akm-cli 0.9.17-alpha.8 → 0.9.17

package/dist/commands/improve/memory/memory-improve.js

@@ -7,11 +7,12 @@ import { assembleAsset } from "../../../core/asset/asset-serialize.js";
 import { mutateFrontmatter, parseFrontmatter } from "../../../core/asset/frontmatter.js";
 import { MEMORY_ARCHIVE_REL } from "../../../core/asset/memory-archive.js";
 import { conceptIdFromTypeName } from "../../../core/asset/resolve-ref.js";
-import { asNonEmptyString, groupBy, stringArray } from "../../../core/common.js";
+import { asNonEmptyString, groupBy, stringArray, toPosix } from "../../../core/common.js";
 import { DERIVED_SUFFIX } from "../../../core/recognition-util.js";
 import { warn } from "../../../core/warn.js";
 import { recordWrittenPath } from "../../../core/write-provenance.js";
 import { walkMarkdownFiles } from "../../../indexer/walk/walker.js";
+import { checkGitPathSafety, isGitBackedStash } from "../../../sources/providers/git-stash.js";
 import { contentHash } from "../content-hash.js";
 import { isDerivedMemory, memoryIdentityRef, parseMemoryName, resolveParentRef } from "./derived-ref.js";
 export function analyzeMemoryCleanup(stashDir, options = {}) {
@@ -463,17 +464,80 @@ function stronglyConnectedComponents(refs, edges) {
     }
     return { components, componentIndexByRef };
 }
-function archiveCleanupCandidate(stashDir, candidate, filePath) {
+/**
+ * The `.derived` twin of a non-derived memory file, if one exists on disk:
+ * `<name>.derived.md` beside it, the naming convention
+ * `indexer/passes/memory-inference.ts`'s `derivedChildPath` writes.
+ * `undefined` for a knowledge or lesson ref (no such twin exists), or for a
+ * memory that is already itself `.derived` (it has no further twin).
+ *
+ * Used by `akm proposal accept` (alpha.9) to take a retired or promoted
+ * memory's derived child along when it archives the memory.
+ */
+export function derivedTwinPath(filePath, refType) {
+    if (refType !== "memory" || filePath.endsWith(`${DERIVED_SUFFIX}.md`))
+        return undefined;
+    const twin = `${filePath.slice(0, -3)}${DERIVED_SUFFIX}.md`;
+    return fs.existsSync(twin) ? twin : undefined;
+}
+/**
+ * True for a retire-proposal-caused archive (alpha.9: the consolidate pair
+ * pass, or O1's promotion retirement) — distinguished from a memory-cleanup
+ * family-prune candidate by carrying a `proposalId`. The two paths differ in
+ * how `previousBeliefState` is derived (below) and in which extra tombstone
+ * fields apply.
+ */
+function isRetireCandidate(candidate) {
+    return candidate.proposalId !== undefined;
+}
+/**
+ * The tombstone's `previousBeliefState`. Memory cleanup's own family-prune
+ * candidates keep their original reason-based inference (unchanged, so
+ * existing behavior is not disturbed by this generalization). A
+ * retire-proposal candidate has no such reason vocabulary to infer from, so
+ * it reads the asset's ACTUAL frontmatter `beliefState` instead — more
+ * correct, and available because every retire path already has the file on
+ * disk right before the move.
+ */
+function resolvePreviousBeliefState(candidate, filePath) {
+    if (!isRetireCandidate(candidate))
+        return priorBeliefStateForArchive(candidate);
+    try {
+        return resolveBeliefState(parseFrontmatter(fs.readFileSync(filePath, "utf8")).data);
+    }
+    catch {
+        return "active";
+    }
+}
+/**
+ * Move `filePath` into the recoverable cleanup archive
+ * (`.akm/memory-cleanup/archive/<stamp>-<ref>/`) with a `cleanup.md`
+ * tombstone, journaling both ends (`recordWrittenPath`) so a LATER sync
+ * commits the move — `akm sync`, or the batched auto-sync an `akm improve`
+ * run does at its own end (`docs/architecture/improvement.md`, "Auto-sync").
+ * This call does not itself commit anything: a standalone `akm proposal
+ * accept` (the only way a retire proposal is ever accepted — triage never
+ * auto-accepts one) leaves the move journaled but uncommitted until
+ * something later reads that journal, unless the write target's `kind` is
+ * `"git"`, in which case the caller's own `commitWriteTargetBoundary` commits
+ * (and maybe pushes) immediately as part of the SAME accept.
+ *
+ * Generalized in alpha.9 to cover any memory, knowledge or lesson file in a
+ * writable bundle — not only `.derived` memories — so `akm proposal accept`
+ * can archive a consolidate pair-pass `retire` proposal's target, or (O1) an
+ * accepted promotion's source memory, through the same one encoding memory
+ * cleanup already used (D27: never two coexisting encodings). A
+ * retire-proposal candidate (one carrying `proposalId`) additionally stamps
+ * `proposalId`, `successorRefs` and `retiredAt` on the tombstone.
