@kontextmind/kxm 0.7.179 → 0.7.181

package/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "kxm",
       "source": "./plugins/kxm",
       "description": "Durable workflows, peer agents, and kxm tui",
-      "version": "0.7.179",
+      "version": "0.7.181",
       "category": "development",
       "tags": ["kxm", "multi-agent", "workflows", "mcp"]
     }

package/CHANGELOG.md

@@ -651,6 +651,15 @@ All notable user-facing changes are documented here. The project follows [Semant
 
 ### Fixed
 
+- **`kxm improve report` and `kxm routing report` include attempts settled in a registered lane.**
+  Inside a KXM project, a present user-state `registry.db` is opened read-only at schema version 2. One query loads the home row and every lane row for that project id. Event-store paths come from the stored project keys, so a stale checkout path cannot hide a lane. A missing store stays a zero-record source. An absent registry, or a checkout that is not registered, still reads only that checkout's own store. `--file` still reads only the named file. See
+  [kxm improve report](docs/reference/cli-reference.md#kxm-improve-report).
+
+- **Browser integration tests isolate the Steel credential environment.**
+  Each test restores the operator's variables afterward, so ambient Authentik
+  credentials cannot override a case that deliberately exercises the legacy
+  API-key path.
+
 - **`kxm supervise` keeps supervisor state across a restart.**
   `status`, `record`, and `tick` store in-flight lanes, the last-seen pull
   request and CI state, and backoff timers in `.kxm/state/supervisor.json`.

package/docs/architecture/inventory.md

@@ -17,7 +17,7 @@ Read from `plugins/kxm/src/cli.ts`, `plugins/kxm/src/config-editor.ts`,
 | Hub cloud binding | `kxm hub bind <url> --cloud --token-env/--token-command` | no listener; writes the binding record and never stores the token | binding record; token stays in the named env or command | `plugins/kxm/src/cli/hub.ts` |
 | Runtime supervisor | `kxm runtime` / `scripts/kxm-runtime-supervisor.mjs` | `127.0.0.1` and the requested port, or ephemeral | registry and event stores below | `plugins/kxm/src/runtime-supervisor.ts` |
 | Runtime registry | opened by the supervisor | `runtime/registry.db` under the user state root | `registry.db`. A lane worktree registers under its project: same project id, its own control root, `lane_of` set. A registering root is the primary worktree when its git common dir is `<root>/.git`; if that primary registers while the live home row is not primary, the primary becomes the home row and every other live row of that repository becomes its lane. | `plugins/kxm/src/runtime-paths.ts` |
-| Runtime event store | opened by the supervisor | `runtime/projects/<key>/run-events.db` | `run-events.db` | `plugins/kxm/src/runtime-paths.ts` |
+| Runtime event store | opened by the supervisor | `runtime/projects/<key>/run-events.db` | `run-events.db`. `kxm improve report` and `kxm routing report` read the home store and every lane store for the registered project id through one read-only query of `registry.db` (`plugins/kxm/src/improve-sources.ts`). An absent registry, or a checkout that is not registered, reads only that checkout's own store. Paths come from the stored project keys. | `plugins/kxm/src/runtime-paths.ts` |
 | MCP server | Claude plugin or stdio launch | stdio | none | `plugins/kxm/src/mcp-server.ts` |
 | One-shot harness | supervisor producer | child process, no listener | none | `plugins/kxm/src/oneshot-producer.ts` |
 | Pi worker | `kxm agent worker` | no HTTP listener in `scripts/kxm-worker.mjs` | none of its own | `scripts/kxm-worker.mjs` |

package/docs/contributing/test-matrix.md

@@ -84,6 +84,7 @@ to run one file is in [Develop KXM](development.md#run-one-file-or-one-test).
 | Promotion needs the configured admin token with no loopback bypass; proposed items never reach a packet | `e5-memory-floor.test.ts` |
 | `kxm memory`: candidates, marker-delimited sync blocks, and one brief across CLI, Pi and the Claude hook | `e5b-harness-agnostic-memory.test.ts` |
 | `kxm improve report` reads Runtime-settled attempts, drops simulated and duplicate ones, and flags only same-ask repeats | `improve.test.ts` ("kxm improve report resolves Runtime-settled attempts from the event log and flags only same-ask cross-run repeats"), `cli.test.ts`, `cli-experience.test.ts`, `commands-policy.test.ts` |
+| A registered lane's attempt appears in `kxm improve report` and `kxm routing report` run from the primary checkout; a duplicate still drops and `--file` stays isolated | `improve.test.ts` ("kxm improve report and kxm routing report from the primary include an attempt recorded only in a registered lane") |
 | Improvement candidates exclude write steps; promotion readiness never authorizes | `improve.test.ts` |
 | Telemetry classification and JSONL recovery | `telemetry.test.ts`, `cli.test.ts` |
 
@@ -100,7 +101,7 @@ The context suites in detail:
 | `wiki.test.ts` | Wiki compilation determinism, lifecycle preservation, contradiction visibility, lint |
 | `skills.test.ts` | Skill candidate lifecycle, quarantine, immutability, CLI |
 | `routing.test.ts` | Behavioral hash, record parsing, comparisons, `kxm routing report` |
-| `improve.test.ts` | Routing-record sources, event-log outcomes, same-ask candidacy, candidate files, promotion readiness |
+| `improve.test.ts` | Routing-record sources, registered lane stores, event-log outcomes, same-ask candidacy, candidate files, promotion readiness |
 
 ## Claude Code plugin and MCP
 

package/docs/reference/cli-reference.md

@@ -3499,21 +3499,21 @@ Proposes coded-repeat candidates from this project's Runtime routing records and
 kxm improve report [--file <path>] [--out-dir <path>]
 ```
 
-Generate the improvement report and candidates from routing records. Inside a KXM project (the current directory's Git root holds `.kxm/project.yaml`) it reads the project's Runtime event store, then `telemetry.jsonl` in the workspace logs directory; `--file` reads only the named file. Routing records (`kxm.routing-record.v1` and `v2`, bare or nested under `routing`, `envelope.routing`, or a `routing.attempt.recorded` event) are grouped by workflow, step, agent role, and ask. Groups that qualify become proposed candidates, each written as a `.diff` and a `.json` file. Nothing is applied.
