 'utf8'));
     }
     catch {
-        return { today, overdue: [], ids, sealedPredicates, contracts: map, stats, integrity: { dropped_lines: 0, skipped_unknown: 0 } };
+        return { today, overdue: [], ids, sealedPredicates, contracts: map, stats, watch, integrity: { dropped_lines: 0, skipped_unknown: 0 } };
     }
     for (const line of raw.split('\n')) {
         if (!line.trim())
@@ -46,8 +50,9 @@ export function replayLedger(argusDir, today) {
         const id = ev['id'];
         // gate_input is an over-fire-gate audit record, not a decision the user
         // opened — counting it made the first-use greeting vanish after a single
-        // restrained argus_open_decision call (11 S7).
-        if (ev['event'] !== 'gate_input')
+        // restrained argus_open_decision call (11 S7). Watch events (당직, §9) are
+        // likewise NOT decisions — they must never count as one.
+        if (ev['event'] !== 'gate_input' && ev['event'] !== 'watch_anchor' && ev['event'] !== 'watch_capture')
             ids.add(id);
         // Record inception (P1-E7): ISO timestamps compare lexicographically.
         if (typeof ev['ts'] === 'string' && ev['ts'] && (!oldestTs || ev['ts'] < oldestTs))
@@ -125,6 +130,30 @@ export function replayLedger(argusDir, today) {
                     stats.partial++;
                 else if (outcome === 'still_pending')
                     stats.still_pending++;
+                else if (outcome === 'missed')
+                    stats.missed++;
+                break;
+            }
+            case 'defer': {
+                // still_pending at the check-by → re-arm, do NOT settle. The contract
+                // moves its check_by forward and stays `sealed` (alive, will come due
+                // again). The original due date and the deferral reason are preserved so
+                // the eventual receipt can state the fact honestly.
+                if (!cur) {
+                    cur = freshEntry(id);
+                    map.set(id, cur);
+                } // defensive; the write-time guard requires `due`
+                const to = typeof ev['check_by'] === 'string' ? ev['check_by'] : undefined;
+                const from = typeof ev['from'] === 'string' ? ev['from'] : cur.check_by;
+                if (to)
+                    cur.check_by = to;
+                cur.status = 'sealed';
+                cur.defer_count = (cur.defer_count ?? 0) + 1;
+                (cur.defer_history ??= []).push({
+                    from, to,
+                    ...(typeof ev['note'] === 'string' ? { note: ev['note'] } : {}),
+                    ...(typeof ev['ts'] === 'string' ? { ts: ev['ts'] } : {}),
+                });
                 break;
             }
             // ── living premises (plan v5 §6.1). The fold is not a validator — the
@@ -149,8 +178,17 @@ export function replayLedger(argusDir, today) {
                     text: ev['text'],
                     external: ev['external'] === true,
                     load_bearing: ev['load_bearing'] === true,
-                    source: (ev['source'] === 'user' ? 'user' : 'ai'),
+                    source: normalizePremiseSource(ev['source']),
                     ...(typeof ev['ai_original'] === 'string' ? { ai_original: ev['ai_original'] } : {}),
+                    ...(isMaterialityRule(ev['materiality_rule']) ? { materiality_rule: ev['materiality_rule'] } : {}),
+                    ...(typeof ev['recheck_cadence_days'] === 'number' && Number.isFinite(ev['recheck_cadence_days']) ? { recheck_cadence_days: ev['recheck_cadence_days'] } : {}),
+                    ...(typeof ev['reponder_cadence_days'] === 'number' && Number.isFinite(ev['reponder_cadence_days']) ? { reponder_cadence_days: ev['reponder_cadence_days'] } : {}),
+                    // M3 — anchor the reconsider clock at add time (an open_question has no
+                    // last_recheck; this is the date the first reconsider-due is measured
+                    // from). Prefer the logical anchor_date (deterministic, honors
+                    // today_override) over the wall-clock ts.
+                    ...(typeof ev['anchor_date'] === 'string' ? { added_ts: ev['anchor_date'] }
+                        : typeof ev['ts'] === 'string' ? { added_ts: ev['ts'] } : {}),
                     status: 'active',
                     amend_history: [],
                     recheck_count: 0,
@@ -179,6 +217,29 @@ export function replayLedger(argusDir, today) {
                     p.external = ev['external'];
                 if (typeof ev['load_bearing'] === 'boolean')
                     p.load_bearing = ev['load_bearing'];
+                // M1 §1.2: the user may re-set the cadence (how often to nudge). A
+                // number widens/narrows the interval; nothing else touches it.
+                if (typeof ev['recheck_cadence_days'] === 'number' && Number.isFinite(ev['recheck_cadence_days']))
+                    p.recheck_cadence_days = ev['recheck_cadence_days'];
+                // M3 §3: the user may re-set the reconsider cadence for an open_question.
