akm-cli 0.10.261012-beta → 0.10.261014-beta

package/dist/sources/resolve.js

@@ -6,11 +6,14 @@ import path from "node:path";
 import { recognizeMatch } from "../core/adapter/recognize-match.js";
 import { assetPathForName, deriveCanonicalAssetNameFromStashRoot, isRelevantAssetFile, stashDirFor, } from "../core/asset/asset-placement.js";
 import { conceptIdFromTypeName } from "../core/asset/resolve-ref.js";
-import { hasErrnoCode, isWithin } from "../core/common.js";
+import { hasErrnoCode, isContainedResolvedPath } from "../core/common.js";
 import { NotFoundError, UsageError } from "../core/errors.js";
 import { walkStashFlat } from "../indexer/walk/walker.js";
 /**
- * Resolve an asset path from a stash directory, type, and name.
+ * Resolve an asset path from a stash directory, type, and name. The path keeps
+ * the authored spelling, not the symlink target's: an asset that links to a
+ * file with another name (or none) is still the kind its own name says, and a
+ * read through it reaches the same bytes.
  */
 export async function resolveAssetPath(stashDir, type, name) {
     try {
@@ -31,25 +34,24 @@ export async function resolveAssetPath(stashDir, type, name) {
 function resolveInTypeDir(stashDir, typeDir, type, name) {
     const root = path.join(stashDir, typeDir);
     const target = assetPathForName(type, root, name);
-    const resolvedRoot = resolveAndValidateTypeRoot(root, type, name);
+    resolveAndValidateTypeRoot(root, type, name);
     const resolvedTarget = path.resolve(target);
-    if (!isWithin(resolvedTarget, resolvedRoot)) {
+    // Name grammar: the name must not climb out of the type directory (`..` or
+    // an absolute name). Lexical only: an asset that is a symlink to a file
+    // elsewhere resolves, because installing a bundle is the trust decision.
+    if (!isContainedResolvedPath(resolvedTarget, path.resolve(root))) {
         throw new UsageError("Ref resolves outside the stash root.", "PATH_ESCAPE_VIOLATION");
     }
     if (!fs.existsSync(resolvedTarget) || !fs.statSync(resolvedTarget).isFile()) {
         throw new NotFoundError(`Stash asset not found for ref: ${conceptIdFromTypeName(type, name)}`, "ASSET_NOT_FOUND");
     }
-    const realTarget = fs.realpathSync(resolvedTarget);
-    if (!isWithin(realTarget, resolvedRoot)) {
-        throw new UsageError("Ref resolves outside the stash root.", "PATH_ESCAPE_VIOLATION");
-    }
     if (!isRelevantAssetFile(type, path.basename(resolvedTarget))) {
         if (type === "script") {
             throw new NotFoundError("Script ref must resolve to a file with a supported script extension. Refer to the akm documentation for the complete list of supported script extensions.");
         }
         throw new NotFoundError(`Stash asset not found for ref: ${conceptIdFromTypeName(type, name)}`, "ASSET_NOT_FOUND");
     }
-    return realTarget;
+    return resolvedTarget;
 }
 function resolveAndValidateTypeRoot(root, type, name) {
     const rootStat = readTypeRootStat(root, type, name);
@@ -57,7 +59,6 @@ function resolveAndValidateTypeRoot(root, type, name) {
         throw new NotFoundError(`Asset directory for ${type} assets is not accessible — got a file where a directory was expected for ref: ${conceptIdFromTypeName(type, name)}. ` +
             "Run `akm index` to rebuild the index, or check your source configuration.", "ASSET_NOT_FOUND", "Run `akm bundle list` to see your configured sources and verify the source path exists.");
     }
-    return fs.realpathSync(root);
 }
 function readTypeRootStat(root, type, name) {
     try {
@@ -79,12 +80,7 @@ async function resolveByCanonicalName(stashDir, type, name) {
         const canonicalName = deriveCanonicalAssetNameFromStashRoot(type, stashDir, ctx.absPath);
         if (canonicalName !== normalizedName)
             continue;
-        const realTarget = fs.realpathSync(ctx.absPath);
-        const resolvedRoot = fs.realpathSync(stashDir);
-        if (!isWithin(realTarget, resolvedRoot)) {
-            throw new UsageError("Ref resolves outside the stash root.", "PATH_ESCAPE_VIOLATION");
-        }
-        return realTarget;
+        return ctx.absPath;
     }
     return undefined;
 }

