@gamaze/hicortex 0.20.9 → 0.20.10

package/dist/reconsolidation.js

@@ -43,13 +43,32 @@
  * NOTHING else: no status change, no rewrite, no merge queue; both records
  * stay live so the consumer sees both truths. Both merge paths (the zone's
  * planDedup and the judged mergeMemoryIds) refuse to blend a conflicts-linked
- * pair, counted as conflict_skipped. The zone therefore runs AFTER the
- * rewrite phase — with the zone first, a >=0.92 conflict pair was blended
+ * pair, counted as conflict_skipped. The zone therefore runs AFTER the scan —
+ * with the zone first, a >=0.92 conflict pair was blended
  * before the judge ever saw it (the planted-eval harm: canonical=older, the
  * newer truth erased); running it last means verdicts/marks/binds land first
  * and the zone merges only what no verdict claimed — a conflicts bind set by
  * this run's scan guards the SAME run's zone.
  *
+ * #439 apply-on-confirm — confirmed merges and rewrite groups apply at the
+ * candidate BOUNDARY (the end of the scan iteration that confirmed them), not
+ * in post-scan phases. The old end-of-run batch was a completion assumption
+ * written when nightlies finished in an hour; under #405 budget pressure it
+ * became a days-long queue where confirmed work never landed and every night
+ * re-paid the judgment cost (cursor held below un-applied groups, pairs
+ * re-detected, re-judged). Now each judged-merge pair applies via
+ * mergeMemoryIds in its OWN transaction at confirmation time, each rewrite
+ * group via its own rewrite call + applyRewriteGroup transaction; the cursor
+ * advances per APPLIED candidate, so a deferral holds it below exactly ONE
+ * candidate's pairs. One pre-merge backup per run (lazy, before the first
+ * application); the capture lock is taken per boundary batch with a same-run
+ * retry list + a final drain. A shared trigger IS the current candidate, so
+ * the multi-target keep rule resolves across the boundary's groups (any keep
+ * keeps). A target corrected by two different candidates takes two sequential
+ * rewrites — the second composes the already-corrected story — instead of one
+ * grouped call (the ONE-call grouping was a cost optimization, not a
+ * correctness invariant; accepted semantics change).
+ *
  * Status vocabulary (code-defined, extensible — deliberately NOT config):
  *   NULL/'active' default | 'superseded' + 'retracted' demote in ranking |
  *   'corrected' = rewritten, never demotes (demoting it would bury the
@@ -601,16 +620,18 @@ async function classifyPair(llm, oldContent, newContent) {
     }
 }
 /**
- * Nightly reconsolidation stage (#384, #392 — THE unified resolution stage).
+ * Nightly reconsolidation stage (#384, #392 — THE unified resolution stage;
+ * #439 apply-on-confirm).
  *
  * Phase order (#393 guard-C): the deterministic merge zone (pairs >= the
- * ceiling) runs LAST — after the scan, the judged-merge phase, and the
- * rewrite phase. Judgment outranks the deterministic sweep: verdicts, marks,
- * and binds land first and the zone merges only what no verdict claimed. With
- * the zone first, a >=0.92 genuine-conflict pair was blended before the judge
- * ever saw it (the planted-eval harm); running it last means a `conflicts`
- * bind set by this run's scan guards the SAME run's zone. Zone internals
- * (lock, backup, deadline, persistBand, fail-soft) are unchanged.
+ * ceiling) runs LAST — after the scan (which now includes every judged-merge
+ * application and rewrite, #439). Judgment outranks the deterministic sweep:
+ * verdicts, marks, and binds land first and the zone merges only what no
+ * verdict claimed. With the zone first, a >=0.92 genuine-conflict pair was
+ * blended before the judge ever saw it (the planted-eval harm); running it
+ * last means a `conflicts` bind set by this run's scan guards the SAME run's
+ * zone. Zone internals (lock, backup, deadline, persistBand, fail-soft) are
+ * unchanged.
  *
  * Scan: every memory with rowid > reconsolidationCursor (no shape filter;
  * absorbed candidates are skipped — invisible memories are not re-judged).
@@ -621,25 +642,33 @@ async function classifyPair(llm, oldContent, newContent) {
  * judged) plus the scout's FTS hits for correction-shaped memories (same
  * verdict loop, NO similarity gate; guard-C: a scout hit whose KNN twin sits
  * at/above the ceiling is re-tagged scout so the pair IS judged instead of
- * being left for the zone to blend). Confirmed
- * `corrects` pairs above the confidence gate on fact-shaped targets group by
- * target into ONE rewrite call each (AC3); confirmed `merge` pairs queue for
- * the merge phase; a `conflicts` verdict writes the conflicts link and
- * nothing else (both live); everything else is mark-only.
+ * being left for the zone to blend). Confirmed `corrects` pairs above the
+ * confidence gate on fact-shaped targets group by target; a `conflicts`
+ * verdict writes the conflicts link and nothing else (both live); everything
+ * else is mark-only.
  *
- * Merge phase (#392): queued pairs merge through the dedup core under one
- * lock/backup window. A pair that cannot apply keeps both memories and holds
- * the cursor; a conflicts-linked or metadata-mismatched refusal keeps both
- * and advances (the verdict was rendered).
+ * #439 BOUNDARY apply: at the END of each candidate iteration everything it
+ * confirmed applies IMMEDIATELY — merges first (each judged-merge pair via
+ * mergeMemoryIds in its own transaction, under the boundary's short lock
+ * window; ONE lazy pre-merge backup per run), then the iteration's rewrite
+ * groups (one rewrite LLM call + one applyRewriteGroup transaction each;
+ * dispositions resolved ACROSS the boundary's groups — the multi-target keep
+ * rule: a trigger absorbed only if every group's contract says absorb). A
+ * busy capture lock pushes the boundary's merges onto a same-run retry list
+ * (retried at the next boundary and once in a final drain after the scan);
+ * a deadline, a backup failure, or a rewrite-call refusal/infra error defers
+ * the remaining work and holds the cursor.
  *
- * Cursor discipline mirrors stageSupersession: the cursor advances past a
- * candidate once its neighbor set has been considered, regardless of infra
- * skips — EXCEPT when rewrite groups or confirmed merges could not be applied
- * (budget exhausted / rewrite-call infra error / merge cap or lock): the
- * cursor then holds BELOW the earliest candidate contributing to the
- * un-applied work, so those pairs are re-detected next run (dup-over-loss —
- * an un-marked, un-rewritten, un-merged confirmed resolution must never be
- * silently dropped by the cursor passing it).
