akm-cli 0.9.0-beta.57 → 0.9.0-beta.59

package/dist/commands/improve/distill.js

@@ -59,7 +59,7 @@ import { parseFrontmatter, writeSalienceToFrontmatter } from "../../core/asset/f
 import { stripMarkdownFences } from "../../core/asset/markdown.js";
 import { authoringRulesForType } from "../../core/authoring-rules.js";
 import { resolveStashDir } from "../../core/common.js";
-import { getDefaultLlmConfig, loadConfig } from "../../core/config/config.js";
+import { getDefaultLlmConfig, getImproveProcessConfig, loadConfig } from "../../core/config/config.js";
 import { ConfigError, UsageError } from "../../core/errors.js";
 import { appendEvent, readEvents } from "../../core/events.js";
 import { lintLessonContent } from "../../core/lesson-lint.js";
@@ -91,6 +91,11 @@ export { runLessonQualityJudge };
  * `lesson:lesson-<name>-lesson-lesson` (double `-lesson` suffix) — the
  * recursive-ref defect observed across 323 archived rejected proposals.
  *
+ * 08-F2: `env` and `secret` are refused as a STRUCTURAL floor — distill reads
+ * the input asset's bytes via `readFileSync` and hands them to the LLM, so
+ * secret material must never be a distill input. This gate is code, not config:
+ * it holds even when `allowedTypes` config is mis-set in unattended cron.
+ *
  * The runtime gate inside {@link akmDistill} still refuses these inputs
  * defensively (returning an `outcome: "skipped"` envelope with `skipReason:
  * "recursive_lesson_input"`). This exported set is the planner-side companion:
@@ -102,7 +107,7 @@ export { runLessonQualityJudge };
  * type means updating this constant — the planner picks the change up for
  * free.
  */
-export const DISTILL_REFUSED_INPUT_TYPES = new Set(["lesson"]);
+export const DISTILL_REFUSED_INPUT_TYPES = new Set(["lesson", "env", "secret"]);
 /**
  * Returns true when `type` is structurally refused as an input by
  * {@link akmDistill}. See {@link DISTILL_REFUSED_INPUT_TYPES}.
@@ -441,15 +446,21 @@ export async function akmDistill(options) {
     // the improve planner can skip these refs before queuing distill attempts;
     // this runtime check stays as a defensive backstop for direct callers.
     if (isDistillRefusedInputType(parsedInputRef.type)) {
-        const skippedRef = `lesson:${parsedInputRef.name}`;
+        // 08-F2: env/secret are a secret-material refusal (never read the bytes);
+        // lesson is the recursive-form refusal. Both skip BEFORE any readFileSync.
+        const isSecretInput = parsedInputRef.type === "env" || parsedInputRef.type === "secret";
+        const skippedRef = isSecretInput ? inputRef : `lesson:${parsedInputRef.name}`;
+        const message = isSecretInput
+            ? `Distill refuses ${parsedInputRef.type} inputs — secret material must never be sent to the LLM.`
+            : "Distill refuses lesson inputs — lessons are the distilled form, not a source.";
         appendEvent({
             eventType: "distill_invoked",
             ref: inputRef,
             metadata: {
                 outcome: "skipped",
                 lessonRef: skippedRef,
-                message: "distill refuses lesson inputs — lessons are the distilled form, not a source",
-                skipReason: "recursive_lesson_input",
+                message,
+                skipReason: isSecretInput ? "refused_secret_input" : "recursive_lesson_input",
                 ...eligMeta,
             },
         });
@@ -459,7 +470,7 @@ export async function akmDistill(options) {
             outcome: "skipped",
             inputRef,
             lessonRef: skippedRef,
-            message: "Distill refuses lesson inputs — lessons are the distilled form, not a source.",
+            message,
         };
     }
     const config = options.config ?? loadConfig();
@@ -623,7 +634,7 @@ export async function akmDistill(options) {
     // When cls.enabled, inject embedding-retrieved adjacent lessons/knowledge
     // into the distill prompt so the LLM avoids overwriting prior generalizations
     // (catastrophic interference). DEFAULT OFF.
-    const clsConfig = config.profiles?.improve?.default?.processes?.distill?.cls ?? {};
+    const clsConfig = getImproveProcessConfig(config, "distill", options.improveProfile)?.cls ?? {};
     let clsContext = "";
     if (clsConfig.enabled) {
         try {
@@ -806,7 +817,8 @@ export async function akmDistill(options) {
             : "Lessons require non-empty `description` and `when_to_use` frontmatter fields. See v1 spec §13.");
     }
     // LLM-as-judge quality gate (P2-B). Only active when the feature flag is
-    // explicitly enabled. Fail-open: judge failures always pass through.
+    // explicitly enabled. Fail-CLOSED (07 P0-2): an unjudgeable proposal (no LLM
+    // / timeout / parse failure) is rejected, not passed through.
     // D-5 / #388: Three-band system — review_needed band queues a proposal
     // with review_needed outcome rather than auto-rejecting.
     let lessonJudgeConfidence;
@@ -823,9 +835,11 @@ export async function akmDistill(options) {
             }
             return writeQualityRejection(stash, inputRef, effectiveLessonRef, content, judgeResult.score, judgeResult.reason, exclusionSet.size > 0 ? { filteredFeedbackCount, feedbackFullyFiltered } : {}, options.eligibilitySource);
         }
-        // Normalize 1-5 judge score to [0, 1]. Score of -1 means pass-through
-        // (no LLM / timeout / parse failure) — leave confidence undefined so
-        // the auto-accept gate treats the proposal as unscored and skips it.
+        // Normalize 1-5 judge score to [0, 1]. Only a real passing verdict
+        // reaches here (07 P0-2: the judge now fails CLOSED on no-LLM / timeout /
+        // parse failure, so those return pass:false and never fall through to
+        // this line). A defensive score>0 guard keeps confidence undefined for any
+        // non-positive score the auto-accept gate should treat as unscored.
         if (judgeResult.score > 0)
             lessonJudgeConfidence = judgeResult.score / 5;
     }
@@ -833,7 +847,7 @@ export async function akmDistill(options) {
     // When fidelityCheck.enabled, check the distill proposal against its cited
     // source memories. A contradiction flag routes to human review (not auto-accept).
     // DEFAULT OFF. Fail-open: any error is treated as no-contradiction.
-    const fidelityConfig = config.profiles?.improve?.default?.processes?.distill?.fidelityCheck ?? {};
+    const fidelityConfig = getImproveProcessConfig(config, "distill", options.improveProfile)?.fidelityCheck ?? {};
     if (fidelityConfig.enabled && assetContent) {
         try {
             const proposalBody = stripBodyForFidelity(content);

