@gamaze/hicortex 0.20.7 → 0.20.9

package/dist/mcp-server.js

@@ -76,6 +76,7 @@ const viz_js_1 = require("./viz.js");
 const dashboard_js_1 = require("./dashboard.js");
 const identity_store_js_1 = require("./identity-store.js");
 const retrieval = __importStar(require("./retrieval.js"));
+const CALIBRATION = __importStar(require("./calibration.js"));
 const recall_registry_js_1 = require("./recall-registry.js");
 const memory_instructions_js_1 = require("./memory-instructions.js");
 const recall_index_js_1 = require("./recall-index.js");
@@ -180,7 +181,7 @@ function createMcpServer() {
     // -- hicortex_search --
     server.tool("hicortex_search", "Search shared long-term memory (all agents, all sessions). CALL THIS BEFORE assuming, guessing, or asking the user about anything that may have come up before: prior decisions, preferences, project facts, people, hardware, past incidents. If you are about to write 'I don't have information about…', search first.", {
         query: zod_1.z.string().describe("Search query text"),
-        limit: zod_1.z.coerce.number().optional().describe("Max results (default: server config searchLimit)"),
+        limit: zod_1.z.coerce.number().optional().describe("Max results (default: the server default)"),
         project: zod_1.z.string().optional().describe("Filter by project name"),
     }, async ({ query, limit, project }) => {
         if (!db)
@@ -214,7 +215,7 @@ function createMcpServer() {
     // -- hicortex_recent --
     server.tool("hicortex_recent", "Get recent memories, optionally filtered by project. CALL THIS AT THE START of substantive work on a project to catch up on its latest state — cheaper than asking the user what happened.", {
         project: zod_1.z.string().optional().describe("Filter by project name"),
-        limit: zod_1.z.coerce.number().optional().describe("Max results (default: server config recentLimit)"),
+        limit: zod_1.z.coerce.number().optional().describe("Max results (default: the server default)"),
     }, async ({ project, limit }) => {
         if (!db)
             return { content: [{ type: "text", text: "Hicortex not initialized" }], isError: true };
@@ -674,9 +675,10 @@ async function startServer(options = {}) {
         });
     }
     if (llmConfig) {
-        // Tuning (#220: maxTokens + enableThinking + numCtx + flush), validated +
-        // copied via the shared overlay (also applied in resolveSavedLlmConfig for
-        // the nightly). Wrong-typed values warn + drop.
+        // Tuning (#220: maxTokens + enableThinking; #408: the diagnostic env tier
+        // for numCtx + ollama flush), validated + resolved via the shared overlay
+        // (also applied in resolveSavedLlmConfig for the nightly — the ONE
+        // resolution point per process). Wrong-typed values warn + drop.
         (0, llm_js_1.applyTierTuningOverlay)(llmConfig, savedConfig);
         llm = new llm_js_1.LlmClient(llmConfig);
         console.log(`[hicortex] LLM (one model, all phases): ${llmConfig.provider}/${llmConfig.model}`);
@@ -749,34 +751,29 @@ async function startServer(options = {}) {
         console.warn("[hicortex] Config uses the legacy 'contextAgents' key — renamed to 'identityAgents' in 0.18 (#264). " +
             "The legacy key still works; update your config to silence this warning.");
     }
-    // #192 recall/decay alignment: decay speed + recall breadth + pushed-recall
-    // knobs, ALL from config (see retrieval.ts configureRecall for the key list)
-    // so calibration is a config edit + restart, never a release.
-    retrieval.configureDecay({ halfLifeDays: savedConfig?.decayHalfLifeDays });
-    const recallCfg = retrieval.configureRecall(savedConfig);
-    const scoringCfg = retrieval.configureScoring(savedConfig);
-    const sessionIntentCfg = retrieval.configureSessionIntent(savedConfig);
-    console.log(`[hicortex] Recall: k=${recallCfg.searchLimit}/recent=${recallCfg.recentLimit}` +
+    // #408: recall/decay calibration is RELEASE-MANAGED (calibration.ts) — no
+    // config keys are read here anymore. The plain configure*() calls pin this
+    // process to the shipped constants (they remain the eval/test seam; see
+    // retrieval.ts). The boot log still prints the active values — now sourced
+    // from the calibration constants via the configure*() returns.
