@gamaze/hicortex 0.20.7 → 0.20.9

package/README.md

@@ -116,11 +116,11 @@ Edit `~/.hicortex/config.json` on the server machine:
 }
 ```
 
-A richer example — including a `compartment: true` work/life firewall and a custom `weakPrimaryFloor` — ships as `domains.example.json` in the package.
+A richer power-user example (a wider life-sphere set) ships as `domains.example.json` in the package.
 
 **How classification works:** the LLM decides only *which* of your domains apply to a memory — never weights or rankings. The weight of each tag is derived from your own data: each domain builds a prototype from the memories already in it, and a tag's weight is how strongly the memory's embedding matches that prototype. The primary domain is picked deterministically from those weights, and everything is recomputed each nightly, so your categories drift with your data instead of going stale. Memories that genuinely fit nothing get a weak association when they are close enough to some domain — and otherwise fade away over time. No junk drawer, no "Unsorted" pile.
 
-`weakPrimaryFloor` (config, default 0.45) sets how close a no-fit memory must be to its nearest domain to earn that weak association instead of fading.
+How close a no-fit memory must be to its nearest domain to earn that weak association (instead of fading) is a release-managed calibration constant — it ships with each release and changes only with published eval evidence, not a config key.
 
 **Backfill an existing corpus** (server mode, needs `domains` in config):
 
@@ -250,19 +250,12 @@ Config at `~/.hicortex/config.json`. Created by `init`. Key options:
 | `mode` | `"server"` (default) or `"client"` |
 | `serverUrl` | Remote server URL (client mode) |
 | `llmModel` | The one model used by all phases (distill, score, classify, reflect). Set via `init`. |
-| `numCtx` | Context window for ollama (default 8192, one value for all phases). Scoring uses ~850 tokens, so 2048 is ample; distill/reflect/classify need more for `detectChunkSize`'s chunk sizing. |
 | `enableThinking` | Toggle the model's internal reasoning ("thinking") stream for OpenAI-compatible endpoints (default false). Only meaningful for local chat-template-aware servers (ollama, mlx-lm); leave unset for cloud OpenAI/OpenRouter/Groq endpoints (they 400 on the unknown `chat_template_kwargs` field). |
 | `maxTokens` | Max output tokens for all phases (default 8192). A ceiling, not a target — the model stops early when done. |
-| `classifyMaxTokens` | Max output tokens for the classify tier — the short JSON-verdict calls (correction/supersession verdicts, rewrite contracts, type and domain tag classification). Default 1024. A ceiling, not a target: raise it when a reasoning-style model spends the budget on internal reasoning and returns empty verdicts; `maxTokens` keeps governing the heavy phases (distill, reflect). |
-| `ollamaFlushEvery` | Flush ollama's accumulated memory every N scoring calls. **Off by default (0)** — opt-in only for an **ollama** install whose runner RSS growth (~171 MB/call) swap-thrashes long consolidations on a RAM-constrained box; N=15 caps a cycle at ~2.5 GB. Gated on the provider being ollama (local **or** remote) — no effect for non-ollama providers. Only you can judge whether your ollama endpoint actually suffers the growth (a managed/cloud ollama host may not), so it stays off until you set it. |
-| `ollamaFlushWaitMs` | Milliseconds to wait after an ollama flush for the runner to exit + release memory (default 180000 = 3 min). |
 | `llmTimeoutMs` | The ONE timeout ceiling on every LLM call in every phase (default 900000 = 15 min). The LLM request paths disable the HTTP client's hidden 5-minute response-header timer, so this knob is the only bound — one place to tune when the endpoint is slow, no per-phase special cases. |
-| `llmBreakerThreshold` | Consecutive fully-failed LLM calls (after their built-in retry ladder) that open the per-endpoint circuit breaker (default 3; **0 disables the breaker**). While open, calls fail fast with no network I/O; an HTTP error with a response body, a malformed-reply parse error, or a rate-limit 429 never counts — only the endpoint being unreachable/hung does. |
-| `llmBreakerCooldownMs` | How long the breaker stays open before one half-open trial call goes out (default 600000 = 10 min). A failing trial re-opens it; a succeeding one resets the counter. |
-| `llmProbeTimeoutMs` | Patience of the readiness probe — one minimal 1-token generation request the nightly sends before consolidating and the daemon sends before distilling (default 60000 = 1 min). Catches a gateway that answers health/model-list queries while generation is dead; a failed probe skips consolidation (`endpoint_down`, retried next run) and answers `/distill` with a 503 so capture holds its cursor. |
+| `llmProbeTimeoutMs` | Patience of the readiness probe — one minimal 1-token generation request the daemon sends before distilling (default 60000 = 1 min). Catches a gateway that answers health/model-list queries while generation is dead; a failed probe answers `/distill` with a 503 so capture holds its cursor. The nightly no longer probes — its dead-endpoint signal is the circuit breaker (`endpoint_down`, retried next run) |
 | `llmProbeTtlMs` | How long the daemon caches a `/distill` probe outcome (default 300000 = 5 min). A healthy capture cadence pays at most one probe per window; a dead endpoint turns into fast cached 503s instead of every request paying the probe timeout. |
 | `llmSingleFlight` | **Serialized LLM calls — default `true`.** At most ONE request in flight per endpoint at any moment, across every process (the daemon distilling concurrent captures, the nightly consolidating, CLI backfills take turns via a per-endpoint lock file). One Hicortex server is several callers at once, and local single-user model servers (a Mac mini or laptop serving one big-context model) can stall or crash — taking the machine with them — under two concurrent large requests. Queued calls wait their turn; batches run back-to-back. **Set `false` if your endpoint is a beefy multi-tenant service that parallelizes well and you want faster consolidation** — you opt into responsibility for the endpoint's concurrency safety. |
-| `llmSingleFlightWaitMs` | How long a queued call waits for the in-flight call before failing as endpoint-down and retrying per the normal ladder/breaker rules (default: `max(900000, llmTimeoutMs)` — a waiter never gives up before a legitimate in-flight call's own, possibly raised, ceiling expires). Only meaningful with serialization on. Note under contention: the readiness probe queues too, but its wait is capped by its own probe budget — during a long consolidation batch, `/distill` answers 503 quickly (captures cursor-hold and retry, lossless) rather than holding the socket for the full queue budget. |
 | `authToken` | Bearer token for endpoint auth. Generated on first `init` in server mode. Find the active token with `hicortex status` or in `~/.hicortex/config.json`. |
