akm-cli 0.9.16-alpha.1 → 0.9.16

package/CHANGELOG.md

@@ -6,147 +6,71 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
-## [0.9.16-alpha.1] - 2026-09-11
+## [0.9.16] - 2026-09-22
 
-### Added
+### Fixed
 
-- **`akm index status`.** A cheap, read-only snapshot of `index.db`'s
-  current state — files tracked, entries, distinct units, how many have a
-  vector for the active embedding identity (and therefore the embedding
-  queue's remaining depth), the active identity itself, and the last
-  reconcile/build times — with no writes. Mirrors `akm info`'s
-  absent/inaccessible handling: a missing index reads as the ordinary
-  first-run state, an unreadable one is reported, never silently presented
-  as empty.
-- **A credential diagnostic on the embedding queue.** Before the first
-  provider request `akm index`'s drain makes, one default-level line names
-  the embedding endpoint, model, and the credential's SOURCE (never the
-  resolved value) whenever a remote endpoint is configured — so a field run
-  can compare it against what the gateway actually saw (#953).
+- **Result documents larger than 64 KiB are no longer truncated on a piped
+  stdout.** `akm show`/`search`/`config get … | python3 -c …` (or `| head`, or
+  any other pipe) returned exactly 65,536 bytes — the Linux pipe-buffer size —
+  producing unparseable JSON, while the same command with `--output <file>`
+  wrote the complete document. The two stdout writers (`deliverRendered` for
+  json/yaml/text/md/html, `outputJsonl` for jsonl) used `console.log`, and on
+  Bun `console.log` issues a single `write(2)` against a non-blocking fd 1 and
+  silently discards whatever the kernel did not accept; a pipe accepts at most
+  one buffer's worth. Both now go through `writeStdout`
+  (`src/output/stdout.ts`), which uses `process.stdout.write` — that handles
+  the short write correctly, and the queued remainder keeps the process alive
+  until it drains. Byte-for-byte output is unchanged on every format; only the
+  transport moved.
 
-### Changed
+### Added
 
-- **`akm index` is redesigned end to end
-  (`docs/plans/index-redesign.md`).** The old walk/clean/embed/finalize
-  phase pipeline, per-directory fingerprint cache, and duplicated storage
-  (entry text held three times, every vector held twice plus a salvage
-  copy) are replaced by two steps: reconcile, then drain. Reconcile
-  (`src/indexer/reconcile.ts`) stat-walks every configured root against a
-  `files` cache, hashing and re-parsing only what actually changed, and
-  derives content-addressed units — one "card" unit per entry
-  (name/description/tags/hints) and one "fragment" unit per Markdown
-  section — into a single text table (`unit_texts`/`units_fts`). Drain
-  (`src/indexer/drain.ts`) treats embedding as a queue, not a phase: the
-  pending set is exactly the unit hashes with no vector under the active
-  embedding identity, packed against the provider's own probed context
-  window and slot count, written into a single vector table
-  (`units`/`units_vec`) keyed by `(unit_hash, identity)`. An unchanged file
-  or unit is never re-derived or re-embedded again — not on a rename, not
-  on `akm index --full`, not on a future generation bump — because
-  everything is keyed by content hash and observed provider identity, never
-  by a row id or a config string.
-- **Every write path indexes what it just wrote, inline.** `remember`,
-  `import`, extract's session-asset capture, `source clone`, and proposal
-  accept each reconcile and drain exactly the paths/units they touched, in
-  the same call as the write, with no lock probe and no background reindex
-  spawn.
-- **Search is one query over `units`**, scoring lexical evidence by BM25
-  magnitude through the calibrated transform the repository already had and
-  combining it with semantic distance on the proven 0.7/0.3 split. Reciprocal
-  rank fusion was tried first and measured worse than the path it replaced
-  (0.918 against 0.933 on the `curate-golden` fixture, unchanged by splitting
-  or weighting the lists), because a rank cannot tell a strong match from a
-  weak one; the shipped scoring measures 0.936 with no banned-above-required
-  hits. The semantic-only `minScore` floor is gone, type filters now apply in
-  SQL before the candidate cap, and the exact/prefix/relaxed ladder tops up to
-  the candidate budget instead of stopping at the first non-empty tier. The
-  tier a hit came from is also ranking evidence: a unit matching every query
-  token outranks one matching a subset, because the calibrated BM25 transform
-  compresses even a sixfold magnitude difference into a few thousandths — far
-  less than any single ranking contributor — so tier decides across tiers and
-  magnitude decides within one.
