akm-cli 0.9.17-alpha.3 → 0.9.17-alpha.4

package/dist/core/config/schema/improve.js

@@ -2,20 +2,14 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 /**
- * Top-level `improve` config section (utility decay, salience, collapse
- * detector, strategies). Extracted verbatim from the former `config-schema.ts`
- * monolith — no behavior change.
+ * Top-level `improve` config section (salience, state GC, strategies). Retired
+ * keys (`salience.replayBudget`, `collapseDetector`, `utilityDecay`) are
+ * tolerated as unknown keys.
  */
 import { z } from "zod";
 import { ImproveProfileConfigSchema } from "./improve-processes.js";
 import { engineName, nonNegativeNumber } from "./primitives.js";
-// ── Improve top-level (utility decay, event retention) ─────────────────────
-const ImproveUtilityDecaySchema = z
-    .object({
-    halfLifeDays: z.number().finite().min(0.1).optional(),
-    feedbackStabilityBoost: z.number().finite().min(1).optional(),
-})
-    .passthrough();
+// ── Improve top-level (event retention, salience, state GC) ────────────────
 const ImproveSalienceSchema = z
     .object({
     /**
@@ -34,36 +28,6 @@ const ImproveSalienceSchema = z
      * Default 0.75. Set to 1.0 to disable the lane entirely.
      */
     salienceThreshold: z.number().min(0).max(1).optional(),
-    /**
-     * Per-run additive replay budget (#610). Up to this many top-salience refs are
-     * revisited even with no reactive signal and regardless of cooldown. Additive
-     * on top of --limit. Default 0 = no replay.
-     */
-    replayBudget: z.number().int().min(0).optional(),
-})
-    .passthrough();
-// R5 — longitudinal collapse detector (observe-only; deterministic,
-// fail-open, runs only on cycles where consolidate did work).
-// Default ON; opt out via `improve.collapseDetector.enabled: false`.
-// See docs/architecture/specs/improve-collapse-churn-detector-design.md.
-// The design's CHURN alert class was removed (never fired in production —
-// its accepted-change-volume input was always a hardcoded 0), so this schema
-// no longer carries `churnMinAcceptedActions`.
-const ImproveCollapseDetectorSchema = z
-    .object({
-    enabled: z.boolean().optional(),
-    // Canary set size minted on first run (owner-approved 30–50 range; default 40).
-    canaryCount: z.number().int().min(3).max(200).optional(),
-    // Top-K cutoff for canary recall/nDCG (default 10).
-    k: z.number().int().min(1).max(100).optional(),
-    // Trend window in qualifying cycles (default 5).
-    windowCycles: z.number().int().min(2).max(50).optional(),
-    // Absolute mean-recall drop vs window median that fires collapse (default 0.15).
-    recallDropThreshold: z.number().min(0).max(1).optional(),
-    // distinct-content-ratio decline over the window that fires collapse (default 0.05).
-    entropyDropThreshold: z.number().min(0).max(1).optional(),
-    // improve_cycle_metrics retention (default 365 days, owner-approved).
-    retentionDays: z.number().int().min(1).optional(),
 })
     .passthrough();
 // #733 — orphan-GC pass (Workstream C, lean by design: one config gate).
@@ -85,10 +49,8 @@ const ImproveStateGcSchema = z
 export const ImproveConfigSchema = z
     .object({
     strategies: z.record(engineName, ImproveProfileConfigSchema).optional(),
-    utilityDecay: ImproveUtilityDecaySchema.optional(),
     eventRetentionDays: nonNegativeNumber.optional(),
     salience: ImproveSalienceSchema.optional(),
-    collapseDetector: ImproveCollapseDetectorSchema.optional(),
     stateGc: ImproveStateGcSchema.optional(),
 })
     .passthrough();

