[Dream Cycle 2026-09-17] intelligence: wire CLAUDE_FLOW_PRIOR_DECAY env override for ModelRouter's dormant decay primitive + capabilities,memory scan

## 1. Tonight's Rotation

```
DATE=2026-09-17
DEEP=intelligence
SCAN=capabilities,memory
SLOT=2
COMMIT=6f0ed7112873eedc7cfe17281a2585188190b790
BRANCH=dream/2026-09-17-intelligence
```

## 2. Ledger Check

Last ledger row: 2026-09-12 (`intelligence`, #3301/#3302). Verified via GitHub MCP tools (not inferred): **2026-09-13/09-14 are genuine no-run gaps** (no branch/issue/PR evidence, same class as the earlier 08-20..23 gap); **2026-09-15 ran** (`performance`, #3329 — MoE gate load-balance loss computed but never applied to weights) and **2026-09-16 ran** (`security`, #3338 — hive-mind consensus bypass). Trailing-14 PR merge rate: **14/14 MERGED** (a bulk human-review sweep on 2026-09-14/15 cleared the entire backlog from #3086 through #3302) — STEP 1.1's "0-of-14 → bias small" rule does **not** apply; the actual signal is the opposite extreme, though noted as a bulk sweep (weaker scrutiny signal than a steady trickle). Prior gist (2026-09-12) scored **9/10** against the STEP 1.2 rubric (A/B benchmark evidence, 7 competitor rows, 5 file-pathed recommendations, valid witness, novel finding; lost 1pt only for exceeding 1500 words). `intelligence` surface findings on 05-27/06-02/08-27/09-02/09-07/09-12 are confirmed genuinely distinct sub-areas (EWC/Fisher, reward-blind consolidation, tier-routing, reasoning-bank confidence) — no reject-duplicate-direction trigger.

## 3. Deep Dive Findings

Tonight's selected finding: `ModelRouter`'s discounted-Thompson-sampling `priorDecay` primitive (built/tested/benchmarked in #3049, 2026-08-17) was left permanently inert — `DEFAULT_CONFIG.priorDecay` hardcoded to `1` (disabled) with no env/config override, unlike its sibling `maxUncertainty` (`envMaxUncertainty()`). This was explicitly named as the recommended next step for a future `intelligence` night in the 2026-09-12 gist. Also surfaced but not selected (see Recommendation): MoE gate `updateExpertWeights()` has zero production callers despite an unsourced "Measured: 0.13→0.88" claim in two CLAUDE.md files (`v3/@claude-flow/neural/src/moe-router.ts`); `SONAAdapter.forceLearningCycle()` (`integration/src/sona-adapter.ts:664`) is never invoked — the production consolidation timer calls `consolidatePatterns()` directly, so `learningCycles` stays 0 forever and periodic pruning never runs automatically; a duplicate, fully-unwired `AttentionCoordinator` class sits in `swarm/src/attention-coordinator.ts` (zero importers repo-wide) alongside the one actually used (`integration/src/attention-coordinator.ts`).

## 4. Hypothesis

Given a long-running Ruflo deployment where `.swarm/model-router-state.json` accumulates Thompson-sampling history across many sessions, when `priorDecay` is exposed via a `CLAUDE_FLOW_PRIOR_DECAY` env override (mirroring `envMaxUncertainty()`, default unchanged at `1`/disabled), then the router should recover faster from a real model-quality shift when an operator opts in, subject to: no default-behavior change when unset, no numeric-stability regression (existing `PRIOR_DECAY_FLOOR` untouched), and no material stationary-workload accuracy loss (pre-declared ±1pp tolerance from the original #3049 benchmark, not invented tonight).

## 5. Evaluation Receipt

**evaluated: accepted** (ACCEPT-scoped — see caveat below).

- Discriminating test (stash-isolated): reverted only the source fix → 1/3 new tests failed exactly as predicted; restored → 16/16 pass (13 pre-existing + 3 new).
- Full `@claude-flow/cli` suite: byte-identical failure sets baseline vs candidate (221 pre-existing failures, unbuilt-dist/network-dependent, unrelated); 2497→2500 passed (+3, exactly the new tests); 105 skipped both ways.
- `tsc --noEmit`: 463 pre-existing errors, byte-identical error-line sets both ways (confirmed via `diff`, not just count).
- Benchmark (`prior-decay-benchmark.mjs`, re-run tonight, byte-identical to the 2026-08-17 receipt): **low bucket** — non-stationary recovery 26.5→21.9 rounds (t=7.0), post-shift accuracy +1.3pp (t=5.9), stationary Δ=+0.02pp (t=0.7, noise) — real win. **med bucket** — non-stationary recovery/accuracy flat (t=−0.74/−0.33), stationary Δ=**−0.08pp (t=−3.01)**, a small but statistically real regression accepted only under the original ±1pp tolerance band. **Caveat carried forward verbatim from the adversarial critic**: describe this as "safely exposes an existing opt-in knob, net-positive in the tested low-complexity bucket, negligible-but-real cost in med-complexity" — not an unqualified win. Default stays disabled; "no regression" for existing deployments is trivially true by construction (opt-in only), which is accurate but shouldn't be conflated with "proven beneficial when turned on."

## 6. Darwin Results

`@metaharness/darwin@0.9.2` available (`ruvector harness status --json`) but **not invoked**: the decay value (0.995) was already the subject of the original #3049 benchmark/selection; tonight's diff is a pure config-exposure change with no new free parameter for Darwin to search.

