create-egregore 0.21.0-runtime-mvp.14 → 0.21.0-runtime-mvp.16

package/assets/egregore-launcher.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// egregore-launcher-version: 0.21.0-runtime-mvp.14
+// egregore-launcher-version: 0.21.0-runtime-mvp.16
 //
 // egregore — launch and browse Egregore instances from your terminal.
 // Installed by create-egregore. Reads ~/.egregore/instances.json.
@@ -35,7 +35,7 @@ const crypto = require("node:crypto");
 const { spawnSync, spawn } = require("node:child_process");
 const readline = require("node:readline");
 
-const VERSION = "0.21.0-runtime-mvp.14";
+const VERSION = "0.21.0-runtime-mvp.16";
 const REGISTRY = path.join(os.homedir(), ".egregore", "instances.json");
 const DEFAULT_FILE = path.join(os.homedir(), ".egregore", "default");
 const UPDATE_CACHE_FILE = path.join(os.homedir(), ".egregore", "update-check.json");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.21.0-runtime-mvp.14",
+  "version": "0.21.0-runtime-mvp.16",
   "description": "Set up Egregore for your team in one command — installs the egregore launcher and your choice of Claude Code, Codex, or Pi.",
   "license": "MIT",
   "bin": {

package/runtime/claude/CLAUDE.md

@@ -228,19 +228,21 @@ For each user-directed organizational lookup, show exactly one visible line:
 - retrieval that actually queries the connected graph:
   `⌕ Egregore Connect · searching your organization’s memory and relationships`
 
-Runtime owns retrieval; no agent feature flag does. `EGREGORE_ORG_CONTEXT_V1`
-is only the schema label. When attached, authorized retrieval is complete:
+When `EGREGORE_ORG_CONTEXT_V1` is attached, authorized retrieval is complete:
 never query again that turn, and state any evidence gap. `OPENED_BY_OBSERVE`
 means the evidence is open. A later explicit search starts a new turn.
 
-**Visibility is the contract.** Emit it verbatim as a
-standalone assistant message before the first Bash, Grep, Glob, Read, or other
-retrieval tool call.
-Shell/tool output does not satisfy this requirement. Do not paraphrase the line.
+**Scope.** Egregore Runtime is for organizational recall only: team memory,
+decisions, handoffs, prior work. Code, files, Git, and tests use the harness's
+normal tools, with no beat and no Runtime call.
 
-Use the memory form normally; use Connect only for an explicit graph traversal
-that actually runs. Emit once per episode. A `bin/search.sh` banner is only a
-shell fallback and does not replace this visible beat.
+**Visibility is the contract.** Emit it verbatim as a standalone assistant
+message before the first tool call that performs the organizational recall
+(the `bin/search.sh` query or a graph read). Tool output does not satisfy it.
+Do not paraphrase the line.
+
+Use Connect only for a graph traversal that actually runs. Emit once per
+episode.
 
 **Routing:** Organizational recall always enters Egregore Runtime. The model is
 the semantic intent authority, deciding from meaning rather than fixed phrases.
@@ -251,20 +253,18 @@ Without sufficient attached context, make exactly one Runtime/QMD call:
 bash bin/search.sh query "<concept>" -n 6 --compact --context-packet
 ```
 
-`--context-packet` keeps the evidence out of the visible transcript and
-attaches it privately; the visible output is the attribution line alone.
-Never re-print ranked results, file/rank/excerpt metadata, or raw JSON.
+`--context-packet` attaches the evidence privately; the visible output is the
+attribution line alone. Never re-print ranked results or raw JSON.
 
 Do not resolve `memory/` to its sibling repo or start with raw `grep`/`ls`.
