akm-cli 0.9.0-beta.4 → 0.9.0-beta.41

package/dist/commands/improve/improve.js

@@ -14,20 +14,21 @@ import { probeLock, releaseLock, releaseLockIfOwned, tryAcquireLockSync } from "
 import { classifyImproveAction } from "../../core/improve-types.js";
 import { openLogsDatabase, purgeOldTaskLogs } from "../../core/logs-db.js";
 import { getDbPath, getStateDbPathInDataDir } from "../../core/paths.js";
-import { openStateDatabase, purgeOldEvents, purgeOldImproveRuns } from "../../core/state-db.js";
+import { listProposalGateDecisions, listStateProposals, openStateDatabase, persistPhaseThreshold, purgeOldEvents, purgeOldImproveRuns, } from "../../core/state-db.js";
 import { info, warn } from "../../core/warn.js";
 import { closeDatabase, getAllEntries, getEntryCount, getRetrievalCounts, getUtilityScoresByIds, getZeroResultSearches, openDatabase, openExistingDatabase, } from "../../indexer/db/db.js";
 import { ensureIndex } from "../../indexer/ensure-index.js";
 import { runGraphExtractionPass } from "../../indexer/graph/graph-extraction.js";
+import { withIndexWriterLease } from "../../indexer/index-writer-lock.js";
 import { akmIndex } from "../../indexer/indexer.js";
-import { runMemoryInferencePass } from "../../indexer/passes/memory-inference.js";
+import { collectPendingMemories, runMemoryInferencePass, } from "../../indexer/passes/memory-inference.js";
 import { runStalenessDetectionPass } from "../../indexer/passes/staleness-detect.js";
 import { getWritableStashDirs, resolveSourceEntries } from "../../indexer/search/search-source.js";
 import { countUsageEventsByType } from "../../indexer/usage/usage-events.js";
 import { resolveAssetPath } from "../../indexer/walk/path-resolver.js";
 import { resolveImproveProcessRunnerFromProfile, resolveTriageJudgmentRunner } from "../../integrations/agent/runner.js";
 import { getAvailableHarnesses } from "../../integrations/session-logs/index.js";
-import { isLlmFeatureEnabled, isProcessEnabled } from "../../llm/feature-gate.js";
+import { isProcessEnabled } from "../../llm/feature-gate.js";
 import { installLlmUsagePersistence } from "../../llm/usage-persist.js";
 import { withLlmStage } from "../../llm/usage-telemetry.js";
 import { isGitBackedStash, resolveWritableOverride, saveGitStash } from "../../sources/providers/git.js";
@@ -37,16 +38,120 @@ import { resolveDrainPolicy } from "../proposal/drain-policies.js";
 import { createProposal, expireStaleProposals, getProposal, isProposalSkipped, listProposals, purgeOrphanProposals, } from "../proposal/validators/proposals.js";
 import { runSchemaRepairPass } from "../sources/schema-repair.js";
 import { checkDeadUrls } from "../url-checker.js";
+import { computeThresholdAutoTune, gateDecisionsToSamples, summarizeCalibration, } from "./calibration.js";
 import { akmConsolidate } from "./consolidate.js";
 import { akmDistill, deriveLessonRef, isDistillRefusedInputType } from "./distill.js";
 import { deriveKnowledgeRef } from "./distill-promotion-policy.js";
 import { countEvalCases, writeEvalCase } from "./eval-cases.js";
 import { akmExtract, countNewExtractCandidates } from "./extract.js";
+import { computeValenceScore, FEEDBACK_WEIGHT, UTILITY_WEIGHT } from "./feedback-valence.js";
 import { makeGateConfig, resolveExtractConfidence, runAutoAcceptGate } from "./improve-auto-accept.js";
 import { isProfileFilteredForAllPasses, resolveImproveProfile, resolveProcessEnabled, shouldSkipRef, } from "./improve-profiles.js";
 import { detectAndWriteContradictions } from "./memory/memory-contradiction-detect.js";
 import { analyzeMemoryCleanup, applyMemoryCleanup } from "./memory/memory-improve.js";
+import { computeProxyAdequacy, getAllAssetOutcomes, getOutcomeScoresByRef, outcomeScoreToSalience, updateAssetOutcome, } from "./outcome-loop.js";
+import { DEFAULT_DUE_DAYS, DEFAULT_MAX_PER_RUN, filterProactiveDue, selectProactiveMaintenanceRefs, } from "./proactive-maintenance.js";
+import { akmProcedural } from "./procedural.js";
+import { akmRecombine } from "./recombine.js";
 import { akmReflect } from "./reflect.js";
+import { buildRankChangeReport, computeSalience, getAllRankScores, getAssetSalience, getConsecutiveNoOps, getLastUseMsByRef, isContentEncodingRow, recordNoOp, resetConsecutiveNoOps, SALIENCE_NO_OP_DAMPEN_FACTOR, SALIENCE_NO_OP_DAMPEN_THRESHOLD, upsertAssetSalience, } from "./salience.js";
+// #607 Lock Decomposition: fine-grained per-process locks replace the single
+// `improve.lock`. Three independent locks allow concurrent improve runs when
+// they touch different subsystems (e.g. quick-shredder consolidate can run
+// alongside daily reflect+distill).
+//
+//   consolidate.lock   — protects consolidate + memoryInference (both write index.db)
+//   reflect-distill.lock — protects reflect + distill (both write state.db proposals)
+//   triage.lock         — protects triage (writes proposal promotions)
+//
+// Stale timeouts are per-lock, tuned to the expected runtime of the protected
+// processes: consolidate is disk-bound (1h), reflect+distill is GPU-bound (2h),
+// triage is fast (30min).
+const PROCESS_LOCK_DEFS = {
+    consolidate: { fileName: "consolidate.lock", staleAfterMs: 60 * 60 * 1000 },
+    reflectDistill: { fileName: "reflect-distill.lock", staleAfterMs: 2 * 60 * 60 * 1000 },
+    triage: { fileName: "triage.lock", staleAfterMs: 30 * 60 * 1000 },
+};
+const heldProcessLocks = new Set();
+export function resetHeldProcessLocks() {
+    heldProcessLocks.clear();
+}
+function processLockPath(lockBaseDir, lockName) {
+    return path.join(lockBaseDir, PROCESS_LOCK_DEFS[lockName].fileName);
+}
+function tryAcquireProcessLock(lockPath, staleAfterMs, skipIfLocked, lockLabel) {
+    fs.mkdirSync(path.dirname(lockPath), { recursive: true });
+    const lockPayload = () => JSON.stringify({ pid: process.pid, startedAt: new Date().toISOString() });
+    if (tryAcquireLockSync(lockPath, lockPayload())) {
+        heldProcessLocks.add(lockPath);
+        return "acquired";
+    }
+    const probe = probeLock(lockPath, { staleAfterMs });
+    const rawContent = probe.state === "absent" ? undefined : probe.rawContent;
+    const lock = rawContent
+        ? (() => {
+            try {
+                return JSON.parse(rawContent);
+            }
+            catch {
+                return null;
+            }
+        })()
+        : null;
+    if (probe.state === "stale") {
+        try {
+            appendEvent({
+                eventType: "improve_lock_recovered",
+                metadata: {
+                    lockName: lockLabel,
+                    stalePid: lock?.pid ?? null,
+                    lockedAt: lock?.startedAt ?? null,
+                    recoveredAt: new Date().toISOString(),
+                    lockAgeMs: probe.ageMs ?? null,
+                    reason: probe.reason === "pid_dead" ? "pid_not_alive" : probe.reason,
+                },
+            });
+        }
+        catch {
+            /* event emission is best-effort; never block lock recovery */
+        }
+        releaseLock(lockPath);
+        if (tryAcquireLockSync(lockPath, lockPayload())) {
+            heldProcessLocks.add(lockPath);
+            return "acquired";
+        }
+        if (skipIfLocked) {
+            warn(`[improve] ${lockLabel} lock acquired by another run during stale recovery; skipping (--skip-if-locked)`);
+            return "skipped";
+        }
+        throw new ConfigError(`akm improve ${lockLabel} is already running. Delete ${lockPath} to force.`, "INVALID_CONFIG_FILE");
+    }
+    if (skipIfLocked) {
+        warn(`[improve] ${lockLabel} lock held by another run (PID ${lock?.pid}, started ${lock?.startedAt}); skipping (--skip-if-locked)`);
+        return "skipped";
+    }
+    throw new ConfigError(`akm improve ${lockLabel} is already running (PID ${lock?.pid}, started ${lock?.startedAt}). Delete ${lockPath} to force.`, "INVALID_CONFIG_FILE");
+}
+function releaseProcessLock(lockPath) {
+    try {
+        fs.unlinkSync(lockPath);
+    }
+    catch {
+        // ignore
+    }
+    heldProcessLocks.delete(lockPath);
+}
+function releaseAllProcessLocks() {
+    for (const p of heldProcessLocks) {
+        try {
+            fs.unlinkSync(p);
+        }
+        catch {
+            // ignore
+        }
+    }
+    heldProcessLocks.clear();
+}
 function resolveImproveScope(scope) {
     const trimmed = scope?.trim();
     if (!trimmed)
@@ -102,6 +207,22 @@ export function renderSyncCommitMessage(template, result, nowMs) {
     };
     return template.replace(/\{(\w+)\}/g, (match, key) => (Object.hasOwn(tokens, key) ? tokens[key] : match));
 }
+/**
+ * Dedupe a list of eligible refs by `ref`, preserving first-seen order. Used to
+ * merge the three eligibility sources (feedback-signal, P0-A high-retrieval,
+ * Layer-2 proactive-maintenance) without admitting a ref into the loop twice.
+ */
+function dedupeRefs(refs) {
+    const seen = new Set();
+    const out = [];
+    for (const r of refs) {
+        if (seen.has(r.ref))
+            continue;
+        seen.add(r.ref);
+        out.push(r);
+    }
+    return out;
+}
 async function collectEligibleRefs(scope, stashDir, improveProfile) {
     if (scope.mode === "ref" && scope.value) {
         const parsed = parseAssetRef(scope.value);
@@ -454,6 +575,107 @@ export function armBudgetWatchdog(budgetMs, controller, deps) {
         }
     };
 }
+/**
+ * #612 / WS-4 — bounded, opt-in per-phase auto-accept threshold auto-tune.
+ *
+ * Reads `improve.calibration` from config. When `autoTune` is enabled, computes
+ * the calibration of recent gate decisions, derives a bounded threshold
+ * adjustment (clamped into the configured band, capped per step), logs it, and
+ * records a `calibration_autotune` event. Returns the new threshold (integer
+ * 0-100) when an adjustment was made, or `undefined` to leave the caller's
+ * threshold unchanged.
+ *
+ * WS-4 change: accepts an optional `phase` parameter. When provided, the tuned
+ * threshold is persisted to `improve_gate_thresholds` (state.db Migration 012)
+ * keyed by phase so `makeGateConfig` can read it back on the next run and each
+ * phase maintains its own calibrated threshold rather than a shared global.
+ *
+ * WS-4 ceiling: `maxThreshold` defaults to 85 (not 100) to prevent the gate
+ * converging to pure exploitation and shutting down Gap-3/4 novelty throughput.
+ *
+ * DEFAULT OFF: with no `improve.calibration` block (or `autoTune: false`) this
+ * returns `undefined` immediately, so the gate threshold is unchanged and
+ * behaviour is byte-identical to today.
+ */
+export function maybeAutoTuneThreshold(currentThreshold, config, stateDbPath, ctx, phase) {
+    const cal = config.improve?.calibration;
+    if (!cal?.autoTune)
+        return undefined;
+    // WS-4: default maxThreshold is now 85 (ceiling to prevent pure exploitation).
+    // Callers that explicitly set maxThreshold in config override this default.
+    const tuneConfig = {
+        autoTune: true,
+        minThreshold: cal.minThreshold ?? 0,
+        maxThreshold: cal.maxThreshold ?? 85,
+        maxStep: cal.maxStep ?? 5,
+        minSamples: cal.minSamples ?? 20,
+        targetAcceptRate: cal.targetAcceptRate ?? 0.9,
+    };
+    // Defensive: an inverted band disables tuning rather than clamping to nonsense.
+    if (tuneConfig.minThreshold > tuneConfig.maxThreshold)
+        return undefined;
+    const db = openStateDatabase(stateDbPath);
+    let summary;
+    try {
+        const allDecisions = listProposalGateDecisions(db);
+        // WS-4 fix: when called with a phase label, restrict calibration to that
+        // phase's decision pool so a reflect-dominated run cannot tighten the
+        // consolidate gate (or vice-versa). The gate field is `improve:<phase>`,
+        // matching what improve-auto-accept.ts stamps at line ~163.
+        const gateLabel = phase ? `improve:${phase}` : undefined;
+        const decisions = gateLabel ? allDecisions.filter((d) => d.gate === gateLabel) : allDecisions;
+        summary = summarizeCalibration(gateDecisionsToSamples(decisions));
+    }
+    finally {
+        db.close();
+    }
+    const result = computeThresholdAutoTune(currentThreshold, summary, tuneConfig);
+    if (!result.adjusted)
+        return undefined;
+    const appendEventFn = ctx?.appendEventFn ?? appendEvent;
+    const phaseLabel = phase ?? "global";
+    info(`[improve] calibration auto-tune (${phaseLabel}): threshold ${result.previousThreshold} -> ${result.newThreshold} ` +
+        `(${result.reason}; samples=${summary.samples}, acceptRate=${summary.overallAcceptRate}, ` +
+        `gap=${summary.calibrationGap}, band=[${tuneConfig.minThreshold},${tuneConfig.maxThreshold}])`);
+    try {
+        appendEventFn({
+            eventType: "calibration_autotune",
+            ref: "improve:calibration",
+            metadata: {
+                phase: phaseLabel,
+                previousThreshold: result.previousThreshold,
+                newThreshold: result.newThreshold,
+                delta: result.delta,
+                reason: result.reason,
+                samples: summary.samples,
+                overallAcceptRate: summary.overallAcceptRate,
+                calibrationGap: summary.calibrationGap,
+                minThreshold: tuneConfig.minThreshold,
+                maxThreshold: tuneConfig.maxThreshold,
+            },
+        });
+    }
+    catch (err) {
+        warn(`[improve] calibration auto-tune event not recorded: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    // WS-4: Persist the per-phase threshold so makeGateConfig reads it on the
+    // next run. Best-effort — a write failure must not abort the improve run.
+    if (phase) {
+        try {
+            const persistDb = openStateDatabase(stateDbPath);
+            try {
+                persistPhaseThreshold(persistDb, phase, result.newThreshold);
+            }
+            finally {
+                persistDb.close();
+            }
+        }
+        catch (err) {
+            warn(`[improve] calibration auto-tune: failed to persist phase threshold for ${phase}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    return result.newThreshold;
+}
 export async function akmImprove(options = {}) {
     const scope = resolveImproveScope(options.scope);
     const reflectFn = options.reflectFn ?? akmReflect;
@@ -461,6 +683,11 @@ export async function akmImprove(options = {}) {
     const ensureIndexFn = options.ensureIndexFn ?? ensureIndex;
     const reindexFn = options.reindexFn ?? akmIndex;
     const drainProposalsFn = options.drainProposalsFn ?? drainProposals;
+    // #616 multi-cycle test seams. Default to the real module-local fns.
+    const collectEligibleRefsImpl = options.collectEligibleRefsFn ?? collectEligibleRefs;
+    const runImprovePreparationStageImpl = options.runImprovePreparationStageFn ?? runImprovePreparationStage;
+    const runImproveLoopStageImpl = options.runImproveLoopStageFn ?? runImproveLoopStage;
+    const runImprovePostLoopStageImpl = options.runImprovePostLoopStageFn ?? runImprovePostLoopStage;
     // Resolve the improve profile for this run. Profile drives type filtering,
     // process gating, and default autoAccept/limit values.
     const _earlyConfig = options.config ?? loadConfig();
@@ -471,8 +698,13 @@ export async function akmImprove(options = {}) {
     options = {
         ...options,
         autoAccept: options.autoAccept ?? improveProfile.autoAccept,
-        limit: options.limit ?? improveProfile.limit,
+        // Profile-level limit, then process-level reflect.limit as fallback.
+        // CLI --limit takes precedence over both.
+        limit: options.limit ?? improveProfile?.processes?.reflect?.limit ?? improveProfile.limit,
     };
+    // #616 — bounded multi-cycle phasing. CLI/programmatic override wins over
+    // profile.maxCycles; default 1 => single pass (byte-identical to pre-#616).
+    const maxCycles = Math.max(1, Math.trunc(options.maxCycles ?? improveProfile.maxCycles ?? 1));
     let primaryStashDir;
     try {
         primaryStashDir = resolveSourceEntries(options.stashDir)[0]?.path;
@@ -489,174 +721,51 @@ export async function akmImprove(options = {}) {
     // timeout root cause). Because beforeEach runs synchronously, env is still the
     // calling test's own at this point; we capture it before yielding the loop.
     const resolvedStateDbPath = getStateDbPathInDataDir();
-    // Phase 4 lock hoist (§7): the `improve.lock` setup is hoisted ABOVE
-    // ensureIndex/collectEligibleRefs so the triage pre-pass (and improve's own
-    // queue writes) run fully serialized under the lock. The dry-run early-return
-    // below still skips the lock and triage (the lock+triage block is gated on
-    // `!options.dryRun`); contradiction-detection and memory-cleanup analysis,
-    // which previously ran before the lock, now sit after it for free.
-    const resolvedLockPath = primaryStashDir
-        ? path.join(primaryStashDir, ".akm", "improve.lock")
-        : path.join(options.stashDir ?? ".", ".akm", "improve.lock");
-    const MAX_LOCK_AGE_MS = 4 * 60 * 60 * 1000; // 4 hours
-    const acquireLock = () => {
-        fs.mkdirSync(path.dirname(resolvedLockPath), { recursive: true });
-        const lockPayload = () => JSON.stringify({ pid: process.pid, startedAt: new Date().toISOString() });
-        if (tryAcquireLockSync(resolvedLockPath, lockPayload()))
-            return "acquired";
-        // Lock file already exists — probe to determine whether it's still held
-        // or whether the prior run died without cleaning up.
-        const probe = probeLock(resolvedLockPath, { staleAfterMs: MAX_LOCK_AGE_MS });
-        const rawContent = probe.state === "absent" ? undefined : probe.rawContent;
-        const lock = rawContent
-            ? (() => {
-                try {
-                    return JSON.parse(rawContent);
-                }
-                catch {
-                    return null;
-                }
-            })()
-            : null;
-        if (probe.state === "stale") {
-            // O-7 / #394: Emit improve_lock_recovered event before recovery so the
-            // audit trail records the abnormal prior-run exit (Temporal/Airflow pattern).
-            try {
-                appendEvent({
-                    eventType: "improve_lock_recovered",
-                    metadata: {
-                        stalePid: lock?.pid ?? null,
-                        lockedAt: lock?.startedAt ?? null,
-                        recoveredAt: new Date().toISOString(),
-                        lockAgeMs: probe.ageMs ?? null,
-                        reason: probe.reason === "pid_dead" ? "pid_not_alive" : probe.reason,
-                    },
-                });
-            }
-            catch {
-                /* event emission is best-effort; never block lock recovery */
-            }
-            releaseLock(resolvedLockPath);
-            if (tryAcquireLockSync(resolvedLockPath, lockPayload()))
-                return "acquired";
-            // Lost the race to another run that grabbed the freed stale lock.
-            if (options.skipIfLocked) {
-                warn("[improve] another run acquired the lock during stale recovery; skipping (--skip-if-locked)");
-                return "skipped";
-            }
-            throw new ConfigError(`akm improve is already running. Delete ${resolvedLockPath} to force.`, "INVALID_CONFIG_FILE");
-        }
-        // Lock is held by a live run within the staleness window.
-        if (options.skipIfLocked) {
-            warn(`[improve] another improve run holds the lock (PID ${lock?.pid}, started ${lock?.startedAt}); skipping (--skip-if-locked)`);
-            return "skipped";
-        }
-        throw new ConfigError(`akm improve is already running (PID ${lock?.pid}, started ${lock?.startedAt}). Delete ${resolvedLockPath} to force.`, "INVALID_CONFIG_FILE");
-    };
-    // Phase 4 lock-leak guard (§7 ordering hazard): hoisting `improve.lock` above
-    // the pre-index region (so the triage pre-pass runs under it) means the lock is
-    // held while ensureIndex / collectEligibleRefs / contradiction-detection /
-    // memory-cleanup analysis run — but the main protecting `try { … } finally {
-    // unlinkSync(resolvedLockPath) }` does not begin until after them. A throw in
-    // any of those steps would leak the lock. We close that window by wrapping the
-    // whole region in a try whose catch releases the lock (when held) and
-    // re-throws. The values this region computes are declared in the outer scope so
-    // they remain visible to the main run below. The dry-run path never sets
-    // `lockAcquired`, so its early return releases nothing.