package/dist/core/config/schema/scheduler.js

@@ -3,18 +3,18 @@
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import { z } from "zod";
 import { nonEmptyString } from "./primitives.js";
-/** One host-local grant allowing an authored asset to create scheduler bindings. */
-export const SchedulerActivationSchema = z
-    .object({
-    kind: z.enum(["task", "workflow"]),
-    ref: nonEmptyString,
-    /** Identity of the configured source this host approved, not merely its mutable bundle name. */
-    sourceId: z.string().regex(/^sha256:[0-9a-f]{64}$/),
-})
-    .strict();
-/** Absence from this allow-list means disabled. */
+/** A 0.9.17-alpha `{kind, ref, sourceId}` activation, read as its ref. */
+const LegacySchedulerActivationSchema = z
+    .object({ ref: nonEmptyString })
+    .passthrough()
+    .transform((activation) => activation.ref);
 export const SchedulerConfigSchema = z
     .object({
-    enabled: z.array(SchedulerActivationSchema).default([]),
+    /**
+     * Fully-qualified refs (`bundle//tasks/x`, `bundle//workflows/y`) this host
+     * schedules. Absent when the host has never chosen: `akm task sync` then
+     * takes the akm-written rows already installed as the choice and writes it.
+     */
+    enabled: z.array(z.union([nonEmptyString, LegacySchedulerActivationSchema])).optional(),
 })
-    .strict();
+    .passthrough();

package/dist/core/config/schema/search.js

@@ -2,29 +2,15 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 /**
- * `search` config section (graph-boost tuning). Extracted verbatim from the
- * former `config-schema.ts` monolith — no behavior change.
+ * `search` config section: default type exclusion and the optional curate
+ * reranker.
  */
 import { z } from "zod";
-import { httpUrl, nonEmptyString, nonNegativeNumber, positiveInt, symbolicOrWarnApiKey } from "./primitives.js";
+import { httpUrl, nonEmptyString, positiveInt, symbolicOrWarnApiKey } from "./primitives.js";
 // ── Search ──────────────────────────────────────────────────────────────────
-const SearchGraphBoostSchema = z
-    .object({
-    directBoostPerEntity: nonNegativeNumber.optional(),
-    directBoostCap: nonNegativeNumber.optional(),
-    hopBoostPerEntity: nonNegativeNumber.optional(),
-    hopBoostCap: nonNegativeNumber.optional(),
-    /** Hard-capped at 3; values > 3 hard-error so users see the typo. */
-    maxHops: positiveInt.max(3).optional(),
-    /** Only "blend" is exercised; "off"/"multiply" were never set in practice and were removed. */
-    confidenceMode: z.enum(["blend"]).default("blend").optional(),
-    /** Range [0, 1]; values > 1 hard-error (no silent clamp). */
-    confidenceWeight: z.number().finite().min(0).max(1).default(0.2).optional(),
-})
-    .passthrough();
 /**
  * `search.curateRerank` (#951) — an optional cross-encoder rerank pass over
- * `akm curate`'s already-selected candidates.
+ * `akm curate`'s top fused candidates.
  *
  * Deliberately its own small config arm rather than a third member of the
  * `engines` map (`EngineConfigSchema` in ./engines.ts): that union's "llm" /
@@ -48,15 +34,13 @@ export const CurateRerankConfigSchema = z
     model: nonEmptyString.optional(),
     apiKey: symbolicOrWarnApiKey("search.curateRerank.apiKey").optional(),
     timeoutMs: positiveInt.optional(),
-    /** How many of curate's already-ranked candidates to send to the reranker. Default 8. */
+    /** How many of the top fused search candidates curate sends to the reranker. Default 30. */
     topN: positiveInt.max(50).optional(),
 })
-    .strict();
+    .passthrough();
 export const SearchConfigSchema = z
     .object({
-    minScore: nonNegativeNumber.optional(),
     defaultExcludeTypes: z.array(nonEmptyString).optional(),
-    graphBoost: SearchGraphBoostSchema.optional(),
     curateRerank: CurateRerankConfigSchema.optional(),
 })
     .passthrough();

package/dist/core/env-secret-ref.js

@@ -271,7 +271,6 @@ export function resolveSecretWriteTarget(ref, writeTarget, create) {
  */
 export function withEnvSecretWrite(target, ref, op, paths, mutate) {
     return withWriteTargetMutation(target, paths, {
-        ignored: "local-only",
         purpose: `${ref.type}-${op.toLowerCase()}`,
         message: `${op} ${formatRefForMessage({ type: ref.type, name: ref.name, origin: target.source.name })}`,
     }, mutate);

