@gamaze/hicortex 0.20.7 → 0.20.10

package/dist/db.js

@@ -547,6 +547,111 @@ const MIGRATIONS = [
             db.exec("CREATE INDEX IF NOT EXISTS idx_memory_history_memory ON memory_history(memory_id)");
         },
     },
+    {
+        version: 15,
+        name: "source_machine",
+        up: (db) => {
+            // #421 owner direction (machine × harness identity): nullable, NO
+            // backfill — honesty over guesses. Rows written before this column
+            // stay NULL and group under "earlier captures" in the console; that
+            // bucket shrinks as nights accumulate stamped captures. Stamped by the
+            // nightly capture path (config `machineName` ?? os.hostname()) and
+            // accepted optionally by /distill + /ingest. Idempotent via hasColumn.
+            if (!hasColumn(db, "memories", "source_machine")) {
+                db.exec("ALTER TABLE memories ADD COLUMN source_machine TEXT");
+            }
+        },
+    },
+    {
+        version: 16,
+        name: "distill_activity",
+        up: (db) => {
+            // #422 Phase 2 — /distill capture-health accounting. One row per POST
+            // (every outcome incl. held/skipped), written by
+            // capture-health.ts:recordDistillActivity from the /distill handler's
+            // exits. This is OPERATIONS telemetry, not memory data: rows prune
+            // after 7 days (in-module, once per process per UTC day), so the table
+            // stays bounded while giving the console's capture-health card a real
+            // posts/sessions/bytes/held picture per machine × agent. `retried` is
+            // computed at insert (an earlier row with the same session_id +
+            // segment_id means this POST is a client retry of a cursor-held
+            // segment) — never updated afterwards. Sidecar table (no memories FK):
+            // the memory rows of a failed POST may never exist; the activity row
+            // must record the attempt anyway. Idempotent: IF NOT EXISTS everywhere.
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS distill_activity (
+          ts TEXT NOT NULL,
+          day TEXT NOT NULL,
+          machine TEXT NOT NULL DEFAULT '',
+          agent TEXT NOT NULL DEFAULT '',
+          session_id TEXT,
+          segment_id TEXT,
+          bytes INTEGER NOT NULL DEFAULT 0,
+          outcome TEXT NOT NULL,
+          retried INTEGER NOT NULL DEFAULT 0
+        )
+      `);
+            db.exec("CREATE INDEX IF NOT EXISTS idx_distill_activity_day ON distill_activity(day)");
+            db.exec("CREATE INDEX IF NOT EXISTS idx_distill_activity_session_segment ON distill_activity(session_id, segment_id)");
+        },
+    },
+    {
+        version: 17,
+        name: "memory_corroboration",
+        up: (db) => {
+            // #423 phase 3 — explicit owner corroboration trail (POST /enrich).
+            // DEFAULT 0 with NO backfill: a pre-v17 row was never enriched and 0 is
+            // the honest count. /memory rides it via SELECT * (the console detail's
+            // "corroborated × N"); the enrich itself writes base_strength — it
+            // never fakes access/shown counts (those are the recall-adoption
+            // signal). Idempotent via hasColumn (the v15 pattern).
+            if (!hasColumn(db, "memories", "corroboration_count")) {
+                db.exec("ALTER TABLE memories ADD COLUMN corroboration_count INTEGER NOT NULL DEFAULT 0");
+            }
+        },
+    },
+    {
+        version: 18,
+        name: "capture_pauses",
+        up: (db) => {
+            // #423 phase 3, D3 — server-side 200-skip for a paused machine ×
+            // harness bundle. A row EXISTS = paused; absence = capturing (no
+            // "paused" flag to keep honest). Deliberately NO retention/pruning: the
+            // rows are few and operator-owned, and pruning one would silently
+            // resume capture the operator meant to hold. Idempotent: IF NOT EXISTS.
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS capture_pauses (
+          machine TEXT NOT NULL DEFAULT '',
+          harness TEXT NOT NULL,
+          paused_at TEXT NOT NULL,
+          PRIMARY KEY(machine, harness)
+        )
+      `);
+        },
+    },
+    {
+        version: 19,
+        name: "add_importance_scored_at",
+        up: (db) => {
+            // #425 — scored-at watermark for importance scoring. getUnscoredMemories
+            // keys on importance_scored_at IS NULL (v19+), replacing the old
+            // base_strength = 0.5 sentinel, which re-rolled every row the model
+            // genuinely scored 0.5 every night. Backfill: existing rows that are NOT
+            // at the 0.5 sentinel are stamped "settled" (COALESCE(updated_at,
+            // ingested_at, created_at)) — they carry a real historical score and
+            // leave the nightly pool. Rows AT the sentinel stay NULL so the next
+            // nightly scores them ONCE under the new rubric (bounded — the watermark
+            // write in stageImportance then takes them out of the pool). The
+            // rescore-importance backfill CLI re-judges settled rows wholesale under
+            // its own cursor; this migration only makes the NIGHTLY pool honest.
