akm-cli 0.9.0-beta.9 → 0.9.0-rc.1

package/dist/commands/improve/consolidate.js

@@ -5,52 +5,54 @@ import { createHash } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import readline from "node:readline";
-import { parse as yamlParse } from "yaml";
+import consolidateSystemPrompt from "../../assets/prompts/consolidate-system.md" with { type: "text" };
 import { parseAssetRef } from "../../core/asset/asset-ref.js";
 import { assembleAssetFromString, serializeFrontmatter } from "../../core/asset/asset-serialize.js";
 import { parseFrontmatter } from "../../core/asset/frontmatter.js";
 import { resolveStashDir, timestampForFilename } from "../../core/common.js";
-import { getDefaultLlmConfig, loadConfig } from "../../core/config/config.js";
+import { getDefaultLlmConfig, getImproveProcessConfig, loadConfig } from "../../core/config/config.js";
 import { ConfigError } from "../../core/errors.js";
-import { appendEvent } from "../../core/events.js";
+// Note: appendEvent import removed (WS-3a: archive TTL machinery retired)
 import { parseEmbeddedJsonResponse } from "../../core/parse.js";
+import { resolveStashStandards } from "../../core/standards/resolve-stash-standards.js";
 import { detectTruncatedDescription } from "../../core/text-truncation.js";
-import { hasHotCaptureMode, hasSupersededStatus, MERGE_ABSOLUTE_FLOOR_CHARS, MERGE_SHRINK_RATIO_MIN, validateProposalFrontmatter, } from "../proposal/validators/proposal-quality-validators.js";
-import { createProposal, isProposalSkipped, listProposals } from "../proposal/validators/proposals.js";
+import { DURATION_UNITS, parseDuration } from "../../core/time.js";
+import { createProposal, isProposalSkipped, listProposals } from "../proposal/repository.js";
+import { hasSupersededStatus, MERGE_ABSOLUTE_FLOOR_CHARS, MERGE_SHRINK_RATIO_MIN, validateProposalFrontmatter, } from "../proposal/validators/proposal-quality-validators.js";
+import { checkGenerationGuard, checkLexicalDiversity, checkMergeInformationFloor, computeMergedGeneration, readAssetGeneration, } from "./anti-collapse.js";
+import { cacheHash, runDeterministicDedup, stripFrontmatterBody } from "./dedup.js";
+import { shouldSkipHotProbationInLlm } from "./hot-probation.js";
 import { writeContradictEdge } from "./memory/memory-belief.js";
 // Re-export the moved helpers so existing test imports continue to resolve.
 export { hasSupersededStatus, validateProposalFrontmatter };
+import { openStateDatabase, withStateDb } from "../../core/state-db.js";
 import { warn } from "../../core/warn.js";
 import { commitWriteTargetBoundary, deleteAssetFromSource, resolveWriteTarget, writeAssetToSource, } from "../../core/write-source.js";
 import { closeDatabase, findEntryIdByRef, getAllEntries, getEntryById, getNeighborsByEntryId, openExistingDatabase, } from "../../indexer/db/db.js";
 import { resolveImproveProcessRunnerFromProfile, runnerIsLlm } from "../../integrations/agent/runner.js";
 import { chatCompletion } from "../../llm/client.js";
-import { cosineSimilarity, embedBatch } from "../../llm/embedder.js";
+import { cosineSimilarity, embedBatch, resolveEmbeddingModelId } from "../../llm/embedder.js";
 import { isLlmFeatureEnabled, tryLlmFeature } from "../../llm/feature-gate.js";
+import { getConsolidationJudgedMap, upsertConsolidationJudged, } from "../../storage/repositories/consolidation-repository.js";
+import { getBodyEmbeddings, upsertBodyEmbeddings } from "../../storage/repositories/embeddings-repository.js";
+// Chunk sizing + per-chunk prompt assembly live in ./consolidate/chunking.
+// Imported for internal use by the orchestrator and re-exported for importers.
+import { buildChunkPrompt, computeSafeChunkSize, DEFAULT_CONTEXT_LENGTH_TOKENS } from "./consolidate/chunking.js";
+export { buildChunkPrompt, computeSafeChunkSize, DEFAULT_CONTEXT_LENGTH_TOKENS } from "./consolidate/chunking.js";
+// LLM-output sanitization (pure string/frontmatter transforms) lives in
+// ./consolidate/sanitize. Imported for internal use + re-exported for importers.
+import { normalizeUpdatedField, sanitizeMergedContent } from "./consolidate/sanitize.js";
+export { normalizeUpdatedField, sanitizeMergedContent, stripOuterCodeFence } from "./consolidate/sanitize.js";
+// Eligibility / safety predicates live in ./consolidate/eligibility. Imported
+// for internal guard use; the two public predicates are re-exported.
+import { consolidateGuardStatus, isConsolidationEligibleMemoryName, isHotCapturedMemory, } from "./consolidate/eligibility.js";
+export { isConsolidationEligibleMemoryName, isHotCapturedMemory } from "./consolidate/eligibility.js";
+// Plan parsing / merging (pure op-reconciliation algebra) lives in
+// ./consolidate/merge. Imported for internal use; mergePlans re-exported.
+import { isValidOp, mergePlans } from "./consolidate/merge.js";
+export { mergePlans } from "./consolidate/merge.js";
 // ── Prompts ─────────────────────────────────────────────────────────────────
-const CONSOLIDATE_SYSTEM_PROMPT = `You are the akm consolidate assistant analyzing memory assets.
-
-Rules:
-1. MERGE: Two or more memories are substantially duplicated or closely related → propose merging. Return the primary ref to keep and secondary refs to delete. Do NOT include mergedContent — the merge will be executed in a separate step.
-2. DELETE: Memory is clearly outdated, contradicted, or redundant → propose deletion. NEVER propose delete for memories annotated \`(captureMode: hot)\` — they are user-explicit and only the user can retire them. The downstream guard will refuse these regardless, so proposing them just wastes tokens.
-3. PROMOTE: Memory expresses a stable, reusable fact suitable as a \`knowledge:\` asset → propose promotion. Do NOT delete the source memory. NEVER propose promote / merge / contradict for memories annotated \`(already queued)\` — they have a pending proposal whose body matches; a duplicate will be deterministically dropped, so proposing them just wastes tokens.
-4. CONTRADICT: Two memories make mutually exclusive factual claims about the same subject (e.g. "always use VPN" vs "VPN is optional") → mark the older or less authoritative one as contradicted. This writes a contradictedBy edge so the belief-resolution SCC algorithm can resolve the conflict. Do NOT delete contradicted memories — let the belief resolver decide.
-5. KEEP: Memory is unique and current → omit from output.
-
-Return ONLY JSON (no prose, no code fences):
-{
-  "operations": [
-    { "op": "merge", "primary": "memory:<name>", "secondaries": ["memory:<name>", ...], "mergeStrategy": "synthesize", "confidence": 0.95 },
-    { "op": "delete", "ref": "memory:<name>", "reason": "<brief reason>", "confidence": 0.90 },
-    { "op": "promote", "ref": "memory:<name>", "knowledgeRef": "knowledge:<suggested-slug>", "reason": "<brief reason>", "description": "<one sentence describing the new knowledge asset>", "confidence": 0.92 },
-    { "op": "contradict", "ref": "memory:<name>", "contradictedByRef": "memory:<name>", "reason": "<brief reason>", "confidence": 0.88 }
-  ],
-  "warnings": ["<optional concerns>"]
-}
-
-For every operation, emit a \`confidence\` field in [0, 1] expressing your certainty that the operation is correct and safe. Use 0.95+ only when evidence is unambiguous. Omit the field rather than guessing if you are uncertain.
-
-When the merged content includes an \`updated\` frontmatter field, the value MUST be a real ISO date string (e.g. \`updated: 2026-05-20\`). NEVER emit \`updated: today\`, \`updated: {today}\`, \`updated: {today: null}\`, \`updated: now\`, or any other literal placeholder/template-variable. If you do not have a real source-of-truth date, OMIT the \`updated\` field entirely — the post-processor will not invent one for you.`;
+const CONSOLIDATE_SYSTEM_PROMPT = consolidateSystemPrompt;
 /**
  * JSON Schema for structured consolidate plans (PR 1 of the asset-writers
  * decision — see knowledge:projects/akm/asset-writers-investigation/00-synthesis).
@@ -136,140 +138,17 @@ export const CONSOLIDATE_PLAN_JSON_SCHEMA = {
         },
     },
 };
-export function isConsolidationEligibleMemoryName(name) {
-    return !name.endsWith(".derived");
-}
-/**
- * Returns true when the memory file has `captureMode: hot` in its frontmatter.
- *
- * Hot memories are USER-EXPLICIT (written via `akm remember` on the hot path).
- * The consolidate LLM is forbidden from deleting or auto-merging them — the
- * user wrote them on purpose and only the user can decide to retire them.
- *
- * Reads the file once per check; consolidate runs against ~10 memories per
- * chunk so the IO cost is trivial. Returns false on any read/parse error
- * (fail-safe: an unparseable file is treated as not-hot, but the broader
- * consolidate flow already guards against unparseable memories elsewhere).
- *
- * Defends against four observed defect classes (see
- * `memory:akm-improve-critical-review-2026-05-20`):
- *   - LLM marks a memory contradicted then deletes (dangling contradictedBy)
- *   - LLM merges two unrelated memories sharing a topic keyword
- *   - LLM judges a recent durable design memo as "redundant"
- *   - Cascade deletes (LLM uses ref:X as `contradictedBy` for ref:Y then deletes both)
- */
-export function isHotCapturedMemory(filePath) {
-    try {
-        if (!fs.existsSync(filePath))
-            return false;
-        const content = fs.readFileSync(filePath, "utf8");
-        const parsed = parseFrontmatter(content);
-        return hasHotCaptureMode(parsed.data);
-    }
-    catch {
-        return false;
-    }
-}
-function consolidateGuardStatus(filePath) {
-    if (!fs.existsSync(filePath))
-        return "missing";
-    let content;
-    try {
-        content = fs.readFileSync(filePath, "utf8");
-    }
-    catch {
-        return "unparseable";
-    }
-    let parsed;
-    try {
-        parsed = parseFrontmatter(content);
-    }
-    catch {
-        return "unparseable";
-    }
-    const data = parsed.data;
-    if (!data || Object.keys(data).length === 0)
-        return "unparseable";
-    return hasHotCaptureMode(data) ? "hot" : "safe";
-}
-// ── Chunk sizing ─────────────────────────────────────────────────────────────
-/**
- * Conservative chars-per-token estimate used when computing prompt budgets.
- * English text averages roughly 4 chars/token for most LLM tokenizers. We use
- * 3 to stay conservative (shorter tokens = more tokens per char).
- */
-const CHARS_PER_TOKEN = 3;
-/**
- * Overhead budget reserved for the system prompt, chunk header lines, and per-
- * memory metadata lines (name, description, tags, separator). Measured at
- * roughly 600 chars for the system prompt + ~100 chars of header + ~50 chars
- * per memory × chunk size.  We round up to 2 000 tokens to leave room for the
- * model's own output.
- */
-const PROMPT_OVERHEAD_TOKENS = 2_000;
-/**
- * Default effective token budget used when the default LLM profile's
- * `contextLength` is not set. This is intentionally conservative (4 096)
- * rather than being set to the model's actual context window, because:
- *
- *   - When the agent path is used, the agent CLI (e.g. opencode)
- *     prepends its own large system prompt + conversation history before
- *     forwarding to the model. That overhead easily consumes 30K+ tokens on
- *     a model with a 16K context window, leaving very little room for
- *     chunk content.
- *   - When the HTTP path is used (an LLM profile is selected), only the akm
- *     system prompt and user prompt are sent, so the budget can be set to the
- *     model's actual context length via profiles.llm[defaults.llm].contextLength.
- *
- * Set profiles.llm[defaults.llm].contextLength in your config file to the
- * model's actual context window to allow larger chunks on the HTTP path.
- */
-export const DEFAULT_CONTEXT_LENGTH_TOKENS = 4_096;
-/**
- * Given the model's context window and the per-memory body truncation limit,
- * return the maximum number of memories that can safely fit in one chunk
- * without the prompt overflowing the context window.
- *
- * The formula is:
- *   usableTokens = contextLength - PROMPT_OVERHEAD_TOKENS
- *   tokensPerMemory = ceil(bodyTruncation / CHARS_PER_TOKEN)
- *   chunkSize = floor(usableTokens / tokensPerMemory)
- *
- * Result is clamped between 1 and 50 to avoid degenerate values.
- *
- * @param contextLength - Model context window in tokens.
- * @param bodyTruncation - Max chars per memory body included in the prompt.
- * @param maxChunkSize - Optional override for the hardcoded cap of 50 (1–50).
- */
-export function computeSafeChunkSize(contextLength, bodyTruncation, maxChunkSize) {
-    const usableTokens = Math.max(contextLength - PROMPT_OVERHEAD_TOKENS, 0);
-    const tokensPerMemory = Math.max(Math.ceil(bodyTruncation / CHARS_PER_TOKEN), 1);
-    const raw = Math.floor(usableTokens / tokensPerMemory);
-    return Math.max(1, Math.min(maxChunkSize ?? 50, raw));
-}
-// ── Similarity clustering (C-1 / #380) ──────────────────────────────────────
-/**
- * Re-order memories so that similar ones are placed adjacent to each other
- * before the memories are sliced into chunks. This ensures high-similarity
- * memories land in the same LLM context window, allowing the consolidate
- * model to detect and merge duplicates that would otherwise be split across
- * chunks and survive indefinitely.
- *
- * Algorithm: greedy nearest-neighbour chain starting from the first memory.
- * Each step selects the unused memory with the highest cosine similarity to
- * the last-placed memory. O(n²) — acceptable for the expected N < 200.
- *
- * mem0 arXiv:2504.19413 — every candidate compared against whole store.
- * A-MEM arXiv:2502.12110 — atomic notes linked by similarity.
- *
- * Returns the original order unchanged when:
- *   - The embedding config is not present.
- *   - Embedding requests fail (fail-open).
- *   - There are fewer than 3 memories (no benefit to reordering).
- */
-async function clusterMemoriesBySimilarity(memories, config) {
+async function clusterMemoriesBySimilarity(memories, config, stateDb) {
+    const noTelemetry = { embedMs: 0, cacheHits: 0, cacheMisses: 0 };
     if (memories.length < 3 || !config.embedding)
-        return memories;
+        return { ordered: memories, embedTelemetry: noTelemetry };
+    // WS-3a: cluster uses description+tags as the embedding input (NOT the raw
+    // body) — this is intentionally different from the dedup/body cache because
+    // the clustering goal is semantic grouping, not dedup twin detection.
+    // The body_embeddings cache is keyed by cacheHash(body); clustering inputs
+    // are keyed by cacheHash(description+tags text). Re-use the same table with
+    // a distinct hash so the two lookup sets never collide.
+    const modelId = resolveEmbeddingModelId(config.embedding);
     const texts = memories.map((m) => {
         const parts = [];
         if (m.description)
@@ -278,16 +157,91 @@ async function clusterMemoriesBySimilarity(memories, config) {
             parts.push(m.tags.join(" "));
         return parts.join(". ") || m.name;
     });
-    let embeddings = null;
-    try {
-        embeddings = await embedBatch(texts, config.embedding);
+    // Compute content hashes for the cluster texts (not bodies — different input).
+    const contentHashes = texts.map((t) => createHash("sha256").update(t, "utf8").digest("hex"));
+    // WS-5: track embed cache hits/misses for perf telemetry.
+    let embedMs = 0;
+    let cacheHits = 0;
+    let cacheMisses = 0;
+    let cachedVecs = new Map();
+    if (stateDb) {
+        try {
+            cachedVecs = getBodyEmbeddings(stateDb, contentHashes, modelId);
+        }
+        catch {
+            // Fail open.
+            cachedVecs = new Map();
+        }
     }
-    catch {
-        // Fail open: embedding failures degrade gracefully to original order.
-        return memories;
+    const missIndices = [];
+    const missTexts = [];
+    for (let i = 0; i < texts.length; i++) {
+        if (!cachedVecs.has(contentHashes[i])) {
+            missIndices.push(i);
+            missTexts.push(texts[i]);
+            cacheMisses++;
+        }
+        else {
+            cacheHits++;
+        }
+    }
+    let missVecs = [];
+    if (missTexts.length > 0) {
+        const embedStart = Date.now();
+        try {
+            missVecs = await embedBatch(missTexts, config.embedding);
+        }
+        catch {
+            // Fail open: embedding failures degrade gracefully to original order.
+            return { ordered: memories, embedTelemetry: { embedMs, cacheHits, cacheMisses } };
+        }
+        finally {
+            embedMs += Date.now() - embedStart;
+        }
+        // Upsert newly computed vectors into the cache.
+        if (stateDb && missVecs.length === missTexts.length) {
+            try {
+                const toUpsert = missIndices.map((idx, pos) => ({
+                    contentHash: contentHashes[idx],
+                    embedding: missVecs[pos],
+                    modelId,
+                }));
+                upsertBodyEmbeddings(stateDb, toUpsert);
+            }
+            catch {
+                // Fail open: cache write errors are non-fatal.
+            }
+        }
+    }
+    // Assemble the full embedding array in memories order.
+    let embeddings = null;
+    {
+        const assembled = [];
+        let ok = true;
+        for (let i = 0; i < memories.length; i++) {
+            const hash = contentHashes[i];
+            const cached = cachedVecs.get(hash);
+            if (cached) {
+                assembled.push(cached);
+                continue;
+            }
+            const missPos = missIndices.indexOf(i);
+            const vec = missPos >= 0 ? missVecs[missPos] : undefined;
+            if (vec) {
+                assembled.push(vec);
+            }
+            else {
+                ok = false;
+                break;
+            }
+        }
+        if (ok && assembled.length === memories.length) {
+            embeddings = assembled;
+        }
     }
+    const embedTelemetry = { embedMs, cacheHits, cacheMisses };
     if (!embeddings || embeddings.length !== memories.length)
-        return memories;
+        return { ordered: memories, embedTelemetry };
     // Greedy nearest-neighbour chain.
     const used = new Array(memories.length).fill(false);
     const ordered = [];
@@ -313,87 +267,16 @@ async function clusterMemoriesBySimilarity(memories, config) {
         used[bestIdx] = true;
         current = bestIdx;
     }
-    return ordered;
+    return { ordered, embedTelemetry };
 }
 // ── Chunk helpers ────────────────────────────────────────────────────────────
-/**
- * Build the per-chunk user prompt fed to the consolidate LLM.