package/dist/sources/snapshot-fetchers/robots.js

@@ -4,8 +4,7 @@
 /**
  * robots.txt parsing, matching, and a crawl-scoped fetch/cache policy.
  *
- * Behavioral reference: docs/plans/specs/p1-robots.md (authoritative). This
- * module is a clean rewrite against akm's contracts, not a port of any
+ * This module is a clean rewrite against akm's contracts, not a port of any
  * upstream source file.
  *
  * Pure by design: no fetching happens here (see `RobotsTxtLoader`/
@@ -14,7 +13,7 @@
  * `createRobotsPolicy` returns so it dies with the crawl that created it —
  * a module-level `origin -> RobotsRuleSet` map would leak `disallowAll`
  * results across crawls and across the test suite's process-wide `bun test`
- * run (see spec §6.1). The module-level `WeakMap` below is a different
+ * run. The module-level `WeakMap` below is a different
  * category: it memoizes a pure function of an individual rule object's own
  * `pattern` field, keyed by that object's identity. It cannot leak meaning
  * between origins or tests — distinct `parseRobotsTxt` calls (even for
@@ -40,7 +39,7 @@ export const ROBOTS_USER_AGENT_HEADER = "akm-cli website provider";
 /**
  * Frozen so a stray mutation (e.g. an accidental `.rules.push(...)` somewhere
  * that borrows one of these as a starting point) can never poison every other
- * crawl sharing this instance (spec §10, Review log 2026-08-01 finding 1).
+ * crawl sharing this instance.
  */
 const EMPTY_ROBOTS_RULES = Object.freeze([]);
 export const ALLOW_ALL_RULES = Object.freeze({
@@ -128,8 +127,8 @@ export function parseRobotsTxt(text) {
                 pattern: value,
                 specificity: value.length,
             };
-            // Compile once, here, at parse time — not on every URL check (spec
-            // §6.4, review finding robots.ts:238). See `compiledPatternCache`.
+            // Compile once, here, at parse time — not on every URL check. See
+            // `compiledPatternCache`.
             compiledPatternCache.set(rule, compilePatternSegments(value));
             current.rules.push(rule);
             continue;
@@ -185,7 +184,7 @@ function isUnreservedByte(byte) {
  * fallback) and match targets (`isPathAllowedByRobots`), so a percent-encoded
  * alias of a disallowed path — e.g. a link written as `/%73ecret/` — cannot
  * bypass `Disallow: /secret/` simply because `URL.pathname` preserves
- * %-escapes verbatim. Reserved-octet patterns like spec §4.3 M-31's
+ * %-escapes verbatim. Reserved-octet patterns like
  * `/caf%C3%A9` are untouched on both sides (0xC3/0xA9 are not unreserved),
  * so they keep matching themselves exactly as before.
  */
@@ -211,10 +210,10 @@ function compilePatternSegments(pattern) {
 }
 /**
  * Per-rule-object cache of the compiled pattern (see the file-level doc
- * comment for why this is not "module-level state" in the sense spec §6.1
- * forbids). `parseRobotsTxt` populates this eagerly, once, when it creates
- * each `RobotsPathRule` — the compile-once requirement from spec §6.4 /
- * review finding robots.ts:238. `compiledPatternFor` below is a defensive
+ * comment for why this is not "module-level state" in the sense that comment
+ * rules out). `parseRobotsTxt` populates this eagerly, once, when it creates
+ * each `RobotsPathRule` — the compile-once requirement.
+ * `compiledPatternFor` below is a defensive
  * fallback for `RobotsRuleSet`s assembled by hand (e.g. test fixtures)
  * rather than via `parseRobotsTxt`; it still compiles at most once per rule
  * object, just lazily on first use instead of at parse time.
@@ -324,7 +323,7 @@ export function createRobotsPolicy(load) {
         const pending = load(robotsUrl).then(outcomeToRuleSet);
         // A rejected fetch must not poison the cache: the next lookup for this
         // origin should retry the loader rather than replaying the same failure
-        // forever (spec §4.4 L-04).
+        // forever.
         pending.catch(() => {
             if (cache.get(origin) === pending)
                 cache.delete(origin);

package/dist/sources/snapshot-fetchers/secret-seam.js

@@ -1,8 +1,8 @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
-import fs from "node:fs";
 import { resolveSecretPath } from "../../core/env-secret-ref.js";
+import { readValue } from "../../core/secret-value.js";
 /**
  * Reads a secret out of akm's secret store for the fetcher `resolveSecret`
  * seam (see `FetcherContext.resolveSecret`).
@@ -21,9 +21,7 @@ import { resolveSecretPath } from "../../core/env-secret-ref.js";
 export function resolveSecretFromStore(ref) {
     try {
         const { absPath } = resolveSecretPath(ref);
-        if (!fs.existsSync(absPath))
-            return null;
-        return fs.readFileSync(absPath, "utf8").trim() || null;
+        return readValue(absPath) || null;
     }
     catch {
         return null;

