@gamaze/hicortex 0.20.7 → 0.20.9

package/dist/types.d.ts

@@ -91,6 +91,8 @@ export interface ResolutionBandStat {
     merge: number;
     corrects: number;
     supersedes: number;
+    /** #393 guard-C: verdicts that flagged a genuine conflict (link, both kept). */
+    conflicts: number;
     none: number;
     /** Merge verdicts below the confidence gate — both memories kept. */
     merge_below_gate: number;
@@ -100,16 +102,15 @@ export interface ResolutionBandStat {
     metadata_skipped?: number;
 }
 /**
- * Report of the deterministic merge zone (#392) — the >= dedupAutoMergeThreshold
- * band, merged by the dedup core's union-find clustering with ZERO LLM calls.
+ * Report of the deterministic merge zone (#392) — the band at/above the merge
+ * ceiling (release-managed since #408; was the dedupAutoMergeThreshold config
+ * key), merged by the dedup core's union-find clustering with ZERO LLM calls.
  * Computed in dedup.ts (runDeterministicMergeZone); surfaced verbatim as
  * `stages.reconsolidation.merges`.
  */
 export interface DeterministicMergeZoneReport {
-    /** The cosine ceiling in force (config dedupAutoMergeThreshold; default 0.92). */
+    /** The cosine ceiling in force (release-managed calibration; default 0.92). */
     threshold: number;
-    /** The pacing cap in force (dedupNightlyMaxMerges; 0 = machinery disabled). */
-    max_merges: number;
     /** Every cluster found at the threshold (mergeable + mismatch-skipped). */
     clusters_found: number;
     /** Clusters that passed the metadata rails (would merge). */
@@ -122,8 +123,19 @@ export interface DeterministicMergeZoneReport {
     links_repointed: number;
     /** Clusters skipped — members disagree on project / source_agent. */
     skipped_metadata_mismatch: number;
-    /** Mergeable clusters NOT attempted because the pacing cap was exhausted. */
+    /**
+     * #393 guard-C: clusters skipped because a member pair holds a `conflicts`
+     * link — a judge-flagged genuine conflict is never blended, both records
+     * stay live.
+     */
+    skipped_conflict: number;
+    /**
+     * Mergeable clusters NOT attempted (pacing cap retired, #405): the run
+     * deadline fired before them. Deferred clusters drain on the next run.
+     */
     capped: number;
+    /** #405: clusters in `capped` that stopped specifically on the deadline. */
+    deadline_deferred?: number;
     /** Clusters whose merge transaction failed (rolled back; retried next run). */
     failed: number;
     /** Apply only: the capture lock was busy — zero merges, fail-soft. */
@@ -144,7 +156,14 @@ export interface ConsolidationReport {
     started_at: string;
     completed_at?: string;
     dry_run: boolean;
-    status: "completed" | "skipped" | "failed";
+    /**
+     * "deferred" (#405): the run-wide wall-clock deadline
+     * (nightlyTimeBudgetMinutes) fired — at least one stage stopped at a safe
+     * boundary and its remaining work drains on the next run (cursors hold
+     * below it). Like "endpoint_down" it must NOT advance lastConsolidated,
+     * so the pending-set queries re-find the deferred work.
+     */
+    status: "completed" | "skipped" | "failed" | "deferred";
     elapsed_seconds?: number;
     stages: {
         precheck?: {
@@ -178,7 +197,8 @@ export interface ConsolidationReport {
             primaries_updated?: number;
             /**
              * No-fit path: memories that earned a WEAK primary (argmax prototype
-             * cosine >= weakPrimaryFloor) after the LLM found no fitting domain.
+             * cosine >= the weak-primary floor — release-managed since #408) after
+             * the LLM found no fitting domain.
              */
             weak_primary?: number;
             /**
@@ -217,7 +237,8 @@ export interface ConsolidationReport {
          * Reconsolidation (#384) — runs after supersession, before decay/prune.
          * Since #392 this is THE unified resolution stage: its verdict also carries
          * a `merge` disposition, and the deterministic merge zone (pairs at/above
-         * `dedupAutoMergeThreshold`) runs inside it, LLM-free, before the scan.
+         * the merge ceiling — release-managed since #408) runs inside it,
+         * LLM-free, before the scan.
