akm-cli 0.10.261007-beta → 0.10.261009-beta

package/CHANGELOG.md

@@ -6,6 +6,78 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.10.261009] - 2026-10-21
+
+### Changed
+
+- Search and curate default to `--belief current`, retaining unflagged reference
+  knowledge and active/asserted assets while excluding historical beliefs (#1199).
+  Use `--belief all` for broad investigation or `--belief historical` for old
+  evidence. Curate accepts search's repeatable `--filter` scope controls, and the
+  public `akm-cli/api` options add `source`, normalized `filters`, and `belief`.
+  The same eligibility follows derived surfaces, linked support and packed
+  content; historical results are labelled. Belief labels do not establish factual
+  truth. No migration or reindex is required; direct show remains available. The default
+  also applies to `akm ui` search, `akm remember --show-similar` and the related assets
+  distill reads.
+
+### Fixed
+
+- Search applies eligibility filters (scope, source, type, belief state, proposed quality)
+  before each channel's candidate limit instead of after it (#1198). An eligible asset ranked
+  below many ineligible ones in the keyword or semantic channel is no longer dropped before
+  filtering. The vector channel checks eligibility in similarity order, so unfiltered searches
+  load only the top candidates. No index migration or reindex is needed.
+
+- Extraction proposals retain captured `evidence`, optional guidance and known session sources
+  in the Markdown actually published by acceptance (#1196). Reindexing and full/agent `show` preserve
+  the support; compact discovery continues to provide refs for follow-up. Earlier pending
+  proposals require explicit review/repair of their separate evidence payload; existing accepted
+  notes are not backfilled. Run `akm index --full` to project evidence already present in old files.
+- Invalid health comparison windows are rejected before runtime probes can prepend an unrelated
+  installed-agent advisory to the JSON usage error.
+
+- OKF and LLM Wiki indexing no longer records relationships from links inside code spans,
+  fenced or indented code, including code nested in lists and blockquotes (#1200). Links are
+  read with the `marked` tokenizer (new runtime dependency) instead of raw regex scans; the
+  indexed link syntax is otherwise unchanged. Run `akm index --full` once to drop false
+  relationships stored by earlier builds; incremental indexing keeps unchanged files' old links.
+
+- Consolidation preserves the existing `scope_user`, `scope_agent`, `scope_run`, and
+  `scope_channel` tuple (#1197). Pairing requires exact normalized equality before
+  consuming an eligible neighbor slot. Retirement acceptance, including resume, checks
+  live scopes against the judged tuple; promotion refuses incompatible source/output
+  scopes and preserves differently scoped derived twins. Older retirements without a
+  recorded judged tuple remain readable but require rejection/reassessment before
+  acceptance. Staged stale decisions use the existing stale-target rejection/retry
+  path. No database migration is needed; review pending work before unattended drain.
+
+- Consolidation assesses complete note bodies in both retirement checks instead of silently
+  cutting each at 12,000 characters. Requests exceeding the selected engine's context window fail conservatively;
+  failed second checks leave proposals pending and unstaged. Before unattended proposal drain,
+  review and reject/reassess pending or staged retirements produced by older builds when either
+  body exceeded the former cutoff. An upgrade does not revalidate those decisions. No storage
+  migration is needed; accepted retirements remain recoverable with `akm proposal revert <id>`.
+
+### Changed
+
+- The consolidation pair judge reports claim differences; AKM derives `duplicate`, `subsumed`,
+  or `overlap` and the redundant side from those lists. It no longer asks the model to repeat
+  that decision in relation/pointer fields. Replacement retirements use `subsumed`; historical
+  queued labels remain readable. Lexical attention hints accompany complete bodies and never
+  substitute for assessing their meaning.
+
+## [0.10.261008] - 2026-10-20
+
+### Fixed
+
+- **`akm remember`, config saves and other writes work on filesystems that refuse chmod.** On a CIFS/SMB mount
+  such as an Azure Files share, chmod fails with `EPERM`, and akm treated that as fatal: every atomic write
+  (`akm remember`, `akm setup`, `akm env`, `akm secret`) and every config backup failed. akm now keeps the mode the
+  file was created with when the filesystem refuses chmod (`EPERM`, `ENOTSUP`, `EINVAL`); the mount options decide
+  it there, so `env/`, `secrets/` and config backups are not guaranteed owner-only on such a share. Any other chmod
+  error still fails the write.
+
 ## [0.10.261007] - 2026-10-20
 
 ### Added

package/STABILITY.md

@@ -471,10 +471,16 @@ lane (#1143): the `default` strategy runs it without the opt-in, bounded by
 `akm proposal drain --promote`. Only a promote that turns the judgment tier on
 needs `experimental.improveAutonomy`.
 