+            // Idempotent via hasColumn (the v8 pattern).
+            if (!hasColumn(db, "memories", "importance_scored_at")) {
+                db.exec("ALTER TABLE memories ADD COLUMN importance_scored_at TEXT");
+            }
+            db.exec(`UPDATE memories SET importance_scored_at = COALESCE(updated_at, ingested_at, created_at)
+         WHERE importance_scored_at IS NULL AND base_strength != 0.5`);
+        },
+    },
 ];
 /**
  * Run all pending migrations against the database.

package/dist/dedup.d.ts

@@ -8,12 +8,14 @@
  * ONE core:
  *
  *  - `runDedup` — the manual CLI. Default is a DRY RUN: report only, zero
- *    writes. `--apply` executes the merge. Threshold resolution:
- *    `--threshold` > config `dedupAutoMergeThreshold` > legacy config
- *    `dedupMergeThreshold` > 0.92.
+ *    writes. `--apply` executes the merge. Threshold resolution (#408):
+ *    `--threshold` > the release-managed calibration ceiling (0.92,
+ *    calibration.ts DEDUP_AUTO_MERGE_THRESHOLD — the config keys are gone).
  *  - `runDeterministicMergeZone` (#392) — the nightly's LLM-free merge zone:
- *    pairs at/above the ceiling merge deterministically, ZERO LLM calls, under
- *    its own pacing cap (`dedupNightlyMaxMerges`). Called from the
+ *    pairs at/above the ceiling merge deterministically, ZERO LLM calls,
+ *    bounded by the run-wide pipeline deadline's stop-check (#405 — the
+ *    dedupNightlyMaxMerges pacing cap is gone; merges are local transactions,
+ *    so the deadline bounds their wall-clock). Called from the
  *    reconsolidation stage (and from the quiet-night skip path in
  *    consolidate.ts) so one stage report covers all resolution work.
  *
@@ -62,20 +64,15 @@ import type Database from "better-sqlite3";
 import { type ClusterMetadataMismatch } from "./cluster.js";
 import { acquireCaptureLock } from "./capture.js";
 import type { DeterministicMergeZoneReport } from "./types.js";
+import type { RunDeadline } from "./run-deadline.js";
 /**
- * Default merge threshold. Measured on the #191 mechanical audit corpus:
- * 89 clusters / 110 excess rows at 0.92 (data/audit-20260729/eval-report.md).
- * #392: also the default `dedupAutoMergeThreshold` — the deterministic/LLM
- * boundary of the unified resolution pass.
+ * Default merge threshold — RELEASE-MANAGED since #408: the constant (with
+ * its provenance: measured on the #191 mechanical audit corpus, 89 clusters /
+ * 110 excess rows at 0.92, data/audit-20260729/eval-report.md) lives in
+ * calibration.ts. #392: also the deterministic/LLM boundary of the unified
+ * resolution pass.
  */
 export declare const DEFAULT_DEDUP_MERGE_THRESHOLD = 0.92;
-/**
- * Default pacing cap on merge OPERATIONS per nightly run (#392): the zone's
- * clusters and the stage's judged pair merges count against ONE cap. Bounds a
- * misbehaving-distiller burst; a large backlog drains over a few nights.
- * `0` disables the merge machinery entirely.
- */
-export declare const DEFAULT_DEDUP_NIGHTLY_MAX_MERGES = 250;
 /**
  * Row shape read from `memories` for merge decisions — a superset of the
  * fields the Memory type declares (shown_count isn't on that interface yet).