package/dist/sources/snapshot-fetchers/website-ingest.js

@@ -15,10 +15,6 @@ import { escapeMarkdownStructure } from "./fetcher-util.js";
 import { assertResolvedHostAllowed, assertWebsiteRequestUrl } from "./host-guard.js";
 import { loadWikiSnapshotFetchers } from "./registry.js";
 import { createAllowAllRobotsPolicy, createRobotsPolicy, isPathAllowedByRobots, ROBOTS_BODY_TIMEOUT_MS, ROBOTS_BYTE_CAP, } from "./robots.js";
-/** Refresh website snapshots every 12 hours to balance freshness with scraping load. */
-const CACHE_REFRESH_INTERVAL_MS = 12 * 60 * 60 * 1000;
-/** Allow up to 7 days of stale snapshots when refresh fails so search remains available during outages. */
-const CACHE_STALE_MS = 7 * 24 * 60 * 60 * 1000;
 /** Allow limited breadth-first expansion without letting the crawl queue grow unbounded. */
 const QUEUE_EXPANSION_FACTOR = 5;
 const MAX_PAGES_DEFAULT = 50;
@@ -80,8 +76,6 @@ export async function ensureWebsiteMirror(config, options) {
     const requireStashDir = options?.requireStashDir === true;
     await withFreshnessCache({
         markerPath: cachePaths.manifestPath,
-        ttlMs: CACHE_REFRESH_INTERVAL_MS,
-        staleMs: CACHE_STALE_MS,
         force: options?.force === true,
         isUsable: () => !requireStashDir || hasExtractedSite(cachePaths.stashDir),
         refresh: async () => {
@@ -465,7 +459,7 @@ async function resolveCrawlRobotsDecision(robots, normalizedUrl, rawUrl) {
     return decideRobotsAllowance(rules, normalizedUrl, rawUrl);
 }
 /**
- * C-02/C-03: fail fast, before any page fetch, when the start URL itself is
+ * Fail fast, before any page fetch, when the start URL itself is
  * off-limits per an actually-parsed robots.txt rule. A 5xx on robots.txt
  * itself no longer reaches this as `disallowAll`: `loadRobotsTxt` reports it the same way a
  * 4xx is reported (`ALLOW_ALL_RULES`), with its own warning, rather than
@@ -478,7 +472,7 @@ async function resolveCrawlRobotsDecision(robots, normalizedUrl, rawUrl) {
  * `normalizeSiteUrl` stripped any trailing slash — via
  * `decideRobotsAllowance`. Without this, a start URL typed as `.../secret/`
  * under `Disallow: /secret/` would never match that rule and would be
- * crawled instead of rejected with the spec §4.6 C-02 UsageError; conversely,
+ * crawled instead of rejected with a UsageError; conversely,
  * a start URL typed as `.../docs/` under `Disallow: / \n Allow: /docs/`
  * would be normalized to `.../docs`, fail to match `Allow: /docs/`, and be
  * rejected even though the site owner explicitly opened `/docs/` to
@@ -748,7 +742,7 @@ async function websitePageFromResponse(fetched, pageUrl, options) {
     // `Disallow: /secret/` correctly lets `/secret` through that gate; if the
     // server then redirects to `/secret/` (a common trailing-slash
     // canonicalization), the disallowed page would otherwise be fetched and
-    // stored without ever being weighed against robots.txt. See spec §4.6 C-04.
+    // stored without ever being weighed against robots.txt.
     // Checks `rawFinalUrl` (the un-normalized `response.url`, slash intact) as
     // well as `finalUrl`, per `isCrawlUrlAllowedByRobots` — `normalizeCrawlUrl`
     // would otherwise strip the very trailing slash a `Disallow: /secret/`
@@ -821,8 +815,7 @@ async function fetchWebsiteResponse(pageUrl, redirectCount = 0, options) {
         // `/secret/` even when robots.txt disallows it, because that hop is
         // never the queue URL and never the final URL. Only gated when a
         // `RobotsPolicy` was actually threaded in (`crawlWebsite`); single-URL
-        // `fetchWebsiteMarkdownSnapshot` fetches stay deliberately ungated per
-        // spec §1.
+        // `fetchWebsiteMarkdownSnapshot` fetches stay deliberately ungated.
         if (options?.robots) {
             const normalizedNext = normalizeCrawlUrl(nextUrl);
             if (!normalizedNext) {
@@ -850,15 +843,15 @@ async function fetchWebsiteResponse(pageUrl, redirectCount = 0, options) {
 }
 /**
  * Fetches and classifies `<origin>/robots.txt`. Reuses `fetchWebsiteResponse`
- * (spec §6.2: no second fetch path) so robots.txt gets the exact same SSRF
+ * (no second fetch path) so robots.txt gets the exact same SSRF
  * guards, retry, and redirect handling as a page fetch.
  *
  * Steps 1–2 (the guard on the INITIAL URL) run OUTSIDE the try/catch on
  * purpose: a guard rejection there must propagate as-is, never be downgraded
- * to "unavailable" (spec §4.5 F-12, §6.2). Guard rejections on a LATER
+ * to "unavailable". Guard rejections on a LATER
  * redirect hop happen inside `fetchWebsiteResponse`, which the try/catch
  * below does cover — the guard has already refused to fetch that host, so
- * only the error *reporting* is downgraded (F-11).
+ * only the error *reporting* is downgraded.
  */
 export async function loadRobotsTxt(robotsUrl, options) {
     assertWebsiteRequestUrl(robotsUrl, UsageError, options);
@@ -883,7 +876,7 @@ export async function loadRobotsTxt(robotsUrl, options) {
         }
         if (response.status >= 500 && response.status < 600) {
             await response.body?.cancel().catch(() => undefined);
-            // Guard-audit finding 12: RFC 9309 §2.3.1.4 recommends treating an
+            // RFC 9309 §2.3.1.4 recommends treating an
             // unreachable robots.txt as a full disallow, but for a personal tool
             // crawling a site the operator explicitly chose, a transient 5xx on
             // the site's OWN robots.txt is not a site owner's Disallow — it is the