package/dist/commands/improve/extract-prompt.js

@@ -123,22 +123,36 @@ function formatAlreadyPreserved(inlineRefs) {
     })
         .join("\n");
 }
+/**
+ * Delimiters that fence the untrusted session transcript in the extract prompt.
+ * Mirrors the `=== ASSET N ===` convention (`graph-extract.ts`): everything
+ * between the markers is DATA to analyze, never instructions to obey. The
+ * transcript is external, attacker-influenceable content, so an explicit,
+ * greppable boundary defuses prompt-injection that tries to pose as a command.
+ */
+export const TRANSCRIPT_FENCE_BEGIN = "=== BEGIN UNTRUSTED SESSION TRANSCRIPT ===";
+export const TRANSCRIPT_FENCE_END = "=== END UNTRUSTED SESSION TRANSCRIPT ===";
 /**
  * Format pre-filtered events as a transcript snippet. Each event becomes:
  *   [<role> @ <iso>] <text>
  * Events are already truncated/cleaned by the pre-filter; this is purely
  * a render step.
+ *
+ * Anti-spoof: any occurrence of the fence markers inside the transcript text is
+ * neutralised so a crafted session cannot forge the boundary and "escape" the
+ * fence to inject trusted-looking instructions.
  */
 function formatTranscript(events) {
     if (events.length === 0)
         return "(empty — pre-filter removed all events as noise)";
-    return events
+    const body = events
         .map((e) => {
         const tsLabel = e.ts ? new Date(e.ts).toISOString() : "unknown-ts";
         const roleLabel = e.role ?? "unknown";
         return `[${roleLabel} @ ${tsLabel}] ${e.text}`;
     })
         .join("\n\n");
+    return body.split(TRANSCRIPT_FENCE_BEGIN).join("=== (fence) ===").split(TRANSCRIPT_FENCE_END).join("=== (fence) ===");
 }
 /**
  * Build the user-prompt body for the extract LLM call by interpolating
@@ -162,7 +176,7 @@ export function buildExtractPrompt(input) {
         .replace("{{PROJECT_HINT}}", ref.projectHint ?? "(no project hint)")
         .replace("{{ALREADY_PRESERVED}}", formatAlreadyPreserved(input.inlineRefs))
         .replace("{{STANDARDS}}", standards)
-        .replace("{{TRANSCRIPT}}", formatTranscript(input.events));
+        .replace("{{TRANSCRIPT}}", `${TRANSCRIPT_FENCE_BEGIN}\n${formatTranscript(input.events)}\n${TRANSCRIPT_FENCE_END}`);
 }
 /**
  * Parse the LLM's JSON response into a structured {@link ExtractPayload}.