+ */
+export function archiveCleanupCandidate(stashDir, candidate, filePath) {
     const archivedAt = new Date().toISOString();
+    const previousBeliefState = resolvePreviousBeliefState(candidate, filePath);
     const originalPath = path.relative(stashDir, filePath).replace(/\\/g, "/");
     const archiveDir = createArchiveDir(stashDir, candidate.ref, archivedAt);
     const archivedPath = path.join(archiveDir, originalPath);
     fs.mkdirSync(path.dirname(archivedPath), { recursive: true });
-    fs.renameSync(filePath, archivedPath);
-    // #652: an archive is a delete + a create. BOTH ends are journaled so the
-    // sync stages the removal of the original alongside the archived copy.
-    recordWrittenPath(filePath);
-    recordWrittenPath(archivedPath);
+    const retiring = isRetireCandidate(candidate);
     const archiveRef = path.relative(stashDir, archivedPath).replace(/\\/g, "/");
     const auditPath = path.join(archiveDir, "cleanup.md");
     const auditRef = path.relative(stashDir, auditPath).replace(/\\/g, "/");
@@ -482,29 +546,216 @@ function archiveCleanupCandidate(stashDir, candidate, filePath) {
         kind: "memory-cleanup-archive",
         archivedAt,
         beliefState: "archived",
-        previousBeliefState: priorBeliefStateForArchive(candidate),
+        previousBeliefState,
         ref: candidate.ref,
-        parentRef: candidate.parentRef,
+        ...(candidate.parentRef ? { parentRef: candidate.parentRef } : {}),
         reason: candidate.reason,
         ...(candidate.survivorRef ? { survivorRef: candidate.survivorRef } : {}),
         originalPath,
         archivedPath: archiveRef,
+        ...(retiring ? { proposalId: candidate.proposalId, retiredAt: archivedAt } : {}),
+        ...(retiring && candidate.successorRefs && candidate.successorRefs.length > 0
+            ? { successorRefs: candidate.successorRefs }
+            : {}),
     }, "Archived derived memory for recoverable cleanup.\n");
+    // 4c (third review round): write the tombstone BEFORE moving the file — a
+    // crash in between used to leave a file already at archivedPath with no
+    // cleanup.md to explain it (unrecoverable: revert refuses on a missing
+    // tombstone, and nothing else knows this archive dir exists). Reordered,
+    // a crash here instead leaves, at worst, a tombstone describing a move
+    // that has not happened yet, with the file still at its original
+    // location — the ordinary "nothing archived yet" state every caller
+    // already handles.
     fs.writeFileSync(auditPath, auditAsset, "utf8");
     recordWrittenPath(auditPath);
+    fs.renameSync(filePath, archivedPath);
+    // #652: an archive is a delete + a create. BOTH ends are journaled so the
+    // sync stages the removal of the original alongside the archived copy.
+    recordWrittenPath(filePath);
+    recordWrittenPath(archivedPath);
     return {
         ref: candidate.ref,
-        parentRef: candidate.parentRef,
+        ...(candidate.parentRef ? { parentRef: candidate.parentRef } : {}),
         reason: candidate.reason,
         beliefState: "archived",
-        previousBeliefState: priorBeliefStateForArchive(candidate),
+        previousBeliefState,
         ...(candidate.survivorRef ? { survivorRef: candidate.survivorRef } : {}),
         originalPath,
         archivedPath: archiveRef,
         auditPath: auditRef,
         archivedAt,
+        ...(retiring ? { proposalId: candidate.proposalId, retiredAt: archivedAt } : {}),
+        ...(retiring && candidate.successorRefs && candidate.successorRefs.length > 0
+            ? { successorRefs: candidate.successorRefs }
+            : {}),
     };
 }
+/**
+ * How long a retirement's archived bytes stay on disk after `retiredAt`
+ * before the purge sweep deletes them. Git history keeps the bytes (D27;
+ * plan §5.4 "Purge").
+ */
+export const RETIRE_GRACE_DAYS = 30;
+const RETIRE_GRACE_MS = RETIRE_GRACE_DAYS * 24 * 60 * 60 * 1000;
+/** The one file every archive dir keeps forever — never deleted by the purge sweep. */
+const TOMBSTONE_FILENAME = "cleanup.md";
+const EMPTY_ARCHIVE_PURGE_RESULT = { purgedDirs: 0, purgedFiles: 0 };
+/**
+ * The purge sweep (0.9.17-alpha.9 plan §5.4, §8 step 8): deterministic, no
+ * LLM, run once at improve-run start. Deletes the archived asset bytes —
+ * never `cleanup.md` — of every retirement whose tombstone `retiredAt` is
+ * more than {@link RETIRE_GRACE_DAYS} old AND whose archived files are all
+ * git-tracked and clean at the time of the sweep (see below). Git history
+ * keeps the bytes (D27); the tombstone, and ref resolution through it
+ * (`core/asset/memory-archive.ts`), are unaffected — only the tombstone's
+ * own `originalPath` file(s) are removed.