+ * Cursor discipline: the cursor advances past a candidate only when its
+ * iteration's confirmed work has LANDED (or was refused-with-verdict-rendered:
+ * metadata mismatch, conflict-linked, mark-only fallback). A deferral holds
+ * the cursor BELOW the current candidate — bounded to ONE candidate's pairs,
+ * re-detected and re-judged next run (dup-over-loss — a confirmed resolution
+ * must never be silently dropped by the cursor passing it). The separate
+ * scan high-water (state.reconsolidationScannedRowid) records the max
+ * candidate rowid ENTERED and is never held back, so the report can split
+ * verdict calls into pairs_reevaluated (at/below the prior high-water) vs
+ * pairs_new — the convergence measurement.
  *
  * Dry-run: the zone's discovery + the free idempotency check only — zero LLM
  * calls, zero writes, no cursor or band-stats persistence. Gate discovery is
@@ -678,6 +707,14 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
         runBands.set(band.label, stat);
     };
     const startCursor = (0, state_js_1.loadState)(stateDir).reconsolidationCursor ?? 0;
+    // #439 convergence measurement: the scan high-water is the max candidate
+    // rowid any run has ENTERED — never held back by un-applied work. This
+    // run's re-judged/new split keys on the PREVIOUS run's persisted value: a
+    // verdict on a candidate at/below it re-judges pairs a prior run already
+    // judged but could not apply (the cursor held below them, so they
+    // re-detect). Once the backlog drains, pairs_reevaluated reads 0.
+    const prevScannedRowid = (0, state_js_1.loadState)(stateDir).reconsolidationScannedRowid ?? startCursor;
+    let scannedRowidHighwater = startCursor;
     // NO shape filter (AC2) — unlike stageSupersession. Absorbed rows are
     // excluded: they are invisible to recall and must not re-enter judgment.
     const rows = db
@@ -714,12 +751,29 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
     let scoutScanned = 0;
     let scoutCorrectionShaped = 0;
     let scoutCandidatesFound = 0;
+    // #439 observability: the re-judged/new verdict split (keyed on the prior
+    // run's scan high-water) + the scan-stability guard's skip count + the
+    // confirmed-merge deferral count (still un-applied at run end).
+    let pairsReevaluated = 0;
+    let pairsNew = 0;
+    let skippedAbsorbed = 0;
+    let mergePairsDeferred = 0;
     let cursor = startCursor;
-    const queuedMerges = [];
-    // #392 cursor-hold anchor, shared by the merge phase and the rewrite phase:
-    // un-applied work holds the cursor BELOW the earliest contributing
-    // candidate so the pairs are re-detected next run (dup-over-loss).
-    let pendingMinRowid = null;
+    // Lock-busy survivors: boundary merges that could not take the capture
+    // lock, plus (fix round, #440 review finding 1) deadline/backup-dropped
+    // tails re-queued at their boundary instead of discarded. Same-run only —
+    // retried (in full) at the next boundary and once in the final drain after
+    // the scan. While the list is non-empty, every persisted checkpoint clamps
+    // below the earliest contributing candidate (pendingRetryFloor — the kill
+    // window cannot strand them); still un-applied at run end, the drain holds
+    // the cursor below that same floor (dup-over-loss).
+    const retryMerges = [];
+    // ONE pre-merge backup per run (#439): takePreDedupBackup is a full SQLite
+    // copy, so a per-boundary backup would be hundreds of full-DB copies on a
+    // backlog night. Taken LAZILY, immediately before the first judged-merge
+    // application; remembered for the rest of the run (the zone takes its own,
+    // independent backup, as before).
+    let mergeWindowBackedUp = false;
     // Links created by THIS stage in THIS run — lets the explicit-mark pass
     // distinguish operator marks (pre-existing) from stage output.
     const linksCreatedThisRun = new Set();
@@ -727,40 +781,50 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
         storage.addLink(db, oldId, newId, relationship, strength);
         linksCreatedThisRun.add(`${oldId}|${newId}`);
     };
-    // ---- #401: mid-scan cursor persistence. Called at EVERY scan-loop exit
-    // path (deadline, budget cap, mark-verify budget stop, discovery
-    // failure) AND after every fully-considered candidate, so a killed run
-    // loses at most the candidate in flight. The end-of-stage updateState
-    // below stays the authoritative final write (it also applies the
-    // pendingMinRowid hold — that variable is only ever set AFTER the scan
-    // loop, so it is null at every call site here). updateState is
-    // load→mutate→temp-rename atomic.
+    // ---- #401/#439 mid-scan cursor persistence. Called at EVERY scan-loop
+    // exit path AND at the end of every candidate iteration — AFTER that
+    // iteration's boundary apply, so the persisted cursor only ever advances
+    // past candidates whose confirmed work has landed; a killed run loses at
+    // most the candidate in flight. The ONE exception is lock-busy retry
+    // survivors: they intentionally ride the retry list while the scan
+    // continues (the lock may clear this run), so while any are pending every
+    // persisted checkpoint CLAMPS below their earliest contributor — a SIGKILL
+    // in the window between a busy boundary and the pair landing must never
+    // strand a confirmed merge behind the cursor (the #402 orphan-floor
+    // discipline, re-scoped to the retry list; the clamp lifts automatically
+    // once a later boundary or the final drain applies them). Also persists
+    // the scan high-water (never held back). updateState is load→mutate→
+    // temp-rename atomic.
     let deadlineStopped = false;
-    // #402 follow-up (reviewer note 1): the hard-kill orphan floor. Queued
-    // merges and open rewrite groups are applied only in the POST-scan
-    // phases — until then their verdicts exist only in memory, and a
-    // SIGKILL/OOM between two persists would strand them BEHIND the persisted
-    // cursor (the next run would skip them forever). This tracks the smallest
-    // candidate rowid contributing to queued-but-unapplied work;
-    // persistCursor clamps every checkpoint below it so a resumed run
-    // re-detects the pairs (dup-over-loss). Deliberately SEPARATE from the
-    // post-loop pendingMinRowid hold above — different lifetime, different
-    // writers.
-    let scanPendingMinRowid = null;
-    const notePendingRowid = (rowid) => {
-        scanPendingMinRowid =
-            scanPendingMinRowid === null ? rowid : Math.min(scanPendingMinRowid, rowid);
+    // #439: once an iteration's confirmed work deferred (deadline at the
+    // boundary, backup failure, rewrite refusal/infra error), the cursor never
+    // advances again this run — a later iteration must not push it past the
+    // held candidate's rowid.
+    let cursorHold = false;
+    // Fix round (#440 review, finding 1): the floor below the earliest
+    // candidate contributing to a still-un-applied retry merge. Applied at
+    // every persist so the kill-with-pending-retry window cannot strand them.
