@gamaze/hicortex 0.20.7 → 0.20.9

package/dist/reconsolidation.js

@@ -16,11 +16,39 @@
  * #392 — one zone system, ONE verdict per pair: below `correctionMinSimilarity`
  * (floor, 0.75) pairs are not candidates; in [floor, `dedupAutoMergeThreshold`)
  * (ceiling, 0.92) each unlinked pair gets ONE verdict call whose action is
- * `merge` | `corrects` | `supersedes` | `none`; at/above the ceiling the
- * deterministic merge zone (dedup.ts runDeterministicMergeZone — LLM-free,
- * budget-free) owns the pair. The merge disposition reuses the dedup core's
- * execution (canonical pick, link re-point, dedup_log, metadata rails); a
- * merge verdict below `correctionRewriteMinConfidence` keeps both memories.
+ * `merge` | `corrects` | `supersedes` | `conflicts` | `none`; at/above the
+ * ceiling the deterministic merge zone (dedup.ts runDeterministicMergeZone —
+ * LLM-free, budget-free) owns the pair. The merge disposition reuses the
+ * dedup core's execution (canonical pick, link re-point, dedup_log, metadata
+ * rails); a merge verdict below `correctionRewriteMinConfidence` keeps both
+ * memories.
+ *
+ * #393 increment B — the SCOUT, a second detection source with the SAME
+ * judge: the similarity floor is structurally blind to corrections riding
+ * inside topically unrelated memories (the field failure — cosine ~0.5-0.6 to
+ * their target, zero `corrects` verdicts in the whole corpus baseline), so
+ * per NEW memory ONE classify-tier shape call asks whether it corrects/
+ * retracts/supersedes/CONTRADICTS something previously recorded (guard-C
+ * extended the question); correction-shaped
+ * memories FTS the corpus with the referenced claim's distinctive terms (the
+ * correction CONTAINS the words of what it corrects) and the hits become
+ * candidate pairs in the SAME verdict loop — no similarity gate for this
+ * source: cosine is a ranker/link strength, never a blocker. Per-source
+ * counters (scout_scanned / scout_correction_shaped / scout_candidates_found)
+ * ride the stage report; cosine band stats stay similarity-source-only.
+ *
+ * #393 guard-C — the conflicts flag + the zone-runs-last order: judgment
+ * OUTRANKS the deterministic sweep. A `conflicts` verdict writes a symmetric
+ * `conflicts` link (the pair genuinely disagrees — cannot both be true) and
+ * NOTHING else: no status change, no rewrite, no merge queue; both records
+ * stay live so the consumer sees both truths. Both merge paths (the zone's
+ * planDedup and the judged mergeMemoryIds) refuse to blend a conflicts-linked
+ * pair, counted as conflict_skipped. The zone therefore runs AFTER the
+ * rewrite phase — with the zone first, a >=0.92 conflict pair was blended
+ * before the judge ever saw it (the planted-eval harm: canonical=older, the
+ * newer truth erased); running it last means verdicts/marks/binds land first
+ * and the zone merges only what no verdict claimed — a conflicts bind set by
+ * this run's scan guards the SAME run's zone.
  *
  * Status vocabulary (code-defined, extensible — deliberately NOT config):
  *   NULL/'active' default | 'superseded' + 'retracted' demote in ranking |
@@ -71,8 +99,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.absorbTrigger = exports.DEMOTED_STATUSES = exports.FOOTER_HEAD_MAX_CHARS = exports.DEFAULT_RECONSOLIDATION_MAX_CALLS = exports.DEFAULT_RECONSOLIDATION_MAX_MINUTES = exports.DEFAULT_CORRECTION_REWRITE_MIN_CONFIDENCE = exports.DEFAULT_CORRECTION_MIN_SIMILARITY = exports.RECONSOLIDATION_STAGE_LABEL = void 0;
+exports.absorbTrigger = exports.DEMOTED_STATUSES = exports.FOOTER_HEAD_MAX_CHARS = exports.DEFAULT_CORRECTION_REWRITE_MIN_CONFIDENCE = exports.DEFAULT_CORRECTION_MIN_SIMILARITY = exports.RECONSOLIDATION_STAGE_LABEL = void 0;
 exports.isFactShapedTarget = isFactShapedTarget;
+exports.buildScoutShapePrompt = buildScoutShapePrompt;
+exports.parseScoutShape = parseScoutShape;
 exports.buildCorrectionVerdictPrompt = buildCorrectionVerdictPrompt;
 exports.parseCorrectionVerdict = parseCorrectionVerdict;
 exports.buildRewritePrompt = buildRewritePrompt;
@@ -94,6 +124,7 @@ const storage = __importStar(require("./storage.js"));
 const state_js_1 = require("./state.js");
 const db_js_1 = require("./db.js");
 const capture_js_1 = require("./capture.js");
+const CALIBRATION = __importStar(require("./calibration.js"));
 const paths_js_1 = require("./paths.js");
 const dedup_js_1 = require("./dedup.js");
 // ---------------------------------------------------------------------------
@@ -102,37 +133,21 @@ const dedup_js_1 = require("./dedup.js");
 /** Stage label used for every budget.use()/recordUsage() call (#384). */
 exports.RECONSOLIDATION_STAGE_LABEL = "reconsolidation";
 /**
- * Default minimum COSINE similarity for a correction candidate pair. Lower
- * than the supersession stage's 0.80 on purpose: a retraction often rides
- * inside an otherwise unrelated memory (the field failure that opened this
- * issue), so the neighborhood gate must be a touch wider while the LLM
- * verdict + confidence gate carry the precision load.
+ * Default minimum COSINE similarity for a correction candidate pair —
+ * RELEASE-MANAGED since #408 (calibration.ts CORRECTION_MIN_SIMILARITY;
+ * provenance there). Lower than the supersession stage's 0.80 on purpose: a
+ * retraction often rides inside an otherwise unrelated memory (the field
+ * failure that opened this issue), so the neighborhood gate must be a touch
+ * wider while the LLM verdict + confidence gate carry the precision load.