-    let lockAcquired = false;
-    const releaseLockOnError = () => {
-        if (!lockAcquired)
-            return;
-        try {
-            fs.unlinkSync(resolvedLockPath);
-        }
-        catch {
-            // best-effort release on the error path
-        }
-        lockAcquired = false;
-    };
-    // Signal-safe lock release. The SIGTERM/SIGINT/SIGHUP handler in improve-cli.ts
-    // calls `process.exit()`, which does NOT run the `finally` below that owns lock
-    // release — so a cron-timeout SIGTERM leaked `improve.lock` every run.
-    // `process.exit()` DOES fire `'exit'` listeners, so we release the lock from
-    // one. `releaseLockIfOwned` only unlinks a lock still owned by this PID, so it
-    // is safe even if a later run re-acquired it. The listener is removed in the
-    // `finally` so the normal path stays single-release and repeated in-process
-    // `akmImprove` calls (tests) do not accumulate listeners.
-    const releaseLockOnExit = () => {
-        releaseLockIfOwned(resolvedLockPath, process.pid);
-    };
+    // #612 / WS-4 — bounded, OPT-IN per-phase auto-accept threshold auto-tune.
+    // DEFAULT OFF: `autoTune: false` (or absent) is a complete no-op.
+    //
+    // WS-4 change: thresholds are now PER PHASE. The old single global mutation
+    // of `options.autoAccept` is retired — it caused every phase to share one
+    // calibration signal, so a reflect-dominated run could tighten the consolidate
+    // gate (or vice-versa). Instead:
+    //   - Each `makeGateConfig` call reads the phase's stored threshold from
+    //     state.db (Migration 012) and uses it as `phaseThreshold`, overriding
+    //     the `globalThreshold` (= options.autoAccept) for that phase.
+    //   - Per-phase `maybeAutoTuneThreshold` calls fire AFTER each phase's gate
+    //     has run and persist the new threshold to state.db for the NEXT run.
+    //   - `options.autoAccept` stays unchanged (it is the operator-supplied
+    //     baseline, not a mutable run-time state).
+    //
+    // The global tune call is intentionally removed here. See per-phase calls
+    // below (near each makeGateConfig / runAutoAcceptGate block).
+    // #607 Lock decomposition: three per-process locks replace the single
+    // `improve.lock`. Each process acquires only the lock(s) it needs, so
+    // quick-shredder consolidate can run alongside daily reflect+distill.
+    //
+    //   consolidate.lock     — protects consolidate + memoryInference + graphExtraction (index.db writers)
+    //   reflect-distill.lock — protects reflect + distill (state.db proposal writers)
+    //   triage.lock          — protects triage pre-pass (state.db proposal promotions)
+    //
+    // Lock base directory — same `.akm/` under the primary stash dir.
+    const lockBaseDir = primaryStashDir ? path.join(primaryStashDir, ".akm") : path.join(options.stashDir ?? ".", ".akm");
     const preEnsureCleanupWarnings = [];
-    let plannedRefs;
-    let memorySummary;
-    let profileFilteredRefs;
+    // #616: assigned by runIndexAndCollect() (closure) so TS cannot prove definite
+    // assignment — seed with empty values; the first runIndexAndCollect() call
+    // (cycle 1, in the first try) always overwrites them before any read.
+    let plannedRefs = [];
+    let memorySummary = { eligible: 0, derived: 0 };
+    let profileFilteredRefs = [];
     let memoryCleanupPlan;
     let guidance;
     let triageDrain;
-    try {
-        // Acquire the lock and run the triage pre-pass for non-dry-run executions.
-        // The dry-run branch below produces plannedRefs/memorySummary WITHOUT the lock
-        // or triage (decision: dry-run never mutates the queue).
-        if (!options.dryRun) {
-            if (acquireLock() === "skipped") {
-                // Another improve holds the lock and the caller asked to skip rather
-                // than fail. Return a clean no-op result (exit 0) before any index/DB
-                // work — never registered the exit listener, never set lockAcquired,
-                // so we release nothing belonging to the run that owns the lock.
-                return {
-                    schemaVersion: 1,
-                    ok: true,
-                    scope,
-                    dryRun: false,
-                    skipped: { reason: "lock-held" },
-                    memorySummary: { eligible: 0, derived: 0 },
-                    plannedRefs: [],
-                };
-            }
-            lockAcquired = true;
-            // Backstop release on process.exit() (signal handler / budget watchdog),
-            // which skips the finally below. Removed in that finally on the normal path.
-            process.on("exit", releaseLockOnExit);
-            // Phase 4 triage pre-pass (§7, §13): drain the standing pending backlog
-            // BEFORE ensureIndex so improve generates fresh proposals against a cleared
-            // queue (no `duplicate_pending` collisions) and ensureIndex absorbs triage's
-            // promotions for free. Gated on the triage process being enabled (opt-in,
-            // defaults off) and on a whole-stash / type-scoped run — a single-ref
-            // `akm improve skill:x` must never drain the whole queue. Best-effort: a
-            // triage failure is a non-fatal warning, never an abort (mirrors the
-            // contradiction-detection pass below).
-            if (primaryStashDir && resolveProcessEnabled("triage", improveProfile)) {
-                if (scope.mode === "ref") {
-                    warn("[improve] triage pre-pass skipped (single-ref scope never drains the whole queue)");
-                }
-                else {
-                    try {
-                        const triageConfig = improveProfile.processes?.triage;
-                        const policy = resolveDrainPolicy(triageConfig?.policy);
-                        const applyMode = triageConfig?.applyMode ?? "queue";
-                        const maxAccepts = triageConfig?.maxAcceptsPerRun ?? 25;
-                        const judgment = triageConfig?.judgment
-                            ? resolveTriageJudgmentRunner(triageConfig.judgment, _earlyConfig)
-                            : null;
-                        triageDrain = await drainProposalsFn({
-                            stashDir: primaryStashDir,
-                            policy,
-                            applyMode,
-                            maxAccepts,
-                            dryRun: false,
-                            // No fresh ids exist yet — triage runs before improve generates any.
-                            excludeIds: new Set(),
-                            ...(triageConfig?.maxDiffLines !== undefined ? { maxDiffLines: triageConfig.maxDiffLines } : {}),
-                            judgment,
-                        });
-                    }
-                    catch (err) {
-                        // Non-fatal: triage is a best-effort pre-pass and must never abort improve.
-                        warn(`[improve] triage pre-pass failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
-                    }
-                }
-            }
-        }
+    // #616 — ensureIndex + collectEligibleRefs + memory-cleanup recompute, lifted
+    // into a helper so the SAME sequence runs once for cycle 1 (below, in the
+    // first try) and is re-run at the top of each subsequent multi-cycle cycle.
+    // Re-running ensureIndex between cycles makes cycle N's gate-promoted
+    // proposals visible to cycle N+1's collectEligibleRefs. Mutates the
+    // outer-scope plannedRefs/memorySummary/profileFilteredRefs/memoryCleanupPlan/
+    // guidance so for maxCycles:1 the body is byte-identical to pre-#616.
+    const runIndexAndCollect = async () => {
         // #339 fix: ensureIndex MUST run BEFORE collectEligibleRefs. The eligible-ref
         // query reads the `entries` table; if a DB version upgrade just dropped that
         // table (or the index is otherwise empty), the prior run order silently
@@ -684,7 +793,7 @@ export async function akmImprove(options = {}) {
                 // best-effort; leave preEnsureEntryCount undefined
             }
             try {
-                await ensureIndexFn(primaryStashDir);
+                await ensureIndexFn(primaryStashDir, { mode: "blocking" });
             }
             catch (err) {
                 preEnsureCleanupWarnings.push(`ensureIndex failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -714,7 +823,7 @@ export async function akmImprove(options = {}) {
                 }
             }
         }
-        ({ plannedRefs, memorySummary, profileFilteredRefs } = await collectEligibleRefs(scope, options.stashDir, improveProfile));
+        ({ plannedRefs, memorySummary, profileFilteredRefs } = await collectEligibleRefsImpl(scope, options.stashDir, improveProfile));
         const cleanupParentRef = memoryCleanupParentRef(scope, options.stashDir);
         // M-1 (#367): Run contradiction-detection BEFORE analyzeMemoryCleanup so
         // the SCC resolver in resolveFamilyContradictions has edges to work on.
@@ -736,6 +845,69 @@ export async function akmImprove(options = {}) {
             memorySummary.eligible > 0
                 ? "Improve folds memory cleanup into the same proposal queue: speculative promotions still go through reflect/distill proposals, while high-confidence redundant derived memories are moved into a recoverable cleanup archive instead of being left active in the stash."
                 : undefined;
+    };
+    try {
+        // #607: Per-process lock acquisition. Each process acquires only the lock(s)
+        // it needs. The dry-run branch produces plannedRefs/memorySummary WITHOUT any
+        // locks (decision: dry-run never mutates the queue).
+        if (!options.dryRun) {
+            // Backstop release on process.exit() (signal handler / budget watchdog),
+            // which skips the finally below. Removed in that finally on the normal path.
+            const releaseAllOnExit = () => {
+                for (const p of heldProcessLocks) {
+                    releaseLockIfOwned(p, process.pid);
+                }
+            };
+            process.on("exit", releaseAllOnExit);
+            // #607 triage pre-pass: acquire triage.lock, drain the standing pending
+            // backlog BEFORE ensureIndex so improve generates fresh proposals against
+            // a cleared queue (no `duplicate_pending` collisions) and ensureIndex
+            // absorbs triage's promotions for free. Release immediately after —
+            // triage.lock is not needed again until the next improve run.
+            if (primaryStashDir && resolveProcessEnabled("triage", improveProfile)) {
+                if (scope.mode === "ref") {
+                    warn("[improve] triage pre-pass skipped (single-ref scope never drains the whole queue)");
+                }
+                else {
+                    const triageLPath = processLockPath(lockBaseDir, "triage");
+                    const triageResult = tryAcquireProcessLock(triageLPath, PROCESS_LOCK_DEFS.triage.staleAfterMs, options.skipIfLocked, "triage");
+                    if (triageResult === "skipped") {
+                        triageDrain = undefined;
+                    }
+                    else {
+                        try {
+                            const triageConfig = improveProfile.processes?.triage;
+                            const policy = resolveDrainPolicy(triageConfig?.policy);
+                            const applyMode = triageConfig?.applyMode ?? "queue";
+                            const maxAccepts = triageConfig?.maxAcceptsPerRun ?? 25;
+                            const judgment = triageConfig?.judgment
+                                ? resolveTriageJudgmentRunner(triageConfig.judgment, _earlyConfig)
+                                : null;
+                            triageDrain = await drainProposalsFn({
+                                stashDir: primaryStashDir,
+                                policy,
+                                applyMode,
+                                maxAccepts,
+                                dryRun: false,
+                                excludeIds: new Set(),
+                                ...(triageConfig?.maxDiffLines !== undefined ? { maxDiffLines: triageConfig.maxDiffLines } : {}),
+                                judgment,
+                            });
+                        }
+                        catch (err) {
+                            warn(`[improve] triage pre-pass failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
+                        }
+                        finally {
+                            releaseProcessLock(triageLPath);
+                        }
+                    }
+                }
+            }
+        }
+        // #339 fix: ensureIndex MUST run BEFORE collectEligibleRefs (now inside the
+        // helper). Cycle 1 runs it here; subsequent multi-cycle cycles re-run it via
+        // the same helper at the top of each cycle below.
+        await runIndexAndCollect();
         if (options.dryRun) {
             const result = {
                 schemaVersion: 1,
@@ -752,17 +924,14 @@ export async function akmImprove(options = {}) {
         }
     }
     catch (err) {
-        releaseLockOnError();
+        releaseAllProcessLocks();
         throw err;
     }
-    // FIX 2 (lock-leak window): everything from here on runs UNDER the lock that
-    // `acquireLock()` just took. The single `try { … } finally { unlinkSync(lock) }`
-    // below now spans the budget-timer setup, `openStateDatabase()`, and the
-    // `profileFilteredRefs` audit-event loop too — regions that previously sat in
-    // the gap between the lock-acquire catch (above) and the main try. A throw in
-    // any of them used to leak the lock (blocking the next improve up to 4h);
-    // now the finally releases it exactly once. The dry-run path already returned
-    // above without acquiring the lock, so it never reaches this finally; the
+    // #607: per-process locks are acquired/released around each stage below.
+    // The triage pre-pass already ran under triage.lock (released). The
+    // preparation stage runs under consolidate.lock, the loop stage under
+    // reflect-distill.lock, and the post-loop stage under consolidate.lock again.
+    // Each stage acquires its lock just before starting and releases in finally.
     // best-effort `unlinkSync` is a no-op when no lock file exists.
     const startMs = Date.now();
     const budgetMs = options.timeoutMs ?? 2 * 60 * 60 * 1000; // default 2 hours
@@ -771,6 +940,16 @@ export async function akmImprove(options = {}) {
     // run past the declared budget.
     // References: Anthropic *Building Effective Agents* (2024); CoALA §5 (arXiv:2309.02427).
     const budgetAbortController = new AbortController();
+    // Attach a live `remainingBudgetMs` getter to the signal so sub-callers
+    // (e.g. consolidate.ts cold-start budget estimation) can read the remaining
+    // wall-clock budget without needing an extra plumbing parameter. The property
+    // is computed at access time via a getter so it always reflects the actual
+    // elapsed time rather than a stale snapshot taken at arm time.
+    Object.defineProperty(budgetAbortController.signal, "remainingBudgetMs", {
+        get: () => Math.max(0, budgetMs - (Date.now() - startMs)),
+        enumerable: false,
+        configurable: true,
+    });
     // Declared in the outer scope so the `finally` can clear the timer even if a
     // throw occurs before/after it is armed. Defaults to a no-op until armed.
     let clearBudgetTimer = () => { };
@@ -826,71 +1005,213 @@ export async function akmImprove(options = {}) {
                 },
             }, eventsCtx);
         }
-        const preparation = await runImprovePreparationStage({
-            scope,
-            options,
-            plannedRefs,
-            memoryCleanupPlan,
-            primaryStashDir,
-            memorySummary,
-            reindexFn,
-            startMs,
-            budgetMs,
-            eventsCtx,
-            initialCleanupWarnings: preEnsureCleanupWarnings,
-            improveProfile,
-        });
-        // D6: pre-load all proposal_rejected events from the last 30 days once,
-        // so the per-asset loop can use a Map lookup instead of N DB round trips.
-        const REJECTED_PROPOSAL_WINDOW_MS = daysToMs(30);
-        const rejectedProposalSince = new Date(Date.now() - REJECTED_PROPOSAL_WINDOW_MS).toISOString();
-        const allRejectedProposalEvents = readEvents({ type: "proposal_rejected", since: rejectedProposalSince }).events;
-        const rejectedProposalsByRef = new Map();
-        for (const e of allRejectedProposalEvents) {
-            if (e.ref && (!rejectedProposalsByRef.has(e.ref) || e.ts > (rejectedProposalsByRef.get(e.ref)?.ts ?? ""))) {
-                rejectedProposalsByRef.set(e.ref, e);
-            }
-        }
-        const { reflectsWithErrorContext, memoryRefsForInference, gateAutoAcceptedCount: loopGateCount, gateAutoAcceptFailedCount: loopGateFailedCount, } = await runImproveLoopStage({
-            scope,
-            options,
-            primaryStashDir,
-            reflectFn,
-            distillFn,
-            loopRefs: preparation.loopRefs,
-            actions: preparation.actions,
-            signalBearingSet: preparation.signalBearingSet,
-            distillCooledRefs: preparation.distillCooledRefs,
-            distillOnlyRefs: preparation.distillOnlyRefs,
-            recentErrors: preparation.recentErrors,
-            rejectedProposalsByRef,
-            utilityMap: preparation.utilityMap,
-            startMs,
-            budgetMs,
-            eventsCtx,
-            improveProfile,
-        });
-        // #551: consolidation now runs in the preparation stage (before extract);
-        // its result and run-flag are read from `preparation`, not the post-loop.
-        const consolidation = preparation.consolidation;
-        const { allWarnings, deadUrls, memoryInference, graphExtraction, stalenessDetection, maintenanceActions, memoryInferenceDurationMs, graphExtractionDurationMs, orphansPurged, proposalsExpired, gateAutoAcceptedCount: postLoopGateCount, gateAutoAcceptFailedCount: postLoopGateFailedCount, } = await runImprovePostLoopStage({
-            scope,
-            options,
-            primaryStashDir,
-            actionableRefs: preparation.actionableRefs,
-            appliedCleanup: preparation.appliedCleanup,
-            cleanupWarnings: preparation.cleanupWarnings,
-            memoryRefsForInference,
-            reindexFn,
-            eventsCtx,
-            // O-1 (#364): propagate wall-clock budget signal to post-loop maintenance.
-            budgetSignal: budgetAbortController.signal,
-            improveProfile,
-            consolidationRan: preparation.consolidationRan,
-        });
-        const finalActions = maintenanceActions && maintenanceActions.length > 0
-            ? [...preparation.actions, ...maintenanceActions]
-            : preparation.actions;
+        // #616 — bounded multi-cycle phasing. The prep->loop->post-loop sequence is
+        // wrapped in an N-cycle loop. Each cycle re-runs ensureIndex +
+        // collectEligibleRefs (via runIndexAndCollect) so gate-accepted output of
+        // cycle N becomes selectable input to cycle N+1. The per-stage process locks
+        // (consolidate / reflect-distill) are acquired+released INSIDE each cycle,
+        // exactly as the single-pass path did. For maxCycles:1 the loop runs once and
+        // every accumulator below collapses to the single-cycle value (sum-of-one,
+        // concat-of-one, last==only) => BYTE-IDENTICAL to pre-#616.
+        //
+        // Accumulators (see CONSTRAINTS / aggregation plan in #616): SUM the count
+        // fields and durations; CONCAT the array fields; LAST-WINS for point-in-time
+        // objects (the final cycle's value reflects the converged state).
+        let cyclesRun = 0;
+        // Last-wins point-in-time values (assigned every cycle; the final cycle wins).
+        let preparation;
+        let memoryRefsForInference = new Set();
+        let consolidation;
+        let memoryInference;
+        let graphExtraction;
+        let stalenessDetection;
+        let recombination;
+        let proceduralCompilation;
+        // Summed counters/durations.
+        let prepGateCount = 0;
+        let prepGateFailedCount = 0;
+        let reflectsWithErrorContext = 0;
+        let loopGateCount = 0;
+        let loopGateFailedCount = 0;
+        let postLoopGateCount = 0;
+        let postLoopGateFailedCount = 0;
+        let memoryInferenceDurationMs = 0;
+        let graphExtractionDurationMs = 0;
+        let orphansPurged;
+        let proposalsExpired;
+        // Concatenated arrays.
+        const allWarnings = [];
+        let deadUrls;
+        const finalActions = [];
+        for (let cycleIndex = 0; cycleIndex < maxCycles; cycleIndex++) {
+            // #616 budget gate: never start a NEW cycle once the run's wall-clock
+            // budget is exhausted (or the run was aborted). Cycle 0 ALWAYS runs so
+            // maxCycles:1 is byte-identical regardless of budget.
+            if (cycleIndex > 0) {
+                const remaining = budgetAbortController.signal.remainingBudgetMs;
+                if (budgetAbortController.signal.aborted || (remaining !== undefined && remaining <= 0)) {
+                    break;
+                }
+            }
+            // Re-run ensureIndex + collectEligibleRefs + memory-cleanup recompute for
+            // cycles 2+ (cycle 1 already ran them in the first try above). This makes
+            // cycle N's gate-promoted proposals visible to this cycle's ref selection.
+            if (cycleIndex > 0) {
+                await runIndexAndCollect();
+                // Re-emit the profile-filtered audit summary for this cycle's selection.
+                if (profileFilteredRefs.length > 0) {
+                    appendEvent({
+                        eventType: "improve_skipped",
+                        ref: undefined,
+                        metadata: { reason: "profile_filtered_all_passes", count: profileFilteredRefs.length },
+                    }, eventsCtx);
+                }
+            }
+            // #607: acquire consolidate.lock for the preparation stage (consolidate,
+            // ensureIndex, extract all write index.db). Released immediately after.
+            const consolidateLPath = processLockPath(lockBaseDir, "consolidate");
+            const consolidatePrepAcquired = tryAcquireProcessLock(consolidateLPath, PROCESS_LOCK_DEFS.consolidate.staleAfterMs, options.skipIfLocked, "consolidate") === "acquired";
+            preparation = await runImprovePreparationStageImpl({
+                scope,
+                options,
+                plannedRefs,
+                memoryCleanupPlan,
+                primaryStashDir,
+                memorySummary,
+                reindexFn,
+                startMs,
+                budgetMs,
+                eventsCtx,
+                initialCleanupWarnings: preEnsureCleanupWarnings,
+                improveProfile,
+                budgetSignal: budgetAbortController.signal,
+            });
+            if (consolidatePrepAcquired)
+                releaseProcessLock(consolidateLPath);
+            prepGateCount += preparation.gateAutoAcceptedCount;
+            prepGateFailedCount += preparation.gateAutoAcceptFailedCount;
+            // D6: pre-load all proposal_rejected events from the last 30 days once,
+            // so the per-asset loop can use a Map lookup instead of N DB round trips.