+    const pendingRetryFloor = () => retryMerges.length > 0
+        ? Math.min(...retryMerges.map((p) => p.candidateRowid)) - 1
+        : null;
+    const clampedCursor = () => {
+        const floor = pendingRetryFloor();
+        return floor !== null ? Math.min(cursor, floor) : cursor;
     };
     const persistCursor = () => {
         if (dryRun)
             return;
-        const checkpoint = scanPendingMinRowid !== null ? Math.min(cursor, scanPendingMinRowid - 1) : cursor;
         (0, state_js_1.updateState)((s) => {
-            s.reconsolidationCursor = checkpoint;
+            s.reconsolidationCursor = clampedCursor();
+            s.reconsolidationScannedRowid = Math.max(scannedRowidHighwater, s.reconsolidationScannedRowid ?? 0);
         }, stateDir);
     };
-    const groups = new Map();
-    const addTrigger = (target, trigger, confidence, cosine, explicit) => {
+    // #439: rewrite groups live ONLY inside the candidate iteration that
+    // formed them (its boundary applies or degrades them, then they are
+    // discarded). Every trigger is the current candidate — a target corrected
+    // by two different candidates takes two sequential rewrites instead of
+    // the old one grouped call.
+    const addTrigger = (groups, target, trigger, confidence, cosine, explicit) => {
         let group = groups.get(target.id);
         if (!group) {
             group = { targetId: target.id, target, triggers: [] };
@@ -775,10 +839,9 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
                 candidateRowid: trigger.__rowid,
                 explicit,
             });
-            notePendingRowid(trigger.__rowid); // orphan floor — group unapplied until the rewrite phase
         }
     };
-    for (const candidate of rows) {
+    for (const snapshotted of rows) {
         // #401: runtime bounds first — exit cleanly at the last fully-considered
         // candidate boundary (cursor = the previous candidate's rowid here).
         if (!dryRun && deadlineHit()) {
@@ -790,7 +853,50 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
             persistCursor();
             break;
         }
+        // ---- #439 scan-stability guard: `rows` is ONE snapshot fetched at stage
+        // start with status != 'absorbed'; boundary applies (merge losers,
+        // rewrite triggers absorbed) can mark FUTURE rows of that snapshot
+        // absorbed after the filter ran. Without this re-read such a candidate
+        // would be scouted/judged on stale content and its KNN would silently
+        // re-embed it (its vector row is gone). Absorbed → skip (counted,
+        // cursor passes it); otherwise the LIVE row's content/status drives the
+        // rest of the iteration (refreshes content rewritten by an earlier
+        // boundary when created_at and rowid order diverge).
+        const live = db
+            .prepare(`SELECT rowid AS __rowid, * FROM memories WHERE rowid = ?`)
+            .get(snapshotted.__rowid);
+        if (!live) {
+            // Vanished entirely (deleted out from under the scan) — defensive;
+            // nothing to judge, the cursor passes it (never past an active hold).
+            scannedRowidHighwater = Math.max(scannedRowidHighwater, snapshotted.__rowid);
+            if (!cursorHold)
+                cursor = snapshotted.__rowid;
+            persistCursor();
+            continue;
+        }
+        if (live.status === "absorbed") {
+            skippedAbsorbed++;
+            scannedRowidHighwater = Math.max(scannedRowidHighwater, live.__rowid);
+            if (!cursorHold)
+                cursor = live.__rowid;
+            persistCursor();
+            continue;
+        }
+        const candidate = live;
         scanned++;
+        // The high-water advances as candidates are ENTERED — even when the
+        // iteration's work later defers (it is the SCAN mark, never held back).
+        scannedRowidHighwater = Math.max(scannedRowidHighwater, candidate.__rowid);
+        // #439 per-iteration confirmed work, applied at the boundary below.
+        const iterMerges = [];
+        const iterGroups = new Map();
+        // This iteration's confirmed work could not land (deadline at the
+        // boundary, backup failure, rewrite refusal/infra error): the cursor
+        // holds below this candidate.
+        let boundaryHold = false;
+        // Stop the scan AFTER the boundary (budget stop / rewrite-infra
+        // deferral / backup failure): further verdicts could not land anyway.
+        let stopScan = false;
         // ---- AC7: verify incoming explicit marks (corrected_by/superseded_by
         // links targeting this candidate) before they can join a rewrite group.
         // #401: only OPERATOR marks are verified — applyExplicitMark writes
@@ -821,12 +927,16 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
                 const { verdict, usage } = await classifyPair(llm, target.content, candidate.content);
                 budget.recordUsage(exports.RECONSOLIDATION_STAGE_LABEL, usage);
                 pairsEvaluated++;
+                if (candidate.__rowid <= prevScannedRowid)
+                    pairsReevaluated++;
+                else
+                    pairsNew++;
                 if (!verdict) {
                     skippedInfra++; // mark retained; the neighborhood is revisited via newer candidacies
                     continue;
                 }
                 if (verdict.action === "corrects" && verdict.confidence >= rewriteMinConfidence && isFactShapedTarget(target)) {
-                    addTrigger(target, candidate, verdict.confidence, null, true);
+                    addTrigger(iterGroups, target, candidate, verdict.confidence, null, true);
                     explicitVerified++;
                 }
                 else {
@@ -839,8 +949,12 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
                 }
             }
             if (markBudgetStop) {
-                persistCursor(); // #401: this candidate's remaining marks re-verify next run
-                break;
+                // #401: this candidate's remaining marks re-verify next run — the
+                // cursor HOLDS below it (boundaryHold), and #439 still runs the
+                // boundary: marks confirmed before the stop apply, exactly as they
+                // did when the rewrite phase was post-scan.
+                stopScan = true;
+                boundaryHold = true;
             }
         }
         // ---- #393 B: scout shape call — ONE classify-tier call per candidate,
@@ -852,27 +966,31 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
         // discipline. Dry-run skips the call entirely: it is LLM work, and
         // dry-runs make zero LLM calls (the scout counters read 0 there).
         let scoutReferences = null;
-        if (!dryRun) {
+        if (!dryRun && !stopScan) {
             if (!budget.use(exports.RECONSOLIDATION_STAGE_LABEL)) {
-                persistCursor(); // shape call refused — this candidate re-scouts next run
-                break;
+                // Shape call refused — this candidate re-scouts next run: the cursor
+                // HOLDS below it (the candidate was entered but not considered).