 | `corsAllowedOrigins` | Browser origins allowed to read cross-origin responses, e.g. `["https://ui.example.com"]`. **Empty by default** — the server sends no `Access-Control-Allow-Origin` and never `Allow-Credentials`, so no external web page can read its data. The bundled `/viz` and `/identity/ui` pages are same-origin and need no entry. |
 | `licenseKey` | Commercial license key (optional; for display in `hicortex status`) |
@@ -270,8 +263,6 @@ Config at `~/.hicortex/config.json`. Created by `init`. Key options:
 | _env_ `HICORTEX_DISTILL_BODY_LIMIT_MB` | Environment override for the `/distill` body limit — **wins over the `distillBodyLimitMb` config key in every mode** (that is the point: a deployment operator pins it so tenant-writable config cannot raise it). Unset = config/default applies. |
 | _env_ `HICORTEX_MEMORY_CAP` | Environment override for the memory soft cap — a **positive** value wins over the `memorySoftCap` config key in every mode; `0`/negative/malformed fall through to the config key, then the 10000 default (an env can pin a cap, never disable one — config `memorySoftCap: 0` still disables when the env is unset). Mode-agnostic operator knob: nightly eviction, the dashboard-snapshot capacity stamp, and the live dashboard gauge all resolve through the same resolver, so the enforced and displayed caps can never disagree. Drives `nightly --evict-only` the same way. |
 | `domains` | Your memory domain list (`[{name, description}]`). Scaffolded by `init`; edit freely — see [Memory Domains & Tags](#memory-domains--tags) |
-| `weakPrimaryFloor` | Minimum similarity for a no-fit memory to keep a weak domain association (default: 0.45) |
-| `moduleIndexTokenBudget` | Max tokens for domain index in lessons context (default: 500) |
 | `lessonsLimit` | Max lessons injected into an agent's session-start context (default: 10). Lessons are ranked per session by project/domain affinity + recency + strength + access, so each session sees its most-relevant slice. Lower = leaner system prompts. |
 | `identityClients` | Which harnesses inject the [identity layer](#identity-layer) at session start (default `["cc"]`; `"all"` or any subset of `cc`/`hermes`/`oc`/`pi`/`opencode`) |
 | `identityAgents` | Per-agent identity modes (0.13): `{ "<id>": "override" \| "global" \| "off" }`. Absent + no `agents/<id>/` dir → every agent gets the global set. Boot-time (restart to apply) — see [Per-agent identity](#per-agent-identity-013) |
@@ -279,39 +270,17 @@ Config at `~/.hicortex/config.json`. Created by `init`. Key options:
 | `captureCooldownHours` | Success-cooldown (hours) for the **capture watchdog** (0.17). The capture timer polls every ~20 min; the watchdog captures only if more than this has elapsed since the last *successful* capture (`state.lastNightly`). Default `6` (≈4 captures/day). A failed preflight retries on the next poll (~20 min) — so a transient fire-instant network miss costs minutes, not a day (#239) |
 | `consolidationHours` | Hours (0–23, local) for the **consolidation** timer — the full nightly (capture + distill + score + reflect + link). Installed for **server/co-located only** (clients have no local DB). Default `[10, 22]`: the 22:00 evening slot runs after the day's capture waves (same-day results); the 10:00 morning slot runs *after* the morning capture so wake-up pushes are caught. Omitted on clients |
 | `timerJitterSeconds` | Max random delay (seconds) added to **generated** consolidation timers (#256), so a fleet doesn't all fire on the same minute (thundering-herd → LLM-backend contention). systemd: a single `RandomizedDelaySec=<n>`; launchd has no native equivalent so a per-install randomized `Minute` offset is baked into every `StartCalendarInterval` dict (sub-60s values no-op on launchd). Default `3600` (≈±30 min spread on the 2-slot/day cadence); `0` disables. Affects timers on the next `init` (re-init rewrites the unit files; installs that don't re-init keep their existing timers) |
-| `consolidateMaxLlmCalls` | Ceiling on total LLM calls across all classify-tier consolidation stages (content-domain, link discovery, supersession) per run. A runaway **backstop**, not a throughput throttle — on a free local model the binding constraint is the nightly unit's wall-clock timeout, not call count. Default `5000` (was a hard-coded 200 that starved link/supersession during a classification backlog) |
+| `nightlyTimeBudgetMinutes` | The ONE wall-clock budget (minutes) for a nightly run: capture and every consolidation stage share one cooperative deadline, checked at safe boundaries (capture segments, stage boundaries, item loops, the merge zone). A run whose deadline fires reports consolidation `deferred` and resumes from its cursors next run — no work lost, none redone. Default `240`; `0`/invalid → default (a deadline always exists — there is no "off"). The systemd unit's `TimeoutStartSec` is derived from this (+60 min slack) at `init` |
+| `nightlyLlmCallBudget` | The ONE per-run ceiling on LLM calls across the whole pipeline. Consumed in run order — a stage that exhausts it defers its remainder via its cursor. Bounds money/load independent of latency: a fast metered or capacity-limited endpoint permits thousands of calls inside the wall-clock budget, so time alone cannot protect it. Default `5000`; `0`/invalid → default. `consolidateMaxLlmCalls` is a **deprecated alias** (honored one release when the new key is absent — rename it) |
 | `memorySoftCap` | Soft cap on the memory corpus (default 10000). When the corpus exceeds this, the nightly's capacity-eviction stage removes the lowest-`effectiveStrength` memories (ties broken by oldest access) until under the cap — the active forgetting mechanism that bounds DB size, vector-index RAM, and consolidation workload. `0` disables eviction (indefinite growth — the pre-#245 behaviour). The evicted tail is cold by construction (effectiveStrength is the same decay-weighted score the recall ranker uses, so these were not surfacing in the top-k anyway). At 10K memories the load + JS sort is <100 ms |
 | `updateChannel` | Release channel pinned into the generated daemon/timer ExecStart for **npx-thin** installs (global-binary installs use the absolute binary and are unaffected). A dist-tag (`"rc"`, `"next"`) or an exact version (`"0.17.1"`). E.g. `"rc"` → the timer runs `npx -y @gamaze/hicortex@rc nightly`, so the host tracks the rc dist-tag (an internal fleet can ride rc through a pre-promotion soak). Validated as `[\w.\-]+` (rejects anything that'd break the unit/plist templates). Absent → auto-detect (bare on `latest`, else `@next`). (0.17.1) |
 | `nightlyHour` | **Deprecated (0.17) single-slot fallback.** Local hour (0–23) honoured only when `consolidationHours` is absent — yields one daily consolidation slot at that hour (preserves the pre-0.17 "one daily job" intent). New installs should use `consolidationHours` |
