akm-cli 0.10.261012-beta → 0.10.261014-beta

package/dist/core/write-source.js

@@ -49,26 +49,42 @@ export function resolveWritable(entry) {
         return entry.writable;
     return entry.type === "filesystem";
 }
+/**
+ * Whether a resolved source is write-activated. Only the primary stash and
+ * sources explicitly marked `writable: true` are writable; registry-cached
+ * (installed, read-only) sources are never written in place because
+ * `akm update` overwrites them.
+ */
+export function isSourceWriteActivated(source) {
+    return source.writable === true;
+}
 /** The two kinds writes are defined for; scheduler state binds only to these. */
 export function isWriteCapableSourceKind(kind) {
     return kind === "filesystem" || kind === "git";
 }
+/**
+ * Throw when `name` is a configured bundle that is disabled. Callers run it
+ * after a name failed to resolve against the active set, so a disabled bundle
+ * is reported as disabled rather than as not configured.
+ */
+export function assertBundleNotDisabled(akmConfig, name) {
+    if (resolveConfiguredSources(akmConfig).some((source) => source.name === name)) {
+        throw new UsageError(`Bundle "${name}" is disabled.`, "INVALID_FLAG_VALUE");
+    }
+}
 /**
  * Resolve the destination for a write: explicit `--bundle`, then
  * `defaultWriteTarget`, then the working stash (`defaultBundle`). There is no
  * fallback to the first writable source.
  */
 export function resolveWriteTarget(akmConfig, explicitTarget, options = {}) {
-    const allConfiguredSources = resolveConfiguredSources(akmConfig);
     const configuredSources = resolveActiveConfiguredSources(akmConfig);
     const requireWritable = options.requireWritable !== false;
     const flag = options.flag ?? "--bundle";
     if (explicitTarget) {
         const match = configuredSources.find((s) => s.name === explicitTarget);
         if (!match) {
-            if (allConfiguredSources.some((source) => source.name === explicitTarget)) {
-                throw new UsageError(`Bundle "${explicitTarget}" is disabled.`, "INVALID_FLAG_VALUE");
-            }
+            assertBundleNotDisabled(akmConfig, explicitTarget);
             throw new UsageError(`${flag} must reference a source name from your config. No source named "${explicitTarget}" is configured. Run \`akm bundle list\` to see available sources.`, "INVALID_FLAG_VALUE");
         }
         if (requireWritable && !resolveWritable({ type: match.type, writable: match.writable })) {

package/dist/execution/input-contract.js

@@ -6,15 +6,12 @@
  * `src/workflows/ir/params.ts` (workflow parameters) into a contract-shaped
  * vocabulary both workflow params AND task source v4's `inputs:`
  * declarations consume — one validation/coercion implementation, injected
- * per-caller diagnostics (D3-N3). Binding boundary: `src/execution/**` must
- * never import `src/workflows/**` (D3-N1) — `INPUT_NAME_PATTERN` and the
+ * per-caller diagnostics. Binding boundary: `src/execution/**` must
+ * never import `src/workflows/**` — `INPUT_NAME_PATTERN` and the
  * canonical-JSON helpers are therefore defined locally rather than imported
- * from the workflow side (D3-N1/D3-N2), verified by
+ * from the workflow side, verified by
  * `tests/execution/input-contract.test.ts`'s purity/byte-equality scans.
  * Pure module: no IO, no engine imports.
- *
- * See docs/architecture/decisions/0004-task-input-contract-and-flag-coercion.md
- * for the full generalization history and the D3-N1/D3-N2/D3-N3 rationale.
  */
 import { createHash } from "node:crypto";
 import { validateJsonSchemaSubset } from "../core/json-schema.js";

