@gamaze/hicortex 0.20.7 → 0.20.10

package/dist/prompts.js

@@ -16,23 +16,46 @@ exports.distillation = distillation;
 exports.domainCuration = domainCuration;
 /**
  * Importance scoring prompt. Takes a {memories_block} with indexed memories.
+ *
+ * RE-ANCHORED (#425): the pre-fix anchors put "useful context" at 0.3-0.5 —
+ * but the distiller's ephemera gate already removes trivia before anything
+ * reaches this scorer, so the model only ever saw curated material and the
+ * distribution compressed upward (measured on the production snapshot via
+ * eval:importance: median base 0.8, ~11% at exactly 1.0, which the decay
+ * model never forgets). The anchors now place routine-but-curated content
+ * LOW and add an explicit distribution instruction (owner decision D2,
+ * 2026-09-13: target median 0.30-0.40, p90 <= 0.75; 1.0 is never a valid
+ * score). The strict JSON-array response contract is unchanged.
  */
 function importanceScoring(memoriesBlock) {
     return `You are a memory importance scorer. Rate each memory's long-term value.
 
 Score each memory from 0.0 (trivial/ephemeral) to 1.0 (critical/foundational).
+These memories are pre-filtered for durability, so ordinary competent work is
+the NORMAL case — use the full scale and keep the bulk of a batch in the lower
+half. When torn between two bands, choose the LOWER.
 
 Scoring guide:
-- 0.0-0.2: Routine actions, transient state, trivial fixes
-- 0.3-0.5: Useful context, minor decisions, standard patterns
-- 0.6-0.8: Important decisions, debugging breakthroughs, architectural choices
-- 0.9-1.0: Foundational principles, critical constraints, core identity facts
+- 0.0-0.2: Ephemeral state, routine actions, one-off fixes
+- 0.2-0.4: Useful context, ordinary decisions, standard patterns — THE DEFAULT
+  BAND; most memories belong here
+- 0.4-0.6: Notable decisions, recurring patterns, project-shaping context —
+  only rows that clearly stand above ordinary work
+- 0.6-0.8: Important decisions, debugging breakthroughs, architectural
+  choices — rare; at most one or two in a typical batch
+- 0.8-0.95: ONLY genuinely foundational principles, critical constraints, core
+  identity facts — material that would be serious to lose. Never score 1.0.
+
+Distribution: a typical batch should have a median around 0.35 — half the
+batch sits at 0.2-0.4. A score of 0.5 or more says "among the more important
+quarter of everything in long-term memory"; a score above 0.8 must be rare
+and immediately defensible as costly to lose.
 
 MEMORIES:
 ${memoriesBlock}
 
 Respond with ONLY a JSON array of scores in the same order, e.g.:
-[0.3, 0.7, 0.5, 0.9]
+[0.3, 0.4, 0.2, 0.7]
 
