akm-cli 0.9.17-alpha.8 → 0.9.17

package/STABILITY.md

@@ -366,8 +366,8 @@ for scripted use.
 ### `akm improve` autonomy — opt-in in 0.9.0
 
 **`akm improve` is review-first by default in 0.9.0.** The command itself is ON
-— its schedules, reflect/distill proposals, and graph extraction all run — but
-the lanes that mutate assets *without* review require an explicit opt-in:
+— its schedules and reflect/distill proposals all run — but the lanes that
+mutate assets *without* review require an explicit opt-in:
 
 ```sh
 akm config set experimental.improveAutonomy true
@@ -388,9 +388,10 @@ review-first config correctly shows `queue`.
 | memory cleanup | Belief-state frontmatter rewrites, archive moves | analyzed but not applied |
 | `triage` `applyMode: "promote"` | Auto-accepts queued proposals into the bundle | downgraded to `queue` — triage still runs, it just does not auto-accept |
 
-Consolidation remains enabled with autonomy off because merge, delete, and
-contradiction operations are advisory; promotion only emits a reviewable
-proposal.
+Consolidation remains enabled with autonomy off: both its passes (promotion,
+and the pair pass's duplicate/subsumed/supersedes judging) only ever emit a
+reviewable proposal, and a pair-pass `retire` proposal is never auto-accepted
+by `triage` `applyMode: "promote"` regardless of this gate.
 
 Because the gate is applied before the LLM preflight, a review-first workspace
 also needs fewer engines configured: a strategy whose only model-backed process
@@ -409,9 +410,9 @@ Autonomy is never inferred: an absent `experimental` section, an absent key, and
 an explicit `false` all read as off, so a partially-written or older config is
 review-first rather than accidentally permissive.
 
-Reflect, distill, extract candidates, validation, proactive-maintenance
-selection, and graph extraction are proposal-only and never write assets
-directly. Two further direct writes are ungated by design: `extract`'s session
+Reflect, distill, extract candidates, validation, and proactive-maintenance
+selection are proposal-only and never write assets directly. Two further
+direct writes are ungated by design: `extract`'s session
 indexing (additive `sessions/**` writes,
 `processes.extract.indexSessions`, default on) and distill's
 encoding-salience frontmatter stamp (metadata only).

package/dist/assets/hints/cli-hints-full.md

@@ -245,10 +245,9 @@ akm improve --no-push                         # commit but skip push for this ru
 akm improve --sync                            # force sync even on strategies that disable it
 ```
 
-Strategy sync defaults: `catchup`, `consolidate`, `default`,
-`graph-refresh`, `quick`, and `thorough` auto-commit + push;
-`proactive-maintenance` and `reflect-distill` skip sync entirely. Override
-with `--sync` / `--no-sync` flags.
+Strategy sync defaults: `catchup`, `consolidate`, `default`, `quick`, and
+`thorough` auto-commit + push; `proactive-maintenance` and `reflect-distill`
+skip sync entirely. Override with `--sync` / `--no-sync` flags.
 
 The `--writable` flag on `akm bundle add` opts a remote git bundle into push-on-sync:
 