+                stopScan = true;
+                boundaryHold = true;
             }
-            scoutScanned++;
-            try {
-                const r = await llm.complete(buildScoutShapePrompt(candidate.content));
-                budget.recordUsage(exports.RECONSOLIDATION_STAGE_LABEL, r.usage);
-                const shape = parseScoutShape(r.text);
-                if (!shape) {
-                    skippedInfra++;
+            else {
+                scoutScanned++;
+                try {
+                    const r = await llm.complete(buildScoutShapePrompt(candidate.content));
+                    budget.recordUsage(exports.RECONSOLIDATION_STAGE_LABEL, r.usage);
+                    const shape = parseScoutShape(r.text);
+                    if (!shape) {
+                        skippedInfra++;
+                    }
+                    else if (shape.correction) {
+                        scoutCorrectionShaped++;
+                        scoutReferences = shape.references;
+                    }
                 }
-                else if (shape.correction) {
-                    scoutCorrectionShaped++;
-                    scoutReferences = shape.references;
+                catch {
+                    skippedInfra++;
                 }
             }
-            catch {
-                skippedInfra++;
-            }
         }
         // ---- AC2: detection pairs against older neighbors — TWO sources (#393 B):
         // the KNN similarity source (floor-gated, the pre-B baseline) and, for
@@ -880,22 +998,26 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
         // claim's terms → corpus search; NO similarity gate — cosine is a ranker,
         // never a blocker). Merged + deduped by neighbor id: a pair found by both
         // sources is judged ONCE, as similarity (with band attribution).
-        let neighbors;
-        try {
-            neighbors = await findOlderCorrectionNeighbors(db, candidate, embedFn, minSimilarity);
-        }
-        catch (err) {
-            console.warn(`[hicortex] reconsolidation: discovery failed for ${candidate.id.slice(0, 8)} — ${err instanceof Error ? err.message : String(err)}`);
-            cursor = candidate.__rowid;
-            persistCursor(); // #401: every exit path persists
-            continue;
+        let discoveryFailed = false;
+        let neighbors = [];
+        if (!stopScan) {
+            try {
+                neighbors = await findOlderCorrectionNeighbors(db, candidate, embedFn, minSimilarity);
+            }
+            catch (err) {
+                console.warn(`[hicortex] reconsolidation: discovery failed for ${candidate.id.slice(0, 8)} — ${err instanceof Error ? err.message : String(err)}`);
+                // #439: skip this candidate's neighbor judgments but still run the
+                // boundary below — marks confirmed earlier this iteration apply
+                // (they did when the phases were post-scan).
+                discoveryFailed = true;
+            }
         }
         const neighborEntries = neighbors.map((n) => ({
             mem: n,
             cosine: (0, retrieval_js_1.l2ToCosine)(n.distance),
             source: "similarity",
         }));
-        if (scoutReferences !== null) {
+        if (!discoveryFailed && scoutReferences !== null) {
             const candidateVec = storage.getStoredEmbedding(db, candidate.id);
             const knnById = new Map(neighborEntries.map((e) => [e.mem.id, e]));
             for (const entry of findScoutNeighbors(db, candidate, scoutReferences, candidateVec)) {
@@ -943,12 +1065,16 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
                 continue; // preview only — no LLM call, no write
             // #405: the ONE run budget's refusal is the only call cap.
             if (!budget.use(exports.RECONSOLIDATION_STAGE_LABEL)) {
-                persistCursor(); // cursor still points at the last fully-considered candidate
+                stopScan = true; // the boundary below still applies what this candidate already confirmed
                 break;
             }
             const { verdict, usage } = await classifyPair(llm, entry.mem.content, candidate.content);
             budget.recordUsage(exports.RECONSOLIDATION_STAGE_LABEL, usage);
             pairsEvaluated++;
+            if (candidate.__rowid <= prevScannedRowid)
+                pairsReevaluated++;
+            else
+                pairsNew++;
             if (!verdict) {
                 skippedInfra++;
                 continue;
@@ -958,8 +1084,8 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
             // pairs reach them through a different, cosine-blind door.
             if (entry.source === "similarity")
                 recordBand(pairCosine, verdict.action, verdict.confidence);
-            // #392: a merge verdict is queued for the merge phase (below) — no
-            // link, no write here. Below the confidence gate BOTH memories stay
+            // #392/#439: a merge verdict queues for THIS iteration's boundary —
+            // no link, no write here. Below the confidence gate BOTH memories stay
             // live: a weak mark is recoverable, and there is nothing to mark for a
             // duplicate — keeping both is the recoverable outcome.
             if (verdict.action === "merge") {
@@ -975,8 +1101,7 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
                     }
                 }
                 else {
-                    queuedMerges.push({ oldId: entry.mem.id, newId: candidate.id, candidateRowid: candidate.__rowid });
-                    notePendingRowid(candidate.__rowid); // orphan floor — merge unapplied until the merge phase
+                    iterMerges.push({ oldId: entry.mem.id, newId: candidate.id, candidateRowid: candidate.__rowid });
                 }
                 continue;
             }
@@ -1017,73 +1142,302 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
                     markedRetracted++;
                     continue;
                 }
-                addTrigger(entry.mem, candidate, verdict.confidence, cosine, false);
+                addTrigger(iterGroups, entry.mem, candidate, verdict.confidence, cosine, false);
             }
             // verdict "none" → nothing to do
         }
-        cursor = candidate.__rowid;
-        // #402 follow-up (reviewer note 1): persist after EVERY fully-considered
-        // candidate — the 50-candidate batch left a kill window that could
-        // strand several candidates of scan progress. updateState is an atomic
-        // temp-rename of a small file and the loop cadence is seconds per
-        // candidate; the cost is negligible.
+        // ---- #439 BOUNDARY: apply everything this candidate confirmed, NOW —
+        // merges first, then rewrite groups (the order the old post-scan phases
+        // used; preserves the existing tolerance where a merge loser that is
+        // also a rewrite trigger stays absorbed while the rewrite still composes
+        // its content). Each application is its own transaction
+        // (mergeMemoryIds / applyRewriteGroup — group-internal atomicity
+        // preserved); a busy capture lock defers merges to the same-run retry
+        // list, everything else defers by holding the cursor below this
+        // candidate (bounded to ONE candidate's pairs).
+        if (!dryRun) {
+            // Earlier lock-busy survivors retry FIRST (oldest verdicts land
+            // first), ahead of this candidate's fresh confirmations.
+            const mergeBatch = [...retryMerges.splice(0, retryMerges.length), ...iterMerges];
+            if (mergeBatch.length > 0) {
+                if (deadlineHit()) {
+                    deadlineStopped = true;
+                    // Fix round (#440 review, finding 1): never DROP the batch — it can
+                    // begin with lock-busy survivors contributed by EARLIER candidates
+                    // that the cursor has already passed. Re-queue for the final drain;
+                    // its hold-below-earliest-contributor (and the persist clamp) keeps
+                    // every un-applied pair re-detectable next run.
+                    retryMerges.push(...mergeBatch);
+                    boundaryHold = true;
+                    console.log(`[hicortex] Reconsolidation: ${mergeBatch.length} confirmed merge(s) re-queued for the final drain — run deadline reached`);
+                }
+                else {
+                    const acquire = options.acquireLock ?? capture_js_1.acquireCaptureLock;
+                    const release = await acquire(stateDir ?? (0, paths_js_1.hicortexHome)(), 0);
+                    if (!release) {
+                        // Busy capture run — the batch rides the same-run retry list:
+                        // retried at the next boundary and once in the final drain. Not
+                        // a cursor hold yet (the lock may clear this run).