+ *
+ * Git-backed bundles only: a bundle with no `.git` of its own has no history
+ * to fall back on, so its archive is left untouched (`akm health` reports
+ * its size instead — see `health/archive-usage.ts`). Every deleted path is
+ * journaled (`recordWrittenPath`) so the end-of-run sync commits the
+ * removal, the same way it commits the archive move itself (#652).
+ *
+ * `.git` presence is necessary but NOT sufficient: `proposal accept` only
+ * commits for a `kind: "git"` write target (`core/write-source.ts`
+ * `commitWriteTargetBoundary`), and improve's own auto-sync stages only the
+ * paths its own run wrote. A filesystem-kind bundle that merely happens to
+ * have a `.git` directory (e.g. the owner committing by hand, or an old
+ * repo that was never configured as a git source) can carry retirements
+ * that were archived but never committed — deleting those would lose the
+ * only surviving copy. So every archived file under a directory past grace
+ * is checked against `git ls-files` (tracked), `git status --porcelain
+ * -uall` (clean), and `git ls-files -v` (verifiable — an assume-unchanged
+ * or skip-worktree file hides its own edits from `git status`, so it is
+ * never trusted as clean either) — each computed ONCE per sweep, not per
+ * directory; a directory with even one untracked, modified, or
+ * unverifiable file (tombstone included) is left whole for a later sweep.
+ * If any of those three git calls itself fails (a broken submodule can fail
+ * `git status` while `git ls-files` still succeeds, or git can be missing
+ * from `PATH` entirely), the whole sweep purges nothing and warns once —
+ * an empty result from a FAILED check is never treated the same as a
+ * verified-empty one.
+ *
+ * A memory-cleanup family-prune archive (not a retire proposal's) carries no
+ * `retiredAt` in its tombstone at all, so it is never a candidate here —
+ * this sweep only ever touches retirements, never that older archive class.
+ */
+export function purgeGracedArchive(stashDir, now = new Date()) {
+    if (!isGitBackedStash(stashDir))
+        return EMPTY_ARCHIVE_PURGE_RESULT;
+    const archiveRoot = path.join(stashDir, MEMORY_ARCHIVE_REL);
+    let entries;
+    try {
+        entries = fs.readdirSync(archiveRoot, { withFileTypes: true });
+    }
+    catch {
+        return EMPTY_ARCHIVE_PURGE_RESULT; // no archive yet
+    }
+    const cutoffMs = now.getTime() - RETIRE_GRACE_MS;
+    // One git inspection per sweep, not per directory. All three sets are
+    // repo-relative POSIX paths, matched below against each archived file's
+    // own repo-relative path — a file is safe to delete only if it is in
+    // `tracked`, NOT in `dirty`, and NOT in `unverifiable`.
+    //
+    // Each of the three git calls can itself fail independently — a broken
+    // submodule can make `git status` exit nonzero while `git ls-files`
+    // succeeds, or vice versa (round-3 review, probes G8/G9). `[]` from a
+    // failed call is indistinguishable from a genuinely empty result once it
+    // is in a Set, so this checks `ok` FIRST: any failure purges nothing this
+    // sweep rather than silently trusting whichever check happened to
+    // succeed — a `dirty`/`unverifiable` set that came back empty ONLY
+    // because the call failed must never read as "nothing to protect".
+    // G10: assume-unchanged / skip-worktree files never show up as dirty even
+    // when genuinely modified — `checkGitPathSafety` treats them the same as
+    // "not tracked" below, so such a file (and its whole retirement) is left
+    // for a later sweep.
+    const gitSafety = checkGitPathSafety(stashDir, MEMORY_ARCHIVE_REL);
+    if (!gitSafety.ok) {
+        warn(`[improve] archive purge: skipped this sweep — could not determine the archive's git state at ${stashDir} ` +
+            "(git status/ls-files failed); nothing was purged.");
+        return EMPTY_ARCHIVE_PURGE_RESULT;
+    }
+    let purgedDirs = 0;
+    let purgedFiles = 0;
+    for (const entry of entries) {
+        // `Dirent.isDirectory()` reflects `lstat`, so it is false for a symlink
+        // even when the symlink points at a directory — a symlinked
+        // `archive/<name>` is skipped here, never followed (N1). Everything
+        // below only ever joins path components onto `archiveRoot` through
+        // `entry.name`/`readdirSync` results, so a purge can never reach
+        // outside `.akm/memory-cleanup/archive/`.