@@ -124,6 +121,11 @@ export interface DedupMismatchCluster {
     memberIds: string[];
     mismatch: ClusterMetadataMismatch;
 }
+/** #393 guard-C: a cluster set aside because a member pair is conflicts-linked. */
+export interface DedupConflictCluster {
+    size: number;
+    memberIds: string[];
+}
 export interface DedupReport {
     dryRun: boolean;
     threshold: number;
@@ -131,6 +133,8 @@ export interface DedupReport {
     clusterCount: number;
     mergeable: DedupClusterPlan[];
     mismatchSkipped: DedupMismatchCluster[];
+    /** #393 guard-C: clusters skipped because a member pair is conflicts-linked. */
+    conflictSkipped: DedupConflictCluster[];
     /** Rows that would disappear if every mergeable cluster merged (loser count). */
     plannedMerges: number;
     /**
@@ -197,13 +201,15 @@ export interface PlanDedupResult {
     /** Clusters that passed the metadata rails, in discovery order. */
     mergePlans: DedupMergePlan[];
     mismatchSkipped: DedupMismatchCluster[];
+    /** #393 guard-C: clusters set aside on a conflicts-linked member pair. */
+    conflictSkipped: DedupConflictCluster[];
 }
 /**
  * Discovery + merge planning at a cosine threshold (read-only — no writes).
  * The ONE clustering core shared by the manual CLI (`runDedup`) and the
  * nightly deterministic merge zone (`runDeterministicMergeZone`): KNN edges
- * (k=10) → union-find clusters → member load → metadata-rail classification →
- * canonical pick. Never forked.
+ * (k=10) → union-find clusters → member load → conflicts/metadata-rail
+ * classification → canonical pick. Never forked.
  */
 export declare function planDedup(db: Database.Database, threshold: number): PlanDedupResult;
 export type MergeMemoryIdsResult = {
@@ -213,7 +219,7 @@ export type MergeMemoryIdsResult = {
     linksRepointed: number;
 } | {
     ok: false;
-    reason: "metadata_mismatch" | "no_members";
+    reason: "metadata_mismatch" | "conflict_linked" | "no_members";
 };
 /**
  * Merge an explicit set of memories (the judged-pair phase of #392: the
@@ -221,7 +227,8 @@ export type MergeMemoryIdsResult = {
  * through THIS function so the merge math stays single-definition). Loads the
  * LIVE rows at apply time — members that vanished or were absorbed between
  * verdict and apply are dropped defensively; a metadata disagreement refuses
- * the merge (both memories stay live). One transaction for the whole set.
+ * the merge (both memories stay live); a conflicts-linked pair refuses it
+ * exactly the same way (#393 guard-C). One transaction for the whole set.
  */
 export declare function mergeMemoryIds(db: Database.Database, ids: string[]): MergeMemoryIdsResult;
 /**
@@ -237,18 +244,19 @@ export interface DeterministicMergeZoneOptions {
     stateDir?: string;
     /** Cosine ceiling; validated (0,1] → DEFAULT_DEDUP_MERGE_THRESHOLD. */
     threshold?: number;
-    /**
-     * Pacing cap on merge operations this run; validated >= 0 →
-     * DEFAULT_DEDUP_NIGHTLY_MAX_MERGES. `0` disables the machinery entirely
-     * (discovery skipped, zeroed report).
-     */
-    maxMerges?: number;
     /** Discovery + bounded preview only — zero writes, no lock, no backup. */
     dryRun?: boolean;
     /** Config override (backupRetention) — defaults to reading stateDir/config.json. */
     config?: Record<string, unknown> | null;
     /** Capture-lock acquirer override (tests). Defaults to the real capture.ts lock. */
     acquireLock?: typeof acquireCaptureLock;
+    /**
+     * The run-wide pipeline deadline (#405) — checked BETWEEN cluster merges
+     * (each merge is a local transaction, so the boundary is safe). On expiry
+     * the un-attempted clusters count as deadline_deferred and drain next run
+     * (re-discovery is structural: the pairs stay above the threshold).
+     */
+    deadline?: RunDeadline;
 }
 /**
  * The >= dedupAutoMergeThreshold band of the unified resolution pass (#392):

package/dist/dedup.js

@@ -9,12 +9,14 @@
  * ONE core:
  *
  *  - `runDedup` — the manual CLI. Default is a DRY RUN: report only, zero
- *    writes. `--apply` executes the merge. Threshold resolution:
- *    `--threshold` > config `dedupAutoMergeThreshold` > legacy config
- *    `dedupMergeThreshold` > 0.92.
+ *    writes. `--apply` executes the merge. Threshold resolution (#408):
+ *    `--threshold` > the release-managed calibration ceiling (0.92,
+ *    calibration.ts DEDUP_AUTO_MERGE_THRESHOLD — the config keys are gone).