-Consolidation remains enabled with autonomy off: both its passes (promotion,
-and the pair pass's duplicate/subsumed/supersedes judging) only ever emit a
-reviewable proposal, and a pair-pass `retire` proposal is never auto-accepted
-by `triage` `applyMode: "promote"` regardless of this gate.
+Consolidation remains enabled with autonomy off. Both passes emit proposals;
+the pair pass stages a retirement when its claim checks pass and there is no
+continuity risk. `triage` with `applyMode: "promote"` can accept that staged
+retirement unattended; an unstaged retirement stays pending. Both retirement
+checks receive complete note bodies with lexical attention hints, so the selected
+engine must accommodate them. The pair judge supplies distinct-claim lists; AKM
+derives duplicate/subsumed/overlap outcomes and retirement direction from those
+lists. Historical queued retirement labels remain readable. Before unattended drain after an upgrade, review pending/staged
+retirements produced by older builds from notes over 12,000 body characters:
+upgrading does not revalidate their evidence (#1195).
 
 Because the gate is applied before the LLM preflight, a review-first workspace
 also needs fewer engines configured: a strategy whose only model-backed process

package/dist/api.d.ts

@@ -10,6 +10,12 @@ export interface CurateOptions {
   limit?: number;
   /** Asset type filter, same as `--type`. */
   type?: string;
+  /** Named bundle or local|registry|all, same as --from. */
+  source?: string;
+  /** AND-joined exact scope values, same as repeated --filter. */
+  filters?: { user?: string; agent?: string; run?: string; channel?: string };
+  /** Default current; labels do not establish factual truth. */
+  belief?: "all" | "current" | "historical";
   /** Output format, same as `--format`. Default `"json"`, as in the CLI. */
   format?: "text" | "json";
 }

package/dist/api.js

@@ -35,7 +35,18 @@ export async function curate(query, options = {}) {
         const mode = resolveOutputMode(["--detail", "agent", "--format", format], loadConfig().output ?? {});
         const disposeLlmUsageSink = installLlmUsagePersistenceIfAbsent();
         try {
-            const curated = await runCurate({ query, type: options.type, limit: options.limit === undefined ? undefined : String(options.limit) }, mode);
+            const curated = await runCurate({
+                query,
+                type: options.type,
+                limit: options.limit === undefined ? undefined : String(options.limit),
+                from: options.source,
+                belief: options.belief,
+                filters: options.filters === undefined
+                    ? undefined
+                    : Object.entries(options.filters)
+                        .filter(([, value]) => value !== undefined)
+                        .map(([key, value]) => `${key}=${value}`),
+            }, mode);
             return stdoutText(renderOutput("curate", curated, { ...mode, format }));
         }
         finally {

package/dist/assets/prompts/consolidate-pair-check.md

@@ -2,4 +2,6 @@ You check whether deleting note X from one person's agent-memory library would l
 
 A durable claim is a fact, decision, value, command, flag, path, file name, URL, number, version, name, error message, condition or rule someone would act on. Ignore wording, headings, dates of writing, tags and boilerplate. A claim is stated when Y says it in any wording or format, or replaces it with a newer value. It is not stated when Y is vaguer (a config file instead of the specific path) or drops a number, command, step or condition. Read X's description as part of X. Write each item as a short phrase that quotes its identifier. Use [] when Y states everything.
 
+Check the complete X, including its ending, one claim at a time against Y. A missing claim must actually be stated by X and absent from Y in meaning, not just in wording. Extra detail stated only by Y does not belong in missing. Repetition adds no claim. Before answering, remove any item that Y already states or replaces for the same named thing.
+
 Answer ONLY with JSON: {"missing": ["..."]}

package/dist/assets/prompts/consolidate-pair-same-age.md

@@ -0,0 +1 @@
+The two notes have the same creation date: neither is newer, so the chronological replacement rule does not apply. Different values for the same named thing conflict unless the text explicitly says one replaces the other. Treat an unresolved conflicting value as a distinct claim. A note's position in this prompt does not establish which value is current.

package/dist/assets/prompts/consolidate-pair-terms.md

@@ -0,0 +1,6 @@
+Lexical attention hints from the complete notes above:
+{{DIFFERENCES}}
+
+Check these terms in their original context. They are not claim lists: different tokens can express the same claim or a replaced value, and equal token sets do not prove equal claims. Assess the complete notes, including claims that these hints do not distinguish.
+
+Before leaving a side's claim list empty, check the source sentence of every exclusive term. Commands, flags, paths, URLs, numbers, versions and conditions must keep their specific meaning: a shared generic word does not preserve an omitted command or rule. Verify that every claim you list is absent from the other complete note in meaning.

package/dist/assets/prompts/consolidate-pair.md

@@ -1,6 +1,6 @@
-You compare two assets from one person's agent-memory library (memories and knowledge notes an AI coding agent reads). Asset A is the OLDER one and asset B the NEWER one, by the dates shown, unless both carry the same date and are labelled "same age". akm deletes one of them only when the other keeps every claim a reader would need, so your two lists decide what is safe to delete.
+You compare the complete claims of two assets from one person's agent-memory library. Use the supplied dates: when both dates are equal, neither note is newer. A note can be deleted only when the other preserves every claim it states.
 
-First list what each asset has that the other lacks:
+Compare the complete meaning of both assets before answering. Claims are equivalent when they give a reader the same facts, conditions and action, even with different wording. For example, "the build runs `make test`" and "`make test` is the build test command" are the same claim; `make test-fast` is a different command. First give a concise account of what distinguishes the claims of the two notes, including whether a value is explicitly replaced. There may be no safe deletion. Then list only claims that the other asset genuinely lacks:
 - "onlyInA": every durable claim of A that B does not state or replace.
 - "onlyInB": every durable claim of B that A does not state or replace.
 