- *
- * Each memory is annotated with two flags that drive the system-prompt
- * rules at lines 181-186:
- *   - `(captureMode: hot)` — user-explicit memory; system prompt rule 2
- *     forbids proposing delete. ~60 wasted LLM verdicts/4h on this user's
- *     stack before this annotation.
- *   - `(already queued)` — the memory's body hash matches a pending
- *     consolidate proposal; system prompt rule 3 forbids proposing
- *     promote/merge/contradict. ~107/4h before this annotation.
- *
- * Both annotations are visible to the LLM. `pendingProposalBodyHashes`
- * is precomputed once per run by `loadPendingConsolidateProposalHashes`
- * so the cost stays O(memories) inside the chunk loop.
- */
-export function buildChunkPrompt(sourceName, memories, chunkIndex, totalChunks, bodyTruncation, pendingProposalBodyHashes = new Set()) {
-    const start = memories[0] ? `memory:${memories[0].name}` : "";
-    const end = memories[memories.length - 1] ? `memory:${memories[memories.length - 1].name}` : "";
-    const annotationsByIndex = [];
-    const hotRefs = [];
-    for (const m of memories) {
-        let body = "";
-        try {
-            body = fs.readFileSync(m.filePath, "utf8");
-        }
-        catch {
-            body = "(unreadable)";
-        }
-        const parsed = parseFrontmatter(body);
-        const isHot = parsed.data.captureMode === "hot";
-        const bodyHash = createHash("sha256").update(parsed.content.trim(), "utf8").digest("hex");
-        const isAlreadyQueued = pendingProposalBodyHashes.has(bodyHash);
-        annotationsByIndex.push({ isHot, isAlreadyQueued, body });
-        if (isHot)
-            hotRefs.push(`memory:${m.name}`);
-    }
-    const lines = [
-        `Source: ${sourceName}`,
-        `Chunk ${chunkIndex + 1} of ${totalChunks}, memories ${start}–${end}:`,
-        "",
-    ];
-    // Top-of-prompt protection block for hot refs. Neutral phrasing — avoid
-    // op-words like "promote", "merge", "contradict" so the model doesn't
-    // accidentally treat the warning as a hint to use that op elsewhere
-    // (variant B leaked the word "contradict" into the control sample
-    // during the diagnostic).
-    if (hotRefs.length > 0) {
-        lines.push("⛔ DO NOT propose any `delete` operation for these refs — they are user-explicit (captureMode: hot) and the downstream guard refuses them regardless. Proposing delete for any of these only wastes tokens.");
-        for (const ref of hotRefs)
-            lines.push(`  - ${ref}`);
-        lines.push("");
-    }
-    for (let i = 0; i < memories.length; i++) {
-        const m = memories[i];
-        const { isHot, isAlreadyQueued, body } = annotationsByIndex[i];
-        const annotations = [];
-        if (isHot)
-            annotations.push("captureMode: hot");
-        if (isAlreadyQueued)
-            annotations.push("already queued");
-        const annotationSuffix = annotations.length > 0 ? ` (${annotations.join("; ")})` : "";
-        lines.push(`[${i + 1}] memory:${m.name}${annotationSuffix}`);
-        lines.push(`Description: ${m.description || "(none)"}`);
-        lines.push(`Tags: ${m.tags.length > 0 ? m.tags.join(", ") : "(none)"}`);
-        lines.push("---");
-        lines.push(body.slice(0, bodyTruncation));
-        lines.push("");
-    }
-    return lines.join("\n");
-}
 /**
  * Precompute body-hashes of all currently-pending consolidate proposals so
  * the per-chunk prompt can annotate memories whose body would just produce
- * a deterministic `dedup_pending_proposal` skip. Hash domain matches the
- * dedup site at ~line 1510 (sha256 over the post-frontmatter content,
- * trimmed). Empty set on any read/parse error — fail-safe to "annotate
- * nothing" so the LLM still proposes, just slightly more wastefully.
+ * a deterministic `dedup_pending_proposal` skip. Uses `cacheHash` (case-
+ * preserving stripped body) — the same domain used by the body-embedding
+ * cache and `computeMemoryContentHash`. Empty set on any read/parse error
+ * — fail-safe to "annotate nothing" so the LLM still proposes.
  */
 function loadPendingConsolidateProposalHashes(stashDir) {
     const hashes = new Set();
@@ -401,8 +284,7 @@ function loadPendingConsolidateProposalHashes(stashDir) {
         const pending = listProposals(stashDir, { status: "pending" }).filter((p) => p.source === "consolidate");
         for (const p of pending) {
             try {
-                const body = parseFrontmatter(p.payload.content).content.trim();
-                hashes.add(createHash("sha256").update(body, "utf8").digest("hex"));
+                hashes.add(cacheHash(p.payload.content));
             }
             catch {
                 // skip malformed payloads — they can't dedup anyway
@@ -414,148 +296,6 @@ function loadPendingConsolidateProposalHashes(stashDir) {
     }
     return hashes;
 }
-function isValidOp(op) {
-    if (typeof op !== "object" || op === null)
-        return false;
-    const o = op;
-    if (o.op === "merge") {
-        return typeof o.primary === "string" && Array.isArray(o.secondaries);
-    }
-    if (o.op === "delete") {
-        return typeof o.ref === "string";
-    }
-    if (o.op === "promote") {
-        return typeof o.ref === "string" && typeof o.knowledgeRef === "string";
-    }
-    if (o.op === "contradict") {
-        return typeof o.ref === "string" && typeof o.contradictedByRef === "string";
-    }
-    return false;
-}
-export function mergePlans(chunks, knownRefs) {
-    const mergeOps = new Map();
-    const deleteOps = new Map();
-    const promoteOps = new Map();
-    // C-3 / #382: contradict ops keyed by `ref|contradictedByRef` to deduplicate.
-    const contradictOps = new Map();
-    const warnings = [];
-    for (const chunk of chunks) {
-        for (const op of chunk) {
-            if (op.op === "merge") {
-                // Drop ops whose primary the LLM hallucinated (not in the loaded memory
-                // pool). Without this guard, a hallucinated primary flows all the way to
-                // Phase B where !memoryByRef.has(primary) fires and charges every real
-                // secondary with merge_primary_missing — masking LLM hallucinations as
-                // filter regressions in health metrics.
-                if (knownRefs && !knownRefs.has(op.primary)) {
-                    warnings.push(`mergePlans: primary ${op.primary} not in loaded memory pool (LLM hallucination) — dropping op before execution.`);
-                    // Use a dedicated skip reason so dashboards can distinguish
-                    // hallucinated primaries from stale-DB regressions.
-                    // Secondaries are real refs; they are NOT charged here — they remain
-                    // available for other ops to claim.
-                    continue;
-                }
-                // Filter hallucinated secondaries while preserving real ones.
-                let mergeOp = op;
-                if (knownRefs) {
-                    const filteredSecondaries = op.secondaries.filter((sec) => {
-                        if (!knownRefs.has(sec)) {
-                            warnings.push(`mergePlans: secondary ${sec} not in loaded memory pool (LLM hallucination) — dropping from op.`);
-                            return false;
-                        }
-                        return true;
-                    });
-                    if (filteredSecondaries.length !== op.secondaries.length) {
-                        mergeOp = { ...op, secondaries: filteredSecondaries };
-                    }
-                }
-                // merge wins over delete
-                if (deleteOps.has(mergeOp.primary)) {
-                    deleteOps.delete(mergeOp.primary);
-                }
-                for (const sec of mergeOp.secondaries) {
-                    if (deleteOps.has(sec))
-                        deleteOps.delete(sec);
-                }
-                mergeOps.set(mergeOp.primary, mergeOp);
-            }
-            else if (op.op === "delete") {
-                // merge and promote both win over delete. A promote is non-destructive
-                // (creates a proposal) but the source memory is counted in `promoted`;
-                // if a delete also fires, the ref lands in both `promoted` and
-                // `skipReasons`, breaking the invariant by +1.
-                if (!mergeOps.has(op.ref) && !promoteOps.has(op.ref)) {
-                    deleteOps.set(op.ref, op);
-                }
-            }
-            else if (op.op === "promote") {
-                // C-2 / #381: when both a promote and a merge target the same ref,
-                // queue the promote FIRST rather than discarding it. The promote op
-                // routes through createProposal (the human-gated proposal queue), so
-                // it is non-destructive. The merge follows after the proposal is
-                // created. This preserves the human reviewer's ability to inspect the
-                // promotion before the source memory is merged/deleted.
-                // AGM K*8 — retain the maximally informative consistent subset.
-                promoteOps.set(op.ref, op);
-            }
-            else if (op.op === "contradict") {
-                // Deduplicate by ref+contradictedByRef pair.
-                const key = `${op.ref}|${op.contradictedByRef}`;
-                if (!contradictOps.has(key)) {
-                    contradictOps.set(key, op);
-                }
-            }
-        }
-    }
-    // Second pass: enforce merge-wins-over-delete and deduplicate secondaries.
-    //
-    // 1. Delete/secondary ordering bug: the per-chunk loop removes delete ops
-    //    for secondaries that were already in deleteOps, but misses the case
-    //    where the delete chunk came first. A full sweep here fixes both orders.
-    //
-    // 2. Cross-merge secondary dedup: if ref A is a secondary in two merge ops,
-    //    only the first (insertion-order) retains it. Without this, a successful
-    //    merge credits A to mergedSecondaries and a later merge's emitMerge-
-    //    FailureSkips also charges A to skipReasons — double-counting A while
-    //    processed has it only once.
-    //
-    // 3. Primary-as-secondary dedup: if ref A is a primary in one merge op and
-    //    a secondary in another, remove A from the secondary list. Both merges
-    //    would otherwise claim A (merged++ for A, then mergedSecondaries++ for A)
-    //    breaking the invariant the same way.
-    // Also remove delete ops for any ref claimed by a promote op (handles the
-    // case where the delete chunk appeared before the promote chunk).
-    for (const ref of promoteOps.keys()) {
-        deleteOps.delete(ref);
-    }
-    const claimedSecondaries = new Set();
-    for (const mergeOp of mergeOps.values()) {
-        deleteOps.delete(mergeOp.primary);
-        mergeOp.secondaries = mergeOp.secondaries.filter((sec) => {
-            if (mergeOps.has(sec)) {
-                warnings.push(`Merge: secondary ${sec} is also a merge primary — removing from secondary list to avoid double-count.`);
-                return false;
-            }
-            if (claimedSecondaries.has(sec)) {
-                warnings.push(`Merge: secondary ${sec} appears in multiple merge ops — retaining in first op only.`);
-                return false;
-            }
-            claimedSecondaries.add(sec);
-            deleteOps.delete(sec);
-            return true;
-        });
-    }
-    // C-2 / #381: promote ops are ordered BEFORE merge ops so that the
-    // human-gated proposal queue entry is created before any destructive merge.
-    // Phase B processes ops in array order, so promote executes first.
-    const ops = [
-        ...promoteOps.values(),
-        ...mergeOps.values(),
-        ...deleteOps.values(),
-        ...contradictOps.values(),
-    ];
-    return { ops, warnings };
-}
 function getJournalPath(stashDir) {
     return path.join(stashDir, ".akm", "consolidate-journal.json");
 }
@@ -672,6 +412,32 @@ function backupFile(filePath, backupDir, name) {
         // best-effort
     }
 }
+// ── WS-3b: Generation frontmatter injection ───────────────────────────────────
+/**
+ * Inject `generation` and `source_refs` into merged content.
+ * generation = max(sourceGenerations) + 1.
+ * source_refs = UNION of the provided provenance refs (participants + their
+ * cited sources) with anything already present in the merged frontmatter —
+ * R5 §4.2: the old set-if-absent behavior dropped second-generation
+ * provenance whenever the LLM emitted its own (partial) source_refs.
+ * Fails open — returns original content if frontmatter can't be parsed.
+ */
+function injectGenerationFrontmatter(mergedContent, sourceGenerations, provenanceRefs) {
+    try {
+        const parsed = parseFrontmatter(mergedContent);
+        const existingFm = parsed.data;
+        const existingRefs = Array.isArray(existingFm.source_refs) ? existingFm.source_refs.map(String) : [];
+        const updatedFm = {
+            ...existingFm,
+            generation: computeMergedGeneration(sourceGenerations),
+            source_refs: [...new Set([...existingRefs, ...provenanceRefs])],
+        };
+        return assembleAssetFromString(serializeFrontmatter(updatedFm), parsed.content);
+    }
+    catch {
+        return mergedContent; // fail open
+    }
+}
 // ── Archive helper (P1-B: soft-invalidation) ─────────────────────────────────
 /**
  * Move a memory asset to `.akm/archive/` with `status: superseded` frontmatter
@@ -742,8 +508,8 @@ function archiveMemory(filePath, stashDir, ref, reason, opIndex, supersededBy, w
  * silent 400s from LM Studio). The investigation lives at
  * `/tmp/akm-health-investigations/consolidation-no-op.md`.
  */
-function resolveConsolidateLlmConfig(config) {
-    const consolidateProcess = config.profiles?.improve?.default?.processes?.consolidate;
+function resolveConsolidateLlmConfig(config, activeProfile) {
+    const consolidateProcess = getImproveProcessConfig(config, "consolidate", activeProfile);
     const runnerSpec = resolveImproveProcessRunnerFromProfile(consolidateProcess, config);
     if (runnerSpec && runnerIsLlm(runnerSpec)) {
         return runnerSpec.connection;
@@ -752,6 +518,58 @@ function resolveConsolidateLlmConfig(config) {
     // fall back to the default LLM profile rather than disabling the pass.
     return getDefaultLlmConfig(config);
 }
+// ── Judged-state cache (#581) ────────────────────────────────────────────────
+/**
+ * Stable content hash for a memory file used by the judged-state cache (#581)
+ * and the body-embedding cache (WS-3a). Uses `cacheHash` from dedup.ts
+ * (sha256 of the case-preserving stripped body) plus the sorted `tags` list,
+ * so semantic-metadata drift re-enters the judge while cosmetic frontmatter
+ * touches (`updated:`, `inferenceProcessed:`) still hash identically and never
+ * force a needless re-judge. Returns `undefined` on any read/parse error so
+ * callers fail open (treat the memory as un-cached → it stays in the LLM pool).
+ */
+function computeMemoryContentHash(filePath) {
+    try {
+        const raw = fs.readFileSync(filePath, "utf8");
+        let tagSuffix = "";
+        try {
+            const { data } = parseFrontmatter(raw);
+            const tags = Array.isArray(data?.tags) ? data.tags.map(String).sort() : [];
+            if (tags.length > 0)
+                tagSuffix = `\n\u0000tags:${tags.join(",")}`;
+        }
+        catch {
+            // Unparseable frontmatter → body-only hash (prior behaviour).
+        }
+        return cacheHash(raw + tagSuffix);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Build a {@link ConsolidateResult} from partial overrides, filling the envelope
+ * defaults (schemaVersion / ok / shape + the zeroed counters). Collapses the
+ * ~7 near-identical result literals that previously appeared verbatim at every
+ * early-return site and the final return of `akmConsolidateInner`. Callers pass
+ * only the fields that differ from the all-zero, ok, non-preview baseline.
+ */
+export function makeConsolidateResult(overrides) {
+    return {
+        schemaVersion: 1,
+        ok: true,
+        shape: "consolidate-result",
+        dryRun: false,
+        previewOnly: false,
+        processed: 0,
+        merged: 0,
+        deleted: 0,
+        promoted: [],
+        contradicted: 0,
+        warnings: [],
+        ...overrides,
+    };
+}
 // ── Main entry point ─────────────────────────────────────────────────────────
 export async function akmConsolidate(opts = {}) {
     const startMs = Date.now();
@@ -762,24 +580,75 @@ export async function akmConsolidate(opts = {}) {
     const config = opts.config ?? loadConfig();
     const stashDir = opts.stashDir ?? resolveStashDir();
     if (!isLlmFeatureEnabled(config, "memory_consolidation")) {
-        return {
-            schemaVersion: 1,
-            ok: true,
-            shape: "consolidate-result",
+        return makeConsolidateResult({
             dryRun: opts.dryRun ?? false,
-            previewOnly: false,
             target: opts.target ?? stashDir,
-            processed: 0,
-            merged: 0,
-            deleted: 0,
-            promoted: [],
-            contradicted: 0,
-            warnings: [],
             durationMs: Date.now() - startMs,
-        };
+        });
     }
     const warnings = [];
     checkForIncompleteJournal(stashDir, opts.recoveryMode ?? "abort", warnings);
+    // WS-3a: open one state.db handle shared by the body-embedding cache (dedup
+    // + cluster) and the judged-state cache. All callers in the function body
+    // receive this handle; it is closed in the `finally` block below.
+    // Fail-open: any open error leaves it `undefined` and all cache paths skip.
+    let sharedStateDb;
+    try {
+        sharedStateDb = openStateDatabase();
+    }
+    catch {
+        // State DB unavailable → skip the embedding cache for this run.
+    }
+    try {
+        return await akmConsolidateInner(opts, config, stashDir, startMs, sourceRun, warnings, sharedStateDb);
+    }
+    finally {
+        sharedStateDb?.close();
+    }
+}
+/** Fresh, zeroed accounting accumulators for one consolidate run. */
+function createConsolidateAccounting() {
+    const acc = {
+        judgedNoAction: 0,
+        failedChunkMemories: 0,
+        totalChunksFailed: 0,
+        skipReasons: [],
+        skipReasonByRef: new Map(),
+        judgedNoActionRefs: new Set(),
+        pushSkipReason: () => { },
+    };
+    acc.pushSkipReason = (op, ref, reason) => {
+        // 2026-05-27 cross-chunk double-count fix: if `ref` already contributed
+        // to judgedNoAction in its own chunk (a different chunk proposed an op
+        // for it that is now being rejected here), promote it from the
+        // judgedNoAction bucket into the more specific skipReason bucket.
+        // Preserves the invariant: processed == actioned + judgedNoAction +
+        // Σ(skipReasons) + failedChunkMemories.
+        if (acc.judgedNoActionRefs.delete(ref))
+            acc.judgedNoAction--;
+        const existing = acc.skipReasonByRef.get(ref);
+        if (existing) {
+            // Already counted once for accounting. Append the extra skip to the
+            // ref's grouped entry for observability without adding a new array
+            // entry (which would break the accounting invariant).