+        if (!entry.isDirectory())
+            continue;
+        const dir = path.join(archiveRoot, entry.name);
+        let data;
+        try {
+            data = parseFrontmatter(fs.readFileSync(path.join(dir, TOMBSTONE_FILENAME), "utf8")).data;
+        }
+        catch {
+            continue; // not a tombstone dir, or unreadable — never guess
+        }
+        const retiredAt = data.retiredAt;
+        if (typeof retiredAt !== "string")
+            continue; // family-prune archive, not a retirement — out of scope
+        const retiredMs = Date.parse(retiredAt);
+        if (!Number.isFinite(retiredMs) || retiredMs >= cutoffMs)
+            continue; // "more than" the grace period — exactly at it is not enough
+        const allFiles = listFilesRecursive(dir); // tombstone included — the whole entry must be a clean, committed unit
+        const isSafeToPurge = allFiles.every((filePath) => gitSafety.isSafe(toPosix(path.relative(stashDir, filePath))));
+        if (!isSafeToPurge)
+            continue; // untracked, modified, or unverifiable entry — skip the whole directory this sweep (B1, G10)
+        let children;
+        try {
+            children = fs.readdirSync(dir);
+        }
+        catch {
+            continue;
+        }
+        let purgedAnyInThisDir = false;
+        for (const child of children) {
+            if (child === TOMBSTONE_FILENAME)
+                continue;
+            const childPath = path.join(dir, child);
+            // The archived original path may be nested (e.g. `memories/sub/foo.md`
+            // under this dir) — the journal (like git) tracks FILES, so every leaf
+            // under childPath is recorded individually, not the directory itself.
+            const filesUnderChild = listFilesRecursive(childPath);
+            try {
+                fs.rmSync(childPath, { recursive: true, force: true });
+                for (const filePath of filesUnderChild)
+                    recordWrittenPath(filePath);
+                purgedFiles += filesUnderChild.length;
+                purgedAnyInThisDir = purgedAnyInThisDir || filesUnderChild.length > 0;
+            }
+            catch {
+                // Best-effort: a locked or already-gone entry is skipped, not fatal to the run.
+            }
+        }
+        if (purgedAnyInThisDir)
+            purgedDirs++;
+    }
+    return { purgedDirs, purgedFiles };
+}
+/** Every file under `target` (itself included if it's a file), for individual journaling before a recursive delete. */
+function listFilesRecursive(target) {
+    let stat;
+    try {
+        stat = fs.lstatSync(target);
+    }
+    catch {
+        return [];
+    }
+    if (!stat.isDirectory())
+        return stat.isFile() ? [target] : [];
+    let children;
+    try {
+        children = fs.readdirSync(target);
+    }
+    catch {
+        return [];
+    }
+    return children.flatMap((child) => listFilesRecursive(path.join(target, child)));
+}
 function persistBeliefStateTransition(filePath, transition) {
     mutateFrontmatter(filePath, (parsed) => {
         const nextFrontmatter = {

package/dist/commands/improve/planner.js

@@ -114,11 +114,6 @@ export function buildImproveExecutionPlan(input) {
                 wouldRun: input.stageConfig.extract.enabled,
                 reason: input.stageConfig.extract.reason,
             },
-            {
-                name: "graph-extraction",
-                wouldRun: input.stageConfig.graphExtraction.enabled,
-                reason: input.stageConfig.graphExtraction.reason,
-            },
             {
                 name: "memory-inference",
                 wouldRun: input.stageConfig.memoryInference.enabled,

package/dist/commands/improve/preparation.js

@@ -9,10 +9,9 @@
  * Candidate selection reads the improve ledger plus one set of signals: a ref
  * is eligible for a source when feedback newer than its last attempt landed and
  * no ledger window holds it. Refs without recent feedback can still be picked
- * by the fallback lanes (proactive maintenance, high salience, forgetting
- * safety); the survivors are ranked by salience, checked on disk and capped.
- * A plan-only run evaluates the same selectors against read snapshots and
- * writes nothing.
+ * by the fallback lanes (proactive maintenance, high salience); the survivors
+ * are ranked by salience, checked on disk and capped. A plan-only run
+ * evaluates the same selectors against read snapshots and writes nothing.
