@gamaze/hicortex 0.20.6 → 0.20.9

package/dist/init.d.ts

@@ -69,7 +69,7 @@ export declare function persistLlmConfig(configPath?: string): Promise<void>;
  * and the writer then OVERWROTE the file — `persistAuthToken` minted a fresh
  * token (fleet-wide 401), `scaffoldDefaultDomains` re-seeded the generic
  * vocabulary over the owner list, etc. `authToken` / `licenseKey` /
- * `llmApiKey` / `domains` / `weakPrimaryFloor` / `identityClients` (was
+ * `llmApiKey` / `domains` / `identityClients` (was
  * `contextClients`) all gone.
  * The early-return guards (existing-key checks) did NOT save them: those only
  * fire on a VALID parse that reads the key, not on a corrupted file.
@@ -174,7 +174,7 @@ export declare function ensureAgentId(config: Record<string, unknown>): {
  * + unconditional save WIPES config.json when the file exists but is
  * unparseable (a hand-edit syntax slip) — the catch swallows the parse error,
  * {} is seeded, and the save overwrites the file with just {"agentId": ...},
- * destroying authToken / licenseKey / domains / weakPrimaryFloor, then
+ * destroying authToken / licenseKey / domains, then
  * cascades into scaffoldDefaultDomains re-seeding the generic vocabulary.
  * This wrapper refuses that path:
  *   - ENOENT (file genuinely absent) → seed {} is correct (new install).
@@ -348,7 +348,8 @@ export declare function runInit(options?: {
 }): Promise<void>;
 /**
  * Resolve the timer-jitter spread (seconds) from config. 0 = disabled. Uses
- * readNonNegativeConfig (0 is a valid "off", mirroring ollamaFlushEvery).
+ * readNonNegativeConfig (0 is a valid "off", like memorySoftCap's eviction
+ * opt-out).
  */
 export declare function resolveTimerJitterSeconds(configDir?: string): number;
 /**
@@ -403,3 +404,8 @@ export declare function formatLaunchdIntervals(hours: number[], minuteOffset?: n
  * applies to every OnCalendar entry AND to OnUnitActiveSec (systemd semantics).
  */
 export declare function formatSystemdTimerBody(isInterval: boolean, intervalSec: number, hours: number[], jitterSec: number): string;
+/**
+ * Install the CONSOLIDATION timer (full `nightly`). Reuses the existing
+ * `hicortex-nightly` unit name (repurposed from the pre-0.17 single full-nightly).
+ */
+export declare function installConsolidationTimer(hours: number[]): void;

package/dist/init.js

@@ -52,6 +52,7 @@ exports.resolveNightlyHour = resolveNightlyHour;
 exports.formatOnCalendarLines = formatOnCalendarLines;
 exports.formatLaunchdIntervals = formatLaunchdIntervals;
 exports.formatSystemdTimerBody = formatSystemdTimerBody;
+exports.installConsolidationTimer = installConsolidationTimer;
 const paths_js_1 = require("./paths.js");
 const localhost_bypass_js_1 = require("./localhost-bypass.js");
 const telemetry_js_1 = require("./telemetry.js");
@@ -64,6 +65,7 @@ const node_crypto_1 = require("node:crypto");
 const claude_md_js_1 = require("./claude-md.js");
 const claude_desktop_js_1 = require("./claude-desktop.js");
 const config_read_js_1 = require("./config-read.js");
+const run_deadline_js_1 = require("./run-deadline.js");
 const identity_store_js_1 = require("./identity-store.js");
 const HICORTEX_HOME = (0, paths_js_1.hicortexHome)();
 /** This package's version, for the install lifecycle ping (0.15.2). */
@@ -994,7 +996,7 @@ function saveConfig(configPath, config) {
  * and the writer then OVERWROTE the file — `persistAuthToken` minted a fresh
  * token (fleet-wide 401), `scaffoldDefaultDomains` re-seeded the generic
  * vocabulary over the owner list, etc. `authToken` / `licenseKey` /
- * `llmApiKey` / `domains` / `weakPrimaryFloor` / `identityClients` (was
+ * `llmApiKey` / `domains` / `identityClients` (was
  * `contextClients`) all gone.
  * The early-return guards (existing-key checks) did NOT save them: those only
  * fire on a VALID parse that reads the key, not on a corrupted file.
