akm-cli 0.10.26101002-alpha → 0.10.26101201-alpha

package/CHANGELOG.md

@@ -6,6 +6,114 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.10.26101201] - 2026-10-12
+
+### Removed
+
+- **Reflect's retrieval regression gate (#1171).** After the quality judge passed a revision, reflect graded the old and the new text against up to five of the asset's own retrieval queries and refused the revision (`quality_rejected`, a 14-day window) when the mean grade fell at all. Re-measured on 0.10 it refused 12-17% of the revisions the judge had passed and lowered defects fixed from 84 to 77 (35B) and from 92 to 77 (27B) of 96, now that reflect edits frontmatter only. A judge-passed revision is now minted as a proposal with no further check. This also removes the `retrieval-ungraded` review reason, the `retrievalRegression`/`retrievalUngraded` event metadata and the `retrieval-relevance-judge.md` prompt. No config key existed for the gate, so no config changes.
+
+## [0.10.26101101] - 2026-10-11
+
+### Changed
+
+- **A manual fix to an asset applies at once.** `akm feedback --negative ... --replace/--with/--source`, `--superseded-by` and `--outdated` used to queue a `feedback` proposal that waited for `akm proposal accept` and expired after 90 days. The command now files the proposal and accepts it in the same run, through the ordinary accept (a git-backed bundle gets the usual commit; `akm proposal revert` undoes it), with gate decision `manual-fix` and no judge. If the accept refuses, the proposal is rejected, the file is untouched and the command fails. The edited asset stays eligible for every improve process.
+- **`akm improve` syncs before it runs, not only after (#1091).** A live run on a git-backed bundle now does the same
+  fetch / fast-forward-or-merge / commit / push as `akm sync` right after taking its lock and before the index and plan
+  stages, so it plans from what other hosts pushed. It honours `--no-sync` and `--no-push`. A conflict or fetch failure
+  warns and the run continues on the local state; the outcome is `preRunSync` on the result and a `stash_synced` event
+  with `phase: "pre-run"`. Pending hand edits in the managed paths are committed by it, as `akm sync` would.
+- **Reflect no longer locks an asset for 14 days over an uncertain verdict; it asks a person.** A reflect revision the
+  quality judge does not pass but scores 3.5 or more (the judge's own review label begins at 2.5) is now queued as a
+  pending proposal for a person (`judge-uncertain`, with the per-criterion scores and the judge's reason) and records
+  no `quality_rejected` window; a lower score is refused as before. Likewise a retrieval check that cannot grade a
+  revision (transport error, timeout, unreadable reply) queues it for a person (`retrieval-ungraded`) instead of
+  refusing it as a regression, and a distill lesson or promotion whose judge is missing at judge time is queued for
+  review instead of recording a 30-day `quality_rejected` window. Triage never accepts any of these. `akm proposal
+  list` shows the reason as `gate=deferred:<reason>`.
+- **Feedback now changes `akm search` and `akm curate` ranking, as `akm feedback` always said it did.** The fused
+  score is scaled by `1 + 0.03 x (ln(1 + positives) - ln(1 + negatives))`, counting the user's recorded feedback
+  events for the asset (improve, task and audit feedback does not count). The rule is the same for every asset, rises
+  with each positive and falls with each negative, and gains less per vote as votes pile up: about +2% / +3% / +5% /
+  +9% for 1 / 2 / 5 / 20 positives, so an asset with 5 positives outranks one with 2, and the effect reorders close
+  matches without overriding relevance. The counts are read from `state.db` in one query per search. `utility_scores`
+  is still written and read by improve and metrics, but search does not use it.
+- **`akm feedback` reports the real ranking effect.** `rankingUpdate.applied` in its output used to mean the utility
+  EMA write succeeded, which no longer has anything to do with ranking. It is now `true` exactly when the recorded
+  event is user-attributed (the events search counts) and `false` with a reason for improve, task, audit or unknown
+  attribution; a utility-write failure only warns and no longer flips it.
+- **Utility has one formula and one implementation.** `akm feedback` used to move utility with its own bounded step
+  toward the cumulative positive share while `akm index` recomputed the same table with a different formula, so the
+  stored value depended on which ran last. `akm feedback` now calls the indexer's `recomputeUtilityScores` for the one
+  entry (user-attributed events only), so the value it stores is the one `akm index` would compute at that moment; the
+  bounded-step code (`utility-policy.ts`) is removed. A first positive on an entry with no utility row now gives 0.3
+  (the old start was 0.5). Search still does not read utility.
+
+### Fixed
+
+- **The 02:00 nightly `akm improve` can no longer lose its night to the consolidate task's lock.** The shipped
+  `akm-improve-consolidate` task (`20 */4 * * *`) kept the default 2-hour budget, so a 00:20 run could still hold
+  `improve.lock` at 02:00 and the nightly (deliberately without `--skip-if-locked`) failed with `IMPROVE_LOCK_HELD`.
+  The consolidate task now passes `--timeout-ms 3600000`; the nightly is unchanged.
+- **Scheduled command tasks (`uses: commands/…`) get the 6-hour unattended default timeout.** Only workflow and native
+  shell/script tasks had it, so a wedged engine call could hold a command task forever. An explicit task `timeout:`,
+  an engine timeout, or `timeout: null` still wins.