-Search owns lexical/semantic selection and attaches no graph by default. Open a
-source only when its excerpt cannot support a necessary claim. For current
+Search attaches no graph by default. Open a source only when its excerpt
+cannot support a necessary claim. For current
 team/person synthesis, retain known organization/member names and choose
-`--recent-days` plus `--min-evidence`. Use native
-Grep/Glob for code and exact errors. `/activity`, `/dashboard`, and `/project`
+`--recent-days` plus `--min-evidence`. `/activity`, `/dashboard`, and `/project`
 display bounded status surfaces only when named or directly requested as a
-card. Questions asking for an explained synthesis of current organizational
-work are Runtime/QMD recall, as is prior-work discovery. Do not run full
-hybrid retrieval on unrelated prompts or infer graph from recall intent.
+card. Explained syntheses of current organizational work and prior-work
+discovery are Runtime/QMD recall. Do not run retrieval on unrelated prompts or
+infer graph from recall intent.
 
 Do not emit the beat for code search, Git inspection, startup hydration, graph
 writes, ingestion, background sync, maintenance, or internal queries.

package/runtime/claude/bin/codex-render-spec.mjs

@@ -157,9 +157,8 @@ const NON_SKILL_TOKENS = new Set(['loop', 'fast', 'config', 'clear', 'help']);
 // hook delivers there. Rewrite the fallback command to the stdout form and
 // state the same hygiene contract in shell terms: search output is
 // model-internal; the visible reply carries only the retrieval line.
-const CLAUDE_PACKET_NOTE = `\`--context-packet\` keeps the evidence out of the visible transcript and
-attaches it privately; the visible output is the attribution line alone.
-Never re-print ranked results, file/rank/excerpt metadata, or raw JSON.`;
+const CLAUDE_PACKET_NOTE = `\`--context-packet\` attaches the evidence privately; the visible output is the
+attribution line alone. Never re-print ranked results or raw JSON.`;
 const SHELL_PACKET_NOTE = `Search output is model-internal: show only the retrieval line and receipts —
 never ranked blocks, file/rank/excerpt metadata, or raw JSON.`;
 

package/runtime/claude/bin/search.sh

@@ -32,6 +32,19 @@ _maintenance_runtime() {
     python3 -m egregore_runtime.adapters.qmd_cli "$@"
 }
 
+_now_ms() {
+  if command -v perl >/dev/null 2>&1; then
+    perl -MTime::HiRes=time -e 'printf("%d\n", time() * 1000)'
+  else
+    echo $(( $(date +%s) * 1000 ))
+  fi
+}
+
+_elapsed_s() {
+  # One-decimal seconds since a _now_ms() timestamp.
+  awk -v ms="$(( $(_now_ms) - $1 ))" 'BEGIN { printf "%.1f", ms / 1000 }'
+}
+
 _result_paths() {
   local line path canonical_prefix
   canonical_prefix="**file:** \`memory/"
@@ -125,14 +138,14 @@ _banner_and_emit() {
     actual="${actual%% *}"
     required="${gap#*required=}"
     required="${required%% *}"
-    dur=$(( $(date +%s) - t0 ))
+    dur=$(_elapsed_s "$t0")
     printf '⌕ Egregore · searching your organization’s memory · %s · evidence gap · %s/%s sources · %ss\n\n' \
       "$label" "$actual" "$required" "$dur"
     [ "$hide_results" = 1 ] || printf '%s\n' "$out" | tail -n +2
     return 0
   fi
   hits=$(printf '%s\n' "$out" | _result_paths | wc -l | tr -d ' ')
-  dur=$(( $(date +%s) - t0 ))
+  dur=$(_elapsed_s "$t0")
   product="Egregore"
   surface="searching your organization’s memory"
   if [ "$emit" = "_enrich" ] && [ "$hits" -gt 0 ]; then
@@ -223,7 +236,7 @@ cmd_query() {
   esac
 
   local t0 out emit="cat" query_rc
-  t0=$(date +%s)
+  t0=$(_now_ms)
   out=$(_runtime "${args[@]}" 2>&1)
   query_rc=$?
   if [ "$query_rc" -ne 0 ]; then
@@ -235,20 +248,31 @@ cmd_query() {
     } >&2
     return "$query_rc"
   fi
-  # Content-free query telemetry: mode, duration, result count. Never the
-  # query text. This is what makes Runtime/QMD retrieval visible in the
-  # telemetry event list instead of only legacy graph_query rows.