  */
 import fs from "node:fs";
 import path from "node:path";
@@ -36,13 +35,13 @@ import { computeSafeChunkSize, DEFAULT_CONTEXT_LENGTH_TOKENS } from "./consolida
 import { assetTypeOf, buildUtilityMap, dedupeRefs, findAssetFilePath, isDistillCandidateRef, isLessonCandidate, resolveImproveScope, withIndexDb, } from "./eligibility.js";
 import { akmExtract, countNewExtractCandidates } from "./extract.js";
 import { computeValenceScore } from "./feedback-valence.js";
-import { isLedgerBlocked, lastAttemptByRef, ledgerRowFor, loadLedgerSnapshot, stateKey, stripBundle, } from "./ledger.js";
+import { isLedgerBlocked, lastAttemptByRef, ledgerRowFor, loadLedgerSnapshot, stateKey, } from "./ledger.js";
 import { applyMemoryCleanup } from "./memory/memory-improve.js";
 import { getAllAssetOutcomes, getAssetOutcome, getOutcomeScoresByRef, OUTCOME_SCORE_MAX, outcomeScoreToSalience, projectAssetOutcome, updateAssetOutcome, } from "./outcome-loop.js";
 import { projectMemoryCleanup, selectEffectiveImproveRefs } from "./planner.js";
 import { DEFAULT_DUE_DAYS, DEFAULT_MAX_PER_RUN, selectProactiveMaintenanceRefs } from "./proactive-maintenance.js";
 import { isInRetrievalScope, loadRetrievalScope } from "./retrieval-scope.js";
-import { buildRankChangeReport, computeSalience, getAllRankScores, getAssetSalience, getLastUseMsByRef, isContentEncodingRow, SALIENCE_NO_OP_DAMPEN_FACTOR, SALIENCE_NO_OP_DAMPEN_THRESHOLD, upsertAssetSalience, } from "./salience.js";
+import { computeSalience, getAssetSalience, getLastUseMsByRef, isContentEncodingRow, SALIENCE_NO_OP_DAMPEN_FACTOR, SALIENCE_NO_OP_DAMPEN_THRESHOLD, upsertAssetSalience, } from "./salience.js";
 import { attributeStage, errMessage } from "./stage.js";
 /** The candidate's durable state key (salience, outcome, ledger). */
 const keyOf = (r) => stateKey(r.ref, r.itemRef);
@@ -79,13 +78,7 @@ export function pickDefined(source, keys) {
             out[key] = source[key];
     return out;
 }
-export const CONSOLIDATION_CONFIG_KEYS = [
-    "enabled",
-    "minPoolSize",
-    "limit",
-    "maxChunkSize",
-    "incrementalSince",
-];
+export const CONSOLIDATION_CONFIG_KEYS = ["enabled", "minPoolSize", "limit", "maxChunkSize"];
 /** Emit an aggregate `improve_skipped` row (never one per ref). */
 export function recordImproveSkip(eventsCtx, ref, metadata) {
     appendEvent({ eventType: "improve_skipped", ref, metadata }, eventsCtx);
@@ -120,8 +113,6 @@ function planConsolidationPass(args) {
             writeTarget: options.writeTarget,
             target: options.target,
             limit: processConfig?.limit,
-            incrementalSince: processConfig?.incrementalSince,
-            neighborsPerChanged: processConfig?.neighborsPerChanged,
             maxChunkSize: processConfig?.maxChunkSize,
         }, primaryStashDir, [], args.existingKnowledgeBodyHashes ?? loadExistingKnowledgeBodyHashes(primaryStashDir), { readOnly: args.eventsCtx?.readOnly === true })
         : { poolSize: 0, candidatePoolSize: 0, judgedUnchanged: 0 };
@@ -215,8 +206,6 @@ async function runConsolidationPass(args) {
             existingKnowledgeBodyHashes,
             sourceRun: `consolidate-${Date.now()}`,
             limit: processConfig?.limit,
-            incrementalSince: processConfig?.incrementalSince,
-            neighborsPerChanged: processConfig?.neighborsPerChanged,
             maxChunkSize: processConfig?.maxChunkSize,
             signal: args.budgetSignal,
             p90ChunkSecondsDefault: processConfig?.p90ChunkSecondsDefault,
@@ -648,8 +637,8 @@ export function partitionBySignalDelta(args) {
 }
 /**
  * Pick the loop's refs: signal delta, the fallback lanes (unless
- * `--require-feedback-signal`), lane attribution, salience and forgetting
- * safety, the no-op-dampened ranking, the disk check and the limit.
+ * `--require-feedback-signal`), lane attribution, salience, the
+ * no-op-dampened ranking, the disk check and the limit.
  */
 async function selectLoopCandidates(args, postCleanupRefs, validationFailureRefs, actions, persist) {
     const { scope, options, primaryStashDir, eventsCtx, improveProfile } = args;
@@ -664,9 +653,9 @@ async function selectLoopCandidates(args, postCleanupRefs, validationFailureRefs
     const processableRefs = [...partition.eligibleRefs, ...partition.distillOnlyRefs];
     const signalFiltered = processableRefs.filter((c) => snapshot.feedback.get(c.ref)?.hasSignal === true);
     const signalBearingSet = new Set(signalFiltered.map((r) => r.ref));
-    // The fallback lanes (proactive, high salience, forgetting safety) have no
-    // usage evidence of their own: they pick only what retrieval returned or new
-    // material improve never processed (#986). Evaluated once per candidate.
