mover-os 4.7.8 → 4.7.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mover-os",
-  "version": "4.7.8",
+  "version": "4.7.10",
   "description": "Your AI co-founder. Remembers your goals, pushes back when you drift. Works with 15 AI agents.",
   "bin": {
     "moveros": "install.js"
@@ -16,7 +16,8 @@
     "src/dashboard/templates/**",
     "src/dashboard/static/**",
     "src/dashboard/lib/**",
-    "src/dashboard/ui/dist/**"
+    "src/dashboard/ui/dist/**",
+    "src/system/counts.json"
   ],
   "scripts": {
     "test": "node test/runner.mjs",

package/src/dashboard/build.js

@@ -449,10 +449,18 @@ async function build({ vault, version }) {
   // What to call the operator: config userName (user-editable in Configure)
   // wins, then the Identity_Prime H1 name written by onboarding. Never a
   // folder or account name — an honest null greets namelessly instead.
+  // Plausibility gate: pre-4.7.9 onboarding could store a whole identity
+  // sentence as the name ("I'm a 24-year-old freelance photographer...").
+  // A greeting name reads as a callsign; anything sentence-shaped greets
+  // namelessly instead (wrong name is worse than no name).
+  const plausibleName = (s) =>
+    typeof s === "string" && s.trim() && s.trim().length <= 32 &&
+    !/[.!?\n:;]/.test(s.trim()) && s.trim().split(/\s+/).length <= 3
+      ? s.trim() : null;
   const cfgForName = tryParse("config", () => require("./lib/config-parser").read(), {});
   const profileName =
-    (cfgForName && typeof cfgForName.userName === "string" && cfgForName.userName.trim()) ||
-    (identity && identity.name) || null;
+    plausibleName(cfgForName && cfgForName.userName) ||
+    plausibleName(identity && identity.name) || null;
 
   const stateJson = {
     builtAt: builtAt.toISOString(),
@@ -662,7 +670,10 @@ async function build({ vault, version }) {
       };
     })(),
     projects: (() => {
-      const out = tryParse("projects", () => projectScanner.scanProjects(vault, { limit: 12 }), { available: false, projects: [] });
+      // limit 1000 = effectively all. The old 12 silently hid 20 of the
+      // owner's 32 projects from the Library shelf; he ruled: show all,
+      // split active/dormant (2026-07-12). Consumers that want fewer slice.
+      const out = tryParse("projects", () => projectScanner.scanProjects(vault, { limit: 1000 }), { available: false, projects: [] });
       if (!out || !out.available) return { available: false, projects: [], totalCount: 0 };
       return {
         available: true,
@@ -767,6 +778,17 @@ async function build({ vault, version }) {
       } catch (_) { return { available: false, outcomes: [] }; }
     })(),
     overrideSummary,
+    // Core-loop TRIAL MODE (SCHEMA-SPEC v0.2 section 2, wired 2026-07-12):
+    // compares the legacy override count against override.logged events and
+    // logs movement to State/trial-deltas.jsonl. The UI keeps rendering the
+    // LEGACY values everywhere; this field only makes the gap observable.
+    // Best-effort: unmigrated vaults report available:false and nothing runs.
+    stateCoreTrial: (() => {
+      try {
+        const { runTrial } = require("./lib/state-core/trial");
+        return runTrial({ vault, manifestOverrideCount: overrideEntries.length });
+      } catch (_) { return { available: false, reason: "trial module unavailable" }; }
+    })(),
     refusals: (() => {
       // False-zero discipline (T261): full RefusalsData shape on parse failure
       // so count/count7d/recent are never undefined under available:false.
@@ -1028,6 +1050,22 @@ function activeContextForState(ac, manifest) {
     activeSessions: ac.activeSessions || [],
     backlog: ac.backlog || [],
     commitments: ac.commitments || [],
+    // Workflow State bus timestamps (log_last_run etc). Evidence needs these:
+    // activation-log only sees DASHBOARD-launched runs, so it claimed "0
+    // workflow runs this week" while /log had run three times that day in
+    // the terminal (owner-caught, 2026-07-10). These timestamps are written
+    // by the workflows themselves, so they cover both paths. Whitelisted to
+    // *_last_run keys: the section parser also slurps stray session-log
+    // fields (a "latest_delta_..." key carried a whole session summary blob).
+    workflowState: (() => {
+      const ws = ac.workflowState;
+      if (!ws || typeof ws !== "object") return null;
+      const out = {};
+      for (const [k, v] of Object.entries(ws)) {
+        if (/_last_run$/.test(k) && typeof v === "string" && v.length <= 32) out[k] = v;
+      }
+      return Object.keys(out).length ? out : null;
+    })(),
     // v6 SURFACE 5 — buried ideas, for the Say-it graveyard echo. Exposed
     // raw; the client extracts name/reason/date/cost (strict gate: no stanza
     // unless all parse).