package/dist/core/errors.js

@@ -11,13 +11,13 @@ const CONFIG_HINTS = {
     STASH_DIR_UNREADABLE: "Check the path exists and your user has read permission, or update the default bundle path.",
     DATA_DIR_UNREADABLE: "The data directory is not readable by the user running akm. Check its owner and mode, or point AKM_DATA_DIR / XDG_DATA_HOME somewhere this user owns.",
     INDEX_SCHEMA_INCOMPATIBLE: "Run `akm index --full` to rebuild the derived index from the currently materialized sources.",
-    EMBEDDING_NOT_CONFIGURED: 'Run `akm config set embedding \'{"endpoint":"...","model":"..."}\'` to enable embeddings.',
     LLM_NOT_CONFIGURED: 'Run `akm setup` or configure an `engines` entry with `kind: "llm"`, then select it with `defaults.llmEngine`.',
     TEST_ISOLATION_MISSING: "Under bun test, when AKM_BUNDLE_DIR is set you MUST also set XDG_DATA_HOME (or AKM_DATA_DIR) and XDG_STATE_HOME (or AKM_STATE_DIR) to temp directories so the test does not touch the developer's real ~/.local/share/akm or ~/.local/state/akm.",
     UNSAFE_STASH_DIR: "Choose a path inside your home directory (e.g. ~/akm) or another empty workspace. The bundle directory cannot be the filesystem root, your home directory itself, or a sensitive system path like /etc, /var, ~/.config, or ~/.ssh.",
     UNKNOWN_IMPROVE_STRATEGY: "Pass one of the listed strategy names to `--strategy`, or define it under `improve.strategies`. Names are case-sensitive.",
     EXECUTION_NOT_AUTHORIZED: "Change the selected tools or update the machine/user execution policy, then retry.",
     SECRET_REFERENCE_UNRESOLVED: "Check the secret exists (`akm secret list`) and the name after `secret://` matches, or run `akm secret set <name> <value>` to store it.",
+    REGISTRY_URL_INVALID: "Registry URLs must be credential-free http(s) URLs. Fix the entry with `akm registry list` / `akm registry add`, or the AKM_REGISTRY_URL / AKM_NPM_REGISTRY variable that supplied it.",
 };
 // Code-review finding: COMPOSITION_INVALID covers several unrelated causes
 // (a rejected with:, a multi-job source, a composition cycle/depth/size
@@ -56,7 +56,7 @@ const USAGE_HINTS = {
     //
     // Code-review finding: this default is reached ONLY by with:-rejection
     // throw sites (the ones above, plus task.ts's noDeclaredInputsError and
-    // resolve-steps.ts's rejectNonTaskBindingWith) — every other
+    // freeze.ts's resolveStep) — every other
     // COMPOSITION_INVALID throw site (multi-job source, composition
     // cycle/depth/size, invalid child-output reference, an env: on a
     // composing step) passes its own explicit constructor hint instead of
@@ -72,19 +72,17 @@ const USAGE_HINTS = {
     WORKFLOW_SOURCE_INVALID: "Run `akm lint` to see the failing source location, or `akm workflow plan <ref>` to compile it without writing.",
     INPUT_BINDING_INVALID: "Check the step's with: keys against the target's declared inputs.",
     TASK_TARGET_UNSUPPORTED: "Task definitions support command, script, workflow, and shell (run:) targets; akm/command is layered by callers.",
-    // P3a (docs/plans/specs/p3a-plan-v5-child-freeze.md §3.2, A-N2): the
-    // complete-or-abandon policy for a stored pre-irVersion-5 run.
-    WORKFLOW_IR_VERSION_UNSUPPORTED: "Abandon the run with `akm workflow abandon <id>`, then start it again from the workflow source — a frozen plan this akm cannot execute is not re-executable in place.",
-    // P3b (docs/plans/specs/p3b-child-executor.md §4.3).
-    WORKFLOW_OUTPUT_INVALID: "Check each `outputs:` entry's `from:` against the step artifact it names, and its `schema:` against the value that step actually promotes.",
 };
 /** Default hint for each TransientErrorCode. */
 const TRANSIENT_HINTS = {
-    RUN_LEASE_HELD: "Wait for the named engine invocation to finish or for the lease to expire, then retry. `akm workflow status <id>` shows the current lease.",
+    RUN_LEASE_HELD: "Wait for the akm process driving this run (the named pid) to finish, then retry.",
     STATE_DB_CONTENDED: "Another akm process is writing state.db right now. Wait a few seconds and retry; commands that support --skip-if-locked can skip instead of failing.",
     INDEX_DB_CONTENDED: "Another akm process is writing index.db; retry shortly, or pass --skip-if-locked on scheduled runs.",
-    MAINTENANCE_BARRIER_BUSY: "Another akm process is registering a lock or lease right now. Retry shortly, or pass --skip-if-locked on scheduled index/improve/workflow runs.",
     IMPROVE_LOCK_HELD: "Another akm improve run holds the whole-run lock right now. Wait for it to finish and retry, or pass --skip-if-locked on scheduled runs.",
+    LOCKFILE_CONTENDED: "Another akm process is updating its bundle lockfile right now. Wait a few seconds and retry.",
+    ASSET_MUTATION_LEASE_HELD: "Another akm process is writing bundle content right now. Wait for it to finish and retry.",
+    SCHEDULER_LOCK_HELD: "Another `akm task sync`, `add`, `enable`, `disable` or `prune` is writing the scheduler right now. Wait for it to finish and retry.",
+    REGISTRY_UNREACHABLE: "The registry did not answer in time. Check the network and the registry URL (`akm registry list`), then retry.",
 };
 /** Default hint for each NotFoundError code. */
 const NOT_FOUND_HINTS = {
@@ -97,6 +95,7 @@ const NOT_FOUND_HINTS = {
     PROPOSAL_NOT_FOUND: "Run `akm proposal list` to see pending proposals and their ids.",
     FILE_NOT_FOUND: "Check the path exists and is readable.",
     IMPROVE_RUN_NOT_FOUND: "Run `akm improve` first, or `akm improve report --since 30d` to see recent run ids in `runIds`.",
+    REGISTRY_NOT_FOUND: "Check the ref's spelling and version; `akm search <query> --from registry` lists installable refs.",
 };
 /**
  * Base class for all akm-thrown, classified errors. Carries the `kind`