package/dist/commands/improve/extract.js

@@ -27,7 +27,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { assembleAsset } from "../../core/asset/asset-serialize.js";
 import { resolveStashDir, timestampForFilename } from "../../core/common.js";
-import { getDefaultLlmConfig, loadConfig } from "../../core/config/config.js";
+import { getDefaultLlmConfig, getImproveProcessConfig, loadConfig } from "../../core/config/config.js";
 import { ConfigError, UsageError } from "../../core/errors.js";
 import { appendEvent } from "../../core/events.js";
 import { probeLock, releaseLock, tryAcquireLockSync } from "../../core/file-lock.js";
@@ -451,8 +451,12 @@ standardsContext) {
     // When enabled, system-generated extractions enter captureMode: hot-probation
     // so they spend ONE consolidation cycle in probation before the deterministic
     // dedup+quality pass promotes them. Default OFF.
-    const hotProbationEnabled = config.profiles?.improve?.default?.processes?.extract?.hotProbation
-        ?.enabled === true;
+    // Reads the `default` profile deliberately: this per-session hot-probation
+    // flag lives inside the 18-arg `processSession`, which has no handle to the
+    // active profile, and threading a 19th positional arg for a DEFAULT-OFF flag
+    // isn't worth the param bloat. The extract STAGE toggle (in `akmExtract`,
+    // below) already honors `--profile`.
+    const hotProbationEnabled = getImproveProcessConfig(config, "extract")?.hotProbation?.enabled === true;
     for (const candidate of payload.candidates) {
         if (dryRun) {
             proposalIds.push(`dry-run:${candidate.type}:${candidate.name}`);
@@ -557,9 +561,7 @@ export async function akmExtract(options) {
     // is what stops a non-default profile's `extract.enabled` from being silently
     // overridden by the default profile and vice-versa.
     const activeProfile = options.improveProfile;
-    const extractProcess = activeProfile
-        ? activeProfile.processes?.extract
-        : config.profiles?.improve?.default?.processes?.extract;
+    const extractProcess = activeProfile ? activeProfile.processes?.extract : getImproveProcessConfig(config, "extract");
     // The `extract.enabled` process toggle gates extract as a STAGE of `akm improve`
     // (the activeProfile path) — consistent with #593/#594 where the active profile,
     // not `default`, is the source of truth. An EXPLICIT `akm extract` invocation
@@ -870,7 +872,13 @@ export async function akmExtract(options) {
                         // #602 — persist the freshly computed content hash so the NEXT run
                         // can compare byte-for-byte. read_failed (before hash) → null, which
                         // keeps the row eligible for retry (matches failed-row semantics).
-                        contentHash: result.contentHash ?? null,
+                        // R4 — llm_unavailable (LLM was down) and triaged_out (deferred by the
+                        // triage gate) are transient outcomes: persist null so the null-hash
+                        // retry re-processes them on a later run instead of pinning them as
+                        // "seen" forever against the current byte content.
+                        contentHash: result.skipReason === "llm_unavailable" || result.skipReason === "triaged_out"
+                            ? null
+                            : (result.contentHash ?? null),
                         metadata: {
                             preFilterInputCount: result.preFilter.inputCount,
                             preFilterOutputCount: result.preFilter.outputCount,
@@ -968,7 +976,7 @@ export async function akmExtract(options) {
  * changed session is actually re-processed.
  */
 export function countNewExtractCandidates(config, options = {}) {
-    const extractProcess = config.profiles?.improve?.default?.processes?.extract;
+    const extractProcess = getImproveProcessConfig(config, "extract", options.improveProfile);
     const effectiveSince = options.since ?? extractProcess?.defaultSince;
     // Mirror akmExtract: when no explicit window is set, default per-harness to
     // "since the last run" (floored at 48h) instead of a fixed 24h. Keeps this