package/src/dashboard/lib/active-context-parser.js

@@ -84,13 +84,17 @@ function parseActiveContext(vault) {
   };
 
   result.workflowState = (() => {
+    // A "## Workflow State" section whose body didn't parse into fields is
+    // {} — truthy, so the old `if (ws && ws.fields)` made the top-of-file
+    // fallback dead code and the dashboard claimed "no /log run today" while
+    // log_last_run sat in the preface (R5-A). Merge: section fields win,
+    // preface fields fill whatever the section is missing.
     const ws = result.findSection("workflow state");
-    if (ws && ws.fields) return ws.fields;
-    // Fallback: top-of-file fields
     const out = {};
     for (const k of ["log_last_run", "analyse_day_last_run", "weekly_review_last_run", "pivot_strategy_last_run", "monthly_review_last_run", "review_week_day", "friction_escalation"]) {
       if (result.fields[k]) out[k] = result.fields[k];
     }
+    if (ws && ws.fields) Object.assign(out, ws.fields);
     return out;
   })();
 
@@ -123,8 +127,15 @@ function parseBulletList(section, kind) {
   const lines = section.body.split("\n");
   const items = [];
   for (const line of lines) {
-    const m = line.match(/^[-*]\s*\[(.)\]\s*(.+)$/) || line.match(/^[-*]\s+(.+)$/);
+    // Leading whitespace allowed: nested bullets (a normal Obsidian outliner
+    // habit) were silently dropped from BACKLOG/WAITING FOR/COMMITMENTS (R5-A).
+    // They still parse as items, but carry nested:true so surfaces that list
+    // top-level obligations (Home's Loose Ends) can skip them — a sub-bullet
+    // is an annotation on its parent (e.g. an "[UPDATE]" note), not its own
+    // waiting-on-someone row (owner screenshot, 2026-07-12).
+    const m = line.match(/^\s*[-*]\s*\[(.)\]\s*(.+)$/) || line.match(/^\s*[-*]\s+(.+)$/);
     if (m) {
+      const nested = /^\s/.test(line);
       if (m.length === 3) {
         const checked = m[1] === "x" || m[1] === "X";
         const text = m[2].trim();
@@ -140,12 +151,13 @@ function parseBulletList(section, kind) {
         items.push({
           checked,
           done: checked,
+          nested,
           text,
           raw: line.trim(),
           ...meta,
         });
       } else {
-        items.push({ checked: null, done: null, text: m[1].trim(), raw: line.trim() });
+        items.push({ checked: null, done: null, nested, text: m[1].trim(), raw: line.trim() });
       }
     }
   }

package/src/dashboard/lib/agent-session.js

@@ -31,53 +31,16 @@
  */
 
 const { spawn } = require("child_process");
-const os = require("os");
-const path = require("path");
-const fs = require("fs");
+const crypto = require("crypto");
+const { StringDecoder } = require("string_decoder");
 