+                if (typeof ev['reponder_cadence_days'] === 'number' && Number.isFinite(ev['reponder_cadence_days']))
+                    p.reponder_cadence_days = ev['reponder_cadence_days'];
+                break;
+            }
+            // M3 §3 — the user chose `still_open`: the question stays unresolved, but
+            // the reconsider clock resets so it is not nagged again until the next
+            // cadence. "Leaving it open" is a valid answer — this is a defer, not a
+            // resolve; no verdict, no closing decision.
+            case 'premise_reconsider': {
+                const p = cur?.premises?.find((x) => x.premise_id === ev['premise_id']);
+                if (!p)
+                    break;
+                // Prefer the logical anchor_date over wall-clock ts (deterministic reset).
+                p.last_reconsidered = (typeof ev['anchor_date'] === 'string' ? ev['anchor_date']
+                    : typeof ev['ts'] === 'string' ? ev['ts'] : undefined);
+                // optionally re-set cadence at the same time (host may pass it)
+                if (typeof ev['reponder_cadence_days'] === 'number' && Number.isFinite(ev['reponder_cadence_days']))
+                    p.reponder_cadence_days = ev['reponder_cadence_days'];
                 break;
             }
             case 'premise_recheck': {
@@ -194,7 +255,11 @@ export function replayLedger(argusDir, today) {
                     baseline_only: ev['baseline_only'] === true,
                     source: ev['source'],
                     ...(typeof ev['source_detail'] === 'string' ? { source_detail: ev['source_detail'] } : {}),
-                    ts: ev['ts'],
+                    // Prefer the logical anchor_date over the wall-clock ts — the same
+                    // deterministic clock premise_add (added_ts) and premise_reconsider use.
+                    // The cadence math reads dateOnly(last_recheck.ts), so a UTC ts made the
+                    // next nudge fire a day early for a UTC+9 user and broke sim timelines.
+                    ts: (typeof ev['anchor_date'] === 'string' ? ev['anchor_date'] : ev['ts']),
                 };
                 p.recheck_count++;
                 break;
@@ -210,9 +275,47 @@ export function replayLedger(argusDir, today) {
             }
             case 'gate_input':
                 break; // known meta event (over-fire gate audit) — not a state change, not corrupt
+            // ── 당직 루프 (§9) — outside the decision state machine. No contract
+            //    entry is created; nothing touches stats. Anchor is a note, not a bet.
+            case 'watch_anchor': {
+                const date = typeof ev['anchor_date'] === 'string' ? ev['anchor_date']
+                    : typeof ev['ts'] === 'string' ? ev['ts'].slice(0, 10) : undefined;
+                if (!date || typeof ev['text'] !== 'string') {
+                    dropped++;
+                    break;
+                }
+                watch.anchors.set(date, { date, text: ev['text'], ts: ev['ts'] });
+                break;
+            }
+            case 'watch_capture': {
+                const date = typeof ev['anchor_date'] === 'string' ? ev['anchor_date']
+                    : typeof ev['ts'] === 'string' ? ev['ts'].slice(0, 10) : undefined;
+                if (!date || typeof ev['text'] !== 'string') {
+                    dropped++;
+                    break;
+                }
+                // capture_id is sha256(date|text), and argus_watch documents re-capturing
+                // the same sentence on the same day as idempotent — but the fold used to
+                // push blindly, so a double note left TWO identical captures. The user
+                // could then never promote it: argus_premises from_capture matched both
+                // and hard-errored AMBIGUOUS_REF. Dedup here, like premise_add does.
+                const capId = typeof ev['capture_id'] === 'string' ? ev['capture_id'] : undefined;
+                if (capId && watch.captures.some((c) => c.id === capId))
+                    break;
+                watch.captures.push({
+                    ...(typeof ev['capture_id'] === 'string' ? { id: ev['capture_id'] } : {}),
+                    date,
+                    kind: (ev['kind'] === 'claim' || ev['kind'] === 'question' ? ev['kind'] : 'premise'),
+                    text: ev['text'],
+                    source: normalizePremiseSource(ev['source']),
+                    ...(typeof ev['ai_original'] === 'string' ? { ai_original: ev['ai_original'] } : {}),
+                    ts: ev['ts'],
+                });
+                break;
+            }
             default:
                 // Forward-compat tolerance (plan v5 §6.3): a well-formed, VERSIONED event
-                // whose type this binary doesn't know was written by a newer argus-mcp —
+                // whose type this binary doesn't know was written by a newer argus-decision-mcp —
                 // skip it silently (like gate_input) instead of counting it as corruption,
                 // so an old install never raises a false integrity alarm on a new ledger.
                 // Only unversioned/structurally-broken events still count as dropped.