+            existing.skips.push({ op, reason });
+            return;
+        }
+        const entry = { ref, skips: [{ op, reason }] };
+        acc.skipReasonByRef.set(ref, entry);
+        acc.skipReasons.push(entry);
+    };
+    return acc;
+}
+/**
+ * Pass 1 — narrow the memory pool before any LLM work: drop stale DB entries,
+ * partition hot-probation assets, run the deterministic dedup pre-pass, apply
+ * incremental-since and judged-state-cache narrowing, and cap to `opts.limit`
+ * (oldest-modified first). Returns an early envelope when the pool empties at
+ * any stage; otherwise returns the narrowed pool and the state the plan/apply
+ * passes consume. Behavior-identical to the former inlined narrowing block.
+ */
+async function narrowConsolidationPool(opts, config, stashDir, startMs, warnings, sharedStateDb) {
     let memories = loadMemoriesForSource(opts.target, stashDir, warnings);
     // Pre-flight: filter out stale DB entries whose files no longer exist on
     // disk. Without this, memories deleted by a prior run (but not yet
@@ -791,43 +660,177 @@ export async function akmConsolidate(opts = {}) {
         warnings.push(`Pre-flight: filtered ${staleCount} stale DB entr${staleCount === 1 ? "y" : "ies"} (file absent on disk) from memory pool before chunking.`);
     }
     memories = memories.filter((m) => fs.existsSync(m.filePath));
+    // (The former WS-3b Step 0a homeostatic demotion pass was removed — R4:
+    // it was default-off and self-undoing (the next salience recompute
+    // unconditionally overwrote the demoted values). Continuous decay now lives
+    // in computeSalience's recency term, whose floor decays on a long half-life.)
+    // ── WS-3b Step 0c: Filter hot-probation assets from LLM merge pool ─────────
+    // Hot-probation assets (system-generated, not yet graduated from intake pass)
+    // are processed by the dedup pre-pass but excluded from the LLM clustering.
+    // This prevents noisy extractions from polluting LLM context. The dedup pass
+    // below still runs against them so they're cleaned up deterministically.
+    // DEFAULT OFF — only active when `processes.extract.hotProbation.enabled === true`
+    // (the flag that causes extract to tag new extractions as hot-probation).
+    // Without that flag no assets will ever carry the hot-probation marker, so
+    // running the filter loop would be pure unnecessary I/O over the full corpus.
+    const hotProbationEnabled = getImproveProcessConfig(config, "extract", opts.improveProfile)?.hotProbation
+        ?.enabled === true;
+    let hotProbationCount = 0;
+    if (hotProbationEnabled) {
+        const hotProbationMemories = [];
+        const nonProbationMemories = [];
+        for (const m of memories) {
+            try {
+                const raw = fs.readFileSync(m.filePath, "utf8");
+                const parsed = parseFrontmatter(raw);
+                if (shouldSkipHotProbationInLlm(parsed.data)) {
+                    hotProbationMemories.push(m);
+                    hotProbationCount++;
+                }
+                else {
+                    nonProbationMemories.push(m);
+                }
+            }
+            catch {
+                nonProbationMemories.push(m); // fail open
+            }
+        }
+        if (hotProbationCount > 0) {
+            warnings.push(`Hot-probation: ${hotProbationCount} hot-probation asset(s) routed to dedup-only pass (excluded from LLM merge pool).`);
+            memories = nonProbationMemories;
+        }
+    }
+    // ── Deterministic dedup pre-pass (#617) ─────────────────────────────────────
+    // Cheap, no-LLM fast path that collapses the obvious near-duplicates
+    // (`.derived` ↔ origin pairs + content twins) BEFORE the embedding-clustered
+    // LLM consolidation. DEFAULT OFF — when `dedup.enabled !== true` this is a
+    // no-op and the pass behaves byte-identically to today. Collapsed variants
+    // are pruned from the LLM pool so the model only ever sees genuinely
+    // distinct-but-related memories. Each dropped variant is archived (soft
+    // invalidation) before deletion, matching the LLM merge path.
+    // Dry-run never mutates the filesystem, so the dedup pre-pass is skipped
+    // entirely under `--dry-run` (the LLM plan preview below is unaffected).
+    let dedupCollapsed = 0;
+    if (opts.dedup?.enabled && !opts.dryRun) {
+        const dedupTimestamp = timestampForFilename();
+        const dedupResult = await runDeterministicDedup(stashDir, opts.dedup, config, (variantFilePath, variantName) => {
+            archiveMemory(variantFilePath, stashDir, `memory:${variantName}`, "collapsed by deterministic dedup pre-pass", -1, undefined, warnings);
+            backupFile(variantFilePath, getBackupDir(stashDir, dedupTimestamp), variantName);
+        }, opts.signal, sharedStateDb);
+        dedupCollapsed = dedupResult.collapsed;
+        warnings.push(...dedupResult.warnings);
+        if (dedupResult.consumedRefs.length > 0) {
+            const consumed = new Set(dedupResult.consumedRefs);
+            memories = memories.filter((m) => !consumed.has(`memory:${m.name}`));
+            warnings.push(`Deterministic dedup: collapsed ${dedupResult.collapsed} near-duplicate memor${dedupResult.collapsed === 1 ? "y" : "ies"} (no LLM) before chunking.`);
+        }
+    }
     if (memories.length === 0) {
         return {
-            schemaVersion: 1,
-            ok: true,
-            shape: "consolidate-result",
-            dryRun: opts.dryRun ?? false,
-            previewOnly: false,
-            target: opts.target ?? stashDir,
-            processed: 0,
-            merged: 0,
-            deleted: 0,
-            promoted: [],
-            contradicted: 0,
-            warnings,
-            durationMs: Date.now() - startMs,
+            done: true,
+            result: makeConsolidateResult({
+                dryRun: opts.dryRun ?? false,
+                target: opts.target ?? stashDir,
+                // #617: the deterministic dedup pre-pass may have emptied the pool by
+                // collapsing every remaining memory into a canonical. Surface those
+                // collapses in `deleted` so the run reports the work it actually did.
+                deleted: dedupCollapsed,
+                warnings,
+                durationMs: Date.now() - startMs,
+            }),
         };
     }
     if (opts.incrementalSince) {
         memories = narrowToIncrementalCandidates(memories, opts.incrementalSince, warnings, opts.neighborsPerChanged);
         if (memories.length === 0) {
             return {
-                schemaVersion: 1,
-                ok: true,
-                shape: "consolidate-result",
-                dryRun: opts.dryRun ?? false,
-                previewOnly: false,
-                target: opts.target ?? stashDir,
-                processed: 0,
-                merged: 0,
-                deleted: 0,
-                promoted: [],
-                contradicted: 0,
-                warnings,
-                durationMs: Date.now() - startMs,
+                done: true,
+                result: makeConsolidateResult({
+                    dryRun: opts.dryRun ?? false,
+                    target: opts.target ?? stashDir,
+                    warnings,
+                    durationMs: Date.now() - startMs,
+                }),
+            };
+        }
+    }
+    // WS-5 perf telemetry accumulators. These are collected throughout the run and
+    // merged into `perfTelemetry` on the final ConsolidateResult.
+    // `dedupPoolSize` = memories entering judgedCache narrowing (after dedup+incremental+limit).
+    // `judgedCacheSkipped` = memories skipped by the cache.
+    // `llmPoolSize` = memories actually sent to the LLM.
+    // `embedMs/cacheHits/cacheMisses` = accumulated from clusterMemoriesBySimilarity.
+    const perfMs = { dedupPoolSize: memories.length, judgedCacheSkipped: 0 };
+    // ── Judged-state cache narrowing (#581) ─────────────────────────────────────
+    // DEFAULT OFF. When enabled, skip every memory whose current content hash
+    // equals the hash recorded the last time the consolidate LLM judged it
+    // (judged-unchanged → no re-judge). This converts coverage from O(window) to
+    // O(changed/new) so one run can sweep the whole corpus while the LLM only
+    // sees genuinely new/changed memories. `currentHashByName` is populated for
+    // EVERY surviving memory (whether or not the cache is on) so the post-LLM
+    // recording step can upsert judged state without re-reading the files; when
+    // the cache is off it stays empty and the recording step is a no-op.
+    const judgedCacheEnabled = opts.judgedCache?.enabled !== false;
+    const currentHashByName = new Map();
+    if (judgedCacheEnabled) {
+        for (const m of memories) {
+            const h = computeMemoryContentHash(m.filePath);
+            if (h !== undefined)
+                currentHashByName.set(m.name, h);
+        }
+        let cachedMap = new Map();
+        {
+            // Use the shared state.db handle if available; open a local one otherwise.
+            const dbForJudged = sharedStateDb;
+            if (dbForJudged) {
+                try {
+                    cachedMap = getConsolidationJudgedMap(dbForJudged, memories.map((m) => `memory:${m.name}`));
+                }
+                catch {
+                    cachedMap = new Map();
+                }
+            }
+            else {
+                try {
+                    cachedMap = withStateDb((localDb) => getConsolidationJudgedMap(localDb, memories.map((m) => `memory:${m.name}`)));
+                }
+                catch {
+                    // State DB unavailable → fail open: judge the full pool this run.
+                    cachedMap = new Map();
+                }
+            }
+        }
+        const beforeCount = memories.length;
+        memories = memories.filter((m) => {
+            const cur = currentHashByName.get(m.name);
+            // No readable hash → keep (fail open; let the LLM judge it).
+            if (cur === undefined)
+                return true;
+            const cached = cachedMap.get(`memory:${m.name}`);
+            // Skip only when previously judged AND content is byte-identical since.
+            return !(cached !== undefined && cached.content_hash === cur);
+        });
+        const skipped = beforeCount - memories.length;
+        perfMs.judgedCacheSkipped = skipped; // WS-5 perf telemetry
+        if (skipped > 0) {
+            warnings.push(`Judged-state cache: skipped ${skipped} memor${skipped === 1 ? "y" : "ies"} judged-unchanged (no LLM); ${memories.length} remain for judging.`);
+        }
+        if (memories.length === 0) {
+            return {
+                done: true,
+                result: makeConsolidateResult({
+                    dryRun: opts.dryRun ?? false,
+                    target: opts.target ?? stashDir,
+                    deleted: dedupCollapsed,
+                    warnings,
+                    durationMs: Date.now() - startMs,
+                }),
             };
         }
     }
+    if (opts.limit === undefined && memories.length > 150) {
+        warnings.push(`Consolidation: pool has ${memories.length} memories and no limit is set. Consider adding a limit to your consolidate config to prevent timeouts on slow LLM endpoints.`);
+    }
     if (opts.limit !== undefined && memories.length > opts.limit) {
         // Order oldest-modified-first before capping so the limit selects the
         // stalest memories rather than a fixed head of the (rowid-ordered) DB
@@ -849,13 +852,25 @@ export async function akmConsolidate(opts = {}) {
         warnings.push(`Consolidation: pool capped at ${opts.limit} of ${memories.length} memories (limit option, oldest-modified first).`);
         memories = memories.slice(0, opts.limit);
     }
+    return { done: false, memories, dedupCollapsed, perfMs, judgedCacheEnabled, currentHashByName };
+}
+/**
+ * Pass 2 — turn the narrowed pool into an executable plan. Sizes chunks to the
+ * model context window, clusters by embedding similarity, injects the
+ * anti-collapse random fraction, applies the cold-start budget cap, runs the
+ * per-chunk LLM calls (with retry + failure-rate abort), records judged-state
+ * cache outcomes, and reconciles the per-chunk op arrays via {@link mergePlans}.
+ * Populates `accounting` in place. Behavior-identical to the former inlined
+ * plan-generation block.
+ */
+async function planConsolidation(opts, config, stashDir, startMs, memories, warnings, sharedStateDb, judgedCacheEnabled, currentHashByName, accounting) {
     // Consolidation always uses the HTTP LLM client directly — never the agent
     // CLI. The agent CLI is for interactive agent sessions (reflect, propose);
     // structured JSON generation works better and faster via HTTP.
     //
     // Honor `profiles.improve.default.processes.consolidate.profile` first; fall
     // back to the default LLM. See {@link resolveConsolidateLlmConfig}.
-    const llmConfig = resolveConsolidateLlmConfig(config);
+    const llmConfig = resolveConsolidateLlmConfig(config, opts.improveProfile);
     const isHttpPath = !!llmConfig;
     // Chunk sizing: derive a safe chunk size from the configured model context
     // window so that the full prompt (system prompt + chunk user prompt) never
@@ -872,16 +887,64 @@ export async function akmConsolidate(opts = {}) {
     const chunkSize = computeSafeChunkSize(modelContextLength, bodyTruncation, opts.maxChunkSize);
     // -- Phase A: plan generation -----------------------------------------------
     const sourceName = opts.target ?? stashDir;
+    // WS-5: capture llmPoolSize = memories entering the LLM (after all filtering).
+    const llmPoolSize = memories.length;
     // C-1 / #380: Pre-cluster memories by embedding similarity before chunking.
     // This ensures that semantically similar memories land in the same LLM
     // context window, allowing the model to detect and merge duplicates that
     // would otherwise be split across chunks and survive indefinitely.
     // mem0 arXiv:2504.19413, A-MEM arXiv:2502.12110.
     // Fails open: if embeddings are unavailable or fail, original order is used.
-    const clusteredMemories = await clusterMemoriesBySimilarity(memories, config);
+    const { ordered: clusteredMemories, embedTelemetry } = await clusterMemoriesBySimilarity(memories, config, sharedStateDb);
+    // WS-3b Anti-collapse step 8c: inject random (non-similar) clusters.
+    // A small fraction (default 5%) of the pool is shuffled into random positions
+    // so the pipeline isn't PURELY similarity-driven. This prevents rich-get-richer
+    // entrenchment where only the most-retrieved assets ever get consolidated.
+    // DEFAULT ON since R5 — opt out via antiCollapse.enabled: false.
+    let finalClusteredMemories = clusteredMemories;
+    {
+        const antiCollapseForCluster = getImproveProcessConfig(config, "consolidate", opts.improveProfile)?.antiCollapse ?? {};
+        if (antiCollapseForCluster.enabled !== false && clusteredMemories.length > 2) {
+            const fraction = antiCollapseForCluster.randomClusterFraction ?? 0.05;
+            const randomCount = Math.max(1, Math.floor(clusteredMemories.length * fraction));
+            // Pick `randomCount` positions to inject random (un-clustered) members.
+            // Use a seeded-ish shuffle: sort by hash of the name so it's deterministic
+            // per run but not strictly similarity-driven.
+            const shuffled = [...clusteredMemories].sort((a, b) => {
+                // Deterministic shuffle: compare sha256-ish (use name hash as proxy).
+                const ha = a.name.split("").reduce((acc, c) => ((acc << 5) - acc + c.charCodeAt(0)) | 0, 0);
+                const hb = b.name.split("").reduce((acc, c) => ((acc << 5) - acc + c.charCodeAt(0)) | 0, 0);
+                return ha - hb;
+            });
+            const randomSlice = shuffled.slice(0, randomCount);
+            const randomSet = new Set(randomSlice.map((m) => m.name));
+            // Insert random members at intervals through the clustered sequence.
+            const withRandom = [];
+            const interval = Math.max(2, Math.floor(clusteredMemories.length / randomCount));
+            let randomIdx = 0;
+            for (let i = 0; i < clusteredMemories.length; i++) {
+                const m = clusteredMemories[i];
+                if (m && !randomSet.has(m.name))
+                    withRandom.push(m);
+                if (i > 0 && i % interval === 0 && randomIdx < randomSlice.length) {
+                    const r = randomSlice[randomIdx++];
+                    if (r)
+                        withRandom.push(r);
+                }
+            }
+            // Append any remaining random members not yet inserted.
+            while (randomIdx < randomSlice.length) {
+                const r = randomSlice[randomIdx++];
+                if (r)
+                    withRandom.push(r);
+            }
+            finalClusteredMemories = withRandom;
+            warnings.push(`Anti-collapse: injected ${randomCount} random (non-similarity-driven) cluster member(s) into consolidation pool (fraction=${fraction}).`);
+        }
+    }
     const chunks = [];
-    for (let i = 0; i < clusteredMemories.length; i += chunkSize) {
-        chunks.push(clusteredMemories.slice(i, i + chunkSize));
+    for (let i = 0; i < finalClusteredMemories.length; i += chunkSize) {
+        chunks.push(finalClusteredMemories.slice(i, i + chunkSize));
     }
     // 2026-05-27 prompt-context fix: precompute body-hashes of pending
     // consolidate proposals once, so the per-chunk prompt can annotate
@@ -890,71 +953,86 @@ export async function akmConsolidate(opts = {}) {
     // 4h on this user's stack. See
     // /tmp/akm-health-investigations/tuning-reasons-investigation.md §Q3.
     const pendingProposalBodyHashes = loadPendingConsolidateProposalHashes(stashDir);
+    // ── Cold-start budget estimation ─────────────────────────────────────────────
+    // Estimate wall-clock cost BEFORE issuing any LLM calls. When a signal is
+    // provided and the estimated cost exceeds ~60% of the remaining budget we
+    // auto-reduce the pool and log the reduction so the run never starts work
+    // it cannot finish (avoiding SIGTERM mid-LLM-call).
+    //
+    // Formula: chunks.length × p90_chunk_seconds. The p90 comes from
+    // `opts.p90ChunkSecondsDefault` (caller-supplied, typically from the profile
+    // config); absent = 30 s (conservative default matching a medium local LLM).
+    //
+    // "Remaining budget" is read from a custom property on the AbortSignal if
+    // the caller (improve.ts) has attached one. Without it no auto-reduction
+    // fires but the check is still cheap to run.
+    if (chunks.length > 10 && opts.signal) {
+        const p90Chunk = opts.p90ChunkSecondsDefault ?? 30;
+        const estimatedSeconds = chunks.length * p90Chunk;
+        // remainingBudgetMs is a non-standard extension set by improve.ts when it
+        // creates the budget AbortController. Undefined = no budget information.