package/dist/sources/snapshot-fetchers/x.js

@@ -89,7 +89,7 @@ export function resolveXBearerToken(context) {
     if (fromEnv)
         return fromEnv;
     try {
-        return context?.resolveSecret?.(X_BEARER_TOKEN_SECRET_REF)?.trim() || null;
+        return context?.resolveSecret?.(X_BEARER_TOKEN_SECRET_REF) || null;
     }
     catch {
         return null;

package/dist/standalone/onnxruntime-library.js

@@ -0,0 +1,52 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/**
+ * The ONNX Runtime shared library for a compiled standalone binary.
+ *
+ * `onnxruntime-node`'s addon links a shared library that sits beside it in the
+ * package. A Bun executable extracts an embedded addon at load but not the
+ * library it links, so the addon cannot start. The standalone build embeds the
+ * library for its target (`src/standalone/native/`, chosen by
+ * `scripts/build-standalone.ts`); this copies it once into akm's cache and
+ * loads it with `bun:ffi`, after which the addon's own link to it is already
+ * satisfied.
+ *
+ * Outside a standalone binary (`bun src/cli.ts`, the Node build) nothing here
+ * is defined and nothing is evaluated: the package's own files are used.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { getCacheDir } from "../core/paths.js";
+/**
+ * Put the embedded library on disk and load it, before `onnxruntime-node` is
+ * imported. Throws when the library cannot be loaded; the caller reports that
+ * as the embedding runtime being unavailable.
+ */
+export async function preloadOnnxRuntimeLibrary() {
+    if (typeof AKM_STANDALONE_NATIVE_MODULE === "undefined")
+        return;
+    // The specifier is a build constant, so the standalone build bundles this one module and no other build bundles any.
+    const { embeddedPath, fileName } = (await import(AKM_STANDALONE_NATIVE_MODULE));
+    if (!embeddedPath || !fileName)
+        return;
+    const directory = path.join(getCacheDir(), "onnxruntime", `${AKM_ONNXRUNTIME_VERSION}-${process.platform}-${process.arch}`);
+    const library = path.join(directory, fileName);
+    const size = fs.statSync(embeddedPath).size;
+    if (!fs.existsSync(library) || fs.statSync(library).size !== size) {
+        fs.mkdirSync(directory, { recursive: true });
+        const partial = `${library}.${process.pid}.tmp`;
+        fs.writeFileSync(partial, fs.readFileSync(embeddedPath));
+        try {
+            fs.renameSync(partial, library);
+        }
+        catch (error) {
+            // Another akm process copied it first and has it loaded, which Windows will not replace: use that copy.
+            fs.rmSync(partial, { force: true });
+            if (!fs.existsSync(library) || fs.statSync(library).size !== size)
+                throw error;
+        }
+    }
+    const { dlopen } = await import("bun:ffi");
+    dlopen(library, { OrtGetApiBase: { args: [], returns: "ptr" } });
+}

package/dist/storage/repositories/improve-ledger-repository.js

@@ -233,7 +233,7 @@ export function forgetImproveLedgerDecision(db, stashDir, proposalId) {
     db.prepare("DELETE FROM improve_ledger WHERE stash_dir = ? AND proposal_id = ?").run(stashDir, proposalId);
 }
 /**
- * Should-fix 6 (second review round): a read-only or dry-run open never
+ * A read-only or dry-run open never
  * migrates, so it can land on a state.db from before migration 029 added
  * `content_hash` — reading it there threw "no such column", which
  * `loadRetrievalScope`'s own catch then reported as "usage history

package/dist/storage/repositories/improve-runs-repository.js

@@ -127,19 +127,6 @@ export function listRecentImproveRuns(db, limit) {
         .prepare("SELECT id, started_at, completed_at, ok, scope_mode, scope_value, strategy, result_json FROM improve_runs WHERE dry_run = 0 ORDER BY started_at DESC LIMIT ?")
         .all(limit);
 }
-/**
- * #950: count real (non-dry-run) improve_runs rows whose `started_at` falls
- * in `[since, now)` — same filter as {@link queryImproveRuns}, but a `SELECT
- * COUNT(*)` for a caller (the `engine-last-used` gate) that only needs to
- * know whether any run happened, not the rows themselves (which would pull
- * every `result_json` blob in the window just to test for zero).
- */
-export function countImproveRunsSince(db, since) {
-    const row = db
-        .prepare("SELECT COUNT(*) AS cnt FROM improve_runs WHERE started_at >= ? AND dry_run = 0")
-        .get(since);
-    return row.cnt;
-}
 /**
  * Delete improve_runs rows older than `retentionDays` (default: 90). Mirrors
  * {@link purgeOldEvents} — same default, same return shape (number of rows