  */
-exports.DEFAULT_CORRECTION_MIN_SIMILARITY = 0.75;
+exports.DEFAULT_CORRECTION_MIN_SIMILARITY = CALIBRATION.CORRECTION_MIN_SIMILARITY;
 /**
- * Default minimum verdict confidence for the REWRITE fork. Below this a
+ * Default minimum verdict confidence for the REWRITE fork — release-managed
+ * (calibration.ts CORRECTION_REWRITE_MIN_CONFIDENCE). Below this a
  * `corrects` verdict degrades to mark-only — a weak mark is recoverable, a
  * weak rewrite is corruption.
  */
-exports.DEFAULT_CORRECTION_REWRITE_MIN_CONFIDENCE = 0.8;
-/**
- * Default wall-clock bound for the stage, in minutes (#401). Checked at the
- * top of the candidate scan loop (and before each rewrite contract call); on
- * expiry the scan breaks cleanly at the last fully-considered candidate and
- * the next run resumes from the persisted cursor. 120 sits safely under any
- * sane process-level nightly timeout. 0 disables the bound. Invalid →
- * default.
- */
-exports.DEFAULT_RECONSOLIDATION_MAX_MINUTES = 120;
-/**
- * Default per-run classify-call ceiling for the stage (#401) — the
- * supersessionMaxCalls pattern with a NON-ZERO default ON PURPOSE: that
- * knob's 0=unlimited default is what let the first full-corpus pass grow
- * unbounded. Counts EVERY classify-tier call the stage makes (mark
- * verifications, pair verdicts, rewrite contracts). 0 disables the cap.
- * Invalid → default.
- */
-exports.DEFAULT_RECONSOLIDATION_MAX_CALLS = 600;
+exports.DEFAULT_CORRECTION_REWRITE_MIN_CONFIDENCE = CALIBRATION.CORRECTION_REWRITE_MIN_CONFIDENCE;
 /** Neighbor pool size before older/similarity filtering narrows to top 5 (supersession mirror). */
 const CORRECTION_NEIGHBOR_POOL = 15;
 /** Older-neighbor pairs kept per candidate after filtering (supersession mirror). */
@@ -161,10 +176,10 @@ exports.DEMOTED_STATUSES = ["superseded", "retracted"];
 function isFactShapedTarget(mem) {
     return mem.memory_type === "knowledge" || mem.content.includes("[Facts Learned]");
 }
-/** True when a superseded_by OR corrected_by link already exists between the pair, either direction. */
+/** True when a superseded_by / corrected_by / conflicts link already exists between the pair, either direction. */
 function alreadyResolutionLinked(db, oldId, newId) {
     const row = db
-        .prepare(`SELECT 1 FROM memory_links WHERE relationship IN ('superseded_by', 'corrected_by')
+        .prepare(`SELECT 1 FROM memory_links WHERE relationship IN ('superseded_by', 'corrected_by', 'conflicts')
        AND ((source_id = ? AND target_id = ?) OR (source_id = ? AND target_id = ?))`)
         .get(oldId, newId, newId, oldId);
     return !!row;
@@ -178,6 +193,58 @@ function hasLink(db, sourceId, targetId, relationship) {
 function nowIso() {
     return new Date().toISOString();
 }
+/**
+ * Build the constrained correction-shape prompt (classify-tier cost profile:
+ * 1500-char truncation, supersession/verdict precedent). The wording asks for
+ * the OLD claim's distinctive terms — the field-failure mechanism is that a
+ * correction CONTAINS the words of what it corrects, even when the surrounding
+ * topics (and therefore the embedding cosine) are unrelated. Guard-C extends
+ * the question to contradictions: two records that disagree on the same
+ * quantity share even MORE wording than a cross-topic correction does.
+ */
+function buildScoutShapePrompt(content) {
+    const trunc = (s) => (s.length > PROMPT_TRUNCATE_CHARS ? `${s.slice(0, PROMPT_TRUNCATE_CHARS)}…` : s);
+    return (`You are scanning a memory that was just added to an AI agent's long-term memory store.\n\n` +
+        `MEMORY:\n${trunc(content)}\n\n` +
+        `Does this memory correct, retract, supersede, or contradict a claim, decision, or state that was ` +
+        `previously recorded elsewhere in the store? A mere duplicate, elaboration, independent ` +
+        `fact, or new information that invalidates nothing is NOT a correction.\n` +
+        `If it is a correction/retraction/supersession/contradiction, list the most distinctive terms of the ` +
+        `OLD claim it references — words likely to appear verbatim in the older record.\n\n` +
+        `Reply with ONLY a JSON object, no prose: ` +
+        `{"correction": true | false, "references": "<distinctive terms of the referenced old claim, or empty string>", ` +
+        `"confidence": <number between 0 and 1>}`);
+}
+/**
+ * Parse the scout shape reply. Null on unparseable JSON, a missing/non-boolean
+ * `correction`, or a missing/out-of-range `confidence` — the caller counts
+ * skipped_infra and moves on (parseSupersessionReply discipline: never
+ * mis-detect on ambiguity). `references` is lenient (missing/non-string → "")
+ * because an empty string simply yields no FTS hits — a harmless miss, not a
+ * mis-judgment.