+- **`akm search` no longer warns "no embedding provider is configured" on a default install.** With
+  `semanticSearchMode: auto` and no embedding settings, search uses the built-in local model, so the warning was
+  false on every query. It now fires only for a remote `embedding.endpoint` set without `embedding.model` (the one
+  config that cannot work), and the remedy names that field.
+- **`akm sync` fetches the remote and brings other hosts' changes in before it pushes.** It used to check the stale
+  local tracking ref, so once another host had pushed, the lease push failed and `akm sync` exited 70 instead of
+  committing, and a two-host filesystem bundle never converged. A writable bundle with a remote now fetches, then
+  fast-forwards (or merges with git's default merge) the upstream, then pushes; a host with nothing to commit still
+  receives the upstream. A merge that conflicts is aborted, your commit stays, the push is skipped, and
+  `reason` reads `not pushed: merging upstream conflicts in <files> ...`. A failed fetch likewise only skips the push.
+  `--no-push` and read-only bundles never touch the network.
+- **The end-of-run improve sync reports `committed: true` when only the push failed.** The commit had landed, but the
+  result and the `stash_synced` event said `committed: false`.
+- **The extract per-session lock no longer reclaims a live holder.** It was reclaimed once its file was five minutes
+  old, but one session can hold it across two extraction attempts and the summary call, so a session-end hook racing
+  the improve run processed the session twice. Only a lock whose holder process is dead is reclaimed, as with the
+  improve run lock.
+- **Memory inference writes to the default bundle, not the first bundle in the list.** The pass took `sources[0]`, so
+  it relied on list order and did nothing, silently, when that entry was not an akm bundle. It now selects the source
+  flagged as the default bundle and warns when there is none or when it is not an akm bundle.
+- **Memory inference no longer reverts a parent memory's frontmatter edit.** The `inferenceProcessed` stamp rewrote
+  frontmatter parsed before the model call, so an edit made to the memory in the meantime (accepted proposal,
+  feedback hash) was lost. The stamp now adds its key to the file's current frontmatter.
+- **The session summary prompt fences the transcript as untrusted.** Extract's summary call sent the raw, unfiltered
+  event stream with no boundary, so a crafted session could steer the text written into the session asset. It now
+  uses the same pre-filter and the same `UNTRUSTED SESSION TRANSCRIPT` fence, with forged fence markers neutralised,
+  as the extraction call.
+- **`akm proposal revert` of a retirement still works after the 30-day archive purge.** When the graced purge has
+  deleted the archived copy, the primary is restored byte for byte from the proposal's recorded `backupContent`
+  instead of the revert refusing. A file that now occupies the path is still never overwritten.
+- **Retire proposals can no longer become permanent.** They now expire by age like every other proposal (`akm proposal
+  reopen` brings one back, so the old "never expires" rationale is gone), a staged one whose file or successor is gone
+  or changed is auto-rejected once as `stale-target` instead of failing every drain run, and an expired or stale-target
+  retire proposal no longer counts as a person's rejection that settles its pair.
+- **The consolidate pair pass no longer marks assets judged when they have no stored embedding.** With
+  `semanticSearchMode: off` (or before an asset is embedded) the neighbour query could not run, yet the pass wrote a
+  `judged_no_action` row that held the asset until its body changed. It now writes no row for such an asset, so
+  enabling embeddings reconsiders it, and warns once per run that the pair pass needs stored embeddings.
+- **A transient reflect failure no longer consumes the feedback that planned it.** A transport error, parse error,
+  timeout, budget abort or crash wrote a `failed` ledger row that advanced the signal cursor, so the ref was not
+  retried until new feedback arrived. Like distill, these now write no row; guard rejections and quality rejections
+  are unchanged.
+- **The per-run `akm improve` and `akm index` log files are now purged by the retention pass.**
+  `$CACHE/logs/improve/<ISO>.log` and `$CACHE/logs/index/<ISO>.log` were outside the purge and grew without bound;
+  they now follow `improve.eventRetentionDays` like the task log files.
+- **A run hard-killed by the budget watchdog now leaves a record and banks its writes.** The forced `process.exit(0)`
+  (exit code unchanged) skipped every finally block, so the run left no `improve_runs` row and the files it had
+  written were never committed. Before exiting, the watchdog now records the run as terminated
+  (`budget_exhausted`) and makes the same provenance-scoped auto-sync commit, without pushing.
+
+### Changed
+
+- **`captureMode: hot` memories are consolidated like any other memory.** The pair pass may now retire one, the promote
+  pass may promote one (accepting archives the source, as for any memory), and a chunk of only hot memories goes to the
+  model instead of being skipped as judged no-action. The hot-specific retire guard, chunk skip and promote-prompt
+  annotation are gone; `akm remember` still writes `captureMode: hot`.
