@gamaze/hicortex 0.22.3 → 0.23.1

package/dist/mcp-stdio.js

@@ -43,6 +43,27 @@
  * port: explicit error, never a spawn. A remote target that is down is
  * likewise an explicit error — we never spawn for remote URLs.
  *
+ * Startup retry (#501): a REMOTE target that is unreachable at launch is
+ * TRANSIENT, not fatal — the product case is a client (e.g. Claude Desktop
+ * auto-launched at login) starting before the VPN/DNS that carries the
+ * server URL is up (ENOTFOUND/EAI_AGAIN/ECONNREFUSED/timeouts). The bridge
+ * then keeps the stdio side ALIVE and answers `initialize` IMMEDIATELY
+ * (design B), retrying the upstream connect with backoff (1s→2s→4s… capped
+ * 10s) for a 60s window. Why answer immediately: MCP clients cancel a
+ * pending `initialize` at ~60s (TS SDK DEFAULT_REQUEST_TIMEOUT_MSEC;
+ * Claude Desktop observed cancelling at ~60s in the wild) — a delayed
+ * initialize would lose the session the retry window is meant to save, and
+ * the first tools/list request carries the same ~60s client budget, so the
+ * window deliberately stays at the BOTTOM of the 60–90s range the issue
+ * proposed (evidence + decision: issue #501 design-note comment). The
+ * daemon's initialize-result `instructions` are unknowable while it is down
+ * and are therefore omitted on this path (the pre-#383 shape); tools
+ * handlers await upstream readiness. NEVER retried: 401/403 (auth is not
+ * transient — existing HICORTEX_AUTH_TOKEN hint) and a reachable-but-not-
+ * healthy endpoint (foreign service). Local targets keep the autostart poll
+ * (which already waits 30s). Mid-session SSE reconnect after an established
+ * connection drops is OUT OF SCOPE (#501 follow-up).
+ *
  * STDIO DISCIPLINE: stdout carries ONLY the MCP protocol. Every diagnostic
  * goes to stderr; fatal errors are a one-liner on stderr + non-zero exit
  * (thrown to cli.ts's catch). Cancellation downstream→upstream rides the
@@ -59,6 +80,9 @@ exports.resolveBridgeToken = resolveBridgeToken;
 exports.probeHealthOnce = probeHealthOnce;
 exports.decideAutostart = decideAutostart;
 exports.ensureDaemonReady = ensureDaemonReady;
+exports.classifyStartupFailure = classifyStartupFailure;
+exports.nextRetryDelayMs = nextRetryDelayMs;
+exports.defaultConnectUpstream = defaultConnectUpstream;
 exports.runMcpStdio = runMcpStdio;
 const node_child_process_1 = require("node:child_process");
 const node_fs_1 = require("node:fs");
@@ -83,6 +107,14 @@ const DEFAULT_BRIDGE_PORT = 8787;
 const HEALTH_PROBE_TIMEOUT_MS = 2000;
 const AUTOSTART_POLL_INTERVAL_MS = 250;
 const AUTOSTART_POLL_TOTAL_MS = 30_000;
+// #501 startup-retry window. 60s — the bottom of the issue's 60–90s proposal,
+// deliberately: the client's own request timeout (TS SDK default, and Claude
+// Desktop's observed initialize cancel) is 60s, and under design B the FIRST
+// tools/list inherits that same budget, so a longer window would only answer
+// requests the client has already abandoned.