+ */
+function parseScoutShape(reply) {
+    if (!reply)
+        return null;
+    const start = reply.indexOf("{");
+    const end = reply.lastIndexOf("}");
+    if (start === -1 || end === -1 || end <= start)
+        return null;
+    let obj;
+    try {
+        obj = JSON.parse(reply.slice(start, end + 1));
+    }
+    catch {
+        return null;
+    }
+    if (typeof obj.correction !== "boolean")
+        return null;
+    const confidence = Number(obj.confidence);
+    if (!Number.isFinite(confidence) || confidence < 0 || confidence > 1)
+        return null;
+    const references = typeof obj.references === "string" ? obj.references : "";
+    return { correction: obj.correction, references: references.trim(), confidence };
+}
 /** Build the constrained pair-verdict prompt (1500-char truncation, supersession precedent). */
 function buildCorrectionVerdictPrompt(oldContent, newContent) {
     const trunc = (s) => (s.length > PROMPT_TRUNCATE_CHARS ? `${s.slice(0, PROMPT_TRUNCATE_CHARS)}…` : s);
@@ -191,9 +258,12 @@ function buildCorrectionVerdictPrompt(oldContent, newContent) {
         `wrong, no longer true, or was retracted, and the newer memory carries the corrected fact.\n` +
         `- "supersedes": the newer memory replaces a decision, plan, or state that was valid at the time but is ` +
         `now outdated — a replacement, not a factual correction.\n` +
+        `- "conflicts": the two memories make claims that cannot both be true — they disagree on a fact, value, ` +
+        `or state, and neither one corrects, supersedes, or restates the other (for example two sources report ` +
+        `different values for the same quantity). Keep both; flag the conflict.\n` +
         `- "none": unrelated, merely similar, or both can still be true (an addition or elaboration).\n\n` +
         `Reply with ONLY a JSON object, no prose: ` +
-        `{"action": "merge" | "corrects" | "supersedes" | "none", "confidence": <number between 0 and 1>}`);
+        `{"action": "merge" | "corrects" | "supersedes" | "conflicts" | "none", "confidence": <number between 0 and 1>}`);
 }
 /**
  * Parse the pair verdict. Null on anything unparseable, unknown action, or an
@@ -215,8 +285,13 @@ function parseCorrectionVerdict(reply) {
         return null;
     }
     const action = obj.action;
-    if (action !== "merge" && action !== "corrects" && action !== "supersedes" && action !== "none")
+    if (action !== "merge" &&
+        action !== "corrects" &&
+        action !== "supersedes" &&
+        action !== "conflicts" &&
+        action !== "none") {
         return null;
+    }
     const confidence = Number(obj.confidence);
     if (!Number.isFinite(confidence) || confidence < 0 || confidence > 1)
         return null;
@@ -452,7 +527,7 @@ function bandForCosine(bands, cosine) {
 }
 /** An empty band-stat record (fresh accumulation starts from zeroes). */
 function emptyBandStat() {
-    return { pairs: 0, merge: 0, corrects: 0, supersedes: 0, none: 0, merge_below_gate: 0, conf_sum: 0 };
+    return { pairs: 0, merge: 0, corrects: 0, supersedes: 0, conflicts: 0, none: 0, merge_below_gate: 0, conf_sum: 0 };
 }
 /** Add a run's per-band counts into a cumulative record (in place). */
 function accumulateBandStat(cumulative, run) {
@@ -460,6 +535,7 @@ function accumulateBandStat(cumulative, run) {
     cumulative.merge += run.merge;
     cumulative.corrects += run.corrects;
     cumulative.supersedes += run.supersedes;
+    cumulative.conflicts += run.conflicts;
     cumulative.none += run.none;
     cumulative.merge_below_gate += run.merge_below_gate;
     cumulative.conf_sum += run.conf_sum;
@@ -481,9 +557,43 @@ async function findOlderCorrectionNeighbors(db, candidate, embedFn, minSimilarit
         .sort((a, b) => (0, retrieval_js_1.l2ToCosine)(b.distance) - (0, retrieval_js_1.l2ToCosine)(a.distance))
         .slice(0, CORRECTION_NEIGHBOR_TOP_K);
 }
+/**
+ * The scout source (#393 increment B): for a correction-shaped NEW memory, FTS
+ * the corpus with the referenced claim's distinctive terms and return the OLDER
+ * hits as candidate pairs. This is the reference-extraction half — it finds the
+ * old claim even when the overall topics differ (and therefore the cosine sits
+ * below the similarity floor) because the correction CONTAINS the words of
+ * what it corrects. Deterministic: ONE FTS query, zero LLM. Filters: self,
+ * non-older (detection only pairs older → newer, the KNN mirror), and
+ * defensively non-absorbed hits. Pool/top-K reuse the KNN constants; FTS rank
+ * (BM25, best first) is the order. Dedup against the KNN neighbor ids is the
+ * caller's job (a pair found by both sources is judged once, as similarity).
+ */
+function findScoutNeighbors(db, candidate, references, candidateEmbedding) {
+    if (!references)
+        return [];
+    try {
+        const hits = storage.searchFts(db, references, CORRECTION_NEIGHBOR_POOL);
+        return hits
+            .filter((m) => m.id !== candidate.id &&
+            m.created_at < candidate.created_at &&
+            m.status !== "absorbed")
+            .slice(0, CORRECTION_NEIGHBOR_TOP_K)
+            .map((m) => {
+            const hitVec = storage.getStoredEmbedding(db, m.id);
+            const cosine = candidateEmbedding && hitVec ? (0, retrieval_js_1.cosineBetweenVectors)(candidateEmbedding, hitVec) : 0;
+            return { mem: m, cosine, source: "scout" };
+        });
+    }
+    catch {
+        // FTS is deterministic infrastructure — a throw here is a bug or a corrupt
+        // index, never a judgment question. Fail soft: no scout pairs this memory.
+        return [];
+    }
+}
 async function classifyPair(llm, oldContent, newContent) {
     try {
-        const r = await llm.completeClassify(buildCorrectionVerdictPrompt(oldContent, newContent));
+        const r = await llm.complete(buildCorrectionVerdictPrompt(oldContent, newContent));
         return { verdict: parseCorrectionVerdict(r.text), usage: r.usage };
     }
     catch {
@@ -493,21 +603,34 @@ async function classifyPair(llm, oldContent, newContent) {
 /**
  * Nightly reconsolidation stage (#384, #392 — THE unified resolution stage).
