akm-cli 0.9.3 → 0.9.5

package/CHANGELOG.md

@@ -4,7 +4,239 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
-## [Unreleased]
+## [0.9.5] - 2026-08-30
+
+### Action required after upgrading
+
+- **Run `akm index --full` once (#862).** Search ranking previously counted
+  every search *hit* as a small win for that entry's utility score, whether
+  or not you ever opened it — a plain impression, not a selection. Over
+  enough repeat searches this compounded into a real feedback loop: appear
+  in results -> score goes up -> rank higher next time -> appear again. On
+  the install this was diagnosed against, one entry had been searched 19
+  times, opened 0 times, and still carried a utility score of 0.83 — on par
+  with entries a user had actually picked every time; the single
+  highest-utility entry in the whole table had an 8% select rate. That bias
+  is baked into every existing install's stored scores and does not go away
+  on its own — the live bump has been removed (search impressions no longer
+  write utility scores at all; only an actual `akm show`/select or explicit
+  `akm feedback` feeds the offline recompute now), but the already-inflated
+  numbers stay in `utility_scores`/`utility_scores_scoped` until you
+  recompute them. Run `akm index --full` once after upgrading to rebuild
+  scores purely from selection rate and feedback. **Search result order will
+  change after that rebuild — that is intended**, not a regression.
+- **The first `akm task sync` after upgrading may report a large number of
+  updates.** This is a backlog of reconciles that were being silently
+  refused, not new changes to your tasks. Two independent bugs combined to
+  make `sync` refuse work it should have done: (1) an installed scheduler
+  entry written by a pre-`--bundle` akm release couldn't prove ownership
+  under the newer, stricter check and was reported `(unproven owner)`,
+  which made `sync` refuse the *entire* run rather than reconcile everything
+  else; (2) separately, one task or workflow source that failed to compile
+  (e.g. a task still on schema v2 in a shape the shim can't convert) also
+  blocked every other, unrelated task from reconciling. Both are fixed —
+  ownership is now re-derived from the entry's own akm markers instead of
+  requiring a literal `--bundle` token, and a source that fails to compile
+  is now excluded and reported in `failed`/`failures` while every source
+  that DID compile still reconciles. On the install this was diagnosed
+  against, all 18 scheduled tasks showed up as updates on the first `sync`
+  after the fix — that is the backlog, not a sign your tasks changed.
+
+### Added
+
+- **`akm task prune` reclaims orphaned scheduler entries `sync` cannot reach
+  (#851).** `akm task sync` only ever reconciles entries that resolve to a
+  desired task/workflow definition in a live bundle; an entry whose own
+  `--scheduler-context` descriptor is corrupt/missing, or whose owning
+  bundle directory has since been deleted, was permanently invisible to it
+  and had to be removed by hand-editing the crontab/launchd plist/Task
+  Scheduler. `akm task prune` finds those and nothing else: it never
+  touches an entry that still resolves to a live bundle, and there is no
+  `--force`/"remove everything silently" mode. Defaults to a dry-run
+  preview that makes zero scheduler writes and exits non-zero when it finds
+  removal candidates (usable as a CI/health-check guard, mirroring `task
+  sync --dry-run`'s exit-code convention); `--yes` executes the printed
+  plan; `--id a,b` narrows a run to specific binding ids and refuses (with
+  no writes) any id that isn't a current orphan candidate — including a
+  live entry, which cannot be pruned even if you name it explicitly.
+- **`configVersion` read shim (#863).** Config loading now tolerates a
+  known older `configVersion` by upgrading the parsed document in memory
+  (never rewriting the file), with a one-line stderr warning naming the old
+  and new versions. The upgrade is silenced the next time any command
+  writes the config (`akm config set`, etc.), since every config write
+  already stamps the current version. Anything else — unknown, newer, or
+  malformed `configVersion` — still fails closed with the same actionable
+  error as before. No current release needed this shim yet (akm has only
+  ever shipped `configVersion: "0.9.0"`); it's in place now so the next
+  real bump doesn't break every existing config on upgrade.