+                        retryMerges.push(...mergeBatch);
+                        console.warn(`[hicortex] Reconsolidation: capture lock busy — ${mergeBatch.length} confirmed merge(s) deferred to a retry this run`);
+                    }
+                    else {
+                        try {
+                            let backupOk = true;
+                            if (!mergeWindowBackedUp) {
+                                try {
+                                    await (0, dedup_js_1.takePreDedupBackup)(db, stateDir ?? (0, paths_js_1.hicortexHome)());
+                                    mergeWindowBackedUp = true;
+                                }
+                                catch (err) {
+                                    backupOk = false;
+                                    console.error(`[hicortex] Reconsolidation: pre-merge backup failed ` +
+                                        `(${err instanceof Error ? err.message : String(err)}) — ${mergeBatch.length} merge(s) deferred`);
+                                }
+                            }
+                            if (!backupOk) {
+                                // Verdicts that cannot land must not keep being paid: stop
+                                // the scan. The batch re-queues for the final drain — a
+                                // TRANSIENT backup failure can still recover there; a
+                                // persistent one ends with the drain holding the cursor
+                                // below the earliest contributor (never just this candidate,
+                                // when retry survivors ride the batch).
+                                retryMerges.push(...mergeBatch);
+                                boundaryHold = true;
+                                stopScan = true;
+                            }
+                            else {
+                                for (let i = 0; i < mergeBatch.length; i++) {
+                                    const pair = mergeBatch[i];
+                                    // #405: the deadline stop-check between local merge
+                                    // transactions — a safe boundary; deferred pairs hold the
+                                    // cursor below this candidate and retry next run.
+                                    if (deadlineHit()) {
+                                        deadlineStopped = true;
+                                        // Fix round (#440 review, finding 1): the un-applied tail
+                                        // re-queues (it can contain earlier candidates' retry
+                                        // survivors) — the final drain applies or holds it.
+                                        retryMerges.push(...mergeBatch.slice(i));
+                                        boundaryHold = true;
+                                        console.log(`[hicortex] Reconsolidation: ${mergeBatch.length - i} confirmed merge(s) re-queued for the final drain — run deadline reached`);
+                                        break;
+                                    }
+                                    const result = (0, dedup_js_1.mergeMemoryIds)(db, [pair.oldId, pair.newId]);
+                                    if (result.ok) {
+                                        mergePairsApplied++;
+                                        console.log(`[hicortex] Reconsolidation: merged ${pair.oldId.slice(0, 8)} + ${pair.newId.slice(0, 8)} ` +
+                                            `into canonical ${result.canonicalId.slice(0, 8)} (${result.linksRepointed} link(s) re-pointed)`);
+                                    }
+                                    else if (result.reason === "metadata_mismatch") {
+                                        skippedMetadataMismatch++;
+                                        console.log(`[hicortex] Reconsolidation: merge of ${pair.oldId.slice(0, 8)} + ${pair.newId.slice(0, 8)} ` +
+                                            `skipped (metadata mismatch) — both kept`);
+                                    }
+                                    else if (result.reason === "conflict_linked") {
+                                        // #393 guard-C: the pair is conflicts-linked (operator-planted
+                                        // or a prior verdict) — never blended; the cursor advances,
+                                        // this verdict was rendered.
+                                        conflictSkippedJudged++;
+                                        console.log(`[hicortex] Reconsolidation: merge of ${pair.oldId.slice(0, 8)} + ${pair.newId.slice(0, 8)} ` +
+                                            `skipped (conflict-flagged) — both kept`);
+                                    }
+                                    // "no_members": a member vanished/was absorbed since the
+                                    // verdict — nothing to merge, nothing to hold; the cursor
+                                    // advances past it.
+                                }
+                            }
+                        }
+                        finally {
+                            release();
+                        }
+                    }
+                }
+            }
+            if (iterGroups.size > 0) {
+                // One rewrite call per group — the group's triggers are all THIS
+                // candidate (#439: a target corrected by two different candidates
+                // takes two sequential rewrites, one per boundary; the second call
+                // composes the already-corrected story). A call that was never made
+                // (budget/infra/deadline) defers the group — untouched, never
+                // partially applied — and holds the cursor below this candidate.
+                const contracts = new Map(); // null = contract failed
+                let rewritesDeferred = false;
+                for (const group of iterGroups.values()) {
+                    if (deadlineHit()) {
+                        deadlineStopped = true;
+                        rewritesDeferred = true;
+                        break;
+                    }
+                    if (!budget.use(exports.RECONSOLIDATION_STAGE_LABEL)) {
+                        rewritesDeferred = true;
+                        stopScan = true;
+                        break;
+                    }
+                    const triggersArg = group.triggers.map((t) => ({ id: t.id, content: t.memory.content }));
+                    let contract = null;
+                    let infraError = false;
+                    try {
+                        const r = await llm.complete(buildRewritePrompt(group.target.content, triggersArg));
+                        contract = parseRewriteReply(r.text, group.triggers.map((t) => t.id), group.target.content);
+                        budget.recordUsage(exports.RECONSOLIDATION_STAGE_LABEL, r.usage);
+                    }
+                    catch {
+                        infraError = true;
+                    }
+                    if (infraError) {
+                        skippedInfra++;
+                        rewritesDeferred = true; // group NOT marked, NOT rewritten — retried next run
+                        stopScan = true; // verdicts past this hold could not advance the cursor anyway
+                        break;
+                    }
+                    contracts.set(group.targetId, contract);
+                    if (!contract)
+                        contractFailed++;
+                }
+                if (rewritesDeferred) {
+                    boundaryHold = true;
+                }
+                else {
+                    // Multi-target keep rule WITHIN the boundary: the shared trigger is
+                    // the current candidate, so every group it touches resolves here —
+                    // absorbed only if EVERY contract says absorb (any keep keeps).
+                    const finalOutcome = new Map();
+                    for (const contract of contracts.values()) {
+                        if (!contract)
+                            continue;
+                        for (const t of contract.triggers) {
+                            if (t.disposition === "keep" || finalOutcome.get(t.id) === "keep")
+                                finalOutcome.set(t.id, "keep");
+                            else
+                                finalOutcome.set(t.id, "absorb");
+                        }
+                    }
+                    // Counted from APPLIED groups only (a deferred group's dispositions
+                    // never took effect); a trigger in several applied groups counts once.
+                    const appliedOutcome = new Map();
+                    for (const group of iterGroups.values()) {
+                        const contract = contracts.get(group.targetId);
+                        if (contract === undefined)
+                            continue; // pending group — untouched this run
+                        if (contract === null) {
+                            // Failed rewrite contract → whole group mark-only, never a partial
+                            // apply. Content untouched, NO trigger absorbed.
