akm-cli 0.9.17 → 0.9.19-alpha.1

package/CHANGELOG.md

@@ -6,6 +6,163 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.9.19-alpha.1] - 2026-09-30
+
+### Added
+
+- **`akm proposal reopen <id...> [--reason <text>]` (#997).** A rejection was
+  final: nothing undid it, and a rejected `consolidate-pair` retire proposal
+  also kept the pair pass from ever proposing that retirement again while both
+  documents were unchanged. Reopen moves rejected proposals back to `pending`,
+  keeping the rejection (and the gate verdict that came with it) in the
+  proposal's new `reviewHistory`, which `proposal show` prints; the verdict
+  itself is cleared so the drain sees the proposal as undecided, except a
+  `deferred` one (the quality gate's hand-off to a person), which stays. It is
+  refused unless the proposal is `rejected` and `accept` would not refuse it as
+  stale (an update's target unchanged; a create's target still absent; a retire
+  proposal's successor present and both documents' body hashes as recorded),
+  and a retire proposal is refused while another pending retire proposal
+  involves either of its documents. Several ids are all-or-nothing. The pair pass
+  follows the status: a reopened proposal is no longer a settled pair and,
+  pending, is not minted twice. Its `improve_ledger` row is reset (a retire
+  proposal's rejection row is dropped, any other goes back to `proposed`), the
+  age that retention expiry and `--older-than` (bulk accept/reject, `drain`)
+  see restarts at the reopen, so a scheduled sweep does not take a proposal a
+  person just put back, and a `proposal_reopened` event is appended.
+  `akm proposal reject`'s confirmation prompt no longer says a rejection
+  cannot be undone.
+
+### Fixed
+
+- **A tool failure recorded with `akm feedback` no longer becomes a lesson
+  about the error or a `TODO` placeholder in a memory (#999).** Agents
+  recorded `akm show` failing on a memory with a `.derived.md` child (fixed in
+  0.9.17) as negative feedback, and distill and reflect read it as evidence
+  about the memory's content. On one bundle, 9 such events on 8 memories
+  produced 4 distill lessons about "duplicate physical owners" for memories on
+  unrelated subjects (one auto-accepted and live), and a reflect proposal,
+  also auto-accepted, that added a `TODO: verify physical owner` section to a
+  memory, on which a fifth lesson was then built. The shipped hints had told
+  agents to record `--negative` "when it fails"; they, and the help for
+  `akm feedback --reason`, now say a failed akm command is not feedback on the
+  asset. Reflect's feedback caveat no longer offers a `TODO: verify …`
+  placeholder: when feedback asks for information the asset lacks, it says
+  only to leave the section unchanged. The distill quality judge now also
+  scores **grounding**, whether the lesson is about what its source is about
+  (1–2 only for a different subject; a lesson that corrects its source from
+  feedback is not off-subject), and a grounding score of 2 or less is
+  `quality_rejected` (an `improve_ledger` row and a `distill_invoked` event, no
+  proposal) whatever the mean of novelty and non-redundancy is. Such a lesson
+  reads as novel and non-redundant, so it used to pass or, in the review band,
+  be minted as a pending `review_needed` proposal. The judge also reads the
+  same slice of the source the lesson was generated from (its body without
+  frontmatter, first 3000 characters) instead of the raw file's first 2000. A
+  lesson that contradicts its source still reaches a human through the
+  optional fidelity check (`processes.distill.fidelityCheck.enabled`, off by
+  default), and every other `review_needed` reason is unchanged. `TODO:`
+  lines already in a memory are not removed.