-- **`akm index --full`** no longer drops anything first: it forces every
-  walked file to be re-parsed (skipping the unchanged-file shortcut) but
-  updates each file's existing row in place, keeping its id, vectors, and
-  learned utility scores. **`akm index --reembed`** now means "drop the
-  active embedding identity's vectors, then re-embed every unit from
-  scratch."
-- **`akm index --skip-if-locked` is deprecated and does nothing.** Index
-  runs no longer take a rebuild lock — every write is a short, idempotent,
-  content-addressed transaction, so two concurrent runs converge instead of
-  contending. Passing the flag prints one deprecation warning; kept only so
-  an existing script does not fail on an unknown flag.
-- **The derived `index.db` generation changes from v23 to v24.** The first
-  read (or explicit `akm index`) after upgrade re-derives `entries` and
-  every unit from files, and embeds the full corpus once against the
-  configured provider, since the new unit vector store does not carry
-  forward the superseded per-entry vector tables. See the [0.9.16 migration
-  note](docs/migration/release-notes/0.9.16.md) for the cost, stated
-  plainly.
+- **Scheduled execution is now granted by host-local config and bound to the
+  approved source installation.** `scheduler.enabled` records
+  `{kind, ref, sourceId}` entries written by `akm task enable`; authored task
+  frontmatter cannot enable itself. `akm migrate apply` performs the explicit,
+  backed-up conversion of older grants, and runtime config points unmigrated
+  installations to that command instead of silently inventing authority.
+- **Executable assets now run beneath a host-owned tool ceiling.** Local
+  `execution.allowedTools` config caps asset tool requests. Workspace,
+  environment, and opaque runtime selection are no longer accepted from asset
+  frontmatter, and a transport that cannot enforce a non-empty resolved tool
+  policy fails before dispatch.
 
-### Removed
+### Changed
 
-- **The index phase pipeline, directory-fingerprint staleness cache, the
-  index rebuild lock, and the index-path use of the maintenance barrier** —
-  roughly 4,800 lines across the files that implemented the old index core,
-  replaced by the reconcile/drain design above (`docs/plans/index-redesign.md`).
-- **`entries_fts`, `entry_fragments_fts`, the legacy per-entry `embeddings`
-  materializer (`materialize-embeddings.ts`), and `embedding_salvage`** —
-  superseded by the single `unit_texts`/`units_fts` and `units`/`units_vec`
-  tables, which never need a salvage-before-discard step because they are
-  content-addressed and never wholesale-discarded.
-- **`akm index --enrich`, `--re-enrich`, `--clean`, and `--dry-run`.**
-  Plain `akm index` now always performs metadata enrichment when an engine
-  is configured, and every run already removes stale entries as part of
-  reconcile — the work these flags used to separately opt into. All four
-  now fail with a `UsageError` naming the replacement, instead of silently
-  doing nothing or being silently accepted.
-- **Config keys `embedding.maxInputTokens`, `embedding.maxTokens`,
-  `embedding.batchSize`, `embedding.contextLength`, and
-  `search.minScore`.** Embedding request packing is sourced from the
-  provider's own probed limits (unchanged from 0.9.15 packing, applied to
-  units instead of whole entries); the fused score has no comparable 0–1
-  threshold to tune. A config that still sets any of them loads without
-  error and is simply ignored.
-- **The `"ready-js"` semantic-search status.** Named a pure-JS
-  cosine-similarity fallback for when `sqlite-vec` was unavailable; the new
-  unit vector store has no BLOB-table fallback to fall back to, so nothing
-  produces that value any more.
+- **Unscoped `akm task sync` reconciles every enabled bundle.** It refreshes
+  the native scheduler from the latest locally enabled task/workflow sources
+  and removes attributable bindings for bundles that have been disabled.
+  Removing a bundle also revokes its scheduler grants.
+- **Bundle activation and identity are consistent across the CLI.** A disabled
+  bundle is inert for reads, writes, indexing, execution, and scheduling;
+  explicit lifecycle updates remain available. Physical-root identity rejects
+  duplicate or symlink-aliased bundle registrations and prevents an
+  `AKM_BUNDLE_DIR` alias from reactivating disabled content.
+- **Shared config inheritance now separates portable policy from host
+  authority.** Source/default ownership, registries, scheduler and execution
+  grants, credentials, executable arguments/workspace, setup/experimental
+  state, reranker connections, and publication hooks stay local. Every
+  bundle-relative `extends` hop is checked by real path containment.
+- **Unsafe overrides now name one risk each.** Use
+  `--allow-insecure-transport` for reviewed plain HTTP and
+  `--allow-dangerous-env-keys` for reviewed process-hijacking environment
+  keys; the former combined `--allow-insecure` switch is removed.
+- **Bundle/source resolution carries explicit default and priority state.**
+  Search, show, write targeting, registry installation, and configuration
+  mutation no longer infer ownership or trust from array position.
