akm-cli 0.9.17-alpha.9 → 0.9.18

package/dist/cli/unknown-flags.js

@@ -26,8 +26,17 @@
  * validation) — conservative by design.
  */
 import { UsageError } from "../core/errors.js";
+import { warn } from "../core/warn.js";
 import { cittyComparableName, findCittyTopLevelCommandIndex, toAliasArray, } from "./invocation.js";
 import { retiredFlagHint } from "./retired-commands.js";
+/**
+ * Commands that must never refuse on an unrecognized flag — `akm info` warns
+ * and continues instead of exiting 2, the same tolerance a bare `akm help
+ * --whatever` already gets for free from its group-command fallback (no
+ * resolved subcommand, so this gate stands down entirely). `info` is a leaf
+ * command, so it needs an explicit opt-in here instead.
+ */
+const UNKNOWN_FLAG_TOLERANT_COMMANDS = new Set(["info"]);
 /** Flags citty implements itself, which no command declares. */
 const IMPLICIT_FLAGS = ["help", "h", "version", "v"];
 /**
@@ -172,6 +181,10 @@ function throwUnknownFlag(shown, attempted, known) {
         ? `Did you mean \`${suggestion}\`? Run the command with \`--help\` to see its accepted flags.`
         : undefined);
 }
+/** The {@link UNKNOWN_FLAG_TOLERANT_COMMANDS} counterpart to {@link throwUnknownFlag}: report, don't refuse. */
+function warnUnknownFlag(shown, known) {
+    warn(`[akm ${known.path.join(" ")}] ignoring unknown flag "${shown}" — run with --help to see its accepted flags.`);
+}
 /**
  * Throw a {@link UsageError} naming the first flag the resolved command does
  * not declare. Returns silently when every flag is known.
@@ -195,6 +208,7 @@ export function assertKnownFlags(root, rawArgs) {
     const dynamicNamedFlagCommands = new Set(["workflow run", "task run", "task explain"]);
     const dynamicWorkflowParams = dynamicNamedFlagCommands.has(known.path.join(" "));
     const selfDiagnosed = SELF_DIAGNOSED_FLAGS.get(known.path.join(" "));
+    const tolerant = UNKNOWN_FLAG_TOLERANT_COMMANDS.has(known.path.join(" "));
     for (let i = 0; i < ownArgs.length; i += 1) {
         const token = ownArgs[i];
         // Not a flag: positional, a bare `-` (stdin), or a negative number.
@@ -209,8 +223,13 @@ export function assertKnownFlags(root, rawArgs) {
             for (let offset = 0; offset < shortFlags.length; offset += 1) {
                 const rawName = shortFlags[offset];
                 const candidate = cittyComparableName(rawName);
-                if (!known.names.has(candidate))
+                if (!known.names.has(candidate)) {
+                    if (tolerant) {
+                        warnUnknownFlag(token, known);
+                        break;
+                    }
                     throwUnknownFlag(token, `-${rawName}`, known);
+                }
                 if (known.valueFlags.has(candidate)) {
                     if (offset === shortFlags.length - 1)
                         i += 1;
@@ -239,6 +258,10 @@ export function assertKnownFlags(root, rawArgs) {
             // frozen plan before a run is inserted. Short flags remain strict.
             if (dynamicWorkflowParams)
                 continue;
+            if (tolerant) {
+                warnUnknownFlag(token.split("=")[0], known);
+                continue;
+            }
             throwUnknownFlag(token.split("=")[0], `--${rawName}`, known);
         }
         // Skip a declared value flag's value so `--reason "--x"` is not scanned.