+- **Consolidation stops re-proposing memories that `knowledge/` already
+  covers (#998).** The promote pass copied a memory into a new `knowledge/`
+  proposal with no notion of what `knowledge/` already held: the model never
+  sees it, the mint-time checks only caught the same slug or a byte-identical
+  body, and an accepted promotion's memory was eligible again at once (a
+  rejected one after 7 days). On one bundle 88% of a run's proposals came from
+  memories promoted before, one of them 14 times, and 215 of 224 rejections
+  read "covered by an existing knowledge doc". Two changes, no new setting:
+  before queuing a promotion, consolidate now compares the memory with the 20
+  `knowledge/` docs in its bundle nearest to it by stored vector (the lookup
+  the pair pass uses) and skips it, with skip reason
+  `dedup_covered_by_knowledge`, when one of them holds at least half of the
+  memory's distinct 5-word shingles (measured against every knowledge doc,
+  that share was at least 0.5 for 122 of the 224 rejected proposals and for
+  none of the 103 accepted ones; a covering doc past the 20 nearest goes
+  unseen); and a memory whose promotion was accepted or rejected is offered
+  again only when its body changes, the same content-driven rule the pair pass
+  uses, instead of at once or after 7 days. A promotion decided by an older
+  release recorded no body hash and keeps its old windows. With no stored
+  vector (semantic search off) the coverage check does nothing.
+- **`akm improve` no longer files one bundle's assets into another (#1000).**
+  Candidate selection admitted assets from every writable bundle, but every
+  proposal is filed in the run's write target and reflect reads each asset
+  from the bundle that owns it. An asset owned by another bundle therefore
+  came back as a `create` fork in the write target, or as an `update` of the
+  write target's own copy built from the other bundle's copy. A run now plans
+  only the bundle it writes to (`--bundle`, else `defaultWriteTarget`, else
+  the working bundle), and a bare ref scope (`akm improve skills/x`) resolves
+  inside that bundle. Distill's memory-to-knowledge promotion likewise merges
+  only with a doc that already exists in the write target. As a second line of
+  defence, `createProposal` refuses a rewrite whose `itemRef` names an asset
+  owned by a different configured bundle than the queue's. **Narrowed
+  behaviour:** a run no longer picks up assets from your other writable
+  bundles (it used to read them and queue the result in its own write target),
+  so a scheduled `akm improve` now covers only its write target: add one
+  `akm improve --bundle <name>` run per other bundle you want improved.
+  `akm improve <ref>` for an asset that lives only in another bundle now fails
+  with a not-found error whose hint names the remedy (`--bundle team`, or
+  `akm improve team//skills/x`). Proposals the old behaviour already queued
+  stay in the queue; review them with `akm proposal list`. `--bundle`'s help
+  text now says it selects the bundle a run improves and writes to.
+- **`akm improve --dry-run`/`--plan` previews the bundle a live run improves.**
+  With no `--bundle` and no `defaultWriteTarget`, a live run starts from
+  `AKM_BUNDLE_DIR` before `defaultBundle`, but a dry run read `defaultBundle`
+  only, so the two could plan different bundles. The preview now resolves the
+  working bundle the same way.
+- **`akm proposal diff` shows a retire proposal as a retirement (#997).** It
+  rendered the retired file as replaced by one blank line (`----`, a lone `+`,
+  then every other line as a removal, under an `(update: <ref>)` header) and
+  said nothing about the retirement, so one reviewer rejected all 65 of a
+  bundle's `consolidate-pair` proposals as "would destroy content". The diff
+  now lists only the removed lines, under a `(retire: <retired> -> <successor>)`
+  header and `+++ /dev/null (retired: archived; successor <ref>)`, and its JSON
+  result gains `op: "delete"`, a `retirement` block under the keys `proposal
+  show` uses (`retiredRef`, `successorRef`, `judgeLabel`, `judgeReason`,
+  `cosine`, and `continuityRisk` when the pair was flagged, which the text
+  output prints as well) and a `note` that accepting archives the file under
+  `.akm/memory-cleanup/archive/` and `akm proposal revert` restores it
+  byte-exactly. The new fields are additive and appear on retire proposals
+  only. `akm proposal show --detail full` also stops ending a retire proposal
+  with a bare `payload:` heading over nothing.