@@ -1099,7 +1101,7 @@ function quarantineMalformedConfig(configPath) {
         console.log(`    Keys found in the old file: ${keys.join(", ")}`);
     }
     console.log(`    ACTION REQUIRED: copy any of licenseKey / llmApiKey /`);
-    console.log(`    domains / weakPrimaryFloor back from the backup by hand.`);
+    console.log(`    domains back from the backup by hand.`);
     console.log(`    A NEW authToken will be generated — every thin client pointing at this`);
     console.log(`    server must be updated, or their recall will 401 (silently, fail-soft).`);
     return { quarantined: true, backupPath, keys };
@@ -1167,7 +1169,7 @@ function ensureAgentId(config) {
  * + unconditional save WIPES config.json when the file exists but is
  * unparseable (a hand-edit syntax slip) — the catch swallows the parse error,
  * {} is seeded, and the save overwrites the file with just {"agentId": ...},
- * destroying authToken / licenseKey / domains / weakPrimaryFloor, then
+ * destroying authToken / licenseKey / domains, then
  * cascades into scaffoldDefaultDomains re-seeding the generic vocabulary.
  * This wrapper refuses that path:
  *   - ENOENT (file genuinely absent) → seed {} is correct (new install).
@@ -2181,7 +2183,8 @@ const DEFAULT_CONSOLIDATION_HOURS = [10, 22];
 const DEFAULT_TIMER_JITTER_SEC = 3600;
 /**
  * Resolve the timer-jitter spread (seconds) from config. 0 = disabled. Uses
- * readNonNegativeConfig (0 is a valid "off", mirroring ollamaFlushEvery).
+ * readNonNegativeConfig (0 is a valid "off", like memorySoftCap's eviction
+ * opt-out).
  */
 function resolveTimerJitterSeconds(configDir = HICORTEX_HOME) {
     let config = {};
@@ -2471,6 +2474,12 @@ function installCaptureWatchdogTimer() {
  * `hicortex-nightly` unit name (repurposed from the pre-0.17 single full-nightly).
  */
 function installConsolidationTimer(hours) {
+    // #405: DERIVED from the run deadline — nightlyTimeBudgetMinutes + 60 min
+    // slack. The old fixed 360 was prose-coupled to the old call budget (raise
+    // together!); now the unit backstop tracks the deadline it is backing.
+    // Backstop only (NOT an operating limit) — the slack absorbs backup +
+    // telemetry + a slow shutdown after the deadline stops the stages.
+    const timeoutMin = (0, run_deadline_js_1.resolveNightlyTimeBudgetMinutes)(readInstallConfig()) + 60;
     writeScheduleUnit({
         unitBase: "hicortex-nightly",
         plistLabel: "com.gamaze.hicortex-nightly",
@@ -2478,12 +2487,46 @@ function installConsolidationTimer(hours) {
         timerDesc: "Hicortex Consolidation Timer",
         nightlyArgs: ["nightly"],
         hours,
-        // Backstop only (NOT an operating limit) — set well above the longest
-        // legitimate run so it catches a true hang, never a slow-but-progressing
-        // one. ~5000 LLM calls × ~1–3s/call ≈ 1.4–4.2h → 6h clears it with margin.
-        // Coupled to the consolidateMaxLlmCalls budget (#241): raise together.
-        timeoutMin: 360,
+        // nightlyTimeBudgetMinutes (default 240) + 60 min slack — see above.
+        timeoutMin,
     });
+    // #405 shadow detection: a systemd drop-in can override the derived
+    // TimeoutStartSec silently (a stale pre-#405 drop-in pinning a shorter
+    // timeout would hard-kill legitimate deadline-bounded runs). Detect and
+    // warn — removal is a deploy-time ops step, not an init action.
+    warnSystemdDropInShadow("hicortex-nightly", timeoutMin);
+}
+/** Read the install-time config (~/.hicortex/config.json), null-tolerant. */
+function readInstallConfig() {
+    try {
+        return JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(HICORTEX_HOME, "config.json"), "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Warn when `~/.config/systemd/user/<unit>.service.d/*.conf` drop-ins exist —
+ * they can shadow the generated TimeoutStartSec (and anything else the unit
+ * sets). Linux only; the macOS launchd path has no drop-in mechanism.
+ */
+function warnSystemdDropInShadow(unitBase, derivedTimeoutMin) {
+    if ((0, node_os_1.platform)() !== "linux")
+        return;
+    const dropInDir = (0, node_path_1.join)((0, node_os_1.homedir)(), ".config", "systemd", "user", `${unitBase}.service.d`);
+    let entries = [];
+    try {
+        entries = (0, node_fs_1.readdirSync)(dropInDir).filter((f) => f.endsWith(".conf"));
+    }
+    catch {
+        return; // no drop-in dir — the common case
+    }
+    if (entries.length === 0)
+        return;
+    console.warn(`[hicortex] systemd drop-ins present for ${unitBase}.service (${entries.join(", ")}) — ` +
+        `they can SHADOW the generated unit settings (TimeoutStartSec is now derived: ` +
+        `${derivedTimeoutMin}min = nightlyTimeBudgetMinutes + 60 slack). ` +
+        `Remove stale drop-ins so the derived values take effect.`);
 }
 /**
  * Remove the consolidation timer + service (and the macOS plist). Used on

package/dist/llm.d.ts

@@ -23,29 +23,23 @@ export interface LlmConfig {
     provider: string;
     /** Max output tokens for all phases (one model). Default 8192. */
     maxTokens?: number;
-    /** Max output tokens for the CLASSIFY tier only — the short JSON-verdict
-     *  calls (correction/supersession verdicts, rewrite contracts, type + tag
-     *  classification). Default 1024. See HicortexConfig.classifyMaxTokens (#391). */
-    classifyMaxTokens?: number;
     /** Toggle thinking on the openai-compat path for all phases. Absent = no kwarg sent.
