@gamaze/hicortex 0.20.7 → 0.20.10

package/dist/run-deadline.js

@@ -0,0 +1,73 @@
+"use strict";
+/**
+ * The ONE cooperative wall-clock deadline for a nightly run (#405).
+ *
+ * Generalizes the #401/#402/#404 reconsolidation pattern (a deadline checked
+ * at safe boundaries + resumable cursors) from one stage to the whole
+ * pipeline: capture segments, every consolidation stage boundary, the
+ * item loops, and the deterministic merge zone all check the SAME deadline,
+ * created once at nightly start. On expiry each check site stops cleanly at
+ * its last safe boundary — cursors (capture per-session, supersession,
+ * reconsolidation) hold below unconfirmed work, so the next run resumes
+ * without redoing confirmed work or losing deferred work.
+ *
+ * Deferral is a REPORTED outcome, not an error: a run whose deadline fired
+ * reports consolidation status "deferred" and does NOT advance
+ * `lastConsolidated` (the same gate as endpoint_down — otherwise the
+ * pending-set queries would silently lose the deferred work).
+ *
+ * One structured log line per deferred stage (`event=deadline_deferred`,
+ * the same key=value style as `event=budget_exhausted` /
+ * `event=circuit_open`) so `grep event=deadline_deferred` is one of the two
+ * nightly health greps.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_NIGHTLY_TIME_BUDGET_MINUTES = void 0;
+exports.createRunDeadline = createRunDeadline;
+exports.resolveNightlyTimeBudgetMinutes = resolveNightlyTimeBudgetMinutes;
+const config_read_js_1 = require("./config-read.js");
+/** Default wall-clock budget for a full nightly run, in minutes (#405).
+ *  240 sits between the old stage-local reconsolidation clock (120) and the
+ *  old systemd backstop (360) — the deadline is now the operating bound and
+ *  the unit backstop (budget + 60 min slack) only catches a true hang. */
+exports.DEFAULT_NIGHTLY_TIME_BUDGET_MINUTES = 240;
+/**
+ * Create a run deadline of `minutes` (already-resolved value; see
+ * resolveNightlyTimeBudgetMinutes for the config boundary).
+ */
+function createRunDeadline(minutes, now = Date.now) {
+    const start = now();
+    const deadlineAt = start + Math.max(0, Math.round(minutes * 60_000));
+    const logged = new Set();
+    const deferred = [];
+    return {
+        deadlineAt,
+        remainingMs: () => Math.max(0, deadlineAt - now()),
+        expired: () => now() >= deadlineAt,
+        hit(stage) {
+            if (now() < deadlineAt)
+                return false;
+            if (!logged.has(stage)) {
+                logged.add(stage);
+                deferred.push(stage);
+                // Structured (grep-able) + human-readable — same contract as
+                // event=budget_exhausted (consolidate.ts) and event=circuit_open
+                // (llm.ts). remaining_ms=0 states the reason plainly.
+                console.warn(`[hicortex] event=deadline_deferred stage=${stage} ` +
+                    `deadline_minutes=${(deadlineAt - start) / 60_000} remaining_ms=0`);
+            }
+            return true;
+        },
+        deferredStages: () => deferred,
+    };
+}
+/**
+ * Resolve `nightlyTimeBudgetMinutes` from the saved config (#405): positive
+ * finite number wins; absent/0/invalid → the 240 default. Unlike the old
+ * `reconsolidationMaxMinutes`, 0 does NOT disable — there is ALWAYS a
+ * deadline (readPositiveConfig rejects 0 with a warn, which is the loud
+ * migration signal for an operator who used 0 as "off").
+ */
+function resolveNightlyTimeBudgetMinutes(config) {
+    return (0, config_read_js_1.readPositiveConfig)(config ?? {}, "nightlyTimeBudgetMinutes", exports.DEFAULT_NIGHTLY_TIME_BUDGET_MINUTES);
+}

package/dist/schema-prototypes.d.ts

@@ -121,9 +121,9 @@ export declare function computeTagWeights(db: Database.Database, memoryId: strin
  *
  * Used by the no-fit path (nofit.ts, owner amendment 07.07): when the LLM
  * says no domain fits, the memory can still earn a WEAK primary from pure
- * embedding association — provided the best cosine clears the configured
- * weakPrimaryFloor (the caller checks the floor; this function just reports
- * the argmax).
+ * embedding association — provided the best cosine clears the weak-primary
+ * floor (release-managed since #408; the caller checks the floor, this
+ * function just reports the argmax).
  *
  * Returns null when the memory has no stored vector or no configured domain
  * has a prototype (nothing to associate against). Ties resolve to the FIRST