 No explanations. Just the JSON array.`;
 }

package/dist/recall-index.d.ts

@@ -51,9 +51,10 @@ import type { MemorySearchResult } from "./types.js";
 import * as storage from "./storage.js";
 import { SessionRecallRegistry } from "./recall-registry.js";
 export interface RecallIndexOptions {
-    /** Minimum measured cosine for vector-only candidates (config
-     *  `recallMinSimilarity`). FTS-matched candidates pass regardless — a BM25
-     *  text match is direct evidence of relevance. Default 0.62 (raised from 0.55
+    /** Minimum measured cosine for vector-only candidates (release-managed
+     *  since #408 — calibration.ts RECALL_MIN_SIMILARITY; this field is the
+     *  eval/test seam). FTS-matched candidates pass regardless — a BM25
+     *  text match is direct evidence of relevance. 0.62 (raised from 0.55
      *  on 2026-08-03 per a 0.01-step floor sweep on the rewritten corpus): steady
      *  ~3:1 noise:signal removal with no knee; 0.62 = +2.2pts precision, 10/98
      *  prompts silent, sits below the 0.63 local pessimum. The floor is a noise
@@ -61,41 +62,42 @@ export interface RecallIndexOptions {
      *  comes with ~1.5 wrongly-silenced (real signal); a non-cosine gate is the
      *  real silence fix (eval #3 §4). */
     minSimilarity?: number;
-    /** Max index lines per response (config `recallMaxItems`). Default 5
-     *  (lowered from 6 on 2026-08-03). Per-slot decomposition at floor 0.62:
-     *  slot 6 gives NO prompt its first relevant memory — "6 is wrong" is the
-     *  robust, prompt-set-independent finding, and 5 captures it. The K-sweep
-     *  is monotone (precision@4 33.7% > @6 30.6% > @8 28.3%), so 4 is
-     *  lower-noise — but the 4-vs-5 distinction rests on 5 of 98 prompts and is
-     *  overfitting-fragile (K and the floor were tuned on the same set); 5 hedges
-     *  with coverage at modest cost. Lower to 4 if a fresh-prompt eval replicates. */
+    /** Max index lines per response (release-managed — calibration.ts
+     *  RECALL_MAX_ITEMS; seam only). 5 (lowered from 6 on 2026-08-03). Per-slot
+     *  decomposition at floor 0.62: slot 6 gives NO prompt its first relevant
+     *  memory — "6 is wrong" is the robust, prompt-set-independent finding, and
+     *  5 captures it. The K-sweep is monotone (precision@4 33.7% > @6 30.6% >
+     *  @8 28.3%), so 4 is lower-noise — but the 4-vs-5 distinction rests on 5
+     *  of 98 prompts and is overfitting-fragile (K and the floor were tuned on
+     *  the same set); 5 hedges with coverage at modest cost. */
     maxItems?: number;
     /** Prompts shorter than this are skipped (continuations, "yes", "do it"). */
     minPromptLength?: number;
-    /** Max chars of the memory's first line shown in an index entry (config
-     *  `recallTitleChars`). Default 100 (reverted from 150 on 2026-08-03): the
-     *  full-corpus relevance eval (#3, §5) found 100 vs 150 statistically
-     *  identical (0.6pts apart, N=40, full CI overlap); 100 saves ~13% tokens
-     *  per block. */
+    /** Max chars of the memory's first line shown in an index entry
+     *  (release-managed — calibration.ts RECALL_TITLE_CHARS; seam only).
+     *  100 (reverted from 150 on 2026-08-03): the full-corpus relevance eval
+     *  (#3, §5) found 100 vs 150 statistically identical (0.6pts apart, N=40,
+     *  full CI overlap); 100 saves ~13% tokens per block. */
     titleChars?: number;
     /** Slots of `maxItems` guaranteed to the pure-prompt (unblended) search's
-     *  top passing hit(s) — the #324 novelty floor. Config `noveltyFloorSlots`,
-     *  default 2 (mirrors coldExposureSlots sizing: small, a floor not a
-     *  takeover). 0 disables the pure-prompt search entirely (the kill-switch).
-     *  Clamped to [0, maxItems]. */
+     *  top passing hit(s) — the #324 novelty floor. Release-managed
+     *  (calibration.ts NOVELTY_FLOOR_SLOTS; seam only); 2 mirrors
+     *  coldExposureSlots sizing: small, a floor not a takeover. 0 disables the
+     *  pure-prompt search entirely (the kill-switch). Clamped to [0, maxItems]. */
     noveltyFloorSlots?: number;
 }
-/** Default #324 novelty-floor slots (config `noveltyFloorSlots`). 2 mirrors
- *  coldExposureSlots sizing — enough to guarantee the pure-prompt top hit
- *  plus a runner-up, never a takeover of the index. The floor only SPENDS
- *  slots when a pure-prompt hit differs from the blended picks (topic
- *  switch); continuing-intent sessions pay nothing. Exported for the boot
- *  log's knob line (mcp-server resolves config-vs-default here, once). */
+/** Default #324 novelty-floor slots (release-managed — calibration.ts
+ *  NOVELTY_FLOOR_SLOTS). 2 mirrors coldExposureSlots sizing — enough to
+ *  guarantee the pure-prompt top hit plus a runner-up, never a takeover of
+ *  the index. The floor only SPENDS slots when a pure-prompt hit differs
+ *  from the blended picks (topic switch); continuing-intent sessions pay
+ *  nothing. Exported for the boot log's knob line (mcp-server prints the
+ *  calibration constant here, once). */
 export declare const DEFAULT_NOVELTY_FLOOR_SLOTS = 2;
 /** Resolve the EFFECTIVE novelty floor (raw ?? default, clamped to
  *  [0, maxItems]) — one definition shared by the handler and the boot knob
  *  line so the logged value is what handleRecallIndex actually uses.
- *  maxItems may be the handler's already-resolved number OR raw config
+ *  maxItems may be the handler's already-resolved number OR raw/undefined
  *  (boot-log site) — raw is resolved with the handler's exact constants. */
 export declare function resolveNoveltyFloorSlots(rawSlots: unknown, rawMaxItems: unknown): number;
 export interface RecallIndexResult {
@@ -118,7 +120,7 @@ export declare function memoryTitle(content: string, maxLen?: number): string;
  * Render one production index line. Exported (2026-08-02, relevance eval #v2)
  * so the eval can measure the REAL rendered surface instead of reimplementing
  * it — `maxLen` threads through to `memoryTitle` unchanged (default
- * DEFAULT_TITLE_CHARS = 100, config `recallTitleChars`) so the eval's snippet-length
+ * DEFAULT_TITLE_CHARS = 100, release-managed since #408) so the eval's snippet-length
  * sweep (spec §4.2) can call this SAME function at 100/150/title1sent without
  * duplicating the date/scope/agent/type meta-line logic.
  */