package/dist/execution/notices.js

@@ -0,0 +1,49 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/**
+ * The one place lowering notices from several sources become one list.
+ *
+ * Notices are live execution metadata only: executor, report and output paths
+ * merge them, result and evidence journal writers never do.
+ */
+import { sortExecutionJson } from "./json.js";
+/**
+ * Merge notices in first-seen order, each once. Two notices are the same when
+ * everything about them is, `details` included and key order aside, so two
+ * genuinely different structured diagnostics are not collapsed because their
+ * headline fields match. `undefined` when there are none.
+ */
+export function mergeNotices(...groups) {
+    const merged = new Map();
+    for (const group of groups) {
+        for (const notice of group ?? []) {
+            const key = JSON.stringify(sortExecutionJson(notice));
+            if (!merged.has(key))
+                merged.set(key, notice);
+        }
+    }
+    return merged.size > 0 ? Object.freeze([...merged.values()]) : undefined;
+}
+const NONE = Object.freeze([]);
+/**
+ * The notices a run's dispatches report as they go, merged when read.
+ * `forward` also receives each batch as it arrives.
+ */
+export function noticeSet(forward) {
+    const groups = [];
+    const add = (notices) => {
+        groups.push(notices);
+        forward?.(notices);
+    };
+    const list = () => mergeNotices(...groups) ?? NONE;
+    return {
+        add,
+        list,
+        /** `{ notices }` for a result that carries them, `{}` when there are none. */
+        fields: () => {
+            const notices = mergeNotices(...groups);
+            return notices ? { notices } : {};
+        },
+    };
+}