+        const budgetMs = opts.signal.remainingBudgetMs;
+        if (budgetMs !== undefined && budgetMs > 0) {
+            const remainingSeconds = budgetMs / 1000;
+            if (estimatedSeconds > remainingSeconds * 0.6) {
+                const safeCaps = Math.max(1, Math.floor((remainingSeconds * 0.6) / p90Chunk));
+                const removedChunks = chunks.length - safeCaps;
+                if (removedChunks > 0) {
+                    const msg = `[consolidate] cold-start budget: estimated ${estimatedSeconds.toFixed(0)}s > 60% of remaining ${remainingSeconds.toFixed(0)}s; ` +
+                        `reducing pool from ${chunks.length} to ${safeCaps} chunks (${removedChunks} deferred to next run).`;
+                    warn(msg);
+                    warnings.push(msg);
+                    chunks.splice(safeCaps);
+                }
+            }
+        }
+    }
     warn(`[consolidate] ${memories.length} memories / ${chunks.length} chunk(s) / chunk_size=${chunkSize}` +
         ` / pending-proposal hashes: ${pendingProposalBodyHashes.size}`);
+    // Consolidate output merges memories (non-wiki) → stash authoring standards.
+    // Resolved ONCE per run and passed to each chunk prompt (facts not re-read
+    // per chunk).
+    const standardsContext = resolveStashStandards(stashDir);
     const chunkOpsArrays = [];
-    // Structured skip-reason histogram (2026-05-26): every deterministic
-    // post-LLM op rejection site below also calls `pushSkipReason` so the
-    // health rollup can aggregate without regex-parsing English warning
-    // strings. See `/tmp/akm-health-investigations/tuning-reasons-investigation.md` §Q2.
-    const skipReasons = [];
-    // Per-ref grouping of skipReasons entries. A ref occupies exactly one
-    // accounting bucket and therefore exactly one skipReasons array entry;
-    // subsequent skip ops for the same ref append to that entry's `skips[]`
-    // rather than pushing a second array entry (that would inflate
-    // Σ(skipReasons) and break the invariant by +1 per duplicate).
-    const skipReasonByRef = new Map();
-    const pushSkipReason = (op, ref, reason) => {
-        // 2026-05-27 cross-chunk double-count fix: if `ref` already contributed
-        // to judgedNoAction in its own chunk (a different chunk proposed an op
-        // for it that is now being rejected here), promote it from the
-        // judgedNoAction bucket into the more specific skipReason bucket.
-        // Preserves the invariant: processed == actioned + judgedNoAction +
-        // Σ(skipReasons) + failedChunkMemories.
-        if (judgedNoActionRefs.delete(ref))
-            judgedNoAction--;
-        const existing = skipReasonByRef.get(ref);
-        if (existing) {
-            // Already counted once for accounting. Append the extra skip to the
-            // ref's grouped entry for observability without adding a new array
-            // entry (which would break the accounting invariant).
-            existing.skips.push({ op, reason });
-            return;
-        }
-        const entry = { ref, skips: [{ op, reason }] };
-        skipReasonByRef.set(ref, entry);
-        skipReasons.push(entry);
-    };
     // judgedNoAction tracks memories the LLM saw inside a chunk but proposed
     // no op for. Computed per chunk as `chunk.length − unique(targetRefs in ops)`.
-    let judgedNoAction = 0;
-    // 2026-05-27 cross-chunk double-count fix: refs that contributed to
-    // judgedNoAction in their own chunk. When a different chunk's op references
-    // one of these as a secondary and that op later fails, the ref would land
-    // in BOTH judgedNoAction and skipReasons (delta +1 per occurrence). Track
-    // the set so the merge-failure path can decrement and re-bucket.
-    const judgedNoActionRefs = new Set();
-    // 2026-05-26 accounting-leak fix: memories that belong to a chunk whose
-    // LLM call failed before any per-chunk noAction calculation runs. They
-    // would otherwise vanish from the envelope's accounting (no judgedNoAction
-    // bump, no skipReasons entry, no actioned counter).
-    let failedChunkMemories = 0;
-    // 2026-05-26 accounting-leak fix: per-secondary tally so successful merges
-    // account for `1 + secondaries.length` memories instead of 1.
-    let mergedSecondaries = 0;
+    // The structured skip-reason histogram (2026-05-26) plus the cross-chunk
+    // double-count fixes now live on `accounting`; every deterministic post-LLM
+    // op rejection site calls `accounting.pushSkipReason`. See
+    // `/tmp/akm-health-investigations/tuning-reasons-investigation.md` §Q2.
+    //
+    // Judged-state cache (#581): coarse outcome per memory NAME the LLM actually
+    // judged in a successfully-parsed chunk this run. "actioned" = an op targeted
+    // it; "no_action" = the LLM saw it and proposed nothing. Populated only when
+    // the cache is enabled (otherwise it stays empty and the post-loop recording
+    // step is a no-op). Memories in failed/aborted chunks are NOT recorded, so a
+    // transient LLM failure never poisons the cache into skipping them next run.
+    const judgedOutcomeByName = new Map();
     // C-6 / #392: Replace two-consecutive-failures abort with failure-rate threshold.
     // Consecutive-count policies are brittle against transient LM Studio reloads:
     // two transient failures abort the run even though the next chunk would succeed.
     // Rate-based abort (≥50% failure over ≥4 chunks) is more robust.
     // Tanenbaum, Distributed Systems §8 — rate-based policies with minimum sample sizes.
     let totalChunksProcessed = 0;
-    let totalChunksFailed = 0;
     const ABORT_MIN_CHUNKS = 4;
     const ABORT_FAILURE_RATE = 0.5;
     for (let chunkIdx = 0; chunkIdx < chunks.length; chunkIdx++) {
+        // Budget-signal check: break cleanly before the next LLM call if the
+        // caller's budget has been exhausted. Commits work done so far.
+        if (opts.signal?.aborted) {
+            const skipped = chunks.length - chunkIdx;
+            const msg = `[consolidate] budget signal aborted before chunk ${chunkIdx + 1}/${chunks.length}; ${skipped} chunk(s) not processed (partial_timeout — work done so far committed).`;
+            warn(msg);
+            warnings.push(msg);
+            // Account for memories in unprocessed chunks.
+            for (let i = chunkIdx; i < chunks.length; i++) {
+                accounting.failedChunkMemories += chunks[i].length;
+            }
+            break;
+        }
         // Abort if failure rate >= 50% over at least 4 processed chunks.
         if (totalChunksProcessed >= ABORT_MIN_CHUNKS) {
-            const failureRate = totalChunksFailed / totalChunksProcessed;
+            const failureRate = accounting.totalChunksFailed / totalChunksProcessed;
             if (failureRate >= ABORT_FAILURE_RATE) {
                 const skipped = chunks.length - chunkIdx;
                 const abortMsg = `Consolidation aborted — failure rate ${(failureRate * 100).toFixed(0)}% over ${totalChunksProcessed} chunks (>= ${ABORT_FAILURE_RATE * 100}% threshold). LLM may be unavailable. ${skipped} chunk(s) skipped.`;
@@ -965,7 +1043,7 @@ export async function akmConsolidate(opts = {}) {
                 // rejected). Without this, the accounting invariant fails by
                 // `Σ(unattempted_chunk.length)` whenever the abort fires.
                 for (let i = chunkIdx; i < chunks.length; i++) {
-                    failedChunkMemories += chunks[i].length;
+                    accounting.failedChunkMemories += chunks[i].length;
                 }
                 break;
             }
@@ -983,22 +1061,23 @@ export async function akmConsolidate(opts = {}) {
         // LLM-failure-rate abort policy — no request was attempted.
         if (chunk.length > 0 && chunk.every((m) => isHotCapturedMemory(m.filePath))) {
             for (const m of chunk)
-                judgedNoActionRefs.add(`memory:${m.name}`);
-            judgedNoAction += chunk.length;
+                accounting.judgedNoActionRefs.add(`memory:${m.name}`);
+            accounting.judgedNoAction += chunk.length;
             warn(`[consolidate] chunk ${chunkIdx + 1}/${chunks.length}: all ${chunk.length} memories are captureMode: hot — skipping LLM (judged no-action).`);
             continue;
         }
         warn(`[consolidate] chunk ${chunkIdx + 1}/${chunks.length} (${chunk.length} memories) …`);
-        const userPrompt = buildChunkPrompt(sourceName, chunk, chunkIdx, chunks.length, bodyTruncation, pendingProposalBodyHashes);
-        let raw = await tryLlmFeature("memory_consolidation", config, async () => {
+        const userPrompt = buildChunkPrompt(sourceName, chunk, chunkIdx, chunks.length, bodyTruncation, pendingProposalBodyHashes, standardsContext);
+        // Single chunk LLM call, wrapped in the feature gate. Deduplicated across
+        // the first attempt and the retry below (the two blocks were byte-identical
+        // apart from their fallback error string). responseSchema lift (PR 1,
+        // asset-writers-investigation §5): providers with `supportsJsonSchema: true`
+        // enforce the shape upstream; others fall through to
+        // `parseEmbeddedJsonResponse` on the response side.
+        const callChunkLlm = (fallbackError) => tryLlmFeature("memory_consolidation", config, async () => {
             if (!llmConfig)
                 return { ok: false, error: "No LLM configured for consolidation" };
             try {
-                // responseSchema lift (PR 1, asset-writers-investigation §5): pass
-                // the consolidate plan schema so providers with
-                // `supportsJsonSchema: true` enforce shape upstream. Providers that
-                // ignore the option fall through to the existing
-                // `parseEmbeddedJsonResponse` path on the response side.
                 const content = await chatCompletion(llmConfig, [
                     { role: "system", content: CONSOLIDATE_SYSTEM_PROMPT },
                     { role: "user", content: userPrompt },
@@ -1008,36 +1087,24 @@ export async function akmConsolidate(opts = {}) {
             catch (e) {
                 return { ok: false, error: String(e) };
             }
-        }, { ok: false, error: `chunk ${chunkIdx + 1} failed` });
+        }, { ok: false, error: fallbackError });
+        let raw = await callChunkLlm(`chunk ${chunkIdx + 1} failed`);
         if (!raw.ok) {
             // Single retry with 2s backoff before recording chunk as lost.
             // Recovers transient Shredder LM Studio timeouts without significantly
             // extending run time. Only marks failed if both attempts fail.
             await new Promise((r) => setTimeout(r, 2_000));
-            const retry = await tryLlmFeature("memory_consolidation", config, async () => {
-                if (!llmConfig)
-                    return { ok: false, error: "No LLM configured for consolidation" };
-                try {
-                    const content = await chatCompletion(llmConfig, [
-                        { role: "system", content: CONSOLIDATE_SYSTEM_PROMPT },
-                        { role: "user", content: userPrompt },
-                    ], { responseSchema: CONSOLIDATE_PLAN_JSON_SCHEMA, enableThinking: false });
-                    return { ok: true, content };
-                }
-                catch (e) {
-                    return { ok: false, error: String(e) };
-                }
-            }, { ok: false, error: `chunk ${chunkIdx + 1} retry failed` });
+            const retry = await callChunkLlm(`chunk ${chunkIdx + 1} retry failed`);
             if (!retry.ok) {
                 warn(retry.error ?? `chunk ${chunkIdx + 1} failed after retry`);
                 warnings.push(retry.error ?? `chunk ${chunkIdx + 1} failed after retry`);
                 totalChunksProcessed++;
-                totalChunksFailed++;
+                accounting.totalChunksFailed++;
                 // Account for the chunk's memories under the failed-chunk bucket.
                 // judgedNoAction does NOT run on this path (it's after the success
                 // guards) so without this the accounting invariant breaks on every
                 // chunk-level transport/parse failure.
-                failedChunkMemories += chunk.length;
+                accounting.failedChunkMemories += chunk.length;
                 continue;
             }
             raw = retry;
@@ -1054,8 +1121,8 @@ export async function akmConsolidate(opts = {}) {
             warn(`Chunk ${chunkIdx + 1}: invalid plan from AI — skipping.${hint}`);
             warnings.push(`Chunk ${chunkIdx + 1}: invalid plan from AI — skipping.${hint}`);
             totalChunksProcessed++;
-            totalChunksFailed++;
-            failedChunkMemories += chunk.length;
+            accounting.totalChunksFailed++;
+            accounting.failedChunkMemories += chunk.length;
             continue;
         }
         totalChunksProcessed++; // success
@@ -1095,41 +1162,185 @@ export async function akmConsolidate(opts = {}) {
             const memRef = `memory:${m.name}`;
             if (!targetRefs.has(memRef)) {
                 chunkNoAction++;
-                judgedNoActionRefs.add(memRef);
+                accounting.judgedNoActionRefs.add(memRef);
+                // Judged-state cache (#581): the LLM saw this memory and proposed
+                // nothing → record judged-unchanged so the next run can skip it.
+                if (judgedCacheEnabled)
+                    judgedOutcomeByName.set(m.name, "no_action");
+            }
+            else if (judgedCacheEnabled) {
+                // An op targeted this memory → it was judged + actioned.
+                judgedOutcomeByName.set(m.name, "actioned");
             }
         }
-        judgedNoAction += chunkNoAction;
+        accounting.judgedNoAction += chunkNoAction;
         chunkOpsArrays.push(ops);
     }
+    // ── Judged-state cache recording (#581) ─────────────────────────────────────
+    // Persist judged state for every memory the LLM actually judged this run so
+    // the next run can skip the unchanged ones. Keyed by current content hash so
+    // a later body edit (different hash) re-enters the LLM pool. DEFAULT OFF and
+    // skipped under --dry-run (dry-run mutates nothing). Failed/aborted chunks
+    // contributed no entries to `judgedOutcomeByName`, so a transient LLM outage
+    // never caches a memory as judged.
+    if (judgedCacheEnabled && !opts.dryRun && judgedOutcomeByName.size > 0) {
+        // Use the shared state.db handle; open a local one as fallback.
+        const doRecord = (db) => {
+            const judgedAt = new Date(startMs).toISOString();
+            for (const [name, outcome] of judgedOutcomeByName) {
+                const hash = currentHashByName.get(name);
+                if (hash === undefined)
+                    continue;
+                upsertConsolidationJudged(db, {
+                    entryKey: `memory:${name}`,
+                    contentHash: hash,
+                    judgedAt,
+                    outcome,
+                });
+            }
+        };
+        if (sharedStateDb) {
+            try {
+                doRecord(sharedStateDb);
+            }
+            catch (e) {
+                warnings.push(`Judged-state cache: failed to record judged state: ${String(e)}`);
+            }
+        }
+        else {
+            try {
+                withStateDb((localDb) => doRecord(localDb));
+            }
+            catch (e) {
+                warnings.push(`Judged-state cache: failed to record judged state: ${String(e)}`);
+            }
+        }
+    }
     // Build the known-refs set from the already-filtered memory pool so
     // mergePlans() can reject LLM-hallucinated primary refs before execution.
     const knownRefs = new Set(memories.map((m) => `memory:${m.name}`));
     const { ops: allOps, warnings: mergeWarnings } = mergePlans(chunkOpsArrays, knownRefs);
     warnings.push(...mergeWarnings);
+    return { allOps, totalChunks: chunks.length, llmPoolSize, embedTelemetry, isHttpPath, sourceName };
+}
+/**
+ * Pass 3 — execute the reconciled plan against the filesystem: resolve the
+ * write target, journal the batch, dispatch each op to its handler, then commit
+ * the batch at the boundary and clean up the journal. Mutates `accounting` via
+ * the op-handlers' `pushSkipReason`. Behavior-identical to the former inlined
+ * write block. Never invoked on the dry-run or aborted-confirm paths.
+ */
+async function applyConsolidationPlan(config, stashDir, sourceRun, memories, warnings, allOps, accounting, dedupCollapsed, activeProfile) {
+    // -- Phase B + writes -------------------------------------------------------
+    const target = resolveWriteTarget(config);
+    const timestamp = timestampForFilename();
+    const backupDir = getBackupDir(stashDir, timestamp);
+    // Write journal before any mutations
+    writeJournal(stashDir, allOps, timestamp);
+    const counts = {
+        merged: 0,
+        deleted: 0,
+        contradicted: 0, // C-3 / #382: count of contradiction edges written
+        mergeFloorViolations: 0, // R5 §4.2: advisory merge-information-floor failures
+        mergedSecondaries: 0,
+    };
+    const promoted = [];
+    // Within-run dedup: track source refs for which a promote proposal was
+    // already created this run. The LLM can return multiple promote ops for
+    // different source memories that happen to have identical content (all are
+    // duplicate memories), so we also need a content-hash guard below.
+    const promotedSourceRefs = new Set();
+    // Build a lookup map: ref → MemoryEntry
+    const memoryByRef = new Map();
+    for (const m of memories) {
+        memoryByRef.set(`memory:${m.name}`, m);
+    }
+    const opCtx = {
+        config,
+        improveProfile: activeProfile,
+        stashDir,
+        sourceRun,
+        target,
+        backupDir,
+        memoryByRef,
+        promoted,
+        promotedSourceRefs,
+        warnings,
+        counts,
+        pushSkipReason: accounting.pushSkipReason,
+    };
+    // Thin dispatch over the op discriminator — each branch is now an isolated,
+    // independently-testable handler that mutates `opCtx`.
+    for (let opIndex = 0; opIndex < allOps.length; opIndex++) {
+        const op = allOps[opIndex];
+        const opDisplayRef = op.op === "merge" ? op.primary : op.op === "contradict" ? `${op.ref} ↔ ${op.contradictedByRef}` : op.ref;
+        warn(`[consolidate] ${opIndex + 1}/${allOps.length} ${op.op} ${opDisplayRef}`);
+        switch (op.op) {
+            case "merge":
+                await handleMergeOp(op, opIndex, opCtx);
+                break;
+            case "delete":
+                await handleDeleteOp(op, opIndex, opCtx);
+                break;
+            case "promote":
+                await handlePromoteOp(op, opCtx);
+                break;
+            case "contradict":
+                await handleContradictOp(op, opCtx);
+                break;
+        }
+    }
+    const { merged, deleted, contradicted, mergeFloorViolations, mergedSecondaries } = counts;
+    // 0.9.0 (issue #507): batch-at-boundary commit. The merge/delete loop above
+    // wrote one merged primary and deleted N secondaries to the resolved target
+    // with NO per-asset commit. If the target is a writable git source and any
+    // asset was mutated, commit the whole batch ONCE here (stages .akm/ +
+    // siblings together). No-op for filesystem/primary-stash targets.
+    if (merged > 0 || deleted > 0) {
+        commitWriteTargetBoundary(target, `Consolidate: ${merged} merged, ${deleted} removed`);
+    }
+    cleanupJournal(stashDir, timestamp);
+    // [signoff 2026-06-15] TTL archive cleanup machinery RETIRED (WS-3a).