package/dist/schema-prototypes.js

@@ -239,9 +239,9 @@ function computeTagWeights(db, memoryId, tags, prototypes) {
  *
  * Used by the no-fit path (nofit.ts, owner amendment 07.07): when the LLM
  * says no domain fits, the memory can still earn a WEAK primary from pure
- * embedding association — provided the best cosine clears the configured
- * weakPrimaryFloor (the caller checks the floor; this function just reports
- * the argmax).
+ * embedding association — provided the best cosine clears the weak-primary
+ * floor (release-managed since #408; the caller checks the floor, this
+ * function just reports the argmax).
  *
  * Returns null when the memory has no stored vector or no configured domain
  * has a prototype (nothing to associate against). Ties resolve to the FIRST

package/dist/stages.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Memory maturity stages — the console's derived presentation layer
+ * (#409/#421 Phase 1).
+ *
+ * The E-reframe (standing ruling in the #409 thread): stages are DERIVED
+ * presentation of the one numeric strength signal, never stored state. This
+ * module holds the pure derivation only — thresholds live in calibration.ts
+ * (the #408 single home, release-managed with the evolution contract); no
+ * db, no I/O, no config reads.
+ *
+ * Wire keys are forming/belief/truth/fading (lifecycle order). The console
+ * renders human labels over these keys; nothing else consumes them.
+ */
+/** A memory's derived maturity stage (lifecycle order). */
+export type Stage = "forming" | "belief" | "truth" | "fading";
+/** The four stages in lifecycle order: forming → belief → truth → fading. */
+export declare const STAGE_KEYS: readonly Stage[];
+/**
+ * Derive a memory's stage from its effective strength and recency.
+ *
+ * The recency gate runs FIRST: a memory untouched for
+ * STAGE_FADING_DAYS days is Fading no matter how strong it is — decay is a
+ * function of access in this system (effectiveStrength already folds
+ * last_accessed in, but the gate makes long silence legible on its own).
+ * Then the strength bands (calibrated against the measured production
+ * distribution — see calibration.ts): < FADING → fading (the weak cluster),
+ * ≥ TRUTH → truth, ≥ BELIEF → belief, else forming.
+ *
+ * `daysSinceAccess` is whole days (UTC day diff is fine — capture is
+ * night-resolution) since the memory was last touched. The DASHBOARD handler
+ * passes days since `last_accessed`, falling back to days since `created_at`
+ * when last_accessed is NULL (never accessed since ingest — creation is the
+ * last real signal). `null` means "recency unknown" and skips the gate
+ * (strength-only derivation) — the handler never sends it; it exists so the
+ * function is total over caller data quality.
+ */
+export declare function deriveStage(effectiveStrength: number, daysSinceAccess: number | null): Stage;