package/dist/execution/resolved-request.js

@@ -3,25 +3,14 @@
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import { sortExecutionJson } from "./json.js";
 import { decodeExecutionSourceIdentity, } from "./source.js";
-export const RESOLVED_EXECUTION_SCHEMA_VERSION = 1;
-const COMMAND_KEYS = ["template", "argumentInput", "content", "source", "extensions"];
-const PERSONA_KEYS = ["content", "source", "extensions"];
-const ENGINE_KEYS = ["name", "kind", "platform", "settings", "extensions"];
-const MODEL_KEYS = ["input", "interpretation", "resolved", "extensions"];
-const AUTHORIZATION_KEYS = ["status", "reason", "policy"];
-const RUNTIME_KEYS = ["timeoutMs", "workspace", "environment", "settings", "extensions"];
-const NOTICE_KEYS = ["code", "severity", "adapter", "field", "message", "details"];
+export const RESOLVED_EXECUTION_SCHEMA_VERSION = 2;
+const COMMAND_KEYS = ["template", "argumentInput", "content", "source"];
+const PERSONA_KEYS = ["content", "source"];
+const TARGET_KEYS = ["name", "kind", "platform"];
+const MODEL_KEYS = ["model", "alias"];
+const RUNTIME_KEYS = ["timeoutMs", "workspace", "environment"];
 const IDENTITY_KEYS = ["ref", "bundle", "adapter", "file", "hash"];
-const OPTIONAL_REQUEST_KEYS = [
-    "conversation",
-    "agent",
-    "persona",
-    "model",
-    "inference",
-    "outputSchema",
-    "tools",
-    "extensions",
-];
+const OPTIONAL_REQUEST_KEYS = ["conversation", "agent", "persona", "model", "inference", "outputSchema"];
 /** Copy the own, defined fields named by `keys`; omitted stays omitted, `null` stays `null`. */
 function pick(value, keys) {
     const record = value;
@@ -46,7 +35,6 @@ export function createResolvedCommand(input) {
         ...(input.argumentInput !== undefined ? { argumentInput: input.argumentInput } : {}),
         content: input.content,
         source: decodeExecutionSourceIdentity(input.source.identity),
-        ...(input.source.extensions ? { extensions: input.source.extensions } : {}),
     });
 }
 export function createInlineResolvedCommand(input) {
@@ -64,28 +52,27 @@ export function createResolvedPersona(source) {
     return Object.freeze({
         content: source.content,
         source: decodeExecutionSourceIdentity(source.identity),
-        ...(source.extensions ? { extensions: source.extensions } : {}),
     });
 }
 /** Freeze one request without normalizing away optional-field presence. */
 export function createResolvedExecutionRequest(input) {
-    if (!input.command || !input.engine || !input.authorization || !input.runtime || !input.notices) {
-        throw new TypeError("resolved execution request requires command, engine, authorization, runtime, and notices");
+    if (!input.command || !input.target || !input.runtime || typeof input.modelWork !== "boolean") {
+        throw new TypeError("resolved execution request requires command, target, modelWork, and runtime");
     }
     const out = {
         schemaVersion: RESOLVED_EXECUTION_SCHEMA_VERSION,
         command: input.command,
-        engine: input.engine,
-        authorization: input.authorization,
+        target: input.target,
+        modelWork: input.modelWork,
         runtime: input.runtime,
-        notices: input.notices,
         ...pick(input, OPTIONAL_REQUEST_KEYS),
     };
     return Object.freeze(out);
 }
 /**
  * Rehydrate a frozen JSON request after workflow resume/replay. Tolerant of
- * unknown keys; refuses only a request written by a newer schema.
+ * unknown keys; refuses a request of any other schema version: an earlier
+ * release's names an engine and cannot run now.
  */
 export function decodeResolvedExecutionRequest(value) {
     const input = requireRecord(value, "resolved execution request");
@@ -99,22 +86,20 @@ export function decodeResolvedExecutionRequest(value) {
     if (typeof command.template !== "string" || typeof command.content !== "string") {
         throw new TypeError("command template and content must be strings");
     }
-    const engine = requireRecord(input.engine, "engine");
-    if (typeof engine.name !== "string" || (engine.kind !== "agent" && engine.kind !== "sdk" && engine.kind !== "llm")) {
-        throw new TypeError("engine.name must be a string and engine.kind must be agent, sdk, or llm");
+    const target = requireRecord(input.target, "target");
+    if (typeof target.name !== "string" || (target.kind !== "connection" && target.kind !== "harness")) {
+        throw new TypeError("target.name must be a string and target.kind must be connection or harness");
     }
-    const notices = input.notices;
-    if (!Array.isArray(notices))
-        throw new TypeError("notices must be an array");
+    if (typeof input.modelWork !== "boolean")
+        throw new TypeError("modelWork must be a boolean");
     const request = {
         command: Object.freeze({
             ...pick(command, COMMAND_KEYS),
             source: command.source === null ? null : decodeExecutionSourceIdentity(command.source, "command.source"),
         }),
-        engine: Object.freeze(pick(engine, ENGINE_KEYS)),
-        authorization: Object.freeze(pick(requireRecord(input.authorization, "authorization"), AUTHORIZATION_KEYS)),
+        target: Object.freeze(pick(target, TARGET_KEYS)),
+        modelWork: input.modelWork,
         runtime: Object.freeze(pick(requireRecord(input.runtime, "runtime"), RUNTIME_KEYS)),
-        notices: Object.freeze(notices.map((notice, index) => Object.freeze(pick(requireRecord(notice, `notices[${index}]`), NOTICE_KEYS)))),
     };
     if (Array.isArray(input.conversation)) {
         request.conversation = Object.freeze(input.conversation.map((message, index) => Object.freeze(pick(requireRecord(message, `conversation[${index}]`), ["role", "content"]))));
@@ -135,7 +120,7 @@ export function decodeResolvedExecutionRequest(value) {
     if (Object.hasOwn(input, "model") && input.model !== undefined) {
         request.model = input.model === null ? null : Object.freeze(pick(requireRecord(input.model, "model"), MODEL_KEYS));
     }
-    for (const key of ["inference", "outputSchema", "tools", "extensions"]) {
+    for (const key of ["inference", "outputSchema"]) {
         if (Object.hasOwn(input, key) && input[key] !== undefined)
             request[key] = input[key];
     }
@@ -149,10 +134,9 @@ export function canonicalResolvedExecutionRequest(request) {
             ...pick(request.command, COMMAND_KEYS),
             source: request.command.source === null ? null : pick(request.command.source, IDENTITY_KEYS),
         },
-        engine: pick(request.engine, ENGINE_KEYS),
-        authorization: pick(request.authorization, AUTHORIZATION_KEYS),
+        target: pick(request.target, TARGET_KEYS),
+        modelWork: request.modelWork,
         runtime: pick(request.runtime, RUNTIME_KEYS),
-        notices: request.notices.map((notice) => pick(notice, NOTICE_KEYS)),
     };
     if (request.conversation !== undefined) {
         wire.conversation = request.conversation.map((message) => ({ role: message.role, content: message.content }));
@@ -168,7 +152,7 @@ export function canonicalResolvedExecutionRequest(request) {
     if (Object.hasOwn(request, "model") && request.model !== undefined) {
         wire.model = request.model === null ? null : pick(request.model, MODEL_KEYS);
     }
-    for (const key of ["inference", "outputSchema", "tools", "extensions"]) {
+    for (const key of ["inference", "outputSchema"]) {
         if (Object.hasOwn(request, key) && request[key] !== undefined)
             wire[key] = request[key];
     }