+const REMOTE_RETRY_WINDOW_MS = 60_000;
+const REMOTE_RETRY_BASE_DELAY_MS = 1_000;
+const REMOTE_RETRY_MAX_DELAY_MS = 10_000;
 /** Loopback check for URL hostnames (Node's URL keeps the brackets on [::1]). */
 function isLoopbackHost(hostname) {
     return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
@@ -160,6 +192,13 @@ async function probeHealthOnce(url, timeoutMs = HEALTH_PROBE_TIMEOUT_MS) {
         return { reachable: false, ok: false };
     }
 }
+/** The clear unreachable message — shared by the fail-fast path and the #501
+ *  retry-window expiry, so both ends of the window say the same thing. */
+function remoteUnreachableMessage(target) {
+    return (`Cannot reach the Hicortex server at ${target.url}. Start it on the server machine ` +
+        `(check with \`hicortex status\`, start with \`npx @gamaze/hicortex server\`) or fix HICORTEX_SERVER_URL. ` +
+        `If it answers 401 once up, set HICORTEX_AUTH_TOKEN to the server's auth token.`);
+}
 /**
  * Pure decision from one health probe: healthy → bridge; refused + loopback
  * → spawn a local daemon; refused + remote → fail with an actionable message
@@ -177,14 +216,8 @@ function decideAutostart(probe, target) {
                 `then either free the port or point HICORTEX_SERVER_URL at the real Hicortex server.`,
         };
     }
-    if (!target.local) {
-        return {
-            action: "fail",
-            reason: `Cannot reach the Hicortex server at ${target.url}. Start it on the server machine ` +
-                `(check with \`hicortex status\`, start with \`npx @gamaze/hicortex server\`) or fix HICORTEX_SERVER_URL. ` +
-                `If it answers 401 once up, set HICORTEX_AUTH_TOKEN to the server's auth token.`,
-        };
-    }
+    if (!target.local)
+        return { action: "fail", reason: remoteUnreachableMessage(target) };
     return { action: "spawn" };
 }
 /**
@@ -234,49 +267,135 @@ async function ensureDaemonReady(target, options = {}) {
         `${Math.round(totalMs / 1000)}s of autostart. Try \`npx @gamaze/hicortex server\` in a terminal ` +
         `to see the daemon's startup error, then re-run this command.`);
 }
+/** Node/undici errno codes a "network not up yet" boot race produces. */
+const TRANSIENT_ERRNO_RE = /\b(?:ENOTFOUND|EAI_AGAIN|ECONNREFUSED|ECONNRESET|ETIMEDOUT|EHOSTUNREACH|ENETUNREACH|UND_ERR_CONNECT_TIMEOUT)\b/;
+/** SseError carries the HTTP status on .code (SDK client/sse.js). */
+function isAuthRejection(err) {
+    const code = err?.code;
+    return code === 401 || code === 403 || code === "401" || code === "403";
+}
 /**
- * Run the stdio MCP bridge. Resolves only after the downstream transport
- * closes (the lifecycle handlers then exit the process); every setup failure
- * throws for cli.ts to report on stderr and exit 1.
+ * A network-level failure that a retry window can plausibly outlive: walk the
+ * error + its cause chain for a transient errno, a fetch/undici timeout name,
+ * or errno text embedded in the message (SseError has no `cause` — the SDK
+ * puts the underlying text straight into `SSE error: getaddrinfo ENOTFOUND …`).
  */
-async function runMcpStdio(options = {}) {
-    const target = resolveBridgeTarget(options.serverUrl);
-    const token = resolveBridgeToken(options.authToken);
-    await ensureDaemonReady(target, options);
-    // Upstream: the daemon's SSE MCP endpoint. requestInit headers ride BOTH
-    // the GET /sse and the POST /messages (SDK 1.28 _commonHeaders/send).
+function isTransientNetworkError(err) {
+    let current = err;
+    for (let depth = 0; depth < 5 && current instanceof Error; depth += 1) {
+        const code = current.code;
+        if (typeof code === "string" && TRANSIENT_ERRNO_RE.test(code))
+            return true;
+        if (current.name === "TimeoutError" || current.name === "AbortError")
+            return true;
+        if (TRANSIENT_ERRNO_RE.test(current.message))
+            return true;
+        current = current.cause;
+    }
+    return false;
+}
+/**
+ * Classify a startup failure of the upstream connect sequence. Only a REMOTE
+ * target's network-level failure is transient (#501); auth rejections and a
+ * reachable-but-unhealthy endpoint are fatal immediately, and local targets
+ * keep their own autostart-poll semantics.
+ */
+function classifyStartupFailure(err, target) {
+    if (isAuthRejection(err))
+        return "auth";
+    const message = err instanceof Error ? err.message : String(err);
+    if (/not a healthy Hicortex/i.test(message))
+        return "foreign";
+    if (target.local)
+        return "fatal";
+    // decideAutostart's remote-unreachable reason is the probe-level shape of
+    // every refused/DNS-failed/timeout probe (probeHealthOnce collapses them).
