akm-cli 0.9.6 → 0.9.8-beta.1

package/CHANGELOG.md

@@ -4,6 +4,414 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [0.9.8-beta.1] - 2026-09-01
+
+A cleanup and stabilization release: deletion of machinery that policed the
+codebase's shape rather than its behaviour, and — because auditing for that
+machinery meant reading the code closely — a run of real defects it had been
+sitting on top of.
+
+Two security holes, two search-correctness bugs, a locale-dependent hash, a
+deletion shield that failed open, and sixteen places that answered a failure
+with a confident wrong answer instead of an error.
+
+### Fixed
+
+- **Historical state migrations are reachable where akm cannot reinstall
+  itself** (#895). A migration flagged `historical-destructive` is refused
+  during an ordinary open — it needs a verified safety copy, taken under the
+  migration writer lock, so an unattended `akm index` can never quietly drop
+  operator state. That guard is correct and unchanged. Its *remedy* was not:
+  the only code path that admitted the migration ran as a post-install step of
+  `akm upgrade`, behind an npm install. Where akm is installed globally by a
+  container image and the runtime user is unprivileged, that install fails
+  `EACCES` and throws long before the migration is reached, so `akm index
+  --full` was blocked with no supported way out — and the two obvious
+  workarounds are both wrong (upgrading as root installs a *newer* akm than the
+  image ships, which `config-version-shim` then fails closed against; deleting
+  `state.db` destroys task history, proposals, and lessons metadata, none of
+  which is derived). New `akm upgrade --state-only` applies pending state
+  migrations and installs nothing. Nothing about the migration needed the
+  network, root, or a new binary; coupling it to one was the bug. The safety
+  copy is still taken — this changes who may request the migration, not what it
+  does.
+
+- **Two security holes closed.** A failed `git ls-remote` made
+  `verifyClonedRevision` a no-op, silently skipping the R-011 post-clone
+  revision-integrity check — the guard against a compromised mirror — so any
+  network blip disabled it without a word. And `scanExtractedFiles`, the
+  post-extraction TOCTOU path-traversal rescan, returned silently when a
+  directory could not be read: it passed clean in exactly the race it exists
+  to catch. Both now fail loudly.
+
+- **`akm curate --type` ignored the type filter.** A set `--type` bypassed
+  `selectCuratedStashHits` entirely and did a raw slice of the hits as
+  received, which neither filtered by type nor ranked by score — so
+  `--type command` could return a skill, in arbitrary order. It now narrows
+  the candidate pool and runs the full curation pipeline over it. The test
+  that should have caught this passed by accident, because the off-type hit
+  happened to sit past the result limit.
+
+- **Curate silently dropped relevant results.** An undocumented floor excluded
+  any hit scoring below `max(0.35, leader * 0.7)`. Measured against a real
+  3,265-memory bundle, one query went from one result to four once it was
+  removed — the suppressed hits were the ones actually matching. Ordering is
+  unchanged: results were already sorted before the floor ran, so it could
+  only ever hide the tail.
+
+- **A bundle-audit hash depended on the machine's locale.** `canonicalJson`
+  in `installed-stashes.ts` sorted keys with `localeCompare` — ICU-dependent —
+  and fed the result to `sha256Hex`, so the same object could hash differently
+  on two machines. Now codepoint order, matching the other implementations.
+
+- **A deletion shield failed open.** `isHotCapturedMemory` returned false when
+  it could not read or parse a memory, marking exactly the memories it failed
+  to inspect as fair game for consolidate to merge or delete. It now fails
+  closed.
+
+- **Sixteen places returned a confident wrong answer instead of an error.**
+  The pattern (#791) recurred across search, graph, indexing, and scheduling:
+  a corrupt or locked index reported "no matches"; a failed inline rebuild
+  surfaced as "Index is empty. Run 'akm index'" at exit 0; `akm show` reported
+  "0 related files" for an unreadable index; a DB failure in
+  `listProposalsReadOnly` returned `[]`, so dedup could not tell "no prior
+  proposal" from "database unreadable" and could re-mint an already-rejected
+  one; a permission fault on the bundle directory told the user to run
+  `akm bundle create`; and `launchd`'s `list()` returned `[]` when the
+  LaunchAgents directory could not be read, so task reconciliation concluded
+  there was nothing to manage. In each case the failure now surfaces.
+
+- **Drifted copies of shared helpers.** `asNonEmptyString` trimmed in two
+  places and not in four others, so a whitespace-only session id decoded to
+  `" "` in some subsystems and `undefined` in others. `isPlainObject` had two