package/dist/commands/improve/improve-auto-accept.js

@@ -2,11 +2,12 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import { loadConfig } from "../../core/config/config.js";
+import { UsageError } from "../../core/errors.js";
 import { appendEvent } from "../../core/events.js";
 import { withStateDb } from "../../core/state-db.js";
 import { info, warn } from "../../core/warn.js";
 import { getPhaseThreshold } from "../../storage/repositories/improve-runs-repository.js";
-import { getProposal, promoteProposal, recordGateDecision } from "../proposal/repository.js";
+import { archiveProposal, getProposal, promoteProposal, recordGateDecision } from "../proposal/repository.js";
 async function sha256Hex(input) {
     const data = new TextEncoder().encode(input);
     const digest = await crypto.subtle.digest("SHA-256", data);
@@ -177,6 +178,26 @@ export async function runAutoAcceptGate(candidates, cfg, promoteFn = promoteProp
                 ...(currentContentHash !== undefined ? { contentHash: currentContentHash } : {}),
                 gate: gateLabel,
             });
+            // A validation failure is permanent — the minted content can never satisfy
+            // the asset schema, so archive it as rejected instead of leaving it pending
+            // to be retried on every future run (the 90-day TTL is otherwise the first
+            // thing ever to touch these zombies). Best-effort; ctx=undefined mirrors the
+            // promoteFn call above so the archive hits the same stashDir-derived DB.
+            //
+            // Discriminate on the STRUCTURED error, not the `reason` string: promoteProposal
+            // throws UsageError("MISSING_REQUIRED_ARGUMENT") only for the validateProposal
+            // failure branch. Message-sniffing (`reason` = "validation:<kind>") would also
+            // match a transient git-push rejection ("[rejected] ... non-fast-forward") from
+            // a git-backed write target and permanently archive a valid, retryable proposal.
+            const isPermanentValidationFailure = err instanceof UsageError && err.code === "MISSING_REQUIRED_ARGUMENT";
+            if (isPermanentValidationFailure) {
+                try {
+                    archiveProposal(cfg.stashDir, proposalId, "rejected", `auto-accept ${reason}`, undefined);
+                }
+                catch (archiveErr) {
+                    warn(`[improve] ${cfg.phase} failed to archive validation-failed proposal ${proposalId}: ${archiveErr instanceof Error ? archiveErr.message : String(archiveErr)}`);
+                }
+            }
             // If exploration budget was consumed but promotion failed, restore the slot
             // so the budget isn't exhausted on errors.
             if (isExploration)

package/dist/commands/improve/loop-stages.js

@@ -215,6 +215,8 @@ export async function runImproveLoopStage(args) {
                     const reflectCallArgs = {
                         ref: planned.ref,
                         task: options.task,
+                        // Active profile so reflect's per-process reads honor `--profile`.
+                        ...(improveProfile ? { improveProfile } : {}),
                         ...(options.stashDir ? { stashDir: options.stashDir } : {}),
                         ...(reflectErrors.length > 0 ? { avoidPatterns: [...reflectErrors] } : {}),
                         agentProcess: options.agentProcess ?? "reflect",
@@ -475,6 +477,8 @@ export async function runImproveLoopStage(args) {
                     ref: planned.ref,
                     ...(parsedPlannedRef.type === "memory" ? { proposalKind: "auto" } : {}),
                     ...(options.stashDir ? { stashDir: options.stashDir } : {}),
+                    // Active profile so distill's per-process reads honor `--profile`.
+                    ...(improveProfile ? { improveProfile } : {}),
                     // Attribution: carry the eligibility lane so distill stamps it on the
                     // distill_invoked event and the persisted proposal.
                     ...(planned.eligibilitySource ? { eligibilitySource: planned.eligibilitySource } : {}),
@@ -646,9 +650,9 @@ export async function runImprovePostLoopStage(args) {
             recombination = await recombineFn({
                 stashDir: primaryStashDir,
                 config: options.config ?? loadConfig(),
+                improveProfile,
                 ...(options.runId ? { sourceRun: options.runId } : {}),
                 ...(budgetSignal ? { signal: budgetSignal } : {}),
-                ...(options.autoAccept !== undefined ? { autoAccept: options.autoAccept } : {}),
                 eligibilitySource: "recombine",
                 ...(eventsCtx ? { ctx: eventsCtx } : {}),
                 minClusterSize: improveProfile.processes?.recombine?.minClusterSize,
@@ -680,9 +684,9 @@ export async function runImprovePostLoopStage(args) {
             proceduralCompilation = await proceduralFn({
                 stashDir: primaryStashDir,
                 config: options.config ?? loadConfig(),
+                ...(improveProfile ? { improveProfile } : {}),
                 ...(options.runId ? { sourceRun: options.runId } : {}),
                 ...(budgetSignal ? { signal: budgetSignal } : {}),
-                ...(options.autoAccept !== undefined ? { autoAccept: options.autoAccept } : {}),
                 eligibilitySource: "procedural",
                 ...(eventsCtx ? { ctx: eventsCtx } : {}),
                 minRecurrence: improveProfile.processes?.procedural?.minRecurrence,
@@ -704,6 +708,7 @@ export async function runImprovePostLoopStage(args) {
     if (!options.dryRun && (consolidationRan || recombineWorked)) {
         cycleMetrics = runCollapseDetector({
             runId: options.runId ?? "improve-adhoc",
+            ...(improveProfile ? { improveProfile } : {}),
             pass: consolidationRan && recombineWorked ? "both" : consolidationRan ? "consolidate" : "recombine",
             // prep+loop gate accepts, PLUS recombine's confirmed-lesson promotions —
             // recombine churn is the historically observed failure mode and its