-| `preflightTimeoutMs` | **Client mode only.** Per-attempt timeout for the nightly's server-reachability check before it starts capturing (default: 20000 ms, bumped from 15000 in 0.17 to absorb a slow link re-establishing after the client wakes) |
-| `preflightAttempts` | **Client mode only.** Reachability-check retries before the nightly aborts (default: 3; floored at 1). `1` = single try, no retry |
-| `preflightRetryGapMs` | **Client mode only.** Delay between reachability retries (default: 60000 ms). Note: timers don't advance while the machine is asleep, so on a sleeping laptop this gap counts awake-time, not wall-clock |
-| `scoreSimilarityWeight` | Weight of semantic similarity in the ranking score (default: 0.50) |
-| `scoreStrengthWeight` | Weight of effective strength — importance/use/recency of access (default: 0.20) |
-| `scoreConnectionsWeight` | Weight of graph centrality (default: 0.15) |
-| `scoreRecencyWeight` | Weight of the slow recency curve (default: 0.15) |
-| `freshnessBoostDays` | Fresh-memory window: new memories rank higher for this many days (default: 7) |
-| `freshnessBoostWeight` | Size of the fresh-memory bonus at age 0, fading linearly to 0 at the window edge (default: 0.15; set 0 to disable) |
-| `supersededDemotion` | Score multiplier for a memory a later decision reversed (default: 0.50) |
-| `decayHalfLifeDays` | Memory decay half-life in days at reference importance (default: 365). Larger = slower forgetting; importance, access, and links slow it further |
-| `searchLimit` / `recentLimit` | Default result counts for search (8) and recent (12) |
-| `recentWindowDays` | Candidate window for recent recall (default: 180) |
-| `coldExposureSlots` | Top-k slots reservable for never-accessed memories so the long tail gets exposure (default: 2) |
-| `recallMaxItems` | Max lines in the pushed recall index (default: 5) |
-| `noveltyFloorSlots` | Slots of `recallMaxItems` guaranteed to the top passing hit(s) of the pure-prompt (unblended) search — the novelty floor. Keeps a session whose earlier turns set a strong intent from burying a topic-switching prompt's best matches: the floor's picks render first, turn-based re-show suppression still applies, and the total never exceeds `recallMaxItems` (default: 2; set 0 to disable) |
-| `recallMinSimilarity` | Relevance floor for index entries (default: 0.62; text-search matches always pass) |
-| `recallReshowTurns` | Turns before an already-shown memory may reappear in the same session (default: 30) |
-| `recallMinPromptChars` | Prompts shorter than this skip the recall index (default: 20) |
-| `recallTitleChars` | Chars of each memory's first line shown in an index entry (default: 100, range 40–400). Reverted from 150 on 2026-08-03: a full-corpus relevance eval found 100 and 150 statistically identical while 100 saves ~13% of the block's tokens |
-| `sessionIntentWeight` | Blend weight of the session-intent rolling centroid in the recall search vector: `query = (1-w)·prompt + w·centroid` (default: 0.33; set 0 to disable — pure-prompt recall, the kill-switch). The first turn of a session searches with pure prompt and seeds the centroid; subsequent turns blend so recall follows the session's intent instead of being query-literal. The EMA rate (0.4) is a shipped constant, not configurable |
-| `dedupAutoMergeThreshold` | The deterministic merge ceiling of the unified resolution pass: memory pairs at/above this cosine merge automatically (zero LLM) via the dedup core's clustering; pairs between `correctionMinSimilarity` and this value get the one merge/corrects/supersedes/none verdict. Also the default threshold for `hicortex dedup` (default: 0.92) |
-| `dedupMergeThreshold` | Legacy alias for `dedupAutoMergeThreshold`, still honored when the newer key is absent |
-| `dedupNightlyMaxMerges` | Pacing cap on merge operations per nightly run — deterministic-zone clusters plus verdict-confirmed pair merges count against one cap, so a large duplicate backlog drains over a few nights (default: 250; `0` disables the merge machinery) |
-| `supersessionMinSimilarity` | Minimum cosine similarity for a nightly supersession candidate pair (default: 0.80) |
-| `supersessionMaxCalls` | Max classify-tier LLM calls the nightly's supersession stage spends per run (default: 30) |
-| `supersessionPenalty` | Multiplier applied to a superseded memory's `base_strength` (default: 0.5) |
 | `telemetry` | Anonymous usage telemetry. **On by default and not written into config by `init`** — add `"telemetry": false` yourself (or set `HICORTEX_TELEMETRY=off`) to opt out. Inspect exactly what is sent with `hicortex telemetry` |
 
+**Calibration is release-managed.** The ~35 tuning keys earlier releases exposed (recall breadth, relevance floors, ranking weights, decay speed, dedup/supersession/correction thresholds, the weak-primary floor) are no longer config: they are constants that ship with each release and change only in releases, with the eval evidence linked in the changelog. Config values for them are ignored — the server prints a one-time boot warning naming each ignored key. Your config file now describes your *install* (mode, model, schedules, identity, budgets), not the brain's tuning.
+
+**Diagnostic tier (environment).** Three niche, ollama-only operational values moved from config to environment variables: `HICORTEX_NUM_CTX` (context window for ollama, default 8192), `HICORTEX_OLLAMA_FLUSH_EVERY` (flush ollama's accumulated memory every N LLM calls; default 0 = off), and `HICORTEX_OLLAMA_FLUSH_WAIT_MS` (post-flush wait, default 180000). Pin them in a service unit's environment when needed; the old config keys are ignored with a boot warning naming the replacement.
+
 Full docs: [hicortex.gamaze.com/docs/configuration.html](https://hicortex.gamaze.com/docs/configuration.html)
 
 ## REST API
@@ -355,7 +324,7 @@ Optional config (add to plugin entry in `~/.openclaw/openclaw.json`):
 | `serverUrl` | `http://127.0.0.1:8787` | Hicortex server URL. Change for remote servers. |
 | `authToken` | _(none)_ | Bearer token. Localhost bypasses auth; required for remote servers. Get the token from `hicortex status` on the server. |
 | `defaultProject` | _(none)_ | Project name sent on recall, search, recent, and ingest whenever the gateway supplies no project (Hermes `default_project` parity). |
-| `recallLimit` | `8` | Max memories per recall on the pre-0.14 `/search` fallback. The pushed recall index is sized by SERVER config (`recallMaxItems`) — the server accepts no client limit. |
+| `recallLimit` | `8` | Max memories per recall on the pre-0.14 `/search` fallback. The pushed recall index is sized by the server's release-managed calibration — the server accepts no client limit. |
 | `scaffoldDeadMan` | `true` | Auto-scaffold the dead-man identity-guard line into the agent workspace bootstrap (`BOOTSTRAP.md`) at startup. Set `false` to disable the write and any file creation entirely. |
 
 If `serverUrl`/`authToken` are absent from the config, the `HICORTEX_URL` and `HICORTEX_AUTH_TOKEN` environment variables are used as fallbacks (config always wins).

