akm-cli 0.9.0-beta.6 → 0.9.0-rc.0

package/dist/commands/improve/improve.js

@@ -4,89 +4,46 @@
 import fs from "node:fs";
 import path from "node:path";
 import { assertNever } from "../../core/assert.js";
-import { makeAssetRef, parseAssetRef } from "../../core/asset/asset-ref.js";
-import { parseFrontmatter } from "../../core/asset/frontmatter.js";
-import { daysToMs, isAssetType } from "../../core/common.js";
-import { getDefaultLlmConfig, loadConfig } from "../../core/config/config.js";
-import { ConfigError, NotFoundError, rethrowIfTestIsolationError, UsageError } from "../../core/errors.js";
+import { daysToMs } from "../../core/common.js";
+import { loadConfig } from "../../core/config/config.js";
+import { rethrowIfTestIsolationError } from "../../core/errors.js";
 import { appendEvent, readEvents } from "../../core/events.js";
-import { probeLock, releaseLock, releaseLockIfOwned, tryAcquireLockSync } from "../../core/file-lock.js";
-import { classifyImproveAction } from "../../core/improve-types.js";
-import { openLogsDatabase, purgeOldTaskLogs } from "../../core/logs-db.js";
+import { classifyImproveAction, foldDistillSkipped } from "../../core/improve-types.js";
 import { getDbPath, getStateDbPathInDataDir } from "../../core/paths.js";
-import { openStateDatabase, purgeOldEvents, purgeOldImproveRuns } from "../../core/state-db.js";
+import { openStateDatabase } from "../../core/state-db.js";
 import { info, warn } from "../../core/warn.js";
-import { closeDatabase, getAllEntries, getEntryCount, getRetrievalCounts, getUtilityScoresByIds, getZeroResultSearches, openDatabase, openExistingDatabase, } from "../../indexer/db/db.js";
+import { closeDatabase, getEntryCount, openExistingDatabase } from "../../indexer/db/db.js";
 import { ensureIndex } from "../../indexer/ensure-index.js";
-import { runGraphExtractionPass } from "../../indexer/graph/graph-extraction.js";
 import { akmIndex } from "../../indexer/indexer.js";
-import { collectPendingMemories, runMemoryInferencePass, } from "../../indexer/passes/memory-inference.js";
-import { runStalenessDetectionPass } from "../../indexer/passes/staleness-detect.js";
-import { getWritableStashDirs, resolveSourceEntries } from "../../indexer/search/search-source.js";
-import { countUsageEventsByType } from "../../indexer/usage/usage-events.js";
-import { resolveAssetPath } from "../../indexer/walk/path-resolver.js";
-import { resolveImproveProcessRunnerFromProfile, resolveTriageJudgmentRunner } from "../../integrations/agent/runner.js";
-import { getAvailableHarnesses } from "../../integrations/session-logs/index.js";
-import { isLlmFeatureEnabled, isProcessEnabled } from "../../llm/feature-gate.js";
+import { resolveSourceEntries } from "../../indexer/search/search-source.js";
+import { resolveTriageJudgmentRunner } from "../../integrations/agent/runner.js";
 import { installLlmUsagePersistence } from "../../llm/usage-persist.js";
 import { withLlmStage } from "../../llm/usage-telemetry.js";
 import { isGitBackedStash, resolveWritableOverride, saveGitStash } from "../../sources/providers/git.js";
-import { akmLint } from "../lint/index.js";
 import { drainProposals } from "../proposal/drain.js";
 import { resolveDrainPolicy } from "../proposal/drain-policies.js";
-import { createProposal, expireStaleProposals, getProposal, isProposalSkipped, listProposals, purgeOrphanProposals, } from "../proposal/validators/proposals.js";
-import { runSchemaRepairPass } from "../sources/schema-repair.js";
-import { checkDeadUrls } from "../url-checker.js";
-import { akmConsolidate } from "./consolidate.js";
-import { akmDistill, deriveLessonRef, isDistillRefusedInputType } from "./distill.js";
-import { deriveKnowledgeRef } from "./distill-promotion-policy.js";
-import { countEvalCases, writeEvalCase } from "./eval-cases.js";
-import { akmExtract, countNewExtractCandidates } from "./extract.js";
-import { makeGateConfig, resolveExtractConfidence, runAutoAcceptGate } from "./improve-auto-accept.js";
-import { isProfileFilteredForAllPasses, resolveImproveProfile, resolveProcessEnabled, shouldSkipRef, } from "./improve-profiles.js";
+import { akmDistill } from "./distill.js";
+// Eligibility / candidate-selection predicates live in ./eligibility.
+import { buildLatestProposalTsMap, collectEligibleRefs, memoryCleanupParentRef, resolveImproveScope, shouldAnalyzeMemoryCleanup, } from "./eligibility.js";
+import { countEvalCases } from "./eval-cases.js";
+import { resolveImproveProfile, resolveProcessEnabled } from "./improve-profiles.js";
+// #607 per-process lock primitives live in ./locks. Imported for internal use;
+// resetHeldProcessLocks is re-exported (the test seam imports it from here).
+import { PROCESS_LOCK_DEFS, processLockPath, releaseAllProcessLocks, releaseHeldLocksIfOwned, releaseProcessLock, tryAcquireProcessLock, withOptionalProcessLock, } from "./locks.js";
+// The cycle loop / post-loop / maintenance stages live in ./loop-stages.
+import { runImproveLoopStage, runImprovePostLoopStage } from "./loop-stages.js";
 import { detectAndWriteContradictions } from "./memory/memory-contradiction-detect.js";
-import { analyzeMemoryCleanup, applyMemoryCleanup } from "./memory/memory-improve.js";
+import { analyzeMemoryCleanup } from "./memory/memory-improve.js";
+// The pre-loop preparation pipeline lives in ./preparation.
+import { runImprovePreparationStage } from "./preparation.js";
+import { DEFAULT_DUE_DAYS, filterProactiveDue } from "./proactive-maintenance.js";
 import { akmReflect } from "./reflect.js";
-function resolveImproveScope(scope) {
-    const trimmed = scope?.trim();
-    if (!trimmed)
-        return { mode: "all" };
-    try {
-        parseAssetRef(trimmed);
-        return { mode: "ref", value: trimmed };
-    }
-    catch {
-        if (!isAssetType(trimmed)) {
-            throw new UsageError(`Unknown asset type: "${trimmed}". Valid types: memory, knowledge, skill, lesson, workflow, agent, command, script, wiki, env, secret, task.\n` +
-                `If you passed --format to akm improve, that flag is not supported — use it with akm search or akm show instead.`, "INVALID_FLAG_VALUE");
-        }
-        return { mode: "type", value: trimmed };
-    }
-}
-/**
- * Render the end-of-run stash-sync commit message, expanding `{token}`
- * placeholders against this run's results. Unknown tokens are passed through
- * verbatim so adding new tokens later never breaks an existing template, and so
- * a literal brace in a message is harmless.
- *
- * Supported tokens (the "free" set — derived from data already on the result):
- *   {timestamp}  `YYYY-MM-DD HH:MM:SS` (UTC)
- *   {date}       `YYYY-MM-DD` (UTC)
- *   {time}       `HH:MM:SS` (UTC)
- *   {scope}      scope value (e.g. a ref/type) or the scope mode (`all`)
- *   {refs}       number of planned refs this run processed
- *   {accepted}   number of proposals auto-accepted by the confidence gate
- *   {triage_promoted}  proposals promoted by the triage pre-pass (0 if triage did not run)
- *   {triage_rejected}  proposals rejected by the triage pre-pass (0 if triage did not run)
- *   {runId}      this run's id (empty string when absent)
- *
- * The result is still passed through `sanitizeCommitMessage` downstream in
- * `saveGitStash`, so token values never widen the commit-message attack surface
- * (newlines/control chars are collapsed there).
- *
- * `nowMs` is injected (not read from `Date.now()`) so the function is pure and
- * deterministically testable.
- */
+import { errMessage } from "./shared.js";
+export { resetHeldProcessLocks } from "./locks.js";
+// Re-exported from ./loop-stages for test importers (improve-db-locking).
+export { runImproveMaintenancePasses } from "./loop-stages.js";
+// Re-exported from ./preparation so existing importers (tests, callers) resolve.
+export { maybeAutoTuneThreshold } from "./preparation.js";
 export function renderSyncCommitMessage(template, result, nowMs) {
     const iso = new Date(nowMs).toISOString();
     const tokens = {
@@ -102,334 +59,6 @@ export function renderSyncCommitMessage(template, result, nowMs) {
     };
     return template.replace(/\{(\w+)\}/g, (match, key) => (Object.hasOwn(tokens, key) ? tokens[key] : match));
 }
-async function collectEligibleRefs(scope, stashDir, improveProfile) {
-    if (scope.mode === "ref" && scope.value) {
-        const parsed = parseAssetRef(scope.value);
-        const writableDirs = new Set(getWritableStashDirs(stashDir).map((dir) => path.resolve(dir)));
-        const filePath = await findAssetFilePath(scope.value, stashDir, writableDirs);
-        if (!filePath) {
-            return {
-                plannedRefs: [],
-                memorySummary: { eligible: 0, derived: 0 },
-                profileFilteredRefs: [],
-            };
-        }
-        return {
-            plannedRefs: [{ ref: scope.value, reason: "scope-ref", filePath }],
-            memorySummary: {
-                eligible: parsed.type === "memory" ? 1 : 0,
-                derived: parsed.type === "memory" && parsed.name.endsWith(".derived") ? 1 : 0,
-            },
-            profileFilteredRefs: [],
-        };
-    }
-    let sources;
-    try {
-        sources = resolveSourceEntries(stashDir);
-    }
-    catch {
-        return { plannedRefs: [], memorySummary: { eligible: 0, derived: 0 }, profileFilteredRefs: [] };
-    }
-    if (sources.length === 0) {
-        return { plannedRefs: [], memorySummary: { eligible: 0, derived: 0 }, profileFilteredRefs: [] };
-    }
-    // Only operate on writable sources — never mutate read-only registry caches
-    // or remote stashes that the user did not mark writable.
-    let writableDirs;
-    try {
-        writableDirs = getWritableStashDirs(stashDir);
-    }
-    catch {
-        writableDirs = sources.slice(0, 1).map((s) => s.path); // fallback: primary only
-    }
-    const writableDirSet = new Set(writableDirs.map((d) => path.resolve(d)));
-    let db;
-    try {
-        db = openExistingDatabase();
-        const entries = getAllEntries(db, scope.mode === "type" ? scope.value : undefined).filter((indexed) => {
-            // First apply the existing stashDir-scope filter (no-op when stashDir is unset).
-            if (!isEntryInScope(indexed.stashDir, indexed.filePath, stashDir))
-                return false;
-            // Then restrict to writable sources only.
-            return isEntryInWritableSource(indexed.stashDir, indexed.filePath, writableDirSet);
-        });
-        const planned = new Map();
-        const profileFiltered = new Map();
-        let memoryEligible = 0;
-        let memoryDerived = 0;
-        for (const indexed of entries) {
-            const ref = makeAssetRef(indexed.entry.type, indexed.entry.name);
-            const isDerived = indexed.entry.name.endsWith(".derived");
-            // `.derived` memories are LLM-inferred and intentionally skip reflect
-            // (see the synthetic `derived-memory-reflect-skipped` branch in the
-            // improve loop). Enqueueing them here just produced one synthetic skip
-            // per derived memory per hour with no real work — pure churn observed
-            // 2026-05-21: 11 derived refs re-planned every hour during idle periods.
-            // The cleanup phase (analyzeMemoryCleanup) inspects derived memories
-            // independently of `plannedRefs`, so dropping them here loses nothing.
-            if (!isDerived && !planned.has(ref) && !profileFiltered.has(ref)) {
-                // 2026-05-27: extend the .derived precedent to profile-incompatible
-                // refs. If every per-ref pass (reflect + distill) on the active
-                // profile would refuse this ref, drop it from `plannedRefs`. The
-                // caller emits `improve_skipped { reason: profile_filtered_all_passes }`
-                // once `eventsCtx` is available so the audit trail is preserved in a
-                // single event per ref instead of 2× synthetic actions per run.
-                // Background: see /tmp/akm-health-investigations/planner-profile-metrics-deep-analysis.md
-                if (improveProfile && isProfileFilteredForAllPasses(ref, improveProfile)) {
-                    profileFiltered.set(ref, {
-                        ref,
-                        reason: "profile_filtered_all_passes",
-                        filePath: indexed.filePath,
-                    });
-                }
-                else {
-                    planned.set(ref, {
-                        ref,
-                        reason: scope.mode === "type" ? "scope-type" : indexed.entry.type === "memory" ? "memory-cleanup" : "scope-type",
-                        filePath: indexed.filePath,
-                    });
-                }
-            }
-            if (indexed.entry.type === "memory") {
-                memoryEligible += 1;
-                if (isDerived)
-                    memoryDerived += 1;
-            }
-        }
-        return {
-            plannedRefs: [...planned.values()],
-            memorySummary: { eligible: memoryEligible, derived: memoryDerived },
-            profileFilteredRefs: [...profileFiltered.values()],
-        };
-    }
-    catch (error) {
-        // The bun-test isolation guard must never be downgraded to "empty plan".
-        rethrowIfTestIsolationError(error);
-        if (error instanceof NotFoundError || error instanceof Error) {
-            return { plannedRefs: [], memorySummary: { eligible: 0, derived: 0 }, profileFilteredRefs: [] };
-        }
-        throw error;
-    }
-    finally {
-        if (db)
-            closeDatabase(db);
-    }
-}
-function isEntryInScope(entryStashDir, filePath, stashDir) {
-    if (!stashDir)
-        return true;
-    const resolvedEntryStashDir = path.resolve(entryStashDir);
-    const resolvedFilePath = path.resolve(filePath);
-    const resolvedScopeStashDir = path.resolve(stashDir);
-    return (resolvedEntryStashDir === resolvedScopeStashDir ||
-        resolvedEntryStashDir.startsWith(`${resolvedScopeStashDir}${path.sep}`) ||
-        resolvedFilePath.startsWith(`${resolvedScopeStashDir}${path.sep}`));
-}
-/**
- * Return true when the indexed entry belongs to one of the writable source
- * directories. Entries from read-only registry caches or remote stashes that
- * the user has not marked writable must never enter the improve/distill loop.
- */
-function isEntryInWritableSource(entryStashDir, filePath, writableDirSet) {
-    const resolvedEntryStashDir = path.resolve(entryStashDir);
-    const resolvedFilePath = path.resolve(filePath);
-    for (const writableDir of writableDirSet) {
-        if (resolvedEntryStashDir === writableDir ||
-            resolvedEntryStashDir.startsWith(`${writableDir}${path.sep}`) ||
-            resolvedFilePath.startsWith(`${writableDir}${path.sep}`)) {
-            return true;
-        }
-    }
-    return false;
-}
-function memoryCleanupParentRef(scope, stashDir) {
-    if (scope.mode !== "ref" || !scope.value)
-        return undefined;
-    const parsed = parseAssetRef(scope.value);
-    if (parsed.type !== "memory")
-        return undefined;
-    if (!parsed.name.endsWith(".derived"))
-        return scope.value;
-    const sources = resolveSourceEntries(stashDir);
-    for (const source of sources) {
-        const candidate = path.join(source.path, "memories", `${parsed.name}.md`);
-        if (!fs.existsSync(candidate))
-            continue;
-        const raw = fs.readFileSync(candidate, "utf8");
-        const fm = parseFrontmatter(raw).data;
-        const sourceRef = typeof fm.source === "string" ? fm.source : undefined;
-        if (sourceRef) {
-            try {
-                const parent = parseAssetRef(sourceRef.trim());
-                if (parent.type === "memory")
-                    return makeAssetRef(parent.type, parent.name);
-            }
-            catch { }
-        }
-    }
-    return makeAssetRef("memory", parsed.name.slice(0, -".derived".length));
-}
-function isLessonCandidate(ref) {
-    // Only lesson assets need lesson-schema validation (description + when_to_use).
-    // Memories have their own distill path via shouldDistillMemoryRef.
-    // All other types go through reflect, not distill.
-    return parseAssetRef(ref).type === "lesson";
-}
-/**
- * Planner-side check: should this ref enter the distill queue?
- *
- * Distill produces lessons from non-lesson sources. Two cases are eligible:
- *
- *   1. Memory refs that pass {@link shouldDistillMemoryRef} (the existing
- *      memory→lesson/knowledge promotion path).
- *
- * Refs whose `type` is in {@link DISTILL_REFUSED_INPUT_TYPES} (currently
- * `lesson:*`) are explicitly excluded — distill refuses them at runtime and
- * queuing them just produces a no-op `skipped` outcome per ref per hour. That
- * planner waste was the bug fixed in commit
- * fix(improve): drop distill-refused types from planner.
- *
- * Note: prior to this fix the gate used `isLessonCandidate(ref)` directly,
- * which was true *only* for `lesson:*` refs — exactly the set distill refuses.
- * The result: every hourly run re-queued the same lesson refs, the same skip
- * message returned, and no work was ever done. See
- * `tests/commands/improve-distill-planner-skip-lessons.test.ts`.
- */
-function isDistillCandidateRef(ref, stashDir) {
-    const parsed = parseAssetRef(ref);
-    if (isDistillRefusedInputType(parsed.type))
-        return false;
-    return shouldDistillMemoryRef(ref, stashDir);
-}
-function shouldDistillMemoryRef(ref, stashDir) {
-    const parsed = parseAssetRef(ref);
-    if (parsed.type !== "memory")
-        return false;
-    const sources = resolveSourceEntries(stashDir);
-    for (const source of sources) {
-        const candidate = `${source.path}/memories/${parsed.name}.md`;
-        if (!fs.existsSync(candidate))
-            continue;
-        const raw = fs.readFileSync(candidate, "utf8");
-        const fm = parseFrontmatter(raw).data;
-        const quality = typeof fm.quality === "string" ? fm.quality : undefined;
-        if (quality === "proposed")
-            return false;
-        return !parsed.name.endsWith(".derived");
-    }
-    return !parsed.name.endsWith(".derived");
-}
-// ── Signal-delta eligibility helpers (0.8.0) ────────────────────────────────
-//
-// The 0.8.0 redesign replaced flat time-based cooldowns for reflect/distill
-// with a *signal-delta* gate: a ref is re-eligible iff new feedback has
-// landed since the last proposal was generated for it. These helpers build
-// the two timestamp maps the gate needs in bulk, so the planner avoids
-// N+1 queries across the full postCleanupRefs set.
-/**
- * Latest feedback event timestamp per ref in the active window. Reads all
- * `feedback` events newer than `sinceIso` in one query and indexes by ref,
- * keeping the maximum `ts` per ref.
- *
- * Only events with a meaningful payload count as "signal" — `metadata.signal`
- * (positive/negative) OR `metadata.note` (a free-form annotation). Empty
- * metadata events are ignored so a stray `akm feedback <ref>` invocation
- * without a flag doesn't trigger downstream re-processing.
- */
-function buildLatestFeedbackTsMap(refs, sinceIso) {
-    const out = new Map();
-    if (refs.length === 0)
-        return out;
-    const refSet = new Set(refs);
-    const { events } = readEvents({ type: "feedback", since: sinceIso });
-    for (const e of events) {
-        const ref = e.ref;
-        if (!ref || !refSet.has(ref))
-            continue;
-        const meta = e.metadata;
-        const hasSignal = meta !== undefined && (typeof meta.signal === "string" || typeof meta.note === "string");
-        if (!hasSignal)
-            continue;
-        const ts = e.ts ?? "";
-        if (ts > (out.get(ref) ?? ""))
-            out.set(ref, ts);
-    }
-    return out;
-}
-/**
- * Latest proposal timestamp per input-ref, filtered by source ('reflect' or
- * 'distill'). Reads the corresponding `*_invoked` events from state.db —
- * these events are emitted at proposal creation time and carry the *input*
- * asset ref (memory:foo, skill:bar, etc.) directly. We use them rather than
- * `listProposals` because distill proposals are keyed by the derived
- * lesson/knowledge ref, not the source memory — joining back through the
- * payload would be fragile.
- */
-function buildLatestProposalTsMap(refs, source) {
-    const out = new Map();
-    if (refs.length === 0)
-        return out;
-    const refSet = new Set(refs);
-    const eventType = source === "reflect" ? "reflect_invoked" : "distill_invoked";
-    const { events } = readEvents({ type: eventType });
-    for (const e of events) {
-        const ref = e.ref;
-        if (!ref || !refSet.has(ref))
-            continue;
-        // For distill_invoked we only count attempts that produced (or attempted
-        // to produce) a real proposal — config_disabled / parse-error outcomes
-        // should not move the signal-delta cursor forward.