+    retrieval.configureDecay();
+    const recallCfg = retrieval.configureRecall();
+    const scoringCfg = retrieval.configureScoring();
+    const sessionIntentCfg = retrieval.configureSessionIntent();
+    console.log(`[hicortex] Recall (release-managed calibration): k=${recallCfg.searchLimit}/recent=${recallCfg.recentLimit}` +
         `/window=${recallCfg.recentWindowDays}d/cold=${recallCfg.coldExposureSlots}` +
-        `/novelty=${(0, recall_index_js_1.resolveNoveltyFloorSlots)(savedConfig?.noveltyFloorSlots, savedConfig?.recallMaxItems)}` +
+        `/novelty=${CALIBRATION.NOVELTY_FLOOR_SLOTS}` +
         ` · ` +
         `score sim=${scoringCfg.similarity}/str=${scoringCfg.strength}/conn=${scoringCfg.connections}` +
         `/rec=${scoringCfg.recency}, fresh=${scoringCfg.freshnessBoostWeight}@${scoringCfg.freshnessBoostDays}d, ` +
         `superseded×${scoringCfg.supersededDemotion}` +
         `, intent w=${sessionIntentCfg.weight}` +
         (sessionIntentCfg.weight === 0 ? " (disabled)" : ""));
-    recallRegistry = new recall_registry_js_1.SessionRecallRegistry({
-        reshowTurns: savedConfig?.recallReshowTurns,
-    });
-    recallIndexOptions = {
-        minSimilarity: savedConfig?.recallMinSimilarity,
-        maxItems: savedConfig?.recallMaxItems,
-        minPromptLength: savedConfig?.recallMinPromptChars,
-        titleChars: savedConfig?.recallTitleChars,
-        // #324 novelty floor: slots of recallMaxItems guaranteed to the
-        // pure-prompt (unblended) search's top passing hit(s). 0 disables.
-        noveltyFloorSlots: savedConfig?.noveltyFloorSlots,
-    };
+    // Defaults resolve inside recall-index.ts / recall-registry.ts from the
+    // calibration constants (#408) — the options objects stay as the seams the
+    // eval injects through.
+    recallRegistry = new recall_registry_js_1.SessionRecallRegistry();
+    recallIndexOptions = {};
     memoryInstructionsEnabled = savedConfig?.memoryInstructions !== false;
     if (resolvedAgents.dropped.length > 0) {
         console.warn(`[hicortex] Ignoring invalid identityAgents entries: ${resolvedAgents.dropped.join(", ")} ` +
@@ -1002,7 +999,8 @@ async function startServer(options = {}) {
             res.status(400).json({ error: "Missing 'query'" });
             return;
         }
-        // No hardcoded default: absent limit → config-driven (searchLimit).
+        // No hardcoded default: absent limit → the release-managed calibration
+        // default (#408 — was the searchLimit config key).
         const limit = req.query.limit ? Number(req.query.limit) : undefined;
         const project = typeof req.query.project === "string" && req.query.project ? req.query.project : undefined;
         // 0.16.x: `privacy` query param is ACCEPTED for backward compat (old
@@ -1074,7 +1072,8 @@ async function startServer(options = {}) {
             return;
         }
         const project = typeof req.query.project === "string" && req.query.project ? req.query.project : undefined;
-        // No hardcoded default: absent limit → config-driven (recentLimit).
+        // No hardcoded default: absent limit → the release-managed calibration
+        // default (#408 — was the recentLimit config key).
         // 0.16.x: `privacy` query param accepted but ignored (vestigial column).