+
 ## [0.10.26101002] - 2026-10-10
 
 ### Changed

package/dist/assets/hints/cli-hints-full.md

@@ -95,7 +95,7 @@ akm lint --type workflows                      # Parse and compile every workflo
 akm workflow run workflows/ship-release        # Start or resume and execute the workflow
 akm feedback skills/code-review --positive     # Record that an asset helped (ranks it higher; no rewrite)
 akm feedback agents/reviewer --negative --reason "says to run jest; the suite runs on vitest" # Content wrong or stale: lowers its ranking; improve may repair its frontmatter
-akm feedback knowledge/opencode-server --negative --reason "the default port is 4096, not 8000" --replace "port 8000" --with "port 4096" --source "https://opencode.ai/docs/server/" # Queue an exact fix
+akm feedback knowledge/opencode-server --negative --reason "the default port is 4096, not 8000" --replace "port 8000" --with "port 4096" --source "https://opencode.ai/docs/server/" # Apply an exact fix
 akm feedback memories/deployment-notes --positive # Works for memories too
 akm feedback env/prod --positive               # Records env feedback without surfacing values
 ```
@@ -110,7 +110,7 @@ its description, title or `when_to_use` from your reason. A note that simply did
 not fit your task is not negative feedback: record nothing for it. Improve does
 not rewrite an asset's text: once you have verified the correct fact, attach the
 exact fix with `--replace "<exact current text>" --with "<corrected text>"
---source "<URL, command or file>"`, which akm checks and queues as a proposal.
+--source "<URL, command or file>"`, which akm checks and applies at once.
 A note that is outdated can be marked with `--outdated`, or
 `--superseded-by <ref>` when another note replaces it.
 `--positive` records that an asset helped (it raises its ranking) and does not

package/dist/assets/hints/cli-hints-short.md

@@ -41,7 +41,7 @@ akm proposal accept 7c115132                  # Accept by UUID prefix
 akm proposal reject skills/my-skill --reason "..."  # Reject by ref
 akm feedback <ref> --positive                 # Record that an asset helped (ranks it higher; no rewrite)
 akm feedback <ref> --negative --reason "..."  # Content wrong or stale: lowers its ranking; improve may repair its frontmatter
-akm feedback <ref> --negative --reason "..." --replace "<exact text>" --with "<fix>" --source "<url|cmd|file>"  # Queue an exact fix of its text
+akm feedback <ref> --negative --reason "..." --replace "<exact text>" --with "<fix>" --source "<url|cmd|file>"  # Apply an exact fix to its text
 akm bundle add <ref>                                 # Add a source (npm, GitHub, git, local dir)
 akm clone <ref>                               # Copy an asset to the working bundle (optional --dest arg to clone to specific location)
 akm sync                                      # Commit (and push if writable remote) changes in the primary bundle (--no-push to commit only)

package/dist/assets/stash-skeleton/README.md

@@ -85,7 +85,7 @@ akm feedback <ref> --positive
 # A note that simply did not fit your task gets no negative feedback.
 akm feedback <ref> --negative --reason "<what is wrong and what should change>"
 
-# Once you have verified the correct fact, attach the exact fix: it is checked and queued for review
+# Once you have verified the correct fact, attach the exact fix: it is checked and applied at once
 akm feedback <ref> --negative --reason "<what is wrong>" --replace "<exact current text>" --with "<corrected text>" --source "<URL, command or file>"
 
 # Capture a durable lesson or memory from the current session

package/dist/assets/tasks/improve/akm-improve-consolidate.yml

@@ -1,4 +1,4 @@
 version: 4
-run: akm improve --strategy consolidate --skip-if-locked --require-engines
+run: akm improve --strategy consolidate --timeout-ms 3600000 --skip-if-locked --require-engines
 description: Consolidation-only pass (every 4h at :20)
 schedule: "20 */4 * * *"

package/dist/commands/feedback-cli.js

@@ -21,15 +21,17 @@ import { getDbPath } from "../core/paths.js";
 import { withStateDb } from "../core/state-db.js";
 import { warn } from "../core/warn.js";
 import { withWriteTargetMutation } from "../core/write-source.js";
+import { recomputeUtilityScores } from "../indexer/indexer.js";
 import { resolveSourceEntries } from "../indexer/search/search-source.js";
-import { countFeedbackSignals, insertUsageEvent, resolveUsageEventSource } from "../indexer/usage/usage-events.js";
+import { insertUsageEvent, resolveUsageEventSource } from "../indexer/usage/usage-events.js";
 import { resolveSourcesForOrigin } from "../registry/origin-resolve.js";
 import { closeDatabase, openExistingDatabase } from "../storage/repositories/index-connection.js";
 import { findEntryIdByRef, getEntryFilePathById, getItemRefById, } from "../storage/repositories/index-entries-repository.js";
-import { applyFeedbackToUtilityScore } from "../storage/repositories/index-utility-repository.js";
+import { getUtilityScore } from "../storage/repositories/index-utility-repository.js";
 import { contentHash } from "./improve/content-hash.js";
 import { readEdgeList } from "./improve/memory/memory-belief.js";
-import { createProposal } from "./proposal/repository.js";
+import { akmProposalAccept } from "./proposal/proposal.js";
+import { createProposal, recordGateDecision, rejectProposalDurably } from "./proposal/repository.js";
 // ── Tag validation ────────────────────────────────────────────────────────────
 const TAG_KEY_RE = /^[a-z_][a-z0-9_]*$/;
 function validateFeedbackTags(raw) {
@@ -144,26 +146,25 @@ function buildLessonStrengthUpdate(rawBytes, feedbackRef) {
     const nextBytes = Buffer.from(next);
     return rawBytes.equals(nextBytes) ? { strength: strengthList.length } : { strength: strengthList.length, nextBytes };
 }
+/** Utility at or above this is "high"; falling below it after feedback emits `improve_review_needed`. */
+const UTILITY_REVIEW_THRESHOLD = 0.5;
 /**
- * Persist the feedback usage-event (state.db) and immediately fold it into the
- * entry's MemRL utility score (index.db). Chunk-8 WI-8.3: usage_events lives in
- * state.db; entries + utility_scores stay in `indexDb`. BOTH positive and
- * negative signals apply the EMA utility update unconditionally and
- * immediately when the source is user-attributed — no `akm index` run is
- * required for either signal to affect search ranking. Uses the bounded-step
- * EMA policy (F-5 / #386, arXiv:2601.03192).