@@ -232,7 +335,7 @@ export function replayLedger(argusDir, today) {
             overdue.push({ id, date, text: item.text || '' });
     }
     overdue.sort((a, b) => (a.date < b.date ? -1 : 1));
-    return { today, overdue, ids, sealedPredicates, contracts: map, stats, oldest_ts: oldestTs, integrity: { dropped_lines: dropped, skipped_unknown: skippedUnknown } };
+    return { today, overdue, ids, sealedPredicates, contracts: map, stats, watch, oldest_ts: oldestTs, integrity: { dropped_lines: dropped, skipped_unknown: skippedUnknown } };
 }
 /**
  * Bearing-file contract seeds that are due but not yet represented in the
@@ -283,6 +386,15 @@ function readJson(file) {
         return null;
     }
 }
+const KNOWN_RULE_TYPES = new Set(['threshold', 'step', 'delta', 'relative', 'band', 'map', 'stateful']);
+/** Defensive shape check for a persisted materiality_rule (jsonb from the ledger).
+ *  Replay never throws — a malformed rule is simply ignored (heuristic fallback). */
+function isMaterialityRule(v) {
+    if (!v || typeof v !== 'object')
+        return false;
+    const r = v;
+    return typeof r['type'] === 'string' && KNOWN_RULE_TYPES.has(r['type']) && typeof r['params'] === 'object' && r['params'] !== null;
+}
 // Re-export for callers that imported these from here historically.
 export { asDate };
 export const _ledgerFileExists = (argusDir) => {

package/dist/lib/locale.js

@@ -1,5 +1,14 @@
 import fs from 'fs';
+import { detect } from 'tinyld/light';
 import { configPath } from './layout.js';
+/**
+ * detectLocale — CONFIG/ENV detection seeded at argus_init write time.
+ *
+ * Chain (write-time): explicit config > env (LANG/LC_ALL) > Intl > 'en'.
+ * The runtime input-text step lives in resolveResponseLocale (surfaces.ts),
+ * which layers text detection on TOP of a persisted config. This function
+ * stays env-only so a fresh dir on a KST machine seeds locale:ko once.
+ */
 export function detectLocale(argusDir) {
     try {
         const cfg = fs.readFileSync(configPath(argusDir), 'utf8');
@@ -18,3 +27,39 @@ export function detectLocale(argusDir) {
     catch { /* Intl unavailable */ }
     return 'en';
 }
+/**
+ * detectLocaleFromText — the runtime language sniff (M4, spec §4).
+ *
+ * Argus targets exactly two locales, ko and en. Korean is written in Hangul,
+ * a distinct, unambiguous Unicode block — so a Hangul PRESENCE check is 100%
+ * precise for the ko side and needs no statistics. `tinyld/light` (the ~70KB
+ * pure-JS n-gram profile; NO native binding, ships in the published tarball)
+ * is the mature-library secondary signal the spec calls for — but on SHORT
+ * strings its statistical guess misfires ("base rate stays at 3.5%" → 'no',
+ * "downtime < 5 min" → 'pl'), so for our binary ko/en decision the reliable
+ * rule is: any Hangul ⇒ ko, else ⇒ en. tinyld is consulted only to promote a
+ * Hangul-free string to 'ko' if it somehow reads Korean (it never does for
+ * Latin text) — a belt-and-suspenders that never overrides the script check.
+ *
+ * Returns null on empty/too-short/ambiguous input so the caller can fall
+ * through to config/env — a low-confidence guess must never win.
+ */
+const HANGUL = /[가-힣ᄀ-ᇿ㄰-㆏]/;
+export function detectLocaleFromText(text) {
+    if (!text)
+        return null;
+    const t = text.trim();
+    if (t.length < 2)
+        return null;
+    // Script check dominates: Hangul is unambiguous and short-text-safe.
+    if (HANGUL.test(t))
+        return 'ko';
+    // No Hangul. Consult tinyld only to catch a would-be Korean romanization;
+    // in practice Latin text returns a non-ko guess, so this stays 'en'.
+    try {
+        if (detect(t) === 'ko')
+            return 'ko';
+    }
+    catch { /* detector unavailable → script check already ruled */ }
+    return 'en';
+}

package/dist/lib/log.js

@@ -5,10 +5,10 @@
  */
 export function logError(msg, err) {
     const detail = err instanceof Error ? err.stack || err.message : err !== undefined ? String(err) : '';
-    process.stderr.write(`argus-mcp ERROR ${msg}${detail ? ' :: ' + detail : ''}\n`);
+    process.stderr.write(`argus-decision-mcp ERROR ${msg}${detail ? ' :: ' + detail : ''}\n`);
 }
 export function logDebug(msg) {
     if (process.env['ARGUS_DEBUG']) {
-        process.stderr.write(`argus-mcp DEBUG ${msg}\n`);
+        process.stderr.write(`argus-decision-mcp DEBUG ${msg}\n`);
     }
 }