         const limit = req.query.limit ? Number(req.query.limit) : undefined;
         warnDeprecatedPrivacyParamIfPresent(req.query, "recent");
@@ -1789,7 +1788,8 @@ function readConfigFile(stateDir) {
     }
     catch (e) {
         console.warn(`[hicortex] ${configPath} exists but could not be parsed — server booting degraded ` +
-            `(config-driven LLM/decay/recall knobs and agentId self-heal will not apply). ` +
+            `(config-driven LLM knobs and agentId self-heal will not apply; decay/recall ` +
+            `calibration is release-managed and unaffected). ` +
             `Fix the JSON and restart. Cause: ${e instanceof Error ? e.message : String(e)}`);
         return null;
     }

package/dist/nightly.js

@@ -64,7 +64,6 @@ const embedder_js_1 = require("./embedder.js");
 const storage = __importStar(require("./storage.js"));
 const consolidate_js_1 = require("./consolidate.js");
 const domain_classify_js_1 = require("./domain-classify.js");
-const nofit_js_1 = require("./nofit.js");
 const transcript_reader_js_1 = require("./transcript-reader.js");
 const hermes_transcript_reader_js_1 = require("./hermes-transcript-reader.js");
 const pi_transcript_reader_js_1 = require("./pi-transcript-reader.js");
@@ -76,6 +75,7 @@ const state_js_1 = require("./state.js");
 const identity_store_js_1 = require("./identity-store.js");
 const capture_cursors_js_1 = require("./capture-cursors.js");
 const capture_js_1 = require("./capture.js");
+const run_deadline_js_1 = require("./run-deadline.js");
 const dashboard_js_1 = require("./dashboard.js");
 const telemetry_js_1 = require("./telemetry.js");
 const init_js_1 = require("./init.js");
@@ -167,7 +167,7 @@ function computeSince(stateDir, recaptureWindowDays, now = new Date()) {
 }
 /** POST /distill transport for server mode — localhost. Sends authToken so
  *  self-capture works regardless of the localhost-bypass marker (#271 root-cause fix). */
-function makeLocalPost(port, authToken) {
+function makeLocalPost(port, authToken, deadline) {
     return async (body) => {
         const resp = await fetch(`http://127.0.0.1:${port}/distill`, {
             method: "POST",
@@ -177,13 +177,16 @@ function makeLocalPost(port, authToken) {
             },
             body: JSON.stringify(body),
             // Synchronous 35B distillation of a large segment can take minutes.
-            signal: AbortSignal.timeout(20 * 60 * 1000),
+            // #405: never wait past the run deadline — the capture loop's
+            // between-segments check is the clean stop; this is the hard bound
+            // for the POST in flight when the deadline expires mid-wait.
+            signal: AbortSignal.timeout(postTimeoutMs(deadline)),
         });
         return normalizePostResult(resp);
     };
 }
 /** POST /distill transport for client mode — remote URL + optional bearer token. */
-function makeRemotePost(serverUrl, authToken) {
+function makeRemotePost(serverUrl, authToken, deadline) {
     return async (body) => {
         const resp = await fetch(`${serverUrl}/distill`, {
             method: "POST",
@@ -192,11 +195,20 @@ function makeRemotePost(serverUrl, authToken) {
                 ...(authToken ? { Authorization: `Bearer ${authToken}` } : {}),
             },
             body: JSON.stringify(body),
-            signal: AbortSignal.timeout(20 * 60 * 1000),
+            signal: AbortSignal.timeout(postTimeoutMs(deadline)),
         });
         return normalizePostResult(resp);
     };
 }
+/**
+ * Per-POST timeout: 20 min (synchronous distillation of a large segment can
+ * take minutes), clamped to the run deadline's remaining time when one is in
+ * force (#405) — a POST launched near expiry never outlives the deadline.
+ */
+function postTimeoutMs(deadline) {
+    const CAP_MS = 20 * 60 * 1000;
+    return Math.max(1, Math.min(CAP_MS, deadline ? deadline.remainingMs() : Infinity));
+}
 async function normalizePostResult(resp) {
     if (resp.status === 201) {
         const data = (await resp.json().catch(() => ({})));
@@ -272,9 +284,6 @@ function captureLockWaitMs() {
     const env = Number(process.env.HICORTEX_CAPTURE_LOCK_WAIT_MS);
     return Number.isFinite(env) && env >= 0 ? env : CAPTURE_LOCK_WAIT_MS;
 }
-// readPositiveConfig moved to ./config-read.ts (shared with the distill-tier
-// overlay in llm.ts / mcp-server.ts). Validates positive-number config knobs
-// at the disk→runtime boundary with a warn-on-rejected-value.
 const NIGHTLY_LOG_MAX_BYTES = 1024 * 1024; // 1 MB — years of normal runs
 /**
  * Keep ~/.hicortex/nightly.log bounded. The launchd plist and systemd unit
@@ -320,10 +329,11 @@ function runEvictionOnly(options = {}) {
     const stateDir = options.stateDir ?? HICORTEX_HOME;
     const savedConfig = readNightlyConfig(stateDir);
     // Same clock as the full nightly (see runNightly's identical trio) — the
-    // eviction ranker reads these module knobs.