+- **Errors name the flag the command takes, not the retired `--target`
+  (`improve`, `remember`, `clone`, `task`, `proposal --queue`).** A `--bundle`
+  that names no configured bundle, names a read-only one, or differs from a
+  bundle-qualified ref (`akm improve team//skills/x --bundle stash`) failed with
+  "--target must reference a source name", "or pass --target to a different
+  source" or "conflicts with --target". `akm improve`, `remember`, `clone` and
+  every `task` verb reject `--target` (renamed `--bundle` in 0.9), and
+  `proposal --queue` takes `--queue`, so each message sent the user to a flag
+  that does not work. They now name the flag the command takes, and the
+  remedy in `akm remember --supersedes` says "re-run with --bundle" instead of
+  "--target". A bundle that came from a ref inside a task (`ghost//workflows/x`)
+  is described as such rather than blamed on a flag. The commands that really
+  take `--target` (`import`, `env`, `secret`, `proposal accept`) are unchanged.
+  Separately, the help for `akm improve --skip-if-locked` said a lock collision
+  without the flag exits 78. It exits 75 (`IMPROVE_LOCK_HELD`), as the CLI
+  reference says. The `--limit` help says "highest salience first" (it said
+  utility), and the `task add --command` help example uses
+  `--strategy reflect-distill` (the `frequent` strategy no longer exists).
+
+## [0.9.18] - 2026-09-29
+
+### Fixed
+
+- **A running `akm improve` no longer loses its SQLite file locks, which let
+  an older `sqlite3` delete `state.db`'s WAL.** Copying a database file
+  inside a process that also holds it open drops every POSIX lock the process
+  holds on it, and `akm improve` did exactly that (its read snapshots copy
+  `state.db`, hundreds of times a run). A peer on SQLite older than 3.51 (the
+  system `sqlite3` command, Python's `sqlite3` module) that then opened
+  `state.db` read-write, even just for `.backup`, saw no reader and deleted
+  `state.db-wal`/`-shm` at close, leaving colliding rowids, stale index
+  entries and lost rows. Affected: every release since 0.9.2 through the
+  snapshot, and 0.9.2 through 0.9.16 also on every `openStateDatabase` (fixed
+  in 0.9.17-alpha.4). The snapshot now copies in a child `cp` (Windows keeps
+  the in-process copy; its locks belong to the handle), and `improve` reads
+  proposals through its own connection instead of snapshotting per asset.
+  `akm health`'s `state-db-integrity` check now runs `PRAGMA integrity_check`,
+  since `quick_check` does not compare indexes with their tables and reported
+  this damage as `ok`. On earlier releases, open a live database only with
+  `sqlite3 -readonly`.
+
 ## [0.9.17] - 2026-09-29
 
 ### Added

package/STABILITY.md

@@ -89,6 +89,7 @@ enumeration of the whole `proposal` noun group.
 | `akm proposal diff` | Evolving | |
 | `akm proposal accept` | Evolving | |
 | `akm proposal reject` | Evolving | |
+| `akm proposal reopen` | Evolving | New in 0.9.19; undoes a rejection. |
 | `akm proposal revert` | Evolving | |
 | `akm proposal drain` | Evolving | |
 | `akm proposal extract` | Evolving | Former top-level `akm extract`. |
@@ -247,7 +248,7 @@ proposal-queue shape may shift. Breaking changes will be flagged in the
 CHANGELOG with a migration note.
 
 - **Improvement loop** — `akm improve` and the proposal noun group
-  `akm proposal {extract,new,list,show,diff,accept,reject,revert,drain}`
+  `akm proposal {extract,new,list,show,diff,accept,reject,reopen,revert,drain}`
   (`extract` and `new` are the former top-level `akm extract`/`akm propose`,
   moved under `proposal` in 0.9.0). Output JSON keys
   are stable; CLI flags (`--strategy`, `--task`, `--generator`) may add

package/dist/assets/hints/cli-hints-full.md

@@ -100,8 +100,9 @@ akm feedback memories/deployment-notes --positive # Works for memories too
 akm feedback env/prod --positive               # Records env feedback without surfacing values
 ```
 
-Use `akm feedback` whenever an asset materially helps or fails so future search
-ranking can learn from actual usage.