@@ -308,8 +307,8 @@ akm bundle create                                      # Initialize working bund
 akm setup                                     # Interactive wizard: bundle + LLM/embedding + agent + registry config
 akm setup --dir ~/custom-bundle                # Run the wizard against a custom bundle path
 akm setup --yes                               # Non-interactive, accepts all defaults
-akm index                                     # Rebuild search index (metadata enrichment when configured)
-akm index --full                              # Full reindex (metadata enrichment when configured)
+akm index                                     # Rebuild search index
+akm index --full                              # Full reindex
 akm bundle list                                      # List all sources
 akm lint                                      # Structural lint over the bundle; exits 0 regardless of findings
 akm lint --fix                                # Auto-fix Tier 1 issues
@@ -399,7 +398,7 @@ akm agent --model sonnet --prompt "..."         # Model override (aliases or exa
 ```sh
 akm info                                       # Capabilities, bundle dir, index stats, semantic-search status
 akm health                                     # Runtime diagnostics; exit 0 ok / 4 warn / 1 fail
-akm health --report                            # Adds accept-rate and graph-coverage metrics
+akm health --report                            # Adds accept-rate metrics
 akm log                                        # Append-only event stream (mutations, feedback, indexing)
 akm log --ref <ref>                            # One asset's event trail
 akm log --since @offset:<id>                   # Durable row-id cursor — poll this to follow the stream

package/dist/assets/improve-strategies/catchup.json

@@ -16,9 +16,6 @@
     "memoryInference": {
       "enabled": false
     },
-    "graphExtraction": {
-      "enabled": false
-    },
     "extract": {
       "enabled": false
     },

package/dist/assets/improve-strategies/consolidate.json

@@ -5,7 +5,6 @@
     "distill": { "enabled": false },
     "consolidate": { "enabled": true, "allowedTypes": ["memory"], "maxChunkSize": 25 },
     "memoryInference": { "enabled": false },
-    "graphExtraction": { "enabled": false },
     "extract": { "enabled": false },
     "triage": { "enabled": false },
     "validation": { "enabled": false },

package/dist/assets/improve-strategies/default.json

@@ -1,5 +1,5 @@
 {
-  "description": "Standard improve pass — reflect, distill, advisory consolidation, graph extraction, and validation. Memory inference is listed below but only runs when experimental.improveAutonomy is set; improve-stage extract and proactive maintenance off.",
+  "description": "Standard improve pass — reflect, distill, consolidation (promotion plus the reviewed pair-pass retire/supersede proposals), and validation. Memory inference is listed below but only runs when experimental.improveAutonomy is set; improve-stage extract and proactive maintenance off.",
   "processes": {
     "reflect": {
       "enabled": true,
@@ -9,7 +9,6 @@
     "distill": { "enabled": true, "allowedTypes": ["memory"], "requirePlannedRefs": true },
     "consolidate": { "enabled": true, "allowedTypes": ["memory"] },
     "memoryInference": { "enabled": true },
-    "graphExtraction": { "enabled": true },
     "extract": { "enabled": false, "triage": { "enabled": true, "minScore": 2 } },
     "validation": { "enabled": true },
     "proactiveMaintenance": { "enabled": false, "dueDays": 30, "maxPerRun": 15 },

package/dist/assets/improve-strategies/proactive-maintenance.json

@@ -1,5 +1,5 @@
 {
-  "description": "Opt-in proactive-maintenance pass — reflect, distill, proposal triage (promote, high budget), and the proactive-maintenance lane (maxPerRun 100); consolidate/memoryInference/graphExtraction/extract off. Sync disabled: an interrupted run would otherwise leave an uncommitted backlog.",
+  "description": "Opt-in proactive-maintenance pass — reflect, distill, proposal triage (promote, high budget), and the proactive-maintenance lane (maxPerRun 100); consolidate/memoryInference/extract off. Sync disabled: an interrupted run would otherwise leave an uncommitted backlog.",
   "processes": {
     "reflect": {
       "enabled": true,
@@ -8,7 +8,6 @@
     "distill": { "enabled": true, "allowedTypes": ["memory"] },
     "consolidate": { "enabled": false },
     "memoryInference": { "enabled": false },
-    "graphExtraction": { "enabled": false },
     "extract": { "enabled": false },
     "validation": { "enabled": false },
     "triage": {

package/dist/assets/improve-strategies/quick.json

@@ -1,5 +1,5 @@
 {
-  "description": "Reflect-only pass — no extract, distill, consolidate, memoryInference, or graphExtraction.",
+  "description": "Reflect-only pass — no extract, distill, consolidate, or memoryInference.",
   "processes": {
     "reflect": {
       "enabled": true,
@@ -9,7 +9,6 @@
     "distill": { "enabled": false },
     "consolidate": { "enabled": false },
     "memoryInference": { "enabled": false },
-    "graphExtraction": { "enabled": false },
     "triage": { "enabled": false },
     "validation": { "enabled": false },
     "proactiveMaintenance": { "enabled": false }

package/dist/assets/improve-strategies/reflect-distill.json

@@ -1,5 +1,5 @@
 {
-  "description": "Reflect + distill pass — reflect, distill, memoryInference, and proposal triage (promote); proactiveMaintenance/consolidate/graphExtraction/extract off. Sync disabled: an interrupted run would otherwise leave an uncommitted backlog.",
+  "description": "Reflect + distill pass — reflect, distill, memoryInference, and proposal triage (promote); proactiveMaintenance/consolidate/extract off. Sync disabled: an interrupted run would otherwise leave an uncommitted backlog.",
   "processes": {
     "reflect": {
       "enabled": true,
@@ -8,7 +8,6 @@
     "distill": { "enabled": true, "allowedTypes": ["memory"], "requirePlannedRefs": false },
     "consolidate": { "enabled": false },
     "memoryInference": { "enabled": true },
-    "graphExtraction": { "enabled": false },
     "extract": {
       "enabled": false,
       "timeoutMs": 300000,

package/dist/assets/improve-strategies/thorough.json

@@ -18,9 +18,6 @@
     "memoryInference": {
       "enabled": true
     },
-    "graphExtraction": {
-      "enabled": true
-    },
     "extract": {
       "enabled": false,
       "triage": {

package/dist/assets/prompts/consolidate-pair.md

@@ -0,0 +1,20 @@
+You compare two assets from one person's agent-memory library (memories and knowledge notes an AI coding agent reads). Asset A is the OLDER one and asset B the NEWER one, by the dates shown.
+
+Classify the relation between them as exactly one of:
+
+- "duplicate": they state the same durable facts. Wording, title or formatting may differ, but neither adds a claim a reader would need that the other lacks.
+- "subsumed": one of them contains every durable claim of the other, plus more. The smaller one is redundant.
+- "supersedes": B updates, corrects, reverses or replaces a claim in A (a newer version, a changed decision, a fixed bug, a new value). A is now stale or wrong on that point.
+- "contradicts": they make logically exclusive claims about the same thing and nothing shows which one is current.
+- "overlap": same subject, but each has durable claims the other lacks. Keeping both loses nothing; merging them would keep both sets of claims.
+- "unrelated": different subjects or different facts that happen to share words.
+
+Rules:
+- A durable claim is a fact, decision, value, command, path, number or rule someone would act on. Ignore dates, headings, tags and phrasing.
+- Prefer "overlap" over "duplicate" when either asset has a specific detail (a number, command, file, version or condition) that the other lacks.
+- "supersedes" needs a specific claim in A that B changes. Being newer or longer is not enough.
+- "contradicts" needs two claims that cannot both be true. Different scope, project or time is not a contradiction.
+
+Set "redundant" to "A" or "B" when that asset could be removed with no loss (only for "duplicate" or "subsumed"; for "duplicate" name the less complete or older one), else null. Set "stale" to "A" when the relation is "supersedes", else null.
+
+Answer ONLY with JSON: {"relation": "...", "redundant": "A"|"B"|null, "stale": "A"|null, "confidence": 0.0-1.0, "reason": "<at most 25 words>"}

package/dist/assets/stash-skeleton/facts/conventions/backlinks.md

@@ -8,11 +8,11 @@ updated: 2026-09-28
 
 <!--
   SOFT guidance only — advice, not a contract. Back-linking here is a RETRIEVAL
-  mechanism, not decoration: `xrefs:` frontmatter folds into the search index;
-  the entity/relation graph is extracted from BODY prose (memory + knowledge),
-  never from frontmatter. Over-linking degrades ranking, so these rules are
-  deliberately conservative. (LLM-wiki bundles carry their own xref system in
-  their pages' frontmatter — this convention is for in-stash assets.)
+  mechanism, not decoration: `xrefs:` frontmatter folds into the search index
+  and is stored as a declared link `akm show` lists on both assets.
+  Over-linking degrades ranking, so these rules are deliberately conservative.
+  (LLM-wiki bundles carry their own xref system in their pages' frontmatter —
+  this convention is for in-stash assets.)
 -->
 
 # Back-linking conventions
@@ -21,9 +21,8 @@ Cross-references are how knowledge compounds instead of being re-derived every
 session. In AKM they are also **indexed**: the strings in an asset's `xrefs:`
 frontmatter fold into its search-hint text and are stored as links that
 `akm show` lists on both assets (with `supersededBy:`, `contradictedBy:` and a
-`.derived` memory's parent), and knowledge/memory bodies feed an LLM-extracted
-entity/relation graph that boosts ranking. So links are a retrieval
-lever — which means both too few and too many hurt.
+`.derived` memory's parent). So links are a retrieval lever — which means both
+too few and too many hurt.
 
