akm-cli 0.9.5 → 0.9.6

package/CHANGELOG.md

@@ -4,6 +4,111 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [0.9.6] - 2026-08-31
+
+The deletion release: **net −2,100 lines**, almost all of it machinery that
+gated, refused, verified, or cached a judgment. Nearly every guard removed
+here had **zero confirmed firings** across 38,341 production telemetry events,
+while several had already broken real installs.
+
+The standard applied is now written down in `AGENTS.md` (`## Defensive Code`):
+a guard survives only if it has demonstrably helped a real user, its failure
+mode costs less than the hazard it prevents, and the operation is not already
+gated behind a deliberate human command. "This hazard is conceivable" is not a
+justification.
+
+### Fixed
+
+- **Embedding no longer discards an entire index because one batch was too
+  big (#874).** Remote embeddings batched by document count (100) against a
+  fixed 30s timeout; a single oversized batch failed the whole phase, leaving
+  `embeddings` at 0 rows on a real 23,857-entry bundle and silently disabling
+  semantic search. Batching is now bounded by a token budget, failures are
+  skipped-and-reported per batch, and an oversized single document is a named
+  skip rather than a phase failure.
+- **`akm lint` no longer silently skips user directories named `.cache` or
+  `registry`.** Two name-based exclusion sites remained after the 0.9.5 fix, so
+  a bundle's own `knowledge/registry/` was never linted and reported clean.
+  Exclusion is now anchored to akm's resolved registry-cache path.
+- **One directory can no longer register as two bundles (#870).** When
+  `AKM_BUNDLE_DIR` pointed at a directory already configured under another id,
+  akm minted a second bundle for it; `akm migrate` then enumerated every task
+  file twice and failed with `duplicate task migration file path` (exit 70) —
+  permanently, while health checks kept passing. Bundle identity is now the
+  resolved content root (`path.resolve(entry.path, component.root ?? ".")`) at
+  both registration sites, existing duplicates reconcile instead of throwing,
+  and a genuinely irreconcilable pair reports both bundle ids and the shared
+  path.
+
+### Removed
+
+- **The index writer lease (#872).** It guarded a *regenerable cache*, had zero
+  lease events in telemetry, and a live-but-wedged holder stranded all indexing
+  for 12 hours — `probeLock` only reclaims a dead PID. It blocked legitimate
+  work twice in a single day of real use. `withAssetMutationLease` is **kept**
+  (it guards authored, git-backed asset writes) but its identical 12h
+  age-based stale reclaim is gone; only a verifiably-dead holder is reclaimed.
+- **`semantic-status.ts` and its cached `blocked` verdict (#873).** A failed
+  probe was persisted with a 24h TTL, and search consulted that verdict
+  *before attempting semantic search at all* — so one failure silently
+  disabled a working feature for a day. Semantic search now attempts per query
+  and falls back to FTS with a live warning. The remaining pre-flight check is
+  a real-time embedding count, not a stored judgment.
+- **The improve-lock 4h stale reclaim.** Same hole: `--skip-if-locked`
+  silently no-oped nightly `improve` for up to four hours and reported success.
+- **The persisted `supportsJsonSchema` capability cache**, which was never
+  invalidated by `akm config set`; a stale `true` sent `response_format:
+  json_schema` to an incompatible endpoint with no fallback (`isRetryable`
+  excludes 4xx). Replaced by attempt-then-fallback held in memory for the
+  process only. The config field survives as an explicit user override.
+- **Workflow authoring resource caps** — steps, params, route branches,
+  inputs, outputs, gate loops, retries, JSON depth/node, composition depth,
+  and exec argv/env caps. None ever fired; several duplicated OS limits.
+- **`LIFETIME_UNIT_CAP` (10,000)**, which hard-aborted workflows mid-run. The
+  maximum ever observed was 14 units.
+- **`state.db` open-path identity re-verification**, which ran on *every*
+  command and threw a bare `Error`.
+- **The task-source 1 MiB cap** at four sites, restating the `guarded-source`
+  cap already deleted in 0.9.5.
+- **TOCTOU identity checks** — `assertGitPublicationIdentity` (git's
+  `--force-with-lease` already covers it), `assertFrozenDirectoryIdentity`
+  (replaced with a path-containment recheck: containment and resolved-path
+  identity stay, device/inode comparison goes, so a remount or container
+  rebuild no longer aborts a dispatch), `assertTaskSourceExpectation`'s stat
+  fields (its content hash stays), and redundant repeat HEAD-generation
+  compares in `write-source`.
+- **`assertNotFlag`** on persona/system-prompt content; **`MAX_ENV_BYTES`**,
+  **`MAX_SECRET_BYTES`**, **`MAX_FEEDBACK_TAGS`**, **`MAX_CONFIG_FILE_BYTES`**,
+  model-map JSON budgets, memory-contradiction family caps, and two launchd /
+  schtasks re-checks that duplicated an existing fallback. `map.concurrency`
+  now clamps instead of rejecting a human-authored value.
+- **17 dead symbols**, including several whose docstrings described behavior
+  nothing implemented. Three "canonical" constants that call sites were
+  ignoring in favour of hardcoded literals were **wired in** rather than
+  deleted, closing the drift instead of removing the evidence of it.
+- **Speculative flexibility** — `AKM_ABLATE_CONTRIBUTORS` ablation plumbing
+  and the unexercised `graphBoost.confidenceMode` branches.
+
+### Changed
+
+- **Drifted duplicate implementations consolidated.** HTTP retry/backoff (the
+  generic copy's `Retry-After` parsing was unbounded and numeric-only; the
+  capped, date-aware one now applies everywhere), the child-process env
+  allowlist (the opencode-sdk copy was missing `AKM_EVENT_SOURCE` and the
+  Windows HOME equivalents), portable synchronous sleep (five call sites had
+  been silently taking the Node fallback instead of the Bun fast path), a
+  stacked LLM chunk retry, and a duplicate `isProcessAlive`.
+
+### Kept, deliberately
+
+Not everything unused is disposable. `isVecFastPathReady` stays: a partial
+`entries_vec` table does not throw, it silently returns wrong neighbours, so
+there is no error for a fallback to catch. `assertSupportedKind` stays: it has
+a proven independent bypass path and is the real last-line check, not a
+duplicate. The maintenance barrier and registry TTL cache stay. The four
+improve strategies with zero recorded invocations stay — that measures one
+install's cron schedule, not their worth.
+
 ## [0.9.5] - 2026-08-30
 