@@ -8,14 +8,6 @@ A durable claim is a fact, decision, value, command, flag, path, file name, URL,
 
 B replaces a claim of A only when both are about the same named thing (the same service, integration, partner, component, region or file) and B gives a new value for it that is current: B says so (now, instead of, since, renamed, corrected, no longer) or B is created later than A. Notes about different named things never replace each other, whatever their dates: list each one's own name, value and path as its claims. A different value for the same thing with neither sign is a conflict, not a replacement: list A's value in "onlyInA" and B's value in "onlyInB".
 
-Then classify the relation as exactly one of:
-- "duplicate": both lists are empty.
-- "subsumed": exactly one list is empty. The asset with the empty list is redundant.
-- "supersedes": B replaces a claim in A as defined above (a newer version, a changed decision, a fixed bug, a new value), and onlyInA is empty.
-- "contradicts": they make logically exclusive claims about the same thing and nothing shows which one is current: B does not say it replaces the claim and was not created later.
-- "overlap": same subject, and both lists have items.
-- "unrelated": different subjects, or different named things written to one layout (two services, partners or regions), or different facts that happen to share words.
+Before answering, check the final claim lists against the complete notes, including their endings. Every item in onlyInA must be stated by A and neither stated in other wording nor replaced by B; check onlyInB symmetrically. Remove equivalent or replaced claims. The reason must agree with the final lists.
 
-Set "redundant" to the asset that could be deleted with no loss: "A" for "duplicate", the asset with the empty list for "subsumed", "A" for "supersedes"; else null. Set "stale" to "A" when the relation is "supersedes", else null.
-
-Answer ONLY with JSON: {"onlyInA": ["..."], "onlyInB": ["..."], "relation": "...", "redundant": "A"|"B"|null, "stale": "A"|null, "confidence": 0.0-1.0, "reason": "<at most 25 words: name the asset that can be deleted and what the other asset still holds; for supersedes, quote the words of B that replace the claim or say B is created later>"}
+Answer ONLY with JSON: {"reason": "<at most 25 words: the distinct claims of each side, or that their claims are equivalent; quote any explicit replacement>", "onlyInA": ["..."], "onlyInB": ["..."], "confidence": 0.0-1.0}

package/dist/commands/health.js

@@ -580,6 +580,7 @@ export async function akmHealth(options = {}) {
     }
     const { db } = opened;
     try {
+        const { windowResults, deltas } = resolveWindowComparePhase(options, db, stateDbPath, now);
         // Network probes overlap the local database phases below; awaited where consumed.
         const engineProbesPromise = runHealthEngineProbes({ probeReachable: options.probe ? probeLlmEndpoint : undefined });
         engineProbesPromise.catch(() => undefined);
@@ -666,8 +667,6 @@ export async function akmHealth(options = {}) {
         const hardFailure = hardChecks.some((check) => check.status === "fail");
         const deterministicWarnings = [...hardChecks, ...advisories].some((check) => check.status === "warn" && check.kind === "deterministic");
         const status = hardFailure ? "fail" : deterministicWarnings ? "warn" : "pass";
-        // ── Window-compare mode (Phase 3) ─────────────────────────────────────
-        const { windowResults, deltas } = resolveWindowComparePhase(options, db, stateDbPath, now);
         // ── Per-run mode (Phase 2) ────────────────────────────────────────────
         const runs = options.groupBy === "run" ? perRunSummaries : undefined;
         return {