+  incompatible definitions under one name; the loose form would accept a
+  `Date` or class instance as a plain record. Both consolidated, along with
+  `toPosix` (15 copies, whose "avoid an import cycle" justification was false
+  in every case), `isRecord` (11), `compareCodePoints` (8), and five more
+  families.
+
+- **Pruning a memory no longer leaves dangling belief edges (#885).**
+  `writeContradictEdge` — the hardened, test-covered `contradictedBy` writer —
+  had no production caller; its docstring named three that did not exist. The
+  live pass used a private near-copy that had drifted on exactly the two
+  behaviours the original was hardened for: it read the key with
+  `Array.isArray` only, so a SCALAR edge (live data the indexer accepts and
+  lint never flags) read as "no edges" and was overwritten out of existence;
+  and it set `beliefState: "contradicted"` unconditionally, promoting an
+  `archived` memory back up the ranking. The tests for both behaviours were
+  guarding dead code. The copy is gone.
+
+  `persistBeliefStateTransition` is deliberately NOT routed through the shared
+  primitive: it is a state-transition writer that replaces the edge list
+  wholesale and can clear it, which an append-only, never-weaken primitive
+  cannot express.
+
+- **`git worktree` operations no longer fail on a busy machine (#891).** The
+  module's internal `GIT_TIMEOUT_MS` was a flat 30s with no margin, so a
+  healthy `git worktree remove` on a loaded host returned
+  `{ removed: false, error: "timed out after 30000ms" }`. Anyone running a
+  workflow with `isolation: worktree` alongside other git activity could hit
+  spurious create failures, or have a clean worktree wrongly retained as
+  unremovable. Raised to 120s, matching the existing `GIT_PUSH_TIMEOUT_MS`
+  precedent. Note `scripts/test-integration.sh` had already raised *bun's*
+  per-test timeout for this reason, but that never touched the production
+  subprocess timeout, which fires first.
+
+- **`akm health`'s dead-link check no longer reports an unearned all-clear
+  (#892).** `checkDeadUrls` capped at 20 URLs across the whole bundle, plus an
+  undocumented `slice(0, 3)` per entry, then the caller logged "URL check
+  complete (0 dead)". A bundle with thousands of links got a clean bill of
+  health after twenty were examined. Both caps removed; every URL is checked
+  and a failed request surfaces instead of being swallowed.
+
+- **`akm lint --fix` no longer breaks on gitignored drafts (#887).** The doc
+  linter walked `docs/` with no gitignore awareness, so unpublished drafts
+  under `docs/.pending/` were held to the published-docs contract —
+  `bun run lint` failed locally while CI, which never has those files, stayed
+  green.
+
+### Changed
+
+- **Search no longer truncates long queries (#892).** `MAX_LEXICAL_QUERY_TOKENS
+  = 16` silently dropped every token past the sixteenth, and tokens are
+  collected in order, so the discarded half was the tail — for
+  natural-language input, usually where the discriminating words are. It also
+  fed ranking, so token-overlap scoring ran on the truncated set too. It was
+  unexplained in the code and in the commit that introduced it, and unreachable
+  from any flag, config key, or environment variable. Removed: the planner
+  handles 10,000 tokens in 9ms, so no performance cliff was being protected.
+
+- **Content and memory bodies are no longer silently truncated.**
+  `MAX_CONTENT_CHARS` (100k, duplicated across 8 adapters) cut indexed content
+  so the tail of a long document was unsearchable; `MAX_BODY_CHARS` (4000) cut
+  the text sent for memory inference, so on a large-context engine the model
+  saw a fraction of the input while the derived memory looked complete. Both
+  removed.
+
+- **GitHub Actions are pinned to commit SHAs (#768).** All 29 `uses:` steps
+  across every workflow, with the tag preserved in a trailing comment.
+
+- **Gated CI runs on schedule, dispatch, and candidate tags only.** The
+  `detect-changes` job that selected suites by regex-matching a PR diff is
+  gone — its path patterns had gone stale and still named test files this
+  release moved or deleted, so it was silently under-selecting suites. Release
+  evidence is unchanged; the checklist always required an exact-SHA dispatch.
+
+- **`akm-eval` in CI is now a determinism check only.** Its score gates are
+  removed. Measured before cutting: the baseline scored a perfect 1.0 against
+  a 0.75 gate, and seven of nine case types never ran — CI has no LLM and no
+  run history, so everything the eval exists to measure was skipped while the
+  job reported green. The harness itself is unchanged and remains a genuine
+  quality signal when run against a real bundle.
+
+### Removed
+
+- **`akm health --clean-dead-residue` and every other compensating shim.**