          */
         reconsolidation?: {
             /** Candidates examined this run (rowid > cursor; no shape filter). */
@@ -225,14 +246,17 @@ export interface ConsolidationReport {
             /** Pairs actually sent to the verdict LLM (detection + explicit-mark verification). */
             pairs_evaluated: number;
             /**
-             * #394: pairs the similarity floor discovered this run (KNN neighbors
-             * at/above correctionMinSimilarity), counted before any skip or
-             * judgment — the only sizing number a dry-run can show, where
-             * pairs_evaluated is always 0.
+             * #394: pairs the detection sources discovered this run, counted before
+             * any skip or judgment — the only sizing number a dry-run can show,
+             * where pairs_evaluated is always 0. #393 B: BOTH sources join this
+             * total (KNN neighbors at/above the correction floor + the scout's
+             * FTS hits on correction-shaped memories; see scout_candidates_found
+             * for the scout's share).
              */
             pairs_discovered: number;
             /** #394: discovered pairs with no resolution link yet — the actionable
-             * candidates (deterministic-zone work + would-be verdict calls). */
+             * candidates (deterministic-zone work + would-be verdict calls). #393 B:
+             * covers both detection sources. */
             pairs_discovered_unlinked: number;
             /** Targets rewritten in place this run (one history row each). */
             rewritten: number;
@@ -244,7 +268,7 @@ export interface ConsolidationReport {
             marked_superseded: number;
             /** Memories marked status 'retracted' (mark-only: below gate / non-fact / failed contract). */
             marked_retracted: number;
-            /** Verdicts that were `corrects` but below correctionRewriteMinConfidence. */
+            /** Verdicts that were `corrects` but below the rewrite confidence gate. */
             below_gate: number;
             /** Rewrite groups degraded to mark-only on a failed rewrite contract. */
             contract_failed: number;
@@ -267,11 +291,13 @@ export interface ConsolidationReport {
             merges: DeterministicMergeZoneReport;
             /** #392: judged-zone pair merges applied this run (merge verdicts at/above the confidence gate). */
             merge_pairs_applied: number;
-            /** #392: merge verdicts below correctionRewriteMinConfidence — both memories kept. */
+            /** #392: merge verdicts below the rewrite confidence gate — both memories kept. */
             merge_below_gate: number;
             /**
              * #392: pairs the scan saw at/above the ceiling — owned by the
              * deterministic zone (or waiting for its cap), never LLM-judged.
+             * #393 B: similarity-source pairs only; the scout's FTS pairs are
+             * exempt (no similarity gate — cosine never blocks that source).
              */
             skipped_above_ceiling: number;
             /**
@@ -280,6 +306,34 @@ export interface ConsolidationReport {
              * the verdict was rendered, this is not an infra failure.
              */
             skipped_metadata_mismatch: number;
+            /**
+             * #393 guard-C: verdicts that flagged a genuine conflict — a `conflicts`
+             * link was written, both memories stay live (no status change, no
+             * rewrite, no merge queue).
+             */
+            conflict_flagged: number;
+            /**
+             * #393 guard-C: merges refused because the pair (deterministic-zone
+             * cluster or judged merge) holds a `conflicts` link — aggregates the
+             * judged-path refusals plus the zone's `skipped_conflict`. Both records
+             * kept live in every case.
+             */
+            conflict_skipped: number;
+            /**
+             * #393 B: memories given the scout's correction-shape call this run
+             * (ONE classify-tier call per scanned candidate; always 0 on dry-run —
+             * the shape call is LLM work, and dry-runs make zero LLM calls).
+             */
+            scout_scanned: number;
+            /** #393 B: shape verdicts that flagged a correction/retraction/supersession. */
+            scout_correction_shaped: number;
+            /**
+             * #393 B: FTS hits that became candidate pairs — the scout's share of
+             * pairs_discovered (after older-only/self filtering and dedup against
+             * the KNN neighbors; a pair found by both sources counts as
+             * similarity). Counted before the idempotency skip, the #394 discipline.
+             */
+            scout_candidates_found: number;
             /**
              * #392: per-run verdict statistics by cosine band ("0.75-0.8" …
              * ">=0.92"; labels derive from the live floor/ceiling). Calibration
@@ -407,7 +461,7 @@ export interface HicortexConfig {
      * Server-mode `init` scaffolds a generic 5-domain default (Work, Personal,
      * People, Health, Finance — see GENERIC_DEFAULT_DOMAINS in init.ts) when
      * this key is absent, and NEVER touches an existing list. A power-user
-     * example (custom weakPrimaryFloor) ships as
+     * example (a wider life-sphere set) ships as
      * domains.example.json in the package root.