 // ─── crash-orphan markers (MF2) ──────────────────────────────────────────────
 // Each live session's pid (== its process-group id, since detached) is recorded
 // with the owning dashboard's pid. On startup a fresh manager reaps any group
 // whose OWNER process is gone — i.e. children escaped by a crashed dashboard.
-// One file per session pid (Codex r2-MF2): eliminates the shared-file
-// read-modify-write race across concurrent dashboards, and a corrupt write only
-// loses its own marker. Writes are atomic (tmp + rename).
-const MARKERS_DIR = path.join(os.homedir(), ".mover", "dashboard", "agent-pids");
-
-function markerPath(pid) { return path.join(MARKERS_DIR, String(pid) + ".json"); }
-function writeMarker(pid, data) {
-  try {
-    fs.mkdirSync(MARKERS_DIR, { recursive: true });
-    const f = markerPath(pid), tmp = f + ".tmp";
-    fs.writeFileSync(tmp, JSON.stringify(data));
-    fs.renameSync(tmp, f); // atomic: a reader never sees a half-written marker
-  } catch (_) {}
-}
-function removeMarker(pid) { try { fs.unlinkSync(markerPath(pid)); } catch (_) {} }
-function readMarkers() {
-  let files; try { files = fs.readdirSync(MARKERS_DIR); } catch (_) { return []; }
-  const out = [];
-  for (const fn of files) {
-    if (!fn.endsWith(".json")) continue;
-    try { out.push(JSON.parse(fs.readFileSync(path.join(MARKERS_DIR, fn), "utf8"))); } catch (_) {}
-  }
-  return out;
-}
-function isAlive(pid) {
-  if (!pid) return false;
-  try { process.kill(pid, 0); return true; } catch (e) { return e && e.code === "EPERM"; }
-}
-// True if ANY member of the process group still exists (not just the leader) —
-// process.kill(-pid, 0) throws ESRCH only when the whole group is gone.
-function groupAlive(pid) {
-  if (!pid) return false;
-  try { process.kill(-pid, 0); return true; } catch (e) { return e && e.code === "EPERM"; }
-}
-function killGroup(pid, sig) {
-  if (!pid) return false;
-  try { process.kill(-pid, sig); return true; }
-  catch (_) { try { process.kill(pid, sig); return true; } catch (__) { return false; } }
-}
+// Shared with RunRegistry (R5-A) via lib/pid-markers.js so Run-tab children
+// get the identical guarantee; the marker dir is common on purpose.
+const { writeMarker, removeMarker, readMarkers, isAlive, groupAlive, killGroup } = require("./pid-markers");
 
 // ─── setup framing + tool lockout ────────────────────────────────────────────
 // The interview is the single source the Engine is written from, so depth matters.
@@ -265,8 +228,24 @@ class AgentSessionManager {
     const adapter = ADAPTERS[agent];
     if (!adapter) throw new Error(`Unknown agent: ${agent}`);
     if (adapter.unsupported) throw new Error(adapter.unsupported);
+    // Concurrency cap (R5-A): each session is a live CLI child; a retry loop
+    // must not stack them. 6 covers Chat + onboarding + walkthrough headroom.
+    let liveCount = 0;
+    for (const s of this.sessions.values()) if (!s.closed) liveCount++;
+    if (liveCount >= 6) {
+      const err = new Error("6 agent sessions are already open. Close one first.");
+      err.code = "SESSION_LIMIT";
+      throw err;
+    }
 
-    const id = `sess_${process.pid}_${++this._seq}`;
+    // terra session F1 (2026-07-11): the id was `sess_<pid>_<seq>` — deterministic,
+    // so a second same-origin tab could DERIVE another tab's id (pid shared, seq
+    // sequential) and read its SSE transcript / send / approve into it (the token
+    // is process-global, not per-session). Use an unguessable random id: the id
+    // itself is the per-session capability. `++this._seq` kept for internal
+    // ordering/telemetry only, never for addressing.
+    ++this._seq;
+    const id = `sess_${crypto.randomBytes(16).toString("hex")}`;
     // MOVER_STUDIO_RUN=1 marks every dashboard-spawned agent (onboarding
     // interview, walkthrough, and any future workflow run routed here) so the
     // global lifecycle hooks early-exit: an interview that ends must not fire
@@ -291,6 +270,9 @@ class AgentSessionManager {
       transcript: [],
       pending: new Map(),
       stdoutBuf: "",
+      // terra session F3: a stateful UTF-8 decoder so a multibyte char split
+      // across stdout chunks is not corrupted (each chunk was decoded alone).
+      decoder: new StringDecoder("utf8"),
       lastActivity: Date.now(),
       closed: false,
       lastStderr: "",
@@ -309,9 +291,25 @@ class AgentSessionManager {
     return { sessionId: id };
   }
 