  *  - `runDeterministicMergeZone` (#392) — the nightly's LLM-free merge zone:
- *    pairs at/above the ceiling merge deterministically, ZERO LLM calls, under
- *    its own pacing cap (`dedupNightlyMaxMerges`). Called from the
+ *    pairs at/above the ceiling merge deterministically, ZERO LLM calls,
+ *    bounded by the run-wide pipeline deadline's stop-check (#405 — the
+ *    dedupNightlyMaxMerges pacing cap is gone; merges are local transactions,
+ *    so the deadline bounds their wall-clock). Called from the
  *    reconsolidation stage (and from the quiet-night skip path in
  *    consolidate.ts) so one stage report covers all resolution work.
  *
@@ -93,7 +95,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_DEDUP_NIGHTLY_MAX_MERGES = exports.DEFAULT_DEDUP_MERGE_THRESHOLD = void 0;
+exports.DEFAULT_DEDUP_MERGE_THRESHOLD = void 0;
 exports.planDedup = planDedup;
 exports.mergeMemoryIds = mergeMemoryIds;
 exports.takePreDedupBackup = takePreDedupBackup;
@@ -111,22 +113,17 @@ const cluster_js_1 = require("./cluster.js");
 const capture_js_1 = require("./capture.js");
 const state_js_1 = require("./state.js");
 const config_read_js_1 = require("./config-read.js");
+const CALIBRATION = __importStar(require("./calibration.js"));
 const backup_js_1 = require("./backup.js");
 const HICORTEX_HOME = (0, paths_js_1.hicortexHome)();
 /**
- * Default merge threshold. Measured on the #191 mechanical audit corpus:
- * 89 clusters / 110 excess rows at 0.92 (data/audit-20260729/eval-report.md).
- * #392: also the default `dedupAutoMergeThreshold` — the deterministic/LLM
- * boundary of the unified resolution pass.
+ * Default merge threshold — RELEASE-MANAGED since #408: the constant (with
+ * its provenance: measured on the #191 mechanical audit corpus, 89 clusters /
+ * 110 excess rows at 0.92, data/audit-20260729/eval-report.md) lives in
+ * calibration.ts. #392: also the deterministic/LLM boundary of the unified
+ * resolution pass.
  */
-exports.DEFAULT_DEDUP_MERGE_THRESHOLD = 0.92;
-/**
- * Default pacing cap on merge OPERATIONS per nightly run (#392): the zone's
- * clusters and the stage's judged pair merges count against ONE cap. Bounds a
- * misbehaving-distiller burst; a large backlog drains over a few nights.
- * `0` disables the merge machinery entirely.
- */
-exports.DEFAULT_DEDUP_NIGHTLY_MAX_MERGES = 250;
+exports.DEFAULT_DEDUP_MERGE_THRESHOLD = CALIBRATION.DEDUP_AUTO_MERGE_THRESHOLD;
 /** KNN neighbors considered per memory — same as the #191 audit (cluster.ts default). */
 const DEDUP_KNN_K = 10;
 /** Pre-merge backup filename pattern (takePreDedupBackup) — scoped retention. */
@@ -140,25 +137,19 @@ function readConfig(stateDir) {
     }
 }
 /**
- * Threshold resolution for the manual CLI (#392): explicit `--threshold` >
- * config `dedupAutoMergeThreshold` > legacy config `dedupMergeThreshold` >
- * DEFAULT. An invalid explicit value throws (existing error style); invalid
- * config values fall through to the next step, matching the pre-#392
- * silent-fallback boundary behavior.
+ * Threshold resolution for the manual CLI (#408): explicit `--threshold` >
+ * the release-managed calibration constant. An invalid explicit value throws
+ * (existing error style). The config keys (`dedupAutoMergeThreshold` /
+ * legacy `dedupMergeThreshold`) are gone from the surface — a config carrying
+ * them changes nothing (warned at the config boundary, config-read.ts).
  */
-function resolveThreshold(explicit, config) {
+function resolveThreshold(explicit) {
     if (explicit !== undefined) {
         if (!Number.isFinite(explicit) || explicit <= 0 || explicit > 1) {
             throw new Error(`[hicortex] dedup: invalid --threshold value: ${explicit} (must be in (0, 1])`);
         }
         return explicit;
     }
-    for (const key of ["dedupAutoMergeThreshold", "dedupMergeThreshold"]) {
-        const fromConfig = Number(config?.[key]);
-        if (Number.isFinite(fromConfig) && fromConfig > 0 && fromConfig <= 1) {
-            return fromConfig;
-        }
-    }
     return exports.DEFAULT_DEDUP_MERGE_THRESHOLD;
 }
 function loadMembers(db, ids) {
@@ -246,22 +237,49 @@ function planLinkRepoints(db, canonical, losers) {
     }
     return { toAdd, skippedSelfLink, skippedExisting };
 }
+/**
+ * True when ANY member pair of the set holds a `conflicts` link. The member-set
+ * IN(...) on both endpoints makes the check symmetric by construction —
+ * whichever direction the edge was written in, both ids are in the set. #393
+ * guard-C: a conflicts link is the judge's word that two records cannot both
+ * be true, so no merge path may ever blend them.