  *
- * Phase 0 (#392): the deterministic merge zone (pairs >= the ceiling) runs
- * first — LLM-free, budget-free, own lock/backup/cap.
+ * Phase order (#393 guard-C): the deterministic merge zone (pairs >= the
+ * ceiling) runs LAST — after the scan, the judged-merge phase, and the
+ * rewrite phase. Judgment outranks the deterministic sweep: verdicts, marks,
+ * and binds land first and the zone merges only what no verdict claimed. With
+ * the zone first, a >=0.92 genuine-conflict pair was blended before the judge
+ * ever saw it (the planted-eval harm); running it last means a `conflicts`
+ * bind set by this run's scan guards the SAME run's zone. Zone internals
+ * (lock, backup, deadline, persistBand, fail-soft) are unchanged.
  *
  * Scan: every memory with rowid > reconsolidationCursor (no shape filter;
  * absorbed candidates are skipped — invisible memories are not re-judged).
- * Each candidate's pairs: incoming explicit marks (verified once, AC7) then
- * up-to-5 older KNN neighbors in [floor, ceiling) (verdict call per unlinked
- * pair, AC2 — pairs at/above the ceiling are counted, never judged). Confirmed
+ * Each candidate's pairs: incoming explicit marks (verified once, AC7), then
+ * ONE scout shape call (#393 B — flags correction shape; non-corrections stop
+ * there), then up-to-5 older KNN neighbors in [floor, ceiling) (verdict call
+ * per unlinked pair, AC2 — pairs at/above the ceiling are counted, never
+ * judged) plus the scout's FTS hits for correction-shaped memories (same
+ * verdict loop, NO similarity gate; guard-C: a scout hit whose KNN twin sits
+ * at/above the ceiling is re-tagged scout so the pair IS judged instead of
+ * being left for the zone to blend). Confirmed
  * `corrects` pairs above the confidence gate on fact-shaped targets group by
  * target into ONE rewrite call each (AC3); confirmed `merge` pairs queue for
- * the merge phase; everything else is mark-only.
+ * the merge phase; a `conflicts` verdict writes the conflicts link and
+ * nothing else (both live); everything else is mark-only.
  *
  * Merge phase (#392): queued pairs merge through the dedup core under one
- * lock/backup window, capped with the zone by dedupNightlyMaxMerges. A pair
- * that cannot apply keeps both memories and holds the cursor.
+ * lock/backup window. A pair that cannot apply keeps both memories and holds
+ * the cursor; a conflicts-linked or metadata-mismatched refusal keeps both
+ * and advances (the verdict was rendered).
  *
  * Cursor discipline mirrors stageSupersession: the cursor advances past a
  * candidate once its neighbor set has been considered, regardless of infra
@@ -533,25 +656,13 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
     const minSimilarity = validNumber(options.minSimilarity, exports.DEFAULT_CORRECTION_MIN_SIMILARITY, (n) => n > 0 && n <= 1);
     const rewriteMinConfidence = validNumber(options.rewriteMinConfidence, exports.DEFAULT_CORRECTION_REWRITE_MIN_CONFIDENCE, (n) => n > 0 && n <= 1);
     const autoMergeThreshold = validNumber(options.autoMergeThreshold, dedup_js_1.DEFAULT_DEDUP_MERGE_THRESHOLD, (n) => n > 0 && n <= 1);
-    const maxMerges = validNumber(options.maxMerges, dedup_js_1.DEFAULT_DEDUP_NIGHTLY_MAX_MERGES, (n) => n >= 0);
-    const maxMinutes = validNumber(options.maxMinutes, exports.DEFAULT_RECONSOLIDATION_MAX_MINUTES, (n) => n >= 0);
-    const maxCalls = validNumber(options.maxCalls, exports.DEFAULT_RECONSOLIDATION_MAX_CALLS, (n) => n >= 0);
-    // ---- #401 runtime bounds. The wall-clock deadline is measured from stage
-    // start (the deterministic zone's runtime counts against it — the binding
-    // constraint must be THIS knob, never the process-level backstop).
-    const deadlineAt = maxMinutes > 0 ? Date.now() + Math.round(maxMinutes * 60_000) : Infinity;
-    const deadlineHit = () => Date.now() >= deadlineAt;
-    // ---- #392 phase 0: the deterministic merge zone (pairs >= the ceiling),
-    // LLM-free and budget-free — an LLM-less night still drains duplicates. Its
-    // own short lock window, pre-merge backup, and pacing cap; fail-soft, never
-    // a throw. Runs FIRST so the scan below never sees the pairs it owns.
-    const merges = await (0, dedup_js_1.runDeterministicMergeZone)(db, {
-        stateDir: stateDir ?? (0, paths_js_1.hicortexHome)(),
-        threshold: autoMergeThreshold,
-        maxMerges,
-        dryRun,
-        acquireLock: options.acquireLock,
-    });
+    // ---- #405 runtime bound. The stage-local reconsolidationMaxMinutes clock
+    // (#401) is gone — the run-wide pipeline deadline (nightly.ts, config
+    // nightlyTimeBudgetMinutes) is the only wall-clock. The deterministic
+    // zone's runtime counts against it via the zone's own stop-check below.
+    // hit() logs event=deadline_deferred once per stage name.
+    const deadline = options.deadline;
+    const deadlineHit = (stageLabel = exports.RECONSOLIDATION_STAGE_LABEL) => deadline?.hit(stageLabel) ?? false;
     // Per-run verdict statistics by cosine band (#392) — report snapshot here,
     // cumulative series in state.json at stage end (never on dry-run).
     const bands = buildResolutionBands(minSimilarity, autoMergeThreshold);
@@ -593,6 +704,16 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
     let skippedAboveCeiling = 0;
     let skippedMetadataMismatch = 0;
     let mergePairsApplied = 0;
+    // #393 guard-C: conflicts verdicts rendered (link written, both live) and
+    // judged-path merge refusals on a conflicts-linked pair.