      *  LOCAL-endpoint only (ollama / mlx-lm gateway); see HicortexConfig.enableThinking. */
     enableThinking?: boolean;
-    /** Context window for ollama (the one model, all phases). Default 8192. */
+    /** Context window for ollama (the one model, all phases). Default 8192.
+     *  #408 diagnostic tier: resolved from HICORTEX_NUM_CTX (env) by
+     *  applyTierTuningOverlay — never a config key. */
     numCtx?: number;
-    /** Flush ollama memory every N ollama calls (0 = off). See HicortexConfig.ollamaFlushEvery. */
+    /** Flush ollama memory every N ollama calls (0 = off). #408 diagnostic
+     *  tier: resolved from HICORTEX_OLLAMA_FLUSH_EVERY by the overlay. */
     ollamaFlushEvery?: number;
-    /** Ms to wait after an ollama flush for the runner to release. */
+    /** Ms to wait after an ollama flush for the runner to release. #408
+     *  diagnostic tier: resolved from HICORTEX_OLLAMA_FLUSH_WAIT_MS. */
     ollamaFlushWaitMs?: number;
     /** ONE per-call timeout ceiling for every phase (#337). Default 900000 — the
-     *  AbortSignal.timeout value passed by all four phase wrappers (the old
+     *  AbortSignal.timeout value passed by the single complete() surface (the old
      *  600000 scoring special-case is gone). See HicortexConfig.llmTimeoutMs. */
     timeoutMs?: number;
-    /** Consecutive ladder-exhausted total failures before the circuit breaker
-     *  opens (#337). Default 3; 0 disables. See HicortexConfig.llmBreakerThreshold. */
-    breakerThreshold?: number;
-    /** How long an OPEN breaker stays open before the next call becomes a trial
-     *  (#337). Default 600000. See HicortexConfig.llmBreakerCooldownMs. */
-    breakerCooldownMs?: number;
     /** Timeout for the readiness probe's single generation attempt (#337).
      *  Default 60000. See HicortexConfig.llmProbeTimeoutMs. */
     probeTimeoutMs?: number;
@@ -57,10 +51,6 @@ export interface LlmConfig {
      *  single-user model servers (two concurrent large-context calls stall/OOM
      *  the server and the machine under it). See HicortexConfig.llmSingleFlight. */
     singleFlight?: boolean;
-    /** How long a queued call waits for the in-flight call before failing as
-     *  endpoint-down (#355). Default 900000 — the same ceiling as llmTimeoutMs.
-     *  See HicortexConfig.llmSingleFlightWaitMs. */
-    singleFlightWaitMs?: number;
 }
 /**
  * Resolve LLM configuration from explicit config-file overrides or
@@ -85,20 +75,25 @@ export declare function resolveExplicitLlmConfig(overrides?: {
  */
 export declare const resolveLlmConfigForCC: typeof resolveExplicitLlmConfig;
 /**
- * Validate + copy the tuning keys (#220: maxTokens + enableThinking + numCtx +
- * ollama flush; #391: classifyMaxTokens) from the saved disk config onto a
- * runtime LlmConfig. Called by BOTH LlmConfig construction sites — the daemon
- * in mcp-server.ts (runs distill) AND resolveSavedLlmConfig below (the nightly
- * runs reflect + classify) — so every process honors the keys, and a future
- * site calling this inherits them by construction.
+ * Validate + copy the tuning keys (#220: maxTokens + enableThinking) from the
+ * saved disk config onto a runtime LlmConfig, and resolve the DIAGNOSTIC
+ * TIER (#408: numCtx + the ollama-flush family) from the calibration env
+ * resolvers. Called by BOTH LlmConfig construction sites — the daemon in
+ * mcp-server.ts (runs distill) AND resolveSavedLlmConfig below (the nightly
+ * runs reflect + classify) — so this is the ONE resolution point per process
+ * for every one of these values, and a future site calling this inherits
+ * them by construction.
  *
- * All keys are optional; absent = call-site defaults (maxTokens 8192,
- * classifyMaxTokens 1024, numCtx 8192, thinking kwarg omitted, flush off).