+Generate the improvement report and candidates from routing records. Inside a KXM project (the current directory's Git root holds `.kxm/project.yaml`) it reads that project's Runtime event stores, then `telemetry.jsonl` in the workspace logs directory; `--file` reads only the named file. Routing records (`kxm.routing-record.v1` and `v2`, bare or nested under `routing`, `envelope.routing`, or a `routing.attempt.recorded` event) are grouped by workflow, step, agent role, and ask. Groups that qualify become proposed candidates, each written as a `.diff` and a `.json` file. Nothing is applied.
 
 | Option | Argument | Default | Description |
 |---|---|---|---|
-| `--file` | `<path>` | the Runtime store, then `.kxm/logs/telemetry.jsonl` | Read only this routing-record JSONL instead of the project's Runtime store and telemetry |
+| `--file` | `<path>` | the Runtime stores, then `.kxm/logs/telemetry.jsonl` | Read only this routing-record JSONL instead of the project's Runtime stores and telemetry |
 | `--out-dir` | `<path>` | `<project>/.kxm/candidates` | Directory for candidates (default .kxm/candidates) |
 
-- The Runtime store is `<state root>/runtime/projects/<key>/run-events.db`, with the key derived from the checkout's real path, so each checkout and worktree reads only its own. It is opened read-only for one query over its events table and is never created, written, or migrated. Outside a KXM project only telemetry is read, and the text output says `Runtime store not read`.
-- A telemetry record whose `attemptId` the store already supplied is dropped (`duplicatesDropped`). Attempts from simulated drives are excluded (`excludedSimulated`). Each Runtime attempt's outcome is resolved from the event log and never written back: `accepted` when the run completed and the step was not re-entered, `reworked` when the step was entered again, `failed` when the run failed, undecided (`undecided`) when the run was cancelled or is still running.
+- Each Runtime store is `<state root>/runtime/projects/<key>/run-events.db`. When `runtime/registry.db` is absent, or this checkout's project key is not in it, the command reads only the store derived from this checkout's real path and does not create the registry. When the registry is present and this checkout is registered, it is opened read-only with no migration and no write lock, requires schema version 2, and one query returns the home row and every lane row for that project id. The home store is listed first, then lanes by registration time and key. Store paths are built from those stored keys and `runtime/projects`, not from the checkout path saved on the row, so a stale path cannot change the key. A missing store is an engine source with `exists=false` and zero records. A registry that is not a regular database file, is not schema version 2, or does not have exactly one home row and 24-character lowercase hex keys exits 1 with `improve_source_unreadable`. Each store is opened read-only for one query over its events table and is never created, written, or migrated. Outside a KXM project only telemetry is read, and the text output says `Runtime store not read`. The example below is an unregistered checkout, so it lists one engine source.
+- A telemetry record whose `attemptId` an earlier source already supplied is dropped (`duplicatesDropped`). The same drop applies between the home store and a lane store: the first source wins. Attempts from simulated drives are excluded (`excludedSimulated`). Each Runtime attempt's outcome is resolved from the event log and never written back: `accepted` when the run completed and the step was not re-entered, `reworked` when the step was entered again, `failed` when the run failed, undecided (`undecided`) when the run was cancelled or is still running.
 - A group becomes a candidate only when the same objective was decided in at least 2 runs, at least 0.75 of its decided records were accepted, and its step writes no repository. A group that passes but misses shows `no (writes-repository)` or `no (ask-not-repeated)`. `Weighted` is the recency-weighted record count (`improvement.telemetryHalfLifeDays`); it orders rows and never decides candidacy.
 - Reads `improvement.*` from the project and user configuration (see [`kxm.config.v1`](config-reference.md#personalization-settings-kxmconfigv1)) and reports each candidate's promotion readiness under `improvement.promotionPolicy`. Readiness never authorizes anything. Under `critic_quorum` every candidate reports not ready, because this command cites no critic receipts. A configuration that cannot be loaded exits 1 with `config_invalid`.
-- A Runtime store that exists but cannot be read exits 1 with `improve_source_unreadable`; `detail` names the path.
+- A Runtime store or registry that exists but cannot be read, and a registry whose identity is corrupt, exits 1 with `improve_source_unreadable`; `detail` names the path.
 - Writes candidate files under `--out-dir` (relative to the current directory) and the report at `.kxm/assets/improvements/<timestamp>.json`. Honors `--dry-run` (writes neither). No hub needed.
 - JSON keys: `path`, `events`, `recordsCount`, `groupsCount`, `candidatesCount`, `candidates`, `report` (`schema`, `createdAt`, `reviewDecision`, `recordsCount`, `groups`, `candidates`, `promotionPolicy`, `promotion`, and `routeSwitches` when the store recorded any), `sources`, `projectRoot` (`null` outside a project). `routeSwitches` lists opted-in mid-attempt walks (`from`, `to`, `reason`, optional `effort`, `attemptId`, `stepId`). It is omitted when there are none.
-- Each `sources` entry has `kind` (`engine`, `telemetry`, or `file`), `path`, `exists`, `records`, and `duplicatesDropped`; the `engine` entry also has `skippedInvalid`, `excludedSimulated`, and `undecided`.
+- Each `sources` entry has `kind` (`engine`, `telemetry`, or `file`), `path`, `exists`, `records`, and `duplicatesDropped`; each `engine` entry also has `skippedInvalid`, `excludedSimulated`, and `undecided`. A registered project has one `engine` entry for the home store and one for each lane store.
 - Each `report.groups` row has `workflowHash`, `workflowId` (Runtime records), `stepId`, `agentRole`, `promptHash`, `recurrence`, `distinctRuns`, `askRecurrence`, `undecidedRecords`, `meanCost`, `meanLatency`, `verifyPassRate` (accepted share of decided records), `rework`, `weightedRecurrence`, `undatedRecords`, `costSamples`, `writesRepository`, `evidenceRefs`, `isCandidate`, and, when they apply, `excludedReason`, `candidateKind`, and `candidateId`.