-        if (eventType === "distill_invoked") {
-            const outcome = e.metadata?.outcome;
-            if (outcome !== "queued" && outcome !== "skipped" && outcome !== "validation_failed")
-                continue;
-        }
-        const ts = e.ts ?? "";
-        if (ts > (out.get(ref) ?? ""))
-            out.set(ref, ts);
-    }
-    return out;
-}
-/**
- * Signal-delta eligibility predicate.
- *
- * True iff `latestFeedback[ref]` is defined AND either no prior proposal
- * exists for this (ref, source) OR `latestFeedback[ref] > lastProposal[ref]`.
- *
- * Refs with no feedback signal at all are ineligible by definition — the
- * high-retrieval fallback path (see `noFeedbackCandidates` later in the
- * planner) handles never-touched-but-frequently-read assets separately.
- */
-function isSignalDeltaEligible(ref, latestFeedback, lastProposal) {
-    const fb = latestFeedback.get(ref);
-    if (!fb)
-        return false;
-    const lp = lastProposal.get(ref);
-    if (!lp)
-        return true;
-    return fb > lp;
-}
-/**
- * H7 (#566): cooperative budget watchdog with a captured, RAII-cleared hard-kill.
- *
- * When the wall-clock budget expires, `onExhausted` (normally an
- * `AbortController.abort`) signals cooperative cancellation so the run can drain
- * its in-flight log/`state.db` flush and unwind naturally. A second hard-kill
- * timer is then armed as a watchdog: it only `exit(0)`s if the drain itself
- * overruns `hardKillGraceMs`, preventing the process from outliving the task
- * timeout window (lock-cascade fix).
- *
- * Both timers are captured; the returned dispose() clears whichever is still
- * pending. Callers invoke it from a `finally`, so a *clean* drain reaches the
- * `finally` and cancels the pending hard-kill before it can fire — the previous
- * detached `setTimeout(() => process.exit(0), 5000)` always fired, truncating a
- * clean flush. The hard-kill timer is `unref()`-ed so it never keeps the event
- * loop alive on its own: once the run drains it exits with its own code, not the
- * forced 0.
- *
- * Dependencies are injectable purely so the concurrency-sensitive timing
- * contract can be exercised deterministically in unit tests.
- */
 export function armBudgetWatchdog(budgetMs, controller, deps) {
     const setTimeoutFn = deps?.setTimeoutFn ?? setTimeout;
     const clearTimeoutFn = deps?.clearTimeoutFn ?? clearTimeout;
@@ -461,6 +90,11 @@ export async function akmImprove(options = {}) {
     const ensureIndexFn = options.ensureIndexFn ?? ensureIndex;
     const reindexFn = options.reindexFn ?? akmIndex;
     const drainProposalsFn = options.drainProposalsFn ?? drainProposals;
+    // #616 multi-cycle test seams. Default to the real module-local fns.
+    const collectEligibleRefsImpl = options.collectEligibleRefsFn ?? collectEligibleRefs;
+    const runImprovePreparationStageImpl = options.runImprovePreparationStageFn ?? runImprovePreparationStage;
+    const runImproveLoopStageImpl = options.runImproveLoopStageFn ?? runImproveLoopStage;
+    const runImprovePostLoopStageImpl = options.runImprovePostLoopStageFn ?? runImprovePostLoopStage;
     // Resolve the improve profile for this run. Profile drives type filtering,
     // process gating, and default autoAccept/limit values.
     const _earlyConfig = options.config ?? loadConfig();
@@ -475,6 +109,9 @@ export async function akmImprove(options = {}) {
         // CLI --limit takes precedence over both.
         limit: options.limit ?? improveProfile?.processes?.reflect?.limit ?? improveProfile.limit,
     };
+    // #616 — bounded multi-cycle phasing. CLI/programmatic override wins over
+    // profile.maxCycles; default 1 => single pass (byte-identical to pre-#616).
+    const maxCycles = Math.max(1, Math.trunc(options.maxCycles ?? improveProfile.maxCycles ?? 1));
     let primaryStashDir;
     try {
         primaryStashDir = resolveSourceEntries(options.stashDir)[0]?.path;
@@ -491,174 +128,51 @@ export async function akmImprove(options = {}) {
     // timeout root cause). Because beforeEach runs synchronously, env is still the
     // calling test's own at this point; we capture it before yielding the loop.
     const resolvedStateDbPath = getStateDbPathInDataDir();
-    // Phase 4 lock hoist (§7): the `improve.lock` setup is hoisted ABOVE
-    // ensureIndex/collectEligibleRefs so the triage pre-pass (and improve's own
-    // queue writes) run fully serialized under the lock. The dry-run early-return
-    // below still skips the lock and triage (the lock+triage block is gated on
-    // `!options.dryRun`); contradiction-detection and memory-cleanup analysis,
-    // which previously ran before the lock, now sit after it for free.
-    const resolvedLockPath = primaryStashDir
-        ? path.join(primaryStashDir, ".akm", "improve.lock")
-        : path.join(options.stashDir ?? ".", ".akm", "improve.lock");
-    const MAX_LOCK_AGE_MS = 4 * 60 * 60 * 1000; // 4 hours
-    const acquireLock = () => {
-        fs.mkdirSync(path.dirname(resolvedLockPath), { recursive: true });
-        const lockPayload = () => JSON.stringify({ pid: process.pid, startedAt: new Date().toISOString() });
-        if (tryAcquireLockSync(resolvedLockPath, lockPayload()))
-            return "acquired";
-        // Lock file already exists — probe to determine whether it's still held
-        // or whether the prior run died without cleaning up.
-        const probe = probeLock(resolvedLockPath, { staleAfterMs: MAX_LOCK_AGE_MS });
-        const rawContent = probe.state === "absent" ? undefined : probe.rawContent;
-        const lock = rawContent
-            ? (() => {
-                try {
-                    return JSON.parse(rawContent);
-                }
-                catch {
-                    return null;
-                }
-            })()
-            : null;
-        if (probe.state === "stale") {
-            // O-7 / #394: Emit improve_lock_recovered event before recovery so the
-            // audit trail records the abnormal prior-run exit (Temporal/Airflow pattern).
-            try {
-                appendEvent({
-                    eventType: "improve_lock_recovered",
-                    metadata: {
-                        stalePid: lock?.pid ?? null,
-                        lockedAt: lock?.startedAt ?? null,
-                        recoveredAt: new Date().toISOString(),
-                        lockAgeMs: probe.ageMs ?? null,
-                        reason: probe.reason === "pid_dead" ? "pid_not_alive" : probe.reason,
-                    },
-                });
-            }
-            catch {
-                /* event emission is best-effort; never block lock recovery */
-            }
-            releaseLock(resolvedLockPath);
-            if (tryAcquireLockSync(resolvedLockPath, lockPayload()))
-                return "acquired";
-            // Lost the race to another run that grabbed the freed stale lock.
-            if (options.skipIfLocked) {
-                warn("[improve] another run acquired the lock during stale recovery; skipping (--skip-if-locked)");
-                return "skipped";
-            }
-            throw new ConfigError(`akm improve is already running. Delete ${resolvedLockPath} to force.`, "INVALID_CONFIG_FILE");
-        }
-        // Lock is held by a live run within the staleness window.
-        if (options.skipIfLocked) {
-            warn(`[improve] another improve run holds the lock (PID ${lock?.pid}, started ${lock?.startedAt}); skipping (--skip-if-locked)`);
-            return "skipped";
-        }
-        throw new ConfigError(`akm improve is already running (PID ${lock?.pid}, started ${lock?.startedAt}). Delete ${resolvedLockPath} to force.`, "INVALID_CONFIG_FILE");
-    };
-    // Phase 4 lock-leak guard (§7 ordering hazard): hoisting `improve.lock` above
-    // the pre-index region (so the triage pre-pass runs under it) means the lock is
-    // held while ensureIndex / collectEligibleRefs / contradiction-detection /
-    // memory-cleanup analysis run — but the main protecting `try { … } finally {
-    // unlinkSync(resolvedLockPath) }` does not begin until after them. A throw in
-    // any of those steps would leak the lock. We close that window by wrapping the
-    // whole region in a try whose catch releases the lock (when held) and
-    // re-throws. The values this region computes are declared in the outer scope so
-    // they remain visible to the main run below. The dry-run path never sets
-    // `lockAcquired`, so its early return releases nothing.
-    let lockAcquired = false;
-    const releaseLockOnError = () => {
-        if (!lockAcquired)
-            return;
-        try {
-            fs.unlinkSync(resolvedLockPath);
-        }
-        catch {
-            // best-effort release on the error path
-        }
-        lockAcquired = false;
-    };
-    // Signal-safe lock release. The SIGTERM/SIGINT/SIGHUP handler in improve-cli.ts
-    // calls `process.exit()`, which does NOT run the `finally` below that owns lock
-    // release — so a cron-timeout SIGTERM leaked `improve.lock` every run.
-    // `process.exit()` DOES fire `'exit'` listeners, so we release the lock from
-    // one. `releaseLockIfOwned` only unlinks a lock still owned by this PID, so it
-    // is safe even if a later run re-acquired it. The listener is removed in the
-    // `finally` so the normal path stays single-release and repeated in-process
-    // `akmImprove` calls (tests) do not accumulate listeners.
-    const releaseLockOnExit = () => {
-        releaseLockIfOwned(resolvedLockPath, process.pid);
-    };
+    // #612 / WS-4 — bounded, OPT-IN per-phase auto-accept threshold auto-tune.
+    // DEFAULT OFF: `autoTune: false` (or absent) is a complete no-op.
+    //
+    // WS-4 change: thresholds are now PER PHASE. The old single global mutation
+    // of `options.autoAccept` is retired — it caused every phase to share one
+    // calibration signal, so a reflect-dominated run could tighten the consolidate
+    // gate (or vice-versa). Instead:
+    //   - Each `makeGateConfig` call reads the phase's stored threshold from
+    //     state.db (Migration 012) and uses it as `phaseThreshold`, overriding
+    //     the `globalThreshold` (= options.autoAccept) for that phase.
+    //   - Per-phase `maybeAutoTuneThreshold` calls fire AFTER each phase's gate
+    //     has run and persist the new threshold to state.db for the NEXT run.
+    //   - `options.autoAccept` stays unchanged (it is the operator-supplied
+    //     baseline, not a mutable run-time state).
+    //
+    // The global tune call is intentionally removed here. See per-phase calls
+    // below (near each makeGateConfig / runAutoAcceptGate block).
+    // #607 Lock decomposition: three per-process locks replace the single
+    // `improve.lock`. Each process acquires only the lock(s) it needs, so
+    // quick-shredder consolidate can run alongside daily reflect+distill.
+    //
+    //   consolidate.lock     — protects consolidate + memoryInference + graphExtraction (index.db writers)
+    //   reflect-distill.lock — protects reflect + distill (state.db proposal writers)
+    //   triage.lock          — protects triage pre-pass (state.db proposal promotions)
+    //
+    // Lock base directory — same `.akm/` under the primary stash dir.
+    const lockBaseDir = primaryStashDir ? path.join(primaryStashDir, ".akm") : path.join(options.stashDir ?? ".", ".akm");
     const preEnsureCleanupWarnings = [];
-    let plannedRefs;
-    let memorySummary;
-    let profileFilteredRefs;
+    // #616: assigned by runIndexAndCollect() (closure) so TS cannot prove definite
+    // assignment — seed with empty values; the first runIndexAndCollect() call
+    // (cycle 1, in the first try) always overwrites them before any read.
+    let plannedRefs = [];
+    let memorySummary = { eligible: 0, derived: 0 };
+    let profileFilteredRefs = [];
     let memoryCleanupPlan;
     let guidance;
     let triageDrain;
-    try {
-        // Acquire the lock and run the triage pre-pass for non-dry-run executions.
-        // The dry-run branch below produces plannedRefs/memorySummary WITHOUT the lock
-        // or triage (decision: dry-run never mutates the queue).
-        if (!options.dryRun) {
-            if (acquireLock() === "skipped") {
-                // Another improve holds the lock and the caller asked to skip rather
-                // than fail. Return a clean no-op result (exit 0) before any index/DB
-                // work — never registered the exit listener, never set lockAcquired,
-                // so we release nothing belonging to the run that owns the lock.
-                return {
-                    schemaVersion: 1,
-                    ok: true,
-                    scope,
-                    dryRun: false,
-                    skipped: { reason: "lock-held" },
-                    memorySummary: { eligible: 0, derived: 0 },
-                    plannedRefs: [],
-                };
-            }
-            lockAcquired = true;
-            // Backstop release on process.exit() (signal handler / budget watchdog),
-            // which skips the finally below. Removed in that finally on the normal path.
-            process.on("exit", releaseLockOnExit);
-            // Phase 4 triage pre-pass (§7, §13): drain the standing pending backlog
-            // BEFORE ensureIndex so improve generates fresh proposals against a cleared
-            // queue (no `duplicate_pending` collisions) and ensureIndex absorbs triage's
-            // promotions for free. Gated on the triage process being enabled (opt-in,
-            // defaults off) and on a whole-stash / type-scoped run — a single-ref
-            // `akm improve skill:x` must never drain the whole queue. Best-effort: a
-            // triage failure is a non-fatal warning, never an abort (mirrors the
-            // contradiction-detection pass below).
-            if (primaryStashDir && resolveProcessEnabled("triage", improveProfile)) {
-                if (scope.mode === "ref") {
-                    warn("[improve] triage pre-pass skipped (single-ref scope never drains the whole queue)");
-                }
-                else {
-                    try {
-                        const triageConfig = improveProfile.processes?.triage;
-                        const policy = resolveDrainPolicy(triageConfig?.policy);
-                        const applyMode = triageConfig?.applyMode ?? "queue";
-                        const maxAccepts = triageConfig?.maxAcceptsPerRun ?? 25;
-                        const judgment = triageConfig?.judgment
-                            ? resolveTriageJudgmentRunner(triageConfig.judgment, _earlyConfig)
-                            : null;
-                        triageDrain = await drainProposalsFn({
-                            stashDir: primaryStashDir,
-                            policy,
-                            applyMode,
-                            maxAccepts,
-                            dryRun: false,
-                            // No fresh ids exist yet — triage runs before improve generates any.
-                            excludeIds: new Set(),
-                            ...(triageConfig?.maxDiffLines !== undefined ? { maxDiffLines: triageConfig.maxDiffLines } : {}),
-                            judgment,
-                        });
-                    }
-                    catch (err) {
-                        // Non-fatal: triage is a best-effort pre-pass and must never abort improve.
-                        warn(`[improve] triage pre-pass failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
-                    }
-                }
-            }
-        }
+    // #616 — ensureIndex + collectEligibleRefs + memory-cleanup recompute, lifted
+    // into a helper so the SAME sequence runs once for cycle 1 (below, in the
+    // first try) and is re-run at the top of each subsequent multi-cycle cycle.
+    // Re-running ensureIndex between cycles makes cycle N's gate-promoted
+    // proposals visible to cycle N+1's collectEligibleRefs. Mutates the
+    // outer-scope plannedRefs/memorySummary/profileFilteredRefs/memoryCleanupPlan/
+    // guidance so for maxCycles:1 the body is byte-identical to pre-#616.
+    const runIndexAndCollect = async () => {
         // #339 fix: ensureIndex MUST run BEFORE collectEligibleRefs. The eligible-ref
         // query reads the `entries` table; if a DB version upgrade just dropped that
         // table (or the index is otherwise empty), the prior run order silently
@@ -686,10 +200,10 @@ export async function akmImprove(options = {}) {
                 // best-effort; leave preEnsureEntryCount undefined
             }
             try {
-                await ensureIndexFn(primaryStashDir);
+                await ensureIndexFn(primaryStashDir, { mode: "blocking" });
             }
             catch (err) {
-                preEnsureCleanupWarnings.push(`ensureIndex failed: ${err instanceof Error ? err.message : String(err)}`);
+                preEnsureCleanupWarnings.push(`ensureIndex failed: ${errMessage(err)}`);
             }
             // #339 loud-fail: if the index was empty pre-ensureIndex but is now
             // populated, a version-upgrade-triggered rebuild just happened. Surface
@@ -716,7 +230,7 @@ export async function akmImprove(options = {}) {
                 }
             }
         }
-        ({ plannedRefs, memorySummary, profileFilteredRefs } = await collectEligibleRefs(scope, options.stashDir, improveProfile));
+        ({ plannedRefs, memorySummary, profileFilteredRefs } = await collectEligibleRefsImpl(scope, options.stashDir, improveProfile));
         const cleanupParentRef = memoryCleanupParentRef(scope, options.stashDir);
         // M-1 (#367): Run contradiction-detection BEFORE analyzeMemoryCleanup so
         // the SCC resolver in resolveFamilyContradictions has edges to work on.
@@ -728,7 +242,7 @@ export async function akmImprove(options = {}) {
             }
             catch (err) {
                 // Non-fatal: contradiction detection is a best-effort pass.
-                warn(`[improve] contradiction detection failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
+                warn(`[improve] contradiction detection failed (non-fatal): ${errMessage(err)}`);
             }
         }
         memoryCleanupPlan = shouldAnalyzeMemoryCleanup(scope, memorySummary.eligible, primaryStashDir)
@@ -738,6 +252,70 @@ export async function akmImprove(options = {}) {
             memorySummary.eligible > 0
                 ? "Improve folds memory cleanup into the same proposal queue: speculative promotions still go through reflect/distill proposals, while high-confidence redundant derived memories are moved into a recoverable cleanup archive instead of being left active in the stash."
                 : undefined;
+    };
+    // Holds our own process.on("exit") backstop so the finally can remove EXACTLY
+    // that handler (not every exit listener in the process). Declared in the scope
+    // shared by the try and its finally; assigned when the backstop is registered.
+    let exitBackstop;
+    try {
+        // #607: Per-process lock acquisition. Each process acquires only the lock(s)
+        // it needs. The dry-run branch produces plannedRefs/memorySummary WITHOUT any
+        // locks (decision: dry-run never mutates the queue).
+        if (!options.dryRun) {
+            // Backstop release on process.exit() (signal handler / budget watchdog),
+            // which skips the finally below. Removed in that finally on the normal path.
+            const releaseAllOnExit = () => releaseHeldLocksIfOwned(process.pid);
+            exitBackstop = releaseAllOnExit;
+            process.on("exit", releaseAllOnExit);
+            // #607 triage pre-pass: acquire triage.lock, drain the standing pending
+            // backlog BEFORE ensureIndex so improve generates fresh proposals against
+            // a cleared queue (no `duplicate_pending` collisions) and ensureIndex
+            // absorbs triage's promotions for free. Release immediately after —
+            // triage.lock is not needed again until the next improve run.
+            if (primaryStashDir && resolveProcessEnabled("triage", improveProfile)) {
+                if (scope.mode === "ref") {
+                    warn("[improve] triage pre-pass skipped (single-ref scope never drains the whole queue)");
+                }
+                else {
+                    const triageLPath = processLockPath(lockBaseDir, "triage");
+                    const triageResult = tryAcquireProcessLock(triageLPath, PROCESS_LOCK_DEFS.triage.staleAfterMs, options.skipIfLocked, "triage");
+                    if (triageResult === "skipped") {
+                        triageDrain = undefined;
+                    }
+                    else {
+                        try {
+                            const triageConfig = improveProfile.processes?.triage;
+                            const policy = resolveDrainPolicy(triageConfig?.policy);
+                            const applyMode = triageConfig?.applyMode ?? "queue";
+                            const maxAccepts = triageConfig?.maxAcceptsPerRun ?? 25;
+                            const judgment = triageConfig?.judgment
+                                ? resolveTriageJudgmentRunner(triageConfig.judgment, _earlyConfig)
+                                : null;
+                            triageDrain = await drainProposalsFn({
+                                stashDir: primaryStashDir,
+                                policy,
+                                applyMode,
+                                maxAccepts,
+                                dryRun: false,
+                                excludeIds: new Set(),
+                                ...(triageConfig?.maxDiffLines !== undefined ? { maxDiffLines: triageConfig.maxDiffLines } : {}),
+                                judgment,
+                            });
+                        }
+                        catch (err) {
+                            warn(`[improve] triage pre-pass failed (non-fatal): ${errMessage(err)}`);
+                        }
+                        finally {
+                            releaseProcessLock(triageLPath);
+                        }
+                    }
+                }
+            }
+        }
+        // #339 fix: ensureIndex MUST run BEFORE collectEligibleRefs (now inside the
+        // helper). Cycle 1 runs it here; subsequent multi-cycle cycles re-run it via
+        // the same helper at the top of each cycle below.