package/dist/commands/improve/consolidate/pair-pass.js

@@ -5,15 +5,13 @@
  * The consolidate pair pass (0.9.17-alpha.9 plan §5.2, brief §A): runs
  * alongside the existing promote pass inside `akmConsolidate`, over new and
  * changed memory-tier assets. Judges each near-duplicate/superseding pair
- * with the calibrated relation prompt and mints a reviewed `retire` proposal
- * for the `duplicate` / `subsumed` / `supersedes` classes — never merges,
- * never writes belief edges for `contradicts`, and is never auto-accepted by
- * triage (`drain.ts`).
+ * with complete claim comparisons and mints a reviewed `retire` proposal
+ * for derived `duplicate` / `subsumed` outcomes — never merges,
+ * never writes belief edges. A staged retirement can be accepted unattended
+ * by triage (`drain.ts`); an unstaged one stays pending.
  *
- * Calibration (owner grades, 2026-09-28; see the plan's "Human calibration,
- * O5" section): the combined retire class (duplicate ∪ subsumed ∪
- * supersedes) is 20/22 = 0.91 precision against the owner. `T_PAIR` is 0.93,
- * not the initial 0.90, because the 0.90–0.93 band alone graded 3/4 (R1).
+ * Pair-selection calibration (owner grades, 2026-09-28): `T_PAIR` stays
+ * 0.93, not the initial 0.90, because the 0.90–0.93 band alone graded 3/4 (R1).
  *
  * Initiator eligibility and dating (post-review, alpha.9): "created" is the
  * asset's git first-add time (one `git log` per run, {@link loadGitFirstAddedMap}),
@@ -30,6 +28,8 @@ import fs from "node:fs";
 import path from "node:path";
 import consolidatePairPrompt from "../../../assets/prompts/consolidate-pair.md" with { type: "text" };
 import consolidatePairCheckPrompt from "../../../assets/prompts/consolidate-pair-check.md" with { type: "text" };
+import consolidatePairSameAge from "../../../assets/prompts/consolidate-pair-same-age.md" with { type: "text" };
+import consolidatePairTerms from "../../../assets/prompts/consolidate-pair-terms.md" with { type: "text" };
 import { parseFrontmatter } from "../../../core/asset/frontmatter.js";
 import { conceptIdFromTypeName } from "../../../core/asset/resolve-ref.js";
 import { asNonEmptyString } from "../../../core/common.js";
@@ -37,6 +37,7 @@ import { concurrentMap } from "../../../core/concurrent.js";
 import { parseEmbeddedJsonResponse } from "../../../core/parse.js";
 import { DERIVED_SUFFIX } from "../../../core/recognition-util.js";
 import { warnOnce } from "../../../core/warn.js";
+import { sameScope, scopeFromFrontmatter } from "../../../indexer/passes/metadata.js";
 import { runnerLlmConnection } from "../../../integrations/agent/runner.js";
 import { assertRunnerCredentials } from "../../../integrations/agent/runner-dispatch.js";
 import { runGit } from "../../../sources/providers/git-install.js";
@@ -67,28 +68,22 @@ export const BACKFILL_FLOOR = 0.95;
 export const NEW_MATERIAL_DAYS = 7;
 /** Pairs judged per run, highest cosine first (plan §7's nightly cost budget). */
 export const MAX_PAIRS_PER_RUN = 300;
-/** Body characters sent to the judge per side: enough for nearly every note, so a retirement is judged on the whole text. */
-const PAIR_BODY_TRUNCATE_CHARS = 12_000;
 const MS_PER_DAY = 86_400_000;
-const RELATION_LABELS = ["duplicate", "subsumed", "supersedes", "contradicts", "overlap", "unrelated"];
 const RETIRE_LABELS = new Set(["duplicate", "subsumed", "supersedes"]);
-/** The classes that mint a `retire` proposal (the calibrated combined retire class, 20/22 precision). */
+/** The labels represented by the existing retirement metadata. */
 function isRetireLabel(label) {
     return RETIRE_LABELS.has(label);
 }
 /** Exported, with {@link buildPairUserPrompt}, so a replay can drive the exact judge call. */
 export const PAIR_JUDGE_JSON_SCHEMA = {
     type: "object",
-    required: ["onlyInA", "onlyInB", "relation", "redundant", "stale", "confidence", "reason"],
+    required: ["reason", "onlyInA", "onlyInB", "confidence"],
     additionalProperties: false,
     properties: {
+        reason: { type: "string", maxLength: 400 },
         onlyInA: { type: "array", items: { type: "string", maxLength: 200 }, maxItems: 20 },
         onlyInB: { type: "array", items: { type: "string", maxLength: 200 }, maxItems: 20 },
-        relation: { type: "string", enum: [...RELATION_LABELS] },
-        redundant: { type: ["string", "null"], enum: ["A", "B", null] },
-        stale: { type: ["string", "null"], enum: ["A", null] },
         confidence: { type: "number", minimum: 0, maximum: 1 },
-        reason: { type: "string", maxLength: 400 },
     },
 };
 export const PAIR_CHECK_JSON_SCHEMA = {
@@ -97,17 +92,11 @@ export const PAIR_CHECK_JSON_SCHEMA = {
     additionalProperties: false,
     properties: { missing: { type: "array", items: { type: "string", maxLength: 200 }, maxItems: 20 } },
 };
-/** Hand-validates the judge's JSON, independent of whatever the provider's own schema enforcement did. */
+/** Validate both claim lists, then derive the outcome instead of asking the model to duplicate that decision. */
 export function parsePairJudgeResponse(raw) {
     const parsed = parseEmbeddedJsonResponse(raw);
     if (!parsed)
         return undefined;
-    if (typeof parsed.relation !== "string" || !RELATION_LABELS.includes(parsed.relation)) {
-        return undefined;
-    }
-    const redundant = parsed.redundant;
-    if (redundant !== "A" && redundant !== "B" && redundant !== null)
-        return undefined;
     if (typeof parsed.confidence !== "number" || !Number.isFinite(parsed.confidence))
         return undefined;
     const confidence = Math.max(0, Math.min(1, parsed.confidence));
@@ -116,7 +105,13 @@ export function parsePairJudgeResponse(raw) {
     const onlyInB = claimList(parsed.onlyInB);
     if (!onlyInA || !onlyInB)
         return undefined;
-    return { onlyInA, onlyInB, relation: parsed.relation, redundant, confidence, reason };
+    const relation = onlyInA.length === 0 && onlyInB.length === 0
+        ? "duplicate"
+        : onlyInA.length === 0 || onlyInB.length === 0
+            ? "subsumed"
+            : "overlap";
+    const redundant = onlyInA.length === 0 ? "A" : onlyInB.length === 0 ? "B" : null;
+    return { onlyInA, onlyInB, relation, redundant, confidence, reason };
 }
 function claimList(value) {
     if (!Array.isArray(value) || !value.every((v) => typeof v === "string"))