+  A special-purpose flag on `health` that deleted files existed because
+  migrations had not finished their own job. Removing a superseded layout IS
+  migration, so `akm migrate status` now reports it and `akm migrate apply`
+  removes it. Four more of the same class went the same way: the D8
+  `task_history` vocabulary is rewritten once by a state migration instead of
+  re-decided at three read sites; the legacy `extraParams` config lift happens
+  once in `migrate apply` instead of silently on every load forever (an
+  unmigrated config now fails closed, naming the command to run); retired
+  `type:slug` xrefs are rewritten by `lint --fix`; and stale transaction
+  journals are recovered by `migrate apply` rather than reported by an
+  advisory that pointed at documentation while the recovery function it needed
+  sat with zero callers.
+
+- **Dead code with no consumers.** An empty `{}` type threaded through two
+  functions as a parameter neither read, with a `{}` placeholder at the call
+  site; unused helpers, imports, and parameters throughout.
+
+- **14 architecture ratchets, 15 golden/snapshot suites, 12 characterization
+  suites.** Function-size and import-cycle ratchets that failed on refactors
+  harming nothing; byte-for-byte snapshots "fixed" by regenerating; tests that
+  pinned "what the code does today" by definition.
+- **11 of 14 lint scripts (-3,988 lines).** `lint-tests-isolation` alone was
+  717 lines standing in front of `src/core/paths.ts`, which already throws
+  `TEST_ISOLATION_MISSING` at runtime. Also removed: the `gen-config-schema
+  --check` gate (`build` regenerates the schema anyway, so what ships is always
+  current), and `lint-devto-posts` (322 lines that were wired to nothing and
+  duplicated checks `devto-cli` performs itself). The three kept catch
+  user-visible problems: secrets must route through the resolver, no dead refs
+  in shipped assets, no docs teaching commands that do not exist.
+- **Both `MIN_TESTS` floors** — arbitrary numbers whose only job was to fail
+  the suite when test count dropped.
+- **`release-workflow-syntax.yml`** — a workflow that ran actionlint over the
+  other workflows. A broken workflow file already fails at GitHub.
+- **Dead `$STASH/.akm` residue is now reportable (#889).** `akm health` gains a
+  read-only `stash-dead-residue` advisory naming each stale path and its size;
+  deletion is gated behind an explicit `akm health --clean-dead-residue`. On a
+  real bundle 82% of `.akm` (135 MB) was pre-0.9.0 leftovers no code reads.
+
+### Testing
+
+- Test isolation grandfather list drained 58 -> 2 (#785); the two retained
+  entries are the helper-definitions file and a meta-test of the guard itself.
+- The test tree now has a stated unit/integration rule and ~250 files were
+  reclassified by evidence — real DB, network, or process spawn — rather than
+  by filename (#786).
+- 31 status-only `not.toBe(0)` assertions replaced with exact exit codes and
+  machine-readable error codes, every value observed rather than inferred
+  (#787).
+- Near-duplicate clusters drained (#788); real-server timing flakes removed or
+  made deterministic (#789).
+- Kept deliberately: `registry-network-boundary.test.ts`, which enforces that
+  only `pinned-transport.ts` may import `node:http`/`node:https` — the control
+  that stops a raw request bypassing address-pinned fetching. No lint script
+  covers that boundary.
+
+## [0.9.7] - 2026-08-31
+
+### Added
+
+- **`akm curate --pack <tokens>` (#746).** Packs the ranked stash hits' full
+  content into a single token-budgeted blob instead of returning refs the
+  caller has to follow up on with N separate `akm show` calls. Content is
+  resolved through the same path `akm show` uses, so a `ref#fragment` hit
+  packs just that section. Drops whole assets from the tail of the ranked
+  list first; only a single highest-rank hit that alone exceeds the budget
+  is truncated. Registry hits are never packed — that separation stays
+  opt-in and there is no flag to override it. Named `--pack` rather than
+  `--budget` because the workflow asset schema already uses `budget` for
+  run-cost caps.
+
+- **`llms.txt`-aware website ingestion (#749).** `akm bundle add` against an
+  origin root now probes `<origin>/llms.txt` first and, when present, uses
+  that author-curated link list as the crawl frontier instead of discovering
+  links by parsing HTML. Each linked page still flows through the same
+  robots-compliant, host-guarded, content-extracting fetch as before, so
+  ingested pages stay individually addressable. Off-origin manifest entries
+  are dropped. The probe is restricted to origin-root URLs, so adding a
+  specific page still fetches that page. Sites without the file fall through
+  to the existing crawler unchanged. `llms-full.txt` is deliberately not
+  read: its `## <path>` separators are ambiguous against real page content.
+
+### Changed
+