package/dist/cli.js

@@ -645,6 +645,24 @@ export function shouldBypassConfigStartup(argv) {
     const subcommand = args.slice(configIndex + 1).find((arg) => !arg.startsWith("-"));
     return subcommand === "path";
 }
+/**
+ * Whether `argv` resolves to the top-level `info` command — used by
+ * `runCli` (and mirrored in `tests/_helpers/cli.ts`) to scope the startup
+ * config read's best-effort fallback to `info` alone. `info` is NOT on
+ * {@link shouldBypassConfigStartup}'s allowlist: unlike a bare bypass, it
+ * still reads a valid config's `output.format`/`output.detail` like any
+ * other command, it just must not be aborted by one it cannot read (see
+ * `assembleInfo`'s doc comment, src/commands/sources/info.ts, for why).
+ * Every other command reads config exactly as before — a broken config
+ * throws here and the command never runs.
+ */
+export function isInfoCommand(argv) {
+    const userArgs = argv.slice(2);
+    const separator = userArgs.indexOf("--");
+    const args = separator === -1 ? userArgs : userArgs.slice(0, separator);
+    const commandIndex = findCittyTopLevelCommandIndex(args, MAIN_TOP_LEVEL_ARGS);
+    return (commandIndex >= 0 ? args[commandIndex] : undefined) === "info";
+}
 // ── Exit codes ──────────────────────────────────────────────────────────────
 // Canonical table lives in `src/cli/shared.ts` (EXIT_CODES). These aliases keep
 // the local call sites terse. EXIT_HEALTH_WARN (4) is the `akm health` "warn"
@@ -968,7 +986,34 @@ async function runCli() {
     try {
         applyEarlyStderrFlags(process.argv);
         const bypassConfig = shouldBypassConfigStartup(process.argv);
-        initOutputMode(process.argv, bypassConfig ? (DEFAULT_CONFIG.output ?? {}) : (loadConfig().output ?? {}));
+        // Off the bypass allowlist, every command reads config here exactly as
+        // it always has: an invalid config.json throws, `emitJsonError` reports
+        // it, and the command never runs — no side effect of its own body ever
+        // happens (a lock taken, a network call made, a database opened
+        // read-write). `akm info` is the ONE exception (see `assembleInfo`'s
+        // doc comment, src/commands/sources/info.ts): only ITS read is
+        // best-effort, falling back to `DEFAULT_CONFIG.output` instead of
+        // throwing. Scoped narrowly on purpose — an earlier version of this fix
+        // made the read best-effort for every command, which silently changed
+        // outcomes across the CLI (some commands that should refuse at exit 78
+        // ran anyway; `health`/`index`/`config set`/`feedback` still failed,
+        // but only after already taking a lock, opening a database read-write,
+        // or making a network call).
+        let outputDefaults = DEFAULT_CONFIG.output ?? {};
+        if (!bypassConfig) {
+            if (isInfoCommand(process.argv)) {
+                try {
+                    outputDefaults = loadConfig().output ?? {};
+                }
+                catch {
+                    outputDefaults = DEFAULT_CONFIG.output ?? {};
+                }
+            }
+            else {
+                outputDefaults = loadConfig().output ?? {};
+            }
+        }
+        initOutputMode(process.argv, outputDefaults);
     }
     catch (error) {
         emitJsonError(error);