+    // The fallback lanes (proactive, high salience) have no usage evidence of
+    // their own: they pick only what retrieval returned or new material improve
+    // never processed (#986). Evaluated once per candidate.
     const fallbackEligible = postCleanupRefs.filter((c) => !validationFailureRefs.has(c.ref));
     const allowFallbacks = options.requireFeedbackSignal !== true;
     const retrievalScope = scope.mode === "ref" || !allowFallbacks
@@ -689,7 +678,7 @@ async function selectLoopCandidates(args, postCleanupRefs, validationFailureRefs
         : [];
     // An explicit ref scope always acts on its ref; otherwise usage signals gate the pool.
     const signalAndRetrievalRefs = dedupeRefs([...signalFiltered, ...proactive.proactiveRefs, ...highSalienceRefs]);
-    let mergedRefs = scope.mode === "ref" ? processableRefs : options.requireFeedbackSignal ? signalFiltered : signalAndRetrievalRefs;
+    const mergedRefs = scope.mode === "ref" ? processableRefs : options.requireFeedbackSignal ? signalFiltered : signalAndRetrievalRefs;
     // Lane attribution, weakest first so the strongest wins: high-salience <
     // proactive < signal-delta, and an explicit ref scope over everything.
     const sourceByRef = new Map();
@@ -704,22 +693,7 @@ async function selectLoopCandidates(args, postCleanupRefs, validationFailureRefs
             sourceByRef.set(r.ref, "scope");
     for (const r of mergedRefs)
         r.eligibilitySource = sourceByRef.get(r.ref) ?? "unknown";
-    // Forgetting safety may only reuse this plan's own surviving objects inside
-    // the retrieval scope, and never a ref whose reflect window is still open.
-    const forgettingEligible = fallbackEligible.filter((c) => !unscoped.has(c.ref) &&
-        !isLedgerBlocked(ledgerRowFor(snapshot.ledger, "reflect", c.ref, c.itemRef), snapshot.nowIso));
-    const scored = scoreSalience(args, mergedRefs, snapshot.feedback, retrieval.retrievalCounts, persist);
-    mergedRefs = applyForgettingSafety({
-        pendingForgettingRefs: scored.pendingForgettingRefs,
-        scope,
-        mergedRefs,
-        eligibleRefs: forgettingEligible,
-        allowFallbacks,
-        eligibilitySourceByRef: sourceByRef,
-        highSalienceRefs,
-        proactiveRefs: proactive.proactiveRefs,
-        signalFiltered,
-    });
+    const salienceMap = scoreSalience(args, mergedRefs, snapshot.feedback, retrieval.retrievalCounts, persist);
     // Rank by salience; a ref skipped as a no-op repeatedly sorts lower (its stored rank is untouched).
     const noOps = new Map();
     withRunState(eventsCtx, persist, (db) => {
@@ -727,7 +701,7 @@ async function selectLoopCandidates(args, postCleanupRefs, validationFailureRefs
             noOps.set(r.ref, getAssetSalience(db, keyOf(r))?.consecutive_no_ops ?? 0);
     });
     const effectiveScore = (ref) => {
-        const rank = scored.salienceMap.get(ref)?.rankScore ?? 0;
+        const rank = salienceMap.get(ref)?.rankScore ?? 0;
         return (noOps.get(ref) ?? 0) >= SALIENCE_NO_OP_DAMPEN_THRESHOLD ? rank * SALIENCE_NO_OP_DAMPEN_FACTOR : rank;
     };
     const sorted = [...mergedRefs].sort((a, b) => effectiveScore(b.ref) - effectiveScore(a.ref) || (a.ref < b.ref ? -1 : a.ref > b.ref ? 1 : 0));
@@ -907,8 +881,7 @@ function selectHighSalienceLane(options, improveProfile, eventsCtx, candidates,
 /**
  * Score the merged refs: update `asset_outcome` (projected on a plan-only
  * run), compute each salience vector (keeping a stored content-derived
- * encoding score), then persist and compare the stash-wide ranking. A ref that
- * falls from the top 200 to below 500 becomes a forgetting-safety candidate.
+ * encoding score), then persist it.
  */
 function scoreSalience(args, mergedRefs, feedback, retrievalCounts, persist) {
     const { options, eventsCtx } = args;
@@ -950,58 +923,13 @@ function scoreSalience(args, mergedRefs, feedback, retrievalCounts, persist) {
             outcomeWeightEnabled,
         }));
     }
-    const refByKey = new Map(mergedRefs.map((r) => [keyOf(r), r.ref]));
-    const pendingForgettingRefs = withRunState(eventsCtx, persist, (db) => {
-        // Positions are stash-wide: every stored row of this source, with this
-        // run's scores overlaid under the same keys.