package/dist/calibration.d.ts

@@ -0,0 +1,174 @@
+/**
+ * Release-managed calibration constants (#408) — the single home of every
+ * tuning value the product ships. One value, one definition, one provenance
+ * comment. Nothing in here is read from ~/.hicortex/config.json anymore: the
+ * ~35 tuning keys that 0.15–0.20 exposed as config are now CONSTANTS that
+ * move only in releases. The user config surface shrinks to the keys that
+ * describe an install (mode, model, schedules, identity, budgets), not the
+ * ones that tune the brain.
+ *
+ * EVOLUTION CONTRACT: these values change ONLY in releases, with the
+ * eval/band-stats evidence linked in the changelog line that moves them
+ * (eval harness = `npm run eval` + the resolution band stats in the nightly
+ * report). Never in a patch to quiet one corpus, never behind a new config
+ * key. The seams for EXPERIMENTS are the configure*() functions in
+ * retrieval.ts / storage.ts (and the stage Options fields) — the eval and
+ * the tests sweep values through them; production never passes anything, so
+ * every process scores with exactly these constants.
+ *
+ * Every value below equals the default the code shipped the day this module
+ * was introduced (verified by tests/calibration.test.ts) — an install that
+ * never set the old config keys sees byte-identical behavior. The old keys
+ * are warned as RELEASE-MANAGED at the config boundary (config-read.ts) so
+ * the removal is never silent.
+ */
+/**
+ * Memory-decay half-life (days) at the reference importance 0.5. #192 recall/
+ * decay alignment: was ~115 days — aggressive enough to bury the long tail in
+ * ranking. Long-term remembering is the product; time preference stays mild.
+ */
+export declare const DECAY_HALF_LIFE_DAYS = 365;
+/** Default k for retrieve() (/search without an explicit limit). #192. */
+export declare const SEARCH_LIMIT = 8;
+/** Default k for searchRecent() (/recent without an explicit limit). #192. */
+export declare const RECENT_LIMIT = 12;
+/** searchRecent() candidate window, days. #192. */
+export declare const RECENT_WINDOW_DAYS = 180;
+/** Top-k slots reservable for never-accessed memories (cold exposure). #192:
+ *  recall was too passive (88% of memories never accessed) — the long tail
+ *  gets guaranteed slots instead of waiting for the strength clock. */
+export declare const COLD_EXPOSURE_SLOTS = 2;
+/** Blend weight of the session-intent centroid in the recall search vector
+ *  (#192, 0.15.3): query = (1-w)·prompt + w·centroid. The kill-switch is the
+ *  configureSessionIntent(0) seam (eval-only); production always ships 0.33. */
+export declare const SESSION_INTENT_WEIGHT = 0.33;
+/** Relevance-gate floor for vector-only /recall-index candidates. 0.62
+ *  (raised from 0.55 on 2026-08-03 per a 0.01-step floor sweep on the
+ *  rewritten corpus): steady ~3:1 noise:signal removal with no knee; sits
+ *  below the 0.63 local pessimum. FTS-matched candidates pass regardless. */
+export declare const RECALL_MIN_SIMILARITY = 0.62;
+/** Max lines in the pushed recall index. 5 (lowered from 6 on 2026-08-03):
+ *  per-slot decomposition at floor 0.62 showed slot 6 gives NO prompt its
+ *  first relevant memory. The K-sweep is monotone toward 4, but the 4-vs-5
+ *  distinction rests on 5 of 98 prompts — 5 hedges with coverage. */
+export declare const RECALL_MAX_ITEMS = 5;
+/** Prompts shorter than this skip the recall index (continuations, "yes"). */
+export declare const RECALL_MIN_PROMPT_CHARS = 20;
+/** Chars of a memory's first line shown in an index entry. 100 (reverted
+ *  from 150 on 2026-08-03): the full-corpus relevance eval found 100 vs 150
+ *  statistically identical (full CI overlap at N=40); 100 saves ~13% tokens. */
+export declare const RECALL_TITLE_CHARS = 100;
+/** Slots of RECALL_MAX_ITEMS guaranteed to the pure-prompt (unblended)
+ *  search's top passing hit(s) — the #324 novelty floor. 2 mirrors
+ *  COLD_EXPOSURE_SLOTS sizing: a floor, never a takeover. */
+export declare const NOVELTY_FLOOR_SLOTS = 2;
+/** Turns an already-shown memory stays suppressed in the same session before
+ *  it may reappear in the pushed index (#192 turn-based dedup). */
+export declare const RECALL_RESHOW_TURNS = 30;
+/** Semantic-similarity share of the composite score. 0.50 (raised from 0.40
+ *  in the 0.15.2 rebalance, #191 Phase B): on the production corpus effective
+ *  strength (0.30) outweighed what similarity could recover — hardened old
+ *  memories beat exact matches for their own topic. Similarity now leads;
+ *  strength breaks ties and rewards real use. */
+export declare const SCORE_SIMILARITY_WEIGHT = 0.5;
+/** Effective-strength share of the composite score (was 0.30; see above). */
+export declare const SCORE_STRENGTH_WEIGHT = 0.2;
+/** Graph-centrality share of the composite score (was 0.20; see above). */
+export declare const SCORE_CONNECTIONS_WEIGHT = 0.15;
+/** Slow recency curve share of the composite score (was 0.10; see above). */
+export declare const SCORE_RECENCY_WEIGHT = 0.15;
+/** Fresh-memory window: the additive bonus fades linearly to 0 over this
+ *  many days. 7 — nightly capture means 1 day is the floor of "fresh"
+ *  (#191 Phase B). */
+export declare const FRESHNESS_BOOST_DAYS = 7;
+/** Fresh-memory bonus size at age 0 (#191 Phase B; 0 = disabled via seam). */
+export declare const FRESHNESS_BOOST_WEIGHT = 0.15;
+/** Score multiplier for a memory a later decision superseded (0.15.2; the
+ *  belief walk (#393 D) is the primary mechanism — this is the safety net
+ *  for rows the walk does not reach). */
+export declare const SUPERSEDED_DEMOTION = 0.5;
+/** #203 soft boost on exact project match. ADDITIVE, zero-boost neutral,