+- **Truncated indexed content is no longer silent.** The two indexer caps
+  that truncate an entry's content before it's written to the search index
+  (a markdown-body cap and a search-text cap) previously truncated without
+  any signal. Indexed entries now carry a `contentTruncated: true` flag
+  when either cap fired, and truncation logs a `--verbose` diagnostic
+  naming the entry, so an unexpectedly-worse search match on a very large
+  file has a visible cause instead of a silent one. The cap sizes
+  themselves are unchanged.
+
+### Fixed
+
+- **`akm health --report` and `akm proposal list --status accepted` no
+  longer crash, and `improve`'s accepted-proposal counts are no longer
+  silently zero, on proposals written before every optional envelope field
+  existed (#859).** A prior fix already tolerated a missing `changes` key;
+  this closes the same gap for `proposedTarget`, which was still hard-required
+  at decode and — on the real archive this was checked against — absent
+  from 93% of accepted rows. Decoding a proposal now tolerates a genuinely
+  *absent* `proposedTarget` (accept-time resolution already had a
+  ref-derived fallback for this case, previously unreachable because decode
+  threw first); a *present but malformed* value still throws, so real
+  corruption is never silently accepted. Writing a new (`pending`) proposal
+  still requires the full envelope — this only widens what can be *read*,
+  not what akm will *write*.
+- **`akm task sync` no longer refuses to reconcile an entry it can't fully
+  re-prove ownership of, and no longer lets one broken task/workflow source
+  block every other source (#867, plus the scheduler-ownership fix
+  described above).** The v2 task-source shim also no longer hard-fails a
+  command wrapped in `env NAME=value... cmd`, a shape that's common for
+  cron entries (e.g. `env AKM_BIN=/path/akm bash script.sh`) — the shim now
+  looks past a leading `env` and its assignments to the real command before
+  deciding whether the conversion to v3/v4 is safe, instead of checking
+  `env` itself.
+- **`akm task sync --dry-run` no longer crashes on a real install with a
+  pre-`--bundle` cron entry.** The reconcile fix above made those entries
+  reachable for the first time, and the dry-run preview's frozen result
+  object was then mutated in place while stamping output metadata, throwing
+  "Attempting to define property on object that is not extensible" (exit
+  70). Output stamping now copies instead of mutating, so it tolerates a
+  frozen (or any) result uniformly.
+- **`akm migrate apply` no longer aborts an entire batch because one file in
+  it is blocked (#866).** The task v2->v3 and v3->v4 migrators refused to
+  write *any* file — including files with no problem at all — the moment a
+  single file in the batch was classified `blocked`. Both migrators now
+  skip and report the blocked file(s) and still migrate everything else;
+  the run still exits non-zero whenever anything was skipped.
+- Two flaky integration/unit tests fixed at the root cause rather than
+  quarantined (#864): a `state.db` byte-identity assertion that raced
+  SQLite's own WAL checkpoint timing (now forces a checkpoint before
+  comparing, so the assertion reflects real durable mutations only), and a
+  "resolveProjectContext when cwd is the home directory" test that did
+  real, un-mocked filesystem walks against the actual `$HOME` (now isolates
+  `os.homedir()` and the stash/XDG dirs like the rest of the suite).
+
+### Changed
+
+- **`test:integration` is green-by-default (#861).** Verified there is no
+  CI mechanism silently swallowing a failing test (no `continue-on-error`,
+  no lost exit codes, no allowlist of "expected" failures) — the fixes in
+  this release were the actual cause of the prior red baseline. Raised the
+  integration suite's minimum-test-count floor (`AKM_MIN_INTEGRATION_TESTS`,
+  5500 -> 5700) so a large silent test loss is still caught with headroom
+  for ordinary future deletions, and documented in `AGENTS.md` that `TMPDIR`
+  must be a real `/tmp`-family path for the suite to pass — some guards
+  (stash-path safety, `akm-eval`'s Docker twin) intentionally hardcode that
+  assumption rather than reading `TMPDIR`.
+- Simplified several areas flagged in the #866 complexity review without
+  behavior changes: `improve_runs.result_json`'s `schemaVersion` decoding is
+  now an explicit, extensible table instead of one large inline
+  conditional, ready for a future schema bump to add a case rather than
+  restructure the function.