@@ -383,6 +378,10 @@ export function selectCandidates(db, initiators, bundleId, unvectored) {
         // rest of the backlog (no row, not recently git-added) needs the higher
         // BACKFILL_FLOOR.
         const floor = initiator.backlog && !initiator.newMaterial ? BACKFILL_FLOOR : T_PAIR;
+        const initiatorSide = loadSide(initiator, undefined, "");
+        if (!initiatorSide)
+            continue;
+        const scope = scopeFromFrontmatter(initiatorSide.frontmatter);
         let kept = 0;
         for (const hit of getNeighborsByEntryId(db, initiator.entryId, PAIR_NEIGHBOR_FETCH_K)) {
             if (kept >= PAIR_NEIGHBOR_K)
@@ -411,6 +410,9 @@ export function selectCandidates(db, initiators, bundleId, unvectored) {
             const cosine = 1 - (hit.distance * hit.distance) / 2;
             if (cosine < floor)
                 continue;
+            const otherSide = loadSide(other, undefined, "");
+            if (!otherSide || !sameScope(scope, scopeFromFrontmatter(otherSide.frontmatter)))
+                continue;
             const key = pairKey(initiator.ref, other.ref);
             if (seenPairs.has(key))
                 continue;
@@ -460,11 +462,22 @@ function sideSection(label, side) {
         `Description: ${asNonEmptyString(side.frontmatter.description) ?? "(none)"}`,
         "Content:",
         "```",
-        stripFrontmatterBody(side.raw).slice(0, PAIR_BODY_TRUNCATE_CHARS),
+        stripFrontmatterBody(side.raw),
         "```",
         "",
     ];
 }
+/** Lexical attention hints only: equal token sets do not prove equal claims. */
+function exclusiveTerms(side, other) {
+    const tokens = (note) => new Set(`${asNonEmptyString(note.frontmatter.description) ?? ""}\n${stripFrontmatterBody(note.raw)}`
+        .split(/\s+/)
+        .filter(Boolean));
+    const otherTerms = tokens(other);
+    return JSON.stringify([...tokens(side)].filter((term) => !otherTerms.has(term)));
+}
+function termHints(lines) {
+    return consolidatePairTerms.replace("{{DIFFERENCES}}", lines.join("\n"));
+}
 /** Orders two loaded sides by date (older/newer) for the "A (older)"/"B (newer)" labelling the prompt requires. */
 function orderByAge(x, y) {
     const xMs = Date.parse(x.createdIso);
@@ -480,6 +493,11 @@ export function buildPairUserPrompt(older, newer) {
     return [
         ...sideSection(tied ? "A (same age as B)" : "A (older)", older),
         ...sideSection(tied ? "B (same age as A)" : "B (newer)", newer),
+        termHints([
+            `Tokens only in A: ${exclusiveTerms(older, newer)}`,
+            `Tokens only in B: ${exclusiveTerms(newer, older)}`,
+        ]),
+        ...(tied ? [consolidatePairSameAge] : []),
     ].join("\n");
 }
 /** The tombstone-vocabulary reason a judge label maps to (`supersedes` -> `superseded`; the rest unchanged). */
@@ -489,8 +507,7 @@ export function tombstoneReason(label) {
 /**
  * The calibrated outcome table (owner grades, replacing plan §5.2's
  * "shorter body" rule): `duplicate`/`supersedes` keep the newer copy;
- * `subsumed` keeps the side the judge did NOT name `redundant` (no proposal
- * if that pointer is missing or invalid). A side is retired only when the
+ * `subsumed` keeps the side opposite the derived `redundant` pointer. A side is retired only when the
  * judge listed nothing that it alone holds.
  */
 export function decideRetirement(label, redundant, older, newer, only) {
@@ -512,7 +529,7 @@ function checkSection(label, side) {
         `Description: ${asNonEmptyString(side.frontmatter.description) ?? "(none)"}`,
         "Content:",
         "```",
-        stripFrontmatterBody(side.raw).slice(0, PAIR_BODY_TRUNCATE_CHARS),
+        stripFrontmatterBody(side.raw),
         "```",
         "",
     ].join("\n");
@@ -528,7 +545,7 @@ async function confirmNothingLost(ctx, retired, successor) {
         feature: "memory_consolidation",
         runner: ctx.llmRunner,
         system: consolidatePairCheckPrompt,
-        prompt: `${checkSection("X (to delete)", retired)}\n${checkSection("Y (kept)", successor)}`,
+        prompt: `${checkSection("X (to delete)", retired)}\n${checkSection("Y (kept)", successor)}\n${termHints([`Tokens only in X: ${exclusiveTerms(retired, successor)}`])}${Date.parse(retired.createdIso) === Date.parse(successor.createdIso) ? `\n${consolidatePairSameAge}` : ""}`,
         gate: { config: ctx.config, enabled: true },
         request: {
             responseSchema: PAIR_CHECK_JSON_SCHEMA,
@@ -554,6 +571,13 @@ async function judgeOne(ctx, candidate) {
     const otherSide = loadSide(candidate.other, ctx.gitFirstAdded, ctx.stashDir);
     if (!initiatorSide || !otherSide)
         return { failed: false }; // unreadable since selection — skip, not a judge failure
+    const judgedScope = scopeFromFrontmatter(initiatorSide.frontmatter);
+    if (!sameScope(judgedScope, scopeFromFrontmatter(otherSide.frontmatter)))
+        return { failed: false };
+    const scopesStillFresh = () => [initiatorSide, otherSide].every((side) => {
+        const live = loadSide(side.asset, ctx.gitFirstAdded, ctx.stashDir);
+        return live !== undefined && sameScope(judgedScope, scopeFromFrontmatter(live.frontmatter));
+    });
     // Item 0 / S1: this exact pair (same two refs, same two content hashes,
     // EITHER orientation) was already judged and rejected OR reverted. Checked
     // HERE, before the judge call, not after — the judge (not yet run) is what
@@ -651,7 +675,10 @@ async function judgeOne(ctx, candidate) {
         ledgerAccess: { proposalsCtx: ctx.opts.proposalsCtx },
         search: ctx.continuitySearch,
     });
+    if (!scopesStillFresh())
+        return { failed: true };
     const retirement = {
+        judgedScope,
         retiredRef: retired.asset.ref,
         successorRef: successor.asset.ref,
         cosine: candidate.cosine,
@@ -691,7 +718,8 @@ async function judgeOne(ctx, candidate) {
         // reviewed pairs (2026-10-04). Anything else waits for a person.
         if ((verdict.relation !== "duplicate" || verdict.onlyInA.length + verdict.onlyInB.length === 0) &&
             !continuityRisk &&
-            (await confirmNothingLost(ctx, retired, successor))) {
+            (await confirmNothingLost(ctx, retired, successor)) &&
+            scopesStillFresh()) {
             recordGateDecision(ctx.stashDir, proposal.id, {
                 outcome: "staged",
                 reason: verdict.relation,