+  # The runtime marks a query that ran without its persistent worker (the
+  # pinned CLI started cold). Strip the marker from the evidence and carry
+  # it into the banner, the telemetry, and a one-line repair hint.
+  local cold=0 cold_json=false
+  if printf '%s\n' "$out" | grep -qx 'EGREGORE_RETRIEVAL_COLD_START'; then
+    cold=1
+    cold_json=true
+    out=$(printf '%s\n' "$out" | grep -vx 'EGREGORE_RETRIEVAL_COLD_START')
+  fi
+  # Content-free query telemetry: mode, duration, result count, degraded
+  # path. Never the query text. This is what makes Runtime/QMD retrieval
+  # visible in the telemetry event list instead of only legacy graph_query rows.
   local _tele_count _tele_ms
-  _tele_ms=$(( ($(date +%s) - t0) * 1000 ))
+  _tele_ms=$(( $(_now_ms) - t0 ))
   _tele_count=$(printf '%s' "$out" | jq 'if type == "array" then length elif type == "object" then (.results // [] | length) else empty end' 2>/dev/null || true)
   if [[ "$_tele_count" =~ ^[0-9]+$ ]]; then
     bash "$SCRIPT_DIR/bin/telemetry.sh" emit "query" \
-      "$(jq -n --arg mode "$label" --argjson d "$_tele_ms" --argjson c "$_tele_count" \
-        '{mode:$mode, duration_ms:$d, count:$c}')" 2>/dev/null &
+      "$(jq -n --arg mode "$label" --argjson d "$_tele_ms" --argjson c "$_tele_count" --argjson cold "$cold_json" \
+        '{mode:$mode, duration_ms:$d, count:$c, degraded:$cold}')" 2>/dev/null &
   else
     bash "$SCRIPT_DIR/bin/telemetry.sh" emit "query" \
-      "$(jq -n --arg mode "$label" --argjson d "$_tele_ms" '{mode:$mode, duration_ms:$d}')" 2>/dev/null &
+      "$(jq -n --arg mode "$label" --argjson d "$_tele_ms" --argjson cold "$cold_json" \
+        '{mode:$mode, duration_ms:$d, degraded:$cold}')" 2>/dev/null &
   fi
+  [ "$cold" = 1 ] && label="${label} · cold start"
 
   [ "$enrich" = 1 ] && emit="_enrich"
   if [ "$context_packet" = 1 ]; then
@@ -263,6 +287,9 @@ cmd_query() {
   else
     _banner_and_emit "$label" "$t0" "$emit" "$out"
   fi
+  if [ "$cold" = 1 ]; then
+    echo "  ↳ the retrieval server was not running, so this query started QMD cold. Repair: bash bin/search.sh start" >&2
+  fi
 }
 
 cmd_reindex() {

package/runtime/claude/egregore_runtime/adapters/qmd.py

@@ -157,6 +157,11 @@ class QmdLocalRetriever:
         self._resolved_command: tuple[str, ...] | None = None
         self._version_checked = False
         self._daemon_available = False
+        # Outcome of the most recent typed query: True when the owned worker
+        # answered, False when the pinned CLI ran cold, None when no query
+        # ran or persistence is disabled. Read by the harness so a slow
+        # retrieval is never silent.
