fix: derived-state determinism, error visibility, metrics naming, HTTP hardening

- rebuild: fold observations per fingerprint in a total order
  (hcl DESC, node_id DESC, id DESC) so two nodes with identical logs
  rebuild identical entries (was: arbitrary bare-column row, merge-order
  dependent)
- threads: CreateThreadCluster uses INSERT OR IGNORE + existing-id
  fallback — concurrent auto-threaders converge instead of hitting UNIQUE
- errors surfaced instead of swallowed: scanEntries returns rows.Err(),
  Stats() fails fast on query errors, AutoLinkThreadObservations /
  linkTemporalNeighbors / golden-thread linking propagate failures,
  AddThreadNote + LinkObservationToThread write under one tx,
  watch records session upsert failures
- gossip client: push checks HTTP status and reports errors (a broken
  push direction no longer looks like a silent success); gossip diff
  gets a 10s timeout so a dead peer cannot hang the CLI
- ingest: failed source sweeps (obsidian/browser/gitea) are logged,
  and -d's help text now states its file-only scope
- watch --quiet: fatal errors go to stderr instead of io.Discard
- main: cobra SilenceErrors/SilenceUsage (errors print once, usage is
  not dumped on runtime failures); knox mcp exits 0 on SIGINT/SIGTERM
- metrics: drop _total suffix from gauges (knox_observations,
  knox_entries, knox_projects, knox_sessions, knox_peers, knox_threads);
  _total stays on counters per Prometheus convention
- http: ReadHeaderTimeout + IdleTimeout on gossip, metrics, and web servers

tests: concurrent cluster-create idempotency, HCL-order rebuild fold
(both merge orders), push HTTP-error surfacing; full suite + -race pass,
gofmt clean

internal/watch/gossip.go

@@ -242,6 +242,9 @@ func (c *Client) Push(kdb *db.KnoxDB, peerVector map[string]int64) (int, error)
 		return 0, err
 	}
 	defer resp.Body.Close()
+	if resp.StatusCode/100 != 2 {
+		return 0, fmt.Errorf("push to %s: %s", c.Addr, resp.Status)
+	}
 	var out struct {
 		Accepted int `json:"accepted"`
 	}
@@ -354,7 +357,13 @@ func Run(kdb *db.KnoxDB, m *metrics.Metrics, static []string) int {
 			m.IncrementPull(pulled)
 		}
 
-		pushed, _ := c.Push(kdb, p.Vector)
+		pushed, err := c.Push(kdb, p.Vector)
+		if err != nil {
+			log.Printf("[gossip] push %s: %v", addr, err)
+			if m != nil {
+				m.IncrementErrors()
+			}
+		}
 		if m != nil {
 			m.IncrementPush(pushed)
 		}

internal/watch/gossip_test.go

@@ -8,6 +8,7 @@ import (
 	"path/filepath"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/david/knox/internal/db"
 )
@@ -299,7 +300,7 @@ func TestHandleBatchRejectsHugeBody(t *testing.T) {
 	rows := []db.GossipObservation{{
 		NodeID: "0123456789abcdef0123456789abcdef", HCL: 1,
 		Fingerprint: "fp:huge", SourceID: "test", Title: "t",
-		Summary: strings.Repeat("x", 5<<20), // 5 MiB summary
+		Summary:     strings.Repeat("x", 5<<20), // 5 MiB summary
 		CollectedAt: "2026-08-29T00:00:00Z",
 	}}
 	body, _ := json.Marshal(rows)
@@ -345,3 +346,20 @@ func TestHandleBatchSkipsSelfRows(t *testing.T) {
 		t.Errorf("self rows: want accepted=0 conflict=2, got accepted=%d conflict=%d", out.Accepted, out.Conflict)
 	}
 }
+
+// TestClientPushSurfacesHTTPError: a non-2xx push response must surface as an
+// error — silently treating it as accepted=0 would hide a broken sync direction.
+func TestClientPushSurfacesHTTPError(t *testing.T) {
+	a := tmpKnoxDB(t)
+	seedObs(a, "AAA")
+
+	sv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, "boom", http.StatusInternalServerError)
+	}))
+	defer sv.Close()
+
+	c := &Client{Addr: sv.URL, Timeout: 5 * time.Second}
+	if _, err := c.Push(a, map[string]int64{}); err == nil {
+		t.Fatal("expected push error on HTTP 500, got nil")
+	}
+}

internal/watch/watch.go

@@ -98,7 +98,7 @@ func (w *Watcher) Start() error {
 	// seed is still ingesting. Vault/dirs are logged after the seed below.
 	gossipAddr := ListenAddr()
 	node := &Node{Kdb: w.knoxDB, Name: "knox", Addr: gossipAddr, Metrics: w.metrics}
-	srv := &http.Server{Addr: gossipAddr, Handler: node.Handler()}
+	srv := &http.Server{Addr: gossipAddr, Handler: node.Handler(), ReadHeaderTimeout: 10 * time.Second, IdleTimeout: 60 * time.Second}
 	go func() {
 		log.Printf("[knox] gossip listening on %s", gossipAddr)
 		if err := srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
@@ -108,7 +108,7 @@ func (w *Watcher) Start() error {
 
 	// Prometheus scraping on a dedicated port (KNOX_METRICS_ADDR).
 	metricsAddr := MetricsAddr()
-	metricsSrv := &http.Server{Addr: metricsAddr, Handler: node.Metrics.Handler()}
+	metricsSrv := &http.Server{Addr: metricsAddr, Handler: node.Metrics.Handler(), ReadHeaderTimeout: 10 * time.Second, IdleTimeout: 60 * time.Second}
 	go func() {
 		log.Printf("[knox] metrics listening on %s", metricsAddr)
 		if err := metricsSrv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
@@ -367,8 +367,9 @@ func (w *Watcher) recordResult(result *ingest.IngestResult, trigger string) {
 	if result.SourceID == "opencode-session" {
 		sessionID, _ := result.Provenance["session_id"].(string)
 		if sessionID != "" {
-			status := "active"
-			w.knoxDB.UpsertSession(sessionID, result.Project, result.Title, status)
+			if err := w.knoxDB.UpsertSession(sessionID, result.Project, result.Title, "active"); err != nil {
+				log.Printf("[knox] session upsert error: %v", err)
+			}
 		}
 	}
 }