package/dist/commands/improve/extract.js

@@ -189,17 +189,27 @@ export function parseSinceArg(value, now = Date.now()) {
     throw new UsageError(`--since value "${value}" could not be parsed (expected ISO timestamp or duration like 24h / 7d / 30m)`, "INVALID_FLAG_VALUE");
 }
 /**
- * A candidate's ref and content. `description` (and a lesson's `when_to_use`)
- * go into the body's frontmatter so accept-time validation sees them.
+ * Assemble candidate metadata once in the authoritative Markdown that acceptance
+ * publishes. The payload projection is for proposal readers, not another write path.
  */
 function buildCandidateProposal(candidate, sourceRef, sessionAssetRef) {
     const ref = deriveExtractCandidateRef(candidate, sourceRef);
     // Complete a description the model cut mid-sentence (no-op for valid ones).
     const description = repairTruncatedDescription(candidate.description, candidate.body);
-    const fm = { description, ...(sessionAssetRef ? { xrefs: [sessionAssetRef] } : {}) };
-    if (candidate.type === "lesson" && candidate.when_to_use)
+    const fm = {
+        description,
+        evidence: candidate.evidence,
+        ...(sessionAssetRef ? { xrefs: [sessionAssetRef], evidenceSources: [sessionAssetRef] } : {}),
+    };
+    // With no published session asset, keep the known native session identity in
+    // the existing structured provenance channel, never invent an AKM asset ref.
+    // The identity, not the log's absolute path, so published notes carry no local paths.
+    if (!sessionAssetRef && sourceRef.filePath) {
+        fm.provenance = { sources: [{ resource: `${sourceRef.harness}:${sourceRef.sessionId}` }] };
+    }
+    if (candidate.when_to_use)
         fm.when_to_use = candidate.when_to_use;
-    return { ref, content: assembleAsset(fm, candidate.body), description };
+    return { ref, content: assembleAsset(fm, candidate.body), frontmatter: fm };
 }
 function canonicalSegment(value) {
     return value
@@ -496,13 +506,9 @@ async function processSession(run, sessionRef, gate) {
                     attemptedRefs: [built.ref],
                     payload: {
                         content: built.content,
-                        frontmatter: {
-                            description: built.description,
-                            ...(candidate.when_to_use ? { when_to_use: candidate.when_to_use } : {}),
-                            confidence: candidate.confidence,
-                            ...(sessionAsset.sessionAssetRef ? { xrefs: [sessionAsset.sessionAssetRef] } : {}),
-                            evidence: candidate.evidence,
-                        },
+                        // Model confidence stays on the proposal for reviewers; it is not published,
+                        // where promotion scoring would read it as a signal.
+                        frontmatter: { ...built.frontmatter, confidence: candidate.confidence },
                     },
                 });
                 proposalIds.push(proposal.id);