package/dist/commands/improve/memory/memory-belief.js

@@ -27,9 +27,7 @@
  * - Zep / Graphiti (arXiv:2501.13956 §3) — unified belief-revision pipeline
  * - MemOS (arXiv:2507.03724) — formal archive/merge/transition with shared state model
  */
-import fs from "node:fs";
-import { assembleAsset } from "../../../core/asset/asset-serialize.js";
-import { parseFrontmatter } from "../../../core/asset/frontmatter.js";
+import { mutateFrontmatter } from "../../../core/asset/frontmatter.js";
 // ── Contradiction edge writer ─────────────────────────────────────────────────
 /**
  * Write `contradictedBy` and `beliefState: contradicted` edges to a memory
@@ -47,16 +45,17 @@ import { parseFrontmatter } from "../../../core/asset/frontmatter.js";
  * @param contradictedByRef - The ref that contradicts this memory.
  */
 export function writeContradictEdge(filePath, contradictedByRef) {
-    const raw = fs.readFileSync(filePath, "utf8");
-    const parsed = parseFrontmatter(raw);
-    const existing = Array.isArray(parsed.data.contradictedBy) ? parsed.data.contradictedBy : [];
-    if (existing.includes(contradictedByRef))
-        return; // Already written — idempotent.
-    const nextContradictedBy = [...new Set([...existing, contradictedByRef])].sort();
-    const nextFrontmatter = {
-        ...parsed.data,
-        contradictedBy: nextContradictedBy,
-        beliefState: "contradicted",
-    };
-    fs.writeFileSync(filePath, assembleAsset(nextFrontmatter, parsed.content), "utf8");
+    mutateFrontmatter(filePath, (parsed) => {
+        const existing = Array.isArray(parsed.data.contradictedBy)
+            ? parsed.data.contradictedBy
+            : [];
+        if (existing.includes(contradictedByRef))
+            return null; // Already written — idempotent.
+        const nextContradictedBy = [...new Set([...existing, contradictedByRef])].sort();
+        return {
+            ...parsed.data,
+            contradictedBy: nextContradictedBy,
+            beliefState: "contradicted",
+        };
+    });
 }