+  // Transcript byte cap (R5-A): an active long chat (or repeated file
+  // ingests) grew memory without bound — the idle sweep only reclaims
+  // INACTIVE sessions. Cap total retained chars, dropping the oldest turns;
+  // the agent CLI holds its own context, so trimming here only affects
+  // replay-on-reattach depth, never the conversation itself.
+  _pushTranscript(sess, entry) {
+    sess.transcript.push(entry);
+    sess.transcriptBytes = (sess.transcriptBytes || 0) + entry.text.length;
+    const CAP = 4 * 1024 * 1024;
+    while (sess.transcriptBytes > CAP && sess.transcript.length > 1) {
+      const dropped = sess.transcript.shift();
+      sess.transcriptBytes -= dropped.text.length;
+      sess.transcriptTruncated = true;
+    }
+  }
+
   send(sessionId, text) {
     const sess = this._require(sessionId);
-    sess.transcript.push({ role: "user", text: String(text) });
+    this._pushTranscript(sess, { role: "user", text: String(text) });
     sess.lastActivity = Date.now();
     try { sess.child.stdin.write(sess.adapter.encodeTurn(text)); }
     catch (e) { throw new Error(`send failed: ${e.message}`); }
@@ -366,7 +364,17 @@ class AgentSessionManager {
 
   _onStdout(sess, chunk) {
     sess.lastActivity = Date.now();
-    sess.stdoutBuf += chunk.toString("utf8");
+    // F3: decode through the per-session StringDecoder (holds a partial trailing
+    // multibyte char until its continuation bytes arrive).
+    sess.stdoutBuf += sess.decoder.write(chunk);
+    // terra session F4: a newline-free line must not grow the buffer without
+    // bound (a malformed/stalled provider stream). Cap the PENDING line; over the
+    // cap, drop the un-parseable partial and surface an error instead of leaking
+    // memory. A real stream-json line is far under 8 MiB.
+    if (sess.stdoutBuf.length > 8 * 1024 * 1024) {
+      sess.stdoutBuf = "";
+      this._emit(sess, { kind: "error", message: "[mover-studio] agent stream exceeded the line limit; dropping malformed output." });
+    }
     let nl;
     while ((nl = sess.stdoutBuf.indexOf("\n")) >= 0) {
       const line = sess.stdoutBuf.slice(0, nl).trim();
@@ -377,7 +385,7 @@ class AgentSessionManager {
       const ev = sess.adapter.normalize(obj);
       if (!ev) continue;
       if (ev.kind === "_session") { sess.agentSessionId = ev.sessionId; continue; }
-      if (ev.kind === "assistant") sess.transcript.push({ role: "assistant", text: ev.text });
+      if (ev.kind === "assistant") this._pushTranscript(sess, { role: "assistant", text: ev.text });
       if (ev.kind === "permission" && ev.requestId) sess.pending.set(ev.requestId, ev.request);
       this._emit(sess, ev);
     }
@@ -394,11 +402,24 @@ class AgentSessionManager {
     sess.closed = true;
     const pid = sess.child && sess.child.pid;
     try { sess.child.stdin.end(); } catch (_) {}
-    if (pid) this._removeMarker(pid);
     this.sessions.delete(sess.id);
     killGroup(pid, "SIGTERM");
-    const t = setTimeout(() => { if (groupAlive(pid)) killGroup(pid, "SIGKILL"); }, 2500);
-    if (t.unref) t.unref();
+    // terra run-path F1: do NOT drop the orphan-recovery marker up-front. The old
+    // code removed it immediately, then SIGKILL'd after 2.5s — so a TERM-ignoring
+    // tool child that outlived that window was left with NO marker, and if the
+    // dashboard exited meanwhile (the session already deleted, so shutdownAll
+    // skips it) the child was permanently orphaned. Keep the marker until the
+    // whole GROUP is actually dead, escalating to SIGKILL — mirrors
+    // _cleanupAsync. Non-blocking (unref'd poll), so end()/idle stay synchronous.
+    const start = Date.now();
+    let killed = false;
+    const tick = () => {
+      if (!pid || !groupAlive(pid)) { if (pid) this._removeMarker(pid); return; }
+      if (!killed && Date.now() - start >= 2500) { killGroup(pid, "SIGKILL"); killed = true; }
+      if (killed && Date.now() - start >= 3200) { if (!groupAlive(pid)) this._removeMarker(pid); return; }
+      const t = setTimeout(tick, 150); if (t.unref) t.unref();
+    };
+    tick();
   }
 