 
 ### Fixed
 
-- **Two akm processes starting at the same moment against a database neither
-  has created yet no longer fail.** `state.db` and `index.db` each had a
-  first-open race. `index.db` created `entries` about twenty statements
-  before it stamped the generation, so a second opener read
-  entries-without-a-generation as a stale index and dropped the table out
-  from under the first process, which then exited 70 with `no such table:
-  entries` — measured at 8 of 440 racing child processes. `state.db` read its
-  migration ledger and its "does this file have any other tables" check as
-  two separate statements, so a sibling's bootstrap committing between them
-  looked exactly like a legacy unversioned database and was refused outright
-  — 2 of 1200 racing trials. Both initializations are now single atomic
-  units, measured at zero failures in 840 and 1200 trials respectively, idle
-  and under load. Only a genuinely contended run still fails, as
-  `INDEX_DB_CONTENDED`/`STATE_DB_CONTENDED` at exit 75, the documented
-  retry-shortly contract. An already-initialized database takes the same
-  unlocked path it always did.
-- **`akm show <memory>` no longer fails when that memory has an inferred
-  `.derived` twin.** It exited 2 with `RESOURCE_ALREADY_EXISTS` ("multiple
-  physical owners"), so once `akm improve` derived a memory — its ordinary
-  output — the base ref stopped being usable, and the read path that did not
-  fail served the twin's content instead of the memory's. `.derived` is a
-  provenance marker on the same identity and the placement layer always
-  declared that the plain file wins; the physical-owner lookup now honours
-  that instead of discarding it. Genuinely ambiguous cases, including two
-  case-only spellings of one name and `env`'s co-equal `.env`/`default.env`
-  pair, still fail loudly and unchanged. Present since before 0.9.15.
-- **A derived memory no longer outranks the memory it was derived from.** A
-  twin's own filename contributed a `derived` tag that minted a synthetic
-  alias, and the machine-written `source:` provenance backref was folded into
-  search hints, together handing the twin a flat 0.42 of ranking credit for
-  bookkeeping no author wrote — enough to beat a memory whose description
-  matched the query verbatim. Neither field earns ranking credit any more.
+- Protected generated improve content from credential echoes, redacted bodies,
+  and run-only scaffolding, while exercising the real bounded engine probe.
+- Repaired degraded sqlite-vec mirrors, preserved scheduler intent across
+  synchronization, kept explicit setup choices and rollback serialization
+  stable, and tolerated valid sharded startup contention.
+- Made git, website, npm, and filesystem bundle add/update/remove workflows
+  converge on the same lifecycle and dangerous-environment audit behavior.
 
 ## [0.9.15] - 2026-09-10
 

package/dist/assets/hints/cli-hints-full.md

@@ -264,6 +264,7 @@ akm bundle add @scope/pkg                            # From npm (managed)
 akm bundle add owner/repo                            # From GitHub (managed)
 akm bundle add ./path/to/local/bundle                   # Local directory
 akm bundle add git@github.com:org/repo.git --provider git --name my-skills --writable
+akm bundle add https://github.com/org/private.git --provider git --credential '$GIT_READ_TOKEN'
 akm registry add https://skills.sh --name skills.sh --provider skills-sh  # Add the skills.sh registry
 akm registry remove skills.sh                 # Remove the skills.sh registry
 akm bundle list                                      # List all sources
@@ -271,9 +272,13 @@ akm bundle list --kind git                           # Filter by provider (files
 akm bundle remove <target>                           # Remove by id, ref, path, or name
 akm bundle update --all                              # Update all managed sources
 akm bundle update <target> --force                   # Force re-download
-akm bundle update <target> --allow-insecure          # Approve reviewed dangerous env keys
+akm bundle update <target> --allow-dangerous-env-keys # Approve reviewed dangerous env keys
+akm bundle update --all --skip-if-locked             # Scheduled refresh; exit 0 on DB contention
 ```
 
+Git bundles refresh only when `akm bundle update` runs. Schedule that command
+when automatic refresh is desired.
+
 ## Registries
 
 ```sh
@@ -357,7 +362,9 @@ file plus one `sync` is a complete workflow.