package/dist/recall-index.js

@@ -94,28 +94,31 @@ exports.formatMemoryGetText = formatMemoryGetText;
 const storage = __importStar(require("./storage.js"));
 const type_labels_js_1 = require("./type-labels.js");
 const retrieval_js_1 = require("./retrieval.js");
-/** Relevance-gate floor for vector-only candidates (config `recallMinSimilarity`).
- *  0.62 (was 0.55; raised 2026-08-03 on the fine-grain floor sweep — see the
- *  minSimilarity doc above). */
-const DEFAULT_MIN_SIMILARITY = 0.62;
-/** Max index lines per pushed recall block (config `recallMaxItems`).
- *  5 (was 6; lowered 2026-08-03 — slot 6 is pure padding at floor 0.62). */
-const DEFAULT_MAX_ITEMS = 5;
-const DEFAULT_MIN_PROMPT_LENGTH = 20;
+const CALIBRATION = __importStar(require("./calibration.js"));
+/** Relevance-gate floor for vector-only candidates (release-managed —
+ *  calibration.ts RECALL_MIN_SIMILARITY). 0.62 (was 0.55; raised 2026-08-03
+ *  on the fine-grain floor sweep — see the minSimilarity doc above). */
+const DEFAULT_MIN_SIMILARITY = CALIBRATION.RECALL_MIN_SIMILARITY;
+/** Max index lines per pushed recall block (release-managed — calibration.ts
+ *  RECALL_MAX_ITEMS). 5 (was 6; lowered 2026-08-03 — slot 6 is pure padding
+ *  at floor 0.62). */
+const DEFAULT_MAX_ITEMS = CALIBRATION.RECALL_MAX_ITEMS;
+const DEFAULT_MIN_PROMPT_LENGTH = CALIBRATION.RECALL_MIN_PROMPT_CHARS;
 /** Default index-line title length. 100 (reverted from 150 on 2026-08-03:
  *  eval #3 §5 showed 100 vs 150 statistically identical; 100 saves ~13% tokens). */
-const DEFAULT_TITLE_CHARS = 100;
-/** Default #324 novelty-floor slots (config `noveltyFloorSlots`). 2 mirrors
- *  coldExposureSlots sizing — enough to guarantee the pure-prompt top hit
- *  plus a runner-up, never a takeover of the index. The floor only SPENDS
- *  slots when a pure-prompt hit differs from the blended picks (topic
- *  switch); continuing-intent sessions pay nothing. Exported for the boot
- *  log's knob line (mcp-server resolves config-vs-default here, once). */
-exports.DEFAULT_NOVELTY_FLOOR_SLOTS = 2;
+const DEFAULT_TITLE_CHARS = CALIBRATION.RECALL_TITLE_CHARS;
+/** Default #324 novelty-floor slots (release-managed — calibration.ts
+ *  NOVELTY_FLOOR_SLOTS). 2 mirrors coldExposureSlots sizing — enough to
+ *  guarantee the pure-prompt top hit plus a runner-up, never a takeover of
+ *  the index. The floor only SPENDS slots when a pure-prompt hit differs
+ *  from the blended picks (topic switch); continuing-intent sessions pay
+ *  nothing. Exported for the boot log's knob line (mcp-server prints the
+ *  calibration constant here, once). */
+exports.DEFAULT_NOVELTY_FLOOR_SLOTS = CALIBRATION.NOVELTY_FLOOR_SLOTS;
 /** Resolve the EFFECTIVE novelty floor (raw ?? default, clamped to
  *  [0, maxItems]) — one definition shared by the handler and the boot knob
  *  line so the logged value is what handleRecallIndex actually uses.
- *  maxItems may be the handler's already-resolved number OR raw config
+ *  maxItems may be the handler's already-resolved number OR raw/undefined
  *  (boot-log site) — raw is resolved with the handler's exact constants. */
 function resolveNoveltyFloorSlots(rawSlots, rawMaxItems) {
     const maxItems = typeof rawMaxItems === "number"
@@ -164,7 +167,7 @@ function formatDate(iso) {
  * Render one production index line. Exported (2026-08-02, relevance eval #v2)
  * so the eval can measure the REAL rendered surface instead of reimplementing
  * it — `maxLen` threads through to `memoryTitle` unchanged (default
- * DEFAULT_TITLE_CHARS = 100, config `recallTitleChars`) so the eval's snippet-length
+ * DEFAULT_TITLE_CHARS = 100, release-managed since #408) so the eval's snippet-length
  * sweep (spec §4.2) can call this SAME function at 100/150/title1sent without
  * duplicating the date/scope/agent/type meta-line logic.
  */

