v7.9.17: trajectory calibration

A silent calibration observer checks each committed trajectory cycle's self-statements against what the numbers actually did. Only the two fields with cycle-reconstructable ground truth get a ternary sign-score: growth from the success-rate trend in the durable event journal, weakness from a capability snapshot taken at commit and kept so a later prune cannot erase the comparison point. The other four fields are recorded as positions only, each for its own reason. The claimed direction is read at commit by a separate neutral classifier - never Genesis judging itself - and a commit made offline records an explicit absence rather than a guess. Two append-only side files, no schema change; a new fire-and-forget commit event the observer listens to, one way only; and a prediction-mechanism-review thought emitted only by /trajectory review, never on a timer. Nothing acts on the scores yet; this is the observation phase. /trajectory review scores the latest cycle, /trajectory calibration shows the history and per-field null-rate.

Author: Garrus800-stack

ARCHITECTURE.md

@@ -9,7 +9,7 @@
 
 Genesis is a self-modifying AI agent that runs as an Electron desktop app. It talks to LLM backends (Ollama local, Anthropic, OpenAI-compatible), plans multi-step tasks, writes and verifies code, modifies its own source, and monitors its own health. It has an organism-inspired layer that regulates behavior under stress and a lightweight awareness system that gates self-modification via coherence checks.
 
-The codebase is ~119k LOC of JavaScript (CommonJS), 383 source modules, with zero external runtime frameworks. The manifest statically registers 167 DI-managed services. During boot, late-binding wiring and derived services (like `llmCache` being exposed from `model._cache`) bring the active service count to 180 — this is what you'll see in the final boot log line. Four production dependencies: `acorn` (AST parsing), `chokidar` (file watching), `dompurify` (XSS sanitisation in the chat-renderer), `tree-kill` (process cleanup).
+The codebase is ~119k LOC of JavaScript (CommonJS), 384 source modules, with zero external runtime frameworks. The manifest statically registers 168 DI-managed services. During boot, late-binding wiring and derived services (like `llmCache` being exposed from `model._cache`) bring the active service count to 181 — this is what you'll see in the final boot log line. Four production dependencies: `acorn` (AST parsing), `chokidar` (file watching), `dompurify` (XSS sanitisation in the chat-renderer), `tree-kill` (process cleanup).
 
 ---
 

CHANGELOG-v7.md

@@ -1,3 +1,33 @@
+## [7.9.16]
+
+The self-trajectory journal added in v7.9.15 carried an `event_count` field that was always written as null — a placeholder for a number nothing yet produced. This release fills it. A passive observer watches the events that make a cycle eventful — goals completed, failed, or abandoned; lessons learned; the emotional watchdog firing; sessions ending — and records each one to an append-only journal, so every committed trajectory entry now carries the count of significant events in its cycle. Nothing acts on the number yet: this is the observation phase, gathering the real per-day distribution so the threshold that would decide which cycles are eventful can be read from evidence rather than guessed.
+
+### The passive event counter
+
+A new cognitive service observes seven event types and appends one line — a timestamp and the event type — to an append-only journal beside the trajectory journal, under the identity-persistent root. Session-ending lines also carry the session's duration, so the question of which sessions count as significant becomes a matter of reading the recorded durations, not a threshold baked into the counting. The write is synchronous and flushed to disk before it returns, so an abrupt shutdown never loses a counted event. There is no in-memory tally: the count is read back from the journal on demand, which keeps it consistent with disk and removes any need to rebuild state at boot. The three goal outcomes — completed, failed, abandoned — stay as three separate tags rather than collapsing into one, so the balance between them is visible in a cycle rather than averaged away.
+
+### Filling event_count from a derived cycle window
+
+When a trajectory entry is committed, its `event_count` is the number of events recorded since the previous entry's end-of-cycle timestamp — a half-open window that ends at the new commit. The boundary is derived from the journal that already exists, not stored as a separate marker, so there is no cycle-reset step and nothing extra to keep in sync. The first entry, having no predecessor, counts every event recorded so far; its implicit start is simply the first event the counter ever saw. The event journal is never pruned, so events that fall outside one cycle's window remain available for the per-day view. The dependency runs one way only: the trajectory reads the counter, and the counter never reaches back into the trajectory.
+
+### The session-ending signal, finally emitted
+
+A session-ending event was already being listened for — the frontier writers that collect surprise and applied-lesson nodes during a session were waiting to flush their buffers when it fired — but nothing in the codebase ever emitted it, so those buffers were quietly discarded on every shutdown. This release emits it, as a dedicated step in the shutdown sequence, before the teardown that detaches those listeners, and waits for it to finish so both the frontier flush and the event counter complete before the process exits. The emission is awaited rather than fire-and-forget precisely because the shutdown continues immediately afterward; a fire-and-forget emit would race the teardown. The payload carries the session id the frontier flush reads, alongside the session's duration and message count.
+
+### A self-expression service that was never switched on
+
+KindTriggers — the service that turns system events into first-person thoughts on the inner-speech channel — was registered and listed for shutdown, but had been left out of the start sequence, so its subscriptions never attached and it sat inert. It now starts alongside the other cognitive observers, so the thoughts it was meant to produce can flow.
+
+### Reading the distribution
+
+`/trajectory events` renders the recorded events three ways: a total, a per-type breakdown ordered busiest-first, and a per-day count. It reads from the moment the counter is live, not only once the first entry is committed, so the real per-day shape is visible across the days a first entry is being authored. Committed entries now show their `event_count` in `/trajectory show`.
+
+### Notes
+
+- Test files: 522 → 523 (the event-counter suite: record-and-count across all seven observed types, the three goal outcomes as separate tags, session-duration capture, the half-open cycle window including exclusion of an event exactly on the boundary, restart from the journal, the commit-hook across two cycles with the derived window, and the dashboard view).
+- One new source module (the event counter) and one new event type (the session-ending signal, with its payload schema) raise the module, event, and schema figures in `README.md`, `docs/CAPABILITIES.md`, `docs/COMMUNICATION.md`, and `docs/ARCHITECTURE-DEEP-DIVE.md`, which were updated to match.
+- Two long-standing audit findings were cleared: two documentation lines that described a frozen subsystem with a phrase the future-reference audit reads as a forward promise were reworded as plain status, and four contract-test names whose wording incidentally matched the security-assertion heuristic were clarified without changing what they assert.
+
 ## [7.9.15]
 