 ```yaml
 ---
@@ -48,10 +47,8 @@ xrefs:
 - **Associative xrefs are discretionary — real relationships only.** Add one when
   you already know a genuine load-bearing connection. Do **not** hit a link
   quota by pointing at the topically-nearest sibling — a plausible-but-wrong
-  xref makes this asset a false search match for the other topic, and a wrong
-  relationship asserted in prose poisons the entity graph. A relationship you
-  want the graph to learn must be named in the body (e.g. open with "Corrects
-  knowledge/auth/oauth-refresh-races").
+  xref makes this asset a false search match for the other topic and a false
+  declared link on both assets' `akm show` output.
 - **Cap total xrefs at ~5 (a heuristic, not a measured threshold).** Each xref
   folds its ref tokens into THIS asset's search hints — past a handful, the
   asset matches queries about several other topics and its own ranking signal
@@ -80,19 +77,20 @@ prose is indexed in the lowest-weight `content` field, so
 `description:`/`when_to_use:` remain the primary orientation channel. Then
 open the body with a plain title plus a one-line
 orientation naming what it is, its scope/domain, and its key entities in
-canonical spelling (`Postgres`, `OAuth`, `TLS`, `Acme`) — the entity/relation
-graph is extracted from body prose, and readers land here from `akm show`.
-Keep the canonical-spelling list in `facts/conventions/domains` so agents don't
-fragment `postgres` / `postgresql` / `pg`.
+canonical spelling (`Postgres`, `OAuth`, `TLS`, `Acme`) — consistent spelling
+keeps search matches from fragmenting across variants, and readers land here
+from `akm show`. Keep the canonical-spelling list in `facts/conventions/domains`
+so agents don't fragment `postgres` / `postgresql` / `pg`.
 