package/dist/recall-registry.d.ts

@@ -36,7 +36,8 @@
  * LRU beyond maxSessions so long-running servers don't accumulate state.
  */
 export interface RecallRegistryOptions {
-    /** Turns a shown id stays suppressed. Config `recallReshowTurns`, default 30. */
+    /** Turns a shown id stays suppressed. Release-managed since #408 —
+     *  calibration.ts RECALL_RESHOW_TURNS (30); this field is the eval/test seam. */
     reshowTurns?: number;
     /** Max tracked sessions before LRU eviction. */
     maxSessions?: number;

package/dist/recall-registry.js

@@ -36,10 +36,44 @@
  * early re-shows (~15 tokens each) — harmless by design. Sessions are pruned
  * LRU beyond maxSessions so long-running servers don't accumulate state.
  */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SessionRecallRegistry = exports.DEFAULT_RESHOW_TURNS = void 0;
 const schema_prototypes_js_1 = require("./schema-prototypes.js");
-exports.DEFAULT_RESHOW_TURNS = 30;
+const CALIBRATION = __importStar(require("./calibration.js"));
+exports.DEFAULT_RESHOW_TURNS = CALIBRATION.RECALL_RESHOW_TURNS;
 const DEFAULT_MAX_SESSIONS = 500;
 class SessionRecallRegistry {
     reshowTurns;