+        self._last_query_used_daemon: bool | None = None
         self._source_revision_cache: str | None = None
         self._configure_isolated_environment()
         self._prefer_usable_node_runtime()
@@ -726,7 +731,10 @@ class QmdLocalRetriever:
         limit: int,
         intent: str,
     ) -> list[dict[str, Any]]:
-        if self._persistent_enabled() and self._ensure_daemon():
+        self._last_query_used_daemon = None
+        if not self._persistent_enabled():
+            daemon_error = "daemon unavailable"
+        elif self._ensure_daemon():
             payload = {
                 "searches": searches,
                 "collections": [self.collection],
@@ -746,6 +754,7 @@ class QmdLocalRetriever:
                     body = json.loads(response.read().decode("utf-8"))
                 results = body.get("results") if isinstance(body, dict) else None
                 if isinstance(results, list):
+                    self._last_query_used_daemon = True
                     return [item for item in results if isinstance(item, dict)]
             except (OSError, ValueError, urllib.error.URLError) as exc:
                 self._daemon_available = False
@@ -754,8 +763,13 @@ class QmdLocalRetriever:
                 daemon_error = str(exc)
             else:
                 daemon_error = "daemon returned an invalid result payload"
+            self._last_query_used_daemon = False
         else:
+            # The owned worker could not be started or reused. The pinned CLI
+            # answers cold; the harness surfaces that instead of a silent
+            # multi-second query.
             daemon_error = "daemon unavailable"
+            self._last_query_used_daemon = False
 
         query_document = "\n".join(
             f"{item['type']}: {self._single_line(item['query'])}" for item in searches
@@ -1009,6 +1023,13 @@ class QmdLocalRetriever:
     def _persistent_enabled(self) -> bool:
         return self.environment.get("EGREGORE_QMD_PERSISTENT", "1") != "0"
 
+    @property
+    def last_query_used_daemon(self) -> bool | None:
+        """True when the last typed query answered through the owned worker,
+        False when it fell back to a cold CLI run, None when no query ran or
+        the persistent worker is disabled for this instance."""
+        return self._last_query_used_daemon
+
     def _ensure_daemon(self) -> bool:
         if not self._persistent_enabled():
             return False
@@ -1153,15 +1174,30 @@ class QmdLocalRetriever:
 
     @staticmethod
     def _port_available(port: int) -> bool:
+        """A port is free only when both loopback families can bind it.
+
+        The worker binds "localhost", which resolves to ::1 as well as
+        127.0.0.1. Probing IPv4 alone reported a port free while a foreign
+        server held [::1] on it; the owned worker then died on bind and every
+        query ran the CLI cold.
+        """
         if port == 8181:
             return False
-        with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as probe:
-            probe.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+        for family, address in (
+            (socket.AF_INET, "127.0.0.1"),
+            (socket.AF_INET6, "::1"),
+        ):
             try:
-                probe.bind(("127.0.0.1", port))
-                return True
+                probe = socket.socket(family, socket.SOCK_STREAM)
             except OSError:
-                return False
+                continue  # family not available on this host
+            with probe:
+                probe.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+                try:
+                    probe.bind((address, port))
+                except OSError:
+                    return False
+        return True
 
     def _allocate_port(self) -> int:
         for _ in range(20):

package/runtime/claude/egregore_runtime/harness_cli.py

@@ -38,7 +38,7 @@ from .runtime import EgregoreRuntime, local_runtime
 _ORG_CONTEXT_PREFETCH_PATTERN = re.compile(
     "|".join(
         (
-            r"\b(find|locate|dig up|look up|pull up)\b.*\b"
+            r"\b(find|locate|dig up|look up|pull up)\b[^\n]*\b"
             r"(handoff|decision|notes?|docs?|meeting|harvest|quest|reflection)s?\b",
             r"\bdid we (decide|discuss|agree|say|talk about|cover)\b",
             r"\bdo we have (any )?(notes?|docs?|anything|something)( on| about)?\b",
@@ -161,6 +161,19 @@ def _clear_observe_receipt(root: Path, harness: str) -> None:
         pass
 
 
+def _actor_contract_marker_path(root: Path, harness: str) -> Path:
+    """Gitignored per-session marker: the full actor/retrieval contract was
+    already attached once. Later prompts receive a short reminder instead of
+    the ~4 KB block. bin/pre-compact.sh removes the marker so the first prompt
+    after a compaction re-attaches the full contract."""