package/dist/commands/improve/memory/memory-contradiction-detect.js

@@ -36,8 +36,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import contradictionJudgeTemplate from "../../../assets/prompts/contradiction-judge.md" with { type: "text" };
-import { assembleAsset } from "../../../core/asset/asset-serialize.js";
-import { parseFrontmatter } from "../../../core/asset/frontmatter.js";
+import { mutateFrontmatter, parseFrontmatter } from "../../../core/asset/frontmatter.js";
 import { getDefaultLlmConfig } from "../../../core/config/config.js";
 import { chatCompletion, parseEmbeddedJsonResponse } from "../../../llm/client.js";
 import { tryLlmFeature } from "../../../llm/feature-gate.js";
@@ -126,19 +125,42 @@ function resolveParentRef(filePath, frontmatter, memoriesRootDir) {
  */
 /** Returns true if the edge was newly written, false if it already existed. */
 function writeContradictedByEdge(filePath, contradictedByRef) {
-    const raw = fs.readFileSync(filePath, "utf8");
-    const parsed = parseFrontmatter(raw);
-    const existing = Array.isArray(parsed.data.contradictedBy) ? parsed.data.contradictedBy : [];
-    if (existing.includes(contradictedByRef))
-        return false; // Edge already written.
-    const updatedContradictedBy = [...new Set([...existing, contradictedByRef])].sort();
-    const nextFrontmatter = {
-        ...parsed.data,
-        contradictedBy: updatedContradictedBy,
-        beliefState: "contradicted",
-    };
-    fs.writeFileSync(filePath, assembleAsset(nextFrontmatter, parsed.content), "utf8");
-    return true;
+    return mutateFrontmatter(filePath, (parsed) => {
+        const existing = Array.isArray(parsed.data.contradictedBy)
+            ? parsed.data.contradictedBy
+            : [];
+        if (existing.includes(contradictedByRef))
+            return null; // Edge already written.
+        const updatedContradictedBy = [...new Set([...existing, contradictedByRef])].sort();
+        return {
+            ...parsed.data,
+            contradictedBy: updatedContradictedBy,
+            beliefState: "contradicted",
+        };
+    });
+}
+/**
+ * Deterministically pick, for a confirmed-contradiction pair, the LOSER memory
+ * that receives the single directed `contradictedBy` edge (SCC-resolved to
+ * `contradicted`) and the WINNER ref that survives as the current belief.
+ *
+ * A SINGLE directed edge is essential. Writing mutual A↔B edges forms a 2-cycle
+ * that {@link resolveFamilyContradictions} collapses into one strongly-connected
+ * SINK component and refreshes BOTH members back to active — erasing the
+ * contradiction on every run (the self-erasing bug this fix removes).
+ *
+ * Direction = lexicographic ref order: the ref that sorts LATER is the loser.
+ * This is a **total order** over the family's (distinct) refs, so the induced
+ * edges are always acyclic — a family of any size resolves to a DAG with a
+ * single sink, never a cycle that the resolver would refresh back to active.
+ * It is also immutable across runs (unlike file mtime, which the resolver
+ * bumps when it rewrites loser files), so detection is idempotent. Ref order
+ * carries no recency meaning — no derived-memory writer sets a `createdAt`/
+ * timestamp today — but the mechanism only needs a stable, acyclic direction;
+ * eliminating worst-case self-erasure, not ranking by recency, is the goal.
+ */
+function pickContradictionLoser(a, b) {
+    return a.ref < b.ref ? { loser: b, winnerRef: a.ref } : { loser: a, winnerRef: b.ref };
 }
 // ── Main entry point ──────────────────────────────────────────────────────────
 /**
@@ -209,18 +231,22 @@ export async function detectAndWriteContradictions(stashDir, config, chat = chat
                 const b = family[j];
                 if (!a || !b)
                     continue;
-                // Skip pairs where edges already exist in BOTH directions (no new information).
-                const aRaw = fs.readFileSync(a.filePath, "utf8");
-                const aParsed = parseFrontmatter(aRaw);
-                const aCB = Array.isArray(aParsed.data.contradictedBy)
-                    ? aParsed.data.contradictedBy
-                    : [];
-                const bRaw = fs.readFileSync(b.filePath, "utf8");
-                const bParsed = parseFrontmatter(bRaw);
-                const bCB = Array.isArray(bParsed.data.contradictedBy)
-                    ? bParsed.data.contradictedBy
-                    : [];
-                if (aCB.includes(b.ref) && bCB.includes(a.ref))
+                // Resolve the directed edge up front (independent of the judge — it is
+                // decided by lexicographic ref order). Skip when that single loser→winner
+                // edge already exists (no new information; avoids re-judging resolved
+                // pairs across runs).
+                //
+                // Legacy mutual A↔B edges written by the pre-fix pass self-heal: the
+                // skip fires this run, but the SCC resolver treats the 2-cycle as a sink
+                // and refreshes both to active — DELETING both `contradictedBy` arrays
+                // (memory-improve.ts persistBeliefStateTransition). The next detection
+                // run then sees no edge, re-judges, and writes the single canonical edge.
+                const aParsed = parseFrontmatter(fs.readFileSync(a.filePath, "utf8"));
+                const bParsed = parseFrontmatter(fs.readFileSync(b.filePath, "utf8"));
+                const { loser, winnerRef } = pickContradictionLoser(a, b);
+                const loserData = loser === a ? aParsed.data : bParsed.data;
+                const loserCB = Array.isArray(loserData.contradictedBy) ? loserData.contradictedBy : [];
+                if (loserCB.includes(winnerRef))
                     continue;
                 const prompt = buildContradictionJudgePrompt(a, b);
                 const judgeResult = await tryLlmFeature("memory_contradiction_detection", config, async () => {
@@ -251,14 +277,16 @@ export async function detectAndWriteContradictions(stashDir, config, chat = chat
                     result.warnings.push(`Pair ${a.ref} / ${b.ref}: confidence ${confidence.toFixed(2)} below ${CONTRADICT_CONFIDENCE_THRESHOLD} threshold — skipped.`);
                     continue;
                 }
-                // Write contradiction edges: both members get contradictedBy pointing to each other.
+                // Write a SINGLE directed contradiction edge: the losing (older) memory
+                // gets `contradictedBy` pointing to the winner. A mutual A↔B pair forms
+                // a 2-cycle that the SCC resolver refreshes back to active, erasing the
+                // contradiction every run (see pickContradictionLoser).
                 try {
-                    const wroteA = writeContradictedByEdge(a.filePath, b.ref);
-                    const wroteB = writeContradictedByEdge(b.filePath, a.ref);
-                    result.edgesWritten += (wroteA ? 1 : 0) + (wroteB ? 1 : 0);
+                    const wrote = writeContradictedByEdge(loser.filePath, winnerRef);
+                    result.edgesWritten += wrote ? 1 : 0;
                 }
                 catch (err) {
-                    result.warnings.push(`Failed to write contradiction edge ${a.ref} <-> ${b.ref}: ${err instanceof Error ? err.message : String(err)}`);
+                    result.warnings.push(`Failed to write contradiction edge ${loser.ref} -> ${winnerRef}: ${err instanceof Error ? err.message : String(err)}`);
                 }
             }
             if (totalPairsChecked >= MAX_PAIRS_PER_RUN)