package/dist/reconsolidation.d.ts

@@ -15,11 +15,58 @@
  * #392 — one zone system, ONE verdict per pair: below `correctionMinSimilarity`
  * (floor, 0.75) pairs are not candidates; in [floor, `dedupAutoMergeThreshold`)
  * (ceiling, 0.92) each unlinked pair gets ONE verdict call whose action is
- * `merge` | `corrects` | `supersedes` | `none`; at/above the ceiling the
- * deterministic merge zone (dedup.ts runDeterministicMergeZone — LLM-free,
- * budget-free) owns the pair. The merge disposition reuses the dedup core's
- * execution (canonical pick, link re-point, dedup_log, metadata rails); a
- * merge verdict below `correctionRewriteMinConfidence` keeps both memories.
+ * `merge` | `corrects` | `supersedes` | `conflicts` | `none`; at/above the
+ * ceiling the deterministic merge zone (dedup.ts runDeterministicMergeZone —
+ * LLM-free, budget-free) owns the pair. The merge disposition reuses the
+ * dedup core's execution (canonical pick, link re-point, dedup_log, metadata
+ * rails); a merge verdict below `correctionRewriteMinConfidence` keeps both
+ * memories.
+ *
+ * #393 increment B — the SCOUT, a second detection source with the SAME
+ * judge: the similarity floor is structurally blind to corrections riding
+ * inside topically unrelated memories (the field failure — cosine ~0.5-0.6 to
+ * their target, zero `corrects` verdicts in the whole corpus baseline), so
+ * per NEW memory ONE classify-tier shape call asks whether it corrects/
+ * retracts/supersedes/CONTRADICTS something previously recorded (guard-C
+ * extended the question); correction-shaped
+ * memories FTS the corpus with the referenced claim's distinctive terms (the
+ * correction CONTAINS the words of what it corrects) and the hits become
+ * candidate pairs in the SAME verdict loop — no similarity gate for this
+ * source: cosine is a ranker/link strength, never a blocker. Per-source
+ * counters (scout_scanned / scout_correction_shaped / scout_candidates_found)
+ * ride the stage report; cosine band stats stay similarity-source-only.
+ *
+ * #393 guard-C — the conflicts flag + the zone-runs-last order: judgment
+ * OUTRANKS the deterministic sweep. A `conflicts` verdict writes a symmetric
+ * `conflicts` link (the pair genuinely disagrees — cannot both be true) and
+ * NOTHING else: no status change, no rewrite, no merge queue; both records
+ * stay live so the consumer sees both truths. Both merge paths (the zone's
+ * planDedup and the judged mergeMemoryIds) refuse to blend a conflicts-linked
+ * pair, counted as conflict_skipped. The zone therefore runs AFTER the scan —
+ * with the zone first, a >=0.92 conflict pair was blended
+ * before the judge ever saw it (the planted-eval harm: canonical=older, the
+ * newer truth erased); running it last means verdicts/marks/binds land first
+ * and the zone merges only what no verdict claimed — a conflicts bind set by
+ * this run's scan guards the SAME run's zone.
+ *
+ * #439 apply-on-confirm — confirmed merges and rewrite groups apply at the
+ * candidate BOUNDARY (the end of the scan iteration that confirmed them), not
+ * in post-scan phases. The old end-of-run batch was a completion assumption
+ * written when nightlies finished in an hour; under #405 budget pressure it
+ * became a days-long queue where confirmed work never landed and every night
+ * re-paid the judgment cost (cursor held below un-applied groups, pairs
+ * re-detected, re-judged). Now each judged-merge pair applies via
+ * mergeMemoryIds in its OWN transaction at confirmation time, each rewrite
+ * group via its own rewrite call + applyRewriteGroup transaction; the cursor
+ * advances per APPLIED candidate, so a deferral holds it below exactly ONE
+ * candidate's pairs. One pre-merge backup per run (lazy, before the first
+ * application); the capture lock is taken per boundary batch with a same-run
+ * retry list + a final drain. A shared trigger IS the current candidate, so
+ * the multi-target keep rule resolves across the boundary's groups (any keep
+ * keeps). A target corrected by two different candidates takes two sequential
+ * rewrites — the second composes the already-corrected story — instead of one
+ * grouped call (the ONE-call grouping was a cost optimization, not a
+ * correctness invariant; accepted semantics change).
  *
  * Status vocabulary (code-defined, extensible — deliberately NOT config):
  *   NULL/'active' default | 'superseded' + 'retracted' demote in ranking |
@@ -41,40 +88,25 @@ import type { LlmClient, LlmUsage } from "./llm.js";
 import type { ConsolidationReport } from "./types.js";
 import type { EmbedFn } from "./retrieval.js";
 import { acquireCaptureLock } from "./capture.js";
+import type { RunDeadline } from "./run-deadline.js";
 /** Stage label used for every budget.use()/recordUsage() call (#384). */
 export declare const RECONSOLIDATION_STAGE_LABEL = "reconsolidation";
 /**