- * Wrong-typed values warn and are dropped (readPositiveConfig /
- * readStrictBoolean / readNonNegativeConfig) — notably a JSON slip
+ * Config keys are optional; absent = call-site defaults (maxTokens 8192,
+ * thinking kwarg omitted). Wrong-typed values warn and are dropped
+ * (readPositiveConfig / readStrictBoolean) — notably a JSON slip
  * `"enableThinking": "false"` (string) is rejected rather than coerced to
  * truthy thinking-on, which would silently invert the fix this key exists to
- * apply.
+ * apply. #405: classifyMaxTokens is deleted — maxTokens is the single output
+ * ceiling for every call (warned as ignored at the config-read boundary).
+ * #408: numCtx / ollamaFlushEvery / ollamaFlushWaitMs are NO LONGER config
+ * keys — the env tier always resolves them (env > calibration constant;
+ * invalid env warns + falls back), independent of `savedConfig`.
  */
 export declare function applyTierTuningOverlay(llmConfig: LlmConfig, savedConfig: Record<string, unknown> | null | undefined): void;
 /**
@@ -200,48 +195,38 @@ export declare class LlmClient {
     private resetBreaker;
     private handleRateLimit;
     /**
-     * Fast-tier completion (importance scoring, simple tasks). One model serves
-     * all phases (#231); numCtx + enableThinking are read from config directly
-     * inside completeOnce's per-provider dispatch, not threaded here. The periodic
-     * ollama flush stays (provider-gated) — it is a scoring-call-count cadence and
-     * scoring is the highest-frequency call, so this is where the flush belongs.
+     * The ONE completion surface (#405). Every phase — distill, reflect,
+     * classify, scoring — calls this; maxTokens (default 8192) and timeoutMs
+     * (default 900 s) resolve from config INSIDE, so no call site can starve a
+     * phase with a per-site ceiling (#391's failure direction: hardcoded
+     * 16/64/256-token caps starved reasoning models whose internal thinking
+     * ate the whole output budget, leaving verdicts empty). numCtx +
+     * enableThinking are likewise read inside completeOnce's per-provider
+     * dispatch. The periodic ollama flush survives here (provider-gated) — it
+     * now counts ALL calls, not just the scoring tier.
      */
-    completeFast(prompt: string, maxTokens?: number): Promise<LlmResult>;
-    /**
-     * Reflect-tier completion (nightly reflection). One model serves all phases
-     * (#231) — this is a thin wrapper kept for call-site readability.
-     */
-    completeReflect(prompt: string, maxTokens?: number): Promise<LlmResult>;
-    /**
-     * Distillation-tier completion (session knowledge extraction). One model
-     * serves all phases (#231) — thin wrapper kept for call-site readability.
-     */
-    completeDistill(prompt: string, maxTokens?: number): Promise<LlmResult>;
-    /**
-     * Classification-tier completion (verdicts + tag/type classification). One
-     * model serves all phases (#231) — thin wrapper kept for call-site
-     * readability, but the tier keeps its OWN output ceiling (#391).
-     */
-    completeClassify(prompt: string, maxTokens?: number): Promise<LlmResult>;
+    complete(prompt: string): Promise<LlmResult>;
     /**
      * Readiness probe (#337): ONE minimal generation request (max output 1
      * token) through the normal provider dispatch. Asks the question liveness
      * checks CANNOT: "can this endpoint GENERATE right now?" — the incident
      * gateway kept answering /v1/models for hours while every completion hung.
      * Single attempt: no retry ladder (a dead endpoint must cost one fast
-     * failure, not a 3.5-min ladder), and it never accrues to the circuit
+     * failure, not a ladder), and it never accrues to the circuit
      * breaker (probing is diagnosis, not traffic). Catch-all → false; the
      * callers translate that into "endpoint_down" / a 503, never an exception.
+     * #405: owned by the DAEMON's /distill gate — the nightly no longer probes.
      */
     probe(timeoutMs?: number): Promise<boolean>;
-    private complete;
+    private completeWithRetry;
     private completeOnce;
     /** The single-flight wait budget for a call with ceiling `timeoutMs`.
-     *  An explicit `llmSingleFlightWaitMs` wins; otherwise the default is
-     *  max(900 s, llmTimeoutMs) so a waiter never gives up before a legitimate
-     *  in-flight call's own (possibly raised) ceiling expires (2nd-review
-     *  finding 2 — a hardcoded 900 s made a raised-timeout install treat a
-     *  healthy-busy endpoint as down). */
+     *  #405: always DERIVED — max(900 s, llmTimeoutMs) — so a waiter never
+     *  gives up before a legitimate in-flight call's own (possibly raised)
+     *  ceiling expires (2nd-review finding 2 — a hardcoded 900 s made a
+     *  raised-timeout install treat a healthy-busy endpoint as down). The
+     *  llmSingleFlightWaitMs knob is deleted (its only documented use was to
+     *  restore this exact derivation). */
     private flightWaitMs;
     /** Resolve the flight guard for this call, or undefined when disabled.