+        await runIndexAndCollect();
         if (options.dryRun) {
             const result = {
                 schemaVersion: 1,
@@ -754,17 +332,14 @@ export async function akmImprove(options = {}) {
         }
     }
     catch (err) {
-        releaseLockOnError();
+        releaseAllProcessLocks();
         throw err;
     }
-    // FIX 2 (lock-leak window): everything from here on runs UNDER the lock that
-    // `acquireLock()` just took. The single `try { … } finally { unlinkSync(lock) }`
-    // below now spans the budget-timer setup, `openStateDatabase()`, and the
-    // `profileFilteredRefs` audit-event loop too — regions that previously sat in
-    // the gap between the lock-acquire catch (above) and the main try. A throw in
-    // any of them used to leak the lock (blocking the next improve up to 4h);
-    // now the finally releases it exactly once. The dry-run path already returned
-    // above without acquiring the lock, so it never reaches this finally; the
+    // #607: per-process locks are acquired/released around each stage below.
+    // The triage pre-pass already ran under triage.lock (released). The
+    // preparation stage runs under consolidate.lock, the loop stage under
+    // reflect-distill.lock, and the post-loop stage under consolidate.lock again.
+    // Each stage acquires its lock just before starting and releases in finally.
     // best-effort `unlinkSync` is a no-op when no lock file exists.
     const startMs = Date.now();
     const budgetMs = options.timeoutMs ?? 2 * 60 * 60 * 1000; // default 2 hours
@@ -773,6 +348,16 @@ export async function akmImprove(options = {}) {
     // run past the declared budget.
     // References: Anthropic *Building Effective Agents* (2024); CoALA §5 (arXiv:2309.02427).
     const budgetAbortController = new AbortController();
+    // Attach a live `remainingBudgetMs` getter to the signal so sub-callers
+    // (e.g. consolidate.ts cold-start budget estimation) can read the remaining
+    // wall-clock budget without needing an extra plumbing parameter. The property
+    // is computed at access time via a getter so it always reflects the actual
+    // elapsed time rather than a stale snapshot taken at arm time.
+    Object.defineProperty(budgetAbortController.signal, "remainingBudgetMs", {
+        get: () => Math.max(0, budgetMs - (Date.now() - startMs)),
+        enumerable: false,
+        configurable: true,
+    });
     // Declared in the outer scope so the `finally` can clear the timer even if a
     // throw occurs before/after it is armed. Defaults to a no-op until armed.
     let clearBudgetTimer = () => { };
@@ -787,6 +372,63 @@ export async function akmImprove(options = {}) {
     // #576: clears the per-run LLM usage sink. Defaults to a no-op until the sink
     // is installed inside the try; the `finally` always calls it.
     let disposeLlmUsageSink = () => { };
+    // ── Crash-safe / incremental stash sync (#662) ──────────────────────────────
+    // The primary stash writes as a filesystem source DURING the run
+    // (write-source.ts case-3); those writes become a git commit only when this
+    // closure runs. Historically the only call site was a single BATCH commit at
+    // the very end of the happy path, so a run interrupted AFTER writing but
+    // BEFORE finishing — a mid-cycle crash, a budget abort, or an external
+    // SIGTERM/`process.exit` — left every write uncommitted until some LATER run
+    // happened to finish cleanly and swept the whole backlog up. We now call this
+    // from THREE places: between cycles (bank each completed cycle), at end-of-run
+    // (the converged commit), and from the catch path (commit what was written
+    // before the crash). That shrinks the worst-case loss from "the entire run" to
+    // "the in-flight cycle".
+    //
+    // Declared in the OUTER scope (not inside the try) so the catch block can reach
+    // it. Idempotent + NON-FATAL: `saveGitStash` short-circuits a clean working
+    // tree ("nothing to commit") and a thrown sync error is swallowed here, so a
+    // repeat call after a no-op cycle is cheap and a failed push never fails the
+    // run. Gated identically to the original end-of-run block (git-backed primary
+    // stash, sync not disabled). `eventsCtx` is captured by reference, so calls
+    // after the db-backed context is installed inside the try use the live handle.
+    const effectiveSync = { ...improveProfile.sync, ...options.sync };
+    const commitStashBatch = (messageContext) => {
+        if (!primaryStashDir || effectiveSync.enabled === false || !isGitBackedStash(primaryStashDir)) {
+            return undefined;
+        }
+        const saveGitStashFn = options.saveGitStashFn ?? saveGitStash;
+        const writableOverride = resolveWritableOverride(_earlyConfig);
+        const push = effectiveSync.push !== false;
+        const message = renderSyncCommitMessage(effectiveSync.message ?? "akm improve auto-sync", messageContext, Date.now());
+        try {
+            const syncResult = saveGitStashFn(undefined, message, writableOverride, { push, repoDir: primaryStashDir });
+            appendEvent({
+                eventType: "stash_synced",
+                metadata: {
+                    committed: syncResult.committed,
+                    pushed: syncResult.pushed,
+                    skipped: syncResult.skipped,
+                    reason: syncResult.reason ?? null,
+                },
+            }, eventsCtx);
+            return {
+                committed: syncResult.committed,
+                pushed: syncResult.pushed,
+                skipped: syncResult.skipped,
+                ...(syncResult.reason !== undefined ? { reason: syncResult.reason } : {}),
+            };
+        }
+        catch (syncErr) {
+            const reason = errMessage(syncErr);
+            warn(`improve: stash sync failed (non-fatal): ${reason}`);
+            appendEvent({
+                eventType: "stash_synced",
+                metadata: { committed: false, pushed: false, skipped: true, reason },
+            }, eventsCtx);
+            return { committed: false, pushed: false, skipped: true, reason };
+        }
+    };
     try {
         // H7 (#566): arm the budget watchdog. `armBudgetWatchdog` captures both the
         // budget timer and the hard-kill timer it schedules on exhaustion, returning
@@ -828,71 +470,244 @@ export async function akmImprove(options = {}) {
                 },
             }, eventsCtx);
         }
-        const preparation = await runImprovePreparationStage({
-            scope,
-            options,
-            plannedRefs,
-            memoryCleanupPlan,
-            primaryStashDir,
-            memorySummary,
-            reindexFn,
-            startMs,
-            budgetMs,
-            eventsCtx,
-            initialCleanupWarnings: preEnsureCleanupWarnings,
-            improveProfile,
-        });
-        // D6: pre-load all proposal_rejected events from the last 30 days once,
-        // so the per-asset loop can use a Map lookup instead of N DB round trips.
-        const REJECTED_PROPOSAL_WINDOW_MS = daysToMs(30);
-        const rejectedProposalSince = new Date(Date.now() - REJECTED_PROPOSAL_WINDOW_MS).toISOString();
-        const allRejectedProposalEvents = readEvents({ type: "proposal_rejected", since: rejectedProposalSince }).events;
-        const rejectedProposalsByRef = new Map();
-        for (const e of allRejectedProposalEvents) {
-            if (e.ref && (!rejectedProposalsByRef.has(e.ref) || e.ts > (rejectedProposalsByRef.get(e.ref)?.ts ?? ""))) {
-                rejectedProposalsByRef.set(e.ref, e);
+        // #616 — bounded multi-cycle phasing. The prep->loop->post-loop sequence is
+        // wrapped in an N-cycle loop. Each cycle re-runs ensureIndex +
+        // collectEligibleRefs (via runIndexAndCollect) so gate-accepted output of
+        // cycle N becomes selectable input to cycle N+1. The per-stage process locks
+        // (consolidate / reflect-distill) are acquired+released INSIDE each cycle,
+        // exactly as the single-pass path did. For maxCycles:1 the loop runs once and
+        // every accumulator below collapses to the single-cycle value (sum-of-one,
+        // concat-of-one, last==only) => BYTE-IDENTICAL to pre-#616.
+        //
+        // Accumulators (see CONSTRAINTS / aggregation plan in #616): SUM the count
+        // fields and durations; CONCAT the array fields; LAST-WINS for point-in-time
+        // objects (the final cycle's value reflects the converged state).
+        let cyclesRun = 0;
+        // Last-wins point-in-time values (assigned every cycle; the final cycle wins).
+        let preparation;
+        let memoryRefsForInference = new Set();
+        let consolidation;
+        let memoryInference;
+        let graphExtraction;
+        let recombination;
+        let proceduralCompilation;
+        let cycleMetrics;
+        // Summed counters/durations.
+        let prepGateCount = 0;
+        let prepGateFailedCount = 0;
+        let reflectsWithErrorContext = 0;
+        let loopGateCount = 0;
+        let loopGateFailedCount = 0;
+        let postLoopGateCount = 0;
+        let postLoopGateFailedCount = 0;
+        let memoryInferenceDurationMs = 0;
+        let graphExtractionDurationMs = 0;
+        let orphansPurged;
+        let proposalsExpired;
+        // Concatenated arrays.
+        const allWarnings = [];
+        let deadUrls;
+        const finalActions = [];
+        for (let cycleIndex = 0; cycleIndex < maxCycles; cycleIndex++) {
+            // #616 budget gate: never start a NEW cycle once the run's wall-clock
+            // budget is exhausted (or the run was aborted). Cycle 0 ALWAYS runs so
+            // maxCycles:1 is byte-identical regardless of budget.
+            if (cycleIndex > 0) {
+                const remaining = budgetAbortController.signal.remainingBudgetMs;
+                if (budgetAbortController.signal.aborted || (remaining !== undefined && remaining <= 0)) {
+                    break;
+                }
+            }
+            // #662 incremental sync: bank the PREVIOUS cycle's writes before starting a
+            // new one, so a crash/abort/timeout mid-run loses at most the in-flight
+            // cycle rather than the whole run. Guarded on `cycleIndex > 0`, so the
+            // common maxCycles:1 path never calls this — its single end-of-run commit
+            // below stays the only sync and the serialized envelope is byte-identical
+            // to pre-#662. `saveGitStash` no-ops a clean tree, so a cycle that wrote
+            // nothing costs only a `git status`.
+            if (cycleIndex > 0) {
+                commitStashBatch({ scope, plannedRefs, runId: options.runId });
+            }
+            // Re-run ensureIndex + collectEligibleRefs + memory-cleanup recompute for
+            // cycles 2+ (cycle 1 already ran them in the first try above). This makes
+            // cycle N's gate-promoted proposals visible to this cycle's ref selection.
+            if (cycleIndex > 0) {
+                await runIndexAndCollect();
+                // Re-emit the profile-filtered audit summary for this cycle's selection.
+                if (profileFilteredRefs.length > 0) {
+                    appendEvent({
+                        eventType: "improve_skipped",
+                        ref: undefined,
+                        metadata: { reason: "profile_filtered_all_passes", count: profileFilteredRefs.length },
+                    }, eventsCtx);
+                }
             }
+            // #607: acquire consolidate.lock for the preparation stage (consolidate,
+            // ensureIndex, extract all write index.db). Released immediately after.
+            const consolidateLPath = processLockPath(lockBaseDir, "consolidate");
+            preparation = await withOptionalProcessLock({
+                lockPath: consolidateLPath,
+                staleAfterMs: PROCESS_LOCK_DEFS.consolidate.staleAfterMs,
+                skipIfLocked: options.skipIfLocked,
+                label: "consolidate",
+            }, () => runImprovePreparationStageImpl({
+                scope,
+                options,
+                plannedRefs,
+                memoryCleanupPlan,
+                primaryStashDir,
+                memorySummary,
+                reindexFn,
+                startMs,
+                budgetMs,
+                eventsCtx,
+                initialCleanupWarnings: preEnsureCleanupWarnings,
+                improveProfile,
+                budgetSignal: budgetAbortController.signal,
+            }));
+            prepGateCount += preparation.gateAutoAcceptedCount;
+            prepGateFailedCount += preparation.gateAutoAcceptFailedCount;
+            // D6: pre-load all proposal_rejected events from the last 30 days once,
+            // so the per-asset loop can use a Map lookup instead of N DB round trips.
+            const REJECTED_PROPOSAL_WINDOW_MS = daysToMs(30);
+            const rejectedProposalSince = new Date(Date.now() - REJECTED_PROPOSAL_WINDOW_MS).toISOString();
+            const allRejectedProposalEvents = readEvents({ type: "proposal_rejected", since: rejectedProposalSince }).events;
+            const rejectedProposalsByRef = new Map();
+            for (const e of allRejectedProposalEvents) {
+                if (e.ref && (!rejectedProposalsByRef.has(e.ref) || e.ts > (rejectedProposalsByRef.get(e.ref)?.ts ?? ""))) {
+                    rejectedProposalsByRef.set(e.ref, e);
+                }
+            }
+            // #607: acquire reflect-distill.lock for the loop stage (reflect + distill
+            // both write proposals to state.db). Released immediately after.
+            const reflectDistillLPath = processLockPath(lockBaseDir, "reflectDistill");
+            const loopResult = await withOptionalProcessLock({
+                lockPath: reflectDistillLPath,
+                staleAfterMs: PROCESS_LOCK_DEFS.reflectDistill.staleAfterMs,
+                skipIfLocked: options.skipIfLocked,
+                label: "reflect-distill",
+            }, () => {
+                // Post-lock cooldown re-filter for proactive refs (#SELECT-TIME-LEAK).
+                // Planning built `lastReflectProposalTs` BEFORE acquiring this lock, so a
+                // concurrent run's `reflect_invoked` writes are invisible to it. Now that
+                // we hold the lock, re-read fresh timestamp maps for the proactive subset
+                // and drop any ref whose cooldown has been consumed by the concurrent run.
+                const proactiveLoopRefs = preparation.loopRefs.filter((r) => r.eligibilitySource === "proactive");
+                let postLockLoopRefs = preparation.loopRefs;
+                if (proactiveLoopRefs.length > 0) {
+                    const proactiveRefStrs = proactiveLoopRefs.map((r) => r.ref);
+                    const freshReflectTs = buildLatestProposalTsMap(proactiveRefStrs, "reflect");
+                    const freshDistillTs = buildLatestProposalTsMap(proactiveRefStrs, "distill");
+                    const pmDueDays = improveProfile.processes?.proactiveMaintenance?.dueDays ?? DEFAULT_DUE_DAYS;
+                    const stillDue = new Set(filterProactiveDue(proactiveLoopRefs, freshReflectTs, freshDistillTs, pmDueDays, Date.now()).map((r) => r.ref));
+                    const dropped = proactiveLoopRefs.filter((r) => !stillDue.has(r.ref));
+                    if (dropped.length > 0) {
+                        info(`[improve] post-lock cooldown re-filter: dropped ${dropped.length} proactive ref(s) claimed by concurrent run (${dropped.map((r) => r.ref).join(", ")})`);
+                        postLockLoopRefs = preparation.loopRefs.filter((r) => r.eligibilitySource !== "proactive" || stillDue.has(r.ref));
+                    }
+                }
+                return runImproveLoopStageImpl({
+                    scope,
+                    options,
+                    primaryStashDir,
+                    reflectFn,
+                    distillFn,
+                    loopRefs: postLockLoopRefs,
+                    actions: preparation.actions,
+                    signalBearingSet: preparation.signalBearingSet,
+                    distillCooledRefs: preparation.distillCooledRefs,
+                    distillOnlyRefs: preparation.distillOnlyRefs,
+                    recentErrors: preparation.recentErrors,
+                    rejectedProposalsByRef,
+                    utilityMap: preparation.utilityMap,
+                    startMs,
+                    budgetMs,
+                    eventsCtx,
+                    improveProfile,
+                    budgetSignal: budgetAbortController.signal,
+                });
+            });
+            const loopGateCountThisCycle = loopResult.gateAutoAcceptedCount;
+            reflectsWithErrorContext += loopResult.reflectsWithErrorContext;
+            loopGateCount += loopResult.gateAutoAcceptedCount;
+            loopGateFailedCount += loopResult.gateAutoAcceptFailedCount;
+            memoryRefsForInference = loopResult.memoryRefsForInference;
+            // #551: consolidation now runs in the preparation stage (before extract);
+            // its result and run-flag are read from `preparation`, not the post-loop.
+            consolidation = preparation.consolidation;
+            // #607: acquire consolidate.lock for the post-loop stage (memoryInference +
+            // graphExtraction both write index.db). Released immediately after.
+            const consolidatePostLPath = processLockPath(lockBaseDir, "consolidate");
+            const postLoopResult = await withOptionalProcessLock({
+                lockPath: consolidatePostLPath,
+                staleAfterMs: PROCESS_LOCK_DEFS.consolidate.staleAfterMs,
+                skipIfLocked: options.skipIfLocked,
+                label: "consolidate",
+            }, () => runImprovePostLoopStageImpl({
+                scope,
+                options,
+                primaryStashDir,
+                actionableRefs: preparation.actionableRefs,
+                appliedCleanup: preparation.appliedCleanup,
+                cleanupWarnings: preparation.cleanupWarnings,
+                memoryRefsForInference,
+                reindexFn,
+                eventsCtx,
+                budgetSignal: budgetAbortController.signal,
+                improveProfile,
+                consolidationRan: preparation.consolidationRan,
+                // R5: floor violations from this run's consolidate pass + the
+                // auto-accepted volume so far (prep + loop gates) for churn detection.
+                consolidationMergeFloorViolations: preparation.consolidation.mergeFloorViolations ?? 0,
+                acceptedActions: preparation.gateAutoAcceptedCount + loopGateCountThisCycle,
+            }));
+            const postLoopGateCountThisCycle = postLoopResult.gateAutoAcceptedCount;
+            // Last-wins point-in-time objects.
+            memoryInference = postLoopResult.memoryInference;
+            graphExtraction = postLoopResult.graphExtraction;
+            recombination = postLoopResult.recombination;
+            proceduralCompilation = postLoopResult.proceduralCompilation;
+            // Keep the last QUALIFYING cycle's snapshot — a later non-qualifying
+            // cycle in a maxCycles>1 run must not clobber it with undefined.
+            if (postLoopResult.cycleMetrics)
+                cycleMetrics = postLoopResult.cycleMetrics;
+            // Summed counters/durations.
+            postLoopGateCount += postLoopResult.gateAutoAcceptedCount;
+            postLoopGateFailedCount += postLoopResult.gateAutoAcceptFailedCount;
+            memoryInferenceDurationMs += postLoopResult.memoryInferenceDurationMs;
+            graphExtractionDurationMs += postLoopResult.graphExtractionDurationMs;
+            if (postLoopResult.orphansPurged !== undefined) {
+                orphansPurged = (orphansPurged ?? 0) + postLoopResult.orphansPurged;
+            }
+            if (postLoopResult.proposalsExpired !== undefined) {
+                proposalsExpired = (proposalsExpired ?? 0) + postLoopResult.proposalsExpired;
+            }
+            // Concatenated arrays.
+            allWarnings.push(...postLoopResult.allWarnings);
+            if (postLoopResult.deadUrls !== undefined) {
+                deadUrls = [...(deadUrls ?? []), ...postLoopResult.deadUrls];
+            }
+            const maintenanceActions = postLoopResult.maintenanceActions;
+            if (maintenanceActions && maintenanceActions.length > 0) {
+                finalActions.push(...preparation.actions, ...maintenanceActions);
+            }
+            else {
+                finalActions.push(...preparation.actions);
+            }
+            cyclesRun++;
+            // #616 fixed-point stop: a cycle that produced ZERO gate-accepted proposals
+            // (summed across prep + loop + post-loop) would feed cycle N+1 an identical
+            // ref set, so end the loop here rather than spin a pointless next cycle.
+            const gateAcceptedThisCycle = preparation.gateAutoAcceptedCount + loopGateCountThisCycle + postLoopGateCountThisCycle;
+            if (gateAcceptedThisCycle === 0)
+                break;
         }
-        const { reflectsWithErrorContext, memoryRefsForInference, gateAutoAcceptedCount: loopGateCount, gateAutoAcceptFailedCount: loopGateFailedCount, } = await runImproveLoopStage({
-            scope,
-            options,
-            primaryStashDir,
-            reflectFn,
-            distillFn,
-            loopRefs: preparation.loopRefs,
-            actions: preparation.actions,
-            signalBearingSet: preparation.signalBearingSet,
-            distillCooledRefs: preparation.distillCooledRefs,
-            distillOnlyRefs: preparation.distillOnlyRefs,
-            recentErrors: preparation.recentErrors,
-            rejectedProposalsByRef,
-            utilityMap: preparation.utilityMap,
-            startMs,
-            budgetMs,
-            eventsCtx,
-            improveProfile,
-        });
-        // #551: consolidation now runs in the preparation stage (before extract);
-        // its result and run-flag are read from `preparation`, not the post-loop.
-        const consolidation = preparation.consolidation;
-        const { allWarnings, deadUrls, memoryInference, graphExtraction, stalenessDetection, maintenanceActions, memoryInferenceDurationMs, graphExtractionDurationMs, orphansPurged, proposalsExpired, gateAutoAcceptedCount: postLoopGateCount, gateAutoAcceptFailedCount: postLoopGateFailedCount, } = await runImprovePostLoopStage({
-            scope,
-            options,
-            primaryStashDir,
-            actionableRefs: preparation.actionableRefs,
-            appliedCleanup: preparation.appliedCleanup,
-            cleanupWarnings: preparation.cleanupWarnings,
-            memoryRefsForInference,
-            reindexFn,
-            eventsCtx,
-            // O-1 (#364): propagate wall-clock budget signal to post-loop maintenance.