- * Default minimum COSINE similarity for a correction candidate pair. Lower
- * than the supersession stage's 0.80 on purpose: a retraction often rides
- * inside an otherwise unrelated memory (the field failure that opened this
- * issue), so the neighborhood gate must be a touch wider while the LLM
- * verdict + confidence gate carry the precision load.
+ * Default minimum COSINE similarity for a correction candidate pair —
+ * RELEASE-MANAGED since #408 (calibration.ts CORRECTION_MIN_SIMILARITY;
+ * provenance there). Lower than the supersession stage's 0.80 on purpose: a
+ * retraction often rides inside an otherwise unrelated memory (the field
+ * failure that opened this issue), so the neighborhood gate must be a touch
+ * wider while the LLM verdict + confidence gate carry the precision load.
  */
 export declare const DEFAULT_CORRECTION_MIN_SIMILARITY = 0.75;
 /**
- * Default minimum verdict confidence for the REWRITE fork. Below this a
+ * Default minimum verdict confidence for the REWRITE fork — release-managed
+ * (calibration.ts CORRECTION_REWRITE_MIN_CONFIDENCE). Below this a
  * `corrects` verdict degrades to mark-only — a weak mark is recoverable, a
  * weak rewrite is corruption.
  */
 export declare const DEFAULT_CORRECTION_REWRITE_MIN_CONFIDENCE = 0.8;
-/**
- * Default wall-clock bound for the stage, in minutes (#401). Checked at the
- * top of the candidate scan loop (and before each rewrite contract call); on
- * expiry the scan breaks cleanly at the last fully-considered candidate and
- * the next run resumes from the persisted cursor. 120 sits safely under any
- * sane process-level nightly timeout. 0 disables the bound. Invalid →
- * default.
- */
-export declare const DEFAULT_RECONSOLIDATION_MAX_MINUTES = 120;
-/**
- * Default per-run classify-call ceiling for the stage (#401) — the
- * supersessionMaxCalls pattern with a NON-ZERO default ON PURPOSE: that
- * knob's 0=unlimited default is what let the first full-corpus pass grow
- * unbounded. Counts EVERY classify-tier call the stage makes (mark
- * verifications, pair verdicts, rewrite contracts). 0 disables the cap.
- * Invalid → default.
- */
-export declare const DEFAULT_RECONSOLIDATION_MAX_CALLS = 600;
 /** Head of the old content quoted in the provenance footer. */
 export declare const FOOTER_HEAD_MAX_CHARS = 160;
 /** The code-defined status vocabulary (see module doc). Not user-configurable. */
@@ -87,50 +119,38 @@ export declare const DEMOTED_STATUSES: readonly [MemoryStatus, MemoryStatus];
 /** structural subset of consolidate.BudgetTracker (avoids an import cycle). */
 export interface StageBudget {
     readonly exhausted: boolean;
-    use(stage: string, count?: number): boolean;
+    use(stage: string): boolean;
     recordUsage(stage: string, usage: LlmUsage | undefined): void;
 }
 export interface ReconsolidationOptions {
-    /** correctionMinSimilarity (config; default 0.75). Invalid → default. */
+    /** Correction-pair cosine floor. Release-managed default (calibration.ts
+     *  CORRECTION_MIN_SIMILARITY, 0.75); this field is the eval/test seam.
+     *  Invalid → default. */
     minSimilarity?: number;
-    /** correctionRewriteMinConfidence (config; default 0.80). Invalid → default. */
+    /** Rewrite-fork confidence floor. Release-managed default (calibration.ts
+     *  CORRECTION_REWRITE_MIN_CONFIDENCE, 0.80); seam only. Invalid → default. */
     rewriteMinConfidence?: number;
     /**
-     * dedupAutoMergeThreshold (config; default 0.92; legacy dedupMergeThreshold
-     * honored by nightly.ts when the new key is absent). The deterministic/LLM
-     * boundary of the unified resolution pass (#392): pairs at/above it merge
-     * via the LLM-free zone, pairs in [floor, ceiling) get the verdict.
-     * Invalid → default.
+     * The deterministic/LLM boundary of the unified resolution pass (#392):
+     * pairs at/above it merge via the LLM-free zone, pairs in [floor, ceiling)
+     * get the verdict. Release-managed default (calibration.ts
+     * DEDUP_AUTO_MERGE_THRESHOLD, 0.92); seam only. Invalid → default.
      */
     autoMergeThreshold?: number;
     /**
-     * dedupNightlyMaxMerges (config; default 250; 0 disables the merge
-     * machinery). Counts merge OPERATIONS per run — zone clusters + judged
-     * pair merges against ONE cap. Invalid → default.
+     * The run-wide pipeline deadline (#405 — successor of the stage-local
+     * reconsolidationMaxMinutes clock, #401): created at nightly start, shared
+     * with capture and every other stage, threaded here by runConsolidation.
+     * Checked at the top of the candidate scan loop and before each rewrite
+     * contract call; on expiry the scan breaks cleanly — the cursor already
+     * points at the last fully-considered candidate, so the run ends
+     * consistent and the next nightly resumes from it.
      */
-    maxMerges?: number;