package/dist/storage/repositories/index-entries-repository.js

@@ -760,10 +760,10 @@ export function isRefLiveInSnapshot(snapshot, ref) {
 }
 /**
  * The fully-qualified `item_ref` (`<bundle>//<conceptId>`, the durable stored
- * spelling — spec §11.1 D-R3) for an entry `id`, or `null` when the row is gone
+ * spelling) for an entry `id`, or `null` when the row is gone.
  * The usage-event / salience / feedback writers derive the durable
  * key from this so a stored key is always the resolved entry's canonical ref,
- * never raw input (D-R3: durable keys are never derived from input).
+ * never raw input (durable keys are never derived from input).
  */
 export function getItemRefById(db, id) {
     const row = db.prepare("SELECT item_ref FROM entries WHERE id = ?").get(id);

package/dist/storage/repositories/proposals-repository.js

@@ -525,8 +525,8 @@ export function renameProposalsBundleRef(db, oldBundleId, newBundleId) {
     const prefix = `${escapeLikePattern(oldBundleId)}//`;
     return db.transaction(() => {
         const refs = Number(db
-            .prepare(`UPDATE proposals SET ref = ? || substr(ref, ?) WHERE ref LIKE ? ESCAPE '\\'`)
-            .run(newBundleId, oldBundleId.length + 1, `${prefix}%`).changes);
+            .prepare(`UPDATE proposals SET ref = ? || substr(ref, length(?) + 1) WHERE ref LIKE ? ESCAPE '\\'`)
+            .run(newBundleId, oldBundleId, `${prefix}%`).changes);
         const targets = Number(db
             .prepare(`UPDATE proposals SET metadata_json = json_set(metadata_json, '$.proposedTarget.source', ?)
            WHERE json_extract(metadata_json, '$.proposedTarget.source') = ?`)

package/dist/storage/repositories/task-history-repository.js

@@ -221,6 +221,6 @@ export function countTaskHistoryTargetRefs(db, oldBundleId) {
 export function renameTaskHistoryTargetRefs(db, oldBundleId, newBundleId) {
     const prefix = `${escapeLikePattern(oldBundleId)}//`;
     return Number(db
-        .prepare(`UPDATE task_history SET target_ref = ? || substr(target_ref, ?) WHERE target_ref LIKE ? ESCAPE '\\'`)
-        .run(newBundleId, oldBundleId.length + 1, `${prefix}%`).changes);
+        .prepare(`UPDATE task_history SET target_ref = ? || substr(target_ref, length(?) + 1) WHERE target_ref LIKE ? ESCAPE '\\'`)
+        .run(newBundleId, oldBundleId, `${prefix}%`).changes);
 }