package/dist/stages.js

@@ -0,0 +1,51 @@
+"use strict";
+/**
+ * Memory maturity stages — the console's derived presentation layer
+ * (#409/#421 Phase 1).
+ *
+ * The E-reframe (standing ruling in the #409 thread): stages are DERIVED
+ * presentation of the one numeric strength signal, never stored state. This
+ * module holds the pure derivation only — thresholds live in calibration.ts
+ * (the #408 single home, release-managed with the evolution contract); no
+ * db, no I/O, no config reads.
+ *
+ * Wire keys are forming/belief/truth/fading (lifecycle order). The console
+ * renders human labels over these keys; nothing else consumes them.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STAGE_KEYS = void 0;
+exports.deriveStage = deriveStage;
+const calibration_js_1 = require("./calibration.js");
+/** The four stages in lifecycle order: forming → belief → truth → fading. */
+exports.STAGE_KEYS = ["forming", "belief", "truth", "fading"];
+/**
+ * Derive a memory's stage from its effective strength and recency.
+ *
+ * The recency gate runs FIRST: a memory untouched for
+ * STAGE_FADING_DAYS days is Fading no matter how strong it is — decay is a
+ * function of access in this system (effectiveStrength already folds
+ * last_accessed in, but the gate makes long silence legible on its own).
+ * Then the strength bands (calibrated against the measured production
+ * distribution — see calibration.ts): < FADING → fading (the weak cluster),
+ * ≥ TRUTH → truth, ≥ BELIEF → belief, else forming.
+ *
+ * `daysSinceAccess` is whole days (UTC day diff is fine — capture is
+ * night-resolution) since the memory was last touched. The DASHBOARD handler
+ * passes days since `last_accessed`, falling back to days since `created_at`
+ * when last_accessed is NULL (never accessed since ingest — creation is the
+ * last real signal). `null` means "recency unknown" and skips the gate
+ * (strength-only derivation) — the handler never sends it; it exists so the
+ * function is total over caller data quality.
+ */
+function deriveStage(effectiveStrength, daysSinceAccess) {
+    if (daysSinceAccess !== null && daysSinceAccess >= calibration_js_1.STAGE_FADING_DAYS) {
+        return "fading";
+    }
+    if (effectiveStrength < calibration_js_1.STAGE_FADING_STRENGTH)
+        return "fading";
+    if (effectiveStrength >= calibration_js_1.STAGE_TRUTH_STRENGTH)
+        return "truth";
+    if (effectiveStrength >= calibration_js_1.STAGE_BELIEF_STRENGTH)
+        return "belief";
+    return "forming";
+}

package/dist/state.d.ts

@@ -55,22 +55,39 @@ export interface HicortexState {
      * B) — highest memories.rowid whose decision/correction candidates have
      * been evaluated (or infra-skipped) this run. Absent/0 = never run. Unlike
      * relinkCursor/domainCursor (separate resumable CLI commands), this cursor
-     * advances a SMALL amount per night (config `supersessionMaxCalls`, default
-     * 30) as part of the regular nightly — the corpus is back-processed
-     * gradually over many nights.
+     * advances within the shared nightly LLM call budget as part of the regular
+     * nightly — the corpus is back-processed gradually over many nights.
      */
     supersessionCursor?: number;
     /**
      * Resume cursor for the nightly's reconsolidation stage (#384) — highest
      * memories.rowid whose candidates have been evaluated (or infra-skipped)
-     * this run. Absent/0 = never run. Same advance-past-considered-candidates
-     * discipline as supersessionCursor, with one addition: when a rewrite group
-     * could not be applied (budget exhausted / rewrite-call infra error), the
-     * cursor holds BELOW the earliest candidate contributing to an un-applied
-     * group so those pairs are re-detected next run — a confirmed correction is
-     * never silently dropped by the cursor passing it.
+     * with all their CONFIRMED work applied. Absent/0 = never run. Same
+     * advance-past-considered-candidates discipline as supersessionCursor,
+     * with one addition (#439): confirmed merges and rewrite groups apply at
+     * the candidate boundary — the END of the iteration that confirmed them —
+     * and the cursor advances past a candidate only when that apply landed.
+     * A deferral (budget refusal at the rewrite call, deadline at the
+     * boundary, backup failure, lock-busy merge surviving the final drain)
+     * holds the cursor BELOW the current candidate, so the hold is bounded to
+     * ONE candidate's pairs: next run re-detects and re-judges exactly those
+     * (dup-over-loss — a confirmed resolution is never silently dropped by the
+     * cursor passing it). The ONE cross-candidate window is the lock-busy
+     * retry list (plus deadline/backup-dropped tails re-queued at their
+     * boundary): while any retry merge is pending, every persisted checkpoint
+     * clamps below its earliest contributor, so a killed or stopped run can
+     * never strand a confirmed merge behind the cursor (fix round, #440).
      */
     reconsolidationCursor?: number;
+    /**
+     * #439 scan high-water for the reconsolidation stage — the highest
+     * memories.rowid any run has ENTERED, never held back by un-applied work
+     * (unlike reconsolidationCursor, which holds below deferred applies).
+     * Seeds the re-judged/new verdict split: a verdict call on a candidate
+     * at/below this mark is a re-judgment of previously judged work. Absent =
+     * never run; persisted alongside the cursor at every checkpoint.
+     */
+    reconsolidationScannedRowid?: number;
     /**
      * Resume cursor for `hicortex classify-types` (#216) — highest memories.rowid
      * whose batch has been fully committed. Absent/0 = never run (or reset).
@@ -78,6 +95,14 @@ export interface HicortexState {
      * interruption never loses more than the in-flight batch.
      */
     typeCursor?: number;
+    /**
+     * Resume cursor for `hicortex rescore-importance` (#425) — highest live
+     * memories.rowid re-judged under the current rubric. Absent/0 = never run
+     * (or reset). Advances per committed batch (LLM calls are 10 rows each
+     * inside a `--batch` slice); an infra error holds it at the last fully
+     * committed slice so a re-run resumes cleanly.
+     */
+    rescoreImportanceCursor?: number;
     /**
      * LLM token usage accrued this billing period (#246). Period reset is
      * monthly: when `periodStart` is in a previous calendar month, the totals