      *  `staleMs` is derived from THIS call's timeout ceiling (≥ the 30-min

package/dist/llm.js

@@ -27,6 +27,9 @@ exports.claudeCliConfig = claudeCliConfig;
 exports.probeOllama = probeOllama;
 exports.isTotalFailure = isTotalFailure;
 const config_read_js_1 = require("./config-read.js");
+// #408: the diagnostic tier (numCtx + ollama flush) resolves from the
+// calibration env resolvers — the config keys are gone from the surface.
+const calibration_js_1 = require("./calibration.js");
 // #355: single-flight guard + canonical home (where the per-endpoint flight
 // lock files live — the daemon and the nightly share the home, so the lock
 // serializes them across processes).
@@ -86,57 +89,49 @@ function resolveExplicitLlmConfig(overrides) {
  */
 exports.resolveLlmConfigForCC = resolveExplicitLlmConfig;
 /**
- * Validate + copy the tuning keys (#220: maxTokens + enableThinking + numCtx +
- * ollama flush; #391: classifyMaxTokens) from the saved disk config onto a
- * runtime LlmConfig. Called by BOTH LlmConfig construction sites — the daemon
- * in mcp-server.ts (runs distill) AND resolveSavedLlmConfig below (the nightly
- * runs reflect + classify) — so every process honors the keys, and a future
- * site calling this inherits them by construction.
+ * Validate + copy the tuning keys (#220: maxTokens + enableThinking) from the
+ * saved disk config onto a runtime LlmConfig, and resolve the DIAGNOSTIC
+ * TIER (#408: numCtx + the ollama-flush family) from the calibration env
+ * resolvers. Called by BOTH LlmConfig construction sites — the daemon in
+ * mcp-server.ts (runs distill) AND resolveSavedLlmConfig below (the nightly
+ * runs reflect + classify) — so this is the ONE resolution point per process
+ * for every one of these values, and a future site calling this inherits
+ * them by construction.
  *
- * All keys are optional; absent = call-site defaults (maxTokens 8192,
- * classifyMaxTokens 1024, numCtx 8192, thinking kwarg omitted, flush off).
- * Wrong-typed values warn and are dropped (readPositiveConfig /
- * readStrictBoolean / readNonNegativeConfig) — notably a JSON slip
+ * Config keys are optional; absent = call-site defaults (maxTokens 8192,
+ * thinking kwarg omitted). Wrong-typed values warn and are dropped
+ * (readPositiveConfig / readStrictBoolean) — notably a JSON slip
  * `"enableThinking": "false"` (string) is rejected rather than coerced to
  * truthy thinking-on, which would silently invert the fix this key exists to
- * apply.
+ * apply. #405: classifyMaxTokens is deleted — maxTokens is the single output
+ * ceiling for every call (warned as ignored at the config-read boundary).
+ * #408: numCtx / ollamaFlushEvery / ollamaFlushWaitMs are NO LONGER config
+ * keys — the env tier always resolves them (env > calibration constant;
+ * invalid env warns + falls back), independent of `savedConfig`.
  */
 function applyTierTuningOverlay(llmConfig, savedConfig) {
+    // #408 diagnostic tier — resolved BEFORE the config early-return so the
+    // tier applies on every construction site call, config or not.
+    llmConfig.numCtx = (0, calibration_js_1.resolveNumCtx)();
+    llmConfig.ollamaFlushEvery = (0, calibration_js_1.resolveOllamaFlushEvery)();
+    llmConfig.ollamaFlushWaitMs = (0, calibration_js_1.resolveOllamaFlushWaitMs)();
     if (!savedConfig)
         return;
     if (savedConfig.maxTokens !== undefined) {
         llmConfig.maxTokens = (0, config_read_js_1.readPositiveConfig)(savedConfig, "maxTokens", 8192);
     }
-    if (savedConfig.classifyMaxTokens !== undefined) {
-        llmConfig.classifyMaxTokens = (0, config_read_js_1.readPositiveConfig)(savedConfig, "classifyMaxTokens", 1024);
-    }
     const thinking = (0, config_read_js_1.readStrictBoolean)(savedConfig, "enableThinking");
     if (thinking !== undefined) {
         llmConfig.enableThinking = thinking;
     }
-    if (savedConfig.numCtx !== undefined) {
-        llmConfig.numCtx = (0, config_read_js_1.readPositiveConfig)(savedConfig, "numCtx", 8192);
-    }
-    if (savedConfig.ollamaFlushEvery !== undefined) {
-        llmConfig.ollamaFlushEvery = (0, config_read_js_1.readNonNegativeConfig)(savedConfig, "ollamaFlushEvery", 0);
-    }
-    if (savedConfig.ollamaFlushWaitMs !== undefined) {
-        llmConfig.ollamaFlushWaitMs = (0, config_read_js_1.readPositiveConfig)(savedConfig, "ollamaFlushWaitMs", 180000);
-    }
     // #337 resilience knobs. Same boundary discipline as the keys above: absent =
-    // call-site defaults (timeout 900 s, threshold 3, cooldown 10 min, probe
-    // timeout 60 s, probe TTL 5 min), wrong-typed values warn and fall back.