package/dist/commands/health/archive-usage.js

@@ -25,7 +25,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { MEMORY_ARCHIVE_REL } from "../../core/asset/memory-archive.js";
 import { toPosix } from "../../core/common.js";
-import { isGitBackedStash, tryListGitChangedPaths, tryListGitTrackedPaths, tryListGitUnverifiablePaths, } from "../../sources/providers/git-stash.js";
+import { checkGitPathSafety, isGitBackedStash } from "../../sources/providers/git-stash.js";
 import { MAX_WALK_ENTRIES, sizeOfPath } from "./data-dir-usage.js";
 /**
  * Build the `memory-cleanup-archive` advisory, or `undefined` when there is
@@ -52,23 +52,17 @@ export function collectArchiveUsageAdvisory(stashDir) {
     }
     // Git-backed: the SAME three checks purgeGracedArchive runs (B1, G10) —
     // computed once here, not per file, and reused via `onFile` below instead
-    // of a second walk of the same tree.
-    const dirtyQuery = tryListGitChangedPaths(stashDir);
-    const trackedQuery = tryListGitTrackedPaths(stashDir, MEMORY_ARCHIVE_REL);
-    const unverifiableQuery = tryListGitUnverifiablePaths(stashDir, MEMORY_ARCHIVE_REL);
-    // A failed git check here fails the same way purgeGracedArchive's own
-    // sweep would: nothing in the archive can be proven purgeable, so every
-    // byte counts as unpurgeable rather than guessing.
-    const gitStateKnown = dirtyQuery.ok && trackedQuery.ok && unverifiableQuery.ok;
-    const dirty = new Set(dirtyQuery.paths);
-    const tracked = new Set(trackedQuery.paths);
-    const unverifiable = new Set(unverifiableQuery.paths);
+    // of a second walk of the same tree. A failed git check here fails the
+    // same way purgeGracedArchive's own sweep would: nothing in the archive
+    // can be proven purgeable, so every byte counts as unpurgeable rather
+    // than guessing (`checkGitPathSafety`'s `isSafe` is always `false` when
+    // `ok` is `false`).
+    const gitSafety = checkGitPathSafety(stashDir, MEMORY_ARCHIVE_REL);
     let unpurgeableFiles = 0;
     let unpurgeableBytes = 0;
     const usage = sizeOfPath(archiveRoot, { remaining: MAX_WALK_ENTRIES }, (filePath, bytes) => {
         const key = toPosix(path.relative(stashDir, filePath));
-        const safe = gitStateKnown && tracked.has(key) && !dirty.has(key) && !unverifiable.has(key);
-        if (!safe) {
+        if (!gitSafety.isSafe(key)) {
             unpurgeableFiles++;
             unpurgeableBytes += bytes;
         }
@@ -92,7 +86,7 @@ export function collectArchiveUsageAdvisory(stashDir) {
             truncated: usage.truncated,
             unpurgeableFiles,
             unpurgeableBytes,
-            gitStateKnown,
+            gitStateKnown: gitSafety.ok,
         },
     };
 }

package/dist/commands/health/checks.js

@@ -888,7 +888,7 @@ export const HEALTH_CHECKS = [
         // R0: nothing looked at state.db's own SQLite-level integrity before
         // this — the round-trip probe above only proves one row can be appended
         // and read back, which stays true on a database that fails
-        // `PRAGMA quick_check` elsewhere (corrupt indexes, out-of-order rowids).
+        // `PRAGMA integrity_check` elsewhere (corrupt indexes, out-of-order rowids).
         // Also reports the freelist ratio (fraction of pages VACUUM could
         // reclaim) so a bloated-but-uncorrupted file is visible as a warning
         // rather than silence.
@@ -904,8 +904,8 @@ export const HEALTH_CHECKS = [
                     kind: "deterministic",
                     status: "fail",
                     confidence: "high",
-                    message: `state.db failed PRAGMA quick_check: ${detail}. Repair: back up state.db, then run ` +
-                        `sqlite3 state.db ".recover" | sqlite3 state.new.db, verify state.new.db passes quick_check, stop ` +
+                    message: `state.db failed PRAGMA integrity_check: ${detail}. Repair: back up state.db, then run ` +
+                        `sqlite3 -readonly state.db ".recover" | sqlite3 state.new.db, verify state.new.db passes integrity_check, stop ` +
                         "every akm process, then delete state.db-wal and state.db-shm before swapping state.new.db in as " +
                         "state.db — a leftover WAL from the OLD database is replayed onto the new one and corrupts it.",
                     evidence: { path: ctx.stateDbPath, lines, freelistRatio },
@@ -917,7 +917,7 @@ export const HEALTH_CHECKS = [
                     kind: "deterministic",
                     status: "fail",
                     confidence: "high",
-                    message: `state.db passed PRAGMA quick_check, but reading its freelist/page-count failed: ${freelistError}.`,
+                    message: `state.db passed PRAGMA integrity_check, but reading its freelist/page-count failed: ${freelistError}.`,
                     evidence: { path: ctx.stateDbPath, lines, freelistError },
                 };
             }
@@ -928,8 +928,8 @@ export const HEALTH_CHECKS = [
                 status: freelistWarn ? "warn" : "pass",
                 confidence: "high",
                 message: freelistWarn
-                    ? `state.db passed PRAGMA quick_check, but ${(freelistRatio * 100).toFixed(1)}% of its pages are free (reclaimable by VACUUM).`
-                    : "state.db passed PRAGMA quick_check.",
+                    ? `state.db passed PRAGMA integrity_check, but ${(freelistRatio * 100).toFixed(1)}% of its pages are free (reclaimable by VACUUM).`
+                    : "state.db passed PRAGMA integrity_check.",
                 evidence: {
                     path: ctx.stateDbPath,
                     freelistCount: ctx.stateDbFreelist.freelistCount,