+
+    session = re.sub(r"[^A-Za-z0-9_.-]", "-", _session_id(root))[:120]
+    return (
+        root / ".egregore" / "runtime" / "observe"
+        / f"actor-contract-{harness}-{session}.sent"
+    )
+
+
 def _write_observe_receipt(root: Path, harness: str, prompt: str, context) -> None:
     """Record that this prompt already received useful authorized evidence.
 
@@ -369,9 +382,46 @@ def _query(args: argparse.Namespace) -> int:
             )
         else:
             print("No results found.")
+    retriever = getattr(runtime, "retriever", None)
+    if not args.json and getattr(retriever, "last_query_used_daemon", None) is False:
+        # The owned QMD worker was unavailable and the pinned CLI answered
+        # cold. bin/search.sh turns this marker into a visible "cold start"
+        # note so a slow query is never silent.
+        print("EGREGORE_RETRIEVAL_COLD_START")
     return 0
 
 
+_PASTED_OUTPUT_LINE = re.compile(
+    r"^(?:"
+    r"[ MADRCU?!]{2}\s+\S"          # git status --short / porcelain rows
+    r"|[▶❯»]\s"                     # terminal prompt markers
+    r"|\$\s\S"                      # shell prompt
+    r"|(?:\+\+\+|---|@@)\s"          # unified diff
+    r"|diff --git\b"
+    r"|Traceback \(most recent call last\)"
+    r"|\s+File \"[^\"]+\", line \d+"
+    r"|\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}"  # log timestamps
+    r"|[A-Za-z0-9_./-]+/[A-Za-z0-9_.-]+\.[a-z]{1,6}$"  # a bare path
+    r")"
+)
+
+
+def _looks_like_pasted_output(prompt: str) -> bool:
+    """True for terminal output, diffs, logs, and code blocks pasted into a prompt.
+
+    Those carry words like "handoff", "notes", or "docs" by accident; running a
+    retrieval on them attaches unrelated evidence and costs seconds. The actor
+    context still tells the model to recall once if the prompt truly needs it.
+    """
+
+    if "```" in prompt:
+        return True
+    lines = [line for line in prompt.splitlines() if line.strip()]
+    if len(lines) >= 8:
+        return True
+    return sum(1 for line in lines if _PASTED_OUTPUT_LINE.match(line)) >= 2
+
+
 def prompt_prefetches_org_context(prompt: str) -> bool:
     """Return whether Observe should prefetch likely organizational context.
 
@@ -384,6 +434,7 @@ def prompt_prefetches_org_context(prompt: str) -> bool:
     return bool(
         prompt
         and not _EXPLICIT_SEARCH.search(prompt)
+        and not _looks_like_pasted_output(prompt)
         and (
             _ORG_CONTEXT_PREFETCH_PATTERN.search(prompt)
             or _ORG_RITUAL_CONTEXT_PREFETCH_PATTERN.search(prompt)
@@ -408,8 +459,22 @@ def prompt_requests_actor_context(prompt: str) -> bool:
     return bool(prompt and prompt.strip())
 
 
-def _actor_context_block(runtime: EgregoreRuntime, root: Path, harness: str) -> str:
-    """Render the minimum stable identity needed by harness rituals."""
+_RECALL_ONLY_SCOPE = (
+    "Egregore Runtime is for organizational recall and memory only: team memory, "
+    "decisions, handoffs, meetings, prior work. Code search, file reads, Git, tests, "
+    "and every other task use the harness's normal tools (Grep, Glob, Read, Bash) "
+    "with no retrieval ritual and no Runtime call."
+)
+
+
+def _actor_context_block(
+    runtime: EgregoreRuntime, root: Path, harness: str, *, full: bool = True
+) -> str:
+    """Render the stable identity and the recall contract for harness rituals.
+
+    ``full`` renders the complete contract (once per session); otherwise a
+    short reminder that keeps identity and the recall-only scope in view.