+    // The elaborate archiveRetentionDays / archive-dir scan existed only to satisfy
+    // the old irrecoverability constraint. Stashes are now git-backed, so git
+    // history is the recovery path — no bespoke archive TTL needed. Any files in
+    // .akm/archive/ will stay there harmlessly until the operator prunes them with
+    // `git rm` or `find .akm/archive -mtime +90 -delete`. Changed N files this
+    // run; recover any via `git show <sha>:<path>` or `git restore <path>`.
+    if (merged > 0 || deleted > 0 || dedupCollapsed > 0) {
+        const totalChanged = merged + deleted + dedupCollapsed;
+        warnings.push(`Changed ${totalChanged} file(s) this run. Recover any via git if needed (git history is the backstop).`);
+    }
+    return { merged, deleted, contradicted, mergeFloorViolations, mergedSecondaries, promoted };
+}
+async function akmConsolidateInner(opts, config, stashDir, startMs, sourceRun, warnings, sharedStateDb) {
+    // -- Pass 1: narrow the memory pool (may early-return an envelope) ----------
+    const narrowed = await narrowConsolidationPool(opts, config, stashDir, startMs, warnings, sharedStateDb);
+    if (narrowed.done)
+        return narrowed.result;
+    const { memories, dedupCollapsed, perfMs, judgedCacheEnabled, currentHashByName } = narrowed;
+    // -- Pass 2: build the LLM plan (populates the shared accounting counters) ---
+    const accounting = createConsolidateAccounting();
+    const { allOps, totalChunks, llmPoolSize, embedTelemetry, isHttpPath, sourceName } = await planConsolidation(opts, config, stashDir, startMs, memories, warnings, sharedStateDb, judgedCacheEnabled, currentHashByName, accounting);
     // -- Dry-run: show AI plan without executing any writes --------------------
     if (opts.dryRun) {
-        return {
-            schemaVersion: 1,
-            ok: true,
-            shape: "consolidate-result",
+        return makeConsolidateResult({
             dryRun: true,
             previewOnly: true,
             target: sourceName,
             processed: memories.length,
-            merged: 0,
-            deleted: 0,
-            promoted: [],
-            contradicted: 0,
-            failedChunks: totalChunksFailed,
-            totalChunks: chunks.length,
-            judgedNoAction,
-            skipReasons,
-            mergedSecondaries,
-            failedChunkMemories,
+            failedChunks: accounting.totalChunksFailed,
+            totalChunks,
+            judgedNoAction: accounting.judgedNoAction,
+            skipReasons: accounting.skipReasons,
+            // No merge has executed on the preview path — the per-secondary tally is
+            // provably still 0 here (it only increments in the op-execution loop).
+            mergedSecondaries: 0,
+            failedChunkMemories: accounting.failedChunkMemories,
             planned: allOps,
             warnings,
             durationMs: Date.now() - startMs,
-        };
+        });
     }
     warn(`[consolidate] plan: ${allOps.length} operation(s)`);
     // -- HTTP path: warn about quality and confirm unless auto-accepted --------
@@ -1150,555 +1361,28 @@ export async function akmConsolidate(opts = {}) {
             const nonInteractive = process.stdin.isTTY === false || process.env.AKM_NON_INTERACTIVE === "1";
             const answer = nonInteractive ? false : await promptConfirm(`Apply ${n} operations? [y/N] `);
             if (!answer) {
-                return {
-                    schemaVersion: 1,
-                    ok: true,
-                    shape: "consolidate-result",
-                    dryRun: false,
+                return makeConsolidateResult({
                     previewOnly: true,
                     target: sourceName,
                     processed: memories.length,
-                    merged: 0,
-                    deleted: 0,
-                    promoted: [],
-                    contradicted: 0,
-                    failedChunks: totalChunksFailed,
-                    totalChunks: chunks.length,
-                    judgedNoAction,
-                    skipReasons,
-                    mergedSecondaries,
-                    failedChunkMemories,
+                    failedChunks: accounting.totalChunksFailed,
+                    totalChunks,
+                    judgedNoAction: accounting.judgedNoAction,
+                    skipReasons: accounting.skipReasons,
+                    // No merge executed on the abort path — mergedSecondaries is still 0.
+                    mergedSecondaries: 0,
+                    failedChunkMemories: accounting.failedChunkMemories,
                     planned: allOps,
                     warnings: [...warnings, nonInteractive ? "Non-interactive context: skipped apply." : "Aborted by user."],
                     durationMs: Date.now() - startMs,
-                };
-            }
-        }
-    }
-    // -- Phase B + writes -------------------------------------------------------
-    const target = resolveWriteTarget(config);
-    const timestamp = timestampForFilename();
-    const backupDir = getBackupDir(stashDir, timestamp);
-    // Write journal before any mutations
-    writeJournal(stashDir, allOps, timestamp);
-    let merged = 0;
-    let deleted = 0;
-    const promoted = [];
-    let contradicted = 0; // C-3 / #382: count of contradiction edges written
-    // Within-run dedup: track source refs for which a promote proposal was
-    // already created this run. The LLM can return multiple promote ops for
-    // different source memories that happen to have identical content (all are
-    // duplicate memories), so we also need a content-hash guard below.
-    const promotedSourceRefs = new Set();
-    // Build a lookup map: ref → MemoryEntry
-    const memoryByRef = new Map();
-    for (const m of memories) {
-        memoryByRef.set(`memory:${m.name}`, m);
-    }
-    for (let opIndex = 0; opIndex < allOps.length; opIndex++) {
-        const op = allOps[opIndex];
-        const opDisplayRef = op.op === "merge" ? op.primary : op.op === "contradict" ? `${op.ref} ↔ ${op.contradictedByRef}` : op.ref;
-        warn(`[consolidate] ${opIndex + 1}/${allOps.length} ${op.op} ${opDisplayRef}`);
-        if (op.op === "merge") {
-            // Accounting helper: emit a per-participant skipReason for failed
-            // merges so primary + every loaded-memory secondary land in the
-            // structured skip histogram. Pre-2026-05-26 only the primary was
-            // counted (1 skipReason per failed merge), leaving N secondaries
-            // unaccounted for in the `processed == actioned + noAction + Σskips`
-            // invariant — the source of the 4–11 silent leaks per run.
-            const emitMergeFailureSkips = (reason) => {
-                if (memoryByRef.has(op.primary))
-                    pushSkipReason("merge", op.primary, reason);
-                for (const secRef of op.secondaries) {
-                    if (memoryByRef.has(secRef))
-                        pushSkipReason("merge", secRef, reason);
-                }
-            };
-            const primaryEntry = memoryByRef.get(op.primary);
-            if (!primaryEntry) {
-                // This fires when a prior op in the same run consumed this ref as a
-                // secondary and Fix-A pruned it from memoryByRef. It should NOT fire
-                // for hallucinated primaries (those are dropped by mergePlans() before
-                // reaching here). If this counter is non-zero, suspect an intra-run
-                // cross-chunk race, not a filter regression.
-                warnings.push(`Merge: primary ${op.primary} not found in loaded memories (pruned by prior op this run) — skipping.`);
-                emitMergeFailureSkips("merge_primary_missing");
-                continue;
-            }
-            // Defense-in-depth: even if the entry is in memoryByRef (pre-flight ran
-            // before this run's own ops), the file may have been deleted by a
-            // concurrent process or an edge case the pre-flight filter missed.
-            if (!fs.existsSync(primaryEntry.filePath)) {
-                warnings.push(`Merge: primary ${op.primary} file gone at execution time (stale entry) — skipping.`);
-                emitMergeFailureSkips("merge_primary_file_gone");
-                continue;
-            }
-            // Phase B: generate merged content
-            const secondaryBodies = [];
-            for (const secRef of op.secondaries) {
-                const secEntry = memoryByRef.get(secRef);
-                if (!secEntry) {
-                    warnings.push(`Merge: secondary ${secRef} not found — skipping merge op.`);
-                    // No accounting impact: a missing secondary is a phantom ref and
-                    // never contributed to any chunk's targetRefs reduction. We still
-                    // continue the loop to gather the remaining valid secondaries.
-                    continue;
-                }
-                secondaryBodies.push(secRef);
-            }
-            if (secondaryBodies.length === 0) {
-                warnings.push(`Merge: ${op.primary} has no valid secondaries — skipping.`);
-                emitMergeFailureSkips("merge_no_valid_secondaries");
-                continue;
-            }
-            // Pre-flight hot guard — skip the LLM call entirely if any participant
-            // is hot or unparseable. Without this, mixed chunks still send hot merges
-            // to the planner which proposes them; generateMergedContent() is then
-            // called, produces output without `description`, and the skip is
-            // misattributed to merge_missing_description instead of the real cause.
-            const preflightParticipants = [op.primary, ...op.secondaries];
-            const preflightBlocked = preflightParticipants.flatMap((ref) => {
-                const e = memoryByRef.get(ref);
-                if (!e)
-                    return [];
-                const verdict = consolidateGuardStatus(e.filePath);
-                if (verdict === "hot" || verdict === "unparseable")
-                    return [{ ref, verdict }];
-                return [];
-            });
-            if (preflightBlocked.length > 0) {
-                const detail = preflightBlocked.map((p) => `${p.ref} (${p.verdict})`).join(", ");
-                warnings.push(`Merge: refused for ${op.primary} — ${preflightBlocked.length} participant(s) blocked by hot/unparseable frontmatter guard (pre-flight): ${detail}`);
-                emitMergeFailureSkips("merge_participant_blocked");
-                continue;
-            }
-            let primaryBody = "";
-            try {
-                primaryBody = fs.readFileSync(primaryEntry.filePath, "utf8");
-            }
-            catch {
-                warnings.push(`Merge: could not read primary ${op.primary} — skipping.`);
-                emitMergeFailureSkips("merge_read_failed");
-                continue;
-            }
-            const mergeResult = await generateMergedContent(config, op.primary, primaryBody, op.secondaries, memoryByRef);
-            if ("error" in mergeResult) {
-                warnings.push(`Merge: ${mergeResult.error} for ${mergeResult.detail}.`);
-                emitMergeFailureSkips(mergeResult.error);
-                continue;
-            }
-            const mergedContent = mergeResult.content;
-            // Validate frontmatter of merged content — must have a `---` block
-            // with at minimum a `description` field. We parse via the hand-rolled
-            // parser (cheap) AND require non-empty description. This guards against
-            // the historical defect where merged memories were written back with
-            // empty `description` and later polluted the promote path.
-            let parsedMerged;
-            try {
-                parsedMerged = parseFrontmatter(mergedContent);
-            }
-            catch {
-                warnings.push(`Merge: merged content for ${op.primary} has invalid frontmatter — skipping.`);
-                emitMergeFailureSkips("merge_invalid_frontmatter");
-                continue;
-            }
-            if (parsedMerged.frontmatter === null) {
-                warnings.push(`Merge: merged content for ${op.primary} has no frontmatter block — skipping.`);
-                emitMergeFailureSkips("merge_invalid_frontmatter");
-                continue;
-            }
-            const mergedDesc = parsedMerged.data.description;
-            if (typeof mergedDesc !== "string" || mergedDesc.trim().length === 0) {
-                warnings.push(`Merge: merged content for ${op.primary} missing description — skipping.`);
-                emitMergeFailureSkips("merge_missing_description");
-                continue;
-            }
-            const truncReason = detectTruncatedDescription(mergedDesc);
-            if (truncReason) {
-                warnings.push(`Merge: merged content for ${op.primary} has truncated description (${truncReason}) — skipping.`);
-                emitMergeFailureSkips("merge_truncated_description");
-                continue;
-            }
-            // captureMode:hot guard — refuse the merge if ANY participating memory
-            // (primary or secondary) was user-captured or has unparseable frontmatter
-            // (could have hidden a hot flag). Hot memories are user-explicit and
-            // must not be deleted/overwritten by the consolidate LLM. 14 user
-            // memories were silent-deleted by consolidate before this guard landed;
-            // recovery required copying from .akm/archive/ by hand.
-            const mergeParticipants = [op.primary, ...op.secondaries];
-            const blockedParticipants = mergeParticipants.flatMap((ref) => {
-                const e = memoryByRef.get(ref);
-                if (!e)
-                    return [];
-                const verdict = consolidateGuardStatus(e.filePath);
-                if (verdict === "hot" || verdict === "unparseable")
-                    return [{ ref, verdict }];
-                return [];
-            });
-            if (blockedParticipants.length > 0) {
-                const detail = blockedParticipants.map((p) => `${p.ref} (${p.verdict})`).join(", ");
-                warnings.push(`Merge: refused for ${op.primary} — ${blockedParticipants.length} participant(s) blocked by hot/unparseable frontmatter guard: ${detail}`);
-                emitMergeFailureSkips("merge_participant_blocked");
-                continue;
-            }
-            // Backup secondaries before deleting
-            for (const secRef of op.secondaries) {
-                const secEntry = memoryByRef.get(secRef);
-                if (secEntry && fs.existsSync(secEntry.filePath)) {
-                    backupFile(secEntry.filePath, backupDir, secEntry.name);
-                }
-            }
-            // Write merged primary
-            try {
-                const parsedPrimary = parseAssetRef(op.primary);
-                await writeAssetToSource(target.source, target.config, parsedPrimary, mergedContent);
-            }
-            catch (e) {
-                warnings.push(`Merge: write failed for ${op.primary}: ${String(e)}`);
-                emitMergeFailureSkips("merge_write_failed");
-                continue;
-            }
-            // Archive and delete secondaries (P1-B: soft-invalidation)
-            for (const secRef of op.secondaries) {
-                const secEntry = memoryByRef.get(secRef);
-                if (!secEntry)
-                    continue;
-                if (fs.existsSync(secEntry.filePath)) {
-                    archiveMemory(secEntry.filePath, stashDir, secRef, "merged into primary", opIndex, op.primary, warnings);
-                }
-                try {
-                    const parsedSec = parseAssetRef(secRef);
-                    await deleteAssetFromSource(target.source, target.config, parsedSec);
-                    markJournalCompleted(stashDir, secRef);
-                }
-                catch (e) {
-                    warnings.push(`Merge: delete failed for ${secRef}: ${String(e)}`);
-                }
-            }
-            markJournalCompleted(stashDir, op.primary);
-            merged++;
-            // 2026-05-26 accounting-leak fix: `merged` is op-level, but each
-            // successful merge actions `1 + secondaries.length` memories. Without
-            // this counter the accounting invariant breaks by `secondaries.length`
-            // per successful merge (chunk loop excluded all secondaries from
-            // judgedNoAction via targetRefs, but only the primary is credited to
-            // `merged`). Count only loaded-memory secondaries; phantom secondary
-            // refs never affected any chunk's targetRefs in the first place.
-            for (const secRef of op.secondaries) {
-                if (memoryByRef.has(secRef))
-                    mergedSecondaries++;
-            }
-            // Prune consumed refs from memoryByRef so later ops in this run cannot
-            // reference an absorbed secondary as a merge primary and proceed with a
-            // stale entry. Primary is rewritten (not deleted), so we only remove
-            // secondaries; the primary ref remains valid under its new content.
-            for (const secRef of op.secondaries) {
-                memoryByRef.delete(secRef);
-            }
-        }
-        else if (op.op === "delete") {
-            const entry = memoryByRef.get(op.ref);
-            if (!entry) {
-                warnings.push(`Delete: ${op.ref} not found in loaded memories — skipping.`);
-                // Phantom ref: not in the batch so not in processed. Pushing to
-                // skipReasons would inflate Σ(skipReasons) without a matching processed
-                // entry, breaking the accounting invariant. Visibility is preserved via
-                // the warnings array above.
-                continue;
-            }
-            // captureMode:hot guard — refuse to delete user-captured memories OR
-            // memories whose frontmatter is unparseable (could have hidden the hot
-            // flag). The consolidate LLM was deleting hot-captured user memos as
-            // "redundant" — 14 such deletes were silently archived between
-            // 2026-05-19 and 2026-05-20 before this guard. Hot memories are
-            // user-explicit and may only be deleted by the user.
-            const guard = consolidateGuardStatus(entry.filePath);
-            if (guard === "hot" || guard === "unparseable") {
-                warnings.push(`Delete: refused for ${op.ref} — ${guard === "hot" ? "captureMode:hot (user-explicit; never auto-delete)" : "frontmatter unparseable (cannot verify hot flag absent)"}. Reason from LLM: "${op.reason ?? "n/a"}"`);
-                pushSkipReason("delete", op.ref, "captureMode_hot_refused");
-                continue;
-            }
-            if (fs.existsSync(entry.filePath)) {
-                backupFile(entry.filePath, backupDir, entry.name);
-                // P1-B: soft-invalidation archive before hard delete
-                archiveMemory(entry.filePath, stashDir, op.ref, op.reason, opIndex, undefined, warnings);
-            }
-            try {
-                const parsedRef = parseAssetRef(op.ref);
-                await deleteAssetFromSource(target.source, target.config, parsedRef);
-                markJournalCompleted(stashDir, op.ref);
-                deleted++;
-                // Prune from memoryByRef so later ops in this run cannot reference a
-                // deleted memory as a merge primary or secondary.
-                memoryByRef.delete(op.ref);
-            }
-            catch (e) {
-                // Distinguish "file already absent" from genuine failures. A prior run
-                // may have deleted the file but the DB was not yet re-indexed, so the
-                // ref still appeared in memoryByRef. The delete goal is already met.
-                const msg = e instanceof Error ? e.message : String(e);
-                if (msg.includes("not found in source")) {
-                    warnings.push(`Delete: ${op.ref} — file already absent (stale DB entry); skipping.`);
-                    pushSkipReason("delete", op.ref, "delete_already_gone");
-                }
-                else {
-                    warnings.push(`Delete: failed for ${op.ref}: ${String(e)}`);
-                    pushSkipReason("delete", op.ref, "delete_failed");
-                }
-            }
-        }
-        else if (op.op === "promote") {
-            const entry = memoryByRef.get(op.ref);
-            if (!entry) {
-                warnings.push(`Promote: ${op.ref} not found in loaded memories — skipping.`);
-                // Phantom ref: not in processed, so no skipReason (same rationale as
-                // delete_ref_missing above).
-                continue;
-            }
-            // Within-run source-ref dedup: skip if this source memory was already
-            // promoted earlier in this run (safety belt — mergePlans already
-            // deduplicates promote ops by source ref via Map, but this guard also
-            // catches any future code paths that bypass mergePlans).