+ *  never a penalty — a foreign memory ranks equal, not lower. */
+export declare const PROJECT_AFFINITY_WEIGHT = 0.15;
+/** #203 soft boost multiplier on max overlapping domain-tag weight. */
+export declare const DOMAIN_AFFINITY_WEIGHT = 0.15;
+/** #205 RRF k parameter (1/(k+rank+1)) — matches the pre-#205 hardcoded 60
+ *  so the no-config path was byte-identical to 0.15.3. */
+export declare const RRF_K = 60;
+/** #205 composite-score share of the final blend (RRF gets the remainder);
+ *  pre-#205 hardcoded value carried forward. */
+export declare const RRF_COMPOSITE_WEIGHT = 0.8;
+/** #205 per-list RRF weight for the FTS list. 0.5 is the bisection point
+ *  where BM25F + composite-affinity flip the token-exact marine body match
+ *  below the same-scope hardware field (Q4 contamination 0.20 → 0.00) while
+ *  pure-keyword queries keep recall@5 = 1.0. 0.7 was measured too timid. */
+export declare const RRF_FTS_WEIGHT = 0.5;
+/** #205 per-list RRF weight for the vector list (vec stays at 1.0 — the
+ *  conservative nudge is on the FTS side only). */
+export declare const RRF_VECTOR_WEIGHT = 1;
+export declare const BM25_WEIGHT_BODY = 1;
+export declare const BM25_WEIGHT_PROJECT = 2;
+export declare const BM25_WEIGHT_DOMAIN = 2;
+/** Deterministic merge ceiling of the unified resolution pass (#392): pairs
+ *  at/above this cosine merge LLM-free; [CORRECTION_MIN_SIMILARITY, this)
+ *  get the one verdict call. 0.92 — measured on the #191 mechanical audit
+ *  corpus (89 clusters / 110 excess rows; data/audit-20260729). */
+export declare const DEDUP_AUTO_MERGE_THRESHOLD = 0.92;
+/** Minimum cosine for a nightly supersession candidate pair (#100 stage,
+ *  0.15.0): one classify-tier call per pair above the bar. */
+export declare const SUPERSESSION_MIN_SIMILARITY = 0.8;
+/** Minimum cosine for a reconsolidation correction pair (#384). Deliberately
+ *  wider than supersession's 0.80: a retraction often rides inside an
+ *  otherwise unrelated memory; the verdict + confidence gate carry the
+ *  precision. */
+export declare const CORRECTION_MIN_SIMILARITY = 0.75;
+/** Minimum verdict confidence for the REWRITE (and #392 merge-apply) fork
+ *  (#384): below it a `corrects` degrades to mark-only — a weak mark is
+ *  recoverable, a weak rewrite is corruption. */
+export declare const CORRECTION_REWRITE_MIN_CONFIDENCE = 0.8;
+/** Minimum cosine(memory embedding, best domain prototype) for a no-fit
+ *  memory to earn a WEAK primary instead of decaying (owner amendment
+ *  07.07). Starting point for bge-small-en-v1.5. */
+export declare const WEAK_PRIMARY_FLOOR = 0.45;
+/**
+ * Context window for ollama (one value, all phases; #220/#228). 8192 is
+ * where context stops being the binding constraint for a sub-8B model on
+ * ollama. Also drives `detectChunkSize` (chunkChars ≤ numCtx × 0.6 × 4
+ * chars) so the chunker and the request agree by construction.
+ */
+export declare const NUM_CTX = 8192;
+/** Flush ollama's accumulated memory every N LLM calls (0 = off; #220).
+ *  Opt-in operational workaround for ollama runner RSS growth — never a
+ *  default-on behavior. */
+export declare const OLLAMA_FLUSH_EVERY = 0;
+/** Ms to wait after an ollama flush (`keep_alive:0`) for the runner to exit
+ *  + release memory. The runner takes >90 s to exit; 3 min allows margin. */
+export declare const OLLAMA_FLUSH_WAIT_MS = 180000;
+/** The env-tier table (release surface: names + defaults are frozen —
+ *  adding a knob here is a release decision, not a runtime one). */
+export declare const DIAGNOSTIC_ENV_TIER: Readonly<{
+    numCtx: Readonly<{
+        env: string;
+        default: number;
+    }>;
+    ollamaFlushEvery: Readonly<{
+        env: string;
+        default: number;
+    }>;
+    ollamaFlushWaitMs: Readonly<{
+        env: string;
+        default: number;
+    }>;
+}>;
+/** Resolve the effective ollama context window: a positive finite
+ *  HICORTEX_NUM_CTX wins; anything else (absent/blank/invalid) keeps NUM_CTX
+ *  with a warn on the invalid case. */
+export declare function resolveNumCtx(): number;
+/** Resolve the flush cadence: a non-negative finite
+ *  HICORTEX_OLLAMA_FLUSH_EVERY wins (0 = the valid off value); invalid warns
+ *  and keeps OLLAMA_FLUSH_EVERY. */
+export declare function resolveOllamaFlushEvery(): number;
+/** Resolve the post-flush wait: a positive finite
+ *  HICORTEX_OLLAMA_FLUSH_WAIT_MS wins; invalid warns and keeps
+ *  OLLAMA_FLUSH_WAIT_MS. */
+export declare function resolveOllamaFlushWaitMs(): number;

package/dist/calibration.js

@@ -0,0 +1,231 @@
+"use strict";
+/**
+ * Release-managed calibration constants (#408) — the single home of every
+ * tuning value the product ships. One value, one definition, one provenance
+ * comment. Nothing in here is read from ~/.hicortex/config.json anymore: the
+ * ~35 tuning keys that 0.15–0.20 exposed as config are now CONSTANTS that
+ * move only in releases. The user config surface shrinks to the keys that
+ * describe an install (mode, model, schedules, identity, budgets), not the
+ * ones that tune the brain.
+ *
+ * EVOLUTION CONTRACT: these values change ONLY in releases, with the
+ * eval/band-stats evidence linked in the changelog line that moves them
+ * (eval harness = `npm run eval` + the resolution band stats in the nightly
+ * report). Never in a patch to quiet one corpus, never behind a new config
+ * key. The seams for EXPERIMENTS are the configure*() functions in
+ * retrieval.ts / storage.ts (and the stage Options fields) — the eval and
+ * the tests sweep values through them; production never passes anything, so
+ * every process scores with exactly these constants.