 ## Hubs are optional, not per-namespace obligations
 
 A hub (a `knowledge/` overview page that xrefs the key assets in a domain) is
 worth authoring for a **few genuinely high-traffic domains**. Do **not**
 mandate a hub per namespace and do not edit a hub on every write: that is O(n)
-maintenance, a concurrent-write contention point, and it flattens the multi-hop
-graph into a namespace-wide star. Let the FTS index be the catalog; spend the
-effort on per-asset self-situating headers instead.
+maintenance, a concurrent-write contention point, and it flattens every linked
+asset's declared links into a namespace-wide star centered on the hub. Let the
+FTS index be the catalog; spend the effort on per-asset self-situating headers
+instead.
 
 ## Keep assets atomic
 

package/dist/assets/stash-skeleton/facts/conventions/domains.md

@@ -48,8 +48,8 @@ volume justifies it.
 ## Canonical entity spellings
 
 Pick ONE name per entity and use it everywhere in asset **bodies** — retrieval
-is case-insensitive but treats aliases as different entities, so alias variants
-fragment the entity graph. Extend as your stash grows.
+is case-insensitive but treats aliases as different terms, so alias variants
+fragment search matches. Extend as your stash grows.
 
 - Postgres (not postgresql / pg)
 - Kubernetes (not k8s)

package/dist/assets/templates/html/health.html

@@ -325,7 +325,7 @@
 
       <div class="chart-panel full-width">
         <h3>Per-Phase Wall Time Decomposition (stacked, min)</h3>
-        <div id="chartPhases" class="ec tall" role="img" aria-label="Stacked area chart decomposing wall time per run into consolidation, memory inference, graph extraction, and unattributed phases"></div>
+        <div id="chartPhases" class="ec tall" role="img" aria-label="Stacked area chart decomposing wall time per run into consolidation, memory inference, and unattributed phases"></div>
         <div class="empty-overlay" id="emptyPhases">No runs in the selected slice.</div>
       </div>
 