      *
      * NO fallback bucket is needed or special-cased (owner amendment 07.07):
@@ -437,14 +491,28 @@ export interface HicortexConfig {
      */
     consolidationHours?: number[];
     /**
-     * Ceiling on total LLM calls across all classify-tier consolidation stages
-     * (content-domain, link discovery, supersession) per nightly run (0.17, #241).
-     * A runaway backstop, not a throughput throttle — on a free local model the
-     * binding constraint is the nightly unit's wall-clock timeout, not call count.
-     * Default `5000` (was a hard-coded 200 that starved link/supersession during a
-     * classification backlog and drained large backlogs at ~cap/night).
-     */
-    consolidateMaxLlmCalls?: number;
+     * The ONE wall-clock budget (minutes) for a nightly run (#405): capture +
+     * every consolidation stage share one cooperative deadline, checked at safe
+     * boundaries (capture segments, stage boundaries, item loops, the merge
+     * zone). A run whose deadline fires reports consolidation status
+     * "deferred" and resumes from its cursors next run — no work is lost or
+     * redone. Default 240; 0 or invalid → default (a deadline ALWAYS exists —
+     * unlike the retired reconsolidationMaxMinutes, 0 is not "off"). The
+     * systemd unit's TimeoutStartSec is derived from this (budget + 60 min
+     * slack) at init.
+     */
+    nightlyTimeBudgetMinutes?: number;
+    /**
+     * The ONE per-run ceiling on LLM calls across the whole nightly pipeline
+     * (#405; successor of consolidateMaxLlmCalls, #241). Consumed in run
+     * order — run order IS the fair share; a stage that exhausts the budget
+     * defers its remainder to the next run via its cursor. Bounds money/load
+     * independent of latency: a fast metered or capacity-limited endpoint
+     * permits thousands of calls inside the wall-clock budget. Default 5000;
+     * 0 or invalid → default. The legacy `consolidateMaxLlmCalls` key is
+     * honored as a deprecated alias for one release.
+     */
+    nightlyLlmCallBudget?: number;
     /**
      * Release channel pinned into the generated daemon/timer ExecStart for
      * **npx-thin** installs (global-binary installs use the absolute binary path
@@ -454,36 +522,6 @@ export interface HicortexConfig {
      * Absent → auto-detect (bare on `latest`, else `@next`). (0.17.1)
      */
     updateChannel?: string;
-    /**
-     * Minimum cosine(memory embedding, best domain prototype) for a no-fit
-     * memory to earn a WEAK primary instead of decaying (see nofit.ts).
-     * Number in (0, 1); default 0.45. Tune from the corpus weight distribution
-     * (the memory_tags.weight histogram of LLM-tagged rows — set the floor
-     * near its lower tail). See domains.example.json for a worked example.
-     */
-    weakPrimaryFloor?: number;
-    /**
-     * Per-attempt timeout (ms) for the CLIENT nightly's pre-flight GET /health
-     * check before capturing (#163). Default 15000. Overridable per machine —
-     * a wired Pi vs a sleeping laptop want different values. See runClientNightly
-     * in nightly.ts. No effect in server mode (server capture is localhost).
-     */
-    preflightTimeoutMs?: number;
-    /**
-     * Max attempts for the client nightly's pre-flight /health retry loop (#163).
-     * Default 3. Attempts are spaced preflightRetryGapMs apart; on exhaustion the
-     * run aborts with a non-zero exit code and an ok=false telemetry ping so the
-     * failure is visible to systemd/launchd and the activity aggregate.
-     */
-    preflightAttempts?: number;
-    /**
-     * Gap (ms) between pre-flight /health attempts in the client nightly (#163).
-     * Default 60000. Wall-clock-optimistic on a sleeping laptop — setTimeout does
-     * NOT advance while macOS is asleep, so real elapsed time can exceed the
-     * nominal worst case. Not a defect (capture lock isn't held; cursor design is
-     * dup-over-loss); just don't treat the nominal sum as a hard bound.
-     */
-    preflightRetryGapMs?: number;
     /**
      * Max output tokens for the ONE LLM model used by all phases — distillation,
      * reflection, classification, and scoring. Default 8192. An explicit value
@@ -492,18 +530,6 @@ export interface HicortexConfig {
      * when it finishes early. Read in llm.ts; see #220.