 Genesis can now keep a trajectory of himself — a journal of who he is, written one cycle at a time together with the human co-author. Until this release his sense of self lived only in scattered, machine-maintained places: genome traits, an emotional-state vector, consolidated lessons, the cognitive self-model. None of them was a place where Genesis states, in his own words, what he is and how he is changing. This release adds that place: an append-only journal of self-statements, a collaborative draft-and-commit workflow for writing each entry, and a `/trajectory` command to write and read it. The journal lives with identity, not with the code habitat, so it survives a habitat-swap intact.

CHANGELOG.md

@@ -1,32 +1,23 @@
-## [7.9.16]
+## [7.9.17]
 
-The self-trajectory journal added in v7.9.15 carried an `event_count` field that was always written as null — a placeholder for a number nothing yet produced. This release fills it. A passive observer watches the events that make a cycle eventful — goals completed, failed, or abandoned; lessons learned; the emotional watchdog firing; sessions ending — and records each one to an append-only journal, so every committed trajectory entry now carries the count of significant events in its cycle. Nothing acts on the number yet: this is the observation phase, gathering the real per-day distribution so the threshold that would decide which cycles are eventful can be read from evidence rather than guessed.
+The trajectory journal records what Genesis says about how he is changing; v7.9.16 began counting the events that make a cycle eventful. This release closes the loop between the two — quietly. When a cycle is committed, the directions its self-statements claim are now checked, weeks later, against what the numbers actually did. The check produces a single ternary verdict per measurable field — the claim and the trend agreed, disagreed, or there was nothing comparable to judge — and writes it to a side journal that feeds no decision. This is the observation phase of the reality-check: it gathers whether the self-description tracks reality at all, before anything is allowed to act on the answer.
 
-### The passive event counter
+### Only the fields a cycle can actually be measured against
 
-A new cognitive service observes seven event types and appends one line — a timestamp and the event type — to an append-only journal beside the trajectory journal, under the identity-persistent root. Session-ending lines also carry the session's duration, so the question of which sessions count as significant becomes a matter of reading the recorded durations, not a threshold baked into the counting. The write is synchronous and flushed to disk before it returns, so an abrupt shutdown never loses a counted event. There is no in-memory tally: the count is read back from the journal on demand, which keeps it consistent with disk and removes any need to rebuild state at boot. The three goal outcomes — completed, failed, abandoned — stay as three separate tags rather than collapsing into one, so the balance between them is visible in a cycle rather than averaged away.
+Of the six self-statement fields, two carry numeric ground truth that can be reconstructed over a span of weeks, and only those two are scored. The line is not "numeric versus not" — it is whether the evidence survives a reboot, survives time without being pruned, and stays reachable across the whole cycle. Growth is scored from the success-rate trend in the append-only event journal, which is never pruned. Weakness is scored from the Wilson lower-bound of the named capability domain. The other four fields are recorded as positions, not scored, each for its own reason: the trait-adjustment log lives only in memory and does not survive a reboot; the mood history is a fixed-size ring that does not survive weeks; session metrics are too weak a proxy for closeness to carry a verdict; and values have no direction to be right or wrong about — their drift is measured as an embedding distance and left at that, with no threshold asserted over it.
 