+    let conflictFlagged = 0;
+    let conflictSkippedJudged = 0;
+    // #393 B scout counters (per-source observability, the #394 discipline):
+    // shape calls made / correction-shaped verdicts / FTS hits that became
+    // candidate pairs. 0 on dry-run (the shape call is LLM work).
+    let scoutScanned = 0;
+    let scoutCorrectionShaped = 0;
+    let scoutCandidatesFound = 0;
     let cursor = startCursor;
     const queuedMerges = [];
     // #392 cursor-hold anchor, shared by the merge phase and the rewrite phase:
@@ -607,16 +728,14 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
         linksCreatedThisRun.add(`${oldId}|${newId}`);
     };
     // ---- #401: mid-scan cursor persistence. Called at EVERY scan-loop exit
-    // path (deadline, call/budget cap, mark-verify budget stop, discovery
+    // path (deadline, budget cap, mark-verify budget stop, discovery
     // failure) AND after every fully-considered candidate, so a killed run
     // loses at most the candidate in flight. The end-of-stage updateState
     // below stays the authoritative final write (it also applies the
     // pendingMinRowid hold — that variable is only ever set AFTER the scan
     // loop, so it is null at every call site here). updateState is
     // load→mutate→temp-rename atomic.
-    let callsUsed = 0;
     let deadlineStopped = false;
-    let callCapStopped = false;
     // #402 follow-up (reviewer note 1): the hard-kill orphan floor. Queued
     // merges and open rewrite groups are applied only in the POST-scan
     // phases — until then their verdicts exist only in memory, and a
@@ -671,14 +790,6 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
             persistCursor();
             break;
         }
-        // #401: the per-stage call cap stops the scan at the candidate boundary
-        // (the in-loop check below is the mid-candidate backstop — supersession
-        // mirrors both).
-        if (!dryRun && maxCalls > 0 && callsUsed >= maxCalls) {
-            callCapStopped = true;
-            persistCursor();
-            break;
-        }
         scanned++;
         // ---- AC7: verify incoming explicit marks (corrected_by/superseded_by
         // links targeting this candidate) before they can join a rewrite group.
@@ -709,7 +820,6 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
                 }
                 const { verdict, usage } = await classifyPair(llm, target.content, candidate.content);
                 budget.recordUsage(exports.RECONSOLIDATION_STAGE_LABEL, usage);
-                callsUsed++; // #401
                 pairsEvaluated++;
                 if (!verdict) {
                     skippedInfra++; // mark retained; the neighborhood is revisited via newer candidacies
@@ -733,7 +843,43 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
                 break;
             }
         }
-        // ---- AC2: detection pairs against older KNN neighbors.
+        // ---- #393 B: scout shape call — ONE classify-tier call per candidate,
+        // budget-metered under the same stage label as verdicts. Flags whether
+        // this memory corrects/retracts/supersedes something previously recorded;
+        // non-corrections stop here (zero follow-up). A parse/infra failure skips
+        // the scout source for this memory only (fail-soft — the similarity
+        // source below still runs) and counts skipped_infra, the verdict-skip
+        // discipline. Dry-run skips the call entirely: it is LLM work, and
+        // dry-runs make zero LLM calls (the scout counters read 0 there).
+        let scoutReferences = null;
+        if (!dryRun) {
+            if (!budget.use(exports.RECONSOLIDATION_STAGE_LABEL)) {
+                persistCursor(); // shape call refused — this candidate re-scouts next run
+                break;
+            }
+            scoutScanned++;
+            try {
+                const r = await llm.complete(buildScoutShapePrompt(candidate.content));
+                budget.recordUsage(exports.RECONSOLIDATION_STAGE_LABEL, r.usage);
+                const shape = parseScoutShape(r.text);
+                if (!shape) {
+                    skippedInfra++;
+                }
+                else if (shape.correction) {
+                    scoutCorrectionShaped++;
+                    scoutReferences = shape.references;
+                }
+            }
+            catch {
+                skippedInfra++;
+            }
+        }
+        // ---- AC2: detection pairs against older neighbors — TWO sources (#393 B):
+        // the KNN similarity source (floor-gated, the pre-B baseline) and, for
+        // correction-shaped candidates, the scout's FTS source (the referenced
+        // claim's terms → corpus search; NO similarity gate — cosine is a ranker,
+        // never a blocker). Merged + deduped by neighbor id: a pair found by both
+        // sources is judged ONCE, as similarity (with band attribution).
         let neighbors;
         try {
             neighbors = await findOlderCorrectionNeighbors(db, candidate, embedFn, minSimilarity);
@@ -744,39 +890,74 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
             persistCursor(); // #401: every exit path persists
             continue;
         }
-        for (const neighbor of neighbors) {
-            pairsDiscovered++; // every neighbor passed the floor gate
-            if (alreadyResolutionLinked(db, neighbor.id, candidate.id)) {
+        const neighborEntries = neighbors.map((n) => ({
+            mem: n,
+            cosine: (0, retrieval_js_1.l2ToCosine)(n.distance),
+            source: "similarity",
+        }));
+        if (scoutReferences !== null) {
+            const candidateVec = storage.getStoredEmbedding(db, candidate.id);
+            const knnById = new Map(neighborEntries.map((e) => [e.mem.id, e]));
+            for (const entry of findScoutNeighbors(db, candidate, scoutReferences, candidateVec)) {
+                const knn = knnById.get(entry.mem.id);
+                if (knn) {
+                    // Both sources found the pair. Below the ceiling the KNN entry
+                    // would be judged anyway — similarity keeps it (band attribution,
+                    // judged once). At/above the ceiling the similarity entry would be
+                    // ceiling-skipped (zone territory, never judged) — yet the zone now
+                    // runs AFTER the scan, and a genuine conflict at >=0.92 is exactly
+                    // the pair it would blend with no judge in the loop (guard-C's
+                    // harm). Re-tag the entry to the scout source so the pair IS
+                    // judged: the scout's no-gate exemption applies, a `conflicts`
+                    // verdict can plant the guard link, and the zone's own guard then
+                    // refuses the cluster in this same run.