 ### Action required after upgrading

package/dist/commands/env/env-cli.js

@@ -127,8 +127,7 @@ const envCreateCommand = defineJsonCommand({
                 content = fs.readFileSync(fromFile, "utf8");
             }
             else {
-                const MAX_ENV_BYTES = 1024 * 1024; // 1 MB
-                const buf = await readStdin(MAX_ENV_BYTES, () => new UsageError("Env file exceeds 1 MB limit.", "INVALID_FLAG_VALUE"));
+                const buf = await readStdin();
                 content = buf.toString("utf8");
             }
         }

package/dist/commands/env/secret-cli.js

@@ -122,16 +122,12 @@ const secretSetCommand = defineJsonCommand({
         if (fromEnv !== undefined && fromFile !== undefined) {
             throw new UsageError("Pass only one of --from-file or --from-env (or use stdin).", "INVALID_FLAG_VALUE");
         }
-        const MAX_SECRET_BYTES = 5 * 1024 * 1024; // 5 MB
         let value;
         if (fromFile !== undefined) {
             if (!fs.existsSync(fromFile)) {
                 throw new NotFoundError(`File not found: ${fromFile}`, "FILE_NOT_FOUND");
             }
             value = fs.readFileSync(fromFile);
-            if (value.byteLength > MAX_SECRET_BYTES) {
-                throw new UsageError("Secret exceeds the 5 MB limit.");
-            }
         }
         else if (fromEnv !== undefined) {
             const envVal = process.env[fromEnv];
@@ -144,7 +140,7 @@ const secretSetCommand = defineJsonCommand({
             if (process.stdin.isTTY) {
                 process.stderr.write(`Enter value for secret "${name}" (Ctrl-D when done):\n`);
             }
-            const stdinBuf = await readStdin(MAX_SECRET_BYTES, () => new UsageError("Secret exceeds the 5 MB limit."));
+            const stdinBuf = await readStdin();
             // Strip a single trailing newline so `echo "$TOKEN" | akm secret set`
             // stores the token without the shell-added newline. Use --from-file for
             // byte-exact storage of multi-line material (PEM keys, certs).