 ```sh
 akm task add nightly-improve --schedule "@daily" --command "akm improve --strategy default"
 akm task add briefing --schedule "0 9 * * *" --prompt "Draft the morning briefing"  # Inline command task
-akm task sync                                  # Reconcile task files with the OS scheduler
+akm task enable <bundle>//tasks/<id>           # Enable locally and sync that bundle
+akm task disable <bundle>//tasks/<id>          # Disable locally and unschedule it
+akm task sync                                  # Reconcile activated refs from every enabled configured bundle
 akm task sync --rebind                         # Also re-pin the scheduler's akm binary/spelling
 akm task doctor                                # Scheduler binding + runtime eligibility diagnosis
 akm task history                               # Recent run rows (status, timing)
@@ -370,10 +377,10 @@ Task files use task source v4 (`version: 4`). There is no `akm:` options bag
 or `on:` block — every control (`schedule`, `timeout`, `engine`, `model`,
 `redact`, `maxSteps`, `maxRetries`, …) is a top-level key now. Typed
 `inputs:` declarations and a bounded `output:` schema work like a
-workflow's (`output:` replaces v3's `akm.outputSchema`). To disable one
-schedule entry, set that entry's `enabled: false` under `schedule:` and run
-`akm task sync` (the cron line stays, commented); to remove one, delete the
-YAML and run `akm task sync` — the scheduler entry is unbound. Top-level
+workflow's (`output:` replaces v3's `akm.outputSchema`). Task source never
+controls activation: use `akm task enable` / `disable`, which update the
+host-local config allow-list and sync. To remove one, delete the YAML and run
+`akm task sync` — the scheduler entry is unbound. Top-level
 `timeout:` may be `null` (disable the invocation timer) or a duration/number
 overriding the selected engine invocation timeout. Preview old task-v2/v3
 conversion with `akm migrate apply --dry-run`.

package/dist/assets/tasks/core/index-refresh.yml

@@ -1,4 +1,4 @@
 version: 4
-run: akm index
+run: akm index --skip-if-locked
 description: Nightly incremental index refresh
 schedule: "0 4 * * *"

package/dist/assets/tasks/improve/akm-improve-catchup.yml

@@ -1,9 +1,6 @@
 version: 4
 run: akm improve --strategy catchup --skip-if-locked --require-engines
 description: Manual recovery — consolidation + triage drain (run on demand via `akm task run akm-improve-catchup`)
-# Manual-recovery task: ships disabled (the retired registerDefaultTasks
-# marked it enableMode: "manual"). `akm task run` works while disabled;
-# opting into the schedule is `schedule[].enabled: true` + `akm task sync`.
-schedule:
-  - cron: "0 4 * * *"
-    enabled: false
+# Manual-recovery task: setup offers it disabled by default. `akm task run`
+# still works manually; `akm task enable` opts this host into the schedule.
+schedule: "0 4 * * *"

package/dist/cli/retired-commands.js

@@ -62,8 +62,6 @@ const RETIRED_COMMAND_HINTS = {
     "workflow report": "`akm workflow report` was removed — the external-driver protocol is gone; `akm workflow run <target>` dispatches and records units itself.",
     "config show": "`akm config show` was removed in 0.9 — use `akm config list`.",
     "config validate": "`akm config validate` was removed in 0.9 — the config file is validated on every load.",
-    "task enable": "`akm task enable` was removed in 0.9 — set `enabled: true` in the task YAML, then `akm task sync`.",
-    "task disable": "`akm task disable` was removed in 0.9 — set `enabled: false` in the task YAML, then `akm task sync`.",
     "task init": "`akm task init` was removed in 0.9 — `akm setup` seeds the default schedules.",
     "task show": "there is no `task show` — task files are indexed assets; use `akm show <ref>`.",
     "task remove": "there is no `task remove` — delete the task YAML, then run `akm task sync` to unbind it.",
@@ -104,8 +102,6 @@ export function retiredCommandHint(parentPath, attempted) {
  */
 const RETIRED_FLAG_HINTS = {
     "index --background": "`--background` was removed in 0.9 — the flag never actually backgrounded; use `--quiet`.",
-    "index --clean": "`--clean` was removed in the index redesign — every `akm index` run now removes stale entries as part of reconcile, the same work `--clean` used to opt into.",
-    "index --dry-run": "`--dry-run` was removed in the index redesign along with `--clean`, the only flag it ever modified.",
     "setup --detect-only": "`--detect-only` was removed in 0.9 — environment detection runs inside `akm setup`; `akm info` reports the configured capabilities.",
     "setup --reset-recommended": "`--reset-recommended` was removed in 0.9 — `akm setup` now offers to apply recommended defaults interactively.",
     "proposal extract --watch": "`--watch` was removed in 0.9 — schedule `akm proposal extract --auto` as a task instead.",

package/dist/cli/unknown-flags.js

@@ -30,28 +30,6 @@ import { cittyComparableName, findCittyTopLevelCommandIndex, toAliasArray, } fro
 import { retiredFlagHint } from "./retired-commands.js";
 /** Flags citty implements itself, which no command declares. */
 const IMPLICIT_FLAGS = ["help", "h", "version", "v"];
-/**
- * Keys `GLOBAL_OUTPUT_ARGS` (cli/shared.ts) contributes. Every leaf AND every
- * group re-declares these so citty's parser consumes their values (see that
- * constant's own doc) — so their mere presence in a group's own `args` never
- * means the group has a real business use for its own flags; only a key
- * beyond this set does. Duplicated here (not imported) to avoid coupling this
- * shared scanner to `cli/shared.ts`'s own dependency surface; keep in sync if
- * `GLOBAL_OUTPUT_ARGS` gains or loses a key.