+                    if (knn.cosine >= autoMergeThreshold)
+                        knn.source = "scout";
+                    continue;
+                }
+                neighborEntries.push(entry);
+            }
+        }
+        for (const entry of neighborEntries) {
+            pairsDiscovered++; // gate discovery (#394), both sources, before any skip/judgment
+            if (entry.source === "scout")
+                scoutCandidatesFound++;
+            if (alreadyResolutionLinked(db, entry.mem.id, candidate.id)) {
                 skippedIdempotent++;
                 continue;
             }
             pairsDiscoveredUnlinked++; // still unlinked — the actionable candidate
-            // #392: pairs at/above the ceiling belong to the deterministic zone —
-            // counted here, never LLM-judged (the zone merges them or holds them
-            // for its cap; re-detection is structural, not cursor-based).
-            const pairCosine = (0, retrieval_js_1.l2ToCosine)(neighbor.distance);
-            if (pairCosine >= autoMergeThreshold) {
+            const pairCosine = entry.cosine;
+            // #392: SIMILARITY-source pairs at/above the ceiling belong to the
+            // deterministic zone — counted here, never LLM-judged (the zone merges
+            // them at stage end or defers them to a later run; re-detection is
+            // structural, not cursor-based). Scout pairs are exempt (#393 B):
+            // cosine never blocks this source — guard-C's re-tag above relies on
+            // it, and a judged merge re-passes the same metadata/conflict rails
+            // the zone enforces.
+            if (entry.source === "similarity" && pairCosine >= autoMergeThreshold) {
                 skippedAboveCeiling++;
                 continue;
             }
             if (dryRun)
                 continue; // preview only — no LLM call, no write
-            // #401: the per-stage call cap rides the same boundary as the budget —
-            // supersession-stage pattern (consolidate.ts stageSupersession).
-            if ((maxCalls > 0 && callsUsed >= maxCalls) || !budget.use(exports.RECONSOLIDATION_STAGE_LABEL)) {
-                callCapStopped = maxCalls > 0 && callsUsed >= maxCalls;
+            // #405: the ONE run budget's refusal is the only call cap.
+            if (!budget.use(exports.RECONSOLIDATION_STAGE_LABEL)) {
                 persistCursor(); // cursor still points at the last fully-considered candidate
                 break;
             }
-            const { verdict, usage } = await classifyPair(llm, neighbor.content, candidate.content);
+            const { verdict, usage } = await classifyPair(llm, entry.mem.content, candidate.content);
             budget.recordUsage(exports.RECONSOLIDATION_STAGE_LABEL, usage);
-            callsUsed++; // #401
             pairsEvaluated++;
             if (!verdict) {
                 skippedInfra++;
                 continue;
             }
-            recordBand(pairCosine, verdict.action, verdict.confidence);
+            // Bands stay similarity-source-only (refine Q2 ruling): they are the
+            // calibration evidence for the floor/ceiling boundaries, and scout
+            // pairs reach them through a different, cosine-blind door.
+            if (entry.source === "similarity")
+                recordBand(pairCosine, verdict.action, verdict.confidence);
             // #392: a merge verdict is queued for the merge phase (below) — no
             // link, no write here. Below the confidence gate BOTH memories stay
             // live: a weak mark is recoverable, and there is nothing to mark for a
@@ -784,24 +965,38 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
             if (verdict.action === "merge") {
                 if (verdict.confidence < rewriteMinConfidence) {
                     mergeBelowGate++;
-                    const band = bandForCosine(bands, pairCosine);
-                    if (band) {
-                        const stat = runBands.get(band.label) ?? emptyBandStat();
-                        stat.merge_below_gate++;
-                        runBands.set(band.label, stat);
+                    if (entry.source === "similarity") {
+                        const band = bandForCosine(bands, pairCosine);
+                        if (band) {
+                            const stat = runBands.get(band.label) ?? emptyBandStat();
+                            stat.merge_below_gate++;
+                            runBands.set(band.label, stat);
+                        }
                     }
                 }
                 else {
-                    queuedMerges.push({ oldId: neighbor.id, newId: candidate.id, candidateRowid: candidate.__rowid });
+                    queuedMerges.push({ oldId: entry.mem.id, newId: candidate.id, candidateRowid: candidate.__rowid });
                     notePendingRowid(candidate.__rowid); // orphan floor — merge unapplied until the merge phase
                 }
                 continue;
             }
             if (verdict.action === "supersedes") {
-                markLink(neighbor.id, candidate.id, "superseded_by", (0, retrieval_js_1.l2ToCosine)(neighbor.distance));
-                storage.updateMemory(db, neighbor.id, { status: "superseded" });
+                markLink(entry.mem.id, candidate.id, "superseded_by", pairCosine);
+                storage.updateMemory(db, entry.mem.id, { status: "superseded" });
                 markedSuperseded++;
-                console.log(`[hicortex] Reconsolidation: ${neighbor.id.slice(0, 8)} superseded_by ${candidate.id.slice(0, 8)} (mark-only)`);
+                console.log(`[hicortex] Reconsolidation: ${entry.mem.id.slice(0, 8)} superseded_by ${candidate.id.slice(0, 8)} (mark-only)`);
+                continue;
+            }
+            // #393 guard-C: a genuine conflict — link ONLY. No status change on
+            // either memory (both stay live so the consumer sees both truths), no
+            // rewrite, no merge queue; the link is the guard both merge paths
+            // consult. Ungated like the other mark actions (a weak flag is
+            // recoverable; a weak merge is not).