+
+### Removed
+
+- **Three defensive checks that only ever refused work a human explicitly
+  asked for, with no evidence (via telemetry) they ever caught a real
+  problem, were removed:**
+  - The 1 MiB hard cap on reading a bundle file (command/agent/script/task/
+    workflow source, or a frozen workflow secret/env source) into memory.
+    Reads remain exact and integrity-checked (hashed, CAS-verified, fail-
+    closed on read-time mutation) — there is simply no longer a size ceiling
+    that refuses to read a file you put in your own bundle.
+  - The task migrator's inode/hard-link-count/change-time identity
+    fencing on top of its existing lockfile + backup-before-write +
+    byte-for-byte drift check. The extra fencing modeled a multi-tenant
+    race that doesn't apply to a single-user CLI holding an exclusive lock,
+    and its failure mode (refusing to migrate a file that's byte-identical
+    to what was already previewed, or refusing to touch a file merely
+    because it has a hard link elsewhere) was worse than the risk it
+    guarded against. Symlink/path-escape rejection — a real hazard — is
+    unchanged.
+  - Dead anti-collapse "hard refusal" guard functions
+    (`checkGenerationGuard`, `checkMergeInformationFloor`) that had zero
+    production callers.
+
+## [0.9.4] - 2026-08-30
+
+### Changed
+
+- **Node.js 22 support is restored for the npm package.** 0.9.3 raised the
+  npm bootstrap floor to Node >= 24 as a policy simplification; no code in
+  the package actually requires a Node-24-only API, and the pinned
+  better-sqlite3 12.11.1 ships a prebuilt binary for Node 22 (ABI 127), so
+  nothing compiles from source. The floor returns to Node >= 22 across the
+  preinstall check, the CLI bootstrap guard, and the pinned-registry
+  helper, and the CI node-smoke matrix again runs BOTH Node 22 and 24 so
+  the supported floor is tested on every run, not merely declared.
+
+### Added
+
+- **`akm task sync --dry-run` previews the reconcile without touching the
+  scheduler (#849).** Prints the planned adds/updates/removes — removals
+  now carry their owning bundle — makes zero scheduler writes, and exits
+  non-zero when removals are pending so scripts can gate on it. The plan
+  renderer is shared, ready for the planned `task prune` (#851) to reuse.
+- **Search hits now report which stage of the progressive AND->OR lexical
+  ladder produced them (#856).** `akm search` already ran strict AND, then
+  prefix AND, then an OR/prefix-OR recovery, stopping at the first stage
+  that returned candidates — but callers had no way to tell a strict match
+  from a heavily relaxed one. Local bundle hits now carry an optional
+  `matchStage: "exact" | "prefix" | "relaxed"` field (omitted for hits with
+  no FTS component, e.g. a pure-semantic hybrid contribution), surfaced at
+  `--detail normal`, `--detail full`, and `--shape agent` across all output
+  formats. Purely additive; no `schemaVersion` bump.
+- **Previous-release corpus test.** New
+  `tests/integration/previous-release-corpus.test.ts` holds fixtures of
+  data shapes prior releases actually wrote (task v2/v3 sources, pre-#858
+  proposal rows) and asserts the current CLI reads or auto-handles every
+  one. Policy: every schema bump must add the old shape here — this suite
+  failing means an upgrade break was about to ship.
+
+### Fixed
+
+- **`akm show`, `task run`/`explain`, `workflow run`/`plan`, and
+  `command run` no longer fail on bundles past 16,384 files (#857).**
+  Single-ref owner resolution walked the entire bundle tree on every
+  lookup, aborting with `file limit 16384 exceeded` once a bundle grew past
+  the cap — normal `improve` output accumulation was enough to get there.
+  Path-to-conceptId derivation is deterministic, so its inverse is now
+  computed in closed form: each adapter's `readCandidates` enumerates every
+  physical spelling that could own a conceptId (canonical placement, loose
+  off-canonical fallback, env `.env` duality) and the existing
+  verification/collision pipeline runs over that fixed set. The tree walk,
+  both scan caps, and `AdapterConceptScanError` are gone — no cap is needed
+  when nothing walks. Collision guarantees are unchanged (the pinned
+  loose-vs-canonical conformance case still throws), and symlinked
+  off-canonical files are now reachable where the old scan skipped them.