-            budgetSignal: budgetAbortController.signal,
-            improveProfile,
-            consolidationRan: preparation.consolidationRan,
-        });
-        const finalActions = maintenanceActions && maintenanceActions.length > 0
-            ? [...preparation.actions, ...maintenanceActions]
-            : preparation.actions;
+        // C1 (13-bus-factor): fold the per-ref `distill-skipped` rows (~13k/run,
+        // ~91% of result_json bytes) into a bounded aggregate BEFORE persistence.
+        // The metric total + per-reason breakdown are preserved on `distillSkipped`;
+        // the unbounded row list never reaches result_json. Reflect skip counters
+        // below still read `finalActions` (reflect skips are not folded).
+        const { actions: persistedActions, aggregate: distillSkippedAggregate } = foldDistillSkipped(finalActions);
         const result = {
             schemaVersion: 1,
             ok: true,
@@ -923,7 +738,8 @@ export async function akmImprove(options = {}) {
                 : {}),
             plannedRefs: preparation.actionableRefs,
             ...(profileFilteredRefs.length > 0 ? { profileFilteredRefs } : {}),
-            actions: finalActions,
+            actions: persistedActions,
+            ...(distillSkippedAggregate ? { distillSkipped: distillSkippedAggregate } : {}),
             ...(preparation.validationFailures.length > 0 ? { validationFailures: preparation.validationFailures } : {}),
             ...(preparation.schemaRepairs.length > 0 ? { schemaRepairs: preparation.schemaRepairs } : {}),
             ...(consolidation.processed > 0 || consolidation.warnings.length > 0 ? { consolidation } : {}),
@@ -950,18 +766,20 @@ export async function akmImprove(options = {}) {
             // `/tmp/akm-health-investigations/metrics-taxonomy-review.md` §1k / §3.
             ...(memoryInferenceDurationMs > 0 ? { memoryInferenceDurationMs } : {}),
             ...(graphExtractionDurationMs > 0 ? { graphExtractionDurationMs } : {}),
-            ...(stalenessDetection ? { stalenessDetection } : {}),
+            ...(recombination ? { recombination } : {}),
+            ...(proceduralCompilation ? { proceduralCompilation } : {}),
+            ...(cycleMetrics ? { cycleMetrics } : {}),
             ...(orphansPurged !== undefined ? { orphansPurged } : {}),
             ...(proposalsExpired !== undefined && proposalsExpired > 0 ? { proposalsExpired } : {}),
             reflectCooldownActions: finalActions.filter((a) => a.mode === "reflect-cooldown").length,
             reflectSkippedActions: finalActions.filter((a) => a.mode === "reflect-skipped").length,
             reflectGuardRejectedActions: finalActions.filter((a) => a.mode === "reflect-guard-rejected").length,
             ...(() => {
-                const t = preparation.gateAutoAcceptedCount + loopGateCount + postLoopGateCount;
+                const t = prepGateCount + loopGateCount + postLoopGateCount;
                 return t > 0 ? { gateAutoAcceptedCount: t } : {};
             })(),
             ...(() => {
-                const f = preparation.gateAutoAcceptFailedCount + loopGateFailedCount + postLoopGateFailedCount;
+                const f = prepGateFailedCount + loopGateFailedCount + postLoopGateFailedCount;
                 return f > 0 ? { gateAutoAcceptFailedCount: f } : {};
             })(),
             ...(triageDrain
@@ -974,6 +792,10 @@ export async function akmImprove(options = {}) {
                     },
                 }
                 : {}),
+            ...(preparation.proactiveMaintenance ? { proactiveMaintenance: preparation.proactiveMaintenance } : {}),
+            // #616 — report cycles run only when >1 so the default single-pass
+            // serialized envelope stays byte-identical to pre-#616 (AC1).
+            ...(cyclesRun > 1 ? { cyclesRun } : {}),
             ...(options.runId !== undefined ? { runId: options.runId } : {}),
         };
         if (!result.dryRun)
@@ -984,57 +806,18 @@ export async function akmImprove(options = {}) {
                 warningCount: allWarnings.length,
                 orphansPurged: orphansPurged ?? 0,
             }, eventsCtx);
-        // End-of-run BATCH auto-sync. Recognition is decoupled from the per-write
-        // path (see write-source.ts case-3): the primary stash writes as a
-        // filesystem source during the run, then is committed in one shot here via
-        // the same `saveGitStash` that `akm sync` calls. Gated on a non-dry-run, a
-        // git-backed primary stash (by `.git`, not by remote), and sync not
-        // disabled. A sync failure is NON-FATAL — it never fails a successful run
-        // (mirrors the contradiction-detection best-effort pattern).
-        const effectiveSync = { ...improveProfile.sync, ...options.sync };
-        if (!result.dryRun && primaryStashDir && effectiveSync.enabled !== false && isGitBackedStash(primaryStashDir)) {
-            const saveGitStashFn = options.saveGitStashFn ?? saveGitStash;
-            // Reuse the config resolved at the top of the run (`_earlyConfig`) instead
-            // of a second loadConfig(); the writable derivation is shared with
-            // `akm sync` via resolveWritableOverride().
-            const writableOverride = resolveWritableOverride(_earlyConfig);
-            const push = effectiveSync.push !== false;
-            // `sync.message` may contain `{token}` placeholders (timestamp/date/time/
-            // scope/refs/accepted) expanded against this run's results; the default
-            // template has no tokens so it renders verbatim.
-            const message = renderSyncCommitMessage(effectiveSync.message ?? "akm improve auto-sync", result, Date.now());
-            try {
-                // Pass primaryStashDir as the explicit commit target so the gate above
-                // (which validated primaryStashDir via isGitBackedStash) and the commit
-                // operate on the SAME directory — avoids divergence when a caller passes
-                // a non-default options.stashDir (FIX 9).
-                const syncResult = saveGitStashFn(undefined, message, writableOverride, { push, repoDir: primaryStashDir });
-                result.sync = {
-                    committed: syncResult.committed,
-                    pushed: syncResult.pushed,
-                    skipped: syncResult.skipped,
-                    ...(syncResult.reason !== undefined ? { reason: syncResult.reason } : {}),
-                };
-                appendEvent({
-                    eventType: "stash_synced",
-                    metadata: {
-                        committed: syncResult.committed,
-                        pushed: syncResult.pushed,
-                        skipped: syncResult.skipped,
-                        reason: syncResult.reason ?? null,
-                    },
-                }, eventsCtx);
-            }
-            catch (syncErr) {
-                const reason = syncErr instanceof Error ? syncErr.message : String(syncErr);
-                warn(`improve: end-of-run stash sync failed (non-fatal): ${reason}`);
-                result.sync = { committed: false, pushed: false, skipped: true, reason };
-                appendEvent({
-                    eventType: "stash_synced",
-                    metadata: { committed: false, pushed: false, skipped: true, reason },
-                }, eventsCtx);
-            }
-        }
+        // End-of-run BATCH auto-sync — the converged commit. Recognition is
+        // decoupled from the per-write path (see write-source.ts case-3): the primary
+        // stash writes as a filesystem source during the run, then is committed via
+        // the same `saveGitStash` that `akm sync` calls. The gating (git-backed
+        // primary stash, sync not disabled) and the NON-FATAL guarantee now live in
+        // `commitStashBatch` (#662); the inter-cycle and catch-path calls reuse it.
+        // dry-run already returned above, so this always runs on a completed live
+        // run. `result.sync` reflects this final commit (for a one-cycle run it is
+        // the only commit; for a multi-cycle run the earlier cycles were banked by
+        // the inter-cycle calls and this records the last batch). `result` carries
+        // the full `{accepted}`/`{refs}`/`{triage_*}` token data for the message.
+        result.sync = commitStashBatch(result);
         return result;
     }
     catch (err) {
@@ -1043,10 +826,17 @@ export async function akmImprove(options = {}) {
             eventType: "improve_failed",
             ref: scope.mode === "ref" ? scope.value : `improve:${scope.mode}:${scope.value ?? "all"}`,
             metadata: {
-                error: err instanceof Error ? err.message : String(err),
+                error: errMessage(err),
                 durationMs: Date.now() - startMs,
             },
         }, eventsCtx);
+        // #662 crash/abort safety net: commit whatever this run already wrote to the
+        // primary stash BEFORE rethrowing, so an interrupted run (mid-cycle crash or
+        // a cooperative budget abort that surfaces as a throw) does not leave its
+        // writes uncommitted until a later clean run sweeps them up. Best-effort —
+        // `commitStashBatch` swallows its own errors and no-ops a clean tree, so this
+        // never masks or supersedes the original failure being rethrown below.
+        commitStashBatch({ scope, plannedRefs, runId: options.runId });
         throw err;
     }
     finally {
@@ -1056,15 +846,18 @@ export async function akmImprove(options = {}) {
         // O-1 (#364): Clear the budget abort timer so it does not keep the event
         // loop alive after the run completes.
         clearBudgetTimer();
-        try {
-            fs.unlinkSync(resolvedLockPath);
+        // #607: release any per-process locks still held (backstop for error paths;
+        // the normal path already released each lock after its stage completed).
+        releaseAllProcessLocks();
+        // Drop ONLY our own process.exit backstop so it does not fire later (or
+        // accumulate across repeated in-process calls). Must NOT use
+        // removeAllListeners("exit") here: in the in-process model (tests and
+        // programmatic callers import cli.ts) that would silently destroy exit
+        // handlers owned by the host or other commands.
+        if (exitBackstop) {
+            process.removeListener("exit", exitBackstop);
+            exitBackstop = undefined;
         }
-        catch {
-            // ignore
-        }
-        // The normal path released the lock above; drop the process.exit backstop so
-        // it does not fire later (or accumulate across repeated in-process calls).
-        process.removeListener("exit", releaseLockOnExit);
         // I1: close the long-lived state.db connection opened at the top of the run.
         try {
             eventsDb?.close();
@@ -1091,7 +884,7 @@ function emitImproveCompletedEvent(result, durations, eventsCtx) {
     // Coarse audit buckets, derived from the SAME classifyImproveAction the
     // persisted metrics_json uses (state-db.ts#computeImproveRunMetrics) so the
     // emitted event and the stored row can never disagree.
-    const classCounts = { accepted: 0, rejected: 0, error: 0, noop: 0 };
+    const classCounts = { accepted: 0, rejected: 0, skipped: 0, error: 0, noop: 0 };
     for (const action of result.actions ?? []) {
         classCounts[classifyImproveAction(action.mode)] += 1;
         // Per-variant counters for the event metadata. The default arm makes any
@@ -1136,6 +929,13 @@ function emitImproveCompletedEvent(result, durations, eventsCtx) {
                 assertNever(action.mode);
         }
     }
+    // C1: distill-skipped rows are no longer in `result.actions` (folded into the
+    // bounded `distillSkipped` aggregate at assembly). Add the aggregate total to
+    // the per-variant counter AND the coarse `skipped` bucket so the emitted event
+    // still reports the true skipped volume.
+    const distillSkippedTotal = result.distillSkipped?.total ?? 0;
+    actionCounts.distillSkipped += distillSkippedTotal;
+    classCounts.skipped += distillSkippedTotal;
     appendEvent({
         eventType: "improve_completed",
         ref: result.scope.mode === "ref"
@@ -1158,6 +958,7 @@ function emitImproveCompletedEvent(result, durations, eventsCtx) {
             reflectGuardRejectedActions: actionCounts.reflectGuardRejected,
             acceptedActions: classCounts.accepted,
             rejectedActions: classCounts.rejected,
+            skippedActions: classCounts.skipped,
             noopActions: classCounts.noop,
             reflectsWithErrorContext: result.reflectsWithErrorContext ?? 0,
             coverageGapCount: result.coverageGaps?.length ?? 0,
@@ -1177,6 +978,11 @@ function emitImproveCompletedEvent(result, durations, eventsCtx) {
             memoryInferenceDurationMs: durations.memoryInferenceDurationMs,
             graphExtractionExtractedFiles: result.graphExtraction?.quality.extractedFiles ?? 0,
             graphExtractionDurationMs: durations.graphExtractionDurationMs,
+            // Layer-2 proactive-maintenance coverage (0 when the process is disabled
+            // or the run was ref-scoped) so a scheduled sweep's reach is trackable.
+            proactiveSelected: result.proactiveMaintenance?.selected ?? 0,
+            proactiveDueTotal: result.proactiveMaintenance?.dueTotal ?? 0,
+            proactiveNeverReflected: result.proactiveMaintenance?.neverReflected ?? 0,
             // New metrics for tuning the improve loop.
             ...(durations.totalDurationMs !== undefined ? { durationMs: durations.totalDurationMs } : {}),
             ...(durations.warningCount !== undefined ? { warningCount: durations.warningCount } : {}),
@@ -1191,1794 +997,6 @@ function emitImproveCompletedEvent(result, durations, eventsCtx) {
         },
     }, eventsCtx);
 }
-/**
- * Run (or gate-skip) the memory consolidation pass.
- *
- * #551 — two coordinated changes live here:
- *
- *   1. STRUCTURAL: this runs before extract in the improve pipeline (see
- *      `runImprovePreparationStage`). Consolidation therefore only ever judges
- *      PRIOR-run memories; current-run extract promotions are invisible to it.
- *
- *   2. SMARTER POOL-DELTA GATE: even among on-disk files, a memory whose only
- *      post-`lastConsolidateTs` mtime bump came from its OWN auto-accept
- *      promotion (i.e. it was just promoted by extract in the immediately
- *      preceding run and has not had a full improve cycle to settle) does NOT
- *      count as "work to do". We exclude those paths from the pool-delta check
- *      using the `promoted` events already emitted with each promotion's
- *      `assetPath`. A genuinely-settled prior memory — one edited by feedback,
- *      reflect, manual edit, or simply older than the last consolidate — still
- *      triggers the run. This is gate-option (a) from the issue (same-run /
- *      adjacent-run promotion exclusion), chosen over option (b) because there
- *      is no `extract_completed` event in the data model to gate against;
- *      `promoted` events with `assetPath` already carry exactly the signal we
- *      need, so the fix is non-invasive and provably correct.
- */
-async function runConsolidationPass(args) {
-    const { options, primaryStashDir, memorySummary, improveProfile, eventsCtx } = args;
-    const baseConfig = options.config ?? loadConfig();
-    const MEMORY_VOLUME_THRESHOLD = options.memoryVolumeConsolidationThreshold ?? 100;
-    const hasLlm = !!(baseConfig.defaults?.llm || baseConfig.defaults?.agent);
-    const volumeTriggered = typeof memorySummary.eligible === "number" && memorySummary.eligible > MEMORY_VOLUME_THRESHOLD && hasLlm;
-    // When volume triggers a consolidation pass, force-enable the consolidate
-    // process on the default improve profile so the gate accepts the run even
-    // if the user's config disabled it. We synthesise a new profile override
-    // rather than mutating connection settings.
-    const consolidationConfig = volumeTriggered
-        ? {
-            ...baseConfig,
-            profiles: {
-                ...(baseConfig.profiles ?? {}),
-                improve: {
-                    ...(baseConfig.profiles?.improve ?? {}),
-                    default: {
-                        ...(baseConfig.profiles?.improve?.default ?? {}),
-                        processes: {
-                            ...(baseConfig.profiles?.improve?.default?.processes ?? {}),
-                            consolidate: {
-                                ...(baseConfig.profiles?.improve?.default?.processes?.consolidate ?? {}),
-                                enabled: true,
-                            },
-                        },
-                    },
-                },
-            },
-        }
-        : baseConfig;
-    // 0.8.0 pool-delta gate for consolidate: re-eligible iff at least one
-    // memory file has been updated since the most recent successful
-    // consolidate_completed event. Time-based cooldowns produced the same
-    // synchronised-wave failure mode the reflect/distill cooldowns did; the
-    // pool-delta gate ties consolidation to actual work-to-do.
-    const recentConsolidations = readEvents({ type: "consolidate_completed" });
-    const lastConsolidation = recentConsolidations.events
-        .filter((e) => e.metadata?.processed && Number(e.metadata.processed) > 0)
-        .sort((a, b) => new Date(b.ts ?? 0).getTime() - new Date(a.ts ?? 0).getTime())[0];
-    const lastConsolidateTs = lastConsolidation?.ts;
-    // #551 smarter gate: build the set of memory asset paths whose only delta
-    // since the last consolidate is their OWN auto-accept promotion. Those files
-    // have not had a full improve cycle to settle, so they offer no merge /
-    // contradiction candidates yet — excluding them stops the gate firing on
-    // freshly-promoted single-source memories. We read `promoted` events emitted
-    // after the last consolidate; each carries the written `assetPath`.
-    const promotedSinceConsolidate = (() => {
-        const paths = new Set();
-        try {
-            const promoted = readEvents({
-                type: "promoted",
-                ...(lastConsolidateTs ? { since: lastConsolidateTs } : {}),
-            }).events;
-            for (const e of promoted) {
-                const ap = e.metadata?.assetPath;
-                if (typeof ap === "string" && ap.length > 0)
-                    paths.add(path.resolve(ap));
-            }
-        }
-        catch {
-            // best-effort: if the events query fails, fall back to no exclusions
-            // (preserves pre-#551 behaviour rather than over-skipping).
-        }
-        return paths;
-    })();
-    // Pool-delta: any memory file with mtime > lastConsolidateTs flags work to do,
-    // EXCEPT files whose only post-consolidate change was their own promotion.
-    // Using file mtime keeps this query DB-free and matches what the indexer
-    // already uses as the canonical `memory.updated_at` proxy.
-    //
-    // Bootstrap: when no successful consolidate_completed event has ever been
-    // recorded, we cannot evaluate the pool-delta — treat as eligible so a
-    // fresh stash runs consolidate once before the steady-state gate kicks in.
-    const memoryUpdatedAfterLastConsolidate = (() => {
-        if (volumeTriggered)
-            return true; // volume override forces the run regardless.
-        if (!lastConsolidateTs)
-            return true; // bootstrap path: never consolidated.
-        if (!primaryStashDir)
-            return false;
-        const memoriesDir = path.join(primaryStashDir, "memories");
-        if (!fs.existsSync(memoriesDir))
-            return false;
-        try {
-            return fs.readdirSync(memoriesDir).some((f) => {
-                if (!f.endsWith(".md"))
-                    return false;
-                const filePath = path.join(memoriesDir, f);
-                // #551: skip files that were only touched by their own promotion this
-                // cohort — they have no settled merge/contradiction candidates yet.
-                if (promotedSinceConsolidate.has(path.resolve(filePath)))
-                    return false;
-                try {
-                    return fs.statSync(filePath).mtime.toISOString() > lastConsolidateTs;
-                }
-                catch {
-                    return false;
-                }
-            });
-        }
-        catch {
-            return false;
-        }
-    })();
-    const consolidationOnCooldown = !volumeTriggered && !memoryUpdatedAfterLastConsolidate;
-    // Profile gate: if profile explicitly disables consolidate, skip the entire pass.
-    const consolidateDisabledByProfile = improveProfile?.processes?.consolidate?.enabled === false;
-    // #553 minPoolSize guard: skip consolidation when the eligible memory pool is
-    // below a minimum size, rather than spending an LLM pass on a handful of
-    // memories. This is an INDEPENDENT skip condition from #551's mtime pool-delta
-    // gate — either can skip. Default 500; `minPoolSize: 0` disables the guard.
-    // Evaluated against the eligible-pool count BEFORE entering the LLM loop so a
-    // skip costs ZERO LLM calls.
-    const CONSOLIDATE_DEFAULT_MIN_POOL_SIZE = 500;
-    const configuredMinPoolSize = improveProfile?.processes?.consolidate?.minPoolSize;
-    const minPoolSize = typeof configuredMinPoolSize === "number" ? configuredMinPoolSize : CONSOLIDATE_DEFAULT_MIN_POOL_SIZE;
-    const eligiblePoolSize = typeof memorySummary.eligible === "number" ? memorySummary.eligible : 0;
-    // volumeTriggered means the pool already exceeds the volume threshold (100),
-    // so a force-triggered run never trips the pool-size guard. The guard only
-    // engages when minPoolSize > 0 and the eligible pool is strictly below it.