+            if (verdict.action === "conflicts") {
+                markLink(entry.mem.id, candidate.id, "conflicts", pairCosine);
+                conflictFlagged++;
+                console.log(`[hicortex] Reconsolidation: ${entry.mem.id.slice(0, 8)} conflicts ${candidate.id.slice(0, 8)} ` +
+                    `(flag-only) — both kept live, never merged`);
                 continue;
             }
             if (verdict.action === "corrects") {
@@ -810,19 +1005,19 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
                     // Below the gate: mark-only, never rewrite. The
                     // trigger stays live — it is the only carrier of the correction.
                     belowGate++;
-                    markLink(neighbor.id, candidate.id, "corrected_by", cosine);
-                    storage.updateMemory(db, neighbor.id, { status: "retracted" });
+                    markLink(entry.mem.id, candidate.id, "corrected_by", cosine);
+                    storage.updateMemory(db, entry.mem.id, { status: "retracted" });
                     markedRetracted++;
                     continue;
                 }
-                if (!isFactShapedTarget(neighbor)) {
+                if (!isFactShapedTarget(entry.mem)) {
                     // Decisions/plans/experiences are history, not error — mark only.
-                    markLink(neighbor.id, candidate.id, "corrected_by", cosine);
-                    storage.updateMemory(db, neighbor.id, { status: "retracted" });
+                    markLink(entry.mem.id, candidate.id, "corrected_by", cosine);
+                    storage.updateMemory(db, entry.mem.id, { status: "retracted" });
                     markedRetracted++;
                     continue;
                 }
-                addTrigger(neighbor, candidate, verdict.confidence, cosine, false);
+                addTrigger(entry.mem, candidate, verdict.confidence, cosine, false);
             }
             // verdict "none" → nothing to do
         }
@@ -835,24 +1030,20 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
         persistCursor();
     }
     if (deadlineStopped) {
-        console.log(`[hicortex] Reconsolidation: wall-clock deadline reached (reconsolidationMaxMinutes) — ` +
-            `scan stopped at cursor ${cursor}; the next run resumes from there`);
-    }
-    else if (callCapStopped) {
-        console.log(`[hicortex] Reconsolidation: per-run call cap reached (reconsolidationMaxCalls) — ` +
+        console.log(`[hicortex] Reconsolidation: run deadline reached (nightlyTimeBudgetMinutes) — ` +
             `scan stopped at cursor ${cursor}; the next run resumes from there`);
     }
     // ---- #392 judged-merge phase: apply the queued pair merges through the
     // dedup core (mergeMemoryIds — same canonical pick, link re-points,
     // dedup_log, absorb). One short lock/backup window for the whole batch, one
-    // transaction per pair. Zone merge operations count against the SAME
-    // dedupNightlyMaxMerges cap. A pair that cannot apply (cap exhausted, busy
-    // lock, failed backup) keeps BOTH memories live and holds the cursor below
-    // its candidate — a confirmed merge is never silently dropped by the cursor
-    // passing it (dup-over-loss). A metadata-rail refusal is different: the
-    // verdict WAS rendered, both memories stay live, the cursor advances.
-    const zoneOpsUsed = merges.merged_clusters + merges.failed;
-    let mergeOpsRemaining = maxMerges > 0 ? Math.max(0, maxMerges - zoneOpsUsed) : 0;
+    // transaction per pair. #405: the dedupNightlyMaxMerges cap is gone — the
+    // run deadline bounds the merge loop (a stop-check between local
+    // transactions; the deferred pairs hold the cursor below their candidates).
+    // A pair that cannot apply (deadline, busy lock, failed backup) keeps BOTH
+    // memories live and holds the cursor below its candidate — a confirmed
+    // merge is never silently dropped by the cursor passing it (dup-over-loss).
+    // A metadata-rail refusal is different: the verdict WAS rendered, both
+    // memories stay live, the cursor advances.
     let mergePairsDeferred = 0;
     if (!dryRun && queuedMerges.length > 0) {
         const holdQueued = (from) => {
@@ -863,20 +1054,7 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
                         : Math.min(pendingMinRowid, queuedMerges[i].candidateRowid);
             }
         };
-        if (maxMerges === 0) {
-            // Machinery disabled by config: keep both (counted in band_stats as
-            // merge verdicts) and ADVANCE — holding the cursor would re-judge the
-            // same pairs into the same disabled state forever.
-            console.log(`[hicortex] Reconsolidation: ${queuedMerges.length} confirmed merge(s) kept — ` +
-                `dedupNightlyMaxMerges is 0 (merge machinery disabled)`);
-        }
-        else if (mergeOpsRemaining <= 0) {
-            mergePairsDeferred = queuedMerges.length;
-            holdQueued(0); // zone consumed the whole cap — retry next run
-            console.log(`[hicortex] Reconsolidation: ${mergePairsDeferred} confirmed merge(s) deferred — ` +
-                `dedupNightlyMaxMerges exhausted by the deterministic zone`);
-        }
-        else {
+        {
             const acquire = options.acquireLock ?? capture_js_1.acquireCaptureLock;
             const release = await acquire(stateDir ?? (0, paths_js_1.hicortexHome)(), 0);
             if (!release) {
@@ -898,16 +1076,19 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
                     if (backupOk) {
                         for (let i = 0; i < queuedMerges.length; i++) {
                             const pair = queuedMerges[i];
-                            if (mergeOpsRemaining <= 0) {
+                            // #405: the deadline stop-check between local merge
+                            // transactions — a safe boundary; deferred pairs hold the
+                            // cursor below their candidates and retry next run.