package/dist/core/file-lock.js

@@ -1,11 +1,20 @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/**
+ * PID-stamped exclusive lock files.
+ *
+ * A lock is one file created with `O_EXCL` (`wx`), which the filesystem
+ * makes atomic: exactly one creator wins, so no further mutex or barrier is
+ * needed around acquisition. The payload records the holder's PID (and the
+ * launcher PID under a scheduler) so a probe can tell a live holder from a
+ * dead one; only a verifiably dead holder — or, when the caller opts in via
+ * `staleAfterMs`, an over-age one — is ever reclaimed. Reclaim moves the
+ * stale file aside, re-verifies it is the very file that was probed, and only
+ * then unlinks it, so two reclaimers cannot both "win" the same stale lock.
+ */
 import { randomUUID } from "node:crypto";
 import fs from "node:fs";
-import path from "node:path";
-import { sleepSync } from "../runtime.js";
-import { openDatabase } from "../storage/database.js";
 import { isProcessAlive, MAX_LOCK_METADATA_BYTES, readTextFileDescriptorWithLimit } from "./common.js";
 function readLockSnapshot(lockPath) {
     let fd;
@@ -32,51 +41,16 @@ function readLockSnapshot(lockPath) {
 function sameIdentity(left, right) {
     return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeMs === right.mtimeMs;
 }
-function operationMutexPath(lockPath) {
-    // `.sensitive` is an established non-asset suffix across stash walkers. The
-    // mutex may sit beside a secret/env lock and must never surface as an asset.
-    return path.join(path.dirname(lockPath), `.${path.basename(lockPath)}.operations.sensitive`);
-}
-/**
- * Serialize every mutation of one canonical lock path. SQLite's write lock is
- * released by the OS when a process dies, so this mutex needs no stale-owner
- * deletion protocol (which would reproduce the same check/rename race it is
- * meant to prevent).
- */
-function withLockOperationMutex(lockPath, run) {
-    const db = openDatabase(operationMutexPath(lockPath));
-    let began = false;
+function releaseLockRaw(lockPath) {
     try {
-        db.exec("PRAGMA busy_timeout = 30000");
-        for (let attempt = 0; attempt < 5 && !began; attempt += 1) {
-            db.exec("BEGIN IMMEDIATE");
-            began = db.inTransaction;
-            if (!began)
-                sleepSync(2 ** attempt);
-        }
-        if (!began)
-            throw new Error(`Could not acquire lock operation mutex for ${lockPath}.`);
-        const result = run();
-        db.exec("COMMIT");
-        began = false;
-        return result;
-    }
-    catch (error) {
-        if (began && db.inTransaction) {
-            try {
-                db.exec("ROLLBACK");
-            }
-            catch {
-                // Preserve the operation failure.
-            }
-        }
-        throw error;
+        fs.unlinkSync(lockPath);
     }
-    finally {
-        db.close();
+    catch {
+        // Already gone.
     }
 }
-function tryAcquireLockRaw(lockPath, payload) {
+/** Create the lock file atomically; `undefined` when another holder already has it. */
+export function tryAcquireLockSync(lockPath, payload) {
     try {
         fs.writeFileSync(lockPath, payload, { flag: "wx" });
     }
@@ -99,35 +73,6 @@ function tryAcquireLockRaw(lockPath, payload) {
     }
     return { lockPath, ...snapshot };
 }
-function releaseLockRaw(lockPath) {
-    try {
-        fs.unlinkSync(lockPath);
-    }
-    catch {
-        // Sentinel already gone — fine.
-    }
-}
-/**
- * Atomically create a sentinel at `lockPath` with `payload` as the body.
- * Returns an exact ownership handle if we now own the lock, or undefined if a sentinel already
- * exists (EEXIST). Throws any other error (permissions, missing parent
- * dir, etc.) — callers must ensure the parent directory exists.
- *
- * `payload` is typically `String(process.pid)` for the simple cases or
- * a small JSON envelope for callers that want richer metadata
- * (improve.ts records pid + startedAt so audit can correlate runs).
- */
-export function tryAcquireLockSync(lockPath, payload) {