 - Each `report.promotion` entry has `candidateId`, `policy`, `readyForReview`, and `reason`.
 
@@ -3565,18 +3565,18 @@ kxm routing report [-f <path>] [-l] [--prices <path>]
 
 Compare verified completion, cost, and rework per behavioral configuration. The table ranks routes quality-first with columns Harness, Model, Effort, Role, Att, Pass%, Rwk%, p50(ms), p95(ms), CtxTok, Metered($), $/Acc, Unm, Unk, Quota, and optionally ListEquiv($).
 
-Without `--file` it reads the same sources as [`kxm improve report`](#kxm-improve-report): the current project's Runtime event store (read-only), then the workspace `telemetry.jsonl`, dropping a telemetry copy of an attempt the store already supplied and excluding simulated drives. A Runtime attempt counts toward Pass% only when the event log shows its run completed without the step being re-entered.
+Without `--file` it reads the same sources as [`kxm improve report`](#kxm-improve-report): the registered home store and every lane store for that project (read-only), or only this checkout's store when the registry is absent or this checkout is unregistered, then the workspace `telemetry.jsonl`, dropping a later copy of an attempt an earlier source already supplied and excluding simulated drives. A Runtime attempt counts toward Pass% only when the event log shows its run completed without the step being re-entered.
 
 | Option | Argument | Default | Description |
 |---|---|---|---|
-| `-f`, `--file` | `<path>` | the Runtime store, then workspace telemetry | Read only this telemetry or event log JSONL file (default: this project's Runtime event store plus workspace telemetry) |
+| `-f`, `--file` | `<path>` | the Runtime stores, then workspace telemetry | Read only this telemetry or event log JSONL file (default: this project's Runtime event stores plus workspace telemetry) |
 | `-l`, `--equivalent-list-cost` | none | off | Include equivalent list price column using price catalog |
 | `--list-prices` | none | off | Alias for --equivalent-list-cost |
 | `--prices` | `<path>` | `.kxm/prices.yaml` | Path to price catalog (default: .kxm/prices.yaml) |
 
 - Reads only. A price catalog that cannot be loaded is skipped silently.
 - `--equivalent-list-cost` loads the catalog without the freshness check the producers apply, so it prices with a catalog of any date, including one the producers treat as stale. Check the catalog `date` before you rely on `ListEquiv($)`.
-- A Runtime store that exists but cannot be read exits 1 with `improve_source_unreadable`.
+- A Runtime store or registry that exists but cannot be read exits 1 with `improve_source_unreadable`. `--file` does not read the registry or any event store.
 - Ranking: quality first (Pass%, then Rwk%), then cost per accepted attempt. Among routes of equal quality, any route with an unknown-cost attempt ranks after every route without one. Such a route's cost is unknown, not a partial sum: `$/Acc` prints `-` (JSON `costPerAcceptedUsd: null`) and the `*` in `Unk` marks it.
 - The `Quota` column counts attempts whose metadata looks quota-exhausted (a quota failure class, a `quota` flag, or text such as `rate limit` or `HTTP 429`). It is a count only. Quota is not an `onError` class, and the column does not choose a route. Walks a role opted into are listed under Route switches when the store has `routing.route_switched` events (`from`, `to`, `reason`, optional `effort`, `stepId`).
 - The text output does not list the sources, and prints `no routing records in telemetry` when no source holds a record. The Rwk% column counts records with `transitions` greater than 0, which Runtime records never set.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kontextmind/kxm",
-  "version": "0.7.179",
+  "version": "0.7.181",
   "description": "KXM local-first multi-agent orchestration and operator dashboard",
   "type": "module",
   "author": "KontextMind",

package/plugins/kxm/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "kxm",
   "displayName": "KXM",
-  "version": "0.7.179",
+  "version": "0.7.181",
   "description": "Headless multi-agent orchestration, durable workflows, and a live operator dashboard for Pi and Claude Code",
   "author": {
     "name": "KontextMind",

package/plugins/kxm/dist/cli.js

@@ -20760,8 +20760,8 @@ function validateWorkflow(workflow, agents, models, repositories, gates, issues)
       const writable = Object.values(objectValue(step.repositories) ?? {}).filter((access) => access === "write").length;
       if (maxWriteRepositories > writable) issues.push(issue3("semantic", "write_repository_bound_invalid", file, `${stepId} maxWriteRepositories exceeds writable repository scope`));
     }
-    const join60 = objectValue(step.join);
-    const minimumPassed = join60 && typeof join60.minimumPassed === "number" ? join60.minimumPassed : void 0;
+    const join61 = objectValue(step.join);
+    const minimumPassed = join61 && typeof join61.minimumPassed === "number" ? join61.minimumPassed : void 0;
     if (minimumPassed !== void 0 && minimumPassed > maximum) issues.push(issue3("semantic", "join_impossible", file, `${stepId} minimumPassed exceeds assignment maximum`));
     const distinctBy = names(assignment?.distinctBy);
     if (distinctBy.length > 0) {
@@ -25101,7 +25101,7 @@ function compileStep(step, index, stepIndex, requirePlanHash, sink) {
   const maxAttempts = compileCountField(step.maxAttempts, 1, `${id}.maxAttempts`, id, sink);
   const timeoutMs = compileOptionalDuration(step.timeoutMs, `${id}.timeoutMs`, id, sink);
   const assignments = compileAssignments(step, id, agent, sink);