+                            if (deadlineHit()) {
+                                deadlineStopped = true;
                                 mergePairsDeferred = queuedMerges.length - i;
-                                holdQueued(i); // cap exhausted mid-batch — the rest retry next run
-                                console.log(`[hicortex] Reconsolidation: ${mergePairsDeferred} confirmed merge(s) deferred — dedupNightlyMaxMerges exhausted`);
+                                holdQueued(i);
+                                console.log(`[hicortex] Reconsolidation: ${mergePairsDeferred} confirmed merge(s) deferred — run deadline reached`);
                                 break;
                             }
                             const result = (0, dedup_js_1.mergeMemoryIds)(db, [pair.oldId, pair.newId]);
                             if (result.ok) {
                                 mergePairsApplied++;
-                                mergeOpsRemaining--;
                                 console.log(`[hicortex] Reconsolidation: merged ${pair.oldId.slice(0, 8)} + ${pair.newId.slice(0, 8)} ` +
                                     `into canonical ${result.canonicalId.slice(0, 8)} (${result.linksRepointed} link(s) re-pointed)`);
                             }
@@ -916,6 +1097,14 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
                                 console.log(`[hicortex] Reconsolidation: merge of ${pair.oldId.slice(0, 8)} + ${pair.newId.slice(0, 8)} ` +
                                     `skipped (metadata mismatch) — both kept`);
                             }
+                            else if (result.reason === "conflict_linked") {
+                                // #393 guard-C: the pair is conflicts-linked (operator-planted
+                                // or a prior verdict) — never blended; the cursor advances,
+                                // this verdict was rendered.
+                                conflictSkippedJudged++;
+                                console.log(`[hicortex] Reconsolidation: merge of ${pair.oldId.slice(0, 8)} + ${pair.newId.slice(0, 8)} ` +
+                                    `skipped (conflict-flagged) — both kept`);
+                            }
                             // "no_members": a member vanished/was absorbed since the
                             // verdict — nothing to merge, nothing to hold; the cursor
                             // advances past it.
@@ -961,11 +1150,6 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
                 deferFrom(group.targetId);
                 break;
             }
-            if (maxCalls > 0 && callsUsed >= maxCalls) {
-                callCapStopped = true;
-                deferFrom(group.targetId);
-                break;
-            }
             if (!budget.use(exports.RECONSOLIDATION_STAGE_LABEL)) {
                 deferFrom(group.targetId);
                 break;
@@ -974,10 +1158,9 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
             let contract = null;
             let infraError = false;
             try {
-                const r = await llm.completeClassify(buildRewritePrompt(group.target.content, triggersArg));
+                const r = await llm.complete(buildRewritePrompt(group.target.content, triggersArg));
                 contract = parseRewriteReply(r.text, group.triggers.map((t) => t.id), group.target.content);
                 budget.recordUsage(exports.RECONSOLIDATION_STAGE_LABEL, r.usage);
-                callsUsed++; // #401: rewrite contracts count toward the stage call cap
             }
             catch {
                 infraError = true;
@@ -1063,6 +1246,23 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
                 keptLinked++;
         }
     }
+    // ---- #393 guard-C zone reorder: the deterministic merge zone (pairs >=
+    // the ceiling) runs LAST — after the scan, the judged-merge phase, and the
+    // rewrite phase. Judgment outranks the deterministic sweep: verdicts,
+    // marks, and binds land first, and the zone merges only what no verdict
+    // claimed. With the zone first, a >=0.92 genuine-conflict pair was blended
+    // before the judge ever saw it (canonical = oldest, the newer truth erased
+    // — the planted-eval harm); running it last means a `conflicts` bind set by
+    // THIS run's scan guards the SAME run's zone. LLM-free and budget-free — an
+    // LLM-less night still drains duplicates. Its own short lock window,
+    // pre-merge backup, and #405 deadline stop-check; fail-soft, never a throw.
+    const merges = await (0, dedup_js_1.runDeterministicMergeZone)(db, {
+        stateDir: stateDir ?? (0, paths_js_1.hicortexHome)(),
+        threshold: autoMergeThreshold,
+        dryRun,
+        acquireLock: options.acquireLock,
+        deadline,
+    });
     // Cursor hold: un-applied work (rewrite groups, confirmed merges) holds the
     // cursor BELOW its earliest contributing candidate so the pairs are
     // re-detected next run.
@@ -1073,7 +1273,10 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
     // losers are merge verdicts at confidence 1.0; the zone persists the
     // cumulative copy itself) plus this run's judged bands.
     const bandStats = {};
-    if (merges.max_merges > 0) {
+    {
+        // #405: recorded whenever the zone ran (the old max_merges>0 gate was a
+        // 0=disabled switch — the switch is gone; a clean corpus records zeros,
+        // same as the old default-config behavior).
         const det = emptyBandStat();
         det.pairs = merges.losers_merged;
         det.merge = merges.losers_merged;
@@ -1110,7 +1313,10 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
             `${markedRetracted} retracted (${belowGate} below gate, ${mergeBelowGate} merge below gate, ` +
             `${contractFailed} contract failed), ${skippedInfra} infra-skipped, ${skippedIdempotent} ` +
             `already-linked, ${skippedAboveCeiling} above ceiling, ${explicitVerified} explicit verified, ` +
-            `${explicitDivergent} explicit divergent (cursor ${cursor})`);
+            `${explicitDivergent} explicit divergent, scout ${scoutScanned} scanned / ` +
+            `${scoutCorrectionShaped} correction-shaped / ${scoutCandidatesFound} candidate pair(s), ` +
+            `${conflictFlagged} conflict-flagged, ${conflictSkippedJudged + merges.skipped_conflict} conflict-skipped ` +
+            `(cursor ${cursor})`);
     }
     return {
         scanned,
@@ -1134,6 +1340,11 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
         merge_below_gate: mergeBelowGate,
         skipped_above_ceiling: skippedAboveCeiling,
         skipped_metadata_mismatch: skippedMetadataMismatch,
+        conflict_flagged: conflictFlagged,
+        conflict_skipped: conflictSkippedJudged + merges.skipped_conflict,
+        scout_scanned: scoutScanned,
+        scout_correction_shaped: scoutCorrectionShaped,
+        scout_candidates_found: scoutCandidatesFound,
         band_stats: bandStats,
     };
 }