- *
- * The update is intentionally SKIPPED for non-`user` event sources (`improve`,
- * `task`, `audit`, `unknown`) — an anti-self-reinforcement guard that stops an
- * agent or automated pipeline from boosting its own picks. This is by design
- * and must not be removed; R-034 only asks that the skip be surfaced to the
- * caller rather than passing silently. Best-effort: a utility-update failure
- * never fails the feedback record.
+ * Persist the feedback usage-event (state.db) and, for a user-attributed event,
+ * recompute the entry's utility score (index.db) with the same function the
+ * `akm index` finalize pass uses, scoped to this one entry, so there is one
+ * formula and the stored value is what the next index would compute. Chunk-8
+ * WI-8.3: usage_events lives in state.db; entries + utility_scores stay in `indexDb`.
+ * Search ranking does not read the utility score: it counts the recorded
+ * `source='user'` feedback events itself, so a user-attributed event affects
+ * ranking at once and an `improve`/`task`/`audit`/`unknown` one never does — an
+ * anti-self-reinforcement guard that stops an agent or automated pipeline from
+ * boosting its own picks. This is by design and must not be removed. The
+ * utility score is read by improve and metrics only; its update is best-effort
+ * and its failure never fails the feedback record or changes the ranking effect.
  */
 function recordFeedbackUsage(indexDb, entryId, durableEntryRef, signal, metadataStr) {
     let utilityResult;
-    let rankingUpdateApplied = false;
-    let rankingUpdateSkippedReason;
+    let rankingSkippedReason;
     const eventSource = resolveUsageEventSource();
     withStateDb((stateDb) => {
         insertUsageEvent(stateDb, {
@@ -175,22 +176,22 @@ function recordFeedbackUsage(indexDb, entryId, durableEntryRef, signal, metadata
             source: eventSource,
         });
         if (eventSource !== "user") {
-            rankingUpdateSkippedReason =
-                `feedback source is "${eventSource}", not "user" — ranking updates only apply to user-attributed ` +
-                    "feedback (anti-self-reinforcement guard; set AKM_EVENT_SOURCE=user to record as user demand).";
+            rankingSkippedReason =
+                `feedback source is "${eventSource}", not "user" — it does not count toward search ranking, which counts ` +
+                    "user-attributed feedback only (anti-self-reinforcement guard; set AKM_EVENT_SOURCE=user to record as user demand).";
             return;
         }
         try {
-            const { pos, neg } = countFeedbackSignals(stateDb, entryId);
-            utilityResult = applyFeedbackToUtilityScore(indexDb, entryId, pos, neg);
-            rankingUpdateApplied = true;
+            const previousUtility = getUtilityScore(indexDb, entryId)?.utility ?? 0;
+            recomputeUtilityScores(indexDb, stateDb, entryId);
+            utilityResult = { previousUtility, nextUtility: getUtilityScore(indexDb, entryId)?.utility ?? previousUtility };
         }
         catch (err) {
-            // best-effort — feedback recording succeeds even if utility update fails
-            rankingUpdateSkippedReason = `utility update failed: ${err instanceof Error ? err.message : String(err)}`;
+            // best-effort — the event is recorded (and ranked) even if the utility update fails
+            warn(`[feedback] utility update failed: ${err instanceof Error ? err.message : String(err)}`);
         }
     });
-    return { utilityResult, rankingUpdateApplied, rankingUpdateSkippedReason };
+    return { utilityResult, countsTowardRanking: eventSource === "user", rankingSkippedReason };
 }
 // ── Judged text ──────────────────────────────────────────────────────────────
 /**
@@ -416,15 +417,20 @@ export const feedbackCommand = defineJsonCommand({
             'the exact fix: --replace "<exact current text>" --with "<corrected text>" --source "<URL,\n' +
             'command or file that shows it>" (repeat --replace/--with for several edits; use --with=...\n' +
             "for a value that starts with -). akm checks that each --replace text appears exactly once\n" +
-            "and queues the edit as a proposal for review. To mark the asset's history instead, add\n" +
+            "and applies the edit at once, with no review (`akm proposal revert` undoes it). To mark\n" +
+            "the asset's history instead, add\n" +
             "--superseded-by <ref> (the asset that replaces it) or --outdated (it describes a past\n" +
-            "state and nothing replaces it), with --reason and --source: the same proposal sets its\n" +
+            "state and nothing replaces it), with --reason and --source: the same edit sets its\n" +
             "beliefState and, for --superseded-by, adds the ref to supersededBy. `--positive` records\n" +
             "that an asset helped (it raises its ranking) and does not trigger a rewrite.\n\n" +
-            "Both signals adjust the asset's usefulness score right away, in the same\n" +
-            "process: positive feedback raises it, negative lowers it, and recent\n" +
-            "feedback counts for more than old feedback. No reindex is needed — the new\n" +
-            "score affects ranking starting with the very next `akm search`.",
+            "Feedback changes `akm search` and `akm curate` ranking starting with the very\n" +
+            "next search; no reindex is needed. Each recorded positive raises the asset's\n" +
+            "score and each negative lowers it, the same way for every asset: the more\n" +
+            "positives, the higher it ranks (5 outrank 2), and each further vote counts\n" +
+            "for a little less. The effect is small, so it reorders close matches and\n" +
+            "does not override relevance. Only feedback recorded as the user counts, not\n" +
+            "feedback from improve, task or audit runs. Feedback also moves the utility\n" +
+            "score that improve and `akm metrics` read.",
     },
     args: {
         // Optional in citty so run() is invoked even when omitted; we re-validate
@@ -565,8 +571,8 @@ export const feedbackCommand = defineJsonCommand({
         // background reindex it spawned — now that ensureIndex is removed, holding
         // the lock only causes feedback to block for the full improve run duration.