package/dist/commands/health/improve-metrics.js

@@ -53,6 +53,25 @@ export function countAgentFailureReasons(agentFailures) {
     }
     return counts;
 }
+/**
+ * Decode one `improve_runs.result_json` envelope, warning once per row on
+ * failure (mirrors {@link taskFailureDetail}'s handling of the analogous
+ * `task_history` case) and returning `undefined` instead of throwing.
+ * Callers count the `undefined` case themselves (`resultRows.skipped.invalid`
+ * / `resultStatus: "invalid"`) so a decode failure is never silent — the
+ * warning names *why* (corrupt data, or a decoder too strict for a shape an
+ * older release legitimately wrote), the counters say *how many*.
+ */
+function decodeImproveResultRow(row) {
+    try {
+        return decodeImproveResult(row.result_json).envelope;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        console.warn(`[akm] Skipping unparseable improve_runs row in health metrics (id=${row.id}, started_at=${row.started_at}): ${message}`);
+        return undefined;
+    }
+}
 /** A zeroed accumulator — also what health reports when it could not read state.db at all (#791). */
 export function emptyImproveMetrics() {
     return {
@@ -273,11 +292,8 @@ export function summarizeImproveRuns(db, since, until) {
     // newest complete run's snapshot (current state) — not a sum across runs.
     let latest;
     for (const row of rows) {
-        let result;
-        try {
-            result = decodeImproveResult(row.result_json).envelope;
-        }
-        catch {
+        const result = decodeImproveResultRow(row);
+        if (!result) {
             resultRows.skipped.invalid += 1;
             continue;
         }
@@ -298,13 +314,10 @@ export function summarizeImproveRuns(db, since, until) {
 }
 /** Project an improve_runs row + wall time + task attribution into one {@link ImproveRunSummary}. */
 export function projectImproveRunSummary(row, wallTimeMs, taskId) {
-    let result = {};
-    let resultStatus = "invalid";
-    try {
-        result = decodeImproveResult(row.result_json).envelope;
-        resultStatus = "valid";
-    }
-    catch {
+    const decoded = decodeImproveResultRow(row);
+    const result = decoded ?? {};
+    const resultStatus = decoded ? "valid" : "invalid";
+    if (!decoded) {
         // Keep the persisted row visible in per-run output, but do not project its
         // unknown payload or admit its duration to result-derived denominators.
         wallTimeMs = 0;