+Use `akm feedback` whenever an asset's content materially helps, or proves wrong,
+stale or unhelpful, so future search ranking can learn from actual usage. An akm
+command that fails says nothing about the asset; don't record it as feedback.
 
 ## LLM Wiki bundles
 
@@ -340,6 +341,7 @@ akm proposal accept 7c115132                            # Accept by UUID prefix
 akm proposal accept <id> --target team-bundle            # Accept to a named writable bundle source
 akm proposal reject skills/my-skill --reason "not ready" # Reject by asset ref
 akm proposal reject <id> --reason "..."                 # Archive with a reason
+akm proposal reopen <id> --reason "..."                 # Undo a rejection: back to pending (refused if the target changed)
 akm proposal revert <id>                                # Restore the pre-promotion content
 akm proposal new <type> <name> --task "..."             # Agent-author a NEW asset as a proposal
 akm proposal extract --auto                             # Mine native session files into proposals

package/dist/assets/hints/cli-hints-short.md

@@ -8,7 +8,7 @@ For any task, follow this loop:
 1. `akm curate "<task>"` — find the best matching asset
 2. `akm show <ref>` — read the schema (field names and structure)
 3. Edit the workspace file using schema field names + task-specific values from your README
-4. `akm feedback <ref> --positive` — record success; use `--negative --reason "..."` when it fails
+4. `akm feedback <ref> --positive` — record that the asset helped; use `--negative --reason "..."` when its content was wrong, stale or unhelpful. A failed akm command (e.g. `akm show` erroring) is not feedback on the asset — don't record it.
 
 For workflow tasks:
 1. `akm show workflows/<name>` — inspect the procedure before executing it
@@ -63,8 +63,10 @@ akm search "<query>" --from registry          # Search all registries (registry
 | secret | A single sensitive value for AUTHENTICATION (token, key, cert); name only. Inject with `akm secret run <ref> <VAR> -- <cmd>`. |
 | lesson | A distilled feedback lesson: `content` plus `action` (rendered from the `when_to_use` frontmatter). Read both before applying a related skill. Generated by the improve pipeline and promoted through the proposal queue. |
 
-When an asset meaningfully helps or fails, record that with `akm feedback` so
-future search ranking can learn from real usage.
+When an asset's content meaningfully helps, or proves wrong, stale or unhelpful,
+record that with `akm feedback` so future search ranking can learn from real
+usage. An akm command that fails says nothing about the asset; don't record it
+as feedback.
 
 ## Error Shapes and Exit Codes
 

package/dist/assets/prompts/reflect-feedback-framing.md

@@ -1 +1 @@
-Feedback describes what a reader found missing or wrong. It is a signal to investigate, not a fact to insert. Do not add claims, numbers, dates, paths, ports, or incidents that are not already present in the asset content. If feedback asks for information the asset lacks, add a clearly marked `TODO: verify …` placeholder or leave the section unchanged.
+Feedback describes what a reader found missing or wrong. It is a signal to investigate, not a fact to insert. Do not add claims, numbers, dates, paths, ports, or incidents that are not already present in the asset content. If feedback asks for information the asset lacks, leave the section unchanged.