      */
     maxTokens?: number;
-    /**
-     * Max output tokens for the classify tier ONLY — the short JSON-verdict
-     * calls: correction/supersession verdicts, rewrite contracts, and type +
-     * domain tag classification. Default 1024. A ceiling, not a target
-     * (generation stops at the model's natural end) — raise it when a
-     * reasoning-style model spends the budget on internal reasoning and returns
-     * empty verdicts (the pre-#391 hardcoded per-call caps starved exactly that
-     * shape; a local non-reasoning model is unaffected by the raise).
-     * `maxTokens` continues to govern the heavy phases (distill/reflect).
-     * Read in llm.ts; see #391.
-     */
-    classifyMaxTokens?: number;
     /**
      * Toggle the model's internal reasoning ("thinking") stream on the openai-compat
      * path — applies to ALL phases (distill / reflect / classify / scoring) since one
@@ -519,38 +545,6 @@ export interface HicortexConfig {
      * anthropic or claude-cli paths. See #220, #231.
      */
     enableThinking?: boolean;
-    /**
-     * Context window for ollama (the one model, all phases). Default 8192 — the point
-     * where context stops being the binding constraint for a sub-8B model on ollama
-     * (above it the SMALL_MODEL_MAX_CHUNK_CHARS speed cap binds instead, so extra
-     * context buys nothing). Also drives `detectChunkSize`'s chunk sizing
-     * (chunkChars ≤ numCtx × 0.6 × 4 chars), so numCtx is the single dial and the
-     * chunker/request agreement is enforced by construction (#228). For an ≥8B model
-     * on ollama the speed cap is 60,000 chars, needing numCtx ≈ 25000 to reach — raise
-     * it if running 8B+ locally. No effect for non-ollama providers.
-     */
-    numCtx?: number;
-    /**
-     * Flush ollama's accumulated memory every N scoring calls — workaround for
-     * ollama's per-request memory growth (the runner's RSS climbs ~171 MB/call and
-     * isn't freed between requests), which swap-thrashes RAM-constrained boxes
-     * during long consolidations. Default 0 (off). When >0, every Nth scoring call
-     * (`completeFast`) triggers a `keep_alive:0` unload + an `ollamaFlushWaitMs`
-     * pause for the runner to exit + release, then the next call reloads fresh.
-     * N=15 caps a cycle at ~2.5 GB. Scoped to the fast tier (scoring) only. Note:
-     * N counts **logical** scoring calls, not raw HTTP requests — `complete()`
-     * retries up to 4× on timeout, so under retry pressure the actual accumulation
-     * may be up to 4×N calls' worth. In practice the flush prevents the thrash that
-     * causes retries, keeping the count accurate.
-     */
-    ollamaFlushEvery?: number;
-    /**
-     * Milliseconds to wait after an ollama flush (`keep_alive:0`) for the runner
-     * to exit + release its accumulated memory before the next call reloads.
-     * Default 180000 (3 min — the runner takes >90 s to exit after keep_alive:0;
-     * doubled for margin). Only relevant when `ollamaFlushEvery` > 0.
-     */
-    ollamaFlushWaitMs?: number;
     /**
      * ONE per-attempt timeout ceiling (ms) for every LLM phase — distill,
      * reflect, classify, and scoring alike (#337). Default 900000 (15 min). The
@@ -564,21 +558,6 @@ export interface HicortexConfig {
      * claude-cli (subprocess timeout).
      */
     llmTimeoutMs?: number;
-    /**
-     * Consecutive ladder-exhausted TOTAL failures (fetch-failed / ECONNREFUSED /
-     * timeout / "Headers Timeout" class) after which the per-endpoint circuit
-     * breaker opens (#337). Default 3; `0` disables. While open, calls throw
-     * `LlmCircuitOpenError` immediately with NO network I/O. HTTP error statuses
-     * with a response, parse errors, and rate limits never count (they throw
-     * before the retry ladder can be exhausted). Any success resets the counter.
-     */
-    llmBreakerThreshold?: number;
-    /**
-     * How long (ms) an open circuit breaker stays open before the next call
-     * becomes a half-open trial (#337). Default 600000 (10 min). A trial failure
-     * re-opens the breaker; a trial success resets it.