- */
-const GLOBAL_OUTPUT_ARG_KEYS = new Set(["format", "detail", "shape", "output", "quiet", "verbose"]);
-/**
- * Whether a group declares any flag of its own beyond the global output
- * scaffold — i.e. whether its bare invocation (no subcommand token) runs a
- * REAL default body that reads those flags (`akm index`'s `full`/`reembed`),
- * as opposed to the canonical bare-group usage error every other group falls
- * through to (`defineGroupCommand`, cli/shared.ts) — a `UsageError` either
- * way, whose own declared args (if any) exist only so `--help` documents them,
- * never so a body reads them.
- */
-function hasOwnBusinessArgs(cmd) {
-    return Object.keys(cmd.args ?? {}).some((key) => !GLOBAL_OUTPUT_ARG_KEYS.has(key));
-}
 /**
  * Retired flags whose commands still diagnose them THEMSELVES, with a message
  * that names the replacement ("`--scope` was removed, use `--filter`",
@@ -124,20 +102,9 @@ function collectKnownArgs(root, rawArgs) {
             break;
         const idx = findCittyTopLevelCommandIndex(args, (cmd.args ?? {}));
         const token = idx >= 0 ? args[idx] : undefined;
-        // A group with no subcommand token: citty always calls the group's own
-        // `run` regardless (a `defineGroupCommand` group's `run` is never
-        // undefined — see its doc in cli/shared.ts). For most groups that `run`
-        // is the canonical bare-group usage error, and its own declared args (if
-        // any) exist only for `--help`, so a flag meant for the subcommand the
-        // caller forgot to type must not be misreported as "unknown" — stand
-        // down, exactly as before. `akm index` is the one group with a REAL
-        // default body that reads its own flags (`full`/`reembed`), so `akm index
-        // --background` must still be rejected even though `index` also carries a
-        // real subcommand (`status`) — `hasOwnBusinessArgs` is what tells the two
-        // apart.
-        if (token === undefined) {
-            return { names, valueFlags, booleanFlags, displayNames, path, resolved: hasOwnBusinessArgs(cmd) };
-        }
+        // A group with no subcommand token: citty reports "no command specified".
+        if (token === undefined)
+            return { names, valueFlags, booleanFlags, displayNames, path, resolved: false };
         const sub = subCommands[token];
         // An unrecognized token: citty reports the unknown command, which is the
         // real problem — its flags are beside the point.

package/dist/commands/env/env-binding.js

@@ -87,16 +87,16 @@ export function resolveEnvBinding(target, options = {}) {
         const decision = decideDangerousEnvInjection({
             dangerousKeys: dangerous,
             thirdParty: Boolean(source.registryId),
-            allowInsecure: options.allowInsecure,
+            allowDangerousEnvKeys: options.allowDangerousEnvKeys,
         });
         if (decision === "block") {
             throw new UsageError(`Refusing to inject env from a third-party stash. ${detail}\n` +
                 `       Review the file, then copy the values into a first-party env if you trust them, ` +
-                `or pass --allow-insecure once you have.`, "INVALID_FLAG_VALUE");
+                `or pass --allow-dangerous-env-keys once you have.`, "INVALID_FLAG_VALUE");
         }
         if (decision === "warn") {
-            warn(options.allowInsecure && source.registryId
-                ? `${detail} Injecting anyway (--allow-insecure).`
+            warn(options.allowDangerousEnvKeys && source.registryId
+                ? `${detail} Injecting anyway (--allow-dangerous-env-keys).`
                 : `${detail} Injecting anyway (first-party stash).`);
         }
     }

package/dist/commands/env/env-cli.js

@@ -214,7 +214,7 @@ async function runEnvInjected(target, opts) {
     const { values: envValues } = resolveEnvBinding(target, {
         only: opts.only,
         except: opts.except,
-        allowInsecure: opts.allowInsecure,
+        allowDangerousEnvKeys: opts.allowDangerousEnvKeys,
     });
     const mergedEnv = buildChildEnv(process.env, {