-    const poolBelowMinSize = !volumeTriggered && minPoolSize > 0 && eligiblePoolSize < minPoolSize;
-    let consolidation = {
-        schemaVersion: 1,
-        ok: true,
-        shape: "consolidate-result",
-        dryRun: false,
-        previewOnly: false,
-        target: "",
-        processed: 0,
-        merged: 0,
-        deleted: 0,
-        promoted: [],
-        contradicted: 0,
-        warnings: [],
-        durationMs: 0,
-    };
-    let gateAutoAcceptedCount = 0;
-    let gateAutoAcceptFailedCount = 0;
-    const consolidateGateCfg = makeGateConfig("consolidate", {
-        globalThreshold: options.autoAccept,
-        dryRun: options.dryRun ?? false,
-        stashDir: primaryStashDir,
-        config: consolidationConfig,
-        eventsCtx,
-    }, { minimumThreshold: 95 });
-    if (consolidateDisabledByProfile) {
-        info("[improve] consolidation skipped (disabled by improve profile)");
-    }
-    else if (poolBelowMinSize) {
-        // #553: eligible pool below the configured minimum — skip with zero LLM
-        // calls. Reuse the #551 `improve_skipped` emission path so health surfaces
-        // it via the dynamic skipReasons aggregation under `pool_below_min_size`.
-        appendEvent({
-            eventType: "improve_skipped",
-            ref: "memory:_consolidation",
-            metadata: {
-                reason: "pool_below_min_size",
-                poolSize: eligiblePoolSize,
-                minPoolSize,
-            },
-        }, eventsCtx);
-        info(`[improve] consolidation skipped (pool ${eligiblePoolSize} < minPoolSize ${minPoolSize})`);
-    }
-    else if (!consolidationOnCooldown) {
-        consolidation = await withLlmStage("consolidate", () => akmConsolidate({
-            ...options.consolidateOptions,
-            config: consolidationConfig,
-            stashDir: options.stashDir,
-            autoTriggered: volumeTriggered,
-            // Tie consolidate proposals back to this improve invocation so
-            // accept-rate-per-run aggregation works. Mirrors reflect/propose/extract.
-            sourceRun: `consolidate-${Date.now()}`,
-            // Pass profile-configured options. incrementalSince narrows the pool to
-            // recently-changed memories + graph neighbours — use this for frequent
-            // passes (quick-shredder). Leave absent in the nightly default profile for
-            // a full-pool sweep that catches stale-but-unmerged duplicates.
-            incrementalSince: improveProfile?.processes?.consolidate?.incrementalSince,
-            limit: improveProfile?.processes?.consolidate?.limit,
-            neighborsPerChanged: improveProfile?.processes?.consolidate?.neighborsPerChanged,
-            maxChunkSize: improveProfile?.processes?.consolidate?.maxChunkSize,
-            // Honor profile.autoAccept (already merged into options.autoAccept at the
-            // top of akmImprove). The CLI parser always supplies 90 when --auto-accept
-            // is absent, so ?? 90 is not needed here and would prevent --auto-accept=false
-            // (which maps to undefined) from disabling consolidation auto-accept.
-            // options.consolidateOptions.autoAccept (if explicitly provided by caller)
-            // still wins because the spread above runs first.
-            autoAccept: options.consolidateOptions?.autoAccept ?? options.autoAccept,
-        }));
-        {
-            const consolidateGr = await runAutoAcceptGate(consolidation.promoted.map((proposalId) => {
-                try {
-                    if (!primaryStashDir)
-                        return { proposalId, confidence: undefined };
-                    const proposal = getProposal(primaryStashDir, proposalId);
-                    return { proposalId, confidence: proposal.confidence };
-                }
-                catch {
-                    return { proposalId, confidence: undefined };
-                }
-            }), consolidateGateCfg);
-            gateAutoAcceptedCount += consolidateGr.promoted.length;
-            gateAutoAcceptFailedCount += consolidateGr.failed.length;
-        }
-        if (consolidation.processed > 0) {
-            appendEvent({
-                eventType: "consolidate_completed",
-                ref: "memory:_consolidation",
-                metadata: { processed: consolidation.processed, merged: consolidation.merged },
-            }, eventsCtx);
-        }
-    }
-    else {
-        appendEvent({
-            eventType: "improve_skipped",
-            ref: "memory:_consolidation",
-            metadata: {
-                reason: "consolidation_no_memory_updates",
-                lastEventTs: lastConsolidation?.ts ?? null,
-            },
-        }, eventsCtx);
-        info("[improve] consolidation skipped (no memory updates since last run)");
-    }
-    // D9: track whether consolidation wrote any data so graph extraction can reindex if needed
-    const consolidationRan = !consolidateDisabledByProfile && !poolBelowMinSize && !consolidationOnCooldown && consolidation.processed > 0;
-    return { consolidation, consolidationRan, gateAutoAcceptedCount, gateAutoAcceptFailedCount };
-}
-async function runImprovePreparationStage(args) {
-    const { scope, options, plannedRefs, memoryCleanupPlan, primaryStashDir, memorySummary, reindexFn, startMs, budgetMs, eventsCtx, initialCleanupWarnings, improveProfile, } = args;
-    const actions = [];
-    const cleanupWarnings = initialCleanupWarnings ? [...initialCleanupWarnings] : [];
-    // Phase 0 — MEMORY.md budget check (200-line cap; warn at 180)
-    let memoryIndexHealth;
-    if (primaryStashDir) {
-        const memoryMdPath = path.join(primaryStashDir, "memories", "MEMORY.md");
-        if (fs.existsSync(memoryMdPath)) {
-            try {
-                const lines = fs.readFileSync(memoryMdPath, "utf8").split("\n").length;
-                const overBudget = lines >= 180;
-                memoryIndexHealth = { lineCount: lines, overBudget };
-                if (overBudget) {
-                    cleanupWarnings.push(`MEMORY.md has ${lines} lines (budget: 200). Consolidation strongly recommended.`);
-                }
-            }
-            catch {
-                // best-effort
-            }
-        }
-    }
-    // Phase 0.3 — memory consolidation pass (#551).
-    //
-    // Consolidation runs BEFORE the session-extract pass. This is the structural
-    // half of the #551 fix: extract auto-accept writes brand-new memory .md files
-    // on every run, which previously made the consolidation pool-delta gate fire
-    // unconditionally (any new file => "memory updated since last consolidate").
-    // By running consolidation first, the gate and akmConsolidate only ever see
-    // memories that existed at the start of the run — current-run extract
-    // promotions are not on disk yet. The complementary smarter-gate logic
-    // (excluding adjacent-run promotions) lives in `runConsolidationPass`.
-    const consolidationPass = await runConsolidationPass({
-        options,
-        primaryStashDir,
-        memorySummary,
-        improveProfile,
-        eventsCtx,
-    });
-    // Phase 0.4 — session-extract pass.
-    //
-    // Reads native session files (claude-code JSONL, opencode storage tree)
-    // through the SessionLogHarness registry, pre-filters noise, and asks a
-    // bounded in-tree LLM to produce candidate memory/lesson/knowledge
-    // proposals for content the agent did NOT preserve via inline `akm remember`
-    // / `akm feedback` invocations. Replaces the akm-plugin session-checkpoint
-    // hook with an on-demand pull pipeline.
-    //
-    // Default-on; opt out via the ACTIVE profile's `processes.extract.enabled: false`
-    // (#593: the gate respects the resolved improve profile, not just the
-    // hardcoded `default` profile path the legacy feature flag reads).
-    // Each available harness gets one call with the default --since window;
-    // already-seen sessions (tracked in state.db.extract_sessions_seen) are
-    // skipped automatically so re-runs don't burn LLM calls on unchanged data.
-    //
-    // Failures are non-fatal — one harness throwing doesn't abort improve.
-    // The extract envelope's own `warnings` field surfaces what went wrong.
-    let extractResults;
-    // Seed the preparation-stage gate counters with consolidation's auto-accept
-    // gate results (#551: consolidation now runs in this stage), then accumulate
-    // extract's gate results on top.
-    let gateAutoAcceptedCount = consolidationPass.gateAutoAcceptedCount;
-    let gateAutoAcceptFailedCount = consolidationPass.gateAutoAcceptFailedCount;
-    const extractConfig = options.config ?? loadConfig();
-    const extractGateCfg = makeGateConfig("extract", {
-        globalThreshold: options.autoAccept,
-        dryRun: options.dryRun ?? false,
-        stashDir: primaryStashDir,
-        config: extractConfig,
-        eventsCtx,
-    });
-    // #554 minNewSessions gate: skip the entire extract pass (ensureIndex was
-    // already done upstream; here we elide every akmExtract/processSession call)
-    // when the NEW (unseen, in-window) candidate-session pool is below a minimum.
-    // 22% of improve runs produce zero memory-inference writes because extract
-    // finds no new sessions, yet still burns the full extract pipeline. Default 0
-    // (disabled) preserves existing always-run behaviour; only opted-in profiles
-    // (e.g. `frequent`) set it. Evaluated BEFORE any LLM call so a skip costs zero
-    // LLM work AND writes nothing — which also means no extract auto-accept bumps
-    // memory mtimes, so a skipped extract never flags work for the NEXT run's
-    // consolidation mtime-gate (the downstream trigger #554 asks us to suppress).
-    const EXTRACT_DEFAULT_MIN_NEW_SESSIONS = 0;
-    const configuredMinNewSessions = extractConfig.profiles?.improve?.default?.processes?.extract?.minNewSessions;
-    const minNewSessions = typeof configuredMinNewSessions === "number" ? configuredMinNewSessions : EXTRACT_DEFAULT_MIN_NEW_SESSIONS;
-    // #593: gate on BOTH the legacy feature flag (which only reads
-    // `profiles.improve.default.processes.extract.enabled` — kept for back-compat
-    // with users who disable extract via the default-profile path) AND the active
-    // resolved profile. Without the second check a non-default profile setting
-    // `extract.enabled: false` (e.g. the built-in `quick`) was silently ignored
-    // and extract ran on every improve call regardless.
-    if (isLlmFeatureEnabled(extractConfig, "session_extraction") && resolveProcessEnabled("extract", improveProfile)) {
-        const availableHarnesses = options.extractHarnesses ?? getAvailableHarnesses();
-        // The guard engages only when minNewSessions > 0; 0 disables it entirely.
-        let belowMinNewSessions = false;
-        if (minNewSessions > 0 && availableHarnesses.length > 0) {
-            const countFn = options.extractCandidateCountFn ?? countNewExtractCandidates;
-            const newCandidateCount = countFn(extractConfig, {
-                ...(options.extractHarnesses ? { harnesses: options.extractHarnesses } : {}),
-                // C2: pin the candidate-count state.db open to the boundary-resolved path.
-                ...(eventsCtx?.dbPath ? { stateDbPath: eventsCtx.dbPath } : {}),
-            });
-            if (newCandidateCount < minNewSessions) {
-                belowMinNewSessions = true;
-                // Reuse the #551/#553 `improve_skipped` emission path so health's dynamic
-                // skipReasons aggregation surfaces this under `below_min_new_sessions`.
-                appendEvent({
-                    eventType: "improve_skipped",
-                    ref: "memory:_extract",
-                    metadata: {
-                        reason: "below_min_new_sessions",
-                        newSessions: newCandidateCount,
-                        minNewSessions,
-                    },
-                }, eventsCtx);
-                info(`[improve] extract skipped (new sessions ${newCandidateCount} < minNewSessions ${minNewSessions})`);
-            }
-        }
-        if (!belowMinNewSessions && availableHarnesses.length > 0) {
-            extractResults = [];
-            for (const h of availableHarnesses) {
-                try {
-                    const result = await withLlmStage("session-extraction", () => akmExtract({
-                        type: h.name,
-                        ...(primaryStashDir !== undefined ? { stashDir: primaryStashDir } : {}),
-                        config: extractConfig,
-                        dryRun: options.dryRun ?? false,
-                        ...(options.extractHarnesses ? { harnesses: options.extractHarnesses } : {}),
-                        // C2: pin extract's skip-tracking state.db open to the boundary path.
-                        ...(eventsCtx?.dbPath ? { stateDbPath: eventsCtx.dbPath } : {}),
-                    }));
-                    extractResults.push(result);
-                    {
-                        const gr = await runAutoAcceptGate(primaryStashDir
-                            ? result.proposals.map((proposalId) => {
-                                const proposal = getProposal(primaryStashDir, proposalId);
-                                return { proposalId, confidence: resolveExtractConfidence(proposal) };
-                            })
-                            : [], extractGateCfg);
-                        gateAutoAcceptedCount += gr.promoted.length;
-                        gateAutoAcceptFailedCount += gr.failed.length;
-                    }
-                }
-                catch (err) {
-                    const msg = err instanceof Error ? err.message : String(err);
-                    cleanupWarnings.push(`extract(${h.name}) failed: ${msg}`);
-                }
-            }
-            if (extractResults.length === 0) {
-                // All harnesses threw — clear so the envelope's `extract` field is
-                // absent rather than misleadingly empty.
-                extractResults = undefined;
-            }
-        }
-    }
-    // Backlog drain: gate any pending extract proposals that weren't created in
-    // this run (i.e. pre-date the gate or were produced by a run that timed out
-    // before the gate fired). Without this, eligible proposals accumulate
-    // indefinitely — the fresh-gate only covers the current run's output.
-    if (primaryStashDir && !options.dryRun && options.autoAccept !== undefined) {
-        const freshIds = new Set((extractResults ?? []).flatMap((r) => r.proposals));
-        const backlog = listProposals(primaryStashDir, { status: "pending" }).filter((p) => p.source === "extract" && !freshIds.has(p.id));
-        if (backlog.length > 0) {
-            const backlogCandidates = backlog.map((p) => ({
-                proposalId: p.id,
-                confidence: resolveExtractConfidence(p),
-            }));
-            const backlogGr = await runAutoAcceptGate(backlogCandidates, extractGateCfg);
-            gateAutoAcceptedCount += backlogGr.promoted.length;
-            gateAutoAcceptFailedCount += backlogGr.failed.length;
-        }
-    }
-    // eligibleCount = raw pre-filter count (before cooldown/signal/cleanup filters).
-    // improve_completed.plannedRefs = post-filter count of refs that actually entered the loop.
-    appendEvent({
-        eventType: "improve_invoked",
-        ref: scope.mode === "ref" ? scope.value : `improve:${scope.mode}:${scope.value ?? "all"}`,
-        metadata: { scope, dryRun: options.dryRun ?? false, eligibleCount: plannedRefs.length },
-    }, eventsCtx);
-    // ensureIndex now runs in akmImprove() BEFORE collectEligibleRefs so the
-    // eligible-ref query sees a populated `entries` table on the very first
-    // pass after a DB version upgrade (#339). Any failure messages from that
-    // earlier call were threaded in via args.initialCleanupWarnings.
-    let appliedCleanup;
-    try {
-        appliedCleanup =
-            primaryStashDir && memoryCleanupPlan ? applyMemoryCleanup(primaryStashDir, memoryCleanupPlan) : undefined;
-    }
-    catch (err) {
-        cleanupWarnings.push(`applyMemoryCleanup failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    const archivedRefs = appliedCleanup?.archived.map((record) => record.ref) ?? [];
-    const removed = new Set(archivedRefs);
-    const postCleanupRefs = archivedRefs.length === 0 ? plannedRefs : plannedRefs.filter((r) => !removed.has(r.ref));
-    // ── Phase 1: validation pass + schema repair (run on full postCleanupRefs) ──
-    // Identifies refs whose on-disk asset has structural problems. Validation
-    // failures are excluded from every downstream bucket. Run early so the
-    // cooldown partition operates on a clean set.
-    if (appliedCleanup) {
-        for (const candidate of memoryCleanupPlan?.pruneCandidates ?? []) {
-            const archived = appliedCleanup.archived.find((record) => record.ref === candidate.ref);
-            if (!archived)
-                continue;
-            actions.push({
-                ref: candidate.ref,
-                mode: "memory-prune",
-                result: { ok: true, pruned: true, reason: candidate.reason },
-            });
-        }
-        if ((appliedCleanup.archived.length > 0 || appliedCleanup.beliefStateTransitions.length > 0) && primaryStashDir) {
-            try {
-                await reindexFn({ stashDir: primaryStashDir });
-            }
-            catch (err) {
-                cleanupWarnings.push(`reindex after cleanup failed: ${err instanceof Error ? err.message : String(err)}`);
-            }
-        }
-    }
-    const validationFailures = [];
-    for (const candidate of postCleanupRefs) {
-        try {
-            // #591: use the path pre-resolved at planning time when it is still on
-            // disk — a serial async DB lookup per ref cost ~500 s on a 9 000-ref
-            // stash. Fall back to findAssetFilePath only for refs that bypassed
-            // collectEligibleRefs' index scan or whose file moved since planning.
-            const filePath = candidate.filePath && fs.existsSync(candidate.filePath)
-                ? candidate.filePath
-                : await findAssetFilePath(candidate.ref, options.stashDir);
-            if (!filePath) {
-                validationFailures.push({ ref: candidate.ref, reason: "file not found on disk" });
-                continue;
-            }
-            if (path.extname(filePath).toLowerCase() !== ".md") {
-                continue;
-            }
-            if (isLessonCandidate(candidate.ref)) {
-                const raw = fs.readFileSync(filePath, "utf8");
-                const fm = parseFrontmatter(raw).data;
-                if (!fm.description)
-                    validationFailures.push({ ref: candidate.ref, reason: "missing description" });
-            }
-        }
-        catch (e) {
-            validationFailures.push({ ref: candidate.ref, reason: String(e) });
-        }
-    }
-    if (validationFailures.length > 0) {
-        info(`[improve] ${validationFailures.length} assets have validation issues (will attempt schema repair):`);
-        for (const f of validationFailures)
-            info(`  ${f.ref}: ${f.reason}`);
-    }
-    let schemaRepairs = [];
-    let repairedRefs = new Set();
-    // Schema repair pass: attempt to fix validation failures via LLM before skipping.
-    if (validationFailures.length > 0 && options.repairValidationFailures !== false) {
-        const baseConfigForRepair = options.config ?? loadConfig();
-        const llmCfg = getDefaultLlmConfig(baseConfigForRepair);
-        if (llmCfg) {
-            const result = await runSchemaRepairPass(validationFailures, {
-                startMs,
-                budgetMs,
-                llmConfig: llmCfg,
-                stashDir: options.stashDir,
-                findFilePath: findAssetFilePath,
-                isLessonCandidateFn: isLessonCandidate,
-            });
-            schemaRepairs = result.repairs;
-            repairedRefs = result.repairedRefs;
-        }
-    }
-    const validationFailureRefs = new Set(validationFailures.filter((f) => !repairedRefs.has(f.ref)).map((f) => f.ref));
-    if (repairedRefs.size > 0) {
-        info(`[improve] schema repair fixed ${repairedRefs.size}/${validationFailures.length} validation failures; ${validationFailureRefs.size} remain`);
-    }
-    // Phase 0.5 — structural hygiene pass
-    let lintSummary;
-    if (primaryStashDir) {
-        try {
-            const lintResult = akmLint({ fix: true, dir: primaryStashDir });
-            lintSummary = { fixed: lintResult.summary.fixed, flagged: lintResult.summary.flagged };
-        }
-        catch {
-            // lint is best-effort; never block improve
-        }
-    }
-    // O-5 / #378: Per-originator rolling error windows.
-    // Reflexion (arXiv:2303.11366) warns that cross-task verbal critique
-    // contamination degrades below single-shot baseline. Each originator key
-    // ("schema-repair", "reflect") maintains its own rolling window so that
-    // schema-repair failures are not injected as avoidPatterns into reflect calls.
-    const recentErrors = {};
-    const RECENT_ERRORS_CAP = 3;
-    // Helper: push an error onto an originator's rolling window.
-    function pushRecentError(originator, msg) {
-        if (!recentErrors[originator])
-            recentErrors[originator] = [];
-        recentErrors[originator].push(msg);
-        if (recentErrors[originator].length > RECENT_ERRORS_CAP)
-            recentErrors[originator].shift();
-    }
-    // Seed schema-repair originator window from any schema-repair errors.
-    for (const repair of schemaRepairs) {
-        if (repair.outcome === "error") {
-            const errMsg = repair.error ?? `schema repair error: ${repair.reason}`;
-            pushRecentError("schema-repair", errMsg);
-        }
-    }
-    // ── Phase 2: signal-delta eligibility sets built EARLY ────────────────────
-    // 0.8.0 replaces the flat time-based cooldowns (which produced synchronised
-    // waves whenever many refs cooled at the same instant — see the 2026-05-26
-    // 54-ref simultaneous-reflect incident) with a *signal-delta* gate:
-    //
-    //   reflectEligible(ref) ≡ latestFeedbackTs(ref) > lastReflectProposalTs(ref)
-    //   distillEligible(ref) ≡ latestFeedbackTs(ref) > lastDistillProposalTs(ref)
-    //
-    // i.e. a ref is re-eligible iff new feedback has landed since the last
-    // proposal was generated for it. Stable content with no new signal stays
-    // out of the queue regardless of clock time; a sudden burst of feedback
-    // surfaces only the refs that the burst actually touches.
-    //
-    // The 30-day FEEDBACK_SIGNAL_WINDOW_DAYS bound still applies — only feedback
-    // events newer than that count as "current signal". Ancient one-off
-    // negatives don't permanently lock a ref into every run.