+- **`akm health --report` and `akm proposal list --status accepted` no
+  longer crash on proposal rows written before the `changes` metadata
+  envelope existed (#858), and `improve` outcome-score salience no longer
+  silently computes from zero accepted-counts (#859).** ~89% of real
+  archived accepted/rejected rows predate the field and can never recover
+  it; `storedToChanges` now treats a fully-absent `changes` key as a
+  documented legacy gap (empty change list — the rows still count toward
+  accepted/rejected history), `listStateProposals` skips-and-warns on
+  genuinely corrupt rows instead of aborting the whole list, and the write
+  path still refuses to persist a new proposal without changes.
+- **Task v2/v3 sources are auto-read as v4 instead of hard-failing with
+  `TASK_SCHEMA_VERSION_UNSUPPORTED`.** The v4 source gate would have broken
+  every pre-0.9.4 scheduled task headlessly on upgrade until the operator
+  manually ran `akm migrate apply`. `parseTaskSource` now runs the same
+  pure, deterministic migration planners the migrator uses (chained
+  v2->v3->v4) entirely in memory, emits a one-line stderr deprecation
+  warning, and never writes the file; the hard error survives only for
+  sources the deterministic conversion genuinely cannot translate.
+  `akm migrate apply` remains the way to rewrite files on disk and silence
+  the warning. The planner core moved from `scripts/akm-migrate/` into
+  `src/tasks/source/` so there is exactly one copy.
 
 ## [0.9.3] - 2026-08-29
 

package/README.md

@@ -16,7 +16,7 @@ assistant, including [Claude Code](https://claude.ai/code),
 
 ## Install
 
-**Option 1 — npm package (recommended; requires [Node.js](https://nodejs.org) >= 24):**
+**Option 1 — npm package (recommended; requires [Node.js](https://nodejs.org) >= 22):**
 
 ```sh
 npm install -g akm-cli

package/SECURITY.md

@@ -96,7 +96,7 @@ containing secrets or private notes.
 
 ## Known non-issues
 
-- **The `akm-cli` npm package requires Node.js >= 24 as its bootstrap.** A
+- **The `akm-cli` npm package requires Node.js >= 22 as its bootstrap.** A
   working Bun >= 1.0 is preferred for execution when it is also on `PATH`; old,
   unusable, or absent Bun installations fall back to Node.js. Bun does not
   remove the package's Node.js requirement. Standalone binaries are

package/STABILITY.md

@@ -220,7 +220,7 @@ enumeration of the whole `proposal` noun group.
   | `78` | Configuration error |
 - **Install scripts** — `install.sh` and `install.ps1` URLs; the `--prefix`
   / `AKM_INSTALL_DIR` environment override.
-- **Runtime** — the npm package requires Node.js >= 24 as its bootstrap and
+- **Runtime** — the npm package requires Node.js >= 22 as its bootstrap and
   prefers a working Bun >= 1.0 for execution when both are available; old,
   unusable, or absent Bun installations fall back to Node.js. Standalone
   binaries are runtime-free.

package/dist/akm

@@ -120,8 +120,8 @@ if (contextValid) {
 
   if (!process.versions.bun) {
     const [major = 0, minor = 0] = process.versions.node.split(".").map(Number);
-    if (major < 24) {
-      console.error("The akm-cli npm package requires Node.js >= 24 to bootstrap.");
+    if (major < 22) {
+      console.error("The akm-cli npm package requires Node.js >= 22 to bootstrap.");
       process.exit(1);
     }
   }

package/dist/akm-migrate

@@ -8,8 +8,8 @@ import { fileURLToPath } from "node:url";
 
 if (!process.versions.bun) {
   const [major = 0, minor = 0] = process.versions.node.split(".").map(Number);
-  if (major < 24) {
-    console.error("The akm-cli npm package requires Node.js >= 24 to bootstrap.");
+  if (major < 22) {
+    console.error("The akm-cli npm package requires Node.js >= 22 to bootstrap.");
     process.exit(1);
   }
 }

package/dist/cli.js

@@ -2,22 +2,22 @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
-// Runtime guard: the akm-cli npm package bootstraps with Node.js >= 24
+// Runtime guard: the akm-cli npm package bootstraps with Node.js >= 22
 // (#465, #560), then its launcher prefers a working Bun >= 1.0 when available.