   // Awaitable cleanup (shutdown). SIGTERM, resolve on child 'close', escalate to

package/src/dashboard/lib/approval-registry.js

@@ -0,0 +1,170 @@
+"use strict";
+
+/**
+ * approval-registry.js — packet #2 rider: dashboard-owned Engine-write
+ * approval (OWNER-DECISIONS.md, "Packet #2 VERIFICATION VERDICT").
+ *
+ * WHY: Codex/Gemini PreToolUse "ask" on a core Engine file currently converts
+ * to a hard deny in mover-hook-adapter.js (isPermissionDecision branch),
+ * because neither agent supports an interactive terminal prompt. The owner's
+ * rider: for a DASHBOARD-launched run, Mover Studio owns the UI, so the
+ * daemon can hold a real pending approval and let the user answer it from
+ * the browser instead of always denying.
+ *
+ * This registry is the server-held half of that flow: create a pending
+ * approval (tokened POST from the hook adapter), poll its status (tokened
+ * GET, the hook's poll loop), list pending ones (GET, dashboard UI), and
+ * resolve one (tokened POST, dashboard UI click). In-memory only, mirrors
+ * RunRegistry / AgentSessionManager: a daemon restart clears everything,
+ * which is correct — a pending approval only makes sense against a live run.
+ *
+ * TTL expiry resolves as DENY (fail closed), same contract as the hook
+ * adapter's existing unconditional deny it is meant to soften, never worsen.
+ *
+ * NOTE (2026-07-11): nothing currently calls request() in production. The
+ * hook-adapter wiring that would create these (mover-hook-adapter.js's
+ * ask->deny conversion) was evaluated and NOT changed — the Codex/Gemini
+ * host hook timeout (5s, ~/.codex/hooks.json PreToolUse Edit|Write|apply_patch
+ * / install.js generateGeminiHooks BeforeTool write_file|replace) leaves no
+ * safety-margin room for a human-reviewable wait; see dev/plan.md
+ * T-PACKET2-RIDER-1 for the full evidence trail. This module is real,
+ * tested, standalone infrastructure ready for that follow-up.
+ */
+
+const crypto = require("crypto");
+
+const DEFAULTS = {
+  ttlMs: 60 * 1000,           // ask (owner rider): TTL expiry resolves as deny
+  maxPending: 50,             // bound memory; evict oldest non-pending first
+  sweepMs: 30 * 1000,         // periodic cleanup cadence
+  graceMs: 5 * 60 * 1000,     // keep a decided/expired record this long so a
+                               // late poll still reads the real outcome
+};
+
+const MAX_LEN = { agent: 32, file: 1024, tool: 64, excerpt: 4000 };
+
+function capString(v, max, field) {
+  const s = String(v == null ? "" : v);
+  if (!s.trim()) throw new Error(`${field} is required`);
+  return s.length > max ? s.slice(0, max) : s;
+}
+
+class ApprovalRegistry {
+  constructor(opts = {}) {
+    this.opt = { ...DEFAULTS, ...opts };
+    this.pending = new Map(); // id -> record
+    this._sweep = setInterval(() => this._evict(), this.opt.sweepMs);
+    if (this._sweep.unref) this._sweep.unref();
+  }
+
+  /**
+   * Create a pending approval. spec: { agent, file, tool, excerpt }.
+   * Returns the record (id, expiresAt, status:"pending").
+   */
+  request(spec) {
+    const s = spec || {};
+    const agent = capString(s.agent, MAX_LEN.agent, "agent");
+    const file = capString(s.file, MAX_LEN.file, "file");
+    const tool = String(s.tool == null ? "" : s.tool).slice(0, MAX_LEN.tool);
+    const excerpt = String(s.excerpt == null ? "" : s.excerpt).slice(0, MAX_LEN.excerpt);
+
+    this._trimCount();
+