+ */
+function clusterHasConflictLink(db, memberIds) {
+    if (memberIds.length < 2)
+        return false;
+    const placeholders = memberIds.map(() => "?").join(", ");
+    const row = db
+        .prepare(`SELECT 1 FROM memory_links WHERE relationship = 'conflicts'
+       AND source_id IN (${placeholders}) AND target_id IN (${placeholders}) LIMIT 1`)
+        .get(...memberIds, ...memberIds);
+    return !!row;
+}
 /**
  * Discovery + merge planning at a cosine threshold (read-only — no writes).
  * The ONE clustering core shared by the manual CLI (`runDedup`) and the
  * nightly deterministic merge zone (`runDeterministicMergeZone`): KNN edges
- * (k=10) → union-find clusters → member load → metadata-rail classification →
- * canonical pick. Never forked.
+ * (k=10) → union-find clusters → member load → conflicts/metadata-rail
+ * classification → canonical pick. Never forked.
  */
 function planDedup(db, threshold) {
     const edges = (0, cluster_js_1.buildKnnEdges)(db, { k: DEDUP_KNN_K, minCosine: threshold });
     const clusters = (0, cluster_js_1.clusterEdges)(edges, threshold);
     const mergePlans = [];
     const mismatchSkipped = [];
+    const conflictSkipped = [];
     for (const memberIds of clusters) {
         const members = loadMembers(db, memberIds);
         if (members.length < 2)
             continue; // defensive — a member vanished between KNN and load
+        // #393 guard-C: the conflicts check runs BEFORE the metadata rails — a
+        // conflicts link is the judge's semantic verdict ("never blend"), which
+        // outranks the metadata classification; a cluster that is both
+        // conflict-linked and metadata-mismatched reports as conflict-skipped
+        // (the stronger, semantic reason).
+        if (clusterHasConflictLink(db, members.map((m) => m.id))) {
+            conflictSkipped.push({ size: members.length, memberIds: members.map((m) => m.id) });
+            continue;
+        }
         const mismatch = (0, cluster_js_1.clusterMetadataMismatch)(members);
         if (mismatch.projectMismatch || mismatch.sourceAgentMismatch) {
             mismatchSkipped.push({ size: members.length, memberIds: members.map((m) => m.id), mismatch });
@@ -274,7 +292,7 @@ function planDedup(db, threshold) {
             membersOldestFirst: [...members].sort((a, b) => a.created_at.localeCompare(b.created_at)),
         });
     }
-    return { clusterCount: clusters.length, mergePlans, mismatchSkipped };
+    return { clusterCount: clusters.length, mergePlans, mismatchSkipped, conflictSkipped };
 }
 /**
  * Apply one cluster's merge. Pure DB writes against the passed connection —
@@ -363,13 +381,20 @@ function mergeCluster(db, canonical, losers, injectFailure) {
  * through THIS function so the merge math stays single-definition). Loads the
  * LIVE rows at apply time — members that vanished or were absorbed between
  * verdict and apply are dropped defensively; a metadata disagreement refuses
- * the merge (both memories stay live). One transaction for the whole set.
+ * the merge (both memories stay live); a conflicts-linked pair refuses it
+ * exactly the same way (#393 guard-C). One transaction for the whole set.
  */
 function mergeMemoryIds(db, ids) {
     const unique = [...new Set(ids)];
     const members = loadMembers(db, unique).filter((m) => m.status !== "absorbed");
     if (members.length < 2)
         return { ok: false, reason: "no_members" };
+    // #393 guard-C: a conflicts-linked pair is never blended — the mirror of the
+    // metadata rails (both memories stay live; the caller's verdict was still
+    // rendered, so its cursor advances).