+    if (message.startsWith("Cannot reach the Hicortex server"))
+        return "transient";
+    return isTransientNetworkError(err) ? "transient" : "fatal";
+}
+/** Backoff step N (0-based): base·2^N, capped — 1s, 2s, 4s, 8s, then the cap. */
+function nextRetryDelayMs(attempt, baseMs, maxMs) {
+    return Math.min(baseMs * 2 ** attempt, maxMs);
+}
+/** One-line reason for the stderr retry log — never the full fail message. */
+function summarizeStartupFailure(err) {
+    const message = err instanceof Error ? err.message : String(err);
+    const errno = TRANSIENT_ERRNO_RE.exec(message)?.[0];
+    if (errno)
+        return errno;
+    if (message.startsWith("Cannot reach the Hicortex server"))
+        return "unreachable";
+    return message.length > 80 ? `${message.slice(0, 77)}…` : message;
+}
+/** The friendly fatal form: auth rejections get the token hint, the rest pass
+ *  through unchanged (their messages are already the actionable ones). */
+function toStartupError(err, target) {
+    if (isAuthRejection(err)) {
+        const status = err.code;
+        return new Error(`The Hicortex server at ${target.url} rejected the connection (${status}). ` +
+            `Set HICORTEX_AUTH_TOKEN to the server's auth token — it is printed by \`hicortex status\` on the server box.`);
+    }
+    return err instanceof Error ? err : new Error(String(err));
+}
+/**
+ * Connect the upstream Client to the daemon's SSE MCP endpoint. requestInit
+ * headers ride BOTH the GET /sse and the POST /messages (SDK 1.28
+ * _commonHeaders/send). Raw errors propagate — classification happens at the
+ * call site. Exported for the ghost-reconnect unit test.
+ *
+ * On failure the transport is closed EXPLICITLY: the SDK's Client.connect
+ * closes only when the initialize REQUEST fails after a successful start —
+ * a failed transport.start() (refused/DNS) propagates out of Protocol.connect
+ * with no cleanup, and the still-open EventSource keeps eventsource's ~3s
+ * reconnect loop alive. Every retry attempt would leak one ghost that, once
+ * the server appears, opens a REAL authed SSE session on the daemon and is
+ * never closed (proven empirically on SDK 1.28.0 / eventsource 3.0.7, PR
+ * review round 1 — pinned by the ghost-reconnect unit test).
+ */
+async function defaultConnectUpstream(target, token) {
     const upstream = new sse_js_1.SSEClientTransport(new URL(`${target.url}/sse`), token !== undefined ? { requestInit: { headers: { Authorization: `Bearer ${token}` } } } : {});
     const client = new index_js_2.Client({ name: "hicortex-mcp-bridge", version: VERSION });
     try {
         await client.connect(upstream);
     }
     catch (err) {
-        // 401 from the daemon's auth middleware (remote connections; loopback is
-        // exempt). SseError carries the HTTP status as .code.
-        if (err.code === 401) {
-            throw new Error(`The Hicortex server at ${target.url} rejected the connection (401). ` +
-                `Set HICORTEX_AUTH_TOKEN to the server's auth token — it is printed by \`hicortex status\` on the server box.`);
-        }
-        throw err instanceof Error ? err : new Error(String(err));
+        await client.close().catch(() => { });
+        throw err;
     }
-    // Downstream: a low-level Server over stdio advertising exactly what the
-    // daemon offers (tools). Ping is auto-answered by the Protocol base.
-    // #383: forward the DAEMON's initialize-result instructions verbatim — the
-    // daemon owns the text and the memoryInstructions gate, so the two surfaces
-    // cannot diverge and no config read is duplicated in the bridge (a
-    // pre-#383 remote daemon simply has none to forward; undefined omits the
-    // field from the bridge's own initialize result).
-    const server = new index_js_1.Server({ name: "hicortex", version: VERSION }, { capabilities: { tools: {} }, instructions: client.getInstructions() });
+    return client;
+}
+/**
+ * The downstream Server: a low-level Server over stdio advertising exactly
+ * what the daemon offers (tools). Ping is auto-answered by the Protocol
+ * base. #383: `instructions` is the DAEMON's initialize-result text,
+ * forwarded verbatim — undefined (pre-#383 daemon, memoryInstructions off,
+ * or the #501 slow path where the daemon has not answered yet) omits the
+ * field. `awaitClient` yields the upstream Client a tools request should
+ * use — already-resolved on the fast path, a readiness promise on the slow
+ * path, so tools requests queue until the server exists.