-    (0, retrieval_js_1.configureDecay)({ halfLifeDays: savedConfig?.decayHalfLifeDays });
-    (0, retrieval_js_1.configureRecall)(savedConfig);
-    (0, retrieval_js_1.configureScoring)(savedConfig);
+    // eviction ranker reads these module knobs. #408: calibration constants,
+    // never user config — the calls just pin the process to the shipped values.
+    (0, retrieval_js_1.configureDecay)();
+    (0, retrieval_js_1.configureRecall)();
+    (0, retrieval_js_1.configureScoring)();
     const dbPath = (0, db_js_1.resolveDbPath)(options.dbPath);
     console.log(`[hicortex] evict-only run${options.dryRun ? " (dry run)" : ""} — DB: ${dbPath}`);
     const db = (0, db_js_1.initDb)(dbPath);
@@ -460,16 +470,31 @@ async function runNightly(options = {}) {
     }
     const dbPath = (0, db_js_1.resolveDbPath)(options.dbPath);
     // #192: consolidation's decay/prune stage must score with the same clock as
-    // the server's retrieval path (config decayHalfLifeDays, default 365).
-    (0, retrieval_js_1.configureDecay)({ halfLifeDays: savedConfig?.decayHalfLifeDays });
-    (0, retrieval_js_1.configureRecall)(savedConfig);
-    (0, retrieval_js_1.configureScoring)(savedConfig);
+    // the server's retrieval path. #408: that clock is the calibration constant
+    // set (calibration.ts) — both processes resolve identically by construction.
+    (0, retrieval_js_1.configureDecay)();
+    (0, retrieval_js_1.configureRecall)();
+    (0, retrieval_js_1.configureScoring)();
     const modeLabel = consolidateOnly ? " (consolidate-only)" : captureOnly ? " (capture-only)" : dryRun ? " (dry run)" : "";
     console.log(`[hicortex] Nightly pipeline starting${modeLabel}`);
     if (captureOnly) {
         console.log(`[hicortex] capture-only run — consolidation skipped`);
     }
     console.log(`[hicortex] DB: ${dbPath}`);
+    // #405: the ONE pipeline deadline. Full and consolidate-only runs create
+    // it at start and share it across capture + every consolidation stage
+    // (checked at safe boundaries; a hit defers cleanly — see run-deadline.ts).
+    // Capture-only/watchdog runs do NOT: they keep their 30-min systemd
+    // backstop (capture is no-LLM and short). Dry-run is exempt (writes
+    // nothing, spends nothing). 0/invalid config → the 240 default — a
+    // deadline always exists (the old reconsolidationMaxMinutes 0=off is gone).
+    const deadline = !dryRun && !captureOnly
+        ? (0, run_deadline_js_1.createRunDeadline)((0, run_deadline_js_1.resolveNightlyTimeBudgetMinutes)(savedConfig))
+        : undefined;
+    if (deadline) {
+        console.log(`[hicortex] Nightly time budget: ${Math.round((deadline.deadlineAt - Date.now()) / 60_000)} min ` +
+            `(deadline at ${new Date(deadline.deadlineAt).toISOString()})`);
+    }
     // Init DB — consolidation reads the DB directly; capture goes via HTTP.
     const db = (0, db_js_1.initDb)(dbPath);
     try {
@@ -515,8 +540,11 @@ async function runNightly(options = {}) {
         else {
             // Full nightly waits out a transient --capture-only overlap (each segment
             // POST can block up to 20 min); capture-only fails fast. dry-run writes
-            // nothing so it needs no lock.
-            const lockWaitMs = captureLockWaitMs();
+            // nothing so it needs no lock. #405: the wait never outlives the run
+            // deadline — waiting the full 30 min with 5 min left would burn the
+            // whole pipeline on a lock queue. captureLockWaitMs() keeps its env
+            // override (tests); min() clamps to whatever remains.
+            const lockWaitMs = Math.max(0, Math.min(captureLockWaitMs(), deadline ? deadline.remainingMs() : Infinity));
             const releaseLock = dryRun
                 ? (() => { })
                 : await (0, capture_js_1.acquireCaptureLock)(stateDir, captureOnly ? 0 : lockWaitMs);
@@ -581,11 +609,12 @@ async function runNightly(options = {}) {
                     // source_agent_id / source_domain are per-client provenance from
                     // config.json (agentId / sourceDomain) — attribution only, no filtering.
                     const result = await (0, capture_js_1.captureBatches)(batches, {
-                        post: makeLocalPost(port, savedConfig?.authToken),
+                        post: makeLocalPost(port, savedConfig?.authToken, deadline),
                         cursorStore,
                         dryRun,
                         sourceAgentId: savedConfig?.agentId,
                         sourceDomain: savedConfig?.sourceDomain,
+                        deadline,
                     });
                     memoriesIngested = result.memoriesIngested;
                     distillUsage = result.distillUsage;
@@ -633,10 +662,12 @@ async function runNightly(options = {}) {
         // nothing-to-do short-circuit (zero LLM calls), NOT a failure.