+                            try {
+                                applyMarkOnlyGroup(db, group);
+                            }
+                            catch (err) {
+                                console.warn(`[hicortex] reconsolidation: mark-only fallback failed for ${group.targetId.slice(0, 8)} — ${err instanceof Error ? err.message : String(err)}`);
+                                skippedInfra++;
+                                boundaryHold = true; // retried next run
+                                continue;
+                            }
+                            markedRetracted++;
+                            console.log(`[hicortex] Reconsolidation: rewrite contract failed for ${group.targetId.slice(0, 8)} — group degraded to mark-only`);
+                            continue;
+                        }
+                        let applied = false;
+                        try {
+                            applied = await applyRewriteGroup(db, group, contract, finalOutcome, embedFn);
+                        }
+                        catch (err) {
+                            console.warn(`[hicortex] reconsolidation: rewrite apply failed for ${group.targetId.slice(0, 8)} — ${err instanceof Error ? err.message : String(err)}`);
+                        }
+                        if (!applied) {
+                            skippedInfra++; // defensive absorbed-target guard, or an apply error — retry next run
+                            boundaryHold = true;
+                            continue;
+                        }
+                        rewritten++;
+                        for (const t of contract.triggers) {
+                            const outcome = finalOutcome.get(t.id) ?? "keep";
+                            if (outcome === "keep" || appliedOutcome.get(t.id) === "keep")
+                                appliedOutcome.set(t.id, "keep");
+                            else
+                                appliedOutcome.set(t.id, "absorb");
+                        }
+                    }
+                    for (const outcome of appliedOutcome.values()) {
+                        if (outcome === "absorb")
+                            absorbed++;
+                        else
+                            keptLinked++;
+                    }
+                }
+            }
+        }
+        // #439 cursor advance: past this candidate ONLY when its confirmed work
+        // landed (or was refused-with-verdict-rendered). Once anything deferred,
+        // the latch holds the cursor below that candidate for the rest of the
+        // run — a later iteration must never advance past an earlier hold.
+        if (boundaryHold)
+            cursorHold = true;
+        if (!cursorHold)
+            cursor = candidate.__rowid;
+        // #402/#439: persist after EVERY candidate — AFTER the boundary apply,
+        // so the checkpoint only ever crosses candidates whose work landed. A
+        // SIGKILL between persists re-detects at most the in-flight candidate.
         persistCursor();
+        if (stopScan || deadlineStopped)
+            break;
     }
     if (deadlineStopped) {
         console.log(`[hicortex] Reconsolidation: run deadline reached (nightlyTimeBudgetMinutes) — ` +
             `scan stopped at cursor ${cursor}; the next run resumes from there`);
     }
-    // ---- #392 judged-merge phase: apply the queued pair merges through the
-    // dedup core (mergeMemoryIds — same canonical pick, link re-points,
-    // dedup_log, absorb). One short lock/backup window for the whole batch, one
-    // transaction per pair. #405: the dedupNightlyMaxMerges cap is gone — the
-    // run deadline bounds the merge loop (a stop-check between local
-    // transactions; the deferred pairs hold the cursor below their candidates).
-    // A pair that cannot apply (deadline, busy lock, failed backup) keeps BOTH
-    // memories live and holds the cursor below its candidate — a confirmed
-    // merge is never silently dropped by the cursor passing it (dup-over-loss).
-    // A metadata-rail refusal is different: the verdict WAS rendered, both
-    // memories stay live, the cursor advances.
-    let mergePairsDeferred = 0;
-    if (!dryRun && queuedMerges.length > 0) {
-        const holdQueued = (from) => {
-            for (let i = from; i < queuedMerges.length; i++) {
-                pendingMinRowid =
-                    pendingMinRowid === null
-                        ? queuedMerges[i].candidateRowid
-                        : Math.min(pendingMinRowid, queuedMerges[i].candidateRowid);
-            }
+    // ---- #439 final drain: lock-busy merge survivors get ONE more attempt
+    // right after the scan (the retry list is same-run only — everything else
+    // applied at its boundary). Still busy (or the deadline/backup refuses) →
+    // the pairs stay un-applied, counted, and the cursor holds below the
+    // earliest contributing candidate (dup-over-loss; logged).
+    if (!dryRun && retryMerges.length > 0) {
+        const batch = retryMerges.splice(0, retryMerges.length);
+        // Hold below the earliest contributor of the UN-APPLIED tail only (fix
+        // round, minor review note: the old whole-batch min over-held past pairs
+        // that had just applied in the same loop).
+        const holdBelow = (fromIndex) => {
+            cursor = Math.min(cursor, Math.min(...batch.slice(fromIndex).map((p) => p.candidateRowid)) - 1);
         };
-        {
+        if (deadlineHit()) {
+            deadlineStopped = true;
+            mergePairsDeferred += batch.length;
+            holdBelow(0);
+            console.log(`[hicortex] Reconsolidation: ${batch.length} confirmed merge(s) deferred — run deadline reached`);
+        }
+        else {
             const acquire = options.acquireLock ?? capture_js_1.acquireCaptureLock;
             const release = await acquire(stateDir ?? (0, paths_js_1.hicortexHome)(), 0);
             if (!release) {
-                mergePairsDeferred = queuedMerges.length;
-                holdQueued(0); // a busy capture run defers the batch — fail-soft
-                console.warn(`[hicortex] Reconsolidation: capture lock busy — ${mergePairsDeferred} confirmed merge(s) deferred to next run`);
+                mergePairsDeferred += batch.length;
+                holdBelow(0);
+                console.warn(`[hicortex] Reconsolidation: capture lock busy at the final drain — ` +
+                    `${batch.length} confirmed merge(s) deferred to next run`);
             }
             else {
                 try {
                     let backupOk = true;
-                    try {
-                        await (0, dedup_js_1.takePreDedupBackup)(db, stateDir ?? (0, paths_js_1.hicortexHome)());
+                    if (!mergeWindowBackedUp) {
+                        try {
+                            await (0, dedup_js_1.takePreDedupBackup)(db, stateDir ?? (0, paths_js_1.hicortexHome)());
+                            mergeWindowBackedUp = true;
+                        }
+                        catch (err) {
+                            backupOk = false;
+                            console.error(`[hicortex] Reconsolidation: pre-merge backup failed ` +
+                                `(${err instanceof Error ? err.message : String(err)}) — ${batch.length} merge(s) deferred`);
+                        }
                     }
-                    catch (err) {
-                        backupOk = false;
-                        console.error(`[hicortex] Reconsolidation: pre-merge backup failed ` +
-                            `(${err instanceof Error ? err.message : String(err)}) — ${queuedMerges.length} merge(s) deferred`);
+                    if (!backupOk) {
+                        mergePairsDeferred += batch.length;
+                        holdBelow(0);
                     }
-                    if (backupOk) {
-                        for (let i = 0; i < queuedMerges.length; i++) {
-                            const pair = queuedMerges[i];
-                            // #405: the deadline stop-check between local merge
-                            // transactions — a safe boundary; deferred pairs hold the
-                            // cursor below their candidates and retry next run.