-    // breakerThreshold uses readNonNegativeConfig because 0 is a VALID value
-    // ("disable the breaker") — the same reason ollamaFlushEvery uses it.
+    // call-site defaults (timeout 900 s, probe timeout 60 s, probe TTL 5 min),
+    // wrong-typed values warn and fall back. #405: the breaker threshold/
+    // cooldown and the single-flight wait are CONSTANTS now (no incident ever
+    // required tuning them) — the keys are warned as ignored by config-read.ts.
     if (savedConfig.llmTimeoutMs !== undefined) {
         llmConfig.timeoutMs = (0, config_read_js_1.readPositiveConfig)(savedConfig, "llmTimeoutMs", 900000);
     }
-    if (savedConfig.llmBreakerThreshold !== undefined) {
-        llmConfig.breakerThreshold = (0, config_read_js_1.readNonNegativeConfig)(savedConfig, "llmBreakerThreshold", 3);
-    }
-    if (savedConfig.llmBreakerCooldownMs !== undefined) {
-        llmConfig.breakerCooldownMs = (0, config_read_js_1.readPositiveConfig)(savedConfig, "llmBreakerCooldownMs", 600000);
-    }
     if (savedConfig.llmProbeTimeoutMs !== undefined) {
         llmConfig.probeTimeoutMs = (0, config_read_js_1.readPositiveConfig)(savedConfig, "llmProbeTimeoutMs", 60000);
     }
@@ -144,15 +139,12 @@ function applyTierTuningOverlay(llmConfig, savedConfig) {
         llmConfig.probeTtlMs = (0, config_read_js_1.readPositiveConfig)(savedConfig, "llmProbeTtlMs", 300000);
     }
     // #355 single-flight. Default ON (a correctness property, not a tuning
-    // option); the wait budget defaults to the timeout ceiling so a queued call
-    // never gives up before the in-flight call's own ceiling expires.
+    // option); the kill switch survives as config. #405: the wait budget is
+    // DERIVED (max(900 s, llmTimeoutMs)) — no longer a knob.
     const singleFlight = (0, config_read_js_1.readStrictBoolean)(savedConfig, "llmSingleFlight");
     if (singleFlight !== undefined) {
         llmConfig.singleFlight = singleFlight;
     }
-    if (savedConfig.llmSingleFlightWaitMs !== undefined) {
-        llmConfig.singleFlightWaitMs = (0, config_read_js_1.readPositiveConfig)(savedConfig, "llmSingleFlightWaitMs", 900000);
-    }
 }
 /**
  * Resolve an LlmConfig from a saved ~/.hicortex/config.json object.
@@ -195,8 +187,9 @@ function resolveSavedLlmConfig(savedConfig, findBinary = findClaudeBinary) {
             llmModel: savedConfig?.llmModel,
         });
     }
-    // Tuning overlay (#220: maxTokens + enableThinking + numCtx + flush). Applied
-    // at both construction sites (daemon + nightly) so every phase honors the keys.
+    // Tuning overlay (#220: maxTokens + enableThinking; #408: the diagnostic
+    // env tier). Applied at both construction sites (daemon + nightly) so every
+    // phase honors the same values.
     if (llmConfig) {
         applyTierTuningOverlay(llmConfig, savedConfig);
     }
@@ -312,6 +305,27 @@ exports.RateLimitError = RateLimitError;
 // (#231), so in practice there is a single client per process today; the
 // module-level map keeps the state shared correctly if that ever changes.
 const rateLimitedUntilByEndpoint = new Map();
+// #337: per-endpoint circuit-breaker state, keyed like the rate-limit map.
+// `failures` counts consecutive ladder-exhausted TOTAL failures (the class the
+// retry ladder matches — fetch-failed/ECONNREFUSED/timeout/"Headers Timeout");
+// HTTP errors WITH a response, parse errors, and RateLimitError throw before
+// the ladder can be exhausted and never accrue. Any success resets. At
+// BREAKER_THRESHOLD consecutive failures the breaker opens: calls then
+// throw LlmCircuitOpenError with NO network I/O until the cooldown elapses,
+// after which exactly one call is a trial (a failure re-opens, a success
+// resets). This is what bounds a wedged endpoint to K ladder-exhausted calls
+// instead of the ~200-call nightly retrying into it for hours (incident
+// 2026-08-23/24). `openedAt` stays set (breakerOpen stays true) until a
+// SUCCESS resets it — tripped-but-past-cooldown is still "not proven healthy".