-  const join60 = compileJoin(step, id, sink);
+  const join61 = compileJoin(step, id, sink);
   const requiredEvidence = compileEvidence(step, id, sink);
   const transitions = compileTransitions(step, id, index, stepIndex, sink);
   const outcomes = Object.keys(transitions).sort(compareCodeUnits5);
@@ -25129,7 +25129,7 @@ function compileStep(step, index, stepIndex, requirePlanHash, sink) {
     transitions: orderedTransitions,
     requiresPlanHash: requirePlanHash.includes(id),
     assignments,
-    join: join60
+    join: join61
   };
   if (kind === "agent" || kind === "moa") {
     if (!agent) return void 0;
@@ -25179,15 +25179,15 @@ function compileAssignments(step, stepId, primaryAgentId, sink) {
   };
 }
 function compileJoin(step, stepId, sink) {
-  const join60 = objectValue2(step.join);
-  if (!join60) return { strategy: "all" };
-  const declared = stringValue2(join60.strategy);
+  const join61 = objectValue2(step.join);
+  if (!join61) return { strategy: "all" };
+  const declared = stringValue2(join61.strategy);
   const strategy = declared && JOIN_STRATEGIES.has(declared) ? declared : "all";
-  const minimumPassed = compileOptionalCount(join60.minimumPassed, `${stepId}.join.minimumPassed`, stepId, sink);
+  const minimumPassed = compileOptionalCount(join61.minimumPassed, `${stepId}.join.minimumPassed`, stepId, sink);
   const compiled = {
     strategy,
     ...minimumPassed !== void 0 ? { minimumPassed } : {},
-    ...typeof join60.cancelRemaining === "boolean" ? { cancelRemaining: join60.cancelRemaining } : {}
+    ...typeof join61.cancelRemaining === "boolean" ? { cancelRemaining: join61.cancelRemaining } : {}
   };
   return compiled;
 }
@@ -54567,7 +54567,7 @@ import { spawnSync as spawnSync15 } from "node:child_process";
 import { createHash as createHash19 } from "node:crypto";
 import { existsSync as existsSync50, mkdtempSync as mkdtempSync3, readFileSync as readFileSync44, rmSync as rmSync13 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import { basename as basename11, extname as extname3, join as join58, resolve as resolve33 } from "node:path";
+import { basename as basename11, extname as extname3, join as join59, resolve as resolve33 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline";
 
 // plugins/kxm/src/improve.ts
@@ -54992,13 +54992,15 @@ function evaluatePromotionPolicy(candidate, policy = "manual_pr", options = {})
 // plugins/kxm/src/improve-sources.ts
 init_sqlite();
 init_project_config();
-init_runtime_store();
+init_runtime_paths();
 init_route_switch();
 init_routing();
 init_telemetry();
-import { existsSync as existsSync44 } from "node:fs";
-import { resolve as resolve30 } from "node:path";
+import { existsSync as existsSync44, lstatSync as lstatSync8 } from "node:fs";
+import { join as join54, resolve as resolve30 } from "node:path";
 var ENGINE_EVENTS_SQL = "SELECT run_id, sequence, event_type, payload FROM events WHERE event_type IN ('routing.attempt.recorded','routing.route_switched','step.entered','run.status_changed') ORDER BY run_id, sequence";
+var REGISTRY_SIBLING_SQL = "SELECT sibling.project_key AS project_key, sibling.lane_of AS lane_of FROM projects AS current JOIN projects AS sibling ON sibling.project_id = current.project_id WHERE current.project_key = ? ORDER BY CASE WHEN sibling.lane_of IS NULL THEN 0 ELSE 1 END, sibling.registered_at, sibling.project_key";
+var PROJECT_KEY = /^[0-9a-f]{24}$/;
 var SIMULATED_HARNESS = "driver-simulated";
 function parsePayload(text) {
   try {
@@ -55104,6 +55106,61 @@ function readEngineRoutingRecords(path4) {
     source: { ...source, records: records.length, skippedInvalid, excludedSimulated, undecided }
   };
 }
+function registryUnreadable(registryDb, detail) {
+  return new Error(`improve_source_unreadable: ${registryDb}: ${detail}`);
+}
+function discoverProjectEventStores(projectRoot, env) {
+  const paths = kxmRuntimePaths({ env });
+  const ownStore = join54(paths.projectsDir, projectRuntimeKey(projectRoot), "run-events.db");
+  const registryDb = paths.registryDb;
+  const info = lstatSync8(registryDb, { throwIfNoEntry: false });
+  if (!info) return [ownStore];
+  if (!info.isFile()) throw registryUnreadable(registryDb, "runtime registry must be a regular database file");
+  for (const suffix of ["-wal", "-shm"]) {
+    const sidecar = lstatSync8(`${registryDb}${suffix}`, { throwIfNoEntry: false });
+    if (sidecar?.isSymbolicLink()) throw registryUnreadable(registryDb, "runtime registry sidecar must not be a link");
+  }
+  let database;
+  try {
+    database = openReadOnlyDatabase(registryDb);
+    database.exec("PRAGMA busy_timeout = 5000");
+    const versionRow = database.prepare("PRAGMA user_version").get();
+    const version = versionRow?.user_version ?? 0;
+    if (version !== 2) throw registryUnreadable(registryDb, `registry schema version ${version}; this reader requires 2`);
+    const rows = database.prepare(REGISTRY_SIBLING_SQL).all(projectRuntimeKey(projectRoot));
+    if (rows.length === 0) return [ownStore];
+    return eventStoresFromRegistryRows(registryDb, paths.projectsDir, rows);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (message.startsWith("improve_source_unreadable:")) throw error;
+    throw new Error(`improve_source_unreadable: ${registryDb}: ${message}`, { cause: error });
+  } finally {
+    try {
+      database?.close();
+    } catch {
+    }
+  }
+}
+function eventStoresFromRegistryRows(registryDb, projectsDir, rows) {
+  const seen = /* @__PURE__ */ new Set();
+  const parsed = [];
+  for (const row of rows) {