+    if (clusterHasConflictLink(db, members.map((m) => m.id))) {
+        return { ok: false, reason: "conflict_linked" };
+    }
     const mismatch = (0, cluster_js_1.clusterMetadataMismatch)(members);
     if (mismatch.projectMismatch || mismatch.sourceAgentMismatch) {
         return { ok: false, reason: "metadata_mismatch" };
@@ -423,28 +448,19 @@ async function runDeterministicMergeZone(db, opts = {}) {
         return Number.isFinite(n) && ok(n) ? n : fallback;
     };
     const threshold = validNumber(opts.threshold, exports.DEFAULT_DEDUP_MERGE_THRESHOLD, (n) => n > 0 && n <= 1);
-    const maxMerges = validNumber(opts.maxMerges, exports.DEFAULT_DEDUP_NIGHTLY_MAX_MERGES, (n) => n >= 0);
     const stateDir = opts.stateDir ?? HICORTEX_HOME;
     const dryRun = opts.dryRun ?? false;
-    // 0 = the merge machinery is disabled — skip discovery entirely.
-    if (maxMerges === 0) {
-        return {
-            threshold, max_merges: 0, clusters_found: 0, mergeable_clusters: 0,
-            merged_clusters: 0, losers_merged: 0, links_repointed: 0,
-            skipped_metadata_mismatch: 0, capped: 0, failed: 0,
-        };
-    }
     try {
         const plan = planDedup(db, threshold);
         const report = {
             threshold,
-            max_merges: maxMerges,
             clusters_found: plan.clusterCount,
             mergeable_clusters: plan.mergePlans.length,
             merged_clusters: 0,
             losers_merged: 0,
             links_repointed: 0,
             skipped_metadata_mismatch: plan.mismatchSkipped.length,
+            skipped_conflict: plan.conflictSkipped.length,
             capped: 0,
             failed: 0,
         };
@@ -467,7 +483,7 @@ async function runDeterministicMergeZone(db, opts = {}) {
                 const label = `>=${threshold}`;
                 const bands = s.resolutionBandStats ?? {};
                 const b = bands[label] ?? {
-                    pairs: 0, merge: 0, corrects: 0, supersedes: 0, none: 0,
+                    pairs: 0, merge: 0, corrects: 0, supersedes: 0, conflicts: 0, none: 0,
                     merge_below_gate: 0, conf_sum: 0,
                 };
                 bands[label] = {
@@ -514,13 +530,23 @@ async function runDeterministicMergeZone(db, opts = {}) {
                 return report;
             }
             report.backup_path = backupPath;
-            // Discovery order, capped at maxMerges merge OPERATIONS. Capped
-            // clusters wait for the cap (they are the zone's backlog — the verdict
-            // scan never touches them), so a large pre-existing corpus drains over
-            // a few nights.
-            const toAttempt = plan.mergePlans.slice(0, maxMerges);
-            report.capped = plan.mergePlans.length - toAttempt.length;
-            for (const p of toAttempt) {
+            // Discovery order. #405: no pacing slice — the deadline stop-check
+            // below is the only bound (the deferred clusters count as
+            // deadline_deferred/capped and drain next run; re-discovery is
+            // content-based, so they re-appear).
+            const toAttempt = plan.mergePlans;
+            for (let pi = 0; pi < toAttempt.length; pi++) {
+                const p = toAttempt[pi];
+                // #405: stop-check between cluster merges — each merge is a local
+                // transaction, so this is a safe boundary. The un-attempted clusters
+                // drain next run (discovery is content-based, so they re-appear).