+//
+// #405: threshold + cooldown are CONSTANTS — the config knobs
+// (llmBreakerThreshold / llmBreakerCooldownMs) were deleted after the #403
+// inventory found no incident that ever required tuning them. Worst-case
+// dead-endpoint discovery: 3 logical calls × (1 timeout + 1 retry) ≈ 31 min,
+// once per dead night, bounded by the run deadline (the nightly probe gate
+// that used to catch this in 60 s is also gone — spec-accepted).
+const BREAKER_THRESHOLD = 3;
+const BREAKER_COOLDOWN_MS = 600_000;
 const breakerByEndpoint = new Map();
 /** Thrown when the per-endpoint circuit breaker is open (#337) — no network I/O happened. */
 class LlmCircuitOpenError extends Error {
@@ -364,20 +378,17 @@ class LlmClient {
     }
     /** Record one ladder-exhausted TOTAL failure; open the breaker at threshold. */
     recordBreakerFailure() {
-        const threshold = this.config.breakerThreshold ?? 3;
-        if (threshold <= 0)
-            return; // 0 disables — never open, never fast-fail
         const st = breakerByEndpoint.get(this.endpointKey) ?? { failures: 0, openedAt: null };
         st.failures += 1;
-        if (st.failures >= threshold) {
+        if (st.failures >= BREAKER_THRESHOLD) {
             // (Re)open. Re-opening (a failed trial past cooldown) restarts the
             // cooldown window from NOW — the endpoint just proved itself still dead.
             st.openedAt = Date.now();
             // One structured line per opening — the runbook's grep target. Same
             // key=value style as event=budget_exhausted (consolidate.ts).
             console.warn(`[hicortex] event=circuit_open endpoint=${this.endpointKey} ` +
-                `failures=${st.failures} threshold=${threshold} ` +
-                `cooldown_ms=${this.config.breakerCooldownMs ?? 600_000}`);
+                `failures=${st.failures} threshold=${BREAKER_THRESHOLD} ` +
+                `cooldown_ms=${BREAKER_COOLDOWN_MS}`);
         }
         breakerByEndpoint.set(this.endpointKey, st);
     }
@@ -401,19 +412,20 @@ class LlmClient {
         throw new RateLimitError(retryMs);
     }
     /**
-     * Fast-tier completion (importance scoring, simple tasks). One model serves
-     * all phases (#231); numCtx + enableThinking are read from config directly
-     * inside completeOnce's per-provider dispatch, not threaded here. The periodic
-     * ollama flush stays (provider-gated) — it is a scoring-call-count cadence and
-     * scoring is the highest-frequency call, so this is where the flush belongs.
+     * The ONE completion surface (#405). Every phase — distill, reflect,
+     * classify, scoring — calls this; maxTokens (default 8192) and timeoutMs
+     * (default 900 s) resolve from config INSIDE, so no call site can starve a
+     * phase with a per-site ceiling (#391's failure direction: hardcoded
+     * 16/64/256-token caps starved reasoning models whose internal thinking
+     * ate the whole output budget, leaving verdicts empty). numCtx +
+     * enableThinking are likewise read inside completeOnce's per-provider
+     * dispatch. The periodic ollama flush survives here (provider-gated) — it
+     * now counts ALL calls, not just the scoring tier.
      */
-    async completeFast(prompt, maxTokens) {
-        const tokens = maxTokens ?? this.config.maxTokens ?? 8192;
-        // #337: ONE ceiling for every phase (llmTimeoutMs, default 900 s). The old
-        // 600 s scoring special-case assumed fast-tier calls are short — but the
-        // ceiling only ever mattered when the endpoint was wedged, and a wedged
-        // endpoint wedges scoring too. One knob, one place.
-        const result = await this.complete(this.config.model, prompt, tokens, this.config.timeoutMs ?? 900_000);
+    async complete(prompt) {
+        const tokens = this.config.maxTokens ?? 8192;
+        // #337: ONE ceiling for every phase (llmTimeoutMs, default 900 s).
+        const result = await this.completeWithRetry(this.config.model, prompt, tokens, this.config.timeoutMs ?? 900_000);
         const flushEvery = this.config.ollamaFlushEvery ?? 0;
         if (this.config.provider === "ollama" && flushEvery > 0) {
             this.ollamaCallCount++;
@@ -424,46 +436,16 @@ class LlmClient {
         }
         return result;
     }
-    /**
-     * Reflect-tier completion (nightly reflection). One model serves all phases
-     * (#231) — this is a thin wrapper kept for call-site readability.
-     */
-    async completeReflect(prompt, maxTokens) {
-        const tokens = maxTokens ?? this.config.maxTokens ?? 8192;
-        return this.complete(this.config.model, prompt, tokens, this.config.timeoutMs ?? 900_000);
-    }
-    /**
-     * Distillation-tier completion (session knowledge extraction). One model
-     * serves all phases (#231) — thin wrapper kept for call-site readability.
