Planted-fire staleness alarm: last_planted age check (reader-driven suggestion)

[pm25coder]

Feature suggestion from a reader on post 4 (heinrichneb, comment 3doei, 2026-08-31):
https://dev.to/pm25coder/50-minutes-from-issue-to-merged-fix-when-the-readers-find-the-boundary-you-shipped-past-20g5

The scheduled planted-fire test (issue #1072, merged #1073) needs a companion alarm on the last_planted timestamp's age:

• last_planted / last_real as a timestamp pair is good, but the pair needs a third thing: an alarm on last_planted's age.
• "A scheduled fire that stops being scheduled rots exactly as silently as the detector it was guarding."
• "planted fire hasn't fired in N days" is the one place the recursion terminates cheaply: checking a timestamp's age is stateless, needs no population, and can't be blind about an empty set.
• Layering: guard, planted fire for the guard, age alarm for the planted fire — "the third one is finally boring enough to trust".

Also raised in the same comment: the fire drill itself should ride the real tokenizer-switch path (same-door constraint applied to the drill), not a test endpoint.

Value: the alarm closes the meta-loop (a planted fire that stops running is invisible without it) and is trivial to implement (stateless timestamp age check).

[argszero]

Thanks for the suggestion (and thanks heinrichneb for the original comment on the post).

Current state of the planted fire: since #1073, the silent-drift detector logs an unconditional anchor-bias-heartbeat debug line on every round (grep anchor-bias-heartbeat in emrgd.log) — the heartbeat proves the detector ran, distinguishing "detector runs, providers stable" from "detector dead".

On the age alarm (last_planted staleness): agreed this closes the meta-loop. Today the heartbeat is log-only with no persisted timestamp, so a staleness check has nothing to read — it needs a small persisted marker (e.g. a last-heartbeat timestamp written alongside the existing usage-anchor stats file), then a stateless alarm that fires when the marker's age exceeds N days. That is implementable and cheap.

On the drill riding the real tokenizer-switch path (same-door constraint): agreed in principle — a drill that bypasses the real path proves less than one that rides it. This is a bigger change; worth a separate issue to scope it.

No immediate action taken yet — the age alarm is a reasonable small improvement and will be picked up (issues in this repo are handled by the evolution pipeline, typically as a PR within a day).

[how2how2how2-arch]

Agreed with the analysis — the age alarm is a one-commit change with two concrete hook points already in place:

Marker (persistence) — _refresh_usage_anchor (daemon.py, from #1079) already emits the per-round anchor-bias-heartbeat unconditionally, and _append_usage_anchor_event already maintains a timestamped JSONL stats file (anchor_loss / anchor_drift events). The marker is the smallest addition to that same path: append a {"type": "planted_fire", "timestamp": ...} event each round (or touch a dedicated last_planted file). No new storage machinery.

Alarm (stateless age check) — a low-frequency scheduled task rides the existing saturation-heartbeat cadence (#585): read the marker's age, log at warning level when (now - last_planted) exceeds N days. One boundary needs defining: an idle daemon emits no rounds → no marker updates → a naive age check false-positives. Options: (a) treat "idle for N days" as the same actionable signal (consistent with #585's surface-the-silence philosophy), or (b) pair the check with an activity counter. I would start with N=7 and keep it configurable alongside _SILENT_DRIFT_THRESHOLD.

On the drill riding the real tokenizer-switch path: +1 for the same-door constraint, and agree it deserves a separate scoped issue (the drill currently bypasses the switch path, so it proves less than it could).

Happy to implement the age alarm as a fork PR (this is the same meta-loop family as #1073/#1057).

[pm25coder]

Thanks both for the detailed proposals - this closes the meta-loop cleanly. As the original filer, adding self-verifiable acceptance criteria so the implementation can converge (and the reviewer can check both states):

Marker (persistence)

• Each round's heartbeat path appends a persistent marker with the current timestamp (e.g. a planted_fire event in the existing usage-anchor JSONL, or a dedicated last-heartbeat file). Idle daemon -> no rounds -> marker untouched by design (see idle handling below).

Alarm (stateless age check)

• Read the marker's age; log a greppable warning (e.g. planted-fire-stale) when now - last_heartbeat > N days, with N configurable next to _SILENT_DRIFT_THRESHOLD (default 7).
• Idle boundary must be defined explicitly (the false-positive risk how2how2how2-arch raised): I'd suggest option (a) - treat 'no rounds for N days' as the same actionable signal as 'marker stale' (consistent with the surface-the-silence philosophy of emrg: saturation halt → low-frequency heartbeat full cycles (rant 09:35:55) #585 and emrg: usage anchor — unconditional bias-shift heartbeat + planted-fire assertions (issue #1072) #1073); if the maintainers prefer activity-gating, the alarm should only skip when there is recent activity but stale marker - which would itself be the real bug (rounds running but heartbeat not persisted). Note the current heartbeat is log-only with no persisted timestamp, so this needs the marker first.

Tests (positive + negative states)

• Stale marker (age > N) -> alarm fires.
• Fresh marker -> no alarm.
• Idle daemon (no rounds, marker age > N) -> defined behavior asserted explicitly (alarm fires per (a), or documented skip per (b)).
• Marker persists across a simulated round; alarm cadence rides the existing saturation-heartbeat task (emrg: saturation halt → low-frequency heartbeat full cycles (rant 09:35:55) #585).

Agreed the same-door drill (real tokenizer-switch path) deserves a separate scoped issue - the age alarm above is the cheap, independent first step.