+    deadline?: RunDeadline;
     /**
-     * reconsolidationMaxMinutes (config; default 120; 0 disables) — wall-clock
-     * deadline for the stage (#401), measured from stage start. Checked at the
-     * top of the candidate scan loop and before each rewrite contract call; on
-     * expiry the scan breaks cleanly — the cursor already points at the last
-     * fully-considered candidate, so the run ends consistent and the next
-     * nightly resumes from it. Invalid → default.
-     */
-    maxMinutes?: number;
-    /**
-     * reconsolidationMaxCalls (config; default 600; 0 disables) — per-run
-     * ceiling on classify-tier calls for the stage (#401), the
-     * supersessionMaxCalls pattern with a NON-ZERO default (the 0=unlimited
-     * default there is what removed the last per-stage bound). Exhaustion
-     * mid-neighbor-loop or mid-rewrite-phase stops/defers cleanly at the
-     * current candidate boundary. Invalid → default.
-     */
-    maxCalls?: number;
-    /**
-     * Capture-lock acquirer override (tests) — the deterministic zone and the
-     * judged-merge phase each hold a short lock window. Defaults to the real
-     * capture.ts lock. DedupOptions.acquireLock pattern.
+     * Capture-lock acquirer override (tests) — the deterministic zone and each
+     * #439 boundary's judged-merge batch hold a short lock window. Defaults to
+     * the real capture.ts lock. DedupOptions.acquireLock pattern.
      */
     acquireLock?: typeof acquireCaptureLock;
 }
@@ -146,12 +166,50 @@ export declare function isFactShapedTarget(mem: {
     content: string;
 }): boolean;
 /**
- * The unified resolution verdict (#392): ONE call per unlinked pair decides
- * how the newer memory relates to the older — merge (same underlying
- * fact/verdict, differing in wording/qualifiers), corrects, supersedes, or
- * none (related but distinct).
+ * The unified resolution verdict (#392, #393 guard-C): ONE call per unlinked
+ * pair decides how the newer memory relates to the older — merge (same
+ * underlying fact/verdict, differing in wording/qualifiers), corrects,
+ * supersedes, conflicts (genuine disagreement — cannot both be true; flag,
+ * keep both, never blend), or none (related but distinct).
+ */
+export type ResolutionAction = "merge" | "corrects" | "supersedes" | "conflicts" | "none";
+/**
+ * The scout's correction-shape answer (#393 B, guard-C): does this NEW memory
+ * correct, retract, supersede, or CONTRADICT something previously recorded —
+ * and if so, which distinctive terms does the referenced (old) claim carry?
+ * `correction: true` means "resolution-shaped": corrects/retracts/supersedes/
+ * contradicts an earlier claim. `references` feeds an FTS query against the
+ * corpus; the shape call is the ONLY LLM work the scout adds per memory
+ * (non-corrections stop there), and it rides the same `complete()` surface +
+ * stage budget as every other call (#405 — there is no separate classify-tier
+ * ceiling to configure).
+ */
+export interface ScoutShape {
+    correction: boolean;
+    /** Distinctive terms of the referenced old claim ("" when not resolution-shaped). */
+    references: string;
+    /** Informational only — never gates behavior (no uncalibrated parameters). */
+    confidence: number;
+}
+/**
+ * Build the constrained correction-shape prompt (classify-tier cost profile:
+ * 1500-char truncation, supersession/verdict precedent). The wording asks for
+ * the OLD claim's distinctive terms — the field-failure mechanism is that a
+ * correction CONTAINS the words of what it corrects, even when the surrounding
+ * topics (and therefore the embedding cosine) are unrelated. Guard-C extends
+ * the question to contradictions: two records that disagree on the same
+ * quantity share even MORE wording than a cross-topic correction does.
+ */
+export declare function buildScoutShapePrompt(content: string): string;
+/**
+ * Parse the scout shape reply. Null on unparseable JSON, a missing/non-boolean
+ * `correction`, or a missing/out-of-range `confidence` — the caller counts
+ * skipped_infra and moves on (parseSupersessionReply discipline: never
+ * mis-detect on ambiguity). `references` is lenient (missing/non-string → "")
+ * because an empty string simply yields no FTS hits — a harmless miss, not a
+ * mis-judgment.
  */
-export type ResolutionAction = "merge" | "corrects" | "supersedes" | "none";
+export declare function parseScoutShape(reply: string): ScoutShape | null;
 /** Build the constrained pair-verdict prompt (1500-char truncation, supersession precedent). */
 export declare function buildCorrectionVerdictPrompt(oldContent: string, newContent: string): string;
 export interface CorrectionVerdict {
@@ -290,32 +348,55 @@ export declare function buildResolutionBands(floor: number, ceiling: number): Re
  */
 export declare function bandForCosine(bands: ResolutionBand[], cosine: number): ResolutionBand | null;