         clean: opts.clean === true,
@@ -283,7 +283,7 @@ const envRunCommand = defineJsonCommand({
             type: "string",
             description: "When used with --clean, also inherit these parent env vars (comma-separated). Ignored without --clean.",
         },
-        "allow-insecure": {
+        "allow-dangerous-env-keys": {
             type: "boolean",
             description: "Allow injecting a process-hijacking variable (e.g. LD_PRELOAD, GIT_SSH_COMMAND) from a third-party stash, which otherwise blocks. Use only after explicitly reviewing the env file.",
             default: false,
@@ -295,7 +295,7 @@ const envRunCommand = defineJsonCommand({
             except: parseKeyListFlag(args.except),
             clean: args.clean === true,
             inherit: parseKeyListFlag(args.inherit) ?? [],
-            allowInsecure: args["allow-insecure"] === true,
+            allowDangerousEnvKeys: args["allow-dangerous-env-keys"] === true,
         });
     },
 });

package/dist/commands/improve/collapse-detector.js

@@ -36,10 +36,10 @@ import { getImproveProcessConfig } from "../../core/config/config.js";
 import { appendEvent } from "../../core/events.js";
 import { withStateDb } from "../../core/state-db.js";
 import { warn } from "../../core/warn.js";
-import { searchEntriesLexical } from "../../indexer/search/db-search.js";
 import { deactivateCanarySet, getActiveCanaries, getCanariesBySetId, insertCanaries, insertCycleMetrics, listActiveCanarySetIds, queryRecentCycleMetrics, } from "../../storage/repositories/canaries-repository.js";
 import { closeDatabase, openExistingDatabase } from "../../storage/repositories/index-connection.js";
 import { getAllEntries } from "../../storage/repositories/index-entries-repository.js";
+import { searchFts } from "../../storage/repositories/index-fts-repository.js";
 import { computeBigramDiversity, DEFAULT_MAX_GENERATION } from "./anti-collapse.js";
 import { getAllRankScores } from "./salience.js";
 // ── Defaults (mirrored in config-schema.ts ImproveCollapseDetectorSchema) ────
@@ -189,7 +189,7 @@ export function normHash(text) {
  * Returns the 0-based rank of the first hit, or -1.
  */
 function scoreCanary(indexDb, canary, k) {
-    const results = searchEntriesLexical(indexDb, canary.query, k);
+    const results = searchFts(indexDb, canary.query, k);
     const anchorConceptId = canaryConceptId(canary.anchor_ref);
     for (let i = 0; i < Math.min(results.length, k); i++) {
         const r = results[i];

package/dist/commands/improve/consolidate.js

@@ -24,7 +24,7 @@ import { callStructured, preflightStructuredLlmRunner } from "../../llm/structur
 import { getBodyEmbeddings, upsertBodyEmbeddings } from "../../storage/repositories/embeddings-repository.js";
 import { closeDatabase, openExistingDatabase, openReadonlyExistingDatabase, } from "../../storage/repositories/index-connection.js";
 import { findEntryIdByRef, getAllEntries, getEntryById } from "../../storage/repositories/index-entries-repository.js";
-import { getNeighborsByEntryId } from "../../storage/repositories/units-repository.js";
+import { getNeighborsByEntryId } from "../../storage/repositories/index-vec-repository.js";
 import { isProposalSkipped, listProposals, listProposalsReadOnly, proposalContent, } from "../proposal/repository.js";
 import { hasSupersededStatus, validateProposalFrontmatter } from "../proposal/validators/proposal-quality-validators.js";
 import { DEFAULT_RANDOM_CLUSTER_FRACTION } from "./anti-collapse.js";
@@ -1394,11 +1394,9 @@ export function narrowToIncrementalCandidates(memories, since, warnings, neighbo
             const id = findEntryIdByRef(db, conceptIdFromTypeName("memory", m.name));
             if (id === undefined)
                 continue;
-            // index-redesign-contract.md B5f item 4 — `getNeighborsByEntryId`
-            // (units-repository.ts) already excludes the querying entry itself, so
-            // `neighborsPerChanged` genuinely OTHER neighbours are requested
-            // directly (no `+ 1` for self, no self-filter here).