package/dist/commands/feedback-cli.js

@@ -208,7 +208,7 @@ export const feedbackCommand = defineJsonCommand({
         },
         reason: {
             type: "string",
-            description: "Reason for the feedback (required for negative feedback by default; used by distillation)",
+            description: "What was wrong with (or right about) the asset's content (required for negative feedback by default; used by distillation). Not for akm command errors.",
         },
         "failure-mode": {
             type: "string",

package/dist/commands/health/checks.js

@@ -888,7 +888,7 @@ export const HEALTH_CHECKS = [
         // R0: nothing looked at state.db's own SQLite-level integrity before
         // this — the round-trip probe above only proves one row can be appended
         // and read back, which stays true on a database that fails
-        // `PRAGMA quick_check` elsewhere (corrupt indexes, out-of-order rowids).
+        // `PRAGMA integrity_check` elsewhere (corrupt indexes, out-of-order rowids).
         // Also reports the freelist ratio (fraction of pages VACUUM could
         // reclaim) so a bloated-but-uncorrupted file is visible as a warning
         // rather than silence.
@@ -904,8 +904,8 @@ export const HEALTH_CHECKS = [
                     kind: "deterministic",
                     status: "fail",
                     confidence: "high",
-                    message: `state.db failed PRAGMA quick_check: ${detail}. Repair: back up state.db, then run ` +
-                        `sqlite3 state.db ".recover" | sqlite3 state.new.db, verify state.new.db passes quick_check, stop ` +
+                    message: `state.db failed PRAGMA integrity_check: ${detail}. Repair: back up state.db, then run ` +
+                        `sqlite3 -readonly state.db ".recover" | sqlite3 state.new.db, verify state.new.db passes integrity_check, stop ` +
                         "every akm process, then delete state.db-wal and state.db-shm before swapping state.new.db in as " +
                         "state.db — a leftover WAL from the OLD database is replayed onto the new one and corrupts it.",
                     evidence: { path: ctx.stateDbPath, lines, freelistRatio },
@@ -917,7 +917,7 @@ export const HEALTH_CHECKS = [
                     kind: "deterministic",
                     status: "fail",
                     confidence: "high",
-                    message: `state.db passed PRAGMA quick_check, but reading its freelist/page-count failed: ${freelistError}.`,
+                    message: `state.db passed PRAGMA integrity_check, but reading its freelist/page-count failed: ${freelistError}.`,
                     evidence: { path: ctx.stateDbPath, lines, freelistError },
                 };
             }
@@ -928,8 +928,8 @@ export const HEALTH_CHECKS = [
                 status: freelistWarn ? "warn" : "pass",
                 confidence: "high",
                 message: freelistWarn
-                    ? `state.db passed PRAGMA quick_check, but ${(freelistRatio * 100).toFixed(1)}% of its pages are free (reclaimable by VACUUM).`
-                    : "state.db passed PRAGMA quick_check.",
+                    ? `state.db passed PRAGMA integrity_check, but ${(freelistRatio * 100).toFixed(1)}% of its pages are free (reclaimable by VACUUM).`
+                    : "state.db passed PRAGMA integrity_check.",
                 evidence: {
                     path: ctx.stateDbPath,
                     freelistCount: ctx.stateDbFreelist.freelistCount,

package/dist/commands/health.js

@@ -17,7 +17,7 @@ import { countImproveRunsSince } from "../storage/repositories/improve-runs-repo
 import { closeDatabase, openReadonlyExistingDatabase } from "../storage/repositories/index-connection.js";
 import { getAllEntries } from "../storage/repositories/index-entries-repository.js";
 import { queryTaskHistory } from "../storage/repositories/task-history-repository.js";
-import { getStateDbFreelistInfo, runStateDbQuickCheck } from "../storage/state-db-integrity.js";
+import { getStateDbFreelistInfo, runStateDbIntegrityCheck } from "../storage/state-db-integrity.js";
 import { pkgVersion } from "../version.js";
 import { collectArchiveUsageAdvisory } from "./health/archive-usage.js";
 import { HEALTH_CHECKS, probeActiveImproveStrategy, runHealthEngineProbes, runPendingStateMigrationsCheck, SESSION_EXTRACTION_LEDGER_WINDOW_DAYS, } from "./health/checks.js";
@@ -182,10 +182,10 @@ function gatherTaskHistoryPhase(db, since, stateDbPath, now) {
     const requiredTables = ["events", "proposals", "schema_migrations", "task_history"];
     const missingTables = requiredTables.filter((name) => !tableNames.includes(name));
     const probe = probeStateDbRoundTrip(stateDbPath);
-    // R0: read-only, independent of the round-trip probe above — quick_check
+    // R0: read-only, independent of the round-trip probe above — integrity_check
     // catches corruption a successful append/read cannot (out-of-order rowids,
     // bad index entry counts), and the freelist reading is purely informational.