-    return withLockOperationMutex(lockPath, () => tryAcquireLockRaw(lockPath, payload));
-}
-/**
- * Best-effort launcher pid from `AKM_LAUNCHER_PID` (set by
- * `scripts/node-runtime/akm`/`akm-migrate`, #956) — undefined when unset,
- * empty, or not a positive integer (never trust an ambient env var blindly
- * into a lock message). Also the gate the parent-death watchdog
- * (`core/parent-watchdog.ts`) uses to stay inert outside a launcher-managed
- * run.
- */
 export function launcherPidFromEnv() {
     const raw = process.env.AKM_LAUNCHER_PID;
     if (!raw)
@@ -135,13 +80,6 @@ export function launcherPidFromEnv() {
     const pid = Number.parseInt(raw, 10);
     return Number.isInteger(pid) && pid > 0 ? pid : undefined;
 }
-/**
- * Build a PID-bearing payload with a unique token for one acquisition attempt.
- * Adds `launcherPid` (#956) whenever this process is running under the
- * published launcher, so a lock's holder can be identified by the pid every
- * process listing and task log actually shows (the launcher's) as well as
- * the pid that holds the lock (the bun/node child).
- */
 export function createLockPayload(metadata = {}) {
     const launcherPid = launcherPidFromEnv();
     return JSON.stringify({
@@ -151,26 +89,12 @@ export function createLockPayload(metadata = {}) {
         lockId: randomUUID(),
     });
 }
-/**
- * Inspect an existing sentinel at `lockPath` without modifying it.
- * Returns:
- *   - `absent` if the file does not exist.
- *   - `stale` if the file is present but should be reclaimed (the holding
- *     PID is dead, the content is unparseable, or the lock has exceeded
- *     `staleAfterMs`). Includes the failure reason so callers can log it.
- *   - `held` if the lock has a live holder and is not yet age-expired.
- *
- * Does NOT remove the file. Callers decide recovery policy.
- */
 export function probeLock(lockPath, opts) {
     let snapshot;
     try {
         snapshot = readLockSnapshot(lockPath);
     }
     catch (error) {
-        // A permission error means the lock may be genuinely HELD by someone we
-        // cannot see. Reporting it as stale would invite a caller to steal a live
-        // lease (#791) — `unreadable` stays for the corrupt/undecodable case.
         const code = error?.code;
         if (code === "EACCES" || code === "EPERM")
             return { state: "inaccessible", code };
@@ -193,102 +117,81 @@ export function probeLock(lockPath, opts) {
     return { state: "held", holderPid, launcherPid, ageMs, rawContent, identity };
 }
 /**
- * Revalidate and quarantine the probed sentinel while holding the same operation
- * mutex used by acquisitions. A newer owner therefore cannot be renamed in the
- * check/quarantine window, and a third contender cannot acquire until cleanup
- * has completed.
+ * Remove a lock that `probeLock` reported stale. Returns `false` when the file
+ * changed since the probe (someone else reclaimed or re-acquired it) so the
+ * caller re-probes instead of assuming the path is free.
  */
 export function reclaimStaleLock(lockPath, probe, options) {
     if (probe.rawContent === undefined || probe.identity === undefined)
         return false;
     const expectedContent = probe.rawContent;
     const expectedIdentity = probe.identity;
-    return withLockOperationMutex(lockPath, () => {
-        let current;
-        try {
-            current = readLockSnapshot(lockPath);
-        }
-        catch {
-            return false;
-        }
-        if (!current || current.rawContent !== expectedContent || !sameIdentity(current.identity, expectedIdentity)) {
+    let current;
+    try {
+        current = readLockSnapshot(lockPath);
+    }
+    catch {
+        return false;
+    }
+    if (!current || current.rawContent !== expectedContent || !sameIdentity(current.identity, expectedIdentity)) {
+        return false;
+    }
+    const quarantinePath = `${lockPath}.stale-${process.pid}-${randomUUID()}`;
+    try {
+        fs.renameSync(lockPath, quarantinePath);
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
             return false;