package/dist/storage.d.ts

@@ -8,6 +8,13 @@ import type { Memory, MemoryLink, InsertMemoryOptions } from "./types.js";
  * Serialize a Float32Array embedding to a Buffer for sqlite-vec.
  */
 export declare function embedToBlob(embedding: Float32Array): Buffer;
+/**
+ * #421 machine × harness identity: optional capture-machine provenance on
+ * /ingest + /distill. A string, trimmed, capped at 128 chars; anything else
+ * (absent, wrong type, blank) becomes NULL — a wrong machine name is worse
+ * than none. Never filtered; presentation grouping only.
+ */
+export declare function sanitizeSourceMachine(v: unknown): string | null;
 /**
  * Insert a memory and its vector embedding. Returns the memory's UUID.
  *
@@ -35,6 +42,28 @@ export declare function updateMemory(db: Database.Database, memoryId: string, fi
  * Atomically increment access_count and reset last_accessed.
  */
 export declare function strengthenMemory(db: Database.Database, memoryId: string, nowIsoStr: string): void;
+/**
+ * Record an owner corroboration (#423 phase 3): one UPDATE that bumps
+ * corroboration_count, nudges base_strength up by the calibration delta
+ * (MIN-capped at the importance ceiling, #425; COALESCE keeps NULL bases
+ * honest — the unscored default), stamps the importance watermark, and
+ * refreshes last_accessed (the console's "last confirmed" cell reads it: an
+ * enrich IS a confirmation, and it keeps the stage fading gate honest).
+ * EVIDENCE ABOUT IMPORTANCE ONLY — never access_count (reserved for real
+ * recall use) nor shown_count (index exposure): faking either corrupts the
+ * uses-per-showing adoption metric.
+ *
+ * Nightly interaction: the importance pool keys on importance_scored_at IS
+ * NULL (#425), so the watermark stamp here keeps the pre-#425 contract — an
+ * enriched memory leaves the pool and the owner's mark stands in for (and is
+ * never stomped by) the first LLM score. Dedup merges take
+ * max(base_strength), so a merge never loses the mark. Returns the fresh row
+ * values (re-read after the update); null when the id matches nothing.
+ */
+export declare function enrichMemory(db: Database.Database, memoryId: string, nowIsoStr: string): {
+    corroborationCount: number;
+    baseStrength: number;
+} | null;
 /**
  * Record that memories appeared in a pushed recall index (#192): bump
  * shown_count and refresh last_accessed (a mild strengthen — the decay clock
@@ -132,15 +161,15 @@ export declare function vectorSearch(db: Database.Database, queryEmbedding: Floa
     distance: number;
 }>;
 /**
- * BM25F field weights (config-driven via {@link configureBm25Fts}, called from
- * retrieval.configureScoring at boot). The order mirrors the FTS5 column
- * declaration in db.ts (content, project, domain) — `bm25(memories_fts, …)`
- * takes weights POSITIONALLY, so a new FTS column MUST be added here in the
- * same position or the weighting silently shifts. Defaults favor scope fields
- * (project/domain) over body so cross-scope noise that wins on raw token
- * frequency (the marine "battery" memory on a hardware query) is demoted
- * without excluding it — the same "graded, never binary" discipline as
- * computeScore's affinity terms.
+ * BM25F field weights (release-managed since #408 — the defaults resolve from
+ * calibration.ts; {@link configureBm25Fts} is the eval/test seam). The order
+ * mirrors the FTS5 column declaration in db.ts (content, project, domain) —
+ * `bm25(memories_fts, …)` takes weights POSITIONALLY, so a new FTS column
+ * MUST be added here in the same position or the weighting silently shifts.
+ * Defaults favor scope fields (project/domain) over body so cross-scope noise
+ * that wins on raw token frequency (the marine "battery" memory on a hardware
+ * query) is demoted without excluding it — the same "graded, never binary"
+ * discipline as computeScore's affinity terms.
  */
 export interface Bm25Weights {
     body: number;
@@ -148,14 +177,14 @@ export interface Bm25Weights {
     domain: number;
 }
 /**
- * Configure BM25F weights from config. Called by retrieval.configureScoring
- * (which itself is called at server + nightly boot) so storage and retrieval
- * rank identically. Invalid/out-of-range values keep the shipped default per
- * key. Range [0, ∞) — a 0 weight effectively drops that field from the score;
- * negative values are rejected (BM25F sign semantics break otherwise). Returns
- * the resolved set for logging/tests.
+ * Configure BM25F weights from RESOLVED overrides (the eval/test seam — #408;
+ * production calls it with no argument so storage and retrieval rank with the
+ * identical calibration defaults). Invalid/out-of-range values keep the
+ * shipped default per key. Range [0, ∞) — a 0 weight effectively drops that
+ * field from the score; negative values are rejected (BM25F sign semantics
+ * break otherwise). Returns the resolved set for logging/tests.
  */
-export declare function configureBm25Fts(config?: Record<string, unknown> | null): Bm25Weights;
+export declare function configureBm25Fts(overrides?: Partial<Bm25Weights> | null): Bm25Weights;
 /** Current resolved weights (tests + status output). */
 export declare function getBm25Weights(): Bm25Weights;
 /**
@@ -267,8 +296,11 @@ export declare function getPruneCandidates(db: Database.Database, cutoffIso: str
  */
 export declare function getAllLinkCounts(db: Database.Database): Map<string, number>;
 /**
- * Get all memories with default base_strength (never scored).
- * Absorbed memories are excluded (#384): they are invisible to recall, so
+ * Get all never-scored memories — the nightly importance pool, keyed on the
+ * importance_scored_at watermark (#425, migration v19). The pre-v19 sentinel
+ * (`base_strength = 0.5`) re-rolled every row the model genuinely scored
+ * 0.5, every night; NULL watermark = never scored under ANY rubric. Absorbed
+ * memories are excluded (#384): they are invisible to recall, so
  * importance-scoring one would spend an LLM call on dead evidence.
  */
 export declare function getUnscoredMemories(db: Database.Database): Memory[];