+                    else {
+                        for (let i = 0; i < batch.length; i++) {
+                            const pair = batch[i];
                             if (deadlineHit()) {
                                 deadlineStopped = true;
-                                mergePairsDeferred = queuedMerges.length - i;
-                                holdQueued(i);
-                                console.log(`[hicortex] Reconsolidation: ${mergePairsDeferred} confirmed merge(s) deferred — run deadline reached`);
+                                mergePairsDeferred += batch.length - i;
+                                holdBelow(i);
+                                console.log(`[hicortex] Reconsolidation: ${batch.length - i} confirmed merge(s) deferred — run deadline reached`);
                                 break;
                             }
                             const result = (0, dedup_js_1.mergeMemoryIds)(db, [pair.oldId, pair.newId]);
@@ -1098,22 +1452,14 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
                                     `skipped (metadata mismatch) — both kept`);
                             }
                             else if (result.reason === "conflict_linked") {
-                                // #393 guard-C: the pair is conflicts-linked (operator-planted
-                                // or a prior verdict) — never blended; the cursor advances,
-                                // this verdict was rendered.
                                 conflictSkippedJudged++;
                                 console.log(`[hicortex] Reconsolidation: merge of ${pair.oldId.slice(0, 8)} + ${pair.newId.slice(0, 8)} ` +
                                     `skipped (conflict-flagged) — both kept`);
                             }
                             // "no_members": a member vanished/was absorbed since the
-                            // verdict — nothing to merge, nothing to hold; the cursor
-                            // advances past it.
+                            // verdict — nothing to merge, nothing to hold.
                         }
                     }
-                    else {
-                        mergePairsDeferred = queuedMerges.length;
-                        holdQueued(0);
-                    }
                 }
                 finally {
                     release();
@@ -1121,141 +1467,19 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
             }
         }
     }
-    // ---- Rewrite phase (AC3/AC4/AC5). Three sub-phases so the multi-target
-    // keep rule can be honored: (R1) collect contracts, (R2) resolve every
-    // trigger's FINAL disposition across all groups, (R3) apply one transaction
-    // per group. A group whose rewrite call was never made (budget/infra) is
-    // left untouched and holds the cursor — never partially applied.
-    const contracts = new Map(); // null = contract failed
-    // pendingMinRowid (min candidate rowid among un-applied work) is declared
-    // above — shared with the merge phase's holdQueued.
-    const deferFrom = (fromTargetId) => {
-        let seen = false;
-        for (const group of groups.values()) {
-            if (!seen && group.targetId !== fromTargetId)
-                continue;
-            seen = true;
-            for (const t of group.triggers) {
-                pendingMinRowid = pendingMinRowid === null ? t.candidateRowid : Math.min(pendingMinRowid, t.candidateRowid);
-            }
-        }
-    };
-    if (!dryRun && groups.size > 0) {
-        for (const group of groups.values()) {
-            // #401: the bounds stop the rewrite phase too — a group whose rewrite
-            // call was never made is left untouched and holds the cursor (never
-            // partially applied), exactly like the budget-exhausted path below.
-            if (deadlineHit()) {
-                deadlineStopped = true;
-                deferFrom(group.targetId);
-                break;
-            }
-            if (!budget.use(exports.RECONSOLIDATION_STAGE_LABEL)) {
-                deferFrom(group.targetId);
-                break;
-            }
-            const triggersArg = group.triggers.map((t) => ({ id: t.id, content: t.memory.content }));
-            let contract = null;
-            let infraError = false;
-            try {
-                const r = await llm.complete(buildRewritePrompt(group.target.content, triggersArg));
-                contract = parseRewriteReply(r.text, group.triggers.map((t) => t.id), group.target.content);
-                budget.recordUsage(exports.RECONSOLIDATION_STAGE_LABEL, r.usage);
-            }
-            catch {
-                infraError = true;
-            }
-            if (infraError) {
-                skippedInfra++;
-                deferFrom(group.targetId); // group NOT marked, NOT rewritten — retried next run
-                break;
-            }
-            contracts.set(group.targetId, contract);
-            if (!contract)
-                contractFailed++;
-        }
-        // R2: final per-trigger disposition — a trigger in multiple groups is
-        // absorbed only if EVERY disposition says absorb (any keep keeps it).
-        const finalOutcome = new Map();
-        for (const contract of contracts.values()) {
-            if (!contract)
-                continue;
-            for (const t of contract.triggers) {
-                if (t.disposition === "keep" || finalOutcome.get(t.id) === "keep")
-                    finalOutcome.set(t.id, "keep");
-                else
-                    finalOutcome.set(t.id, "absorb");
-            }
-        }
-        // R3: apply (one transaction per group). An apply that fails mid-flight
-        // (embed error, DB error) writes NOTHING (the transaction never ran) —
-        // the group is deferred like a pending one so it retries next run.
-        const appliedOutcome = new Map();
-        const deferGroup = (group) => {
-            for (const t of group.triggers) {
-                pendingMinRowid = pendingMinRowid === null ? t.candidateRowid : Math.min(pendingMinRowid, t.candidateRowid);
-            }
-        };
-        for (const group of groups.values()) {
-            const contract = contracts.get(group.targetId);
-            if (contract === undefined)
-                continue; // pending group — untouched this run
-            if (contract === null) {
-                // Failed rewrite contract → whole group mark-only, never a partial
-                // apply. Content untouched, NO trigger absorbed.
-                try {
-                    applyMarkOnlyGroup(db, group);
-                }
-                catch (err) {
-                    console.warn(`[hicortex] reconsolidation: mark-only fallback failed for ${group.targetId.slice(0, 8)} — ${err instanceof Error ? err.message : String(err)}`);
-                    skippedInfra++;
-                    deferGroup(group);
-                    continue;
-                }
-                markedRetracted++;
-                console.log(`[hicortex] Reconsolidation: rewrite contract failed for ${group.targetId.slice(0, 8)} — group degraded to mark-only`);
-                continue;
-            }
-            let applied = false;
-            try {
-                applied = await applyRewriteGroup(db, group, contract, finalOutcome, embedFn);
-            }
-            catch (err) {
-                console.warn(`[hicortex] reconsolidation: rewrite apply failed for ${group.targetId.slice(0, 8)} — ${err instanceof Error ? err.message : String(err)}`);
-            }
-            if (!applied) {
-                skippedInfra++; // defensive absorbed-target guard, or an apply error — retry next run
-                deferGroup(group);
-                continue;
-            }
-            rewritten++;
-            // Counted from APPLIED groups only (a deferred group's dispositions
-            // never took effect); a trigger in several applied groups counts once.