@@ -390,7 +390,7 @@
       <div class="table-wrap">
       <table>
         <thead>
-          <tr><th>Started</th><th>Task</th><th>Strategy</th><th>Wall</th><th>Promoted</th><th>Merged</th><th>Contradicted</th><th>MI Written</th><th>Entities</th><th>Lint Fixed</th><th>Status</th></tr>
+          <tr><th>Started</th><th>Task</th><th>Strategy</th><th>Wall</th><th>Promoted</th><th>Merged</th><th>Contradicted</th><th>MI Written</th><th>Lint Fixed</th><th>Status</th></tr>
         </thead>
         <tbody id="lastRunsTable"></tbody>
       </table>
@@ -539,7 +539,7 @@ mkChart('chartWallTime', {
 // ── 2. Per-phase wall time decomposition (stacked area) ──────────────────────
 mkChart('chartPhases', {
   tooltip: baseTooltip,
-  legend: { ...baseLegend, data: ['Consolidation', 'Memory inference', 'Graph extraction', 'Unattributed'] },
+  legend: { ...baseLegend, data: ['Consolidation', 'Memory inference', 'Unattributed'] },
   grid: denseGrid,
   dataZoom: denseZoom,
   xAxis: { type: 'category', data: xLabels, ...baseAxis },
@@ -547,7 +547,6 @@ mkChart('chartPhases', {
   series: [
     { name: 'Consolidation',    type: 'line', stack: 'p', areaStyle: { color: 'rgba(88,166,255,0.55)' },  lineStyle: { width: 0 }, showSymbol: false, data: rs.map(r => toMin(r.consDurationMs)) },
     { name: 'Memory inference', type: 'line', stack: 'p', areaStyle: { color: 'rgba(63,185,80,0.55)' },   lineStyle: { width: 0 }, showSymbol: false, data: rs.map(r => toMin(r.miDurationMs)) },
-    { name: 'Graph extraction', type: 'line', stack: 'p', areaStyle: { color: 'rgba(188,140,255,0.55)' }, lineStyle: { width: 0 }, showSymbol: false, data: rs.map(r => toMin(r.geDurationMs)) },
     { name: 'Unattributed',     type: 'line', stack: 'p', areaStyle: { color: 'rgba(210,153,34,0.45)' },  lineStyle: { width: 0 }, showSymbol: false, data: rs.map(r => toMin(r.otherMs)) },
   ],
 });
@@ -695,7 +694,6 @@ tbody.innerHTML = '';
     <td>${r.merged || 0}</td>
     <td style="color:${(r.contradicted||0)>5?'var(--yellow)':'var(--text)'};">${r.contradicted || 0}</td>
     <td style="color:var(--green);">${r.miWritten || 0}</td>
-    <td>${r.geEntities || 0}</td>
     <td>${r.lintFixed || 0}</td>
     <td>${badge}</td>
   `;

package/dist/cli/retired-commands.js

@@ -38,7 +38,7 @@ const RETIRED_COMMAND_HINTS = {
     events: "`akm events` moved in 0.9 — use `akm log`.",
     // Removed observability surfaces.
     history: "`akm history` was removed in 0.9 — use `akm log --ref <ref>` for an asset's event trail.",
-    graph: "`akm graph` was removed in 0.9 — graph counts appear in `akm health`; refresh extraction with `akm improve --strategy graph-refresh`.",
+    graph: "`akm graph` was removed in 0.9. The LLM entity graph it inspected was itself retired in 0.9.17-alpha.9 — use `akm show <ref>` for an asset's declared links.",
     lessons: "`akm lessons` was removed in 0.9 — lesson strength is indexed; use `akm search --type lesson`.",
     lesson: "`akm lesson` was removed in 0.9 — lesson strength is indexed; use `akm search --type lesson`.",
     // Relocated guidance / removed asset verbs.

package/dist/cli/unknown-flags.js

@@ -26,8 +26,17 @@
  * validation) — conservative by design.
  */
 import { UsageError } from "../core/errors.js";
+import { warn } from "../core/warn.js";
 import { cittyComparableName, findCittyTopLevelCommandIndex, toAliasArray, } from "./invocation.js";
 import { retiredFlagHint } from "./retired-commands.js";
+/**
+ * Commands that must never refuse on an unrecognized flag — `akm info` warns
+ * and continues instead of exiting 2, the same tolerance a bare `akm help
+ * --whatever` already gets for free from its group-command fallback (no
+ * resolved subcommand, so this gate stands down entirely). `info` is a leaf
+ * command, so it needs an explicit opt-in here instead.
+ */
+const UNKNOWN_FLAG_TOLERANT_COMMANDS = new Set(["info"]);
 /** Flags citty implements itself, which no command declares. */
 const IMPLICIT_FLAGS = ["help", "h", "version", "v"];
 /**
@@ -172,6 +181,10 @@ function throwUnknownFlag(shown, attempted, known) {
         ? `Did you mean \`${suggestion}\`? Run the command with \`--help\` to see its accepted flags.`
         : undefined);
 }
+/** The {@link UNKNOWN_FLAG_TOLERANT_COMMANDS} counterpart to {@link throwUnknownFlag}: report, don't refuse. */
+function warnUnknownFlag(shown, known) {
+    warn(`[akm ${known.path.join(" ")}] ignoring unknown flag "${shown}" — run with --help to see its accepted flags.`);
+}
 /**
  * Throw a {@link UsageError} naming the first flag the resolved command does
  * not declare. Returns silently when every flag is known.
@@ -195,6 +208,7 @@ export function assertKnownFlags(root, rawArgs) {
     const dynamicNamedFlagCommands = new Set(["workflow run", "task run", "task explain"]);
     const dynamicWorkflowParams = dynamicNamedFlagCommands.has(known.path.join(" "));
     const selfDiagnosed = SELF_DIAGNOSED_FLAGS.get(known.path.join(" "));
+    const tolerant = UNKNOWN_FLAG_TOLERANT_COMMANDS.has(known.path.join(" "));
     for (let i = 0; i < ownArgs.length; i += 1) {
         const token = ownArgs[i];
         // Not a flag: positional, a bare `-` (stdin), or a negative number.
@@ -209,8 +223,13 @@ export function assertKnownFlags(root, rawArgs) {
             for (let offset = 0; offset < shortFlags.length; offset += 1) {
                 const rawName = shortFlags[offset];
                 const candidate = cittyComparableName(rawName);
-                if (!known.names.has(candidate))
+                if (!known.names.has(candidate)) {
+                    if (tolerant) {
+                        warnUnknownFlag(token, known);
+                        break;
+                    }
                     throwUnknownFlag(token, `-${rawName}`, known);
+                }
                 if (known.valueFlags.has(candidate)) {
                     if (offset === shortFlags.length - 1)
                         i += 1;
@@ -239,6 +258,10 @@ export function assertKnownFlags(root, rawArgs) {
             // frozen plan before a run is inserted. Short flags remain strict.
             if (dynamicWorkflowParams)
                 continue;
+            if (tolerant) {
+                warnUnknownFlag(token.split("=")[0], known);
+                continue;
+            }
             throwUnknownFlag(token.split("=")[0], `--${rawName}`, known);
         }
         // Skip a declared value flag's value so `--reason "--x"` is not scanned.