 /**
- * Nightly reconsolidation stage (#384, #392 — THE unified resolution stage).
+ * Nightly reconsolidation stage (#384, #392 — THE unified resolution stage;
+ * #439 apply-on-confirm).
  *
- * Phase 0 (#392): the deterministic merge zone (pairs >= the ceiling) runs
- * first — LLM-free, budget-free, own lock/backup/cap.
+ * Phase order (#393 guard-C): the deterministic merge zone (pairs >= the
+ * ceiling) runs LAST — after the scan (which now includes every judged-merge
+ * application and rewrite, #439). Judgment outranks the deterministic sweep:
+ * verdicts, marks, and binds land first and the zone merges only what no
+ * verdict claimed. With the zone first, a >=0.92 genuine-conflict pair was
+ * blended before the judge ever saw it (the planted-eval harm); running it
+ * last means a `conflicts` bind set by this run's scan guards the SAME run's
+ * zone. Zone internals (lock, backup, deadline, persistBand, fail-soft) are
+ * unchanged.
  *
  * Scan: every memory with rowid > reconsolidationCursor (no shape filter;
  * absorbed candidates are skipped — invisible memories are not re-judged).
- * Each candidate's pairs: incoming explicit marks (verified once, AC7) then
- * up-to-5 older KNN neighbors in [floor, ceiling) (verdict call per unlinked
- * pair, AC2 — pairs at/above the ceiling are counted, never judged). Confirmed
- * `corrects` pairs above the confidence gate on fact-shaped targets group by
- * target into ONE rewrite call each (AC3); confirmed `merge` pairs queue for
- * the merge phase; everything else is mark-only.
+ * Each candidate's pairs: incoming explicit marks (verified once, AC7), then
+ * ONE scout shape call (#393 B — flags correction shape; non-corrections stop
+ * there), then up-to-5 older KNN neighbors in [floor, ceiling) (verdict call
+ * per unlinked pair, AC2 — pairs at/above the ceiling are counted, never
+ * judged) plus the scout's FTS hits for correction-shaped memories (same
+ * verdict loop, NO similarity gate; guard-C: a scout hit whose KNN twin sits
+ * at/above the ceiling is re-tagged scout so the pair IS judged instead of
+ * being left for the zone to blend). Confirmed `corrects` pairs above the
+ * confidence gate on fact-shaped targets group by target; a `conflicts`
+ * verdict writes the conflicts link and nothing else (both live); everything
+ * else is mark-only.
  *
- * Merge phase (#392): queued pairs merge through the dedup core under one
- * lock/backup window, capped with the zone by dedupNightlyMaxMerges. A pair
- * that cannot apply keeps both memories and holds the cursor.
+ * #439 BOUNDARY apply: at the END of each candidate iteration everything it
+ * confirmed applies IMMEDIATELY — merges first (each judged-merge pair via
+ * mergeMemoryIds in its own transaction, under the boundary's short lock
+ * window; ONE lazy pre-merge backup per run), then the iteration's rewrite
+ * groups (one rewrite LLM call + one applyRewriteGroup transaction each;
+ * dispositions resolved ACROSS the boundary's groups — the multi-target keep
+ * rule: a trigger absorbed only if every group's contract says absorb). A
+ * busy capture lock pushes the boundary's merges onto a same-run retry list
+ * (retried at the next boundary and once in a final drain after the scan);
+ * a deadline, a backup failure, or a rewrite-call refusal/infra error defers
+ * the remaining work and holds the cursor.
  *
- * Cursor discipline mirrors stageSupersession: the cursor advances past a
- * candidate once its neighbor set has been considered, regardless of infra
- * skips — EXCEPT when rewrite groups or confirmed merges could not be applied
- * (budget exhausted / rewrite-call infra error / merge cap or lock): the
- * cursor then holds BELOW the earliest candidate contributing to the
- * un-applied work, so those pairs are re-detected next run (dup-over-loss —
- * an un-marked, un-rewritten, un-merged confirmed resolution must never be
- * silently dropped by the cursor passing it).
+ * Cursor discipline: the cursor advances past a candidate only when its
+ * iteration's confirmed work has LANDED (or was refused-with-verdict-rendered:
+ * metadata mismatch, conflict-linked, mark-only fallback). A deferral holds
+ * the cursor BELOW the current candidate — bounded to ONE candidate's pairs,
+ * re-detected and re-judged next run (dup-over-loss — a confirmed resolution
+ * must never be silently dropped by the cursor passing it). The separate
+ * scan high-water (state.reconsolidationScannedRowid) records the max
+ * candidate rowid ENTERED and is never held back, so the report can split
+ * verdict calls into pairs_reevaluated (at/below the prior high-water) vs
+ * pairs_new — the convergence measurement.
  *
  * Dry-run: the zone's discovery + the free idempotency check only — zero LLM
  * calls, zero writes, no cursor or band-stats persistence. Gate discovery is