package/dist/storage.js

@@ -3,14 +3,49 @@
  * Storage layer — CRUD operations for the SQLite + sqlite-vec database.
  * Ported from hicortex/storage.py. All functions are synchronous (better-sqlite3).
  */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FTS_MATCH_MAX_TOKENS = void 0;
 exports.embedToBlob = embedToBlob;
+exports.sanitizeSourceMachine = sanitizeSourceMachine;
 exports.insertMemory = insertMemory;
 exports.resolveMemoryId = resolveMemoryId;
 exports.getMemory = getMemory;
 exports.updateMemory = updateMemory;
 exports.strengthenMemory = strengthenMemory;
+exports.enrichMemory = enrichMemory;
 exports.touchMemoriesShown = touchMemoriesShown;
 exports.deleteMemory = deleteMemory;
 exports.memoryRowid = memoryRowid;
@@ -38,6 +73,7 @@ exports.getAllLinkCounts = getAllLinkCounts;
 exports.getUnscoredMemories = getUnscoredMemories;
 const node_crypto_1 = require("node:crypto");
 const schema_prototypes_js_1 = require("./schema-prototypes.js");
+const CALIBRATION = __importStar(require("./calibration.js"));
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
@@ -56,6 +92,18 @@ function rowToMemory(row) {
 // ---------------------------------------------------------------------------
 // Single memory CRUD
 // ---------------------------------------------------------------------------
+/**
+ * #421 machine × harness identity: optional capture-machine provenance on
+ * /ingest + /distill. A string, trimmed, capped at 128 chars; anything else
+ * (absent, wrong type, blank) becomes NULL — a wrong machine name is worse
+ * than none. Never filtered; presentation grouping only.
+ */
+function sanitizeSourceMachine(v) {
+    if (typeof v !== "string")
+        return null;
+    const t = v.trim();
+    return t.length > 0 ? t.slice(0, 128) : null;
+}
 /**
  * Insert a memory and its vector embedding. Returns the memory's UUID.
  *
@@ -74,9 +122,9 @@ function insertMemory(db, content, embedding, opts = {}) {
         .prepare(`INSERT OR IGNORE INTO memories
        (id, content, base_strength, last_accessed, access_count,
         created_at, ingested_at, source_agent, source_agent_id, source_session,
-        source_domain, project, privacy, memory_type)
-       VALUES (?, ?, ?, ?, 0, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-        .run(id, content, opts.baseStrength ?? 0.5, ts, ts, ingestedTs, opts.sourceAgent ?? "default", opts.sourceAgentId ?? null, sourceSession, opts.sourceDomain ?? null, opts.project ?? null, opts.privacy ?? null, opts.memoryType ?? "experience");
+        source_domain, project, privacy, memory_type, source_machine)
+       VALUES (?, ?, ?, ?, 0, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+        .run(id, content, opts.baseStrength ?? 0.5, ts, ts, ingestedTs, opts.sourceAgent ?? "default", opts.sourceAgentId ?? null, sourceSession, opts.sourceDomain ?? null, opts.project ?? null, opts.privacy ?? null, opts.memoryType ?? "experience", opts.sourceMachine ?? null);
     if (result.changes > 0) {
         // New row — store its vector.
         db.prepare("INSERT INTO memory_vectors (id, embedding) VALUES (?, ?)").run(id, embedToBlob(embedding));
@@ -138,6 +186,10 @@ const ALLOWED_UPDATE_FIELDS = new Set([
     // reconsolidation stage, explicit ingest marks, and history rollback.
     // Code-defined vocabulary — see Memory.status.
     "status",
+    // Importance scored-at watermark (#425, migration v19): written by
+    // stageImportance, the enrich path, and the rescore-importance backfill —
+    // the moment a row's base_strength is settled under some rubric.