+- **The improve-strategy presets were reviewed as a set (#878).** The
+  investigation first believed `thorough` silently ran without validation;
+  that was wrong — every strategy deep-merges onto `default` before
+  resolving, so the old asset behaved correctly. What was real: `thorough`
+  was the only preset of ten relying on that invisible inheritance instead
+  of an explicit process matrix, and its triage used `applyMode: "queue"`
+  while its description promised to "drain the backlog" — queue mode never
+  promotes, so nothing drained. `catchup` had the same inertness:
+  `maxAcceptsPerRun: 100` under queue mode, a key the promote loop never
+  reads.
+
+  Both now use the same judged-promotion pattern as `reflect-distill` and
+  `proactive-maintenance`: `applyMode: "promote"`, `judgment: true`, a
+  per-run accept cap (`thorough` 25, `catchup` 100), and `maxDiffLines:
+  200`. The autonomy gate demotes promote back to queue unless
+  `experimental.improveAutonomy` is enabled, so by default both still
+  review-only; with autonomy on, they actually drain. `thorough` now
+  carries default's full explicit matrix, and a regression test pins
+  "everything default enables, thorough enables identically, plus triage."
+
+### Fixed
+
+- **Pruning a memory no longer leaves dangling belief edges (#884).**
+  `analyzeMemoryCleanup` archives a pruned memory rather than deleting it —
+  the file moves under `.akm/memory-cleanup/archive/` beside a `cleanup.md`
+  audit record naming its `ref` and `originalPath`. Ref resolution only ever
+  looked at the memory's original location, so once #882 made
+  `contradictedBy`/`supersededBy` validatable, every memory pointing at a
+  pruned one began reporting `missing-ref`. `refExistsInAnyStash` now resolves
+  the archive tombstone, so a belief edge to an archived memory is satisfied
+  instead of dangling. Existence only: `resolveRefPathInStash` still ignores
+  the archive, because it returns a path callers mutate (`--supersedes`
+  demotion) and an archived file must never be written to. The contradiction
+  an edge records is preserved rather than erased, which a bare edge-scrub
+  would have destroyed.
+
+  A ref whose target has neither a file nor a tombstone was removed by
+  something other than prune — a hand `git rm`, or a pre-fix release — and is
+  genuinely dangling. Clearing those deletes user assertions, so it is opt-in
+  behind `akm lint --prune-dangling-edges` and is deliberately NOT folded into
+  `--fix`: every other auto-fix repairs a malformed file, whereas this one
+  edits well-formed files to drop a claim about the belief graph. The repair
+  is scoped to the `supersededBy`/`contradictedBy` channels — a stale `xrefs`
+  entry is an ordinary broken link that the author may want to re-target, not
+  delete — and preserves comments, key order, and surviving list entries. It
+  clears the same `writable: false` gate `--fix` does.
+
+  Known limitation: if a memory's only edge on a channel is dropped, a
+  `beliefState:` naming that channel is left without a supporting edge.
+  Choosing a demotion target is a belief-semantics decision this fix does not
+  make. No occurrences existed in the stash that surfaced #884.
+
+- **A corrupt `index.db` now rebuilds instead of failing the command
+  (#865).** `src/core/state-db.ts` documented that "a corrupt index is
+  recovered by deleting it and re-running `akm index`" — that recovery was
+  never implemented. Real on-disk corruption surfaced a raw `SQLITE_CORRUPT`
+  and exited 70, and the existing inline-reindex fallback could not help
+  because it reopened the same corrupt file. `openIndexDatabase` now detects
+  corruption, removes the file and its `-wal`/`-shm` sidecars, and retries
+  the open once. Scoped to `index.db`, which is fully regenerable from the
+  stash; `state.db` is never touched.
+
+- **`akm task sync` accepts an immutable package-local install (#868).** An
+  image-baked akm pinned at a path outside the npm global root was refused
+  outright, and `--rebind` then warned on every sync that the pinned binary
+  was "mutable, unproven" — the opposite of true, training operators to
+  ignore a recurring warning. The npm-global check was only ever a proxy for
+  "this binary won't change out from under the scheduler"; that property is
+  now tested directly, so a launcher this process cannot write to (a
+  read-only mount) is eligible without `--rebind` and without the warning.
+  Writable `npx`/project-`node_modules` installs remain ineligible, which is
+  the case the original check existed for. No new config knob.
+
+- **`TASK_SCHEMA_VERSION_UNSUPPORTED` names the actual blocker (#869).** For
+  a v2/v3 file the message is only reached after the read-time shim has
+  already tried and failed to convert it — meaning a human decision is
+  required — yet it pointed at `akm migrate apply`, which would report the