-    //
-    // High-retrieval refs (P0-A path) use a simpler "eligible once" rule: a
-    // ref with no feedback signal but retrievalCount ≥ threshold is eligible
-    // exactly once (no prior reflect proposal). Subsequent re-eligibility for
-    // those refs requires either a new feedback event (then the normal
-    // signal-delta gate applies) or human action. Documented limitation: this
-    // path does not re-fire on retrieval-count growth alone in 0.8.0; storing
-    // the retrieval count in proposal metadata for proper delta-tracking is
-    // captured as future work.
-    const FEEDBACK_SIGNAL_WINDOW_DAYS = 30;
-    const feedbackSinceCutoff = new Date(Date.now() - daysToMs(FEEDBACK_SIGNAL_WINDOW_DAYS)).toISOString();
-    // Build the three timestamp maps once across the entire postCleanupRefs set.
-    // Per-ref queries would be N+1 and the planner is already the hottest path
-    // in `akm improve`.
-    const candidateRefs = postCleanupRefs.filter((r) => !validationFailureRefs.has(r.ref)).map((r) => r.ref);
-    const latestFeedbackTs = buildLatestFeedbackTsMap(candidateRefs, feedbackSinceCutoff);
-    const lastReflectProposalTs = buildLatestProposalTsMap(candidateRefs, "reflect");
-    const lastDistillProposalTs = buildLatestProposalTsMap(candidateRefs, "distill");
-    // Refs the distill signal-delta gate rejected at planning time. The main
-    // loop reads this to skip distill for these refs without re-checking
-    // eligibility per iteration.
-    const distillCooledRefs = new Set();
-    const preCooldownCount = postCleanupRefs.length;
-    // ── Phase 3: partition postCleanupRefs by signal-delta eligibility ────────
-    // Three buckets (validation failures are excluded entirely):
-    //   eligibleRefs        — reflect signal-delta passes (full reflect+distill
-    //                         loop path; distill guard remains in the loop for
-    //                         refs that fail the distill signal-delta gate).
-    //   distillOnlyRefs     — reflect blocked but distill signal-delta passes
-    //                         AND ref is a distill candidate.
-    //   fullySkippedCount   — neither gate passes → synthetic skip action
-    //                         + improve_skipped event, excluded from sort.
-    const eligibleRefs = [];
-    const distillOnlyRefs = [];
-    let fullySkippedCount = 0;
-    // O-2 (#365): explicit --scope <ref> bypasses every gate (user intent wins).
-    const scopeRefBypass = scope.mode === "ref";
-    for (const r of postCleanupRefs) {
-        if (validationFailureRefs.has(r.ref))
-            continue;
-        if (scopeRefBypass) {
-            eligibleRefs.push(r);
-            continue;
-        }
-        const reflectOk = isSignalDeltaEligible(r.ref, latestFeedbackTs, lastReflectProposalTs);
-        const distillOk = isSignalDeltaEligible(r.ref, latestFeedbackTs, lastDistillProposalTs);
-        const isDistillCandidate = isDistillCandidateRef(r.ref, options.stashDir);
-        if (reflectOk) {
-            if (!distillOk && isDistillCandidate) {
-                // Reflect passes the gate, distill does not — emit the synthetic
-                // distill-skipped action and event up-front so the in-loop guard
-                // does not have to re-derive eligibility.
-                distillCooledRefs.add(r.ref);
-                actions.push({ ref: r.ref, mode: "distill-skipped", result: { ok: true, reason: "distill signal-delta" } });
-                appendEvent({
-                    eventType: "improve_skipped",
-                    ref: r.ref,
-                    metadata: { reason: "distill_no_new_signal" },
-                }, eventsCtx);
-            }
-            else if (!distillOk) {
-                // Not a distill candidate AND distill gate doesn't pass — just mark
-                // distillCooled so the loop's distill section is a no-op.
-                distillCooledRefs.add(r.ref);
-            }
-            eligibleRefs.push(r);
-        }
-        else if (distillOk && isDistillCandidate) {
-            // Reflect blocked but distill passes → distill-only bucket.
-            distillOnlyRefs.push(r);
-        }
-        else {
-            // Neither gate passes — fully skipped.
-            fullySkippedCount++;
-            actions.push({
-                ref: r.ref,
-                mode: "distill-skipped",
-                result: { ok: true, reason: "no new signal since last proposal" },
-            });
-            appendEvent({ eventType: "improve_skipped", ref: r.ref, metadata: { reason: "no_new_signal" } }, eventsCtx);
-        }
-    }
-    // ── Phase 4: signal/feedback/utility/sort on the reduced set ──────────────
-    // Everything from here works only on (eligibleRefs ∪ distillOnlyRefs). The
-    // fully-skipped bucket has already been routed and emitted; we deliberately
-    // avoid spending DB/CPU on refs that cannot enter the loop.
-    const processableRefs = [...eligibleRefs, ...distillOnlyRefs];
-    // Gap 6: only surface feedback signals from the last 30 days so that
-    // ancient one-off feedback events don't permanently lock an asset into
-    // every improve run. Assets with only stale signals fall through to the
-    // high-retrieval path (P0-A) or are skipped until new signals arrive.
-    // (FEEDBACK_SIGNAL_WINDOW_DAYS / feedbackSinceCutoff are already defined in
-    // Phase 2 above for the signal-delta gate; we reuse them here.)
-    // Pre-compute feedback summary per ref in a single pass so we don't issue
-    // two readEvents({type:"feedback", ref}) per asset (one for signal filtering,
-    // one for ratio computation).
-    const feedbackSummary = new Map();
-    for (const candidate of processableRefs) {
-        const { events } = readEvents({ type: "feedback", ref: candidate.ref });
-        let hasSignal = false;
-        let positive = 0;
-        let negative = 0;
-        for (const e of events) {
-            if (!hasSignal &&
-                (e.ts ?? "") >= feedbackSinceCutoff &&
-                e.metadata !== undefined &&
-                (typeof e.metadata.signal === "string" || typeof e.metadata.note === "string")) {
-                hasSignal = true;
-            }
-            if (e.metadata?.signal === "positive")
-                positive++;
-            else if (e.metadata?.signal === "negative")
-                negative++;
-        }
-        feedbackSummary.set(candidate.ref, { hasSignal, positive, negative });
-    }
-    const signalFiltered = processableRefs.filter((candidate) => feedbackSummary.get(candidate.ref)?.hasSignal === true);
-    // P0-A: also surface zero-feedback assets that have been retrieved many times.
-    const RETRIEVAL_COUNT_THRESHOLD = options.minRetrievalCount ?? 5;
-    const signalBearingSet = new Set(signalFiltered.map((r) => r.ref));
-    const noFeedbackCandidates = processableRefs.filter((r) => !signalBearingSet.has(r.ref));
-    let highRetrievalRefs = [];
-    let dbForRetrieval;
-    try {
-        dbForRetrieval = openExistingDatabase();
-        const showEventCount = countUsageEventsByType(dbForRetrieval, "show");
-        if (showEventCount === 0) {
-            warn("Warning: show events not yet in usage_events — zero-feedback fallback will match only search-retrieved assets.");
-        }
-        const retrievalCounts = getRetrievalCounts(dbForRetrieval, noFeedbackCandidates.map((r) => r.ref));
-        // High-retrieval signal-delta (simplified rule, 0.8.0): a no-feedback
-        // ref qualifies exactly once — when retrievalCount ≥ threshold AND no
-        // prior reflect proposal exists for it. Once a reflect proposal is on
-        // record, subsequent re-eligibility requires explicit feedback (which
-        // flows through the normal signal-delta gate above). Tracking growth in
-        // retrieval count would require persisting the count in proposal
-        // metadata; deferred to a follow-up.
-        highRetrievalRefs = noFeedbackCandidates.filter((r) => (retrievalCounts.get(r.ref) ?? 0) >= RETRIEVAL_COUNT_THRESHOLD && !lastReflectProposalTs.has(r.ref));
-    }
-    catch (err) {
-        rethrowIfTestIsolationError(err);
-        // best-effort: if DB unavailable, highRetrievalRefs stays empty
-    }
-    finally {
-        if (dbForRetrieval)
-            closeDatabase(dbForRetrieval);
-    }
-    // If the user explicitly scoped to a single ref, always act on it —
-    // skip the signal/retrieval filter entirely. The filter exists to avoid
-    // noisy "improve everything" runs; it should not gate an intentional
-    // per-ref invocation where the user's explicit choice is the signal.
-    //
-    // For type/all scope: only process refs with usage signals (recent feedback
-    // or sufficient retrievals). A stash with no signals has 0 eligible refs —
-    // usage is the gate. Run `akm feedback <ref> --positive` or retrieve assets
-    // to bring them into the eligible pool.
-    const signalAndRetrievalRefs = [...signalFiltered, ...highRetrievalRefs];
-    const mergedRefs = scope.mode === "ref" ? processableRefs : options.requireFeedbackSignal ? signalFiltered : signalAndRetrievalRefs;
-    const utilityMap = buildUtilityMap(mergedRefs);
-    // Load feedback ratio per ref from the pre-computed summary (no extra DB pass).
-    const feedbackRatios = new Map();
-    for (const ref of mergedRefs) {
-        const summary = feedbackSummary.get(ref.ref);
-        const positive = summary?.positive ?? 0;
-        const negative = summary?.negative ?? 0;
-        const total = positive + negative;
-        // ratio = negative proportion (high = needs more improvement)
-        feedbackRatios.set(ref.ref, total > 0 ? negative / total : 0);
-    }
-    // Sort: combine utility (desc) with feedback negativity (desc) — high-negative assets rank higher
-    const sorted = [...mergedRefs].sort((a, b) => {
-        const utilA = utilityMap.get(a.ref) ?? 0;
-        const utilB = utilityMap.get(b.ref) ?? 0;
-        const ratioA = feedbackRatios.get(a.ref) ?? 0;
-        const ratioB = feedbackRatios.get(b.ref) ?? 0;
-        // Combined score: 70% utility, 30% negative ratio
-        const scoreA = utilA * 0.7 + ratioA * 0.3;
-        const scoreB = utilB * 0.7 + ratioB * 0.3;
-        return scoreB - scoreA;
-    });
-    // Phase 0: surface coverage gaps from zero-result search queries
-    let coverageGaps = [];
-    try {
-        const dbForGaps = openExistingDatabase();
-        try {
-            coverageGaps = getZeroResultSearches(dbForGaps);
-        }
-        finally {
-            closeDatabase(dbForGaps);
-        }
-    }
-    catch (err) {
-        rethrowIfTestIsolationError(err);
-        // best-effort
-    }
-    // actionableRefs is the post-cooldown, post-validation, post-signal, post-sort
-    // set — i.e. the genuinely processable refs in priority order. Note: this is
-    // a semantic shift from earlier code where actionableRefs was the pre-cooldown
-    // sorted set; the new meaning matches reality and is documented on
-    // ImprovePreparationResult.actionableRefs.
-    //
-    // Final guard: drop any candidate whose backing file is no longer on disk.
-    // Phase 1 validation captures missing files at the start of preparation, but
-    // the gap between that check and dispatch can be minutes on large stashes —
-    // long enough for a checkpoint / git checkout / external cleanup to delete
-    // the asset. Empirically (improve-critical-review 2026-05-20) the single
-    // biggest reject category was "Asset no longer exists on disk" (604/1407 =
-    // 43%), meaning reflect/distill was producing proposals against deleted refs.
-    // A cheap existsSync per surviving candidate eliminates that wasted work.
-    const assetMissingOnDisk = [];
-    const existsCheckedActionable = [];
-    for (const candidate of sorted) {
-        // #591: prefer the path pre-resolved at planning time (synchronous
-        // existsSync) over a serial async DB lookup per ref.
-        const filePath = candidate.filePath && fs.existsSync(candidate.filePath)
-            ? candidate.filePath
-            : await findAssetFilePath(candidate.ref, options.stashDir);
-        if (filePath && fs.existsSync(filePath)) {
-            existsCheckedActionable.push(candidate);
-        }
-        else {
-            assetMissingOnDisk.push(candidate.ref);
-        }
-    }
-    // #592 audit: one summary event instead of one per missing ref. Normally
-    // tiny, but a stash deletion racing the run could make this O(n) sequential
-    // state.db writes. `refs` is capped so the metadata row stays bounded.
-    if (assetMissingOnDisk.length > 0) {
-        appendEvent({
-            eventType: "improve_skipped",
-            ref: undefined,
-            metadata: {
-                reason: "asset_missing_on_disk",
-                count: assetMissingOnDisk.length,
-                refs: assetMissingOnDisk.slice(0, 50),
-            },
-        }, eventsCtx);
-    }
-    const actionableRefs = existsCheckedActionable;
-    // Re-split actionableRefs (sorted) into reflect-path vs distill-only-path while
-    // preserving sort order. distillOnlyRefs participate in the sort so --limit
-    // picks them by score, not by arbitrary position.
-    const distillOnlyRefSetForSort = new Set(distillOnlyRefs.map((r) => r.ref));
-    const reflectAndDistillRefsAfterSort = [];
-    const distillOnlyRefsAfterSort = [];
-    for (const r of actionableRefs) {
-        if (distillOnlyRefSetForSort.has(r.ref)) {
-            distillOnlyRefsAfterSort.push(r);
-        }
-        else {
-            reflectAndDistillRefsAfterSort.push(r);
-        }
-    }
-    // ── Phase 5: --limit applies to the post-cooldown actionable set ──────────
-    const allLoopRefs = [...reflectAndDistillRefsAfterSort, ...distillOnlyRefsAfterSort];
-    const loopRefs = options.limit ? allLoopRefs.slice(0, options.limit) : allLoopRefs;
-    // Update the returned distillOnlyRefs to the sorted order so callers see the
-    // ranked view (loop stage uses it as a Set so order is irrelevant, but the
-    // shape change keeps downstream consumers consistent).
-    const distillOnlyRefsResult = distillOnlyRefsAfterSort;
-    const totalReflectBlocked = fullySkippedCount + distillOnlyRefs.length;
-    if (totalReflectBlocked > 0) {
-        info(`[improve] ${totalReflectBlocked} of ${preCooldownCount} indexed refs blocked by reflect signal-delta ` +
-            `(${fullySkippedCount} fully skipped, ${distillOnlyRefs.length} routed to distill-only)`);
-    }
-    if (signalAndRetrievalRefs.length > 0) {
-        info(`[improve] ${signalAndRetrievalRefs.length} refs with usage signals (${signalFiltered.length} feedback, ${highRetrievalRefs.length} high-retrieval)`);
-    }
-    if (validationFailureRefs.size > 0) {
-        info(`[improve] ${validationFailureRefs.size} with validation failures excluded`);
-    }
-    if (assetMissingOnDisk.length > 0) {
-        info(`[improve] ${assetMissingOnDisk.length} candidates dropped — file not on disk`);
-    }
-    const deferredCount = actionableRefs.length - loopRefs.length;
-    info(`[improve] ${actionableRefs.length} actionable; ${loopRefs.length} will be processed` +
-        (options.limit && deferredCount > 0 ? ` (--limit ${options.limit} applied; ${deferredCount} deferred)` : ""));
-    return {
-        actions,
-        cleanupWarnings,
-        appliedCleanup,
-        memoryIndexHealth,
-        extract: extractResults,
-        actionableRefs,
-        signalBearingSet,
-        validationFailures,
-        schemaRepairs,
-        lintSummary,
-        loopRefs,
-        distillCooledRefs,
-        distillOnlyRefs: distillOnlyRefsResult,
-        coverageGaps,
-        recentErrors,
-        utilityMap,
-        gateAutoAcceptedCount,
-        gateAutoAcceptFailedCount,
-        consolidation: consolidationPass.consolidation,
-        consolidationRan: consolidationPass.consolidationRan,
-    };
-}
-async function runImproveLoopStage(args) {
-    const { scope, options, primaryStashDir, reflectFn, distillFn, loopRefs, actions, signalBearingSet, distillCooledRefs, distillOnlyRefs, recentErrors, rejectedProposalsByRef, utilityMap, startMs, budgetMs, eventsCtx, improveProfile, } = args;
-    // O-1 (#364): compute remaining budget at call time so each sub-call
-    // receives only its fair share of the wall-clock budget.
-    const remainingBudgetMs = () => Math.max(0, budgetMs - (Date.now() - startMs));
-    const RECENT_ERRORS_CAP = 3;
-    // requirePlannedRefs guard: when the distill profile sets this flag, skip
-    // distill for distill-only refs if the reflect phase produced no planned refs.
-    // Prevents the distill loop from generating hundreds of distill-skipped events
-    // on quiet passes (all refs on reflect cooldown, no new signal to distill).
-    const requirePlannedRefs = improveProfile?.processes?.distill?.requirePlannedRefs === true;
-    const _distillOnlyRefNames = new Set(distillOnlyRefs.map((r) => r.ref));
-    const hasReflectEligibleRefs = loopRefs.some((r) => !_distillOnlyRefNames.has(r.ref));
-    const skipDistillDueToRequirePlannedRefs = requirePlannedRefs && !hasReflectEligibleRefs;
-    // R-2 / #389: Self-Consistency multi-sample voting helpers.
-    // Wang et al. arXiv:2203.11171 — N=3 samples beat single-shot on reasoning tasks.
-    const SC_THRESHOLD = options.selfConsistencyThreshold ?? 0.7;
-    const SC_N = Math.min(Math.max(2, options.selfConsistencyN ?? 3), 5);
-    /**
-     * Compute Jaccard token overlap between two strings.
-     * Tokenizes by whitespace; returns 0 when both are empty.
-     */
-    function jaccardSimilarity(a, b) {
-        const tokensA = new Set(a.split(/\s+/).filter(Boolean));
-        const tokensB = new Set(b.split(/\s+/).filter(Boolean));
-        if (tokensA.size === 0 && tokensB.size === 0)
-            return 1;
-        let intersection = 0;
-        for (const t of tokensA) {
-            if (tokensB.has(t))
-                intersection++;
-        }
-        const union = tokensA.size + tokensB.size - intersection;
-        return union > 0 ? intersection / union : 0;
-    }
-    /**
-     * Given N reflect results, return the one with the highest average Jaccard
-     * similarity to all other successful results (majority-vote winner).
-     * Falls back to the first successful result when N < 2.
-     */
-    function pickMajorityVote(results) {
-        const successful = results.filter((r) => r.ok);
-        if (successful.length === 0)
-            return (results[0] ?? {
-                schemaVersion: 1,
-                ok: false,
-                reason: "non_zero_exit",
-                error: "all samples failed",
-                exitCode: null,
-            });
-        if (successful.length === 1)
-            return successful[0];
-        let bestIdx = 0;
-        let bestScore = -1;
-        for (let i = 0; i < successful.length; i++) {
-            let totalSim = 0;
-            for (let j = 0; j < successful.length; j++) {
-                if (i === j)
-                    continue;
-                totalSim += jaccardSimilarity(successful[i].proposal.payload.content ?? "", successful[j].proposal.payload.content ?? "");
-            }
-            const avgSim = totalSim / (successful.length - 1);
-            if (avgSim > bestScore) {
-                bestScore = avgSim;
-                bestIdx = i;
-            }
-        }
-        return successful[bestIdx] ?? successful[0];
-    }
-    // O-5 / #378: helper to push per-originator errors into the rolling window.
-    function pushRecentError(originator, msg) {
-        if (!recentErrors[originator])
-            recentErrors[originator] = [];
-        recentErrors[originator].push(msg);
-        if (recentErrors[originator].length > RECENT_ERRORS_CAP)
-            recentErrors[originator].shift();
-    }
-    // Build a Set for O(1) membership test — these refs skip the reflect call (Bug D2).
-    const distillOnlyRefSet = new Set(distillOnlyRefs.map((r) => r.ref));
-    let completedCount = 0;
-    let reflectsWithErrorContext = 0;
-    const memoryRefsForInference = new Set();
-    // Pre-load all pending proposals once instead of querying per asset in the loop.
-    const dedupeStashDirForProposals = primaryStashDir ?? options.stashDir;
-    const pendingProposalRefSet = new Set(dedupeStashDirForProposals
-        ? listProposals(dedupeStashDirForProposals, { status: "pending" }).map((p) => p.ref)
-        : []);
-    let gateAutoAcceptedCount = 0;
-    let gateAutoAcceptFailedCount = 0;
-    const reflectGateCfg = makeGateConfig("reflect", {
-        globalThreshold: options.autoAccept,
-        dryRun: options.dryRun ?? false,
-        stashDir: primaryStashDir,
-        config: options.config ?? loadConfig(),
-        eventsCtx,
-    });
-    const distillGateCfg = makeGateConfig("distill", {
-        globalThreshold: options.autoAccept,
-        dryRun: options.dryRun ?? false,
-        stashDir: primaryStashDir,
-        config: options.config ?? loadConfig(),
-        eventsCtx,
-    });
-    for (const planned of loopRefs) {
-        if (Date.now() - startMs >= budgetMs) {
-            const remaining = loopRefs.length - completedCount;
-            info(`[improve] budget exhausted after ${Math.round((Date.now() - startMs) / 60000)}min — ${remaining} assets skipped`);
-            appendEvent({
-                eventType: "improve_skipped",
-                ref: planned.ref,
-                metadata: {
-                    reason: "budget_exhausted",
-                    remaining,
-                },
-            }, eventsCtx);
-            // B11: Emit improve_skipped for all remaining assets that will not be processed.
