Summary

The port of Loop's algorithm from LoopKit to the standalone LoopAlgorithm package dropped IntegralRetrospectiveCorrection's integral clamp — a safety bound on the wound-up integral term. This adds a bound back, but not the original one: instead of scaling the limit by ISF × basal (dosing authority) and the target range, it bounds the RC correction rate to a physiological ceiling (mg/dL/min), independent of user settings.

Why not restore the original (settings-dependent) clamp

RC forecasts unmodeled physiology (the residual between observed and model-predicted glucose). The plausible velocity of that physiology — carbs, EGP, exercise, insulin-model error — does not depend on a person's insulin needs or target range.

The original LoopKit clamp bounded the integral by zeroTempEffect = |ISF × basal| and glucose − rangeMax/rangeMin. Because the integral is already self-limiting (it's a leaky integrator: integralForget ≈ 0.92, so it converges to ≈ 1.087 × discrepancy), that clamp is really just deciding how large an unmodeled discrepancy to trust — and it answered that in units of dosing authority. The implied "plausible unmodeled velocity" therefore varied ~11× across settings (≈ 0.55–4.9 mg/dL/min for ISF × basal of 18–160): the same real carb rise would be trusted for a high-need user and clamped as implausible for a low-need one. That's the wrong axis for a physiological plausibility bound.

What this does

Bounds the correction rate to maxCorrectionVelocity (default 4 mg/dL/min, the top of plausible sustained unmodeled glucose velocity). Since the integral self-limits, this is a rare-event backstop for large or spurious discrepancies (e.g. sensor artifacts), and a fixed physiological rate ceiling is the right shape for that.

• Default via IntegralRetrospectiveCorrection(effectDuration:); configurable through the new maxCorrectionVelocity: initializer parameter; nil disables the clamp.
• No changes to the RetrospectiveCorrection protocol, generatePrediction, or any call site — the ceiling is internal to IRC.
• Empirically, on real IRC data across two datasets, the default reproduces the deployed clamp's behavior — both are near-inert in normal operation — without the settings coupling.

Tests

New cases in IntegralRetrospectiveCorrectionTests (via the added correctionVelocity diagnostic): the correction rate is clamped to ±ceiling on a large windup, symmetric for negative discrepancies, and left untouched when the rate is below the ceiling. All 141 package tests pass.