package/dist/commands/improve/memory/memory-improve.js

@@ -5,8 +5,8 @@ import fs from "node:fs";
 import path from "node:path";
 import { makeAssetRef, parseAssetRef } from "../../../core/asset/asset-ref.js";
 import { assembleAsset } from "../../../core/asset/asset-serialize.js";
-import { parseFrontmatter } from "../../../core/asset/frontmatter.js";
-import { firstString, groupBy, stringArray } from "../../../core/common.js";
+import { mutateFrontmatter, parseFrontmatter } from "../../../core/asset/frontmatter.js";
+import { asNonEmptyString, groupBy, stringArray } from "../../../core/common.js";
 const DERIVED_SUFFIX = ".derived";
 export function analyzeMemoryCleanup(stashDir, options = {}) {
     const records = collectDerivedMemories(stashDir, options.parentRef);
@@ -491,27 +491,27 @@ function archiveCleanupCandidate(stashDir, candidate, filePath) {
     };
 }
 function persistBeliefStateTransition(filePath, transition) {
-    const raw = fs.readFileSync(filePath, "utf8");
-    const parsed = parseFrontmatter(raw);
-    const nextFrontmatter = {
-        ...parsed.data,
-        beliefState: transition.toState,
-    };
-    const currentBeliefRefs = [...new Set(transition.currentBeliefRefs ?? [])].sort();
-    if (transition.toState === "contradicted") {
-        nextFrontmatter.contradictedBy = [...currentBeliefRefs];
-    }
-    else {
-        delete nextFrontmatter.contradictedBy;
-        if (parsed.data.supersededBy !== undefined && refArray(parsed.data.supersededBy).length === 0) {
-            delete nextFrontmatter.supersededBy;
+    mutateFrontmatter(filePath, (parsed) => {
+        const nextFrontmatter = {
+            ...parsed.data,
+            beliefState: transition.toState,
+        };
+        const currentBeliefRefs = [...new Set(transition.currentBeliefRefs ?? [])].sort();
+        if (transition.toState === "contradicted") {
+            nextFrontmatter.contradictedBy = [...currentBeliefRefs];
         }
-    }
-    if (currentBeliefRefs.length > 0)
-        nextFrontmatter.currentBeliefRefs = [...currentBeliefRefs];
-    else
-        delete nextFrontmatter.currentBeliefRefs;
-    fs.writeFileSync(filePath, assembleAsset(nextFrontmatter, parsed.content), "utf8");
+        else {
+            delete nextFrontmatter.contradictedBy;
+            if (parsed.data.supersededBy !== undefined && refArray(parsed.data.supersededBy).length === 0) {
+                delete nextFrontmatter.supersededBy;
+            }
+        }
+        if (currentBeliefRefs.length > 0)
+            nextFrontmatter.currentBeliefRefs = [...currentBeliefRefs];
+        else
+            delete nextFrontmatter.currentBeliefRefs;
+        return nextFrontmatter;
+    });
 }
 function appendBeliefStateTransitionLog(stashDir, transitions) {
     const logDir = path.join(stashDir, ".akm", "memory-cleanup");
@@ -580,8 +580,8 @@ function collectDerivedMemories(stashDir, parentRefFilter) {
             continue;
         if (!isDerivedMemory(name, parsed.data))
             continue;
-        const title = firstString(parsed.data.title) ?? extractHeading(parsed.content) ?? "";
-        const description = firstString(parsed.data.description) ?? "";
+        const title = asNonEmptyString(parsed.data.title) ?? extractHeading(parsed.content) ?? "";
+        const description = asNonEmptyString(parsed.data.description) ?? "";
         const tags = stringArray(parsed.data.tags);
         const searchHints = stringArray(parsed.data.searchHints);
         const body = parsed.content.trim();
@@ -637,7 +637,7 @@ function isFrozenHistoricalBeliefState(state) {
     return state === "deprecated";
 }
 function resolveBeliefState(frontmatter) {
-    const explicit = firstString(frontmatter.beliefState);
+    const explicit = asNonEmptyString(frontmatter.beliefState);
     if (explicit === "active" ||
         explicit === "asserted" ||
         explicit === "deprecated" ||
@@ -651,10 +651,10 @@ function isDerivedMemory(name, frontmatter) {
     return frontmatter.inferred === true || name.endsWith(DERIVED_SUFFIX);
 }
 function resolveParentRef(name, frontmatter) {
-    const fromSource = parseMemoryRef(firstString(frontmatter.source));
+    const fromSource = parseMemoryRef(asNonEmptyString(frontmatter.source));
     if (fromSource)
         return fromSource;
-    const derivedFrom = firstString(frontmatter.derivedFrom);
+    const derivedFrom = asNonEmptyString(frontmatter.derivedFrom);
     if (derivedFrom)
         return makeAssetRef("memory", derivedFrom);
     if (name.endsWith(DERIVED_SUFFIX)) {