+    const projectKey = typeof row.project_key === "string" ? row.project_key : "";
+    const laneRaw = row.lane_of;
+    const laneOf = laneRaw === null || laneRaw === void 0 ? null : typeof laneRaw === "string" ? laneRaw : "";
+    if (!PROJECT_KEY.test(projectKey) || seen.has(projectKey) || laneOf !== null && !PROJECT_KEY.test(laneOf)) {
+      throw registryUnreadable(registryDb, "registry identity is corrupt");
+    }
+    seen.add(projectKey);
+    parsed.push({ projectKey, laneOf });
+  }
+  const homes = parsed.filter((row) => row.laneOf === null);
+  const homeKey = homes[0]?.projectKey;
+  if (homes.length !== 1 || homeKey === void 0 || parsed.some((row) => row.laneOf !== null && row.laneOf !== homeKey)) {
+    throw registryUnreadable(registryDb, "registry identity is corrupt");
+  }
+  return parsed.map((row) => join54(projectsDir, row.projectKey, "run-events.db"));
+}
 function readJsonlSource(kind, path4) {
   const exists = existsSync44(path4);
   const records = exists ? readRoutingRecords(path4).map((entry) => entry.routing) : [];
@@ -55120,7 +55177,11 @@ function loadRoutingSources(options) {
   if (options.file !== void 0) {
     reads.push(readJsonlSource("file", resolve30(options.cwd, options.file)));
   } else {
-    if (projectRoot !== void 0) reads.push(readEngineRoutingRecords(kxmProjectRunEventsPath(projectRoot, options.env)));
+    if (projectRoot !== void 0) {
+      for (const path4 of discoverProjectEventStores(projectRoot, options.env)) {
+        reads.push(readEngineRoutingRecords(path4));
+      }
+    }
     reads.push(readJsonlSource("telemetry", telemetryPath(options.logsDir)));
   }
   const seen = /* @__PURE__ */ new Set();
@@ -55152,7 +55213,7 @@ function loadRoutingSources(options) {
 var import_yaml21 = __toESM(require_dist(), 1);
 init_prices();
 import { existsSync as existsSync45, readFileSync as readFileSync40 } from "node:fs";
-import { join as join54 } from "node:path";
+import { join as join55 } from "node:path";
 var DEFAULT_MODES_CONFIG = Object.freeze({
   schema: "kxm.modes.v1",
   majorModes: {
@@ -55215,7 +55276,7 @@ function loadModesConfig(projectRoot) {
   if (!projectRoot) {
     return DEFAULT_MODES_CONFIG;
   }
-  const modesPath = join54(projectRoot, ".kxm", "modes.yaml");
+  const modesPath = join55(projectRoot, ".kxm", "modes.yaml");
   if (!existsSync45(modesPath)) {
     return DEFAULT_MODES_CONFIG;
   }
@@ -55306,7 +55367,7 @@ function calculatePromptFootprint(resolved, projectRoot = process.cwd(), catalog
     estimatedTokens: estimateTokens(baseSystemPromptChars)
   });
   for (const relPath of resolved.contextFiles) {
-    const fullPath = join54(projectRoot, relPath);
+    const fullPath = join55(projectRoot, relPath);
     let chars = 0;
     if (existsSync45(fullPath)) {
       try {
@@ -55445,7 +55506,7 @@ init_safety_integrity();
 import { spawnSync as spawnSync14 } from "node:child_process";
 import { existsSync as existsSync46, mkdirSync as mkdirSync32, readFileSync as readFileSync41, readdirSync as readdirSync14, rmSync as rmSync12, statSync as statSync7 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
-import { join as join55, resolve as resolve31 } from "node:path";
+import { join as join56, resolve as resolve31 } from "node:path";
 var MAX_SSH_OUTPUT_BYTES = 50 * 1024;
 var MAX_SSH_OUTPUT_LINES = 2e3;
 var DEFAULT_SOCKET_DIR = ".kxm/run/ssh-sockets";
@@ -55471,7 +55532,7 @@ function truncateSshOutput(raw) {
   return { text, truncated };
 }
 function parseSshConfig(configPath) {
-  const targetPath = configPath ?? join55(homedir8(), ".ssh", "config");
+  const targetPath = configPath ?? join56(homedir8(), ".ssh", "config");
   if (!existsSync46(targetPath)) {
     return [];
   }
@@ -55561,7 +55622,7 @@ function ensureSocketDir(socketDir = DEFAULT_SOCKET_DIR) {
 }
 function buildSshArgs(options) {
   const socketDir = ensureSocketDir(options.socketDir ?? DEFAULT_SOCKET_DIR);
-  const controlPath = join55(socketDir, "%C");
+  const controlPath = join56(socketDir, "%C");
   const persist = options.controlPersist ?? DEFAULT_CONTROL_PERSIST;
   const args = [
     "-o",
@@ -55586,7 +55647,7 @@ function buildSshArgs(options) {
 }
 function checkControlSocket(host, socketDir = DEFAULT_SOCKET_DIR, execFn = spawnSync14) {
   const resolvedDir = ensureSocketDir(socketDir);
-  const controlPath = join55(resolvedDir, "%C");
+  const controlPath = join56(resolvedDir, "%C");
   try {
     const result = execFn("ssh", ["-O", "check", "-o", `ControlPath=${controlPath}`, host], {
       encoding: "utf-8"
@@ -55598,7 +55659,7 @@ function checkControlSocket(host, socketDir = DEFAULT_SOCKET_DIR, execFn = spawn
 }
 function closeControlSocket(host, socketDir = DEFAULT_SOCKET_DIR, execFn = spawnSync14) {
   const resolvedDir = ensureSocketDir(socketDir);
-  const controlPath = join55(resolvedDir, "%C");
+  const controlPath = join56(resolvedDir, "%C");
   try {
     const result = execFn("ssh", ["-O", "stop", "-o", `ControlPath=${controlPath}`, host], {
       encoding: "utf-8"
@@ -56349,7 +56410,7 @@ complete -c kxm -n "__fish_seen_subcommand_from goal" -a "create list get"
 // plugins/kxm/src/completion-install.ts
 import { existsSync as existsSync48, mkdirSync as mkdirSync33, readFileSync as readFileSync43, writeFileSync as writeFileSync28 } from "node:fs";
 import { homedir as homedir9 } from "node:os";
-import { basename as basename10, delimiter, dirname as dirname24, isAbsolute as isAbsolute12, join as join56, resolve as resolve32 } from "node:path";