package/dist/commands/feedback-cli.js

@@ -25,7 +25,6 @@ import { findEntryIdByRef, getEntryFilePathById, getItemRefById, } from "../stor
 import { applyFeedbackToUtilityScore } from "../storage/repositories/index-utility-repository.js";
 // ── Tag validation ────────────────────────────────────────────────────────────
 const TAG_KEY_RE = /^[a-z_][a-z0-9_]*$/;
-const MAX_FEEDBACK_TAGS = 10;
 function validateFeedbackTags(raw) {
     const seen = new Set();
     const out = [];
@@ -43,9 +42,6 @@ function validateFeedbackTags(raw) {
         seen.add(tag);
         out.push(tag);
     }
-    if (out.length > MAX_FEEDBACK_TAGS) {
-        throw new UsageError(`Too many tags: ${out.length}. Maximum is ${MAX_FEEDBACK_TAGS}.`, "INVALID_FLAG_VALUE");
-    }
     return out;
 }
 // ── Lesson strength helper ────────────────────────────────────────────────────

package/dist/commands/health/checks.js

@@ -607,38 +607,6 @@ export const HEALTH_CHECKS = [
             };
         },
     },
-    {
-        name: "semantic-search-runtime",
-        channel: "advisory",
-        run: (ctx) => {
-            const blocked = ctx.semanticStatus?.status === "blocked";
-            // The generic "status: blocked" line is not actionable when the real
-            // problem is a configured remote embedding endpoint that is down while
-            // semanticSearchMode leaves semantic search enabled — every index run
-            // burns time failing against it and searches silently degrade to
-            // keyword-only. Name the endpoint and the two ways out.
-            const remoteReason = ctx.semanticStatus?.reason?.startsWith("remote-") === true;
-            const endpointAdvisory = blocked && remoteReason && ctx.embeddingEndpoint
-                ? `Configured embedding endpoint ${ctx.embeddingEndpoint} is failing ` +
-                    `(${ctx.semanticStatus?.reason}${ctx.semanticStatus?.message ? `: ${ctx.semanticStatus.message}` : ""}) ` +
-                    `while semanticSearchMode is "${ctx.semanticSearchMode ?? "off"}". Searches fall back to keyword-only. ` +
-                    `Restore the endpoint, or set semanticSearchMode to "off" (or remove embedding.endpoint to use the local model).`
-                : undefined;
-            return {
-                name: "semantic-search-runtime",
-                kind: "deterministic",
-                status: !ctx.semanticStatus || !blocked ? "pass" : "warn",
-                confidence: "medium",
-                message: endpointAdvisory ??
-                    (ctx.semanticStatus
-                        ? `Semantic search status: ${ctx.semanticStatus.status}`
-                        : "No semantic-search runtime status recorded yet."),
-                evidence: ctx.semanticStatus
-                    ? { ...ctx.semanticStatus, ...(ctx.embeddingEndpoint ? { embeddingEndpoint: ctx.embeddingEndpoint } : {}) }
-                    : undefined,
-            };
-        },
-    },
     {
         name: "session-extraction",
         channel: "advisory",

package/dist/commands/health/surfaces.js

@@ -14,7 +14,7 @@
  * the stash-exposure pattern. `egress-endpoints` is the one informational
  * (pass-status) entry: it emits whenever any remote endpoint is configured.
  */
-import { MAX_CONFIG_FILE_BYTES, readTextFileWithLimit } from "../../core/common.js";
+import { readTextFile } from "../../core/common.js";
 import { CURRENT_CONFIG_VERSION } from "../../core/config/config-schema.js";
 import { compareConfigVersion } from "../../core/config/config-version.js";
 import { formatRegistryUrl } from "../../core/registry-url.js";
@@ -28,7 +28,7 @@ import { formatRegistryUrl } from "../../core/registry-url.js";
 export function collectConfigSkewAdvisory(configPath) {
     let raw;
     try {
-        raw = JSON.parse(readTextFileWithLimit(configPath, MAX_CONFIG_FILE_BYTES, "Config file"));
+        raw = JSON.parse(readTextFile(configPath, "Config file"));
     }
     catch {
         return undefined;