package/dist/storage/repositories/workflow-runs-repository.js

@@ -42,75 +42,10 @@ export class WorkflowRunsRepository {
         return withImmediateTransaction(this.db, () => fn(this.db));
     }
     // ── reads (fully materialised) ─────────────────────────────────────────────
-    /**
-     * The top-level start guard `publishWorkflowRunV4` uses to refuse starting
-     * a SECOND active run of the same ref in the same scope. `AND
-     * parent_run_id IS NULL` (B-N10's FOURTH site, code-review round 4 finding
-     * 2 / Review log R2): a child run carries the PARENT's `scope_key` (P3a
-     * §5.2), so once a parent publishes a child of some ref, starting a
-     * TOP-LEVEL run of that same ref in that scope must never resolve to the
-     * child — the child is not "already an active run in this scope" from a
-     * fresh top-level invocation's point of view; the PARENT, if anything, is.
-     * Before this filter, `publishWorkflowRunV4` refused with
-     * `RESOURCE_ALREADY_EXISTS` naming the CHILD's own run id, instructing the
-     * operator to `akm workflow abandon` a child a parent is actively driving.
-     * For any database with no child rows the result is byte-identical, same
-     * as the other three B-N10 sites below.
-     *
-     * Always scope-local: `scopeKey` is a real scope, never "every scope" — see
-     * {@link findActiveRunOutsideScope} for the cross-scope warning's query.
-     */
-    findActiveRunForScope(workflowRefs, scopeKey) {
-        const refs = typeof workflowRefs === "string" ? [workflowRefs] : [...workflowRefs];
-        if (refs.length === 0)
-            return undefined;
-        return this.db
-            .prepare(`SELECT id, current_step_id FROM workflow_runs WHERE workflow_ref IN (${refs.map(() => "?").join(", ")}) AND scope_key = ? AND status = 'active' AND parent_run_id IS NULL ORDER BY updated_at DESC, created_at DESC LIMIT 1`)
-            .get(...refs, scopeKey);
-    }
-    /**
-     * The cross-scope start warning's query (#942): the most recently active
-     * run of these refs OUTSIDE `scopeKey` — i.e. `scope_key IS NULL OR
-     * scope_key != scopeKey`, not merely "the most recent active run of these
-     * refs anywhere". A same-scope active row must never win the `LIMIT 1` and
-     * mask a DIFFERENT scope's run: with `--new`/`--force`, the caller's own
-     * active run could otherwise sort first (most recently updated) and hide a
-     * third scope's run entirely, so `startWorkflowRun` silently warned about
-     * nothing while a genuinely stale run in another scope went unreported.
-     * `findActiveRunForScope` deliberately stays scope-local and is never used
-     * for this purpose.
-     */
-    findActiveRunOutsideScope(workflowRefs, scopeKey) {
-        const refs = typeof workflowRefs === "string" ? [workflowRefs] : [...workflowRefs];
-        if (refs.length === 0)
-            return undefined;
-        return (this.db
-            .prepare(`SELECT * FROM workflow_runs WHERE workflow_ref IN (${refs.map(() => "?").join(", ")}) AND (scope_key IS NULL OR scope_key != ?) AND status = 'active' AND parent_run_id IS NULL ORDER BY updated_at DESC, created_at DESC LIMIT 1`)
-            .get(...refs, scopeKey) ?? undefined);
-    }
     getRunById(runId) {
         return (this.db.prepare("SELECT * FROM workflow_runs WHERE id = ?").get(runId) ??
             undefined);
     }
-    /**
-     * The scope-attach lookup `akm workflow run <ref>` uses to find an
-     * in-progress top-level run to resume instead of starting a new one.
-     * `AND parent_run_id IS NULL` (B-N10): a child run must never be attached
-     * to directly through this path — a parent-driven child would then have
-     * TWO drivers. For any database with no child rows the result is
-     * byte-identical.
-     *
-     * Always scope-local: `scopeKey` is a real scope, never "every scope" — see
-     * {@link findActiveRunOutsideScope} for the cross-scope warning's query.
-     */
-    getActiveRunRowForScope(workflowRefs, scopeKey) {
-        const refs = typeof workflowRefs === "string" ? [workflowRefs] : [...workflowRefs];
-        if (refs.length === 0)
-            return undefined;
-        return (this.db
-            .prepare(`SELECT * FROM workflow_runs WHERE workflow_ref IN (${refs.map(() => "?").join(", ")}) AND scope_key = ? AND status = 'active' AND parent_run_id IS NULL ORDER BY updated_at DESC, created_at DESC LIMIT 1`)
-            .get(...refs, scopeKey) ?? undefined);
-    }
     hasRun(runId) {
         const row = this.db.prepare("SELECT 1 FROM workflow_runs WHERE id = ? LIMIT 1").get(runId);
         return !!row;
@@ -128,16 +63,9 @@ export class WorkflowRunsRepository {
         }
         throw new NotFoundError(`Workflow run "${prefix}" not found.`, "WORKFLOW_NOT_FOUND");
     }
-    listRuns(filter) {
+    listRuns(filter = {}) {
         const filters = [];
         const params = [];
-        // `scopeKey: null` (#942) is "every scope" — the predicate is omitted
-        // rather than bound as SQL NULL (which would match nothing, since a real
-        // `scope_key` column value is never NULL for a fresh run).
-        if (filter.scopeKey !== null) {
-            filters.push("scope_key = ?");
-            params.push(filter.scopeKey);
-        }
         if (filter.workflowRef) {
             filters.push("workflow_ref = ?");
             params.push(filter.workflowRef);
@@ -152,11 +80,7 @@ export class WorkflowRunsRepository {
             // human `resume`), so it must never appear under `--active`, or a script