         // "throttled" (#246) = the llmTokensPerMonth fair-use cap was projected to
         // be exceeded, so consolidation was skipped before any LLM call.
-        // "endpoint_down" (#337) = the pre-consolidation readiness probe failed, or
-        // the LLM circuit breaker was open after the run — transient (retried next
-        // run), and NEVER "completed": the stages fail soft, so without this
-        // override a dead-endpoint run would report clean.
+        // "endpoint_down" (#337) = the LLM circuit breaker was open after the run —
+        // transient (retried next run), and NEVER "completed": the stages fail
+        // soft, so without this override a dead-endpoint run would report clean.
+        // "deferred" (#405) = the run-wide wall-clock deadline fired — at least one
+        // stage stopped at a safe boundary and drains next run (lastConsolidated
+        // held, exactly like endpoint_down).
         let consolidationStatus;
         // #246: total consolidation tokens consumed this run (hoisted for telemetry
         // + the dashboard snapshot). Undefined when consolidation didn't run at all
@@ -688,12 +719,11 @@ async function runNightly(options = {}) {
                         // estimate so the next month starts clean.
                         if (!dryRun) {
                             (0, state_js_1.updateState)((s) => {
-                                const now = new Date();
-                                const cur = s.llmTokensThisPeriod;
-                                const startD = cur?.periodStart ? new Date(cur.periodStart) : now;
-                                if (startD.getUTCFullYear() !== now.getUTCFullYear() ||
-                                    startD.getUTCMonth() !== now.getUTCMonth()) {
-                                    s.llmTokensThisPeriod = { prompt: 0, completion: 0, total: 0, periodStart: now.toISOString() };
+                                // #405: the ONE monthly-reset staleness helper — shared by
+                                // shouldThrottleTokens, this file's post-consolidation
+                                // accrual write, and token-budget.ts recordDistillUsage.
+                                if ((0, consolidate_js_1.isStaleTokenPeriod)(s.llmTokensThisPeriod?.periodStart)) {
+                                    s.llmTokensThisPeriod = { prompt: 0, completion: 0, total: 0, periodStart: new Date().toISOString() };
                                     s.llmTokensLastRun = 0;
                                     console.log("[hicortex] Token fair-use period reset (new month) — throttle cleared.");
                                 }
@@ -702,59 +732,41 @@ async function runNightly(options = {}) {
                     }
                 }
                 if (consolidationStatus !== "throttled") {
-                    // #337: readiness probe — ONE minimal generation request before any
-                    // consolidation phase. This REPLACES the #231 no-preflight decision
-                    // (its premise "a failed phase costs latency, not data" was falsified
-                    // by the 2026-08-23/24 incident: the gateway answered /v1/models —
-                    // liveness — while generation was dead, and the nightly retried into
-                    // it for ~5 h, making the wedge monotonically worse). A failed probe
-                    // skips consolidation entirely with the diagnosis "LLM endpoint not
-                    // generating" (not-generating, not slow) and status endpoint_down —
-                    // a transient outcome: consolidation has resumable cursors, the
-                    // nightly re-runs 2-4×/day, and capture is unaffected (the daemon's
-                    // /distill path has its own probe). Zero LLM phases run when the
-                    // probe fails — one fast failure is the whole cost.
-                    const probeOk = await llm.probe();
-                    if (!probeOk) {
-                        console.error("[hicortex] LLM endpoint not generating — consolidation skipped " +
-                            "(endpoint_down, will retry next run). See the ops runbook's " +
-                            "known failure signatures; llmProbeTimeoutMs tunes the probe's patience.");
-                        consolidationStatus = "endpoint_down";
-                    }
-                    else {
+                    // #405: the pre-consolidation readiness probe gate is DELETED. The
+                    // breaker's first-fast-failure semantics took over its job: a
+                    // wedged endpoint costs at most 3 ladder-exhausted logical calls
+                    // (~31 min at the 900 s ceiling, once per dead night, bounded by
+                    // the run deadline) before the post-run breakerOpen override below
+                    // reports endpoint_down. The probe SURVIVES in the daemon's
+                    // /distill gate (mcp-server.ts resolveDistillProbeGate) — a
+                    // different process with a different job.