package/dist/commands/health.js

@@ -13,7 +13,6 @@ import { classifyPathAccess, describeInaccessiblePath } from "../core/path-acces
 import { getConfigPath, getDataDir, getDbPath, getStateDbPathInDataDir } from "../core/paths.js";
 import { listExistingTableNames, openStateDatabase } from "../core/state-db.js";
 import { DURATION_UNITS, parseDuration, parseSinceToIso } from "../core/time.js";
-import { readSemanticStatus } from "../indexer/search/semantic-status.js";
 import { closeDatabase, openReadonlyExistingDatabase } from "../storage/repositories/index-connection.js";
 import { getAllEntries } from "../storage/repositories/index-entries-repository.js";
 import { queryTaskHistory } from "../storage/repositories/task-history-repository.js";
@@ -183,25 +182,20 @@ function gatherStaleTxnJournalsPhase(now) {
     }
 }
 /**
- * Semantic-search status + the config fields the embedding-endpoint and
- * surfaces advisories need. Best-effort: an unloadable config leaves the
- * config-derived fields undefined and callers fall back to generic messages.
+ * Config fields the surfaces advisory needs. Best-effort: an unloadable
+ * config leaves the field undefined and the caller falls back to a generic
+ * message.
  */
-function gatherSemanticConfigPhase() {
-    const semanticStatus = readSemanticStatus();
-    let semanticSearchMode;
-    let embeddingEndpoint;
+function gatherEgressConfigPhase() {
     let egressConfigView;
     try {
         const config = loadConfig();
-        semanticSearchMode = config.semanticSearchMode;
-        embeddingEndpoint = config.embedding?.endpoint;
         egressConfigView = config;
     }
     catch {
         // fall through with undefined
     }
-    return { semanticStatus, semanticSearchMode, embeddingEndpoint, egressConfigView };
+    return { egressConfigView };
 }
 /**
  * Assemble the window's improve-pipeline summary: invoked/completed/skipped
@@ -519,7 +513,7 @@ export function akmHealth(options = {}) {
         const taskHistory = gatherTaskHistoryPhase(db, logsDb, since, stateDbPath, now);
         const { tableNames, missingTables, probe } = taskHistory;
         const staleTxnJournals = gatherStaleTxnJournalsPhase(now);
-        const { semanticStatus, semanticSearchMode, embeddingEndpoint, egressConfigView } = gatherSemanticConfigPhase();
+        const { egressConfigView } = gatherEgressConfigPhase();
         const { improveSummary } = gatherImproveSummaryPhase(db, stateDbPath, since, now);
         advisories.push(...gatherAncillaryAdvisories(db, stateDbPath, since, improveSummary, options, egressConfigView));
         const engineProbes = runHealthEngineProbes();
@@ -542,9 +536,6 @@ export function akmHealth(options = {}) {
             stuckActiveTasks: taskHistory.stuckActiveTasks,
             worstTaskFailRate: taskHistory.worstTaskFailRate,
             staleTxnJournals,
-            semanticStatus,
-            semanticSearchMode,
-            embeddingEndpoint,
             sessionExtraction: improveSummary.sessionExtraction,
             autoAccept: improveSummary.autoAccept,
             engineProbes,

package/dist/commands/improve/autonomy-gate.js

@@ -29,7 +29,7 @@ export function describeGatedLanes(lanes) {
 }
 /** Configured capabilities that tasks doctor reports behind the autonomy gate. */
 export function configuredDirectAutonomyLanes() {
-    return ["memoryCleanup"];
+    return [...DIRECT_AUTONOMY_LANES];
 }
 /**
  * True when a lane may mutate. Used by the lane that bypasses the strategy