+  identical block for that same file. The blocked `reason`/`detail` were
+  already computed and then discarded; they are now surfaced, so the error
+  names the specific reason (e.g.
+  `shell-command-resolution-changes-v2-literal-argv-semantics`) and says a
+  decision is needed rather than sending the operator to a command that
+  cannot help.
+
+  Also verified as already fixed and left alone: cross-bundle scoping (a
+  blocked file in one bundle does not prevent conversion in another —
+  resolved by #866) and `env`-prefixed command conversion (resolved by
+  #867).
+
+- **`akm task sync` no longer dead-ends on pre-0.9.2 crontab rows (#881).**
+  Rows written by v0.9.0/v0.9.1 carry no `--scheduler-context` marker, so
+  `extractCronInvocation` could not parse them. Sync therefore saw the task
+  as absent, tried to install it, and collided with the row that was still
+  physically present — permanently blocking sync for every task on any
+  install upgrading past v0.9.2. Such a row is now recognized and
+  reconciled. The fallback fires only when the marker is entirely absent
+  and only inside akm's own `# akm:task … BEGIN/END` sentinels, so a row
+  carrying the marker that fails to parse for any other reason is never
+  reinterpreted, and no ownership or cardinality assertion changed.
+
+- **`akm lint` validates `type:slug` xrefs instead of silently skipping
+  them (#882).** `typeNameFromConceptId` returns `undefined` for the colon
+  grammar, so `classifyConceptRef` treated those refs as "not a local ref"
+  and dropped them before validation — roughly half the xref channel on a
+  real corpus. Zero `missing-ref` findings read as "every reference is
+  healthy" when half had never been examined. akm still writes this
+  grammar today (`memory-contradiction-detect.ts` emits `contradictedBy:`
+  as `memory:<name>`), so it is a live channel, not legacy residue; it is
+  now accepted as a fallback in lint only, leaving the parser and write
+  paths on the single conceptId grammar.
+
+- **Refs to derived memories resolve (#882).** `assetPathCandidatesForName`
+  only ever offered `<name>.md`, so any ref to a memory stored as
+  `<name>.derived.md` failed to resolve — affecting the conceptId grammar
+  equally, and invisible until the above fix made these refs validatable.
+  `.derived` is a provenance marker on the same identity, not part of the
+  name, so `<name>.derived.md` is now a secondary candidate with plain
+  `<name>.md` still taking precedence when both exist. Fixed at the
+  resolution primitive, so write-time `--xref`/`--supersedes` validation
+  benefits as well.
+
+### Removed
+
+- **The `frequent` and `memory-focus` improve strategies.** Zero recorded
+  invocations, and both were mid-points of other presets (`frequent` ≈
+  `reflect-distill` without distill or triage; `memory-focus` a subset of
+  `frequent`). The shipped hourly task template now uses `reflect-distill`
+  — matching what real deployments had already switched to by hand. Any
+  removed combination remains expressible via `improve.strategies` in
+  config. One caveat: a user-config strategy *named* `frequent` or
+  `memory-focus` previously merged over the built-in of the same name; it
+  now merges over `default` only, so a partial override that relied on the
+  built-in's values will resolve differently and should be made explicit.
+
+### Testing
+
+- **The previous-release corpus covers more than task sources (#880).**
+  Added fixtures for the synthesized `AKM_BUNDLE_DIR` duplicate-`stash`
+  bundle shape that caused #870, the retired 0.8 `stashDir`/`sources[]`/
+  `installed[]` config keys, and a downstream consumer's `config.json` plus
+  four task-source-v4 files. The 0.8 fixture deliberately asserts the
+  opposite of the others: those keys are hard-rejected by design, so it
+  guards that the rejection stays loud and actionable rather than silently
+  loading. Every fixture was proven to catch a regression by breaking the
+  guarantee, observing the failure, and reverting.
+
+- Pinned current handling of truncated LLM responses (`finishReason:
+  "length"`) as a regression test (#865). No distinct classification or
+  retry was added: the underlying truncation was already resolved by
+  `reasoningEffort`, and threading the finish reason through four layers to
+  earn one diagnostic label was not justified.
+
+### Not shipped
+
+- **Orphan-asset detection for `akm health` (#750)** was implemented and
+  then backed out after measurement. Against a live 23,859-entry index it
+  flagged 16,609 of 16,615 in-scope assets (99.96%) and took 135 s. The
+  corpus is not densely cross-linked — 1,591 distinct xref tokens exist in
+  total — so the check has no signal to give. The broken-ref half of #750
+  had already shipped previously. Moved to Backlog; see #882 for the
+  resolver defect the investigation exposed.
+
 ## [0.9.6] - 2026-08-31
 