+ */
+function createBridgeServer(instructions, awaitClient) {
+    const server = new index_js_1.Server({ name: "hicortex", version: VERSION }, instructions !== undefined ? { capabilities: { tools: {} }, instructions } : { capabilities: { tools: {} } });
     // The proxy core — the SDK's documented proxy pattern. Forward the two
     // tools requests and pass extra.signal through so a downstream
     // notifications/cancelled aborts the upstream call (which emits the
     // correctly-id'd cancellation to the daemon). Nothing else is forwarded
     // request-wise: the daemon is tools-only and the base class answers ping.
-    server.setRequestHandler(types_js_1.ListToolsRequestSchema, async (_request, extra) => (await client.listTools(undefined, { signal: extra.signal })));
-    server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request, extra) => (await client.callTool(request.params, undefined, { signal: extra.signal })));
-    // Upstream → downstream notifications, best-effort: the daemon's tool-list
-    // changes or log messages reach the client; a closed far end must not kill
-    // the bridge from inside a notification handler.
+    server.setRequestHandler(types_js_1.ListToolsRequestSchema, async (_request, extra) => {
+        const client = await awaitClient();
+        return (await client.listTools(undefined, { signal: extra.signal }));
+    });
+    server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request, extra) => {
+        const client = await awaitClient();
+        return (await client.callTool(request.params, undefined, { signal: extra.signal }));
+    });
+    return server;
+}
+/** Upstream → downstream notifications, best-effort: the daemon's tool-list
+ *  changes or log messages reach the client; a closed far end must not kill
+ *  the bridge from inside a notification handler. */
+function forwardNotifications(client, server) {
     client.fallbackNotificationHandler = async (notification) => {
         try {
             await server.notification(notification);
@@ -285,29 +404,131 @@ async function runMcpStdio(options = {}) {
             // Best-effort by design.
         }
     };
-    // Lifecycle: whichever side ends first tears down the other. The `exiting`
-    // guard keeps our OWN client.close() (graceful path) from being read as an
-    // upstream loss.
+}
+/**
+ * Lifecycle: whichever side ends first tears down the other. The `exiting`
+ * guard keeps our OWN client.close() (graceful path) from being read as an
+ * upstream loss. The upstream attaches late on the #501 slow path, hence
+ * attachUpstream() instead of a constructor argument.
+ */
+function wireBridgeLifecycle(server) {
     let exiting = false;
+    let upstream;
     const shutdown = (code) => {
         if (exiting)
             return;
         exiting = true;
-        void Promise.allSettled([server.close(), client.close()]).then(() => process.exit(code));
+        const closing = [server.close()];
+        if (upstream)
+            closing.push(upstream.close());
+        void Promise.allSettled(closing).then(() => process.exit(code));
     };
     // Downstream closed (the MCP client went away) → close upstream → exit 0.
     server.onclose = () => shutdown(0);
-    // Upstream transport died → the bridge cannot serve anything → exit 1.
-    client.onclose = () => {
-        if (exiting)
-            return;
-        console.error("[hicortex] mcp: lost the connection to the Hicortex server");
-        shutdown(1);
-    };
     process.once("SIGINT", () => shutdown(0));
     process.once("SIGTERM", () => shutdown(0));
-    const downstream = options.downstream ?? new stdio_js_1.StdioServerTransport();
-    await server.connect(downstream);
-    // Diagnostics NEVER touch stdout (the MCP wire) — stderr only.
+    return {
+        shutdown,
+        attachUpstream(client) {
+            upstream = client;
+            // Upstream transport died → the bridge cannot serve anything → exit 1.
+            client.onclose = () => {
+                if (exiting)
+                    return;
+                console.error("[hicortex] mcp: lost the connection to the Hicortex server");
+                shutdown(1);
+            };
+        },
+    };
+}
+/**
+ * Run the stdio MCP bridge. Fast path (daemon reachable now): connect
+ * upstream first, then serve stdio with the daemon's forwarded instructions
+ * — exactly the pre-#501 sequence. Slow path (REMOTE target, transient
+ * network failure — the boot race): serve stdio IMMEDIATELY (design B,
+ * initialize answered at once) and retry the upstream connect with backoff
+ * for the retry window. Resolves once bridging is established; every setup
+ * failure throws for cli.ts to report on stderr and exit 1.