-        const before = new Map();
-        for (const [ref, score] of getAllRankScores(db)) {
-            const boundary = ref.indexOf("//");
-            if (options.sourceName && (boundary >= 0 ? ref.slice(0, boundary) : undefined) !== options.sourceName)
-                continue;
-            before.set(ref, score);
-        }
-        let forgetting = [];
-        if (before.size > 0) {
-            const after = new Map(before);
-            for (const r of mergedRefs)
-                after.set(keyOf(r), salienceMap.get(r.ref)?.rankScore ?? 0);
-            const report = buildRankChangeReport(toRankPositions(before), toRankPositions(after));
-            if (report.forgettingCandidates.length > 0) {
-                const drops = report.forgettingCandidates
-                    .slice(0, 5)
-                    .map((e) => `${e.ref} (#${e.oldRank}→#${e.newRank})`)
-                    .join(", ");
-                warn(`[improve/salience] WS-1 rank-change report: ${report.forgettingCandidates.length} asset(s) fell from top-200 to below position 500. Top drops: ${drops}`);
-                forgetting = report.forgettingCandidates.map((e) => refByKey.get(e.ref) ?? e.ref);
-            }
-            if (persist) {
-                appendEvent({
-                    eventType: "improve_salience_rank_change",
-                    ref: undefined,
-                    metadata: {
-                        stashSize: before.size,
-                        totalChanged: report.allChanges.length,
-                        forgettingCandidates: report.forgettingCandidates.length,
-                        topDrops: report.forgettingCandidates
-                            .slice(0, 10)
-                            .map((e) => ({ ref: e.ref, oldRank: e.oldRank, newRank: e.newRank })),
-                    },
-                }, eventsCtx);
-            }
-        }
-        if (persist) {
+    if (persist) {
+        withRunState(eventsCtx, persist, (db) => {
             for (const r of mergedRefs)
                 upsertAssetSalience(db, keyOf(r), salienceMap.get(r.ref), now);
-        }
-        return forgetting;
-    }) ?? [];
-    return { salienceMap, pendingForgettingRefs };
-}
-/** 1-indexed positions by score desc (ref asc on ties). */
-function toRankPositions(scores) {
-    const sorted = [...scores.entries()].sort(([refA, a], [refB, b]) => b !== a ? b - a : refA < refB ? -1 : refA > refB ? 1 : 0);
-    return new Map(sorted.map(([ref], i) => [ref, i + 1]));
+        });
+    }
+    return salienceMap;
 }
 /**
  * Update each ref's outcome row and return its outcome salience, normalized
@@ -1086,49 +1014,6 @@ function updateOutcomeScores(args) {
     });
     return out;
 }
-/**
- * Forgetting safety: inject this plan's own candidates that fell out of the
- * top ranks, past the signal gate (never for a ref scope or with
- * `--require-feedback-signal`). Attribution afterwards: high-salience <
- * proactive < forgetting-safety < signal-delta.
- */
-export function applyForgettingSafety(args) {
-    const { eligibilitySourceByRef } = args;
-    let mergedRefs = args.mergedRefs;
-    if (args.pendingForgettingRefs.length === 0 || args.scope.mode === "ref" || !args.allowFallbacks)
-        return mergedRefs;
-    const present = new Set(mergedRefs.map((r) => r.ref));
-    const byRef = new Map(args.eligibleRefs.map((c) => [c.ref, c]));
-    const byItemRef = new Map(args.eligibleRefs.flatMap((c) => (c.itemRef ? [[c.itemRef, c]] : [])));
-    const added = [];
-    const forgetting = new Set();
-    for (const stored of args.pendingForgettingRefs) {
-        // A qualified spelling must match this plan's exact item_ref.
-        const candidate = byItemRef.get(stored) ?? (stored.includes("//") ? undefined : byRef.get(stripBundle(stored)));
-        if (!candidate || forgetting.has(candidate.ref))
-            continue;
-        forgetting.add(candidate.ref);
-        if (!present.has(candidate.ref)) {
-            added.push(candidate);
-            present.add(candidate.ref);
-        }
-    }
-    if (added.length > 0)
-        mergedRefs = dedupeRefs([...mergedRefs, ...added]);
-    if (forgetting.size === 0)
-        return mergedRefs;
-    for (const r of args.highSalienceRefs)
-        eligibilitySourceByRef.set(r.ref, "high-salience");
-    for (const r of args.proactiveRefs)
-        eligibilitySourceByRef.set(r.ref, "proactive");
-    for (const ref of forgetting)
-        eligibilitySourceByRef.set(ref, "forgetting-safety");
-    for (const r of args.signalFiltered)
-        eligibilitySourceByRef.set(r.ref, "signal-delta");
-    for (const r of mergedRefs)
-        r.eligibilitySource = eligibilitySourceByRef.get(r.ref) ?? "unknown";
-    return mergedRefs;
-}
 /** Drop candidates whose file vanished since planning, with one aggregate event. */
 async function dropRefsMissingOnDisk(sorted, options, eventsCtx, persist) {
     const actionableRefs = [];

package/dist/commands/improve/retrieval-scope.js

@@ -7,8 +7,8 @@
  *
  * Fresh feedback and an explicit `--scope <ref>` are usage evidence of their
  * own, so the signal-delta and scope lanes need no check. The fallback lanes
- * (proactive maintenance, high salience, forgetting safety) and consolidation
- * pick assets without such evidence, so they pick only inside this scope.