+            const REJECTED_PROPOSAL_WINDOW_MS = daysToMs(30);
+            const rejectedProposalSince = new Date(Date.now() - REJECTED_PROPOSAL_WINDOW_MS).toISOString();
+            const allRejectedProposalEvents = readEvents({ type: "proposal_rejected", since: rejectedProposalSince }).events;
+            const rejectedProposalsByRef = new Map();
+            for (const e of allRejectedProposalEvents) {
+                if (e.ref && (!rejectedProposalsByRef.has(e.ref) || e.ts > (rejectedProposalsByRef.get(e.ref)?.ts ?? ""))) {
+                    rejectedProposalsByRef.set(e.ref, e);
+                }
+            }
+            // #607: acquire reflect-distill.lock for the loop stage (reflect + distill
+            // both write proposals to state.db). Released immediately after.
+            const reflectDistillLPath = processLockPath(lockBaseDir, "reflectDistill");
+            const reflectDistillAcquired = tryAcquireProcessLock(reflectDistillLPath, PROCESS_LOCK_DEFS.reflectDistill.staleAfterMs, options.skipIfLocked, "reflect-distill") === "acquired";
+            // Post-lock cooldown re-filter for proactive refs (#SELECT-TIME-LEAK).
+            // Planning built `lastReflectProposalTs` BEFORE acquiring this lock, so a
+            // concurrent run's `reflect_invoked` writes are invisible to it. Now that
+            // we hold the lock, re-read fresh timestamp maps for the proactive subset
+            // and drop any ref whose cooldown has been consumed by the concurrent run.
+            const proactiveLoopRefs = preparation.loopRefs.filter((r) => r.eligibilitySource === "proactive");
+            let postLockLoopRefs = preparation.loopRefs;
+            if (proactiveLoopRefs.length > 0) {
+                const proactiveRefStrs = proactiveLoopRefs.map((r) => r.ref);
+                const freshReflectTs = buildLatestProposalTsMap(proactiveRefStrs, "reflect");
+                const freshDistillTs = buildLatestProposalTsMap(proactiveRefStrs, "distill");
+                const pmDueDays = improveProfile.processes?.proactiveMaintenance?.dueDays ?? DEFAULT_DUE_DAYS;
+                const stillDue = new Set(filterProactiveDue(proactiveLoopRefs, freshReflectTs, freshDistillTs, pmDueDays, Date.now()).map((r) => r.ref));
+                const dropped = proactiveLoopRefs.filter((r) => !stillDue.has(r.ref));
+                if (dropped.length > 0) {
+                    info(`[improve] post-lock cooldown re-filter: dropped ${dropped.length} proactive ref(s) claimed by concurrent run (${dropped.map((r) => r.ref).join(", ")})`);
+                    postLockLoopRefs = preparation.loopRefs.filter((r) => r.eligibilitySource !== "proactive" || stillDue.has(r.ref));
+                }
+            }
+            const loopResult = await runImproveLoopStageImpl({
+                scope,
+                options,
+                primaryStashDir,
+                reflectFn,
+                distillFn,
+                loopRefs: postLockLoopRefs,
+                actions: preparation.actions,
+                signalBearingSet: preparation.signalBearingSet,
+                distillCooledRefs: preparation.distillCooledRefs,
+                distillOnlyRefs: preparation.distillOnlyRefs,
+                recentErrors: preparation.recentErrors,
+                rejectedProposalsByRef,
+                utilityMap: preparation.utilityMap,
+                startMs,
+                budgetMs,
+                eventsCtx,
+                improveProfile,
+                budgetSignal: budgetAbortController.signal,
+            });
+            if (reflectDistillAcquired)
+                releaseProcessLock(reflectDistillLPath);
+            const loopGateCountThisCycle = loopResult.gateAutoAcceptedCount;
+            reflectsWithErrorContext += loopResult.reflectsWithErrorContext;
+            loopGateCount += loopResult.gateAutoAcceptedCount;
+            loopGateFailedCount += loopResult.gateAutoAcceptFailedCount;
+            memoryRefsForInference = loopResult.memoryRefsForInference;
+            // #551: consolidation now runs in the preparation stage (before extract);
+            // its result and run-flag are read from `preparation`, not the post-loop.
+            consolidation = preparation.consolidation;
+            // #607: acquire consolidate.lock for the post-loop stage (memoryInference +
+            // graphExtraction both write index.db). Released immediately after.
+            const consolidatePostLPath = processLockPath(lockBaseDir, "consolidate");
+            const consolidatePostAcquired = tryAcquireProcessLock(consolidatePostLPath, PROCESS_LOCK_DEFS.consolidate.staleAfterMs, options.skipIfLocked, "consolidate") === "acquired";
+            const postLoopResult = await runImprovePostLoopStageImpl({
+                scope,
+                options,
+                primaryStashDir,
+                actionableRefs: preparation.actionableRefs,
+                appliedCleanup: preparation.appliedCleanup,
+                cleanupWarnings: preparation.cleanupWarnings,
+                memoryRefsForInference,
+                reindexFn,
+                eventsCtx,
+                budgetSignal: budgetAbortController.signal,
+                improveProfile,
+                consolidationRan: preparation.consolidationRan,
+            });
+            if (consolidatePostAcquired)
+                releaseProcessLock(consolidatePostLPath);
+            const postLoopGateCountThisCycle = postLoopResult.gateAutoAcceptedCount;
+            // Last-wins point-in-time objects.
+            memoryInference = postLoopResult.memoryInference;
+            graphExtraction = postLoopResult.graphExtraction;
+            stalenessDetection = postLoopResult.stalenessDetection;
+            recombination = postLoopResult.recombination;
+            proceduralCompilation = postLoopResult.proceduralCompilation;
+            // Summed counters/durations.
+            postLoopGateCount += postLoopResult.gateAutoAcceptedCount;
+            postLoopGateFailedCount += postLoopResult.gateAutoAcceptFailedCount;
+            memoryInferenceDurationMs += postLoopResult.memoryInferenceDurationMs;
+            graphExtractionDurationMs += postLoopResult.graphExtractionDurationMs;
+            if (postLoopResult.orphansPurged !== undefined) {
+                orphansPurged = (orphansPurged ?? 0) + postLoopResult.orphansPurged;
+            }
+            if (postLoopResult.proposalsExpired !== undefined) {
+                proposalsExpired = (proposalsExpired ?? 0) + postLoopResult.proposalsExpired;
+            }
+            // Concatenated arrays.
+            allWarnings.push(...postLoopResult.allWarnings);
+            if (postLoopResult.deadUrls !== undefined) {
+                deadUrls = [...(deadUrls ?? []), ...postLoopResult.deadUrls];
+            }
+            const maintenanceActions = postLoopResult.maintenanceActions;
+            if (maintenanceActions && maintenanceActions.length > 0) {
+                finalActions.push(...preparation.actions, ...maintenanceActions);
+            }
+            else {
+                finalActions.push(...preparation.actions);
+            }
+            cyclesRun++;
+            // #616 fixed-point stop: a cycle that produced ZERO gate-accepted proposals
+            // (summed across prep + loop + post-loop) would feed cycle N+1 an identical
+            // ref set, so end the loop here rather than spin a pointless next cycle.
+            const gateAcceptedThisCycle = preparation.gateAutoAcceptedCount + loopGateCountThisCycle + postLoopGateCountThisCycle;
+            if (gateAcceptedThisCycle === 0)
+                break;
+        }
         const result = {
             schemaVersion: 1,
             ok: true,
@@ -949,17 +1270,19 @@ export async function akmImprove(options = {}) {
             ...(memoryInferenceDurationMs > 0 ? { memoryInferenceDurationMs } : {}),
             ...(graphExtractionDurationMs > 0 ? { graphExtractionDurationMs } : {}),
             ...(stalenessDetection ? { stalenessDetection } : {}),
+            ...(recombination ? { recombination } : {}),
+            ...(proceduralCompilation ? { proceduralCompilation } : {}),
             ...(orphansPurged !== undefined ? { orphansPurged } : {}),
             ...(proposalsExpired !== undefined && proposalsExpired > 0 ? { proposalsExpired } : {}),
             reflectCooldownActions: finalActions.filter((a) => a.mode === "reflect-cooldown").length,
             reflectSkippedActions: finalActions.filter((a) => a.mode === "reflect-skipped").length,
             reflectGuardRejectedActions: finalActions.filter((a) => a.mode === "reflect-guard-rejected").length,
             ...(() => {
-                const t = preparation.gateAutoAcceptedCount + loopGateCount + postLoopGateCount;
+                const t = prepGateCount + loopGateCount + postLoopGateCount;
                 return t > 0 ? { gateAutoAcceptedCount: t } : {};
             })(),
             ...(() => {
-                const f = preparation.gateAutoAcceptFailedCount + loopGateFailedCount + postLoopGateFailedCount;
+                const f = prepGateFailedCount + loopGateFailedCount + postLoopGateFailedCount;
                 return f > 0 ? { gateAutoAcceptFailedCount: f } : {};
             })(),
             ...(triageDrain
@@ -972,6 +1295,10 @@ export async function akmImprove(options = {}) {
                     },
                 }
                 : {}),
+            ...(preparation.proactiveMaintenance ? { proactiveMaintenance: preparation.proactiveMaintenance } : {}),
+            // #616 — report cycles run only when >1 so the default single-pass
+            // serialized envelope stays byte-identical to pre-#616 (AC1).
+            ...(cyclesRun > 1 ? { cyclesRun } : {}),
             ...(options.runId !== undefined ? { runId: options.runId } : {}),
         };
         if (!result.dryRun)
@@ -1054,15 +1381,12 @@ export async function akmImprove(options = {}) {
         // O-1 (#364): Clear the budget abort timer so it does not keep the event
         // loop alive after the run completes.
         clearBudgetTimer();
-        try {
-            fs.unlinkSync(resolvedLockPath);
-        }
-        catch {
-            // ignore
-        }
-        // The normal path released the lock above; drop the process.exit backstop so
-        // it does not fire later (or accumulate across repeated in-process calls).
-        process.removeListener("exit", releaseLockOnExit);
+        // #607: release any per-process locks still held (backstop for error paths;
+        // the normal path already released each lock after its stage completed).
+        releaseAllProcessLocks();
+        // Drop the process.exit backstop so it does not fire later (or accumulate
+        // across repeated in-process calls).
+        process.removeAllListeners("exit");
         // I1: close the long-lived state.db connection opened at the top of the run.
         try {
             eventsDb?.close();
@@ -1175,6 +1499,11 @@ function emitImproveCompletedEvent(result, durations, eventsCtx) {
             memoryInferenceDurationMs: durations.memoryInferenceDurationMs,
             graphExtractionExtractedFiles: result.graphExtraction?.quality.extractedFiles ?? 0,
             graphExtractionDurationMs: durations.graphExtractionDurationMs,
+            // Layer-2 proactive-maintenance coverage (0 when the process is disabled
+            // or the run was ref-scoped) so a scheduled sweep's reach is trackable.
+            proactiveSelected: result.proactiveMaintenance?.selected ?? 0,
+            proactiveDueTotal: result.proactiveMaintenance?.dueTotal ?? 0,
+            proactiveNeverReflected: result.proactiveMaintenance?.neverReflected ?? 0,
             // New metrics for tuning the improve loop.
             ...(durations.totalDurationMs !== undefined ? { durationMs: durations.totalDurationMs } : {}),
             ...(durations.warningCount !== undefined ? { warningCount: durations.warningCount } : {}),
@@ -1213,7 +1542,7 @@ function emitImproveCompletedEvent(result, durations, eventsCtx) {
  *      need, so the fix is non-invasive and provably correct.
  */
 async function runConsolidationPass(args) {
-    const { options, primaryStashDir, memorySummary, improveProfile, eventsCtx } = args;
+    const { options, primaryStashDir, memorySummary, improveProfile, eventsCtx, budgetSignal, runBudgetMs } = args;
     const baseConfig = options.config ?? loadConfig();
     const MEMORY_VOLUME_THRESHOLD = options.memoryVolumeConsolidationThreshold ?? 100;
     const hasLlm = !!(baseConfig.defaults?.llm || baseConfig.defaults?.agent);
@@ -1357,6 +1686,7 @@ async function runConsolidationPass(args) {
         stashDir: primaryStashDir,
         config: consolidationConfig,
         eventsCtx,
+        stateDbPath: eventsCtx?.dbPath,
     }, { minimumThreshold: 95 });
     if (consolidateDisabledByProfile) {
         info("[improve] consolidation skipped (disabled by improve profile)");
@@ -1385,14 +1715,22 @@ async function runConsolidationPass(args) {
             // Tie consolidate proposals back to this improve invocation so
             // accept-rate-per-run aggregation works. Mirrors reflect/propose/extract.
             sourceRun: `consolidate-${Date.now()}`,
-            // Full-pool sweep: consolidation only runs on the nightly default-profile
-            // pass (quick/frequent disable it), so a complete re-cluster is correct and
-            // affordable here. Do NOT pass incrementalSince — the time-window narrowing
-            // it triggers permanently excludes stale-but-unmerged duplicate clusters,
-            // starving merge recall and letting the pool grow unbounded. (The narrowing
-            // was a band-aid for an every-30-min consolidation cadence that the profile
-            // split has since eliminated.) lastConsolidateTs still gates whether we run.
+            // Pass profile-configured options. incrementalSince narrows the pool to
+            // recently-changed memories + graph neighbours — use this for frequent
+            // passes (quick-shredder). Leave absent in the nightly default profile for
+            // a full-pool sweep that catches stale-but-unmerged duplicates.
+            incrementalSince: improveProfile?.processes?.consolidate?.incrementalSince,
+            limit: improveProfile?.processes?.consolidate?.limit,
+            neighborsPerChanged: improveProfile?.processes?.consolidate?.neighborsPerChanged,
             maxChunkSize: improveProfile?.processes?.consolidate?.maxChunkSize,
+            // #617 — deterministic near-duplicate dedup pre-pass. DEFAULT OFF; only
+            // runs when the profile explicitly sets `consolidate.dedup.enabled`.
+            dedup: improveProfile?.processes?.consolidate?.dedup,
+            // #581 — judged-state cache. DEFAULT OFF; only engages when the profile
+            // explicitly sets `consolidate.judgedCache.enabled`. Skips memories
+            // judged-unchanged since their last judge so one run sweeps the full
+            // corpus instead of narrowing to a time-window slice.
+            judgedCache: improveProfile?.processes?.consolidate?.judgedCache,
             // Honor profile.autoAccept (already merged into options.autoAccept at the
             // top of akmImprove). The CLI parser always supplies 90 when --auto-accept
             // is absent, so ?? 90 is not needed here and would prevent --auto-accept=false
@@ -1400,6 +1738,13 @@ async function runConsolidationPass(args) {
             // options.consolidateOptions.autoAccept (if explicitly provided by caller)
             // still wins because the spread above runs first.
             autoAccept: options.consolidateOptions?.autoAccept ?? options.autoAccept,
+            // WS-3a: forward budget signal for graceful abort on timeout, and pass
+            // the profile's p90 estimate for cold-start budget reduction.
+            signal: budgetSignal,
+            p90ChunkSecondsDefault: improveProfile?.processes?.consolidate?.p90ChunkSecondsDefault,
+            // WS-5: pass total run budget so perfTelemetry.estimatedBudgetFractionUsed
+            // can flag when consolidation alone exceeded the budget.
+            runBudgetMs,
         }));
         {
             const consolidateGr = await runAutoAcceptGate(consolidation.promoted.map((proposalId) => {
@@ -1420,7 +1765,14 @@ async function runConsolidationPass(args) {
             appendEvent({
                 eventType: "consolidate_completed",
                 ref: "memory:_consolidation",
-                metadata: { processed: consolidation.processed, merged: consolidation.merged },
+                metadata: {
+                    processed: consolidation.processed,
+                    merged: consolidation.merged,
+                    deleted: consolidation.deleted,
+                    contradicted: consolidation.contradicted,
+                    failedChunks: consolidation.failedChunks ?? 0,
+                    durationMs: consolidation.durationMs,
+                },
             }, eventsCtx);
         }
     }
@@ -1437,10 +1789,21 @@ async function runConsolidationPass(args) {
     }
     // D9: track whether consolidation wrote any data so graph extraction can reindex if needed
     const consolidationRan = !consolidateDisabledByProfile && !poolBelowMinSize && !consolidationOnCooldown && consolidation.processed > 0;
+    // WS-4: Per-phase threshold auto-tune for the consolidate phase.
+    // Persists result for the NEXT run's makeGateConfig to read.
+    const consolidateTuneDbPath = eventsCtx?.dbPath;
+    if (options.autoAccept !== undefined && consolidateTuneDbPath) {
+        try {
+            maybeAutoTuneThreshold(consolidateGateCfg.phaseThreshold ?? options.autoAccept, consolidationConfig, consolidateTuneDbPath, undefined, "consolidate");
+        }
+        catch (err) {
+            warn(`[improve] calibration auto-tune (consolidate) skipped: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
     return { consolidation, consolidationRan, gateAutoAcceptedCount, gateAutoAcceptFailedCount };
 }
 async function runImprovePreparationStage(args) {
-    const { scope, options, plannedRefs, memoryCleanupPlan, primaryStashDir, memorySummary, reindexFn, startMs, budgetMs, eventsCtx, initialCleanupWarnings, improveProfile, } = args;
+    const { scope, options, plannedRefs, memoryCleanupPlan, primaryStashDir, memorySummary, reindexFn, startMs, budgetMs, eventsCtx, initialCleanupWarnings, improveProfile, budgetSignal, } = args;
     const actions = [];
     const cleanupWarnings = initialCleanupWarnings ? [...initialCleanupWarnings] : [];
     // Phase 0 — MEMORY.md budget check (200-line cap; warn at 180)
@@ -1477,6 +1840,8 @@ async function runImprovePreparationStage(args) {
         memorySummary,
         improveProfile,
         eventsCtx,
+        budgetSignal,
+        runBudgetMs: budgetMs,
     });
     // Phase 0.4 — session-extract pass.
     //
@@ -1509,6 +1874,7 @@ async function runImprovePreparationStage(args) {
         stashDir: primaryStashDir,
         config: extractConfig,
         eventsCtx,
+        stateDbPath: eventsCtx?.dbPath,
     });
     // #554 minNewSessions gate: skip the entire extract pass (ensureIndex was
     // already done upstream; here we elide every akmExtract/processSession call)
@@ -1521,15 +1887,19 @@ async function runImprovePreparationStage(args) {
     // memory mtimes, so a skipped extract never flags work for the NEXT run's
     // consolidation mtime-gate (the downstream trigger #554 asks us to suppress).
     const EXTRACT_DEFAULT_MIN_NEW_SESSIONS = 0;
-    const configuredMinNewSessions = extractConfig.profiles?.improve?.default?.processes?.extract?.minNewSessions;
+    // Read from the ACTIVE resolved profile (not always `default`), matching how
+    // `extract.enabled` resolves — otherwise a non-default profile (e.g.
+    // `frequent`) setting `minNewSessions` was silently ignored.
+    const configuredMinNewSessions = improveProfile.processes?.extract?.minNewSessions;
     const minNewSessions = typeof configuredMinNewSessions === "number" ? configuredMinNewSessions : EXTRACT_DEFAULT_MIN_NEW_SESSIONS;
-    // #593: gate on BOTH the legacy feature flag (which only reads
-    // `profiles.improve.default.processes.extract.enabled` — kept for back-compat
-    // with users who disable extract via the default-profile path) AND the active
-    // resolved profile. Without the second check a non-default profile setting
-    // `extract.enabled: false` (e.g. the built-in `quick`) was silently ignored
-    // and extract ran on every improve call regardless.
-    if (isLlmFeatureEnabled(extractConfig, "session_extraction") && resolveProcessEnabled("extract", improveProfile)) {
+    // #593/#594: the ACTIVE resolved improve profile is the single source of
+    // truth for whether extract runs. (Previously this also ANDed in the legacy
+    // `session_extraction` feature flag, which only reads
+    // `profiles.improve.default.processes.extract.enabled`; that made the default
+    // profile a global kill switch, so a non-default profile enabling extract was
+    // silently overridden. The default profile is now just another profile.)
+    // `akmExtract` re-checks the same active profile internally via `improveProfile`.