package/dist/execution/source.js

@@ -1,42 +1,34 @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
-import { cloneExecutionJson, cloneExecutionJsonObject } from "./json.js";
+import { warnOnce } from "../core/warn.js";
+import { cloneExecutionJsonObject } from "./json.js";
 export const EXECUTION_SOURCE_SCHEMA_VERSION = 1;
 /** Current internal adapter identifiers are lowercase kebab-case registry keys. */
 export const EXECUTION_ADAPTER_ID_PATTERN = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
-/**
- * The model-work tool policy: unattended model work (improve, the judges, index
- * passes, remember) may read, edit only inside the dispatch's own scratch
- * working directory, and run `akm search` and `akm show`; the stash stays
- * read-only to it. A transport grants what it can confine and refuses the policy
- * at build when it can confine nothing; an LLM has no tools. A request carries it
- * as `authorization.policy.id`, set only when its caller asks (`modelWork`): no
- * `tools` value names it, so an asset's own `tools:` cannot.
- */
-export const MODEL_WORK_POLICY_ID = "model-work";
+/** What an asset that still says `engine:` is told, once. */
+export function warnRetiredEngineKey() {
+    warnOnce("asset-engine-key-retired", "`engine` is retired; use `connection:` or `harness:`.");
+}
+/** Those settings as one layer's defaults. A setting that is absent says nothing; `null` is a real value. */
+export function executionDefaultsOf(settings) {
+    if (!settings)
+        return {};
+    return {
+        ...(settings.connection !== undefined ? { connection: settings.connection } : {}),
+        ...(settings.harness !== undefined ? { harness: settings.harness } : {}),
+        ...(settings.engine !== undefined ? { engine: settings.engine } : {}),
+        ...(settings.model !== undefined ? { model: settings.model } : {}),
+        ...(settings.llm !== undefined ? { inference: cloneExecutionJsonObject(settings.llm, "inference") } : {}),
+        ...(settings.timeoutMs !== undefined ? { timeout: settings.timeoutMs } : {}),
+    };
+}
 function requireRecord(value, path) {
     if (value === null || typeof value !== "object" || Array.isArray(value)) {
         throw new TypeError(`${path} must be an object`);
     }
     return value;
 }
-export function createAdapterExtensions(first, second, ...rest) {
-    const entries = typeof first === "string"
-        ? [[first, second]]
-        : [first, ...(second === undefined ? [] : [second]), ...rest];
-    const out = {};
-    for (const [owner, values] of entries)
-        out[owner] = cloneExecutionJsonObject(values, `extensions.${owner}`);
-    return Object.freeze(out);
-}
-export function cloneAdapterExtensions(value, path) {
-    const out = {};
-    for (const [owner, fields] of Object.entries(requireRecord(value, path))) {
-        out[owner] = cloneExecutionJsonObject(fields, `${path}.${owner}`);
-    }
-    return Object.freeze(out);
-}
 /** A selector or layer identifier that may cross the durable execution boundary. */
 export function requireStableExecutionSelector(value, path) {
     if (typeof value !== "string" || value.length === 0 || value.trim() !== value) {
@@ -75,7 +67,7 @@ export function cloneUnresolvedExecutionDefaults(input, path = "execution source
     const record = requireRecord(input, path);
     const present = (key) => Object.hasOwn(record, key) && record[key] !== undefined;
     const out = {};
-    for (const key of ["agent", "engine", "model", "workspace"]) {
+    for (const key of ["agent", "connection", "harness", "engine", "model", "workspace"]) {
         if (!present(key))
             continue;
         const value = record[key];
@@ -90,7 +82,7 @@ export function cloneUnresolvedExecutionDefaults(input, path = "execution source
         }
         out.timeout = timeout;
     }
-    for (const key of ["inference", "outputSchema", "runtime"]) {
+    for (const key of ["inference", "outputSchema"]) {
         if (!present(key))
             continue;
         out[key] = record[key] === null ? null : cloneExecutionJsonObject(record[key], `${path}.${key}`);
@@ -102,21 +94,8 @@ export function cloneUnresolvedExecutionDefaults(input, path = "execution source
         }
         out.environment = environment;
     }
-    if (present("tools"))
-        out.tools = cloneToolSelection(record.tools, `${path}.tools`);
     return Object.freeze(out);
 }
-export function cloneToolSelection(value, path = "tools") {
-    if (value === null || typeof value === "string")
-        return value;
-    const cloned = cloneExecutionJson(value, path);
-    if (Array.isArray(cloned)) {
-        if (cloned.some((tool) => typeof tool !== "string"))
-            throw new TypeError(`${path} array values must be strings`);
-        return cloned;
-    }
-    return cloneExecutionJsonObject(cloned, path);
-}
 export function createAdapterRenderedExecutionSource(input) {
     const { kind, content } = input;
     if (kind !== "command" && kind !== "persona")
@@ -129,8 +108,5 @@ export function createAdapterRenderedExecutionSource(input) {
         content,
         defaults: cloneUnresolvedExecutionDefaults(input.defaults ?? {}),
         identity: createExecutionSourceIdentity(input.identity),
-        ...(input.extensions
-            ? { extensions: cloneAdapterExtensions(input.extensions, "execution source extensions") }
-            : {}),
     });
 }