             // treating `--active` output as executable work would pick up a blocked
             // run (owner manual-validation finding 1). Blocked runs stay visible in
-            // plain `list` (all statuses) with their `blocked` status. The
-            // active-OR-blocked scope semantics some call sites want (the `akm show`
-            // scope guard, which surfaces a blocked run as the scope's occupant) live
-            // in the SEPARATE {@link findActiveOrBlockedRunForScope} — never folded
-            // into this shared list filter.
+            // plain `list` (all statuses) with their `blocked` status.
             filters.push("status = 'active'");
         }
         // B-N10: a child run is invisible to this scope query unless the caller
@@ -178,32 +102,20 @@ export class WorkflowRunsRepository {
     getStep(runId, stepId) {
         return this.db.prepare("SELECT * FROM workflow_run_steps WHERE run_id = ? AND step_id = ?").get(runId, stepId);
     }
-    /**
-     * The `akm show` active-run guard: which run (if any) currently occupies
-     * this scope. `AND parent_run_id IS NULL` (B-N10) — a child a parent is
-     * driving must never be reported as "the" active run; the PARENT is. For
-     * any database with no child rows the result is byte-identical.
-     */
-    findActiveOrBlockedRunForScope(scopeKey) {
-        return (this.db
-            .prepare("SELECT id, current_step_id, workflow_ref FROM workflow_runs WHERE scope_key = ? AND status IN ('active', 'blocked') AND parent_run_id IS NULL ORDER BY updated_at DESC LIMIT 1")
-            .get(scopeKey) ?? null);
-    }
     // ── writes ─────────────────────────────────────────────────────────────────
     insertRun(input) {
-        // R-R3 (P3a Review log; docs/plans/specs/p4-deletions-closeout.md §8):
-        // this 12-column list is hand-duplicated by publishChildWorkflowRun's own
+        // This column list is hand-duplicated by publishChildWorkflowRun's own
         // INSERT below, which extends it with parent_run_id/parent_unit_id/
-        // invocation_key. A signature refactor to share one INSERT builder was
-        // considered and deliberately deferred — see
-        // docs/architecture/decisions/0009-child-run-publication-column-parity.md.
-        // Keep both column lists in sync by hand.
+        // invocation_key; one shared INSERT builder was deliberately not introduced.
+        // Keep both column lists in sync by hand. `scope_key` and
+        // `workflow_entry_id` are legacy columns: read tolerantly, never written
+        // (#1239), so a fresh row carries NULL in both.
         this.db
             .prepare(`INSERT INTO workflow_runs (
-          id, workflow_ref, scope_key, workflow_entry_id, workflow_title, status, params_json, current_step_id, created_at, updated_at,
+          id, workflow_ref, workflow_title, status, params_json, current_step_id, created_at, updated_at,
           agent_harness, agent_session_id
-        ) VALUES (?, ?, ?, ?, ?, 'active', ?, ?, ?, ?, ?, ?)`)
-            .run(input.id, input.workflowRef, input.scopeKey, input.workflowEntryId, input.workflowTitle, input.paramsJson, input.currentStepId, input.createdAt, input.updatedAt, input.agentHarness, input.agentSessionId);
+        ) VALUES (?, ?, ?, 'active', ?, ?, ?, ?, ?, ?)`)
+            .run(input.id, input.workflowRef, input.workflowTitle, input.paramsJson, input.currentStepId, input.createdAt, input.updatedAt, input.agentHarness, input.agentSessionId);
     }
     insertSteps(steps) {
         const insertStep = this.db.prepare(`INSERT INTO workflow_run_steps (
@@ -252,22 +164,6 @@ export class WorkflowRunsRepository {
      */
     publishWorkflowRunV4(input) {
         this.immediateTransaction((db) => {
-            if (!input.force) {
-                // The uniqueness guard must never silently skip its scope predicate
-                // (#942) — every real caller (`startWorkflowRun`) stamps a concrete
-                // scope key, so a null one here means the caller is misusing this
-                // top-level guard, not that scoping should be waived.
-                if (input.run.scopeKey === null) {
-                    throw new Error("publishWorkflowRunV4: run.scopeKey must not be null for the scope uniqueness guard.");
-                }
-                const existing = this.findActiveRunForScope(input.workflowRefs, input.run.scopeKey);
-                if (existing) {
-                    throw new UsageError(`Workflow ${input.run.workflowRef} already has an active run in this scope ` +
-                        `(id=${existing.id}, scope=${input.run.scopeKey}, step=${existing.current_step_id ?? "—"}). ` +
-                        `Use 'akm workflow run ${input.run.workflowRef}' to resume it or ` +
-                        `'akm workflow abandon ${existing.id}' to give up on it.`, "RESOURCE_ALREADY_EXISTS");
-                }
-            }
             this.insertRun(input.run);
             this.insertSteps(input.steps);
             db.prepare("UPDATE workflow_runs SET plan_json = ?, plan_hash = ?, plan_ir_version = ? WHERE id = ?").run(input.planJson, input.planHash, WORKFLOW_PLAN_VERSION, input.run.id);
@@ -294,13 +190,10 @@ export class WorkflowRunsRepository {
      * (`plan_ir_version` = the current plan version), and append its
      * `workflow_started` event — then return the freshly-inserted row.
      *
-     * Deliberately does NOT call {@link findActiveRunForScope} or raise
-     * `RESOURCE_ALREADY_EXISTS` (top-level scope-conflict rules do not apply to