-            if (promotedSourceRefs.has(op.ref)) {
-                warnings.push(`Skipping promote: ${op.ref} already promoted in this run`);
-                pushSkipReason("promote", op.ref, "promote_already_promoted_this_run");
-                continue;
-            }
-            let knowledgeRef = op.knowledgeRef;
-            try {
-                parseAssetRef(knowledgeRef);
-            }
-            catch {
-                const slug = op.knowledgeRef
-                    .replace(/^knowledge:/, "")
-                    .replace(/[^a-z0-9-]/gi, "-")
-                    .toLowerCase();
-                knowledgeRef = `knowledge:${slug}`;
-                warnings.push(`Normalized invalid ref "${op.knowledgeRef}" → "${knowledgeRef}"`);
-            }
-            // Idempotency: check pending proposals by target ref
-            const existingProposals = listProposals(stashDir, { ref: knowledgeRef });
-            if (existingProposals.some((p) => p.status === "pending")) {
-                warnings.push(`Skipping promote: pending proposal already exists for ${knowledgeRef}`);
-                pushSkipReason("promote", op.ref, "promote_pending_proposal_exists");
-                continue;
-            }
-            // Idempotency: check if knowledge asset already exists
-            const parsedKnowledgeRef = parseAssetRef(knowledgeRef);
-            const destPath = path.join(target.source.path, "knowledge", `${parsedKnowledgeRef.name}.md`);
-            if (fs.existsSync(destPath)) {
-                warnings.push(`Skipping promote: ${knowledgeRef} already exists in source`);
-                pushSkipReason("promote", op.ref, "promote_already_exists");
-                continue;
-            }
-            let memoryContent = "";
-            try {
-                memoryContent = fs.readFileSync(entry.filePath, "utf8");
-            }
-            catch (e) {
-                warnings.push(`Promote: could not read ${op.ref}: ${String(e)}`);
-                pushSkipReason("promote", op.ref, "promote_read_failed");
-                continue;
-            }
-            // Defensive sanitization: legacy memory files written by older
-            // consolidate runs may still carry outer code fences or broken YAML.
-            // Strip them here so we never propose a polluted asset.
-            const promoteSanitized = sanitizeMergedContent(memoryContent);
-            if (!promoteSanitized.ok) {
-                warnings.push(`Promote: rejected ${op.ref} — source memory failed sanitization (${promoteSanitized.reason}).`);
-                pushSkipReason("promote", op.ref, "promote_sanitization_failed");
-                continue;
-            }
-            memoryContent = promoteSanitized.result.content;
-            // SOURCE_SUPERSEDED guard: refuse to promote a memory whose source
-            // frontmatter carries `status: superseded`. Predicate at module top
-            // (`hasSupersededStatus`) so tests can exercise it directly.
-            if (hasSupersededStatus(promoteSanitized.result.frontmatter)) {
-                warnings.push(`Promote: refused for ${op.ref} → ${knowledgeRef} — source memory has status:superseded; superseded memories are not promotable knowledge.`);
-                pushSkipReason("promote", op.ref, "promote_superseded");
-                continue;
-            }
-            // Parse the source memory up-front so the body/frontmatter checks below
-            // share the same parsed view.
-            const parsedMemory = parseFrontmatter(memoryContent);
-            // Reject sources whose body is too small to make useful knowledge.
-            // Observed failure: memory files whose body is literally a tags string
-            // ("discord,notification,send-notification") get promoted to knowledge
-            // proposals that no reviewer would accept. Threshold is conservative —
-            // 100 chars catches single-line tag dumps without rejecting genuinely
-            // terse but valid notes.
-            const PROMOTE_BODY_MIN_CHARS = 100;
-            const sourceBody = parsedMemory.content.trim();
-            if (sourceBody.length < PROMOTE_BODY_MIN_CHARS) {
-                warnings.push(`Promote: rejected ${op.ref} → ${knowledgeRef} — source memory body is too small (${sourceBody.length} chars; need ≥${PROMOTE_BODY_MIN_CHARS}) to make useful knowledge.`);
-                pushSkipReason("promote", op.ref, "promote_source_too_small");
-                continue;
-            }
-            // Cross-run + within-run content dedup: if an identical body already
-            // exists in ANY pending consolidate proposal (regardless of target ref),
-            // skip. This prevents duplicate proposals when:
-            //   (a) Multiple source memories have identical bodies but differ only
-            //       in noise frontmatter (`inferenceProcessed: true` twin alongside
-            //       the original; differing `updated:` timestamps; etc.) — the body
-            //       is the load-bearing content, so dedup must hash on body only.
-            //   (b) A prior run created a proposal for the same body under a
-            //       different knowledgeRef slug.
-            const bodyHash = createHash("sha256").update(sourceBody, "utf8").digest("hex");
-            const allPendingConsolidateProposals = listProposals(stashDir, { status: "pending" }).filter((p) => p.source === "consolidate");
-            const contentDupProposal = allPendingConsolidateProposals.find((p) => {
-                const otherBody = parseFrontmatter(p.payload.content).content.trim();
-                return createHash("sha256").update(otherBody, "utf8").digest("hex") === bodyHash;
-            });
-            if (contentDupProposal) {
-                warnings.push(`Skipping promote: identical body already pending as proposal ${contentDupProposal.id} (ref: ${contentDupProposal.ref}); skipping duplicate for ${op.ref} → ${knowledgeRef}`);
-                pushSkipReason("promote", op.ref, "dedup_pending_proposal");
-                continue;
-            }
-            try {
-                // Use LLM-provided description; fall back to memory's own description
-                // (post-sanitization frontmatter is authoritative).
-                const description = (typeof op.description === "string" && op.description.trim()
-                    ? op.description.trim()
-                    : parsedMemory.data?.description?.trim()) ?? "";
-                // Validate the resolved frontmatter before emitting a proposal.
-                // Required field: non-empty description. Reject obvious truncation
-                // markers (description ends with `,`/`;`/`:`/`...`/hanging connector)
-                // so the queue never sees half-formed metadata that the reviewer
-                // would only reject.
-                const fmCheck = validateProposalFrontmatter({ description });
-                if (!fmCheck.ok) {
-                    warnings.push(`Promote: rejected ${op.ref} → ${knowledgeRef} — ${fmCheck.reason}.`);
-                    pushSkipReason("promote", op.ref, "promote_invalid_frontmatter");
-                    continue;
-                }
-                // Merge `description` INTO the body's YAML frontmatter so it lands in
-                // the on-disk asset when the proposal is accepted. The descriptionQuality
-                // validator parses `payload.content` body (not the envelope
-                // `payload.frontmatter`), and a memory's native frontmatter has
-                // `captureMode`/`beliefState`/etc. but never `description` — without
-                // this merge, 60+ pending proposals were blocked at accept-time with
-                // MISSING_FRONTMATTER_DESCRIPTION even though the envelope had it.
-                // (The body-frontmatter assumption baked into the 2026-05-20 comment
-                // below was wrong: body fm and envelope fm only converge when the
-                // writer explicitly merges them, which it now does.)
-                const mergedBodyFm = {
-                    ...(parsedMemory.data ?? {}),
-                    description,
-                };
-                const serializedMergedFm = serializeFrontmatter(mergedBodyFm);
-                const proposalContent = assembleAssetFromString(serializedMergedFm, parsedMemory.content);
-                // Pre-emit dedup against pending consolidate proposals from the
-                // same improve run (slug-variant match). The cross-run content-hash
-                // dedup inside `mergePlans` handles duplicates against existing
-                // stash assets — see commit history for the deletion of the
-                // unbounded embedding + cross-type slug branches.
-                const dedup = await checkPreEmitDedup({
-                    candidateRef: knowledgeRef,
-                    candidateText: `${description}. ${memoryContent}`,
-                    stashDir,
-                    config,
                 });
-                if (dedup.duplicate) {
-                    warnings.push(`Promote: skipped ${op.ref} → ${knowledgeRef} — ${dedup.reason}.`);
-                    pushSkipReason("promote", op.ref, "promote_dedup_window");
-                    continue;
-                }
-                const proposalResult = createProposal(stashDir, {
-                    ref: knowledgeRef,
-                    source: "consolidate",
-                    sourceRun,
-                    payload: {
-                        content: proposalContent,
-                        frontmatter: { description },
-                    },
-                    ...(typeof op.confidence === "number" ? { confidence: op.confidence } : {}),
-                });
-                if (isProposalSkipped(proposalResult)) {
-                    warnings.push(`Promote: skipped proposal for ${op.ref} (${proposalResult.reason}): ${proposalResult.message}`);
-                    pushSkipReason("promote", op.ref, `promote_proposal_${proposalResult.reason}`);
-                }
-                else {
-                    promoted.push(proposalResult.id);
-                    promotedSourceRefs.add(op.ref);
-                    markJournalCompleted(stashDir, op.ref);
-                }
-            }
-            catch (e) {
-                warnings.push(`Promote: createProposal failed for ${op.ref}: ${String(e)}`);
-                pushSkipReason("promote", op.ref, "promote_create_failed");
-            }
-        }
-        else if (op.op === "contradict") {
-            // C-3 / #382: Write contradictedBy edges so resolveFamilyContradictions
-            // (the SCC resolver in memory-improve.ts) has edges to work on.
-            // Zep arXiv:2501.13956 §3 — unified belief-revision with contradiction edges.
-            const entry = memoryByRef.get(op.ref);
-            const contradictorEntry = memoryByRef.get(op.contradictedByRef);
-            if (!entry) {
-                warnings.push(`Contradict: ${op.ref} not found in loaded memories — skipping.`);
-                // Phantom ref: not in processed, so no skipReason (same rationale as
-                // delete_ref_missing).
-                continue;
-            }
-            if (!contradictorEntry) {
-                warnings.push(`Contradict: ${op.contradictedByRef} not found — skipping.`);
-                // op.ref IS in the batch (entry found above) so the skipReason is
-                // correctly charged against a real processed memory.
-                pushSkipReason("contradict", op.ref, "contradict_target_missing");
-                continue;
-            }
-            try {
-                // Write the contradiction edge: op.ref is contradicted by op.contradictedByRef
-                writeContradictEdge(entry.filePath, op.contradictedByRef);
-                contradicted++;
-                markJournalCompleted(stashDir, op.ref);
-            }
-            catch (e) {
-                warnings.push(`Contradict: failed to write edge for ${op.ref}: ${String(e)}`);
-                pushSkipReason("contradict", op.ref, "contradict_write_failed");
-            }
-        }
-    }
-    // 0.9.0 (issue #507): batch-at-boundary commit. The merge/delete loop above
-    // wrote one merged primary and deleted N secondaries to the resolved target
-    // with NO per-asset commit. If the target is a writable git source and any
-    // asset was mutated, commit the whole batch ONCE here (stages .akm/ +
-    // siblings together). No-op for filesystem/primary-stash targets.
-    if (merged > 0 || deleted > 0) {
-        commitWriteTargetBoundary(target, `Consolidate: ${merged} merged, ${deleted} removed`);
-    }
-    cleanupJournal(stashDir, timestamp);
-    // TTL cleanup: remove archive entries older than archiveRetentionDays (default 90).
-    // C-5 / #391: emit an `archive_cleanup` event before each deletion so the
-    // audit trail records what was lost. Outbox pattern (EIP, Hohpe-Woolf) —
-    // any event that is recorded must be queryable; silent deletes are an anti-pattern.
-    const archiveDir = path.join(stashDir, ".akm", "archive");
-    if (fs.existsSync(archiveDir)) {
-        const retentionMs = (config.archiveRetentionDays ?? 90) * 86_400_000;
-        const cutoff = Date.now() - retentionMs;
-        for (const fname of fs.readdirSync(archiveDir)) {
-            const fp = path.join(archiveDir, fname);
-            try {
-                const stat = fs.statSync(fp);
-                if (stat.mtimeMs < cutoff) {
-                    // Emit event before deletion so the record survives the purge.
-                    appendEvent({
-                        eventType: "archive_cleanup",
-                        metadata: {
-                            file: fname,
-                            filePath: fp,
-                            ageMs: Date.now() - stat.mtimeMs,
-                            retentionMs,
-                        },
-                    });
-                    fs.unlinkSync(fp);
-                }
-            }
-            catch {
-                /* ignore race conditions */
             }
         }
     }
+    // -- Pass 3: execute the plan against the filesystem ------------------------
+    const { merged, deleted, contradicted, mergeFloorViolations, mergedSecondaries, promoted } = await applyConsolidationPlan(config, stashDir, sourceRun, memories, warnings, allOps, accounting, dedupCollapsed, opts.improveProfile);
+    const runDurationMs = Date.now() - startMs;
+    const budgetFraction = opts.runBudgetMs !== undefined && opts.runBudgetMs > 0 ? runDurationMs / opts.runBudgetMs : undefined;
     return {
         schemaVersion: 1,
         ok: true,
@@ -1708,245 +1392,577 @@ export async function akmConsolidate(opts = {}) {
         target: sourceName,
         processed: memories.length,
         merged,
-        deleted,
+        // #617: fold the deterministic dedup pre-pass collapses into the reported
+        // deleted count. Each collapse removed exactly one variant file with NO
+        // LLM call before the LLM pass ran on the pruned pool.
+        deleted: deleted + dedupCollapsed,
         promoted,
         contradicted,
-        failedChunks: totalChunksFailed,
-        totalChunks: chunks.length,
-        judgedNoAction,
-        skipReasons,
+        mergeFloorViolations,
+        failedChunks: accounting.totalChunksFailed,
+        totalChunks,
+        judgedNoAction: accounting.judgedNoAction,
+        skipReasons: accounting.skipReasons,
         mergedSecondaries,
-        failedChunkMemories,
+        failedChunkMemories: accounting.failedChunkMemories,
         warnings,
-        durationMs: Date.now() - startMs,
+        durationMs: runDurationMs,
+        perfTelemetry: {
+            dedupPoolSize: perfMs.dedupPoolSize,
+            llmPoolSize,
+            judgedCacheSkipped: perfMs.judgedCacheSkipped,
+            embedMs: embedTelemetry.embedMs,
+            embedCacheHits: embedTelemetry.cacheHits,
+            embedCacheMisses: embedTelemetry.cacheMisses,
+            ...(budgetFraction !== undefined ? { estimatedBudgetFractionUsed: budgetFraction } : {}),
+        },
     };
 }
-// ── Helpers ─────────────────────────────────────────────────────────────────
-// ── LLM-output sanitization ─────────────────────────────────────────────────
-//
-// Three classes of LLM defect have been observed across hundreds of
-// consolidate proposals (see audit notes in this branch):
-//
-//   1. Code-fence leakage: the entire merged asset is wrapped in
-//      ```markdown … ``` (or ```yaml … ```) despite the prompt forbidding
-//      fences. The post-processor used to pass this through verbatim, so the
-//      first character of the asset content became a backtick rather than
-//      `---`, defeating the frontmatter parser.
-//   2. YAML quote-escaping bugs: descriptions like `'"Specialty intro...:`
-//      with unbalanced quotes that break the YAML reader. The post-processor
-//      historically passed the LLM's raw scalar straight into a manually
-//      assembled `description: <raw>` line.
-//   3. Truncated descriptions hitting token cutoffs — the model's max_tokens
-//      runs out mid-sentence, leaving things like
-//      `description: "Tables in narrow column containers need max-width:100% +"`
-//      with no closing context.
-//
-// `sanitizeMergedContent` and `validateProposalFrontmatter` defend against
-// all three at the point where LLM output is consumed.
-/**
- * Attempt to recover a frontmatter block that is missing its closing `---`.
- *
- * Scans lines after the opening `---` for the first blank line or the first
- * line that cannot be a YAML scalar (i.e. not a key-value, indented
- * continuation, comment, or list item). Injects `---` before that line so
- * the normal parser can proceed.
- *
- * Returns the patched string on success, or `null` if the structure is too
- * ambiguous to recover safely (e.g. no opening `---`, or no body content
- * found after the frontmatter key-value lines).
- */
-function recoverMalformedFrontmatter(raw) {
-    if (!raw.startsWith("---"))
-        return null;
-    const lines = raw.split(/\r?\n/);
-    // Skip the opening `---` line (index 0).
-    let insertAt = -1;
-    for (let i = 1; i < lines.length; i++) {
-        const line = lines[i];
-        // A blank line marks the end of the frontmatter block in many YAML variants.
-        if (line.trim() === "") {
-            insertAt = i;
-            break;
+/** Execute one `merge` op (behavior-identical to the former inlined branch). */
+export async function handleMergeOp(op, opIndex, ctx) {
+    const { config, stashDir, target, backupDir, memoryByRef, warnings, pushSkipReason, counts } = ctx;
+    // Accounting helper: emit a per-participant skipReason for failed
+    // merges so primary + every loaded-memory secondary land in the
+    // structured skip histogram. Pre-2026-05-26 only the primary was
+    // counted (1 skipReason per failed merge), leaving N secondaries
+    // unaccounted for in the `processed == actioned + noAction + Σskips`
+    // invariant — the source of the 4–11 silent leaks per run.
+    const emitMergeFailureSkips = (reason) => {
+        if (memoryByRef.has(op.primary))
+            pushSkipReason("merge", op.primary, reason);
+        for (const secRef of op.secondaries) {
+            if (memoryByRef.has(secRef))
+                pushSkipReason("merge", secRef, reason);
         }
-        // A line that is clearly body content: doesn't look like a YAML key, an
-        // indented continuation, a comment, or a sequence item.
-        const isYaml = /^\w[\w-]*\s*:/.test(line) || // key: value
-            /^\s+\S/.test(line) || // indented continuation / nested
-            /^\s*#/.test(line) || // YAML comment
-            /^\s*-\s/.test(line); // sequence item
-        if (!isYaml) {
-            insertAt = i;
-            break;
+    };
+    const primaryEntry = memoryByRef.get(op.primary);
+    if (!primaryEntry) {
+        // This fires when a prior op in the same run consumed this ref as a
+        // secondary and Fix-A pruned it from memoryByRef. It should NOT fire
+        // for hallucinated primaries (those are dropped by mergePlans() before
+        // reaching here). If this counter is non-zero, suspect an intra-run
+        // cross-chunk race, not a filter regression.
+        warnings.push(`Merge: primary ${op.primary} not found in loaded memories (pruned by prior op this run) — skipping.`);
+        emitMergeFailureSkips("merge_primary_missing");
+        return;
+    }
+    // Defense-in-depth: even if the entry is in memoryByRef (pre-flight ran
+    // before this run's own ops), the file may have been deleted by a
+    // concurrent process or an edge case the pre-flight filter missed.