-            for (const hit of getNeighborsByEntryId(db, id, neighborsPerChanged)) {
+            for (const hit of getNeighborsByEntryId(db, id, neighborsPerChanged + 1)) {
+                if (hit.id === id)
+                    continue;
                 const entry = getEntryById(db, hit.id);
                 if (!entry)
                     continue;

package/dist/commands/improve/improve-cli.js

@@ -15,7 +15,7 @@ import { redactSensitiveText } from "../../core/redaction.js";
 import { clearLogFile, setLogFile, warn } from "../../core/warn.js";
 import { resolveWriteTarget } from "../../core/write-source.js";
 import { collectEngineCredentialValues } from "../../integrations/agent/engine-resolution.js";
-import { probeEndpointOnce, probeLlmEndpoint } from "../../llm/client.js";
+import { probeLlmReachable } from "../../llm/client.js";
 import { getOutputMode } from "../../output/context.js";
 import { deliverRendered } from "../../output/html-render.js";
 import { akmImprove, resolveImproveReadSource } from "./improve.js";
@@ -122,27 +122,32 @@ function collectRequiredEngineTargets(plan) {
  * `--require-engines` field re-test (#957): the static check above only
  * proves an engine is configured and credentialed — it cannot see a dead
  * endpoint. A field run against an unreachable engine sat silent for
- * minutes instead of hitting the documented exit-78 path. Reuse the SAME
- * bounded reachability probe `akm health`'s `default-llm-engine` /
- * `configured-engines` checks already run (`probeLlmEndpoint`, a single
- * `/models` GET bounded by its own default timeout) once per distinct
- * endpoint (via the shared `probeEndpointOnce` memoization health/checks.ts
- * also uses), so a dead engine is caught here instead of during dispatch.
+ * minutes instead of hitting the documented exit-78 path. Exercise the real
+ * model completion path with a tiny response and a three-second bound. The
+ * `/models` endpoint used by the lightweight health check is deliberately
+ * insufficient here: a gateway can list a model while its upstream completion
+ * route is dead (#980). Deduplicate by endpoint + model, not endpoint alone,
+ * because model backends behind one gateway can fail independently.
  */
-async function assertRequiredEnginesReachable(plan, probeReachable = probeLlmEndpoint) {
+async function assertRequiredEnginesReachable(plan, probeReachable = (connection) => probeLlmReachable(connection, 3_000)) {
     const targets = collectRequiredEngineTargets(plan);
     if (targets.length === 0)
         return;
-    const probesByEndpoint = new Map();
-    const probed = await Promise.all(targets.map(async (target) => ({
-        ...target,
-        reach: await probeEndpointOnce(target.connection, probesByEndpoint, probeReachable),
-    })));
+    const probesByConnection = new Map();
+    const probed = await Promise.all(targets.map(async (target) => {
+        const key = `${target.connection.endpoint.replace(/\/+$/, "")}|${target.connection.model}`;
+        let pending = probesByConnection.get(key);
+        if (!pending) {
+            pending = probeReachable(target.connection);
+            probesByConnection.set(key, pending);
+        }
+        return { ...target, reach: await pending };
+    }));
     const unreachable = probed.filter((item) => !item.reach.reachable);
     if (unreachable.length === 0)
         return;
     const lines = unreachable.map((item) => `  - ${item.process} (engine "${item.engine}", ${item.connection.endpoint}): ${item.reach.error ?? "did not respond"}`);
-    throw new ConfigError(`--require-engines: ${unreachable.length} improve process${unreachable.length === 1 ? "" : "es"} cannot run because ${unreachable.length === 1 ? "its" : "their"} engine endpoint is not reachable:\n${lines.join("\n")}`, "LLM_NOT_CONFIGURED");
+    throw new ConfigError(`--require-engines: ${unreachable.length} improve process${unreachable.length === 1 ? "" : "es"} cannot run because ${unreachable.length === 1 ? "its" : "their"} engine completion path is not reachable:\n${lines.join("\n")}`, "LLM_NOT_CONFIGURED");
 }
 /**
  * `--show-prompt` (#952): render the composed reflect prompt for one asset ref
@@ -249,7 +254,7 @@ export const improveCommand = defineCommand({
         },
         "skip-if-locked": {
             type: "boolean",
-            description: "If another improve run already holds the lock, skip gracefully (exit 0) instead of failing with 'already running' (exit 75). Use for high-frequency scheduled runs so they don't pile up failures while a longer run is in progress.",
+            description: "If another improve run already holds the lock, skip gracefully (exit 0) instead of failing with 'already running' (exit 78). Use for high-frequency scheduled runs so they don't pile up failures while a longer run is in progress.",
             default: false,
         },
         "require-engines": {

package/dist/commands/improve/reflect.js

@@ -29,6 +29,7 @@ import { parseFrontmatter } from "../../core/asset/frontmatter.js";
 import { conceptIdFromTypeName, parseRefInput } from "../../core/asset/resolve-ref.js";
 import { DESCRIPTION_MAX_CHARS, requiresDescription } from "../../core/authoring-rules.js";
 import { loadConfig } from "../../core/config/config.js";
+import { generatedContentRejection, stripReflectPromptScaffolding } from "../../core/content-safety.js";
 import { ConfigError, UsageError } from "../../core/errors.js";
 import { appendEvent, readEvents } from "../../core/events.js";
 import { lintLessonContent } from "../../core/lesson-lint.js";
@@ -511,7 +512,12 @@ export function sanitizeReflectPayload(payload, sourceContent, targetRef) {
             mergedFm[field] = sourceFm[field];
         }
     }
-    const cleanedBody = stripAppendedFrontmatter(rawLlmBody.replace(/^\s+/, ""));
+    const withoutAppendedFrontmatter = stripAppendedFrontmatter(rawLlmBody.replace(/^\s+/, ""));
+    const promptScaffolding = stripReflectPromptScaffolding(withoutAppendedFrontmatter);
+    const cleanedBody = promptScaffolding.content;
+    if (promptScaffolding.stripped) {
+        warnings.push('Removed echoed run-only "Avoid These Patterns" guidance from the proposed asset body (#963).');
+    }
     // #636 — deterministic description fallback (reflect-side belt-and-suspenders).