package/dist/commands/improve/consolidate.js

@@ -27,6 +27,7 @@ import { findEntryIdByRef, getAllEntries, getEntryById } from "../../storage/rep
 import { getNeighborsByEntryId } from "../../storage/repositories/index-vec-repository.js";
 import { isProposalSkipped, listProposals, listProposalsReadOnly, proposalContent, } from "../proposal/repository.js";
 import { hasSupersededStatus, validateProposalFrontmatter } from "../proposal/validators/proposal-quality-validators.js";
+import { DEFAULT_RANDOM_CLUSTER_FRACTION } from "./anti-collapse.js";
 import { cacheHash } from "./content-hash.js";
 import { resolveImproveLlmExecution } from "./execution.js";
 import { resolveImproveStrategy, resolveProcessEnabled } from "./improve-strategies.js";
@@ -190,14 +191,15 @@ async function clusterMemoriesBySimilarity(memories, config, stateDb, signal) {
         finally {
             embedMs += Date.now() - embedStart;
         }
-        // Upsert newly computed vectors into the cache.
+        // Upsert newly computed vectors into the cache. A skipped document
+        // (embedBatch reports it via `undefined` rather than throwing, #874) has
+        // no vector to cache — omit it rather than writing a bogus embedding.
         if (stateDb && missVecs.length === missTexts.length) {
             try {
-                const toUpsert = missIndices.map((idx, pos) => ({
-                    contentHash: contentHashes[idx],
-                    embedding: missVecs[pos],
-                    modelId,
-                }));
+                const toUpsert = missIndices.flatMap((idx, pos) => {
+                    const embedding = missVecs[pos];
+                    return embedding ? [{ contentHash: contentHashes[idx], embedding, modelId }] : [];
+                });
                 upsertBodyEmbeddings(stateDb, toUpsert);
             }
             catch {
@@ -783,26 +785,23 @@ async function judgeConsolidationChunks(args) {
                 ...(opts.onNotices ? { onNotices: opts.onNotices } : {}),
             });
         };
-        let raw = await callChunkLlm(`chunk ${chunkIdx + 1} failed`);
+        // callChunkLlm already retries once internally (llm/client.ts's
+        // chatCompletion, jittered 200-800ms backoff) — a second, outer retry
+        // here stacked an uncoordinated fixed 2s backoff on top of it. Removed;
+        // only mark the chunk failed once the single retry the client already
+        // performs has been exhausted.
+        const raw = await callChunkLlm(`chunk ${chunkIdx + 1} failed`);
         if (!raw.ok) {
-            // Single retry with 2s backoff before recording chunk as lost.
-            // Recovers transient Shredder LM Studio timeouts without significantly
-            // extending run time. Only marks failed if both attempts fail.
-            await new Promise((r) => setTimeout(r, 2_000));
-            const retry = await callChunkLlm(`chunk ${chunkIdx + 1} retry failed`);
-            if (!retry.ok) {
-                warn(retry.error ?? `chunk ${chunkIdx + 1} failed after retry`);
-                warnings.push(retry.error ?? `chunk ${chunkIdx + 1} failed after retry`);
-                totalChunksProcessed++;
-                accounting.totalChunksFailed++;
-                // Account for the chunk's memories under the failed-chunk bucket.
-                // judgedNoAction does NOT run on this path (it's after the success
-                // guards) so without this the accounting invariant breaks on every
-                // chunk-level transport/parse failure.
-                accounting.failedChunkMemories += chunk.length;
-                continue;
-            }
-            raw = retry;
+            warn(raw.error ?? `chunk ${chunkIdx + 1} failed`);
+            warnings.push(raw.error ?? `chunk ${chunkIdx + 1} failed`);
+            totalChunksProcessed++;
+            accounting.totalChunksFailed++;
+            // Account for the chunk's memories under the failed-chunk bucket.
+            // judgedNoAction does NOT run on this path (it's after the success
+            // guards) so without this the accounting invariant breaks on every
+            // chunk-level transport/parse failure.
+            accounting.failedChunkMemories += chunk.length;
+            continue;
         }
         // C9 action 1: AKM_DEBUG_LLM was a separate, undocumented env var for this
         // one diagnostic; folded into the standard AKM_VERBOSE gate (warnVerbose)
@@ -922,7 +921,7 @@ async function planConsolidation(opts, config, stashDir, _startMs, memories, war
             const antiCollapseForCluster = getImproveProcessConfig("consolidate", opts.improveProfile)?.antiCollapse ??
                 {};
             if (antiCollapseForCluster.enabled !== false && clusteredMemories.length > 2) {
-                const fraction = antiCollapseForCluster.randomClusterFraction ?? 0.05;
+                const fraction = antiCollapseForCluster.randomClusterFraction ?? DEFAULT_RANDOM_CLUSTER_FRACTION;
                 const randomCount = Math.max(1, Math.floor(clusteredMemories.length * fraction));
                 // Pick `randomCount` positions to inject random (un-clustered) members.
                 // Use a seeded-ish shuffle: sort by hash of the name so it's deterministic

package/dist/commands/improve/distill.js

@@ -73,7 +73,7 @@ import { stripFrontmatterBody as stripBodyForFidelity } from "./content-hash.js"
 import { autoRepairLessonFrontmatter, autoSwapDescriptionWhenToUse, collectLessonQualityFindings, repairLessonDescriptionTruncation, } from "./distill/content-repair.js";
 import { memoryKnowledgePromotionRequiresDispatch, planMemoryKnowledgePromotion, promoteMemoryToKnowledge, } from "./distill/promote-memory.js";
 import { fetchTopSimilarLessons, persistOutputEncodingSalience, runLessonQualityJudge, writeQualityRejection, } from "./distill/quality-gate.js";
-import { buildClsContext, checkDistillFidelity } from "./distill-guards.js";
+import { buildClsContext, checkDistillFidelity, DEFAULT_CLS_ADJACENT_COUNT } from "./distill-guards.js";
 import { deriveKnowledgeRef } from "./distill-promotion-policy.js";
 import { buildRefVocabulary, scoreEncodingSalience } from "./encoding-salience.js";
 import { resolveImproveLlmExecution } from "./execution.js";
@@ -1239,7 +1239,7 @@ async function buildDistillMessages(args) {
     let clsContext = "";
     if (clsConfig.enabled) {
         try {
-            const adjacentCount = clsConfig.adjacentCount ?? 3;
+            const adjacentCount = clsConfig.adjacentCount ?? DEFAULT_CLS_ADJACENT_COUNT;
             // Use the asset content or input ref as the query for adjacent retrieval.
             const clsQuery = assetContent ? assetContent.slice(0, 500) : inputRef;
             const adjacentItems = await fetchSimilarLessonsFn(clsQuery, adjacentCount);