+ *
+ * Every value below equals the default the code shipped the day this module
+ * was introduced (verified by tests/calibration.test.ts) — an install that
+ * never set the old config keys sees byte-identical behavior. The old keys
+ * are warned as RELEASE-MANAGED at the config boundary (config-read.ts) so
+ * the removal is never silent.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DIAGNOSTIC_ENV_TIER = exports.OLLAMA_FLUSH_WAIT_MS = exports.OLLAMA_FLUSH_EVERY = exports.NUM_CTX = exports.WEAK_PRIMARY_FLOOR = exports.CORRECTION_REWRITE_MIN_CONFIDENCE = exports.CORRECTION_MIN_SIMILARITY = exports.SUPERSESSION_MIN_SIMILARITY = exports.DEDUP_AUTO_MERGE_THRESHOLD = exports.BM25_WEIGHT_DOMAIN = exports.BM25_WEIGHT_PROJECT = exports.BM25_WEIGHT_BODY = exports.RRF_VECTOR_WEIGHT = exports.RRF_FTS_WEIGHT = exports.RRF_COMPOSITE_WEIGHT = exports.RRF_K = exports.DOMAIN_AFFINITY_WEIGHT = exports.PROJECT_AFFINITY_WEIGHT = exports.SUPERSEDED_DEMOTION = exports.FRESHNESS_BOOST_WEIGHT = exports.FRESHNESS_BOOST_DAYS = exports.SCORE_RECENCY_WEIGHT = exports.SCORE_CONNECTIONS_WEIGHT = exports.SCORE_STRENGTH_WEIGHT = exports.SCORE_SIMILARITY_WEIGHT = exports.RECALL_RESHOW_TURNS = exports.NOVELTY_FLOOR_SLOTS = exports.RECALL_TITLE_CHARS = exports.RECALL_MIN_PROMPT_CHARS = exports.RECALL_MAX_ITEMS = exports.RECALL_MIN_SIMILARITY = exports.SESSION_INTENT_WEIGHT = exports.COLD_EXPOSURE_SLOTS = exports.RECENT_WINDOW_DAYS = exports.RECENT_LIMIT = exports.SEARCH_LIMIT = exports.DECAY_HALF_LIFE_DAYS = void 0;
+exports.resolveNumCtx = resolveNumCtx;
+exports.resolveOllamaFlushEvery = resolveOllamaFlushEvery;
+exports.resolveOllamaFlushWaitMs = resolveOllamaFlushWaitMs;
+// ---------------------------------------------------------------------------
+// Recall / decay family (was: decayHalfLifeDays, searchLimit, recentLimit,
+// recentWindowDays, coldExposureSlots, sessionIntentWeight, recall*,
+// noveltyFloorSlots, recallReshowTurns)
+// ---------------------------------------------------------------------------
+/**
+ * Memory-decay half-life (days) at the reference importance 0.5. #192 recall/
+ * decay alignment: was ~115 days — aggressive enough to bury the long tail in
+ * ranking. Long-term remembering is the product; time preference stays mild.
+ */
+exports.DECAY_HALF_LIFE_DAYS = 365;
+/** Default k for retrieve() (/search without an explicit limit). #192. */
+exports.SEARCH_LIMIT = 8;
+/** Default k for searchRecent() (/recent without an explicit limit). #192. */
+exports.RECENT_LIMIT = 12;
+/** searchRecent() candidate window, days. #192. */
+exports.RECENT_WINDOW_DAYS = 180;
+/** Top-k slots reservable for never-accessed memories (cold exposure). #192:
+ *  recall was too passive (88% of memories never accessed) — the long tail
+ *  gets guaranteed slots instead of waiting for the strength clock. */
+exports.COLD_EXPOSURE_SLOTS = 2;
+/** Blend weight of the session-intent centroid in the recall search vector
+ *  (#192, 0.15.3): query = (1-w)·prompt + w·centroid. The kill-switch is the
+ *  configureSessionIntent(0) seam (eval-only); production always ships 0.33. */
+exports.SESSION_INTENT_WEIGHT = 0.33;
+/** Relevance-gate floor for vector-only /recall-index candidates. 0.62
+ *  (raised from 0.55 on 2026-08-03 per a 0.01-step floor sweep on the
+ *  rewritten corpus): steady ~3:1 noise:signal removal with no knee; sits
+ *  below the 0.63 local pessimum. FTS-matched candidates pass regardless. */
+exports.RECALL_MIN_SIMILARITY = 0.62;
+/** Max lines in the pushed recall index. 5 (lowered from 6 on 2026-08-03):
+ *  per-slot decomposition at floor 0.62 showed slot 6 gives NO prompt its
+ *  first relevant memory. The K-sweep is monotone toward 4, but the 4-vs-5
+ *  distinction rests on 5 of 98 prompts — 5 hedges with coverage. */
+exports.RECALL_MAX_ITEMS = 5;
+/** Prompts shorter than this skip the recall index (continuations, "yes"). */
+exports.RECALL_MIN_PROMPT_CHARS = 20;
+/** Chars of a memory's first line shown in an index entry. 100 (reverted
+ *  from 150 on 2026-08-03): the full-corpus relevance eval found 100 vs 150
+ *  statistically identical (full CI overlap at N=40); 100 saves ~13% tokens. */
+exports.RECALL_TITLE_CHARS = 100;
+/** Slots of RECALL_MAX_ITEMS guaranteed to the pure-prompt (unblended)
+ *  search's top passing hit(s) — the #324 novelty floor. 2 mirrors
+ *  COLD_EXPOSURE_SLOTS sizing: a floor, never a takeover. */
+exports.NOVELTY_FLOOR_SLOTS = 2;
+/** Turns an already-shown memory stays suppressed in the same session before
+ *  it may reappear in the pushed index (#192 turn-based dedup). */
+exports.RECALL_RESHOW_TURNS = 30;
+// ---------------------------------------------------------------------------
+// Composite ranking weights (was: score*Weight, freshnessBoost*,
+// supersededDemotion, *AffinityWeight, rrf*)
+// ---------------------------------------------------------------------------
+/** Semantic-similarity share of the composite score. 0.50 (raised from 0.40
+ *  in the 0.15.2 rebalance, #191 Phase B): on the production corpus effective
+ *  strength (0.30) outweighed what similarity could recover — hardened old
+ *  memories beat exact matches for their own topic. Similarity now leads;
+ *  strength breaks ties and rewards real use. */
+exports.SCORE_SIMILARITY_WEIGHT = 0.50;
+/** Effective-strength share of the composite score (was 0.30; see above). */
+exports.SCORE_STRENGTH_WEIGHT = 0.20;
+/** Graph-centrality share of the composite score (was 0.20; see above). */
+exports.SCORE_CONNECTIONS_WEIGHT = 0.15;
+/** Slow recency curve share of the composite score (was 0.10; see above). */
+exports.SCORE_RECENCY_WEIGHT = 0.15;
+/** Fresh-memory window: the additive bonus fades linearly to 0 over this
+ *  many days. 7 — nightly capture means 1 day is the floor of "fresh"
+ *  (#191 Phase B). */
+exports.FRESHNESS_BOOST_DAYS = 7;
+/** Fresh-memory bonus size at age 0 (#191 Phase B; 0 = disabled via seam). */
+exports.FRESHNESS_BOOST_WEIGHT = 0.15;
+/** Score multiplier for a memory a later decision superseded (0.15.2; the
+ *  belief walk (#393 D) is the primary mechanism — this is the safety net
+ *  for rows the walk does not reach). */
+exports.SUPERSEDED_DEMOTION = 0.50;
+/** #203 soft boost on exact project match. ADDITIVE, zero-boost neutral,
+ *  never a penalty — a foreign memory ranks equal, not lower. */
+exports.PROJECT_AFFINITY_WEIGHT = 0.15;
+/** #203 soft boost multiplier on max overlapping domain-tag weight. */
+exports.DOMAIN_AFFINITY_WEIGHT = 0.15;
+/** #205 RRF k parameter (1/(k+rank+1)) — matches the pre-#205 hardcoded 60
+ *  so the no-config path was byte-identical to 0.15.3. */
+exports.RRF_K = 60;
+/** #205 composite-score share of the final blend (RRF gets the remainder);
+ *  pre-#205 hardcoded value carried forward. */
+exports.RRF_COMPOSITE_WEIGHT = 0.8;
+/** #205 per-list RRF weight for the FTS list. 0.5 is the bisection point
+ *  where BM25F + composite-affinity flip the token-exact marine body match
+ *  below the same-scope hardware field (Q4 contamination 0.20 → 0.00) while
+ *  pure-keyword queries keep recall@5 = 1.0. 0.7 was measured too timid. */
+exports.RRF_FTS_WEIGHT = 0.5;
+/** #205 per-list RRF weight for the vector list (vec stays at 1.0 — the
+ *  conservative nudge is on the FTS side only). */
+exports.RRF_VECTOR_WEIGHT = 1.0;
+// ---------------------------------------------------------------------------
+// BM25F field weights (was: bm25WeightBody/Project/Domain) — #205. Body is
+// down-weighted relative to the scope fields so a project/domain token match
+// outranks a token-exact body collision from a foreign scope.