 // The runtime boundary (src/runtime.ts, src/storage/database.ts) supports both.
 // Under Node the CLI must be launched via the
 // `dist/cli-node.mjs` wrapper, which registers the text-import loader hook
 // before this module graph loads; running `node dist/cli.js` directly still
 // works for code paths that touch no embedded text asset, but the wrapper is
-// the supported entry. The hard floor is Node 24; Node 22 is no longer a
-// supported npm bootstrap runtime.
+// the supported entry. The hard floor is Node 22 (Node 20 support dropped 2026-07; `@clack/core` imports
+// `node:util`'s `styleText` (added in Node 20.12) — Node 18 (EOL) throws at import.
 {
     const isBun = typeof globalThis.Bun !== "undefined";
     if (!isBun) {
         const [major = 0] = (process.versions.node ?? "0").split(".").map((part) => Number.parseInt(part, 10) || 0);
-        const nodeOk = major >= 24;
+        const nodeOk = major >= 22;
         if (!nodeOk) {
-            console.error("\n  ERROR: the akm-cli npm package requires Node.js >= 24.\n" +
+            console.error("\n  ERROR: the akm-cli npm package requires Node.js >= 22.\n" +
                 `  Detected Node.js ${process.versions.node ?? "unknown"}.\n` +
                 "  Bun >= 1.0 is optional for execution; it does not replace the Node.js bootstrap.\n" +
                 "  Upgrade Node.js (https://nodejs.org), or install the runtime-free standalone binary:\n" +

package/dist/commands/health/improve-metrics.js

@@ -15,6 +15,23 @@ export function parseTaskMetadata(row) {
         ...(metadata.engine !== undefined ? { engine: metadata.engine } : {}),
     };
 }
+/**
+ * `parseTaskMetadata`, but per-row skip-and-warn instead of throwing (mirrors
+ * `listStateProposals`). `decodeTaskHistoryMetadata` already tolerates
+ * legacy/additive shapes; only genuine corruption reaches this catch, and a
+ * corrupt row must degrade the metric (excluded, not fatal) rather than abort
+ * the whole `akm health` computation.
+ */
+export function taskFailureDetail(row) {
+    try {
+        return parseTaskMetadata(row).detail;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        console.warn(`[akm] Skipping unparseable task_history row in agent-failure-rate (task_id=${row.task_id}, started_at=${row.started_at}): ${message}`);
+        return undefined;
+    }
+}
 /**
  * D8 read-boundary predicate (spec docs/plans/specs/p1b-model-extraction.md
  * §5.3) for `akm health`'s `agentFailureRate`: true for a `task_history` row

package/dist/commands/health/windows.js

@@ -11,7 +11,7 @@ import { readEvents } from "../../core/events.js";
 import { buildTaskRunId, getLoggedRunIds } from "../../core/logs-db.js";
 import { DURATION_UNITS, parseDuration } from "../../core/time.js";
 import { queryTaskHistory } from "../../storage/repositories/task-history-repository.js";
-import { buildImproveSkipSummary, computeWallTimeStats, isAgentTaskHistoryRow, parseTaskMetadata, roundRate, summarizeImproveCompleted, summarizeImproveRuns, } from "./improve-metrics.js";
+import { buildImproveSkipSummary, computeWallTimeStats, isAgentTaskHistoryRow, roundRate, summarizeImproveCompleted, summarizeImproveRuns, taskFailureDetail, } from "./improve-metrics.js";
 import { readLlmUsageAggregate } from "./llm-usage.js";
 import { computeDegradationMetrics, computeDenominatorFixedCoverage } from "./metrics.js";
 import { buildPerRunSummaries } from "./task-runs.js";
@@ -154,7 +154,7 @@ export function buildWindowMetrics(db, stateDbPath, since, until, now = () => Da
     // isAgentTaskHistoryRow's header comment for the full mapping).