package/dist/commands/improve/preparation.js

@@ -21,7 +21,7 @@ import { akmLint } from "../lint/index.js";
 import { getProposal, listProposals } from "../proposal/repository.js";
 import { runSchemaRepairPass } from "../sources/schema-repair.js";
 import { computeThresholdAutoTune, gateDecisionsToSamples, summarizeCalibration, } from "./calibration.js";
-import { akmConsolidate, isSessionCaptureMemoryName } from "./consolidate.js";
+import { akmConsolidate } from "./consolidate.js";
 // Eligibility / candidate-selection predicates live in ./eligibility.
 import { buildLatestFeedbackTsMap, buildLatestProposalTsMap, buildUtilityMap, dedupeRefs, findAssetFilePath, isDistillCandidateRef, isLessonCandidate, isSignalDeltaEligible, } from "./eligibility.js";
 import { akmExtract, countNewExtractCandidates } from "./extract.js";
@@ -320,6 +320,9 @@ export async function runConsolidationPass(args) {
             ...options.consolidateOptions,
             config: consolidationConfig,
             stashDir: options.stashDir,
+            // Active profile for this improve run — lets consolidate's secondary
+            // process-config reads honor `--profile <name>` instead of `default`.
+            improveProfile,
             autoTriggered: volumeTriggered,
             // Tie consolidate proposals back to this improve invocation so
             // accept-rate-per-run aggregation works. Mirrors reflect/propose/extract.
@@ -485,6 +488,7 @@ async function runSessionExtractPass(args) {
             const countFn = options.extractCandidateCountFn ?? countNewExtractCandidates;
             const newCandidateCount = countFn(extractConfig, {
                 ...(options.extractHarnesses ? { harnesses: options.extractHarnesses } : {}),
+                improveProfile,
                 // Use the ACTIVE profile's discovery window so the gate counts over the
                 // same window akmExtract will scan (not always `default`).
                 ...(improveProfile.processes?.extract?.defaultSince
@@ -1152,10 +1156,7 @@ export async function runImprovePreparationStage(args) {
             // collapse the lane to exactly 1 ref via the bare `?? 10` fallback.
             const effectiveLimit = options.limit ?? improveProfile?.processes?.reflect?.limit ?? improveProfile.limit ?? 10;
             const highSalienceCap = Math.max(1, Math.floor(effectiveLimit * 0.1));
-            // #632/#4 — session-capture telemetry (checkpoints) must never consume
-            // the scarce high-salience budget. Even with a content-scored row, these
-            // are pipeline bookkeeping, not assets worth reflecting/rewriting.
-            const candidates = noFeedbackCandidates.filter((r) => !proactiveAndRetrievalSet.has(r.ref) && !isSessionCaptureMemoryName(parseAssetRef(r.ref).name));
+            const candidates = noFeedbackCandidates.filter((r) => !proactiveAndRetrievalSet.has(r.ref));
             // Collect ALL qualifying candidates, then take the top-N BY SCORE — the
             // previous first-N-in-scan-order break meant a higher-salience candidate
             // found later in the scan lost its slot to an earlier lower-scoring one.

package/dist/commands/improve/procedural.js

@@ -292,6 +292,7 @@ export async function akmProcedural(opts) {
             systemPrompt: PROCEDURAL_SYSTEM_PROMPT,
             tag: "[procedural]",
             signal: opts.signal,
+            activeProfile: opts.improveProfile,
         });
     if (!llmFn) {
         warnings.push("procedural: no LLM configured — skipping");