-     */
-    llmBreakerCooldownMs?: number;
     /**
      * Timeout (ms) for the readiness probe's single 1-token generation attempt
      * (#337). Default 60000. The probe asks "can this endpoint GENERATE", which
@@ -610,8 +589,8 @@ export interface HicortexConfig {
     /**
      * Max memories per recall on the OpenClaw plugin's legacy /search fallback
      * (pre-0.14 servers, #316). Default 8. Does NOT size the pushed
-     * /recall-index — that is server config (`recallMaxItems`); the server
-     * accepts no client limit.
+     * /recall-index — that is sized by the server's release-managed calibration
+     * (#408); the server accepts no client limit.
      */
     recallLimit?: number;
     /**
@@ -706,45 +685,6 @@ export interface HicortexConfig {
     orgName?: string;
     /** Plan/tier label rendered as a small badge (e.g. "Cloud · Early bird"). */
     planLabel?: string;
-    /**
-     * Minimum cosine similarity for a reconsolidation candidate pair (#384):
-     * each new-since-cursor memory is paired with up to 5 older KNN neighbors
-     * at/above this bar before the verdict call. Default 0.75 — a touch wider
-     * than the supersession stage's 0.80 because a retraction often rides inside
-     * an otherwise unrelated memory; the verdict + confidence gate carry the
-     * precision. Number in (0, 1]; invalid/absent keeps the default.
-     */
-    correctionMinSimilarity?: number;
-    /**
-     * Minimum verdict confidence for the REWRITE fork of reconsolidation (#384):
-     * a `corrects` verdict at/above this bar on a fact-shaped target is rewritten
-     * in place; below it the pair degrades to mark-only (a weak mark is
-     * recoverable, a weak rewrite is corruption). Default 0.80. Number in
-     * (0, 1]; invalid/absent keeps the default. Since #392 this same gate also
-     * decides whether a `merge` verdict is applied (analogous reasoning: a weak
-     * merge keeps both memories, a confirmed merge hides one).
-     */
-    correctionRewriteMinConfidence?: number;
-    /**
-     * Deterministic merge ceiling for the unified resolution pass (#392): memory
-     * pairs at/above this cosine are merged by the dedup core's union-find
-     * clustering with ZERO LLM calls; pairs in [correctionMinSimilarity, this
-     * value) get the one unified verdict call (merge/corrects/supersedes/none).
-     * Default 0.92 (the #100/#191 calibration). The legacy `dedupMergeThreshold`
-     * key is honored as a fallback when this key is absent. Number in (0, 1];
-     * invalid/absent keeps the default. Also read by the manual `hicortex dedup`
-     * CLI (same precedence: --threshold > this key > legacy key > 0.92).
-     */
-    dedupAutoMergeThreshold?: number;
-    /**
-     * Pacing cap on merge OPERATIONS per nightly run (#392): deterministic-zone
-     * clusters plus judged pair merges count against ONE cap, so a
-     * misbehaving-distiller burst is bounded and a large pre-existing backlog
-     * drains over a few nights rather than in one run. Default 250. `0` disables
-     * the merge machinery entirely (the deterministic zone is skipped; a
-     * confirmed merge verdict keeps both memories). Non-negative integer.
-     */
-    dedupNightlyMaxMerges?: number;
 }
 /** A config-owned life-sphere domain (see HicortexConfig.domains). */
 export interface DomainDef {

package/domains.example.json

@@ -1,11 +1,11 @@
 {
   "_readme": [
     "Hicortex memory domains — example config.",
-    "Copy the `domains` key (and optionally `weakPrimaryFloor`) into ~/.hicortex/config.json on the SERVER machine.",
+    "Copy the `domains` key into ~/.hicortex/config.json on the SERVER machine.",
     "Domains are your top-level memory spheres. Each memory gets multiple weighted tags plus a derived primary.",
     "They can be life areas OR project/topic areas — edit to match how YOU think.",
     "The `domains` list below is the generic default that `hicortex init` scaffolds automatically.",
-    "There is NO fallback category: memories that fit nothing are handled automatically (weak-primary floor + decay).",
+    "There is NO fallback category: memories that fit nothing are handled automatically (weak-primary floor + decay — release-managed calibration, not config).",
     "Backfill an existing corpus with: hicortex classify-domains"
   ],
   "domains": [
@@ -34,7 +34,7 @@
     "_readme": [
       "A narrower life-sphere set for users who want tighter buckets.",
       "The PRIMARY domain is derived by argmax association weight (LLM tag order breaks ties) — no manual override flag.",
-      "`weakPrimaryFloor` (default 0.45) is the minimum embedding similarity for a no-fit memory to earn a weak primary; tune it from your corpus."