-    const stateDbIntegrity = runStateDbQuickCheck(stateDbPath);
+    const stateDbIntegrity = runStateDbIntegrityCheck(stateDbPath);
     const stateDbFreelist = getStateDbFreelistInfo(stateDbPath);
     // D8 (spec §5.3): a marked "command" row or a legacy (unmarked) "prompt"
     // row is the agent/LLM arm; an unmarked "command" row is the legacy

package/dist/commands/improve/consolidate/coverage.js

@@ -0,0 +1,132 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/**
+ * The promote pass's coverage gate (#998): before a memory becomes a
+ * `knowledge/` proposal, ask whether `knowledge/` already says it.
+ *
+ * The rule: a memory is covered when at least {@link COVERAGE_MIN_CONTAINMENT}
+ * (half) of its distinct {@link COVERAGE_SHINGLE_WORDS}-word shingles appear in
+ * one of the knowledge docs nearest to it. It is a containment of the MEMORY in
+ * the doc, not a similarity: a long guide that quotes the memory covers it; a
+ * memory that quotes a short doc and adds claims of its own does not.
+ *
+ * Why this rule and this cut. The model never sees `knowledge/`, and the
+ * mint-time checks before this one only catch the same slug or the same whole
+ * body, so one edit or paraphrase defeats them. The evidence is #998's, from
+ * the owner's bundle (run `consolidate-1790666282516`: 327 decided proposals,
+ * 103 accepted, 224 rejected, 215 of those as "duplicate of / covered by /
+ * overlaps" an existing knowledge doc): the share of a proposal's distinct
+ * 5-word shingles found in the best OTHER knowledge doc was >= 0.5 for 122 of
+ * the 224 rejected proposals and for none of the 103 accepted ones. 0.5 is the
+ * cut that sample supports: no accepted promotion would have been skipped. That
+ * sample compared each proposal with EVERY other knowledge doc, so 122 of 224
+ * (up to about 54%) is what the rule can take out of review at most, not what
+ * this gate achieves: it reads only the {@link PAIR_NEIGHBOR_FETCH_K} nearest
+ * knowledge docs (below), and a covering doc that ranks lower goes unseen. The
+ * recall over that candidate set is unmeasured. The rest of the rejected
+ * proposals (paraphrases, partial overlaps) still reach review: the next cut
+ * measured, 0.2 (169 of 224 rejected), would also have skipped 2 of the 103
+ * accepted ones, and no cosine cut was measured at all. A wrong skip is a
+ * promotion nobody gets to review.
+ *
+ * Candidates are the memory's {@link PAIR_NEIGHBOR_FETCH_K} nearest knowledge
+ * docs in its bundle by stored vector (`getNeighborsByEntryId`, the lookup the
+ * pair pass runs, scoped to the bundle's knowledge entries), never a scan of
+ * `knowledge/`. There is no similarity floor, only a rank: a guide that quotes
+ * the memory is found however far it sits from it by vector, as long as fewer
+ * than that many other knowledge docs in the bundle are nearer. With no stored
+ * vector (semantic search off, the memory not indexed yet, no index at all)
+ * there are no candidates and the gate does nothing: the exact-slug and
+ * whole-body checks still run, and nothing throws.