+    if (!fs.existsSync(primaryEntry.filePath)) {
+        warnings.push(`Merge: primary ${op.primary} file gone at execution time (stale entry) — skipping.`);
+        emitMergeFailureSkips("merge_primary_file_gone");
+        return;
+    }
+    // Phase B: generate merged content
+    const secondaryBodies = [];
+    for (const secRef of op.secondaries) {
+        const secEntry = memoryByRef.get(secRef);
+        if (!secEntry) {
+            warnings.push(`Merge: secondary ${secRef} not found — skipping merge op.`);
+            // No accounting impact: a missing secondary is a phantom ref and
+            // never contributed to any chunk's targetRefs reduction. We still
+            // continue the loop to gather the remaining valid secondaries.
+            continue;
         }
+        secondaryBodies.push(secRef);
     }
-    if (insertAt < 0)
-        return null;
-    const result = [...lines.slice(0, insertAt), "---", ...lines.slice(insertAt)].join("\n");
-    return result;
-}
-/**
- * Outer-fence stripper specific to consolidate. Unlike the shared
- * `stripMarkdownFences` helper (which only handles markdown fences), this
- * variant additionally recognises `yaml` and bare-language fences and refuses
- * to strip an unbalanced fence — i.e. a leading ``` with no trailing ``` is
- * treated as a malformed response, not partially sanitized.
- *
- * Returns `null` when only one half of a fence pair is present (caller
- * should reject the response entirely).
- */
-export function stripOuterCodeFence(raw) {
-    const trimmed = raw.trim();
-    const leading = trimmed.match(/^```(?:markdown|md|yaml|yml)?\s*\r?\n/i);
-    const trailing = trimmed.match(/\r?\n```\s*$/);
-    if (!leading && !trailing)
-        return { content: trimmed, stripped: false };
-    if (!leading || !trailing)
-        return null; // unbalanced — refuse
-    const inner = trimmed.slice(leading[0].length, trimmed.length - trailing[0].length).trim();
-    return { content: inner, stripped: true };
-}
-export function sanitizeMergedContent(raw) {
-    // Step 1: Strip outer code fence.
-    // Recovery path: if only the leading fence is present, strip it and continue
-    // provided the inner content starts with `---`. Trailing-only fences are NOT
-    // recovered — a trailing ``` is more likely a body code block than a forgotten
-    // wrapper, so recovering would silently corrupt the body.
-    let body;
-    {
-        const fenceResult = stripOuterCodeFence(raw);
-        if (fenceResult) {
-            body = fenceResult.content;
+    if (secondaryBodies.length === 0) {
+        warnings.push(`Merge: ${op.primary} has no valid secondaries — skipping.`);
+        emitMergeFailureSkips("merge_no_valid_secondaries");
+        return;
+    }
+    // Pre-flight hot guard — skip the LLM call entirely if any participant
+    // is hot or unparseable. Without this, mixed chunks still send hot merges
+    // to the planner which proposes them; generateMergedContent() is then
+    // called, produces output without `description`, and the skip is
+    // misattributed to merge_missing_description instead of the real cause.
+    const preflightParticipants = [op.primary, ...op.secondaries];
+    const preflightBlocked = preflightParticipants.flatMap((ref) => {
+        const e = memoryByRef.get(ref);
+        if (!e)
+            return [];
+        const verdict = consolidateGuardStatus(e.filePath);
+        if (verdict === "hot" || verdict === "unparseable")
+            return [{ ref, verdict }];
+        return [];
+    });
+    if (preflightBlocked.length > 0) {
+        const detail = preflightBlocked.map((p) => `${p.ref} (${p.verdict})`).join(", ");
+        warnings.push(`Merge: refused for ${op.primary} — ${preflightBlocked.length} participant(s) blocked by hot/unparseable frontmatter guard (pre-flight): ${detail}`);
+        emitMergeFailureSkips("merge_participant_blocked");
+        return;
+    }
+    let primaryBody = "";
+    try {
+        primaryBody = fs.readFileSync(primaryEntry.filePath, "utf8");
+    }
+    catch {
+        warnings.push(`Merge: could not read primary ${op.primary} — skipping.`);
+        emitMergeFailureSkips("merge_read_failed");
+        return;
+    }
+    const mergeResult = await generateMergedContent(config, op.primary, primaryBody, op.secondaries, memoryByRef, ctx.improveProfile);
+    if ("error" in mergeResult) {
+        warnings.push(`Merge: ${mergeResult.error} for ${mergeResult.detail}.`);
+        emitMergeFailureSkips(mergeResult.error);
+        return;
+    }
+    let mergedContent = mergeResult.content;
+    // Validate frontmatter of merged content — must have a `---` block
+    // with at minimum a `description` field. We parse via the hand-rolled
+    // parser (cheap) AND require non-empty description. This guards against
+    // the historical defect where merged memories were written back with
+    // empty `description` and later polluted the promote path.
+    let parsedMerged;
+    try {
+        parsedMerged = parseFrontmatter(mergedContent);
+    }
+    catch {
+        warnings.push(`Merge: merged content for ${op.primary} has invalid frontmatter — skipping.`);
+        emitMergeFailureSkips("merge_invalid_frontmatter");
+        return;
+    }
+    if (parsedMerged.frontmatter === null) {
+        warnings.push(`Merge: merged content for ${op.primary} has no frontmatter block — skipping.`);
+        emitMergeFailureSkips("merge_invalid_frontmatter");
+        return;
+    }
+    const mergedDesc = parsedMerged.data.description;
+    if (typeof mergedDesc !== "string" || mergedDesc.trim().length === 0) {
+        warnings.push(`Merge: merged content for ${op.primary} missing description — skipping.`);
+        emitMergeFailureSkips("merge_missing_description");
+        return;
+    }
+    const truncReason = detectTruncatedDescription(mergedDesc);
+    if (truncReason) {
+        warnings.push(`Merge: merged content for ${op.primary} has truncated description (${truncReason}) — skipping.`);
+        emitMergeFailureSkips("merge_truncated_description");
+        return;
+    }
+    // captureMode:hot guard — refuse the merge if ANY participating memory
+    // (primary or secondary) was user-captured or has unparseable frontmatter
+    // (could have hidden a hot flag). Hot memories are user-explicit and
+    // must not be deleted/overwritten by the consolidate LLM. 14 user
+    // memories were silent-deleted by consolidate before this guard landed;
+    // recovery required copying from .akm/archive/ by hand.
+    const mergeParticipants = [op.primary, ...op.secondaries];
+    const blockedParticipants = mergeParticipants.flatMap((ref) => {
+        const e = memoryByRef.get(ref);
+        if (!e)
+            return [];
+        const verdict = consolidateGuardStatus(e.filePath);
+        if (verdict === "hot" || verdict === "unparseable")
+            return [{ ref, verdict }];
+        return [];
+    });
+    if (blockedParticipants.length > 0) {
+        const detail = blockedParticipants.map((p) => `${p.ref} (${p.verdict})`).join(", ");
+        warnings.push(`Merge: refused for ${op.primary} — ${blockedParticipants.length} participant(s) blocked by hot/unparseable frontmatter guard: ${detail}`);
+        emitMergeFailureSkips("merge_participant_blocked");
+        return;
+    }
+    // WS-3b: Anti-collapse generation guard (step 8a).
+    // DEFAULT ON since R5 (opt out via antiCollapse.enabled: false). Refuses
+    // to merge two assets both above generation N (default 2) — prevents the
+    // pipeline from building ever-deeper LLM-merged trees that lose the
+    // source fidelity of the original episodes.
+    const antiCollapseConfig = getImproveProcessConfig(config, "consolidate", ctx.improveProfile)?.antiCollapse ?? {};
+    if (antiCollapseConfig.enabled !== false) {
+        const allParticipants = [op.primary, ...op.secondaries];
+        // One read per participant: generation counter, stripped body (for the
+        // information floor), and existing source_refs (for the provenance union).
+        const participantInfo = allParticipants.map((ref) => {
+            const e = memoryByRef.get(ref);
+            if (!e)
+                return { ref, generation: 0, body: "", sourceRefs: [] };
+            try {
+                const raw = fs.readFileSync(e.filePath, "utf8");
+                const parsed = parseFrontmatter(raw);
+                const fm = parsed.data;
+                const sourceRefs = Array.isArray(fm.source_refs) ? fm.source_refs.map(String) : [];
+                return { ref, generation: readAssetGeneration(fm), body: stripFrontmatterBody(raw), sourceRefs };
+            }
+            catch {
+                return { ref, generation: 0, body: "", sourceRefs: [] };
+            }
+        });
+        const sourceGenerations = participantInfo.map((p) => p.generation);
+        const generationCheck = checkGenerationGuard(sourceGenerations, antiCollapseConfig);
+        if (generationCheck.refused) {
+            warnings.push(`Merge: ${generationCheck.reason}`);
+            emitMergeFailureSkips("merge_generation_guard");
+            return;
         }
-        else {
-            const trimmed = raw.trim();
-            const leadingMatch = trimmed.match(/^```(?:markdown|md|yaml|yml)?\s*\r?\n([\s\S]*)$/i);
-            const inner = leadingMatch ? leadingMatch[1].trim() : null;
-            if (!inner?.startsWith("---")) {
-                return { ok: false, reason: "UNBALANCED_CODE_FENCE" };
+        // WS-3b: Lexical diversity check (step 8b).
+        // Low n-gram diversity ⇒ likely correlated-extraction artifact; raise merge threshold.
+        if (antiCollapseConfig.lexicalDiversityCheck !== false) {
+            const bodies = participantInfo.map((p) => p.body).filter((b) => b.length > 0);
+            const diversityCheck = checkLexicalDiversity(bodies, antiCollapseConfig);
+            if (diversityCheck.lowDiversity) {
+                // Low-diversity cluster: just warn (don't refuse merge since the dedup
+                // path handles exact twins). The warning surfaces in health telemetry.
+                warnings.push(`Merge: cluster around ${op.primary} has low lexical diversity (${diversityCheck.diversity?.toFixed(2) ?? "?"} < 0.30) — likely correlated extraction; merge proceeds but review is recommended.`);
             }
-            body = inner;
+        }
+        // Inject generation counter into merged content frontmatter (step 8a).
+        // merged.generation = max(sourceGenerations) + 1. source_refs is the
+        // UNION of participants + everything they already cited (R5 §4.2 —
+        // the old set-if-absent behavior dropped second-generation provenance).
+        const provenanceUnion = [...new Set([...allParticipants, ...participantInfo.flatMap((p) => p.sourceRefs)])];
+        mergedContent = injectGenerationFrontmatter(mergedContent, sourceGenerations, provenanceUnion);
+        // R5 §4.2: merge-information floor — ADVISORY in v1. A merge that
+        // shrinks provenance or genericizes below the retention floor is
+        // counted + warned, never refused (promotion path: design doc §7).
+        try {
+            const mergedParsed = parseFrontmatter(mergedContent);
+            const mergedFm = mergedParsed.data;
+            const mergedSourceRefs = Array.isArray(mergedFm.source_refs) ? mergedFm.source_refs.map(String) : [];
+            const floorCheck = checkMergeInformationFloor(mergedParsed.content, mergedSourceRefs, participantInfo, antiCollapseConfig);
+            if (!floorCheck.passed) {
+                counts.mergeFloorViolations++;
+                warnings.push(`Merge: information floor advisory for ${op.primary}: ${floorCheck.reason ?? "unspecified"} — merge proceeds (v1 observe-only).`);
+            }
+        }
+        catch {
+            // Floor measurement is best-effort; never blocks the merge path.
         }
     }
-    // Strip <think> blocks (some local models still emit them despite system prompts).
-    body = body.replace(/<think>[\s\S]*?<\/think>/gi, "").trim();
-    // Step 2: Verify frontmatter sentinel.
-    // Recovery path: LLM sometimes emits 1-2 lines of preamble (e.g. "Here is the
-    // merged content:") before the `---`. Accept if `---` appears within 300 chars.
-    // Beyond that it's more likely a body section divider, not a frontmatter start.
-    if (!body.startsWith("---")) {
-        const nlIdx = body.indexOf("\n---");
-        if (nlIdx >= 0 && nlIdx < 300) {
-            body = body.slice(nlIdx + 1);
+    // Backup secondaries before deleting
+    for (const secRef of op.secondaries) {
+        const secEntry = memoryByRef.get(secRef);
+        if (secEntry && fs.existsSync(secEntry.filePath)) {
+            backupFile(secEntry.filePath, backupDir, secEntry.name);
         }
-        else {
-            return { ok: false, reason: "MISSING_FRONTMATTER_SENTINEL" };
-        }
-    }
-    // Extract frontmatter block.
-    // Recovery path: LLM sometimes omits the closing `---` delimiter. Detect this
-    // by scanning lines after the opening `---` for the first blank line or the
-    // first line that isn't a YAML key-value pair, then inject `---` there.
-    let match = body.match(/^---\r?\n([\s\S]*?)\r?\n---(?:\r\n|\r|\n|$)([\s\S]*)$/);
-    if (!match) {
-        const recovered = recoverMalformedFrontmatter(body);
-        if (recovered) {
-            match = recovered.match(/^---\r?\n([\s\S]*?)\r?\n---(?:\r\n|\r|\n|$)([\s\S]*)$/);
-        }
-        if (!match) {
-            return { ok: false, reason: "MALFORMED_FRONTMATTER_BLOCK" };
-        }
-    }
-    // Re-parse via the yaml library so any quote-escaping mistakes either get
-    // normalised or surface as a parse error we can reject.
-    // Recovery: if the strict yaml library fails, fall back to the lenient
-    // hand-rolled parseFrontmatter parser, which tolerates common LLM YAML
-    // quirks (unescaped special chars, bare scalars, etc.). If it recovers
-    // at least one key, proceed — serializeFrontmatter below will re-serialize
-    // cleanly. Only reject if both parsers fail to extract any data.
-    let parsedFm;
+    }
+    // Write merged primary
     try {
-        parsedFm = yamlParse(match[1]);
+        const parsedPrimary = parseAssetRef(op.primary);
+        await writeAssetToSource(target.source, target.config, parsedPrimary, mergedContent);
     }
     catch (e) {
-        const fallback = parseFrontmatter(`---\n${match[1]}\n---\n${match[2]}`);
-        if (fallback.frontmatter !== null && Object.keys(fallback.data).length > 0) {
-            parsedFm = fallback.data;
+        warnings.push(`Merge: write failed for ${op.primary}: ${String(e)}`);
+        emitMergeFailureSkips("merge_write_failed");
+        return;
+    }
+    // Archive and delete secondaries (P1-B: soft-invalidation)
+    for (const secRef of op.secondaries) {
+        const secEntry = memoryByRef.get(secRef);
+        if (!secEntry)
+            continue;
+        if (fs.existsSync(secEntry.filePath)) {
+            archiveMemory(secEntry.filePath, stashDir, secRef, "merged into primary", opIndex, op.primary, warnings);
         }
-        else {
-            return { ok: false, reason: `INVALID_YAML: ${e instanceof Error ? e.message : String(e)}` };
+        try {
+            const parsedSec = parseAssetRef(secRef);
+            await deleteAssetFromSource(target.source, target.config, parsedSec);
+            markJournalCompleted(stashDir, secRef);
         }
+        catch (e) {
+            warnings.push(`Merge: delete failed for ${secRef}: ${String(e)}`);
+        }
+    }
+    markJournalCompleted(stashDir, op.primary);
+    counts.merged++;
+    // 2026-05-26 accounting-leak fix: `merged` is op-level, but each
+    // successful merge actions `1 + secondaries.length` memories. Without
+    // this counter the accounting invariant breaks by `secondaries.length`
+    // per successful merge (chunk loop excluded all secondaries from
+    // judgedNoAction via targetRefs, but only the primary is credited to
+    // `merged`). Count only loaded-memory secondaries; phantom secondary
+    // refs never affected any chunk's targetRefs in the first place.
+    for (const secRef of op.secondaries) {
+        if (memoryByRef.has(secRef))
+            counts.mergedSecondaries++;
+    }
+    // Prune consumed refs from memoryByRef so later ops in this run cannot
+    // reference an absorbed secondary as a merge primary and proceed with a
+    // stale entry. Primary is rewritten (not deleted), so we only remove
+    // secondaries; the primary ref remains valid under its new content.
+    for (const secRef of op.secondaries) {
+        memoryByRef.delete(secRef);
     }
-    if (parsedFm === null || typeof parsedFm !== "object" || Array.isArray(parsedFm)) {
-        return { ok: false, reason: "FRONTMATTER_NOT_OBJECT" };
+}
+/** Execute one `delete` op (behavior-identical to the former inlined branch). */
+export async function handleDeleteOp(op, opIndex, ctx) {
+    const { stashDir, target, backupDir, memoryByRef, warnings, pushSkipReason, counts } = ctx;
+    const entry = memoryByRef.get(op.ref);
+    if (!entry) {
+        warnings.push(`Delete: ${op.ref} not found in loaded memories — skipping.`);
+        // Phantom ref: not in the batch so not in processed. Pushing to
+        // skipReasons would inflate Σ(skipReasons) without a matching processed
+        // entry, breaking the accounting invariant. Visibility is preserved via
+        // the warnings array above.
+        return;
+    }
+    // captureMode:hot guard — refuse to delete user-captured memories OR
+    // memories whose frontmatter is unparseable (could have hidden the hot
+    // flag). The consolidate LLM was deleting hot-captured user memos as
+    // "redundant" — 14 such deletes were silently archived between
+    // 2026-05-19 and 2026-05-20 before this guard. Hot memories are
+    // user-explicit and may only be deleted by the user.
+    const guard = consolidateGuardStatus(entry.filePath);
+    if (guard === "hot" || guard === "unparseable") {
+        warnings.push(`Delete: refused for ${op.ref} — ${guard === "hot" ? "captureMode:hot (user-explicit; never auto-delete)" : "frontmatter unparseable (cannot verify hot flag absent)"}. Reason from LLM: "${op.reason ?? "n/a"}"`);
+        pushSkipReason("delete", op.ref, "captureMode_hot_refused");
+        return;
+    }
+    if (fs.existsSync(entry.filePath)) {
+        backupFile(entry.filePath, backupDir, entry.name);
+        // P1-B: soft-invalidation archive before hard delete
+        archiveMemory(entry.filePath, stashDir, op.ref, op.reason, opIndex, undefined, warnings);
     }
-    const fm = parsedFm;
-    // Normalise placeholder leaks like `updated: today`, `updated: {today: null}`,
-    // `updated: now`, etc. The consolidate prompt instructs the LLM not to emit
-    // these, but small models still do. Replace any such leak with today's ISO
-    // date OR drop the field if we can't safely normalise it.