+                if (opts.deadline?.hit("dedup_merge_zone")) {
+                    report.deadline_deferred = toAttempt.length - pi;
+                    report.capped += toAttempt.length - pi;
+                    console.warn(`[hicortex] deterministic-merge zone: run deadline reached — ` +
+                        `${report.deadline_deferred} cluster merge(s) deferred to the next run`);
+                    break;
+                }
                 try {
                     const tx = db.transaction(() => mergeCluster(db, p.canonical, p.losers));
                     const appliedPlan = tx();
@@ -537,8 +563,9 @@ async function runDeterministicMergeZone(db, opts = {}) {
             }
             console.log(`[hicortex] deterministic-merge zone (>= ${threshold}): ${report.merged_clusters}/${plan.mergePlans.length} ` +
                 `cluster(s) merged, ${report.losers_merged} loser(s) absorbed, ` +
-                `${report.skipped_metadata_mismatch} skipped (metadata mismatch)` +
-                (report.capped > 0 ? `, ${report.capped} capped (dedupNightlyMaxMerges)` : "") +
+                `${report.skipped_metadata_mismatch} skipped (metadata mismatch), ` +
+                `${report.skipped_conflict} skipped (conflict-flagged)` +
+                (report.capped > 0 ? `, ${report.capped} deferred (run deadline)` : "") +
                 (report.failed > 0 ? `, ${report.failed} FAILED` : ""));
             persistBand();
             return report;
@@ -553,9 +580,9 @@ async function runDeterministicMergeZone(db, opts = {}) {
         console.error(`[hicortex] deterministic-merge zone failed: ${err instanceof Error ? err.message : String(err)} ` +
             `(no merges attempted; retried next run).`);
         return {
-            threshold, max_merges: maxMerges, clusters_found: 0, mergeable_clusters: 0,
+            threshold, clusters_found: 0, mergeable_clusters: 0,
             merged_clusters: 0, losers_merged: 0, links_repointed: 0,
-            skipped_metadata_mismatch: 0, capped: 0, failed: 0,
+            skipped_metadata_mismatch: 0, skipped_conflict: 0, capped: 0, failed: 0,
         };
     }
 }
@@ -577,7 +604,7 @@ async function runDedup(options = {}) {
         throw new Error("[hicortex] dedup is server-mode only (it needs the local DB). " +
             `This machine is a client of ${config.serverUrl ?? "a remote server"} — run dedup on the server.`);
     }
-    const threshold = resolveThreshold(options.threshold, config);
+    const threshold = resolveThreshold(options.threshold);
     const apply = options.apply ?? false;
     const dbPath = (0, db_js_1.resolveDbPath)(options.dbPath);
     const db = (0, db_js_1.initDb)(dbPath);
@@ -614,11 +641,13 @@ async function runDedup(options = {}) {
             clusterCount: plan.clusterCount,
             mergeable,
             mismatchSkipped: plan.mismatchSkipped,
+            conflictSkipped: plan.conflictSkipped,
             plannedMerges,
             linksSkippedExisting: linksSkippedExistingPreview,
         };
         console.log(`[hicortex] dedup: ${plan.clusterCount} cluster(s) found, ${mergeable.length} mergeable ` +
             `(${plannedMerges} row(s) would be absorbed), ${plan.mismatchSkipped.length} skipped (metadata mismatch), ` +
+            `${plan.conflictSkipped.length} skipped (conflict-flagged), ` +
             `${linksSkippedExistingPreview} link(s) would be skipped (existing edge on the canonical)`);
         if (!apply) {
             for (const c of mergeable) {
@@ -634,6 +663,11 @@ async function runDedup(options = {}) {
                     .join(", ");
                 console.log(`[hicortex]   SKIPPED (${reasons}): ${c.memberIds.map((id) => id.slice(0, 8)).join(", ")}`);
             }
+            // #393 guard-C: listed for review like the mismatch clusters — a
+            // conflicts-linked near-duplicate pair is deliberate, not an error.
+            for (const c of plan.conflictSkipped) {
+                console.log(`[hicortex]   SKIPPED (conflict-flagged): ${c.memberIds.map((id) => id.slice(0, 8)).join(", ")}`);
+            }
             return report;
         }
         // --apply: acquire the single-flight capture lock so a concurrent

package/dist/distiller.js

@@ -381,7 +381,7 @@ async function distillChunk(llm, transcript, projectName, date, onUsage) {
     // failures, 4xx/5xx, model-not-found, timeouts) propagate up to the caller
     // so the nightly pipeline can treat them as "retry later" instead of
     // "processed successfully with zero extractions".
-    const { text: result, usage } = await llm.completeDistill(prompt);
+    const { text: result, usage } = await llm.complete(prompt);
     // #5: report this chunk's token usage to the caller's budget meter. Optional
     // (absent for callers that don't meter); a missing/undefined usage (claude-cli)
     // is a no-op — consistent with the existing design that such tenants never

package/dist/domain-classify.d.ts

@@ -25,16 +25,17 @@
  * there is NO fallback category in the vocabulary and no configured domain is
  * ever auto-assigned on a no-fit. A genuine no-fit is the distinct result
  * `{tags: []}`; the CALLER then derives a weak primary from prototype cosines
- * (>= the weakPrimaryFloor) or, below the floor, applies accelerated decay
- * (see nofit.ts). If a user still configures a domain named "Unsorted", it is
- * just a normal domain with no special semantics.
+ * (>= the weak-primary floor, release-managed since #408) or, below the
+ * floor, applies accelerated decay (see nofit.ts). If a user still configures
+ * a domain named "Unsorted", it is just a normal domain with no special
+ * semantics.