+    const id = crypto.randomBytes(16).toString("hex");
+    const createdAt = Date.now();
+    const rec = {
+      id,
+      agent,
+      file,
+      tool,
+      excerpt,
+      createdAt,
+      expiresAt: createdAt + this.opt.ttlMs,
+      status: "pending",
+      decidedAt: null,
+      decidedReason: null,
+    };
+    this.pending.set(id, rec);
+    return rec;
+  }
+
+  /**
+   * Look up a record and resolve TTL expiry lazily (a poll after the TTL
+   * elapsed sees "denied", even if no sweep has run yet). Returns null if
+   * the id was never issued or has aged out of the grace window.
+   */
+  get(id) {
+    const rec = this.pending.get(String(id || ""));
+    if (!rec) return null;
+    if (rec.status === "pending" && Date.now() > rec.expiresAt) {
+      rec.status = "denied";
+      rec.decidedAt = Date.now();
+      rec.decidedReason = "timeout";
+    }
+    return rec;
+  }
+
+  /** All currently PENDING (not yet decided, not yet expired) approvals. */
+  listPending() {
+    const out = [];
+    for (const id of this.pending.keys()) {
+      const rec = this.get(id); // applies TTL-expiry lazily
+      if (rec && rec.status === "pending") out.push({ ...rec });
+    }
+    return out;
+  }
+
+  /**
+   * Resolve a pending approval. Returns { ok, code, status, error }.
+   * - unknown/aged-out id -> { ok:false, code:404 }
+   * - already decided (approved/denied/timeout) -> { ok:false, code:409 }
+   * - success -> { ok:true, status: "approved"|"denied" }
+   */
+  respond(id, approve) {
+    const rec = this.get(id);
+    if (!rec) return { ok: false, code: 404, error: "no such approval" };
+    if (rec.status !== "pending") {
+      return { ok: false, code: 409, error: `already ${rec.status}` };
+    }
+    rec.status = approve === true ? "approved" : "denied";
+    rec.decidedAt = Date.now();
+    rec.decidedReason = "response";
+    return { ok: true, status: rec.status };
+  }
+
+  /** Cap the number of retained records: drop the oldest DECIDED ones first,
+   *  never a live pending one, so a burst of writes can't push out a request
+   *  a human hasn't answered yet. */
+  _trimCount() {
+    if (this.pending.size < this.opt.maxPending) return;
+    const decided = [...this.pending.values()]
+      .filter((r) => r.status !== "pending")
+      .sort((a, b) => a.createdAt - b.createdAt);
+    while (this.pending.size >= this.opt.maxPending && decided.length) {
+      this.pending.delete(decided.shift().id);
+    }
+    // Degenerate case: still at cap and every record is genuinely pending
+    // (a flood). Drop the oldest pending rather than grow unbounded; it
+    // will read as a denial to whichever caller is waiting on it, which is
+    // the fail-closed outcome anyway.
+    if (this.pending.size >= this.opt.maxPending) {
+      const oldest = [...this.pending.values()].sort((a, b) => a.createdAt - b.createdAt)[0];
+      if (oldest) this.pending.delete(oldest.id);
+    }
+  }
+
+  _evict() {
+    const now = Date.now();
+    for (const rec of [...this.pending.values()]) {
+      const decidedAt = rec.status === "pending" ? null : (rec.decidedAt || rec.expiresAt);
+      if (decidedAt && now - decidedAt > this.opt.graceMs) this.pending.delete(rec.id);
+    }
+  }
+
+  /** Test/shutdown hygiene: stop the sweep timer. */
+  stop() {
+    if (this._sweep) { clearInterval(this._sweep); this._sweep = null; }
+  }
+}
+
+module.exports = { ApprovalRegistry, DEFAULTS };