-        }
-        const quarantinePath = `${lockPath}.stale-${process.pid}-${randomUUID()}`;
+        throw err;
+    }
+    let quarantined;
+    try {
+        quarantined = readLockSnapshot(quarantinePath);
+    }
+    catch {
+        quarantined = undefined;
+    }
+    if (!quarantined ||
+        quarantined.rawContent !== expectedContent ||
+        !sameIdentity(quarantined.identity, expectedIdentity)) {
+        // The file we moved aside is not the one we probed: a fresh holder took
+        // the path in between. Put it back and report no reclaim.
         try {
-            fs.renameSync(lockPath, quarantinePath);
+            fs.linkSync(quarantinePath, lockPath);
         }
         catch (err) {
-            if (err.code === "ENOENT")
-                return false;
-            throw err;
+            if (err.code !== "EEXIST")
+                throw err;
         }
-        let quarantined;
-        try {
-            quarantined = readLockSnapshot(quarantinePath);
-        }
-        catch {
-            quarantined = undefined;
-        }
-        if (!quarantined ||
-            quarantined.rawContent !== expectedContent ||
-            !sameIdentity(quarantined.identity, expectedIdentity)) {
-            try {
-                // Restore without replacing a non-cooperating lock installed after quarantine.
-                fs.linkSync(quarantinePath, lockPath);
-            }
-            catch (err) {
-                if (err.code !== "EEXIST")
-                    throw err;
-            }
-            releaseLockRaw(quarantinePath);
+        releaseLockRaw(quarantinePath);
+        return false;
+    }
+    options?.afterQuarantineVerified?.();
+    try {
+        fs.unlinkSync(quarantinePath);
+        return true;
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
             return false;
-        }
-        options?.afterQuarantineVerified?.();
-        try {
-            fs.unlinkSync(quarantinePath);
-            return true;
-        }
-        catch (err) {
-            if (err.code === "ENOENT")
-                return false;
-            throw err;
-        }
-    });
+        throw err;
+    }
 }
-/**
- * Release only the exact sentinel returned by `tryAcquireLockSync`. Content and
- * file identity are revalidated while holding the acquisition operation mutex,
- * so a stale holder cannot remove a successor. Synchronous and idempotent so it
- * is safe in both `finally` blocks and process exit handlers.
- */
+/** Unlink the lock only while it is still the exact file this owner created. */
 export function releaseLock(ownership) {
     const { lockPath } = ownership;
-    if (!fs.existsSync(lockPath) && !fs.existsSync(operationMutexPath(lockPath)))
+    let current;
+    try {
+        current = readLockSnapshot(lockPath);
+    }
+    catch {
         return;
-    withLockOperationMutex(lockPath, () => {
-        let current;
-        try {
-            current = readLockSnapshot(lockPath);
-        }
-        catch {
-            // Absent or unreadable — nothing of ours to release.
-            return;
-        }
-        if (current && current.rawContent === ownership.rawContent && sameIdentity(current.identity, ownership.identity)) {
-            releaseLockRaw(lockPath);
-        }
-    });
+    }
+    if (current && current.rawContent === ownership.rawContent && sameIdentity(current.identity, ownership.identity)) {
+        releaseLockRaw(lockPath);
+    }
 }
-/**
- * Extract a holder pid, and (#956) a launcher pid when the payload recorded
- * one, from a sentinel body. Accepts the two shapes used across the
- * codebase: a bare numeric string (config-io, vault, lockfile — never
- * carries a `launcherPid`) and a JSON object with `pid`/`launcherPid` fields
- * (`createLockPayload`). `holderPid` is undefined when the body is
- * unparseable or yields a non-positive integer; `launcherPid` is undefined
- * whenever the payload has none, independent of whether `holderPid` parsed.
- */
 function extractLockIdentity(content) {
     const trimmed = content.trim();
     if (!trimmed)