+import { basename as basename10, delimiter, dirname as dirname24, isAbsolute as isAbsolute12, join as join57, resolve as resolve32 } from "node:path";
 var COMPLETION_MARKER = "# kxm completion";
 var PATH_MARKER = "# kxm path";
 function detectShell(env = process.env, platform = process.platform) {
@@ -56371,25 +56432,25 @@ function completionScriptPath(shell, options = {}) {
   const env = options.env ?? process.env;
   const explicit = options.configDir ?? env.KXM_USER_CONFIG_DIR?.trim();
   const base = explicit && explicit.length > 0 ? resolve32(explicit) : resolve32(effectiveHome(options), ".config", "kxm");
-  return join56(base, "completions", `kxm.${shell}`);
+  return join57(base, "completions", `kxm.${shell}`);
 }
 function bashRcCandidate(options) {
   const home = effectiveHome(options);
-  const candidates = [join56(home, ".bashrc"), join56(home, ".bash_profile")];
+  const candidates = [join57(home, ".bashrc"), join57(home, ".bash_profile")];
   const existing = candidates.find((candidate) => existsSync48(candidate));
   return existing ?? candidates[0];
 }
 function zshRcCandidate(options) {
   const env = options.env ?? process.env;
   const home = effectiveHome(options);
-  if (env.ZDOTDIR?.trim()) return join56(resolve32(env.ZDOTDIR.trim()), ".zshrc");
-  return join56(home, ".zshrc");
+  if (env.ZDOTDIR?.trim()) return join57(resolve32(env.ZDOTDIR.trim()), ".zshrc");
+  return join57(home, ".zshrc");
 }
 function fishCompletionTarget(shell, options) {
   const env = options.env ?? process.env;
   const home = effectiveHome(options);
-  if (env.XDG_CONFIG_HOME?.trim()) return join56(resolve32(env.XDG_CONFIG_HOME.trim()), "fish", "completions", "kxm.fish");
-  return join56(home, ".config", "fish", "completions", "kxm.fish");
+  if (env.XDG_CONFIG_HOME?.trim()) return join57(resolve32(env.XDG_CONFIG_HOME.trim()), "fish", "completions", "kxm.fish");
+  return join57(home, ".config", "fish", "completions", "kxm.fish");
 }
 function completionRcTarget(shell, options = {}) {
   if (shell === "fish") {
@@ -56477,7 +56538,7 @@ function kxmBinDir(env = process.env) {
   const argv1 = env.KXM_ENTRY ?? process.argv[1];
   if (argv1 && isAbsolute12(argv1)) {
     const dir = dirname24(argv1);
-    if (existsSync48(join56(dir, process.platform === "win32" ? "kxm.cmd" : "kxm"))) return dir;
+    if (existsSync48(join57(dir, process.platform === "win32" ? "kxm.cmd" : "kxm"))) return dir;
   }
   const pathEnv = env.PATH ?? "";
   for (const part of pathEnv.split(delimiter)) {
@@ -56517,7 +56578,7 @@ ${line}
 var import_yaml23 = __toESM(require_dist(), 1);
 init_routes();
 import { existsSync as existsSync49, mkdirSync as mkdirSync34, writeFileSync as writeFileSync29 } from "node:fs";
-import { dirname as dirname25, join as join57 } from "node:path";
+import { dirname as dirname25, join as join58 } from "node:path";
 var ADMITTED_GUIDE_BINDINGS = Object.freeze({
   "anthropic/claude-fable-5.1": { harness: "claude", provider: "anthropic", model: "fable" },
   "anthropic/fable": { harness: "claude", provider: "anthropic", model: "fable" },
@@ -56948,7 +57009,7 @@ function renderGuideSetupFiles(projectRoot, plan) {
     const piMatch = binding.harness === "pi" && guidePiNoteMatches(binding);
     if (binding.harness === "pi" && !piMatch) {
       files.push({
-        path: join57(projectRoot, ".kxm", "agents", `${role}.yaml`),
+        path: join58(projectRoot, ".kxm", "agents", `${role}.yaml`),
         content: (0, import_yaml23.stringify)(agentDocument(role, stage))
       });
       continue;
@@ -56966,22 +57027,22 @@ function renderGuideSetupFiles(projectRoot, plan) {
       modelDocument.origin = { source: GUIDE_PI_EVIDENCE_SOURCE, sha256: GUIDE_PI_EVIDENCE_SHA256 };
       if (!evidenceQueued) {
         files.push({
-          path: join57(projectRoot, GUIDE_PI_EVIDENCE_SOURCE),
+          path: join58(projectRoot, GUIDE_PI_EVIDENCE_SOURCE),
           content: GUIDE_PI_EVIDENCE_NOTE
         });
         evidenceQueued = true;
       }
     }
     files.push({
-      path: join57(projectRoot, ".kxm", "agents", `${role}.yaml`),
+      path: join58(projectRoot, ".kxm", "agents", `${role}.yaml`),
       content: (0, import_yaml23.stringify)(agentDocument(role, stage))
     });
     files.push({
-      path: join57(projectRoot, ".kxm", "models", `${routeId2}.yaml`),
+      path: join58(projectRoot, ".kxm", "models", `${routeId2}.yaml`),
       content: (0, import_yaml23.stringify)(modelDocument)
     });
     files.push({
-      path: join57(projectRoot, ".kxm", "roles", `${role}.yaml`),
+      path: join58(projectRoot, ".kxm", "roles", `${role}.yaml`),
       content: (0, import_yaml23.stringify)({
         schema: "kxm.role.v2",
         id: role,
@@ -56994,7 +57055,7 @@ function renderGuideSetupFiles(projectRoot, plan) {
   }
   for (const workflow of plan.workflows) {
     files.push({
-      path: join57(projectRoot, ".kxm", "workflows", `${workflow.slug}.yaml`),
+      path: join58(projectRoot, ".kxm", "workflows", `${workflow.slug}.yaml`),
       content: (0, import_yaml23.stringify)(workflowDocument(workflow))
     });
   }
@@ -57011,7 +57072,7 @@ function mergeGuideRouteAdmission(projectRoot, plan) {
   }
   if (added.length === 0) return added;
   policy.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const path4 = join57(projectRoot, ".kxm", "routes.yaml");
+  const path4 = join58(projectRoot, ".kxm", "routes.yaml");
   mkdirSync34(dirname25(path4), { recursive: true });
   writeFileSync29(path4, (0, import_yaml23.stringify)(policy), "utf8");
   return added;
@@ -57091,7 +57152,7 @@ function applyKxmPackageUpdate(runtime, notice) {