+      "The weak-primary floor is release-managed since #408 (a calibration constant shipped with each release) — not a config key."
     ],
     "domains": [
       {
@@ -69,7 +69,6 @@
         "name": "Travel",
         "description": "Trips, destinations, bookings, travel plans"
       }
-    ],
-    "weakPrimaryFloor": 0.5
+    ]
   }
 }

package/hermes-plugin/hicortex/README.md

@@ -22,7 +22,7 @@ That's the whole surface. No `sync_turn`, no compaction/session-end capture —
 
 ### Pushed recall index (0.7.0, server ≥ 0.14)
 
-Instead of injecting full memory content every turn, `prefetch` sends the user's message to the server's `POST /recall-index` and injects the returned **index block** verbatim — one line per memory (id, title, date), capped and relevance-gated server-side. The agent fetches full content with `hicortex_get(id)` only when a line is actually relevant; that fetch is what strengthens the memory (exposure ≠ use). All tuning knobs (`recallMaxItems`, `recallMinSimilarity`, `recallReshowTurns`, `recallMinPromptChars`, …) live in the **server** config — the plugin carries none. Dedup is turn-based and server-side per session; the plugin resets it at `initialize` (the Hermes `MemoryProvider` interface exposes no compaction signal, so a mid-session context rebuild cannot trigger a reset — the server's turn-based re-show window covers that gap). Against a pre-0.14 server (404) the plugin falls back to the 0.6.x `GET /search` full-content prefetch, fail-soft, re-probing the endpoint every 10 minutes so a later server upgrade is picked up without a gateway restart. The recall calls carry the profile's configured `default_project` (and `mission_domains`) and use a short dedicated timeout (1.5 s) so a slow server can never stall a turn. (`privacy_filter` is deprecated since 0.7.2 — the server ignores privacy; see [Configuration](#configure-activate).)
+Instead of injecting full memory content every turn, `prefetch` sends the user's message to the server's `POST /recall-index` and injects the returned **index block** verbatim — one line per memory (id, title, date), capped and relevance-gated server-side. The agent fetches full content with `hicortex_get(id)` only when a line is actually relevant; that fetch is what strengthens the memory (exposure ≠ use). All tuning knobs (`recallMaxItems`, `recallMinSimilarity`, `recallReshowTurns`, `recallMinPromptChars`, …) are release-managed constants on the server (they ship with each release and change only with published eval evidence) — the plugin carries none, and neither does the server's config. Dedup is turn-based and server-side per session; the plugin resets it at `initialize` (the Hermes `MemoryProvider` interface exposes no compaction signal, so a mid-session context rebuild cannot trigger a reset — the server's turn-based re-show window covers that gap). Against a pre-0.14 server (404) the plugin falls back to the 0.6.x `GET /search` full-content prefetch, fail-soft, re-probing the endpoint every 10 minutes so a later server upgrade is picked up without a gateway restart. The recall calls carry the profile's configured `default_project` (and `mission_domains`) and use a short dedicated timeout (1.5 s) so a slow server can never stall a turn. (`privacy_filter` is deprecated since 0.7.2 — the server ignores privacy; see [Configuration](#configure-activate).)
 
 ### Per-agent standing context (0.13)
 
@@ -78,7 +78,7 @@ hermes memory setup   # select "hicortex", enter the server URL/token when promp
 
 Run it once per profile if you use Hermes profiles. Hermes allows **one** external memory provider at a time, so disable Honcho (or any other) first, then restart the gateway.