+                    {
                         const cfgDomains = (0, domain_classify_js_1.parseConfigDomains)(savedConfig);
                         console.log(`[hicortex] Running consolidation...`);
                         const report = await (0, consolidate_js_1.runConsolidation)(db, llm, embedder_js_1.embed, dryRun, false, undefined, {
                             domains: cfgDomains,
                             contentDomainsReady: true,
-                            weakPrimaryFloor: (0, nofit_js_1.resolveWeakPrimaryFloor)(savedConfig),
+                            // #408: weakPrimaryFloor is a release-managed calibration
+                            // constant now — no config threading; the Options field stays
+                            // as the eval/test seam.
                         }, {
-                            minSimilarity: savedConfig?.supersessionMinSimilarity,
-                            maxCalls: savedConfig?.supersessionMaxCalls,
+                        // #405: no supersessionMaxCalls — the ONE run budget is the
+                        // only call cap. #408: minSimilarity defaults to the
+                        // calibration constant (seam only).
                         }, 
-                        // #241: config-driven total LLM-call ceiling (default 5000, was 200).
-                        (0, config_read_js_1.readPositiveConfig)(savedConfig ?? {}, "consolidateMaxLlmCalls", consolidate_js_1.CONSOLIDATE_MAX_LLM_CALLS), 
+                        // #405: the ONE per-run LLM-call ceiling (default 5000;
+                        // consolidateMaxLlmCalls honored as a deprecated alias).
+                        (0, consolidate_js_1.resolveNightlyLlmCallBudget)(savedConfig), 
                         // #245: soft cap on the corpus (default 10000; 0 disables eviction).
                         memorySoftCapResolved, {
-                            // #384 reconsolidation knobs — threaded exactly like the
-                            // supersession pair above; the stage validates and falls back
-                            // to its defaults (0.75 / 0.80) on invalid/absent values.
-                            minSimilarity: savedConfig?.correctionMinSimilarity,
-                            rewriteMinConfidence: savedConfig?.correctionRewriteMinConfidence,
-                            // #392 unified-resolution knobs: the deterministic-merge
-                            // ceiling (legacy dedupMergeThreshold honored when the new
-                            // key is absent) and the pacing cap. Same validation posture
-                            // — the stage defaults to 0.92 / 250.
-                            autoMergeThreshold: (savedConfig?.dedupAutoMergeThreshold ??
-                                savedConfig?.dedupMergeThreshold),
-                            maxMerges: savedConfig?.dedupNightlyMaxMerges,
-                            // #401 runtime bounds: the wall-clock deadline (default 120
-                            // min, 0 disables) and the per-run classify-call ceiling
-                            // (default 600, 0 disables). Same posture — the stage
-                            // validates and falls back on invalid/absent values.
-                            maxMinutes: savedConfig?.reconsolidationMaxMinutes,
-                            maxCalls: savedConfig?.reconsolidationMaxCalls,
-                        });
+                        // #384/#392 reconsolidation knobs — eval/test seams since
+                        // #408 (release-managed calibration constants; nothing is
+                        // threaded from config). The stage validates and falls back
+                        // to its calibration defaults on invalid/absent values.
+                        }, 
+                        // #405: the ONE run-wide deadline — capture and every
+                        // consolidation stage check this same handle.
+                        deadline);
                         console.log(`[hicortex] Consolidation ${report.status} in ${report.elapsed_seconds}s` +
                             (report.stages.reflection ? ` (${report.stages.reflection.lessons_generated} lessons)` : ""));
                         consolidationStatus = report.status;
@@ -812,27 +824,18 @@ async function runNightly(options = {}) {
                             (0, state_js_1.updateState)((s) => {
                                 const now = new Date();
                                 const cur = s.llmTokensThisPeriod;
-                                let periodStart = cur?.periodStart ?? now.toISOString();
-                                let prompt = cur?.prompt ?? 0;
-                                let completion = cur?.completion ?? 0;
-                                let total = cur?.total ?? 0;
-                                // Monthly reset: if periodStart is in a previous calendar month,
-                                // zero the accrual before adding this run's contribution.