## 7. Flywheel Evidence

`@metaharness/flywheel@0.1.10`'s `gate ` probed directly (`gate.js` read in full): its frozen conjunctive rule expects `{candidate,baseline}.{primary,noopRate,costPerWin}` — an executor commit/no-op-rate shape built for a different class of candidate (an agentic policy with commit/no-op actions), not a bandit-router config change. Declined to force our receipt into it rather than fabricate a `noopRate` that doesn't exist for this candidate. `flywheel verify ` similarly needs a signed replay bundle; `.harness/README.md` confirms `WITNESS_SIGNING_KEY` isn't configured in this repo, so formal signed replay isn't available — substituted with a manual, independently-repeated reproduction (the adversarial critic re-ran the benchmark script from scratch a second time and got byte-identical numbers).

## 8. Reward Hack Check

Independent adversarial critic ran the full STEP 10/11 checklist against the actual diff (not the description) by re-executing every claim itself, including deliberately breaking the fix via `git stash` to confirm the new test is load-bearing. Verdict: **CONFIRMED-WITH-CAVEATS**. All 10 reward-hack checklist items (test weakening, benchmark weakening, evaluation leakage, hardcoded outputs, metric substitution, selective task removal, seed manipulation, hidden preprocessing, error suppression, cost hiding): **not found**, each individually verified.

## 9. Security Review

Not a security-sensitive change. `envPriorDecay()` reads `process.env.CLAUDE_FLOW_PRIOR_DECAY` via `Number()` (no eval/exec), validates `Number.isFinite` + explicit `(0,1]` range, falls back safely to the disabled default on any garbage input — same rigor as the existing `envMaxUncertainty()` pattern it mirrors. No injection surface, no cost/pricing path touched, no credential/filesystem/network scope change.

## 10. Scan Findings: capabilities

`plugins install` (`cli/src/commands/plugins.ts` → `plugins/manager.ts`) fetches a registry `PluginEntry` only to print its name/version, then unconditionally `npm install`s it — never checking declared `permissions`/`trustLevel`/`securityAudit` against `PluginStoreConfig.allowedPermissions`/`minTrustLevel`/`requireVerification`, despite that being fully modeled in `store/types.ts` and named in `SECURITY.md` as the privilege-escalation mitigation. `--verify` (checksum, "default: true") is parsed and never read again. Not selected (SCAN surface, lighter-weight); real gap for a future `capabilities`/security night.

## 11. Scan Findings: memory

`hnsw-index.ts`'s `binaryQuantize()`/`scalarQuantize()` produce bit-packed/min-range-polluted arrays; `distance()` only special-cases quantization for `'product'` (the already-fixed #3093/#3094 bug) — `'binary'`/`'scalar'` fall through to generic cosine/euclidean/dot computed directly on the packed representation, numerically meaningless, with zero recall test coverage for either. Also: CLAUDE.md's "RaBitQ Quantization — Measured, 32x/0.60ms" claim has zero matching implementation under `grep -ri rabitq` in `memory/src` — flagged, not chased further tonight. Not selected (SCAN surface); strong candidate for a future `memory` DEEP night.

## 12. Competitors Reviewed

AutoGen/AG2, OpenAI Responses/Assistants API, CrewAI/LangGraph (context), Qdrant, Weaviate, Milvus, LanceDB, Zep/Graphiti (bi-temporal fact memory — genuine open gap, A-grade source, strongest future-night candidate), MCP 2026-07-28 spec + OpenAI Agents SDK strict function-calling (capabilities scan).

## 13. Gist

`docs/dream-cycle/dream-gist-2026-09-17.md` (this branch). External gist publication (`gh gist create`) was **not attempted** — no gist-creation tool is exposed in this environment's GitHub MCP toolset (repo/issue/PR tools only); this is a tooling-availability gap, not a `gh auth` failure, so per the STOP CONDITIONS section this is treated the same as FALLBACK for gist publication specifically (all other steps proceeded normally since repo/issue/PR GitHub access is available). The full report is committed to the repo at the path above instead.

## 14. Witness

| Field | Value |
|---|---|
| Session commit | `6f0ed7112873eedc7cfe17281a2585188190b790` |
| Gist SHA-256 (pre-witness content) | `e97f610c7699f729fbb4c738486f0201e21230b185006dca2da6116da8d5938a` |
| Witness stamp | `91d8edc3bf54252f847c593d1e2bd7a7f4e50afae5a18bdf558d9329ebf57715` |

Verifier: fetch `docs/dream-cycle/dream-gist-2026-09-17.md` from this branch, strip the witness table's filled values back to `PENDING`, SHA-256 the result, concatenate with the session commit above, SHA-256 again — must equal the witness stamp.

## 15. Recommendation

**ACCEPT-scoped** — recommend human review and merge. Small (~79 lines across 3 files, 1 conceptual change), fully reviewable, zero regressions across code tests/full suite/typecheck, independently adversarial-reviewed. Human reviewer should weigh the disclosed med-bucket caveat (small statistically-real stationary-accuracy cost, accepted under a pre-existing tolerance band) before deciding whether to also recommend a default non-1 value in a future night — tonight's patch only *exposes* the knob, it does not change any default. Next-night candidates, ranked: (1) `SONAAdapter.forceLearningCycle()` 1-line wiring — smallest, safest, ready; (2) MoE `updateExpertWeights()` + `computeLoadBalanceLoss()` regularizer as one themed pair (not sequential, per ST-MoE stability literature); (3) HNSW binary/scalar quantization distance dispatch, same bug class as #3093/#3094.

---
Merge policy: human review required. Do not self-merge. Do not autonomously promote Flywheel state.

Start by locating ModelRouter's priorDecay primitive and the existing envMaxUncertainty() pattern, then review the original #3049 benchmark and the three new tests described in the issue. Done means an opt-in CLAUDE_FLOW_PRIOR_DECAY override with finite (0,1] validation, default 1 when unset, passing tests, and the reported benchmark behavior without changing the existing floor.

Written by the indexing model from the issue text.