       detail: `release v${notice.latest} has no sha256 digest for ${name}; refusing to install`
     };
   }
-  const releaseDir = mkdtempSync3(join58(tmpdir3(), "kxm-pkg-update-"));
+  const releaseDir = mkdtempSync3(join59(tmpdir3(), "kxm-pkg-update-"));
   try {
     const downloader = notice.source === "github" && !ghReleaseDownloadAvailable(runtime.env) ? "curl" : "gh";
     const planned = planKxmPackageUpdate(notice.source, notice.latest, releaseDir, notice.asset, downloader, notice.localRoot);
@@ -57529,7 +57590,7 @@ async function cmdImprove(runtime, options = {}) {
     print(runtime.io, runtime.json, { ok: false, command: "improve", error: "config_invalid", detail: message }, `config_invalid: ${message}`);
     return 1;
   }
-  const candidatesDir = options.outDir ? resolve33(runtime.cwd, options.outDir) : join58(root, ".kxm", "candidates");
+  const candidatesDir = options.outDir ? resolve33(runtime.cwd, options.outDir) : join59(root, ".kxm", "candidates");
   const report2 = buildImprovementReport(loaded2.records, {
     candidatesDir,
     projectRoot: root,
@@ -57539,7 +57600,7 @@ async function cmdImprove(runtime, options = {}) {
     halfLifeDays: config.improvement.telemetryHalfLifeDays,
     routeSwitches: loaded2.routeSwitches
   });
-  const reportDir = join58(runtime.dirs.assets, "improvements");
+  const reportDir = join59(runtime.dirs.assets, "improvements");
   const reportPath = writeImprovementReport(reportDir, report2, runtime.dryRun);
   const text = [
     "Sources:",
@@ -57881,7 +57942,7 @@ async function cmdRoutingReport(runtime, options) {
   let catalog;
   if (includeEquivalentListCost) {
     try {
-      const pricesPath = options.prices ? resolve33(runtime.cwd, options.prices) : join58(runtime.dirs.workspace, "prices.yaml");
+      const pricesPath = options.prices ? resolve33(runtime.cwd, options.prices) : join59(runtime.dirs.workspace, "prices.yaml");
       catalog = loadPriceCatalog(pricesPath);
     } catch {
     }

package/plugins/kxm/dist/mcp-server.js

@@ -25462,7 +25462,7 @@ function sessionTokenFixHint(policy) {
 }
 
 // plugins/kxm/src/mcp-server.ts
-var VERSION = "0.7.179";
+var VERSION = "0.7.181";
 var CONFIGURE_PLUGIN = "/plugin configure kxm@kxm";
 var inbox = /* @__PURE__ */ new Map();
 var notifiedInbox = /* @__PURE__ */ new Set();

package/plugins/kxm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-plugin",
-  "version": "0.7.179",
+  "version": "0.7.181",
   "private": true,
   "type": "module",
   "engines": {

package/plugins/kxm/src/improve-sources.ts

@@ -1,8 +1,8 @@
-import { existsSync } from "node:fs";
-import { resolve } from "node:path";
-import { DatabaseSync } from "./sqlite.ts";
+import { existsSync, lstatSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { DatabaseSync, openReadOnlyDatabase } from "./sqlite.ts";
 import { discoverKxmProjectRoot } from "./project-config.ts";
-import { kxmProjectRunEventsPath } from "./runtime-store.ts";
+import { kxmRuntimePaths, projectRuntimeKey } from "./runtime-paths.ts";
 import { parseRouteSwitchRecord, type RouteSwitchRecord } from "./route-switch.ts";
 import { parseRoutingRecordV2, ROUTING_RECORD_V2_SCHEMA, type RoutingRecord, type RoutingRecordV2 } from "./routing.ts";
 import { readRoutingRecords, telemetryPath } from "./telemetry.ts";
@@ -10,10 +10,14 @@ import { readRoutingRecords, telemetryPath } from "./telemetry.ts";
 /**
  * Routing-record sources for `kxm improve` and `kxm routing report`.
  *
- * The project's Runtime event store is read read-only: one SELECT over the
- * events table, never the runs table, the run plans, or the prompts sidecar,
- * and never a write or a migration. Each settled attempt's outcome is resolved
- * in memory from the event log; nothing resolved here is stored.
+ * Each Runtime event store is read read-only: one SELECT over the events
+ * table, never the runs table, the run plans, or the prompts sidecar, and
+ * never a write or a migration. When the user-state registry is present and
+ * this checkout is registered, the home store and every lane store for that
+ * project id are read. The registry itself is opened read-only at schema
+ * version 2: no constructor, migration, write lock, directory, or sidecar.
+ * Each settled attempt's outcome is resolved in memory from the event log;
+ * nothing resolved here is stored.
  */
 
 export interface RoutingSourceSummary {
@@ -45,6 +49,15 @@ const ENGINE_EVENTS_SQL = "SELECT run_id, sequence, event_type, payload FROM eve
   + " WHERE event_type IN ('routing.attempt.recorded','routing.route_switched','step.entered','run.status_changed')"
   + " ORDER BY run_id, sequence";
 
+/** Home row first, then lanes by registration time and project key. One query. */
+const REGISTRY_SIBLING_SQL = "SELECT sibling.project_key AS project_key, sibling.lane_of AS lane_of"
+  + " FROM projects AS current"
+  + " JOIN projects AS sibling ON sibling.project_id = current.project_id"
+  + " WHERE current.project_key = ?"
+  + " ORDER BY CASE WHEN sibling.lane_of IS NULL THEN 0 ELSE 1 END, sibling.registered_at, sibling.project_key";
+
+const PROJECT_KEY = /^[0-9a-f]{24}$/;
+
 /** The simulated producer's harness label; its attempts measure nothing. */
 const SIMULATED_HARNESS = "driver-simulated";
 
@@ -175,6 +188,75 @@ export function readEngineRoutingRecords(path: string): EngineRoutingRead {
   };
 }
 
+function registryUnreadable(registryDb: string, detail: string): Error {
+  return new Error(`improve_source_unreadable: ${registryDb}: ${detail}`);
+}
+
+/**
+ * Event stores for this checkout.