-     * a child), and reads no source: the child plan was frozen into the parent's.
+     * Reads no source: the child plan was frozen into the parent's.
      *
      * This method's serialization guarantee holds only when it is the
-     * OUTERMOST transaction on the connection (spec Review log R10,
-     * docs/plans/specs/p3a-plan-v5-child-freeze.md). `withImmediateTransaction`
+     * OUTERMOST transaction on the connection. `withImmediateTransaction`
      * (src/core/state-db.ts) has a re-entrancy guard: if a transaction is
      * already open on the connection, it SILENTLY JOINS that transaction
      * instead of issuing its own `BEGIN IMMEDIATE`.
@@ -318,11 +211,10 @@ export class WorkflowRunsRepository {
      * same `(parentRunId, invocationKey)` serialize on SQLite's write lock: the
      * first to acquire it inserts and commits, and the second's own SELECT —
      * which can only run once it has acquired the lock in turn — finds and
-     * returns the first's row rather than inserting a duplicate or throwing
-     * (C-09). Calling this twice with the same key, including across a crash
+     * returns the first's row rather than inserting a duplicate or throwing.
+     * Calling this twice with the same key, including across a crash
      * between publish and parent-side recording, is therefore safe and returns
-     * the same child both times, with exactly one event and one step set
-     * (C-08).
+     * the same child both times, with exactly one event and one step set.
      */
     publishChildWorkflowRun(input) {
         return this.immediateTransaction((db) => {
@@ -331,15 +223,13 @@ export class WorkflowRunsRepository {
                 .get(input.parentRunId, input.invocationKey);
             if (existing)
                 return existing;
-            // R-R3 (P3a Review log; docs/plans/specs/p4-deletions-closeout.md §8):
-            // the first 12 columns here must stay byte-identical to insertRun's own
-            // column list above (hand-duplicated, not shared, by deliberate choice
-            // — see docs/architecture/decisions/0009-child-run-publication-column-parity.md).
+            // The first 10 columns here must stay byte-identical to insertRun's own
+            // column list above (hand-duplicated, not shared, by deliberate choice).
             // Keep both column lists in sync by hand.
             db.prepare(`INSERT INTO workflow_runs (
-          id, workflow_ref, scope_key, workflow_entry_id, workflow_title, status, params_json, current_step_id, created_at, updated_at,
+          id, workflow_ref, workflow_title, status, params_json, current_step_id, created_at, updated_at,
           agent_harness, agent_session_id, parent_run_id, parent_unit_id, invocation_key
-        ) VALUES (?, ?, ?, ?, ?, 'active', ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(input.run.id, input.run.workflowRef, input.run.scopeKey, input.run.workflowEntryId, input.run.workflowTitle, input.run.paramsJson, input.run.currentStepId, input.run.createdAt, input.run.updatedAt, input.run.agentHarness, input.run.agentSessionId, input.parentRunId, input.spawnedByUnitId, input.invocationKey);
+        ) VALUES (?, ?, ?, 'active', ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(input.run.id, input.run.workflowRef, input.run.workflowTitle, input.run.paramsJson, input.run.currentStepId, input.run.createdAt, input.run.updatedAt, input.run.agentHarness, input.run.agentSessionId, input.parentRunId, input.spawnedByUnitId, input.invocationKey);
             this.insertSteps(input.steps);
             db.prepare("UPDATE workflow_runs SET plan_json = ?, plan_hash = ?, plan_ir_version = ? WHERE id = ?").run(input.planJson, input.planHash, WORKFLOW_PLAN_VERSION, input.run.id);
             insertEventOnce(db, {
@@ -543,6 +433,31 @@ export class WorkflowRunsRepository {
         return this.db.prepare("SELECT * FROM workflow_run_units WHERE run_id = ? AND unit_id = ?").get(runId, unitId);
     }
 }
+/**
+ * Preview counterpart of {@link renameWorkflowRunRefs} for `akm bundle rename`:
+ * how many run rows name `oldBundleId`, and which of them are still `active`
+ * or `blocked` (their frozen `plan_json` keeps the old qualified refs, so the operator
+ * finishes or abandons them — the rename lists them rather than touching them).
+ */
+export function countWorkflowRunRefsForRename(db, oldBundleId) {
+    const like = `${escapeLikePattern(oldBundleId)}//%`;
+    const refs = db.prepare(`SELECT COUNT(*) AS n FROM workflow_runs WHERE workflow_ref LIKE ? ESCAPE '\\'`).get(like).n;
+    const active = db
+        .prepare(`SELECT id, workflow_ref AS workflowRef, status FROM workflow_runs WHERE workflow_ref LIKE ? ESCAPE '\\' AND status IN ('active', 'blocked') ORDER BY updated_at DESC, created_at DESC`)
+        .all(like);
+    return { refs, active };
+}
+/**
+ * Rewrite every `workflow_runs.workflow_ref` naming `oldBundleId` to
+ * `newBundleId` (`akm bundle rename`). A legacy unqualified ref is not matched
+ * by the `LIKE` prefix and is left alone. Returns the number of rows rewritten.
+ */
+export function renameWorkflowRunRefs(db, oldBundleId, newBundleId) {
+    const prefix = `${escapeLikePattern(oldBundleId)}//`;
+    return Number(db
+        .prepare(`UPDATE workflow_runs SET workflow_ref = ? || substr(workflow_ref, length(?) + 1) WHERE workflow_ref LIKE ? ESCAPE '\\'`)
+        .run(newBundleId, oldBundleId, `${prefix}%`).changes);
+}
 /**
  * Run `fn` against a {@link WorkflowRunsRepository} bound to state.db
  * ({@link StorageLocations.stateDb}, the post-cutover home of the