+ */
+import fs from "node:fs";
+import { closeDatabase, openExistingDatabase } from "../../../storage/repositories/index-connection.js";
+import { getEntryById, getEntryIdByFilePath } from "../../../storage/repositories/index-entries-repository.js";
+import { getNeighborsByEntryId } from "../../../storage/repositories/index-vec-repository.js";
+import { stripFrontmatterBody } from "../content-hash.js";
+import { PAIR_NEIGHBOR_FETCH_K } from "./pair-pass.js";
+/** Words per shingle. */
+export const COVERAGE_SHINGLE_WORDS = 5;
+/** Share of a memory's distinct shingles one knowledge doc must hold for the memory to count as covered. */
+export const COVERAGE_MIN_CONTAINMENT = 0.5;
+const WORD = /[\p{L}\p{N}]+/gu;
+/** The distinct lower-cased word n-grams of `text`; empty when it has fewer than {@link COVERAGE_SHINGLE_WORDS} words. */
+export function wordShingles(text) {
+    const words = text.toLowerCase().match(WORD) ?? [];
+    const shingles = new Set();
+    for (let i = 0; i + COVERAGE_SHINGLE_WORDS <= words.length; i++) {
+        shingles.add(words.slice(i, i + COVERAGE_SHINGLE_WORDS).join(" "));
+    }
+    return shingles;
+}
+/** The share (0..1) of `memory`'s shingles that also occur in `doc`; 0 when the memory has none. */
+export function shingleContainment(memory, doc) {
+    if (memory.size === 0)
+        return 0;
+    const docShingles = wordShingles(doc);
+    let shared = 0;
+    for (const shingle of memory)
+        if (docShingles.has(shingle))
+            shared++;
+    return shared / memory.size;
+}
+/**
+ * The best-covering knowledge doc among the {@link PAIR_NEIGHBOR_FETCH_K}
+ * knowledge docs in `bundleId` nearest to the memory. `filePath` is the
+ * memory's indexed file; a memory the index does not know has no stored vector
+ * and so no candidates.
+ */
+export function findCoveringKnowledge(db, bundleId, filePath, body) {
+    const shingles = wordShingles(body);
+    if (shingles.size === 0)
+        return undefined;
+    const entryId = getEntryIdByFilePath(db, filePath);
+    if (entryId === undefined)
+        return undefined;
+    let best;
+    for (const hit of getNeighborsByEntryId(db, entryId, PAIR_NEIGHBOR_FETCH_K, { type: "knowledge", bundleId })) {
+        const neighbour = getEntryById(db, hit.id);
+        if (!neighbour)
+            continue;
+        let raw;
+        try {
+            raw = fs.readFileSync(neighbour.filePath, "utf8");
+        }
+        catch {
+            continue; // the index outlived the file
+        }
+        const containment = shingleContainment(shingles, stripFrontmatterBody(raw));
+        if (containment >= COVERAGE_MIN_CONTAINMENT && (best === undefined || containment > best.containment)) {
+            best = { ref: neighbour.conceptId, containment };
+        }
+    }
+    return best;
+}
+/**
+ * The gate for one run, holding its own read handle on `index.db` for the
+ * promotions that run emits; `undefined` when there is no bundle or no index
+ * to look in. A lookup that throws counts as "not known to be covered".