+    "importance_scored_at",
 ]);
 /**
  * Update specific fields on a memory.
@@ -164,6 +216,42 @@ function strengthenMemory(db, memoryId, nowIsoStr) {
      SET access_count = access_count + 1, last_accessed = ?
      WHERE id = ?`).run(nowIsoStr, memoryId);
 }
+/**
+ * Record an owner corroboration (#423 phase 3): one UPDATE that bumps
+ * corroboration_count, nudges base_strength up by the calibration delta
+ * (MIN-capped at the importance ceiling, #425; COALESCE keeps NULL bases
+ * honest — the unscored default), stamps the importance watermark, and
+ * refreshes last_accessed (the console's "last confirmed" cell reads it: an
+ * enrich IS a confirmation, and it keeps the stage fading gate honest).
+ * EVIDENCE ABOUT IMPORTANCE ONLY — never access_count (reserved for real
+ * recall use) nor shown_count (index exposure): faking either corrupts the
+ * uses-per-showing adoption metric.
+ *
+ * Nightly interaction: the importance pool keys on importance_scored_at IS
+ * NULL (#425), so the watermark stamp here keeps the pre-#425 contract — an
+ * enriched memory leaves the pool and the owner's mark stands in for (and is
+ * never stomped by) the first LLM score. Dedup merges take
+ * max(base_strength), so a merge never loses the mark. Returns the fresh row
+ * values (re-read after the update); null when the id matches nothing.
+ */
+function enrichMemory(db, memoryId, nowIsoStr) {
+    const result = db
+        .prepare(`UPDATE memories
+       SET corroboration_count = corroboration_count + 1,
+           base_strength = MIN(?, COALESCE(base_strength, 0.5) + ?),
+           importance_scored_at = COALESCE(importance_scored_at, ?),
+           last_accessed = ?
+       WHERE id = ?`)
+        .run(CALIBRATION.IMPORTANCE_CEILING, CALIBRATION.ENRICH_STRENGTH_DELTA, nowIsoStr, nowIsoStr, memoryId);
+    if (result.changes === 0)
+        return null;
+    const row = db
+        .prepare("SELECT corroboration_count, base_strength FROM memories WHERE id = ?")
+        .get(memoryId);
+    return row
+        ? { corroborationCount: row.corroboration_count, baseStrength: row.base_strength }
+        : null;
+}
 /**
  * Record that memories appeared in a pushed recall index (#192): bump
  * shown_count and refresh last_accessed (a mild strengthen — the decay clock
@@ -354,28 +442,28 @@ function vectorSearch(db, queryEmbedding, limit = 10, excludeIds = []) {
     return results;
 }
 const BM25_DEFAULTS = {
-    body: 1.0,
-    project: 2.0,
-    domain: 2.0,
+    body: CALIBRATION.BM25_WEIGHT_BODY,
+    project: CALIBRATION.BM25_WEIGHT_PROJECT,
+    domain: CALIBRATION.BM25_WEIGHT_DOMAIN,
 };
 let bm25Weights = { ...BM25_DEFAULTS };
 /**
- * Configure BM25F weights from config. Called by retrieval.configureScoring
- * (which itself is called at server + nightly boot) so storage and retrieval
- * rank identically. Invalid/out-of-range values keep the shipped default per
- * key. Range [0, ∞) — a 0 weight effectively drops that field from the score;
- * negative values are rejected (BM25F sign semantics break otherwise). Returns
- * the resolved set for logging/tests.
- */
-function configureBm25Fts(config) {
-    const num = (key, dflt) => {
-        const v = Number(config?.[key]);
-        return Number.isFinite(v) && v >= 0 ? v : dflt;
+ * Configure BM25F weights from RESOLVED overrides (the eval/test seam — #408;
+ * production calls it with no argument so storage and retrieval rank with the
+ * identical calibration defaults). Invalid/out-of-range values keep the