-            for (const remainingRef of loopRefs.slice(completedCount + 1)) {
-                appendEvent({
-                    eventType: "improve_skipped",
-                    ref: remainingRef.ref,
-                    metadata: { reason: "budget_exhausted_batch", remaining: loopRefs.length - completedCount - 1 },
-                }, eventsCtx);
-            }
-            actions.push({
-                ref: planned.ref,
-                mode: "error",
-                result: { ok: false, error: "timeout: improve wall-clock budget exhausted" },
-            });
-            break;
-        }
-        try {
-            // Bug D2: distillOnlyRefs skip the reflect call but still run the distill path.
-            // Bug D1: in-loop distill-cooldown check removed — distill-cooled candidates
-            //         have their synthetic actions emitted in runImprovePreparationStage.
-            const isDistillOnly = distillOnlyRefSet.has(planned.ref);
-            const parsedPlannedRef = parseAssetRef(planned.ref);
-            // B6: derived memories are machine-generated; skip reflect to avoid noisy proposals.
-            // shouldDistillMemoryRef already returns false for .derived refs, so the distill
-            // path is also a no-op for them — we just avoid unnecessary agent spawns.
-            // D2: distillOnlyRefs also skip the reflect call (reflect-cooled, distill path only).
-            if (!isDistillOnly && !planned.ref.endsWith(".derived")) {
-                // Type guard: skip reflect for unsupported types (script, env, task, etc.)
-                // and raw wiki directories, driven by the active improve profile.
-                const reflectSkip = shouldSkipRef(planned.ref, "reflect", improveProfile);
-                if (reflectSkip.skip) {
-                    actions.push({
-                        ref: planned.ref,
-                        mode: "reflect-skipped",
-                        result: { ok: true, reason: reflectSkip.reason },
-                    });
-                }
-                else {
-                    // O-5 / #378: only inject reflect-originator errors into the reflect call.
-                    // Cross-task errors (e.g. schema-repair) must NOT contaminate reflect prompts.
-                    const reflectErrors = recentErrors.reflect ?? [];
-                    if (reflectErrors.length > 0)
-                        reflectsWithErrorContext++;
-                    // O-1 (#364): pass remaining budget as timeoutMs so the agent spawn is
-                    // bounded by the wall-clock deadline rather than the default per-profile timeout.
-                    const reflectBudgetMs = remainingBudgetMs();
-                    // Wire profile.processes.reflect.{mode, profile, timeoutMs} into the reflect
-                    // dispatch when present. Falls back to akmReflect's own config-based resolution
-                    // (profiles.improve.<name>.processes.reflect → defaults.llm) when the profile
-                    // does not specify.
-                    const reflectProfileRunner = resolveImproveProcessRunnerFromProfile(improveProfile.processes?.reflect, options.config ?? loadConfig());
-                    const reflectCallArgs = {
-                        ref: planned.ref,
-                        task: options.task,
-                        ...(options.stashDir ? { stashDir: options.stashDir } : {}),
-                        ...(reflectErrors.length > 0 ? { avoidPatterns: [...reflectErrors] } : {}),
-                        agentProcess: options.agentProcess ?? "reflect",
-                        eventSource: "improve",
-                        ...(reflectBudgetMs > 0 ? { timeoutMs: reflectBudgetMs } : {}),
-                        ...(reflectProfileRunner ? { runner: reflectProfileRunner } : {}),
-                    };
-                    // R-2 / #389: Self-consistency multi-sample voting for high-utility refs.
-                    // Self-Consistency arXiv:2203.11171 — N=3 samples beat single-shot quality.
-                    const refUtility = utilityMap.get(planned.ref) ?? 0;
-                    const useConsistency = refUtility >= SC_THRESHOLD && SC_N >= 2;
-                    let reflectResult;
-                    if (useConsistency) {
-                        const samples = [];
-                        for (let s = 0; s < SC_N; s++) {
-                            if (remainingBudgetMs() <= 0)
-                                break;
-                            // draftMode: skip DB write so each sample doesn't create a proposal.
-                            samples.push(await withLlmStage("reflect", () => reflectFn({ ...reflectCallArgs, draftMode: true })));
-                        }
-                        const winner = pickMajorityVote(samples.length > 0
-                            ? samples
-                            : [await withLlmStage("reflect", () => reflectFn({ ...reflectCallArgs, draftMode: true }))]);
-                        // Persist only the majority-vote winner as a single real proposal.
-                        if (winner.ok && primaryStashDir) {
-                            const persistResult = createProposal(primaryStashDir, {
-                                ref: winner.proposal.ref,
-                                source: "reflect",
-                                sourceRun: `reflect-sc-${Date.now()}`,
-                                payload: winner.proposal.payload,
-                            });
-                            reflectResult = isProposalSkipped(persistResult)
-                                ? {
-                                    schemaVersion: 1,
-                                    ok: false,
-                                    reason: "cooldown",
-                                    error: `SC proposal skipped: ${persistResult.message}`,
-                                    ref: winner.ref,
-                                    exitCode: null,
-                                }
-                                : { ...winner, proposal: persistResult };
-                        }
-                        else {
-                            reflectResult = winner;
-                        }
-                    }
-                    else {
-                        reflectResult = await withLlmStage("reflect", () => reflectFn(reflectCallArgs));
-                    }
-                    const isCooldown = !reflectResult.ok && reflectResult.reason === "cooldown";
-                    // Content-policy guard hits (reflect size-rail rejections) are NOT
-                    // LLM faults — the agent responded fine, the downstream guard
-                    // blocked the output. Route them to a distinct `reflect-guard-rejected`
-                    // mode so health metrics can split deterministic guard hits out of
-                    // true LLM failures. See
-                    // `/tmp/akm-health-investigations/metrics-taxonomy-review.md` §1a.
-                    const isGuardReject = !reflectResult.ok && reflectResult.reason === "content_policy_reject";
-                    // Type-guard rejection (reflect refused a script/env/task ref) is
-                    // also NOT an LLM failure — the LLM is never invoked. Route to the
-                    // existing `reflect-skipped` bucket so it does not inflate the
-                    // failure-rate numerator. ~9% of `reflect-failed` events in the
-                    // user's stack were this case; see review §1a row "Reflect refused
-                    // asset type".
-                    const isTypeRefused = !reflectResult.ok && reflectResult.reason === "unsupported_type";
-                    // Noise-gate suppression (#580): the candidate edit was an empty
-                    // diff or a cosmetic-only reformat of the current asset. Like
-                    // `unsupported_type`, this is a deterministic skip — not an LLM
-                    // fault — so it routes to the `reflect-skipped` bucket and stays
-                    // out of recentErrors/avoidPatterns.
-                    const isNoChange = !reflectResult.ok && reflectResult.reason === "no_change";
-                    actions.push({
-                        ref: planned.ref,
-                        mode: reflectResult.ok
-                            ? "reflect"
-                            : isCooldown
-                                ? "reflect-cooldown"
-                                : isGuardReject
-                                    ? "reflect-guard-rejected"
-                                    : isTypeRefused || isNoChange
-                                        ? "reflect-skipped"
-                                        : "reflect-failed",
-                        result: reflectResult,
-                    });
-                    // Cooldown skips, guard rejects, type-refused skips, and noise-gate
-                    // skips are not failures — do not pollute recentErrors with them
-                    // (those get injected as `avoidPatterns` into the next reflect
-                    // prompt). Guard rejects ARE worth showing the LLM as a learn-signal
-                    // so the next iteration sees "your last expansion was too large";
-                    // type-refused and no-change are deterministic and add no learning
-                    // signal.
-                    if (!reflectResult.ok && !isCooldown && !isTypeRefused && !isNoChange) {
-                        const errMsg = reflectResult.error ?? reflectResult.reason ?? "unknown reflect error";
-                        pushRecentError("reflect", errMsg);
-                    }
-                    // improve_reflect_outcome — per-asset metric for tuning the reflect path.
-                    appendEvent({
-                        eventType: "improve_reflect_outcome",
-                        ref: planned.ref,
-                        metadata: {
-                            ok: reflectResult.ok,
-                            durationMs: reflectResult.ok ? reflectResult.durationMs : undefined,
-                            agentProfile: reflectResult.ok ? reflectResult.agentProfile : undefined,
-                            reason: reflectResult.ok ? undefined : reflectResult.reason,
-                        },
-                    }, eventsCtx);
-                    if (reflectResult.ok) {
-                        const reflectGr = await runAutoAcceptGate([{ proposalId: reflectResult.proposal.id, confidence: reflectResult.proposal.confidence }], reflectGateCfg);
-                        gateAutoAcceptedCount += reflectGr.promoted.length;
-                        gateAutoAcceptFailedCount += reflectGr.failed.length;
-                    }
-                } // end else (reflect type/profile check)
-            }
-            else if (!isDistillOnly && planned.ref.endsWith(".derived")) {
-                // B6: .derived refs skip reflect; record synthetic skip action.
-                actions.push({
-                    ref: planned.ref,
-                    mode: "distill-skipped",
-                    result: { ok: true, reason: "derived-memory-reflect-skipped" },
-                });
-                appendEvent({
-                    eventType: "improve_skipped",
-                    ref: planned.ref,
-                    metadata: { reason: "derived_memory_reflect_skipped" },
-                }, eventsCtx);
-            }
-            // isDistillOnly refs: no reflect action emitted — proceed directly to distill path below.
-            const hasRecentFeedbackSignal = signalBearingSet.has(planned.ref);
-            const explicitRefScope = scope.mode === "ref";
-            // Profile gate: apply the full type-filter / raw-wiki / disabled rules to
-            // distill so callers who configure `profile.processes.distill.allowedTypes`
-            // or land on raw-wiki refs get a recorded skip action instead of silently
-            // proceeding.
-            const distillSkip = shouldSkipRef(planned.ref, "distill", improveProfile);
-            if (distillSkip.skip) {
-                actions.push({
-                    ref: planned.ref,
-                    mode: "distill-skipped",
-                    result: { ok: true, reason: distillSkip.reason },
-                });
-                completedCount++;
-                info(`[improve] ${completedCount}/${loopRefs.length} ${planned.ref}`);
-                continue;
-            }
-            // requirePlannedRefs guard: skip distill for distill-only refs when no
-            // reflect-eligible refs were planned this run, preventing mass skip events.
-            if (skipDistillDueToRequirePlannedRefs && isDistillOnly) {
-                actions.push({
-                    ref: planned.ref,
-                    mode: "distill-skipped",
-                    result: { ok: true, reason: "require_planned_refs" },
-                });
-                completedCount++;
-                info(`[improve] ${completedCount}/${loopRefs.length} ${planned.ref}`);
-                continue;
-            }
-            // See `isDistillCandidateRef` — excludes `lesson:*` (and anything else in
-            // DISTILL_REFUSED_INPUT_TYPES) so distill never gets queued for an input
-            // it will refuse.
-            const shouldAttemptDistill = isDistillCandidateRef(planned.ref, options.stashDir);
-            const skipMemoryDistillForWeakSignal = !isDistillOnly && parsedPlannedRef.type === "memory" && !hasRecentFeedbackSignal && !explicitRefScope;
-            // distillCooledRefs guard: pre-filter emitted synthetic actions for distill-candidate
-            // refs; non-candidate refs in the set are blocked here.
-            // O-2 (#365): bypass the distill cooldown when the user explicitly targeted
-            // this ref via --scope — their intent overrides unattended-run policies.
-            if (shouldAttemptDistill &&
-                !skipMemoryDistillForWeakSignal &&
-                (!distillCooledRefs.has(planned.ref) || explicitRefScope)) {
-                // TODO(refactor): single call site needs both lesson+knowledge refs for proposal dedup. If a third target ref type is added, extract deriveAllTargetRefs(inputRef): string[].
-                const lessonRef = deriveLessonRef(planned.ref);
-                const knowledgeRef = deriveKnowledgeRef(planned.ref);
-                const dedupeStashDir = primaryStashDir ?? options.stashDir;
-                if (dedupeStashDir) {
-                    // B2: check both lesson ref and knowledge ref since auto-promoted memories
-                    // create knowledge: proposals, not lesson: proposals.
-                    const hasExistingPending = pendingProposalRefSet.has(lessonRef) || pendingProposalRefSet.has(knowledgeRef);
-                    if (hasExistingPending) {
-                        actions.push({
-                            ref: planned.ref,
-                            mode: "distill-skipped",
-                            result: { ok: true, reason: "pending proposal exists" },
-                        });
-                        appendEvent({
-                            eventType: "improve_skipped",
-                            ref: planned.ref,
-                            metadata: { reason: "pending_proposal_exists" },
-                        }, eventsCtx);
-                        completedCount++;
-                        info(`[improve] ${completedCount}/${loopRefs.length} ${planned.ref}`);
-                        continue;
-                    }
-                    // D-2 (#370): reject-aware cooldown for distill. When the reviewer
-                    // recently rejected a distilled lesson or knowledge proposal for this
-                    // asset, skip re-distillation for a 1-day grace window. Prevents the
-                    // same rejected proposal from being regenerated immediately. The
-                    // window is fixed (the 0.8.0 redesign moved per-ref cooldowns to
-                    // signal-delta gates and dropped --distill-cooldown-days; a short
-                    // reject grace is preserved here so a fresh rejection isn't
-                    // overridden by the same run).
-                    // References: ExpeL arXiv:2308.10144, STaR arXiv:2203.14465.
-                    const DISTILL_REJECT_COOLDOWN_MS = daysToMs(1);
-                    const recentlyRejectedLesson = !explicitRefScope && // O-2: bypass when --scope <ref> is explicit
-                        (rejectedProposalsByRef.has(lessonRef) || rejectedProposalsByRef.has(knowledgeRef));
-                    if (recentlyRejectedLesson) {
-                        const rejectedEntry = rejectedProposalsByRef.get(lessonRef) ?? rejectedProposalsByRef.get(knowledgeRef);
-                        const rejectedAgeMs = rejectedEntry ? Date.now() - new Date(rejectedEntry.ts).getTime() : 0;
-                        if (rejectedAgeMs < DISTILL_REJECT_COOLDOWN_MS) {
-                            actions.push({
-                                ref: planned.ref,
-                                mode: "distill-skipped",
-                                result: { ok: true, reason: "distill reject grace window" },
-                            });
-                            appendEvent({
-                                eventType: "improve_skipped",
-                                ref: planned.ref,
-                                metadata: {
-                                    reason: "distill_reject_grace_window",
-                                },
-                            }, eventsCtx);
-                            completedCount++;
-                            info(`[improve] ${completedCount}/${loopRefs.length} ${planned.ref}`);
-                            continue;
-                        }
-                    }
-                }
-                const distillResult = await withLlmStage("distill", () => distillFn({
-                    ref: planned.ref,
-                    ...(parsedPlannedRef.type === "memory" ? { proposalKind: "auto" } : {}),
-                    ...(options.stashDir ? { stashDir: options.stashDir } : {}),
-                }));
-                actions.push({ ref: planned.ref, mode: "distill", result: distillResult });
-                if (distillResult.outcome === "queued" && distillResult.proposal) {
-                    const distillGr = await runAutoAcceptGate([{ proposalId: distillResult.proposal.id, confidence: distillResult.proposal.confidence }], distillGateCfg);
-                    gateAutoAcceptedCount += distillGr.promoted.length;
-                    gateAutoAcceptFailedCount += distillGr.failed.length;
-                }
-                if (parsedPlannedRef.type === "memory") {
-                    const promotedToKnowledge = distillResult.outcome === "queued" && distillResult.proposalKind === "knowledge";
-                    if (!promotedToKnowledge)
-                        memoryRefsForInference.add(planned.ref);
-                }
-                if (distillResult.outcome === "quality_rejected" && primaryStashDir) {
-                    const slug = planned.ref
-                        .replace(/[^a-z0-9]/gi, "-")
-                        .toLowerCase()
-                        .slice(0, 60);
-                    writeEvalCase(primaryStashDir, {
-                        ref: planned.ref,
-                        failureReason: distillResult.reason ?? "quality gate rejected",
-                        assetType: parseAssetRef(planned.ref).type ?? "unknown",
-                        rejectedAt: Date.now(),
-                        source: "distill_quality_rejected",
-                        slug: `${slug}-${Date.now()}`,
-                    });
-                }
-                // D6: use pre-loaded map instead of per-iteration DB query
-                const rejectedProposalEvent = rejectedProposalsByRef.get(planned.ref);
-                if (rejectedProposalEvent && primaryStashDir) {
-                    const slug = planned.ref
-                        .replace(/[^a-z0-9]/gi, "-")
-                        .toLowerCase()
-                        .slice(0, 60);
-                    writeEvalCase(primaryStashDir, {
-                        ref: planned.ref,
-                        failureReason: rejectedProposalEvent.metadata?.reason ?? "proposal rejected",
-                        assetType: parseAssetRef(planned.ref).type ?? "unknown",
-                        rejectedAt: new Date(rejectedProposalEvent.ts).getTime(),
-                        source: "proposal_rejected",
-                        slug: `${slug}-rejected`,
-                    });
-                }
-            }
-            else if (skipMemoryDistillForWeakSignal) {
-                actions.push({
-                    ref: planned.ref,
-                    mode: "distill-skipped",
-                    result: { ok: true, reason: "memory requires recent feedback signal" },
-                });
-                appendEvent({
-                    eventType: "improve_skipped",
-                    ref: planned.ref,
-                    metadata: { reason: "memory_distill_requires_feedback" },
-                }, eventsCtx);
-            }
-        }
-        catch (err) {
-            // B7: UsageError thrown by akmDistill on validation_failed should be recorded
-            // as mode:"distill" with outcome:"validation_failed", NOT as a generic error.
-            // The distill_invoked event was already emitted inside akmDistill before the throw.
-            if (err instanceof UsageError) {
-                actions.push({
-                    ref: planned.ref,
-                    mode: "distill",
-                    result: { ok: false, outcome: "validation_failed", error: err.message },
-                });
-            }
-            else {
-                actions.push({
-                    ref: planned.ref,
-                    mode: "error",
-                    result: { ok: false, error: err instanceof Error ? err.message : String(err) },
-                });
-            }
-        }
-        completedCount++;
-        info(`[improve] ${completedCount}/${loopRefs.length} ${planned.ref}`);
-    }
-    return { reflectsWithErrorContext, memoryRefsForInference, gateAutoAcceptedCount, gateAutoAcceptFailedCount };
-}
-async function runImprovePostLoopStage(args) {
-    const { scope, options, primaryStashDir, actionableRefs, appliedCleanup, cleanupWarnings, memoryRefsForInference, reindexFn, eventsCtx, budgetSignal, improveProfile, consolidationRan, } = args;
-    const allWarnings = [...cleanupWarnings, ...(appliedCleanup?.warnings ?? [])];
-    info("[improve] post-loop maintenance starting");
-    const maintenanceResult = await runImproveMaintenancePasses({
-        options,
-        primaryStashDir,
-        actionableRefs,
-        memoryRefsForInference,
-        allWarnings,
-        reindexFn,
-        consolidationRan,
-        // O-1 (#364): forward the budget signal to memory inference + graph extraction.
-        budgetSignal,
-        eventsCtx,
-        improveProfile,
-    });
-    let deadUrls;
-    if (scope.mode === "all" && primaryStashDir && actionableRefs.length > 0) {
-        try {
-            const knowledgeEntries = actionableRefs
-                .filter((r) => {
-                try {
-                    return parseAssetRef(r.ref).type === "knowledge";
-                }
-                catch {
-                    return false;
-                }
-            })
-                .slice(0, 10)
-                .map((r) => ({ ref: r.ref, body: "" }));
-            if (knowledgeEntries.length > 0) {
-                info(`[improve] checking URLs in ${knowledgeEntries.length} knowledge refs`);
-                deadUrls = await checkDeadUrls(primaryStashDir, knowledgeEntries);
-                info(`[improve] URL check complete (${deadUrls.length} dead/timeout URLs)`);
-            }
-        }
-        catch {
-            // best-effort
-        }
-    }
-    return {
-        allWarnings,
-        deadUrls,
-        ...(maintenanceResult.memoryInference ? { memoryInference: maintenanceResult.memoryInference } : {}),
-        ...(maintenanceResult.graphExtraction ? { graphExtraction: maintenanceResult.graphExtraction } : {}),
-        ...(maintenanceResult.stalenessDetection ? { stalenessDetection: maintenanceResult.stalenessDetection } : {}),
-        ...(maintenanceResult.actions && maintenanceResult.actions.length > 0
-            ? { maintenanceActions: maintenanceResult.actions }
-            : {}),
-        memoryInferenceDurationMs: maintenanceResult.memoryInferenceDurationMs,
-        graphExtractionDurationMs: maintenanceResult.graphExtractionDurationMs,
-        orphansPurged: maintenanceResult.orphansPurged,
-        proposalsExpired: maintenanceResult.proposalsExpired,
-        // Consolidation's auto-accept gate counts now accrue in the preparation
-        // stage (#551); post-loop no longer runs an auto-accept gate of its own.