+    if (resolveProcessEnabled("extract", improveProfile)) {
         const availableHarnesses = options.extractHarnesses ?? getAvailableHarnesses();
         // The guard engages only when minNewSessions > 0; 0 disables it entirely.
         let belowMinNewSessions = false;
@@ -1537,6 +1907,11 @@ async function runImprovePreparationStage(args) {
             const countFn = options.extractCandidateCountFn ?? countNewExtractCandidates;
             const newCandidateCount = countFn(extractConfig, {
                 ...(options.extractHarnesses ? { harnesses: options.extractHarnesses } : {}),
+                // Use the ACTIVE profile's discovery window so the gate counts over the
+                // same window akmExtract will scan (not always `default`).
+                ...(improveProfile.processes?.extract?.defaultSince
+                    ? { since: improveProfile.processes.extract.defaultSince }
+                    : {}),
                 // C2: pin the candidate-count state.db open to the boundary-resolved path.
                 ...(eventsCtx?.dbPath ? { stateDbPath: eventsCtx.dbPath } : {}),
             });
@@ -1564,6 +1939,9 @@ async function runImprovePreparationStage(args) {
                         type: h.name,
                         ...(primaryStashDir !== undefined ? { stashDir: primaryStashDir } : {}),
                         config: extractConfig,
+                        // Thread the ACTIVE profile so extract's internal gate + per-process
+                        // config read the running profile, not always `default`.
+                        improveProfile,
                         dryRun: options.dryRun ?? false,
                         ...(options.extractHarnesses ? { harnesses: options.extractHarnesses } : {}),
                         // C2: pin extract's skip-tracking state.db open to the boundary path.
@@ -1791,10 +2169,19 @@ async function runImprovePreparationStage(args) {
     //                         refs that fail the distill signal-delta gate).
     //   distillOnlyRefs     — reflect blocked but distill signal-delta passes
     //                         AND ref is a distill candidate.
-    //   fullySkippedCount   — neither gate passes → synthetic skip action
-    //                         + improve_skipped event, excluded from sort.
+    //   noFeedbackPool      — neither signal-delta gate passes *and* the ref has
+    //                         no recent feedback signal at all. These are NOT
+    //                         skipped here: they are handed to the high-retrieval
+    //                         fallback (P0-A) below so frequently-retrieved but
+    //                         never-rated assets can still be improved. Only refs
+    //                         that P0-A declines are ultimately fully skipped.
+    //   fullySkippedCount   — has stale feedback but no signal delta → genuine
+    //                         skip (counted, aggregated event emitted post-loop),
+    //                         excluded from sort.
     const eligibleRefs = [];
     const distillOnlyRefs = [];
+    // Zero-(recent-)feedback refs deferred to the P0-A high-retrieval fallback.
+    const noFeedbackPool = [];
     let fullySkippedCount = 0;
     // O-2 (#365): explicit --scope <ref> bypasses every gate (user intent wins).
     const scopeRefBypass = scope.mode === "ref";
@@ -1832,57 +2219,134 @@ async function runImprovePreparationStage(args) {
             // Reflect blocked but distill passes → distill-only bucket.
             distillOnlyRefs.push(r);
         }
+        else if (!latestFeedbackTs.has(r.ref)) {
+            // Neither signal-delta gate passes AND there is no recent feedback signal
+            // at all. Rather than skip outright, defer to the high-retrieval fallback
+            // (P0-A) below: a never-rated-but-frequently-retrieved asset is exactly
+            // what that path is meant to rescue. Refs P0-A declines are skipped there.
+            noFeedbackPool.push(r);
+        }
         else {
-            // Neither gate passes — fully skipped.
+            // Has feedback on record but no signal delta since the last proposal —
+            // genuinely fully skipped. Counted here; a single aggregated
+            // improve_skipped event is emitted after the loop (mirrors
+            // profile_filtered_all_passes) instead of one event per ref.
             fullySkippedCount++;
             actions.push({
                 ref: r.ref,
                 mode: "distill-skipped",
                 result: { ok: true, reason: "no new signal since last proposal" },
             });
-            appendEvent({ eventType: "improve_skipped", ref: r.ref, metadata: { reason: "no_new_signal" } }, eventsCtx);
         }
     }
+    // Emit ONE aggregated skip event for the fully-skipped bucket rather than one
+    // improve_skipped event per ref (#592 pattern, mirrors
+    // profile_filtered_all_passes above). The per-ref loop previously produced
+    // ~11K state.db writes per run on a large stash, the dominant contributor to
+    // 900 s timeouts. The in-memory `actions` log keeps the per-ref detail for the
+    // run summary; no downstream consumer needs a per-ref DB audit trail (health's
+    // skip histogram reads the `no_new_signal` counter from the count field).
+    if (fullySkippedCount > 0) {
+        appendEvent({
+            eventType: "improve_skipped",
+            ref: undefined,
+            metadata: {
+                reason: "no_new_signal",
+                count: fullySkippedCount,
+            },
+        }, eventsCtx);
+    }
     // ── Phase 4: signal/feedback/utility/sort on the reduced set ──────────────
-    // Everything from here works only on (eligibleRefs ∪ distillOnlyRefs). The
-    // fully-skipped bucket has already been routed and emitted; we deliberately
-    // avoid spending DB/CPU on refs that cannot enter the loop.
+    // Everything from here works on (eligibleRefs ∪ distillOnlyRefs) plus the
+    // deferred noFeedbackPool that may be rescued by the high-retrieval fallback
+    // (P0-A). The fully-skipped bucket has already been routed and its aggregated
+    // event emitted; we deliberately avoid spending DB/CPU on refs that the
+    // signal-delta gate rejected with feedback already on record.
     const processableRefs = [...eligibleRefs, ...distillOnlyRefs];
+    // Refs eligible for the high-retrieval fallback (P0-A): the signal-delta
+    // partition above could not place these in a reflect/distill bucket, but they
+    // may still qualify if they have been retrieved often enough. Two disjoint
+    // sources feed this set:
+    //   1. noFeedbackPool — refs with no recent feedback that the partition loop
+    //      deliberately deferred here (otherwise they would never reach P0-A).
+    //   2. processableRefs entries that turn out to carry no recent feedback
+    //      *signal* once feedbackSummary is computed below.
+    // (1) is added here; (2) is folded in after feedbackSummary is built.
     // Gap 6: only surface feedback signals from the last 30 days so that
     // ancient one-off feedback events don't permanently lock an asset into
     // every improve run. Assets with only stale signals fall through to the
     // high-retrieval path (P0-A) or are skipped until new signals arrive.
     // (FEEDBACK_SIGNAL_WINDOW_DAYS / feedbackSinceCutoff are already defined in
     // Phase 2 above for the signal-delta gate; we reuse them here.)
-    // Pre-compute feedback summary per ref in a single pass so we don't issue
-    // two readEvents({type:"feedback", ref}) per asset (one for signal filtering,
-    // one for ratio computation).
+    // Pre-compute feedback summary per ref in a SINGLE bulk read so we don't
+    // open state.db once per asset (which caused 5000+ accumulated FDs and a
+    // 2-hour runaway on a 13K-asset stash). Pattern mirrors buildLatestFeedbackTsMap
+    // above: one readEvents() call fetches ALL feedback events, then we aggregate
+    // in-memory by ref — O(1) DB opens regardless of candidate set size.
+    // Cover processableRefs *and* the deferred noFeedbackPool so utility/feedback
+    // ratios are available for any noFeedbackPool ref that P0-A rescues below.
+    //
+    // Behavioral note: positive/negative COUNTS are all-time (same as the old
+    // per-ref readEvents call which had no `since` filter); hasSignal is bounded
+    // to feedbackSinceCutoff (same as the old inline `(e.ts ?? "") >= cutoff` guard).
     const feedbackSummary = new Map();
-    for (const candidate of processableRefs) {
-        const { events } = readEvents({ type: "feedback", ref: candidate.ref });
-        let hasSignal = false;
-        let positive = 0;
-        let negative = 0;
-        for (const e of events) {
-            if (!hasSignal &&
-                (e.ts ?? "") >= feedbackSinceCutoff &&
-                e.metadata !== undefined &&
-                (typeof e.metadata.signal === "string" || typeof e.metadata.note === "string")) {
-                hasSignal = true;
-            }
-            if (e.metadata?.signal === "positive")
-                positive++;
-            else if (e.metadata?.signal === "negative")
-                negative++;
-        }
-        feedbackSummary.set(candidate.ref, { hasSignal, positive, negative });
+    {
+        const feedbackCandidateSet = new Set([...processableRefs, ...noFeedbackPool].map((r) => r.ref));
+        if (feedbackCandidateSet.size > 0) {
+            // Fetch ALL feedback events in one query (no ref filter, no since filter =
+            // single full table scan). Filtering per-ref in memory avoids N sequential
+            // state.db opens — the dominant FD-leak path on large stashes.
+            const { events: allFeedbackEvents } = readEvents({ type: "feedback" }, eventsCtx);
+            for (const e of allFeedbackEvents) {
+                const ref = e.ref;
+                if (!ref || !feedbackCandidateSet.has(ref))
+                    continue;
+                const entry = feedbackSummary.get(ref) ?? { hasSignal: false, positive: 0, negative: 0 };
+                const meta = e.metadata;
+                // hasSignal: only count feedback events within the 30-day window.
+                if (!entry.hasSignal &&
+                    (e.ts ?? "") >= feedbackSinceCutoff &&
+                    meta !== undefined &&
+                    (typeof meta.signal === "string" || typeof meta.note === "string")) {
+                    entry.hasSignal = true;
+                }
+                // positive/negative: all-time counts (no since filter, matching prior behaviour).
+                if (meta?.signal === "positive")
+                    entry.positive++;
+                else if (meta?.signal === "negative")
+                    entry.negative++;
+                feedbackSummary.set(ref, entry);
+            }
+            // Ensure every candidate has an entry (even refs with zero feedback events).
+            for (const ref of feedbackCandidateSet) {
+                if (!feedbackSummary.has(ref)) {
+                    feedbackSummary.set(ref, { hasSignal: false, positive: 0, negative: 0 });
+                }
+            }
+        }
     }
     const signalFiltered = processableRefs.filter((candidate) => feedbackSummary.get(candidate.ref)?.hasSignal === true);
     // P0-A: also surface zero-feedback assets that have been retrieved many times.
     const RETRIEVAL_COUNT_THRESHOLD = options.minRetrievalCount ?? 5;
     const signalBearingSet = new Set(signalFiltered.map((r) => r.ref));
-    const noFeedbackCandidates = processableRefs.filter((r) => !signalBearingSet.has(r.ref));
+    // Zero-feedback candidates for P0-A: processableRefs without a recent signal,
+    // plus the deferred noFeedbackPool. Dedupe by ref (the two sources are
+    // disjoint by construction, but guard against overlap defensively).
+    const noFeedbackSeen = new Set();
+    const noFeedbackCandidates = [];
+    for (const r of [...processableRefs.filter((r) => !signalBearingSet.has(r.ref)), ...noFeedbackPool]) {
+        if (noFeedbackSeen.has(r.ref))
+            continue;
+        noFeedbackSeen.add(r.ref);
+        noFeedbackCandidates.push(r);
+    }
     let highRetrievalRefs = [];
+    // Retrieval counts for the zero-feedback pool, hoisted so the Layer-2
+    // proactive-maintenance selector below can reuse them without a second DB pass.
+    // Also fetch lastUseMs here for the proactive-maintenance recency term (plan §WS-1
+    // step 2: recency is MANDATORY — never pinned to floor).
+    let retrievalCounts = new Map();
+    let lastUseMsForProactive = new Map();
     let dbForRetrieval;
     try {
         dbForRetrieval = openExistingDatabase();
@@ -1890,15 +2354,29 @@ async function runImprovePreparationStage(args) {
         if (showEventCount === 0) {
             warn("Warning: show events not yet in usage_events — zero-feedback fallback will match only search-retrieved assets.");
         }
-        const retrievalCounts = getRetrievalCounts(dbForRetrieval, noFeedbackCandidates.map((r) => r.ref));
+        // Fetch retrieval counts for ALL candidates — not only the zero-feedback pool.
+        // Previously only noFeedbackCandidates were looked up, so feedback-bearing refs
+        // had retrievalFreq=0 in computeSalience(), collapsing their retrievalSalience
+        // to 0 regardless of actual use. Two assets of the same type — one
+        // heavily-retrieved, one never-touched — would receive identical rankScores.
+        // Fix (WS-1 blocker 3): union the feedback pool into the lookup.
+        const allCandidateRefs = [...new Set([...signalFiltered, ...noFeedbackCandidates].map((r) => r.ref))];
+        retrievalCounts = getRetrievalCounts(dbForRetrieval, allCandidateRefs);
+        lastUseMsForProactive = getLastUseMsByRef(dbForRetrieval, noFeedbackCandidates.map((r) => r.ref));
         // High-retrieval signal-delta (simplified rule, 0.8.0): a no-feedback
-        // ref qualifies exactly once — when retrievalCount ≥ threshold AND no
-        // prior reflect proposal exists for it. Once a reflect proposal is on
-        // record, subsequent re-eligibility requires explicit feedback (which
-        // flows through the normal signal-delta gate above). Tracking growth in
-        // retrieval count would require persisting the count in proposal
-        // metadata; deferred to a follow-up.
-        highRetrievalRefs = noFeedbackCandidates.filter((r) => (retrievalCounts.get(r.ref) ?? 0) >= RETRIEVAL_COUNT_THRESHOLD && !lastReflectProposalTs.has(r.ref));
+        // ref qualifies exactly once — when it has actually been retrieved
+        // (retrievalCount ≥ 1) AND retrievalCount ≥ threshold AND no prior reflect
+        // proposal exists for it. Once a reflect proposal is on record, subsequent
+        // re-eligibility requires explicit feedback (which flows through the normal
+        // signal-delta gate above). The explicit `> 0` guard keeps a threshold of 0
+        // from rescuing genuinely never-retrieved assets — the fallback is for
+        // *retrieved* assets, not silent ones. Tracking growth in retrieval count
+        // would require persisting the count in proposal metadata; deferred to a
+        // follow-up.
+        highRetrievalRefs = noFeedbackCandidates.filter((r) => {
+            const count = retrievalCounts.get(r.ref) ?? 0;
+            return count > 0 && count >= RETRIEVAL_COUNT_THRESHOLD && !lastReflectProposalTs.has(r.ref);
+        });
     }
     catch (err) {
         rethrowIfTestIsolationError(err);
@@ -1908,6 +2386,137 @@ async function runImprovePreparationStage(args) {
         if (dbForRetrieval)
             closeDatabase(dbForRetrieval);
     }
+    // ── Layer 2: PROACTIVE MAINTENANCE SELECTOR (third eligibility source) ─────
+    // The signal-delta gate and P0-A only surface assets with fresh feedback or a
+    // raw-retrieval spike. Neither revisits a stable, high-value asset on a
+    // schedule, so on a quiet stash useful assets drift stale and are never
+    // refreshed. When the `proactiveMaintenance` process is enabled (DEFAULT OFF)
+    // and the run is whole-stash / type scope, this selector ranks the eligible
+    // population by a composite maintenance priority, gates on staleness ("due"),
+    // bounds to top-N, and folds the winners into the SAME candidate set the other
+    // two sources feed — so they flow through the existing #580 empty-diff /
+    // cosmetic suppression and additive-distill gates. It adds no new mutation
+    // logic of its own. The due gate doubles as the rotation cooldown: a freshly
+    // reflected asset is excluded until it ages back past `dueDays`, so successive
+    // runs rotate through the due pool rather than re-selecting the same heads.
+    let proactiveRefs = [];
+    let proactiveMaintenanceSummary;
+    const proactiveEnabled = scope.mode !== "ref" && resolveProcessEnabled("proactiveMaintenance", improveProfile);
+    if (proactiveEnabled) {
+        const pmCfg = improveProfile.processes?.proactiveMaintenance;
+        const dueDays = pmCfg?.dueDays ?? DEFAULT_DUE_DAYS;
+        const maxPerRun = pmCfg?.maxPerRun ?? pmCfg?.limit ?? DEFAULT_MAX_PER_RUN;
+        // Candidate population: the zero-feedback / non-signal pool — exactly the
+        // assets the other two sources would NOT pick this run. Exclude any P0-A
+        // rescued this run so we never double-select the same ref.
+        const alreadySelected = new Set(highRetrievalRefs.map((r) => r.ref));
+        const pmCandidates = noFeedbackCandidates.filter((r) => !alreadySelected.has(r.ref));
+        const selection = selectProactiveMaintenanceRefs({
+            candidates: pmCandidates,
+            lastReflectTs: lastReflectProposalTs,
+            lastDistillTs: lastDistillProposalTs,
+            retrievalCounts,
+            // WS-1: wire lastUseMs so the recency decay term is genuine (plan §step 2).
+            lastUseMs: lastUseMsForProactive,
+            sizeBytesOf: (r) => {
+                const fp = r.filePath;
+                if (!fp)
+                    return undefined;
+                try {
+                    return fs.statSync(fp).size;
+                }
+                catch {
+                    return undefined;
+                }
+            },
+            dueDays,
+            maxPerRun,
+        });
+        proactiveRefs = selection.selected;
+        proactiveMaintenanceSummary = {
+            selected: selection.selected.length,
+            dueTotal: selection.dueTotal,
+            neverReflected: selection.neverReflected,
+        };
+        // Aggregated observability event (never per-ref — avoids the event flood the
+        // Layer-1 work eliminated). Mirrors the `no_new_signal` aggregation pattern.
+        appendEvent({
+            eventType: "proactive_selected",
+            ref: undefined,
+            metadata: {
+                count: selection.selected.length,
+                dueTotal: selection.dueTotal,
+                neverReflected: selection.neverReflected,
+            },
+        }, eventsCtx);
+        if (selection.selected.length > 0) {
+            info(`[improve] proactive maintenance selected ${selection.selected.length}/${selection.dueTotal} due refs ` +
+                `(${selection.neverReflected} never reflected, dueDays=${dueDays}, maxPerRun=${maxPerRun})`);
+        }
+    }
+    // ── Layer 3: HIGH-SALIENCE ADMISSION GATE (#608) ──────────────────────────
+    // Zero-feedback refs whose encoding_salience (set at distill time by
+    // scoreEncodingSalience) exceeds the configured salienceThreshold are admitted
+    // into the improve run even without retrieval or feedback signal. This rescues
+    // newly distilled assets that the stash has not yet surfaced to users.
+    //
+    // Cap: at most 10% of the effective run limit so the lane cannot crowd out
+    // reactive feedback. Requires state.db to have an asset_salience row — refs
+    // without a row (pre-#608 assets still on the type-weight stub) are skipped.
+    //
+    // Cooldown: a ref qualifies at most once — when no prior reflect proposal
+    // exists for it (`!lastReflectProposalTs.has`). Without this guard the lane
+    // re-selects the same high-salience refs on EVERY run (auto-accept emits a
+    // `promoted` event, not `feedback`, so the ref never leaves
+    // noFeedbackCandidates), burning LLM calls and churning the asset. This
+    // mirrors the P0-A high-retrieval gate's `!lastReflectProposalTs.has(r.ref)`
+    // guard above so all "rescue" lanes share the same once-per-asset semantics.
+    const highSalienceRefs = [];
+    const salienceCfg = (options.config ?? loadConfig()).improve?.salience;
+    const salienceThreshold = salienceCfg?.salienceThreshold ?? 0.75;
+    const proactiveAndRetrievalSet = new Set([...highRetrievalRefs, ...proactiveRefs].map((r) => r.ref));
+    {
+        let dbForHighSalience;
+        try {
+            dbForHighSalience = openStateDatabase(eventsCtx?.dbPath);
+            const effectiveLimit = options.limit ?? 10;
+            const highSalienceCap = Math.max(1, Math.floor(effectiveLimit * 0.1));
+            const candidates = noFeedbackCandidates.filter((r) => !proactiveAndRetrievalSet.has(r.ref));
+            for (const r of candidates) {
+                if (highSalienceRefs.length >= highSalienceCap)
+                    break;
+                const row = getAssetSalience(dbForHighSalience, r.ref);
+                if (row && row.encoding_salience >= salienceThreshold && !lastReflectProposalTs.has(r.ref)) {
+                    highSalienceRefs.push(r);
+                }
+            }
+        }
+        catch (err) {
+            rethrowIfTestIsolationError(err);
+            // best-effort: if DB unavailable, highSalienceRefs stays empty
+        }
+        finally {
+            if (dbForHighSalience)
+                dbForHighSalience.close();
+        }
+    }
+    // Record an in-memory skip action for every zero-feedback ref that the
+    // partition loop deferred to P0-A but P0-A then declined (retrievalCount below
+    // threshold, or a prior reflect proposal already on record). These never make
+    // it into mergedRefs, so without this they would silently vanish from the run
+    // summary. No DB event is written here — these refs carry no signal at all, so
+    // there is nothing for the skip histogram to aggregate; the action log alone
+    // preserves the per-ref audit trail (mirrors the fully-skipped action above).