 The deletion release: **net −2,100 lines**, almost all of it machinery that

package/dist/assets/hints/cli-hints-full.md

@@ -245,8 +245,8 @@ akm improve --no-push                         # commit but skip push for this ru
 akm improve --sync                            # force sync even on strategies that disable it
 ```
 
-Strategy sync defaults: `catchup`, `consolidate`, `default`, `frequent`,
-`graph-refresh`, `memory-focus`, `quick`, and `thorough` auto-commit + push;
+Strategy sync defaults: `catchup`, `consolidate`, `default`,
+`graph-refresh`, `quick`, and `thorough` auto-commit + push;
 `proactive-maintenance` and `reflect-distill` skip sync entirely. Override
 with `--sync` / `--no-sync` flags.
 
@@ -355,7 +355,7 @@ scheduler (cron / launchd / schtasks). The file is the source of truth:
 file plus one `sync` is a complete workflow.
 
 ```sh
-akm task add nightly-improve --schedule "@daily" --command "akm improve --strategy frequent"
+akm task add nightly-improve --schedule "@daily" --command "akm improve --strategy default"
 akm task add briefing --schedule "0 9 * * *" --prompt "Draft the morning briefing"  # Inline command task
 akm task sync                                  # Reconcile task files with the OS scheduler
 akm task sync --rebind                         # Also re-pin the scheduler's akm binary/spelling