+ */
+async function runMcpStdio(options = {}) {
+    const target = resolveBridgeTarget(options.serverUrl);
+    const token = resolveBridgeToken(options.authToken);
+    const connect = options.connectUpstream ?? defaultConnectUpstream;
+    // ---- Fast path: the daemon answers now. ----
+    let firstFailure;
+    let upstream;
+    try {
+        await ensureDaemonReady(target, options);
+        upstream = await connect(target, token);
+    }
+    catch (err) {
+        if (classifyStartupFailure(err, target) !== "transient")
+            throw toStartupError(err, target);
+        firstFailure = err;
+    }
+    if (upstream) {
+        const server = createBridgeServer(upstream.getInstructions(), async () => upstream);
+        const lifecycle = wireBridgeLifecycle(server);
+        lifecycle.attachUpstream(upstream);
+        forwardNotifications(upstream, server);
+        await server.connect(options.downstream ?? new stdio_js_1.StdioServerTransport());
+        // Diagnostics NEVER touch stdout (the MCP wire) — stderr only.
+        console.error(`[hicortex] mcp: bridging stdio <-> ${target.url}/sse (target: ${target.source})`);
+        return;
+    }
+    // ---- Slow path (#501): remote + transient — answer initialize now,
+    // retry the upstream in the background, keep stdio alive throughout. ----
+    const windowMs = options.retryWindowMs ?? REMOTE_RETRY_WINDOW_MS;
+    const baseDelayMs = options.retryBaseDelayMs ?? REMOTE_RETRY_BASE_DELAY_MS;
+    const maxDelayMs = options.retryMaxDelayMs ?? REMOTE_RETRY_MAX_DELAY_MS;
+    let resolveReady;
+    let rejectReady;
+    const upstreamReady = new Promise((resolve, reject) => {
+        resolveReady = resolve;
+        rejectReady = reject;
+    });
+    // Mark handled: if the window expires before any tools request arrived,
+    // rejecting an un-awaited promise would crash the process as an unhandled
+    // rejection.
+    upstreamReady.catch(() => { });
+    const server = createBridgeServer(undefined, () => upstreamReady);
+    const lifecycle = wireBridgeLifecycle(server);
+    await server.connect(options.downstream ?? new stdio_js_1.StdioServerTransport());
     console.error(`[hicortex] mcp: bridging stdio <-> ${target.url}/sse (target: ${target.source})`);
+    console.error(`[hicortex] mcp: Hicortex server at ${target.url} unreachable at startup ` +
+        `(${summarizeStartupFailure(firstFailure)}) — retrying for up to ${Math.round(windowMs / 1000)}s ` +
+        `while the network comes up; the connection stays open and tools wait for the server`);
+    const deadline = Date.now() + windowMs;
+    let attempt = 0;
+    let lastFailure = firstFailure;
+    for (;;) {
+        const remainingMs = deadline - Date.now();
+        if (remainingMs <= 0) {
+            rejectReady(new Error(remoteUnreachableMessage(target)));
+            throw new Error(remoteUnreachableMessage(target));
+        }
+        const delayMs = Math.min(nextRetryDelayMs(attempt, baseDelayMs, maxDelayMs), remainingMs);
+        console.error(`[hicortex] mcp: retrying ${target.url} in ${delayMs}ms ` +
+            `(attempt ${attempt + 1}, ${Math.ceil(remainingMs / 1000)}s of window left) after: ${summarizeStartupFailure(lastFailure)}`);
+        await sleep(delayMs);
+        attempt += 1;
+        try {
+            await ensureDaemonReady(target, { probeHealth: options.probeHealth });
+            const client = await connect(target, token);
+            // Established — from here the lifecycle is exactly the fast path's.
+            lifecycle.attachUpstream(client);
+            forwardNotifications(client, server);
+            resolveReady(client);
+            console.error(`[hicortex] mcp: server reachable after ${attempt} retry${attempt === 1 ? "" : "ies"} — serving tools`);
+            return;
+        }
+        catch (err) {
+            const kind = classifyStartupFailure(err, target);
+            if (kind === "auth")
+                throw toStartupError(err, target);
+            if (kind !== "transient")
+                throw err;
+            lastFailure = err;
+        }
+    }
 }

package/dist/nightly.js

@@ -782,13 +782,11 @@ async function runNightly(options = {}) {
                             // #408: weakPrimaryFloor is a release-managed calibration
                             // constant now — no config threading; the Options field stays
                             // as the eval/test seam.