+ */
+export function openKnowledgeCoverage(bundleId) {
+    if (!bundleId)
+        return undefined;
+    let db;
+    try {
+        db = openExistingDatabase();
+    }
+    catch {
+        return undefined;
+    }
+    return {
+        find: (filePath, body) => {
+            try {
+                return findCoveringKnowledge(db, bundleId, filePath, body);
+            }
+            catch {
+                return undefined;
+            }
+        },
+        close: () => closeDatabase(db),
+    };
+}

package/dist/commands/improve/consolidate/pair-pass.js

@@ -273,6 +273,35 @@ function pairKey(a, b) {
 function rejectedPairKey(retiredRef, successorRef, retiredHash, successorHash) {
     return [retiredRef, successorRef, retiredHash, successorHash].join("\u0000");
 }
+/**
+ * Item 0 / S1: every rejected OR reverted consolidate-pair retirement on
+ * record, as {@link rejectedPairKey}s — read once per run, the same shape as
+ * `pendingRetireRefs` in {@link runConsolidatePairPass}. `reverted` is
+ * included alongside `rejected`: a person undoing an accept via `akm proposal
+ * revert` is the same "no, not this" signal as a reject — without it, the next
+ * run would re-mint the identical retirement, and a bulk accept could
+ * re-apply a decision the person just undid. The keys follow each proposal's
+ * CURRENT status, so one `akm proposal reopen` put back to `pending` (#997) is
+ * no longer among them — and, pending, blocks its pair from a second mint.
+ *
+ * @internal exported for unit tests.
+ */
+export function loadRejectedPairKeys(stashDir, proposalsCtx) {
+    const keys = new Set();
+    try {
+        for (const status of ["rejected", "reverted"]) {
+            for (const p of listProposalsReadOnly(stashDir, { status, includeArchive: true }, proposalsCtx)) {
+                if (!isRetireProposal(p) || !p.retirement)
+                    continue;
+                keys.add(rejectedPairKey(p.retirement.retiredRef, p.retirement.successorRef, p.retirement.retiredContentHash, p.retirement.successorContentHash));
+            }
+        }
+    }
+    catch {
+        // Best-effort de-dup only; a failed read never blocks judging.
+    }
+    return keys;
+}
 /**
  * Initiators (plan §5.2 step 1, S1 post-review): the pool, in the retrieval
  * scope, and content-eligible — no prior `consolidate-pair` ledger row, or a
@@ -635,7 +664,7 @@ seams = {}) {
     // also be judged as part of another until that decision resolves.
     const pendingRetireRefs = new Set();
     try {
-        for (const p of listProposalsReadOnly(stashDir, { status: "pending" })) {
+        for (const p of listProposalsReadOnly(stashDir, { status: "pending" }, opts.proposalsCtx)) {
             if (!isRetireProposal(p))
                 continue;
             pendingRetireRefs.add(stripBundle(p.ref));
@@ -647,26 +676,7 @@ seams = {}) {
         // Best-effort de-dup only; a failed read never blocks judging.
     }
     const isPendingBlocked = (c) => pendingRetireRefs.has(stripBundle(c.initiator.ref)) || pendingRetireRefs.has(stripBundle(c.other.ref));
-    // Item 0 / S1: every rejected OR reverted consolidate-pair retirement on
-    // record, keyed by its exact ref pair and both content hashes — read once
-    // per run, the same shape as pendingRetireRefs above. `reverted` is
-    // included alongside `rejected`: a person undoing an accept via `akm
-    // proposal revert` is the same "no, not this" signal as a reject — without
-    // it, the next run would re-mint the identical retirement, and a bulk
-    // accept could re-apply a decision the person just undid.
-    const rejectedPairKeys = new Set();
-    try {
-        for (const status of ["rejected", "reverted"]) {
-            for (const p of listProposalsReadOnly(stashDir, { status, includeArchive: true })) {
-                if (!isRetireProposal(p) || !p.retirement)
-                    continue;
-                rejectedPairKeys.add(rejectedPairKey(p.retirement.retiredRef, p.retirement.successorRef, p.retirement.retiredContentHash, p.retirement.successorContentHash));
-            }
-        }
-    }
-    catch {
-        // Best-effort de-dup only; a failed read never blocks judging.
-    }
+    const rejectedPairKeys = loadRejectedPairKeys(stashDir, opts.proposalsCtx);
     // Blocker 2: admit WHOLE initiators under MAX_PAIRS_PER_RUN, never
     // individual pairs — the old flat "top 300 candidates by cosine" cap let a
     // pending-blocked pair spend a budget slot doing nothing, and left