+    """
 
     actor_context = _actor(runtime, root, harness)
     actor = actor_context.actor
@@ -429,6 +494,22 @@ def _actor_context_block(runtime: EgregoreRuntime, root: Path, harness: str) ->
     search_command = 'bash bin/search.sh query "<concept>" -n 6 --compact'
     if harness == "claude":
         search_command += " --context-packet"
+    if not full:
+        return "\n".join(
+            (
+                "EGREGORE_ACTOR_CONTEXT_V1",
+                "Reminder — the full contract was attached earlier in this session.",
+                f"Actor: {actor.display_name} · Actor ID: {actor.actor_id} · "
+                f"Organization ID: {actor_context.profile.org_id} · Runtime root: {root}",
+                _RECALL_ONLY_SCOPE,
+                "When a prompt needs that recall and no EGREGORE_ORG_CONTEXT_V1 block is "
+                f"attached, run exactly one `{search_command}`; exact latest/oldest/open "
+                "handoff questions use `bash bin/search.sh handoffs …` instead.",
+                "`me` and `myself` mean this Actor ID and display name; never infer identity "
+                "from the OS user, Git, or GitHub names.",
+                "END_EGREGORE_ACTOR_CONTEXT_V1",
+            )
+        )
     return "\n".join(
         (
             "EGREGORE_ACTOR_CONTEXT_V1",
@@ -445,6 +526,7 @@ def _actor_context_block(runtime: EgregoreRuntime, root: Path, harness: str) ->
             f"Runtime root: {root}",
             "Run Egregore retrieval and workflow commands from this Runtime root. "
             "Do not fall back to a launch checkout named elsewhere in the session.",
+            _RECALL_ONLY_SCOPE,
             "Organizational retrieval status: NOT_PERFORMED. This actor-only block "
             "does not mean organizational recall is unnecessary.",
             "Interpret the user's intent semantically, without requiring trigger words. "
@@ -681,11 +763,20 @@ def _prompt_hook(args: argparse.Namespace) -> int:
                 args.limit,
             )
         else:
+            marker = _actor_contract_marker_path(root, args.harness)
+            full = not marker.exists()
             additional_context = _actor_context_block(
                 runtime,
                 root,
                 args.harness,
+                full=full,
             )
+            if full:
+                try:
+                    marker.parent.mkdir(parents=True, exist_ok=True)
+                    marker.write_text(datetime.now(UTC).isoformat(), encoding="utf-8")
+                except OSError:
+                    pass
     except Exception as exc:  # Hooks are advisory and must never block a prompt.
         additional_context = (
             "Egregore Runtime context was requested but the Local Runtime is unavailable "

package/runtime/codex/.codex/spec-manifest.json

@@ -53,7 +53,7 @@
     {
       "section": "Egregore Retrieval Beat",
       "action": "keep",
-      "sourceHash": "6c5cbb0d1c9a",
+      "sourceHash": "bb2f214689cb",
       "note": "Kept verbatim — product attribution applies across runtimes."
     },
     {

package/runtime/codex/AGENTS.md

@@ -258,19 +258,21 @@ For each user-directed organizational lookup, show exactly one visible line:
 - retrieval that actually queries the connected graph:
   `⌕ Egregore Connect · searching your organization’s memory and relationships`
 
-Runtime owns retrieval; no agent feature flag does. `EGREGORE_ORG_CONTEXT_V1`
-is only the schema label. When attached, authorized retrieval is complete:
+When `EGREGORE_ORG_CONTEXT_V1` is attached, authorized retrieval is complete:
 never query again that turn, and state any evidence gap. `OPENED_BY_OBSERVE`
 means the evidence is open. A later explicit search starts a new turn.
 
-**Visibility is the contract.** Emit it verbatim as a
-standalone assistant message before the first Bash, Grep, Glob, Read, or other
-retrieval tool call.
-Shell/tool output does not satisfy this requirement. Do not paraphrase the line.
+**Scope.** Egregore Runtime is for organizational recall only: team memory,
+decisions, handoffs, prior work. Code, files, Git, and tests use the harness's
+normal tools, with no beat and no Runtime call.
 
-Use the memory form normally; use Connect only for an explicit graph traversal
-that actually runs. Emit once per episode. A `bin/search.sh` banner is only a
-shell fallback and does not replace this visible beat.