package/dist/commands/improve/extract.js

@@ -44,6 +44,7 @@ import { indexWrittenAssets } from "../../indexer/index-written-assets.js";
 import { disposeLoweredExecutionDispatchLease, } from "../../integrations/agent/execution-lowering.js";
 import { getAvailableHarnesses } from "../../integrations/session-logs/index.js";
 import { preFilterSession } from "../../integrations/session-logs/pre-filter.js";
+import { isJsonSchemaKnownUnsupported } from "../../llm/client.js";
 import { callStructured, preflightStructuredLlmRunner } from "../../llm/structured-call.js";
 import { sha256Hex } from "../../runtime.js";
 import { getExtractedSessionsMap, getLastExtractRunAt, shouldSkipAlreadyExtractedSession, upsertExtractedSession, } from "../../storage/repositories/extract-sessions-repository.js";
@@ -563,7 +564,13 @@ async function runSessionExtractionLlmCall(args) {
                 return payload.parseFailure ? undefined : payload;
             },
             validate: (payload) => ({ ok: true, value: payload }),
-            maxAttempts: llmRunner.connection.supportsJsonSchema === true ? 1 : 2,
+            // One attempt when structured output is expected to work (not explicitly
+            // disabled, and this connection hasn't already proven otherwise this
+            // process — see `isJsonSchemaKnownUnsupported`); two when it's known
+            // unsupported and extraction is relying on looser prompt-contract JSON.
+            maxAttempts: llmRunner.connection.supportsJsonSchema !== false && !isJsonSchemaKnownUnsupported(llmRunner.connection)
+                ? 1
+                : 2,
             buildFeedback: () => "Your previous response did not contain a valid extraction payload. Respond with ONLY a JSON object matching the requested schema, with a candidates array and no prose or code fences.",
         });
         if (result.ok)

package/dist/commands/improve/improve.js

@@ -35,7 +35,7 @@ import { akmDistill } from "./distill.js";
 import { buildLatestProposalTsMap, collectEligibleRefs, collectEligibleRefsReadOnly, memoryCleanupParentRef, resolveImproveScope, shouldAnalyzeMemoryCleanup, } from "./eligibility.js";
 import { countEvalCases } from "./eval-cases.js";
 import { resolveImprovePlan, resolveImproveStrategy } from "./improve-strategies.js";
-import { improveLockPath, MIN_IMPROVE_LOCK_STALE_MS, releaseImproveLock, tryAcquireImproveLock } from "./locks.js";
+import { improveLockPath, releaseImproveLock, tryAcquireImproveLock } from "./locks.js";
 // The cycle loop / post-loop / maintenance stages live in ./loop-stages.
 import { runImproveLoopStage, runImprovePostLoopStage } from "./loop-stages.js";
 import { analyzeMemoryCleanup } from "./memory/memory-improve.js";
@@ -115,7 +115,7 @@ function createRunWriteJournal() {
 export async function akmImprove(options = {}) {
     const setup = resolveImproveRunSetup(options);
     options = setup.options;
-    const { budgetMs, budgetAbortController, scope, selectedStrategy, syncRepoDir, resolvedStateDbPath, resolvedLockPath, lockStaleAfterMs, } = setup;
+    const { budgetMs, budgetAbortController, scope, selectedStrategy, syncRepoDir, resolvedStateDbPath, resolvedLockPath, } = setup;
     let clearBudgetTimer = () => { };
     let initialGitPaths = new Set();
     const runJournal = createRunWriteJournal();
@@ -164,7 +164,7 @@ export async function akmImprove(options = {}) {
     }
     try {
         if (!options.dryRun) {
-            const acquisition = tryAcquireImproveLock(resolvedLockPath, lockStaleAfterMs, options.skipIfLocked, {
+            const acquisition = tryAcquireImproveLock(resolvedLockPath, options.skipIfLocked, {
                 // R25: C2 boundary-pinned path — the long-lived handle doesn't exist yet.
                 dbPath: resolvedStateDbPath,
             });
@@ -484,7 +484,6 @@ function resolveImproveRunSetup(options) {
     // triage, indexing, proposal work, maintenance, and final stash sync.
     const lockBaseDir = primaryStashDir ? path.join(primaryStashDir, ".akm") : path.join(options.stashDir ?? ".", ".akm");
     const resolvedLockPath = improveLockPath(lockBaseDir);
-    const lockStaleAfterMs = Math.max(MIN_IMPROVE_LOCK_STALE_MS, budgetMs + 10 * 60 * 1000);
     const effectiveSync = { ...improveProfile.sync, ...options.sync };
     return {
         startMs,
@@ -514,7 +513,6 @@ function resolveImproveRunSetup(options) {
         syncRepoDir,
         resolvedStateDbPath,
         resolvedLockPath,
-        lockStaleAfterMs,
         effectiveSync,
     };
 }