package/dist/commands/improve/memory/memory-belief.js

@@ -7,8 +7,8 @@
  * present edge AND demotion is a no-op; an edge without its demotion is
  * repaired) and never weakens a stronger demotion — severity is
  * superseded > contradicted > archived. (alpha.4 removed belief weights from
- * ranking: search no longer reads `beliefState` at all, and `--belief
- * current|historical` is the only reader, opt-in.)
+ * ranking: beliefState never changes rank. Search/curate filter current
+ * by default; --belief all|historical explicitly includes older context.)
  * The SCC resolver in memory-improve.ts is a state-transition writer (it
  * replaces and clears edges) and deliberately does not use this (#885).
  */

package/dist/commands/proposal/repository.js

@@ -33,9 +33,10 @@ import { assertAkmAssetWrite, commitAcceptedPaths, commitWriteTargetBoundary, pr
 import { withAssetMutationLease } from "../../indexer/index-writer-lock.js";
 import { indexWrittenAssets } from "../../indexer/index-written-assets.js";
 import { deriveInstallations } from "../../indexer/installations.js";
+import { sameScope, scopeFromFrontmatter } from "../../indexer/passes/metadata.js";
 import { resolveSourceEntries } from "../../indexer/search/search-source.js";
 import { insertEventOnce } from "../../storage/repositories/events-repository.js";
-import { CONSOLIDATE_LEDGER_SOURCE, forgetImproveLedgerDecision, recordImproveLedger, recordImproveLedgerDecision, reopenImproveLedgerDecision, } from "../../storage/repositories/improve-ledger-repository.js";
+import { CONSOLIDATE_LEDGER_SOURCE, forgetImproveLedgerDecision, PAIR_PASS_LEDGER_SOURCE, recordImproveLedger, recordImproveLedgerDecision, reopenImproveLedgerDecision, } from "../../storage/repositories/improve-ledger-repository.js";
 import { getStateProposal, listStateProposalIdsByPrefix, listStateProposals, upsertProposal, } from "../../storage/repositories/proposals-repository.js";
 import { openSqliteReadSnapshot } from "../../storage/sqlite-read-snapshot.js";
 import { pkgVersion } from "../../version.js";
@@ -528,6 +529,14 @@ export function archiveProposal(stashDir, id, status, reason, ctx, gateDecision)
             at: decidedAt,
             ...(reason !== undefined ? { detail: reason } : {}),
         });
+        // The pair pass settles initiators under bare refs, independently of the
+        // proposal's durable ref. A stale decision must release both inputs for
+        // reassessment through that same ledger, rather than hold an old body forever.
+        if (isRetireProposal(updated) && gateDecision?.reason === STALE_TARGET_GATE_REASON) {
+            for (const ref of retireHeldRefs(updated)) {
+                recordImproveLedger(db, { stashDir, ref, source: PAIR_PASS_LEDGER_SOURCE, outcome: "failed", at: decidedAt });
+            }
+        }
         return updated;
     }));
 }
@@ -1007,6 +1016,14 @@ export function preflightProposalPromotion(config, proposal, options = {}, ctx)
             // best-effort; the freshness check is the real staleness gate
         }
     }
+    if (prepared.promotionSource) {
+        const sourcePath = resolveAssetFilePathSafe(target.source, parseRefInput(prepared.promotionSource));
+        if (sourcePath &&
+            fs.existsSync(sourcePath) &&
+            !sameScope(scopeFromFrontmatter(parseFrontmatter(fs.readFileSync(sourcePath, "utf8")).data), scopeFromFrontmatter(parseFrontmatter(stampedContent).data))) {
+            throw new UsageError(`Promotion ${proposal.id} has incompatible source/output scope — reject and reassess.`, "INVALID_FLAG_VALUE");
+        }
+    }
     const lintBlockers = promotionLintBlockers(stampedContent, assetPath, target.source.path, ref.type, config);
     if (lintBlockers.length > 0) {
         const summary = lintBlockers.map((finding) => `[${finding.issue}] ${finding.detail}`).join("; ");
@@ -1127,7 +1144,12 @@ function retirePromotionSource(mutationTarget, accepted, paths) {
             warn(`[proposal] O1: ${accepted.id} has no recorded source hash (minted by an older release) — leaving its source ${accepted.promotionSource} unarchived.`);
             return;
         }
-        const currentHash = contentHash(fs.readFileSync(sourcePath, "utf8"), "body");
+        const sourceContent = fs.readFileSync(sourcePath, "utf8");
+        if (!sameScope(scopeFromFrontmatter(parseFrontmatter(sourceContent).data), scopeFromFrontmatter(parseFrontmatter(proposalContent(accepted)).data))) {
+            warn(`[proposal] source scope changed for ${accepted.id} — leaving ${accepted.promotionSource} unarchived.`);
+            return;
+        }
+        const currentHash = contentHash(sourceContent, "body");
         if (currentHash !== accepted.promotionSourceHash) {
             warn(`[proposal] O1: source ${accepted.promotionSource} for ${accepted.id} changed since the promotion was queued — leaving it unarchived.`);
             return;
@@ -1141,7 +1163,8 @@ function retirePromotionSource(mutationTarget, accepted, paths) {
         const record = archiveCleanupCandidate(mutationTarget.source.path, candidate, sourcePath);