     const agentRows = taskRows.filter((row) => isAgentTaskHistoryRow(row));
     const agentFailures = agentRows.filter((row) => {
-        const detail = parseTaskMetadata(row).detail;
+        const detail = taskFailureDetail(row);
         return typeof detail?.reason === "string" && detail.reason.length > 0;
     });
     const logBackingRate = taskRowsWithLogs.length === 0 ? 1 : existingLogRows.length / taskRowsWithLogs.length;

package/dist/commands/health.js

@@ -20,7 +20,7 @@ import { queryTaskHistory } from "../storage/repositories/task-history-repositor
 import { pkgVersion } from "../version.js";
 import { collectImproveAdvisories } from "./health/advisories.js";
 import { HEALTH_CHECKS, runHealthEngineProbes } from "./health/checks.js";
-import { buildImproveSkipSummary, computeWallTimeStats, isAgentTaskHistoryRow, parseTaskMetadata, roundRate, summarizeImproveCompleted, summarizeImproveRuns, } from "./health/improve-metrics.js";
+import { buildImproveSkipSummary, computeWallTimeStats, isAgentTaskHistoryRow, roundRate, summarizeImproveCompleted, summarizeImproveRuns, taskFailureDetail, } from "./health/improve-metrics.js";
 import { emptyLlmUsageAggregate, readLlmUsageAggregate } from "./health/llm-usage.js";
 import { computeDegradationMetrics, computeDenominatorFixedCoverage, computeEnrichmentMintingRollup, probeStateDbRoundTrip, } from "./health/metrics.js";
 import { collectPluginStalenessAdvisories } from "./health/plugin-staleness.js";
@@ -130,7 +130,7 @@ function gatherTaskHistoryPhase(db, logsDb, since, stateDbPath, now) {
     // isAgentTaskHistoryRow's header comment for the full mapping).
     const agentRows = taskRows.filter((row) => isAgentTaskHistoryRow(row));
     const agentFailures = agentRows.filter((row) => {
-        const detail = parseTaskMetadata(row).detail;
+        const detail = taskFailureDetail(row);
         return typeof detail?.reason === "string" && detail.reason.length > 0;
     });
     const logBackingRate = taskRowsWithLogs.length === 0 ? 1 : existingLogRows.length / taskRowsWithLogs.length;

package/dist/commands/improve/anti-collapse.js

@@ -4,11 +4,11 @@
 /**
  * WS-3b Step 8 — Anti-collapse merge guards.
  *
- *   (a) Generation counter: merged.generation = max(sources)+1; refuse merge
- *       of two assets both above generation N (default 2); merges cite sources.
+ *   (a) Generation counter: merged.generation = max(sources)+1; merges cite
+ *       sources. `over_generation_count` (collapse-detector.ts) tracks assets
+ *       above the generation threshold as an advisory metric only — there is
+ *       no merge-refusal path wired in.
  *   (b) Lexical-diversity check: low n-gram diversity ⇒ raise merge threshold.
- *   (c) Merge-information floor (R5 §4.2): provenance union must not shrink and
- *       the merged body must retain a minimum fraction of the source tokens.
  *   (d) Occasional random non-similar cluster in the pool.
  *
  * @module anti-collapse
@@ -37,93 +37,6 @@ export function computeMergedGeneration(sourceGenerations) {
         return 1;
     return Math.max(...sourceGenerations) + 1;
 }
-/**
- * Check whether a merge of the given assets should be refused due to the
- * anti-collapse generation guard.
- *
- * Returns `{ refused: true, reason }` when BOTH assets have generation > maxGeneration.
- * Returns `{ refused: false }` when the merge is allowed.
- *
- * @param sourceGenerations - Generation values for all merge participants.
- * @param config - Anti-collapse config.
- */
-export function checkGenerationGuard(sourceGenerations, config) {
-    // R5: default ON — only an explicit opt-out disables the guard.