+    const rescuedSet = new Set([...highRetrievalRefs, ...proactiveRefs, ...highSalienceRefs].map((r) => r.ref));
+    for (const r of noFeedbackPool) {
+        if (rescuedSet.has(r.ref))
+            continue;
+        actions.push({
+            ref: r.ref,
+            mode: "distill-skipped",
+            result: { ok: true, reason: "no new signal since last proposal" },
+        });
+    }
     // If the user explicitly scoped to a single ref, always act on it —
     // skip the signal/retrieval filter entirely. The filter exists to avoid
     // noisy "improve everything" runs; it should not gate an intentional
@@ -1917,38 +2526,656 @@ async function runImprovePreparationStage(args) {
     // or sufficient retrievals). A stash with no signals has 0 eligible refs —
     // usage is the gate. Run `akm feedback <ref> --positive` or retrieve assets
     // to bring them into the eligible pool.
-    const signalAndRetrievalRefs = [...signalFiltered, ...highRetrievalRefs];
-    const mergedRefs = scope.mode === "ref" ? processableRefs : options.requireFeedbackSignal ? signalFiltered : signalAndRetrievalRefs;
+    // Layer-2 proactive refs join the eligible set alongside feedback-signal and
+    // high-retrieval (P0-A) refs. The four sources are disjoint by construction
+    // (proactive draws from noFeedbackCandidates with the P0-A picks removed, and
+    // high-salience draws from the remainder), but dedupe defensively so a ref can
+    // never enter the loop twice. `requireFeedbackSignal` still suppresses all
+    // fallback sources for callers that want feedback-only runs.
+    const signalAndRetrievalRefs = dedupeRefs([
+        ...signalFiltered,
+        ...highRetrievalRefs,
+        ...proactiveRefs,
+        ...highSalienceRefs,
+    ]);
+    let mergedRefs = scope.mode === "ref" ? processableRefs : options.requireFeedbackSignal ? signalFiltered : signalAndRetrievalRefs;
+    // ── Attribution tagging: stamp each ref with the eligibility lane that
+    // selected it ──────────────────────────────────────────────────────────────
+    // Every reflect/distill proposal must record WHICH lane chose its source asset
+    // so downstream accept/reject/revert/retrieval outcomes can be sliced by lane
+    // (does the PROACTIVE lane produce value vs the reactive lanes?). We build the
+    // lane map here — the one place all four lanes are known — and stamp it onto
+    // each ImproveEligibleRef object. Because the ref objects are shared by
+    // reference across buckets, the stamp travels with the ref through the sort,
+    // disk-check, and loop stages down to the reflect/distill event emit sites and
+    // createProposal calls. See EligibilitySource for the lane vocabulary.
+    //
+    // Precedence (prefer the most specific reactive signal):
+    //   scope > signal-delta > high-retrieval > proactive > high-salience
+    // A ref with real feedback is attributed to feedback even if it was also due
+    // for proactive maintenance or had high encoding salience. We apply lanes
+    // weakest-first so the strongest overwrites; the explicit --scope <ref> bypass
+    // wins outright (user intent).
+    const eligibilitySourceByRef = new Map();
+    for (const r of highSalienceRefs)
+        eligibilitySourceByRef.set(r.ref, "high-salience");
+    for (const r of proactiveRefs)
+        eligibilitySourceByRef.set(r.ref, "proactive");
+    for (const r of highRetrievalRefs)
+        eligibilitySourceByRef.set(r.ref, "high-retrieval");
+    for (const r of signalFiltered)
+        eligibilitySourceByRef.set(r.ref, "signal-delta");
+    if (scope.mode === "ref") {
+        // O-2 (#365): explicit --scope <ref> bypass — every ref in processableRefs
+        // arrived via the scopeRefBypass branch, so attribute the whole set to scope.
+        for (const r of processableRefs)
+            eligibilitySourceByRef.set(r.ref, "scope");
+    }
+    for (const r of mergedRefs) {
+        // "unknown" is a genuine fallback, never a silent alias for signal-delta:
+        // only refs we truly cannot attribute land here (none in practice, since
+        // mergedRefs is always a subset of the four lanes above).
+        r.eligibilitySource = eligibilitySourceByRef.get(r.ref) ?? "unknown";
+    }
+    // WS-1 — Unified salience vector (S1 seam).
+    //
+    // The legacy sort combined three independent formulas (utility EMA, negative-only
+    // ratio / symmetric-valence magnitude, and the proactive-maintenance priority
+    // formula). WS-1 converges them into one `computeSalience()` call per ref, with
+    // three independently-stored sub-scores and one documented rankScore projection.
+    //
+    // Migration note: if a profile still has `symmetricValence` set, emit a one-time
+    // warning — its behaviour (symmetric |valence| attention) is now always-on as
+    // part of the salience vector, so the knob is a no-op and will be removed in 0.10.
+    if (improveProfile.symmetricValence === true) {
+        warn("[improve] Profile option 'symmetricValence' is deprecated (WS-1 salience vector). " +
+            "Symmetric valence is now always active; remove the option from your improve profile.");
+    }
+    // Fetch last-use timestamps from the index DB for the full merged set so the
+    // recency term in retrievalSalience is genuinely decayable (plan §WS-1 step 2).
+    // This reuses the index DB opened earlier for retrieval counts; a separate
+    // lightweight open is used here to avoid holding the connection longer than needed.
+    let lastUseMsByRef = new Map();
+    // utilityMap is kept for backward-compatible observability (health report reads it).
     const utilityMap = buildUtilityMap(mergedRefs);
-    // Load feedback ratio per ref from the pre-computed summary (no extra DB pass).
-    const feedbackRatios = new Map();
-    for (const ref of mergedRefs) {
-        const summary = feedbackSummary.get(ref.ref);
-        const positive = summary?.positive ?? 0;
-        const negative = summary?.negative ?? 0;
-        const total = positive + negative;
-        // ratio = negative proportion (high = needs more improvement)
-        feedbackRatios.set(ref.ref, total > 0 ? negative / total : 0);
-    }
-    // Sort: combine utility (desc) with feedback negativity (desc) — high-negative assets rank higher
-    const sorted = [...mergedRefs].sort((a, b) => {
-        const utilA = utilityMap.get(a.ref) ?? 0;
-        const utilB = utilityMap.get(b.ref) ?? 0;
-        const ratioA = feedbackRatios.get(a.ref) ?? 0;
-        const ratioB = feedbackRatios.get(b.ref) ?? 0;
-        // Combined score: 70% utility, 30% negative ratio
-        const scoreA = utilA * 0.7 + ratioA * 0.3;
-        const scoreB = utilB * 0.7 + ratioB * 0.3;
-        return scoreB - scoreA;
-    });
-    // Phase 0: surface coverage gaps from zero-result search queries
-    let coverageGaps = [];
+    let dbForSalience;
     try {
-        const dbForGaps = openExistingDatabase();
-        try {
-            coverageGaps = getZeroResultSearches(dbForGaps);
-        }
-        finally {
+        dbForSalience = openExistingDatabase();
+        lastUseMsByRef = getLastUseMsByRef(dbForSalience, mergedRefs.map((r) => r.ref));
+    }
+    catch (err) {
+        rethrowIfTestIsolationError(err);
+        // best-effort: if DB unavailable, recency term stays at floor (lastUseMs=0)
+    }
+    finally {
+        if (dbForSalience)
+            closeDatabase(dbForSalience);
+    }
+    // ── WS-2 Outcome loop ─────────────────────────────────────────────────────
+    //
+    // Update asset_outcome for every ref in the merged set BEFORE computing the
+    // salience vector so the updated outcome_score feeds outcomeSalience this run.
+    //
+    // Inputs per ref:
+    //   - currentRetrievalCount: from retrievalCounts (index DB)
+    //   - lastRetrievedAt: from lastUseMsByRef (utility_scores.last_used_at)
+    //   - negativeFeedbackCount: cumulative negatives from feedbackSummary
+    //   - acceptedChangeCount: accepted proposals for this ref (state.db)
+    //   - valence: net valence from computeValenceScore(feedbackSummary.get(ref))
+    //   - utilityScore: from utilityMap (for warm-start seed on new rows)
+    //
+    // Best-effort: outcome failures never block the salience or ranking pass.
+    const outcomeSalienceByRef = new Map();
+    try {
+        const outcomeDb = eventsCtx?.db ?? openStateDatabase(eventsCtx?.dbPath);
+        const ownsOutcomeDb = !eventsCtx?.db;
+        try {
+            // Count accepted proposals per ref in one pass (avoid N separate queries).
+            // Scoped to primaryStashDir when available so multi-stash installs don't
+            // inflate counts with proposals from other stashes.
+            const acceptedCountByRef = new Map();
+            try {
+                const acceptedProposals = listStateProposals(outcomeDb, {
+                    status: "accepted",
+                    ...(primaryStashDir ? { stashDir: primaryStashDir } : {}),
+                });
+                for (const p of acceptedProposals) {
+                    acceptedCountByRef.set(p.ref, (acceptedCountByRef.get(p.ref) ?? 0) + 1);
+                }
+            }
+            catch {
+                // best-effort: if proposals query fails, accepted counts stay at 0
+            }
+            // Update each ref's outcome row and collect the resulting outcome scores.
+            const rawOutcomeScores = new Map();
+            const nowForOutcome = Date.now();
+            for (const r of mergedRefs) {
+                const fb = feedbackSummary.get(r.ref) ?? { positive: 0, negative: 0 };
+                const valenceResult = computeValenceScore(fb);
+                try {
+                    const result = updateAssetOutcome(outcomeDb, {
+                        ref: r.ref,
+                        currentRetrievalCount: retrievalCounts.get(r.ref) ?? 0,
+                        lastRetrievedAt: lastUseMsByRef.get(r.ref) ?? 0,
+                        acceptedChangeCount: acceptedCountByRef.get(r.ref) ?? 0,
+                        negativeFeedbackCount: fb.negative,
+                        valence: valenceResult.valence,
+                        utilityScore: utilityMap.get(r.ref),
+                        now: nowForOutcome,
+                    });
+                    rawOutcomeScores.set(r.ref, result.outcomeScore);
+                }
+                catch {
+                    // best-effort per-ref: skip this ref's outcome update on failure
+                }
+            }
+            // Compute stash-wide max outcome_score for normalisation (diversity floor).
+            // Read ALL rows (not just this run's batch) so the normalisation is
+            // stash-relative, not pool-relative.
+            let maxOutcomeScore = 0;
+            try {
+                const allOutcomes = getAllAssetOutcomes(outcomeDb);
+                for (const row of allOutcomes) {
+                    if (row.outcome_score > maxOutcomeScore)
+                        maxOutcomeScore = row.outcome_score;
+                }
+                // Proxy-adequacy tripwire: emit a health event if outcome_score is
+                // negatively correlated with accepted_change_rate (inverted proxy).
+                const adequacy = computeProxyAdequacy(allOutcomes);
+                if (adequacy.isInverted) {
+                    appendEvent({
+                        eventType: "outcome_proxy_inverted",
+                        ref: undefined,
+                        metadata: {
+                            correlation: adequacy.correlation,
+                            n: adequacy.n,
+                            note: "corr(outcome_score, accepted_change_rate) < −0.3: high-outcome_score assets have LOW accepted-change rates — the proxy's 'doing well' signal is inverted, so the coarse retrieval-delta signal is no longer trustworthy and the 0.10+ rich in-session signal is no longer deferrable. See plan §WS-2 proxy-adequacy tripwire.",
+                        },
+                    }, eventsCtx);
+                }
+            }
+            catch {
+                // best-effort: tripwire failure never blocks ranking
+            }
+            // Convert raw outcome scores → normalised outcomeSalience values in [0,1].
+            for (const [ref, score] of rawOutcomeScores) {
+                const normalised = outcomeScoreToSalience(score, maxOutcomeScore);
+                outcomeSalienceByRef.set(ref, normalised);
+            }
+            // Also fetch outcome scores for refs NOT updated this run (stale or absent)
+            // so the outcomeSalience read path works for all refs in the batch.
+            const missingRefs = mergedRefs.map((r) => r.ref).filter((ref) => !rawOutcomeScores.has(ref));
+            if (missingRefs.length > 0) {
+                const storedScores = getOutcomeScoresByRef(outcomeDb, missingRefs);
+                for (const [ref, score] of storedScores) {
+                    outcomeSalienceByRef.set(ref, outcomeScoreToSalience(score, maxOutcomeScore));
+                }
+            }
+        }
+        finally {
+            if (ownsOutcomeDb)
+                outcomeDb.close();
+        }
+    }
+    catch (err) {
+        rethrowIfTestIsolationError(err);
+        // best-effort: outcome failures never block salience computation
+    }
+    // Compute the salience vector for every ref in the merged set.
+    // retrievalCounts now covers the full candidate set (feedback-bearing + zero-feedback)
+    // so feedback refs get their genuine retrieval frequency, not a 0-floor fallback.
+    // outcomeSalienceByRef is populated by WS-2 above (or empty on first run).
+    //
+    // Part-V gate: read the operator opt-in flag from config. Default false
+    // (WS-1 parity weights) until the maintainer runs scripts/akm-eval and sets
+    // improve.salience.outcomeWeightEnabled: true in the config.
+    const salienceConfig = (options.config ?? loadConfig()).improve?.salience;
+    const outcomeWeightEnabled = salienceConfig?.outcomeWeightEnabled === true;
+    const salienceMap = new Map();
+    const nowForSalience = Date.now();
+    // #644 — preserve content-derived encoding scores across runs.
+    //
+    // Before computing the salience vector, load each ref's stored encoding score
+    // and its provenance. When the stored row carries a genuine content-derived
+    // score (written by the distill path via `scoreEncodingSalience`), pass that
+    // value back in as `inputs.encodingSalience` so `computeSalience` does NOT fall
+    // back to the type-weight stub — keeping both the persisted `encoding_salience`
+    // AND the derived `rank_score` keyed on real novelty/magnitude/prediction-error.
+    // Refs that have never been content-scored keep the type-weight stub fallback.
+    const storedEncodingByRef = new Map();
+    {
+        let dbForStoredEncoding;
+        try {
+            dbForStoredEncoding = openStateDatabase(eventsCtx?.dbPath);
+            for (const r of mergedRefs) {
+                const type = r.ref.includes(":") ? r.ref.slice(0, r.ref.indexOf(":")) : "";
+                const row = getAssetSalience(dbForStoredEncoding, r.ref);
+                if (row && isContentEncodingRow(row, type)) {
+                    storedEncodingByRef.set(r.ref, row.encoding_salience);
+                }
+            }
+        }
+        catch (err) {
+            rethrowIfTestIsolationError(err);
+            // best-effort: if DB unavailable, fall back to type-weight stub (prior behaviour)
+        }
+        finally {
+            if (dbForStoredEncoding)
+                dbForStoredEncoding.close();
+        }
+    }
+    for (const r of mergedRefs) {
+        const type = r.ref.includes(":") ? r.ref.slice(0, r.ref.indexOf(":")) : "";
+        const sizeBytes = (() => {
+            const fp = r.filePath;
+            if (!fp)
+                return undefined;
+            try {
+                return fs.statSync(fp).size;
+            }
+            catch {
+                return undefined;
+            }
+        })();
+        const storedEncoding = storedEncodingByRef.get(r.ref);
+        const vector = computeSalience({
+            ref: r.ref,
+            type,
+            // #644: pass the stored content-derived score (if any) so the type-weight
+            // stub is NOT re-asserted over a real distill-written encoding score.
+            ...(storedEncoding !== undefined ? { encodingSalience: storedEncoding } : {}),
+            retrievalFreq: retrievalCounts.get(r.ref) ?? 0,
+            lastUseMs: lastUseMsByRef.get(r.ref),
+            utilityScore: utilityMap.get(r.ref),
+            outcomeSalience: outcomeSalienceByRef.get(r.ref),
+            sizeBytes,
+            now: nowForSalience,
+            outcomeWeightEnabled,
+        });
+        salienceMap.set(r.ref, vector);
+    }
+    // Persist salience vectors to state.db (best-effort, non-blocking).
+    // The canonical store enables WS-3 homeostatic demotion and WS-2 outcome reads.
+    //
+    // Forgetting-safety report (plan §WS-1 step 7) — stash-wide rank comparison:
+    //
+    // BEFORE persisting the new rankScores, read ALL existing rows from state.db
+    // (not just the per-run candidate pool). This gives stash-wide rank positions so
+    // the top-200/below-500 thresholds are meaningful.
+    //
+    // Two distinct scenarios:
+    //
+    // A. First WS-1 run (table empty): the old stash-wide combinedEligibilityScore
+    //    ordering was never persisted in state.db (asset_salience is a new WS-1 table).
+    //    However, the old formula's inputs are available in-scope for every candidate
+    //    in the current pool: utility comes from utilityMap and the attention term
+    //    from feedbackSummary (positive/negative counts). We reconstruct the old
+    //    combinedEligibilityScore = utility * UTILITY_WEIGHT + attention * FEEDBACK_WEIGHT
+    //    for every ref in salienceMap and rank them, giving a candidate-pool-scoped
+    //    old ordering. This is a partial reconstruction (only current-pool refs, not
+    //    stash-wide), but it is the most faithful comparison possible at cutover and
+    //    allows the top-200→below-500 forgetting guard to fire if the formula change
+    //    dramatically reorders the candidate pool.
+    //    See docs/design/improve-reconciliation-plan.md §WS-1 step 7 — the stash-wide
+    //    ordering was unreconstructable (no prior state.db snapshot), so this candidate-
+    //    pool partial reconstruction is the documented resolution for the first-run case.
+    //    Emit `improve_salience_first_run` to mark the cutover moment and include the
+    //    reconstructed comparison result in the metadata.
+    //
+    // B. Subsequent runs (table has rows): use ALL existing rows as old ranks, merge
+    //    them with the current run's salienceMap updates for new ranks, and call
+    //    buildRankChangeReport with stash-wide positions. This detects real rank drift
+    //    — e.g. a retrieval-pattern shift causing a previously top-200 asset to slip
+    //    below position 500.
+    //
+    // Measurement-protocol deferral (plan §269, Part-V):
+    // The Part-V T0 baseline (scripts/akm-eval + health report) and the throughput/
+    // quality gate are deferred pending owner sign-off. Full measurement requires a
+    // before/after `akm health` report. Owner-acknowledged deferral: WS-2 landing
+    // will re-introduce outcome salience and trigger the full re-tuning pass at that
+    // time. salience.ts already accepts outcomeSalience directly as an input
+    // (see SalienceInputs.outcomeSalience); no separate hook is needed.
+    //
+    // Forgetting-safety collection: populated inside scenario B below, consumed
+    // after the try/catch to union candidates into mergedRefs before the sort.
+    // Only refs from a real pre-existing ordering (scenario B) are collected;
+    // empty on scenario A or when no candidates dropped below the threshold.
+    let pendingForgettingRefs = [];
+    try {
+        const stateDb = openStateDatabase(eventsCtx?.dbPath);
+        try {
+            // Step 7: stash-wide rank-change report BEFORE overwriting the table.
+            //
+            // Load ALL existing rows so rank positions are stash-relative, not pool-relative.
+            const existingAllScores = getAllRankScores(stateDb);
+            if (existingAllScores.size === 0) {
+                // Scenario A: first WS-1 run — table empty.
+                //
+                // Reconstruct the old combinedEligibilityScore ordering for the current
+                // candidate pool using inputs that are already in-scope: utility from
+                // utilityMap and the attention term from feedbackSummary (positive/negative
+                // counts). Old formula: score = utility * UTILITY_WEIGHT + attention * FEEDBACK_WEIGHT.
+                //
+                // Limitation: this covers only the current-run candidate pool, not the full
+                // stash. The stash-wide ordering was never persisted (asset_salience is a new
+                // WS-1 table), so this is the most faithful comparison possible at cutover.
+                // See docs/design/improve-reconciliation-plan.md §WS-1 step 7.
+                const reconstructedOldScores = new Map();
+                for (const ref of salienceMap.keys()) {
+                    const utility = utilityMap.get(ref) ?? 0;
+                    const fb = feedbackSummary.get(ref) ?? { positive: 0, negative: 0 };
+                    const attention = computeValenceScore(fb).attention;
+                    reconstructedOldScores.set(ref, utility * UTILITY_WEIGHT + attention * FEEDBACK_WEIGHT);
+                }
+                // Assign 1-indexed rank positions sorted by score desc (tie-break: ref asc).