 
-Setup asks exactly two questions: the **server URL** and the **auth token**. Everything else has a correct default and is configured — if ever needed — directly in `$HERMES_HOME/plugins/hicortex/config.json`: `default_project` (blank = memories unattributed), `recall_limit` (default 5; sizes the tools and the legacy `/search` fallback only — the pushed recall index is sized by SERVER config `recallMaxItems`), `agent_name` (blank auto-derives from the running profile; pin it only for fleet re-installs — see [Per-agent standing context](#per-agent-standing-context-013)), and `mission_domains` (blank = off; an optional recall boost keyed to the server's domain vocabulary). The auth token is a **secret** — set it via env, not the JSON file:
+Setup asks exactly two questions: the **server URL** and the **auth token**. Everything else has a correct default and is configured — if ever needed — directly in `$HERMES_HOME/plugins/hicortex/config.json`: `default_project` (blank = memories unattributed), `recall_limit` (default 5; sizes the tools and the legacy `/search` fallback only — the pushed recall index is sized by the server's release-managed calibration), `agent_name` (blank auto-derives from the running profile; pin it only for fleet re-installs — see [Per-agent standing context](#per-agent-standing-context-013)), and `mission_domains` (blank = off; an optional recall boost keyed to the server's domain vocabulary). The auth token is a **secret** — set it via env, not the JSON file:
 
 ```bash
 export HICORTEX_AUTH_TOKEN=hctx-<your-token>   # or your custom token

package/openclaw.plugin.json

@@ -24,7 +24,7 @@
       "recallLimit": {
         "type": "number",
         "default": 8,
-        "description": "Max memories per recall on the pre-0.14 /search fallback (default 8). The pushed recall index is sized by SERVER config (recallMaxItems) — the server accepts no client limit."
+        "description": "Max memories per recall on the pre-0.14 /search fallback (default 8). The pushed recall index is sized by the server's release-managed calibration — the server accepts no client limit."
       },
       "scaffoldDeadMan": {
         "type": "boolean",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gamaze/hicortex",
-  "version": "0.20.7",
+  "version": "0.20.9",
   "description": "Persistent agent identity for AI agents \u2014 a hand-edited identity layer, nightly-distilled experience, and lessons injected every session, shared across your whole fleet. Works with Hermes, OpenClaw, Claude Code, Pi, and opencode.",
   "main": "dist/index.js",
   "bin": {
@@ -42,6 +42,7 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "eval": "node dist/eval/run-eval.js",
+    "eval:planted": "node dist/eval/planted-eval.js",
     "eval:recall-sweep": "node dist/eval/recall-sweep.js",
     "eval:relevance": "node dist/eval/relevance-eval.js",
     "prepack": "npm run build && rm -rf ./hermes-plugin && mkdir -p ./hermes-plugin && cp -r ../../hermes-plugin/hicortex ./hermes-plugin/ && find ./hermes-plugin -name __pycache__ -type d -exec rm -rf {} + 2>/dev/null || true && rm -rf ./pi-extension && mkdir -p ./pi-extension && cp -r ../../pi-extension/hicortex ./pi-extension/ && rm -rf ./opencode-plugin && mkdir -p ./opencode-plugin && cp -r ../../opencode-plugin/hicortex ./opencode-plugin/",

package/pi-extension/hicortex/README.md

@@ -18,7 +18,7 @@ Gives [Pi](https://pi.dev) agents self-learning memory backed by a Hicortex serv
 
 ### Pushed recall index
 
-Each user prompt is POSTed to the server's `/recall-index`; the returned **index block** (one line per relevant memory: id, title, date) is injected into the turn. All gating and dedup knobs (`recallMaxItems`, `recallMinSimilarity`, `recallReshowTurns`, …) live in the **server** config — the extension carries none. A dedup reset fired at session start is awaited by the first turn's recall POST, so it can never land after it and wipe the turn state.
+Each user prompt is POSTed to the server's `/recall-index`; the returned **index block** (one line per relevant memory: id, title, date) is injected into the turn. All gating and dedup knobs (`recallMaxItems`, `recallMinSimilarity`, `recallReshowTurns`, …) are release-managed constants on the server (they ship with each release and change only with published eval evidence) — the extension carries none, and neither does the server's config. A dedup reset fired at session start is awaited by the first turn's recall POST, so it can never land after it and wipe the turn state.
 
 ### Identity layer
 

package/server.json

@@ -2,13 +2,13 @@
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.gamaze-labs/hicortex",
   "title": "Hicortex",
-  "description": "Shared fleet memory for AI agents \u2014 what one agent learns, the whole fleet knows.",
-  "version": "0.20.5",
+  "description": "Shared fleet memory for AI agents: nightly self-correction, recall every prompt (supported agents).",
+  "version": "0.20.9",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@gamaze/hicortex",
-      "version": "0.20.5",
+      "version": "0.20.9",
       "transport": {
         "type": "stdio",
         "command": "npx",