     // If the type requires a `description` and the merged frontmatter is still
     // MISSING one (source had none AND the model didn't author one), derive a
@@ -1881,7 +1887,22 @@ export async function akmReflect(options = {}) {
             // draft paths.
             cleanupReflectDrafts(draftPathsToCleanup);
         }
-        payload = { ...payload, content: redactSensitiveText(payload.content, sensitiveValues) };
+        const unsafeContent = generatedContentRejection(payload.content, redactSensitiveText(payload.content, sensitiveValues));
+        if (unsafeContent) {
+            emitReflectFailed("parse_error", "parse_error", options.ref, {
+                ...(result.exitCode !== null ? { exitCode: result.exitCode } : {}),
+            });
+            return {
+                schemaVersion: 2,
+                ok: false,
+                reason: "parse_error",
+                error: unsafeContent,
+                ...(options.ref ? { ref: options.ref } : {}),
+                engine: engineName,
+                exitCode: result.exitCode,
+                ...reflectNoticeFields(executionNotices),
+            };
+        }
         const refFailure = validateReflectPayloadRef({
             payload,
             result,

package/dist/commands/lint/base-linter.js

@@ -41,6 +41,7 @@ import { checkUnquotedDescriptionColon } from "../../core/asset/frontmatter-lint
 import { isArchivedRelPath } from "../../core/asset/memory-archive.js";
 import { conceptIdFromTypeName, typeNameFromConceptId } from "../../core/asset/resolve-ref.js";
 import { localDateStamp } from "../../core/common.js";
+import { containsRedactedContent, REDACTED_CONTENT_MARKER } from "../../core/content-safety.js";
 import { findFenceRegions } from "./markdown-insertion.js";
 // ── Helpers ───────────────────────────────────────────────────────────────────
 /** Fold physically wrapped prose the same way a YAML plain scalar does. */
@@ -603,6 +604,14 @@ export function runBaseChecks(ctx) {
         .map((v) => String(v).trim())
         .filter(Boolean);
     const shouldRun = (issueType) => !lintSkip.includes(issueType);
+    if (shouldRun("redacted-content") && containsRedactedContent(currentRaw)) {
+        issues.push({
+            file: ctx.relPath,
+            issue: "redacted-content",
+            detail: `asset contains ${REDACTED_CONTENT_MARKER}; restore the original non-secret prose from version history`,
+            fixed: false,
+        });
+    }
     // ── 1. unquoted-colon ──────────────────────────────────────────────────
     if (shouldRun("unquoted-colon")) {
         const unquotedColonDetail = checkUnquotedDescriptionColon(ctx.frontmatter);

package/dist/commands/lint/env-key-rules.js

@@ -11,7 +11,7 @@
  *
  * Enforcement scope:
  *   - `akm lint` reports findings as `dangerous-env-key` (non-blocking warn).
- *   - `akm bundle add` BLOCKS install unless `--allow-insecure` is set (or, on TTY,
+ *   - `akm bundle add` BLOCKS install unless `--allow-dangerous-env-keys` is set (or, on TTY,
  *     the user explicitly confirms at the prompt).
  *   - Local env writes do NOT consult this list — by design, the operator may
  *     legitimately store any key locally. The gate exists only for third-party
@@ -22,7 +22,7 @@
  *   invoked by many interactive tools and are a documented RCE vector when
  *   sourced from untrusted environments. They will also flag on benign files
  *   where the operator legitimately wants to set their editor — accept the
- *   FP and bypass with `--allow-insecure` after review.
+ *   FP and bypass with `--allow-dangerous-env-keys` after review.
  */
 import fs from "node:fs";
 import { listKeys } from "../env/env.js";