+ *
+ * An absent registry, or a registry that has no row for this checkout's
+ * project key, keeps the single store derived from the checkout path. A
+ * present registry must be a regular schema-v2 database. Paths then come
+ * from the stored keys and the Runtime projects directory, so a stale
+ * checkout path in the registry cannot choose the store.
+ */
+function discoverProjectEventStores(projectRoot: string, env: NodeJS.ProcessEnv): string[] {
+  const paths = kxmRuntimePaths({ env });
+  const ownStore = join(paths.projectsDir, projectRuntimeKey(projectRoot), "run-events.db");
+  const registryDb = paths.registryDb;
+  const info = lstatSync(registryDb, { throwIfNoEntry: false });
+  if (!info) return [ownStore];
+  if (!info.isFile()) throw registryUnreadable(registryDb, "runtime registry must be a regular database file");
+  for (const suffix of ["-wal", "-shm"]) {
+    const sidecar = lstatSync(`${registryDb}${suffix}`, { throwIfNoEntry: false });
+    if (sidecar?.isSymbolicLink()) throw registryUnreadable(registryDb, "runtime registry sidecar must not be a link");
+  }
+
+  let database: DatabaseSync | undefined;
+  try {
+    database = openReadOnlyDatabase(registryDb);
+    database.exec("PRAGMA busy_timeout = 5000");
+    const versionRow = database.prepare("PRAGMA user_version").get() as { user_version?: number } | undefined;
+    const version = versionRow?.user_version ?? 0;
+    if (version !== 2) throw registryUnreadable(registryDb, `registry schema version ${version}; this reader requires 2`);
+    const rows = database.prepare(REGISTRY_SIBLING_SQL).all(projectRuntimeKey(projectRoot));
+    if (rows.length === 0) return [ownStore];
+    return eventStoresFromRegistryRows(registryDb, paths.projectsDir, rows);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (message.startsWith("improve_source_unreadable:")) throw error;
+    throw new Error(`improve_source_unreadable: ${registryDb}: ${message}`, { cause: error });
+  } finally {
+    try {
+      database?.close();
+    } catch {
+      // Closing a read-only handle has nothing to flush.
+    }
+  }
+}
+
+function eventStoresFromRegistryRows(registryDb: string, projectsDir: string, rows: Array<Record<string, unknown>>): string[] {
+  const seen = new Set<string>();
+  const parsed: Array<{ projectKey: string; laneOf: string | null }> = [];
+  for (const row of rows) {
+    const projectKey = typeof row.project_key === "string" ? row.project_key : "";
+    const laneRaw = row.lane_of;
+    const laneOf = laneRaw === null || laneRaw === undefined ? null : typeof laneRaw === "string" ? laneRaw : "";
+    if (!PROJECT_KEY.test(projectKey) || seen.has(projectKey) || (laneOf !== null && !PROJECT_KEY.test(laneOf))) {
+      throw registryUnreadable(registryDb, "registry identity is corrupt");
+    }
+    seen.add(projectKey);
+    parsed.push({ projectKey, laneOf });
+  }
+  const homes = parsed.filter((row) => row.laneOf === null);
+  const homeKey = homes[0]?.projectKey;
+  if (homes.length !== 1 || homeKey === undefined || parsed.some((row) => row.laneOf !== null && row.laneOf !== homeKey)) {
+    throw registryUnreadable(registryDb, "registry identity is corrupt");
+  }
+  return parsed.map((row) => join(projectsDir, row.projectKey, "run-events.db"));
+}
+
 function readJsonlSource(kind: "telemetry" | "file", path: string): { records: Array<RoutingRecord | RoutingRecordV2>; source: RoutingSourceSummary } {
   const exists = existsSync(path);
   const records = exists ? readRoutingRecords(path).map((entry) => entry.routing) : [];
@@ -190,10 +272,10 @@ function attemptKey(record: RoutingRecord | RoutingRecordV2): string | undefined
 /**
  * Load routing records for improvement and routing reports.
  *
- * With `file`, only that file is read. Otherwise the project's Runtime event
- * store (when cwd is inside a KXM project) comes first, then telemetry.jsonl.
- * v2 records are de-duplicated by attemptId: the first occurrence wins and the
- * later source counts the drop.
+ * With `file`, only that file is read. Otherwise every discovered Runtime
+ * event store (when cwd is inside a KXM project) comes first, then
+ * telemetry.jsonl. v2 records are de-duplicated by attemptId: the first
+ * occurrence wins and the later source counts the drop.
  */
 export function loadRoutingSources(options: {
   cwd: string;
@@ -206,7 +288,11 @@ export function loadRoutingSources(options: {
   if (options.file !== undefined) {
     reads.push(readJsonlSource("file", resolve(options.cwd, options.file)));
   } else {
-    if (projectRoot !== undefined) reads.push(readEngineRoutingRecords(kxmProjectRunEventsPath(projectRoot, options.env)));
+    if (projectRoot !== undefined) {
+      for (const path of discoverProjectEventStores(projectRoot, options.env)) {
+        reads.push(readEngineRoutingRecords(path));
+      }
+    }
     reads.push(readJsonlSource("telemetry", telemetryPath(options.logsDir)));
   }
 

package/plugins/kxm/src/mcp-server.ts

@@ -11,7 +11,7 @@ import { deliverInboxNotification } from "./inbox.ts";
 import type { HubEvent, MessageRecord } from "./protocol.ts";
 import { sessionTokenFixHint } from "./session-token-hint.ts";
 
-const VERSION = "0.7.179";
+const VERSION = "0.7.181";
 const CONFIGURE_PLUGIN = "/plugin configure kxm@kxm";
 const inbox = new Map<string, MessageRecord>();
 const notifiedInbox = new Set<string>();