package/dist/commands/improve/locks.js

@@ -9,13 +9,12 @@ import { createLockPayload, probeLock, reclaimStaleLock, releaseLock, tryAcquire
 import { tryWithMaintenanceStartBarrier, withMaintenanceStartBarrier } from "../../core/maintenance-barrier.js";
 import { describeInaccessiblePath } from "../../core/path-access.js";
 import { warn } from "../../core/warn.js";
-export const MIN_IMPROVE_LOCK_STALE_MS = 4 * 60 * 60 * 1000;
 export function improveLockPath(lockBaseDir) {
     return path.join(lockBaseDir, "improve.lock");
 }
-export function tryAcquireImproveLock(lockPath, staleAfterMs, skipIfLocked, eventsCtx) {
+export function tryAcquireImproveLock(lockPath, skipIfLocked, eventsCtx) {
     let recoveryEvent;
-    const acquire = () => tryAcquireImproveLockUnlocked(lockPath, staleAfterMs, skipIfLocked, (event) => {
+    const acquire = () => tryAcquireImproveLockUnlocked(lockPath, skipIfLocked, (event) => {
         recoveryEvent = event;
     });
     const result = skipIfLocked ? tryWithMaintenanceStartBarrier(acquire) : withMaintenanceStartBarrier(acquire);
@@ -37,14 +36,23 @@ export function tryAcquireImproveLock(lockPath, staleAfterMs, skipIfLocked, even
     }
     return result;
 }
-function tryAcquireImproveLockUnlocked(lockPath, staleAfterMs, skipIfLocked, onRecovered) {
+function tryAcquireImproveLockUnlocked(lockPath, skipIfLocked, onRecovered) {
     fs.mkdirSync(path.dirname(lockPath), { recursive: true });
     const lockPayload = () => createLockPayload({ startedAt: new Date().toISOString() });
     let ownership = tryAcquireLockSync(lockPath, lockPayload());
     if (ownership) {
         return { state: "acquired", ownership };
     }
-    const probe = probeLock(lockPath, { staleAfterMs });
+    // No `staleAfterMs`: only a verifiably dead holder is ever reclaimed. A
+    // wedged-but-alive `akm improve` (SQLite WAL + busy_timeout + BEGIN
+    // IMMEDIATE already serialize concurrent writes to state.db at the
+    // correctness layer, so this lock only avoids duplicate LOGICAL work) must
+    // not have its lease silently taken away purely because a clock elapsed —
+    // that was the #872-shaped hazard here: a live holder passed the
+    // PID-liveness check forever, so only a multi-hour age window could ever
+    // free it, stranding every `akm improve --skip-if-locked` invocation for
+    // up to that long while reporting success.
+    const probe = probeLock(lockPath);
     // Race: the holder released the lock between our failed `tryAcquireLockSync`
     // and this probe, so the probe sees no file (`absent`). Retry acquisition once
     // rather than falling through to the contended skip/throw below — otherwise we