package/dist/cli.js

@@ -645,6 +645,24 @@ export function shouldBypassConfigStartup(argv) {
     const subcommand = args.slice(configIndex + 1).find((arg) => !arg.startsWith("-"));
     return subcommand === "path";
 }
+/**
+ * Whether `argv` resolves to the top-level `info` command — used by
+ * `runCli` (and mirrored in `tests/_helpers/cli.ts`) to scope the startup
+ * config read's best-effort fallback to `info` alone. `info` is NOT on
+ * {@link shouldBypassConfigStartup}'s allowlist: unlike a bare bypass, it
+ * still reads a valid config's `output.format`/`output.detail` like any
+ * other command, it just must not be aborted by one it cannot read (see
+ * `assembleInfo`'s doc comment, src/commands/sources/info.ts, for why).
+ * Every other command reads config exactly as before — a broken config
+ * throws here and the command never runs.
+ */
+export function isInfoCommand(argv) {
+    const userArgs = argv.slice(2);
+    const separator = userArgs.indexOf("--");
+    const args = separator === -1 ? userArgs : userArgs.slice(0, separator);
+    const commandIndex = findCittyTopLevelCommandIndex(args, MAIN_TOP_LEVEL_ARGS);
+    return (commandIndex >= 0 ? args[commandIndex] : undefined) === "info";
+}
 // ── Exit codes ──────────────────────────────────────────────────────────────
 // Canonical table lives in `src/cli/shared.ts` (EXIT_CODES). These aliases keep
 // the local call sites terse. EXIT_HEALTH_WARN (4) is the `akm health` "warn"
@@ -968,7 +986,34 @@ async function runCli() {
     try {
         applyEarlyStderrFlags(process.argv);
         const bypassConfig = shouldBypassConfigStartup(process.argv);
-        initOutputMode(process.argv, bypassConfig ? (DEFAULT_CONFIG.output ?? {}) : (loadConfig().output ?? {}));
+        // Off the bypass allowlist, every command reads config here exactly as
+        // it always has: an invalid config.json throws, `emitJsonError` reports
+        // it, and the command never runs — no side effect of its own body ever
+        // happens (a lock taken, a network call made, a database opened
+        // read-write). `akm info` is the ONE exception (see `assembleInfo`'s
+        // doc comment, src/commands/sources/info.ts): only ITS read is
+        // best-effort, falling back to `DEFAULT_CONFIG.output` instead of
+        // throwing. Scoped narrowly on purpose — an earlier version of this fix
+        // made the read best-effort for every command, which silently changed
+        // outcomes across the CLI (some commands that should refuse at exit 78
+        // ran anyway; `health`/`index`/`config set`/`feedback` still failed,
+        // but only after already taking a lock, opening a database read-write,
+        // or making a network call).
+        let outputDefaults = DEFAULT_CONFIG.output ?? {};
+        if (!bypassConfig) {
+            if (isInfoCommand(process.argv)) {
+                try {
+                    outputDefaults = loadConfig().output ?? {};
+                }
+                catch {
+                    outputDefaults = DEFAULT_CONFIG.output ?? {};
+                }
+            }
+            else {
+                outputDefaults = loadConfig().output ?? {};
+            }
+        }
+        initOutputMode(process.argv, outputDefaults);
     }
     catch (error) {
         emitJsonError(error);