-                                const startD = new Date(periodStart);
-                                if (startD.getUTCFullYear() !== now.getUTCFullYear() ||
-                                    startD.getUTCMonth() !== now.getUTCMonth()) {
-                                    periodStart = now.toISOString();
-                                    prompt = 0;
-                                    completion = 0;
-                                    total = 0;
-                                }
-                                if (tokensTotal) {
-                                    prompt += tokensTotal.prompt;
-                                    completion += tokensTotal.completion;
-                                    total += tokensTotal.total;
-                                }
+                                // Monthly reset — the ONE staleness helper (#405): zero the
+                                // accrual before adding this run's contribution when
+                                // periodStart sits in a previous UTC calendar month. Shared
+                                // with shouldThrottleTokens, this file's throttle-branch
+                                // reset, and token-budget.ts recordDistillUsage.
+                                const stale = (0, consolidate_js_1.isStaleTokenPeriod)(cur?.periodStart, now);
+                                const prompt = (stale ? 0 : cur?.prompt ?? 0) + (tokensTotal?.prompt ?? 0);
+                                const completion = (stale ? 0 : cur?.completion ?? 0) + (tokensTotal?.completion ?? 0);
+                                const total = (stale ? 0 : cur?.total ?? 0) + (tokensTotal?.total ?? 0);
                                 s.llmTokensThisPeriod = {
-                                    prompt, completion, total, periodStart,
+                                    prompt, completion, total,
+                                    periodStart: stale ? now.toISOString() : cur.periodStart,
                                 };
                                 s.llmTokensLastRun = tokensTotal?.total ?? 0;
                             }, stateDir);
@@ -1089,13 +1092,12 @@ async function runClientNightly(config, dryRun, stateDir = HICORTEX_HOME, recapt
     // the whole run — the pre-flight only needs the link back, which can take
     // ~1 min after wake.
     //
-    // Config-overridable (#163): a wired/well-connected client vs one whose link
-    // is slow to re-establish after wake want different values. Defaults: 20s
-    // per-attempt timeout, 3 attempts, 60s gap. The 20s per-attempt (bumped from
-    // 15s in 0.17) absorbs a slow link coming back after the client wakes — a
-    // remote server reached over a mesh/VPN link can take several seconds to
-    // answer on the first request. For a genuinely DOWN link (`fetch failed`) no
-    // timeout length helps — the capture watchdog's frequent retry handles that (#239).
+    // #163/#405: constants (the preflightTimeoutMs/preflightAttempts/
+    // preflightRetryGapMs config keys are removed — no incident in the #403
+    // inventory ever required tuning them). 20s per attempt absorbs a slow link
+    // re-establishing after the client wakes (bumped from 15s in 0.17); for a
+    // genuinely DOWN link no timeout length helps — the capture watchdog's
+    // frequent retry handles that (#239).
     //
     // WALL-CLOCK NOTE: setTimeout and AbortSignal.timeout do NOT advance while
     // macOS is asleep, so the ~3m worst case (3×20s + 2×60s) is wall-clock-
@@ -1103,9 +1105,9 @@ async function runClientNightly(config, dryRun, stateDir = HICORTEX_HOME, recapt
     // elapsed time can exceed it. Not a defect: the capture lock isn't held
     // during the retry and the cursor design is dup-over-loss, so a late success
     // is harmless. Just don't treat 3m as a hard wall-clock bound.
-    const PREFLIGHT_TIMEOUT_MS = (0, config_read_js_1.readPositiveConfig)(config, "preflightTimeoutMs", 20_000);
-    const PREFLIGHT_ATTEMPTS = Math.max(1, Math.floor((0, config_read_js_1.readPositiveConfig)(config, "preflightAttempts", 3)));
-    const PREFLIGHT_RETRY_GAP_MS = (0, config_read_js_1.readPositiveConfig)(config, "preflightRetryGapMs", 60_000);
+    const PREFLIGHT_TIMEOUT_MS = 20_000;
+    const PREFLIGHT_ATTEMPTS = 3;
+    const PREFLIGHT_RETRY_GAP_MS = 60_000;
     let reachable = false;
     for (let attempt = 1; attempt <= PREFLIGHT_ATTEMPTS; attempt++) {
         try {

package/dist/nofit.d.ts

@@ -54,21 +54,14 @@ import type { DomainDef } from "./types.js";
  * Default weak-primary floor: minimum cosine(memory embedding, best domain
  * prototype) for a no-fit memory to earn a weak primary.