+// ---------------------------------------------------------------------------
+exports.BM25_WEIGHT_BODY = 1.0;
+exports.BM25_WEIGHT_PROJECT = 2.0;
+exports.BM25_WEIGHT_DOMAIN = 2.0;
+// ---------------------------------------------------------------------------
+// Resolution / dedup family (was: dedupAutoMergeThreshold [legacy
+// dedupMergeThreshold], supersessionMinSimilarity, correctionMinSimilarity,
+// correctionRewriteMinConfidence, weakPrimaryFloor)
+// ---------------------------------------------------------------------------
+/** Deterministic merge ceiling of the unified resolution pass (#392): pairs
+ *  at/above this cosine merge LLM-free; [CORRECTION_MIN_SIMILARITY, this)
+ *  get the one verdict call. 0.92 — measured on the #191 mechanical audit
+ *  corpus (89 clusters / 110 excess rows; data/audit-20260729). */
+exports.DEDUP_AUTO_MERGE_THRESHOLD = 0.92;
+/** Minimum cosine for a nightly supersession candidate pair (#100 stage,
+ *  0.15.0): one classify-tier call per pair above the bar. */
+exports.SUPERSESSION_MIN_SIMILARITY = 0.80;
+/** Minimum cosine for a reconsolidation correction pair (#384). Deliberately
+ *  wider than supersession's 0.80: a retraction often rides inside an
+ *  otherwise unrelated memory; the verdict + confidence gate carry the
+ *  precision. */
+exports.CORRECTION_MIN_SIMILARITY = 0.75;
+/** Minimum verdict confidence for the REWRITE (and #392 merge-apply) fork
+ *  (#384): below it a `corrects` degrades to mark-only — a weak mark is
+ *  recoverable, a weak rewrite is corruption. */
+exports.CORRECTION_REWRITE_MIN_CONFIDENCE = 0.80;
+/** Minimum cosine(memory embedding, best domain prototype) for a no-fit
+ *  memory to earn a WEAK primary instead of decaying (owner amendment
+ *  07.07). Starting point for bge-small-en-v1.5. */
+exports.WEAK_PRIMARY_FLOOR = 0.45;
+// ---------------------------------------------------------------------------
+// Diagnostic tier (env-overridable — #408). The ollama-operational family is
+// NOT user tuning: it exists so an operator of a constrained box can pin the
+// three values into a service unit's environment without a config-file
+// round-trip. Precedence: env > the constant below. An invalid env value
+// warns and falls back to the constant (the resolveMemorySoftCap boundary
+// posture, applied to the env half).
+// ---------------------------------------------------------------------------
+/**
+ * Context window for ollama (one value, all phases; #220/#228). 8192 is
+ * where context stops being the binding constraint for a sub-8B model on
+ * ollama. Also drives `detectChunkSize` (chunkChars ≤ numCtx × 0.6 × 4
+ * chars) so the chunker and the request agree by construction.
+ */
+exports.NUM_CTX = 8192;
+/** Flush ollama's accumulated memory every N LLM calls (0 = off; #220).
+ *  Opt-in operational workaround for ollama runner RSS growth — never a
+ *  default-on behavior. */
+exports.OLLAMA_FLUSH_EVERY = 0;
+/** Ms to wait after an ollama flush (`keep_alive:0`) for the runner to exit
+ *  + release memory. The runner takes >90 s to exit; 3 min allows margin. */
+exports.OLLAMA_FLUSH_WAIT_MS = 180000;
+/** The env-tier table (release surface: names + defaults are frozen —
+ *  adding a knob here is a release decision, not a runtime one). */
+exports.DIAGNOSTIC_ENV_TIER = Object.freeze({
+    numCtx: Object.freeze({ env: "HICORTEX_NUM_CTX", default: exports.NUM_CTX }),
+    ollamaFlushEvery: Object.freeze({
+        env: "HICORTEX_OLLAMA_FLUSH_EVERY",
+        default: exports.OLLAMA_FLUSH_EVERY,
+    }),
+    ollamaFlushWaitMs: Object.freeze({
+        env: "HICORTEX_OLLAMA_FLUSH_WAIT_MS",
+        default: exports.OLLAMA_FLUSH_WAIT_MS,
+    }),
+});
+/** Resolve the effective ollama context window: a positive finite
+ *  HICORTEX_NUM_CTX wins; anything else (absent/blank/invalid) keeps NUM_CTX
+ *  with a warn on the invalid case. */
+function resolveNumCtx() {
+    const raw = process.env[exports.DIAGNOSTIC_ENV_TIER.numCtx.env];
+    if (raw === undefined || raw === "")
+        return exports.NUM_CTX;
+    const v = Number(raw);
+    if (Number.isFinite(v) && v > 0)
+        return v;
+    console.warn(`[hicortex] env HICORTEX_NUM_CTX=${JSON.stringify(raw)} is not a positive finite number — using default ${exports.NUM_CTX}.`);
+    return exports.NUM_CTX;
+}
+/** Resolve the flush cadence: a non-negative finite
+ *  HICORTEX_OLLAMA_FLUSH_EVERY wins (0 = the valid off value); invalid warns
+ *  and keeps OLLAMA_FLUSH_EVERY. */
+function resolveOllamaFlushEvery() {
+    const raw = process.env[exports.DIAGNOSTIC_ENV_TIER.ollamaFlushEvery.env];
+    if (raw === undefined || raw === "")
+        return exports.OLLAMA_FLUSH_EVERY;
+    const v = Number(raw);
+    if (Number.isFinite(v) && v >= 0)
+        return Math.floor(v);
+    console.warn(`[hicortex] env HICORTEX_OLLAMA_FLUSH_EVERY=${JSON.stringify(raw)} is not a non-negative finite number — using default ${exports.OLLAMA_FLUSH_EVERY}.`);
+    return exports.OLLAMA_FLUSH_EVERY;
+}
+/** Resolve the post-flush wait: a positive finite
+ *  HICORTEX_OLLAMA_FLUSH_WAIT_MS wins; invalid warns and keeps
+ *  OLLAMA_FLUSH_WAIT_MS. */
+function resolveOllamaFlushWaitMs() {
+    const raw = process.env[exports.DIAGNOSTIC_ENV_TIER.ollamaFlushWaitMs.env];
+    if (raw === undefined || raw === "")
+        return exports.OLLAMA_FLUSH_WAIT_MS;
+    const v = Number(raw);