-                        }, {
-                        // #405: no supersessionMaxCalls — the ONE run budget is the
-                        // only call cap. #408: minSimilarity defaults to the
-                        // calibration constant (seam only).
                         }, 
                         // #405: the ONE per-run LLM-call ceiling (default 5000;
                         // consolidateMaxLlmCalls honored as a deprecated alias).
+                        // (#206-B: the retired supersession stage's options slot sat
+                        // here — removed with the stage; true-update detection is 3.8's.)
                         (0, consolidate_js_1.resolveNightlyLlmCallBudget)(savedConfig), 
                         // #245: soft cap on the corpus (default 10000; 0 disables eviction).
                         memorySoftCapResolved, {

package/dist/recall-hook-cli.js

@@ -17,6 +17,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildHookRequest = buildHookRequest;
 exports.runRecallHook = runRecallHook;
 const learnings_identity_js_1 = require("./learnings-identity.js");
+const wrapper_prompt_js_1 = require("./wrapper-prompt.js");
 const node_path_1 = require("node:path");
 const FETCH_TIMEOUT_MS = 1000;
 /** Read all of stdin (CC pipes the hook payload JSON). */
@@ -44,6 +45,15 @@ function buildHookRequest(payload, cwd = process.cwd()) {
     const prompt = typeof payload.prompt === "string" ? payload.prompt : "";
     if (!prompt)
         return null;
+    // #489: a pure plumbing payload (task-notification without a report result,
+    // command envelope, caveat, stdout echo, bare system-reminder) produces NO
+    // request at all — no HTTP call, so the 1000 ms hook budget is spent on
+    // real prompts only. A wrapper CARRYING prose (agent-message hand-back,
+    // report <result>, user text around the wrapper) recalls on the full text
+    // (owner decision 4) — the shared classifier, same function the server
+    // guards with (wrapper-prompt.ts).
+    if ((0, wrapper_prompt_js_1.isPureWrapperPrompt)(prompt))
+        return null;
     // #203 scope: derive project from the session cwd so retrieval can apply a
     // soft project-affinity boost. basename(cwd) matches capture's
     // decodeProjectDirName for non-hyphenated dirs (the common case); a hyphen

package/dist/recall-index.js

@@ -93,6 +93,7 @@ exports.handleRecallIndex = handleRecallIndex;
 exports.handleMemoryGet = handleMemoryGet;
 exports.formatMemoryGetText = formatMemoryGetText;
 const storage = __importStar(require("./storage.js"));
+const wrapper_prompt_js_1 = require("./wrapper-prompt.js");
 const type_labels_js_1 = require("./type-labels.js");
 const retrieval_js_1 = require("./retrieval.js");
 const CALIBRATION = __importStar(require("./calibration.js"));
@@ -321,6 +322,17 @@ async function handleRecallIndex(deps, body) {
         return { status: 200, body: { ok: true, reset: true } };
     }
     const prompt = typeof req.prompt === "string" ? req.prompt.trim() : "";
+    // #489 wrapper guard — the short-prompt gate's slot, BEFORE beginTurn and
+    // before any precision recording, so a pure plumbing payload (CC delivers
+    // task-notifications/command envelopes as user-role messages; any client
+    // could POST one) gets {block: null} with NO recall_pushes row, NO turn
+    // burn, NO shown_count bump, NO last_accessed refresh. The SAME shared
+    // classifier the hook client guards with (wrapper-prompt.ts) — defense in
+    // depth. A wrapper carrying real payload prose falls through and recalls on
+    // the full text, exactly today's behavior (owner decision 4).
+    if ((0, wrapper_prompt_js_1.isPureWrapperPrompt)(prompt)) {
+        return { status: 200, body: { block: null, skipped: "wrapper-prompt" } };
+    }
     const minPromptLength = deps.options?.minPromptLength ?? DEFAULT_MIN_PROMPT_LENGTH;
     if (prompt.length < minPromptLength) {
         return { status: 200, body: { block: null, skipped: "short-prompt" } };

package/dist/reconsolidation.d.ts

@@ -2,7 +2,7 @@
  * Reconsolidation (#384, #392) — the store resolves its own corrections, and
  * THE unified resolution stage.