-        gateAutoAcceptedCount: 0,
-        gateAutoAcceptFailedCount: 0,
-    };
-}
-// TODO(refactor): mutates the passed-in `allWarnings` array as a hidden side channel. Return warnings in ImproveMaintenanceResult and merge in caller — invasive signature change deferred to next refactor pass.
-// Exported for tests (#584/#585 DB-locking regression coverage); production
-// callers reach it only through akmImprove → runImprovePostLoopStage.
-export async function runImproveMaintenancePasses(args) {
-    const { options, primaryStashDir, memoryRefsForInference, allWarnings, reindexFn, consolidationRan, budgetSignal, eventsCtx, improveProfile, } = args;
-    if (!primaryStashDir)
-        return { memoryInferenceDurationMs: 0, graphExtractionDurationMs: 0 };
-    const config = options.config ?? loadConfig();
-    const sources = resolveSourceEntries(options.stashDir, config);
-    const memoryInferenceFn = options.memoryInferenceFn ?? runMemoryInferencePass;
-    const graphExtractionFn = options.graphExtractionFn ?? runGraphExtractionPass;
-    const stalenessDetectionFn = options.stalenessDetectionFn ?? runStalenessDetectionPass;
-    let db;
-    let memoryInference;
-    let graphExtraction;
-    let stalenessDetection;
-    let reindexedAfterInference = false;
-    const actions = [];
-    let memoryInferenceDurationMs = 0;
-    let graphExtractionDurationMs = 0;
-    let orphansPurged = 0;
-    let proposalsExpired = 0;
-    const openIndexDb = () => openDatabase(getDbPath(), config.embedding?.dimension ? { embeddingDim: config.embedding.dimension } : undefined);
-    // #584: reindexFn opens its own write handle on the same index.db WAL file.
-    // Holding our handle across that call produced SQLITE_BUSY / "database is
-    // locked" failures in production, so the handle is closed BEFORE every
-    // reindex and reopened after — the fresh handle also sees the post-reindex
-    // state that graph extraction and staleness detection below rely on. The
-    // reopen runs in `finally` so a failed reindex still leaves a usable handle.
-    const reindexWithIndexDbReleased = async (stashDir) => {
-        if (db) {
-            closeDatabase(db);
-            db = undefined;
-        }
-        try {
-            await reindexFn({ stashDir });
-        }
-        finally {
-            db = openIndexDb();
-        }
-    };
-    try {
-        db = openIndexDb();
-        // Memory inference candidate-discovery (post-Item 9 fix from
-        // memory:akm-improve-critical-review-2026-05-20). Previously this pass
-        // was gated on memoryRefsForInference.size > 0 AND passed those refs as a
-        // candidateRefs filter. But memoryRefsForInference is populated from refs
-        // distilled THIS RUN — by the time that happens, those parents are
-        // already split (`inferenceProcessed: true`) and `isPendingMemory` excludes
-        // them. The genuinely-pending parents in the stash never entered the
-        // filter. Result: 0/0/0 for 25 consecutive runs.
-        //
-        // Fix: always run the pass when the feature is enabled; let the pass's
-        // own `collectPendingMemories` + `isPendingMemory` predicate find
-        // candidates from the filesystem-of-truth. The this-run set is still
-        // logged as a hint but no longer used as a filter.
-        const memoryInferenceDisabledByProfile = improveProfile?.processes?.memoryInference?.enabled === false;
-        const minPendingCount = improveProfile?.processes?.memoryInference?.minPendingCount;
-        const pendingBelowMinCount = (() => {
-            if (!primaryStashDir || minPendingCount === undefined || minPendingCount <= 0)
-                return false;
-            const pending = collectPendingMemories(primaryStashDir).length;
-            if (pending < minPendingCount) {
-                info(`[improve] memory inference skipped (${pending} pending < minPendingCount ${minPendingCount})`);
-                return true;
-            }
-            return false;
-        })();
-        if (memoryInferenceDisabledByProfile) {
-            info("[improve] memory inference skipped (disabled by improve profile)");
-        }
-        else if (pendingBelowMinCount) {
-            // skipped — message already emitted above
-        }
-        else {
-            const hintRefs = memoryRefsForInference.size;
-            info(hintRefs > 0
-                ? `[improve] memory inference starting (${hintRefs} hint refs touched this run; pass discovers all pending)`
-                : "[improve] memory inference starting (discovering pending parents)");
-            const inferenceStart = Date.now();
-            try {
-                // O-1 (#364): pass budget signal so a hung inference call is cancelled.
-                memoryInference = await withLlmStage("memory-inference", () => memoryInferenceFn({
-                    config,
-                    sources,
-                    signal: budgetSignal,
-                    db,
-                    reEnrich: false,
-                    onProgress: (event) => {
-                        const current = event.currentRef ? ` ${event.currentRef}` : "";
-                        info(`[improve] memory inference ${event.processed}/${event.total}${current} (written ${event.writtenFacts}, skipped ${event.skippedNoFacts})`);
-                    },
-                }));
-                memoryInferenceDurationMs = Date.now() - inferenceStart;
-                actions.push({ ref: "memory:_inference", mode: "memory-inference", result: memoryInference });
-                info(`[improve] memory inference complete (${memoryInference.writtenFacts} facts written from ${memoryInference.splitParents} parents)`);
-            }
-            catch (err) {
-                memoryInferenceDurationMs = Date.now() - inferenceStart;
-                allWarnings.push(`memory inference failed: ${err instanceof Error ? err.message : String(err)}`);
-            }
-        }
-        if (memoryInference && (memoryInference.splitParents > 0 || memoryInference.writtenFacts > 0)) {
-            info("[improve] reindexing after memory inference writes");
-            try {
-                await reindexWithIndexDbReleased(primaryStashDir);
-                reindexedAfterInference = true;
-                info("[improve] reindex after memory inference complete");
-            }
-            catch (err) {
-                allWarnings.push(`reindex after memory inference failed: ${err instanceof Error ? err.message : String(err)}`);
-            }
-        }
-        const graphEnabled = isProcessEnabled("index", "graph_extraction", config);
-        const graphExtractionDisabledByProfile = improveProfile?.processes?.graphExtraction?.enabled === false;
-        const graphExtractionFullScan = improveProfile?.processes?.graphExtraction?.fullScan === true;
-        // Build the set of refs actually touched this run.
-        const touchedRefs = new Set();
-        for (const r of args.actionableRefs)
-            touchedRefs.add(r.ref);
-        for (const r of memoryRefsForInference)
-            touchedRefs.add(r);
-        // INVARIANT: graph extraction normally runs only on files touched by
-        // actionable refs (candidatePaths). Full-corpus scans are opt-in via
-        // profile.processes.graphExtraction.fullScan = true (used by the
-        // `graph-refresh` built-in profile and its weekly scheduled task).
-        // The empty-Set fallback is intentional when no refs were touched —
-        // the extractor's filter rejects every file and returns empty, keeping
-        // the pass invoked so the action is recorded and tests stay exercised.
-        if (graphExtractionDisabledByProfile) {
-            info("[improve] graph extraction skipped (disabled by improve profile)");
-        }
-        else if (sources.length > 0 && graphEnabled) {
-            info(`[improve] graph extraction starting${graphExtractionFullScan ? " (full-corpus scan)" : ""}`);
-            const extractionStart = Date.now();
-            try {
-                // D9: if consolidation ran but memory inference did not reindex, force a reindex
-                // so graph extraction sees current DB state after consolidation writes.
-                if (consolidationRan && !reindexedAfterInference) {
-                    info("[improve] reindexing after consolidation (graph extraction needs current state)");
-                    try {
-                        await reindexWithIndexDbReleased(primaryStashDir);
-                        reindexedAfterInference = true;
-                        info("[improve] reindex after consolidation complete");
-                    }
-                    catch (err) {
-                        allWarnings.push(`reindex after consolidation failed: ${err instanceof Error ? err.message : String(err)}`);
-                    }
-                }
-                // #584: no close/reopen needed here — reindexWithIndexDbReleased
-                // already swapped in a fresh post-reindex handle.
-                // Resolve touched refs to absolute file paths. Skipped for fullScan
-                // (candidatePaths stays undefined → extractor processes all files).
-                let candidatePaths;
-                if (!graphExtractionFullScan) {
-                    candidatePaths = new Set();
-                    if (primaryStashDir && touchedRefs.size > 0) {
-                        const writableDirSet = new Set(getWritableStashDirs(primaryStashDir).map((d) => path.resolve(d)));
-                        const resolved = await Promise.all([...touchedRefs].map((ref) => findAssetFilePath(ref, primaryStashDir, writableDirSet).catch(() => null)));
-                        for (const p of resolved) {
-                            if (typeof p === "string" && p.length > 0)
-                                candidatePaths.add(p);
-                        }
-                    }
-                }
-                const progressHandler = (event) => {
-                    const current = event.currentPath ? ` ${path.basename(event.currentPath)}` : "";
-                    info(`[improve] graph extraction ${event.processed}/${event.total}${current} (extracted ${event.extracted}, entities ${event.totalEntities}, relations ${event.totalRelations})`);
-                };
-                // O-1 (#364): pass budget signal so a hung graph extraction call is cancelled.
-                graphExtraction = await withLlmStage("graph-extraction", () => graphExtractionFn({
-                    config,
-                    sources,
-                    signal: budgetSignal,
-                    db,
-                    reEnrich: false,
-                    onProgress: progressHandler,
-                    options: { candidatePaths },
-                }));
-                graphExtractionDurationMs = Date.now() - extractionStart;
-                actions.push({ ref: "graph:_artifact", mode: "graph-extraction", result: graphExtraction });
-                info(`[improve] graph extraction complete (${graphExtraction.quality.extractedFiles} files, ${graphExtraction.quality.entityCount} entities, ${graphExtraction.quality.relationCount} relations)`);
-            }
-            catch (err) {
-                graphExtractionDurationMs = Date.now() - extractionStart;
-                allWarnings.push(`graph extraction failed: ${err instanceof Error ? err.message : String(err)}`);
-            }
-        }
-        else if (sources.length > 0 && !graphEnabled) {
-            info("[improve] graph extraction skipped (features.index.graph_extraction is disabled)");
-        }
-        // Orphan proposal purge — reject pending reflect proposals whose target
-        // asset no longer exists on disk. Runs after graph extraction so newly
-        // promoted assets from accept flows during this run are already present.
-        if (primaryStashDir) {
-            try {
-                const purgeResult = purgeOrphanProposals(primaryStashDir, sources.map((s) => s.path));
-                orphansPurged = purgeResult.rejected;
-                if (purgeResult.rejected > 0) {
-                    info(`[improve] orphan purge: ${purgeResult.rejected}/${purgeResult.checked} orphaned proposals rejected (${purgeResult.durationMs}ms)`);
-                }
-                appendEvent({
-                    eventType: "proposal_orphan_purge",
-                    ref: "proposals:_orphan-purge",
-                    metadata: {
-                        checked: purgeResult.checked,
-                        rejected: purgeResult.rejected,
-                        durationMs: purgeResult.durationMs,
-                        byType: purgeResult.byType,
-                        orphans: purgeResult.orphans.map((o) => o.ref),
-                    },
-                }, eventsCtx);
-            }
-            catch (err) {
-                allWarnings.push(`orphan purge failed: ${err instanceof Error ? err.message : String(err)}`);
-            }
-            // Phase 6B (Advantage D6b): expire pending proposals that have aged past
-            // the retention window. Runs AFTER orphan purge so we never double-archive
-            // a proposal that orphan-purge already moved. `expireStaleProposals` emits
-            // its own per-proposal `proposal_expired` events; we additionally emit a
-            // single roll-up event here for parity with the orphan-purge surface.
-            try {
-                const expireResult = expireStaleProposals(primaryStashDir, config);
-                proposalsExpired = expireResult.expired;
-                if (expireResult.expired > 0) {
-                    info(`[improve] expiration: ${expireResult.expired}/${expireResult.checked} pending proposals expired ` +
-                        `(retention=${expireResult.retentionDays}d, ${expireResult.durationMs}ms)`);
-                }
-                appendEvent({
-                    eventType: "proposal_expiration_pass",
-                    ref: "proposals:_expiration",
-                    metadata: {
-                        checked: expireResult.checked,
-                        expired: expireResult.expired,
-                        durationMs: expireResult.durationMs,
-                        retentionDays: expireResult.retentionDays,
-                        expiredProposals: expireResult.expiredProposals,
-                    },
-                }, eventsCtx);
-            }
-            catch (err) {
-                allWarnings.push(`proposal expiration failed: ${err instanceof Error ? err.message : String(err)}`);
-            }
-        }
-        // Fix #2 (observability 0.8.0): trim the events table in state.db so it
-        // doesn't grow unbounded. `akm health` writes a `health_probe` row on every
-        // invocation, and every command surface emits at least one event besides —
-        // without this trim, state.db is a permanent append-only log. Config key
-        // `improve.eventRetentionDays` (default 90, set 0 to disable) controls the
-        // window. The purge runs against state.db (a different SQLite file from
-        // the index `db` above).
-        {
-            const retentionDays = typeof config.improve?.eventRetentionDays === "number" ? config.improve.eventRetentionDays : 90;
-            if (retentionDays > 0) {
-                // #585: reuse the long-lived eventsCtx.db connection when akmImprove
-                // opened one — opening a second state.db write connection while
-                // eventsDb is still live made two simultaneous writers contend on the
-                // same WAL file ("database is locked"). Only the eventsCtx.dbPath
-                // fallback path (state.db failed to open up-front) opens — and then
-                // owns and closes — its own handle. C2 still holds: the fallback uses
-                // the boundary-pinned path, never a live `process.env` re-read.
-                const ownsStateDb = !eventsCtx?.db;
-                let stateDb;
-                try {
-                    stateDb = eventsCtx?.db ?? openStateDatabase(eventsCtx?.dbPath);
-                    const purgedCount = purgeOldEvents(stateDb, retentionDays);
-                    if (purgedCount > 0) {
-                        info(`[improve] events purge: ${purgedCount} event(s) older than ${retentionDays}d removed from state.db`);
-                    }
-                    appendEvent({
-                        eventType: "events_purged",
-                        ref: "events:_purge",
-                        metadata: { purgedCount, retentionDays },
-                    }, eventsCtx);
-                    // improve_runs uses the same retention window as events — both are
-                    // observability/audit data, both grow append-only, both have a
-                    // dedicated purge helper. Mirroring the events purge here means a
-                    // single retention knob (improve.eventRetentionDays) governs both.
-                    const improveRunsPurged = purgeOldImproveRuns(stateDb, retentionDays);
-                    if (improveRunsPurged > 0) {
-                        info(`[improve] improve_runs purge: ${improveRunsPurged} run(s) older than ${retentionDays}d removed from state.db`);
-                    }
-                    appendEvent({
-                        eventType: "improve_runs_purged",
-                        ref: "improve_runs:_purge",
-                        metadata: { purgedCount: improveRunsPurged, retentionDays },
-                    }, eventsCtx);
-                }
-                catch (err) {
-                    allWarnings.push(`events purge failed: ${err instanceof Error ? err.message : String(err)}`);
-                }
-                finally {
-                    if (ownsStateDb && stateDb) {
-                        try {
-                            stateDb.close();
-                        }
-                        catch {
-                            // best-effort
-                        }
-                    }
-                }
-                // task_logs in logs.db (#579) shares the same retention window as
-                // events/improve_runs — all three are observability data governed by
-                // the single improve.eventRetentionDays knob. Separate try/finally
-                // because logs.db is a different file: a locked/missing logs.db must
-                // not block the state.db purges above.
-                let logsDb;
-                try {
-                    logsDb = openLogsDatabase();
-                    const taskLogsPurged = purgeOldTaskLogs(logsDb, retentionDays);
-                    if (taskLogsPurged > 0) {
-                        info(`[improve] task_logs purge: ${taskLogsPurged} log line(s) older than ${retentionDays}d removed from logs.db`);
-                    }
-                    appendEvent({
-                        eventType: "task_logs_purged",
-                        ref: "task_logs:_purge",
-                        metadata: { purgedCount: taskLogsPurged, retentionDays },
-                    }, eventsCtx);
-                }
-                catch (err) {
-                    allWarnings.push(`task_logs purge failed: ${err instanceof Error ? err.message : String(err)}`);
-                }
-                finally {
-                    if (logsDb) {
-                        try {
-                            logsDb.close();
-                        }
-                        catch {
-                            // best-effort
-                        }
-                    }
-                }
-            }
-        }
-        // Phase 4A (staleness detection). Activates the `deprecated` belief-state
-        // machinery shipped in Phase 1A. Default OFF — gated by
-        // `features.index.staleness_detection.enabled`. Runs after orphan purge
-        // and before the URL check (which lives in the outer caller).
-        if (sources.length > 0) {
-            try {
-                stalenessDetection = await withLlmStage("staleness-detection", () => stalenessDetectionFn({ config, sources, signal: budgetSignal, db }));
-                if (stalenessDetection.considered > 0) {
-                    info(`[improve] staleness detection complete (considered ${stalenessDetection.considered}, ` +
-                        `deprecated ${stalenessDetection.deprecated}, confirmed ${stalenessDetection.confirmed}, ` +
-                        `skipped ${stalenessDetection.skipped}, ${stalenessDetection.durationMs}ms)`);
-                }
-                for (const w of stalenessDetection.warnings)
-                    allWarnings.push(`[improve] staleness detection: ${w}`);
-            }
-            catch (err) {
-                allWarnings.push(`staleness detection failed: ${err instanceof Error ? err.message : String(err)}`);
-            }
-        }
-    }
-    finally {
-        if (db)
-            closeDatabase(db);
-    }
-    return {
-        ...(memoryInference ? { memoryInference } : {}),
-        ...(graphExtraction ? { graphExtraction } : {}),
-        ...(stalenessDetection ? { stalenessDetection } : {}),
-        ...(actions.length > 0 ? { actions } : {}),
-        memoryInferenceDurationMs,
-        graphExtractionDurationMs,
-        orphansPurged,
-        proposalsExpired,
-    };
-}
-function shouldAnalyzeMemoryCleanup(scope, eligibleMemories, primaryStashDir) {
-    if (!primaryStashDir || eligibleMemories === 0)
-        return false;
-    if (scope.mode === "all")
-        return true;
-    if (scope.mode === "type")
-        return scope.value === "memory";
-    if (!scope.value)
-        return false;
-    return parseAssetRef(scope.value).type === "memory";
-}
 function shapeMemoryCleanup(plan) {
     return {
         analyzedDerived: plan.analyzedDerived,
@@ -2989,48 +1007,3 @@ function shapeMemoryCleanup(plan) {
         ...(plan.relativeDateCandidates.length > 0 ? { relativeDateCandidates: plan.relativeDateCandidates } : {}),
     };
 }
-function buildUtilityMap(refs) {
-    const map = new Map();
-    if (refs.length === 0)
-        return map;
-    const refSet = new Set(refs.map((r) => r.ref));
-    let db;
-    try {
-        db = openExistingDatabase();
-        const allDbEntries = getAllEntries(db);
-        const idToRef = new Map();
-        for (const indexed of allDbEntries) {
-            const ref = makeAssetRef(indexed.entry.type, indexed.entry.name);
-            if (refSet.has(ref))
-                idToRef.set(indexed.id, ref);
-        }
-        const ids = [...idToRef.keys()];
-        if (ids.length > 0) {
-            const { global: scores } = getUtilityScoresByIds(db, ids);
-            for (const [id, score] of scores) {
-                const ref = idToRef.get(id);
-                if (ref)
-                    map.set(ref, score.utility);
-            }
-        }
-    }
-    catch (err) {
-        rethrowIfTestIsolationError(err);
-        // best-effort: if DB unavailable, all utilities default to 0
-    }
-    finally {
-        if (db)
-            closeDatabase(db);
-    }
-    return map;
-}
-async function findAssetFilePath(ref, stashDir, writableDirSet) {
-    return resolveAssetPath(ref, {
-        stashDir,
-        mode: "disk-only",
-        writableDirSet,
-        directoryIndexNames: ["SKILL.md"],
-        preserveDirectNameFallback: true,
-        honorOrigin: false,
-    });
-}