package/dist/assets/improve-strategies/catchup.json

@@ -1,15 +1,44 @@
 {
-  "description": "Manual catch-up — consolidation + triage drain with no interval minimum.",
+  "description": "Manual catch-up \u2014 consolidation plus a judged triage drain (up to 100 accepts) with no interval minimum. Auto-accepts only when improve autonomy is enabled; otherwise proposals queue for review.",
   "processes": {
-    "reflect": { "enabled": false },
-    "distill": { "enabled": false },
-    "consolidate": { "enabled": true, "allowedTypes": ["memory"], "maxChunkSize": 50, "minPoolSize": 0 },
-    "memoryInference": { "enabled": false },
-    "graphExtraction": { "enabled": false },
-    "extract": { "enabled": false },
-    "triage": { "enabled": true, "applyMode": "queue", "policy": "personal-stash", "maxAcceptsPerRun": 100 },
-    "validation": { "enabled": false },
-    "proactiveMaintenance": { "enabled": false }
+    "reflect": {
+      "enabled": false
+    },
+    "distill": {
+      "enabled": false
+    },
+    "consolidate": {
+      "enabled": true,
+      "allowedTypes": ["memory"],
+      "maxChunkSize": 50,
+      "minPoolSize": 0
+    },
+    "memoryInference": {
+      "enabled": false
+    },
+    "graphExtraction": {
+      "enabled": false
+    },
+    "extract": {
+      "enabled": false
+    },
+    "triage": {
+      "enabled": true,
+      "applyMode": "promote",
+      "policy": "personal-stash",
+      "maxAcceptsPerRun": 100,
+      "judgment": true,
+      "maxDiffLines": 200
+    },
+    "validation": {
+      "enabled": false
+    },
+    "proactiveMaintenance": {
+      "enabled": false
+    }
   },
-  "sync": { "enabled": true, "push": true }
+  "sync": {
+    "enabled": true,
+    "push": true
+  }
 }

package/dist/assets/improve-strategies/thorough.json

@@ -1,15 +1,53 @@
 {
-  "description": "Like default, plus the triage process (drains the pending-proposal backlog).",
+  "description": "Everything default runs, plus a judged triage drain of the pending-proposal backlog (up to 25 accepts per run). Auto-accepts only when improve autonomy is enabled; otherwise proposals queue for review. Identical tuning to default; improve-stage extract and proactive maintenance stay off.",
   "processes": {
     "reflect": {
       "enabled": true,
+      "limit": 25,
       "allowedTypes": ["agent", "command", "knowledge", "lesson", "memory", "skill", "workflow"]
     },
-    "distill": { "enabled": true, "allowedTypes": ["memory"] },
-    "consolidate": { "enabled": true, "allowedTypes": ["memory"] },
-    "memoryInference": { "enabled": true },
-    "graphExtraction": { "enabled": true },
-    "triage": { "enabled": true, "applyMode": "queue" }
+    "distill": {
+      "enabled": true,
+      "allowedTypes": ["memory"],
+      "requirePlannedRefs": true
+    },
+    "consolidate": {
+      "enabled": true,
+      "allowedTypes": ["memory"],
+      "minPoolSize": 500
+    },
+    "memoryInference": {
+      "enabled": true
+    },
+    "graphExtraction": {
+      "enabled": true
+    },
+    "extract": {
+      "enabled": false,
+      "triage": {
+        "enabled": true,
+        "minScore": 2
+      }
+    },
+    "validation": {
+      "enabled": true
+    },
+    "proactiveMaintenance": {
+      "enabled": false,
+      "dueDays": 30,
+      "maxPerRun": 15
+    },
+    "triage": {
+      "enabled": true,
+      "applyMode": "promote",
+      "policy": "personal-stash",
+      "maxAcceptsPerRun": 25,
+      "maxDiffLines": 200,
+      "judgment": true
+    }
   },
-  "sync": { "enabled": true, "push": true }
+  "sync": {
+    "enabled": true,
+    "push": true
+  }
 }

package/dist/assets/tasks/improve/akm-improve-frequent.yml

@@ -1,4 +1,4 @@
 version: 4
-run: akm improve --strategy frequent --skip-if-locked
-description: Frequent inference pass (hourly at :40; improve-stage extract off)
+run: akm improve --strategy reflect-distill --skip-if-locked
+description: Frequent learning pass (hourly at :40) — reflect, distill, memory inference, judged triage
 schedule: "40 * * * *"