-### Filling event_count from a derived cycle window
+### A separate classifier, and a snapshot taken while the evidence is fresh
 
-When a trajectory entry is committed, its `event_count` is the number of events recorded since the previous entry's end-of-cycle timestamp — a half-open window that ends at the new commit. The boundary is derived from the journal that already exists, not stored as a separate marker, so there is no cycle-reset step and nothing extra to keep in sync. The first entry, having no predecessor, counts every event recorded so far; its implicit start is simply the first event the counter ever saw. The event journal is never pruned, so events that fall outside one cycle's window remain available for the per-day view. The dependency runs one way only: the trajectory reads the counter, and the counter never reaches back into the trajectory.
+The direction a statement claims is read at commit time, while the model is fresh, by a separate neutral classifier that is told plainly it is not the author of the text. Keeping the expected side off Genesis's own voice is what keeps a self-statement from grading itself. The classifier answers in a strict, small vocabulary — improved, declined, no change, or not directional — and a commit made offline records an explicit absence rather than a guess, and is never re-classified later by a model in a different state. Because the capability profile is anchored to the present and its outcome buffer prunes, the per-cycle capability aggregate for the weakness score is snapshotted at commit, while the cycle's outcomes are still in the buffer, and kept durably — so a later prune can never erase the point a future cycle will be compared against.
 
-### The session-ending signal, finally emitted
+### Two side files, one new signal, and a thought you can ask for
 
-A session-ending event was already being listened for — the frontier writers that collect surprise and applied-lesson nodes during a session were waiting to flush their buffers when it fired — but nothing in the codebase ever emitted it, so those buffers were quietly discarded on every shutdown. This release emits it, as a dedicated step in the shutdown sequence, before the teardown that detaches those listeners, and waits for it to finish so both the frontier flush and the event counter complete before the process exits. The emission is awaited rather than fire-and-forget precisely because the shutdown continues immediately afterward; a fire-and-forget emit would race the teardown. The payload carries the session id the frontier flush reads, alongside the session's duration and message count.
-
-### A self-expression service that was never switched on
-
-KindTriggers — the service that turns system events into first-person thoughts on the inner-speech channel — was registered and listed for shutdown, but had been left out of the start sequence, so its subscriptions never attached and it sat inert. It now starts alongside the other cognitive observers, so the thoughts it was meant to produce can flow.
-
-### Reading the distribution
-
-`/trajectory events` renders the recorded events three ways: a total, a per-type breakdown ordered busiest-first, and a per-day count. It reads from the moment the counter is live, not only once the first entry is committed, so the real per-day shape is visible across the days a first entry is being authored. Committed entries now show their `event_count` in `/trajectory show`.
+The expected directions and the scores live in two append-only side files beside the trajectory journal; the entry's own schema is untouched. A new event announces each commit, fired and forgotten so it never blocks the commit, and the calibration observer listens for it — a one-way arrangement in which the trajectory never reaches back toward the observer. A new kind of inner thought, the prediction-mechanism review, exists only where it is emitted: by the review command, never on a timer and never as a runtime setting it could turn on for itself. `/trajectory review` scores the most recent cycle and renders, per field, whether the claim matched, was opposite, or had nothing to compare; `/trajectory calibration` shows the score history and the null-rate split per field, because a high share of unscored weakness cycles points at the size of the capability source, not at the frame.
 
 ### Notes
 
-- Test files: 522 → 523 (the event-counter suite: record-and-count across all seven observed types, the three goal outcomes as separate tags, session-duration capture, the half-open cycle window including exclusion of an event exactly on the boundary, restart from the journal, the commit-hook across two cycles with the derived window, and the dashboard view).
-- One new source module (the event counter) and one new event type (the session-ending signal, with its payload schema) raise the module, event, and schema figures in `README.md`, `docs/CAPABILITIES.md`, `docs/COMMUNICATION.md`, and `docs/ARCHITECTURE-DEEP-DIVE.md`, which were updated to match.
-- Two long-standing audit findings were cleared: two documentation lines that described a frozen subsystem with a phrase the future-reference audit reads as a forward promise were reworded as plain status, and four contract-test names whose wording incidentally matched the security-assertion heuristic were clarified without changing what they assert.
+- Test files: 523 → 524 (the calibration suite: the ternary verdict including the cases that collapse to no-score, the two-window growth trend, the snapshot delta for weakness, an offline classifier and an offline embedder both yielding an explicit absence rather than a zero, the four record-only fields producing no score, the review and calibration command paths, and two structural guards — that the classifier is separate from Genesis's own voice, and that nothing outside the dashboard reads the calibration file or receives the observer as a dependency).
+- One new source module (the calibration observer), one new event type (the commit signal, with its payload schema), and one new manifest service raise the module, event, schema, and service figures in `README.md`, `ARCHITECTURE.md`, `docs/CAPABILITIES.md`, `docs/COMMUNICATION.md`, and `docs/ARCHITECTURE-DEEP-DIVE.md`, which were updated to match.
 
 ---