         let utilityResult;
-        let rankingUpdateApplied = false;
-        let rankingUpdateSkippedReason;
+        let countsTowardRanking = false;
+        let rankingSkippedReason;
         let durableRef = ref;
         let fix;
         const db = openExistingDatabase();
@@ -586,10 +592,10 @@ export const feedbackCommand = defineJsonCommand({
                 throw new NotFoundError(`Ref "${ref}" is not in the index. ` +
                     "Run 'akm search' to verify the asset exists, then 'akm index' if it was recently added.", "ASSET_NOT_FOUND");
             }
-            // Persist the feedback signal into usage_events. Both positive and
-            // negative signals apply the EMA utility update immediately — no
-            // `akm index` run is required for either signal to affect ranking in
-            // search results (see recordFeedbackUsage / applyFeedbackToUtilityScore).
+            // Persist the feedback signal into usage_events. A user-attributed signal
+            // also recomputes the entry's utility at once (see recordFeedbackUsage).
+            // Search ranking reads the recorded events directly, so no `akm index`
+            // run is needed.
             // WI-8.5b: the `feedback` / `improve_review_needed` events key on the
             // resolved entry's fully-qualified item_ref — the SAME durable key the
             // usage_events row carries and the SAME spelling the signal-delta
@@ -645,8 +651,8 @@ export const feedbackCommand = defineJsonCommand({
             const metadataStr = Object.keys(metadataObj).length > 1 ? JSON.stringify(metadataObj) : undefined;
             const recordResult = recordFeedbackUsage(db, entryId, itemRef, signal, metadataStr);
             utilityResult = recordResult.utilityResult;
-            rankingUpdateApplied = recordResult.rankingUpdateApplied;
-            rankingUpdateSkippedReason = recordResult.rankingUpdateSkippedReason;
+            countsTowardRanking = recordResult.countsTowardRanking;
+            rankingSkippedReason = recordResult.rankingSkippedReason;
         }
         finally {
             closeDatabase(db);
@@ -656,16 +662,34 @@ export const feedbackCommand = defineJsonCommand({
             ref: durableRef,
             metadata: metadataObj,
         });
-        const fixProposal = fix && reason?.trim() && fixSource
-            ? createProposal(resolveStashDir(), {
+        // A person typed the fix, so it is applied now: the proposal is minted for the audit trail, `akm proposal
+        // revert` and reflect's "already acted on" rule, then accepted through the ordinary accept path (the same
+        // checks and git commit). If that refuses, the proposal is rejected and the command fails.
+        let fixProposal;
+        if (fix && reason?.trim() && fixSource) {
+            const stashDir = resolveStashDir();
+            const minted = createProposal(stashDir, {
                 ref: durableRef,
                 itemRef: durableRef,
                 target: fix.target,
                 source: "feedback",
                 payload: { content: fix.content },
                 feedback: { reason: reason.trim(), source: fixSource },
-            })
-            : undefined;
+            });
+            try {
+                recordGateDecision(stashDir, minted.id, { outcome: "auto-accepted", reason: "manual-fix", gate: "feedback" });
+                fixProposal = (await akmProposalAccept({ stashDir, id: minted.id })).proposal;
+            }
+            catch (err) {
+                try {
+                    rejectProposalDurably(stashDir, minted.id, `manual fix not applied: ${err instanceof Error ? err.message : String(err)}`);
+                }
+                catch (rejectErr) {
+                    warn(`[feedback] could not reject proposal ${minted.id}: ${rejectErr instanceof Error ? rejectErr.message : String(rejectErr)}`);
+                }
+                throw err;
+            }
+        }
         // F-5 / #386: When a high-utility asset crosses below the review threshold,
         // auto-create a review-needed escalation proposal so a human can confirm
         // whether the negative feedback is valid before the asset falls out of
@@ -674,7 +698,9 @@ export const feedbackCommand = defineJsonCommand({
         // Emit a structured event rather than a proposal so the review-needed
         // signal doesn't risk an accidental asset overwrite if the proposal is
         // accepted.