package/dist/execution/target-ref.js

@@ -2,7 +2,7 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 /**
- * The target-ref classifier (P1a Lane B, docs/plans/specs/p1a-with-rejection-classifier.md §4.1).
+ * The target-ref classifier.
  *
  * `classifyTargetRef` is the canonical classifier for a canonical asset ref
  * used as an execution target: `commands/<name>`, `scripts/<name>`,
@@ -20,7 +20,7 @@
  *      first `/` is one of `commands`, `scripts`, `tasks`, `workflows`;
  *   5. the name segment after the first `/` is non-empty.
  *
- * Explicit non-goals (binding, spec §4.1): no GitHub locator grammar, no
+ * Explicit non-goals: no GitHub locator grammar, no
  * `akm/command` builtin special case, no resolution, no filesystem access, no
  * guessing.
  */

package/dist/indexer/bundle-identity-guard.js

@@ -5,7 +5,7 @@
  * §11.5 bundle-rename startup guard.
  *
  * Renaming a workspace bundle id is a mass identity migration (every ref in the
- * bundle changes without any file moving) and MUST go through the future
+ * bundle changes without any file moving) and MUST go through the
  * explicit `akm bundle rename <old> <new>` command, which rekeys the index +
  * every ref-keyed state table atomically. If a user instead hand-edits the
  * `bundles` KEY in config.json, the durable index/state rows still carry the OLD
@@ -131,8 +131,9 @@ export function warnOnBundleRenameDrift(config = loadConfig()) {
     warn("WARNING: bundle identity drift detected. " +
         `Configured bundle(s) with no indexed content: ${renamedConfiguredIds.map((id) => `"${id}"`).join(", ")}; ` +
         `indexed content under unconfigured bundle id(s): ${renamedOldIds.map((id) => `"${id}"`).join(", ")}. ` +
-        "This is the signature of a hand-renamed bundle id (spec §11.5). AKM will NOT silently re-mint fresh state " +
-        "under the new id. There is no rekey command in 0.9.0: either restore the previous bundle id in config.json " +
-        "to reattach the existing rows, or keep the new id and run `akm index --full` to re-mint under it, accepting " +
-        "that learned state (utility, salience, outcomes, usage history) keyed to the old id is left behind.");
+        "This is the signature of a hand-renamed bundle id. AKM will NOT silently re-mint fresh state " +
+        "under the new id. To keep the learned state, restore the previous bundle id in config.json and rename it with " +
+        "`akm bundle rename <old> <new>`, which rekeys the config, the index and akm's state together; or keep the new " +
+        "id and run `akm index --full` to re-mint under it, accepting that learned state (utility, salience, outcomes, " +
+        "usage history) keyed to the old id is left behind.");
 }