+    if (Number.isFinite(v) && v > 0)
+        return v;
+    console.warn(`[hicortex] env HICORTEX_OLLAMA_FLUSH_WAIT_MS=${JSON.stringify(raw)} is not a positive finite number — using default ${exports.OLLAMA_FLUSH_WAIT_MS}.`);
+    return exports.OLLAMA_FLUSH_WAIT_MS;
+}

package/dist/capture.d.ts

@@ -14,6 +14,7 @@
  */
 import type { TranscriptBatch } from "./transcript-reader.js";
 import type { CursorStore } from "./capture-cursors.js";
+import type { RunDeadline } from "./run-deadline.js";
 /**
  * Max denoised chars per segment. Kept below the server's 80K distill cap
  * (distiller.ts MAX_TRANSCRIPT_CHARS) with ~20K headroom so NO capture path can
@@ -105,6 +106,15 @@ export interface CaptureOptions {
      * `source_domain` provenance. Null when undeclared.
      */
     sourceDomain?: string | null;
+    /**
+     * The run-wide pipeline deadline (#405), checked BETWEEN segment POSTs —
+     * a boundary the per-session cursor discipline already guarantees is safe
+     * (the cursor only advances past server-confirmed segments, so a deadline
+     * stop holds every unconfirmed segment for the next run; dup-over-loss).
+     * Full and consolidate-only nightlies pass it; capture-only/watchdog runs
+     * keep their 30-min unit backstop instead.
+     */
+    deadline?: RunDeadline;
 }
 export interface CaptureResult {
     memoriesIngested: number;
@@ -113,10 +123,12 @@ export interface CaptureResult {
     /**
      * Set when the loop stopped early on a terminal server response: "limit"
      * (token-budget 429, mcp-server.ts's `"token budget exceeded"` gate) or
-     * "auth" (401). A rate-limit 429 never sets this — it is transient (#327).
-     * The caller decides watermark handling.
+     * "auth" (401); "deadline" (#405) when the run-wide pipeline deadline fired
+     * between segments (transient — the watermark holds, everything unconfirmed
+     * retries next run). A rate-limit 429 never sets this — it is transient
+     * (#327). The caller decides watermark handling.
      */
-    stopped?: "limit" | "auth";
+    stopped?: "limit" | "auth" | "deadline";
     /**
      * Run-global rate-429 latch (#327 CR): true when at least one session
      * SURRENDERED to a rate-limit 429 (the transient kind — postWithRateRetry

package/dist/capture.js

@@ -204,7 +204,7 @@ async function postWithRateRetry(post, body) {
  * re-paying the Retry-After ladder (#327).
  */
 async function captureBatches(batches, opts) {
-    const { post, cursorStore, dryRun = false, segmentMaxChars = exports.SEGMENT_MAX_CHARS, sourceAgentId, sourceDomain } = opts;
+    const { post, cursorStore, dryRun = false, segmentMaxChars = exports.SEGMENT_MAX_CHARS, sourceAgentId, sourceDomain, deadline } = opts;
     let memoriesIngested = 0;
     let sessionsSent = 0;
     let hadTransientFailure = false;
@@ -249,6 +249,15 @@ async function captureBatches(batches, opts) {
         let sessionPosted = false;
         for (let s = 0; s < segments.length; s++) {
             const seg = segments[s];
+            // #405: stop BETWEEN segments — a safe boundary by construction (the
+            // cursor below only advances past server-confirmed segments). The whole
+            // session loop breaks on `stopped` at the bottom; unconfirmed segments
+            // hold and retry next run.
+            if (!dryRun && deadline?.hit("capture")) {
+                console.warn(`[hicortex]     Run deadline reached — capture stops after the last confirmed segment`);
+                stopped = "deadline";
+                break;
+            }
             // A segment advances the cursor to its segEnd only when it is the LAST
             // segment ending at that boundary. Hard-split pieces (.p0,.p1,…) of one
             // entry share the same segEnd; confirming an earlier piece must NOT move

package/dist/classify-domains.d.ts

@@ -50,6 +50,12 @@ export interface ClassifyDomainsOptions {
     llm?: LlmClient;
     /** Config override (tests). Defaults to reading stateDir/config.json. */
     config?: Record<string, unknown> | null;
+    /**
+     * Weak-primary floor (#408): release-managed default (calibration.ts via
+     * nofit's DEFAULT_WEAK_PRIMARY_FLOOR); this field is the eval/test seam —
+     * the config key is gone from the surface. Invalid → default.
+     */
+    weakPrimaryFloor?: number;
     /**
      * Embedder override (tests). Used only for domain-description prototype
      * seeds; defaults to the local ONNX embedder, loaded lazily on first need

package/dist/classify-domains.js

@@ -118,7 +118,13 @@ async function runClassifyDomains(options = {}) {
             '{ "name": "Boating", "description": "..." }] } and re-run. ' +
             "No fallback bucket is needed — no-fit memories are handled automatically.");
     }
-    const weakPrimaryFloor = (0, nofit_js_1.resolveWeakPrimaryFloor)(config);
+    // #408: the floor is a release-managed calibration constant; the Options
+    // field is the eval/test seam (invalid values keep the default, the stage
+    // knob-validation style — silent fallback, no warn).
+    const floorRaw = Number(options.weakPrimaryFloor);
+    const weakPrimaryFloor = Number.isFinite(floorRaw) && floorRaw > 0 && floorRaw < 1
+        ? floorRaw
+        : nofit_js_1.DEFAULT_WEAK_PRIMARY_FLOOR;
     // Resolve the LLM (one model serves all phases — #231).
     let llm;
     if (options.llm) {