+ * shipped default per key. Range [0, ∞) — a 0 weight effectively drops that
+ * field from the score; negative values are rejected (BM25F sign semantics
+ * break otherwise). Returns the resolved set for logging/tests.
+ */
+function configureBm25Fts(overrides) {
+    const num = (v, dflt) => {
+        const n = Number(v);
+        return Number.isFinite(n) && n >= 0 ? n : dflt;
     };
     bm25Weights = {
-        body: num("bm25WeightBody", BM25_DEFAULTS.body),
-        project: num("bm25WeightProject", BM25_DEFAULTS.project),
-        domain: num("bm25WeightDomain", BM25_DEFAULTS.domain),
+        body: num(overrides?.body, BM25_DEFAULTS.body),
+        project: num(overrides?.project, BM25_DEFAULTS.project),
+        domain: num(overrides?.domain, BM25_DEFAULTS.domain),
     };
     return { ...bm25Weights };
 }
@@ -487,14 +575,18 @@ function searchFts(db, query, limit = 10, sourceAgent) {
  * Create a link between two memories.
  */
 function addLink(db, sourceId, targetId, relationship, strength = 0.5) {
-    // Guard: superseded_by and corrected_by are the ranking-demotion /
-    // correction-resolution signals, so never let a different relationship
-    // clobber an existing one for the same pair — INSERT OR REPLACE would
-    // otherwise silently remove the resolution (corrected_by is protected
-    // exactly like superseded_by, #384 AC9).
-    if (relationship !== "superseded_by" && relationship !== "corrected_by") {
+    // Guard: superseded_by, corrected_by, and conflicts are the ranking-demotion /
+    // correction-resolution / conflict-preservation signals, so never let a
+    // different relationship clobber an existing one for the same pair — INSERT
+    // OR REPLACE would otherwise silently remove the resolution (corrected_by is
+    // protected exactly like superseded_by, #384 AC9; conflicts joins the set in
+    // #393 guard-C — a conflicts edge marks the pair as never-blendable, so it
+    // must survive arbitrary later link writes exactly the same way).
+    if (relationship !== "superseded_by" &&
+        relationship !== "corrected_by" &&
+        relationship !== "conflicts") {
         const protectedLink = db
-            .prepare("SELECT 1 FROM memory_links WHERE source_id = ? AND target_id = ? AND relationship IN ('superseded_by', 'corrected_by') LIMIT 1")
+            .prepare("SELECT 1 FROM memory_links WHERE source_id = ? AND target_id = ? AND relationship IN ('superseded_by', 'corrected_by', 'conflicts') LIMIT 1")
             .get(sourceId, targetId);
         if (protectedLink)
             return;
@@ -641,14 +733,17 @@ function getAllLinkCounts(db) {
     return counts;
 }
 /**
- * Get all memories with default base_strength (never scored).
- * Absorbed memories are excluded (#384): they are invisible to recall, so
+ * Get all never-scored memories — the nightly importance pool, keyed on the
+ * importance_scored_at watermark (#425, migration v19). The pre-v19 sentinel
+ * (`base_strength = 0.5`) re-rolled every row the model genuinely scored
+ * 0.5, every night; NULL watermark = never scored under ANY rubric. Absorbed
+ * memories are excluded (#384): they are invisible to recall, so
  * importance-scoring one would spend an LLM call on dead evidence.
  */
 function getUnscoredMemories(db) {
     const rows = db
         .prepare(`SELECT * FROM memories
-       WHERE base_strength = 0.5 AND COALESCE(status, '') != 'absorbed'
+       WHERE importance_scored_at IS NULL AND COALESCE(status, '') != 'absorbed'
        ORDER BY ingested_at ASC`)
         .all();
     return rows.map(rowToMemory);