package/dist/commands/health.js

@@ -17,7 +17,7 @@ import { countImproveRunsSince } from "../storage/repositories/improve-runs-repo
 import { closeDatabase, openReadonlyExistingDatabase } from "../storage/repositories/index-connection.js";
 import { getAllEntries } from "../storage/repositories/index-entries-repository.js";
 import { queryTaskHistory } from "../storage/repositories/task-history-repository.js";
-import { getStateDbFreelistInfo, runStateDbQuickCheck } from "../storage/state-db-integrity.js";
+import { getStateDbFreelistInfo, runStateDbIntegrityCheck } from "../storage/state-db-integrity.js";
 import { pkgVersion } from "../version.js";
 import { collectArchiveUsageAdvisory } from "./health/archive-usage.js";
 import { HEALTH_CHECKS, probeActiveImproveStrategy, runHealthEngineProbes, runPendingStateMigrationsCheck, SESSION_EXTRACTION_LEDGER_WINDOW_DAYS, } from "./health/checks.js";
@@ -182,10 +182,10 @@ function gatherTaskHistoryPhase(db, since, stateDbPath, now) {
     const requiredTables = ["events", "proposals", "schema_migrations", "task_history"];
     const missingTables = requiredTables.filter((name) => !tableNames.includes(name));
     const probe = probeStateDbRoundTrip(stateDbPath);
-    // R0: read-only, independent of the round-trip probe above — quick_check
+    // R0: read-only, independent of the round-trip probe above — integrity_check
     // catches corruption a successful append/read cannot (out-of-order rowids,
     // bad index entry counts), and the freelist reading is purely informational.
-    const stateDbIntegrity = runStateDbQuickCheck(stateDbPath);
+    const stateDbIntegrity = runStateDbIntegrityCheck(stateDbPath);
     const stateDbFreelist = getStateDbFreelistInfo(stateDbPath);
     // D8 (spec §5.3): a marked "command" row or a legacy (unmarked) "prompt"
     // row is the agent/LLM arm; an unmarked "command" row is the legacy

package/dist/commands/improve/consolidate/pair-pass.js

@@ -635,7 +635,7 @@ seams = {}) {
     // also be judged as part of another until that decision resolves.
     const pendingRetireRefs = new Set();
     try {
-        for (const p of listProposalsReadOnly(stashDir, { status: "pending" })) {
+        for (const p of listProposalsReadOnly(stashDir, { status: "pending" }, opts.proposalsCtx)) {
             if (!isRetireProposal(p))
                 continue;
             pendingRetireRefs.add(stripBundle(p.ref));
@@ -657,7 +657,7 @@ seams = {}) {
     const rejectedPairKeys = new Set();
     try {
         for (const status of ["rejected", "reverted"]) {
-            for (const p of listProposalsReadOnly(stashDir, { status, includeArchive: true })) {
+            for (const p of listProposalsReadOnly(stashDir, { status, includeArchive: true }, opts.proposalsCtx)) {
                 if (!isRetireProposal(p) || !p.retirement)
                     continue;
                 rejectedPairKeys.add(rejectedPairKey(p.retirement.retiredRef, p.retirement.successorRef, p.retirement.retiredContentHash, p.retirement.successorContentHash));

package/dist/commands/improve/consolidate.js

@@ -222,10 +222,10 @@ function injectRandomClusterMembers(memories, profile, warnings) {
     return out;
 }
 /** Body hashes of pending consolidate proposals, so the prompt can mark memories already queued. */
-function loadPendingConsolidateProposalHashes(stashDir) {
+function loadPendingConsolidateProposalHashes(stashDir, proposalsCtx) {
     const hashes = new Set();
     try {
-        for (const p of listProposalsReadOnly(stashDir, { status: "pending" })) {
+        for (const p of listProposalsReadOnly(stashDir, { status: "pending" }, proposalsCtx)) {
             if (p.source !== "consolidate")
                 continue;
             try {
@@ -622,7 +622,7 @@ async function planConsolidation(opts, config, stashDir, memories, warnings, sta
         assertRunnerCredentials(llmRunner);
     const { ordered, embedTelemetry } = await clusterMemoriesBySimilarity(budgeted, config, stateDb, opts.signal);
     const chunks = slice(injectRandomClusterMembers(ordered, opts.improveProfile, warnings));
-    const pendingProposalBodyHashes = loadPendingConsolidateProposalHashes(stashDir);
+    const pendingProposalBodyHashes = loadPendingConsolidateProposalHashes(stashDir, opts.proposalsCtx);
     warn(`[consolidate] ${budgeted.length} memories / ${chunks.length} chunk(s) / chunk_size=${chunkSize}` +
         ` / pending-proposal hashes: ${pendingProposalBodyHashes.size}`);
     const planned = await judgeConsolidationChunks({