package/dist/commands/health/archive-usage.js

@@ -0,0 +1,92 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/**
+ * `memory-cleanup-archive` advisory for `akm health` (item 4, 0.9.17-alpha.9
+ * plan §5.4/§8 step 8).
+ *
+ * Reports the archive's size and file count for every bundle, git-backed or
+ * not. A bundle with no `.git` of its own keeps every retirement's archived
+ * bytes forever (the purge sweep never runs there at all), so that alone is
+ * reported. A git-backed bundle can ALSO have bytes the purge sweep will
+ * never remove: `.git` presence alone does not prove a retirement was ever
+ * committed (`proposal accept` only commits for a `kind: "git"` write
+ * target, and a `kind: "filesystem"` bundle that merely happens to have a
+ * `.git` directory never gets one) — those bytes sit there indefinitely,
+ * however old they get, with nothing else to say so. This checks the SAME
+ * git state `purgeGracedArchive` checks (tracked, clean, verifiable) and
+ * reports how much of the archive fails it.
+ *
+ * Silent whenever there is nothing to say: the archive does not exist or is
+ * empty, or (for a git-backed bundle) every byte in it is purgeable once it
+ * ages out.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { MEMORY_ARCHIVE_REL } from "../../core/asset/memory-archive.js";
+import { toPosix } from "../../core/common.js";
+import { checkGitPathSafety, isGitBackedStash } from "../../sources/providers/git-stash.js";
+import { MAX_WALK_ENTRIES, sizeOfPath } from "./data-dir-usage.js";
+/**
+ * Build the `memory-cleanup-archive` advisory, or `undefined` when there is
+ * nothing to report.
+ */
+export function collectArchiveUsageAdvisory(stashDir) {
+    const archiveRoot = path.join(stashDir, MEMORY_ARCHIVE_REL);
+    if (!fs.existsSync(archiveRoot))
+        return undefined;
+    if (!isGitBackedStash(stashDir)) {
+        const usage = sizeOfPath(archiveRoot, { remaining: MAX_WALK_ENTRIES });
+        if (usage.files === 0)
+            return undefined;
+        const lowerBound = usage.truncated ? ` (a lower bound — the walk stopped after ${MAX_WALK_ENTRIES} entries)` : "";
+        return {
+            name: "memory-cleanup-archive",
+            kind: "deterministic",
+            status: "pass",
+            confidence: "high",
+            message: `${usage.files} archived file(s), ${usage.bytes} byte(s)${lowerBound} in .akm/memory-cleanup/archive — ` +
+                "this bundle has no git history, so the purge sweep leaves it untouched.",
+            evidence: { files: usage.files, bytes: usage.bytes, truncated: usage.truncated },
+        };
+    }
+    // Git-backed: the SAME three checks purgeGracedArchive runs (B1, G10) —
+    // computed once here, not per file, and reused via `onFile` below instead
+    // of a second walk of the same tree. A failed git check here fails the
+    // same way purgeGracedArchive's own sweep would: nothing in the archive
+    // can be proven purgeable, so every byte counts as unpurgeable rather
+    // than guessing (`checkGitPathSafety`'s `isSafe` is always `false` when
+    // `ok` is `false`).
+    const gitSafety = checkGitPathSafety(stashDir, MEMORY_ARCHIVE_REL);
+    let unpurgeableFiles = 0;
+    let unpurgeableBytes = 0;
+    const usage = sizeOfPath(archiveRoot, { remaining: MAX_WALK_ENTRIES }, (filePath, bytes) => {
+        const key = toPosix(path.relative(stashDir, filePath));
+        if (!gitSafety.isSafe(key)) {
+            unpurgeableFiles++;
+            unpurgeableBytes += bytes;
+        }
+    });
+    if (usage.files === 0)
+        return undefined;
+    if (unpurgeableFiles === 0)
+        return undefined; // everything here is purgeable once it ages out — nothing to say
+    const lowerBound = usage.truncated ? ` (a lower bound — the walk stopped after ${MAX_WALK_ENTRIES} entries)` : "";
+    return {
+        name: "memory-cleanup-archive",
+        kind: "deterministic",
+        status: "warn",
+        confidence: "high",
+        message: `${usage.files} archived file(s), ${usage.bytes} byte(s)${lowerBound} in .akm/memory-cleanup/archive; ` +
+            `${unpurgeableFiles} file(s), ${unpurgeableBytes} byte(s) of that cannot be purged (untracked, modified, ` +
+            "or unverifiable in git) — commit them so the purge sweep can remove them once they age out.",
+        evidence: {
+            files: usage.files,
+            bytes: usage.bytes,
+            truncated: usage.truncated,
+            unpurgeableFiles,
+            unpurgeableBytes,
+            gitStateKnown: gitSafety.ok,
+        },
+    };
+}