+ * (proactive maintenance, high salience) and consolidation pick assets
+ * without such evidence, so they pick only inside this scope.
  */
 import fs from "node:fs";
 import { daysToMs } from "../../core/common.js";
@@ -16,7 +16,7 @@ import { warn } from "../../core/warn.js";
 import { listUsedEntryRefs, USAGE_EVENT_RETENTION_DAYS } from "../../indexer/usage/usage-events.js";
 import { listImproveLedgerRows } from "../../storage/repositories/improve-ledger-repository.js";
 import { listProposalRefSources } from "../../storage/repositories/proposals-repository.js";
-import { readLedgerDb, stripBundle } from "./ledger.js";
+import { PAIR_PASS_LEDGER_SOURCE, readLedgerDb, stripBundle } from "./ledger.js";
 /**
  * Ledger and proposal sources that bring material in. Every other source is an
  * improve stage reworking an asset (reflect, distill, consolidate, schema repair).
@@ -43,7 +43,22 @@ export function loadRetrievalScope(access, stashDir) {
             }
             if (!stashDir)
                 return;
-            for (const row of [...listImproveLedgerRows(db, stashDir), ...listProposalRefSources(db, stashDir)]) {
+            // Blocker 1 (second review round): a pair-pass ledger row must NOT mark
+            // an asset "processed" — unlike every other stage, the pair pass judges
+            // material against its NEIGHBOURS, not on its own merits, so its own
+            // attempt is not usage evidence the fallback lanes (proactive,
+            // high-salience) or promotion retries should be starved by. Left in
+            // the ledger for the pair pass's OWN eligibility
+            // (selectInitiators reads content_hash directly, never this scope).
+            // Proposal rows are untouched: a MINTED retire proposal is real
+            // evidence something happened to the asset.
+            for (const row of listImproveLedgerRows(db, stashDir)) {
+                if (row.source === PAIR_PASS_LEDGER_SOURCE)
+                    continue;
+                if (!CAPTURE_SOURCES.has(row.source))
+                    processed.add(stripBundle(row.ref));
+            }
+            for (const row of listProposalRefSources(db, stashDir)) {
                 if (!CAPTURE_SOURCES.has(row.source))
                     processed.add(stripBundle(row.ref));
             }

package/dist/commands/improve/salience.js

@@ -62,7 +62,7 @@ export function computeSalience(inputs) {
     const rankScore = clamp01((we * encoding + wo * outcome + wr * retrieval) * sizePenalty);
     return { encoding, outcome, retrieval, rankScore, encodingSource };
 }
-export { getAllRankScores, getAssetSalience, getConsecutiveNoOps, recordNoOp, resetConsecutiveNoOps, upsertAssetSalience, } from "../../storage/repositories/salience-repository.js";
+export { getAssetSalience, getConsecutiveNoOps, recordNoOp, resetConsecutiveNoOps, upsertAssetSalience, } from "../../storage/repositories/salience-repository.js";
 /** Whether a stored row's encoding salience is content-derived (unknown provenance is not). */
 export function isContentEncodingRow(row) {
     return row.encoding_source === "content";
@@ -73,19 +73,6 @@ export function isContentEncodingRow(row) {
  */
 export const SALIENCE_NO_OP_DAMPEN_THRESHOLD = 3;
 export const SALIENCE_NO_OP_DAMPEN_FACTOR = 0.5;
-/** Forgetting safety: compare 1-indexed rank positions between two rankings. */
-export function buildRankChangeReport(oldRanks, newRanks, oldTopN = 200, forgettingThreshold = 500) {
-    const allChanges = [];
-    for (const [ref, oldRank] of oldRanks) {
-        const newRank = newRanks.get(ref);
-        if (newRank !== undefined)
-            allChanges.push({ ref, oldRank, newRank, rankDelta: newRank - oldRank });
-    }
-    const forgettingCandidates = allChanges
-        .filter((c) => c.oldRank <= oldTopN && c.newRank > forgettingThreshold)
-        .sort((a, b) => b.rankDelta - a.rankDelta);
-    return { forgettingCandidates, allChanges };
-}
 /** `ref → last retrieval (ms)` from the index's utility scores; absent means never retrieved. */
 export function getLastUseMsByRef(indexDb, candidates) {
     const result = new Map();