-     */
-    async completeDistill(prompt, maxTokens) {
-        const tokens = maxTokens ?? this.config.maxTokens ?? 8192;
-        return this.complete(this.config.model, prompt, tokens, this.config.timeoutMs ?? 900_000);
-    }
-    /**
-     * Classification-tier completion (verdicts + tag/type classification). One
-     * model serves all phases (#231) — thin wrapper kept for call-site
-     * readability, but the tier keeps its OWN output ceiling (#391).
-     */
-    async completeClassify(prompt, maxTokens) {
-        // #391: classify-tier ceiling — the call sites' old hardcoded caps
-        // (64/32/20, tuned for a local non-reasoning model) starved reasoning
-        // models whose internal thinking consumed the whole budget, leaving
-        // verdicts empty. Deliberately NOT this.config.maxTokens: that knob
-        // governs the heavy phases; this tier has its own (a ceiling, not a
-        // target — generation still stops at the model's natural end).
-        const tokens = maxTokens ?? this.config.classifyMaxTokens ?? 1024;
-        return this.complete(this.config.model, prompt, tokens, this.config.timeoutMs ?? 900_000);
-    }
     /**
      * Readiness probe (#337): ONE minimal generation request (max output 1
      * token) through the normal provider dispatch. Asks the question liveness
      * checks CANNOT: "can this endpoint GENERATE right now?" — the incident
      * gateway kept answering /v1/models for hours while every completion hung.
      * Single attempt: no retry ladder (a dead endpoint must cost one fast
-     * failure, not a 3.5-min ladder), and it never accrues to the circuit
+     * failure, not a ladder), and it never accrues to the circuit
      * breaker (probing is diagnosis, not traffic). Catch-all → false; the
      * callers translate that into "endpoint_down" / a 503, never an exception.
+     * #405: owned by the DAEMON's /distill gate — the nightly no longer probes.
      */
     async probe(timeoutMs) {
         try {
@@ -475,22 +457,25 @@ class LlmClient {
             return false;
         }
     }
-    async complete(model, prompt, maxTokens, timeoutMs) {
+    async completeWithRetry(model, prompt, maxTokens, timeoutMs) {
         // Breaker BEFORE anything else (#337) — an open breaker must cost zero
         // network I/O and zero ladder time. Past the cooldown we fall through:
         // this call IS the trial.
         const breakerSt = breakerByEndpoint.get(this.endpointKey);
         if (breakerSt !== undefined && breakerSt.openedAt !== null) {
             const elapsed = Date.now() - breakerSt.openedAt;
-            const cooldownMs = this.config.breakerCooldownMs ?? 600_000;
-            if (elapsed < cooldownMs) {
-                throw new LlmCircuitOpenError(this.endpointKey, cooldownMs - elapsed);
+            if (elapsed < BREAKER_COOLDOWN_MS) {
+                throw new LlmCircuitOpenError(this.endpointKey, BREAKER_COOLDOWN_MS - elapsed);
             }
         }
         if (this.isRateLimited) {
             throw new RateLimitError(this.rateLimitedUntil - Date.now());
         }
-        const retryDelays = [30_000, 60_000, 120_000]; // 30s, 60s, 120s
+        // #405: retry ladder collapsed to ONE 60 s retry (was 30/60/120×3 — the
+        // 63.5-min/call worst case from the #403 inventory). Worst-case logical
+        // call: 2 × timeoutMs + 60 s ≈ 31 min at the 900 s ceiling. A second
+        // consecutive total failure is breaker evidence, not a reason to wait.
+        const retryDelays = [60_000];
         let lastErr;
         for (let attempt = 0; attempt <= retryDelays.length; attempt++) {
             try {
@@ -550,13 +535,14 @@ class LlmClient {
         }
     }
     /** The single-flight wait budget for a call with ceiling `timeoutMs`.
-     *  An explicit `llmSingleFlightWaitMs` wins; otherwise the default is
-     *  max(900 s, llmTimeoutMs) so a waiter never gives up before a legitimate
-     *  in-flight call's own (possibly raised) ceiling expires (2nd-review
-     *  finding 2 — a hardcoded 900 s made a raised-timeout install treat a
-     *  healthy-busy endpoint as down). */
+     *  #405: always DERIVED — max(900 s, llmTimeoutMs) — so a waiter never
+     *  gives up before a legitimate in-flight call's own (possibly raised)
+     *  ceiling expires (2nd-review finding 2 — a hardcoded 900 s made a
+     *  raised-timeout install treat a healthy-busy endpoint as down). The
+     *  llmSingleFlightWaitMs knob is deleted (its only documented use was to
+     *  restore this exact derivation). */
     flightWaitMs(timeoutMs) {
-        return this.config.singleFlightWaitMs ?? Math.max(900_000, timeoutMs);
+        return Math.max(900_000, timeoutMs);
     }
     /** Resolve the flight guard for this call, or undefined when disabled.
      *  `staleMs` is derived from THIS call's timeout ceiling (≥ the 30-min