-        if (utilityResult?.crossedReviewThreshold) {
+        if (utilityResult &&
+            utilityResult.previousUtility >= UTILITY_REVIEW_THRESHOLD &&
+            utilityResult.nextUtility < UTILITY_REVIEW_THRESHOLD) {
             try {
                 appendEvent({
                     eventType: "improve_review_needed",
@@ -729,9 +755,9 @@ export const feedbackCommand = defineJsonCommand({
             signal,
             reason: reason?.trim() ?? null,
             tags: validatedTags,
-            rankingUpdate: rankingUpdateApplied
+            rankingUpdate: countsTowardRanking
                 ? { applied: true }
-                : { applied: false, reason: rankingUpdateSkippedReason ?? "unknown" },
+                : { applied: false, reason: rankingSkippedReason ?? "unknown" },
             ...(fixProposal
                 ? {
                     fix: {

package/dist/commands/improve/consolidate/chunking.js

@@ -3,7 +3,6 @@
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 /** Consolidate's chunk sizing and per-chunk prompt (pure token math and text). */
 import fs from "node:fs";
-import { parseFrontmatter } from "../../../core/asset/frontmatter.js";
 import { contentHash, stripFrontmatterBody } from "../content-hash.js";
 /** A conservative chars-per-token estimate, shared by every context-length budget. */
 export const CHARS_PER_TOKEN = 3;
@@ -24,9 +23,8 @@ export function computeSafeChunkSize(contextLength, bodyTruncation, maxChunkSize
 /**
  * One chunk's user prompt. Each memory shows its body only (frontmatter can
  * outrun the truncation and leave the model judging metadata), marked
- * `captureMode: hot` when the user captured it explicitly and `already queued`
- * when a pending consolidate proposal carries its body hash — the system
- * prompt forbids promoting those.
+ * `already queued` when a pending consolidate proposal carries its body hash —
+ * the system prompt forbids promoting those.
  */
 export function buildChunkPrompt(sourceName, memories, chunkIndex, totalChunks, bodyTruncation, pendingProposalBodyHashes = new Set()) {
     const lines = [
@@ -42,12 +40,7 @@ export function buildChunkPrompt(sourceName, memories, chunkIndex, totalChunks,
         catch {
             body = "(unreadable)";
         }
-        const annotations = [];
-        if (parseFrontmatter(body).data.captureMode === "hot")
-            annotations.push("captureMode: hot");
-        if (pendingProposalBodyHashes.has(contentHash(body, "body")))
-            annotations.push("already queued");
-        const annotationSuffix = annotations.length > 0 ? ` (${annotations.join("; ")})` : "";
+        const annotationSuffix = pendingProposalBodyHashes.has(contentHash(body, "body")) ? " (already queued)" : "";
         lines.push(`[${i + 1}] memories/${m.name}${annotationSuffix}`, `Description: ${m.description || "(none)"}`, `Tags: ${m.tags.length > 0 ? m.tags.join(", ") : "(none)"}`, "---", stripFrontmatterBody(body).slice(0, bodyTruncation), "");
     });
     return lines.join("\n");

package/dist/commands/improve/consolidate/continuity-check.js

@@ -4,7 +4,7 @@
 import { searchLocal } from "../../../indexer/search/db-search.js";
 import { stripFrontmatterBody } from "../content-hash.js";
 import { stripBundle } from "../ledger.js";
-import { loadRetrievalQueries } from "../retrieval-gate.js";
+import { loadRetrievalQueries } from "../retrieval-queries.js";
 /** At most this many of the retired asset's most recent queries are replayed (plan §5.4, §7). */
 export const CONTINUITY_MAX_QUERIES = 5;
 /** "Top 10" per the plan's rule — both the pass/fail cutoff and the search `limit`. */
@@ -63,8 +63,8 @@ function normalizedBody(raw) {
  *
  * S3: two fixes against false flags measured on a real night-1 admission
  * (300 pairs, 6 flags, half spurious):
- *  - queries are the SAME cleaned set `loadRetrievalQueries` replays for the
- *    retrieval regression gate (`../retrieval-gate.ts`) — stash-README
+ *  - queries are the cleaned set `loadRetrievalQueries` returns
+ *    (`../retrieval-queries.ts`) — stash-README
  *    boilerplate, harness/tool envelopes, pastes over 2,000 characters, and
  *    duplicates are dropped before replay, not just capped at 5 raw entries;
  *  - when the retired and successor bodies normalize identical, the check
@@ -92,7 +92,7 @@ export async function checkRetirementContinuity(args) {
     // no real risk here to check for.
     if (normalizedBody(args.retiredRaw) === normalizedBody(args.successorRaw))
         return undefined;
-    // S3a: the SAME cleaned queries the retrieval regression gate replays —
+    // S3a: the cleaned queries from `loadRetrievalQueries` —
     // boilerplate, envelopes, pastes and duplicates dropped before replay.