+                const toRanks = (scores) => {
+                    const sorted = [...scores.entries()].sort(([refA, a], [refB, b]) => b !== a ? b - a : refA < refB ? -1 : refA > refB ? 1 : 0);
+                    return new Map(sorted.map(([ref], i) => [ref, i + 1]));
+                };
+                const oldRanks = toRanks(reconstructedOldScores);
+                const newRanks = toRanks(new Map([...salienceMap.entries()].map(([ref, v]) => [ref, v.rankScore])));
+                const firstRunReport = buildRankChangeReport(oldRanks, newRanks);
+                if (firstRunReport.forgettingCandidates.length > 0) {
+                    warn(`[improve/salience] WS-1 first-run rank-change report: ${firstRunReport.forgettingCandidates.length} asset(s) fell from top-200 to below position 500 (cutover formula change). ` +
+                        `Top drops: ${firstRunReport.forgettingCandidates
+                            .slice(0, 5)
+                            .map((e) => `${e.ref} (#${e.oldRank}→#${e.newRank})`)
+                            .join(", ")}`);
+                    pendingForgettingRefs = firstRunReport.forgettingCandidates.map((e) => e.ref);
+                }
+                appendEvent({
+                    eventType: "improve_salience_first_run",
+                    ref: undefined,
+                    metadata: {
+                        candidateCount: salienceMap.size,
+                        note: "first WS-1 salience run — partial reconstruction of old combinedEligibilityScore ordering for candidate pool (stash-wide ordering not available); see improve-reconciliation-plan.md §WS-1 step 7",
+                        forgettingCandidates: firstRunReport.forgettingCandidates.length,
+                        topDrops: firstRunReport.forgettingCandidates.slice(0, 10).map((e) => ({
+                            ref: e.ref,
+                            oldRank: e.oldRank,
+                            newRank: e.newRank,
+                        })),
+                    },
+                }, eventsCtx);
+            }
+            else {
+                // Scenario B: subsequent run — compare stash-wide old vs. new ranks.
+                //
+                // Build new scores by merging the full table with this run's updates.
+                // Refs in salienceMap override their stored value; refs not in this run
+                // retain their stored value unchanged. This gives a complete stash-wide
+                // picture of what the new ordering looks like after this run.
+                const mergedNewScores = new Map(existingAllScores);
+                for (const [ref, vector] of salienceMap) {
+                    mergedNewScores.set(ref, vector.rankScore);
+                }
+                // Assign 1-indexed rank positions sorted by score desc (tie-break: ref asc).
+                const toRanks = (scores) => {
+                    const sorted = [...scores.entries()].sort(([refA, a], [refB, b]) => b !== a ? b - a : refA < refB ? -1 : refA > refB ? 1 : 0);
+                    return new Map(sorted.map(([ref], i) => [ref, i + 1]));
+                };
+                const oldRanks = toRanks(existingAllScores);
+                const newRanks = toRanks(mergedNewScores);
+                const report = buildRankChangeReport(oldRanks, newRanks);
+                if (report.forgettingCandidates.length > 0) {
+                    warn(`[improve/salience] WS-1 rank-change report: ${report.forgettingCandidates.length} asset(s) fell from top-200 to below position 500. ` +
+                        `Top drops: ${report.forgettingCandidates
+                            .slice(0, 5)
+                            .map((e) => `${e.ref} (#${e.oldRank}→#${e.newRank})`)
+                            .join(", ")}`);
+                    // Collect refs for protective consolidation pass (plan §WS-1 step 7).
+                    // These are force-included in the candidate pool (mergedRefs) after
+                    // this try block, bypassing cooldown/signal-delta gating.
+                    pendingForgettingRefs = report.forgettingCandidates.map((e) => e.ref);
+                }
+                appendEvent({
+                    eventType: "improve_salience_rank_change",
+                    ref: undefined,
+                    metadata: {
+                        stashSize: existingAllScores.size,
+                        totalChanged: report.allChanges.length,
+                        forgettingCandidates: report.forgettingCandidates.length,
+                        topDrops: report.forgettingCandidates.slice(0, 10).map((e) => ({
+                            ref: e.ref,
+                            oldRank: e.oldRank,
+                            newRank: e.newRank,
+                        })),
+                    },
+                }, eventsCtx);
+            }
+            for (const [ref, vector] of salienceMap) {
+                upsertAssetSalience(stateDb, ref, vector, nowForSalience);
+            }
+        }
+        finally {
+            stateDb.close();
+        }
+    }
+    catch (err) {
+        rethrowIfTestIsolationError(err);
+        // best-effort: salience persistence failure never blocks ranking
+    }
+    // ── Protective consolidation pass (plan §WS-1 step 7) ─────────────────────
+    // Forgetting candidates detected in scenario B are force-injected into
+    // mergedRefs here, BEFORE the effectiveScore sort, bypassing cooldown and
+    // signal-delta gating. Any ref already present in mergedRefs keeps its
+    // existing eligibilitySource (stronger reactive signals win); refs not yet in
+    // the pool are synthesised as minimal ImproveEligibleRef stubs and labelled
+    // 'forgetting-safety' so S5/WS-5 can slice by lane. The dedupeRefs call
+    // ensures no ref can enter the loop twice.
+    if (pendingForgettingRefs.length > 0 && scope.mode !== "ref") {
+        const existingRefSet = new Set(mergedRefs.map((r) => r.ref));
+        const newForgettingRefs = [];
+        for (const ref of pendingForgettingRefs) {
+            if (!existingRefSet.has(ref)) {
+                // Ref not already in the candidate pool — synthesise a stub so it
+                // participates in the reflect/distill loop with proper attribution.
+                newForgettingRefs.push({ ref, reason: "scope-type", eligibilitySource: "forgetting-safety" });
+            }
+            // Always stamp the lane in the attribution map (overwrites weaker lanes;
+            // stronger reactive signals — scope/signal-delta/high-retrieval/proactive
+            // — are written after this block so they take precedence).
+            eligibilitySourceByRef.set(ref, "forgetting-safety");
+        }
+        if (newForgettingRefs.length > 0) {
+            mergedRefs = dedupeRefs([...mergedRefs, ...newForgettingRefs]);
+        }
+        // Re-stamp attribution for any refs whose lane needs updating.
+        // Precedence (weakest → strongest, each overwrites the previous):
+        //   proactive < high-retrieval < forgetting-safety < signal-delta
+        // Scope mode is already excluded by the outer guard (`scope.mode !== "ref"`).
+        // forgetting-safety sits above proactive and high-retrieval so that a ref
+        // flagged as a forgetting candidate is always visible to S5/WS-5 as such,
+        // even when it was also due for a proactive maintenance run. signal-delta
+        // overrides forgetting-safety because a ref with fresh feedback is reactive
+        // and doesn't need the protective pass label for measurement purposes.
+        for (const r of highSalienceRefs)
+            eligibilitySourceByRef.set(r.ref, "high-salience");
+        for (const r of proactiveRefs)
+            eligibilitySourceByRef.set(r.ref, "proactive");
+        for (const r of highRetrievalRefs)
+            eligibilitySourceByRef.set(r.ref, "high-retrieval");
+        // Apply forgetting-safety OVER proactive, high-retrieval, and high-salience
+        // (already stamped in the loop above via
+        // `eligibilitySourceByRef.set(ref, "forgetting-safety")`). No-op here: the
+        // set() calls above for proactive/high-retrieval/high-salience overwrite the
+        // earlier forgetting-safety stamp — so we re-apply forgetting-safety now for
+        // those refs that are both forgetting candidates AND in another fallback lane.
+        for (const ref of pendingForgettingRefs) {
+            eligibilitySourceByRef.set(ref, "forgetting-safety");
+        }
+        // signal-delta is the strongest reactive signal and overrides forgetting-safety.
+        for (const r of signalFiltered)
+            eligibilitySourceByRef.set(r.ref, "signal-delta");
+        // Update eligibilitySource on the ref objects themselves for any refs whose
+        // lane changed (covers both new stubs and pre-existing refs).
+        for (const r of mergedRefs) {
+            r.eligibilitySource = eligibilitySourceByRef.get(r.ref) ?? "unknown";
+        }
+    }
+    // ── REPLAY SELECTION layer (#610) ─────────────────────────────────────────
+    // Bounded, ADDITIVE replay budget: up to `replayBudget` top-salience refs are
+    // revisited even with zero reactive signal (no feedback, no retrieval) and
+    // regardless of cooldown — exactly like the forgetting-safety lane, replay is
+    // injected AFTER cooldown/signal-delta partitioning so it bypasses those gates.
+    //
+    // Strictly additive: the replay slice is appended AFTER the --limit fresh slice
+    // (see the loopRefs partition below), so it can never shrink the fresh-ref set.
+    // Replay is the WEAKEST lane — it only stamps refs no other lane already claimed,
+    // and budget is spent only on refs not already in mergedRefs (so a stronger lane
+    // never has its budget wasted or its label overwritten).
+    //
+    // Default replayBudget=0 ⇒ this whole block is a no-op (no DB open, no event,
+    // no mergedRefs mutation), preserving byte-identical pre-#610 selection behavior.
+    const replayBudget = (options.config ?? loadConfig()).improve?.salience?.replayBudget ?? 0;
+    const replayRefSet = new Set();
+    if (replayBudget > 0 && scope.mode !== "ref" && !options.requireFeedbackSignal) {
+        let replayDb;
+        try {
+            replayDb = openStateDatabase(eventsCtx?.dbPath);
+            const alreadyInPool = new Set(mergedRefs.map((r) => r.ref));
+            const allRankScores = getAllRankScores(replayDb);
+            // Candidate universe = every salience row NOT already in the pool, ordered by
+            // rank_score desc with a deterministic ref-string tie-break (mirrors the main
+            // sort). Converged refs (consecutive_no_ops >= dampener threshold) are fully
+            // EXCLUDED — a stronger skip than the dampener (which only halves order).
+            let convergedSkipped = 0;
+            const candidates = [];
+            for (const [ref, rankScore] of allRankScores) {
+                if (alreadyInPool.has(ref))
+                    continue;
+                const noOps = getConsecutiveNoOps(replayDb, ref);
+                if (noOps >= SALIENCE_NO_OP_DAMPEN_THRESHOLD) {
+                    convergedSkipped++;
+                    continue;
+                }
+                candidates.push({ ref, rankScore });
+            }
+            candidates.sort((a, b) => b.rankScore !== a.rankScore ? b.rankScore - a.rankScore : a.ref < b.ref ? -1 : a.ref > b.ref ? 1 : 0);
+            const candidatePool = candidates.length;
+            const selected = candidates.slice(0, replayBudget);
+            const newReplayRefs = [];
+            for (const { ref } of selected) {
+                replayRefSet.add(ref);
+                // Synthesise a stub (mirror the forgetting-safety stub). Resolve the
+                // backing file from the planned-ref pool so the downstream existsSync
+                // guard keeps the ref (a replay candidate from asset_salience whose file
+                // is gone correctly drops out). Only refs present in the indexed pool can
+                // be revisited — refs without a planned entry get no filePath and are
+                // dropped by the disk check, which is the desired behavior.
+                const planned = plannedRefs.find((p) => p.ref === ref);
+                newReplayRefs.push({
+                    ref,
+                    reason: "scope-type",
+                    eligibilitySource: "replay",
+                    ...(planned?.filePath ? { filePath: planned.filePath } : {}),
+                });
+                // Seed the salienceMap so the sort/effectiveScore can rank the replay ref.
+                if (!salienceMap.has(ref)) {
+                    salienceMap.set(ref, {
+                        encoding: 0,
+                        outcome: 0,
+                        retrieval: 0,
+                        rankScore: allRankScores.get(ref) ?? 0,
+                    });
+                }
+            }
+            if (newReplayRefs.length > 0) {
+                mergedRefs = dedupeRefs([...mergedRefs, ...newReplayRefs]);
+                // Replay is the WEAKEST lane: stamp 'replay' ONLY for refs not already
+                // keyed by a stronger lane.
+                for (const ref of replayRefSet) {
+                    if (!eligibilitySourceByRef.has(ref))
+                        eligibilitySourceByRef.set(ref, "replay");
+                }
+                for (const r of mergedRefs) {
+                    r.eligibilitySource = eligibilitySourceByRef.get(r.ref) ?? "unknown";
+                }
+            }
+            // Aggregated observability event (never per-ref).
+            appendEvent({
+                eventType: "improve_replay_selected",
+                ref: undefined,
+                metadata: {
+                    count: newReplayRefs.length,
+                    budget: replayBudget,
+                    convergedSkipped,
+                    candidatePool,
+                },
+            }, eventsCtx);
+        }
+        catch (err) {
+            rethrowIfTestIsolationError(err);
+            // best-effort: if DB unavailable, replayRefSet stays empty
+        }
+        finally {
+            if (replayDb)
+                replayDb.close();
+        }
+    }
+    // Build no-op map for consolidation-selection dampener (plan §WS-1 step 8).
+    // Reads consecutive_no_ops from the SAME pinned db handle used elsewhere in
+    // this function.  The effective score is used ONLY for processing/selection
+    // order — the persisted rank_score in asset_salience is never mutated here.
+    const noOpMap = new Map();
+    try {
+        const noOpDb = eventsCtx?.db ?? (eventsCtx?.dbPath ? openStateDatabase(eventsCtx.dbPath) : null);
+        if (noOpDb) {
+            const ownsNoOpDb = !eventsCtx?.db;
+            try {
+                for (const r of mergedRefs) {
+                    noOpMap.set(r.ref, getConsecutiveNoOps(noOpDb, r.ref));
+                }
+            }
+            finally {
+                if (ownsNoOpDb)
+                    noOpDb.close();
+            }
+        }
+    }
+    catch {
+        // best-effort: dampener failure never blocks selection
+    }
+    // Sort by effective selection score (desc), with explicit ref-string tie-break
+    // for determinism.  The effective score applies the consolidation-selection
+    // dampener: assets that have been repeatedly skipped (consecutive_no_ops >=
+    // THRESHOLD) are penalised by FACTOR so they sort after peers with similar
+    // rankScore.  The persisted rank_score is left unchanged — this is the whole
+    // point of the dampener (stable assets stay fully retrievable).
+    //
+    // WIRING NOTE (plan §WS-1 step 8 / "consolidation-selection" disambiguation):
+    // "consolidation-selection" in the plan refers to THIS reflect/distill
+    // eligibility ordering — i.e. which assets are chosen for the reflect/distill
+    // LLM pass — NOT to akmConsolidate (the cluster-merge phase at ~line 1994,
+    // which runs earlier and never reads noOpMap).  The no-op counter originates
+    // from no-change reflect / quality-rejected distill outcomes; the dampener
+    // suppresses repeated LLM attempts on those same assets without touching their
+    // persisted rank_score (so they remain fully retrievable).
+    //
+    // This is the ONLY ranking path — negativeOnlyRatio and the legacy
+    // symmetricValence branch are replaced. The three eligibilitySource lanes
+    // (signal-delta / high-retrieval / proactive) survive as labels (set above).
+    const effectiveScore = (ref) => {
+        const rankScore = salienceMap.get(ref)?.rankScore ?? 0;
+        const noOps = noOpMap.get(ref) ?? 0;
+        return noOps >= SALIENCE_NO_OP_DAMPEN_THRESHOLD ? rankScore * SALIENCE_NO_OP_DAMPEN_FACTOR : rankScore;
+    };
+    const sorted = [...mergedRefs].sort((a, b) => {
+        const scoreA = effectiveScore(a.ref);
+        const scoreB = effectiveScore(b.ref);
+        if (scoreB !== scoreA)
+            return scoreB - scoreA;
+        // Stable tie-break: deterministic regardless of input ordering.
+        return a.ref < b.ref ? -1 : a.ref > b.ref ? 1 : 0;
+    });
+    // Phase 0: surface coverage gaps from zero-result search queries
+    let coverageGaps = [];
+    try {
+        const dbForGaps = openExistingDatabase();
+        try {
+            coverageGaps = getZeroResultSearches(dbForGaps);
+        }
+        finally {
             closeDatabase(dbForGaps);
         }
     }
@@ -2015,8 +3242,22 @@ async function runImprovePreparationStage(args) {
         }
     }
     // ── Phase 5: --limit applies to the post-cooldown actionable set ──────────
+    //
+    // #610 ADDITIVITY: replay-lane refs are budgeted SEPARATELY from the --limit
+    // fresh slice. Without this split, a high-rankScore replay ref could sort above
+    // a fresh ref in the single combined slice and STEAL its slot (violating AC2).
+    // We partition into the replay lane vs the rest, apply --limit to the
+    // non-replay (fresh) refs only, then APPEND up to `replayBudget` replay refs
+    // after the fresh slice. Sort order within each partition is preserved.
+    //
+    // Default replayBudget=0 reduces this to the exact pre-#610 expression: with no
+    // replay refs, `nonReplayLoop === allLoopRefs`, so `baseLoop === old slice` and
+    // `replayLoop.slice(0, 0) === []` — byte-identical.
     const allLoopRefs = [...reflectAndDistillRefsAfterSort, ...distillOnlyRefsAfterSort];
-    const loopRefs = options.limit ? allLoopRefs.slice(0, options.limit) : allLoopRefs;
+    const replayLoop = allLoopRefs.filter((r) => r.eligibilitySource === "replay");
+    const nonReplayLoop = allLoopRefs.filter((r) => r.eligibilitySource !== "replay");
+    const baseLoop = options.limit ? nonReplayLoop.slice(0, options.limit) : nonReplayLoop;
+    const loopRefs = [...baseLoop, ...replayLoop.slice(0, replayBudget)];
     // Update the returned distillOnlyRefs to the sorted order so callers see the
     // ranked view (loop stage uses it as a Set so order is irrelevant, but the
     // shape change keeps downstream consumers consistent).
@@ -2027,7 +3268,7 @@ async function runImprovePreparationStage(args) {
             `(${fullySkippedCount} fully skipped, ${distillOnlyRefs.length} routed to distill-only)`);
     }
     if (signalAndRetrievalRefs.length > 0) {
-        info(`[improve] ${signalAndRetrievalRefs.length} refs with usage signals (${signalFiltered.length} feedback, ${highRetrievalRefs.length} high-retrieval)`);
+        info(`[improve] ${signalAndRetrievalRefs.length} refs with usage signals (${signalFiltered.length} feedback, ${highRetrievalRefs.length} high-retrieval${replayRefSet.size > 0 ? `, ${replayRefSet.size} replay` : ""})`);
     }
     if (validationFailureRefs.size > 0) {
         info(`[improve] ${validationFailureRefs.size} with validation failures excluded`);
@@ -2038,6 +3279,17 @@ async function runImprovePreparationStage(args) {
     const deferredCount = actionableRefs.length - loopRefs.length;
     info(`[improve] ${actionableRefs.length} actionable; ${loopRefs.length} will be processed` +
         (options.limit && deferredCount > 0 ? ` (--limit ${options.limit} applied; ${deferredCount} deferred)` : ""));
+    // WS-4: Per-phase threshold auto-tune for the extract phase.
+    // Persists result for the NEXT run's makeGateConfig to read.
+    const extractTuneDbPath = eventsCtx?.dbPath;
+    if (options.autoAccept !== undefined && extractTuneDbPath) {
+        try {
+            maybeAutoTuneThreshold(extractGateCfg.phaseThreshold ?? options.autoAccept, options.config ?? loadConfig(), extractTuneDbPath, undefined, "extract");
+        }
+        catch (err) {
+            warn(`[improve] calibration auto-tune (extract) skipped: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
     return {
         actions,
         cleanupWarnings,
@@ -2059,6 +3311,7 @@ async function runImprovePreparationStage(args) {
         gateAutoAcceptFailedCount,
         consolidation: consolidationPass.consolidation,
         consolidationRan: consolidationPass.consolidationRan,
+        ...(proactiveMaintenanceSummary ? { proactiveMaintenance: proactiveMaintenanceSummary } : {}),
     };
 }
 async function runImproveLoopStage(args) {
@@ -2067,6 +3320,14 @@ async function runImproveLoopStage(args) {
     // receives only its fair share of the wall-clock budget.
     const remainingBudgetMs = () => Math.max(0, budgetMs - (Date.now() - startMs));
     const RECENT_ERRORS_CAP = 3;
+    // requirePlannedRefs guard: when the distill profile sets this flag, skip
+    // distill for distill-only refs if the reflect phase produced no planned refs.
+    // Prevents the distill loop from generating hundreds of distill-skipped events
+    // on quiet passes (all refs on reflect cooldown, no new signal to distill).
+    const requirePlannedRefs = improveProfile?.processes?.distill?.requirePlannedRefs === true;
+    const _distillOnlyRefNames = new Set(distillOnlyRefs.map((r) => r.ref));
+    const hasReflectEligibleRefs = loopRefs.some((r) => !_distillOnlyRefNames.has(r.ref));
+    const skipDistillDueToRequirePlannedRefs = requirePlannedRefs && !hasReflectEligibleRefs;
     // R-2 / #389: Self-Consistency multi-sample voting helpers.