package/dist/indexer/ensure-index.js

@@ -225,7 +225,7 @@ export async function ensureIndex(stashDir, options = {}) {
         // Blocking callers (improve's planning preflight) are a sanctioned
         // materialization point and hydrate cache-backed sources as usual. The
         // background READ path (`show` auto-index) must never clone/pull/fetch at
-        // query time (spec §14.3 / D11): it builds from already-materialized
+        // query time: it builds from already-materialized
         // content, and absent source caches are skipped with a warning.
         ...(blocking ? {} : { hydrateSources: false }),
     });

package/dist/indexer/index-writer-lock.js

@@ -16,7 +16,7 @@
  * longer take any lease.
  *
  * What remains here guards actual data loss (a lost or conflicting git
- * commit), so per AGENTS.md `## Defensive Code` it stays — but with the same
+ * commit), so core principle 1's data-loss exemption keeps it — but with the same
  * fix applied: no age-based stale-reclaim. A holder is only ever reclaimed
  * once its PID is verifiably dead; a live-but-wedged holder makes an
  * acquisition attempt wait (bounded by `maxWaitMs`) or fail, never silently

package/dist/indexer/indexer.js

@@ -12,6 +12,8 @@ import { getDbPath } from "../core/paths.js";
 import { SCRIPT_EXTENSIONS } from "../core/recognition-util.js";
 import { withStateDb } from "../core/state-db.js";
 import { isVerbose, warn, warnOnce, warnVerbose } from "../core/warn.js";
+import { localEmbeddingRuntime } from "../llm/embedder.js";
+import { effectiveEmbedding } from "../llm/embedders/connection.js";
 import { resolveSourcesForOrigin } from "../registry/origin-resolve.js";
 import { closeDatabase, openExistingDatabase, openIndexDatabase, openReadonlyExistingDatabase, } from "../storage/repositories/index-connection.js";
 import { deleteEntriesByBundle, deleteEntriesByDirAndBundle, deleteEntriesByDirExceptRefs, deleteEntriesByIds, deleteUsageEventsByEntryIds, findEntryIdByRef, getAllEntries, getEmbeddableEntryCount, getEntryCount, getIndexedBundleIdsByDir, getIndexedDirPathsByBundleId, relinkUsageEvents, upsertEntry, } from "../storage/repositories/index-entries-repository.js";
@@ -25,12 +27,13 @@ import { INDEX_DB_VACUUMED_EVENT, readFreelistInfo, vacuumIfReclaimable } from "
 import { assertIndexedWorkflowSourceIdentity, WorkflowSourceIdentityError } from "../workflows/source-files.js";
 import { reclassifyIndexDbContention } from "./index-db-contention.js";
 import { deriveEntryProvenance, deriveInstallations } from "./installations.js";
-import { indexedPathMatchesOwner, resolveAdapterConceptOwner, } from "./lookup/adapter-concept-owner.js";
+import { indexedPathMatchesOwner, resolveConceptOwner } from "./lookup/adapter-concept-owner.js";
 import { generateEmbeddingsForDb } from "./materialize-embeddings.js";
 import { canUseIncrementalSkip, computeDirFingerprint, getCachedDirState, getDirIndexState, inferZeroRowReason, } from "./passes/dir-staleness.js";
 import { isWorkflowSkipWarning, withFileSize } from "./passes/metadata.js";
 import { drainDirDocuments } from "./scan/drain-dir.js";
 import { purgeOldUsageEvents, USAGE_EVENT_RETENTION_DAYS } from "./usage/usage-events.js";
+import { SEMANTIC_SEARCH_META_KEY, } from "./walk/index-context.js";
 import { walkStashFlatWithStatus } from "./walk/walker.js";
 function throwIfAborted(signal) {
     if (signal?.aborted) {
@@ -104,7 +107,7 @@ function applyRemovedSources(db, sources, removedSources, isIncremental) {
 /**
  * The embedding phase (#954): generate and store vectors for every entry
  * missing one, then compute the `hasEmbeddings` fact and the semantic-search
- * verification off the result. `db` must have no ambient transaction open —
+ * verification off the result, and record it for `akm health`. `db` must have no ambient transaction open —
  * each per-batch commit is its own durable write.
  */
 export async function runEmbeddingPass(params) {
@@ -116,6 +119,15 @@ export async function runEmbeddingPass(params) {
     const semanticEntryCount = getEmbeddableEntryCount(db);
     onProgress({ phase: "finalize", message: "Verifying semantic search state." });
     const verification = verifyIndexState(db, config, semanticEntryCount, embeddingResult);