package/dist/telemetry.d.ts

@@ -91,17 +91,17 @@ export interface TelemetryPayload {
      * `runConsolidation`'s status: "completed" | "skipped" | "failed", plus
      * "no_llm" when consolidation was skipped because no LLM was configured,
      * "throttled" (#246) when the run was skipped because the
-     * `llmTokensPerMonth` fair-use cap was projected to be exceeded, and
-     * "endpoint_down" (#337) when the pre-consolidation readiness probe failed
-     * or the LLM circuit breaker was open after the run — a TRANSIENT state
-     * (retried next run), never reported as "completed" even though the stages
-     * fail soft.
+     * `llmTokensPerMonth` fair-use cap was projected to be exceeded,
+     * "endpoint_down" (#337) when the LLM circuit breaker was open after the
+     * run, and "deferred" (#405) when the run-wide wall-clock deadline fired —
+     * the latter two are TRANSIENT states (retried next run), never reported
+     * as "completed" even though the stages fail soft.
      * "skipped" = the built-in nothing-to-do short-circuit (no new + no unscored
      * memories → zero LLM calls), NOT a failure. Lets the fleet aggregate tell a
      * real consolidation run from a no-op without repurposing `ok` (which is the
      * capture-health signal). 0.17+.
      */
-    consolidation?: "completed" | "skipped" | "failed" | "no_llm" | "throttled" | "endpoint_down";
+    consolidation?: "completed" | "skipped" | "failed" | "no_llm" | "throttled" | "endpoint_down" | "deferred";
     /**
      * Total LLM tokens consumed by THIS nightly's consolidation (#246) — the
      * BudgetTracker total. Server-mode only (capture-only + client runs make no
@@ -111,7 +111,8 @@ export interface TelemetryPayload {
      */
     tokens_this_run?: number;
     /**
-     * True when the per-tenant consolidation budget (`consolidateMaxLlmCalls`)
+     * True when the per-tenant consolidation budget (`nightlyLlmCallBudget`,
+     * #405 — formerly consolidateMaxLlmCalls)
      * was exhausted this run (#255) — LLM-bound stages deferred remaining work.
      * A quality-degradation signal concentrated on heavy users; absent on a
      * pre-#255 ping, a capture-only/no-LLM/throttled/skipped run, or when the

package/dist/token-budget.js

@@ -105,10 +105,9 @@ function recordDistillUsage(stateDir, usage) {
     let periodStart = "";
     (0, state_js_1.updateState)((s) => {
         const prev = s.llmTokensThisPeriod;
-        // Monthly reset (year+month) — matches shouldThrottleTokens's staleness check.
-        const stale = !prev?.periodStart ||
-            new Date(prev.periodStart).getUTCFullYear() !== new Date().getUTCFullYear() ||
-            new Date(prev.periodStart).getUTCMonth() !== new Date().getUTCMonth();
+        // Monthly reset — the ONE staleness helper (#405; was a hand-rolled copy
+        // of shouldThrottleTokens's check).
+        const stale = (0, consolidate_js_1.isStaleTokenPeriod)(prev?.periodStart);
         if (stale) {
             s.llmTokensThisPeriod = {
                 prompt: usage.prompt,