-    normalizeUpdatedField(fm);
-    // Re-serialise via yaml.stringify to fix any quoting quirks.
-    let serialized;
     try {
-        serialized = serializeFrontmatter(fm);
+        const parsedRef = parseAssetRef(op.ref);
+        await deleteAssetFromSource(target.source, target.config, parsedRef);
+        markJournalCompleted(stashDir, op.ref);
+        counts.deleted++;
+        // Prune from memoryByRef so later ops in this run cannot reference a
+        // deleted memory as a merge primary or secondary.
+        memoryByRef.delete(op.ref);
     }
     catch (e) {
-        return { ok: false, reason: `YAML_STRINGIFY_FAILED: ${e instanceof Error ? e.message : String(e)}` };
+        // Distinguish "file already absent" from genuine failures. A prior run
+        // may have deleted the file but the DB was not yet re-indexed, so the
+        // ref still appeared in memoryByRef. The delete goal is already met.
+        const msg = e instanceof Error ? e.message : String(e);
+        if (msg.includes("not found in source")) {
+            warnings.push(`Delete: ${op.ref} — file already absent (stale DB entry); skipping.`);
+            pushSkipReason("delete", op.ref, "delete_already_gone");
+        }
+        else {
+            warnings.push(`Delete: failed for ${op.ref}: ${String(e)}`);
+            pushSkipReason("delete", op.ref, "delete_failed");
+        }
     }
-    const cleaned = assembleAssetFromString(serialized, match[2]);
-    return { ok: true, result: { content: cleaned, frontmatter: fm } };
 }
-/**
- * Mutate `fm.updated` in place to normalise placeholder leaks emitted by the
- * LLM. The consolidate prompt forbids these, but small models still produce
- * literal `today` / `{today: null}` / `now` values.
- *
- * Rules:
- *   - A real ISO-style date string (YYYY-MM-DD, optionally with time) stays as-is.
- *   - A Date object (some YAML parsers materialise dates) is converted to its
- *     ISO yyyy-mm-dd form.
- *   - A placeholder string ("today", "now", "{today}", "${today}", template
- *     variables) is replaced with today's ISO date.
- *   - A map/object (e.g. `{today: null}`) is replaced with today's ISO date.
- *   - `null`, empty string, missing → left alone (no field added; reviewers
- *     should not silently gain metadata they didn't write).
- *
- * Exported for unit testing.
- */
-export function normalizeUpdatedField(fm) {
-    if (!("updated" in fm))
+/** Execute one `promote` op (behavior-identical to the former inlined branch). */
+export async function handlePromoteOp(op, ctx) {
+    const { config, stashDir, sourceRun, target, memoryByRef, warnings, pushSkipReason, promoted, promotedSourceRefs } = ctx;
+    const entry = memoryByRef.get(op.ref);
+    if (!entry) {
+        warnings.push(`Promote: ${op.ref} not found in loaded memories — skipping.`);
+        // Phantom ref: not in processed, so no skipReason (same rationale as
+        // delete_ref_missing above).
         return;
-    const v = fm.updated;
-    if (v === null || v === undefined || v === "")
+    }
+    // Within-run source-ref dedup: skip if this source memory was already
+    // promoted earlier in this run (safety belt — mergePlans already
+    // deduplicates promote ops by source ref via Map, but this guard also
+    // catches any future code paths that bypass mergePlans).
+    if (promotedSourceRefs.has(op.ref)) {
+        warnings.push(`Skipping promote: ${op.ref} already promoted in this run`);
+        pushSkipReason("promote", op.ref, "promote_already_promoted_this_run");
+        return;
+    }
+    let knowledgeRef = op.knowledgeRef;
+    try {
+        parseAssetRef(knowledgeRef);
+    }
+    catch {
+        const slug = op.knowledgeRef
+            .replace(/^knowledge:/, "")
+            .replace(/[^a-z0-9-]/gi, "-")
+            .toLowerCase();
+        knowledgeRef = `knowledge:${slug}`;
+        warnings.push(`Normalized invalid ref "${op.knowledgeRef}" → "${knowledgeRef}"`);
+    }
+    // Idempotency: check pending proposals by target ref
+    const existingProposals = listProposals(stashDir, { ref: knowledgeRef });
+    if (existingProposals.some((p) => p.status === "pending")) {
+        warnings.push(`Skipping promote: pending proposal already exists for ${knowledgeRef}`);
+        pushSkipReason("promote", op.ref, "promote_pending_proposal_exists");
         return;
-    const todayIso = new Date().toISOString().slice(0, 10);
-    if (v instanceof Date) {
-        fm.updated = v.toISOString().slice(0, 10);
+    }
+    // Idempotency: check if knowledge asset already exists
+    const parsedKnowledgeRef = parseAssetRef(knowledgeRef);
+    const destPath = path.join(target.source.path, "knowledge", `${parsedKnowledgeRef.name}.md`);
+    if (fs.existsSync(destPath)) {
+        warnings.push(`Skipping promote: ${knowledgeRef} already exists in source`);
+        pushSkipReason("promote", op.ref, "promote_already_exists");
+        return;
+    }
+    let memoryContent = "";
+    try {
+        memoryContent = fs.readFileSync(entry.filePath, "utf8");
+    }
+    catch (e) {
+        warnings.push(`Promote: could not read ${op.ref}: ${String(e)}`);
+        pushSkipReason("promote", op.ref, "promote_read_failed");
+        return;
+    }
+    // Defensive sanitization: legacy memory files written by older
+    // consolidate runs may still carry outer code fences or broken YAML.
+    // Strip them here so we never propose a polluted asset.
+    const promoteSanitized = sanitizeMergedContent(memoryContent);
+    if (!promoteSanitized.ok) {
+        warnings.push(`Promote: rejected ${op.ref} — source memory failed sanitization (${promoteSanitized.reason}).`);
+        pushSkipReason("promote", op.ref, "promote_sanitization_failed");
+        return;
+    }
+    memoryContent = promoteSanitized.result.content;
+    // SOURCE_SUPERSEDED guard: refuse to promote a memory whose source
+    // frontmatter carries `status: superseded`. Predicate at module top
+    // (`hasSupersededStatus`) so tests can exercise it directly.
+    if (hasSupersededStatus(promoteSanitized.result.frontmatter)) {
+        warnings.push(`Promote: refused for ${op.ref} → ${knowledgeRef} — source memory has status:superseded; superseded memories are not promotable knowledge.`);
+        pushSkipReason("promote", op.ref, "promote_superseded");
+        return;
+    }
+    // Parse the source memory up-front so the body/frontmatter checks below
+    // share the same parsed view.
+    const parsedMemory = parseFrontmatter(memoryContent);
+    // Reject sources whose body is too small to make useful knowledge.
+    // Observed failure: memory files whose body is literally a tags string
+    // ("discord,notification,send-notification") get promoted to knowledge
+    // proposals that no reviewer would accept. Threshold is conservative —
+    // 100 chars catches single-line tag dumps without rejecting genuinely
+    // terse but valid notes.
+    const PROMOTE_BODY_MIN_CHARS = 100;
+    const sourceBody = parsedMemory.content.trim();
+    if (sourceBody.length < PROMOTE_BODY_MIN_CHARS) {
+        warnings.push(`Promote: rejected ${op.ref} → ${knowledgeRef} — source memory body is too small (${sourceBody.length} chars; need ≥${PROMOTE_BODY_MIN_CHARS}) to make useful knowledge.`);
+        pushSkipReason("promote", op.ref, "promote_source_too_small");
+        return;
+    }
+    // Cross-run + within-run content dedup: if an identical body already
+    // exists in ANY pending consolidate proposal (regardless of target ref),
+    // skip. This prevents duplicate proposals when:
+    //   (a) Multiple source memories have identical bodies but differ only
+    //       in noise frontmatter (`inferenceProcessed: true` twin alongside
+    //       the original; differing `updated:` timestamps; etc.) — the body
+    //       is the load-bearing content, so dedup must hash on body only.
+    //   (b) A prior run created a proposal for the same body under a
+    //       different knowledgeRef slug.
+    // Use cacheHash (case-preserving stripped body) to match the canonical
+    // hash domain used by the body-embedding cache and pending-proposal set.
+    const bodyHash = cacheHash(sourceBody);
+    const allPendingConsolidateProposals = listProposals(stashDir, { status: "pending" }).filter((p) => p.source === "consolidate");
+    const contentDupProposal = allPendingConsolidateProposals.find((p) => {
+        return cacheHash(p.payload.content) === bodyHash;
+    });
+    if (contentDupProposal) {
+        warnings.push(`Skipping promote: identical body already pending as proposal ${contentDupProposal.id} (ref: ${contentDupProposal.ref}); skipping duplicate for ${op.ref} → ${knowledgeRef}`);
+        pushSkipReason("promote", op.ref, "dedup_pending_proposal");
         return;
     }
-    if (typeof v === "string") {
-        const trimmed = v.trim().toLowerCase();
-        if (/^\d{4}-\d{2}-\d{2}/.test(v.trim()))
-            return; // already a real date
-        if (trimmed === "today" ||
-            trimmed === "now" ||
-            trimmed === "{today}" ||
-            // biome-ignore lint/suspicious/noTemplateCurlyInString: matches the literal user-typed placeholder text "${today}" so we can normalize it to today's ISO date
-            trimmed === "${today}" ||
-            trimmed === "{{today}}" ||
-            /^\{?\s*today\s*\}?$/.test(trimmed)) {
-            fm.updated = todayIso;
+    try {
+        // Use LLM-provided description; fall back to memory's own description
+        // (post-sanitization frontmatter is authoritative).
+        const description = (typeof op.description === "string" && op.description.trim()
+            ? op.description.trim()
+            : parsedMemory.data?.description?.trim()) ?? "";
+        // Validate the resolved frontmatter before emitting a proposal.
+        // Required field: non-empty description. Reject obvious truncation
+        // markers (description ends with `,`/`;`/`:`/`...`/hanging connector)
+        // so the queue never sees half-formed metadata that the reviewer
+        // would only reject.
+        const fmCheck = validateProposalFrontmatter({ description });
+        if (!fmCheck.ok) {
+            warnings.push(`Promote: rejected ${op.ref} → ${knowledgeRef} — ${fmCheck.reason}.`);
+            pushSkipReason("promote", op.ref, "promote_invalid_frontmatter");
+            return;
+        }
+        // Merge `description` INTO the body's YAML frontmatter so it lands in
+        // the on-disk asset when the proposal is accepted. The descriptionQuality
+        // validator parses `payload.content` body (not the envelope
+        // `payload.frontmatter`), and a memory's native frontmatter has
+        // `captureMode`/`beliefState`/etc. but never `description` — without
+        // this merge, 60+ pending proposals were blocked at accept-time with
+        // MISSING_FRONTMATTER_DESCRIPTION even though the envelope had it.
+        // (The body-frontmatter assumption baked into the 2026-05-20 comment
+        // below was wrong: body fm and envelope fm only converge when the
+        // writer explicitly merges them, which it now does.)
+        const mergedBodyFm = {
+            ...(parsedMemory.data ?? {}),
+            description,
+        };
+        const serializedMergedFm = serializeFrontmatter(mergedBodyFm);
+        const proposalContent = assembleAssetFromString(serializedMergedFm, parsedMemory.content);
+        // Pre-emit dedup against pending consolidate proposals from the
+        // same improve run (slug-variant match). The cross-run content-hash
+        // dedup inside `mergePlans` handles duplicates against existing
+        // stash assets — see commit history for the deletion of the
+        // unbounded embedding + cross-type slug branches.
+        const dedup = await checkPreEmitDedup({
+            candidateRef: knowledgeRef,
+            candidateText: `${description}. ${memoryContent}`,
+            stashDir,
+            config,
+        });
+        if (dedup.duplicate) {
+            warnings.push(`Promote: skipped ${op.ref} → ${knowledgeRef} — ${dedup.reason}.`);
+            pushSkipReason("promote", op.ref, "promote_dedup_window");
             return;
         }
-        // Unknown string format — leave alone so it's visible in the diff.
+        const proposalResult = createProposal(stashDir, {
+            ref: knowledgeRef,
+            source: "consolidate",
+            sourceRun,
+            payload: {
+                content: proposalContent,
+                frontmatter: { description },
+            },
+            ...(typeof op.confidence === "number" ? { confidence: op.confidence } : {}),
+        });
+        if (isProposalSkipped(proposalResult)) {
+            warnings.push(`Promote: skipped proposal for ${op.ref} (${proposalResult.reason}): ${proposalResult.message}`);
+            pushSkipReason("promote", op.ref, `promote_proposal_${proposalResult.reason}`);
+        }
+        else {
+            promoted.push(proposalResult.id);
+            promotedSourceRefs.add(op.ref);
+            markJournalCompleted(stashDir, op.ref);
+        }
+    }
+    catch (e) {
+        warnings.push(`Promote: createProposal failed for ${op.ref}: ${String(e)}`);
+        pushSkipReason("promote", op.ref, "promote_create_failed");
+    }
+}
+/** Execute one `contradict` op (behavior-identical to the former inlined branch). */
+export async function handleContradictOp(op, ctx) {
+    const { stashDir, memoryByRef, warnings, pushSkipReason, counts } = ctx;
+    // Confidence gate: surface-level topic overlap causes false positives
+    // (investigation 2026-06-18). Require ≥0.92 confidence before writing
+    // contradiction edges. Missing confidence field defaults to 1.0 for
+    // backward compatibility with responses that predate this field.
+    const opConfidence = typeof op.confidence === "number" ? op.confidence : 1.0;
+    if (opConfidence < 0.92) {
+        warnings.push(`Contradict: confidence ${opConfidence.toFixed(2)} below 0.92 threshold for ${op.ref} <-> ${op.contradictedByRef} — skipping.`);
+        pushSkipReason("contradict", op.ref, "contradict_low_confidence");
+        return;
+    }
+    // C-3 / #382: Write contradictedBy edges so resolveFamilyContradictions
+    // (the SCC resolver in memory-improve.ts) has edges to work on.
+    // Zep arXiv:2501.13956 §3 — unified belief-revision with contradiction edges.
+    const entry = memoryByRef.get(op.ref);
+    const contradictorEntry = memoryByRef.get(op.contradictedByRef);
+    if (!entry) {
+        warnings.push(`Contradict: ${op.ref} not found in loaded memories — skipping.`);
+        // Phantom ref: not in processed, so no skipReason (same rationale as
+        // delete_ref_missing).
         return;
     }
-    if (typeof v === "object") {
-        // Maps like `{today: null}`, `{now: null}` — clearly a template leak.
-        fm.updated = todayIso;
+    if (!contradictorEntry) {
+        warnings.push(`Contradict: ${op.contradictedByRef} not found — skipping.`);
+        // op.ref IS in the batch (entry found above) so the skipReason is
+        // correctly charged against a real processed memory.
+        pushSkipReason("contradict", op.ref, "contradict_target_missing");
         return;
     }
+    try {
+        // Write the contradiction edge: op.ref is contradicted by op.contradictedByRef
+        writeContradictEdge(entry.filePath, op.contradictedByRef);
+        counts.contradicted++;
+        markJournalCompleted(stashDir, op.ref);
+    }
+    catch (e) {
+        warnings.push(`Contradict: failed to write edge for ${op.ref}: ${String(e)}`);
+        pushSkipReason("contradict", op.ref, "contradict_write_failed");
+    }
 }
+// ── Helpers ─────────────────────────────────────────────────────────────────
 /**
  * Normalise a knowledge slug for variant-aware deduplication. Collapses:
  *   - date suffixes (`-may-2026`, `-2026-05-03`, `-2026`)
@@ -2019,11 +2035,13 @@ async function checkPreEmitDedup(opts) {
  * doesn't match the pattern (assumed to already be an ISO timestamp).
  */
 function parseSinceToIso(since) {
-    const m = since.match(/^(\d+)(m|h|d)$/);
-    if (!m)
+    // Canonical CLI unit grammar: `m` = minutes, `M` = months (see core/time.ts
+    // DURATION_UNITS). Non-matching input is returned unchanged (assumed to
+    // already be an ISO timestamp).
+    const ms = parseDuration(since, DURATION_UNITS);
+    if (ms === null)
         return since;
-    const multiplier = { m: 60_000, h: 3_600_000, d: 86_400_000 }[m[2]];
-    return new Date(Date.now() - parseInt(m[1], 10) * multiplier).toISOString();
+    return new Date(Date.now() - ms).toISOString();
 }
 export function narrowToIncrementalCandidates(memories, since, warnings, neighborsPerChanged = 5) {
     const sinceIso = parseSinceToIso(since);
@@ -2129,7 +2147,7 @@ function loadMemoriesForSource(source, stashDir, warnings) {
     }
     return memories;
 }
-async function generateMergedContent(config, primaryRef, primaryBody, secondaryRefs, memoryByRef) {
+async function generateMergedContent(config, primaryRef, primaryBody, secondaryRefs, memoryByRef, activeProfile) {
     // Only handle single-secondary merges per design (one call per merge op)
     const secRef = secondaryRefs[0];
     const secEntry = memoryByRef.get(secRef);
@@ -2173,7 +2191,7 @@ async function generateMergedContent(config, primaryRef, primaryBody, secondaryR
         .join("\n");
     // Use the same per-process profile resolution as the chunk-plan call above
     // so the merge generation step doesn't silently revert to the default LLM.
-    const llmConfig = resolveConsolidateLlmConfig(config);
+    const llmConfig = resolveConsolidateLlmConfig(config, activeProfile);
     const result = await tryLlmFeature("memory_consolidation", config, async () => {
         if (!llmConfig)
             return { ok: false, error: "No LLM configured for consolidation" };
@@ -2251,8 +2269,8 @@ async function generateMergedContent(config, primaryRef, primaryBody, secondaryR
             }
             normalizeUpdatedField(repairedFmData);
             const repairedYaml = serializeFrontmatter(repairedFmData);
-            const bodyPart = mergedFm.content ?? "";
-            return { content: `---\n${repairedYaml}\n---\n${bodyPart}` };
+            const bodyPart = typeof mergedFm.content === "string" ? mergedFm.content : "";
+            return { content: assembleAssetFromString(repairedYaml, bodyPart) };
         }
     }
     catch {