+    const unavailable = verification.semanticStatus === "blocked" ? embeddingResult.runtimeUnavailable : undefined;
+    const record = {
+        status: unavailable ? "unavailable" : verification.semanticStatus,
+        ...(unavailable ? { unavailable } : {}),
+        provider: verification.embeddingProvider,
+        ...(verification.embeddingRuntime ? { runtime: verification.embeddingRuntime } : {}),
+        ...(verification.ok ? {} : { reason: verification.message }),
+    };
+    setMeta(db, SEMANTIC_SEARCH_META_KEY, JSON.stringify(record));
     onProgress({ phase: "verify", message: verification.message });
     return { embeddingResult, verification };
 }
@@ -384,7 +396,6 @@ async function akmIndexReal(options) {
     // path. `secret-seam` is imported here, never from inside the cycle.
     const { storeSecretResolver } = await import("../sources/snapshot-fetchers/secret-seam.js");
     await ensureSourceCaches(config, {
-        force: full,
         materialize: options.hydrateSources !== false,
         secrets: storeSecretResolver,
         // Same progress channel as every other phase (#954) — a
@@ -423,7 +434,7 @@ async function akmIndexReal(options) {
                 mode,
                 sourcesCount: sourceDirs.length,
                 semanticSearchMode: config.semanticSearchMode,
-                embeddingProvider: getEmbeddingProvider(config.embedding),
+                embeddingProvider: getEmbeddingProvider(effectiveEmbedding(config)),
             }),
         });
         const removedSources = findRemovedSources(db, sources);
@@ -669,9 +680,6 @@ function buildSourceScanPlans(db, allSourceEntries, isIncremental, reconcileMiss
         }
         const walked = walkStashFlatWithStatus(currentStashDir, {
             includeAllDirectories: component.adapter === "okf",
-            ...(component.adapter === "akm" || component.adapter === "akm-workflow"
-                ? { workflowSymlinkAdapter: component.adapter }
-                : {}),
         });
         const dirGroups = groupFileContextsByDir(walked.files);
         const adapter = adapterForId(component.adapter);
@@ -961,7 +969,7 @@ function persistDirRecords(db, dirRecords, warnings, bundleByRoot) {
                 }
                 continue;
             }
-            // Diff-persist (F4a M-core-2, spec §14.2): upsert the current file set
+            // Diff-persist: upsert the current file set
             // FIRST (ON CONFLICT preserving `entries.id` so embeddings / utility /
             // usage stay attached to unchanged rows), tracking every upserted
             // durable `item_ref`, then prune only the departed rows below. Replaces the old
@@ -1091,7 +1099,8 @@ function getEmbeddingProvider(embedding) {
 }
 function verifyIndexState(db, config, embeddableEntries, embeddingResult) {
     const embeddingCount = getEmbeddingCount(db);
-    const embeddingProvider = getEmbeddingProvider(config.embedding);
+    const embeddingProvider = getEmbeddingProvider(effectiveEmbedding(config));
+    const embeddingRuntime = embeddingProvider === "local" ? localEmbeddingRuntime() : undefined;
     const verification = (ok, message, semanticSearchEnabled, semanticStatus, guidance) => ({
         ok,
         message,
@@ -1100,6 +1109,7 @@ function verifyIndexState(db, config, embeddableEntries, embeddingResult) {
         semanticSearchMode: config.semanticSearchMode,
         semanticStatus,
         embeddingProvider,
+        ...(embeddingRuntime !== undefined ? { embeddingRuntime } : {}),
         entryCount: embeddableEntries,
         embeddingCount,
     });
@@ -1132,10 +1142,8 @@ borrowed = false) {
     const sources = await resolveLookupSources();
     if (sources.length === 0)
         return { entry: null };
-    const bundleBySourcePath = new Map(sourceComponents(sources).map((component, index) => [path.resolve(sources[index].path), component.id]));
     const qualified = Boolean(ref.bundle);
-    const candidateSources = ref.bundle ? resolveSourcesForOrigin(ref.bundle, sources) : sources;
-    if (candidateSources.length === 0)
+    if ((ref.bundle ? resolveSourcesForOrigin(ref.bundle, sources) : sources).length === 0)
         return { entry: null };
     let db;