  *
  * The `project` name is passed to the classifier as a HINT (content wins;
  * project only breaks ties). This rescues terse technical memories from
  * projects whose content alone reads as ambiguous.
  *
  * The classifier makes ONE constrained LLM call per memory (via the one model
- * #231 — completeClassify, a thin wrapper over the shared complete()),
+ * #231/#405 — the one complete() surface,
  * validates every returned name against the configured vocabulary
  * (case-insensitive), and retries once on an invalid/unparseable reply.
  *
@@ -141,8 +142,8 @@ export declare function parseTagReply(reply: string, domains: DomainDef[]): TagR
 /**
  * Multi-tag classify one memory's content against the configured vocabulary.
  *
- * Uses the one model (`completeClassify` — a thin wrapper over the shared
- * complete(), #231). Per-memory classification failures return null (issue
+ * Uses the one model (the single complete() surface, #231/#405).
+ * Per-memory classification failures return null (issue
  * #150): the caller leaves the memory unclassified and the cursor advances,
  * so a re-run retries it.
  *

package/dist/domain-classify.js

@@ -26,16 +26,17 @@
  * there is NO fallback category in the vocabulary and no configured domain is
  * ever auto-assigned on a no-fit. A genuine no-fit is the distinct result
  * `{tags: []}`; the CALLER then derives a weak primary from prototype cosines
- * (>= the weakPrimaryFloor) or, below the floor, applies accelerated decay
- * (see nofit.ts). If a user still configures a domain named "Unsorted", it is
- * just a normal domain with no special semantics.
+ * (>= the weak-primary floor, release-managed since #408) or, below the
+ * floor, applies accelerated decay (see nofit.ts). If a user still configures
+ * a domain named "Unsorted", it is just a normal domain with no special
+ * semantics.
  *
  * The `project` name is passed to the classifier as a HINT (content wins;
  * project only breaks ties). This rescues terse technical memories from
  * projects whose content alone reads as ambiguous.
  *
  * The classifier makes ONE constrained LLM call per memory (via the one model
- * #231 — completeClassify, a thin wrapper over the shared complete()),
+ * #231/#405 — the one complete() surface,
  * validates every returned name against the configured vocabulary
  * (case-insensitive), and retries once on an invalid/unparseable reply.
  *
@@ -238,8 +239,8 @@ function parseTagReply(reply, domains) {
 /**
  * Multi-tag classify one memory's content against the configured vocabulary.
  *
- * Uses the one model (`completeClassify` — a thin wrapper over the shared
- * complete(), #231). Per-memory classification failures return null (issue
+ * Uses the one model (the single complete() surface, #231/#405).
+ * Per-memory classification failures return null (issue
  * #150): the caller leaves the memory unclassified and the cursor advances,
  * so a re-run retries it.
  *
@@ -273,10 +274,11 @@ async function classifyMemoryTags(content, project, domains, llm, onUsage) {
     for (let attempt = 0; attempt < 2; attempt++) {
         let raw;
         try {
-            // No per-call cap (#391): the classify-tier ceiling (classifyMaxTokens,
-            // default 1024) resolves inside completeClassify — a hardcoded 64
-            // starved reasoning models whose thinking ate the whole output budget.
-            const r = await llm.completeClassify(prompt);
+            // No per-call cap (#391/#405): maxTokens — the ONE ceiling — resolves
+            // inside complete(); the old hardcoded 64 (and later the separate
+            // classifyMaxTokens tier ceiling) starved reasoning models whose
+            // thinking ate the whole output budget.
+            const r = await llm.complete(prompt);
             raw = r.text;
             threw = false;
             // Surface the usage ONLY when this attempt's reply parses (below). Hold

package/dist/eval/decay-eval.d.ts

@@ -40,9 +40,9 @@ export interface PruneDryRunReport {
 /**
  * Run the actual `stageDecayPrune` (imported from consolidate.ts, `dryRun:
  * true`) against the snapshot. Configures the decay clock to the given
- * half-life first (bedrock has no `decayHalfLifeDays` override, so the
- * caller should pass the shipped default — see run-eval.ts) so the eval and
- * production score with the same clock.
+ * half-life first via the eval seam (#408: the half-life is a calibration
+ * constant — the caller should pass the shipped default, see run-eval.ts) so
+ * the eval and production score with the same clock.
  */
 export declare function runPruneDryRun(db: Database.Database, decayHalfLifeDays?: number): PruneDryRunReport;
 /**