package/dist/commands/improve/distill.js

@@ -799,7 +799,7 @@ function readDistillFeedback(run) {
 }
 /** System + user prompt: rejected-proposal context, optional CLS neighbours, stash standards. */
 async function buildDistillMessages(run, feedback, kind, outputRef) {
-    const rejectedProposals = rejectedProposalContext(run.stash, run.inputRef, run.options.ctx);
+    const rejectedProposals = rejectedProposalContext(run.stash, run.inputRef, run.options.ctx, run.options.eventsCtx);
     // CLS interleaving (default off): show related lessons so the model does not overwrite them.
     const cls = getImproveProcessConfig("distill", run.profile)?.cls ?? {};
     let clsContext = "";

package/dist/commands/improve/memory/memory-improve.js

@@ -12,7 +12,7 @@ import { DERIVED_SUFFIX } from "../../../core/recognition-util.js";
 import { warn } from "../../../core/warn.js";
 import { recordWrittenPath } from "../../../core/write-provenance.js";
 import { walkMarkdownFiles } from "../../../indexer/walk/walker.js";
-import { isGitBackedStash, tryListGitChangedPaths, tryListGitTrackedPaths, tryListGitUnverifiablePaths, } from "../../../sources/providers/git-stash.js";
+import { checkGitPathSafety, isGitBackedStash } from "../../../sources/providers/git-stash.js";
 import { contentHash } from "../content-hash.js";
 import { isDerivedMemory, memoryIdentityRef, parseMemoryName, resolveParentRef } from "./derived-ref.js";
 export function analyzeMemoryCleanup(stashDir, options = {}) {
@@ -665,20 +665,16 @@ export function purgeGracedArchive(stashDir, now = new Date()) {
     // sweep rather than silently trusting whichever check happened to
     // succeed — a `dirty`/`unverifiable` set that came back empty ONLY
     // because the call failed must never read as "nothing to protect".
-    const dirtyQuery = tryListGitChangedPaths(stashDir);
-    const trackedQuery = tryListGitTrackedPaths(stashDir, MEMORY_ARCHIVE_REL);
-    const unverifiableQuery = tryListGitUnverifiablePaths(stashDir, MEMORY_ARCHIVE_REL);
-    if (!dirtyQuery.ok || !trackedQuery.ok || !unverifiableQuery.ok) {
+    // G10: assume-unchanged / skip-worktree files never show up as dirty even
+    // when genuinely modified — `checkGitPathSafety` treats them the same as
+    // "not tracked" below, so such a file (and its whole retirement) is left
+    // for a later sweep.
+    const gitSafety = checkGitPathSafety(stashDir, MEMORY_ARCHIVE_REL);
+    if (!gitSafety.ok) {
         warn(`[improve] archive purge: skipped this sweep — could not determine the archive's git state at ${stashDir} ` +
             "(git status/ls-files failed); nothing was purged.");
         return EMPTY_ARCHIVE_PURGE_RESULT;
     }
-    const dirty = new Set(dirtyQuery.paths);
-    const tracked = new Set(trackedQuery.paths);
-    // G10: assume-unchanged / skip-worktree files never show up as dirty even
-    // when genuinely modified — treated the same as "not tracked" below, so
-    // such a file (and its whole retirement) is left for a later sweep.
-    const unverifiable = new Set(unverifiableQuery.paths);
     let purgedDirs = 0;
     let purgedFiles = 0;
     for (const entry of entries) {
@@ -705,10 +701,7 @@ export function purgeGracedArchive(stashDir, now = new Date()) {
         if (!Number.isFinite(retiredMs) || retiredMs >= cutoffMs)
             continue; // "more than" the grace period — exactly at it is not enough
         const allFiles = listFilesRecursive(dir); // tombstone included — the whole entry must be a clean, committed unit
-        const isSafeToPurge = allFiles.every((filePath) => {
-            const key = toPosix(path.relative(stashDir, filePath));
-            return tracked.has(key) && !dirty.has(key) && !unverifiable.has(key);
-        });
+        const isSafeToPurge = allFiles.every((filePath) => gitSafety.isSafe(toPosix(path.relative(stashDir, filePath))));
         if (!isSafeToPurge)
             continue; // untracked, modified, or unverifiable entry — skip the whole directory this sweep (B1, G10)
         let children;