         paths.push(sourcePath, path.join(mutationTarget.source.path, record.archivedPath), path.join(mutationTarget.source.path, record.auditPath));
         const twin = derivedTwinPath(sourcePath, sourceRef.type);
-        if (twin) {
+        if (twin &&
+            sameScope(scopeFromFrontmatter(parseFrontmatter(fs.readFileSync(twin, "utf8")).data), scopeFromFrontmatter(parseFrontmatter(sourceContent).data))) {
             const twinRecord = archiveCleanupCandidate(mutationTarget.source.path, candidate, twin);
             paths.push(twin, path.join(mutationTarget.source.path, twinRecord.archivedPath), path.join(mutationTarget.source.path, twinRecord.auditPath));
         }
@@ -1325,7 +1348,7 @@ function persistRetireAcceptance(stashDir, proposal, info, ctx) {
 }
 /**
  * B2: throws a stale-retire `UsageError` unless the successor still exists
- * and both sides' recorded body hashes still match their current files — the
+ * and both sides' recorded body hashes and judged scopes still match — the
  * durable half of the chain guard. Used for a fresh accept, and (4b, third
  * review round) to re-check a resumed accept whose intent was recorded but
  * nothing has moved yet: a separate proposal accepted in between (e.g. this
@@ -1335,6 +1358,15 @@ function persistRetireAcceptance(stashDir, proposal, info, ctx) {
 function assertRetirementStillFresh(proposalId, proposalRef, retirement, targetSource, retiredCurrentBytes) {
     const successorPath = resolveAssetFilePathSafe(targetSource, parseRefInput(retirement.successorRef));
     const successorBytes = successorPath && fs.existsSync(successorPath) ? fs.readFileSync(successorPath) : undefined;
+    const judgedScope = retirement.judgedScope;
+    if (!judgedScope || typeof judgedScope !== "object" || Array.isArray(judgedScope)) {
+        throw new UsageError(`Retire proposal ${proposalId} is stale — judged scope cannot be established; reject it and reassess the pair before acceptance.`, "INVALID_FLAG_VALUE");
+    }
+    if (!sameScope(scopeFromFrontmatter(parseFrontmatter(retiredCurrentBytes.toString("utf8")).data), judgedScope) ||
+        (successorBytes &&
+            !sameScope(scopeFromFrontmatter(parseFrontmatter(successorBytes.toString("utf8")).data), judgedScope))) {
+        throw new UsageError(`Retire proposal ${proposalId} is stale — scope changed since judging; reject and reassess.`, "INVALID_FLAG_VALUE");
+    }
     const retiredFresh = contentHash(retiredCurrentBytes, "body") === retirement.retiredContentHash;
     const successorFresh = successorBytes !== undefined && contentHash(successorBytes, "body") === retirement.successorContentHash;
     if (!successorBytes || !retiredFresh || !successorFresh) {
@@ -1416,14 +1448,10 @@ async function retireProposalWithLease(stashDir, config, proposal, options, ctx)
     }
     else {
         assertAkmAssetWrite(target.source);
-        // 4b (third review round): intent was recorded but Phase 2 never moved
-        // anything yet — re-run the B2 freshness check before resuming. A
-        // separate proposal accepted in the meantime (this one's successor
-        // itself retired by a B->C accept) can make the decision stale even
-        // though nothing here changed. Once something has moved, it is too late
-        // to cleanly refuse — Phase 2 below already tolerates a partial move.
-        if (working.retirement && fs.existsSync(intent.assetPath)) {
-            assertRetirementStillFresh(proposal.id, proposal.ref, working.retirement, target.source, fs.readFileSync(intent.assetPath));
+        // Revalidate the survivor even after a partial archive. The recorded original
+        // is the judged retired side when its file has already moved.
+        if (working.retirement) {
+            assertRetirementStillFresh(proposal.id, proposal.ref, working.retirement, target.source, fs.existsSync(intent.assetPath) ? fs.readFileSync(intent.assetPath) : Buffer.from(intent.backupContent));
         }
     }
     // Phase 2: move, idempotently — a resumed call skips whichever file a
@@ -1449,7 +1477,10 @@ async function retireProposalWithLease(stashDir, config, proposal, options, ctx)
     // tombstone scan above (`alreadyDone`) already finds one archived earlier,
     // so storing it was redundant persisted state.
     const twinPath = derivedTwinPath(intent.assetPath, ref.type);
-    if (twinPath && !alreadyDone.has(path.resolve(twinPath)) && fs.existsSync(twinPath)) {
+    if (twinPath &&
+        !alreadyDone.has(path.resolve(twinPath)) &&
+        fs.existsSync(twinPath) &&
+        sameScope(scopeFromFrontmatter(parseFrontmatter(fs.readFileSync(twinPath, "utf8")).data), scopeFromFrontmatter(parseFrontmatter(intent.backupContent).data))) {
         const twinRecord = archiveCleanupCandidate(mutationTarget.source.path, candidate, twinPath);
         archiveDirs.push(path.dirname(twinRecord.auditPath));
         paths.push(twinPath, path.join(mutationTarget.source.path, twinRecord.archivedPath), path.join(mutationTarget.source.path, twinRecord.auditPath));