     const queries = loadRetrievalQueries(args.ledgerAccess, args.retiredRef).slice(0, CONTINUITY_MAX_QUERIES);
     if (queries.length === 0)

package/dist/commands/improve/consolidate/pair-pass.js

@@ -42,10 +42,9 @@ import { assertRunnerCredentials } from "../../../integrations/agent/runner-disp
 import { runGit } from "../../../sources/providers/git-install.js";
 import { closeDatabase, openExistingDatabase, openReadonlyExistingDatabase, } from "../../../storage/repositories/index-connection.js";
 import { getAllEntries, getEntryById } from "../../../storage/repositories/index-entries-repository.js";
-import { getNeighborsByEntryId } from "../../../storage/repositories/index-vec-repository.js";
-import { isRetireProposal, PAIR_PASS_GATE, } from "../../proposal/proposal-types.js";
+import { getNeighborsByEntryId, hasStoredEmbedding } from "../../../storage/repositories/index-vec-repository.js";
+import { EXPIRED_GATE_REASON, isRetireProposal, PAIR_PASS_GATE, STALE_TARGET_GATE_REASON, } from "../../proposal/proposal-types.js";
 import { createRetireProposal, listProposalsReadOnly, proposalContentHash, recordGateDecision, } from "../../proposal/repository.js";
-import { isHotCapturedMemory } from "../consolidate.js";
 import { contentHash, stripFrontmatterBody } from "../content-hash.js";
 import { loadLedgerSnapshot, PAIR_PASS_LEDGER_SOURCE, recordLedgerAttempt, stripBundle } from "../ledger.js";
 import { isInRetrievalScope, loadRetrievalScope } from "../retrieval-scope.js";
@@ -313,6 +312,10 @@ export function loadRejectedPairKeys(stashDir, proposalsCtx) {
             for (const p of listProposalsReadOnly(stashDir, { status, includeArchive: true }, proposalsCtx)) {
                 if (!isRetireProposal(p) || !p.retirement)
                     continue;
+                // Expiry and a stale target are procedural, not a person saying no: the pair may be judged again.
+                const autoReason = p.gateDecision?.outcome === "auto-rejected" ? p.gateDecision.reason : undefined;
+                if (autoReason === EXPIRED_GATE_REASON || autoReason === STALE_TARGET_GATE_REASON)
+                    continue;
                 keys.add(rejectedPairKey(p.retirement.retiredRef, p.retirement.successorRef, p.retirement.retiredContentHash, p.retirement.successorContentHash));
             }
         }
@@ -364,12 +367,18 @@ export function selectInitiators(pool, opts, stashDir, gitFirstAdded) {
  * apart from a fully-judged one). S2: fetches `PAIR_NEIGHBOR_FETCH_K` (20)
  * raw neighbours and keeps the first `PAIR_NEIGHBOR_K` (5) that clear every
  * filter, so a few self/twin/bundle/tier misses in the raw top-5 no longer
- * starve an initiator down to zero real candidates.
+ * starve an initiator down to zero real candidates. An initiator with no
+ * stored vector (embeddings off, or not embedded yet) cannot be queried at
+ * all; its ref is added to `unvectored` so the caller does not settle it.
  */
-export function selectCandidates(db, initiators, bundleId) {
+export function selectCandidates(db, initiators, bundleId, unvectored) {
     const candidates = [];
     const seenPairs = new Set();
     for (const initiator of initiators) {
+        if (!hasStoredEmbedding(db, initiator.entryId)) {
+            unvectored?.add(initiator.ref);
+            continue;
+        }
         // S1: a changed-content or new-material initiator judges at T_PAIR; the
         // rest of the backlog (no row, not recently git-added) needs the higher
         // BACKFILL_FLOOR.
@@ -597,9 +606,6 @@ async function judgeOne(ctx, candidate) {
         [retired, successor] = [successor, retired];
     }
     // Guards (plan §5.2 step 4 / brief §A "Guards").
-    if (retired.asset.type === "memory" && isHotCapturedMemory(retired.asset.filePath)) {
-        return { failed: false }; // never propose retiring a captureMode: hot memory — leave the pair alone
-    }
     if (retired.asset.type === "memory" && retired.asset.name.endsWith(DERIVED_SUFFIX)) {
         // S3: derive the parent path from the FULL file path, not from name +
         // dirname — for a subfolder memory (e.g. memories/sub/foo.derived) the
@@ -736,6 +742,7 @@ seams = {}) {
     let candidates;
     let gitFirstAdded;
     let db;
+    const unvectored = new Set();
     try {
         db = opts.dryRun ? openReadonlyExistingDatabase(undefined, { isolatedSnapshot: true }) : openExistingDatabase();
         if (!db)
@@ -743,7 +750,7 @@ seams = {}) {
         gitFirstAdded = loadGitFirstAddedMap(stashDir);
         const pool = loadPairPassPool(db, bundleId);
         initiators = selectInitiators(pool, opts, stashDir, gitFirstAdded).initiators;
-        candidates = selectCandidates(db, initiators, bundleId);
+        candidates = selectCandidates(db, initiators, bundleId, unvectored);
     }
     catch (error) {
         warnings.push(`Pair pass: index unavailable — skipped (${error instanceof Error ? error.message : String(error)}).`);
@@ -754,6 +761,9 @@ seams = {}) {
             closeDatabase(db);
     }
     const initiatorsBacklog = initiators.filter((i) => i.backlog).length;
+    if (unvectored.size > 0) {
+        warnings.push(`Pair pass: ${unvectored.size} asset(s) have no stored embedding, so their neighbours cannot be found and they were not judged. The pair pass needs stored embeddings (set semanticSearchMode to "auto" in the config, then run akm index).`);
+    }
     // Never judge a pair when either side already has a pending retire
     // proposal, as the retired ref OR its successor (B2 widens this from the
     // retired ref alone): an asset spoken for by one pending decision cannot
@@ -867,6 +877,9 @@ seams = {}) {
         const admittedRefs = new Set(judgeable.map((c) => c.initiator.ref));
         const ledgerInputs = initiators
             .filter((i) => {
+            // No stored vector: the neighbour query never ran, so nothing was judged. Leave it unsettled.