     let indexError;
@@ -1151,42 +1159,38 @@ borrowed = false) {
         ...(indexError === undefined ? {} : { indexError }),
     });
     try {
-        for (const source of candidateSources) {
-            const adapterId = source.adapterId ?? detectAdapterId(source.path);
-            const owner = resolveAdapterConceptOwner(source.path, adapterId, ref.conceptId);
-            const lookupConceptId = owner?.conceptId ?? ref.conceptId;
-            const inputRef = makeBundleRef(qualified ? ref.bundle : undefined, lookupConceptId);
-            const sourceBundleId = bundleBySourcePath.get(path.resolve(source.path));
-            const id = db && sourceBundleId ? findEntryIdByRef(db, inputRef, sourceBundleId) : undefined;
-            if (id !== undefined && owner && db) {
-                const entry = readLookupEntry(db, id, ref.conceptId, source.path);
-                if (entry) {
-                    if (owner.workflowSource) {
-                        try {
-                            assertIndexedWorkflowSourceIdentity(inputRef, entry.filePath, owner.workflowSource);
-                            if (entry.adapterId !== adapterId) {
-                                throw new WorkflowSourceIdentityError(inputRef, entry.filePath, owner.path);
-                            }
-                        }
-                        catch (error) {
-                            if (!(error instanceof WorkflowSourceIdentityError))
-                                throw error;
-                            warn(`${error.message} Falling back to the physical owner.`);
-                            return resolved(null, owner);
+        const match = resolveConceptOwner(ref, sources);
+        if (!match)
+            return resolved(null);
+        const { owner, source, bundleId, adapterId } = match;
+        const inputRef = makeBundleRef(qualified ? ref.bundle : undefined, owner.conceptId);
+        const id = db ? findEntryIdByRef(db, inputRef, bundleId) : undefined;
+        if (id !== undefined && db) {
+            const entry = readLookupEntry(db, id, ref.conceptId, source.path);
+            if (entry) {
+                if (owner.workflowSource) {
+                    try {
+                        assertIndexedWorkflowSourceIdentity(inputRef, entry.filePath, owner.workflowSource);
+                        if (entry.adapterId !== adapterId) {
+                            throw new WorkflowSourceIdentityError(inputRef, entry.filePath, owner.path);
                         }
                     }
-                    else if (entry.adapterId !== adapterId || !indexedPathMatchesOwner(entry.filePath, owner)) {
+                    catch (error) {
+                        if (!(error instanceof WorkflowSourceIdentityError))
+                            throw error;
+                        warn(`${error.message} Falling back to the physical owner.`);
                         return resolved(null, owner);
                     }
-                    return resolved(entry, owner);
                 }
+                else if (entry.adapterId !== adapterId || !indexedPathMatchesOwner(entry.filePath, owner)) {
+                    return resolved(null, owner);
+                }
+                return resolved(entry, owner);
             }
-            // A physical owner with a missing/incomplete index row still owns this
-            // unqualified concept. Stop here so a later source cannot retarget it.
-            if (owner)
-                return resolved(null, owner);
         }
-        return resolved(null);
+        // A physical owner with a missing/incomplete index row still owns this
+        // concept: no later source can retarget it.
+        return resolved(null, owner);
     }
     finally {
         if (db && !borrowed)
@@ -1290,7 +1294,7 @@ function readLookupEntry(db, id, fallbackConceptId, sourceRoot) {
     };
 }
 /**
- * Look up a single asset by ref. Spec §6.2 — `akm show` queries this and
+ * Look up a single asset by ref. `akm show` queries this and
  * reads the file from disk. The index is the source of truth for which
  * file corresponds to which ref; the indexer walks `provider.path()` for
  * every configured source, so this query covers all source kinds.