-    if (config.enabled === false)
-        return { refused: false };
-    const maxGen = config.maxGeneration ?? DEFAULT_MAX_GENERATION;
-    const highGenCount = sourceGenerations.filter((g) => g > maxGen).length;
-    if (highGenCount >= 2) {
-        return {
-            refused: true,
-            reason: `Anti-collapse: ${highGenCount} merge participants have generation > ${maxGen} (${sourceGenerations.join(", ")}); refusing to merge over-consolidated assets.`,
-        };
-    }
-    return { refused: false };
-}
-/** Distinct-token retention floor default (R5 §4.2). */
-export const DEFAULT_MIN_SPECIFICITY_RETENTION = 0.6;
-function distinctTokens(text) {
-    // Same lowercase whitespace tokenization computeBigramDiversity uses.
-    return new Set(text
-        .toLowerCase()
-        .split(/\s+/)
-        .filter((w) => w.length > 0));
-}
-/**
- * A merge must strictly increase information (R5 §4.2):
- *  1. Provenance: the merged asset's `xrefs` must be a superset of the union of
- *     all participants' `xrefs` plus the participant refs
- *     themselves — provenance never shrinks through a merge.
- *  2. Specificity: distinctTokens(mergedBody) ≥ minSpecificityRetention ×
- *     |union(distinctTokens(participant bodies))| — a merge that only
- *     shortens/genericizes fails.
- *
- * Pure and deterministic; ADVISORY in v1 (the caller counts violations, it
- * does not refuse the merge). Returns `passed: true` immediately when the
- * anti-collapse suite or the floor itself is opted out.
- */
-export function checkMergeInformationFloor(mergedBody, mergedSourceRefs, participants, config) {
-    if (config.enabled === false || config.mergeInformationFloor === false || participants.length === 0) {
-        return { passed: true, provenanceBefore: 0, provenanceAfter: 0, specificityRetention: 1 };
-    }
-    // 1. Provenance union: participants + everything they already cited.
-    const required = new Set();
-    for (const p of participants) {
-        required.add(p.ref);
-        for (const xref of p.xrefs)
-            required.add(xref);
-    }
-    const after = new Set(mergedSourceRefs);
-    const missing = [...required].filter((r) => !after.has(r));
-    // 2. Specificity retention over the union of source tokens.
-    const sourceTokens = new Set();
-    for (const p of participants) {
-        for (const t of distinctTokens(p.body))
-            sourceTokens.add(t);
-    }
-    const mergedTokens = distinctTokens(mergedBody);
-    // Clamped at computation so the pass/fail decision, the reason string, and
-    // the reported field all describe the same value.
-    const specificityRetention = Math.min(1, sourceTokens.size === 0 ? 1 : mergedTokens.size / sourceTokens.size);
-    const minRetention = config.minSpecificityRetention ?? DEFAULT_MIN_SPECIFICITY_RETENTION;
-    const provenanceOk = missing.length === 0;
-    const specificityOk = specificityRetention >= minRetention;
-    const reasons = [];
-    if (!provenanceOk) {
-        reasons.push(`provenance shrank: merged xrefs missing ${missing.length} ref(s) (e.g. ${missing[0]})`);
-    }
-    if (!specificityOk) {
-        reasons.push(`specificity retention ${specificityRetention.toFixed(2)} < ${minRetention} (merge genericized/shortened)`);
-    }
-    return {
-        passed: provenanceOk && specificityOk,
-        provenanceBefore: required.size,
-        provenanceAfter: after.size,
-        specificityRetention,
-        ...(reasons.length > 0 ? { reason: reasons.join("; ") } : {}),
-    };
-}
 /**
  * Compute the bigram n-gram diversity of a text string.
  * Returns a value in [0, 1] where 0 = all identical bigrams, 1 = all unique.