package/dist/commands/health/data-dir-usage.js

@@ -41,7 +41,7 @@ const DOMINANT_SUBDIR_PERCENT_THRESHOLD = 50;
  * cap the walk stops descending further and the advisory says its size
  * figures are a lower bound.
  */
-const MAX_WALK_ENTRIES = 100_000;
+export const MAX_WALK_ENTRIES = 100_000;
 /**
  * Below this the data dir is not worth an opinion. The advisory exists for
  * disk blowups (74 GB in the incident); on a small directory a ratio is
@@ -59,31 +59,42 @@ function liveDbBytesFor(name, sizes) {
     return ((sizes.get(name)?.bytes ?? 0) + (sizes.get(`${name}-wal`)?.bytes ?? 0) + (sizes.get(`${name}-shm`)?.bytes ?? 0));
 }
 /**
- * Recursively sum file sizes under `root` (stat-only, symlinks not
- * followed so a cyclic or huge-target symlink can't blow up the walk).
- * `budget` is a shared mutable counter across the whole tree so the
- * `MAX_WALK_ENTRIES` cap applies to the walk as a whole, not per-branch.
+ * Recursively sum file sizes (and count files) under `root` (stat-only,
+ * symlinks not followed so a cyclic or huge-target symlink can't blow up the
+ * walk). `budget` is a shared mutable counter across the whole tree so the
+ * entry cap applies to the walk as a whole, not per-branch — callers
+ * typically pass {@link MAX_WALK_ENTRIES}, sized for this module's own data
+ * dir walk, but a smaller/larger budget is fine for a different tree.
+ * Shared with the `archive-usage` advisory (N2) — the same "don't let a
+ * pathological tree hang a health check" concern applies to both.
+ *
+ * `onFile`, when given, is called once per leaf file (path, bytes) as the
+ * walk visits it — `archive-usage` uses this to classify each file's git
+ * state without a second, separate walk of the same tree.
  */
-function sizeOfPath(root, budget) {
+export function sizeOfPath(root, budget, onFile) {
     let stat;
     try {
         stat = fs.lstatSync(root);
     }
     catch {
-        return { bytes: 0, truncated: false };
+        return { bytes: 0, files: 0, truncated: false };
     }
     if (stat.isSymbolicLink())
-        return { bytes: 0, truncated: false };
-    if (!stat.isDirectory())
-        return { bytes: stat.size, truncated: false };
+        return { bytes: 0, files: 0, truncated: false };
+    if (!stat.isDirectory()) {
+        onFile?.(root, stat.size);
+        return { bytes: stat.size, files: 1, truncated: false };
+    }
     let entries;
     try {
         entries = fs.readdirSync(root, { withFileTypes: true });
     }
     catch {
-        return { bytes: 0, truncated: false };
+        return { bytes: 0, files: 0, truncated: false };
     }
     let bytes = 0;
+    let files = 0;
     let truncated = false;
     for (const entry of entries) {
         if (budget.remaining <= 0) {
@@ -91,12 +102,13 @@ function sizeOfPath(root, budget) {
             break;
         }
         budget.remaining--;
-        const sub = sizeOfPath(path.join(root, entry.name), budget);
+        const sub = sizeOfPath(path.join(root, entry.name), budget, onFile);
         bytes += sub.bytes;
+        files += sub.files;
         if (sub.truncated)
             truncated = true;
     }
-    return { bytes, truncated };
+    return { bytes, files, truncated };
 }
 /** `1610612736` -> `"1.5G"`. Values under 10 in a unit keep one decimal; 10+ round to an integer. */
 function formatBytes(bytes) {