package/dist/commands/improve/loop-stages.js

@@ -13,7 +13,6 @@ import { getDbPath } from "../../core/paths.js";
 import { withStateDb } from "../../core/state-db.js";
 import { info } from "../../core/warn.js";
 import { DEFAULT_GRAPH_EXTRACTION_INCLUDE_TYPES, runGraphExtractionPass, } from "../../indexer/graph/graph-extraction.js";
-import { withIndexWriterLease } from "../../indexer/index-writer-lock.js";
 import { deriveWritableBundleIds } from "../../indexer/installations.js";
 import { collectPendingMemories, runMemoryInferencePass, } from "../../indexer/passes/memory-inference.js";
 import { resolveSourceEntries } from "../../indexer/search/search-source.js";
@@ -679,13 +678,13 @@ export async function runImproveMaintenancePasses(args) {
         graphExtractionFn,
         reindexWithIndexDbReleased,
     };
-    const collected = await withIndexWriterLease({ purpose: "improve-maintenance", signal: budgetSignal }, () => runMaintenancePassesUnderLease(ctx, dbCell, {
+    const collected = await runMaintenancePassesUnderLease(ctx, dbCell, {
         actionableRefs: args.actionableRefs,
         memoryRefsForInference,
         consolidationRan: args.consolidationRan,
         allWarnings,
         openIndexDb,
-    }));
+    });
     return {
         ...(collected.memoryInference ? { memoryInference: collected.memoryInference } : {}),
         ...(collected.graphExtraction ? { graphExtraction: collected.graphExtraction } : {}),
@@ -697,12 +696,12 @@ export async function runImproveMaintenancePasses(args) {
     };
 }
 /**
- * The maintenance sequence run under the index-writer lease (formerly the
- * ~389-line anonymous `withIndexWriterLease` callback): memory inference →
- * reindex-after-inference → graph extraction → proposal hygiene (orphan purge,
- * expiration) → retention purges. Each pass returns its results and warnings;
- * this orchestrator folds warnings into the caller's `allWarnings` sink at the
- * same points the inline code pushed them.
+ * The maintenance sequence (formerly the ~389-line anonymous
+ * `withIndexWriterLease` callback, before #872 removed the index-rebuild
+ * lease): memory inference → reindex-after-inference → graph extraction →
+ * proposal hygiene (orphan purge, expiration) → retention purges. Each pass
+ * returns its results and warnings; this orchestrator folds warnings into the
+ * caller's `allWarnings` sink at the same points the inline code pushed them.
  */
 async function runMaintenancePassesUnderLease(ctx, dbCell, args) {
     const { allWarnings } = args;

package/dist/commands/improve/memory/memory-contradiction-detect.js

@@ -14,7 +14,7 @@
  * # Algorithm
  *
  *   1. Collect all derived memories grouped by `parentRef` family.
- *   2. For each family, enumerate candidate pairs (limited to MAX_FAMILY_SIZE).
+ *   2. For each family, enumerate candidate pairs.
  *   3. For each pair, call the LLM to judge whether the two memories are in
  *      direct factual conflict.
  *   4. For confirmed contradictions, write `contradictedBy` edges directly to
@@ -43,16 +43,6 @@ import { callStructured, preflightStructuredLlmRunner } from "../../../llm/struc
 import { resolveImproveLlmExecution } from "../execution.js";
 import { isDerivedMemory, memoryIdentityRef, resolveParentRef } from "./derived-ref.js";
 // ── Constants ────────────────────────────────────────────────────────────────
-/**
- * Maximum family size for pairwise contradiction checking. Families larger
- * than this are skipped to bound the LLM call count (O(n²) pairs).
- */
-const MAX_FAMILY_SIZE = 8;
-/**
- * Maximum number of contradiction pairs to check per improve run, across all
- * families. Prevents runaway LLM usage on stashes with many memories.
- */
-const MAX_PAIRS_PER_RUN = 20;
 /**
  * Minimum confidence required to write a contradiction edge. Below this
  * threshold the LLM may be flagging topic-overlap rather than genuine logical
@@ -218,15 +208,9 @@ export async function detectAndWriteContradictions(stashDir, config, chat, strat
     for (const [, family] of byParent) {
         if (family.length < 2)
             continue;
-        if (family.length > MAX_FAMILY_SIZE) {
-            result.warnings.push(`Skipping contradiction check for family of ${family.length} members (exceeds MAX_FAMILY_SIZE=${MAX_FAMILY_SIZE})`);
-            continue;
-        }
         result.familiesExamined++;
         for (let i = 0; i < family.length - 1; i++) {
             for (let j = i + 1; j < family.length; j++) {
-                if (candidatePairs.length >= MAX_PAIRS_PER_RUN)
-                    break;
                 const a = family[i];
                 const b = family[j];
                 if (!a || !b)
@@ -245,8 +229,6 @@ export async function detectAndWriteContradictions(stashDir, config, chat, strat
                     continue;
                 candidatePairs.push({ a, b, loser, winnerRef });
             }
-            if (candidatePairs.length >= MAX_PAIRS_PER_RUN)
-                break;
         }
     }
     if (candidatePairs.length === 0) {

package/dist/commands/improve/outcome-loop.js

@@ -9,12 +9,6 @@ import { getAllAssetOutcomes, getAssetOutcome, getOutcomeScoresByRef, upsertAsse
  * At α = 0.3 the window is ≈ 3 cycles.
  */
 export const OUTCOME_EMA_ALPHA = 0.3;
-/**
- * Maximum K improve cycles for the eligibility-trace window. Retrievals older
- * than K cycles contribute via the EMA decay naturally (they are already baked
- * into `expected_retrieval_rate`).
- */
-export const OUTCOME_TRACE_CYCLES = 5;
 /**
  * Warm-start cap: the maximum `outcome_score` a brand-new row can be seeded with
  * (from the utility EMA). Prevents a `[0,1]`-range utility value from generating