package/dist/commands/improve/preparation.js

@@ -1744,6 +1744,13 @@ function updateOutcomeScores(args) {
             // inflate counts with proposals from other stashes.
             const acceptedCountByRef = new Map();
             try {
+                // #858/#859: listStateProposals() now skips-and-warns on individual
+                // unparseable rows (including legacy pre-#578 rows with no
+                // persisted `changes`, which it tolerates directly) instead of
+                // throwing, so this no longer silently zeroes out every ref's
+                // count on a single bad row. The outer try/catch stays as a
+                // defense-in-depth fallback for unexpected failures (e.g. a query
+                // error), not the primary safeguard it used to be.
                 const acceptedProposals = listStateProposals(outcomeDb, {
                     status: "accepted",
                     ...(primaryStashDir ? { stashDir: primaryStashDir } : {}),
@@ -1753,7 +1760,7 @@ function updateOutcomeScores(args) {
                 }
             }
             catch {
-                // best-effort: if proposals query fails, accepted counts stay at 0
+                // best-effort: if the query itself fails, accepted counts stay at 0
             }
             // Update each ref's outcome row and collect the resulting outcome scores.
             const rawOutcomeScores = new Map();

package/dist/commands/lint/index.js

@@ -11,7 +11,7 @@ import { stashDirFor } from "../../core/asset/asset-placement.js";
 import { parseFrontmatter } from "../../core/asset/frontmatter.js";
 import { conceptIdForStashFile, displayRefForConceptId } from "../../core/asset/resolve-ref.js";
 import { deriveBundleIds } from "../../core/bundle-id.js";
-import { resolveStashDir } from "../../core/common.js";
+import { isAkmRegistryCachePath, resolveStashDir } from "../../core/common.js";
 import { loadConfig, primaryBundlePath } from "../../core/config/config.js";
 import { UsageError } from "../../core/errors.js";
 import { warn } from "../../core/warn.js";
@@ -80,10 +80,6 @@ function collectMarkdownFiles(dir, caseInsensitive = false) {
     }
     return results;
 }
-function isCachedLintPath(filePath) {
-    const posixPath = filePath.replace(/\\/g, "/");
-    return posixPath.includes("/.cache/") || posixPath.includes("/registry/");
-}
 /** Peer workflow sources accepted by the source-IR compiler; `.yaml` remains unsupported. */
 function collectWorkflowFiles(dir) {
     if (!fs.existsSync(dir))
@@ -546,7 +542,7 @@ function lintAkmSweep(stashRoot, extraStashRoots, cfg, sources, options) {
                 : collectMarkdownFiles(dirPath, true);
         let assetFiles = subdir === "workflows" ? files.filter((file) => path.basename(file).toLowerCase() !== "readme.md") : files;
         if (subdir === "workflows") {
-            assetFiles = assetFiles.filter((file) => !isCachedLintPath(file));
+            assetFiles = assetFiles.filter((file) => !isAkmRegistryCachePath(file));
             const ownership = resolveWorkflowLintOwnership(stashRoot, assetFiles);
             assetFiles = ownership.files;
             flagged.push(...ownership.issues);
@@ -575,7 +571,7 @@ function lintAkmSweep(stashRoot, extraStashRoots, cfg, sources, options) {
             // Compare on a separator-normalized copy: on Windows these paths carry
             // backslashes, so the forward-slash substring never matched and --fix
             // rewrote files inside the registry cache.
-            if (isCachedLintPath(filePath))
+            if (isAkmRegistryCachePath(filePath))
                 continue;
             const relPath = path.relative(stashRoot, filePath);
             let raw;

package/dist/commands/proposal/validators/proposal-validators.js

@@ -67,6 +67,18 @@ const canonicalProposalValidators = {
         const content = proposalContent(proposal);
         if (!content.trim())
             return [];
+        // #859: proposedTarget is absent on legacy archived rows, but this
+        // validator only ever runs on a proposal about to be minted or promoted
+        // (both always carry proposedTarget — see the Proposal.proposedTarget
+        // doc comment) — so hitting this is a genuine defect, not a legacy gap.
+        if (!proposal.proposedTarget) {
+            return [
+                {
+                    kind: "invalid-workflow-structure",
+                    message: `Workflow proposal ${proposal.id} (${proposal.ref}) is missing proposedTarget and cannot be validated.`,
+                },
+            ];
+        }
         const sourcePath = proposal.changes[0]?.path || proposal.ref;
         const result = compileWorkflowSource(content, {
             path: sourcePath,