+            if (unvectored.has(i.ref))
+                return false;
             const hasCandidates = byInitiator.has(i.ref);
             if (!hasCandidates)
                 return true;

package/dist/commands/improve/consolidate.js

@@ -43,7 +43,7 @@ import { getBodyEmbeddings, upsertBodyEmbeddings } from "../../storage/repositor
 import { closeDatabase, openExistingDatabase, openReadonlyExistingDatabase, } from "../../storage/repositories/index-connection.js";
 import { getAllEntries } from "../../storage/repositories/index-entries-repository.js";
 import { listProposals, listProposalsReadOnly, proposalContent } from "../proposal/repository.js";
-import { hasHotCaptureMode, hasSupersededStatus, validateProposalFrontmatter, } from "../proposal/validators/proposal-quality-validators.js";
+import { hasSupersededStatus, validateProposalFrontmatter } from "../proposal/validators/proposal-quality-validators.js";
 import { buildChunkPrompt, computeSafeChunkSize, DEFAULT_CONTEXT_LENGTH_TOKENS } from "./consolidate/chunking.js";
 import { openKnowledgeCoverage } from "./consolidate/coverage.js";
 import { runConsolidatePairPass } from "./consolidate/pair-pass.js";
@@ -75,21 +75,6 @@ export function mergePlans(chunks) {
 export function isConsolidationEligibleMemoryName(name) {
     return !name.endsWith(".derived");
 }
-/**
- * A `captureMode: hot` memory (written deliberately with `akm remember`). A
- * missing file is not hot; an unreadable one is treated as hot — the check is
- * a protection and must not fail open.
- */
-export function isHotCapturedMemory(filePath) {
-    if (!fs.existsSync(filePath))
-        return false;
-    try {
-        return hasHotCaptureMode(parseFrontmatter(fs.readFileSync(filePath, "utf8")).data);
-    }
-    catch {
-        return true;
-    }
-}
 /**
  * Structured-output schema for a plan. Promote-only: merge/delete/contradict
  * were removed in 0.9.17-alpha.1 (`e82eec811`) after running in production —
@@ -531,9 +516,8 @@ const ABORT_MIN_CHUNKS = 4;
 const ABORT_FAILURE_RATE = 0.5;
 /**
  * The chunk loop: stop cleanly on the budget signal, abort once ≥50% of at
- * least 4 chunks failed (the model is likely down), skip an all-hot chunk
- * without a call (the only thing the model could do with it is refused), and
- * count every memory into exactly one accounting bucket.
+ * least 4 chunks failed (the model is likely down), and count every memory
+ * into exactly one accounting bucket.
  */
 async function judgeConsolidationChunks(args) {
     const { chunks, opts, config, warnings, acc } = args;
@@ -571,15 +555,6 @@ async function judgeConsolidationChunks(args) {
             }
         }
         const chunk = chunks[chunkIdx];
-        if (chunk.length > 0 && chunk.every((m) => isHotCapturedMemory(m.filePath))) {
-            for (const m of chunk) {
-                acc.judgedNoActionRefs.add(memRef(m));
-                acc.judgedRefs.add(memRef(m));
-            }
-            acc.judgedNoAction += chunk.length;
-            warn(`[consolidate] chunk ${chunkIdx + 1}/${chunks.length}: all ${chunk.length} memories are captureMode: hot — skipping LLM (judged no-action).`);
-            continue;
-        }
         warn(`[consolidate] chunk ${chunkIdx + 1}/${chunks.length} (${chunk.length} memories) …`);
         processed++;
         if (!llmRunner) {
@@ -667,8 +642,7 @@ async function planConsolidation(opts, config, stashDir, memories, warnings, sta
         }
     }
     const slice = (list) => Array.from({ length: Math.ceil(list.length / chunkSize) }, (_, i) => list.slice(i * chunkSize, (i + 1) * chunkSize));
-    const willDispatch = slice(budgeted).some((chunk) => chunk.length > 0 && !chunk.every((memory) => isHotCapturedMemory(memory.filePath)));
-    if (llmRunner && willDispatch)
+    if (llmRunner && budgeted.length > 0)
         assertRunnerCredentials(llmRunner);
     const { ordered, embedTelemetry } = await clusterMemoriesBySimilarity(budgeted, config, stateDb, opts.signal);
     const chunks = slice(ordered);