-            for (const t of contract.triggers) {
-                const outcome = finalOutcome.get(t.id) ?? "keep";
-                if (outcome === "keep" || appliedOutcome.get(t.id) === "keep")
-                    appliedOutcome.set(t.id, "keep");
-                else
-                    appliedOutcome.set(t.id, "absorb");
-            }
-        }
-        for (const outcome of appliedOutcome.values()) {
-            if (outcome === "absorb")
-                absorbed++;
-            else
-                keptLinked++;
-        }
-    }
     // ---- #393 guard-C zone reorder: the deterministic merge zone (pairs >=
-    // the ceiling) runs LAST — after the scan, the judged-merge phase, and the
-    // rewrite phase. Judgment outranks the deterministic sweep: verdicts,
-    // marks, and binds land first, and the zone merges only what no verdict
-    // claimed. With the zone first, a >=0.92 genuine-conflict pair was blended
-    // before the judge ever saw it (canonical = oldest, the newer truth erased
-    // — the planted-eval harm); running it last means a `conflicts` bind set by
-    // THIS run's scan guards the SAME run's zone. LLM-free and budget-free — an
-    // LLM-less night still drains duplicates. Its own short lock window,
-    // pre-merge backup, and #405 deadline stop-check; fail-soft, never a throw.
+    // the ceiling) runs LAST — after the scan (which includes every #439
+    // boundary apply: judged merges + rewrites). Judgment outranks the
+    // deterministic sweep: verdicts, marks, and binds land first, and the zone
+    // merges only what no verdict claimed. With the zone first, a >=0.92
+    // genuine-conflict pair was blended before the judge ever saw it
+    // (canonical = oldest, the newer truth erased — the planted-eval harm);
+    // running it last means a `conflicts` bind set by THIS run's scan guards
+    // the SAME run's zone. LLM-free and budget-free — an LLM-less night still
+    // drains duplicates (a deadline-deferred cluster re-detects next run at
+    // zero token cost — content-based discovery, no cursor involvement). Its
+    // own short lock window, pre-merge backup, and #405 deadline stop-check;
+    // fail-soft, never a throw.
     const merges = await (0, dedup_js_1.runDeterministicMergeZone)(db, {
         stateDir: stateDir ?? (0, paths_js_1.hicortexHome)(),
         threshold: autoMergeThreshold,
@@ -1263,12 +1487,6 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
         acquireLock: options.acquireLock,
         deadline,
     });
-    // Cursor hold: un-applied work (rewrite groups, confirmed merges) holds the
-    // cursor BELOW its earliest contributing candidate so the pairs are
-    // re-detected next run.
-    if (pendingMinRowid !== null) {
-        cursor = Math.min(cursor, pendingMinRowid - 1);
-    }
     // Report snapshot: the deterministic band (from the zone's own numbers —
     // losers are merge verdicts at confidence 1.0; the zone persists the
     // cumulative copy itself) plus this run's judged bands.
@@ -1289,10 +1507,15 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
     for (const [label, stat] of runBands)
         bandStats[label] = stat;
     if (!dryRun) {
-        // #401: the authoritative FINAL cursor write — the mid-scan persists
-        // above are checkpoints; this one also applies the pendingMinRowid hold.
+        // #401/#439: the authoritative FINAL write — the mid-scan persists above
+        // are checkpoints; this one applies the final-drain cursor hold (already
+        // folded into `cursor`) and the scan high-water. The retry floor is
+        // applied defensively too: the drain splices retryMerges empty on every
+        // path, but a non-empty list here would mean a confirmed merge stranded
+        // behind the cursor — clamp, never write past un-applied work.
         (0, state_js_1.updateState)((s) => {
-            s.reconsolidationCursor = cursor;
+            s.reconsolidationCursor = clampedCursor();
+            s.reconsolidationScannedRowid = Math.max(scannedRowidHighwater, s.reconsolidationScannedRowid ?? 0);
             // Cumulative judged-band accumulation (#392) — the zone already
             // persisted the deterministic band under its own label.
             if (runBands.size > 0) {
@@ -1306,13 +1529,16 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
             }
         }, stateDir);
     }
-    if (rows.length > 0 || groups.size > 0 || mergePairsApplied > 0 || mergeBelowGate > 0) {
-        console.log(`[hicortex] Reconsolidation: ${scanned} scanned, ${pairsEvaluated} pairs evaluated, ` +
+    if (rows.length > 0 || mergePairsApplied > 0 || mergeBelowGate > 0) {
+        console.log(`[hicortex] Reconsolidation: ${scanned} scanned, ${pairsEvaluated} pairs evaluated ` +
+            `(${pairsReevaluated} re-judged / ${pairsNew} new), ` +
             `${rewritten} rewritten (${absorbed} triggers absorbed, ${keptLinked} kept), ` +
-            `${mergePairsApplied} pair(s) merged, ${markedSuperseded} superseded, ` +
+            `${mergePairsApplied} pair(s) merged (${mergePairsDeferred} deferred), ` +
+            `${markedSuperseded} superseded, ` +
             `${markedRetracted} retracted (${belowGate} below gate, ${mergeBelowGate} merge below gate, ` +
             `${contractFailed} contract failed), ${skippedInfra} infra-skipped, ${skippedIdempotent} ` +
-            `already-linked, ${skippedAboveCeiling} above ceiling, ${explicitVerified} explicit verified, ` +
+            `already-linked, ${skippedAbsorbed} absorbed-skip, ${skippedAboveCeiling} above ceiling, ` +
+            `${explicitVerified} explicit verified, ` +
             `${explicitDivergent} explicit divergent, scout ${scoutScanned} scanned / ` +
             `${scoutCorrectionShaped} correction-shaped / ${scoutCandidatesFound} candidate pair(s), ` +
             `${conflictFlagged} conflict-flagged, ${conflictSkippedJudged + merges.skipped_conflict} conflict-skipped ` +
@@ -1335,6 +1561,10 @@ async function stageReconsolidation(db, llm, budget, embedFn, dryRun, stateDir,
         explicit_verified: explicitVerified,
         explicit_divergent: explicitDivergent,
         cursor,
+        pairs_reevaluated: pairsReevaluated,
+        pairs_new: pairsNew,
+        skipped_absorbed: skippedAbsorbed,
+        merge_pairs_deferred: mergePairsDeferred,
         merges,
         merge_pairs_applied: mergePairsApplied,
         merge_below_gate: mergeBelowGate,