+**Visibility is the contract.** Emit it verbatim as a standalone assistant
+message before the first tool call that performs the organizational recall
+(the `bin/search.sh` query or a graph read). Tool output does not satisfy it.
+Do not paraphrase the line.
+
+Use Connect only for a graph traversal that actually runs. Emit once per
+episode.
 
 **Routing:** Organizational recall always enters Egregore Runtime. The model is
 the semantic intent authority, deciding from meaning rather than fixed phrases.
@@ -285,15 +287,14 @@ Search output is model-internal: show only the retrieval line and receipts —
 never ranked blocks, file/rank/excerpt metadata, or raw JSON.
 
 Do not resolve `memory/` to its sibling repo or start with raw `grep`/`ls`.
-Search owns lexical/semantic selection and attaches no graph by default. Open a
-source only when its excerpt cannot support a necessary claim. For current
+Search attaches no graph by default. Open a source only when its excerpt
+cannot support a necessary claim. For current
 team/person synthesis, retain known organization/member names and choose
-`--recent-days` plus `--min-evidence`. Use native
-Grep/Glob for code and exact errors. `$activity`, `$dashboard`, and `$project`
+`--recent-days` plus `--min-evidence`. `$activity`, `$dashboard`, and `$project`
 display bounded status surfaces only when named or directly requested as a
-card. Questions asking for an explained synthesis of current organizational
-work are Runtime/QMD recall, as is prior-work discovery. Do not run full
-hybrid retrieval on unrelated prompts or infer graph from recall intent.
+card. Explained syntheses of current organizational work and prior-work
+discovery are Runtime/QMD recall. Do not run retrieval on unrelated prompts or
+infer graph from recall intent.
 
 Do not emit the beat for code search, Git inspection, startup hydration, graph
 writes, ingestion, background sync, maintenance, or internal queries.

package/runtime/codex/bin/codex-render-spec.mjs

@@ -157,9 +157,8 @@ const NON_SKILL_TOKENS = new Set(['loop', 'fast', 'config', 'clear', 'help']);
 // hook delivers there. Rewrite the fallback command to the stdout form and
 // state the same hygiene contract in shell terms: search output is
 // model-internal; the visible reply carries only the retrieval line.
-const CLAUDE_PACKET_NOTE = `\`--context-packet\` keeps the evidence out of the visible transcript and
-attaches it privately; the visible output is the attribution line alone.
-Never re-print ranked results, file/rank/excerpt metadata, or raw JSON.`;
+const CLAUDE_PACKET_NOTE = `\`--context-packet\` attaches the evidence privately; the visible output is the
+attribution line alone. Never re-print ranked results or raw JSON.`;
 const SHELL_PACKET_NOTE = `Search output is model-internal: show only the retrieval line and receipts —
 never ranked blocks, file/rank/excerpt metadata, or raw JSON.`;
 

package/runtime/codex/bin/search.sh

@@ -32,6 +32,19 @@ _maintenance_runtime() {
     python3 -m egregore_runtime.adapters.qmd_cli "$@"
 }
 
+_now_ms() {
+  if command -v perl >/dev/null 2>&1; then
+    perl -MTime::HiRes=time -e 'printf("%d\n", time() * 1000)'
+  else
+    echo $(( $(date +%s) * 1000 ))
+  fi
+}
+
+_elapsed_s() {
+  # One-decimal seconds since a _now_ms() timestamp.