     // Wang et al. arXiv:2203.11171 — N=3 samples beat single-shot on reasoning tasks.
     const SC_THRESHOLD = options.selfConsistencyThreshold ?? 0.7;
@@ -2148,6 +3409,10 @@ async function runImproveLoopStage(args) {
         stashDir: primaryStashDir,
         config: options.config ?? loadConfig(),
         eventsCtx,
+        stateDbPath: eventsCtx?.dbPath,
+        // candidateCount drives the exploration budget. loopRefs is the per-phase
+        // set for reflect/distill; pass it so exploration budget is proportional.
+        candidateCount: loopRefs.length,
     });
     const distillGateCfg = makeGateConfig("distill", {
         globalThreshold: options.autoAccept,
@@ -2155,6 +3420,8 @@ async function runImproveLoopStage(args) {
         stashDir: primaryStashDir,
         config: options.config ?? loadConfig(),
         eventsCtx,
+        stateDbPath: eventsCtx?.dbPath,
+        candidateCount: loopRefs.length,
     });
     for (const planned of loopRefs) {
         if (Date.now() - startMs >= budgetMs) {
@@ -2227,6 +3494,9 @@ async function runImproveLoopStage(args) {
                         eventSource: "improve",
                         ...(reflectBudgetMs > 0 ? { timeoutMs: reflectBudgetMs } : {}),
                         ...(reflectProfileRunner ? { runner: reflectProfileRunner } : {}),
+                        // Attribution: carry the eligibility lane so reflect stamps it on
+                        // the reflect_invoked event and the persisted proposal.
+                        ...(planned.eligibilitySource ? { eligibilitySource: planned.eligibilitySource } : {}),
                     };
                     // R-2 / #389: Self-consistency multi-sample voting for high-utility refs.
                     // Self-Consistency arXiv:2203.11171 — N=3 samples beat single-shot quality.
@@ -2251,6 +3521,9 @@ async function runImproveLoopStage(args) {
                                 source: "reflect",
                                 sourceRun: `reflect-sc-${Date.now()}`,
                                 payload: winner.proposal.payload,
+                                // Attribution: the self-consistency path persists the winner here
+                                // (draftMode skips reflect's own createProposal), so stamp the lane.
+                                ...(planned.eligibilitySource ? { eligibilitySource: planned.eligibilitySource } : {}),
                             });
                             reflectResult = isProposalSkipped(persistResult)
                                 ? {
@@ -2326,6 +3599,28 @@ async function runImproveLoopStage(args) {
                             reason: reflectResult.ok ? undefined : reflectResult.reason,
                         },
                     }, eventsCtx);
+                    // Plasticity counter (plan §WS-1 step 8): record no-ops so the
+                    // WS-1 selection comparator (effectiveScore, ~line 3073) can dampen
+                    // repeatedly-silent assets during consolidation-selection.
+                    // A no_change reflect means the LLM was invoked but found nothing to
+                    // improve — the asset is stable. Track it. A successful reflect means
+                    // the asset changed; reset the counter so the dampener lifts.
+                    if (isNoChange && eventsCtx?.db) {
+                        try {
+                            recordNoOp(eventsCtx.db, planned.ref);
+                        }
+                        catch {
+                            // best-effort: plasticity counter failure never blocks the run
+                        }
+                    }
+                    else if (reflectResult.ok && eventsCtx?.db) {
+                        try {
+                            resetConsecutiveNoOps(eventsCtx.db, planned.ref);
+                        }
+                        catch {
+                            // best-effort
+                        }
+                    }
                     if (reflectResult.ok) {
                         const reflectGr = await runAutoAcceptGate([{ proposalId: reflectResult.proposal.id, confidence: reflectResult.proposal.confidence }], reflectGateCfg);
                         gateAutoAcceptedCount += reflectGr.promoted.length;
@@ -2364,6 +3659,18 @@ async function runImproveLoopStage(args) {
                 info(`[improve] ${completedCount}/${loopRefs.length} ${planned.ref}`);
                 continue;
             }
+            // requirePlannedRefs guard: skip distill for distill-only refs when no
+            // reflect-eligible refs were planned this run, preventing mass skip events.
+            if (skipDistillDueToRequirePlannedRefs && isDistillOnly) {
+                actions.push({
+                    ref: planned.ref,
+                    mode: "distill-skipped",
+                    result: { ok: true, reason: "require_planned_refs" },
+                });
+                completedCount++;
+                info(`[improve] ${completedCount}/${loopRefs.length} ${planned.ref}`);
+                continue;
+            }
             // See `isDistillCandidateRef` — excludes `lesson:*` (and anything else in
             // DISTILL_REFUSED_INPUT_TYPES) so distill never gets queued for an input
             // it will refuse.
@@ -2437,6 +3744,9 @@ async function runImproveLoopStage(args) {
                     ref: planned.ref,
                     ...(parsedPlannedRef.type === "memory" ? { proposalKind: "auto" } : {}),
                     ...(options.stashDir ? { stashDir: options.stashDir } : {}),
+                    // Attribution: carry the eligibility lane so distill stamps it on the
+                    // distill_invoked event and the persisted proposal.
+                    ...(planned.eligibilitySource ? { eligibilitySource: planned.eligibilitySource } : {}),
                 }));
                 actions.push({ ref: planned.ref, mode: "distill", result: distillResult });
                 if (distillResult.outcome === "queued" && distillResult.proposal) {
@@ -2449,6 +3759,23 @@ async function runImproveLoopStage(args) {
                     if (!promotedToKnowledge)
                         memoryRefsForInference.add(planned.ref);
                 }
+                // Plasticity counter (plan §WS-1 step 8) for the distill path.
+                // quality_rejected: the LLM ran but produced output that didn't pass the
+                // quality gate — the asset is not yielding useful distill output.
+                // queued: a proposal was produced; reset the no-op counter.
+                if (eventsCtx?.db) {
+                    try {
+                        if (distillResult.outcome === "quality_rejected" || distillResult.outcome === "skipped") {
+                            recordNoOp(eventsCtx.db, planned.ref);
+                        }
+                        else if (distillResult.outcome === "queued") {
+                            resetConsecutiveNoOps(eventsCtx.db, planned.ref);
+                        }
+                    }
+                    catch {
+                        // best-effort: plasticity counter failure never blocks the run
+                    }
+                }
                 if (distillResult.outcome === "quality_rejected" && primaryStashDir) {
                     const slug = planned.ref
                         .replace(/[^a-z0-9]/gi, "-")
@@ -2515,6 +3842,26 @@ async function runImproveLoopStage(args) {
         completedCount++;
         info(`[improve] ${completedCount}/${loopRefs.length} ${planned.ref}`);
     }
+    // WS-4: Per-phase threshold auto-tune — runs AFTER the loop so the gate
+    // has processed all candidates for this run. Persists each phase's tuned
+    // threshold to state.db for the NEXT run's makeGateConfig to read.
+    // Best-effort: a tune failure must never fail the improve run.
+    const stateDbPathForTune = eventsCtx?.dbPath;
+    if (options.autoAccept !== undefined && stateDbPathForTune) {
+        const phaseGateCfgMap = {
+            reflect: reflectGateCfg,
+            distill: distillGateCfg,
+        };
+        for (const phase of ["reflect", "distill"]) {
+            const phaseCfg = phaseGateCfgMap[phase];
+            try {
+                maybeAutoTuneThreshold(phaseCfg.phaseThreshold ?? options.autoAccept, options.config ?? loadConfig(), stateDbPathForTune, undefined, phase);
+            }
+            catch (err) {
+                warn(`[improve] calibration auto-tune (${phase}) skipped: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
+    }
     return { reflectsWithErrorContext, memoryRefsForInference, gateAutoAcceptedCount, gateAutoAcceptFailedCount };
 }
 async function runImprovePostLoopStage(args) {
@@ -2558,9 +3905,73 @@ async function runImprovePostLoopStage(args) {
             // best-effort
         }
     }
+    // #609 — recombine / synthesize pass. Whole-corpus cross-episodic
+    // generalization. Runs in the post-loop stage under consolidate.lock (it
+    // reads the consolidated corpus and writes proposals). Opt-in: gated on the
+    // `recombine` process being enabled, whole-stash / type scope (never `ref`),
+    // and not a dry run. Mirrors the proactiveMaintenance opt-in wiring.
+    let recombination;
+    if (primaryStashDir &&
+        improveProfile &&
+        resolveProcessEnabled("recombine", improveProfile) &&
+        scope.mode !== "ref" &&
+        !options.dryRun) {
+        const recombineFn = options.recombineFn ?? akmRecombine;
+        try {
+            recombination = await recombineFn({
+                stashDir: primaryStashDir,
+                config: options.config ?? loadConfig(),
+                ...(options.runId ? { sourceRun: options.runId } : {}),
+                ...(budgetSignal ? { signal: budgetSignal } : {}),
+                ...(options.autoAccept !== undefined ? { autoAccept: options.autoAccept } : {}),
+                eligibilitySource: "recombine",
+                ...(eventsCtx ? { ctx: eventsCtx } : {}),
+                minClusterSize: improveProfile.processes?.recombine?.minClusterSize,
+                maxClustersPerRun: improveProfile.processes?.recombine?.maxClustersPerRun,
+                relatednessSource: improveProfile.processes?.recombine?.relatednessSource,
+                confirmThreshold: improveProfile.processes?.recombine?.confirmThreshold,
+                // #632 — clustering-tuning knobs. UNSET = pre-#632 behaviour.
+                maxClusterSize: improveProfile.processes?.recombine?.maxClusterSize,
+                excludeTags: improveProfile.processes?.recombine?.excludeTags,
+            });
+        }
+        catch (e) {
+            allWarnings.push(`recombine: ${String(e)}`);
+        }
+    }
+    // #615 — procedural-compilation pass. Detects recurring successful ordered
+    // action sequences and compiles them into workflow proposals. Opt-in: gated
+    // on the `procedural` process being enabled, whole-stash / type scope (never
+    // `ref`), and not a dry run. Mirrors the recombine opt-in wiring.
+    let proceduralCompilation;
+    if (primaryStashDir &&
+        improveProfile &&
+        resolveProcessEnabled("procedural", improveProfile) &&
+        scope.mode !== "ref" &&
+        !options.dryRun) {
+        const proceduralFn = options.proceduralFn ?? akmProcedural;
+        try {
+            proceduralCompilation = await proceduralFn({
+                stashDir: primaryStashDir,
+                config: options.config ?? loadConfig(),
+                ...(options.runId ? { sourceRun: options.runId } : {}),
+                ...(budgetSignal ? { signal: budgetSignal } : {}),
+                ...(options.autoAccept !== undefined ? { autoAccept: options.autoAccept } : {}),
+                eligibilitySource: "procedural",
+                ...(eventsCtx ? { ctx: eventsCtx } : {}),
+                minRecurrence: improveProfile.processes?.procedural?.minRecurrence,
+                maxProposalsPerRun: improveProfile.processes?.procedural?.maxProposalsPerRun,
+            });
+        }
+        catch (e) {
+            allWarnings.push(`procedural: ${String(e)}`);
+        }
+    }
     return {
         allWarnings,
         deadUrls,
+        ...(recombination ? { recombination } : {}),
+        ...(proceduralCompilation ? { proceduralCompilation } : {}),
         ...(maintenanceResult.memoryInference ? { memoryInference: maintenanceResult.memoryInference } : {}),
         ...(maintenanceResult.graphExtraction ? { graphExtraction: maintenanceResult.graphExtraction } : {}),
         ...(maintenanceResult.stalenessDetection ? { stalenessDetection: maintenanceResult.stalenessDetection } : {}),
@@ -2618,309 +4029,328 @@ export async function runImproveMaintenancePasses(args) {
             db = openIndexDb();
         }
     };
-    try {
-        db = openIndexDb();
-        // Memory inference candidate-discovery (post-Item 9 fix from
-        // memory:akm-improve-critical-review-2026-05-20). Previously this pass
-        // was gated on memoryRefsForInference.size > 0 AND passed those refs as a
-        // candidateRefs filter. But memoryRefsForInference is populated from refs
-        // distilled THIS RUN — by the time that happens, those parents are
-        // already split (`inferenceProcessed: true`) and `isPendingMemory` excludes
-        // them. The genuinely-pending parents in the stash never entered the
-        // filter. Result: 0/0/0 for 25 consecutive runs.
-        //
-        // Fix: always run the pass when the feature is enabled; let the pass's
-        // own `collectPendingMemories` + `isPendingMemory` predicate find
-        // candidates from the filesystem-of-truth. The this-run set is still
-        // logged as a hint but no longer used as a filter.
-        const memoryInferenceDisabledByProfile = improveProfile?.processes?.memoryInference?.enabled === false;
-        if (memoryInferenceDisabledByProfile) {
-            info("[improve] memory inference skipped (disabled by improve profile)");
-        }
-        else {
-            const hintRefs = memoryRefsForInference.size;
-            info(hintRefs > 0
-                ? `[improve] memory inference starting (${hintRefs} hint refs touched this run; pass discovers all pending)`
-                : "[improve] memory inference starting (discovering pending parents)");
-            const inferenceStart = Date.now();
-            try {
-                // O-1 (#364): pass budget signal so a hung inference call is cancelled.
-                memoryInference = await withLlmStage("memory-inference", () => memoryInferenceFn({
-                    config,
-                    sources,
-                    signal: budgetSignal,
-                    db,
-                    reEnrich: false,
-                    onProgress: (event) => {
-                        const current = event.currentRef ? ` ${event.currentRef}` : "";
-                        info(`[improve] memory inference ${event.processed}/${event.total}${current} (written ${event.writtenFacts}, skipped ${event.skippedNoFacts})`);
-                    },
-                }));
-                memoryInferenceDurationMs = Date.now() - inferenceStart;
-                actions.push({ ref: "memory:_inference", mode: "memory-inference", result: memoryInference });
-                info(`[improve] memory inference complete (${memoryInference.writtenFacts} facts written from ${memoryInference.splitParents} parents)`);
-            }
-            catch (err) {
-                memoryInferenceDurationMs = Date.now() - inferenceStart;
-                allWarnings.push(`memory inference failed: ${err instanceof Error ? err.message : String(err)}`);
+    await withIndexWriterLease({ purpose: "improve-maintenance", signal: budgetSignal }, async () => {
+        try {
+            db = openIndexDb();
+            // Memory inference candidate-discovery (post-Item 9 fix from
+            // memory:akm-improve-critical-review-2026-05-20). Previously this pass
+            // was gated on memoryRefsForInference.size > 0 AND passed those refs as a
+            // candidateRefs filter. But memoryRefsForInference is populated from refs
+            // distilled THIS RUN — by the time that happens, those parents are
+            // already split (`inferenceProcessed: true`) and `isPendingMemory` excludes
+            // them. The genuinely-pending parents in the stash never entered the
+            // filter. Result: 0/0/0 for 25 consecutive runs.
+            //
+            // Fix: always run the pass when the feature is enabled; let the pass's
+            // own `collectPendingMemories` + `isPendingMemory` predicate find
+            // candidates from the filesystem-of-truth. The this-run set is still
+            // logged as a hint but no longer used as a filter.
+            const memoryInferenceDisabledByProfile = improveProfile?.processes?.memoryInference?.enabled === false;
+            const minPendingCount = improveProfile?.processes?.memoryInference?.minPendingCount;
+            const pendingBelowMinCount = (() => {
+                if (!primaryStashDir || minPendingCount === undefined || minPendingCount <= 0)
+                    return false;
+                const pending = collectPendingMemories(primaryStashDir).length;
+                if (pending < minPendingCount) {
+                    info(`[improve] memory inference skipped (${pending} pending < minPendingCount ${minPendingCount})`);
+                    return true;
+                }
+                return false;
+            })();
+            if (memoryInferenceDisabledByProfile) {
+                info("[improve] memory inference skipped (disabled by improve profile)");
             }
-        }
-        if (memoryInference && (memoryInference.splitParents > 0 || memoryInference.writtenFacts > 0)) {
-            info("[improve] reindexing after memory inference writes");
-            try {
-                await reindexWithIndexDbReleased(primaryStashDir);
-                reindexedAfterInference = true;
-                info("[improve] reindex after memory inference complete");
+            else if (pendingBelowMinCount) {
+                // skipped — message already emitted above
             }
-            catch (err) {
-                allWarnings.push(`reindex after memory inference failed: ${err instanceof Error ? err.message : String(err)}`);
-            }
-        }
-        const graphEnabled = isProcessEnabled("index", "graph_extraction", config);
-        const graphExtractionDisabledByProfile = improveProfile?.processes?.graphExtraction?.enabled === false;
-        const graphExtractionFullScan = improveProfile?.processes?.graphExtraction?.fullScan === true;
-        // Build the set of refs actually touched this run.
-        const touchedRefs = new Set();
-        for (const r of args.actionableRefs)
-            touchedRefs.add(r.ref);
-        for (const r of memoryRefsForInference)
-            touchedRefs.add(r);
-        // INVARIANT: graph extraction normally runs only on files touched by
-        // actionable refs (candidatePaths). Full-corpus scans are opt-in via
-        // profile.processes.graphExtraction.fullScan = true (used by the
-        // `graph-refresh` built-in profile and its weekly scheduled task).
-        // The empty-Set fallback is intentional when no refs were touched —
-        // the extractor's filter rejects every file and returns empty, keeping
-        // the pass invoked so the action is recorded and tests stay exercised.
-        if (graphExtractionDisabledByProfile) {
-            info("[improve] graph extraction skipped (disabled by improve profile)");
-        }
-        else if (sources.length > 0 && graphEnabled) {
-            info(`[improve] graph extraction starting${graphExtractionFullScan ? " (full-corpus scan)" : ""}`);
-            const extractionStart = Date.now();
-            try {
-                // D9: if consolidation ran but memory inference did not reindex, force a reindex
-                // so graph extraction sees current DB state after consolidation writes.
-                if (consolidationRan && !reindexedAfterInference) {
-                    info("[improve] reindexing after consolidation (graph extraction needs current state)");
-                    try {
-                        await reindexWithIndexDbReleased(primaryStashDir);
-                        reindexedAfterInference = true;
-                        info("[improve] reindex after consolidation complete");
-                    }
-                    catch (err) {
-                        allWarnings.push(`reindex after consolidation failed: ${err instanceof Error ? err.message : String(err)}`);
-                    }
+            else {
+                const hintRefs = memoryRefsForInference.size;
+                info(hintRefs > 0
+                    ? `[improve] memory inference starting (${hintRefs} hint refs touched this run; pass discovers all pending)`
+                    : "[improve] memory inference starting (discovering pending parents)");
+                const inferenceStart = Date.now();
+                try {
+                    // O-1 (#364): pass budget signal so a hung inference call is cancelled.
+                    memoryInference = await withLlmStage("memory-inference", () => memoryInferenceFn({
+                        config,
+                        sources,
+                        signal: budgetSignal,
+                        db,
+                        reEnrich: false,
+                        onProgress: (event) => {
+                            const current = event.currentRef ? ` ${event.currentRef}` : "";
+                            info(`[improve] memory inference ${event.processed}/${event.total}${current} (written ${event.writtenFacts}, skipped ${event.skippedNoFacts})`);
+                        },
+                    }));
+                    memoryInferenceDurationMs = Date.now() - inferenceStart;
+                    actions.push({ ref: "memory:_inference", mode: "memory-inference", result: memoryInference });
+                    info(`[improve] memory inference complete (${memoryInference.writtenFacts} facts written from ${memoryInference.splitParents} parents)`);
                 }
-                // #584: no close/reopen needed here — reindexWithIndexDbReleased
-                // already swapped in a fresh post-reindex handle.
-                // Resolve touched refs to absolute file paths. Skipped for fullScan
-                // (candidatePaths stays undefined → extractor processes all files).
-                let candidatePaths;
-                if (!graphExtractionFullScan) {
-                    candidatePaths = new Set();
-                    if (primaryStashDir && touchedRefs.size > 0) {
-                        const writableDirSet = new Set(getWritableStashDirs(primaryStashDir).map((d) => path.resolve(d)));
-                        const resolved = await Promise.all([...touchedRefs].map((ref) => findAssetFilePath(ref, primaryStashDir, writableDirSet).catch(() => null)));
-                        for (const p of resolved) {
-                            if (typeof p === "string" && p.length > 0)
-                                candidatePaths.add(p);
-                        }
-                    }
+                catch (err) {
+                    memoryInferenceDurationMs = Date.now() - inferenceStart;
+                    allWarnings.push(`memory inference failed: ${err instanceof Error ? err.message : String(err)}`);
                 }
-                const progressHandler = (event) => {
-                    const current = event.currentPath ? ` ${path.basename(event.currentPath)}` : "";
-                    info(`[improve] graph extraction ${event.processed}/${event.total}${current} (extracted ${event.extracted}, entities ${event.totalEntities}, relations ${event.totalRelations})`);
-                };
-                // O-1 (#364): pass budget signal so a hung graph extraction call is cancelled.