  *
- * Nightly consolidation stage (runs as Stage 3.8, after supersession, before
+ * Nightly consolidation stage (runs as Stage 3.8, after links, before
  * decay/prune) that detects memories which correct, retract, supersede, or
  * DUPLICATE older ones; REWRITES corrected facts in place (absorbing
  * transition-only trigger memories), MERGES confirmed duplicates via the
@@ -44,8 +44,9 @@
  * planDedup and the judged mergeMemoryIds) refuse to blend a conflicts-linked
  * pair, counted as conflict_skipped. The zone therefore runs AFTER the scan —
  * with the zone first, a >=0.92 conflict pair was blended
- * before the judge ever saw it (the planted-eval harm: canonical=older, the
- * newer truth erased); running it last means verdicts/marks/binds land first
+ * before the judge ever saw it (the planted-eval harm: an unjudged blend —
+ * whichever row lost the canonical pick, its wording was simply erased);
+ * running it last means verdicts/marks/binds land first
  * and the zone merges only what no verdict claimed — a conflicts bind set by
  * this run's scan guards the SAME run's zone.
  *
@@ -94,10 +95,14 @@ export declare const RECONSOLIDATION_STAGE_LABEL = "reconsolidation";
 /**
  * Default minimum COSINE similarity for a correction candidate pair —
  * RELEASE-MANAGED since #408 (calibration.ts CORRECTION_MIN_SIMILARITY;
- * provenance there). Lower than the supersession stage's 0.80 on purpose: a
- * retraction often rides inside an otherwise unrelated memory (the field
- * failure that opened this issue), so the neighborhood gate must be a touch
- * wider while the LLM verdict + confidence gate carry the precision load.
+ * provenance there). Deliberately wide: a retraction often rides inside an
+ * otherwise unrelated memory (the field failure that opened this issue), so
+ * the neighborhood gate must be a touch wider while the LLM verdict +
+ * confidence gate carry the precision load. Since #206-B (owner decision 6)
+ * this floor also subsumes the retired Stage 3.7 supersession scan's 0.80:
+ * 3.8 is the ONLY true-update detector, scanning every new memory — no
+ * shape gate, wider floor — with `corrects`/`supersedes` partitioning what
+ * 3.7's binary prompt called a supersession.
  */
 export declare const DEFAULT_CORRECTION_MIN_SIMILARITY = 0.75;
 /**
@@ -193,7 +198,7 @@ export interface ScoutShape {
 }
 /**
  * Build the constrained correction-shape prompt (classify-tier cost profile:
- * 1500-char truncation, supersession/verdict precedent). The wording asks for
+ *  1500-char truncation, verdict-prompt precedent). The wording asks for
  * the OLD claim's distinctive terms — the field-failure mechanism is that a
  * correction CONTAINS the words of what it corrects, even when the surrounding
  * topics (and therefore the embedding cosine) are unrelated. Guard-C extends
@@ -204,13 +209,14 @@ export declare function buildScoutShapePrompt(content: string): string;
 /**
  * Parse the scout shape reply. Null on unparseable JSON, a missing/non-boolean
  * `correction`, or a missing/out-of-range `confidence` — the caller counts
- * skipped_infra and moves on (parseSupersessionReply discipline: never
+ * skipped_infra and moves on (the retired supersession stage's parse
+ * discipline, kept: never
  * mis-detect on ambiguity). `references` is lenient (missing/non-string → "")
  * because an empty string simply yields no FTS hits — a harmless miss, not a
  * mis-judgment.
  */
 export declare function parseScoutShape(reply: string): ScoutShape | null;
-/** Build the constrained pair-verdict prompt (1500-char truncation, supersession precedent). */
+/** Build the constrained pair-verdict prompt (1500-char truncation). */
 export declare function buildCorrectionVerdictPrompt(oldContent: string, newContent: string): string;
 export interface CorrectionVerdict {
     action: ResolutionAction;
@@ -219,7 +225,7 @@ export interface CorrectionVerdict {
 /**
  * Parse the pair verdict. Null on anything unparseable, unknown action, or an
  * out-of-range/missing confidence — the caller counts skipped_infra and moves
- * on (same discipline as parseSupersessionReply: never mis-judge on ambiguity).
+ * on (the same never-mis-judge-on-ambiguity discipline).
  */
 export declare function parseCorrectionVerdict(reply: string): CorrectionVerdict | null;
 export interface RewriteTriggerDisposition {