package/src/dashboard/lib/daily-note-resolver.js

@@ -88,14 +88,17 @@ function resolveDailyNotes(vault, options = {}) {
   const yyyy = sessionDate.getFullYear();
   const yyyyMm = `${yyyy}-${String(sessionDate.getMonth() + 1).padStart(2, "0")}`;
   const monthDir = path.join(dailiesDir(vault), yyyyMm);
-  out.totalThisMonth = safeListDir(monthDir, { extension: ".md" }).length;
+  // Count only real daily notes — cloud-sync artifacts ("Daily - 2026-07-10
+  // (conflicted copy).md", "Daily - 2026-07-10 2.md") inflated the totals.
+  const isDailyNote = (e) => /^Daily - \d{4}-\d{2}-\d{2}\.md$/.test(e.name);
+  out.totalThisMonth = safeListDir(monthDir, { extension: ".md" }).filter(isDailyNote).length;
 
   // This year — sum across all month folders
   const yearDirs = safeListDir(dailiesDir(vault), { dirsOnly: true })
     .filter(e => e.name.startsWith(`${yyyy}-`));
   let yearCount = 0;
   for (const yd of yearDirs) {
-    yearCount += safeListDir(yd.path, { extension: ".md" }).length;
+    yearCount += safeListDir(yd.path, { extension: ".md" }).filter(isDailyNote).length;
   }
   out.totalThisYear = yearCount;
 
@@ -133,7 +136,21 @@ function parseJournal(text) {
   const nextTop = sect.search(/^#{1,2}\s/m);
   if (nextTop > 0) sect = sect.slice(0, nextTop);
   const under = (re) => { const m = sect.match(re); return m ? cleanLine(m[1]) : null; };
-  const num = (line) => { if (!line) return null; const m = line.match(/\b(?:10|[1-9])\b/); return m ? Number(m[0]) : null; };
+  // A score must be ANCHORED, never the leftmost digit in prose — "Day 3 in a
+  // row, honestly a 7/10" read as 3 and corrupted the calibration gap (R5-A).
+  // Accepted shapes, in order: "7/10" anywhere; "Score: 7" / "Energy: 7";
+  // a leading first-token number (the journal endpoint's own format,
+  // "7 — scattered but shipped") unless it's a time/duration ("5 hours…").
+  // Anything else = null (never a guess).
+  const num = (line) => {
+    if (!line) return null;
+    let m = line.match(/\b(10|[1-9])\s*\/\s*10\b/);
+    if (m) return Number(m[1]);
+    m = line.match(/\b(?:score|energy)\s*[:=]?\s*(10|[1-9])\b/i);
+    if (m) return Number(m[1]);
+    m = line.match(/^\s*(10|[1-9])\b(?!\s*(?:am|pm|h\b|hr|hour|min|:|%))/i);
+    return m ? Number(m[1]) : null;
+  };
 
   const evScoreLine = under(/###[^\n]*evening[^\n]*score[^\n]*\n+([^\n#][^\n]*)/i);
   const evening = {

package/src/dashboard/lib/date-utils.js

@@ -32,4 +32,12 @@ function sessionDateKey(date = new Date()) {
   return localDateKey(d);
 }
 
-module.exports = { localDateKey, localMidnight, sessionDateKey };
+// Midnight of the SESSION day (see sessionDateKey) as a Date — for parsers
+// that bucket by day and must agree with the T245 convention.
+function sessionMidnight(date = new Date()) {
+  const d = date instanceof Date ? new Date(date.getTime()) : new Date(date);
+  if (d.getHours() < 5) d.setDate(d.getDate() - 1);
+  return localMidnight(d);
+}
+
+module.exports = { localDateKey, localMidnight, sessionDateKey, sessionMidnight };