-                graphExtraction = await withLlmStage("graph-extraction", () => graphExtractionFn({
-                    config,
-                    sources,
-                    signal: budgetSignal,
-                    db,
-                    reEnrich: false,
-                    onProgress: progressHandler,
-                    options: { candidatePaths },
-                }));
-                graphExtractionDurationMs = Date.now() - extractionStart;
-                actions.push({ ref: "graph:_artifact", mode: "graph-extraction", result: graphExtraction });
-                info(`[improve] graph extraction complete (${graphExtraction.quality.extractedFiles} files, ${graphExtraction.quality.entityCount} entities, ${graphExtraction.quality.relationCount} relations)`);
-            }
-            catch (err) {
-                graphExtractionDurationMs = Date.now() - extractionStart;
-                allWarnings.push(`graph extraction failed: ${err instanceof Error ? err.message : String(err)}`);
             }
-        }
-        else if (sources.length > 0 && !graphEnabled) {
-            info("[improve] graph extraction skipped (features.index.graph_extraction is disabled)");
-        }
-        // Orphan proposal purge — reject pending reflect proposals whose target
-        // asset no longer exists on disk. Runs after graph extraction so newly
-        // promoted assets from accept flows during this run are already present.
-        if (primaryStashDir) {
-            try {
-                const purgeResult = purgeOrphanProposals(primaryStashDir, sources.map((s) => s.path));
-                orphansPurged = purgeResult.rejected;
-                if (purgeResult.rejected > 0) {
-                    info(`[improve] orphan purge: ${purgeResult.rejected}/${purgeResult.checked} orphaned proposals rejected (${purgeResult.durationMs}ms)`);
+            if (memoryInference && (memoryInference.splitParents > 0 || memoryInference.writtenFacts > 0)) {
+                info("[improve] reindexing after memory inference writes");
+                try {
+                    await reindexWithIndexDbReleased(primaryStashDir);
+                    reindexedAfterInference = true;
+                    info("[improve] reindex after memory inference complete");
+                }
+                catch (err) {
+                    allWarnings.push(`reindex after memory inference failed: ${err instanceof Error ? err.message : String(err)}`);
                 }
-                appendEvent({
-                    eventType: "proposal_orphan_purge",
-                    ref: "proposals:_orphan-purge",
-                    metadata: {
-                        checked: purgeResult.checked,
-                        rejected: purgeResult.rejected,
-                        durationMs: purgeResult.durationMs,
-                        byType: purgeResult.byType,
-                        orphans: purgeResult.orphans.map((o) => o.ref),
-                    },
-                }, eventsCtx);
             }
-            catch (err) {
-                allWarnings.push(`orphan purge failed: ${err instanceof Error ? err.message : String(err)}`);
+            const graphEnabled = isProcessEnabled("index", "graph_extraction", config);
+            const graphExtractionDisabledByProfile = improveProfile?.processes?.graphExtraction?.enabled === false;
+            const graphExtractionFullScan = improveProfile?.processes?.graphExtraction?.fullScan === true;
+            // #624 P2: optional incremental high-signal-first cap. Unset = process all
+            // eligible (byte-identical to today; no ranking/slice).
+            const graphExtractionTopN = improveProfile?.processes?.graphExtraction?.topN;
+            // Build the set of refs actually touched this run.
+            const touchedRefs = new Set();
+            for (const r of args.actionableRefs)
+                touchedRefs.add(r.ref);
+            for (const r of memoryRefsForInference)
+                touchedRefs.add(r);
+            // INVARIANT: graph extraction normally runs only on files touched by
+            // actionable refs (candidatePaths). Full-corpus scans are opt-in via
+            // profile.processes.graphExtraction.fullScan = true (used by the
+            // `graph-refresh` built-in profile and its weekly scheduled task).
+            // The empty-Set fallback is intentional when no refs were touched —
+            // the extractor's filter rejects every file and returns empty, keeping
+            // the pass invoked so the action is recorded and tests stay exercised.
+            if (graphExtractionDisabledByProfile) {
+                info("[improve] graph extraction skipped (disabled by improve profile)");
             }
-            // Phase 6B (Advantage D6b): expire pending proposals that have aged past
-            // the retention window. Runs AFTER orphan purge so we never double-archive
-            // a proposal that orphan-purge already moved. `expireStaleProposals` emits
-            // its own per-proposal `proposal_expired` events; we additionally emit a
-            // single roll-up event here for parity with the orphan-purge surface.
-            try {
-                const expireResult = expireStaleProposals(primaryStashDir, config);
-                proposalsExpired = expireResult.expired;
-                if (expireResult.expired > 0) {
-                    info(`[improve] expiration: ${expireResult.expired}/${expireResult.checked} pending proposals expired ` +
-                        `(retention=${expireResult.retentionDays}d, ${expireResult.durationMs}ms)`);
+            else if (sources.length > 0 && graphEnabled) {
+                info(`[improve] graph extraction starting${graphExtractionFullScan ? " (full-corpus scan)" : ""}`);
+                const extractionStart = Date.now();
+                try {
+                    // D9: if consolidation ran but memory inference did not reindex, force a reindex
+                    // so graph extraction sees current DB state after consolidation writes.
+                    if (consolidationRan && !reindexedAfterInference) {
+                        info("[improve] reindexing after consolidation (graph extraction needs current state)");
+                        try {
+                            await reindexWithIndexDbReleased(primaryStashDir);
+                            reindexedAfterInference = true;
+                            info("[improve] reindex after consolidation complete");
+                        }
+                        catch (err) {
+                            allWarnings.push(`reindex after consolidation failed: ${err instanceof Error ? err.message : String(err)}`);
+                        }
+                    }
+                    // #584: no close/reopen needed here — reindexWithIndexDbReleased
+                    // already swapped in a fresh post-reindex handle.
+                    // Resolve touched refs to absolute file paths. Skipped for fullScan
+                    // (candidatePaths stays undefined → extractor processes all files).
+                    let candidatePaths;
+                    if (!graphExtractionFullScan) {
+                        candidatePaths = new Set();
+                        if (primaryStashDir && touchedRefs.size > 0) {
+                            const writableDirSet = new Set(getWritableStashDirs(primaryStashDir).map((d) => path.resolve(d)));
+                            const resolved = await Promise.all([...touchedRefs].map((ref) => findAssetFilePath(ref, primaryStashDir, writableDirSet).catch(() => null)));
+                            for (const p of resolved) {
+                                if (typeof p === "string" && p.length > 0)
+                                    candidatePaths.add(p);
+                            }
+                        }
+                    }
+                    const progressHandler = (event) => {
+                        const current = event.currentPath ? ` ${path.basename(event.currentPath)}` : "";
+                        info(`[improve] graph extraction ${event.processed}/${event.total}${current} (extracted ${event.extracted}, entities ${event.totalEntities}, relations ${event.totalRelations})`);
+                    };
+                    // O-1 (#364): pass budget signal so a hung graph extraction call is cancelled.
+                    graphExtraction = await withLlmStage("graph-extraction", () => graphExtractionFn({
+                        config,
+                        sources,
+                        signal: budgetSignal,
+                        db,
+                        reEnrich: false,
+                        onProgress: progressHandler,
+                        options: { candidatePaths, ...(graphExtractionTopN != null ? { topN: graphExtractionTopN } : {}) },
+                    }));
+                    graphExtractionDurationMs = Date.now() - extractionStart;
+                    actions.push({ ref: "graph:_artifact", mode: "graph-extraction", result: graphExtraction });
+                    info(`[improve] graph extraction complete (${graphExtraction.quality.extractedFiles} files, ${graphExtraction.quality.entityCount} entities, ${graphExtraction.quality.relationCount} relations)`);
+                }
+                catch (err) {
+                    graphExtractionDurationMs = Date.now() - extractionStart;
+                    allWarnings.push(`graph extraction failed: ${err instanceof Error ? err.message : String(err)}`);
                 }
-                appendEvent({
-                    eventType: "proposal_expiration_pass",
-                    ref: "proposals:_expiration",
-                    metadata: {
-                        checked: expireResult.checked,
-                        expired: expireResult.expired,
-                        durationMs: expireResult.durationMs,
-                        retentionDays: expireResult.retentionDays,
-                        expiredProposals: expireResult.expiredProposals,
-                    },
-                }, eventsCtx);
             }
-            catch (err) {
-                allWarnings.push(`proposal expiration failed: ${err instanceof Error ? err.message : String(err)}`);
+            else if (sources.length > 0 && !graphEnabled) {
+                info("[improve] graph extraction skipped (features.index.graph_extraction is disabled)");
             }
-        }
-        // Fix #2 (observability 0.8.0): trim the events table in state.db so it
-        // doesn't grow unbounded. `akm health` writes a `health_probe` row on every
-        // invocation, and every command surface emits at least one event besides —
-        // without this trim, state.db is a permanent append-only log. Config key
-        // `improve.eventRetentionDays` (default 90, set 0 to disable) controls the
-        // window. The purge runs against state.db (a different SQLite file from
-        // the index `db` above).
-        {
-            const retentionDays = typeof config.improve?.eventRetentionDays === "number" ? config.improve.eventRetentionDays : 90;
-            if (retentionDays > 0) {
-                // #585: reuse the long-lived eventsCtx.db connection when akmImprove
-                // opened one — opening a second state.db write connection while
-                // eventsDb is still live made two simultaneous writers contend on the
-                // same WAL file ("database is locked"). Only the eventsCtx.dbPath
-                // fallback path (state.db failed to open up-front) opens — and then
-                // owns and closes — its own handle. C2 still holds: the fallback uses
-                // the boundary-pinned path, never a live `process.env` re-read.
-                const ownsStateDb = !eventsCtx?.db;
-                let stateDb;
+            // Orphan proposal purge — reject pending reflect proposals whose target
+            // asset no longer exists on disk. Runs after graph extraction so newly
+            // promoted assets from accept flows during this run are already present.
+            if (primaryStashDir) {
                 try {
-                    stateDb = eventsCtx?.db ?? openStateDatabase(eventsCtx?.dbPath);
-                    const purgedCount = purgeOldEvents(stateDb, retentionDays);
-                    if (purgedCount > 0) {
-                        info(`[improve] events purge: ${purgedCount} event(s) older than ${retentionDays}d removed from state.db`);
-                    }
-                    appendEvent({
-                        eventType: "events_purged",
-                        ref: "events:_purge",
-                        metadata: { purgedCount, retentionDays },
-                    }, eventsCtx);
-                    // improve_runs uses the same retention window as events — both are
-                    // observability/audit data, both grow append-only, both have a
-                    // dedicated purge helper. Mirroring the events purge here means a
-                    // single retention knob (improve.eventRetentionDays) governs both.
-                    const improveRunsPurged = purgeOldImproveRuns(stateDb, retentionDays);
-                    if (improveRunsPurged > 0) {
-                        info(`[improve] improve_runs purge: ${improveRunsPurged} run(s) older than ${retentionDays}d removed from state.db`);
+                    const purgeResult = purgeOrphanProposals(primaryStashDir, sources.map((s) => s.path));
+                    orphansPurged = purgeResult.rejected;
+                    if (purgeResult.rejected > 0) {
+                        info(`[improve] orphan purge: ${purgeResult.rejected}/${purgeResult.checked} orphaned proposals rejected (${purgeResult.durationMs}ms)`);
                     }
                     appendEvent({
-                        eventType: "improve_runs_purged",
-                        ref: "improve_runs:_purge",
-                        metadata: { purgedCount: improveRunsPurged, retentionDays },
+                        eventType: "proposal_orphan_purge",
+                        ref: "proposals:_orphan-purge",
+                        metadata: {
+                            checked: purgeResult.checked,
+                            rejected: purgeResult.rejected,
+                            durationMs: purgeResult.durationMs,
+                            byType: purgeResult.byType,
+                            orphans: purgeResult.orphans.map((o) => o.ref),
+                        },
                     }, eventsCtx);
                 }
                 catch (err) {
-                    allWarnings.push(`events purge failed: ${err instanceof Error ? err.message : String(err)}`);
-                }
-                finally {
-                    if (ownsStateDb && stateDb) {
-                        try {
-                            stateDb.close();
-                        }
-                        catch {
-                            // best-effort
-                        }
-                    }
+                    allWarnings.push(`orphan purge failed: ${err instanceof Error ? err.message : String(err)}`);
                 }
-                // task_logs in logs.db (#579) shares the same retention window as
-                // events/improve_runs — all three are observability data governed by
-                // the single improve.eventRetentionDays knob. Separate try/finally
-                // because logs.db is a different file: a locked/missing logs.db must
-                // not block the state.db purges above.
-                let logsDb;
+                // Phase 6B (Advantage D6b): expire pending proposals that have aged past
+                // the retention window. Runs AFTER orphan purge so we never double-archive
+                // a proposal that orphan-purge already moved. `expireStaleProposals` emits
+                // its own per-proposal `proposal_expired` events; we additionally emit a
+                // single roll-up event here for parity with the orphan-purge surface.
                 try {
-                    logsDb = openLogsDatabase();
-                    const taskLogsPurged = purgeOldTaskLogs(logsDb, retentionDays);
-                    if (taskLogsPurged > 0) {
-                        info(`[improve] task_logs purge: ${taskLogsPurged} log line(s) older than ${retentionDays}d removed from logs.db`);
+                    const expireResult = expireStaleProposals(primaryStashDir, config);
+                    proposalsExpired = expireResult.expired;
+                    if (expireResult.expired > 0) {
+                        info(`[improve] expiration: ${expireResult.expired}/${expireResult.checked} pending proposals expired ` +
+                            `(retention=${expireResult.retentionDays}d, ${expireResult.durationMs}ms)`);
                     }
                     appendEvent({
-                        eventType: "task_logs_purged",
-                        ref: "task_logs:_purge",
-                        metadata: { purgedCount: taskLogsPurged, retentionDays },
+                        eventType: "proposal_expiration_pass",
+                        ref: "proposals:_expiration",
+                        metadata: {
+                            checked: expireResult.checked,
+                            expired: expireResult.expired,
+                            durationMs: expireResult.durationMs,
+                            retentionDays: expireResult.retentionDays,
+                            expiredProposals: expireResult.expiredProposals,
+                        },
                     }, eventsCtx);
                 }
                 catch (err) {
-                    allWarnings.push(`task_logs purge failed: ${err instanceof Error ? err.message : String(err)}`);
+                    allWarnings.push(`proposal expiration failed: ${err instanceof Error ? err.message : String(err)}`);
                 }
-                finally {
-                    if (logsDb) {
-                        try {
-                            logsDb.close();
+            }
+            // Fix #2 (observability 0.8.0): trim the events table in state.db so it
+            // doesn't grow unbounded. `akm health` writes a `health_probe` row on every
+            // invocation, and every command surface emits at least one event besides —
+            // without this trim, state.db is a permanent append-only log. Config key
+            // `improve.eventRetentionDays` (default 90, set 0 to disable) controls the
+            // window. The purge runs against state.db (a different SQLite file from
+            // the index `db` above).
+            {
+                const retentionDays = typeof config.improve?.eventRetentionDays === "number" ? config.improve.eventRetentionDays : 90;
+                if (retentionDays > 0) {
+                    // #585: reuse the long-lived eventsCtx.db connection when akmImprove
+                    // opened one — opening a second state.db write connection while
+                    // eventsDb is still live made two simultaneous writers contend on the
+                    // same WAL file ("database is locked"). Only the eventsCtx.dbPath
+                    // fallback path (state.db failed to open up-front) opens — and then
+                    // owns and closes — its own handle. C2 still holds: the fallback uses
+                    // the boundary-pinned path, never a live `process.env` re-read.
+                    const ownsStateDb = !eventsCtx?.db;
+                    let stateDb;
+                    try {
+                        stateDb = eventsCtx?.db ?? openStateDatabase(eventsCtx?.dbPath);
+                        const purgedCount = purgeOldEvents(stateDb, retentionDays);
+                        if (purgedCount > 0) {
+                            info(`[improve] events purge: ${purgedCount} event(s) older than ${retentionDays}d removed from state.db`);
                         }
-                        catch {
-                            // best-effort
+                        appendEvent({
+                            eventType: "events_purged",
+                            ref: "events:_purge",
+                            metadata: { purgedCount, retentionDays },
+                        }, eventsCtx);
+                        // improve_runs uses the same retention window as events — both are
+                        // observability/audit data, both grow append-only, both have a
+                        // dedicated purge helper. Mirroring the events purge here means a
+                        // single retention knob (improve.eventRetentionDays) governs both.
+                        const improveRunsPurged = purgeOldImproveRuns(stateDb, retentionDays);
+                        if (improveRunsPurged > 0) {
+                            info(`[improve] improve_runs purge: ${improveRunsPurged} run(s) older than ${retentionDays}d removed from state.db`);
+                        }
+                        appendEvent({
+                            eventType: "improve_runs_purged",
+                            ref: "improve_runs:_purge",
+                            metadata: { purgedCount: improveRunsPurged, retentionDays },
+                        }, eventsCtx);
+                    }
+                    catch (err) {
+                        allWarnings.push(`events purge failed: ${err instanceof Error ? err.message : String(err)}`);
+                    }
+                    finally {
+                        if (ownsStateDb && stateDb) {
+                            try {
+                                stateDb.close();
+                            }
+                            catch {
+                                // best-effort
+                            }
+                        }
+                    }
+                    // task_logs in logs.db (#579) shares the same retention window as
+                    // events/improve_runs — all three are observability data governed by
+                    // the single improve.eventRetentionDays knob. Separate try/finally
+                    // because logs.db is a different file: a locked/missing logs.db must
+                    // not block the state.db purges above.
+                    let logsDb;
+                    try {
+                        logsDb = openLogsDatabase();
+                        const taskLogsPurged = purgeOldTaskLogs(logsDb, retentionDays);
+                        if (taskLogsPurged > 0) {
+                            info(`[improve] task_logs purge: ${taskLogsPurged} log line(s) older than ${retentionDays}d removed from logs.db`);
+                        }
+                        appendEvent({
+                            eventType: "task_logs_purged",
+                            ref: "task_logs:_purge",
+                            metadata: { purgedCount: taskLogsPurged, retentionDays },
+                        }, eventsCtx);
+                    }
+                    catch (err) {
+                        allWarnings.push(`task_logs purge failed: ${err instanceof Error ? err.message : String(err)}`);
+                    }
+                    finally {
+                        if (logsDb) {
+                            try {
+                                logsDb.close();
+                            }
+                            catch {
+                                // best-effort
+                            }
                         }
                     }
                 }
             }
-        }
-        // Phase 4A (staleness detection). Activates the `deprecated` belief-state
-        // machinery shipped in Phase 1A. Default OFF — gated by
-        // `features.index.staleness_detection.enabled`. Runs after orphan purge
-        // and before the URL check (which lives in the outer caller).
-        if (sources.length > 0) {
-            try {
-                stalenessDetection = await withLlmStage("staleness-detection", () => stalenessDetectionFn({ config, sources, signal: budgetSignal, db }));
-                if (stalenessDetection.considered > 0) {
-                    info(`[improve] staleness detection complete (considered ${stalenessDetection.considered}, ` +
-                        `deprecated ${stalenessDetection.deprecated}, confirmed ${stalenessDetection.confirmed}, ` +
-                        `skipped ${stalenessDetection.skipped}, ${stalenessDetection.durationMs}ms)`);
+            // Phase 4A (staleness detection). Activates the `deprecated` belief-state
+            // machinery shipped in Phase 1A. Default OFF — gated by
+            // `features.index.staleness_detection.enabled`. Runs after orphan purge
+            // and before the URL check (which lives in the outer caller).
+            if (sources.length > 0) {
+                try {
+                    stalenessDetection = await withLlmStage("staleness-detection", () => stalenessDetectionFn({ config, sources, signal: budgetSignal, db }));
+                    if (stalenessDetection.considered > 0) {
+                        info(`[improve] staleness detection complete (considered ${stalenessDetection.considered}, ` +
+                            `deprecated ${stalenessDetection.deprecated}, confirmed ${stalenessDetection.confirmed}, ` +
+                            `skipped ${stalenessDetection.skipped}, ${stalenessDetection.durationMs}ms)`);
+                    }
+                    for (const w of stalenessDetection.warnings)
+                        allWarnings.push(`[improve] staleness detection: ${w}`);
+                }
+                catch (err) {
+                    allWarnings.push(`staleness detection failed: ${err instanceof Error ? err.message : String(err)}`);
                 }
-                for (const w of stalenessDetection.warnings)
-                    allWarnings.push(`[improve] staleness detection: ${w}`);
-            }
-            catch (err) {
-                allWarnings.push(`staleness detection failed: ${err instanceof Error ? err.message : String(err)}`);
             }
         }
-    }
-    finally {
-        if (db)
-            closeDatabase(db);
-    }
+        finally {
+            if (db)
+                closeDatabase(db);
+        }
+    });
     return {
         ...(memoryInference ? { memoryInference } : {}),
         ...(graphExtraction ? { graphExtraction } : {}),