  *
- * TUNING: 0.45 is a starting point for bge-small-en-v1.5 embeddings — it
- * should be tuned from the actual corpus weight distribution (e.g. inspect
- * the memory_tags.weight histogram of LLM-tagged rows and set the floor
- * near its lower tail). Override per install via `weakPrimaryFloor` in
- * ~/.hicortex/config.json.
+ * #408: RELEASE-MANAGED — the constant (and its provenance: a starting point
+ * for bge-small-en-v1.5 embeddings) lives in calibration.ts. There is no
+ * config override anymore; the DomainStageOptions.weakPrimaryFloor field
+ * stays as the eval/test seam.
  */
 export declare const DEFAULT_WEAK_PRIMARY_FLOOR = 0.45;
 /** Halving never takes base_strength below this (survivable, not zeroed). */
 export declare const NO_ASSOCIATION_MIN_STRENGTH = 0.05;
-/**
- * Resolve the weak-primary floor from a raw config object. Accepts a finite
- * number in (0, 1); anything else (absent, wrong type, out of range) falls
- * back to DEFAULT_WEAK_PRIMARY_FLOOR with a warning for invalid values.
- */
-export declare function resolveWeakPrimaryFloor(config: Record<string, unknown> | null | undefined): number;
 /** Outcome of resolving a no-fit memory against the domain prototypes. */
 export type NoFitResolution = {
     kind: "weak_primary";

package/dist/nofit.js

@@ -84,41 +84,24 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.NO_ASSOCIATION_MIN_STRENGTH = exports.DEFAULT_WEAK_PRIMARY_FLOOR = void 0;
-exports.resolveWeakPrimaryFloor = resolveWeakPrimaryFloor;
 exports.resolveNoFit = resolveNoFit;
 exports.applyWeakPrimary = applyWeakPrimary;
 exports.applyNoAssociationDecay = applyNoAssociationDecay;
 const storage = __importStar(require("./storage.js"));
 const schema_prototypes_js_1 = require("./schema-prototypes.js");
+const CALIBRATION = __importStar(require("./calibration.js"));
 /**
  * Default weak-primary floor: minimum cosine(memory embedding, best domain
  * prototype) for a no-fit memory to earn a weak primary.
  *
- * TUNING: 0.45 is a starting point for bge-small-en-v1.5 embeddings — it
- * should be tuned from the actual corpus weight distribution (e.g. inspect
- * the memory_tags.weight histogram of LLM-tagged rows and set the floor
- * near its lower tail). Override per install via `weakPrimaryFloor` in
- * ~/.hicortex/config.json.
+ * #408: RELEASE-MANAGED — the constant (and its provenance: a starting point
+ * for bge-small-en-v1.5 embeddings) lives in calibration.ts. There is no
+ * config override anymore; the DomainStageOptions.weakPrimaryFloor field
+ * stays as the eval/test seam.
  */
-exports.DEFAULT_WEAK_PRIMARY_FLOOR = 0.45;
+exports.DEFAULT_WEAK_PRIMARY_FLOOR = CALIBRATION.WEAK_PRIMARY_FLOOR;
 /** Halving never takes base_strength below this (survivable, not zeroed). */
 exports.NO_ASSOCIATION_MIN_STRENGTH = 0.05;
-/**
- * Resolve the weak-primary floor from a raw config object. Accepts a finite
- * number in (0, 1); anything else (absent, wrong type, out of range) falls
- * back to DEFAULT_WEAK_PRIMARY_FLOOR with a warning for invalid values.
- */
-function resolveWeakPrimaryFloor(config) {
-    const raw = config?.weakPrimaryFloor;
-    if (raw === undefined || raw === null)
-        return exports.DEFAULT_WEAK_PRIMARY_FLOOR;
-    if (typeof raw === "number" && Number.isFinite(raw) && raw > 0 && raw < 1) {
-        return raw;
-    }
-    console.warn(`[hicortex] invalid weakPrimaryFloor in config (${JSON.stringify(raw)}) — ` +
-        `must be a number in (0, 1); using default ${exports.DEFAULT_WEAK_PRIMARY_FLOOR}`);
-    return exports.DEFAULT_WEAK_PRIMARY_FLOOR;
-}
 /**
  * Decide what happens to a no-fit memory (READ-ONLY — no writes, so callers
  * batching writes into a transaction can decide during the scan phase):