+  awk -v ms="$(( $(_now_ms) - $1 ))" 'BEGIN { printf "%.1f", ms / 1000 }'
+}
+
 _result_paths() {
   local line path canonical_prefix
   canonical_prefix="**file:** \`memory/"
@@ -125,14 +138,14 @@ _banner_and_emit() {
     actual="${actual%% *}"
     required="${gap#*required=}"
     required="${required%% *}"
-    dur=$(( $(date +%s) - t0 ))
+    dur=$(_elapsed_s "$t0")
     printf '⌕ Egregore · searching your organization’s memory · %s · evidence gap · %s/%s sources · %ss\n\n' \
       "$label" "$actual" "$required" "$dur"
     [ "$hide_results" = 1 ] || printf '%s\n' "$out" | tail -n +2
     return 0
   fi
   hits=$(printf '%s\n' "$out" | _result_paths | wc -l | tr -d ' ')
-  dur=$(( $(date +%s) - t0 ))
+  dur=$(_elapsed_s "$t0")
   product="Egregore"
   surface="searching your organization’s memory"
   if [ "$emit" = "_enrich" ] && [ "$hits" -gt 0 ]; then
@@ -223,7 +236,7 @@ cmd_query() {
   esac
 
   local t0 out emit="cat" query_rc
-  t0=$(date +%s)
+  t0=$(_now_ms)
   out=$(_runtime "${args[@]}" 2>&1)
   query_rc=$?
   if [ "$query_rc" -ne 0 ]; then
@@ -235,20 +248,31 @@ cmd_query() {
     } >&2
     return "$query_rc"
   fi
-  # Content-free query telemetry: mode, duration, result count. Never the
-  # query text. This is what makes Runtime/QMD retrieval visible in the
-  # telemetry event list instead of only legacy graph_query rows.
+  # The runtime marks a query that ran without its persistent worker (the
+  # pinned CLI started cold). Strip the marker from the evidence and carry
+  # it into the banner, the telemetry, and a one-line repair hint.
+  local cold=0 cold_json=false
+  if printf '%s\n' "$out" | grep -qx 'EGREGORE_RETRIEVAL_COLD_START'; then
+    cold=1
+    cold_json=true
+    out=$(printf '%s\n' "$out" | grep -vx 'EGREGORE_RETRIEVAL_COLD_START')
+  fi
+  # Content-free query telemetry: mode, duration, result count, degraded
+  # path. Never the query text. This is what makes Runtime/QMD retrieval
+  # visible in the telemetry event list instead of only legacy graph_query rows.
   local _tele_count _tele_ms
-  _tele_ms=$(( ($(date +%s) - t0) * 1000 ))
+  _tele_ms=$(( $(_now_ms) - t0 ))
   _tele_count=$(printf '%s' "$out" | jq 'if type == "array" then length elif type == "object" then (.results // [] | length) else empty end' 2>/dev/null || true)
   if [[ "$_tele_count" =~ ^[0-9]+$ ]]; then
     bash "$SCRIPT_DIR/bin/telemetry.sh" emit "query" \
-      "$(jq -n --arg mode "$label" --argjson d "$_tele_ms" --argjson c "$_tele_count" \
-        '{mode:$mode, duration_ms:$d, count:$c}')" 2>/dev/null &
+      "$(jq -n --arg mode "$label" --argjson d "$_tele_ms" --argjson c "$_tele_count" --argjson cold "$cold_json" \
+        '{mode:$mode, duration_ms:$d, count:$c, degraded:$cold}')" 2>/dev/null &
   else
     bash "$SCRIPT_DIR/bin/telemetry.sh" emit "query" \
-      "$(jq -n --arg mode "$label" --argjson d "$_tele_ms" '{mode:$mode, duration_ms:$d}')" 2>/dev/null &
+      "$(jq -n --arg mode "$label" --argjson d "$_tele_ms" --argjson cold "$cold_json" \
+        '{mode:$mode, duration_ms:$d, degraded:$cold}')" 2>/dev/null &
   fi
+  [ "$cold" = 1 ] && label="${label} · cold start"
 
   [ "$enrich" = 1 ] && emit="_enrich"
   if [ "$context_packet" = 1 ]; then
@@ -263,6 +287,9 @@ cmd_query() {
   else
     _banner_and_emit "$label" "$t0" "$emit" "$out"
   fi
+  if [ "$cold" = 1 ]; then
+    echo "  ↳ the retrieval server was not running, so this query started QMD cold. Repair: bash bin/search.sh start" >&2
+  fi
 }
 
 cmd_reindex() {