package/dist/commands/improve/preparation.js

@@ -209,6 +209,8 @@ async function runConsolidationPass(args) {
             maxChunkSize: processConfig?.maxChunkSize,
             signal: args.budgetSignal,
             p90ChunkSecondsDefault: processConfig?.p90ChunkSecondsDefault,
+            // Its read-only proposal lookups go through the run's own state.db handle.
+            ...(eventsCtx?.db ? { proposalsCtx: { db: eventsCtx.db } } : {}),
         }));
     }
     return { consolidation, plan: planned.plan };

package/dist/commands/improve/reflect.js

@@ -761,7 +761,7 @@ async function gatherReflectPromptSources(options, stash, parsedRef, assetConten
         relatedLessons: options.ref && parsedRef
             ? await readRelatedLessons(stash, options.ref, parsedRef, options.itemRef, options.eventsCtx)
             : [],
-        rejectedProposals: rejectedProposalContext(stash, options.ref, options.ctx),
+        rejectedProposals: rejectedProposalContext(stash, options.ref, options.ctx, options.eventsCtx),
         standardsContext: resolveStandardsContext(options.ref, stash),
     };
 }

package/dist/commands/improve/stage.js

@@ -100,12 +100,14 @@ export const MAX_REJECTED_PROPOSALS = 3;
 /**
  * Reflexion context: the newest reviewer rejections for `ref`. Procedural
  * refusals (expiry, stale target, missing asset) are not judgements on the
- * content and are left out. Reads never create state.db.
+ * content and are left out. Reads never create state.db, and an improve run's
+ * live connection (`eventsCtx.db`) is read through, not copied.
  */
-export function rejectedProposalContext(stash, ref, ctx) {
+export function rejectedProposalContext(stash, ref, ctx, eventsCtx) {
     if (!ref)
         return [];
-    return listProposalsReadOnly(stash, { ref, status: "rejected", includeArchive: true }, ctx)
+    const proposalsCtx = eventsCtx?.db ? { ...ctx, db: eventsCtx.db } : ctx;
+    return listProposalsReadOnly(stash, { ref, status: "rejected", includeArchive: true }, proposalsCtx)
         .filter((p) => !isProceduralRejection(p))
         .sort((a, b) => new Date(b.updatedAt ?? 0).getTime() - new Date(a.updatedAt ?? 0).getTime())
         .slice(0, MAX_REJECTED_PROPOSALS)

package/dist/commands/proposal/repository.js

@@ -373,9 +373,13 @@ export function listProposals(stashDir, options = {}, ctx) {
 /**
  * {@link listProposals} on a read snapshot that never creates or migrates
  * state.db: prompt building runs before the first dispatch has validated its
- * credentials, and a missing store is simply empty.
+ * credentials, and a missing store is simply empty. A caller that already
+ * holds a live connection (`ctx.db`) reads through it: a snapshot would copy
+ * the whole database for nothing.
  */
 export function listProposalsReadOnly(stashDir, options = {}, ctx) {
+    if (ctx?.db)
+        return queryProposals(ctx.db, stashDir, options);
     const dbPath = ctx?.dbPath ?? getStateDbPath();
     if (!fs.existsSync(dbPath))
         return [];