package/dist/core/logs-db.js

@@ -33,13 +33,13 @@
  * ## Schema evolution
  *
  * Same migration-safety contract as state.db: append-only `MIGRATIONS` applied
- * through the shared runner in src/storage/engines/sqlite-migrations.ts.
+ * through the shared runner in src/storage/sqlite-migrations.ts.
  *
  * @module logs-db
  */
 import path from "node:path";
-import { assertMigrationRegistry, runMigrations as runSqliteMigrations, } from "../storage/engines/sqlite-migrations.js";
 import { openManagedDatabase } from "../storage/managed-db.js";
+import { assertMigrationRegistry, runMigrations as runSqliteMigrations, } from "../storage/sqlite-migrations.js";
 import { getDataDir } from "./paths.js";
 // ── Path helper ──────────────────────────────────────────────────────────────
 /**

package/dist/core/paths.js

@@ -245,9 +245,6 @@ export function getIndexWriterLockPath() {
 export function getIndexRebuildLockPath() {
     return path.join(getDataDir(), "index.rebuild.lock");
 }
-export function getMaintenanceBarrierPath() {
-    return path.join(getDataDir(), "maintenance.barrier.lock");
-}
 /** Path to the state.db file in $DATA. */
 export function getStateDbPathInDataDir() {
     return path.join(getDataDir(), "state.db");
@@ -339,30 +336,6 @@ export function getStashStateKey(stashDir) {
 function stashScopedDir(base, stashDir) {
     return path.join(base, getStashStateKey(stashDir));
 }
-/**
- * `$STATE/improve/distill-rejected/<stash>/` — lessons that failed the
- * distill quality gate. Moved out of `$STASH/.akm/distill-rejected/`
- * (itlackey/akm#890): nothing reads it to resolve bundle content, so it does
- * not meet the "must travel with the content" rule.
- */
-export function getDistillRejectedDir(stashDir) {
-    return stashScopedDir(path.join(getStateDir(), "improve", "distill-rejected"), stashDir);
-}
-/**
- * `$STATE/improve/eval-cases/<stash>/` — regression eval cases captured from
- * rejected distill/proposal output. Moved out of `$STASH/.akm/eval-cases/`
- * (itlackey/akm#890).
- *
- * R10: the writer (`src/commands/improve/eval-cases.ts`) was removed —
- * nothing ever read the files it wrote, and a rejected proposal row now
- * carries the same information (see `quality-gate.ts`'s
- * `writeQualityRejection`). This resolver stays: `scripts/akm-migrate/migrate/
- * writer-relocation.ts` still uses it to relocate pre-existing eval-case
- * files an older release wrote to the legacy `$STASH/.akm/eval-cases/` path.
- */
-export function getEvalCasesDir(stashDir) {
-    return stashScopedDir(path.join(getStateDir(), "improve", "eval-cases"), stashDir);
-}
 /**
  * `$STATE/improve/measurement/verdicts/<stash>/` — `akm-eval-proactive-verdict`
  * reports. Moved out of `$STASH/.akm/measurement/verdicts/` (itlackey/akm#890);