package/dist/commands/agent/contribute-cli.js

@@ -139,6 +139,16 @@ export const lintCommand = defineCommand({
             description: "Exit non-zero when summary.flagged > 0 (CI-friendly). Default: exit 0 regardless of findings.",
             default: false,
         },
+        // #884: NOT folded into `--fix`. Every other auto-fix repairs a structural
+        // defect in the file it edits; this one DELETES an assertion the user (or
+        // the improve pipeline) made about the belief graph, and it does so in
+        // files that are themselves perfectly well-formed. That is a data decision,
+        // so it stays opt-in behind its own flag even when `--fix` is present.
+        "prune-dangling-edges": {
+            type: "boolean",
+            description: "Opt-in repair: drop supersededBy/contradictedBy entries whose target has neither a file nor a prune tombstone. Modifies memories — review the plain `akm lint` report first.",
+            default: false,
+        },
         type: {
             type: "string",
             description: "Only lint assets of this type (e.g. workflows, tasks, memories). akm bundles only — every other adapter validates the whole bundle and warns that the flag had no effect.",
@@ -151,6 +161,7 @@ export const lintCommand = defineCommand({
                 fix: args.fix === true || getHyphenatedBoolean(args, "auto-fix"),
                 dir: getStringArg(args, "dir"),
                 typeFilter: getStringArg(args, "type"),
+                pruneDanglingEdges: getHyphenatedBoolean(args, "prune-dangling-edges"),
             });
             output("lint", result);
             if (args["fail-on-flagged"] && result.summary.flagged > 0) {

package/dist/commands/env/env.js

@@ -48,28 +48,9 @@
 import fs from "node:fs";
 import path from "node:path";
 import dotenv from "dotenv";
-import { writeFileAtomic } from "../../core/common.js";
+import { scanEnvKeyNames, writeFileAtomic } from "../../core/common.js";
 import { sensitiveMarkerPath } from "./marker-path.js";
-/** Matches a KEY=value assignment line, capturing only the key. */
-const ASSIGN_RE = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/;
-/** Scan lines and return KEY names in file order, without duplicates. */
-export function scanEnvKeyNames(text) {
-    const keys = [];
-    const seen = new Set();
-    for (const line of text.split(/\r?\n/)) {
-        const m = line.match(ASSIGN_RE);
-        if (!m)
-            continue;
-        const key = m[1];
-        if (!key)
-            continue;
-        if (seen.has(key))
-            continue;
-        seen.add(key);
-        keys.push(key);
-    }
-    return keys;
-}
+export { scanEnvKeyNames };
 /**
  * Read and return ONLY non-secret metadata: key names.
  *

package/dist/commands/health/checks.js

@@ -706,29 +706,4 @@ export const HEALTH_CHECKS = [
             };
         },
     },
-    {
-        // Item 4: stale durable-transaction journals under $DATA/txn (stranded
-        // recovery state seen twice in a real 0.9 migration) had zero health
-        // visibility. `count`/`unreadable` already exclude journals younger than
-        // the sweeper's grace period (a currently-running operation), so any
-        // nonzero count here is a real leftover.
-        name: "stale-txn-journals",
-        channel: "advisory",
-        run: (ctx) => {
-            const s = ctx.staleTxnJournals;
-            const warn = s.count > 0;
-            const unreadablePart = s.unreadable > 0 ? `, ${s.unreadable} unreadable` : "";
-            const agePart = s.oldestAgeMs !== null ? `, oldest ${Math.round(s.oldestAgeMs / 60000)}m old` : "";
-            return {
-                name: "stale-txn-journals",
-                kind: "deterministic",
-                status: warn ? "warn" : "pass",
-                confidence: "high",
-                message: warn
-                    ? `${s.count} stale transaction journal(s) found under ${s.dir}${unreadablePart}${agePart} — see docs/migration/v0.9.0-troubleshooting.md for journal reconciliation steps.`
-                    : "No stale transaction journals found.",
-                evidence: { dir: s.dir, count: s.count, unreadable: s.unreadable, oldestAgeMs: s.oldestAgeMs },
-            };
-        },
-    },
 ];